[PATCH 11/15] NAN: Skip GTK cipher suites in PMKID list

[Andrei Otcheretianski]

nan_crypto_pmkid_list() tried to calculate PMKID for group suites.
This resulted in a failure when trying to publish a service with
cipher_suites 5 and 6. Fix it by skipping GTK suites. While at it fix
a memleak on error path in PMKID derivation. Update the hwsim test to
publish with the GTK suites as well.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski at intel.com>
---
 src/nan/nan_crypto.c    | 9 +++++++--
 tests/hwsim/test_nan.py | 4 +++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/nan/nan_crypto.c b/src/nan/nan_crypto.c
index 93ab7599da..1cc3ef311d 100644
--- a/src/nan/nan_crypto.c
+++ b/src/nan/nan_crypto.c
@@ -730,8 +730,9 @@ void nan_crypto_clear_pmkid_list(struct dl_list *pmkid_list)
  * @pmk: PMK for which the PMKIDs are generated
  * Returns: 0 on success, -1 on failure
  *
- * This function generates a PMKID for each cipher suite in the provided array
- * and adds them to the pmkid_list.
+ * This function generates a PMKID for each NDP cipher suite in the provided
+ * array and adds them to the pmkid_list. Cipher suites that are not used for
+ * an ND-TKSA, e.g., the NCS-GTK-* suites, have no ND-PMK and are skipped.
  */
 int nan_crypto_pmkid_list(struct dl_list *pmkid_list, const u8 *raddr,
 			  const u8 *srv_id, const int *cipher_suites,
@@ -752,6 +753,9 @@ int nan_crypto_pmkid_list(struct dl_list *pmkid_list, const u8 *raddr,
 		enum nan_cipher_suite_id csid =
 			(enum nan_cipher_suite_id) cipher_suites[i];
 
+		if (!NAN_CS_IS_VALID_NDP(csid))
+			continue;
+
 		p = os_zalloc(sizeof(*p));
 		if (!p)
 			return -1;
@@ -762,6 +766,7 @@ int nan_crypto_pmkid_list(struct dl_list *pmkid_list, const u8 *raddr,
 			wpa_printf(MSG_DEBUG,
 				   "NAN: Failed to derive PMKID for cipher suite %d",
 				   cipher_suites[i]);
+			os_free(p);
 			nan_crypto_clear_pmkid_list(pmkid_list);
 			return ret;
 		}
diff --git a/tests/hwsim/test_nan.py b/tests/hwsim/test_nan.py
index 5f10d1cc49..e37e5c8d52 100644
--- a/tests/hwsim/test_nan.py
+++ b/tests/hwsim/test_nan.py
@@ -2280,7 +2280,9 @@ def test_nan_publish_with_pmk(dev, apdev, params):
 
         # Test PMK - 32 bytes (64 hex characters)
         nd_pmk = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
-        cipher_suites = "1,2"  # NAN_CS_SK_CCM_128, NAN_CS_SK_GCM_256
+        # The GTK suites carry no ND-PMK, so they must be skipped rather than
+        # failing the whole publish
+        cipher_suites = "1,2,5,6"
 
         # Publish with PMK and cipher suites
         pid = pub.publish("secure_test", nd_pmk=nd_pmk, cipher_suites=cipher_suites)
-- 
2.53.0