tls-eap: Reject EAP Start packets from clients

The Start flag should only be set in the first packet from server to client so we never should process one received from a client.
2026-07-24 08:47:37 +02:00
parent f1c70a04d5
commit fd7fccabe8
1 changed files with 6 additions and 0 deletions
@@ -360,6 +360,12 @@ METHOD(tls_eap_t, process, status_t,
 	if ((this->type == EAP_PT_EAP && (pkt->flags & EAP_PT_START)) ||
        (pkt->flags & EAP_TLS_START))
 	{
+		if (this->is_server)
+		{
+			DBG1(DBG_TLS, "received unexpected %N start from client",
+				 eap_type_names, this->type);
+			return FAILED;
+		}
 		if (this->type == EAP_TTLS || this->type == EAP_TNC ||
 			this->type == EAP_PEAP || this->type == EAP_PT_EAP)
 		{