[PATCH 3/5] FT: Reconcile RSNXE Override in reassoc response validation

[Gopi Raga]

wpa_ft_validate_reassoc_resp() checked only the standard sm->ap_rsnxe
when the FTE indicated RSNXE-Used. In WPA3-Personal Compatibility Mode
(RSN Overriding) with rsn_override_omit_rsnxe=1, the AP omits the
standard RSNXE from Beacon/Probe Response frames and carries it only in
the RSNXE Override element, which the supplicant parses into
sm->ap_rsnxe_override (leaving sm->ap_rsnxe NULL).

As a result, the STA rejected an otherwise valid, MIC-verified
Reassociation Response and tore down the link locally
(CTRL-EVENT-DISCONNECTED reason=13, locally_generated=1) before any
4-way handshake on the target AP.

Accept the RSNXE Override as satisfying the FTE RSNXE-Used indication
when RSN Overriding is in use. The FTE MIC verification just above
remains the ultimate authenticity check, so this change fails safe.

Signed-off-by: Gopi Raga <ragagopi7 at gmail.com>
---
 src/rsn_supp/wpa_ft.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c
index fb46fa2f4..85779cfcd 100644
--- a/src/rsn_supp/wpa_ft.c
+++ b/src/rsn_supp/wpa_ft.c
@@ -1178,7 +1178,17 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies,
 		goto fail;
 	}
 
-	if (parse.fte_rsnxe_used && !sm->ap_rsnxe) {
+	/* In WPA3-Personal Compatibility Mode (RSN Overriding) the AP may
+	 * advertise the RSNXE only in the RSNXE Override element and omit the
+	 * standard RSNXE from Beacon/Probe Response frames
+	 * (rsn_override_omit_rsnxe=1). The negotiated RSNXE is then stored in
+	 * sm->ap_rsnxe_override rather than sm->ap_rsnxe, so accept the override
+	 * RSNXE as satisfying the FTE RSNXE-Used indication instead of
+	 * spuriously rejecting the valid, MIC-verified Reassociation Response.
+	 */
+	if (parse.fte_rsnxe_used && !sm->ap_rsnxe &&
+	    !(sm->rsn_override != RSN_OVERRIDE_NOT_USED &&
+	      sm->ap_rsnxe_override && sm->ap_rsnxe_override_len)) {
 		wpa_printf(MSG_INFO,
 			   "FT: FTE indicated that AP uses RSNXE, but RSNXE was not included in Beacon/Probe Response frames");
 		goto fail;
-- 
2.43.0