/* * * Wireless daemon for Linux * * Copyright (C) 2014-2019 Intel Corporation. All rights reserved. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this library; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA * */ #ifdef HAVE_CONFIG_H #include #endif #include #include #include #include "src/ie.h" #include "src/mpdu.h" /* 802.11-2020 section 9.3.3.5 */ static const enum ie_type association_request_ie_order[] = { IE_TYPE_SSID, IE_TYPE_SUPPORTED_RATES, IE_TYPE_EXTENDED_SUPPORTED_RATES, IE_TYPE_POWER_CAPABILITY, IE_TYPE_SUPPORTED_CHANNELS, IE_TYPE_RSN, IE_TYPE_QOS_CAPABILITY, IE_TYPE_RM_ENABLED_CAPABILITIES, IE_TYPE_MOBILITY_DOMAIN, IE_TYPE_SUPPORTED_OPERATING_CLASSES, IE_TYPE_HT_CAPABILITIES, IE_TYPE_BSS_COEXISTENCE, IE_TYPE_EXTENDED_CAPABILITIES, IE_TYPE_QOS_TRAFFIC_CAPABILITY, IE_TYPE_TIM_BROADCAST_REQUEST, IE_TYPE_INTERWORKING, IE_TYPE_MULTIBAND, IE_TYPE_DMG_CAPABILITIES, IE_TYPE_MULTIPLE_MAC_SUBLAYERS, IE_TYPE_VHT_CAPABILITIES, IE_TYPE_OPERATING_MODE_NOTIFICATION, IE_TYPE_FILS_SESSION, IE_TYPE_FILS_PUBLIC_KEY, IE_TYPE_FILS_KEY_CONFIRMATION, IE_TYPE_FILS_HLP_CONTAINER, IE_TYPE_FILS_IP_ADDRESS, IE_TYPE_TWT, IE_TYPE_AID_REQUEST, IE_TYPE_S1G_CAPABILITIES, IE_TYPE_EL_OPERATION, IE_TYPE_S1G_RELAY, IE_TYPE_BSS_MAX_IDLE_PERIOD, IE_TYPE_HEADER_COMPRESSION, IE_TYPE_MAD, IE_TYPE_REACHABLE_ADDRESS, IE_TYPE_S1G_RELAY_ACTIVATION, IE_TYPE_CDMG_CAPABILITIES, IE_TYPE_CMMG_CAPABILITIES, IE_TYPE_GLK_GCR_PARAMETER_SET, IE_TYPE_FAST_BSS_TRANSITION, IE_TYPE_RSNX, IE_TYPE_SUPPLEMENTAL_CLASS_2_CAPABILITIES, IE_TYPE_MSCS_DESCRIPTOR, IE_TYPE_VENDOR_SPECIFIC, }; /* 802.11-2020 section 9.3.3.6 */ static const enum ie_type association_response_ie_order[] = { IE_TYPE_AID, IE_TYPE_SUPPORTED_RATES, IE_TYPE_EXTENDED_SUPPORTED_RATES, IE_TYPE_EDCA_PARAMETER_SET, IE_TYPE_RCPI, IE_TYPE_RSNI, IE_TYPE_RM_ENABLED_CAPABILITIES, IE_TYPE_RSN, IE_TYPE_MOBILITY_DOMAIN, IE_TYPE_FAST_BSS_TRANSITION, IE_TYPE_DSE_REGISTERED_LOCATION, IE_TYPE_TIMEOUT_INTERVAL, IE_TYPE_HT_CAPABILITIES, IE_TYPE_HT_OPERATION, IE_TYPE_BSS_COEXISTENCE, IE_TYPE_OVERLAPPING_BSS_SCAN_PARAMETERS, IE_TYPE_EXTENDED_CAPABILITIES, IE_TYPE_BSS_MAX_IDLE_PERIOD, IE_TYPE_TIM_BROADCAST_RESPONSE, IE_TYPE_QOS_MAP_SET, IE_TYPE_QMF_POLICY, IE_TYPE_MULTIBAND, IE_TYPE_DMG_CAPABILITIES, IE_TYPE_DMG_OPERATION, IE_TYPE_MULTIPLE_MAC_SUBLAYERS, IE_TYPE_NEIGHBOR_REPORT, IE_TYPE_VHT_CAPABILITIES, IE_TYPE_VHT_OPERATION, IE_TYPE_OPERATING_MODE_NOTIFICATION, IE_TYPE_FUTURE_CHANNEL_GUIDANCE, IE_TYPE_FILS_SESSION, IE_TYPE_FILS_PUBLIC_KEY, IE_TYPE_FILS_KEY_CONFIRMATION, IE_TYPE_FILS_HLP_CONTAINER, IE_TYPE_FILS_IP_ADDRESS, IE_TYPE_KEY_DELIVERY, IE_TYPE_S1G_SECTOR_OPERATION, IE_TYPE_TWT, IE_TYPE_TSF_TIMER_ACCURACY, IE_TYPE_S1G_CAPABILITIES, IE_TYPE_S1G_OPERATION, IE_TYPE_AID_RESPONSE, IE_TYPE_SECTORIZED_GROUP_ID_LIST, IE_TYPE_S1G_RELAY, IE_TYPE_HEADER_COMPRESSION, IE_TYPE_SST_OPERATION, IE_TYPE_MAD, IE_TYPE_S1G_RELAY_ACTIVATION, IE_TYPE_CDMG_CAPABILITIES, IE_TYPE_CMMG_CAPABILITIES, IE_TYPE_CMMG_OPERATION, IE_TYPE_GLK_GCR_PARAMETER_SET, IE_TYPE_RSNX, IE_TYPE_MSCS_DESCRIPTOR, IE_TYPE_VENDOR_SPECIFIC, }; /* 802.11-2020 section 9.3.3.7 */ static const enum ie_type reassociation_request_ie_order[] = { IE_TYPE_SSID, IE_TYPE_SUPPORTED_RATES, IE_TYPE_EXTENDED_SUPPORTED_RATES, IE_TYPE_POWER_CAPABILITY, IE_TYPE_SUPPORTED_CHANNELS, IE_TYPE_RSN, IE_TYPE_QOS_CAPABILITY, IE_TYPE_RM_ENABLED_CAPABILITIES, IE_TYPE_MOBILITY_DOMAIN, IE_TYPE_FAST_BSS_TRANSITION, IE_TYPE_RIC_DATA, IE_TYPE_SUPPORTED_OPERATING_CLASSES, IE_TYPE_HT_CAPABILITIES, IE_TYPE_BSS_COEXISTENCE, IE_TYPE_EXTENDED_CAPABILITIES, IE_TYPE_QOS_TRAFFIC_CAPABILITY, IE_TYPE_TIM_BROADCAST_REQUEST, IE_TYPE_FMS_REQUEST, IE_TYPE_DMS_REQUEST, IE_TYPE_INTERWORKING, IE_TYPE_MULTIBAND, IE_TYPE_DMG_CAPABILITIES, IE_TYPE_MULTIPLE_MAC_SUBLAYERS, IE_TYPE_VHT_CAPABILITIES, IE_TYPE_OPERATING_MODE_NOTIFICATION, IE_TYPE_FILS_SESSION, IE_TYPE_FILS_PUBLIC_KEY, IE_TYPE_FILS_KEY_CONFIRMATION, IE_TYPE_FILS_HLP_CONTAINER, IE_TYPE_FILS_IP_ADDRESS, IE_TYPE_TWT, IE_TYPE_AID_REQUEST, IE_TYPE_S1G_CAPABILITIES, IE_TYPE_EL_OPERATION, IE_TYPE_BSS_MAX_IDLE_PERIOD, IE_TYPE_S1G_RELAY, IE_TYPE_HEADER_COMPRESSION, IE_TYPE_MAD, IE_TYPE_REACHABLE_ADDRESS, IE_TYPE_S1G_RELAY_ACTIVATION, IE_TYPE_CDMG_CAPABILITIES, IE_TYPE_CMMG_CAPABILITIES, IE_TYPE_OCI, IE_TYPE_GLK_GCR_PARAMETER_SET, IE_TYPE_RSNX, IE_TYPE_SUPPLEMENTAL_CLASS_2_CAPABILITIES, IE_TYPE_MSCS_DESCRIPTOR, IE_TYPE_VENDOR_SPECIFIC, }; /* 802.11-2020 section 9.3.3.8 */ static const enum ie_type reassociation_response_ie_order[] = { IE_TYPE_AID, IE_TYPE_SUPPORTED_RATES, IE_TYPE_EXTENDED_SUPPORTED_RATES, IE_TYPE_EDCA_PARAMETER_SET, IE_TYPE_RCPI, IE_TYPE_RSNI, IE_TYPE_RM_ENABLED_CAPABILITIES, IE_TYPE_RSN, IE_TYPE_MOBILITY_DOMAIN, IE_TYPE_FAST_BSS_TRANSITION, IE_TYPE_RIC_DATA, IE_TYPE_DSE_REGISTERED_LOCATION, IE_TYPE_TIMEOUT_INTERVAL, IE_TYPE_HT_CAPABILITIES, IE_TYPE_HT_OPERATION, IE_TYPE_BSS_COEXISTENCE, IE_TYPE_OVERLAPPING_BSS_SCAN_PARAMETERS, IE_TYPE_EXTENDED_CAPABILITIES, IE_TYPE_BSS_MAX_IDLE_PERIOD, IE_TYPE_TIM_BROADCAST_RESPONSE, IE_TYPE_FMS_RESPONSE, IE_TYPE_DMS_RESPONSE, IE_TYPE_QOS_MAP_SET, IE_TYPE_QMF_POLICY, IE_TYPE_MULTIBAND, IE_TYPE_DMG_CAPABILITIES, IE_TYPE_DMG_OPERATION, IE_TYPE_MULTIPLE_MAC_SUBLAYERS, IE_TYPE_NEIGHBOR_REPORT, IE_TYPE_VHT_CAPABILITIES, IE_TYPE_VHT_OPERATION, IE_TYPE_OPERATING_MODE_NOTIFICATION, IE_TYPE_FUTURE_CHANNEL_GUIDANCE, IE_TYPE_FILS_SESSION, IE_TYPE_FILS_PUBLIC_KEY, IE_TYPE_FILS_KEY_CONFIRMATION, IE_TYPE_FILS_HLP_CONTAINER, IE_TYPE_FILS_IP_ADDRESS, IE_TYPE_KEY_DELIVERY, IE_TYPE_S1G_SECTOR_OPERATION, IE_TYPE_TWT, IE_TYPE_TSF_TIMER_ACCURACY, IE_TYPE_S1G_CAPABILITIES, IE_TYPE_S1G_OPERATION, IE_TYPE_AID_RESPONSE, IE_TYPE_SECTORIZED_GROUP_ID_LIST, IE_TYPE_S1G_RELAY, IE_TYPE_HEADER_COMPRESSION, IE_TYPE_SST_OPERATION, IE_TYPE_MAD, IE_TYPE_S1G_RELAY_ACTIVATION, IE_TYPE_CDMG_CAPABILITIES, IE_TYPE_CMMG_CAPABILITIES, IE_TYPE_CMMG_OPERATION, IE_TYPE_OCI, IE_TYPE_GLK_GCR_PARAMETER_SET, IE_TYPE_RSNX, IE_TYPE_MSCS_DESCRIPTOR, IE_TYPE_VENDOR_SPECIFIC, }; /* 802.11-2020 section 9.3.3.9 */ static const enum ie_type probe_request_ie_order[] = { IE_TYPE_SSID, IE_TYPE_SUPPORTED_RATES, IE_TYPE_REQUEST, IE_TYPE_EXTENDED_SUPPORTED_RATES, IE_TYPE_DSSS_PARAMETER_SET, IE_TYPE_SUPPORTED_OPERATING_CLASSES, IE_TYPE_HT_CAPABILITIES, IE_TYPE_BSS_COEXISTENCE, IE_TYPE_EXTENDED_CAPABILITIES, IE_TYPE_SSID_LIST, IE_TYPE_CHANNEL_USAGE, IE_TYPE_INTERWORKING, IE_TYPE_MESH_ID, IE_TYPE_MULTIBAND, IE_TYPE_DMG_CAPABILITIES, IE_TYPE_MULTIPLE_MAC_SUBLAYERS, IE_TYPE_VHT_CAPABILITIES, IE_TYPE_ESTIMATED_SERVICE_PARAMETERS, IE_TYPE_EXTENDED_REQUEST, IE_TYPE_FILS_REQUEST_PARAMETERS, IE_TYPE_AP_CSN, IE_TYPE_CHANGE_SEQUENCE, IE_TYPE_S1G_RELAY_DISCOVERY, IE_TYPE_PV1_PROBE_RESPONSE_OPTION, IE_TYPE_S1G_CAPABILITIES, IE_TYPE_EL_OPERATION, IE_TYPE_MAD, IE_TYPE_VENDOR_SPECIFIC_REQUEST, IE_TYPE_CDMG_CAPABILITIES, IE_TYPE_CLUSTER_PROBE, IE_TYPE_CMMG_CAPABILITIES, IE_TYPE_ESTIMATED_SERVICE_PARAMETERS_OUT, IE_TYPE_SUPPLEMENTAL_CLASS_2_CAPABILITIES, IE_TYPE_VENDOR_SPECIFIC, }; static bool validate_mgmt_header(const struct mmpdu_header *mpdu, int len, int *offset) { /* Duration + Address1 + Address 2 + Address 3 + SeqCntrl */ if (len < *offset + 22) return false; *offset += 22; if (!mpdu->fc.order) return true; if (len < *offset + 4) return false; *offset += 4; return true; } /* 802.11-2016 13.11.2 */ static bool skip_resource_req_resp(struct ie_tlv_iter *iter) { struct ie_tlv_iter tmp; /* * This is called when we've seen an RDE so we only need to validate * and skip IEs representing one or more Resource Descriptors up to * the end of this Resource Request or Resource Response. * * Since the Resource Descriptor specification is complex and, * especially in the case of a Vendor Specific descriptor and * in the case of a Resource Response to a failed request (with * the optional information), there seems to be no strict definition * of where one request/response ends and the next begins, allow * any combination of any of the IEs listed in 13.11.2 until an * IE that doesn't seem to be part of this RDE. */ memcpy(&tmp, iter, sizeof(tmp)); while (ie_tlv_iter_next(&tmp)) { switch (ie_tlv_iter_get_tag(&tmp)) { case IE_TYPE_TSPEC: case IE_TYPE_TCLAS: case IE_TYPE_TCLAS_PROCESSING: case IE_TYPE_EXPEDITED_BANDWIDTH_REQUEST: case IE_TYPE_SCHEDULE: case IE_TYPE_TS_DELAY: case IE_TYPE_RIC_DESCRIPTOR: case IE_TYPE_VENDOR_SPECIFIC: memcpy(iter, &tmp, sizeof(tmp)); continue; default: break; } break; } return true; } static bool validate_mgmt_ies(const uint8_t *ies, size_t ies_len, const enum ie_type tag_order[], int tag_count) { struct ie_tlv_iter iter; enum ie_type tag; ie_tlv_iter_init(&iter, ies, ies_len); while (ie_tlv_iter_next(&iter)) { int i = 0; tag = ie_tlv_iter_get_tag(&iter); /* Check that the tag is part of the valid set */ while (i < tag_count && tag_order[i] != tag) i += 1; /* * 802.11-2016 section 9.3.3.2: * "All fields and elements are mandatory unless stated * otherwise and appear in the specified, relative order. * STAs that encounter an element ID they do not recognize * in the frame body of a received Management frame ignore * that element and continue to parse the remainder of the * management frame body (if any) for additional elements * with recognizable element IDs." */ if (i == tag_count) continue; /* Tag found, make sure no duplicates present unless allowed */ if (tag != IE_TYPE_VENDOR_SPECIFIC && tag != IE_TYPE_RIC_DATA && tag != IE_TYPE_TRANSMIT_POWER_ENVELOPE && tag != IE_TYPE_MCCAOP_ADVERTISEMENT && tag != IE_TYPE_EMERGENCY_ALERT_IDENTIFIER && tag != IE_TYPE_MULTIPLE_BSSID && tag != IE_TYPE_NEIGHBOR_REPORT && tag != IE_TYPE_QUIET_CHANNEL && tag != IE_TYPE_FILS_HLP_CONTAINER) { struct ie_tlv_iter clone; memcpy(&clone, &iter, sizeof(clone)); /* * Some APs send completely identical duplicate IEs: * Since these are harmless (and ignored by us) we're * going to allow them here for interoperability. */ while (ie_tlv_iter_next(&clone)) { if (ie_tlv_iter_get_tag(&clone) != tag) continue; else if (ie_tlv_iter_data_eq(&iter, &clone)) continue; return false; } } if (tag == IE_TYPE_RIC_DATA && !skip_resource_req_resp(&iter)) return false; } return true; } static bool validate_association_request_mmpdu(const struct mmpdu_header *mpdu, int len, int *offset) { const struct mmpdu_association_request *body = (const void *) mpdu + *offset; if (len < *offset + (int) sizeof(struct mmpdu_association_request)) return false; *offset += sizeof(struct mmpdu_association_request); return validate_mgmt_ies(body->ies, len - *offset, association_request_ie_order, L_ARRAY_SIZE(association_request_ie_order)); } static bool validate_association_response_mmpdu(const struct mmpdu_header *mpdu, int len, int *offset) { const struct mmpdu_association_response *body = (const void *) mpdu + *offset; if (len < *offset + (int) sizeof(struct mmpdu_association_response)) return false; *offset += sizeof(struct mmpdu_association_response); return validate_mgmt_ies(body->ies, len - *offset, association_response_ie_order, L_ARRAY_SIZE(association_response_ie_order)); } static bool validate_reassociation_request_mmpdu( const struct mmpdu_header *mpdu, int len, int *offset) { const struct mmpdu_reassociation_request *body = (const void *) mpdu + *offset; if (len < *offset + (int) sizeof(struct mmpdu_reassociation_request)) return false; *offset += sizeof(struct mmpdu_reassociation_request); return validate_mgmt_ies(body->ies, len - *offset, reassociation_request_ie_order, L_ARRAY_SIZE(reassociation_request_ie_order)); } static bool validate_reassociation_response_mmpdu( const struct mmpdu_header *mpdu, int len, int *offset) { const struct mmpdu_reassociation_response *body = (const void *) mpdu + *offset; if (len < *offset + (int) sizeof(struct mmpdu_reassociation_response)) return false; *offset += sizeof(struct mmpdu_reassociation_response); return validate_mgmt_ies(body->ies, len - *offset, reassociation_response_ie_order, L_ARRAY_SIZE(reassociation_response_ie_order)); } static bool validate_probe_request_mmpdu(const struct mmpdu_header *mpdu, int len, int *offset) { const struct mmpdu_probe_request *body = (const void *) mpdu + *offset; if (len < *offset + (int) sizeof(struct mmpdu_probe_request)) return false; *offset += sizeof(struct mmpdu_probe_request); return validate_mgmt_ies(body->ies, len - *offset, probe_request_ie_order, L_ARRAY_SIZE(probe_request_ie_order)); } /* 802.11-2016 section 9.3.3.11 */ static bool validate_probe_response_mmpdu(const struct mmpdu_header *mpdu, int len, int *offset) { /* * If this is a response to a frame that could have contained a * Request or an Extended Request element, then, after all of the * "Elements that would have been included even in the absence of * the Request element or Extended Request element" (802.11-2016 * section 11.1.4.3.5) basically any Element ID may appear with the * only requirement being an ascending order of the numerical values * of the IDs. * * Given the above, and the fact that nobody on the planet seems * to order IEs properly inside the Management frames, we simply skip * any checking here and return true. */ return true; } /* 802.11-2020 section 9.3.3.15 */ static bool validate_timing_advertisement_mmpdu(const struct mmpdu_header *mpdu, int len, int *offset) { const struct mmpdu_timing_advertisement *body = (const void *) mpdu + *offset; static const enum ie_type ie_order[] = { IE_TYPE_COUNTRY, IE_TYPE_POWER_CONSTRAINT, IE_TYPE_TIME_ADVERTISEMENT, IE_TYPE_EXTENDED_CAPABILITIES, IE_TYPE_VENDOR_SPECIFIC, }; if (len < *offset + (int) sizeof(struct mmpdu_timing_advertisement)) return false; *offset += sizeof(struct mmpdu_timing_advertisement); return validate_mgmt_ies(body->ies, len - *offset, ie_order, L_ARRAY_SIZE(ie_order)); } /* 802.11-2020 section 9.3.3.2 */ static bool validate_beacon_mmpdu(const struct mmpdu_header *mpdu, int len, int *offset) { const struct mmpdu_beacon *body = (const void *) mpdu + *offset; static const enum ie_type ie_order[] = { IE_TYPE_SSID, IE_TYPE_SUPPORTED_RATES, IE_TYPE_DSSS_PARAMETER_SET, IE_TYPE_CF_PARAMETER_SET, IE_TYPE_IBSS_PARAMETER_SET, IE_TYPE_TIM, IE_TYPE_COUNTRY, IE_TYPE_POWER_CONSTRAINT, IE_TYPE_CHANNEL_SWITCH_ANNOUNCEMENT, IE_TYPE_QUIET, IE_TYPE_IBSS_DFS, IE_TYPE_TPC_REPORT, IE_TYPE_ERP, IE_TYPE_EXTENDED_SUPPORTED_RATES, IE_TYPE_RSN, IE_TYPE_BSS_LOAD, IE_TYPE_EDCA_PARAMETER_SET, IE_TYPE_QOS_CAPABILITY, IE_TYPE_AP_CHANNEL_REPORT, IE_TYPE_BSS_AVERAGE_ACCESS_DELAY, IE_TYPE_ANTENNA, IE_TYPE_BSS_AVAILABLE_ADMISSION_CAPACITY, IE_TYPE_BSS_AC_ACCESS_DELAY, IE_TYPE_MEASUREMENT_PILOT_TRANSMISSION, IE_TYPE_MULTIPLE_BSSID, IE_TYPE_RM_ENABLED_CAPABILITIES, IE_TYPE_MOBILITY_DOMAIN, IE_TYPE_DSE_REGISTERED_LOCATION, IE_TYPE_EXTENDED_CHANNEL_SWITCH_ANNOUNCEMENT, IE_TYPE_SUPPORTED_OPERATING_CLASSES, IE_TYPE_HT_CAPABILITIES, IE_TYPE_HT_OPERATION, IE_TYPE_BSS_COEXISTENCE, IE_TYPE_OVERLAPPING_BSS_SCAN_PARAMETERS, IE_TYPE_EXTENDED_CAPABILITIES, IE_TYPE_FMS_DESCRIPTOR, IE_TYPE_QOS_TRAFFIC_CAPABILITY, IE_TYPE_TIME_ADVERTISEMENT, IE_TYPE_INTERWORKING, IE_TYPE_ADVERTISEMENT_PROTOCOL, IE_TYPE_ROAMING_CONSORTIUM, IE_TYPE_EMERGENCY_ALERT_IDENTIFIER, IE_TYPE_MESH_ID, IE_TYPE_MESH_CONFIGURATION, IE_TYPE_MESH_AWAKE_WINDOW, IE_TYPE_BEACON_TIMING, IE_TYPE_MCCAOP_ADVERTISEMENT_OVERVIEW, IE_TYPE_MCCAOP_ADVERTISEMENT, IE_TYPE_MESH_CHANNEL_SWITCH_PARAMETERS, IE_TYPE_QMF_POLICY, IE_TYPE_QLOAD_REPORT, IE_TYPE_HCCA_TXOP_UPDATE_COUNT, IE_TYPE_MULTIBAND, IE_TYPE_VHT_CAPABILITIES, IE_TYPE_VHT_OPERATION, IE_TYPE_TRANSMIT_POWER_ENVELOPE, IE_TYPE_CHANNEL_SWITCH_WRAPPER, IE_TYPE_EXTENDED_BSS_LOAD, IE_TYPE_QUIET_CHANNEL, IE_TYPE_OPERATING_MODE_NOTIFICATION, IE_TYPE_REDUCED_NEIGHBOR_REPORT, IE_TYPE_TVHT_OPERATION, IE_TYPE_ESTIMATED_SERVICE_PARAMETERS, IE_TYPE_FUTURE_CHANNEL_GUIDANCE, IE_TYPE_CAG_NUMBER, IE_TYPE_FILS_INDICATION, IE_TYPE_AP_CSN, IE_TYPE_DILS, IE_TYPE_MAX_CHANNEL_SWITCH_TIME, IE_TYPE_ESTIMATED_SERVICE_PARAMETERS_OUT, IE_TYPE_SERVICE_HINT, IE_TYPE_SERVICE_HASH, IE_TYPE_RSNX, IE_TYPE_VENDOR_SPECIFIC, }; if (len < *offset + (int) sizeof(struct mmpdu_beacon)) return false; *offset += sizeof(struct mmpdu_beacon); return validate_mgmt_ies(body->ies, len - *offset, ie_order, L_ARRAY_SIZE(ie_order)); } static bool validate_atim_mmpdu(const struct mmpdu_header *mpdu, int len, int *offset) { return *offset == len; } static bool validate_disassociation_mmpdu(const struct mmpdu_header *mpdu, int len, int *offset) { *offset += 2; return *offset <= len; } static bool validate_authentication_mmpdu(const struct mmpdu_header *mpdu, int len, int *offset) { uint16_t transaction_sequence; const struct mmpdu_authentication *body = (const void *) mpdu + *offset; static const enum ie_type ie_order_shared_key[] = { IE_TYPE_CHALLENGE_TEXT, IE_TYPE_MULTIBAND, IE_TYPE_VENDOR_SPECIFIC, }; static const enum ie_type ie_order_ft[] = { IE_TYPE_RSN, IE_TYPE_MOBILITY_DOMAIN, IE_TYPE_FAST_BSS_TRANSITION, IE_TYPE_TIMEOUT_INTERVAL, IE_TYPE_RIC_DATA, IE_TYPE_FAST_BSS_TRANSITION, IE_TYPE_MULTIBAND, IE_TYPE_VENDOR_SPECIFIC, }; static const enum ie_type ie_order_error[] = { IE_TYPE_NEIGHBOR_REPORT, IE_TYPE_VENDOR_SPECIFIC, }; static const enum ie_type ie_order_fils[] = { IE_TYPE_FILS_SESSION, IE_TYPE_FILS_WRAPPED_DATA, }; if (len < *offset + 6) return false; *offset += 6; if (L_LE16_TO_CPU(L_LE16_TO_CPU(body->status)) != 0) return validate_mgmt_ies(body->ies, len - *offset, ie_order_error, L_ARRAY_SIZE(ie_order_error)); switch (L_LE16_TO_CPU(body->algorithm)) { case MMPDU_AUTH_ALGO_OPEN_SYSTEM: return *offset <= len; case MMPDU_AUTH_ALGO_SHARED_KEY: transaction_sequence = L_LE16_TO_CPU(body->transaction_sequence); if (transaction_sequence < 2 || transaction_sequence > 3) return *offset <= len; return validate_mgmt_ies(body->ies, len - *offset, ie_order_shared_key, L_ARRAY_SIZE(ie_order_shared_key)); case MMPDU_AUTH_ALGO_FT: return validate_mgmt_ies(body->ies, len - *offset, ie_order_ft, L_ARRAY_SIZE(ie_order_ft)); case MMPDU_AUTH_ALGO_SAE: return *offset <= len; case MMPDU_AUTH_ALGO_FILS_SK: case MMPDU_AUTH_ALGO_FILS_SK_PFS: return validate_mgmt_ies(body->ies, len - *offset, ie_order_fils, L_ARRAY_SIZE(ie_order_fils)); default: return false; } return false; } static bool validate_deauthentication_mmpdu(const struct mmpdu_header *mpdu, int len, int *offset) { *offset += 2; return *offset <= len; } static bool validate_mgmt_mpdu(const struct mmpdu_header *mpdu, int len, int *offset) { if (!validate_mgmt_header(mpdu, len, offset)) return false; switch (mpdu->fc.subtype) { case MPDU_MANAGEMENT_SUBTYPE_ASSOCIATION_REQUEST: return validate_association_request_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_ASSOCIATION_RESPONSE: return validate_association_response_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_REASSOCIATION_REQUEST: return validate_reassociation_request_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_REASSOCIATION_RESPONSE: return validate_reassociation_response_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_PROBE_REQUEST: return validate_probe_request_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_PROBE_RESPONSE: return validate_probe_response_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_TIMING_ADVERTISEMENT: return validate_timing_advertisement_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_BEACON: return validate_beacon_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_ATIM: return validate_atim_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_DISASSOCIATION: return validate_disassociation_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_AUTHENTICATION: return validate_authentication_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_DEAUTHENTICATION: return validate_deauthentication_mmpdu(mpdu, len, offset); case MPDU_MANAGEMENT_SUBTYPE_ACTION: case MPDU_MANAGEMENT_SUBTYPE_ACTION_NO_ACK: return *offset + 1 <= len; default: return false; } return true; } const struct mmpdu_header *mpdu_validate(const uint8_t *frame, int len) { const struct mpdu_fc *fc; const struct mmpdu_header *mmpdu; int offset; if (!frame) return NULL; if (len < 2) return NULL; offset = 2; fc = (const struct mpdu_fc *) frame; switch (fc->type) { case MPDU_TYPE_MANAGEMENT: mmpdu = (const struct mmpdu_header *) frame; if (validate_mgmt_mpdu(mmpdu, len, &offset)) return mmpdu; return NULL; default: return NULL; } } size_t mmpdu_header_len(const struct mmpdu_header *mmpdu) { return mmpdu->fc.order == 0 ? 24 : 28; } const void *mmpdu_body(const struct mmpdu_header *mmpdu) { return ((const uint8_t *) mmpdu + mmpdu_header_len(mmpdu)); } struct ie_sort_info { const enum ie_type *ie_order; size_t n_elem; }; static struct ie_sort_info sortinfo; static unsigned int ie_order_find(const struct iovec *iov) { const uint8_t *ie = iov->iov_base; enum ie_type type = ie[0]; unsigned int i; if (ie[0] == IE_TYPE_EXTENSION) type = 256 + ie[2]; for (i = 0; i < sortinfo.n_elem; i++) { if (sortinfo.ie_order[i] != type) continue; return i; } return UINT_MAX; } static int ie_order_compare(const void *a, const void *b) { const struct iovec *iova = a; const struct iovec *iovb = b; unsigned int ia = ie_order_find(iova); unsigned int ib = ie_order_find(iovb); if (ia < ib) return -1; if (ia > ib) return 1; return 0; } int mpdu_sort_ies(enum mpdu_management_subtype type, struct iovec *iov, size_t n_iovs) { switch (type) { case MPDU_MANAGEMENT_SUBTYPE_ASSOCIATION_REQUEST: sortinfo.ie_order = association_request_ie_order; sortinfo.n_elem = L_ARRAY_SIZE(association_request_ie_order); break; case MPDU_MANAGEMENT_SUBTYPE_ASSOCIATION_RESPONSE: sortinfo.ie_order = association_response_ie_order; sortinfo.n_elem = L_ARRAY_SIZE(association_response_ie_order); break; case MPDU_MANAGEMENT_SUBTYPE_REASSOCIATION_REQUEST: sortinfo.ie_order = reassociation_request_ie_order; sortinfo.n_elem = L_ARRAY_SIZE(reassociation_request_ie_order); break; case MPDU_MANAGEMENT_SUBTYPE_REASSOCIATION_RESPONSE: sortinfo.ie_order = reassociation_response_ie_order; sortinfo.n_elem = L_ARRAY_SIZE(reassociation_response_ie_order); break; case MPDU_MANAGEMENT_SUBTYPE_PROBE_REQUEST: sortinfo.ie_order = probe_request_ie_order; sortinfo.n_elem = L_ARRAY_SIZE(probe_request_ie_order); break; default: return -ENOTSUP; } /* * qsort_r would be better, but it is still missing on some non-glibc * implementations, and since iwd is not multi-threaded, qsort is * just as good */ qsort(iov, n_iovs, sizeof(struct iovec), ie_order_compare); return 0; }