Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix 64 character WPA2 PSK password. #1146

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Conversation

BotoX
Copy link

@BotoX BotoX commented Jun 6, 2017

@@ -70,7 +70,10 @@ bool StationClass::config(String ssid, String password, bool autoConnectOnStartu
memset(config.password, 0, sizeof(config.password));
config.bssid_set = false;
strcpy((char*)config.ssid, ssid.c_str());
strcpy((char*)config.password, password.c_str());
if (password.length() == 64)
memcpy((char*)config.password, password.c_str(), 64);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The issue with this is that station_config::password is exactly 64 chars so you will have no ending zero... IMHO the correct fix would be to declare uint8 password[65]; in esp_sta.h, and signal a bug to espressif.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WPA passphrases are 8-63 ASCII characters by 802.11 spec so this is not a bug.

@zgoda
Copy link
Contributor

zgoda commented Jun 7, 2017

I've been there.

https://stackoverflow.com/a/21554182/12138

@slaff
Copy link
Contributor

slaff commented Jun 13, 2017

@BotoX Please, fix the issue that Codacy is reporting.

@slaff slaff added this to the 3.3.0 milestone Jun 13, 2017
@slaff
Copy link
Contributor

slaff commented Jun 13, 2017

@zgoda @ADiea Any comments from your side before I merge this PR?

@zgoda
Copy link
Contributor

zgoda commented Jun 13, 2017

This change does not fix any problem because there is still 63 characters limit in SDK for both AP and station. Did anybody made a test how the application on esp behaves if wifi has 64 characters passphrase? Will it connect at all?

@BotoX
Copy link
Author

BotoX commented Jun 13, 2017

It works fine for me in station mode, my home network access point is using a 64 character passphrase.
I did not try to create an access point on the ESP with 64 character passphrase however.

@zgoda
Copy link
Contributor

zgoda commented Jun 13, 2017

Ok, none of my access points I have at home allows passphrases longer than 63 chars so I have no chance to test this.

@ADiea
Copy link
Contributor

ADiea commented Jun 14, 2017

To me still not clear what happens here if you use the 64th position for passphrase and no space left for zero ending the string. Maybe the sdk has special way of reading from this array?

@zgoda
Copy link
Contributor

zgoda commented Jun 14, 2017

Tape side A: ESP8266 core for Arduino gets this wrong, against IEEE 802.11 spec and against vendor published SDK.
Tape side B: we want compatibility with ESP8266 core for Arduino.

My guess is SDK just copies array using memcpy, not string with strcpy - all implementations of PBKDF2 I know of use byte arrays, not strings so this assumption seems plausible. Things may work by accident for border case of 64 byte passphrase, until somebody decides to make string from byte array somewhere in AP software effectively replacing last byte with zero and then things will go boom. So as with all network related programming I'd go traditional route of "be relaxed when receiving and strict when sending". If my assumption about SDK is right then SDK does this exactly.

@slaff slaff removed this from the 3.3.0 milestone Nov 21, 2017
@mikee47 mikee47 force-pushed the develop branch 2 times, most recently from 7b19c1b to 295a5f3 Compare February 22, 2021 15:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants