DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

WEP shared key: Use os_memcmp_const() for hash/password comparisons

Browse source 
This makes the implementation less likely to provide useful timing
information to potential attackers from comparisons of information
received from a remote device and private material known only by the
authorized devices.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-06-29 20:27:45 +03:00
parent 3e4b77c9bd
commit 34ef46ce54
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/ap/ieee802_11.c
View file

@ -236,7 +236,8 @@ static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
/* Transaction 3 */ /* Transaction 3 */
if (!iswep || !sta->challenge || !challenge || if (!iswep || !sta->challenge || !challenge ||
os_memcmp(sta->challenge, challenge, WLAN_AUTH_CHALLENGE_LEN)) { os_memcmp_const(sta->challenge, challenge,
WLAN_AUTH_CHALLENGE_LEN)) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO, HOSTAPD_LEVEL_INFO,
"shared key authentication - invalid " "shared key authentication - invalid "