[PATCH v3 1/3] FT: Do not set RSNXE Used for a base RSNE STA without the RSNXE

[Koral Ilgun]

From: Koral Ilgun <koral.ilgun at adtran.com>

The RSNXE Used subfield of the FTE MIC Control field tells the STA that
the AP uses the RSNXE. A STA that uses the base RSNE compares it with
the RSNXE of the Beacon and Probe Response frames: wpa_supplicant
rejects an FT Reassociation Response with the bit set when those frames
carried no RSNXE, with "FT: FTE indicated that AP uses RSNXE, but RSNXE
was not included in Beacon/Probe Response frames".

The AP set the bit from sae_pwe alone, so FT failed for such a STA when
the AP advertises no base RSNXE:
- rsn_override_omit_rsnxe=1 omits it.
- In WPA3-Personal Compatibility Mode, the base RSNE has no SAE AKM, so
  rsnxe_capab() of the base AKMs has no H2E bit, and in the common
  configuration wpa_write_rsnxe() writes no RSNXE at all, while the
  RSNXOE carries H2E for the override AKMs.

Do not set RSNXE Used for a STA on the base RSNE when the AP advertises
no RSNXE. A STA that selected RSN Overriding gets the bit as before.

The sae_pwe-only rule comes from 51d1924bd8cf ("FT: Set the new RSNXE
Used subfield in FT reassociation"); the two commits below made an AP
without a base RSNXE possible.

Fixes: 157b0163832c ("RSNE/RSNXE overriding for AP")
Fixes: 8b2ddfdbb688 ("RSNO: Allow RSNXE to be omitted")
Signed-off-by: Koral Ilgun <koral.ilgun at adtran.com>
---
 src/ap/wpa_auth_ft.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c
index e12f2ad8e..01bde71b7 100644
--- a/src/ap/wpa_auth_ft.c
+++ b/src/ap/wpa_auth_ft.c
@@ -2521,6 +2521,18 @@ static u8 * wpa_ft_process_ric(struct wpa_state_machine *sm, u8 *pos, u8 *end,
 }
 
 
+/* A STA that uses the base RSNE compares RSNXE Used with the RSNXE of the
+ * Beacon and Probe Response frames, and rejects the bit when those frames
+ * carry no RSNXE. RSN Overriding keeps the bit as before. */
+static bool wpa_ft_rsnxe_used_allowed(struct wpa_state_machine *sm)
+{
+	if (sm->rsn_override || sm->rsn_override_2)
+		return true;
+	return get_ie(sm->wpa_auth->wpa_ie, sm->wpa_auth->wpa_ie_len,
+		      WLAN_EID_RSNX) != NULL;
+}
+
+
 u8 * wpa_sm_write_assoc_resp_ies(struct wpa_state_machine *sm, u8 *pos,
 				 size_t max_len, int auth_alg,
 				 const u8 *req_ies, size_t req_ies_len,
@@ -2716,7 +2728,8 @@ u8 * wpa_sm_write_assoc_resp_ies(struct wpa_state_machine *sm, u8 *pos,
 	}
 	rsnxe_used = (auth_alg == WLAN_AUTH_FT) &&
 		(conf->sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
-		 conf->sae_pwe == SAE_PWE_BOTH);
+		 conf->sae_pwe == SAE_PWE_BOTH) &&
+		wpa_ft_rsnxe_used_allowed(sm);
 #ifdef CONFIG_TESTING_OPTIONS
 	if (sm->wpa_auth->conf.ft_rsnxe_used) {
 		rsnxe_used = sm->wpa_auth->conf.ft_rsnxe_used == 1;
-- 
2.43.0