Browse Source

qcacld-3.0: Fix Invalid EAPOL-Key MIC packet drop issue

After the roaming is offloaded to Firmware when the GTK rekey
happens in Host proper KCK should be used to verify MIC.
In WPA2 GTK rekey is offloaded to Firmware but not in WPA3 case.
In WPA3 SuiteB Firmware sends KCK in Key material extended TLV
instead of Key material TLV in Roam sync indication event, as the
Keys length is more in WPA3 SuiteB. And the Key material ext TLV
is parsed improperly in driver and the same is sent in roam+auth
event to wpa_supplicant. This wrong KCK was used to verify MIC
received in EAPOL.
This fix is to properly parse the KCK and KEK from Key buffer.

Change-Id: I57658b918bb41de2b5d2476d89b026d1f5982337
CRs-Fixed: 2713711
Srikanth Marepalli 4 years ago
parent
commit
89a9eb0370
1 changed files with 6 additions and 6 deletions
  1. 6 6
      core/wma/src/wma_scan_roam.c

+ 6 - 6
core/wma/src/wma_scan_roam.c

@@ -2576,14 +2576,14 @@ static int wma_fill_roam_synch_buffer(tp_wma_handle wma,
 		kck_len = KCK_192BIT_KEY_LEN;
 		kek_len = KEK_256BIT_KEY_LEN;
 
-		roam_synch_ind_ptr->kek_len = kek_len;
-		qdf_mem_copy(roam_synch_ind_ptr->kek,
-			     key_ft->key_buffer, kek_len);
-
 		roam_synch_ind_ptr->kck_len = kck_len;
 		qdf_mem_copy(roam_synch_ind_ptr->kck,
-			     (key_ft->key_buffer + kek_len),
-			     kck_len);
+			     key_ft->key_buffer, kck_len);
+
+		roam_synch_ind_ptr->kek_len = kek_len;
+		qdf_mem_copy(roam_synch_ind_ptr->kek,
+			     (key_ft->key_buffer + kck_len),
+			     kek_len);
 
 		qdf_mem_copy(roam_synch_ind_ptr->replay_ctr,
 			     (key_ft->key_buffer + kek_len + kck_len),