FILS: Do not allow multiple (Re)Association Response frames

The driver is expected to not report a second association event without
the station having explicitly request a new association. As such, this
case should not be reachable. However, since reconfiguring the same
pairwise or group keys to the driver could result in nonce reuse issues,
be extra careful here and do an additional state check to avoid this
even if the local driver ends up somehow accepting an unexpected
(Re)Association Response frame.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index fc6c4c83ac0bb7bdf47227c20219102ea0aaba86..215834e33e7b43b3d8fd5f0c43f4149152755ce5 100644 (file)
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -4068,6 +4068,12 @@ int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
                return -1;
        }
 
+       if (sm->fils_completed) {
+               wpa_printf(MSG_DEBUG,
+                          "FILS: Association has already been completed for this FILS authentication - ignore unexpected retransmission");
+               return -1;
+       }
+
        wpa_hexdump(MSG_DEBUG, "FILS: (Re)Association Response frame",
                    resp, len);