[PATCH 4/5] Treat Protocol-Error as Access-Reject in 802.1X

[aland at deployingradius.com]

From: "Alan T. DeKok" <aland at freeradius.org>

Signed-off-by: Alan DeKok <alan.dekok at inkbridge.io>
---
 src/ap/ieee802_1x.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/src/ap/ieee802_1x.c b/src/ap/ieee802_1x.c
index 91e501ef3..346bc59a2 100644
--- a/src/ap/ieee802_1x.c
+++ b/src/ap/ieee802_1x.c
@@ -2060,7 +2060,8 @@ ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req,
 
 	if (hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
 	    hdr->code != RADIUS_CODE_ACCESS_REJECT &&
-	    hdr->code != RADIUS_CODE_ACCESS_CHALLENGE) {
+	    hdr->code != RADIUS_CODE_ACCESS_CHALLENGE &&
+	    hdr->code != RADIUS_CODE_PROTOCOL_ERROR) {
 		wpa_printf(MSG_INFO, "Unknown RADIUS message code");
 		return RADIUS_RX_UNKNOWN;
 	}
@@ -2166,6 +2167,23 @@ ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req,
 			sm->eap_if->aaaMethodTimeout = 0;
 		}
 		break;
+	case RADIUS_CODE_PROTOCOL_ERROR:
+		sm->eap_if->aaaFail = true;
+		override_eapReq = 1;
+		if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_WLAN_REASON_CODE,
+					      &reason_code) == 0) {
+			wpa_printf(MSG_DEBUG,
+				   "RADIUS server indicated WLAN-Reason-Code %u in Protocol-Error for "
+				   MACSTR, reason_code, MAC2STR(sta->addr));
+			sta->disconnect_reason_code = reason_code;
+		}
+		if (radius_msg_get_attr_int32(msg, RADIUS_ATTR_ERROR_CAUSE,
+					      &reason_code) == 0) {
+			wpa_printf(MSG_DEBUG,
+				   "RADIUS server indicated Error-Cause %u in Protocol-Error for "
+				   MACSTR, reason_code, MAC2STR(sta->addr));
+		}
+		break;
 	}
 
 	ieee802_1x_decapsulate_radius(hapd, sta);
-- 
2.49.0