DPP2: Try to negotiate PFS only if AP supports version 2 or newer
Check AP's DPP Protocol Version during network introduction and mark the PMKSA cache as suitable for PFS use with version 2 or newer. This avoids unnecessary attempt of negotiating PFS with version 1 APs. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
parent
f6c22dcdea
commit
1f5f000086
4 changed files with 26 additions and 1 deletions
|
@ -28,6 +28,7 @@ struct rsn_pmksa_cache_entry {
|
|||
*/
|
||||
u8 fils_cache_id[2];
|
||||
unsigned int fils_cache_id_set:1;
|
||||
unsigned int dpp_pfs:1;
|
||||
|
||||
os_time_t reauth_time;
|
||||
|
||||
|
|
|
@ -1771,6 +1771,11 @@ static void wpas_dpp_rx_peer_disc_resp(struct wpa_supplicant *wpa_s,
|
|||
struct wpa_ssid *ssid;
|
||||
const u8 *connector, *trans_id, *status;
|
||||
u16 connector_len, trans_id_len, status_len;
|
||||
#ifdef CONFIG_DPP2
|
||||
const u8 *version;
|
||||
u16 version_len;
|
||||
#endif /* CONFIG_DPP2 */
|
||||
u8 peer_version = 1;
|
||||
struct dpp_introduction intro;
|
||||
struct rsn_pmksa_cache_entry *entry;
|
||||
struct os_time now;
|
||||
|
@ -1871,6 +1876,13 @@ static void wpas_dpp_rx_peer_disc_resp(struct wpa_supplicant *wpa_s,
|
|||
os_memcpy(entry->pmk, intro.pmk, intro.pmk_len);
|
||||
entry->pmk_len = intro.pmk_len;
|
||||
entry->akmp = WPA_KEY_MGMT_DPP;
|
||||
#ifdef CONFIG_DPP2
|
||||
version = dpp_get_attr(buf, len, DPP_ATTR_PROTOCOL_VERSION,
|
||||
&version_len);
|
||||
if (version && version_len >= 1)
|
||||
peer_version = version[0];
|
||||
entry->dpp_pfs = peer_version >= 2;
|
||||
#endif /* CONFIG_DPP2 */
|
||||
if (expiry) {
|
||||
os_get_time(&now);
|
||||
seconds = expiry - now.sec;
|
||||
|
@ -1884,7 +1896,7 @@ static void wpas_dpp_rx_peer_disc_resp(struct wpa_supplicant *wpa_s,
|
|||
wpa_sm_pmksa_cache_add_entry(wpa_s->wpa, entry);
|
||||
|
||||
wpa_msg(wpa_s, MSG_INFO, DPP_EVENT_INTRO "peer=" MACSTR
|
||||
" status=%u", MAC2STR(src), status[0]);
|
||||
" status=%u version=%u", MAC2STR(src), status[0], peer_version);
|
||||
|
||||
wpa_printf(MSG_DEBUG,
|
||||
"DPP: Try connection again after successful network introduction");
|
||||
|
|
|
@ -1796,6 +1796,12 @@ void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
|
|||
if (wpa_s->key_mgmt == WPA_KEY_MGMT_DPP && ssid &&
|
||||
ssid->dpp_netaccesskey && ssid->dpp_pfs != 2 &&
|
||||
!ssid->dpp_pfs_fallback) {
|
||||
struct rsn_pmksa_cache_entry *pmksa;
|
||||
|
||||
pmksa = pmksa_cache_get_current(wpa_s->wpa);
|
||||
if (!pmksa || !pmksa->dpp_pfs)
|
||||
goto pfs_fail;
|
||||
|
||||
dpp_pfs_free(wpa_s->dpp_pfs);
|
||||
wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
|
||||
ssid->dpp_netaccesskey_len);
|
||||
|
|
|
@ -3087,6 +3087,12 @@ static u8 * wpas_populate_assoc_ies(
|
|||
if (wpa_sm_get_key_mgmt(wpa_s->wpa) == WPA_KEY_MGMT_DPP &&
|
||||
ssid->dpp_netaccesskey &&
|
||||
ssid->dpp_pfs != 2 && !ssid->dpp_pfs_fallback) {
|
||||
struct rsn_pmksa_cache_entry *pmksa;
|
||||
|
||||
pmksa = pmksa_cache_get_current(wpa_s->wpa);
|
||||
if (!pmksa || !pmksa->dpp_pfs)
|
||||
goto pfs_fail;
|
||||
|
||||
dpp_pfs_free(wpa_s->dpp_pfs);
|
||||
wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
|
||||
ssid->dpp_netaccesskey_len);
|
||||
|
|
Loading…
Reference in a new issue