From: Jouni Malinen <j@w1.fi>
Date: Fri, 22 Sep 2017 08:52:55 +0000 (+0300)
Subject: FILS: Do not allow multiple (Re)Association Response frames
X-Git-Tag: hostap_2_7~1020
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e760851176c77ae6de19821bb1d5bf3ae2cb5187;p=thirdparty%2Fhostap.git

FILS: Do not allow multiple (Re)Association Response frames

The driver is expected to not report a second association event without
the station having explicitly request a new association. As such, this
case should not be reachable. However, since reconfiguring the same
pairwise or group keys to the driver could result in nonce reuse issues,
be extra careful here and do an additional state check to avoid this
even if the local driver ends up somehow accepting an unexpected
(Re)Association Response frame.

Signed-off-by: Jouni Malinen <j@w1.fi>
---

diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index fc6c4c83a..215834e33 100644
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -4068,6 +4068,12 @@ int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
 		return -1;
 	}
 
+	if (sm->fils_completed) {
+		wpa_printf(MSG_DEBUG,
+			   "FILS: Association has already been completed for this FILS authentication - ignore unexpected retransmission");
+		return -1;
+	}
+
 	wpa_hexdump(MSG_DEBUG, "FILS: (Re)Association Response frame",
 		    resp, len);