diff options
| author |   stsp <stsp@openbsd.org> | 2017-03-01 19:28:48 +0000 |
|---|---|---|
| committer | stsp <stsp@openbsd.org> | 2017-03-01 19:28:48 +0000 |
| commit | 98998980f534aa528027c3e9b37e5cf6594ebe2c (patch) | |
| tree | 60f49e2e3146677d27a411ba57762a49f2af5ba6 /sys/net80211/ieee80211_pae_output.c | |
| parent | Split vmm.c into two files: vm.c for the VM child, vmm.c for the parent (diff) | |
| download | wireguard-openbsd-98998980f534aa528027c3e9b37e5cf6594ebe2c.tar.xz wireguard-openbsd-98998980f534aa528027c3e9b37e5cf6594ebe2c.zip | |
Fix a bug allowing a man-in-the-middle attack against WPA wireless clients.
A malicious AP could trick clients into connecting to the malicious AP
instead of the desired AP. All frames would then be sent in the clear.
This problem was found and reported by Mathy Vanhoef who also provided
an initial patch which we improved together.
Diffstat (limited to 'sys/net80211/ieee80211_pae_output.c')
| -rw-r--r-- | sys/net80211/ieee80211_pae_output.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/net80211/ieee80211_pae_output.c b/sys/net80211/ieee80211_pae_output.c index 340e9a0fa9e..d385b00ad9d 100644 --- a/sys/net80211/ieee80211_pae_output.c +++ b/sys/net80211/ieee80211_pae_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ieee80211_pae_output.c,v 1.28 2016/12/17 18:36:22 stsp Exp $ */ +/* $OpenBSD: ieee80211_pae_output.c,v 1.29 2017/03/01 19:28:48 stsp Exp $ */ /*- * Copyright (c) 2007,2008 Damien Bergamini <damien.bergamini@free.fr> @@ -310,6 +310,7 @@ ieee80211_send_4way_msg2(struct ieee80211com *ic, struct ieee80211_node *ni, u_int16_t info; u_int8_t *frm; + ni->ni_rsn_supp_state = RSNA_SUPP_PTKNEGOTIATING; m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA, (ni->ni_rsnprotos == IEEE80211_PROTO_WPA) ? 2 + IEEE80211_WPAIE_MAXLEN : @@ -438,6 +439,7 @@ ieee80211_send_4way_msg4(struct ieee80211com *ic, struct ieee80211_node *ni) struct mbuf *m; u_int16_t info; + ni->ni_rsn_supp_state = RNSA_SUPP_PTKDONE; m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA, 0); if (m == NULL) return ENOMEM; |