diff options
| author | Jouni Malinen <j@w1.fi> | 2015-10-25 15:45:50 +0200 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2015-11-30 18:03:33 -0800 |
| commit | ae7ea2e3bd4df652b6c2fa96455cbe3570a41496 (patch) | |
| tree | e15890863990334546bf33c1c0f41e7ce57f25a1 | |
| parent | 4cf0f2d0d869c35a9ec4432861d5efa8ead4279c (diff) | |
| download | android_external_wpa_supplicant_8-ae7ea2e3bd4df652b6c2fa96455cbe3570a41496.tar.gz android_external_wpa_supplicant_8-ae7ea2e3bd4df652b6c2fa96455cbe3570a41496.tar.bz2 android_external_wpa_supplicant_8-ae7ea2e3bd4df652b6c2fa96455cbe3570a41496.zip | |
WNM: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use
WNM Sleep Mode Response frame is used to update GTK/IGTK only if PMF is
enabled. Verify that PMF is in use before using this field on station
side to avoid accepting unauthenticated key updates.
Bug: 25266660
Change-Id: Ib4b80f9c9e4aa5ea0b827c5202809c9660ad9b39
Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
| -rw-r--r-- | wpa_supplicant/wnm_sta.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c index 4a792c4b..e08480a6 100644 --- a/wpa_supplicant/wnm_sta.c +++ b/wpa_supplicant/wnm_sta.c @@ -186,6 +186,12 @@ static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s, end = ptr + key_len_total; wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total); + if (key_len_total && !wpa_sm_pmf_enabled(wpa_s->wpa)) { + wpa_msg(wpa_s, MSG_INFO, + "WNM: Ignore Key Data in WNM-Sleep Mode Response - PMF not enabled"); + return; + } + while (ptr + 1 < end) { if (ptr + 2 + ptr[1] > end) { wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element " |