From 74866f53789fc267fe35666b7bee5e687c34129b Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Fri, 18 Oct 2019 00:17:51 +0300 Subject: [PATCH] RSN: Verify RSNXE match between (Re)AssocReq and EAPOL-Key msg 2/4 If the STA advertises RSN Extension element, it has to be advertised consistently in the unprotected ((Re)Association Request) and protected (EAPOL-Key msg 2/4) frames. Verify that this is the case. Signed-off-by: Jouni Malinen --- src/ap/wpa_auth.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c index aaea5841f..7b690d730 100644 --- a/src/ap/wpa_auth.c +++ b/src/ap/wpa_auth.c @@ -2937,6 +2937,22 @@ SM_STATE(WPA_PTK, PTKCALCNEGOTIATING) WLAN_REASON_PREV_AUTH_NOT_VALID); return; } + if ((!sm->rsnxe && kde.rsnxe) || + (sm->rsnxe && !kde.rsnxe) || + (sm->rsnxe && kde.rsnxe && + (sm->rsnxe_len != kde.rsnxe_len || + os_memcmp(sm->rsnxe, kde.rsnxe, sm->rsnxe_len) != 0))) { + wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, + "RSNXE from (Re)AssocReq did not match the one in EAPOL-Key msg 2/4"); + wpa_hexdump(MSG_DEBUG, "RSNXE in AssocReq", + sm->rsnxe, sm->rsnxe_len); + wpa_hexdump(MSG_DEBUG, "RSNXE in EAPOL-Key msg 2/4", + kde.rsnxe, kde.rsnxe_len); + /* MLME-DEAUTHENTICATE.request */ + wpa_sta_disconnect(wpa_auth, sm->addr, + WLAN_REASON_PREV_AUTH_NOT_VALID); + return; + } #ifdef CONFIG_OCV if (wpa_auth_uses_ocv(sm)) { struct wpa_channel_info ci;