[PATCH v2] eap_peer: Ignore Identity heartbeats in round counting

[Jouni Malinen]

On Tue, Apr 14, 2026 at 05:54:46PM +0800, xinpeng wang wrote:
> In many wired 802.1X network environments, the Authenticator sends
> periodic EAP-Request/Identity messages as a non-standard keep-alive
> mechanism after a successful authentication.
> 
> Since these Identity Requests are often short messages (< 20 bytes),
> they consistently increment 'num_rounds_short' without being reset
> by any interleaved long messages. This eventually causes the EAP state
> machine to exceed EAP_MAX_AUTH_ROUNDS_SHORT and transition to the
> FAILURE state. While the network may remain connected, this leads to
> spurious EAP failure logs and unnecessary state transitions.
> 
> Modify the round-trip counting logic in SM_STATE(EAP, RECEIVED) to
> exclude Identity Requests when no EAP method is currently selected.
> This prevents the counter from overflowing due to network probing
> or keep-alive messages, while still maintaining protection against
> protocol loops during active EAP method negotiation.

Thanks, applied.
 
-- 
Jouni Malinen                                            PGP id EFC895FA