From 02b38d0ad53d733ac9526be9344bdb05550284bf Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Wed, 27 Dec 2017 18:38:12 +0200 Subject: [PATCH] Fix MFP-enabled test for disallowed TKIP The test against use of TKIP was done only in MFP-required (ieee80211w=2) configuration. Fix this to check the pairwise cipher for MFP-enabled (ieee80211w=1) case as well. Signed-off-by: Jouni Malinen --- src/ap/wpa_auth_ie.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/ap/wpa_auth_ie.c b/src/ap/wpa_auth_ie.c index 64dd78773..c394293e8 100644 --- a/src/ap/wpa_auth_ie.c +++ b/src/ap/wpa_auth_ie.c @@ -711,12 +711,6 @@ int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth, return WPA_MGMT_FRAME_PROTECTION_VIOLATION; } - if (ciphers & WPA_CIPHER_TKIP) { - wpa_printf(MSG_DEBUG, "Management frame protection " - "cannot use TKIP"); - return WPA_MGMT_FRAME_PROTECTION_VIOLATION; - } - if (data.mgmt_group_cipher != wpa_auth->conf.group_mgmt_cipher) { wpa_printf(MSG_DEBUG, "Unsupported management group " @@ -740,6 +734,12 @@ int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth, sm->mgmt_frame_prot = 0; else sm->mgmt_frame_prot = 1; + + if (sm->mgmt_frame_prot && (ciphers & WPA_CIPHER_TKIP)) { + wpa_printf(MSG_DEBUG, + "Management frame protection cannot use TKIP"); + return WPA_MGMT_FRAME_PROTECTION_VIOLATION; + } #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_IEEE80211R_AP