SAE: Fix PMKID derivation for OKC

SAE authentication derives PMKID differently from the EAP cases. The
value comes from information exchanged during SAE authentication and
does not bind in the MAC addresses of the STAs. As such, the same PMKID
is used with different BSSIDs. Fix both the hostapd and wpa_supplicant
to use the previous PMKID as is for OKC instead of deriving a new PMKID
using an incorrect derivation method when using an SAE AKM.

This fixes use of opportunistic key caching with SAE.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/src/ap/pmksa_cache_auth.c b/src/ap/pmksa_cache_auth.c
index 15e2c4943f2bd105dc17ab3140e7b447abd947c5..fe5f8171754b902d8b62855d3bd3b878b04b5307 100644 (file)
--- a/src/ap/pmksa_cache_auth.c
+++ b/src/ap/pmksa_cache_auth.c
@@ -516,6 +516,11 @@ struct rsn_pmksa_cache_entry * pmksa_cache_get_okc(
        for (entry = pmksa->pmksa; entry; entry = entry->next) {
                if (os_memcmp(entry->spa, spa, ETH_ALEN) != 0)
                        continue;
+               if (wpa_key_mgmt_sae(entry->akmp)) {
+                       if (os_memcmp(entry->pmkid, pmkid, PMKID_LEN) == 0)
+                               return entry;
+                       continue;
+               }
                rsn_pmkid(entry->pmk, entry->pmk_len, aa, spa, new_pmkid,
                          entry->akmp);
                if (os_memcmp(new_pmkid, pmkid, PMKID_LEN) == 0)

diff --git a/src/rsn_supp/pmksa_cache.c b/src/rsn_supp/pmksa_cache.c
index cd4b0508f2338f05ef7c82ac7278379d0fbf6730..862fdec026d2babcc2933804b874fb210b480b2f 100644 (file)
--- a/src/rsn_supp/pmksa_cache.c
+++ b/src/rsn_supp/pmksa_cache.c
@@ -371,9 +371,12 @@ pmksa_cache_clone_entry(struct rsn_pmksa_cache *pmksa,
 {
        struct rsn_pmksa_cache_entry *new_entry;
        os_time_t old_expiration = old_entry->expiration;
+       const u8 *pmkid = NULL;
 
+       if (wpa_key_mgmt_sae(old_entry->akmp))
+               pmkid = old_entry->pmkid;
        new_entry = pmksa_cache_add(pmksa, old_entry->pmk, old_entry->pmk_len,
-                                   NULL, NULL, 0,
+                                   pmkid, NULL, 0,
                                    aa, pmksa->sm->own_addr,
                                    old_entry->network_ctx, old_entry->akmp,
                                    old_entry->fils_cache_id_set ?