Kernel/iwd
3
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-10-04 10:29:03 +02:00
Code Releases Activity

mpdu: Validate association response mpdu subtype

Browse Source 
We do not currently validate the IEs that are following until the end
of the frame.
This commit is contained in:
Tomasz Bursztyka 2015-01-21 13:36:42 +02:00 committed by Denis Kenzior
parent 5c9f1db01f
commit 8353ac445d
2 changed files with 18 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/mpdu.c
View File

@ -118,6 +118,9 @@ static bool validate_mgmt_mpdu(const struct mpdu *mpdu, int len, int *offset)
case MPDU_MANAGEMENT_SUBTYPE_ASSOCIATION_REQUEST: case MPDU_MANAGEMENT_SUBTYPE_ASSOCIATION_REQUEST:
return validate_on_ies_start_position_mgmt_mpdu(mpdu, len, return validate_on_ies_start_position_mgmt_mpdu(mpdu, len,
offset, 9); offset, 9);
case MPDU_MANAGEMENT_SUBTYPE_ASSOCIATION_RESPONSE:
return validate_on_ies_start_position_mgmt_mpdu(mpdu, len,
offset, 9);
case MPDU_MANAGEMENT_SUBTYPE_ATIM: case MPDU_MANAGEMENT_SUBTYPE_ATIM:
return validate_atim_mgmt_mpdu(mpdu, len, offset); return validate_atim_mgmt_mpdu(mpdu, len, offset);
case MPDU_MANAGEMENT_SUBTYPE_DISASSOCIATION: case MPDU_MANAGEMENT_SUBTYPE_DISASSOCIATION:

10
src/mpdu.h
View File

@ -33,6 +33,7 @@ enum mpdu_type {
/* 802.11, Table 8-1 "Valid type and subtype combinations" */ /* 802.11, Table 8-1 "Valid type and subtype combinations" */
enum mpdu_management_subtype { enum mpdu_management_subtype {
MPDU_MANAGEMENT_SUBTYPE_ASSOCIATION_REQUEST = 0x0, MPDU_MANAGEMENT_SUBTYPE_ASSOCIATION_REQUEST = 0x0,
MPDU_MANAGEMENT_SUBTYPE_ASSOCIATION_RESPONSE = 0x1,
MPDU_MANAGEMENT_SUBTYPE_ATIM = 0x9, MPDU_MANAGEMENT_SUBTYPE_ATIM = 0x9,
MPDU_MANAGEMENT_SUBTYPE_DISASSOCIATION = 0xA, MPDU_MANAGEMENT_SUBTYPE_DISASSOCIATION = 0xA,
MPDU_MANAGEMENT_SUBTYPE_AUTHENTICATION = 0xB, MPDU_MANAGEMENT_SUBTYPE_AUTHENTICATION = 0xB,
@ -146,6 +147,14 @@ struct mpdu_association_request {
uint8_t ies[0]; uint8_t ies[0];
} __attribute__ ((packed)); } __attribute__ ((packed));
/* 802.11, Section 8.3.3.6 */
struct mpdu_association_response {
struct mpdu_field_capability capability;
__le16 status_code;
__le16 aid;
uint8_t ies[0];
} __attribute__ ((packed));
/* 802.11, Section 8.3.3.4 */ /* 802.11, Section 8.3.3.4 */
struct mpdu_disassociation { struct mpdu_disassociation {
__le16 reason_code; __le16 reason_code;
@ -179,6 +188,7 @@ struct mpdu {
struct mpdu_mgmt_header mgmt_hdr; struct mpdu_mgmt_header mgmt_hdr;
union { union {
struct mpdu_association_request assoc_req; struct mpdu_association_request assoc_req;
struct mpdu_association_response assoc_resp;
struct mpdu_disassociation disassoc; struct mpdu_disassociation disassoc;
struct mpdu_authentication auth; struct mpdu_authentication auth;
struct mpdu_deauthentication deauth; struct mpdu_deauthentication deauth;