mac80211: allow same PN for AMSDU sub-frames

Some hardware (iwlwifi an example) de-aggregate AMSDUs and copy the IV
as is to the generated MPDUs, so the same PN appears in multiple
packets without being a replay attack.  Allow driver to explicitly
indicate that a frame is allowed to have the same PN as the previous
frame.

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 12 insertions, 4 deletions

diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 7e4f2652bca7..b48c1e13e281 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -519,12 +519,16 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
                 return RX_DROP_UNUSABLE;
 
         if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
+                int res;
+
                 ccmp_hdr2pn(pn, skb->data + hdrlen);
 
                 queue = rx->security_idx;
 
-                if (memcmp(pn, key->u.ccmp.rx_pn[queue],
-                           IEEE80211_CCMP_PN_LEN) <= 0) {
+                res = memcmp(pn, key->u.ccmp.rx_pn[queue],
+                             IEEE80211_CCMP_PN_LEN);
+                if (res < 0 ||
+                    (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
                         key->u.ccmp.replays++;
                         return RX_DROP_UNUSABLE;
                 }
@@ -745,12 +749,16 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
                 return RX_DROP_UNUSABLE;
 
         if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
+                int res;
+
                 gcmp_hdr2pn(pn, skb->data + hdrlen);
 
                 queue = rx->security_idx;
 
-                if (memcmp(pn, key->u.gcmp.rx_pn[queue],
-                           IEEE80211_GCMP_PN_LEN) <= 0) {
+                res = memcmp(pn, key->u.gcmp.rx_pn[queue],
+                             IEEE80211_GCMP_PN_LEN);
+                if (res < 0 ||
+                    (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
                         key->u.gcmp.replays++;
                         return RX_DROP_UNUSABLE;
                 }