mt76: use a separate CCMP PN receive counter for management frames

When received frame is decryped by hardware, CCMP PN is checked by
mt76.

When management frame protection (IEEE 802.11w) is used, we must use
a separate counter for tracking received CCMP packet number for the
management frames. The previously used counter was shared with data
frames and that can cause problems in detecting replays incorrectly
for robust management frames.

Add a new counter just for robust management frames to avoid this
issue.

Signed-off-by: Xing Song <xing.song@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 831717d9638c3148f0cbb78b4c7b94607e9bb2ea..5a6608f36ebc3a72463520876cb8cce260a53eac 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -902,10 +902,17 @@ void mt76_wcid_key_setup(struct mt76_dev *dev, struct mt76_wcid *wcid,
                return;
 
        wcid->rx_check_pn = true;
+
+       /* data frame */
        for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
                ieee80211_get_key_rx_seq(key, i, &seq);
                memcpy(wcid->rx_key_pn[i], seq.ccmp.pn, sizeof(seq.ccmp.pn));
        }
+
+       /* robust management frame */
+       ieee80211_get_key_rx_seq(key, -1, &seq);
+       memcpy(wcid->rx_key_pn[i], seq.ccmp.pn, sizeof(seq.ccmp.pn));
+
 }
 EXPORT_SYMBOL(mt76_wcid_key_setup);
 
@@ -958,7 +965,7 @@ mt76_check_ccmp_pn(struct sk_buff *skb)
        struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
        struct mt76_wcid *wcid = status->wcid;
        struct ieee80211_hdr *hdr;
-       u8 tidno = status->qos_ctl & IEEE80211_QOS_CTL_TID_MASK;
+       int security_idx;
        int ret;
 
        if (!(status->flag & RX_FLAG_DECRYPTED))
@@ -967,24 +974,36 @@ mt76_check_ccmp_pn(struct sk_buff *skb)
        if (!wcid || !wcid->rx_check_pn)
                return 0;
 
+       hdr = mt76_skb_get_hdr(skb);
        if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
                /*
                 * Validate the first fragment both here and in mac80211
                 * All further fragments will be validated by mac80211 only.
                 */
-               hdr = mt76_skb_get_hdr(skb);
                if (ieee80211_is_frag(hdr) &&
                    !ieee80211_is_first_frag(hdr->frame_control))
                        return 0;
        }
 
+       /* IEEE 802.11-2020, 12.5.3.4.4 "PN and replay detection" c):
+        *
+        * the recipient shall maintain a single replay counter for received
+        * individually addressed robust Management frames that are received
+        * with the To DS subfield equal to 0, [...]
+        */
+       if (ieee80211_is_mgmt(hdr->frame_control) &&
+           !ieee80211_has_tods(hdr->frame_control))
+               security_idx = IEEE80211_NUM_TIDS;
+       else
+               security_idx = status->qos_ctl & IEEE80211_QOS_CTL_TID_MASK;
+
        BUILD_BUG_ON(sizeof(status->iv) != sizeof(wcid->rx_key_pn[0]));
-       ret = memcmp(status->iv, wcid->rx_key_pn[tidno],
+       ret = memcmp(status->iv, wcid->rx_key_pn[security_idx],
                     sizeof(status->iv));
        if (ret <= 0)
                return -EINVAL; /* replay */
 
-       memcpy(wcid->rx_key_pn[tidno], status->iv, sizeof(status->iv));
+       memcpy(wcid->rx_key_pn[security_idx], status->iv, sizeof(status->iv));
 
        if (status->flag & RX_FLAG_IV_STRIPPED)
                status->flag |= RX_FLAG_PN_VALIDATED;

diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 520fd162d40618dd10b40e2a96771a5d5d1f2234..4c20b128466df1153e718dc0efd1e85252996421 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -255,7 +255,7 @@ struct mt76_wcid {
        u8 amsdu:1;
 
        u8 rx_check_pn;
-       u8 rx_key_pn[IEEE80211_NUM_TIDS][6];
+       u8 rx_key_pn[IEEE80211_NUM_TIDS + 1][6];
        u16 cipher;
 
        u32 tx_info;