[PATCH v2] wpa_supplicant: Fix PMKSA caching with 802.1X 4-way handshake offload

[Chung-Hsien Hsu]

When driver-based 4-way handshake offload is used with IEEE 802.1X,
wpa_supplicant_eapol_cb() retrieves the PMK from the EAPOL state machine
and configures it to the driver. Since the subsequent 4-way handshake is
handled by the driver, the normal host-side EAPOL-Key processing path
that creates a PMKSA cache entry is not executed.

As a result, a subsequent connection cannot use PMKSA caching and may
require a full EAP authentication again.

Create a PMKSA cache entry after successful IEEE 802.1X authentication
for the same non-FT and non-Suite-B RSN cases where the host-driven
EAPOL-Key processing path does so. Only call wpa_sm_set_pmk() when a
valid authenticator address is available.

Signed-off-by: Chung-Hsien Hsu <chung-hsien.hsu at infineon.com>
---
v2:
- Clarified that the issue being fixed is the missing PMKSA cache entry
  and its impact on subsequent connections.
- Removed the unconditional wpa_sm_set_pmk() call with auth_addr ==
  NULL.
- Limited wpa_sm_set_pmk() to cases where PMKSA caching is applicable
  and a valid authenticator address is available.
- Updated the subject and commit message to focus on PMKSA caching.
---
 wpa_supplicant/wpas_glue.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/wpa_supplicant/wpas_glue.c b/wpa_supplicant/wpas_glue.c
index e57114503228..52fc468452a6 100644
--- a/wpa_supplicant/wpas_glue.c
+++ b/wpa_supplicant/wpas_glue.c
@@ -292,6 +292,7 @@ static void wpa_supplicant_eapol_cb(struct eapol_sm *eapol,
 				    void *ctx)
 {
 	struct wpa_supplicant *wpa_s = ctx;
+	const u8 *auth_addr;
 	int res, pmk_len;
 	u8 pmk[PMK_LEN_MAX];
 
@@ -380,6 +381,15 @@ static void wpa_supplicant_eapol_cb(struct eapol_sm *eapol,
 		wpa_printf(MSG_DEBUG, "Failed to set PMK to the driver");
 	}
 
+	if (wpa_s->wpa_proto == WPA_PROTO_RSN &&
+	    !wpa_key_mgmt_suite_b(wpa_s->key_mgmt) &&
+	    !wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
+		auth_addr = wpa_sm_get_auth_addr(wpa_s->wpa);
+		if (!is_zero_ether_addr(auth_addr))
+			wpa_sm_set_pmk(wpa_s->wpa, pmk, pmk_len, NULL,
+				       auth_addr);
+	}
+
 	wpa_supplicant_cancel_scan(wpa_s);
 	wpa_supplicant_cancel_auth_timeout(wpa_s);
 	wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
-- 
2.25.1