linux/poky.git/meta/recipes-connectivity/wpa-supplicant, branch 2.7_M2

wpa-supplicant: update to 2.7

2019-02-08T23:15:32+00:00

CVE patches is already applied in v2.7 (From OE-Core rev: 2c3a905061b501b1c79e191a1f275fdb9768a2d6) Signed-off-by: Changhyeok Bae Signed-off-by: Richard Purdie

wpa_supplicant: Changed systemd template units

2019-02-08T23:15:31+00:00

I goofed up the scissor line on the last attempt. Not sure how much it matters, but here it is correct this time. Here it is, updated to work with wpa-supplicant_2.6.bb. -- >8 -- https://www.freedesktop.org/software/systemd/man/systemd.unit.html#WantedBy= When building root filesystems with any of the wpa_supplicant systemd template service files enabled (current default is to have them disabled) the systemd-native-fake script would not process the line: Alias=multi-user.target.wants/wpa_supplicant@%i.service appropriately due the the use of "%i." According to the systemd documentation "WantedBy=foo.service in a service bar.service is mostly equivalent to Alias=foo.service.wants/bar.service in the same file." However, this is not really the intended purpose of install Aliases. All lines of the form: Alias=multi-user.target.wants/*%i.service Were replaced with the following lines: WantedBy=multi-user.target (From OE-Core rev: 85f82e94849f1c1b5e150c2e38c03eae19a2b370) Signed-off-by: Joshua DeWeese Signed-off-by: Richard Purdie

wpa-supplicant: fix CVE-2018-14526

2018-09-05T17:00:25+00:00

Ignore unauthenticated encrypted EAPOL-Key data in supplicant processing. When using WPA2, these are frames that have the Encrypted flag set, but not the MIC flag. (From OE-Core rev: a5a07887e73ebf0aa6b3b1fa247e44743b39322e) Signed-off-by: Andrej Valek Signed-off-by: Richard Purdie

wpa-supplicant: fix the bug for PATCHTOOL = "patch"

2018-06-15T16:56:24+00:00

When switch PATCHTOOL to patch, applying 'key-replay-cve-multiple.patch' failed: checking file src/ap/ieee802_11.c checking file src/ap/wpa_auth.c checking file src/ap/wpa_auth.h checking file src/ap/wpa_auth_ft.c checking file src/ap/wpa_auth_i.h checking file src/common/wpa_common.h checking file src/rsn_supp/wpa.c checking file src/rsn_supp/wpa_i.h checking file src/rsn_supp/wpa.c Hunk #1 FAILED at 709. Hunk #2 FAILED at 757. Hunk #3 succeeded at 840 (offset -12 lines). Hunk #4 FAILED at 868. Hunk #5 FAILED at 900. Hunk #6 FAILED at 924. Hunk #7 succeeded at 1536 (offset -38 lines). Hunk #8 FAILED at 2386. Hunk #9 FAILED at 2920. Hunk #10 succeeded at 2940 (offset -46 lines). Hunk #11 FAILED at 2998. 8 out of 11 hunks FAILED checking file src/rsn_supp/wpa_i.h Hunk #1 FAILED at 32. 1 out of 1 hunk FAILED checking file src/common/wpa_common.h Hunk #1 succeeded at 215 with fuzz 1. checking file src/rsn_supp/wpa.c checking file src/rsn_supp/wpa_i.h checking file src/ap/wpa_auth.c Hunk #1 succeeded at 1898 (offset -3 lines). Hunk #2 succeeded at 2470 (offset -3 lines). checking file src/rsn_supp/tdls.c checking file wpa_supplicant/wnm_sta.c checking file src/rsn_supp/wpa.c Hunk #1 succeeded at 2378 (offset -62 lines). checking file src/rsn_supp/wpa_ft.c checking file src/rsn_supp/wpa_i.h Hunk #1 succeeded at 123 (offset -5 lines). So split the wpa-supplicant/key-replay-cve-multiple to 8 patches. (From OE-Core rev: 4e9bc513c22b9a52c48588ef276e2ab7f7781526) Signed-off-by: Hong Liu Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

wpa-supplicant: add a missing WPA_COMMON_CTRL_IFACE definition

2017-12-02T11:25:33+00:00

The WPA_COMMON_CTRL_IFACE definition is missing, which leads to obvious problems since there is no way to access the ctrl socket. So add it in. (From OE-Core rev: 7baa3137859915fdbaaea0499b442f5d9df3f17b) Signed-off-by: Ming Liu Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

wpa_supplicant: fix WPA2 key replay security bug

2017-10-16T22:46:38+00:00

WPA2 is vulnerable to replay attacks which result in unauthenticated users having access to the network. * CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake * CVE-2017-13078: reinstallation of the group key in the Four-way handshake * CVE-2017-13079: reinstallation of the integrity group key in the Four-way handshake * CVE-2017-13080: reinstallation of the group key in the Group Key handshake * CVE-2017-13081: reinstallation of the integrity group key in the Group Key handshake * CVE-2017-13082: accepting a retransmitted Fast BSS Transition Reassociation Request and reinstalling the pairwise key while processing it * CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake * CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame * CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame Backport patches from upstream to resolve these CVEs. (From OE-Core rev: 1c46e201ef486395ec047f29af272f8c3dfd9611) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

wpa-supplicant_2.6.bb: set CVE_PRODUCT to wpa_supplicant

2017-07-24T08:13:31+00:00

It is used in NVD database CVE's like: https://nvd.nist.gov/vuln/detail/CVE-2015-1863 (From OE-Core rev: cc3882ca2fea2c5a8830311eeb7840ae98da9b3c) Signed-off-by: Mikko Rapeli Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

wpa-supplicant: inherit pkgconfig

2017-01-31T15:25:56+00:00

Missing dependency uncovered after recipe specific sysroots were enabled. (From OE-Core rev: 3173505ba6014271e59fdde2450ecc0d3cd4c8c2) Signed-off-by: Markus Lehtonen Signed-off-by: Richard Purdie

wpa-supplicant: 2.5 -> 2.6

2016-12-17T09:57:03+00:00

1)Upgrade wpa-supplicant from 2.5 to 2.6. 2)Delete 5 patches below, since they are integrated upstream. 0001-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch 0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch 0002-Reject-SET_CRED-commands-with-newline-characters-in-.patch 0002-Remove-newlines-from-wpa_supplicant-config-network-o.patch 0003-Reject-SET-commands-with-newline-characters-in-the-s.patch 3)License checksum changes are not related to license changes. (From OE-Core rev: 878d411eb53e96bf78e902cc2345eccda8807bfc) (From OE-Core rev: 8751dbde2736a4dbea83f6f581fe90f0c60def76) Signed-off-by: Zheng Ruoqin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

wpa_supplicant: Security Advisory-CVE-2016-4477

2016-09-23T13:56:39+00:00

Add CVE-2016-4477 patch for avoiding \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation. Patches came from http://w1.fi/security/2016-1/ (From OE-Core rev: d4d4ed5f31c687b2b2b716ff0fb8ca6c7aa29853) Signed-off-by: Zhixiong Chi Signed-off-by: Ross Burton Signed-off-by: Richard Purdie