diff mbox series

AP: Reject WPA-PSK AKM when PMF is required

Message ID 20260515030901.743078-1-Jason.Huang2@infineon.com
State Rejected
Headers show
Series AP: Reject WPA-PSK AKM when PMF is required | expand

Commit Message

HungTsung Huang May 15, 2026, 3:09 a.m. UTC 
From: Rakshith P <rakshith.p@infineon.com>

PMF required mode (ieee80211w=2) must not be combined with WPA-PSK AKM.
That configuration is internally inconsistent and should be rejected during
configuration validation instead of being accepted at startup.

Add a config-time check to fail when PMF is required and the selected AKM
set includes WPA-PSK. Use a bitmask-based test so this also catches mixed
AKM sets (for example, WPA-PSK + SAE), not only one specific AKM
combination.

This makes hostapd fail fast with a clear error for invalid security policy
selection and prevents deployment of unsupported PMF-required PSK setups.

Signed-off-by: Rakshith P <rakshith.p@infineon.com>
Signed-off-by: Jason Huang <jason.huang2@infineon.com>
---
 src/ap/ap_config.c | 7 +++++++
 1 file changed, 7 insertions(+)

Comments

Jouni Malinen May 20, 2026, 8:36 a.m. UTC | #1 
On Fri, May 15, 2026 at 11:09:01AM +0800, Jason Huang wrote:
> PMF required mode (ieee80211w=2) must not be combined with WPA-PSK AKM.

Why? That combination is what the PMF program was initially launched
with and I see no reason to suddenly start disallowing it.

> That configuration is internally inconsistent and should be rejected during
> configuration validation instead of being accepted at startup.

What do you mean with being "internally inconsistent"?

> Add a config-time check to fail when PMF is required and the selected AKM
> set includes WPA-PSK. Use a bitmask-based test so this also catches mixed
> AKM sets (for example, WPA-PSK + SAE), not only one specific AKM
> combination.
> 
> This makes hostapd fail fast with a clear error for invalid security policy
> selection and prevents deployment of unsupported PMF-required PSK setups.

This would disallow configurations that are valid and as such, I don't
think this is going to be an acceptable change.
diff mbox series

Patch

diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
index 36a4dad65..0a7785cce 100644
--- a/src/ap/ap_config.c
+++ b/src/ap/ap_config.c
@@ -1536,6 +1536,13 @@  static int hostapd_config_check_bss(struct hostapd_bss_config *bss,
 				   WPA_CIPHER_GCMP_256 | WPA_CIPHER_GCMP)))
 		bss->spp_amsdu = false;
 
+	if (full_config && (bss->ieee80211w == 2) &&
+	    (bss->wpa_key_mgmt & WPA_KEY_MGMT_PSK)) {
+		wpa_printf(MSG_ERROR,
+			   "Cannot set ieee80211w=2 along with the selected wpa_key_mgmt");
+		return -1;
+	}
+
 	return 0;
 }