eap-authenticator: Enforce failure if MSK generation fails

Without this, the authentication succeeded if the server sent an early
EAP-Success message for mutual, key-generating EAP methods like EAP-TLS,
which may be used in EAP-only scenarios but would complete without server
or client authentication.  For clients configured for such EAP-only
scenarios, a rogue server could capture traffic after the tunnel is
established or even access hosts behind the client.  For non-mutual EAP
methods, public key server authentication has been enforced for a while.

A server previously could also crash a client by sending an EAP-Success
immediately without initiating an actual EAP method.

Fixes: 0706c39cda ("added support for EAP methods not establishing an MSK")
Fixes: CVE-2021-45079

This commit is contained in:

Tobias Brunner

2022-01-20 17:23:24 +01:00

parent de15386d94

commit 64cc9acbf0

5 changed files with 40 additions and 8 deletions

									
										src/libcharon/plugins/eap_gtc/eap_gtc.c
									
		+1
		-1
	
												View File
												
				@@ -195,7 +195,7 @@ METHOD(eap_method_t, get_type, eap_type_t,

				METHOD(eap_method_t, get_msk, status_t,

					private_eap_gtc_t *this, chunk_t *msk)

				{

					return FAILED;

					return NOT_SUPPORTED;

				}

				METHOD(eap_method_t, get_identifier, uint8_t,