wpa_supplicant/repos/core-x86_64/0002-AP-guard-FT-SAE-code-with-CONFIG_IEEE80211R_AP.patch

   1 From: Beniamino Galvani <bgalvani@redhat.com>
   2 Date: Mon, 4 Apr 2022 09:13:12 +0200
   3 Subject: AP: guard FT-SAE code with CONFIG_IEEE80211R_AP
   4
   5 wpa_supplicant doesn't support FT in AP mode, but it still negotiates
   6 FT-SAE. This can lead to an authentication failure when the AP is
   7 started with key_mgmt="SAE FT-SAE" and the STA supports both.
   8
   9 Ensure that FT-SAE is not negotiated when CONFIG_IEEE80211R_AP is not
  10 defined.
  11
  12 Signed-off-by: Beniamino Galvani <bgalvani@redhat.com>
  13 ---
  14  src/ap/wpa_auth_ie.c | 6 ++++++
  15  1 file changed, 6 insertions(+)
  16
  17 diff --git a/src/ap/wpa_auth_ie.c b/src/ap/wpa_auth_ie.c
  18 index 524922e..d63cbeb 100644
  19 --- a/src/ap/wpa_auth_ie.c
  20 +++ b/src/ap/wpa_auth_ie.c
  21 @@ -228,11 +228,13 @@ int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len,
  22                 pos += RSN_SELECTOR_LEN;
  23                 num_suites++;
  24         }
  25 +#ifdef CONFIG_IEEE80211R_AP
  26         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_SAE) {
  27                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_SAE);
  28                 pos += RSN_SELECTOR_LEN;
  29                 num_suites++;
  30         }
  31 +#endif /* CONFIG_IEEE80211R_AP */
  32  #endif /* CONFIG_SAE */
  33         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
  34                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B);
  35 @@ -670,8 +672,10 @@ wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
  36  #ifdef CONFIG_SAE
  37                 else if (data.key_mgmt & WPA_KEY_MGMT_SAE)
  38                         selector = RSN_AUTH_KEY_MGMT_SAE;
  39 +#ifdef CONFIG_IEEE80211R_AP
  40                 else if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE)
  41                         selector = RSN_AUTH_KEY_MGMT_FT_SAE;
  42 +#endif /* CONFIG_IEEE80211R_AP */
  43  #endif /* CONFIG_SAE */
  44                 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
  45                         selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
  46 @@ -778,8 +782,10 @@ wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
  47  #ifdef CONFIG_SAE
  48         else if (key_mgmt & WPA_KEY_MGMT_SAE)
  49                 sm->wpa_key_mgmt = WPA_KEY_MGMT_SAE;
  50 +#ifdef CONFIG_IEEE80211R_AP
  51         else if (key_mgmt & WPA_KEY_MGMT_FT_SAE)
  52                 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_SAE;
  53 +#endif /* CONFIG_IEEE80211R_AP */
  54  #endif /* CONFIG_SAE */
  55         else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X)
  56                 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X;