FT: Reject over-the-DS response with MFPC=0 if PMF is required

If FT over-the-DS case is enforced through the "FT_DS <BSSID>" control
interface command, the PMF capability check during BSS selection is not
used and that could have allowed PMF to be disabled in the over-the-DS
case even if the local network profile mandated use of PMF. Check
against this explicitly to avoid unexpected cases if the APs within the
same mobility domain are not configured consistently.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/src/common/wpa_common.c b/src/common/wpa_common.c
index 4c4b8999220e63085a8df1cf4d066bdb8a9c0a62..a7569580f64a1e18730345a6da7d483306c83b3e 100644 (file)
--- a/src/common/wpa_common.c
+++ b/src/common/wpa_common.c
@@ -958,6 +958,7 @@ int wpa_ft_parse_ies(const u8 *ies, size_t ies_len,
                                           "RSN IE: %d", ret);
                                return -1;
                        }
+                       parse->rsn_capab = data.capabilities;
                        if (data.num_pmkid == 1 && data.pmkid)
                                parse->rsn_pmkid = data.pmkid;
                        parse->key_mgmt = data.key_mgmt;

diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h
index e83d6887a1cd51c5ef897766ba36b23b7bc41082..cb511ff0b0fb330e44c915af9e525f2f976c98b4 100644 (file)
--- a/src/common/wpa_common.h
+++ b/src/common/wpa_common.h
@@ -453,6 +453,7 @@ struct wpa_ft_ies {
        size_t r0kh_id_len;
        const u8 *rsn;
        size_t rsn_len;
+       u16 rsn_capab;
        const u8 *rsn_pmkid;
        const u8 *tie;
        size_t tie_len;

diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c
index 7e8b523e49218a7368d227cbdff42f8502f0bd0f..f698ff4eb9436267fff5487ef294a2da33125239 100644 (file)
--- a/src/rsn_supp/wpa_ft.c
+++ b/src/rsn_supp/wpa_ft.c
@@ -597,6 +597,14 @@ int wpa_ft_process_response(struct wpa_sm *sm, const u8 *ies, size_t ies_len,
                return -1;
        }
 
+#ifdef CONFIG_IEEE80211W
+       if (sm->mfp == 2 && !(parse.rsn_capab & WPA_CAPABILITY_MFPC)) {
+               wpa_printf(MSG_INFO,
+                          "FT: Target AP does not support PMF, but local configuration requires that");
+               return -1;
+       }
+#endif /* CONFIG_IEEE80211W */
+
        os_memcpy(sm->r1kh_id, parse.r1kh_id, FT_R1KH_ID_LEN);
        wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID", sm->r1kh_id, FT_R1KH_ID_LEN);
        wpa_hexdump(MSG_DEBUG, "FT: SNonce", sm->snonce, WPA_NONCE_LEN);