From 0cb12963b69abf493e456c8b2ed2b0be30ce11e7 Mon Sep 17 00:00:00 2001 From: Sunil Dutt Date: Tue, 5 Feb 2013 13:36:36 +0200 Subject: [PATCH] TDLS: Fix MIC calculation for teardown frame to depend on reason code The reason code used for calculating the MIC should correspond to the reason code with which the teardown frame is sent, as the receiver shall use the one obtained in the frame for validating the MIC. Signed-hostap: Jouni Malinen --- src/rsn_supp/tdls.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c index 4373801ba..9a79d28ce 100644 --- a/src/rsn_supp/tdls.c +++ b/src/rsn_supp/tdls.c @@ -680,8 +680,11 @@ int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, u16 reason_code) return -1; pos = rbuf; - if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) + if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) { + /* Overwrite the reason code */ + reason_code = WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED; goto skip_ies; + } ftie = (struct wpa_tdls_ftie *) pos; ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; @@ -715,8 +718,7 @@ skip_ies: /* request driver to send Teardown using this FTIE */ wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0, - WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, rbuf, - pos - rbuf); + reason_code, rbuf, pos - rbuf); os_free(rbuf); /* clear the Peerkey statemachine */