SAE: Do not reject reauth threshold passed PMKSA in association event

Do not reject reauth threshold passed PMKSA indicated in successful
association event since the PMKSA is still valid.

Additionally, remove the reauth threshold passed PMKSA entry from the
driver to prevent using it further in the driver.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>

diff --git a/src/rsn_supp/pmksa_cache.c b/src/rsn_supp/pmksa_cache.c
index ea83e76e6e52ba5e5dd645e4a3f96e86fb9e9a67..8dd770f386aad0b996885c53423dff482bd9dffd 100644 (file)
--- a/src/rsn_supp/pmksa_cache.c
+++ b/src/rsn_supp/pmksa_cache.c
@@ -611,12 +611,13 @@ void pmksa_cache_clear_current(struct wpa_sm *sm)
  * @network_ctx: Network configuration context
  * @try_opportunistic: Whether to allow opportunistic PMKSA caching
  * @fils_cache_id: Pointer to FILS Cache Identifier or %NULL if not used
+ * @associated: Whether the device is associated
  * Returns: 0 if PMKSA was found or -1 if no matching entry was found
  */
 int pmksa_cache_set_current(struct wpa_sm *sm, const u8 *pmkid,
                            const u8 *bssid, void *network_ctx,
                            int try_opportunistic, const u8 *fils_cache_id,
-                           int akmp)
+                           int akmp, bool associated)
 {
        struct rsn_pmksa_cache *pmksa = sm->pmksa;
        wpa_printf(MSG_DEBUG, "RSN: PMKSA cache search - network_ctx=%p "
@@ -654,13 +655,29 @@ int pmksa_cache_set_current(struct wpa_sm *sm, const u8 *pmkid,
                if (wpa_key_mgmt_sae(sm->cur_pmksa->akmp) &&
                    os_get_reltime(&now) == 0 &&
                    sm->cur_pmksa->reauth_time < now.sec) {
-                       wpa_printf(MSG_DEBUG,
-                                  "RSN: Do not allow PMKSA cache entry for "
-                                  MACSTR
-                                  " to be used for SAE since its reauth threshold has passed",
-                                  MAC2STR(sm->cur_pmksa->aa));
-                       sm->cur_pmksa = NULL;
-                       return -1;
+                       /* Driver-based roaming might have used a PMKSA entry
+                        * that is already past the reauthentication threshold.
+                        * Remove the related PMKID from the driver to avoid
+                        * further uses for this PMKSA, but allow the
+                        * association to continue since the PMKSA has not yet
+                        * expired. */
+                       wpa_sm_remove_pmkid(sm, sm->cur_pmksa->network_ctx,
+                                           sm->cur_pmksa->aa,
+                                           sm->cur_pmksa->pmkid, NULL);
+                       if (associated) {
+                               wpa_printf(MSG_DEBUG,
+                                          "RSN: Associated with " MACSTR
+                                          " using reauth threshold passed PMKSA cache entry",
+                                          MAC2STR(sm->cur_pmksa->aa));
+                       } else {
+                               wpa_printf(MSG_DEBUG,
+                                          "RSN: Do not allow PMKSA cache entry for "
+                                          MACSTR
+                                          " to be used for SAE since its reauth threshold has passed",
+                                          MAC2STR(sm->cur_pmksa->aa));
+                               sm->cur_pmksa = NULL;
+                               return -1;
+                       }
                }
 
                wpa_hexdump(MSG_DEBUG, "RSN: PMKSA cache entry found - PMKID",

diff --git a/src/rsn_supp/pmksa_cache.h b/src/rsn_supp/pmksa_cache.h
index 48c9e0465b30dfb2be230a090336eba989b05bce..37c116282d60a39f48f4c141222a77d49ef807ae 100644 (file)
--- a/src/rsn_supp/pmksa_cache.h
+++ b/src/rsn_supp/pmksa_cache.h
@@ -86,7 +86,7 @@ void pmksa_cache_clear_current(struct wpa_sm *sm);
 int pmksa_cache_set_current(struct wpa_sm *sm, const u8 *pmkid,
                            const u8 *bssid, void *network_ctx,
                            int try_opportunistic, const u8 *fils_cache_id,
-                           int akmp);
+                           int akmp, bool associated);
 struct rsn_pmksa_cache_entry *
 pmksa_cache_get_opportunistic(struct rsn_pmksa_cache *pmksa,
                              void *network_ctx, const u8 *aa, int akmp);
@@ -164,7 +164,7 @@ static inline int pmksa_cache_set_current(struct wpa_sm *sm, const u8 *pmkid,
                                          void *network_ctx,
                                          int try_opportunistic,
                                          const u8 *fils_cache_id,
-                                         int akmp)
+                                         int akmp, bool associated)
 {
        return -1;
 }

diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 32cf24c795534eba674f16bfcd590b3b709f0589..f205b91d5ed0f620fb8d2752d98f81c5d5470921 100644 (file)
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -426,7 +426,8 @@ static void wpa_find_assoc_pmkid(struct wpa_supplicant *wpa_s, bool authorized)
        for (i = 0; i < ie.num_pmkid; i++) {
                pmksa_set = pmksa_cache_set_current(wpa_s->wpa,
                                                    ie.pmkid + i * PMKID_LEN,
-                                                   NULL, NULL, 0, NULL, 0);
+                                                   NULL, NULL, 0, NULL, 0,
+                                                   true);
                if (pmksa_set == 0) {
                        eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
                        if (authorized)
@@ -5025,7 +5026,7 @@ static void wpa_supplicant_event_assoc_auth(struct wpa_supplicant *wpa_s,
                        /* Update the current PMKSA used for this connection */
                        pmksa_cache_set_current(wpa_s->wpa,
                                                data->assoc_info.fils_pmkid,
-                                               NULL, NULL, 0, NULL, 0);
+                                               NULL, NULL, 0, NULL, 0, true);
                }
        }
 #endif /* CONFIG_FILS */

diff --git a/wpa_supplicant/preauth_test.c b/wpa_supplicant/preauth_test.c
index 3aa667525cef1144571299e4538f15050a199380..f266ce4f409ac53d5c62a8cc4d902115db9ffaf6 100644 (file)
--- a/wpa_supplicant/preauth_test.c
+++ b/wpa_supplicant/preauth_test.c
@@ -357,7 +357,7 @@ int main(int argc, char *argv[])
                ret = -2;
        else {
                ret = pmksa_cache_set_current(wpa_s.wpa, NULL, bssid, NULL, 0,
-                                             NULL, 0) ? 0 : -3;
+                                             NULL, 0, false) ? 0 : -3;
        }
 
        test_eapol_clean(&wpa_s);

diff --git a/wpa_supplicant/sme.c b/wpa_supplicant/sme.c
index 4ed0a3003ff42f324208ee5d9568ee5e3d2585f8..bb04652f558e3b95c930d1eff44dcab0220e0ae2 100644 (file)
--- a/wpa_supplicant/sme.c
+++ b/wpa_supplicant/sme.c
@@ -731,7 +731,7 @@ static void sme_send_authentication(struct wpa_supplicant *wpa_s,
                                            bss->bssid,
                                            wpa_s->current_ssid,
                                            try_opportunistic, cache_id,
-                                           0) == 0)
+                                           0, false) == 0)
                        eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
                wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
                if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
@@ -1037,7 +1037,7 @@ static void sme_send_authentication(struct wpa_supplicant *wpa_s,
                                    NULL,
                                    wpa_key_mgmt_sae(wpa_s->key_mgmt) ?
                                    wpa_s->key_mgmt :
-                                   (int) WPA_KEY_MGMT_SAE) == 0) {
+                                   (int) WPA_KEY_MGMT_SAE, false) == 0) {
                wpa_dbg(wpa_s, MSG_DEBUG,
                        "PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
                wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
@@ -1135,7 +1135,7 @@ static void sme_send_authentication(struct wpa_supplicant *wpa_s,
                                            bss->bssid,
                                            ssid, 0,
                                            wpa_bss_get_fils_cache_id(bss),
-                                           0) == 0)
+                                           0, false) == 0)
                        wpa_printf(MSG_DEBUG,
                                   "SME: Try to use FILS with PMKSA caching");
                resp = fils_build_auth(wpa_s->wpa, ssid->fils_dh_group, md);

diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 94f549b6e7ae7fe311b3983506fa806e0fdd7500..69f228919df84845ee68bc7541809d0f2151d701 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -3310,7 +3310,7 @@ static u8 * wpas_populate_assoc_ies(
 #endif /* CONFIG_FILS */
                if (pmksa_cache_set_current(wpa_s->wpa, NULL, addr,
                                            ssid, try_opportunistic,
-                                           cache_id, 0) == 0) {
+                                           cache_id, 0, false) == 0) {
                        eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
 #if defined(CONFIG_SAE) || defined(CONFIG_FILS)
                        pmksa_cached = 1;