From b1ec5ad89898fd16d9072c6698c1a51897be271e Mon Sep 17 00:00:00 2001 From: Calin Crisan Date: Sun, 29 Oct 2017 14:30:50 +0200 Subject: [PATCH] wpa_supplicant: backport security patches --- package/wpa_supplicant/Config.in | 6 +++--- package/wpa_supplicant/wpa_supplicant.hash | 7 +++++++ package/wpa_supplicant/wpa_supplicant.mk | 24 ++++++++++++++-------- 3 files changed, 26 insertions(+), 11 deletions(-) diff --git a/package/wpa_supplicant/Config.in b/package/wpa_supplicant/Config.in index 9250a3b200..4b810bf1a8 100644 --- a/package/wpa_supplicant/Config.in +++ b/package/wpa_supplicant/Config.in @@ -4,15 +4,15 @@ config BR2_PACKAGE_WPA_SUPPLICANT help WPA supplicant for secure wireless networks - http://hostap.epitest.fi/wpa_supplicant/ + http://w1.fi/wpa_supplicant/ if BR2_PACKAGE_WPA_SUPPLICANT config BR2_PACKAGE_WPA_SUPPLICANT_NL80211 bool "Enable nl80211 support" default y - select BR2_PACKAGE_LIBNL depends on BR2_TOOLCHAIN_HAS_THREADS # libnl + select BR2_PACKAGE_LIBNL help Enable support for nl80211. This is the current wireless API for Linux, supported by all wireless drivers in vanilla @@ -83,8 +83,8 @@ config BR2_PACKAGE_WPA_SUPPLICANT_CLI Install wpa_cli command line utility config BR2_PACKAGE_WPA_SUPPLICANT_WPA_CLIENT_SO - depends on !BR2_STATIC_LIBS bool "Install wpa_client shared library" + depends on !BR2_STATIC_LIBS help Install libwpa_client.so. diff --git a/package/wpa_supplicant/wpa_supplicant.hash b/package/wpa_supplicant/wpa_supplicant.hash index 22b2e8ddd8..65a6ae246f 100644 --- a/package/wpa_supplicant/wpa_supplicant.hash +++ b/package/wpa_supplicant/wpa_supplicant.hash @@ -1,2 +1,9 @@ # Locally calculated sha256 b4936d34c4e6cdd44954beba74296d964bc2c9668ecaa5255e499636fe2b1450 wpa_supplicant-2.6.tar.gz +sha256 529113cc81256c6178f3c1cf25dd8d3f33e6d770e4a180bd31c6ab7e4917f40b rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch +sha256 d86d47ab74170f3648b45b91bce780949ca92b09ab43df065178850ec0c335d7 rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch +sha256 d4535e36739a0cc7f3585e6bcba3c0bb8fc67cb3e729844e448c5dc751f47e81 rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch +sha256 793a54748161b5af430dd9de4a1988d19cb8e85ab29bc2340f886b0297cee20b rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch +sha256 596d4d3b63ea859ed7ea9791b3a21cb11b6173b04c0a14a2afa47edf1666afa6 rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch +sha256 c5a17af84aec2d88c56ce0da2d6945be398fe7cab5c0c340deb30973900c2736 rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch +sha256 c8840d857b9432f3b488113c85c1ff5d4a4b8d81078b7033388dae1e990843b1 rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk index 9c8414b568..75ecbaa53c 100644 --- a/package/wpa_supplicant/wpa_supplicant.mk +++ b/package/wpa_supplicant/wpa_supplicant.mk @@ -5,8 +5,16 @@ ################################################################################ WPA_SUPPLICANT_VERSION = 2.6 -WPA_SUPPLICANT_SITE = http://hostap.epitest.fi/releases -WPA_SUPPLICANT_LICENSE = BSD-3c +WPA_SUPPLICANT_SITE = http://w1.fi/releases +WPA_SUPPLICANT_PATCH = \ + http://w1.fi/security/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch \ + http://w1.fi/security/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch \ + http://w1.fi/security/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch \ + http://w1.fi/security/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch \ + http://w1.fi/security/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch \ + http://w1.fi/security/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch \ + http://w1.fi/security/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch +WPA_SUPPLICANT_LICENSE = BSD-3-Clause WPA_SUPPLICANT_LICENSE_FILES = README WPA_SUPPLICANT_CONFIG = $(WPA_SUPPLICANT_DIR)/wpa_supplicant/.config WPA_SUPPLICANT_SUBDIR = wpa_supplicant @@ -24,9 +32,9 @@ WPA_SUPPLICANT_CONFIG_EDITS = WPA_SUPPLICANT_CONFIG_SET = CONFIG_BGSCAN_SIMPLE WPA_SUPPLICANT_CONFIG_ENABLE = \ - CONFIG_IEEE80211AC \ - CONFIG_IEEE80211N \ - CONFIG_IEEE80211R \ + CONFIG_IEEE80211AC \ + CONFIG_IEEE80211N \ + CONFIG_IEEE80211R \ CONFIG_INTERNAL_LIBTOMMATH \ CONFIG_DEBUG_FILE \ CONFIG_MATCH_IFACE @@ -89,8 +97,8 @@ WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_WPS endif # Try to use openssl if it's already available -ifeq ($(BR2_PACKAGE_OPENSSL),y) -WPA_SUPPLICANT_DEPENDENCIES += openssl +ifeq ($(BR2_PACKAGE_LIBOPENSSL),y) +WPA_SUPPLICANT_DEPENDENCIES += libopenssl WPA_SUPPLICANT_LIBS += $(if $(BR2_STATIC_LIBS),-lcrypto -lz) WPA_SUPPLICANT_CONFIG_EDITS += 's/\#\(CONFIG_TLS=openssl\)/\1/' else @@ -101,7 +109,7 @@ endif ifeq ($(BR2_PACKAGE_DBUS),y) WPA_SUPPLICANT_DEPENDENCIES += host-pkgconf dbus WPA_SUPPLICANT_MAKE_ENV = \ - PKG_CONFIG_SYSROOT_DIR="$(STAGING_DIR)" \ + PKG_CONFIG_SYSROOT_DIR="$(STAGING_DIR)" \ PKG_CONFIG_PATH="$(STAGING_DIR)/usr/lib/pkgconfig" ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_DBUS_OLD),y)