diff options
| author | Jouni Malinen <jouni@qca.qualcomm.com> | 2014-11-14 20:57:05 +0200 |
|---|---|---|
| committer | Dmitry Shmidt <dimitrysh@google.com> | 2014-11-17 14:13:36 -0800 |
| commit | 658fb4adb9458c3055c64a43833f1a9e89b4db74 (patch) | |
| tree | fdea5bcfc84d7d6632a333dee90c0e357e7fef73 /src | |
| parent | 772e12cfed81754a9fd890be7bc77bc602a549b5 (diff) | |
| download | android_external_wpa_supplicant_8-658fb4adb9458c3055c64a43833f1a9e89b4db74.tar.gz android_external_wpa_supplicant_8-658fb4adb9458c3055c64a43833f1a9e89b4db74.tar.bz2 android_external_wpa_supplicant_8-658fb4adb9458c3055c64a43833f1a9e89b4db74.zip | |
Work around AP misbehavior on EAPOL-Key descriptor version
It looks like some APs are incorrectly selecting descriptor version 3
(AES-128-CMAC) for EAPOL-Key frames when version 2 (HMAC-SHA1) was
expected to be used. This is likely triggered by an attempt to negotiate
PMF with SHA1-based AKM.
Since AES-128-CMAC is considered stronger than HMAC-SHA1, allow the
incorrect, but stronger, option to be used in these cases to avoid
interoperability issues with deployed APs.
This issue shows up with "WPA: CCMP is used, but EAPOL-Key descriptor
version (3) is not 2" in debug log. With the new workaround, this issue
is ignored and "WPA: Interoperability workaround: allow incorrect
(should have been HMAC-SHA1), but stronger (is AES-128-CMAC), descriptor
version to be used" is written to the log.
Bug: 18411110
Change-Id: I9ae12e8882adc9e785f6e4cef9f30b89bf72dcd2
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/rsn_supp/wpa.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c index 94710717..d6fb6a15 100644 --- a/src/rsn_supp/wpa.c +++ b/src/rsn_supp/wpa.c @@ -1736,6 +1736,9 @@ int wpa_sm_rx_eapol(struct wpa_sm *sm, const u8 *src_addr, wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Backwards compatibility: allow invalid " "version for non-CCMP group keys"); + } else if (ver == WPA_KEY_INFO_TYPE_AES_128_CMAC) { + wpa_msg(sm->ctx->msg_ctx, MSG_INFO, + "WPA: Interoperability workaround: allow incorrect (should have been HMAC-SHA1), but stronger (is AES-128-CMAC), descriptor version to be used"); } else goto out; } else if (sm->pairwise_cipher == WPA_CIPHER_GCMP && |