diff mbox series

[10/15] mka: Do not print contents of SAK to debug log

Message ID 20180302201103.16264-11-msiedzik@extremenetworks.com
State Accepted
Headers show
Series MKA bugfixes and enhancements | expand

Commit Message

Michael Siedzik March 2, 2018, 8:10 p.m. UTC 
From: Mike Siedzik <msiedzik@extremenetworks.com>

Log newly generated SAKs as well as unwrapped SAKs with wpa_hexdump_key()
rather than wpa_hexdump(). By default, the wpa_hexdump_key() function
will not display sensitive key data.

Signed-off-by: Michael Siedzik <msiedzik@extremenetworks.com>
---
 src/pae/ieee802_1x_kay.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--
2.11.1

Comments

Jouni Malinen March 12, 2018, 11:51 p.m. UTC | #1 
On Fri, Mar 02, 2018 at 03:10:58PM -0500, msiedzik@extremenetworks.com wrote:
> Log newly generated SAKs as well as unwrapped SAKs with wpa_hexdump_key()
> rather than wpa_hexdump(). By default, the wpa_hexdump_key() function
> will not display sensitive key data.

Thanks, applied.
diff mbox series

Patch

diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c
index 4ac4fdc15..27022d994 100644
--- a/src/pae/ieee802_1x_kay.c
+++ b/src/pae/ieee802_1x_kay.c
@@ -1644,7 +1644,7 @@  ieee802_1x_mka_decode_dist_sak_body(
                os_free(unwrap_sak);
                return -1;
        }
-       wpa_hexdump(MSG_DEBUG, "\tAES Key Unwrap of SAK:", unwrap_sak, sak_len);
+       wpa_hexdump_key(MSG_DEBUG, "\tAES Key Unwrap of SAK:", unwrap_sak, sak_len);

        sa_key = os_zalloc(sizeof(*sa_key));
        if (!sa_key) {
@@ -2035,7 +2035,7 @@  ieee802_1x_kay_generate_new_sak(struct ieee802_1x_mka_participant *participant)
                wpa_printf(MSG_ERROR, "KaY: SAK Length not support");
                goto fail;
        }
-       wpa_hexdump(MSG_DEBUG, "KaY: generated new SAK", key, key_len);
+       wpa_hexdump_key(MSG_DEBUG, "KaY: generated new SAK", key, key_len);
        os_free(context);
        context = NULL;