From: Mike Siedzik Date: Tue, 20 Feb 2018 19:28:32 +0000 (-0500) Subject: mka: Ignore MACsec SAK Use Old Key parameter if we don't have our old key X-Git-Tag: hostap_2_7~527 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8fb546d8e608f436b354afb82409dfbc6daa8278;p=thirdparty%2Fhostap.git mka: Ignore MACsec SAK Use Old Key parameter if we don't have our old key Upon receipt of the "MACsec MKPDU SAK Use parameter set" the KaY verifies that both the latest key and the old key are valid. If the local system reboots or is reinitialized, the KaY won't have a copy of its old key. Therefore if the KaY does not have a copy of its old key it should not reject MKPDUs that contain old key data in the MACsec SAK Use parameter. Signed-off-by: Michael Siedzik --- diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c index 857c282a8..94d6046ea 100644 --- a/src/pae/ieee802_1x_kay.c +++ b/src/pae/ieee802_1x_kay.c @@ -1343,8 +1343,8 @@ ieee802_1x_mka_decode_sak_use_body( } } - /* check old key is valid */ - if (body->otx || body->orx) { + /* check old key is valid (but only if we remember our old key) */ + if (participant->oki.kn != 0 && (body->otx || body->orx)) { if (os_memcmp(participant->oki.mi, body->osrv_mi, sizeof(participant->oki.mi)) != 0 || be_to_host32(body->okn) != participant->oki.kn ||