Check the return of pbkdf2_sha1() for errors

pbkdf2_sha1() may return errors and this should be checked in calls.
This is especially an issue with FIPS builds because the FIPS
requirement is that the password must be at least 14 characters.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>

diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
index e208788d11242a6d9ef41a6d98902f549e6afe5e..1c229c6c78ae3385ccf91964715d8926d0301fcf 100644 (file)
--- a/src/ap/ap_config.c
+++ b/src/ap/ap_config.c
@@ -461,9 +461,12 @@ static int hostapd_derive_psk(struct hostapd_ssid *ssid)
        wpa_hexdump_ascii_key(MSG_DEBUG, "PSK (ASCII passphrase)",
                              (u8 *) ssid->wpa_passphrase,
                              os_strlen(ssid->wpa_passphrase));
-       pbkdf2_sha1(ssid->wpa_passphrase,
-                   ssid->ssid, ssid->ssid_len,
-                   4096, ssid->wpa_psk->psk, PMK_LEN);
+       if (pbkdf2_sha1(ssid->wpa_passphrase,
+                       ssid->ssid, ssid->ssid_len,
+                       4096, ssid->wpa_psk->psk, PMK_LEN) != 0) {
+               wpa_printf(MSG_ERROR, "Error in pbkdf2_sha1()");
+               return -1;
+       }
        wpa_hexdump_key(MSG_DEBUG, "PSK (from passphrase)",
                        ssid->wpa_psk->psk, PMK_LEN);
        return 0;

diff --git a/src/ap/wpa_auth_glue.c b/src/ap/wpa_auth_glue.c
index 71a487161cf4fd229f5dd5d212277e016adb8ba6..50efc2c28c2eb987810fc63c0b25e91215f23567 100644 (file)
--- a/src/ap/wpa_auth_glue.c
+++ b/src/ap/wpa_auth_glue.c
@@ -391,10 +391,14 @@ static const u8 * hostapd_wpa_auth_get_psk(void *ctx, const u8 *addr,
                psk = sta->psk->psk;
                for (pos = sta->psk; pos; pos = pos->next) {
                        if (pos->is_passphrase) {
-                               pbkdf2_sha1(pos->passphrase,
-                                           hapd->conf->ssid.ssid,
-                                           hapd->conf->ssid.ssid_len, 4096,
-                                           pos->psk, PMK_LEN);
+                               if (pbkdf2_sha1(pos->passphrase,
+                                               hapd->conf->ssid.ssid,
+                                               hapd->conf->ssid.ssid_len, 4096,
+                                               pos->psk, PMK_LEN) != 0) {
+                                       wpa_printf(MSG_WARNING,
+                                                  "Error in pbkdf2_sha1()");
+                                       continue;
+                               }
                                pos->is_passphrase = 0;
                        }
                        if (pos->psk == prev_psk) {

diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index b5ffb9253047f4d14e5e23f212b4a1f8348c6235..e511ab6b58b9e2377cd4911cabee2dbeefda943f 100644 (file)
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -3426,8 +3426,11 @@ char * wpa_config_get_no_key(struct wpa_ssid *ssid, const char *var)
 void wpa_config_update_psk(struct wpa_ssid *ssid)
 {
 #ifndef CONFIG_NO_PBKDF2
-       pbkdf2_sha1(ssid->passphrase, ssid->ssid, ssid->ssid_len, 4096,
-                   ssid->psk, PMK_LEN);
+       if (pbkdf2_sha1(ssid->passphrase, ssid->ssid, ssid->ssid_len, 4096,
+                       ssid->psk, PMK_LEN) != 0) {
+               wpa_printf(MSG_ERROR, "Error in pbkdf2_sha1()");
+               return;
+       }
        wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
                        ssid->psk, PMK_LEN);
        ssid->psk_set = 1;

diff --git a/wpa_supplicant/wpa_passphrase.c b/wpa_supplicant/wpa_passphrase.c
index 538997e62580a33c539dc3f584288a07ff694d26..d9c07e673d0b1094d1db6dbf5e0e0ba33f45a46f 100644 (file)
--- a/wpa_supplicant/wpa_passphrase.c
+++ b/wpa_supplicant/wpa_passphrase.c
@@ -58,7 +58,11 @@ int main(int argc, char *argv[])
                return 1;
        }
 
-       pbkdf2_sha1(passphrase, (u8 *) ssid, os_strlen(ssid), 4096, psk, 32);
+       if (pbkdf2_sha1(passphrase, (u8 *) ssid, os_strlen(ssid), 4096, psk, 32)
+           != 0) {
+               fprintf(stderr, "Error in pbkdf2_sha1()\n");
+               return 1;
+       }
 
        printf("network={\n");
        printf("\tssid=\"%s\"\n", ssid);

diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 4237174ab61815e55e9c773d9c1398e5c0237088..82aaad8918da561d281e9be551cd662b302117b2 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -1774,9 +1774,15 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
                if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
                    ssid->passphrase && !sae_only) {
                        u8 psk[PMK_LEN];
-                       pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
-                                   4096, psk, PMK_LEN);
-                       wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
+
+                       if (pbkdf2_sha1(ssid->passphrase, bss->ssid,
+                                       bss->ssid_len,
+                                       4096, psk, PMK_LEN) != 0) {
+                               wpa_msg(wpa_s, MSG_WARNING,
+                                       "Error in pbkdf2_sha1()");
+                               return -1;
+                       }
+                       wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
                                        psk, PMK_LEN);
                        wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
                        psk_set = 1;
@@ -1810,8 +1816,14 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
 #ifndef CONFIG_NO_PBKDF2
                        if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
                        {
-                               pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
-                                           4096, psk, PMK_LEN);
+                               if (pbkdf2_sha1(pw_str, bss->ssid,
+                                               bss->ssid_len,
+                                               4096, psk, PMK_LEN) != 0) {
+                                       wpa_msg(wpa_s, MSG_WARNING,
+                                               "Error in pbkdf2_sha1()");
+                                       ext_password_free(pw);
+                                       return -1;
+                               }
                                os_memset(pw_str, 0, sizeof(pw_str));
                                wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
                                                "external passphrase)",