jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

HS 2.0: Fix PMF-in-use check for ANQP Venue URL processing

Browse source 
The previous implementation did not check that we are associated with
the sender of the GAS response before checking for PMF status. This
could have accepted Venue URL when not in associated state. Fix this by
explicitly checking for association with the responder first.

This fixes an issue that was detected, e.g., with these hwsim test case
sequences:
gas_anqp_venue_url_pmf gas_anqp_venue_url
gas_prot_vs_not_prot gas_anqp_venue_url

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2018-12-08 13:57:51 +02:00 committed by Jouni Malinen
parent 842c29c173
commit 3ce48c440e
3 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
wpa_supplicant/gas_query.c
View file

@ -272,7 +272,7 @@ static void gas_query_tx_status(struct wpa_supplicant *wpa_s,
}
static int pmf_in_use(struct wpa_supplicant *wpa_s, const u8 *addr)
int pmf_in_use(struct wpa_supplicant *wpa_s, const u8 *addr)
{
if (wpa_s->current_ssid == NULL ||
wpa_s->wpa_state < WPA_4WAY_HANDSHAKE ||

1
wpa_supplicant/gas_query.h
View file

@ -19,6 +19,7 @@ void gas_query_deinit(struct gas_query *gas);
int gas_query_rx(struct gas_query *gas, const u8 *da, const u8 *sa,
const u8 *bssid, u8 categ, const u8 *data, size_t len,
int freq);
int pmf_in_use(struct wpa_supplicant *wpa_s, const u8 *addr);
/**
* enum gas_query_result - GAS query result

2
wpa_supplicant/interworking.c
View file

@ -2983,7 +2983,7 @@ static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
MAC2STR(sa));
anqp_add_extra(wpa_s, anqp, info_id, pos, slen);
if (!wpa_sm_pmf_enabled(wpa_s->wpa)) {
if (!pmf_in_use(wpa_s, sa)) {
wpa_printf(MSG_DEBUG,
"ANQP: Ignore Venue URL since PMF was not enabled");
break;