DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

SAE: Do not clone PMKSA entry for OKC after its reauth threshold

Browse source 
Since SAE PMK can be updated only by going through a new SAE
authentication instead of being able to update it during an association
like EAP authentication, do not allow PMKSA entries to be used for OKC
after the reauthentication threshold has been reached. This allows the
PMK to be updated without having to force a disassociation when the PMK
expires if the station roams between the reauthentication threshold and
expiration timeout.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2020-02-28 17:26:36 +02:00 committed by Jouni Malinen
parent 114d124186
commit bb93ea234e
1 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/rsn_supp/pmksa_cache.c
View file

@ -416,6 +416,20 @@ pmksa_cache_get_opportunistic(struct rsn_pmksa_cache *pmksa, void *network_ctx,
while (entry) { while (entry) {
if (entry->network_ctx == network_ctx && if (entry->network_ctx == network_ctx &&
(!akmp || entry->akmp == akmp)) { (!akmp || entry->akmp == akmp)) {
struct os_reltime now;
if (wpa_key_mgmt_sae(entry->akmp) &&
os_get_reltime(&now) == 0 &&
entry->reauth_time < now.sec) {
wpa_printf(MSG_DEBUG,
"RSN: Do not clone PMKSA cache entry for "
MACSTR
" since its reauth threshold has passed",
MAC2STR(entry->aa));
entry = entry->next;
continue;
}
entry = pmksa_cache_clone_entry(pmksa, entry, aa); entry = pmksa_cache_clone_entry(pmksa, entry, aa);
if (entry) { if (entry) {
wpa_printf(MSG_DEBUG, "RSN: added " wpa_printf(MSG_DEBUG, "RSN: added "