DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

SAE: Clear rejected groups list on continuous failures

Browse source 
wpa_supplicant used to maintain the list of rejected groups for SAE over
multiple failed attempts. This could have some DoS issues, so clear this
list if SAE authentication attempts fails continuously.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2024-07-07 11:52:36 +03:00
parent 21fe042815
commit 0ab009db3c
3 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
wpa_supplicant/sme.c
View file

@ -2015,6 +2015,12 @@ void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
NULL); NULL);
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED); wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
if (wpa_s->sme.sae_rejected_groups &&
ssid->disabled_until.sec) {
wpa_printf(MSG_DEBUG,
"SME: Clear SAE state with rejected groups due to continuous failures");
wpa_s_clear_sae_rejected(wpa_s);
}
} }
if (res != 1) if (res != 1)
return; return;

2
wpa_supplicant/wpa_supplicant.c
View file

@ -2444,7 +2444,7 @@ void wpa_s_setup_sae_pt(struct wpa_config *conf, struct wpa_ssid *ssid,
} }
static void wpa_s_clear_sae_rejected(struct wpa_supplicant *wpa_s) void wpa_s_clear_sae_rejected(struct wpa_supplicant *wpa_s)
{ {
#if defined(CONFIG_SAE) && defined(CONFIG_SME) #if defined(CONFIG_SAE) && defined(CONFIG_SME)
os_free(wpa_s->sme.sae_rejected_groups); os_free(wpa_s->sme.sae_rejected_groups);

1
wpa_supplicant/wpa_supplicant_i.h
View file

@ -1893,6 +1893,7 @@ int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid);
int pmf_in_use(struct wpa_supplicant *wpa_s, const u8 *addr); int pmf_in_use(struct wpa_supplicant *wpa_s, const u8 *addr);
void wpa_s_setup_sae_pt(struct wpa_config *conf, struct wpa_ssid *ssid, void wpa_s_setup_sae_pt(struct wpa_config *conf, struct wpa_ssid *ssid,
bool force); bool force);
void wpa_s_clear_sae_rejected(struct wpa_supplicant *wpa_s);
bool wpas_is_sae_avoided(struct wpa_supplicant *wpa_s, bool wpas_is_sae_avoided(struct wpa_supplicant *wpa_s,
struct wpa_ssid *ssid, struct wpa_ssid *ssid,