DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Stop authentication attemps if AP does not disconnect us

Browse source 
It would have been possible for the authentication attemps to go into a
loop if the AP/Authenticator/authentication server were to believe EAP
authentication succeeded when the local conclusion in Supplicant was
failure. Avoid this by timing out authentication immediately on the
second consecutive EAP authentication failure.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This commit is contained in:
Jouni Malinen 2022-04-06 15:12:06 +03:00 committed by Jouni Malinen
parent 88ab59d71b
commit 6135a8a6aa
3 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
wpa_supplicant/wpa_supplicant.c
View file

@ -2226,6 +2226,7 @@ void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
else else
rand_style = ssid->mac_addr; rand_style = ssid->mac_addr;
wpa_s->eapol_failed = 0;
wpa_s->multi_ap_ie = 0; wpa_s->multi_ap_ie = 0;
wmm_ac_clear_saved_tspecs(wpa_s); wmm_ac_clear_saved_tspecs(wpa_s);
wpa_s->reassoc_same_bss = 0; wpa_s->reassoc_same_bss = 0;

1
wpa_supplicant/wpa_supplicant_i.h
View file

@ -949,6 +949,7 @@ struct wpa_supplicant {
struct os_reltime pending_eapol_rx_time; struct os_reltime pending_eapol_rx_time;
u8 pending_eapol_rx_src[ETH_ALEN]; u8 pending_eapol_rx_src[ETH_ALEN];
unsigned int last_eapol_matches_bssid:1; unsigned int last_eapol_matches_bssid:1;
unsigned int eapol_failed:1;
unsigned int eap_expected_failure:1; unsigned int eap_expected_failure:1;
unsigned int reattach:1; /* reassociation to the same BSS requested */ unsigned int reattach:1; /* reassociation to the same BSS requested */
unsigned int mac_addr_changed:1; unsigned int mac_addr_changed:1;

10
wpa_supplicant/wpas_glue.c
View file

@ -298,13 +298,21 @@ static void wpa_supplicant_eapol_cb(struct eapol_sm *eapol,
EAPOL_SUPP_RESULT_EXPECTED_FAILURE; EAPOL_SUPP_RESULT_EXPECTED_FAILURE;
if (result != EAPOL_SUPP_RESULT_SUCCESS) { if (result != EAPOL_SUPP_RESULT_SUCCESS) {
int timeout = 2;
/* /*
* Make sure we do not get stuck here waiting for long EAPOL * Make sure we do not get stuck here waiting for long EAPOL
* timeout if the AP does not disconnect in case of * timeout if the AP does not disconnect in case of
* authentication failure. * authentication failure.
*/ */
wpa_supplicant_req_auth_timeout(wpa_s, 2, 0); if (wpa_s->eapol_failed) {
wpa_printf(MSG_DEBUG,
"EAPOL authentication failed again and AP did not disconnect us");
timeout = 0;
}
wpa_s->eapol_failed = 1;
wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
} else { } else {
wpa_s->eapol_failed = 0;
ieee802_1x_notify_create_actor(wpa_s, wpa_s->last_eapol_src); ieee802_1x_notify_create_actor(wpa_s, wpa_s->last_eapol_src);
} }