aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorCy Schubert <cy@FreeBSD.org>2018-07-19 16:58:20 +0000
committerCy Schubert <cy@FreeBSD.org>2018-07-19 16:58:20 +0000
commitd8b7f52b5107a4090323512694e518f9cffbaa60 (patch)
treed1414fb8e430253cd895ac92a4bec452de75b0dc
parentd221b2962e9d35b81ced0fac31ee78889d02873f (diff)
downloadsrc-d8b7f52b5107a4090323512694e518f9cffbaa60.tar.gz
src-d8b7f52b5107a4090323512694e518f9cffbaa60.zip
Import upline security patch: Prevent installation of an all-zero TK
This is also upline git commit 53bb18cc8b7a4da72e47e4b3752d0d2135cffb23. Obtained from: https://w1.fi/security/2017-1/\ rebased-v2.6-0004-Prevent-installation-\ of-an-all-zero-TK.patch
Notes
Notes: svn path=/vendor/wpa/dist/; revision=336490
-rw-r--r--src/common/wpa_common.h1
-rw-r--r--src/rsn_supp/wpa.c5
-rw-r--r--src/rsn_supp/wpa_i.h1
3 files changed, 3 insertions, 4 deletions
diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h
index d2002857ae86..1021ccb05a71 100644
--- a/src/common/wpa_common.h
+++ b/src/common/wpa_common.h
@@ -215,6 +215,7 @@ struct wpa_ptk {
size_t kck_len;
size_t kek_len;
size_t tk_len;
+ int installed; /* 1 if key has already been installed to driver */
};
struct wpa_gtk {
diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index 7a2c68d56f53..0550a412fcc7 100644
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -510,7 +510,6 @@ static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
os_memset(buf, 0, sizeof(buf));
}
sm->tptk_set = 1;
- sm->tk_to_set = 1;
kde = sm->assoc_wpa_ie;
kde_len = sm->assoc_wpa_ie_len;
@@ -615,7 +614,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
enum wpa_alg alg;
const u8 *key_rsc;
- if (!sm->tk_to_set) {
+ if (sm->ptk.installed) {
wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
"WPA: Do not re-install same PTK to the driver");
return 0;
@@ -659,7 +658,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
/* TK is not needed anymore in supplicant */
os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
- sm->tk_to_set = 0;
+ sm->ptk.installed = 1;
if (sm->wpa_ptk_rekey) {
eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
index 9a54631888cf..41f371f26c69 100644
--- a/src/rsn_supp/wpa_i.h
+++ b/src/rsn_supp/wpa_i.h
@@ -24,7 +24,6 @@ struct wpa_sm {
struct wpa_ptk ptk, tptk;
int ptk_set, tptk_set;
unsigned int msg_3_of_4_ok:1;
- unsigned int tk_to_set:1;
u8 snonce[WPA_NONCE_LEN];
u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */
int renew_snonce;