From patchwork Fri May 15 03:09:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: HungTsung Huang X-Patchwork-Id: 2238446 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=2loNEJz1; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=infineon.com header.i=@infineon.com header.a=rsa-sha256 header.s=IFXMAIL header.b=b73MNJ3Q; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4gGsf11fkZz1y5L for ; Fri, 15 May 2026 13:10:49 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:CC :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=AGu3EjF+bde3LijPd6wBr0ys2YxbuyBSKfRwEJlvn/I=; b=2loNEJz1eN0g4V If9D9U8AmbLMQXIIQSxO+EYOTYcGZViOCnV3d03pLlcGS6BGQibdnh15RMPjrVMXiHMBRAmqyF/vu 6lcWZhxRK3KD3L6tDNksfARW9qZJwgw3+EaM1nMQ9ukTWfMSineDu6XHSRc1YSNxvU+OpRWbhEElt tsD4MFXM3WjPkv7gO/Ho3RHIXmiEbO0bjgYlzgf9odKvZDE4ujlU/imA+JixLQ/8Enf5m8peZul0w 6ZrYtOHeYp/uWYU75Na2NPEbD+drOSwko4DZcTKDTcCL+YyvQG/jzMwE6RjN009RK51hWW3Ykozfw U6MNIjcH9UB7ryE/fOIw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wNivR-00000007C24-0cjV; Fri, 15 May 2026 03:09:21 +0000 Received: from smtp11.infineon.com ([2a00:18f0:1e00:4::5]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wNivP-00000007C0u-03wg for hostap@lists.infradead.org; Fri, 15 May 2026 03:09:20 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=infineon.com; i=@infineon.com; q=dns/txt; s=IFXMAIL; t=1778814560; x=1810350560; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=RvYm+qhyOkuM1Ur/Yr8z0+5TeWY0hh0wJGczItmBl+Q=; b=b73MNJ3QacH7qYS4qXrmk+t0Nsrl3c4NQLRy89XpmCSvmD/L4b4h/KIV GZ1fYY/v3xm+K8wAHXTU/jYdzY9SR9bdf9Wmb9Pq7yyk+D9qnyGLuKpPJ hSuVwLWbW34BJKN9XMbnFHWihVdh7bsuIu8F3AdIyACeOdGJJbN66Ii9M E=; X-CSE-ConnectionGUID: /dC4wCTKQpqR51Ynqpt0cg== X-CSE-MsgGUID: WMVlzah7TMmbH/DT4SREhA== X-IronPort-AV: E=McAfee;i="6800,10657,11786"; a="143314904" X-IronPort-AV: E=Sophos;i="6.23,235,1770591600"; d="scan'208";a="143314904" X-Amp-Result: SKIPPED(no attachment in message) Received: from unknown (HELO MUCSE814.infineon.com) ([172.23.29.40]) by smtp11.infineon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 May 2026 05:09:18 +0200 Received: from MUCSE809.infineon.com (172.23.29.35) by MUCSE814.infineon.com (172.23.29.40) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37; Fri, 15 May 2026 05:09:17 +0200 Received: from ISCN5CG5251XQT.infineon.com (10.161.6.196) by MUCSE809.infineon.com (172.23.29.35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37; Fri, 15 May 2026 05:09:15 +0200 From: Jason Huang To: CC: Rakshith P , Jason Huang Subject: [PATCH] AP: Reject WPA-PSK AKM when PMF is required Date: Fri, 15 May 2026 11:09:01 +0800 Message-ID: <20260515030901.743078-1-Jason.Huang2@infineon.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.161.6.196] X-ClientProxiedBy: MUCSE814.infineon.com (172.23.29.40) To MUCSE809.infineon.com (172.23.29.35) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260514_200919_358315_9ADA2689 X-CRM114-Status: GOOD ( 11.22 ) X-Spam-Score: -2.1 (--) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Rakshith P PMF required mode (ieee80211w=2) must not be combined with WPA-PSK AKM. That configuration is internally inconsistent and should be rejected during configuration validation instead of being accepted a [...] Content analysis details: (-2.1 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] -0.0 DMARC_PASS DMARC pass policy X-BeenThere: hostap@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Hostap" Errors-To: hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org From: Rakshith P PMF required mode (ieee80211w=2) must not be combined with WPA-PSK AKM. That configuration is internally inconsistent and should be rejected during configuration validation instead of being accepted at startup. Add a config-time check to fail when PMF is required and the selected AKM set includes WPA-PSK. Use a bitmask-based test so this also catches mixed AKM sets (for example, WPA-PSK + SAE), not only one specific AKM combination. This makes hostapd fail fast with a clear error for invalid security policy selection and prevents deployment of unsupported PMF-required PSK setups. Signed-off-by: Rakshith P Signed-off-by: Jason Huang --- src/ap/ap_config.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c index 36a4dad65..0a7785cce 100644 --- a/src/ap/ap_config.c +++ b/src/ap/ap_config.c @@ -1536,6 +1536,13 @@ static int hostapd_config_check_bss(struct hostapd_bss_config *bss, WPA_CIPHER_GCMP_256 | WPA_CIPHER_GCMP))) bss->spp_amsdu = false; + if (full_config && (bss->ieee80211w == 2) && + (bss->wpa_key_mgmt & WPA_KEY_MGMT_PSK)) { + wpa_printf(MSG_ERROR, + "Cannot set ieee80211w=2 along with the selected wpa_key_mgmt"); + return -1; + } + return 0; }