tree fdea5bcfc84d7d6632a333dee90c0e357e7fef73
parent 772e12cfed81754a9fd890be7bc77bc602a549b5
author Jouni Malinen <jouni@qca.qualcomm.com> 1415991425 +0200
committer Dmitry Shmidt <dimitrysh@google.com> 1416262416 -0800

Work around AP misbehavior on EAPOL-Key descriptor version

It looks like some APs are incorrectly selecting descriptor version 3
(AES-128-CMAC) for EAPOL-Key frames when version 2 (HMAC-SHA1) was
expected to be used. This is likely triggered by an attempt to negotiate
PMF with SHA1-based AKM.

Since AES-128-CMAC is considered stronger than HMAC-SHA1, allow the
incorrect, but stronger, option to be used in these cases to avoid
interoperability issues with deployed APs.

This issue shows up with "WPA: CCMP is used, but EAPOL-Key descriptor
version (3) is not 2" in debug log. With the new workaround, this issue
is ignored and "WPA: Interoperability workaround: allow incorrect
(should have been HMAC-SHA1), but stronger (is AES-128-CMAC), descriptor
version to be used" is written to the log.

Bug: 18411110

Change-Id: I9ae12e8882adc9e785f6e4cef9f30b89bf72dcd2
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>