DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Add an option allow canned EAP-Success for wired IEEE 802.1X

Browse source 
For wired IEEE 802.1X authentication, phase1="allow_canned_success=1"
can now be used to configure a mode that allows EAP-Success (and
EAP-Failure) without going through authentication step. Some switches
use such sequence when forcing the port to be authorized/unauthorized or
as a fallback option if the authentication server is unreachable. By
default, wpa_supplicant discards such frames to protect against
potential attacks by rogue devices, but this option can be used to
disable that protection for cases where the server/authenticator does
not need to be authenticated.

When enabled, this mode allows EAP-Success/EAP-Failure as an immediate
response to EAPOL-Start (or even without EAPOL-Start) and EAP-Success is
also allowed immediately after EAP-Identity exchange (fallback case for
authenticator not being able to connect to authentication server).

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2015-02-01 19:22:54 +02:00
parent 49fcc32e91
commit 7f7bfba919
3 changed files with 40 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
wpa_supplicant/wpa_supplicant.conf
View file

@ -940,6 +940,16 @@ fast_reauth=1
# * 2 = require cryptobinding
# EAP-WSC (WPS) uses following options: pin=<Device Password> or
# pbc=1.
#
# For wired IEEE 802.1X authentication, "allow_canned_success=1" can be
# used to configure a mode that allows EAP-Success (and EAP-Failure)
# without going through authentication step. Some switches use such
# sequence when forcing the port to be authorized/unauthorized or as a
# fallback option if the authentication server is unreachable. By default,
# wpa_supplicant discards such frames to protect against potential attacks
# by rogue devices, but this option can be used to disable that protection
# for cases where the server/authenticator does not need to be
# authenticated.
# phase2: Phase2 (inner authentication with TLS tunnel) parameters
# (string with field-value pairs, e.g., "auth=MSCHAPV2" for EAP-PEAP or
# "autheap=MSCHAPV2 autheap=MD5" for EAP-TTLS). "mschapv2_retry=0" can be