[PATCH v2 0/3] FT: RSNXE Used without the RSNXE

[Koral Ilgun]

From: Koral Ilgun <koral.ilgun at adtran.com>

The RSNXE Used subfield of the FTE MIC Control field indicates that the AP
uses the RSNXE in other frames, and wpa_supplicant checks it against the
Beacon and Probe Response frames.

Patch 1 fixes a case where the AP set the subfield although it omits the
RSNXE from those frames (rsn_override_omit_rsnxe=1); with sae_pwe=1 or 2,
wpa_supplicant then rejected every FT Reassociation Response.

Patch 2 adds an opt-in interoperability workaround,
ft_rsnxe_used_only_with_rsnxe, default 0, for STAs that check the subfield
against the response itself. An iPad that uses SAE without H2E discards a
response with RSNXE Used set and no RSNXE, and FT never completes. The
option trades away an indication that a STA without an RSNXE could use to
detect an RSNXE removed from the Beacon frame.

Patch 3 adds hwsim tests for both.

v2:
- v1 described the AP behavior as a fault; it matches the design of
  51d1924bd. The STA case is now an opt-in workaround.
- New patch 1 for rsn_override_omit_rsnxe.
- New hwsim tests.
v1: http://patchwork.ozlabs.org/project/hostap/patch/20261028210518.666179-1-koralilgun@gmail.com/

Testing: hostapd and wpa_supplicant build without warnings (FT, SAE,
OCV, testing options). hwsim under UML, kernel wireless-next 2c50cd5d1:
the 37 existing FT-SAE tests pass on main, and the 40 FT-SAE tests pass
with the series. On main with only patch 3 applied,
ap_ft_sae_omit_rsnxe fails with "FTE indicated that AP uses RSNXE, but
RSNXE was not included in Beacon/Probe Response frames", which patch 1
fixes. The workaround of patch 2 ran in an earlier form on three APs
with sae_pwe=2 and FT-SAE: an iPad that looped on every FT
reassociation completed each roam with a single reassociation.

Koral Ilgun (3):
  FT: Do not set RSNXE Used when the RSNXE is omitted
  FT: Add ft_rsnxe_used_only_with_rsnxe interoperability workaround
  tests: FT-SAE RSNXE Used without RSNXE in Beacon or request

 hostapd/config_file.c     |  2 ++
 hostapd/hostapd.conf      | 12 +++++++++
 src/ap/ap_config.h        |  3 +++
 src/ap/wpa_auth.h         |  1 +
 src/ap/wpa_auth_ft.c      |  5 ++++
 src/ap/wpa_auth_glue.c    |  2 ++
 tests/hwsim/test_ap_ft.py | 57 ++++++++++++++++++++++++++++++++++++++-
 7 files changed, 81 insertions(+), 1 deletion(-)

-- 
2.43.0