jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

mka: Ignore MACsec SAK Use Old Key parameter if we don't have our old key

Browse source 
Upon receipt of the "MACsec MKPDU SAK Use parameter set" the KaY verifies
that both the latest key and the old key are valid. If the local system
reboots or is reinitialized, the KaY won't have a copy of its old key.
Therefore if the KaY does not have a copy of its old key it should not
reject MKPDUs that contain old key data in the MACsec SAK Use parameter.

Signed-off-by: Michael Siedzik <msiedzik@extremenetworks.com>
This commit is contained in:
Mike Siedzik 2018-02-20 14:28:32 -05:00 committed by Jouni Malinen
parent b54b53e644
commit 8fb546d8e6
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/pae/ieee802_1x_kay.c
View file

@ -1343,8 +1343,8 @@ ieee802_1x_mka_decode_sak_use_body(
}
}
/* check old key is valid */
if (body->otx || body->orx) {
/* check old key is valid (but only if we remember our old key) */
if (participant->oki.kn != 0 && (body->otx || body->orx)) {
if (os_memcmp(participant->oki.mi, body->osrv_mi,
sizeof(participant->oki.mi)) != 0 ||
be_to_host32(body->okn) != participant->oki.kn ||