[RFC] netdev: destroy auth-proto in connect event, for ext auth

[RFC] netdev: destroy auth-proto in connect event, for ext auth

[James Prestwood]

With external auth there is no associate event meaning the auth proto
never gets freed, which prevents eapol from starting inside the
OCI callback. Check for this specific case and free the auth proto
in the connect event.
---
 src/netdev.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/netdev.c b/src/netdev.c
index 02496c92..9deff699 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -2615,6 +2615,8 @@ static void netdev_connect_event(struct l_genl_msg *msg, struct netdev *netdev)
 	struct handshake_state *hs = netdev->handshake;
 	bool timeout = false;
 	uint32_t timeout_reason = 0;
+	struct netdev_handshake_state *nhs = l_container_of(netdev->handshake,
+				struct netdev_handshake_state, super);
 
 	l_debug("");
 
@@ -2821,6 +2823,16 @@ process_resp_ies:
 
 	l_debug("Request / Response IEs parsed");
 
+	/*
+	 * This should only be the case for Fullmac/External auth. Here we don't
+	 * get an associate event, so we need to destroy the auth-proto now
+	 * so eapol gets started within the OCI callback
+	 */
+	if (netdev->ap && nhs->type == CONNECTION_TYPE_FULLMAC) {
+		auth_proto_free(netdev->ap);
+		netdev->ap = NULL;
+	}
+
 	if (netdev->sm) {
 		if (!hs->chandef) {
 			if (netdev_get_oci(netdev) < 0)
-- 
2.34.1

Re: [RFC] netdev: destroy auth-proto in connect event, for ext auth

[Denis Kenzior]

Hi James,

On 12/19/24 6:44 AM, James Prestwood wrote:
> With external auth there is no associate event meaning the auth proto
> never gets freed, which prevents eapol from starting inside the
> OCI callback. Check for this specific case and free the auth proto
> in the connect event.
> ---
>   src/netdev.c | 12 ++++++++++++
>   1 file changed, 12 insertions(+)
> 

<snip>

> @@ -2821,6 +2823,16 @@ process_resp_ies:
>   
>   	l_debug("Request / Response IEs parsed");
>   
> +	/*
> +	 * This should only be the case for Fullmac/External auth. Here we don't
> +	 * get an associate event, so we need to destroy the auth-proto now
> +	 * so eapol gets started within the OCI callback
> +	 */
> +	if (netdev->ap && nhs->type == CONNECTION_TYPE_FULLMAC) {
> +		auth_proto_free(netdev->ap);
> +		netdev->ap = NULL;
> +	}
> +

Would this be better done in netdev_external_auth_sae_tx_associate() instead?

>   	if (netdev->sm) {
>   		if (!hs->chandef) {
>   			if (netdev_get_oci(netdev) < 0)

Regards,
-Denis