Fix OKC-based PMKSA cache entry clearing

Commit c3fea272747f738f5723fc577371fe03711d988f added a call to clear
all other PMKSA cache entries for the same network if the PMKSA cache
entry of the current AP changed. This was needed to fix OKC cases since
the other APs would likely use the new PMK in the future. However, this
ended up clearing entries in cases where that is not desired and this
resulted in needing additional full EAP authentication with networks
that did not support OKC if wpa_supplicant was configured to try to use
it.

Make PMKSA cache entry flushing more limited so that the other entries
are removed only if they used the old PMK that was replaced for the
current AP and only if that PMK had previously been used successfully
(i.e., opportunistic flag was already cleared back to 0 in
wpa_supplicant_key_neg_complete()). This is still enough to fix the
issue described in that older commit while not causing problems for
standard PMKSA caching operations even if OKC is enabled in
wpa_supplicant configuration.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/src/rsn_supp/pmksa_cache.c b/src/rsn_supp/pmksa_cache.c
index df675834c6f482dd09776cfc9906b004db2aaa00..93056ea8e314d3b729222d69718b38cb56bc5c9e 100644 (file)
--- a/src/rsn_supp/pmksa_cache.c
+++ b/src/rsn_supp/pmksa_cache.c
@@ -164,17 +164,23 @@ pmksa_cache_add(struct rsn_pmksa_cache *pmksa, const u8 *pmk, size_t pmk_len,
                                pmksa->pmksa = pos->next;
                        else
                                prev->next = pos->next;
-                       wpa_printf(MSG_DEBUG, "RSN: Replace PMKSA entry for "
-                                  "the current AP");
-                       pmksa_cache_free_entry(pmksa, pos, PMKSA_REPLACE);
 
                        /*
                         * If OKC is used, there may be other PMKSA cache
                         * entries based on the same PMK. These needs to be
                         * flushed so that a new entry can be created based on
-                        * the new PMK.
+                        * the new PMK. Only clear other entries if they have a
+                        * matching PMK and this PMK has been used successfully
+                        * with the current AP, i.e., if opportunistic flag has
+                        * been cleared in wpa_supplicant_key_neg_complete().
                         */
-                       pmksa_cache_flush(pmksa, network_ctx);
+                       wpa_printf(MSG_DEBUG, "RSN: Replace PMKSA entry for "
+                                  "the current AP and any PMKSA cache entry "
+                                  "that was based on the old PMK");
+                       if (!pos->opportunistic)
+                               pmksa_cache_flush(pmksa, network_ctx, pos->pmk,
+                                                 pos->pmk_len);
+                       pmksa_cache_free_entry(pmksa, pos, PMKSA_REPLACE);
                        break;
                }
                prev = pos;
@@ -235,15 +241,22 @@ pmksa_cache_add(struct rsn_pmksa_cache *pmksa, const u8 *pmk, size_t pmk_len,
  * pmksa_cache_flush - Flush PMKSA cache entries for a specific network
  * @pmksa: Pointer to PMKSA cache data from pmksa_cache_init()
  * @network_ctx: Network configuration context or %NULL to flush all entries
+ * @pmk: PMK to match for or %NYLL to match all PMKs
+ * @pmk_len: PMK length
  */
-void pmksa_cache_flush(struct rsn_pmksa_cache *pmksa, void *network_ctx)
+void pmksa_cache_flush(struct rsn_pmksa_cache *pmksa, void *network_ctx,
+                      const u8 *pmk, size_t pmk_len)
 {
        struct rsn_pmksa_cache_entry *entry, *prev = NULL, *tmp;
        int removed = 0;
 
        entry = pmksa->pmksa;
        while (entry) {
-               if (entry->network_ctx == network_ctx || network_ctx == NULL) {
+               if ((entry->network_ctx == network_ctx ||
+                    network_ctx == NULL) &&
+                   (pmk == NULL ||
+                    (pmk_len == entry->pmk_len &&
+                     os_memcmp(pmk, entry->pmk, pmk_len) == 0))) {
                        wpa_printf(MSG_DEBUG, "RSN: Flush PMKSA cache entry "
                                   "for " MACSTR, MAC2STR(entry->aa));
                        if (prev)

diff --git a/src/rsn_supp/pmksa_cache.h b/src/rsn_supp/pmksa_cache.h
index 6f3dfb3196ce3671e5f9424848f1f5b0cad97be7..d5aa229a4b809943d627c0d190d04244c20b776f 100644 (file)
--- a/src/rsn_supp/pmksa_cache.h
+++ b/src/rsn_supp/pmksa_cache.h
@@ -66,7 +66,8 @@ int pmksa_cache_set_current(struct wpa_sm *sm, const u8 *pmkid,
 struct rsn_pmksa_cache_entry *
 pmksa_cache_get_opportunistic(struct rsn_pmksa_cache *pmksa,
                              void *network_ctx, const u8 *aa);
-void pmksa_cache_flush(struct rsn_pmksa_cache *pmksa, void *network_ctx);
+void pmksa_cache_flush(struct rsn_pmksa_cache *pmksa, void *network_ctx,
+                      const u8 *pmk, size_t pmk_len);
 
 #else /* IEEE8021X_EAPOL and !CONFIG_NO_WPA2 */
 

diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index e50404ce78a79d4137ce16faa4d558b4178642b9..365a710ec41ee6360e288ee9765bb065c0bf24fb 100644 (file)
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -2622,7 +2622,7 @@ void wpa_sm_update_replay_ctr(struct wpa_sm *sm, const u8 *replay_ctr)
 void wpa_sm_pmksa_cache_flush(struct wpa_sm *sm, void *network_ctx)
 {
 #ifndef CONFIG_NO_WPA2
-       pmksa_cache_flush(sm->pmksa, network_ctx);
+       pmksa_cache_flush(sm->pmksa, network_ctx, NULL, 0);
 #endif /* CONFIG_NO_WPA2 */
 }