summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant
Commit message (Collapse)AuthorAgeFilesLines
* wpa-supplicant: Fix CVE-2023-52160Claus Stovgaard2024-02-291-0/+213
| | | | | | | | | | PEAP client: Update Phase 2 authentication requirements. Also see https://www.top10vpn.com/research/wifi-vulnerabilities/ (From OE-Core rev: 57b6a329df897de69ae8b90706d9fe37e0ed6d35) Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Install wpa_passphrase when not disabledAlex Kiernan2022-04-221-0/+33
| | | | | | | | | | | | As part of fixing CONFIG_NO_WPA_PASSPHRASE, whilst wpa_passphrase gets built, its not installed during `make install`. (From OE-Core rev: 94c31ba28eb7bc3ab68876b3433cd3534679a3b6) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Use upstream defconfigAlex Kiernan2022-04-191-552/+0
| | | | | | | | | | | | | | | The copy of defconfig we were carrying was from 2014 and very out of date; drop it and use the upstream version with appropriate edits for our PACKAGECONFIG. Switch PACKAGECONFIG to using a default (?=) rather than weak default (??=) as per current recommendation. (From OE-Core rev: d97bedd8bdcc8c5073e8feead72ea5640987125b) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Backport libwpa/clean build fixesAlex Kiernan2022-04-192-0/+99
| | | | | | | | | | | | | | | Enabling CONFIG_BUILD_WPA_CLIENT_SO or CONFIG_NO_WPA_PASSPHRASE do nothing in the released 2.10 wpa-supplicant; backport the fixes for this. Also backport the fixes for `make clean` when `wpa_passphrase` is built. (From OE-Core rev: 179fedda2b347b0e9b17642afa4ba752587d4965) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: update 2.9 -> 2.10Alexander Kanavin2022-02-018-623/+0
| | | | | | | | | License-Update: copyright years (From OE-Core rev: 4f30b96207efcddfe76d6bf8d4c24f4fb7f80abb) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix CVE-2021-30004Stefan Ghinea2021-04-181-0/+123
| | | | | | | | | | | | | | | | | In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c. References: https://nvd.nist.gov/vuln/detail/CVE-2021-30004 Upstream patches: https://w1.fi/cgit/hostap/commit/?id=a0541334a6394f8237a4393b7372693cd7e96f15 (From OE-Core rev: b32b671bf430b36a5547f8d822dbb760d6be47f7) Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix CVE-2021-27803Stefan Ghinea2021-03-061-0/+58
| | | | | | | | | | | | | | | | | | A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. References: https://nvd.nist.gov/vuln/detail/CVE-2021-27803 Upstream patches: https://w1.fi/cgit/hostap/commit/?id=8460e3230988ef2ec13ce6b69b687e941f6cdb32 (From OE-Core rev: 81e4260b83c52558c320fd7d1c1eafcb312ad6be) Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix CVE-2021-0326Stefan Ghinea2021-02-261-0/+45
| | | | | | | | | | | | | | | | | | | | In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9 Android ID: A-172937525 References: https://nvd.nist.gov/vuln/detail/CVE-2021-0326 Upstream patches: https://w1.fi/cgit/hostap/commit/?id=947272febe24a8f0ea828b5b2f35f13c3821901e<links_for_CVE_patches> (From OE-Core rev: b7940edabe100512e8f558cc37f9da836feae74d) Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Security fix CVE-2020-12695Armin Kuster2020-06-283-0/+263
| | | | | | | | | | | | Source: http://w1.fi/security/ Disposition: Backport from http://w1.fi/security/2020-1/ Affects <= 2.9 wpa-supplicant (From OE-Core rev: e9c696397ae1b4344b8329a13076f265980ee74d) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix CVE-2019-16275Ross Burton2019-10-311-0/+82
| | | | | | | (From OE-Core rev: d7b5a2ebdb6e74a21059ac2496b5dbea4597eb87) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: update to 2.7Changhyeok Bae2019-02-089-1188/+0
| | | | | | | | | CVE patches is already applied in v2.7 (From OE-Core rev: 2c3a905061b501b1c79e191a1f275fdb9768a2d6) Signed-off-by: Changhyeok Bae <changhyeok.bae@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa_supplicant: Changed systemd template unitsJoshua DeWeese2019-02-081-0/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I goofed up the scissor line on the last attempt. Not sure how much it matters, but here it is correct this time. Here it is, updated to work with wpa-supplicant_2.6.bb. -- >8 -- https://www.freedesktop.org/software/systemd/man/systemd.unit.html#WantedBy= When building root filesystems with any of the wpa_supplicant systemd template service files enabled (current default is to have them disabled) the systemd-native-fake script would not process the line: Alias=multi-user.target.wants/wpa_supplicant@%i.service appropriately due the the use of "%i." According to the systemd documentation "WantedBy=foo.service in a service bar.service is mostly equivalent to Alias=foo.service.wants/bar.service in the same file." However, this is not really the intended purpose of install Aliases. All lines of the form: Alias=multi-user.target.wants/*%i.service Were replaced with the following lines: WantedBy=multi-user.target (From OE-Core rev: 85f82e94849f1c1b5e150c2e38c03eae19a2b370) Signed-off-by: Joshua DeWeese <jdeweese@hennypenny.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix CVE-2018-14526Andrej Valek2018-09-051-0/+44
| | | | | | | | | | | Ignore unauthenticated encrypted EAPOL-Key data in supplicant processing. When using WPA2, these are frames that have the Encrypted flag set, but not the MIC flag. (From OE-Core rev: a5a07887e73ebf0aa6b3b1fa247e44743b39322e) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix the bug for PATCHTOOL = "patch"Hong Liu2018-06-159-1025/+1144
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When switch PATCHTOOL to patch, applying 'key-replay-cve-multiple.patch' failed: checking file src/ap/ieee802_11.c checking file src/ap/wpa_auth.c checking file src/ap/wpa_auth.h checking file src/ap/wpa_auth_ft.c checking file src/ap/wpa_auth_i.h checking file src/common/wpa_common.h checking file src/rsn_supp/wpa.c checking file src/rsn_supp/wpa_i.h checking file src/rsn_supp/wpa.c Hunk #1 FAILED at 709. Hunk #2 FAILED at 757. Hunk #3 succeeded at 840 (offset -12 lines). Hunk #4 FAILED at 868. Hunk #5 FAILED at 900. Hunk #6 FAILED at 924. Hunk #7 succeeded at 1536 (offset -38 lines). Hunk #8 FAILED at 2386. Hunk #9 FAILED at 2920. Hunk #10 succeeded at 2940 (offset -46 lines). Hunk #11 FAILED at 2998. 8 out of 11 hunks FAILED checking file src/rsn_supp/wpa_i.h Hunk #1 FAILED at 32. 1 out of 1 hunk FAILED checking file src/common/wpa_common.h Hunk #1 succeeded at 215 with fuzz 1. checking file src/rsn_supp/wpa.c checking file src/rsn_supp/wpa_i.h checking file src/ap/wpa_auth.c Hunk #1 succeeded at 1898 (offset -3 lines). Hunk #2 succeeded at 2470 (offset -3 lines). checking file src/rsn_supp/tdls.c checking file wpa_supplicant/wnm_sta.c checking file src/rsn_supp/wpa.c Hunk #1 succeeded at 2378 (offset -62 lines). checking file src/rsn_supp/wpa_ft.c checking file src/rsn_supp/wpa_i.h Hunk #1 succeeded at 123 (offset -5 lines). So split the wpa-supplicant/key-replay-cve-multiple to 8 patches. (From OE-Core rev: 4e9bc513c22b9a52c48588ef276e2ab7f7781526) Signed-off-by: Hong Liu <hongl.fnst@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: add a missing WPA_COMMON_CTRL_IFACE definitionMing Liu2017-12-021-0/+1
| | | | | | | | | | | The WPA_COMMON_CTRL_IFACE definition is missing, which leads to obvious problems since there is no way to access the ctrl socket. So add it in. (From OE-Core rev: 7baa3137859915fdbaaea0499b442f5d9df3f17b) Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa_supplicant: fix WPA2 key replay security bugRoss Burton2017-10-161-0/+1025
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | WPA2 is vulnerable to replay attacks which result in unauthenticated users having access to the network. * CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake * CVE-2017-13078: reinstallation of the group key in the Four-way handshake * CVE-2017-13079: reinstallation of the integrity group key in the Four-way handshake * CVE-2017-13080: reinstallation of the group key in the Group Key handshake * CVE-2017-13081: reinstallation of the integrity group key in the Group Key handshake * CVE-2017-13082: accepting a retransmitted Fast BSS Transition Reassociation Request and reinstalling the pairwise key while processing it * CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake * CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame * CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame Backport patches from upstream to resolve these CVEs. (From OE-Core rev: 1c46e201ef486395ec047f29af272f8c3dfd9611) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: 2.5 -> 2.6Zheng Ruoqin2016-12-175-347/+0
| | | | | | | | | | | | | | | | | | | 1)Upgrade wpa-supplicant from 2.5 to 2.6. 2)Delete 5 patches below, since they are integrated upstream. 0001-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch 0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch 0002-Reject-SET_CRED-commands-with-newline-characters-in-.patch 0002-Remove-newlines-from-wpa_supplicant-config-network-o.patch 0003-Reject-SET-commands-with-newline-characters-in-the-s.patch 3)License checksum changes are not related to license changes. (From OE-Core rev: 878d411eb53e96bf78e902cc2345eccda8807bfc) (From OE-Core rev: 8751dbde2736a4dbea83f6f581fe90f0c60def76) Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa_supplicant: Security Advisory-CVE-2016-4477Zhixiong Chi2016-09-233-0/+175
| | | | | | | | | | | | | Add CVE-2016-4477 patch for avoiding \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation. Patches came from http://w1.fi/security/2016-1/ (From OE-Core rev: d4d4ed5f31c687b2b2b716ff0fb8ca6c7aa29853) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa_supplicant: Security Advisory-CVE-2016-4476Zhixiong Chi2016-09-232-0/+172
| | | | | | | | | | | | | Add CVE-2016-4476 patch for avoiding \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation. Patches came from http://w1.fi/security/2016-1/ (From OE-Core rev: ed610b68f7e19644c89d7131e34c990a02403c62) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: upgrade to 2.5Fan Xin2015-12-018-438/+0
| | | | | | | | | | | | | | wpa-supplicant: upgrade to 2.5 1. upgrade to 2.5 2. remove eight patches since they have been applied in 2.5 3. update SRC_URI, HOMEPAGE and BUGTRACKER to use w1.fi instead (From OE-Core rev: 80af821d1240a1fc2b32379b75801571db562657) Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Fix CVE-2015-4141, CVE-2015-4143, CVE-2015-4144, ↵Fan Xin2015-08-096-0/+346
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2015-4145, CVE-2015-4146 wpa-supplicant: backport patch to fix CVE-2015-4141, CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146 Backport patch to fix CVE-2015-4141, CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146. This patch is originally from: For CVE-2015-4141: http://w1.fi/security/2015-2/0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch For CVE-2015-4143: http://w1.fi/security/2015-4/0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch http://w1.fi/security/2015-4/0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch For CVE-2015-4144 and CVE-2015-4145: http://w1.fi/security/2015-4/0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch http://w1.fi/security/2015-4/0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch For CVE-2015-4146: http://w1.fi/security/2015-4/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch (From OE-Core rev: ce16e95de05db24e4e4132660d793cc7b1d890b9) Signed-off-by: Fan Xin <fan.xin at jp.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Fix CVE-2015-4142fan.xin2015-07-011-0/+45
| | | | | | | | | | | | | wpa-supplicant: backport patch to fix CVE-2015-4142 Backport patch to fix CVE-2015-4142. This patch is originally from: http://w1.fi/security/2015-3/0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch (From OE-Core rev: 61f2a6a18dcda22d7b0e236f9150674bff2764a7) Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: upgrade to 2.4Yue Tao2015-05-293-80/+47
| | | | | | | | | | | | 1. upgrade to 2.4 2. update the checksum, and license checksum since date in it is changed 3. Backport a patch to fix CVE-2015-1863 4. remove two deprecated patches (From OE-Core rev: fd0880c2b0958b72d641a6821ddd6d6790a92b7a) Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Replace non-standard base defines with c99 compliant onesKhem Raj2015-04-081-0/+38
| | | | | | | | | | Makes it more portable Change-Id: I033787934cd91243ce8f8ce3a974a157aa5cfd6a (From OE-Core rev: 1ee774c8a70d83011a1a4ed5da9ea056ed0f0c96) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: upgrade to 2.3Cristian Iorga2014-11-201-7/+7
| | | | | | | | | | - P2P WiFi improvements; - Bug fixes. (From OE-Core rev: f600e77bbdc1d6a0f29bf8bd775b79dc01bc0b4d) Signed-off-by: Cristian Iorga <cristian.iorga@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: use PACKAGECONFIG for ssl selectionYasir-Khan2014-08-111-1/+1
| | | | | | | | | | | Select between openssl or gnutls as ssl implementation via PACKAGECONFIG instead of explicitly adding both via DEPENDS. (From OE-Core rev: 0be9be4055e5b7f649d523a38344d3964dc9fdc4) Signed-off-by: Yasir-Khan <yasir_khan@mentor.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: upgrade to 2.1Cristian Iorga2014-03-022-82/+155
| | | | | | | | | | | | | | | | | - USE {BP} variable; - Updated naming scheme; - Updated copyright owners. - Update defconfig file, is now in sync with current version; as such, more functionality can be enabled for wpa-supplicant. - removed register-autoscan-correctly.patch, included in upstream. (From OE-Core rev: 361d334cabdeb9f25788e9f4b84e8cf7b28d26d3) Signed-off-by: Cristian Iorga <cristian.iorga@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: enable CONFIG_CTRL_IFACE_DBUS_NEWSteve Sakoman2013-11-121-1/+1
| | | | | | | | | | | Without this option wifi support in connman will fail: src/technology.c:technology_get() No matching drivers found for wifi (From OE-Core rev: 403e365e433c54633bcc843b32487a766282226e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: enable required configuration options for connmanSimon Busch2013-07-291-1/+20
| | | | | | | | | | | Details can be found in the connman documentation: https://git.kernel.org/cgit/network/connman/connman.git/tree/README#n280 (From OE-Core rev: 2e4d939b6a0061eec22b859a827dedda51b299ba) Signed-off-by: Simon Busch <morphis@gravedo.de> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: backport patch to fix dbus interface for autoscan functionalitySimon Busch2013-07-181-0/+51
| | | | | | | | | | | | See https://lists.connman.net/pipermail/connman/2013-July/014871.html for details about the issue with connman and http://lists.shmoo.com/pipermail/hostap/2013-July/028167.html about the upstream submission of the patch. (From OE-Core rev: 0d045e401bbd6a5ebf31a25e333fccc5a529f8cb) Signed-off-by: Simon Busch <morphis@gravedo.de> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: avoid host contamination by libnl3Andreas Oberritter2013-03-121-0/+42
| | | | | | | | | | | Removes hardcoded include path -I/usr/include/libnl3. OE's include path gets injected by do_configure. (From OE-Core rev: 1c3beda0015da9a0fec2581af7645c9ea122c7e3) Signed-off-by: Andreas Oberritter <obi@opendreambox.org> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: upgrade to 2.0Constantin Musca2013-01-255-0/+1192
- as of February 11, 2012, the project has chosen to use only the BSD license option for future distribution - wpa-supplicant-1.0 dir was not version specific, as such it is generic now (From OE-Core rev: 0f83cb8ca629fbf1af448781f28912bbc75e0d80) Signed-off-by: Constantin Musca <constantinx.musca@intel.com> Signed-off-by: Cristian Iorga <cristian.iorga@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-04-30 09:49:16 +0000