DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

FT: Reject over-the-DS response with MFPC=0 if PMF is required

Browse source 
If FT over-the-DS case is enforced through the "FT_DS <BSSID>" control
interface command, the PMF capability check during BSS selection is not
used and that could have allowed PMF to be disabled in the over-the-DS
case even if the local network profile mandated use of PMF. Check
against this explicitly to avoid unexpected cases if the APs within the
same mobility domain are not configured consistently.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2019-08-16 13:50:54 +03:00 committed by Jouni Malinen
parent ae05b6a215
commit 528f263c4a
3 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/common/wpa_common.c
View file

@ -958,6 +958,7 @@ int wpa_ft_parse_ies(const u8 *ies, size_t ies_len,
"RSN IE: %d", ret); "RSN IE: %d", ret);
return -1; return -1;
} }
parse->rsn_capab = data.capabilities;
if (data.num_pmkid == 1 && data.pmkid) if (data.num_pmkid == 1 && data.pmkid)
parse->rsn_pmkid = data.pmkid; parse->rsn_pmkid = data.pmkid;
parse->key_mgmt = data.key_mgmt; parse->key_mgmt = data.key_mgmt;

1
src/common/wpa_common.h
View file

@ -453,6 +453,7 @@ struct wpa_ft_ies {
size_t r0kh_id_len; size_t r0kh_id_len;
const u8 *rsn; const u8 *rsn;
size_t rsn_len; size_t rsn_len;
u16 rsn_capab;
const u8 *rsn_pmkid; const u8 *rsn_pmkid;
const u8 *tie; const u8 *tie;
size_t tie_len; size_t tie_len;

8
src/rsn_supp/wpa_ft.c
View file

@ -597,6 +597,14 @@ int wpa_ft_process_response(struct wpa_sm *sm, const u8 *ies, size_t ies_len,
return -1; return -1;
} }
#ifdef CONFIG_IEEE80211W
if (sm->mfp == 2 && !(parse.rsn_capab & WPA_CAPABILITY_MFPC)) {
wpa_printf(MSG_INFO,
"FT: Target AP does not support PMF, but local configuration requires that");
return -1;
}
#endif /* CONFIG_IEEE80211W */
os_memcpy(sm->r1kh_id, parse.r1kh_id, FT_R1KH_ID_LEN); os_memcpy(sm->r1kh_id, parse.r1kh_id, FT_R1KH_ID_LEN);
wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID", sm->r1kh_id, FT_R1KH_ID_LEN); wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID", sm->r1kh_id, FT_R1KH_ID_LEN);
wpa_hexdump(MSG_DEBUG, "FT: SNonce", sm->snonce, WPA_NONCE_LEN); wpa_hexdump(MSG_DEBUG, "FT: SNonce", sm->snonce, WPA_NONCE_LEN);