Kernel/iwd
3
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-22 13:02:44 +01:00
Code Releases Activity

eap-pwd: Memzero copies of secrets

Browse Source 
Note that PK and PWE are also considered secret but their buffers
will need to be cleared in l_ecc_point_free in ell.
This commit is contained in:
Andrew Zaborowski 2019-03-22 18:56:21 +01:00 committed by Denis Kenzior
parent 20ac57783b
commit 05d556d493
1 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/eap-pwd.c
View File

@ -168,7 +168,12 @@ static void eap_pwd_free(struct eap_state *eap)
eap_pwd_reset_state(eap); eap_pwd_reset_state(eap);
l_free(pwd->identity); l_free(pwd->identity);
l_free(pwd->password);
if (pwd->password) {
explicit_bzero(pwd->password, strlen(pwd->password));
l_free(pwd->password);
}
l_free(pwd); l_free(pwd);
eap_set_data(eap, NULL); eap_set_data(eap, NULL);
@ -330,6 +335,9 @@ static void eap_pwd_handle_id(struct eap_state *eap,
l_ecc_point_free(pwe); l_ecc_point_free(pwe);
} }
explicit_bzero(pwd_seed, sizeof(pwd_seed));
explicit_bzero(pwd_value, sizeof(pwd_value));
pos = resp + 5; /* header */ pos = resp + 5; /* header */
*pos++ = EAP_PWD_EXCH_ID; *pos++ = EAP_PWD_EXCH_ID;
l_put_be16(group, pos); l_put_be16(group, pos);
@ -532,6 +540,10 @@ static void eap_pwd_handle_confirm(struct eap_state *eap,
kdf(mk, 32, (const char *) session_id, 33, msk_emsk, 128); kdf(mk, 32, (const char *) session_id, 33, msk_emsk, 128);
eap_set_key_material(eap, msk_emsk, 64, msk_emsk + 64, 64, NULL, 0); eap_set_key_material(eap, msk_emsk, 64, msk_emsk + 64, 64, NULL, 0);
explicit_bzero(mk, sizeof(mk));
explicit_bzero(msk_emsk, sizeof(msk_emsk));
explicit_bzero(kpx, sizeof(kpx));
return; return;
invalid_point: invalid_point:
@ -539,6 +551,8 @@ invalid_point:
l_error("invalid point during confirm exchange"); l_error("invalid point during confirm exchange");
error: error:
explicit_bzero(kpx, sizeof(kpx));
eap_method_error(eap); eap_method_error(eap);
} }
@ -735,6 +749,7 @@ static int eap_pwd_check_settings(struct l_settings *settings,
password = l_settings_get_string(settings, "Security", password = l_settings_get_string(settings, "Security",
password_key_old); password_key_old);
if (password) { if (password) {
explicit_bzero(password, strlen(password));
l_warn("Setting '%s' is deprecated, use '%s' instead", l_warn("Setting '%s' is deprecated, use '%s' instead",
password_key_old, password_key); password_key_old, password_key);
return 0; return 0;
@ -748,7 +763,8 @@ static int eap_pwd_check_settings(struct l_settings *settings,
eap_append_secret(out_missing, EAP_SECRET_REMOTE_PASSWORD, eap_append_secret(out_missing, EAP_SECRET_REMOTE_PASSWORD,
password_key, NULL, identity, password_key, NULL, identity,
EAP_CACHE_TEMPORARY); EAP_CACHE_TEMPORARY);
} } else
explicit_bzero(password, strlen(password));
return 0; return 0;
} }
@ -796,8 +812,12 @@ static bool eap_pwd_load_settings(struct eap_state *eap,
return true; return true;
error: error:
if (pwd->password) {
explicit_bzero(pwd->password, strlen(pwd->password));
l_free(pwd->password);
}
l_free(pwd->identity); l_free(pwd->identity);
l_free(pwd->password);
l_free(pwd); l_free(pwd);
return false; return false;