summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/wpa-supplicant
Commit message (Collapse)AuthorAgeFilesLines
* wpa-supplicant: Ignore CVE-2024-5290Peter Marko2024-10-291-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NVD CVE report [1] links Ubuntu bug [2] which has a very good description/discussion about this issue. It applies only to distros patching wpa-supplicant to allow non-root users (e.g. via netdev group) to load modules. This is not the case of Yocto. Quote: So upstream isn't vulnerable as they only expose the dbus interface to root. Downstreams like Ubuntu and Chromium added a patch that grants access to the netdev group. The patch is the problem, not the upstream code IMHO. There is also a commit [3] associated with this CVE, however that only provides build-time configuration to limit paths which can be accessed but it acts only as a mitigation for distros which allow non-root users to load crafted modules. The patch is included in version 2.11, however NVD has this CVE version-less, so explicit ignore is necessary. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-5290 [2] https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613 [3] https://w1.fi/cgit/hostap/commit/?id=c84388ee4c66bcd310db57489eac4a75fc600747 (From OE-Core rev: 617cf25b0f49b732f961f1fa4d1390e8e883f12b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6cb794d44a8624784ec0f76dca764616d81ffbf5) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wpa-supplicant: add patch to check for kernel header version when compiling ↵Jon Mason2024-09-172-0/+54
| | | | | | | | | | | | | | | | | | | | | macsec When using Arm binary toolchain, version 2.11 of wpa-supplicant is failing to compile with the following error: | ../src/drivers/driver_macsec_linux.c:81:29: error: field ‘offload’ has incomplete type | 81 | enum macsec_offload offload; | | Backport a recent patch that corrects the issue by adding a check for the version of kernel headers being used in compilation and disabling that enum if too old a version is being used (or is used by the binary toolchain). (From OE-Core rev: 373d8d4f5316416d70eb2c0733d9838e57419ac3) Signed-off-by: Jon Mason <jdmason@kudzu.us> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Upgrade 2.10 -> 2.11Siddharth Doshi2024-08-235-352/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | License-Update: =============== - README: Change in copyright years as per https://w1.fi/cgit/hostap/commit/README?id=d945ddd368085f255e68328f2d3b020ceea359af - wpa_supplicant/wpa_supplicant.c: Change in copyright years as per https://w1.fi/cgit/hostap/commit/wpa_supplicant/wpa_supplicant.c?id=d945ddd368085f255e68328f2d3b020ceea359af CVE's Fixed: =========== - CVE-2024-5290 wpa_supplicant: wpa_supplicant loading arbitrary shared objects allowing privilege escalation - CVE-2023-52160 wpa_supplicant: potential authorization bypass Changes between 2.10 -> 2.11: ============================ https://w1.fi/cgit/hostap/commit/wpa_supplicant/ChangeLog?id=d945ddd368085f255e68328f2d3b020ceea359af Note: ===== Patches 0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch, 0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch, 0001-Install-wpa_passphrase-when-not-disabled.patch, 0001-PEAP-client-Update-Phase-2-authentication-requiremen.patch (CVE-2023-52160) are already fixed and hence removing them. (From OE-Core rev: 824eb0641dc6001a5e9ad7a685e60c472c9fdce8) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: Update WORKDIR references to UNPACKDIRRichard Purdie2024-05-021-4/+4
| | | | | | | | | | Since we want to be able to stop unpacking to WORKDIR, correct the WORKDIR references in recipe do_compile/do_install tasks to use UNPACKDIR in the appropraite places instead. (From OE-Core rev: d73595df69667fe9d12ecd407b77a0b8dae2109c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Fix CVE-2023-52160Claus Stovgaard2024-02-292-0/+214
| | | | | | | | | | PEAP client: Update Phase 2 authentication requirements. Also see https://www.top10vpn.com/research/wifi-vulnerabilities/ (From OE-Core rev: 57b6a329df897de69ae8b90706d9fe37e0ed6d35) Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes, classes: Avoid adding extra whitespace to PACKAGESPLITFUNCSPeter Kjellerstedt2023-01-121-1/+1
| | | | | | | | | | | | This is a follow-up to commit 846ff49465 to remove the extra whitespace that is no longer needed after converting :append and :prepend to += and =+. (From OE-Core rev: 5a38be49e451c9f9d973b10a33c3972507f7b18a) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes/classes: Drop prepend/append usage with PACKAGESPLITFUNCSRichard Purdie2023-01-051-1/+1
| | | | | | | | | | As far as I can tell, none of these uses of PACKAGESPLITFUNCS need append/prepend operators, the standard += and =+ can work just fine. Since OE-Core is copied a lot, use the preferred syntax which is also simpler to parse and change. (From OE-Core rev: 846ff49465337dddd75a83161f41f48117f6571c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: update config for gnutlsKai Kang2022-05-031-1/+4
| | | | | | | | | | | | | | | | | It fails to build wpa-supplicant with gnutls by setting PACKAGECONFIG with 'gnutls': | wpa_supplicant/../src/eap_common/eap_pwd_common.c:440: undefined reference to `crypto_ec_point_deinit' Disable 3 configure options CONFIG_DPP, CONFIG_EAP_PWD and CONFIG_SAE to make it work with gnutls. (From OE-Core rev: 3a43c2a82881688d85238464db371f695e60b572) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Package shared library into wpa-supplicant-libAlex Kiernan2022-04-221-1/+3
| | | | | | | | | | | | When CONFIG_BUILD_WPA_CLIENT_SO is enabled, package the library into wpa-supplicant-lib. (From OE-Core rev: 0f96a77c431bba9ae89fb6ee079f460c011b9b36) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Install wpa_passphrase when not disabledAlex Kiernan2022-04-222-1/+35
| | | | | | | | | | | | As part of fixing CONFIG_NO_WPA_PASSPHRASE, whilst wpa_passphrase gets built, its not installed during `make install`. (From OE-Core rev: 94c31ba28eb7bc3ab68876b3433cd3534679a3b6) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Package dynamic modulesAlex Kiernan2022-04-191-1/+21
| | | | | | | | | | | If CONFIG_DYNAMIC_EAP_METHODS and some modules are set to `dyn` ensure these are packaged as part of the build. (From OE-Core rev: 6043e4332beea8073eb1148a59b66f0618c05e96) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Simplify build/install flowAlex Kiernan2022-04-191-11/+3
| | | | | | | | | | | | | | The build/install steps for wpa-supplicant support CFLAGS and an install target, so use these rather than attempting to do it manually (which was broken by upstream splitting into build.rules and lib.rules). Note that this installs wpa_passphrase into sbindir rather than bindir. (From OE-Core rev: d34e00cce8fb7489aaf404d0b2491b3bbb93a0ed) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Use upstream defconfigAlex Kiernan2022-04-192-562/+6
| | | | | | | | | | | | | | | The copy of defconfig we were carrying was from 2014 and very out of date; drop it and use the upstream version with appropriate edits for our PACKAGECONFIG. Switch PACKAGECONFIG to using a default (?=) rather than weak default (??=) as per current recommendation. (From OE-Core rev: d97bedd8bdcc8c5073e8feead72ea5640987125b) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Build static library if not DISABLE_STATICAlex Kiernan2022-04-191-0/+11
| | | | | | | | | | Build the static library if the configuration indicates we should. (From OE-Core rev: 28e25faf500861c25e50aeb898e5e933b5090916) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Backport libwpa/clean build fixesAlex Kiernan2022-04-193-0/+101
| | | | | | | | | | | | | | | Enabling CONFIG_BUILD_WPA_CLIENT_SO or CONFIG_NO_WPA_PASSPHRASE do nothing in the released 2.10 wpa-supplicant; backport the fixes for this. Also backport the fixes for `make clean` when `wpa_passphrase` is built. (From OE-Core rev: 179fedda2b347b0e9b17642afa4ba752587d4965) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Use PACKAGE_BEFORE_PN/${PN}Alex Kiernan2022-04-191-4/+4
| | | | | | | | | | | Use PACKAGE_BEFORE_PN for packages which need to capture files early, switch to idiomatic ${PN} for additional packages. (From OE-Core rev: c69b90a38203fc9c61f49c33591fbe445074c1ce) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Avoid changing directory in do_installAlex Kiernan2022-04-191-2/+1
| | | | | | | | | | | Changing directory leads to anyone coming later needing to be explicit in their directory usage as the working directory is no longer ${B}. (From OE-Core rev: 36555aa783ffe5420c6da96dfece12931afaefa6) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Reorder/group following style guideAlex Kiernan2022-04-191-19/+22
| | | | | | | | (From OE-Core rev: d99436b3c3f38584e3638b4ccaa6a14382e0c3a5) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: update 2.9 -> 2.10Alexander Kanavin2022-02-019-638/+6
| | | | | | | | | License-Update: copyright years (From OE-Core rev: 4f30b96207efcddfe76d6bf8d4c24f4fb7f80abb) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Match package override to PACKAGES for pkg_postinstRichard Purdie2021-11-111-1/+1
| | | | | | | | | | | In PACKAGES, ${PN} is used so it makes sense for the pkg_postinst variable override to match that else it causes user confusion. [YOCTO #14616] (From OE-Core rev: ae9094d45bbfff377bd542939e12a8451a4959b6) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: '${systemd_unitdir}/system' => '${systemd_system_unitdir}'Robert P. J. Day2021-09-071-2/+2
| | | | | | | | | | | Repo-wide replacement to use newer variable to represent systemd system unitdir directory. (From OE-Core rev: 5ace3ada5c54500c71becc8e0c6eddeb8bc053e3) Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Convert to new override syntaxRichard Purdie2021-08-021-8/+8
| | | | | | | | | | | | This is the result of automated script conversion: scripts/contrib/convert-overrides.py <oe-core directory> converting the metadata to use ":" as the override character instead of "_". (From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Enable opensslKhem Raj2021-04-201-1/+1
| | | | | | | | | Use openSSL for TLS/SSL implementation (From OE-Core rev: 2bd4702d68ef79320c8194934568c56b4cc87aa3) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix CVE-2021-30004Stefan Ghinea2021-04-182-0/+124
| | | | | | | | | | | | | | | | | In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c. References: https://nvd.nist.gov/vuln/detail/CVE-2021-30004 Upstream patches: https://w1.fi/cgit/hostap/commit/?id=a0541334a6394f8237a4393b7372693cd7e96f15 (From OE-Core rev: b32b671bf430b36a5547f8d822dbb760d6be47f7) Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix CVE-2021-27803Stefan Ghinea2021-03-062-0/+59
| | | | | | | | | | | | | | | | | | A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. References: https://nvd.nist.gov/vuln/detail/CVE-2021-27803 Upstream patches: https://w1.fi/cgit/hostap/commit/?id=8460e3230988ef2ec13ce6b69b687e941f6cdb32 (From OE-Core rev: 81e4260b83c52558c320fd7d1c1eafcb312ad6be) Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta/recipes-connectivity: Add HOMEPAGE / DESCRIPTIONDorinda2021-02-261-0/+1
| | | | | | | | | | | Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage [YOCTO #13471] (From OE-Core rev: ecf8922e6bb12a2facc59bbe794b575101fce1dc) Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix CVE-2021-0326Stefan Ghinea2021-02-262-0/+46
| | | | | | | | | | | | | | | | | | | | In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9 Android ID: A-172937525 References: https://nvd.nist.gov/vuln/detail/CVE-2021-0326 Upstream patches: https://w1.fi/cgit/hostap/commit/?id=947272febe24a8f0ea828b5b2f35f13c3821901e<links_for_CVE_patches> (From OE-Core rev: b7940edabe100512e8f558cc37f9da836feae74d) Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Security fix CVE-2020-12695Armin Kuster2020-06-284-1/+267
| | | | | | | | | | | | Source: http://w1.fi/security/ Disposition: Backport from http://w1.fi/security/2020-1/ Affects <= 2.9 wpa-supplicant (From OE-Core rev: e9c696397ae1b4344b8329a13076f265980ee74d) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: remove service templates from SYSTEMD_SERVICEKai Kang2020-06-091-3/+3
| | | | | | | | | | | Remove service templates wpa_supplicant-nl80211@.service and wpa_supplicant-wired@.service from SYSTEMD_SERVICE that they should NOT be started/stopped by calling 'systemctl' in postinst and prerm scripts. (From OE-Core rev: fe9b8e50461ab00ab3ad8b065ebd32f0eea2a255) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix CVE-2019-16275Ross Burton2019-10-312-0/+83
| | | | | | | (From OE-Core rev: d7b5a2ebdb6e74a21059ac2496b5dbea4597eb87) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Clarify BSD license variantChristophe PRIOUZEAU2019-10-151-1/+1
| | | | | | | | | The license of wpa-supplicant is BSD-3-Clause (From OE-Core rev: 95507898ad6a7b88c83ef376c1cb8b3b3a685c96) Signed-off-by: Christophe Priouzeau <christophe.priouzeau@st.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: update to 2.9Oleksandr Kravchuk2019-08-121-2/+2
| | | | | | | (From OE-Core rev: 84f6fd6464b987c556c630e83e8888ee484dadc6) Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: update to 2.8Oleksandr Kravchuk2019-05-081-5/+5
| | | | | | | | | License checksums were changed due to modified copyright years. (From OE-Core rev: d6df8c1a7766e5df6351bb56f905664394cbdcc0) Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Remove no longer required hack for libnlAdrian Bunk2019-03-061-2/+0
| | | | | | | | | Upstream already fixed this properly by using pkg-config. (From OE-Core rev: d37396c48cd44a6036677ea47c249efbf9a91472) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: update to 2.7Changhyeok Bae2019-02-0810-1202/+5
| | | | | | | | | CVE patches is already applied in v2.7 (From OE-Core rev: 2c3a905061b501b1c79e191a1f275fdb9768a2d6) Signed-off-by: Changhyeok Bae <changhyeok.bae@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa_supplicant: Changed systemd template unitsJoshua DeWeese2019-02-082-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I goofed up the scissor line on the last attempt. Not sure how much it matters, but here it is correct this time. Here it is, updated to work with wpa-supplicant_2.6.bb. -- >8 -- https://www.freedesktop.org/software/systemd/man/systemd.unit.html#WantedBy= When building root filesystems with any of the wpa_supplicant systemd template service files enabled (current default is to have them disabled) the systemd-native-fake script would not process the line: Alias=multi-user.target.wants/wpa_supplicant@%i.service appropriately due the the use of "%i." According to the systemd documentation "WantedBy=foo.service in a service bar.service is mostly equivalent to Alias=foo.service.wants/bar.service in the same file." However, this is not really the intended purpose of install Aliases. All lines of the form: Alias=multi-user.target.wants/*%i.service Were replaced with the following lines: WantedBy=multi-user.target (From OE-Core rev: 85f82e94849f1c1b5e150c2e38c03eae19a2b370) Signed-off-by: Joshua DeWeese <jdeweese@hennypenny.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix CVE-2018-14526Andrej Valek2018-09-052-0/+45
| | | | | | | | | | | Ignore unauthenticated encrypted EAPOL-Key data in supplicant processing. When using WPA2, these are frames that have the Encrypted flag set, but not the MIC flag. (From OE-Core rev: a5a07887e73ebf0aa6b3b1fa247e44743b39322e) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: fix the bug for PATCHTOOL = "patch"Hong Liu2018-06-1510-1026/+1152
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When switch PATCHTOOL to patch, applying 'key-replay-cve-multiple.patch' failed: checking file src/ap/ieee802_11.c checking file src/ap/wpa_auth.c checking file src/ap/wpa_auth.h checking file src/ap/wpa_auth_ft.c checking file src/ap/wpa_auth_i.h checking file src/common/wpa_common.h checking file src/rsn_supp/wpa.c checking file src/rsn_supp/wpa_i.h checking file src/rsn_supp/wpa.c Hunk #1 FAILED at 709. Hunk #2 FAILED at 757. Hunk #3 succeeded at 840 (offset -12 lines). Hunk #4 FAILED at 868. Hunk #5 FAILED at 900. Hunk #6 FAILED at 924. Hunk #7 succeeded at 1536 (offset -38 lines). Hunk #8 FAILED at 2386. Hunk #9 FAILED at 2920. Hunk #10 succeeded at 2940 (offset -46 lines). Hunk #11 FAILED at 2998. 8 out of 11 hunks FAILED checking file src/rsn_supp/wpa_i.h Hunk #1 FAILED at 32. 1 out of 1 hunk FAILED checking file src/common/wpa_common.h Hunk #1 succeeded at 215 with fuzz 1. checking file src/rsn_supp/wpa.c checking file src/rsn_supp/wpa_i.h checking file src/ap/wpa_auth.c Hunk #1 succeeded at 1898 (offset -3 lines). Hunk #2 succeeded at 2470 (offset -3 lines). checking file src/rsn_supp/tdls.c checking file wpa_supplicant/wnm_sta.c checking file src/rsn_supp/wpa.c Hunk #1 succeeded at 2378 (offset -62 lines). checking file src/rsn_supp/wpa_ft.c checking file src/rsn_supp/wpa_i.h Hunk #1 succeeded at 123 (offset -5 lines). So split the wpa-supplicant/key-replay-cve-multiple to 8 patches. (From OE-Core rev: 4e9bc513c22b9a52c48588ef276e2ab7f7781526) Signed-off-by: Hong Liu <hongl.fnst@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: add a missing WPA_COMMON_CTRL_IFACE definitionMing Liu2017-12-021-0/+1
| | | | | | | | | | | The WPA_COMMON_CTRL_IFACE definition is missing, which leads to obvious problems since there is no way to access the ctrl socket. So add it in. (From OE-Core rev: 7baa3137859915fdbaaea0499b442f5d9df3f17b) Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa_supplicant: fix WPA2 key replay security bugRoss Burton2017-10-162-0/+1026
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | WPA2 is vulnerable to replay attacks which result in unauthenticated users having access to the network. * CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake * CVE-2017-13078: reinstallation of the group key in the Four-way handshake * CVE-2017-13079: reinstallation of the integrity group key in the Four-way handshake * CVE-2017-13080: reinstallation of the group key in the Group Key handshake * CVE-2017-13081: reinstallation of the integrity group key in the Group Key handshake * CVE-2017-13082: accepting a retransmitted Fast BSS Transition Reassociation Request and reinstalling the pairwise key while processing it * CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake * CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame * CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame Backport patches from upstream to resolve these CVEs. (From OE-Core rev: 1c46e201ef486395ec047f29af272f8c3dfd9611) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant_2.6.bb: set CVE_PRODUCT to wpa_supplicantMikko Rapeli2017-07-241-0/+2
| | | | | | | | | | | | It is used in NVD database CVE's like: https://nvd.nist.gov/vuln/detail/CVE-2015-1863 (From OE-Core rev: cc3882ca2fea2c5a8830311eeb7840ae98da9b3c) Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: inherit pkgconfigMarkus Lehtonen2017-01-311-1/+1
| | | | | | | | | Missing dependency uncovered after recipe specific sysroots were enabled. (From OE-Core rev: 3173505ba6014271e59fdde2450ecc0d3cd4c8c2) Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: 2.5 -> 2.6Zheng Ruoqin2016-12-176-357/+5
| | | | | | | | | | | | | | | | | | | 1)Upgrade wpa-supplicant from 2.5 to 2.6. 2)Delete 5 patches below, since they are integrated upstream. 0001-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch 0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch 0002-Reject-SET_CRED-commands-with-newline-characters-in-.patch 0002-Remove-newlines-from-wpa_supplicant-config-network-o.patch 0003-Reject-SET-commands-with-newline-characters-in-the-s.patch 3)License checksum changes are not related to license changes. (From OE-Core rev: 878d411eb53e96bf78e902cc2345eccda8807bfc) (From OE-Core rev: 8751dbde2736a4dbea83f6f581fe90f0c60def76) Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa_supplicant: Security Advisory-CVE-2016-4477Zhixiong Chi2016-09-234-0/+178
| | | | | | | | | | | | | Add CVE-2016-4477 patch for avoiding \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation. Patches came from http://w1.fi/security/2016-1/ (From OE-Core rev: d4d4ed5f31c687b2b2b716ff0fb8ca6c7aa29853) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa_supplicant: Security Advisory-CVE-2016-4476Zhixiong Chi2016-09-233-0/+174
| | | | | | | | | | | | | Add CVE-2016-4476 patch for avoiding \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation. Patches came from http://w1.fi/security/2016-1/ (From OE-Core rev: ed610b68f7e19644c89d7131e34c990a02403c62) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Only depend on libgcrypt when neededJussi Kukkonen2016-02-111-2/+2
| | | | | | | | (From OE-Core rev: 8490c3da1a84f654a05254cb7b12871f89fda976) Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: upgrade to 2.5Fan Xin2015-12-019-452/+6
| | | | | | | | | | | | | | wpa-supplicant: upgrade to 2.5 1. upgrade to 2.5 2. remove eight patches since they have been applied in 2.5 3. update SRC_URI, HOMEPAGE and BUGTRACKER to use w1.fi instead (From OE-Core rev: 80af821d1240a1fc2b32379b75801571db562657) Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Fix CVE-2015-4142Otavio Salvador2015-08-111-0/+1
| | | | | | | | | | | | | The original commit "wpa-supplicant: Fix CVE-2015-4142" included the patch file but didn't apply it into the recipe, so the backport has not been effective. Reported-by: Adam Moore <adam.moore@savantsystems.com> (From OE-Core rev: 2a8944b63b7249500f1b6b292ce1a87b82699f3d) Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Fix CVE-2015-4141, CVE-2015-4143, CVE-2015-4144, ↵Fan Xin2015-08-097-0/+352
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2015-4145, CVE-2015-4146 wpa-supplicant: backport patch to fix CVE-2015-4141, CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146 Backport patch to fix CVE-2015-4141, CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146. This patch is originally from: For CVE-2015-4141: http://w1.fi/security/2015-2/0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch For CVE-2015-4143: http://w1.fi/security/2015-4/0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch http://w1.fi/security/2015-4/0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch For CVE-2015-4144 and CVE-2015-4145: http://w1.fi/security/2015-4/0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch http://w1.fi/security/2015-4/0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch For CVE-2015-4146: http://w1.fi/security/2015-4/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch (From OE-Core rev: ce16e95de05db24e4e4132660d793cc7b1d890b9) Signed-off-by: Fan Xin <fan.xin at jp.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Fix CVE-2015-4142fan.xin2015-07-011-0/+45
| | | | | | | | | | | | | wpa-supplicant: backport patch to fix CVE-2015-4142 Backport patch to fix CVE-2015-4142. This patch is originally from: http://w1.fi/security/2015-3/0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch (From OE-Core rev: 61f2a6a18dcda22d7b0e236f9150674bff2764a7) Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-17 00:49:19 +0000