Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2025-01-18 10:54:03 -05:00
Code Issues Projects Releases Wiki Activity

WPS: Do not increment wildcard_uuid when pin is locked

Browse Source 
Commit 84751b98c1 ('WPS: Allow wildcard
UUID PIN to be used twice') relaxed the constraints on how many time a
wildcard PIN can be used to allow two attempts. However, it did this in
a way that could result in concurrent attempts resulting in the wildcard
PIN being invalidated even without the second attempt actually going as
far as trying to use the PIN and a WPS protocol run.

wildcard_uuid is a flag/counter set for wildcard PINs and it is
incremented whenever the PIN is retrieved by wps_registrar_get_pin().
Eventually it causes the wildcard PIN to be released, effectively
limiting the number of registration attempts with a wildcard PIN.

With the previous implementation, when the PIN is in use and locked
(PIN_LOCKED), it is not returned from wps_registrar_get_pin() but
wildcard_uuid is still incremented which can cause the PIN to be
released earlier and stations will have fewer registration attempts with
it. Fix this scenario by only incrementing wildcard_uuid if the PIN is
actually going to be returned and used.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
This commit is contained in:
Lior David 2017-09-28 21:55:09 +03:00 committed by Jouni Malinen
parent 002b49ed07
commit fa4b605a0d
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/wps/wps_registrar.c
View File

@ -880,6 +880,7 @@ static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
const u8 *uuid, size_t *pin_len) const u8 *uuid, size_t *pin_len)
{ {
struct wps_uuid_pin *pin, *found = NULL; struct wps_uuid_pin *pin, *found = NULL;
int wildcard = 0;
wps_registrar_expire_pins(reg); wps_registrar_expire_pins(reg);
@ -899,7 +900,7 @@ static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
pin->wildcard_uuid == 2) { pin->wildcard_uuid == 2) {
wpa_printf(MSG_DEBUG, "WPS: Found a wildcard " wpa_printf(MSG_DEBUG, "WPS: Found a wildcard "
"PIN. Assigned it for this UUID-E"); "PIN. Assigned it for this UUID-E");
pin->wildcard_uuid++; wildcard = 1;
os_memcpy(pin->uuid, uuid, WPS_UUID_LEN); os_memcpy(pin->uuid, uuid, WPS_UUID_LEN);
found = pin; found = pin;
break; break;
@ -921,6 +922,8 @@ static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
} }
*pin_len = found->pin_len; *pin_len = found->pin_len;
found->flags |= PIN_LOCKED; found->flags |= PIN_LOCKED;
if (wildcard)
found->wildcard_uuid++;
return found->pin; return found->pin;
} }