]> git.ipfire.org Git - thirdparty/hostap.git/commit
STA: Allow PTK rekeying without Ext KeyID to be disabled as a workaround
authorAlexander Wetzel <alexander@wetzel-home.de>
Fri, 10 Jan 2020 22:19:09 +0000 (23:19 +0100)
committerJouni Malinen <j@w1.fi>
Sun, 23 Feb 2020 11:05:19 +0000 (13:05 +0200)
commit1f90a49d028debceb748ab91b7685ae774451e8f
tree039a94724d640b46232122ec7a9d311fe665be7f
parent1a7963e36fa67b865fd1486ce863e612e6b6a052
STA: Allow PTK rekeying without Ext KeyID to be disabled as a workaround

Rekeying a pairwise key using only keyid 0 (PTK0 rekey) has many broken
implementations and should be avoided when using or interacting with
one. The effects can be triggered by either end of the connection and
range from hardly noticeable disconnects over long connection freezes up
to leaking clear text MPDUs.

To allow affected users to mitigate the issues, add a new configuration
option "wpa_deny_ptk0_rekey" to replace all PTK0 rekeys with fast
reconnects.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
18 files changed:
src/eapol_supp/eapol_supp_sm.c
src/eapol_supp/eapol_supp_sm.h
src/rsn_supp/wpa.c
src/rsn_supp/wpa.h
src/rsn_supp/wpa_i.h
wpa_supplicant/ap.c
wpa_supplicant/config.c
wpa_supplicant/config_file.c
wpa_supplicant/config_ssid.h
wpa_supplicant/ctrl_iface.c
wpa_supplicant/events.c
wpa_supplicant/ibss_rsn.c
wpa_supplicant/preauth_test.c
wpa_supplicant/wpa_cli.c
wpa_supplicant/wpa_supplicant.c
wpa_supplicant/wpa_supplicant.conf
wpa_supplicant/wpa_supplicant_i.h
wpa_supplicant/wpas_glue.c