Page MenuHomeFreeBSD

net80211: fix TKIP trailer trimming w/ no rx parameters given
ClosedPublic

Authored by adrian on Jun 2 2025, 12:15 AM.
Referenced Files
Unknown Object (File)
Sat, Jul 26, 6:09 AM
Unknown Object (File)
Fri, Jul 25, 4:49 AM
Unknown Object (File)
Sat, Jul 12, 7:57 AM
Unknown Object (File)
Mon, Jul 7, 11:57 AM
Unknown Object (File)
Mon, Jul 7, 10:49 AM
Unknown Object (File)
Sun, Jul 6, 7:25 PM
Unknown Object (File)
Sat, Jul 5, 8:59 PM
Unknown Object (File)
Sat, Jul 5, 5:50 PM

Details

Summary

Previous work made trimming the TKIP trailer an optional thing
based on what the driver indicated it did with the received
frame. However, for drivers that aren't populating an RX frame
with an rx status - notably iwn(4) - exposed this bug.

If the driver doesn't expose any RX status then just restore
the previous behaviour.

This should be considered a temporary (ish) workaround until we've
figured out a longer term approach to checking RX status information
from drivers and what the default (if any) behaviour should be.

Locally tested:

  • iwn(4), STA mode, CCMP + TKIP groupwise network

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

bz requested changes to this revision.Jun 2 2025, 1:13 AM
bz added a subscriber: bz.

Need to check all the other places which may have changed implicit behaviour too and they all need the same comment,

sys/net80211/ieee80211_crypto_tkip.c
375

What about?

/* Code implicit legacy behavior until all drivers are converted. */
if (rxs == NULL || (rxs->c_pktflags & IEEE80211_RX_F_ICV_STRIP) == 0) ?
This revision now requires changes to proceed.Jun 2 2025, 1:13 AM

update from bz; matches what's in CCMP

In D50638#1156017, @bz wrote:

Need to check all the other places which may have changed implicit behaviour too and they all need the same comment,

it looks like ccmp and gcmp are OK. CCMP actually has the suggested fix from you here. :-)

Important:

Please add:

Fixes:     731ff40069d28
MFC after: 3 days

I can do the MFC and handle the possible errata notice if you want me to given it's my bug; added re@ to this review.

Thankfully it seems all the other changes were indeed new or not changing the status quo. Cannot find any others matching
git diff 1eb3f15c149b.. sys/net80211 | grep 'rxs != NULL' | grep ==

This revision is now accepted and ready to land.Jun 2 2025, 1:19 PM

update commit message (locally)

This revision now requires review to proceed.Jun 2 2025, 11:31 PM
This revision is now accepted and ready to land.Jun 3 2025, 12:09 AM