aports

 1From: Beniamino Galvani <bgalvani@redhat.com>
 2Date: Mon, 4 Apr 2022 09:13:12 +0200
 3Subject: AP: guard FT-SAE code with CONFIG_IEEE80211R_AP
 4
 5wpa_supplicant doesn't support FT in AP mode, but it still negotiates
 6FT-SAE. This can lead to an authentication failure when the AP is
 7started with key_mgmt="SAE FT-SAE" and the STA supports both.
 8
 9Ensure that FT-SAE is not negotiated when CONFIG_IEEE80211R_AP is not
10defined.
11
12Signed-off-by: Beniamino Galvani <bgalvani@redhat.com>
13---
14 src/ap/wpa_auth_ie.c | 6 ++++++
15 1 file changed, 6 insertions(+)
16
17diff --git i/src/ap/wpa_auth_ie.c w/src/ap/wpa_auth_ie.c
18index 2efadf896..85cd90bfa 100644
19--- i/src/ap/wpa_auth_ie.c
20+++ w/src/ap/wpa_auth_ie.c
21@@ -241,6 +241,7 @@ int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len,
22 		pos += RSN_SELECTOR_LEN;
23 		num_suites++;
24 	}
25+#ifdef CONFIG_IEEE80211R_AP
26 	if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_SAE) {
27 		RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_SAE);
28 		pos += RSN_SELECTOR_LEN;
29@@ -251,6 +252,7 @@ int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len,
30 		pos += RSN_SELECTOR_LEN;
31 		num_suites++;
32 	}
33+#endif /* CONFIG_IEEE80211R_AP */
34 #endif /* CONFIG_SAE */
35 	if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
36 		RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B);
37@@ -700,10 +702,12 @@ wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
38 			selector = RSN_AUTH_KEY_MGMT_SAE;
39 		else if (data.key_mgmt & WPA_KEY_MGMT_SAE_EXT_KEY)
40 			selector = RSN_AUTH_KEY_MGMT_SAE_EXT_KEY;
41+#ifdef CONFIG_IEEE80211R_AP
42 		else if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE)
43 			selector = RSN_AUTH_KEY_MGMT_FT_SAE;
44 		else if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE_EXT_KEY)
45 			selector = RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY;
46+#endif /* CONFIG_IEEE80211R_AP */
47 #endif /* CONFIG_SAE */
48 		else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
49 			selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
50@@ -820,10 +824,12 @@ wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
51 		sm->wpa_key_mgmt = WPA_KEY_MGMT_SAE;
52 	else if (key_mgmt & WPA_KEY_MGMT_SAE_EXT_KEY)
53 		sm->wpa_key_mgmt = WPA_KEY_MGMT_SAE_EXT_KEY;
54+#ifdef CONFIG_IEEE80211R_AP
55 	else if (key_mgmt & WPA_KEY_MGMT_FT_SAE)
56 		sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_SAE;
57 	else if (key_mgmt & WPA_KEY_MGMT_FT_SAE_EXT_KEY)
58 		sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_SAE_EXT_KEY;
59+#endif /* CONFIG_IEEE80211R_AP */
60 #endif /* CONFIG_SAE */
61 	else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X)
62 		sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X;