diff mbox

driver_nl80211: fix control port protocol no-encrypt setting

Message ID 1471426825-2899-1-git-send-email-johannes@sipsolutions.net
State Accepted
Headers show

Commit Message

Johannes Berg Aug. 17, 2016, 9:40 a.m. UTC 
From: Johannes Berg <johannes.berg@intel.com>

Currently, driver_nl80211 sets NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT
in AP mode, to get 802.1X frames out unencrypted. However, due to
the way nl80211/cfg80211 is implemented, this attribute is ignored
by the kernel if NL80211_ATTR_CONTROL_PORT_ETHERTYPE isn't specified
as well. Fix this by including NL80211_ATTR_CONTROL_PORT_ETHERTYPE
set to ETH_P_PAE. This can be done unconditionally, since the kernel
will allow ETH_P_PAE to be set even when the driver didn't advertise
support for arbitrary ethertypes.

Additionally, the params->pairwise_ciphers appear to not be set at
this point, so relax the check and allow them to be zero.

In client mode, this whole thing was missing, so add it. Again, the
pairwise suite can be WPA_CIPHER_NONE, so allow that case as well.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 src/drivers/driver_nl80211.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

Comments

Jouni Malinen Aug. 18, 2016, 7:48 p.m. UTC | #1 
On Wed, Aug 17, 2016 at 11:40:25AM +0200, Johannes Berg wrote:
> Currently, driver_nl80211 sets NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT
> in AP mode, to get 802.1X frames out unencrypted. However, due to
> the way nl80211/cfg80211 is implemented, this attribute is ignored
> by the kernel if NL80211_ATTR_CONTROL_PORT_ETHERTYPE isn't specified
> as well. Fix this by including NL80211_ATTR_CONTROL_PORT_ETHERTYPE
> set to ETH_P_PAE. This can be done unconditionally, since the kernel
> will allow ETH_P_PAE to be set even when the driver didn't advertise
> support for arbitrary ethertypes.
> 
> Additionally, the params->pairwise_ciphers appear to not be set at
> this point, so relax the check and allow them to be zero.
> 
> In client mode, this whole thing was missing, so add it. Again, the
> pairwise suite can be WPA_CIPHER_NONE, so allow that case as well.

Thanks, applied.
diff mbox

Patch

diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index 3391012047df..338cdc9c8d49 100644
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -3587,8 +3587,10 @@  static int wpa_driver_nl80211_set_ap(void *priv,
 		goto fail;
 
 	if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
-	    params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40) &&
-	    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))
+	    (!params->pairwise_ciphers ||
+	     params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40)) &&
+	    (nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, ETH_P_PAE) ||
+	     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
 		goto fail;
 
 	wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
@@ -4904,6 +4906,14 @@  static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
 	if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
 		return -1;
 
+	if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
+	    (params->pairwise_suite == WPA_CIPHER_NONE ||
+	     params->pairwise_suite == WPA_CIPHER_WEP104 ||
+	     params->pairwise_suite == WPA_CIPHER_WEP40) &&
+	    (nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, ETH_P_PAE) ||
+	     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
+		return -1;
+
 	if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED &&
 	    nla_put_u32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED))
 		return -1;