From: Jouni Malinen <j@w1.fi>
Date: Sat, 11 Nov 2023 21:44:52 +0000 (+0200)
Subject: SAE: Require PMKID match to PMKSA with SAE-EXT-KEY
X-Git-Tag: hostap_2_11~802
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=30748d2b3f16665ef4675c52e6e11804fa5d2bad;p=thirdparty%2Fhostap.git

SAE: Require PMKID match to PMKSA with SAE-EXT-KEY

This check was supposed to be done for all SAE cases other than FT
roaming.

Signed-off-by: Jouni Malinen <j@w1.fi>
---

diff --git a/src/ap/wpa_auth_ie.c b/src/ap/wpa_auth_ie.c
index 283b9a10f..a5f2861c9 100644
--- a/src/ap/wpa_auth_ie.c
+++ b/src/ap/wpa_auth_ie.c
@@ -1014,7 +1014,8 @@ wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
 	}
 
 #ifdef CONFIG_SAE
-	if (sm->wpa_key_mgmt == WPA_KEY_MGMT_SAE) {
+	if (sm->wpa_key_mgmt == WPA_KEY_MGMT_SAE ||
+	    sm->wpa_key_mgmt == WPA_KEY_MGMT_SAE_EXT_KEY) {
 		u64 drv_flags = 0;
 		u64 drv_flags2 = 0;
 		bool ap_sae_offload = false;