diff options
| author | Jouni Malinen <j@w1.fi> | 2015-10-25 15:45:50 +0200 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2015-12-01 17:41:04 -0800 |
| commit | 86da57f0c3d2d7185735e2bd129b65c73dda24a1 (patch) | |
| tree | babf8629ef33c614d50f160e0b9d09486b245e9f | |
| parent | 6ec3038c3538e97f079e67e46453d969af30d12c (diff) | |
| download | android_external_wpa_supplicant_8-86da57f0c3d2d7185735e2bd129b65c73dda24a1.tar.gz android_external_wpa_supplicant_8-86da57f0c3d2d7185735e2bd129b65c73dda24a1.tar.bz2 android_external_wpa_supplicant_8-86da57f0c3d2d7185735e2bd129b65c73dda24a1.zip | |
WNM: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use
WNM Sleep Mode Response frame is used to update GTK/IGTK only if PMF is
enabled. Verify that PMF is in use before using this field on station
side to avoid accepting unauthenticated key updates.
Bug: 25266660
Change-Id: Ib4b80f9c9e4aa5ea0b827c5202809c9660ad9b39
Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
| -rw-r--r-- | wpa_supplicant/wnm_sta.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c index 954de67c..7d79499a 100644 --- a/wpa_supplicant/wnm_sta.c +++ b/wpa_supplicant/wnm_sta.c @@ -187,6 +187,12 @@ static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s, end = ptr + key_len_total; wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total); + if (key_len_total && !wpa_sm_pmf_enabled(wpa_s->wpa)) { + wpa_msg(wpa_s, MSG_INFO, + "WNM: Ignore Key Data in WNM-Sleep Mode Response - PMF not enabled"); + return; + } + while (ptr + 1 < end) { if (ptr + 2 + ptr[1] > end) { wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element " |