From 8fb546d8e608f436b354afb82409dfbc6daa8278 Mon Sep 17 00:00:00 2001 From: Mike Siedzik Date: Tue, 20 Feb 2018 14:28:32 -0500 Subject: [PATCH] mka: Ignore MACsec SAK Use Old Key parameter if we don't have our old key Upon receipt of the "MACsec MKPDU SAK Use parameter set" the KaY verifies that both the latest key and the old key are valid. If the local system reboots or is reinitialized, the KaY won't have a copy of its old key. Therefore if the KaY does not have a copy of its old key it should not reject MKPDUs that contain old key data in the MACsec SAK Use parameter. Signed-off-by: Michael Siedzik --- src/pae/ieee802_1x_kay.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c index 857c282a8..94d6046ea 100644 --- a/src/pae/ieee802_1x_kay.c +++ b/src/pae/ieee802_1x_kay.c @@ -1343,8 +1343,8 @@ ieee802_1x_mka_decode_sak_use_body( } } - /* check old key is valid */ - if (body->otx || body->orx) { + /* check old key is valid (but only if we remember our old key) */ + if (participant->oki.kn != 0 && (body->otx || body->orx)) { if (os_memcmp(participant->oki.mi, body->osrv_mi, sizeof(participant->oki.mi)) != 0 || be_to_host32(body->okn) != participant->oki.kn ||