tree 301ae68ad94b7636b5d2a5bd7ae5f5140dbb0d78
parent 10bfd644d0adaf334c036f8cda91a73984dbb7b9
author Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be> 1500038135 +0200
committer Glen Kuhne <kuh@google.com> 1508172637 -0700

hostapd: Avoid key reinstallation in FT handshake

Do not reinstall TK to the driver during Reassociation Response frame
processing if the first attempt of setting the TK succeeded. This avoids
issues related to clearing the TX/RX PN that could result in reusing
same PN values for transmitted frames (e.g., due to CCM nonce reuse and
also hitting replay protection on the receiver) and accepting replayed
frames on RX side.

This issue was introduced by the commit
0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in
authenticator') which allowed wpa_ft_install_ptk() to be called multiple
times with the same PTK. While the second configuration attempt is
needed with some drivers, it must be done only if the first attempt
failed.

Bug: 65245581
Test: WiFi integration tests
Change-Id: I9d60b25a655eeb2dc19694e49d2f34d537849a13
Merged-In: I9d60b25a655eeb2dc19694e49d2f34d537849a13
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
Signed-off-by: Glen Kuhne <kuh@google.com>