SAE-PK: Advertise RSNXE capability bit in STA mode

Set the SAE-PK capability bit in RSNXE when sending out (Re)Association
Request frame for a network profile that allows use of SAE-PK.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index 0ae73e8f39469b2099ca8f680e5d4925c311eaa0..63171021f7f22ecb16e28640b1bf3d419bdab45d 100644 (file)
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -3289,6 +3289,9 @@ int wpa_sm_set_param(struct wpa_sm *sm, enum wpa_sm_conf_params param,
        case WPA_PARAM_SAE_PWE:
                sm->sae_pwe = value;
                break;
+       case WPA_PARAM_SAE_PK:
+               sm->sae_pk = value;
+               break;
        case WPA_PARAM_DENY_PTK0_REKEY:
                sm->wpa_deny_ptk0_rekey = value;
                break;

diff --git a/src/rsn_supp/wpa.h b/src/rsn_supp/wpa.h
index a4512eadc26553d74c01ffd9e4b1862d717c9f25..36a17df3dd05daa1838a5bc2a8ba078b170666b4 100644 (file)
--- a/src/rsn_supp/wpa.h
+++ b/src/rsn_supp/wpa.h
@@ -103,6 +103,7 @@ enum wpa_sm_conf_params {
        WPA_PARAM_MFP,
        WPA_PARAM_OCV,
        WPA_PARAM_SAE_PWE,
+       WPA_PARAM_SAE_PK,
        WPA_PARAM_DENY_PTK0_REKEY,
        WPA_PARAM_EXT_KEY_ID,
        WPA_PARAM_USE_EXT_KEY_ID,

diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
index b2b43f4f07d0c52534e9360bc3f859c3c0463d3a..8d7a7a93a84a947f685dd663222ddfea8fd9c955 100644 (file)
--- a/src/rsn_supp/wpa_i.h
+++ b/src/rsn_supp/wpa_i.h
@@ -95,6 +95,7 @@ struct wpa_sm {
        int mfp; /* 0 = disabled, 1 = optional, 2 = mandatory */
        int ocv; /* Operating Channel Validation */
        int sae_pwe; /* SAE PWE generation options */
+       int sae_pk; /* whether SAE-PK is used */
 
        u8 *assoc_wpa_ie; /* Own WPA/RSN IE from (Re)AssocReq */
        size_t assoc_wpa_ie_len;

diff --git a/src/rsn_supp/wpa_ie.c b/src/rsn_supp/wpa_ie.c
index 9068781b1f9a280b16212d819bb376fcaea1f15e..20fdd6987f23ede9b71438a39ea0e6879aae7335 100644 (file)
--- a/src/rsn_supp/wpa_ie.c
+++ b/src/rsn_supp/wpa_ie.c
@@ -357,7 +357,7 @@ int wpa_gen_rsnxe(struct wpa_sm *sm, u8 *rsnxe, size_t rsnxe_len)
 
        if (!wpa_key_mgmt_sae(sm->key_mgmt))
                return 0; /* SAE not in use */
-       if (sm->sae_pwe != 1 && sm->sae_pwe != 2)
+       if (sm->sae_pwe != 1 && sm->sae_pwe != 2 && !sm->sae_pk)
                return 0; /* no supported extended RSN capabilities */
 
        if (rsnxe_len < 3)
@@ -367,7 +367,12 @@ int wpa_gen_rsnxe(struct wpa_sm *sm, u8 *rsnxe, size_t rsnxe_len)
        *pos++ = 1;
        /* bits 0-3 = 0 since only one octet of Extended RSN Capabilities is
         * used for now */
-       *pos++ = BIT(WLAN_RSNX_CAPAB_SAE_H2E);
+       *pos = BIT(WLAN_RSNX_CAPAB_SAE_H2E);
+#ifdef CONFIG_SAE_PK
+       if (sm->sae_pk)
+               *pos |= BIT(WLAN_RSNX_CAPAB_SAE_PK);
+#endif /* CONFIG_SAE_PK */
+       pos++;
 
        return pos - rsnxe;
 }

diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index f5a4c360b6a41392b872ac69201dbb1b6a365d4c..4c1daf1fab9eb48de1af6df45615cb4d329021ee 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -1639,6 +1639,13 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
        if (ssid->sae_password_id && sae_pwe != 3)
                sae_pwe = 1;
        wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_SAE_PWE, sae_pwe);
+#ifdef CONFIG_SAE_PK
+       wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_SAE_PK,
+                        wpa_key_mgmt_sae(ssid->key_mgmt) &&
+                        ssid->sae_pk != SAE_PK_MODE_DISABLED &&
+                        ssid->sae_password &&
+                        sae_pk_valid_password(ssid->sae_password));
+#endif /* CONFIG_SAE_PK */
 #ifdef CONFIG_TESTING_OPTIONS
        wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_FT_RSNXE_USED,
                         wpa_s->ft_rsnxe_used);