diff options
| author | Tobias Heider <tobhe@cvs.openbsd.org> | 2021-10-12 09:27:22 +0000 |
|---|---|---|
| committer | Tobias Heider <tobhe@cvs.openbsd.org> | 2021-10-12 09:27:22 +0000 |
| commit | 85d4e994fb2d7a79a137508db85120226fc9922a (patch) | |
| tree | f8a6a3fb0e11cb197ce2a788964c8adfe5845966 /sbin/iked | |
| parent | 6425c53ed1ee106c4e6efe0e0156bf72c41f3536 (diff) | |
Make sure all copies of MSCHAPv2 passphrase are zeroed after use.
ok patrick@
Diffstat (limited to 'sbin/iked')
| -rw-r--r-- | sbin/iked/config.c | 14 | ||||
| -rw-r--r-- | sbin/iked/ikev2.c | 8 | ||||
| -rw-r--r-- | sbin/iked/parse.y | 6 |
3 files changed, 16 insertions, 12 deletions
diff --git a/sbin/iked/config.c b/sbin/iked/config.c index 87047a1f326..50b73b67c1a 100644 --- a/sbin/iked/config.c +++ b/sbin/iked/config.c @@ -1,4 +1,4 @@ -/* $OpenBSD: config.c,v 1.81 2021/09/18 16:45:07 deraadt Exp $ */ +/* $OpenBSD: config.c,v 1.82 2021/10/12 09:27:21 tobhe Exp $ */ /* * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de> @@ -670,16 +670,18 @@ int config_getuser(struct iked *env, struct imsg *imsg) { struct iked_user usr; + int ret = -1; IMSG_SIZE_CHECK(imsg, &usr); memcpy(&usr, imsg->data, sizeof(usr)); - if (config_new_user(env, &usr) == NULL) - return (-1); - - print_user(&usr); + if (config_new_user(env, &usr) != NULL) { + print_user(&usr); + ret = 0; + } - return (0); + explicit_bzero(&usr, sizeof(usr)); + return (ret); } int diff --git a/sbin/iked/ikev2.c b/sbin/iked/ikev2.c index 833c2875825..f319919168d 100644 --- a/sbin/iked/ikev2.c +++ b/sbin/iked/ikev2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ikev2.c,v 1.327 2021/09/07 14:09:04 tobhe Exp $ */ +/* $OpenBSD: ikev2.c,v 1.328 2021/10/12 09:27:21 tobhe Exp $ */ /* * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de> @@ -3611,7 +3611,7 @@ ikev2_resp_ike_eap_mschap(struct iked *env, struct iked_sa *sa, sizeof(ntresponse)) != 0) { log_info("%s: '%s' authentication failed", SPI_SA(sa, __func__), usr->usr_name); - free(pass); + freezero(pass, passlen); /* XXX should we send an EAP failure packet? */ return (-1); @@ -3625,12 +3625,12 @@ ikev2_resp_ike_eap_mschap(struct iked *env, struct iked_sa *sa, successmsg); if ((sa->sa_eapmsk = ibuf_new(NULL, MSCHAP_MSK_SZ)) == NULL) { log_info("%s: failed to get MSK", SPI_SA(sa, __func__)); - free(pass); + freezero(pass, passlen); return (-1); } mschap_msk(pass, passlen, ntresponse, ibuf_data(sa->sa_eapmsk)); - free(pass); + freezero(pass, passlen); log_info("%s: '%s' authenticated", __func__, usr->usr_name); diff --git a/sbin/iked/parse.y b/sbin/iked/parse.y index fc47c89c3aa..0dbdb5a5e85 100644 --- a/sbin/iked/parse.y +++ b/sbin/iked/parse.y @@ -1,4 +1,4 @@ -/* $OpenBSD: parse.y,v 1.132 2021/09/18 16:45:52 deraadt Exp $ */ +/* $OpenBSD: parse.y,v 1.133 2021/10/12 09:27:21 tobhe Exp $ */ /* * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de> @@ -551,7 +551,7 @@ user : USER STRING STRING { if (create_user($2, $3) == -1) YYERROR; free($2); - free($3); + freezero($3, strlen($3)); } ; @@ -3078,6 +3078,8 @@ create_user(const char *user, const char *pass) config_setuser(env, &usr, PROC_IKEV2); rules++; + + explicit_bzero(&usr, sizeof usr); return (0); } |