[PATCH 0/5] FT: Support 802.11r with WPA3-Personal Compatibility Mode

[Gopi Raga]

This series adds 802.11r (Fast BSS Transition) support for BSSes running
in WPA3-Personal Compatibility Mode, i.e. with RSN Overriding enabled.

In Compatibility Mode the base RSNE/RSNXE advertise legacy WPA2-PSK (PMF
optional/disabled) for old clients, while the SAE/FT-SAE AKMs, the
override pairwise/PMF policy, and the RSNXE are carried in the WFA RSN
Override / RSNXE Override elements. The association path already selects
the correct variant using the RSN Selection element, but several 802.11r
code paths predate RSN Overriding and consult only the base RSNE/RSNXE.
As a result an FT-SAE roam between two BSSes of such an ESS fails at four
independent gates:

  1. AP FT authentication rejects the FT-SAE AKM because the key-mgmt
     gate never OR's in the RSN Override AKM suites
     ("FT: Invalid key mgmt").
  2. AP FT reassociation miscounts / mis-MICs the base RSNXE because it
     does not consult the RSN Selection element the STA sent
     ("FT: Unexpected IE count in MIC Control").
  3. The supplicant rejects the (MIC-verified) Reassociation Response
     because the negotiated RSNXE lives in ap_rsnxe_override rather than
     ap_rsnxe (local deauth, reason=13 INVALID_IE).
  4. The supplicant rejects the FT authentication response because the
     base RSNE lacks MFPC, even though the SAE AKM selected via the RSNE
     Override mandates and carries PMF ("Target AP does not support PMF",
     reason=3).

Each patch fixes one gate and fails safe: the FTE MIC verification
remains the ultimate authenticity check on both sides, and the relaxed
checks are gated on RSN Overriding being in use with an SAE AKM / an
RSNE Override RSN Selection. The authenticator and supplicant handling
are kept symmetric (both keyed on the STA's RSN Selection rather than
local configuration).

Patch 5 adds hwsim coverage: FT-SAE roaming in Compatibility Mode with
and without the base RSNXE present. The full test_ap_ft and
test_rsn_override suites pass with no regressions.

Found and validated on real hardware (MediaTek Filogic AP + client)
before being reproduced under hwsim.

Gopi Raga (5):
  FT: Accept RSN Override AKM suites in FT authentication
  FT: Reconcile RSNXE with RSN Overriding in reassociation
  FT: Reconcile RSNXE Override in reassoc response validation
  FT: Accept PMF via RSN Override in FT authentication response
  tests: FT-SAE roaming in WPA3-Personal Compatibility Mode

 src/ap/wpa_auth_ft.c      | 41 ++++++++++++++++++++++---
 src/common/wpa_common.c   | 36 +++++++++++++++++++++-
 src/common/wpa_common.h   |  2 ++
 src/rsn_supp/wpa_ft.c     | 22 ++++++++++++--
 tests/hwsim/test_ap_ft.py | 64 +++++++++++++++++++++++++++++++++++++++
 5 files changed, 157 insertions(+), 8 deletions(-)

-- 
2.43.0