Consider two APs: AP1, AP2
Both APs configured with EAP 802.1x security mode
and OKC is enabled in both APs by default. Initially
DUT successfully associated with AP1, and generated
PMK1 by performing full EAP and added an entry for AP1
in pmk table. At this stage, pmk table has only one
entry for PMK1 (1. AP1-->PMK1).
Now DUT roams to AP2 using PMK1 (as OKC is enabled)
but session timeout happens on AP2 just before 4 way
handshake completion in FW. At this point of time DUT not
in authenticated state. Due to this DUT performs full EAP
with AP2 and generates PMK2. As there is no previous
entry of AP2 (AP2-->PMK1) in pmk table. When host gets
pmk delete command for BSSID of AP2, the BSSID match
fails. Hence host will not delete pmk entry of AP1 as well.
At this point of time, the PMK table has two entry
1. AP1-->PMK1 and 2. AP2 --> PMK2.
Ideally, if OKC is enabled then whenever timeout occurs in
a mobility domain, then the driver should clear all APs
cache entries related to that domain but as the BSSID
doesn't exist yet in the driver cache there is no way of
clearing the cache entries, without disturbing the legacy
roaming. Now security profile for both APs changed to FT-RSN.
DUT first disassociate with AP2 and successfully associated
with AP2 and perform full EAP and generates PMK3. DUT first
deletes PMK entry for AP2 and then adds a new entry for AP2.
At this point of time pmk table has two entry AP2--> PMK3
and AP1-->PMK1. Now DUT roamed to AP1 using
PMK3 but sends stale entry of AP1 (PMK1) to fw via RSO
command. This override PMK for both APs with PMK1
(as FW uses mlme session PMK for both APs in case of FT
roaming) and next time when FW try to roam to AP2 using
PMK1, AP2 rejects PMK1 (As AP2 is expecting PMK3) and
initiates full EAP with AP2, which is wrong.
Fix is to update pmk table entry for roamed AP1 with PMK3 value
comes to host via roam sync indication event.. By this host
override stale entry (if any) with the latest valid pmk for
that AP at a point of time.
Also add new api to get the sae single pmk ini value and
update the bss desc of single_pmk cap after intersecting the ini
value.
Change-Id: I12fecbae69d0d2a11f2a39eee6be960752d831bd
CRs-Fixed: 2889847
17a2fc170b