hostapd: Fix AP mode PMF disconnection protection bypass

This fixes
* CVE-2019-16275 AP mode PMF disconnection protection bypass
https://w1.fi/security/2019-7/ap-mode-pmf-disconnection-protection-bypass.txt

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit a6981604b30bc1ddc1713b368fe853d89c2ba40d)

diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile
index ba0f6e6b587174021cd5fe9906f143449105c4c3..9712e7247aaecbed9f79eb666974954f85291a0a 100644 (file)
--- a/package/network/services/hostapd/Makefile
+++ b/package/network/services/hostapd/Makefile
@@ -7,7 +7,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_RELEASE:=7
+PKG_RELEASE:=8
 
 PKG_SOURCE_URL:=http://w1.fi/hostap.git
 PKG_SOURCE_PROTO:=git

diff --git a/package/network/services/hostapd/patches/067-0001-AP-Silently-ignore-management-frame-from-unexpected-.patch b/package/network/services/hostapd/patches/067-0001-AP-Silently-ignore-management-frame-from-unexpected-.patch
new file mode 100644 (file)
index 0000000..2a44dc5
--- /dev/null
+++ b/package/network/services/hostapd/patches/067-0001-AP-Silently-ignore-management-frame-from-unexpected-.patch
@@ -0,0 +1,66 @@
+From 8c07fa9eda13e835f3f968b2e1c9a8be3a851ff9 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Thu, 29 Aug 2019 11:52:04 +0300
+Subject: [PATCH] AP: Silently ignore management frame from unexpected source
+ address
+
+Do not process any received Management frames with unexpected/invalid SA
+so that we do not add any state for unexpected STA addresses or end up
+sending out frames to unexpected destination. This prevents unexpected
+sequences where an unprotected frame might end up causing the AP to send
+out a response to another device and that other device processing the
+unexpected response.
+
+In particular, this prevents some potential denial of service cases
+where the unexpected response frame from the AP might result in a
+connected station dropping its association.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/ap/drv_callbacks.c | 13 +++++++++++++
+ src/ap/ieee802_11.c    | 12 ++++++++++++
+ 2 files changed, 25 insertions(+)
+
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -129,6 +129,19 @@ int hostapd_notif_assoc(struct hostapd_d
+                          "hostapd_notif_assoc: Skip event with no address");
+               return -1;
+       }
++
++      if (is_multicast_ether_addr(addr) ||
++          is_zero_ether_addr(addr) ||
++          os_memcmp(addr, hapd->own_addr, ETH_ALEN) == 0) {
++              /* Do not process any frames with unexpected/invalid SA so that
++               * we do not add any state for unexpected STA addresses or end
++               * up sending out frames to unexpected destination. */
++              wpa_printf(MSG_DEBUG, "%s: Invalid SA=" MACSTR
++                         " in received indication - ignore this indication silently",
++                         __func__, MAC2STR(addr));
++              return 0;
++      }
++
+       random_add_randomness(addr, ETH_ALEN);
+ 
+       hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -3929,6 +3929,18 @@ int ieee802_11_mgmt(struct hostapd_data
+       fc = le_to_host16(mgmt->frame_control);
+       stype = WLAN_FC_GET_STYPE(fc);
+ 
++      if (is_multicast_ether_addr(mgmt->sa) ||
++          is_zero_ether_addr(mgmt->sa) ||
++          os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
++              /* Do not process any frames with unexpected/invalid SA so that
++               * we do not add any state for unexpected STA addresses or end
++               * up sending out frames to unexpected destination. */
++              wpa_printf(MSG_DEBUG, "MGMT: Invalid SA=" MACSTR
++                         " in received frame - ignore this frame silently",
++                         MAC2STR(mgmt->sa));
++              return 0;
++      }
++
+       if (stype == WLAN_FC_STYPE_BEACON) {
+               handle_beacon(hapd, mgmt, len, fi);
+               return 1;

diff --git a/package/network/services/hostapd/patches/200-multicall.patch b/package/network/services/hostapd/patches/200-multicall.patch
index 273af644c61e2b0f3c368d01e837fa71655b273e..f2d2d33e2176201baab36cc135dbeb108b69ab16 100644 (file)
--- a/package/network/services/hostapd/patches/200-multicall.patch
+++ b/package/network/services/hostapd/patches/200-multicall.patch
@@ -178,7 +178,7 @@
  /*
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -1515,8 +1515,8 @@ static void hostapd_event_wds_sta_interf
+@@ -1528,8 +1528,8 @@ static void hostapd_event_wds_sta_interf
  }
  
  
@@ -189,7 +189,7 @@
  {
        struct hostapd_data *hapd = ctx;
  #ifndef CONFIG_NO_STDOUT_DEBUG
-@@ -1742,7 +1742,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -1755,7 +1755,7 @@ void wpa_supplicant_event(void *ctx, enu
  }
  
  

diff --git a/package/network/services/hostapd/patches/600-ubus_support.patch b/package/network/services/hostapd/patches/600-ubus_support.patch
index 7ac16e62b3fc164b65da1c33829465af6ead2afb..2f4f613654653fce0639c15c4b923ba9954bd009 100644 (file)
--- a/package/network/services/hostapd/patches/600-ubus_support.patch
+++ b/package/network/services/hostapd/patches/600-ubus_support.patch
@@ -193,7 +193,7 @@
        sta = ap_get_sta(hapd, mgmt->sa);
        if (sta == NULL) {
                wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
-@@ -3951,7 +3980,7 @@ int ieee802_11_mgmt(struct hostapd_data
+@@ -3963,7 +3992,7 @@ int ieee802_11_mgmt(struct hostapd_data
  
  
        if (stype == WLAN_FC_STYPE_PROBE_REQ) {
@@ -202,7 +202,7 @@
                return 1;
        }
  
-@@ -3971,17 +4000,17 @@ int ieee802_11_mgmt(struct hostapd_data
+@@ -3983,17 +4012,17 @@ int ieee802_11_mgmt(struct hostapd_data
        switch (stype) {
        case WLAN_FC_STYPE_AUTH:
                wpa_printf(MSG_DEBUG, "mgmt::auth");
@@ -291,7 +291,7 @@
  
        if (addr == NULL) {
                /*
-@@ -195,6 +199,12 @@ int hostapd_notif_assoc(struct hostapd_d
+@@ -208,6 +212,12 @@ int hostapd_notif_assoc(struct hostapd_d
                goto fail;
        }