Return-path: Received: from mail-wg0-f49.google.com ([74.125.82.49]:49270 "EHLO mail-wg0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752726Ab3LCLRs (ORCPT ); Tue, 3 Dec 2013 06:17:48 -0500 Received: by mail-wg0-f49.google.com with SMTP id x12so13079294wgg.28 for ; Tue, 03 Dec 2013 03:17:03 -0800 (PST) MIME-Version: 1.0 In-Reply-To: <1386063265.4393.3.camel@jlt4.sipsolutions.net> References: <1386010316-2540-1-git-send-email-johannes@sipsolutions.net> <1386063265.4393.3.camel@jlt4.sipsolutions.net> From: Krishna Chaitanya Date: Tue, 3 Dec 2013 16:46:43 +0530 Message-ID: (sfid-20131203_121751_974588_EF3BDA82) Subject: Re: [RFC] cfg80211/mac80211: drop GTK-protected unicast IP packets To: Johannes Berg Cc: linux-wireless , j@w1.fi Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-wireless-owner@vger.kernel.org List-ID: On Tue, Dec 3, 2013 at 3:04 PM, Johannes Berg wrote: > On Tue, 2013-12-03 at 14:50 +0530, Krishna Chaitanya wrote: >> On Tue, Dec 3, 2013 at 12:21 AM, Johannes Berg >> wrote: >> > From: Johannes Berg >> > >> > The GTK is shared by all stations in an 802.11 BSS and as such any >> > one of them can send forged group-addressed frames. To prevent this >> > kind of attack, drop unicast IP packets if they were protected with >> > the GTK, i.e. were multicast packets at the 802.11 layer. >> > >> > Based in part on a patch by Jouni that did the same but in the IP >> > stack, which was considered too intrusive. >> > >> As per RFC 1122 this is an invalid case: >> When a host sends a datagram to a link-layer broadcast address, >> the IP destination address MUST be a legal IP broadcast or IP >> multicast address. >> >> A host SHOULD silently discard a datagram that is received via >> a link-layer broadcast (see Section 2.4) but does not specify >> an IP multicast or broadcast destination address. >> >> We can simply drop this frame irrespective of GTK/PTK is used. > > Interesting. Can you point out where this is implemented in the IP > stack(s)? AFAIK there is no check in the drivers/IP Stack for this. May be we can implement this IP stack in a generic way confirming to RFC1122?