DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

WPS: Explicitly reject Public Key attribute with unexpected length

Browse source 
There is no need to try to derive DH shared key with a peer that tries
to use too short or too long DH Public Key. Previously, such cases ended
up implicitly getting rejected by the DH operations failing to produce
matching results. That is unnecessarily, so simply reject the message
completely if it does not have a Public Key with valid length. Accept
couple of octets shorter value to be used to avoid interoperability
issues if there are implementations that do not use zero-padding
properly.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2015-04-19 17:45:33 +03:00
parent 6b94f71dcd
commit ca68a8b561
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/wps/wps_attr_parse.c
View file

@ -484,6 +484,18 @@ static int wps_set_attr(struct wps_parse_attr *attr, u16 type,
attr->dev_name_len = len;
break;
case ATTR_PUBLIC_KEY:
/*
* The Public Key attribute is supposed to be exactly 192 bytes
* in length. Allow couple of bytes shorter one to try to
* interoperate with implementations that do not use proper
* zero-padding.
*/
if (len < 190 || len > 192) {
wpa_printf(MSG_DEBUG,
"WPS: Ignore Public Key with unexpected length %u",
len);
break;
}
attr->public_key = pos;
attr->public_key_len = len;
break;