Re: [PATCH 7/9] station: set OCVC for handshakes

[Denis Kenzior <denkenz at gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2051 bytes --]

Hi James,

On 9/27/21 12:04 PM, James Prestwood wrote:
> Setting OCVC true for all connections except FT-over-DS. Since
> Authentication is skipped there is no way to obtain OCI information
> from the kernel prior to (Re)association.
> ---
>   src/station.c | 15 +++++++++++----
>   1 file changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/src/station.c b/src/station.c
> index 672c4860..96794998 100644
> --- a/src/station.c
> +++ b/src/station.c
> @@ -998,11 +998,11 @@ static int station_build_handshake_rsn(struct handshake_state *hs,
>   	enum security security = network_get_security(network);
>   	bool add_mde = false;
>   	struct erp_cache_entry *erp_cache = NULL;
> -
>   	struct ie_rsn_info bss_info;
>   	uint8_t rsne_buf[256];
>   	struct ie_rsn_info info;
>   	uint8_t *ap_ie;
> +	bool ocvc = true;
>   
>   	memset(&info, 0, sizeof(info));
>   
> @@ -1080,6 +1080,16 @@ static int station_build_handshake_rsn(struct handshake_state *hs,
>   		goto not_supported;
>   
>   build_ie:
> +	if (IE_AKM_IS_FT(info.akm_suites)) {
> +		/* Don't set OCVC if FT-over-DS is enabled */
> +		if (bss->mde[2] & 1)
> +			ocvc = false;
> +
> +		add_mde = true;
> +	}
> +
> +	info.ocvc = ocvc;
> +

You can't really do it this way since this builds the handshake for an initial 
association.  Only FT-over-DS is affected, and so you want to reset ocvc 
elsewhere.  Maybe prior to calling netdev_fast_transition_over_ds or somewhere 
inside that function.

>   	/* RSN takes priority */
>   	if (bss->rsne) {
>   		ap_ie = bss->rsne;
> @@ -1099,9 +1109,6 @@ build_ie:
>   	if (!handshake_state_set_supplicant_ie(hs, rsne_buf))
>   		goto not_supported;
>   
> -	if (IE_AKM_IS_FT(info.akm_suites))
> -		add_mde = true;
> -
>   	/*
>   	 * If FILS was chosen, the ERP cache has been verified to exist. Take
>   	 * a reference now so it remains valid (in case of expiration) until
> 

Also, can we add a way to disable OCV in case we get into compatibility issues?

Regards,
-Denis