DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

RSN: Do not include RC4 use in FIPS builds

Browse source 
CONFIG_NO_RC4=y could have been used to remove this functionality, but
it might as well be done automatically based on CONFIG_FIPS=y as well.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2022-11-26 11:29:28 +02:00
parent df5ae2aadb
commit 1d42dafce6
2 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/ap/wpa_auth.c
View file

@ -1667,7 +1667,7 @@ void __wpa_send_eapol(struct wpa_authenticator *wpa_auth,
"RSN: Encrypted Key Data from AES-WRAP", "RSN: Encrypted Key Data from AES-WRAP",
key_data, key_data_len); key_data, key_data_len);
WPA_PUT_BE16(key_mic + mic_len, key_data_len); WPA_PUT_BE16(key_mic + mic_len, key_data_len);
#ifndef CONFIG_NO_RC4 #if !defined(CONFIG_NO_RC4) && !defined(CONFIG_FIPS)
} else if (sm->PTK.kek_len == 16) { } else if (sm->PTK.kek_len == 16) {
u8 ek[32]; u8 ek[32];
@ -1681,7 +1681,7 @@ void __wpa_send_eapol(struct wpa_authenticator *wpa_auth,
os_memcpy(key_data, buf, key_data_len); os_memcpy(key_data, buf, key_data_len);
rc4_skip(ek, 32, 256, key_data, key_data_len); rc4_skip(ek, 32, 256, key_data, key_data_len);
WPA_PUT_BE16(key_mic + mic_len, key_data_len); WPA_PUT_BE16(key_mic + mic_len, key_data_len);
#endif /* CONFIG_NO_RC4 */ #endif /* !(CONFIG_NO_RC4 || CONFIG_FIPS) */
} else { } else {
os_free(hdr); os_free(hdr);
bin_clear_free(buf, key_data_len); bin_clear_free(buf, key_data_len);

12
src/rsn_supp/wpa.c
View file

@ -2640,11 +2640,11 @@ static int wpa_supplicant_process_1_of_2_wpa(struct wpa_sm *sm,
gd->keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >> gd->keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
WPA_KEY_INFO_KEY_INDEX_SHIFT; WPA_KEY_INFO_KEY_INDEX_SHIFT;
if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) { if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
#ifdef CONFIG_NO_RC4 #if defined(CONFIG_NO_RC4) || defined(CONFIG_FIPS)
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
"WPA: RC4 not supported in the build"); "WPA: RC4 not supported in the build");
return -1; return -1;
#else /* CONFIG_NO_RC4 */ #else /* CONFIG_NO_RC4 || CONFIG_FIPS */
u8 ek[32]; u8 ek[32];
if (key_data_len > sizeof(gd->gtk)) { if (key_data_len > sizeof(gd->gtk)) {
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
@ -2662,7 +2662,7 @@ static int wpa_supplicant_process_1_of_2_wpa(struct wpa_sm *sm,
return -1; return -1;
} }
forced_memzero(ek, sizeof(ek)); forced_memzero(ek, sizeof(ek));
#endif /* CONFIG_NO_RC4 */ #endif /* CONFIG_NO_RC4 || CONFIG_FIPS */
} else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) { } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
if (maxkeylen % 8) { if (maxkeylen % 8) {
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
@ -3048,11 +3048,11 @@ static int wpa_supplicant_decrypt_key_data(struct wpa_sm *sm,
/* Decrypt key data here so that this operation does not need /* Decrypt key data here so that this operation does not need
* to be implemented separately for each message type. */ * to be implemented separately for each message type. */
if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) { if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
#ifdef CONFIG_NO_RC4 #if defined(CONFIG_NO_RC4) || defined(CONFIG_FIPS)
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
"WPA: RC4 not supported in the build"); "WPA: RC4 not supported in the build");
return -1; return -1;
#else /* CONFIG_NO_RC4 */ #else /* CONFIG_NO_RC4 || CONFIG_FIPS */
u8 ek[32]; u8 ek[32];
wpa_printf(MSG_DEBUG, "WPA: Decrypt Key Data using RC4"); wpa_printf(MSG_DEBUG, "WPA: Decrypt Key Data using RC4");
@ -3065,7 +3065,7 @@ static int wpa_supplicant_decrypt_key_data(struct wpa_sm *sm,
return -1; return -1;
} }
forced_memzero(ek, sizeof(ek)); forced_memzero(ek, sizeof(ek));
#endif /* CONFIG_NO_RC4 */ #endif /* CONFIG_NO_RC4 || CONFIG_FIPS */
} else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES || } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES ||
ver == WPA_KEY_INFO_TYPE_AES_128_CMAC || ver == WPA_KEY_INFO_TYPE_AES_128_CMAC ||
wpa_use_aes_key_wrap(sm->key_mgmt)) { wpa_use_aes_key_wrap(sm->key_mgmt)) {