denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls-eap: Reject EAP Start packets from clients

Browse Source 
The Start flag should only be set in the first packet from server to
client so we never should process one received from a client.
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:37 +02:00
parent f1c70a04d5
commit fd7fccabe8
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_eap.c
+6
View File
@@ -360,6 +360,12 @@ METHOD(tls_eap_t, process, status_t,
if ((this->type == EAP_PT_EAP && (pkt->flags & EAP_PT_START)) || if ((this->type == EAP_PT_EAP && (pkt->flags & EAP_PT_START)) ||
(pkt->flags & EAP_TLS_START)) (pkt->flags & EAP_TLS_START))
{ {
if (this->is_server)
{
DBG1(DBG_TLS, "received unexpected %N start from client",
eap_type_names, this->type);
return FAILED;
}
if (this->type == EAP_TTLS || this->type == EAP_TNC || if (this->type == EAP_TTLS || this->type == EAP_TNC ||
this->type == EAP_PEAP || this->type == EAP_PT_EAP) this->type == EAP_PEAP || this->type == EAP_PT_EAP)
{ {