diff options
| author |   Jason A. Donenfeld <Jason@zx2c4.com> | 2017-09-22 04:04:00 +0200 |
|---|---|---|
| committer | Jason A. Donenfeld <Jason@zx2c4.com> | 2017-09-24 23:10:15 +0200 |
| commit | 6ddb4753c62fd08f4da71a5d1bd4222de492a331 (patch) | |
| tree | dcba7d7df5c810a4476fabdfb83e73a0205aba12 /src/tools/ipc.c | |
| parent | config: do not reset device port (diff) | |
| download | wireguard-monolithic-historical-6ddb4753c62fd08f4da71a5d1bd4222de492a331.tar.xz wireguard-monolithic-historical-6ddb4753c62fd08f4da71a5d1bd4222de492a331.zip | |
tools: use key_is_zero for comparing to zeros
Maybe an attacker on the system could use the infoleak in /proc to gauge
how long a wg(8) process takes to complete and determine the number of
leading zeros. This is somewhat ridiculous, but it's possible somebody
somewhere might at somepoint care in the future, so alright.
Diffstat (limited to 'src/tools/ipc.c')
| -rw-r--r-- | src/tools/ipc.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/src/tools/ipc.c b/src/tools/ipc.c index 48d06aa..d0b5a46 100644 --- a/src/tools/ipc.c +++ b/src/tools/ipc.c @@ -170,7 +170,6 @@ out: static int userspace_set_device(struct wgdevice *dev) { - static const uint8_t zero[WG_KEY_LEN] = { 0 }; char hex[WG_KEY_LEN_HEX], ip[INET6_ADDRSTRLEN], host[4096 + 1], service[512 + 1]; struct wgpeer *peer; struct wgipmask *ipmask; @@ -186,7 +185,7 @@ static int userspace_set_device(struct wgdevice *dev) if (dev->flags & WGDEVICE_REMOVE_PRIVATE_KEY) fprintf(f, "private_key=\n"); - else if (memcmp(dev->private_key, zero, WG_KEY_LEN)) { + else if (!key_is_zero(dev->private_key)) { key_to_hex(hex, dev->private_key); fprintf(f, "private_key=%s\n", hex); } @@ -208,7 +207,7 @@ static int userspace_set_device(struct wgdevice *dev) } if (peer->flags & WGPEER_REMOVE_PRESHARED_KEY) fprintf(f, "preshared_key=\n"); - else if (memcmp(peer->preshared_key, zero, WG_KEY_LEN)) { + else if (!key_is_zero(peer->preshared_key)) { key_to_hex(hex, peer->preshared_key); fprintf(f, "preshared_key=%s\n", hex); } |