[PATCH 19/44] FT: check hapd->wpa_auth before RRB internal delivery

[michael-dev at fami-braun.de]

From: Michael Braun <michael-dev at fami-braun.de>

A malcious station could try to do FT-over-DS with a non WPA-enabled BSS.
When this BSS is located in the same hostapd instance, internal RRB
delivery will be used and thus the FT Action Frame will be processed by a
non-WPA enabled BSS.
This processing will crash hostapd as hapd->wpa_auth is null.
If the target BSS is on a different hostapd instance, it will not listen
for these packets and thus not crash.

This patch fixes this by checking hapd->wpa_auth before delivery.

Signed-off-by: Michael Braun <michael-dev at fami-braun.de>
---
 src/ap/wpa_auth_glue.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/ap/wpa_auth_glue.c b/src/ap/wpa_auth_glue.c
index a85559a..ee34012 100644
--- a/src/ap/wpa_auth_glue.c
+++ b/src/ap/wpa_auth_glue.c
@@ -423,6 +423,8 @@ static int hostapd_wpa_auth_ft_iter(struct hostapd_iface *iface, void *ctx)
 		hapd = iface->bss[j];
 		if (hapd == idata->src_hapd)
 			continue;
+		if (!hapd->wpa_auth)
+			continue;
 		if (os_memcmp(hapd->own_addr, idata->dst, ETH_ALEN) == 0) {
 			wpa_printf(MSG_DEBUG, "FT: Send RRB data directly to "
 				   "locally managed BSS " MACSTR "@%s -> "
-- 
1.9.1