commit 4283f9e410efee9a51c3cf849ddece34b876f65f
author Jouni Malinen <j@w1.fi> Fri Sep 22 12:06:37 2017 +0300
committer Glen Kuhne <kuh@google.com> Mon Oct 16 09:50:40 2017 -0700
tree 129f4c8a9b891c83f09b4e89fa917d799755a5fa
parent 90bfa4553c31214252b33ba81c0d759271753bd4

FT: Do not allow multiple Reassociation Response frames

The driver is expected to not report a second association event without
the station having explicitly request a new association. As such, this
case should not be reachable. However, since reconfiguring the same
pairwise or group keys to the driver could result in nonce reuse issues,
be extra careful here and do an additional state check to avoid this
even if the local driver ends up somehow accepting an unexpected
Reassociation Response frame.

Bug: 65245581
Test: WiFi Integration Suite
Change-Id: Ic951a6fc87a742f7811b44ea0d93e6dae515c9ee
Merged-In: Ic951a6fc87a742f7811b44ea0d93e6dae515c9ee
Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Glen Kuhne <kuh@google.com>

src/rsn_supp/wpa.c

diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index eb3d75c..1fa2783 100644
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -2578,6 +2578,9 @@
 #ifdef CONFIG_FILS
 	sm->fils_completed = 0;
 #endif /* CONFIG_FILS */
+#ifdef CONFIG_IEEE80211R
+	sm->ft_reassoc_completed = 0;
+#endif /* CONFIG_IEEE80211R */
 
 	/* Keys are not needed in the WPA state machine anymore */
 	wpa_sm_drop_sa(sm);

src/rsn_supp/wpa_ft.c

diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c
index 205793e..d45bb45 100644
--- a/src/rsn_supp/wpa_ft.c
+++ b/src/rsn_supp/wpa_ft.c
@@ -153,6 +153,7 @@
 	u16 capab;
 
 	sm->ft_completed = 0;
+	sm->ft_reassoc_completed = 0;
 
 	buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) +
 		2 + sm->r0kh_id_len + ric_ies_len + 100;
@@ -681,6 +682,11 @@
 		return -1;
 	}
 
+	if (sm->ft_reassoc_completed) {
+		wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission");
+		return 0;
+	}
+
 	if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) {
 		wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs");
 		return -1;
@@ -781,6 +787,8 @@
 		return -1;
 	}
 
+	sm->ft_reassoc_completed = 1;
+
 	if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0)
 		return -1;
 

src/rsn_supp/wpa_i.h

diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
index 899dc45..5293ca4 100644
--- a/src/rsn_supp/wpa_i.h
+++ b/src/rsn_supp/wpa_i.h
@@ -126,6 +126,7 @@
 	size_t r0kh_id_len;
 	u8 r1kh_id[FT_R1KH_ID_LEN];
 	int ft_completed;
+	int ft_reassoc_completed;
 	int over_the_ds_in_progress;
 	u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */
 	int set_ptk_after_assoc;