diff mbox series

AP: guard FT-SAE code with CONFIG_IEEE80211R_AP

Message ID 20220404071312.99989-1-bgalvani@redhat.com
State Changes Requested
Headers show
Series AP: guard FT-SAE code with CONFIG_IEEE80211R_AP | expand

Commit Message

Beniamino Galvani April 4, 2022, 7:13 a.m. UTC 
wpa_supplicant doesn't support FT in AP mode, but it still negotiates
FT-SAE. This can lead to an authentication failure when the AP is
started with key_mgmt="SAE FT-SAE" and the STA supports both.

Ensure that FT-SAE is not negotiated when CONFIG_IEEE80211R_AP is not
defined.

Signed-off-by: Beniamino Galvani <bgalvani@redhat.com>
---
 src/ap/wpa_auth_ie.c | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

Jouni Malinen April 6, 2022, 8:21 p.m. UTC | #1 
On Mon, Apr 04, 2022 at 09:13:12AM +0200, Beniamino Galvani wrote:
> wpa_supplicant doesn't support FT in AP mode, but it still negotiates
> FT-SAE. This can lead to an authentication failure when the AP is
> started with key_mgmt="SAE FT-SAE" and the STA supports both.
> 
> Ensure that FT-SAE is not negotiated when CONFIG_IEEE80211R_AP is not
> defined.

This sounds like hiding the problem with invalid configuration instead
of addressing that more explicitly. Wouldn't it be better to refuse to
start the AP mode operation if it is configured with unsupported
key_mgmt value? I'm not keen on having the configuration indicate
something is enabled when it is actually not in practice.
diff mbox series

Patch

diff --git a/src/ap/wpa_auth_ie.c b/src/ap/wpa_auth_ie.c
index 524922e4e..d63cbeb92 100644
--- a/src/ap/wpa_auth_ie.c
+++ b/src/ap/wpa_auth_ie.c
@@ -228,11 +228,13 @@  int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len,
 		pos += RSN_SELECTOR_LEN;
 		num_suites++;
 	}
+#ifdef CONFIG_IEEE80211R_AP
 	if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_SAE) {
 		RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_SAE);
 		pos += RSN_SELECTOR_LEN;
 		num_suites++;
 	}
+#endif /* CONFIG_IEEE80211R_AP */
 #endif /* CONFIG_SAE */
 	if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
 		RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B);
@@ -670,8 +672,10 @@  wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
 #ifdef CONFIG_SAE
 		else if (data.key_mgmt & WPA_KEY_MGMT_SAE)
 			selector = RSN_AUTH_KEY_MGMT_SAE;
+#ifdef CONFIG_IEEE80211R_AP
 		else if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE)
 			selector = RSN_AUTH_KEY_MGMT_FT_SAE;
+#endif /* CONFIG_IEEE80211R_AP */
 #endif /* CONFIG_SAE */
 		else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 			selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
@@ -778,8 +782,10 @@  wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
 #ifdef CONFIG_SAE
 	else if (key_mgmt & WPA_KEY_MGMT_SAE)
 		sm->wpa_key_mgmt = WPA_KEY_MGMT_SAE;
+#ifdef CONFIG_IEEE80211R_AP
 	else if (key_mgmt & WPA_KEY_MGMT_FT_SAE)
 		sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_SAE;
+#endif /* CONFIG_IEEE80211R_AP */
 #endif /* CONFIG_SAE */
 	else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 		sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X;