From c975fec986febdb2dd7c6f3f14f4df12d2a78460 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Sat, 26 Sep 2026 21:36:46 +0200 Subject: [PATCH] hostapd: start DPP Network Introduction unless a DPP PMKSA is cached wpas_dpp_check_connect() skipped Network Introduction whenever any PMKSA for the AP existed, because wpa_sm_pmksa_exists() matches any AKM. A backhaul STA that had joined with SAE while the AP offered no DPP AKM kept that SAE PMKSA, and once the AP offered DPP again it associated with the DPP AKM and no PMKID, which the AP rejected with status 53. Require a PMKSA of the DPP AKM, under the AP MLD address as well for an MLD, as patch 163 stores it. Signed-off-by: Felix Fietkau --- ...-pmksa-of-the-dpp-akm-before-connect.patch | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 package/network/services/hostapd/patches/164-dpp-check-for-a-pmksa-of-the-dpp-akm-before-connect.patch diff --git a/package/network/services/hostapd/patches/164-dpp-check-for-a-pmksa-of-the-dpp-akm-before-connect.patch b/package/network/services/hostapd/patches/164-dpp-check-for-a-pmksa-of-the-dpp-akm-before-connect.patch new file mode 100644 index 00000000000..6bb96b645cf --- /dev/null +++ b/package/network/services/hostapd/patches/164-dpp-check-for-a-pmksa-of-the-dpp-akm-before-connect.patch @@ -0,0 +1,56 @@ +From: Felix Fietkau +Date: Sat, 26 Sep 2026 21:30:00 +0200 +Subject: [PATCH] DPP: require a PMKSA of the DPP AKM before skipping Network + Introduction + +wpas_dpp_check_connect() skips the Network Introduction protocol when +wpa_sm_pmksa_exists() finds a PMKSA for the BSS. That lookup ignores the +AKM, so a PMKSA from an SAE association, made while the AP did not offer +the DPP AKM, counts as one for DPP. Once the AP offers DPP again, the +station associates with the DPP AKM without a PMKID, and the AP rejects +the Association Request with status 53 (invalid PMKID), because +wpa_validate_wpa_ie() requires a PMKSA for DPP. + +Look up a PMKSA of the DPP AKM instead. For an AP MLD, also require the +entry under the AP MLD address, which is the one an MLD association looks +up and which the Peer Discovery Response handler stores beside the +per-link entry. + +Signed-off-by: Felix Fietkau +--- + +--- a/wpa_supplicant/dpp_supplicant.c ++++ b/wpa_supplicant/dpp_supplicant.c +@@ -4564,6 +4564,23 @@ static int wpas_dpp_start_private_peer_i + #endif /* CONFIG_DPP3 */ + + ++static bool wpas_dpp_pmksa_exists(struct wpa_supplicant *wpa_s, ++ struct wpa_ssid *ssid, struct wpa_bss *bss) ++{ ++ if (!wpa_sm_pmksa_cache_get(wpa_s->wpa, bss->bssid, NULL, ssid, ++ WPA_KEY_MGMT_DPP)) ++ return false; ++ ++ /* An MLD association looks up the PMKSA by the AP MLD address. */ ++ if (!is_zero_ether_addr(bss->mld_addr) && ++ !wpa_sm_pmksa_cache_get(wpa_s->wpa, bss->mld_addr, NULL, ssid, ++ WPA_KEY_MGMT_DPP)) ++ return false; ++ ++ return true; ++} ++ ++ + int wpas_dpp_check_connect(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid, + struct wpa_bss *bss) + { +@@ -4580,7 +4597,7 @@ int wpas_dpp_check_connect(struct wpa_su + if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 && + !(ied.key_mgmt & WPA_KEY_MGMT_DPP)) + return 0; /* AP does not support DPP AKM - continue */ +- if (wpa_sm_pmksa_exists(wpa_s->wpa, bss->bssid, wpa_s->own_addr, ssid)) ++ if (wpas_dpp_pmksa_exists(wpa_s, ssid, bss)) + return 0; /* PMKSA exists for DPP AKM - continue */ + + if (!ssid->dpp_connector || !ssid->dpp_netaccesskey ||