EAP-TTLS/PAP: User-Password obfuscation for zero length password

The password in User-Password AVP is padded to a multiple of 16 bytes
on EAP-TTLS/PAP. But when the password length is zero, no padding is
added. It doesn't cause connectivity issue. In fact, I could connect
with hostapd RADIUS server with zero length password.

I think it's better for obfuscation to pad the 16 bytes data when the
password length is zero with this patch.

diff --git a/src/eap_peer/eap_ttls.c b/src/eap_peer/eap_ttls.c
index 800f1b57db6227969862ec15c0010fb4b322f2a1..f93ba38f20f99e90282c089f36493c14826925aa 100644 (file)
--- a/src/eap_peer/eap_ttls.c
+++ b/src/eap_peer/eap_ttls.c
@@ -846,7 +846,7 @@ static int eap_ttls_phase2_request_pap(struct eap_sm *sm,
        /* User-Password; in RADIUS, this is encrypted, but EAP-TTLS encrypts
         * the data, so no separate encryption is used in the AVP itself.
         * However, the password is padded to obfuscate its length. */
-       pad = (16 - (password_len & 15)) & 15;
+       pad = password_len == 0 ? 16 : (16 - (password_len & 15)) & 15;
        pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_USER_PASSWORD, 0, 1,
                               password_len + pad);
        os_memcpy(pos, password, password_len);