From: Ben Greear <greearb@candelatech.com>
To: Janusz Dziedzic <janusz.dziedzic@tieto.com>,
"Peer, Ilan" <ilan.peer@intel.com>
Cc: Johannes Berg <johannes@sipsolutions.net>,
Emmanuel Grumbach <egrumbach@gmail.com>,
"alexander.wetzel@web.de" <alexander.wetzel@web.de>,
Jouni Malinen <j@w1.fi>,
linux-wireless <linux-wireless@vger.kernel.org>
Subject: Re: mac80211 drops packet with old IV after rekeying
Date: Mon, 18 May 2015 07:40:31 -0700 [thread overview]
Message-ID: <5559F9DF.5090403@candelatech.com> (raw)
In-Reply-To: <CALhHN=p1N8EzauGMddaQk29Gz3xPV7Pf=UO_8Ca7Xohsw3OoeQ@mail.gmail.com>
On 05/18/2015 01:03 AM, Janusz Dziedzic wrote:
> On 18 May 2015 at 08:14, Peer, Ilan <ilan.peer@intel.com> wrote:
>>
>>
>>> -----Original Message-----
>>> From: linux-wireless-owner@vger.kernel.org [mailto:linux-wireless-
>>> owner@vger.kernel.org] On Behalf Of Johannes Berg
>>> Sent: Sunday, May 17, 2015 23:22
>>> To: Emmanuel Grumbach
>>> Cc: alexander.wetzel@web.de; Jouni Malinen; linux-wireless
>>> Subject: Re: mac80211 drops packet with old IV after rekeying
>>>
>>> On Sun, 2015-05-17 at 23:13 +0300, Emmanuel Grumbach wrote:
>>>
>>>>>> Yeah - ok. But how come we *already* set the pointer to the new key
>>>>>> while the HW is still successfully decrypting with the old key.
>>>>>> This is the point I can' figure out. I'd expect the transmitting
>>>>>> side to stop using the old key prior to sending the EAPOL (which
>>
>> There is probably no synchronization between the 4way HS and other data traffic on the transmitter side, as these are different processes. So it is possible that after receiving message 3 and before setting the keys, the HW would be able to decrypt additional frames with the old key.
>>
> In ath10k hw we have peer flag WMI_PEER_NEED_PTK_4_WAY.
> This will lock tx (discard data) until PTK_M4_SENT and install key
> after 4way HS.
> But I didn't check ptk_rekey and I am not sure this will help with all races.
I think at least the 10.1 firmware has bugs that keep this from actually working
just right. Maybe later firmware works better.
Thanks,
Ben
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
next prev parent reply other threads:[~2015-05-18 14:40 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-05-15 6:48 mac80211 drops packet with old IV after rekeying Emmanuel Grumbach
2015-05-15 7:25 ` Johannes Berg
2015-05-15 7:52 ` Emmanuel Grumbach
2015-05-15 18:35 ` Johannes Berg
2015-05-16 18:18 ` Emmanuel Grumbach
2015-05-16 19:57 ` Johannes Berg
2015-05-17 16:05 ` Jouni Malinen
2015-05-17 18:23 ` Emmanuel Grumbach
2015-05-17 19:25 ` Johannes Berg
2015-05-17 19:49 ` Emmanuel Grumbach
2015-05-17 20:05 ` Johannes Berg
2015-05-17 20:13 ` Emmanuel Grumbach
2015-05-17 20:22 ` Johannes Berg
2015-05-18 6:14 ` Peer, Ilan
2015-05-18 8:03 ` Janusz Dziedzic
2015-05-18 14:40 ` Ben Greear [this message]
2015-05-18 15:02 ` Johannes Berg
2015-05-18 19:34 ` Emmanuel Grumbach
2015-05-18 19:47 ` Alexander Wetzel
2015-05-18 21:55 ` Johannes Berg
2015-05-20 20:55 ` mac80211 drops packet with old IV after rekeying - workaround patch for CCMP Alexander Wetzel
2015-05-21 7:11 ` Johannes Berg
2015-05-17 19:14 ` mac80211 drops packet with old IV after rekeying Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5559F9DF.5090403@candelatech.com \
--to=greearb@candelatech.com \
--cc=alexander.wetzel@web.de \
--cc=egrumbach@gmail.com \
--cc=ilan.peer@intel.com \
--cc=j@w1.fi \
--cc=janusz.dziedzic@tieto.com \
--cc=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).