diff options
| author | Jouni Malinen <jouni@qca.qualcomm.com> | 2014-11-14 20:57:05 +0200 |
|---|---|---|
| committer | Chet Lanctot <clanctot@codeaurora.org> | 2014-11-17 15:15:26 -0800 |
| commit | acc9f5bc1a3e687fa95a6cc8b1908faf5b6197f0 (patch) | |
| tree | ba0f8dc932b689a1b0a49fff6006841ba08b5bee | |
| parent | bedb15e4d8b38dd8bfd13359b88d8d35ba585057 (diff) | |
| download | android_external_wpa_supplicant_8-acc9f5bc1a3e687fa95a6cc8b1908faf5b6197f0.tar.gz android_external_wpa_supplicant_8-acc9f5bc1a3e687fa95a6cc8b1908faf5b6197f0.tar.bz2 android_external_wpa_supplicant_8-acc9f5bc1a3e687fa95a6cc8b1908faf5b6197f0.zip | |
Work around AP misbehavior on EAPOL-Key descriptor version
It looks like some APs are incorrectly selecting descriptor version 3
(AES-128-CMAC) for EAPOL-Key frames when version 2 (HMAC-SHA1) was
expected to be used. This is likely triggered by an attempt to negotiate
PMF with SHA1-based AKM.
Since AES-128-CMAC is considered stronger than HMAC-SHA1, allow the
incorrect, but stronger, option to be used in these cases to avoid
interoperability issues with deployed APs.
This issue shows up with "WPA: CCMP is used, but EAPOL-Key descriptor
version (3) is not 2" in debug log. With the new workaround, this issue
is ignored and "WPA: Interoperability workaround: allow incorrect
(should have been HMAC-SHA1), but stronger (is AES-128-CMAC), descriptor
version to be used" is written to the log.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Git-commit: 9f6a7cddc42811883d6035032854089475f2fc65
Git-repo : git://w1.fi/srv/git/hostap.git
CRs-fixed: 758207
Change-Id: If33e34aa0583a3a39f15cc5714eb1fe0ed28e361
| -rw-r--r-- | src/rsn_supp/wpa.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c index 7e095751..56718b1b 100644 --- a/src/rsn_supp/wpa.c +++ b/src/rsn_supp/wpa.c @@ -1752,6 +1752,9 @@ int wpa_sm_rx_eapol(struct wpa_sm *sm, const u8 *src_addr, wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Backwards compatibility: allow invalid " "version for non-CCMP group keys"); + } else if (ver == WPA_KEY_INFO_TYPE_AES_128_CMAC) { + wpa_msg(sm->ctx->msg_ctx, MSG_INFO, + "WPA: Interoperability workaround: allow incorrect (should have been HMAC-SHA1), but stronger (is AES-128-CMAC), descriptor version to be used"); } else goto out; } else if (sm->pairwise_cipher == WPA_CIPHER_GCMP && |