Fix PMF protect disconnection on session timeout

Request the driver to send a Deauthentication frame before doing
any other disconnection steps on the session timeout path. This is
needed when PMF is negotiated for the association since the driver
will need to find the STA entry and the PTK for it to be able to
protect the robust Deauthentication frame.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/src/ap/sta_info.c b/src/ap/sta_info.c
index 0b90e3b..c7d051b 100644 (file)
--- a/src/ap/sta_info.c
+++ b/src/ap/sta_info.c
@@ -473,7 +473,6 @@ static void ap_handle_session_timer(void *eloop_ctx, void *timeout_ctx)
 {
        struct hostapd_data *hapd = eloop_ctx;
        struct sta_info *sta = timeout_ctx;
-       u8 addr[ETH_ALEN];
 
        if (!(sta->flags & WLAN_STA_AUTH)) {
                if (sta->flags & WLAN_STA_GAS) {
@@ -484,6 +483,8 @@ static void ap_handle_session_timer(void *eloop_ctx, void *timeout_ctx)
                return;
        }
 
+       hostapd_drv_sta_deauth(hapd, sta->addr,
+                              WLAN_REASON_PREV_AUTH_NOT_VALID);
        mlme_deauthenticate_indication(hapd, sta,
                                       WLAN_REASON_PREV_AUTH_NOT_VALID);
        hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
@@ -491,9 +492,7 @@ static void ap_handle_session_timer(void *eloop_ctx, void *timeout_ctx)
                       "session timeout");
        sta->acct_terminate_cause =
                RADIUS_ACCT_TERMINATE_CAUSE_SESSION_TIMEOUT;
-       os_memcpy(addr, sta->addr, ETH_ALEN);
        ap_free_sta(hapd, sta);
-       hostapd_drv_sta_deauth(hapd, addr, WLAN_REASON_PREV_AUTH_NOT_VALID);
 }