aboutsummaryrefslogtreecommitdiffstats
path: root/src/wps
diff options
context:
space:
mode:
authorJouni Malinen <jouni@qca.qualcomm.com>2016-03-04 15:20:18 (GMT)
committerJouni Malinen <j@w1.fi>2016-05-02 08:08:25 (GMT)
commitecbb0b3dc122b0d290987cf9c84010bbe53e1022 (patch)
tree54a04335b11122850990e9524ffe768e179c0c96 /src/wps
parentf4830bed661f4adff51f50a0d37c64ceb748e780 (diff)
downloadhostap-ecbb0b3dc122b0d290987cf9c84010bbe53e1022.zip
hostap-ecbb0b3dc122b0d290987cf9c84010bbe53e1022.tar.gz
hostap-ecbb0b3dc122b0d290987cf9c84010bbe53e1022.tar.bz2
WPS: Reject a Credential with invalid passphrase
WPA/WPA2-Personal passphrase is not allowed to include control characters. Reject a Credential received from a WPS Registrar both as STA (Credential) and AP (AP Settings) if the credential is for WPAPSK or WPA2PSK authentication type and includes an invalid passphrase. This fixes an issue where hostapd or wpa_supplicant could have updated the configuration file PSK/passphrase parameter with arbitrary data from an external device (Registrar) that may not be fully trusted. Should such data include a newline character, the resulting configuration file could become invalid and fail to be parsed. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Diffstat (limited to 'src/wps')
-rw-r--r--src/wps/wps_attr_process.c10
1 files changed, 10 insertions, 0 deletions
diff --git a/src/wps/wps_attr_process.c b/src/wps/wps_attr_process.c
index eadb22f..e8c4579 100644
--- a/src/wps/wps_attr_process.c
+++ b/src/wps/wps_attr_process.c
@@ -229,6 +229,16 @@ static int wps_workaround_cred_key(struct wps_credential *cred)
cred->key_len--;
#endif /* CONFIG_WPS_STRICT */
}
+
+
+ if (cred->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK) &&
+ (cred->key_len < 8 || has_ctrl_char(cred->key, cred->key_len))) {
+ wpa_printf(MSG_INFO, "WPS: Reject credential with invalid WPA/WPA2-Personal passphrase");
+ wpa_hexdump_ascii_key(MSG_INFO, "WPS: Network Key",
+ cred->key, cred->key_len);
+ return -1;
+ }
+
return 0;
}