net80211: prevent plaintext injection by A-MSDU RFC1042/EAPOL frames

[bz]

Summary

No longer accept plaintext A-MSDU frames that start with an RFC1042
header with EtherType EAPOL. This is done by only accepting EAPOL
packets that are included in non-aggregated 802.11 frames.

Note that before this patch, FreeBSD also only accepted EAPOL frames
that are sent in a non-aggregated 802.11 frame due to bugs in
processing EAPOL packets inside A-MSDUs. In other words,
compatibility with legitimate devices remains the same.

This relates to section 6.5 in the 2021 Usenix "FragAttacks" (Fragment
and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation)
paper.

Submitted by: Mathy Vanhoef (Mathy.Vanhoef kuleuven.be)
Security: CVE-2020-26144
PR: 256120

[bz]

Please see PR for original description/comments; I did add the "else eh = NULL" bits here and wrapped the debug logging.

[bz]

If no one has any (further) comments I'll commit these tomorrow morning (UTC).

[emaste]

A minor comment inline but no objection to this patch.

sys/net80211/ieee80211_adhoc.c

590–593

I might take advantage of the recent >80 col style allowance to keep at least the main part of the message together (or, just break before "ether type" perhaps)

I could see someone upon encountering this message doing a grep for unauthorized or unknown.

And similar for other messages.

[bz]

sys/net80211/ieee80211_adhoc.c

590–593

I was pondering this but I added func, LINE information to all of them in cb5c07649aa005abb1e847c2cd5f816d762efb93 so I think formatting/wrapping won't matter so much anymore on any of them.
Do you think I should still do?