mka: Ignore MACsec SAK Use Old Key parameter if we don't have our old key

Upon receipt of the "MACsec MKPDU SAK Use parameter set" the KaY verifies
that both the latest key and the old key are valid. If the local system
reboots or is reinitialized, the KaY won't have a copy of its old key.
Therefore if the KaY does not have a copy of its old key it should not
reject MKPDUs that contain old key data in the MACsec SAK Use parameter.

Signed-off-by: Michael Siedzik <msiedzik@extremenetworks.com>

diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c
index 857c282a8a31a1a696cf87dbfc1c590362adf938..94d6046eadc49afbea77f9fdbbaeca57a082f264 100644 (file)
--- a/src/pae/ieee802_1x_kay.c
+++ b/src/pae/ieee802_1x_kay.c
@@ -1343,8 +1343,8 @@ ieee802_1x_mka_decode_sak_use_body(
                }
        }
 
-       /* check old key is valid */
-       if (body->otx || body->orx) {
+       /* check old key is valid (but only if we remember our old key) */
+       if (participant->oki.kn != 0 && (body->otx || body->orx)) {
                if (os_memcmp(participant->oki.mi, body->osrv_mi,
                              sizeof(participant->oki.mi)) != 0 ||
                    be_to_host32(body->okn) != participant->oki.kn ||