diff options
| author | Jouni Malinen <j@w1.fi> | 2017-10-01 12:32:57 +0300 |
|---|---|---|
| committer | Glen Kuhne <kuh@google.com> | 2017-10-10 10:42:51 -0700 |
| commit | e52ae8e63a78f72480c802930053c727ce1ee724 (patch) | |
| tree | 8f95e914aa3ca30491d7ecc91c7fe4cf6c7f0500 | |
| parent | af1b1a2118e2192acace26b06d01a24a1d3f4cb5 (diff) | |
| download | android_external_wpa_supplicant_8-e52ae8e63a78f72480c802930053c727ce1ee724.tar.gz android_external_wpa_supplicant_8-e52ae8e63a78f72480c802930053c727ce1ee724.tar.bz2 android_external_wpa_supplicant_8-e52ae8e63a78f72480c802930053c727ce1ee724.zip | |
Fix PTK rekeying to generate a new ANonce
The Authenticator state machine path for PTK rekeying ended up bypassing
the AUTHENTICATION2 state where a new ANonce is generated when going
directly to the PTKSTART state since there is no need to try to
determine the PMK again in such a case. This is far from ideal since the
new PTK would depend on a new nonce only from the supplicant.
Fix this by generating a new ANonce when moving to the PTKSTART state
for the purpose of starting new 4-way handshake to rekey PTK.
Bug: 65245581
Test: Wifi Integration Suite
Merged-In: Ib1276336b08af19f664d1562e2844f969774bb1c
Change-Id: Ib1276336b08af19f664d1562e2844f969774bb1c
Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Glen Kuhne <kuh@google.com>
| -rw-r--r-- | src/ap/wpa_auth.c | 24 |
1 files changed, 21 insertions, 3 deletions
diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c index 2bb8aab8..f57296ab 100644 --- a/src/ap/wpa_auth.c +++ b/src/ap/wpa_auth.c @@ -1709,6 +1709,21 @@ SM_STATE(WPA_PTK, AUTHENTICATION2) } +static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm) +{ + if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { + wpa_printf(MSG_ERROR, + "WPA: Failed to get random data for ANonce"); + sm->Disconnect = TRUE; + return -1; + } + wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce, + WPA_NONCE_LEN); + sm->TimeoutCtr = 0; + return 0; +} + + SM_STATE(WPA_PTK, INITPMK) { u8 msk[2 * PMK_LEN]; @@ -2220,9 +2235,12 @@ SM_STEP(WPA_PTK) SM_ENTER(WPA_PTK, AUTHENTICATION); else if (sm->ReAuthenticationRequest) SM_ENTER(WPA_PTK, AUTHENTICATION2); - else if (sm->PTKRequest) - SM_ENTER(WPA_PTK, PTKSTART); - else switch (sm->wpa_ptk_state) { + else if (sm->PTKRequest) { + if (wpa_auth_sm_ptk_update(sm) < 0) + SM_ENTER(WPA_PTK, DISCONNECTED); + else + SM_ENTER(WPA_PTK, PTKSTART); + } else switch (sm->wpa_ptk_state) { case WPA_PTK_INITIALIZE: break; case WPA_PTK_DISCONNECT: |