FT-SAE: Use PMK as XXKey in AP when SAE PMKSA caching is used

When connected using FT-SAE key mgmt, use PMK from PMKSA cache as XXKey
for PMK-R0 and PMK-R1 derivations. This fixes an issue where FT key
hierarchy could not be established due to missing (not yet configured)
XXKey when using SAE PMKSA caching for the initial mobility domain
association.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
index 0781068775e0cb5c388adf7aac823321eb0a15d3..616b20592caf68368aba4bbcffdb8a7cd1b473a7 100644 (file)
--- a/src/ap/wpa_auth.c
+++ b/src/ap/wpa_auth.c
@@ -2060,6 +2060,10 @@ SM_STATE(WPA_PTK, INITPSK)
                wpa_printf(MSG_DEBUG, "SAE: PMK from PMKSA cache");
                os_memcpy(sm->PMK, sm->pmksa->pmk, sm->pmksa->pmk_len);
                sm->pmk_len = sm->pmksa->pmk_len;
+#ifdef CONFIG_IEEE80211R_AP
+               os_memcpy(sm->xxkey, sm->pmksa->pmk, sm->pmksa->pmk_len);
+               sm->xxkey_len = sm->pmksa->pmk_len;
+#endif /* CONFIG_IEEE80211R_AP */
        }
 #endif /* CONFIG_SAE */
        sm->req_replay_counter_used = 0;