From: tb <tb@openbsd.org>
Date: Sat, 3 Jun 2017 11:58:10 +0000 (+0000)
Subject: Explicitly zero out the wepseed for TKIP and WEP.
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=48e63f16f297d04f0b07cd11ae58563ee17baa43;p=openbsd

Explicitly zero out the wepseed for TKIP and WEP.

ok stsp
---

diff --git a/sys/net80211/ieee80211_crypto_tkip.c b/sys/net80211/ieee80211_crypto_tkip.c
index ee26433987e..d1b44a4f3f9 100644
--- a/sys/net80211/ieee80211_crypto_tkip.c
+++ b/sys/net80211/ieee80211_crypto_tkip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_crypto_tkip.c,v 1.28 2017/03/23 04:10:10 tb Exp $	*/
+/*	$OpenBSD: ieee80211_crypto_tkip.c,v 1.29 2017/06/03 11:58:10 tb Exp $	*/
 
 /*-
  * Copyright (c) 2008 Damien Bergamini <damien.bergamini@free.fr>
@@ -234,6 +234,7 @@ ieee80211_tkip_encrypt(struct ieee80211com *ic, struct mbuf *m0,
 	}
 	Phase2((u_int8_t *)wepseed, k->k_key, ctx->txttak, k->k_tsc & 0xffff);
 	rc4_keysetup(&ctx->rc4, (u_int8_t *)wepseed, 16);
+	explicit_bzero(wepseed, sizeof(wepseed));
 
 	/* encrypt frame body and compute WEP ICV */
 	m = m0;
@@ -389,6 +390,7 @@ ieee80211_tkip_decrypt(struct ieee80211com *ic, struct mbuf *m0,
 	}
 	Phase2((u_int8_t *)wepseed, k->k_key, ctx->rxttak, tsc & 0xffff);
 	rc4_keysetup(&ctx->rc4, (u_int8_t *)wepseed, 16);
+	explicit_bzero(wepseed, sizeof(wepseed));
 
 	/* decrypt frame body and compute WEP ICV */
 	m = m0;
diff --git a/sys/net80211/ieee80211_crypto_wep.c b/sys/net80211/ieee80211_crypto_wep.c
index 0bc428091c9..6bd1ff7702d 100644
--- a/sys/net80211/ieee80211_crypto_wep.c
+++ b/sys/net80211/ieee80211_crypto_wep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_crypto_wep.c,v 1.15 2017/03/23 04:10:10 tb Exp $	*/
+/*	$OpenBSD: ieee80211_crypto_wep.c,v 1.16 2017/06/03 11:58:10 tb Exp $	*/
 
 /*-
  * Copyright (c) 2008 Damien Bergamini <damien.bergamini@free.fr>
@@ -125,6 +125,7 @@ ieee80211_wep_encrypt(struct ieee80211com *ic, struct mbuf *m0,
 	memcpy(wepseed, ivp, IEEE80211_WEP_IVLEN);
 	memcpy(wepseed + IEEE80211_WEP_IVLEN, k->k_key, k->k_len);
 	rc4_keysetup(&ctx->rc4, wepseed, IEEE80211_WEP_IVLEN + k->k_len);
+	explicit_bzero(wepseed, sizeof(wepseed));
 
 	/* encrypt frame body and compute WEP ICV */
 	m = m0;
@@ -220,6 +221,7 @@ ieee80211_wep_decrypt(struct ieee80211com *ic, struct mbuf *m0,
 	memcpy(wepseed, ivp, IEEE80211_WEP_IVLEN);
 	memcpy(wepseed + IEEE80211_WEP_IVLEN, k->k_key, k->k_len);
 	rc4_keysetup(&ctx->rc4, wepseed, IEEE80211_WEP_IVLEN + k->k_len);
+	explicit_bzero(wepseed, sizeof(wepseed));
 
 	MGET(n0, M_DONTWAIT, m0->m_type);
 	if (n0 == NULL)