Some server implementation don't seem to provide the valid compound MACs. In the meantime, iwd will ignore the invalid Crypto-Binding TLVs as their usage is optional. --- src/eap-peap.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/eap-peap.c b/src/eap-peap.c index 273a206f..005eacc4 100644 --- a/src/eap-peap.c +++ b/src/eap-peap.c @@ -231,8 +231,11 @@ static int eap_extensions_handle_cryptobinding_tlv(struct eap_state *eap, cryptobinding_compound_mac_len)) { l_error("PEAP: Generated compound MAC and server compound MAC " "don't match."); - - return -EIO; + /* + * Ignore the Crypto-Binding TLV in the case of unmatched + * compound MACs. + */ + return 0; } /* Build response Crypto-Binding TLV */ -- 2.13.6