DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

PASN: Derive KDK on AP only when both ends support SecureLTF

Browse source 
On the AP responder side, KDK was derived if the driver advertises
WPA_DRIVER_FLAGS2_SEC_LTF_AP. That is not correct, i.e., this needs to
also depend on the initiator indicating support for this in the RSNXE of
PASN authentication frame 1.

Signed-off-by: Sai Pratyusha Magam <quic_smagam@quicinc.com>
This commit is contained in:
Sai Pratyusha Magam 2024-05-09 15:16:29 +05:30 committed by Jouni Malinen
parent e5f76b9153
commit b745cd33ef
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/ap/ieee802_11.c
View file

@ -2701,6 +2701,14 @@ static void hapd_pasn_update_params(struct hostapd_data *hapd,
pasn_set_akmp(pasn, rsn_data.key_mgmt); pasn_set_akmp(pasn, rsn_data.key_mgmt);
pasn_set_cipher(pasn, rsn_data.pairwise_cipher); pasn_set_cipher(pasn, rsn_data.pairwise_cipher);
if (pasn->derive_kdk &&
!ieee802_11_rsnx_capab_len(elems.rsnxe, elems.rsnxe_len,
WLAN_RSNX_CAPAB_SECURE_LTF))
pasn_disable_kdk_derivation(pasn);
#ifdef CONFIG_TESTING_OPTIONS
if (hapd->conf->force_kdk_derivation)
pasn_enable_kdk_derivation(pasn);
#endif /* CONFIG_TESTING_OPTIONS */
akmp = pasn_get_akmp(pasn); akmp = pasn_get_akmp(pasn);
if (wpa_key_mgmt_ft(akmp) && rsn_data.num_pmkid) { if (wpa_key_mgmt_ft(akmp) && rsn_data.num_pmkid) {