FT: Omit RSNXE from FT protocol Reassociation Request when needed

The previous design for adding RSNXE into FT was not backwards
compatible. Move to a new design based on 20/332r3 to avoid that issue
by not include RSNXE in the FT protocol Reassociation Request frame so
that an AP not supporting RSNXE can still validate the FTE MIC
correctly.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c
index ab73e311c13852d354b195c6a74b63becdb02081..6d92de5a6d9b254e652bdd93f9d8f5d1e774d8f7 100644 (file)
--- a/src/rsn_supp/wpa_ft.c
+++ b/src/rsn_supp/wpa_ft.c
@@ -162,6 +162,7 @@ int wpa_sm_set_ft_params(struct wpa_sm *sm, const u8 *ies, size_t ies_len)
  * @ric_ies: Optional IE(s), e.g., WMM TSPEC(s), for RIC-Request or %NULL
  * @ric_ies_len: Length of ric_ies buffer in octets
  * @ap_mdie: Mobility Domain IE from the target AP
+ * @omit_rsnxe: Whether RSNXE is omitted from Reassociation Request frame
  * Returns: Pointer to buffer with IEs or %NULL on failure
  *
  * Caller is responsible for freeing the returned buffer with os_free();
@@ -171,7 +172,7 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len,
                               const u8 *kck, size_t kck_len,
                               const u8 *target_ap,
                               const u8 *ric_ies, size_t ric_ies_len,
-                              const u8 *ap_mdie)
+                              const u8 *ap_mdie, int omit_rsnxe)
 {
        size_t buf_len;
        u8 *buf, *pos, *ftie_len, *ftie_pos, *fte_mic, *elem_count;
@@ -375,12 +376,16 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len,
                pos += ric_ies_len;
        }
 
-       res = wpa_gen_rsnxe(sm, rsnxe, sizeof(rsnxe));
-       if (res < 0) {
-               os_free(buf);
-               return NULL;
+       if (omit_rsnxe) {
+               rsnxe_len = 0;
+       } else {
+               res = wpa_gen_rsnxe(sm, rsnxe, sizeof(rsnxe));
+               if (res < 0) {
+                       os_free(buf);
+                       return NULL;
+               }
+               rsnxe_len = res;
        }
-       rsnxe_len = res;
 
        if (kck) {
                /*
@@ -463,7 +468,7 @@ int wpa_ft_prepare_auth_request(struct wpa_sm *sm, const u8 *mdie)
        }
 
        ft_ies = wpa_ft_gen_req_ies(sm, &ft_ies_len, NULL, sm->pmk_r0_name,
-                                   NULL, 0, sm->bssid, NULL, 0, mdie);
+                                   NULL, 0, sm->bssid, NULL, 0, mdie, 0);
        if (ft_ies) {
                wpa_sm_update_ft_ies(sm, sm->mobility_domain,
                                     ft_ies, ft_ies_len);
@@ -659,7 +664,8 @@ int wpa_ft_process_response(struct wpa_sm *sm, const u8 *ies, size_t ies_len,
                                    sm->pmk_r1_name,
                                    kck, kck_len, bssid,
                                    ric_ies, ric_ies_len,
-                                   parse.mdie ? parse.mdie - 2 : NULL);
+                                   parse.mdie ? parse.mdie - 2 : NULL,
+                                   !sm->ap_rsnxe);
        if (ft_ies) {
                wpa_sm_update_ft_ies(sm, sm->mobility_domain,
                                     ft_ies, ft_ies_len);
@@ -1220,7 +1226,7 @@ int wpa_ft_start_over_ds(struct wpa_sm *sm, const u8 *target_ap,
        }
 
        ft_ies = wpa_ft_gen_req_ies(sm, &ft_ies_len, NULL, sm->pmk_r0_name,
-                                   NULL, 0, target_ap, NULL, 0, mdie);
+                                   NULL, 0, target_ap, NULL, 0, mdie, 0);
        if (ft_ies) {
                sm->over_the_ds_in_progress = 1;
                os_memcpy(sm->target_ap, target_ap, ETH_ALEN);

diff --git a/wpa_supplicant/sme.c b/wpa_supplicant/sme.c
index d4c12d1e32e041ac8283aac7c8a63db3d0543f74..f7792ec9629e07513153f7b798ad410f47b87d08 100644 (file)
--- a/wpa_supplicant/sme.c
+++ b/wpa_supplicant/sme.c
@@ -299,6 +299,7 @@ static void sme_send_authentication(struct wpa_supplicant *wpa_s,
 #ifdef CONFIG_MBO
        const u8 *mbo_ie;
 #endif /* CONFIG_MBO */
+       int omit_rsnxe = 0;
 
        if (bss == NULL) {
                wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
@@ -506,6 +507,7 @@ static void sme_send_authentication(struct wpa_supplicant *wpa_s,
                wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
                        md[0], md[1]);
 
+               omit_rsnxe = !wpa_bss_get_ie(bss, WLAN_EID_RSNX);
                if (wpa_s->sme.assoc_req_ie_len + 5 <
                    sizeof(wpa_s->sme.assoc_req_ie)) {
                        struct rsn_mdie *mdie;
@@ -614,7 +616,8 @@ static void sme_send_authentication(struct wpa_supplicant *wpa_s,
 #endif /* CONFIG_TESTING_OPTIONS */
        if (wpa_s->rsnxe_len > 0 &&
            wpa_s->rsnxe_len <=
-           sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len) {
+           sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len &&
+           !omit_rsnxe) {
                os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
                          wpa_s->rsnxe, wpa_s->rsnxe_len);
                wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;