[PATCH 1/5] FT: Accept RSN Override AKM suites in FT authentication

[Gopi Raga]

In WPA3-Personal Compatibility Mode (RSN Overriding, WPA3 specification
v3.4+), the SAE and FT-SAE AKM suites are advertised only in the RSNE
Override / RSNE Override 2 elements, while the base RSNE carries a
reduced, legacy-compatible suite (e.g., PSK/FT-PSK). A roaming STA that
selected FT-SAE via the override element signals FT-SAE in the RSNE of
its FT authentication request.

wpa_ft_set_key_mgmt() validated the requested AKM (and pairwise cipher)
against the base configuration only (conf->wpa_key_mgmt and
conf->rsn_pairwise), so FT-SAE was rejected with "FT: Invalid key mgmt"
and the FT authentication response carried status
UNSPECIFIED_FAILURE. In addition, the AKM-to-key_mgmt mapping had no
FT-SAE / FT-SAE-EXT-KEY branch.

Validate the requested AKM and pairwise cipher against the union of the
base and RSN Override suites, and add the missing FT-SAE / FT-SAE-EXT-KEY
mappings, mirroring the (Re)Association handling in
wpa_validate_wpa_ie(). This allows 802.11r Fast BSS Transition to work
for SAE clients in Compatibility Mode.

Signed-off-by: Gopi Raga <ragagopi7 at gmail.com>
---
 src/ap/wpa_auth_ft.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c
index 76b14ddd3..6be65d2bc 100644
--- a/src/ap/wpa_auth_ft.c
+++ b/src/ap/wpa_auth_ft.c
@@ -3016,11 +3016,20 @@ static int wpa_ft_set_key_mgmt(struct wpa_state_machine *sm,
 			       struct wpa_ft_ies *parse)
 {
 	int key_mgmt, ciphers;
+	struct wpa_auth_config *conf = &sm->wpa_auth->conf;
 
 	if (sm->wpa_key_mgmt)
 		return 0;
 
-	key_mgmt = parse->key_mgmt & sm->wpa_auth->conf.wpa_key_mgmt;
+	/* In WPA3-Personal Compatibility Mode (RSN Overriding), the SAE and
+	 * FT-SAE AKMs are advertised only in the RSNE Override element(s), not
+	 * in the base RSNE. A STA that selected such an AKM signals it in the
+	 * FT authentication RSNE, so validate the requested AKM against the RSN
+	 * Override key_mgmt suites in addition to the base configuration
+	 * (matching wpa_validate_wpa_ie() for (Re)Association). */
+	key_mgmt = parse->key_mgmt & (conf->wpa_key_mgmt |
+				      conf->rsn_override_key_mgmt |
+				      conf->rsn_override_key_mgmt_2);
 	if (!key_mgmt) {
 		wpa_printf(MSG_DEBUG, "FT: Invalid key mgmt (0x%x) from "
 			   MACSTR, parse->key_mgmt, MAC2STR(sm->addr));
@@ -3034,13 +3043,21 @@ static int wpa_ft_set_key_mgmt(struct wpa_state_machine *sm,
 #endif /* CONFIG_SHA384 */
 	else if (key_mgmt & WPA_KEY_MGMT_FT_PSK)
 		sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK;
+#ifdef CONFIG_SAE
+	else if (key_mgmt & WPA_KEY_MGMT_FT_SAE)
+		sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_SAE;
+	else if (key_mgmt & WPA_KEY_MGMT_FT_SAE_EXT_KEY)
+		sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_SAE_EXT_KEY;
+#endif /* CONFIG_SAE */
 #ifdef CONFIG_FILS
 	else if (key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256)
 		sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA256;
 	else if (key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384)
 		sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_FILS_SHA384;
 #endif /* CONFIG_FILS */
-	ciphers = parse->pairwise_cipher & sm->wpa_auth->conf.rsn_pairwise;
+	ciphers = parse->pairwise_cipher & (conf->rsn_pairwise |
+					    conf->rsn_override_pairwise |
+					    conf->rsn_override_pairwise_2);
 	if (!ciphers) {
 		wpa_printf(MSG_DEBUG, "FT: Invalid pairwise cipher (0x%x) from "
 			   MACSTR,
-- 
2.43.0