Explicitly zero out the wepseed for TKIP and WEP.

ok stsp

diff --git a/sys/net80211/ieee80211_crypto_tkip.c b/sys/net80211/ieee80211_crypto_tkip.c
index ee26433..d1b44a4 100644 (file)
--- a/sys/net80211/ieee80211_crypto_tkip.c
+++ b/sys/net80211/ieee80211_crypto_tkip.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ieee80211_crypto_tkip.c,v 1.28 2017/03/23 04:10:10 tb Exp $   */
+/*     $OpenBSD: ieee80211_crypto_tkip.c,v 1.29 2017/06/03 11:58:10 tb Exp $   */
 
 /*-
  * Copyright (c) 2008 Damien Bergamini <damien.bergamini@free.fr>
@@ -234,6 +234,7 @@ ieee80211_tkip_encrypt(struct ieee80211com *ic, struct mbuf *m0,
        }
        Phase2((u_int8_t *)wepseed, k->k_key, ctx->txttak, k->k_tsc & 0xffff);
        rc4_keysetup(&ctx->rc4, (u_int8_t *)wepseed, 16);
+       explicit_bzero(wepseed, sizeof(wepseed));
 
        /* encrypt frame body and compute WEP ICV */
        m = m0;
@@ -389,6 +390,7 @@ ieee80211_tkip_decrypt(struct ieee80211com *ic, struct mbuf *m0,
        }
        Phase2((u_int8_t *)wepseed, k->k_key, ctx->rxttak, tsc & 0xffff);
        rc4_keysetup(&ctx->rc4, (u_int8_t *)wepseed, 16);
+       explicit_bzero(wepseed, sizeof(wepseed));
 
        /* decrypt frame body and compute WEP ICV */
        m = m0;

diff --git a/sys/net80211/ieee80211_crypto_wep.c b/sys/net80211/ieee80211_crypto_wep.c
index 0bc4280..6bd1ff7 100644 (file)
--- a/sys/net80211/ieee80211_crypto_wep.c
+++ b/sys/net80211/ieee80211_crypto_wep.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ieee80211_crypto_wep.c,v 1.15 2017/03/23 04:10:10 tb Exp $    */
+/*     $OpenBSD: ieee80211_crypto_wep.c,v 1.16 2017/06/03 11:58:10 tb Exp $    */
 
 /*-
  * Copyright (c) 2008 Damien Bergamini <damien.bergamini@free.fr>
@@ -125,6 +125,7 @@ ieee80211_wep_encrypt(struct ieee80211com *ic, struct mbuf *m0,
        memcpy(wepseed, ivp, IEEE80211_WEP_IVLEN);
        memcpy(wepseed + IEEE80211_WEP_IVLEN, k->k_key, k->k_len);
        rc4_keysetup(&ctx->rc4, wepseed, IEEE80211_WEP_IVLEN + k->k_len);
+       explicit_bzero(wepseed, sizeof(wepseed));
 
        /* encrypt frame body and compute WEP ICV */
        m = m0;
@@ -220,6 +221,7 @@ ieee80211_wep_decrypt(struct ieee80211com *ic, struct mbuf *m0,
        memcpy(wepseed, ivp, IEEE80211_WEP_IVLEN);
        memcpy(wepseed + IEEE80211_WEP_IVLEN, k->k_key, k->k_len);
        rc4_keysetup(&ctx->rc4, wepseed, IEEE80211_WEP_IVLEN + k->k_len);
+       explicit_bzero(wepseed, sizeof(wepseed));
 
        MGET(n0, M_DONTWAIT, m0->m_type);
        if (n0 == NULL)