GAS client: Make PMF check on RX more consistent

Use the SA field instead of BSSID in the received Action frame to
determine whether PMF has been negotiated with the transmitter. While
these fields are supposed to be same for Public Action frames from an
AP, it would be possible that a frame is received with different values.
The following operations in gas_query_rx() use SA, so do the same for
the PMF check.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/gas_query.c b/wpa_supplicant/gas_query.c
index 457f5fb647d3c6397e75b6133502b20a6f9012b4..4f0d0e62238e8c7218fb981c225d95ec3172994c 100644 (file)
--- a/wpa_supplicant/gas_query.c
+++ b/wpa_supplicant/gas_query.c
@@ -501,7 +501,7 @@ int gas_query_rx(struct gas_query *gas, const u8 *da, const u8 *sa,
                return -1;
 
        prot = categ == WLAN_ACTION_PROTECTED_DUAL;
-       pmf = pmf_in_use(gas->wpa_s, bssid);
+       pmf = pmf_in_use(gas->wpa_s, sa);
        if (prot && !pmf) {
                wpa_printf(MSG_DEBUG, "GAS: Drop unexpected protected GAS frame when PMF is disabled");
                return 0;