From 0ab009db3c9e916ed4e2455cf203a1d19c1d2bfb Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sun, 7 Jul 2024 11:52:36 +0300 Subject: [PATCH] SAE: Clear rejected groups list on continuous failures wpa_supplicant used to maintain the list of rejected groups for SAE over multiple failed attempts. This could have some DoS issues, so clear this list if SAE authentication attempts fails continuously. Signed-off-by: Jouni Malinen --- wpa_supplicant/sme.c | 6 ++++++ wpa_supplicant/wpa_supplicant.c | 2 +- wpa_supplicant/wpa_supplicant_i.h | 1 + 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/wpa_supplicant/sme.c b/wpa_supplicant/sme.c index 906fa1036..0700ae61d 100644 --- a/wpa_supplicant/sme.c +++ b/wpa_supplicant/sme.c @@ -2015,6 +2015,12 @@ void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data) NULL); wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED); + if (wpa_s->sme.sae_rejected_groups && + ssid->disabled_until.sec) { + wpa_printf(MSG_DEBUG, + "SME: Clear SAE state with rejected groups due to continuous failures"); + wpa_s_clear_sae_rejected(wpa_s); + } } if (res != 1) return; diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c index 1b5a26090..6df13739b 100644 --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c @@ -2444,7 +2444,7 @@ void wpa_s_setup_sae_pt(struct wpa_config *conf, struct wpa_ssid *ssid, } -static void wpa_s_clear_sae_rejected(struct wpa_supplicant *wpa_s) +void wpa_s_clear_sae_rejected(struct wpa_supplicant *wpa_s) { #if defined(CONFIG_SAE) && defined(CONFIG_SME) os_free(wpa_s->sme.sae_rejected_groups); diff --git a/wpa_supplicant/wpa_supplicant_i.h b/wpa_supplicant/wpa_supplicant_i.h index 426d077d2..7a1286225 100644 --- a/wpa_supplicant/wpa_supplicant_i.h +++ b/wpa_supplicant/wpa_supplicant_i.h @@ -1893,6 +1893,7 @@ int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid); int pmf_in_use(struct wpa_supplicant *wpa_s, const u8 *addr); void wpa_s_setup_sae_pt(struct wpa_config *conf, struct wpa_ssid *ssid, bool force); +void wpa_s_clear_sae_rejected(struct wpa_supplicant *wpa_s); bool wpas_is_sae_avoided(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,