Allow RSNXE to be removed from Beacon frames for testing purposes

The new hostapd configuration parameter no_beacon_rsnxe=1 can be used to
remove RSNXE from Beacon frames. This can be used to test protection
mechanisms for downgrade attacks.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index 1a5b742b2543f577d8853d2c0120263accb963c5..3c7bb395f9bdd4f3d75cd76af167c7cc8492f550 100644 (file)
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -4194,6 +4194,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
        } else if (os_strcmp(buf, "igtk_rsc_override") == 0) {
                wpabuf_free(bss->igtk_rsc_override);
                bss->igtk_rsc_override = wpabuf_parse_bin(pos);
+       } else if (os_strcmp(buf, "no_beacon_rsnxe") == 0) {
+               bss->no_beacon_rsnxe = atoi(pos);
 #endif /* CONFIG_TESTING_OPTIONS */
 #ifdef CONFIG_SAE
        } else if (os_strcmp(buf, "sae_password") == 0) {

diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
index 0cb10c118264a59ab8cddf02b7463d3fa8bd4e66..80be7ed3908746fd78317d5c58b4be34afe7c75b 100644 (file)
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -683,6 +683,7 @@ struct hostapd_bss_config {
        struct wpabuf *rsnxe_override_ft;
        struct wpabuf *gtk_rsc_override;
        struct wpabuf *igtk_rsc_override;
+       int no_beacon_rsnxe;
 #endif /* CONFIG_TESTING_OPTIONS */
 
 #define MESH_ENABLED BIT(0)

diff --git a/src/ap/beacon.c b/src/ap/beacon.c
index 53e35492d7804ad243fa2bed4d8f8e72d96ed4fc..ff760a0d1a9e772ace6f4da02f7f9b99ea96634c 100644 (file)
--- a/src/ap/beacon.c
+++ b/src/ap/beacon.c
@@ -323,6 +323,12 @@ static u8 * hostapd_get_rsnxe(struct hostapd_data *hapd, u8 *pos, size_t len)
 {
        const u8 *ie;
 
+#ifdef CONFIG_TESTING_OPTIONS
+       if (hapd->conf->no_beacon_rsnxe) {
+               wpa_printf(MSG_INFO, "TESTING: Do not add RSNXE into Beacon");
+               return pos;
+       }
+#endif /* CONFIG_TESTING_OPTIONS */
        ie = hostapd_wpa_ie(hapd, WLAN_EID_RSNX);
        if (!ie || 2U + ie[1] > len)
                return pos;