[PATCH] ft: defer PTK installation for unassociated AP clients

[Giuseppe Piscitelli]

mac80211 rejects an ordinary FT PTK before the driver station is
associated. hostapd retries after association, but the early request
produces a key-add error for each transition.

Honor the FT station preparation callback before installing the PTK.
For drivers exposing full AP client state, defer ordinary FT keys until
association. Preserve PMF station cleanup and early installation for EPP
peers, which need the key for encrypted association frames. Keep early
installation when the callback is absent.

Tested eight hwsim FT-SAE roams with required PMF, including OTA and
over-DS, with bidirectional traffic after every roam. Key-add errors
changed from eight to zero. A backport on OpenWrt 25.12.6 with ath11k
also completed a real FT roam with PMF and bidirectional traffic,
without the key-add error observed with the original build.

Signed-off-by: Giuseppe Piscitelli <ooonea at gmail.com>
Assisted-by: OpenAI Codex
---
 src/ap/wpa_auth.h      |  1 +
 src/ap/wpa_auth_ft.c   | 13 +++----------
 src/ap/wpa_auth_glue.c |  8 +++++++-
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h
index 9e5e384..ab21546 100644
--- a/src/ap/wpa_auth.h
+++ b/src/ap/wpa_auth.h
@@ -425,6 +425,7 @@ struct wpa_auth_callbacks {
 				   const u8 *eapol, size_t eapol_len);
 #ifdef CONFIG_IEEE80211R_AP
 	struct wpa_state_machine * (*add_sta)(void *ctx, const u8 *sta_addr);
+	/* Nonzero defers PTK installation until the post-association retry. */
 	int (*add_sta_ft)(void *ctx, const u8 *sta_addr);
 	int (*set_vlan)(void *ctx, const u8 *sta_addr,
 			struct vlan_description *vlan);
diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c
index 172f3db..6742881 100644
--- a/src/ap/wpa_auth_ft.c
+++ b/src/ap/wpa_auth_ft.c
@@ -2869,7 +2869,7 @@ static inline int wpa_auth_add_sta_ft(struct
wpa_authenticator *wpa_auth,
 				      const u8 *addr)
 {
 	if (!wpa_auth->cb->add_sta_ft)
-		return -1;
+		return 0;
 	return wpa_auth->cb->add_sta_ft(wpa_auth->cb_ctx, addr);
 }

@@ -2896,15 +2896,8 @@ void wpa_ft_install_ptk(struct
wpa_state_machine *sm, int retry)
 		return;
 	}

-	if (!retry)
-		wpa_auth_add_sta_ft(sm->wpa_auth, sm->addr);
-
-	/* FIX: add STA entry to kernel/driver here? The set_key will fail
-	 * most likely without this.. At the moment, STA entry is added only
-	 * after association has been completed. This function will be called
-	 * again after association to get the PTK configured, but that could be
-	 * optimized by adding the STA entry earlier.
-	 */
+	if (!retry && wpa_auth_add_sta_ft(sm->wpa_auth, sm->addr))
+		return;
 	if (wpa_auth_set_key(sm->wpa_auth, 0, alg, sm->addr, sm->keyidx_active,
 			     sm->PTK.tk, klen, KEY_FLAG_PAIRWISE_RX_TX))
 		return;
diff --git a/src/ap/wpa_auth_glue.c b/src/ap/wpa_auth_glue.c
index 9da2e6d..b29597a 100644
--- a/src/ap/wpa_auth_glue.c
+++ b/src/ap/wpa_auth_glue.c
@@ -1329,9 +1329,15 @@ static int hostapd_wpa_auth_add_sta_ft(void
*ctx, const u8 *sta_addr)
 		 * previous association. */
 		wpa_printf(MSG_DEBUG,
 			   "FT: Remove and re-add driver STA entry after successful FT
authentication");
-		return ap_sta_re_add(hapd, sta);
+		if (ap_sta_re_add(hapd, sta))
+			return -1;
 	}

+	/* EPP needs the key before the encrypted association exchange. */
+	if (FULL_AP_CLIENT_STATE_SUPP(hapd->iface->drv_flags) &&
+	    !(sta->flags & WLAN_STA_ASSOC) && !ap_sta_is_epp(sta))
+		return 1;
+
 	return 0;
 }


base-commit: fcccc8c82e0b33e348f3f34f3777186c9efc73f5
-- 
2.54.0