mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-01-31 16:57:10 +00:00
Code Issues Releases Activity

net80211: mitigation against A-MSDU design flaw

Browse Source 
Mitigate A-MSDU injection attacks by detecting if the destination address
of a subframe equals an RFC1042 (i.e., LLC/SNAP) header, and if so
dropping the complete A-MSDU frame.  This mitigates known attacks,
although new (unknown) aggregation-based attacks may remain possible.

This defense works because in A-MSDU aggregation injection attacks, a
normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means
the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042
header. In other words, the destination MAC address of the first A-MSDU
subframe contains the start of an RFC1042 header during an aggregation
attack. We can detect this and thereby prevent this specific attack.

This relates to section 7.2 in the 2021 Usenix "FragAttacks" (Fragment
and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation)
paper.

Submitted by:	Mathy Vanhoef (Mathy.Vanhoef kuleuven.be)
Security:	CVE-2020-24588
PR:		256119
Differential Revision: https://reviews.freebsd.org/D30664
This commit is contained in:
Mathy Vanhoef 2021-06-06 22:10:52 +00:00 committed by Bjoern A. Zeeb
parent 11572d7d7f
commit f024bdf115
6 changed files with 24 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/net80211/ieee80211_adhoc.c
View File

@ -558,7 +558,7 @@ adhoc_input(struct ieee80211_node *ni, struct mbuf *m,
/*
* Finally, strip the 802.11 header.
*/
m = ieee80211_decap(vap, m, hdrspace);
m = ieee80211_decap(vap, m, hdrspace, qos);
if (m == NULL) {
/* XXX mask bit to check for both */
/* don't count Null data frames as errors */

2
sys/net80211/ieee80211_hostap.c
View File

@ -744,7 +744,7 @@ hostap_input(struct ieee80211_node *ni, struct mbuf *m,
/*
* Finally, strip the 802.11 header.
*/
m = ieee80211_decap(vap, m, hdrspace);
m = ieee80211_decap(vap, m, hdrspace, qos);
if (m == NULL) {
/* XXX mask bit to check for both */
/* don't count Null data frames as errors */

20
sys/net80211/ieee80211_input.c
View File

@ -309,7 +309,8 @@ ieee80211_deliver_data(struct ieee80211vap *vap,
}
struct mbuf *
ieee80211_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen)
ieee80211_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen,
uint8_t qos)
{
struct ieee80211_qosframe_addr4 wh;
struct ether_header *eh;
@ -331,7 +332,9 @@ ieee80211_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen)
llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
/* NB: preserve AppleTalk frames that have a native SNAP hdr */
!(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
llc->llc_snap.ether_type == htons(ETHERTYPE_IPX)) &&
/* Do not want to touch A-MSDU frames. */
!(qos & IEEE80211_QOS_AMSDU)) {
m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
llc = NULL;
} else {
@ -379,6 +382,10 @@ ieee80211_decap1(struct mbuf *m, int *framelen)
#define FF_LLC_SIZE (sizeof(struct ether_header) + sizeof(struct llc))
struct ether_header *eh;
struct llc *llc;
const uint8_t llc_hdr_mac[ETHER_ADDR_LEN] = {
/* MAC address matching the 802.2 LLC header */
LLC_SNAP_LSAP, LLC_SNAP_LSAP, LLC_UI, 0, 0, 0
};
/*
* The frame has an 802.3 header followed by an 802.2
@ -391,6 +398,15 @@ ieee80211_decap1(struct mbuf *m, int *framelen)
if (m->m_len < FF_LLC_SIZE && (m = m_pullup(m, FF_LLC_SIZE)) == NULL)
return NULL;
eh = mtod(m, struct ether_header *); /* 802.3 header is first */
/*
* Detect possible attack where a single 802.11 frame is processed
* as an A-MSDU frame due to an adversary setting the A-MSDU present
* bit in the 802.11 QoS header. [FragAttacks]
*/
if (memcmp(eh->ether_dhost, llc_hdr_mac, ETHER_ADDR_LEN) == 0)
return NULL;
llc = (struct llc *)&eh[1]; /* 802.2 header follows */
*framelen = ntohs(eh->ether_type) /* encap'd frame size */
+ sizeof(struct ether_header) - sizeof(struct llc);

3
sys/net80211/ieee80211_input.h
View File

@ -311,7 +311,8 @@ void ieee80211_deliver_data(struct ieee80211vap *,
struct mbuf *ieee80211_defrag(struct ieee80211_node *,
struct mbuf *, int, int);
struct mbuf *ieee80211_realign(struct ieee80211vap *, struct mbuf *, size_t);
struct mbuf *ieee80211_decap(struct ieee80211vap *, struct mbuf *, int);
struct mbuf *ieee80211_decap(struct ieee80211vap *, struct mbuf *, int,
uint8_t);
struct mbuf *ieee80211_decap1(struct mbuf *, int *);
int ieee80211_setup_rates(struct ieee80211_node *ni,
const uint8_t *rates, const uint8_t *xrates, int flags);

2
sys/net80211/ieee80211_sta.c
View File

@ -827,7 +827,7 @@ sta_input(struct ieee80211_node *ni, struct mbuf *m,
/*
* Finally, strip the 802.11 header.
*/
m = ieee80211_decap(vap, m, hdrspace);
m = ieee80211_decap(vap, m, hdrspace, qos);
if (m == NULL) {
/* XXX mask bit to check for both */
/* don't count Null data frames as errors */

2
sys/net80211/ieee80211_wds.c
View File

@ -621,7 +621,7 @@ wds_input(struct ieee80211_node *ni, struct mbuf *m,
/*
* Finally, strip the 802.11 header.
*/
m = ieee80211_decap(vap, m, hdrspace);
m = ieee80211_decap(vap, m, hdrspace, qos);
if (m == NULL) {
/* XXX mask bit to check for both */
/* don't count Null data frames as errors */