| Message ID | 20240421125050.6649-8-brandtwjohn@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Basic SAE support for AP mode | expand |
| Context | Check | Description |
|---|---|---|
| tedd_an/pre-ci_am | success | Success |
| prestwoj/iwd-ci-gitlint | success | GitLint |
Hi John, On 4/21/24 5:50 AM, John Brandt wrote: > Experimental AP-mode support for receiving a Confirm frame when in the > COMMITTED state. The AP will reply with a Confirm frame. > > Note that when acting as an AP, on reception of a Commit frame, the AP > only replies with a Commit frame. The protocols allows to also already > send the Confirm frame, but older clients may not support simultaneously > receiving a Commit and Confirm frame. Could we add some basic unit tests. Mainly just sanity checks that the message flow works as expected with handshake->authenticator set. > --- > src/sae.c | 38 +++++++++++++++++++++++++------------- > 1 file changed, 25 insertions(+), 13 deletions(-) > > diff --git a/src/sae.c b/src/sae.c > index 8a1e311a..da55c764 100644 > --- a/src/sae.c > +++ b/src/sae.c > @@ -906,9 +906,13 @@ static int sae_process_confirm(struct sae_sm *sm, const uint8_t *from, > > sm->state = SAE_STATE_ACCEPTED; > > - sae_debug("Sending Associate to "MAC, MAC_STR(sm->handshake->aa)); > - > - sm->tx_assoc(sm->user_data); > + if (!sm->handshake->authenticator) { > + sae_debug("Sending Associate to "MAC, MAC_STR(sm->handshake->aa)); > + sm->tx_assoc(sm->user_data); > + } else { > + if (!sae_send_confirm(sm)) > + return -EPROTO; > + } > > return 0; > } > @@ -1059,16 +1063,24 @@ static int sae_verify_committed(struct sae_sm *sm, uint16_t transaction, > unsigned int skip; > struct ie_tlv_iter iter; > > - /* > - * Upon receipt of a Con event... > - * Then the protocol instance checks the value of Sync. If it > - * is greater than dot11RSNASAESync, the protocol instance shall send a > - * Del event to the parent process and transition back to Nothing state. > - * If Sync is not greater than dot11RSNASAESync, the protocol instance > - * shall increment Sync, transmit the last SAE Commit message sent to > - * the peer... > - */ > - if (transaction == SAE_STATE_CONFIRMED) { > + if (sm->handshake->authenticator && transaction == SAE_STATE_CONFIRMED) { > + /* > + * TODO: Sanity-check received Confirm frame from the client. For now > + * AP-mode SAE support is experimental and we simply accept the frame. > + * Note that the cryptographic confirm field value will still be checked > + * before replying with a Confirm frame. > + */ > + return 0; > + } else if (transaction == SAE_STATE_CONFIRMED) { > + /* > + * Upon receipt of a Con event... > + * Then the protocol instance checks the value of Sync. If it > + * is greater than dot11RSNASAESync, the protocol instance shall send a > + * Del event to the parent process and transition back to Nothing state. > + * If Sync is not greater than dot11RSNASAESync, the protocol instance > + * shall increment Sync, transmit the last SAE Commit message sent to > + * the peer... > + */ > if (sm->sync > SAE_SYNC_MAX) > return -ETIMEDOUT; >
diff --git a/src/sae.c b/src/sae.c index 8a1e311a..da55c764 100644 --- a/src/sae.c +++ b/src/sae.c @@ -906,9 +906,13 @@ static int sae_process_confirm(struct sae_sm *sm, const uint8_t *from, sm->state = SAE_STATE_ACCEPTED; - sae_debug("Sending Associate to "MAC, MAC_STR(sm->handshake->aa)); - - sm->tx_assoc(sm->user_data); + if (!sm->handshake->authenticator) { + sae_debug("Sending Associate to "MAC, MAC_STR(sm->handshake->aa)); + sm->tx_assoc(sm->user_data); + } else { + if (!sae_send_confirm(sm)) + return -EPROTO; + } return 0; } @@ -1059,16 +1063,24 @@ static int sae_verify_committed(struct sae_sm *sm, uint16_t transaction, unsigned int skip; struct ie_tlv_iter iter; - /* - * Upon receipt of a Con event... - * Then the protocol instance checks the value of Sync. If it - * is greater than dot11RSNASAESync, the protocol instance shall send a - * Del event to the parent process and transition back to Nothing state. - * If Sync is not greater than dot11RSNASAESync, the protocol instance - * shall increment Sync, transmit the last SAE Commit message sent to - * the peer... - */ - if (transaction == SAE_STATE_CONFIRMED) { + if (sm->handshake->authenticator && transaction == SAE_STATE_CONFIRMED) { + /* + * TODO: Sanity-check received Confirm frame from the client. For now + * AP-mode SAE support is experimental and we simply accept the frame. + * Note that the cryptographic confirm field value will still be checked + * before replying with a Confirm frame. + */ + return 0; + } else if (transaction == SAE_STATE_CONFIRMED) { + /* + * Upon receipt of a Con event... + * Then the protocol instance checks the value of Sync. If it + * is greater than dot11RSNASAESync, the protocol instance shall send a + * Del event to the parent process and transition back to Nothing state. + * If Sync is not greater than dot11RSNASAESync, the protocol instance + * shall increment Sync, transmit the last SAE Commit message sent to + * the peer... + */ if (sm->sync > SAE_SYNC_MAX) return -ETIMEDOUT;