[PATCH] FT: Clear RSNXE Used when the response omits the RSNXE

[Koral Ilgun]

From: Koral Ilgun <koral.ilgun at adtran.com>

A non-AP STA that sends no RSNXE in its FT Reassociation Request, for
example one that uses SAE without H2E, gets a Reassociation Response
without the RSNXE. The AP still set the RSNXE Used subfield of the FTE
MIC Control field whenever sae_pwe is 1 or 2, so the response announced
an element that it did not carry and that the MIC did not cover.
hostapd discards a request with this combination in
wpa_ft_validate_reassoc(). Some STAs apply the same check to the
response, discard it and send the request again, so the FT protocol
never completes for them.

Set RSNXE Used only when the response carries the RSNXE. A STA that
sent an RSNXE gets the same response as before.

Signed-off-by: Koral Ilgun <koral.ilgun at adtran.com>
---
Tested on three APs with sae_pwe=2 and FT-SAE, with an iPad that uses
SAE without H2E. Without this change, every FT reassociation to an AP
looped: the iPad sent the Reassociation Request again 4 to 5 times and
gave up, and a capture showed MIC Control 0x0301 (RSNXE Used = 1, element
count 3) in a response without the RSNXE. With this change on all three
APs, each FT roam completed with a single reassociation. Overnight, the
iPad stayed associated, where it looped on each wake before the change.
The hwsim tests were not run.

 src/ap/wpa_auth_ft.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c
index e12f2ad8e..bc1f3c5f8 100644
--- a/src/ap/wpa_auth_ft.c
+++ b/src/ap/wpa_auth_ft.c
@@ -2714,7 +2714,12 @@ u8 * wpa_sm_write_assoc_resp_ies(struct wpa_state_machine *sm, u8 *pos,
 		anonce = NULL;
 		snonce = NULL;
 	}
-	rsnxe_used = (auth_alg == WLAN_AUTH_FT) &&
+	/*
+	 * A response without the RSNXE must not announce one: some STAs
+	 * discard a response whose RSNXE Used bit and RSNXE do not match,
+	 * as hostapd discards such a request.
+	 */
+	rsnxe_used = (auth_alg == WLAN_AUTH_FT) && !omit_rsnxe &&
 		(conf->sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
 		 conf->sae_pwe == SAE_PWE_BOTH);
 #ifdef CONFIG_TESTING_OPTIONS
-- 
2.43.0