svn commit: r336490 - in vendor/wpa/dist/src: common rsn_supp

[Cy Schubert]

Author: cy
Date: Thu Jul 19 16:58:20 2018
New Revision: 336490
URL: https://svnweb.freebsd.org/changeset/base/336490

Log:
  Import upline security patch: Prevent installation of an all-zero TK
  This is also upline git commit 53bb18cc8b7a4da72e47e4b3752d0d2135cffb23.
  
  Obtained from:	https://w1.fi/security/2017-1/\
  		rebased-v2.6-0004-Prevent-installation-\
  		of-an-all-zero-TK.patch

Modified:
  vendor/wpa/dist/src/common/wpa_common.h
  vendor/wpa/dist/src/rsn_supp/wpa.c
  vendor/wpa/dist/src/rsn_supp/wpa_i.h

Modified: vendor/wpa/dist/src/common/wpa_common.h
==============================================================================
--- vendor/wpa/dist/src/common/wpa_common.h	Thu Jul 19 16:03:20 2018	(r336489)
+++ vendor/wpa/dist/src/common/wpa_common.h	Thu Jul 19 16:58:20 2018	(r336490)
@@ -215,6 +215,7 @@ struct wpa_ptk {
 	size_t kck_len;
 	size_t kek_len;
 	size_t tk_len;
+	int installed; /* 1 if key has already been installed to driver */
 };
 
 struct wpa_gtk {

Modified: vendor/wpa/dist/src/rsn_supp/wpa.c
==============================================================================
--- vendor/wpa/dist/src/rsn_supp/wpa.c	Thu Jul 19 16:03:20 2018	(r336489)
+++ vendor/wpa/dist/src/rsn_supp/wpa.c	Thu Jul 19 16:58:20 2018	(r336490)
@@ -510,7 +510,6 @@ static void wpa_supplicant_process_1_of_4(struct wpa_s
 		os_memset(buf, 0, sizeof(buf));
 	}
 	sm->tptk_set = 1;
-	sm->tk_to_set = 1;
 
 	kde = sm->assoc_wpa_ie;
 	kde_len = sm->assoc_wpa_ie_len;
@@ -615,7 +614,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *s
 	enum wpa_alg alg;
 	const u8 *key_rsc;
 
-	if (!sm->tk_to_set) {
+	if (sm->ptk.installed) {
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 			"WPA: Do not re-install same PTK to the driver");
 		return 0;
@@ -659,7 +658,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *s
 
 	/* TK is not needed anymore in supplicant */
 	os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
-	sm->tk_to_set = 0;
+	sm->ptk.installed = 1;
 
 	if (sm->wpa_ptk_rekey) {
 		eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);

Modified: vendor/wpa/dist/src/rsn_supp/wpa_i.h
==============================================================================
--- vendor/wpa/dist/src/rsn_supp/wpa_i.h	Thu Jul 19 16:03:20 2018	(r336489)
+++ vendor/wpa/dist/src/rsn_supp/wpa_i.h	Thu Jul 19 16:58:20 2018	(r336490)
@@ -24,7 +24,6 @@ struct wpa_sm {
 	struct wpa_ptk ptk, tptk;
 	int ptk_set, tptk_set;
 	unsigned int msg_3_of_4_ok:1;
-	unsigned int tk_to_set:1;
 	u8 snonce[WPA_NONCE_LEN];
 	u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */
 	int renew_snonce;