Re: kern/44506: ieee80211_match_bss matches all different SSIDs of the identical length

[James.Woo%ricoh-usa.com@localhost]

Hi David,

Oops. I've missed two lines of code.

        if (ic->ic_des_esslen
!= 0) {
         
  if (ni->ni_esslen == ic->ic_des_esslen) {
           
if (memcmp(ni->ni_essid, ic->ic_des_essid, ic->ic_des_esslen)
!= 0)
           
    fail |= 0x10;
        } else
           
fail |= 0x10;
        
James

David Laight <david%l8s.co.uk@localhost>

02/03/2011 12:15 AM

Please respond to
gnats-bugs%NetBSD.org@localhost

To	kern-bug-people%netbsd.org@localhost, gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost, james.woo%ricoh-usa.com@localhost
cc
Subject	Re: kern/44506: ieee80211_match_bss matches all different SSIDs of the identical length

The following reply was made to PR kern/44506; it
has been noted by GNATS.

From: David Laight <david%l8s.co.uk@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/44506: ieee80211_match_bss matches all different SSIDs
of the identical length
Date: Thu, 3 Feb 2011 08:15:52 +0000

 On Wed, Feb 02, 2011 at 11:25:01PM +0000, james.woo%rioch-usa.com@localhost wrote:
 > >Number:         44506
 > >Category:       kern
 > >Synopsis:       ieee80211_match_bss matches all
different SSIDs of the identical length
 ...
 >                  ieee80211_match
will match all different SSIDs of the identical length
 >                  Connection
is only successful if the target SSID has a higher RSSI than
 >                  the
other "matching" SSIDs. Otherwise, connection is not possible
if the target SSID
 >                  has
a lower RSSI than the other "matching" SSIDs.
 > >How-To-Repeat:
 >                  Assign
different SSIDs of identical length to several APs.
 >                  Try
to connect to the one with the lowest RSSI. It will fail to connect.
 >                  Now
connect to the one with the highest RSSI. It will succeed.
 > >Fix:
 >                  net80211/ieee80211_node.c,
line 532-534 was
 >                  if
(ic->ic_dess_esslen != 0 &&
 >                  
   (ni->ni_esslen != ic->ic_des_esslen ||
 >                  
    memcmp(ni->ni_essid, ic->ic_des_essid, ic->ic_des_esslen)
!= 0))
 >                  should
be change to:
 >                  if
(ic->ic_des_esslen != 0) {
 >                  
   if (ni->ni_esslen == ic->ic_des_esslen) {
 >                  
               
if (memcmp(ni->ni_essid, ic->ic_des_essid, ic->ic_dess_esslen)
!= 0)
 
 That change doesn't look right to me.
 The line following the confition is:   fail |= 0x19;
 So the old code sets fail if the length or contents of the ssid don't
match.
 Your version won't set 'fail' if the lengths differ - but that isn't a
match.
 
                  David
 
 -- 
 David Laight: david%l8s.co.uk@localhost