Return-path: Received: from mail-qk0-f180.google.com ([209.85.220.180]:35960 "EHLO mail-qk0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751916AbeBAMXs (ORCPT ); Thu, 1 Feb 2018 07:23:48 -0500 Received: by mail-qk0-f180.google.com with SMTP id d21so19074108qkj.3 for ; Thu, 01 Feb 2018 04:23:48 -0800 (PST) Subject: Re: [PATCH] brcmfmac: detect & reject faked packet generated by a firmware To: =?UTF-8?B?UmFmYcWCIE1pxYJlY2tp?= , Hante Meuleman References: <20180130090922.30346-1-zajec5@gmail.com> <5A705B5E.5070906@broadcom.com> <5A71D08B.7090905@broadcom.com> <4f6223b8083ed69432493a37d4f45b69@mail.gmail.com> <194eff6f46f740bf11edd110de1d0b7e@milecki.pl> Cc: =?UTF-8?B?UmFmYcWCIE1pxYJlY2tp?= , Kalle Valo , Franky Lin , Chi-Hsien Lin , Wright Feng , Pieter-Paul Giesberts , linux-wireless@vger.kernel.org, "BRCM80211-DEV-LIST,PDL" , brcm80211-dev-list@cypress.com From: Arend van Spriel Message-ID: <5A7306D0.7020900@broadcom.com> (sfid-20180201_132352_282362_2FA50B2B) Date: Thu, 1 Feb 2018 13:23:44 +0100 MIME-Version: 1.0 In-Reply-To: <194eff6f46f740bf11edd110de1d0b7e@milecki.pl> Content-Type: text/plain; charset=utf-8; format=flowed Sender: linux-wireless-owner@vger.kernel.org List-ID: On 2/1/2018 12:48 PM, Rafał Miłecki wrote: > On 2018-01-31 17:14, Hante Meuleman wrote: >> It is an 802.2 frame, more specifically a LLC XID frames. So why it >> exists? >> And more over, why would we crash as an result? Decoding info can be >> found >> here: >> >> https://www.cisco.com/c/en/us/support/docs/ibm-technologies/logical-link-control-llc/12247-45.html#con3 >> >> >> The frame was likely sent by the stack from remote site PC, should be >> possible to capture with tcpdump. >> >> I've seen these frames before, but don’t know what they are for. The >> frame >> appears to be correctly encoded. The ethertype, is not a type, but a len >> field. The only protocol with such a short len allowed is llc, see also >> >> https://www.savvius.com/networking-glossary/ethernet/frame_formats/ >> >> So it is 802.2 (also known as LLC) > > This was actually quite helpful, thanks! Googling for "802.11 LLC XID > association" pointed me to some Google-indexed books: > 1) Internet Protocols: Advances, Technologies and Applications > 2) Broadband Wireless Access and Local Networks: Mobile WiMax and WiFi > > Both of them describe IAPP standard which appears as IEEE 802.11f on > Wikipedia. It seems to be some old & obsolete roaming standard that was > replaced by 802.11r. > > There is ADD operation defined by the 802.11f which is triggered "when a > station is newly associated". It also says "The frame is sent using a > MAC source address equal to the MAC address of the station". > > So far it seems to match what I'm seeing. My guess is that Broadcom's > firmware includes some kind of support for the 802.11f. I'm still not > sure if that is really firmware's responsibility to handle that though. I was just writing up a reply. It is indeed an IAPP packet. So it is a 802.11f packet and our firmware implements the 802.11 stack. What makes you think it is not firmware responsibility. It goes along with MLME states. The firmware change has been made centuries ago as far as I can tell. Anyway, the packet should not have been sent back to us as it will result in intended disassociate. So what kernel are you running on. I am not seeing it on 4.4 kernel, but I am in the middle of another debugging session. However, I was able to associate just fine. Regards, Arend