From 6135a8a6aa11224611a4eb56afa83714a3b825ee Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Wed, 6 Apr 2022 15:12:06 +0300 Subject: [PATCH] Stop authentication attemps if AP does not disconnect us It would have been possible for the authentication attemps to go into a loop if the AP/Authenticator/authentication server were to believe EAP authentication succeeded when the local conclusion in Supplicant was failure. Avoid this by timing out authentication immediately on the second consecutive EAP authentication failure. Signed-off-by: Jouni Malinen --- wpa_supplicant/wpa_supplicant.c | 1 + wpa_supplicant/wpa_supplicant_i.h | 1 + wpa_supplicant/wpas_glue.c | 10 +++++++++- 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c index 3d3d5465a..64cad0af2 100644 --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c @@ -2226,6 +2226,7 @@ void wpa_supplicant_associate(struct wpa_supplicant *wpa_s, else rand_style = ssid->mac_addr; + wpa_s->eapol_failed = 0; wpa_s->multi_ap_ie = 0; wmm_ac_clear_saved_tspecs(wpa_s); wpa_s->reassoc_same_bss = 0; diff --git a/wpa_supplicant/wpa_supplicant_i.h b/wpa_supplicant/wpa_supplicant_i.h index e759dbd8b..da3c36166 100644 --- a/wpa_supplicant/wpa_supplicant_i.h +++ b/wpa_supplicant/wpa_supplicant_i.h @@ -949,6 +949,7 @@ struct wpa_supplicant { struct os_reltime pending_eapol_rx_time; u8 pending_eapol_rx_src[ETH_ALEN]; unsigned int last_eapol_matches_bssid:1; + unsigned int eapol_failed:1; unsigned int eap_expected_failure:1; unsigned int reattach:1; /* reassociation to the same BSS requested */ unsigned int mac_addr_changed:1; diff --git a/wpa_supplicant/wpas_glue.c b/wpa_supplicant/wpas_glue.c index 17fc05bcb..33bc831f3 100644 --- a/wpa_supplicant/wpas_glue.c +++ b/wpa_supplicant/wpas_glue.c @@ -298,13 +298,21 @@ static void wpa_supplicant_eapol_cb(struct eapol_sm *eapol, EAPOL_SUPP_RESULT_EXPECTED_FAILURE; if (result != EAPOL_SUPP_RESULT_SUCCESS) { + int timeout = 2; /* * Make sure we do not get stuck here waiting for long EAPOL * timeout if the AP does not disconnect in case of * authentication failure. */ - wpa_supplicant_req_auth_timeout(wpa_s, 2, 0); + if (wpa_s->eapol_failed) { + wpa_printf(MSG_DEBUG, + "EAPOL authentication failed again and AP did not disconnect us"); + timeout = 0; + } + wpa_s->eapol_failed = 1; + wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0); } else { + wpa_s->eapol_failed = 0; ieee802_1x_notify_create_actor(wpa_s, wpa_s->last_eapol_src); }