Commit 37720569 authored by Jouni Malinen's avatar Jouni Malinen Committed by Johannes Berg

cfg80211: Fix BIP (AES-CMAC) cipher validation

This cipher can be used only as a group management frame cipher and as
such, there is no point in validating that it is not used with non-zero
key-index. Instead, verify that it is not used as a pairwise cipher
regardless of the key index.
Signed-off-by: default avatarJouni Malinen <jouni@qca.qualcomm.com>
[change code to use switch statement which is easier to extend]
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 3cb10943
...@@ -227,18 +227,26 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev, ...@@ -227,18 +227,26 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
if (pairwise && !mac_addr) if (pairwise && !mac_addr)
return -EINVAL; return -EINVAL;
/* switch (params->cipher) {
* Disallow pairwise keys with non-zero index unless it's WEP case WLAN_CIPHER_SUITE_TKIP:
case WLAN_CIPHER_SUITE_CCMP:
/* Disallow pairwise keys with non-zero index unless it's WEP
* or a vendor specific cipher (because current deployments use * or a vendor specific cipher (because current deployments use
* pairwise WEP keys with non-zero indices and for vendor specific * pairwise WEP keys with non-zero indices and for vendor
* ciphers this should be validated in the driver or hardware level * specific ciphers this should be validated in the driver or
* - but 802.11i clearly specifies to use zero) * hardware level - but 802.11i clearly specifies to use zero)
*/ */
if (pairwise && key_idx && if (pairwise && key_idx)
((params->cipher == WLAN_CIPHER_SUITE_TKIP) ||
(params->cipher == WLAN_CIPHER_SUITE_CCMP) ||
(params->cipher == WLAN_CIPHER_SUITE_AES_CMAC)))
return -EINVAL; return -EINVAL;
break;
case WLAN_CIPHER_SUITE_AES_CMAC:
/* Disallow BIP (group-only) cipher as pairwise cipher */
if (pairwise)
return -EINVAL;
break;
default:
break;
}
switch (params->cipher) { switch (params->cipher) {
case WLAN_CIPHER_SUITE_WEP40: case WLAN_CIPHER_SUITE_WEP40:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment