diff options
| author | Stefan Sperling <stsp@cvs.openbsd.org> | 2016-12-18 08:00:21 +0000 |
|---|---|---|
| committer | Stefan Sperling <stsp@cvs.openbsd.org> | 2016-12-18 08:00:21 +0000 |
| commit | 1dc7152c544d02c76a03a540d4032b71798e2f6d (patch) | |
| tree | c618f8a0e76df4537d6cfdf0fa08e774322c0906 /sys | |
| parent | 1c58aba831fcf19768aa93bd070c13ec280a1a6a (diff) | |
Set the maximum TKIP countermeasure timeout to 90 seconds instead of 120.
Waiting more time does not buy us anything and makes a denial of service
a tiny bit easier.
Suggested by Mathy Vanhoef.
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/net80211/ieee80211_crypto_tkip.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/net80211/ieee80211_crypto_tkip.c b/sys/net80211/ieee80211_crypto_tkip.c index b5d9cbd685f..81b1fe85b25 100644 --- a/sys/net80211/ieee80211_crypto_tkip.c +++ b/sys/net80211/ieee80211_crypto_tkip.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ieee80211_crypto_tkip.c,v 1.26 2016/12/17 18:35:54 stsp Exp $ */ +/* $OpenBSD: ieee80211_crypto_tkip.c,v 1.27 2016/12/18 08:00:20 stsp Exp $ */ /*- * Copyright (c) 2008 Damien Bergamini <damien.bergamini@free.fr> @@ -541,7 +541,7 @@ ieee80211_michael_mic_failure(struct ieee80211com *ic, u_int64_t tsc) case IEEE80211_M_HOSTAP: /* refuse new TKIP associations for at least 60 seconds */ ic->ic_flags |= IEEE80211_F_COUNTERM; - sec = 60 + arc4random_uniform(60); + sec = 60 + arc4random_uniform(30); log(LOG_WARNING, "%s: HostAP will be disabled for %d seconds " "as a countermeasure against TKIP key cracking attempts\n", ic->ic_if.if_xname, sec); |