Previous BR EUI-64 is now used on second authentication attempt

If EAP-TLS is succesful and 4WH fails, the BR EUI-64 received on
EAP-TLS is not used on second attempt initial EAPOL-Key PMKID
generation.

Author: Mika Leppänen

source/6LoWPAN/ws/ws_pae_supp.c

@@ -105,6 +105,7 @@ typedef struct {
     bool auth_requested : 1;                               /**< Authentication has been requested */
     bool timer_running : 1;                                /**< Timer is running */
     bool new_br_eui_64_set : 1;                            /**< Border router address has been set */
+    bool new_br_eui_64_fresh : 1;                          /**< Border router address is fresh (set during this authentication attempt) */
 } pae_supp_t;
 
 
@@ -179,7 +180,7 @@ int8_t ws_pae_supp_authenticate(protocol_interface_info_entry_t *interface_ptr,
     pae_supp->sec_keys_nw_info.key_pan_id = dest_pan_id;
 
     // Prepare to receive new border router address
-    pae_supp->new_br_eui_64_set = false;
+    pae_supp->new_br_eui_64_fresh = false;
 
     // Stores target/parent address
     kmp_address_init(KMP_ADDR_EUI_64, &pae_supp->target_addr, dest_eui_64);
@@ -231,6 +232,7 @@ int8_t ws_pae_supp_border_router_addr_write(protocol_interface_info_entry_t *int
 
     memcpy(pae_supp->new_br_eui_64, eui_64, 8);
     pae_supp->new_br_eui_64_set = true;
+    pae_supp->new_br_eui_64_fresh = true;
 
     return 0;
 }
@@ -533,9 +535,13 @@ int8_t ws_pae_supp_init(protocol_interface_info_entry_t *interface_ptr, const se
     pae_supp->nw_key_insert = NULL;
     pae_supp->nw_key_index_set = NULL;
     pae_supp->initial_key_timer = 0;
-    pae_supp->auth_trickle_running = false;
     pae_supp->nw_keys_used_cnt = 0;
     pae_supp->timer_settings = timer_settings;
+    pae_supp->auth_trickle_running = false;
+    pae_supp->auth_requested = false;
+    pae_supp->timer_running = false;
+    pae_supp->new_br_eui_64_set = false;
+    pae_supp->new_br_eui_64_fresh = false;
 
     ws_pae_lib_supp_init(&pae_supp->entry);
 
@@ -895,15 +901,22 @@ static void ws_pae_supp_kmp_service_addr_get(kmp_service_t *service, kmp_api_t *
         kmp_address_eui_64_set(local_addr, mac_params.mac_long);
     }
 
-    if (pae_supp->new_br_eui_64_set) {
+    // BR address has been received during authentication attempt
+    if (pae_supp->new_br_eui_64_fresh) {
         kmp_address_eui_64_set(remote_addr, pae_supp->new_br_eui_64);
     } else {
         uint8_t *eui_64 = sec_prot_keys_ptk_eui_64_get(&pae_supp->entry.sec_keys);
+        // BR address is set on security keys (confirmed using 4WH)
         if (eui_64) {
             kmp_address_eui_64_set(remote_addr, eui_64);
         } else {
-            memset(remote_addr, 0, 8);
-            tr_error("No border router EUI-64");
+            // For initial EAPOL key, if BR address has been received during previous attempt, generate PMKID using it
+            if (pae_supp->new_br_eui_64_set && kmp_api_type_get(kmp) >= IEEE_802_1X_INITIAL_KEY) {
+                kmp_address_eui_64_set(remote_addr, pae_supp->new_br_eui_64);
+            } else {
+                memset(remote_addr, 0, 8);
+                tr_error("No border router EUI-64");
+            }
         }
     }
 }