mac80211: Report beacon protection failures to user space

Report received Beacon frames that do not have a valid MME MIC when
beacon protection is enabled. This covers both the cases of no MME in
the received frame and invalid MIC in the MME.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20200401142548.6990-2-jouni@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 91a13ae..a724551 100644 (file)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1984,8 +1984,12 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 
                if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
                    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
-                   NUM_DEFAULT_BEACON_KEYS)
+                   NUM_DEFAULT_BEACON_KEYS) {
+                       cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
+                                                    skb->data,
+                                                    skb->len);
                        return RX_DROP_MONITOR; /* unexpected BIP keyidx */
+               }
 
                rx->key = ieee80211_rx_get_bigtk(rx, mmie_keyidx);
                if (!rx->key)
@@ -2131,6 +2135,10 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
        /* either the frame has been decrypted or will be dropped */
        status->flag |= RX_FLAG_DECRYPTED;
 
+       if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE))
+               cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
+                                            skb->data, skb->len);
+
        return result;
 }
 
@@ -2411,8 +2419,12 @@ static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
                        return -EACCES;
                }
                if (unlikely(ieee80211_is_beacon(fc) && rx->key &&
-                            ieee80211_get_mmie_keyidx(rx->skb) < 0))
+                            ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
+                       cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
+                                                    rx->skb->data,
+                                                    rx->skb->len);
                        return -EACCES;
+               }
                /*
                 * When using MFP, Action frames are not allowed prior to
                 * having configured keys.