DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

EAP-PAX server: Avoid debug prints of uninitialized memory in error cases

Browse source 
Use a separate error case handler for eap_pax_mac() failures and memcmp
to avoid wpa_hexdump() calls for the (mainly theoretical) local error
cases in deriving the MAC.

Fixes: b3c2b5d9f7 ("EAP-PAX server: Check hash function results")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2019-05-08 19:02:19 +03:00 committed by Jouni Malinen
parent 677e120181
commit 51dc146f3e
1 changed files with 20 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
src/eap_server/eap_server_pax.c
View file

@ -282,8 +282,13 @@ static Boolean eap_pax_check(struct eap_sm *sm, void *priv,
if (eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN, if (eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN,
wpabuf_mhead(respData), wpabuf_mhead(respData),
wpabuf_len(respData) - EAP_PAX_ICV_LEN, wpabuf_len(respData) - EAP_PAX_ICV_LEN,
NULL, 0, NULL, 0, icvbuf) < 0 || NULL, 0, NULL, 0, icvbuf) < 0) {
os_memcmp_const(icvbuf, icv, EAP_PAX_ICV_LEN) != 0) { wpa_printf(MSG_INFO,
"EAP-PAX: Failed to calculate ICV");
return TRUE;
}
if (os_memcmp_const(icvbuf, icv, EAP_PAX_ICV_LEN) != 0) {
wpa_printf(MSG_INFO, "EAP-PAX: Invalid ICV"); wpa_printf(MSG_INFO, "EAP-PAX: Invalid ICV");
wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected ICV", wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected ICV",
icvbuf, EAP_PAX_ICV_LEN); icvbuf, EAP_PAX_ICV_LEN);
@ -413,8 +418,13 @@ static void eap_pax_process_std_2(struct eap_sm *sm,
if (eap_pax_mac(data->mac_id, data->ck, EAP_PAX_CK_LEN, if (eap_pax_mac(data->mac_id, data->ck, EAP_PAX_CK_LEN,
data->rand.r.x, EAP_PAX_RAND_LEN, data->rand.r.x, EAP_PAX_RAND_LEN,
data->rand.r.y, EAP_PAX_RAND_LEN, data->rand.r.y, EAP_PAX_RAND_LEN,
(u8 *) data->cid, data->cid_len, mac) < 0 || (u8 *) data->cid, data->cid_len, mac) < 0) {
os_memcmp_const(mac, pos, EAP_PAX_MAC_LEN) != 0) { wpa_printf(MSG_INFO, "EAP-PAX: Failed to calculate MAC_CK");
data->state = FAILURE;
return;
}
if (os_memcmp_const(mac, pos, EAP_PAX_MAC_LEN) != 0) {
wpa_printf(MSG_INFO, "EAP-PAX: Invalid MAC_CK(A, B, CID) in " wpa_printf(MSG_INFO, "EAP-PAX: Invalid MAC_CK(A, B, CID) in "
"PAX_STD-2"); "PAX_STD-2");
wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected MAC_CK(A, B, CID)", wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected MAC_CK(A, B, CID)",
@ -435,8 +445,12 @@ static void eap_pax_process_std_2(struct eap_sm *sm,
if (eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN, if (eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN,
wpabuf_head(respData), wpabuf_head(respData),
wpabuf_len(respData) - EAP_PAX_ICV_LEN, NULL, 0, wpabuf_len(respData) - EAP_PAX_ICV_LEN, NULL, 0,
NULL, 0, icvbuf) < 0 || NULL, 0, icvbuf) < 0) {
os_memcmp_const(icvbuf, pos, EAP_PAX_ICV_LEN) != 0) { wpa_printf(MSG_INFO, "EAP-PAX: Failed to calculate ICV");
return;
}
if (os_memcmp_const(icvbuf, pos, EAP_PAX_ICV_LEN) != 0) {
wpa_printf(MSG_INFO, "EAP-PAX: Invalid ICV in PAX_STD-2"); wpa_printf(MSG_INFO, "EAP-PAX: Invalid ICV in PAX_STD-2");
wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected ICV", wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected ICV",
icvbuf, EAP_PAX_ICV_LEN); icvbuf, EAP_PAX_ICV_LEN);