[PATCH 4/5] FT: Accept PMF via RSN Override in FT authentication response

[Gopi Raga]

In WPA3-Personal Compatibility Mode (RSN Overriding) with
rsn_override_omit_rsnxe=1, the FT authentication response echoes the
base RSNE (legacy WPA2-PSK with MFPC=0); the SAE/FT-SAE AKM and the PMF
policy are carried in the RSNE Override element. With ieee80211w=2 (PMF
required), wpa_ft_process_response() rejected the response with "FT:
Target AP does not support PMF" and aborted the transition
(reason=3) before reaching reassociation.

Do not reject on the base RSNE lacking MFPC when RSN Overriding is in
use and the STA selected an SAE AKM: SAE mandates PMF and the override
RSNE (with MFPR=1) was validated at (re)association.

Signed-off-by: Gopi Raga <ragagopi7 at gmail.com>
---
 src/rsn_supp/wpa_ft.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c
index 85779cfcd..75138ef45 100644
--- a/src/rsn_supp/wpa_ft.c
+++ b/src/rsn_supp/wpa_ft.c
@@ -679,7 +679,15 @@ int wpa_ft_process_response(struct wpa_sm *sm, const u8 *ies, size_t ies_len,
 		goto fail;
 	}
 
-	if (sm->mfp == 2 && !(parse.rsn_capab & WPA_CAPABILITY_MFPC)) {
+	/* In WPA3-Personal Compatibility Mode (RSN Overriding) the FT
+	 * authentication response echoes the base RSNE (legacy WPA2 without
+	 * MFPC); the SAE AKM and PMF policy are carried in the RSNE Override.
+	 * When the STA selected an SAE AKM via the override, PMF is mandated by
+	 * SAE and was validated from the override at (re)association, so do not
+	 * reject on the base RSNE lacking MFPC here. */
+	if (sm->mfp == 2 && !(parse.rsn_capab & WPA_CAPABILITY_MFPC) &&
+	    !(sm->rsn_override != RSN_OVERRIDE_NOT_USED &&
+	      wpa_key_mgmt_sae(sm->key_mgmt))) {
 		wpa_printf(MSG_INFO,
 			   "FT: Target AP does not support PMF, but local configuration requires that");
 		goto fail;
-- 
2.43.0