mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-01-02 06:03:50 +00:00
Code Issues Releases Activity

security/wpa_supplicant: Upgrade version 2.4 => 2.5

Browse Source
This commit is contained in:
John Marino 2015-10-11 22:52:59 +00:00
parent 30ebb3a02e
commit 16f7d87a0d
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=399108
10 changed files with 25 additions and 211 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
security/wpa_supplicant/Makefile
View File

@ -1,8 +1,7 @@
# $FreeBSD$
PORTNAME= wpa_supplicant
PORTVERSION= 2.4
PORTREVISION= 4
PORTVERSION= 2.5
CATEGORIES= security net
MASTER_SITES= http://w1.fi/releases/
@ -14,7 +13,7 @@ USE_OPENSSL= yes
BUILD_WRKSRC= ${WRKSRC}/wpa_supplicant
INSTALL_WRKSRC= ${WRKSRC}/src
CFLAGS+= ${CPPFLAGS} # USES=readline only augments CPPFLAGS and LDFLAGS
LDFLAGS= -lutil
LDFLAGS+= -lutil
SUB_FILES= pkg-message
PORTDOCS= README ChangeLog

4
security/wpa_supplicant/distinfo
View File

@ -1,2 +1,2 @@
SHA256 (wpa_supplicant-2.4.tar.gz) = 058dc832c096139a059e6df814080f50251a8d313c21b13364c54a1e70109122
SIZE (wpa_supplicant-2.4.tar.gz) = 2525648
SHA256 (wpa_supplicant-2.5.tar.gz) = cce55bae483b364eae55c35ba567c279be442ed8bab5b80a3c7fb0d057b9b316
SIZE (wpa_supplicant-2.5.tar.gz) = 2607336

12
security/wpa_supplicant/files/patch-src_ap_wmm.c
View File

@ -1,12 +0,0 @@
--- src/ap/wmm.c.orig 2015-03-15 17:30:39 UTC
+++ src/ap/wmm.c
@@ -274,6 +274,9 @@ void hostapd_wmm_action(struct hostapd_d
return;
}
+ if (left < 0)
+ return; /* not a valid WMM Action frame */
+
/* extract the tspec info element */
if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) {
hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,

77
security/wpa_supplicant/files/patch-src_eap__peer_eap__pwd.c
View File

@ -1,77 +0,0 @@
--- src/eap_peer/eap_pwd.c.orig 2015-03-15 17:30:39 UTC
+++ src/eap_peer/eap_pwd.c
@@ -301,6 +301,23 @@ eap_pwd_perform_commit_exchange(struct e
BIGNUM *mask = NULL, *x = NULL, *y = NULL, *cofactor = NULL;
u16 offset;
u8 *ptr, *scalar = NULL, *element = NULL;
+ size_t prime_len, order_len;
+
+ if (data->state != PWD_Commit_Req) {
+ ret->ignore = TRUE;
+ goto fin;
+ }
+
+ prime_len = BN_num_bytes(data->grp->prime);
+ order_len = BN_num_bytes(data->grp->order);
+
+ if (payload_len != 2 * prime_len + order_len) {
+ wpa_printf(MSG_INFO,
+ "EAP-pwd: Unexpected Commit payload length %u (expected %u)",
+ (unsigned int) payload_len,
+ (unsigned int) (2 * prime_len + order_len));
+ goto fin;
+ }
if (((data->private_value = BN_new()) == NULL) ||
((data->my_element = EC_POINT_new(data->grp->group)) == NULL) ||
@@ -500,6 +517,18 @@ eap_pwd_perform_confirm_exchange(struct
u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr;
int offset;
+ if (data->state != PWD_Confirm_Req) {
+ ret->ignore = TRUE;
+ goto fin;
+ }
+
+ if (payload_len != SHA256_MAC_LEN) {
+ wpa_printf(MSG_INFO,
+ "EAP-pwd: Unexpected Confirm payload length %u (expected %u)",
+ (unsigned int) payload_len, SHA256_MAC_LEN);
+ goto fin;
+ }
+
/*
* first build up the ciphersuite which is group | random_function |
* prf
@@ -783,11 +812,23 @@ eap_pwd_process(struct eap_sm *sm, void
* if it's the first fragment there'll be a length field
*/
if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {
+ if (len < 2) {
+ wpa_printf(MSG_DEBUG,
+ "EAP-pwd: Frame too short to contain Total-Length field");
+ ret->ignore = TRUE;
+ return NULL;
+ }
tot_len = WPA_GET_BE16(pos);
wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments whose "
"total length = %d", tot_len);
if (tot_len > 15000)
return NULL;
+ if (data->inbuf) {
+ wpa_printf(MSG_DEBUG,
+ "EAP-pwd: Unexpected new fragment start when previous fragment is still in use");
+ ret->ignore = TRUE;
+ return NULL;
+ }
data->inbuf = wpabuf_alloc(tot_len);
if (data->inbuf == NULL) {
wpa_printf(MSG_INFO, "Out of memory to buffer "
@@ -873,6 +914,7 @@ eap_pwd_process(struct eap_sm *sm, void
/*
* we have output! Do we need to fragment it?
*/
+ lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch);
len = wpabuf_len(data->outbuf);
if ((len + EAP_PWD_HDR_SIZE) > data->mtu) {
resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu,

60
security/wpa_supplicant/files/patch-src_eap__server_eap__server__pwd.c
View File

@ -1,60 +0,0 @@
--- src/eap_server/eap_server_pwd.c.orig 2015-03-15 17:30:39 UTC
+++ src/eap_server/eap_server_pwd.c
@@ -634,9 +634,21 @@ eap_pwd_process_commit_resp(struct eap_s
BIGNUM *x = NULL, *y = NULL, *cofactor = NULL;
EC_POINT *K = NULL, *point = NULL;
int res = 0;
+ size_t prime_len, order_len;
wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response");
+ prime_len = BN_num_bytes(data->grp->prime);
+ order_len = BN_num_bytes(data->grp->order);
+
+ if (payload_len != 2 * prime_len + order_len) {
+ wpa_printf(MSG_INFO,
+ "EAP-pwd: Unexpected Commit payload length %u (expected %u)",
+ (unsigned int) payload_len,
+ (unsigned int) (2 * prime_len + order_len));
+ goto fin;
+ }
+
if (((data->peer_scalar = BN_new()) == NULL) ||
((data->k = BN_new()) == NULL) ||
((cofactor = BN_new()) == NULL) ||
@@ -752,6 +764,13 @@ eap_pwd_process_confirm_resp(struct eap_
u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr;
int offset;
+ if (payload_len != SHA256_MAC_LEN) {
+ wpa_printf(MSG_INFO,
+ "EAP-pwd: Unexpected Confirm payload length %u (expected %u)",
+ (unsigned int) payload_len, SHA256_MAC_LEN);
+ goto fin;
+ }
+
/* build up the ciphersuite: group | random_function | prf */
grp = htons(data->group_num);
ptr = (u8 *) &cs;
@@ -901,11 +920,21 @@ static void eap_pwd_process(struct eap_s
* the first fragment has a total length
*/
if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {
+ if (len < 2) {
+ wpa_printf(MSG_DEBUG,
+ "EAP-pwd: Frame too short to contain Total-Length field");
+ return;
+ }
tot_len = WPA_GET_BE16(pos);
wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments, total "
"length = %d", tot_len);
if (tot_len > 15000)
return;
+ if (data->inbuf) {
+ wpa_printf(MSG_DEBUG,
+ "EAP-pwd: Unexpected new fragment start when previous fragment is still in use");
+ return;
+ }
data->inbuf = wpabuf_alloc(tot_len);
if (data->inbuf == NULL) {
wpa_printf(MSG_INFO, "EAP-pwd: Out of memory to "

10
security/wpa_supplicant/files/patch-src_p2p_p2p.c
View File

@ -1,10 +0,0 @@
--- src/p2p/p2p.c.orig 2015-04-24 22:44:26 UTC
+++ src/p2p/p2p.c
@@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p,
if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
os_memcpy(dev->interface_addr, addr, ETH_ALEN);
if (msg.ssid &&
+ msg.ssid[1] <= sizeof(dev->oper_ssid) &&
(msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
!= 0)) {

19
security/wpa_supplicant/files/patch-src_utils_os__unix.c
View File

@ -1,6 +1,6 @@
--- src/utils/os_unix.c.orig 2015-03-15 17:30:39 UTC
--- src/utils/os_unix.c.orig 2015-09-27 19:02:05 UTC
+++ src/utils/os_unix.c
@@ -190,17 +190,42 @@ static int os_daemon(int nochdir, int no
@@ -214,17 +214,42 @@ static int os_daemon(int nochdir, int no
#define os_daemon daemon
#endif /* __APPLE__ */
@ -43,7 +43,7 @@
if (pid_file) {
FILE *f = fopen(pid_file, "w");
if (f) {
@@ -208,6 +233,7 @@ int os_daemonize(const char *pid_file)
@@ -232,6 +257,7 @@ int os_daemonize(const char *pid_file)
fclose(f);
}
}
@ -51,7 +51,7 @@
return -0;
#endif /* defined(__uClinux__) || defined(__sun__) */
@@ -357,7 +383,7 @@ int os_setenv(const char *name, const ch
@@ -384,7 +410,7 @@ int os_setenv(const char *name, const ch
int os_unsetenv(const char *name)
{
@ -60,3 +60,14 @@
defined(__OpenBSD__)
unsetenv(name);
return 0;
@@ -445,7 +471,9 @@ int os_file_exists(const char *fname)
int os_fdatasync(FILE *stream)
{
if (!fflush(stream)) {
-#ifndef __MACH__
+#ifdef FREE_DRAGON
+ return fsync(fileno(stream));
+#elif !defined __MACH__
return fdatasync(fileno(stream));
#else /* __MACH__ */
#ifdef F_FULLFSYNC

16
security/wpa_supplicant/files/patch-src_wps_httpread.c
View File

@ -1,16 +0,0 @@
--- src/wps/httpread.c.orig 2015-03-15 17:30:39 UTC
+++ src/wps/httpread.c
@@ -533,6 +533,13 @@ static void httpread_read_handler(int sd
if (!isxdigit(*cbp))
goto bad;
h->chunk_size = strtoul(cbp, NULL, 16);
+ if (h->chunk_size < 0 ||
+ h->chunk_size > h->max_bytes) {
+ wpa_printf(MSG_DEBUG,
+ "httpread: Invalid chunk size %d",
+ h->chunk_size);
+ goto bad;
+ }
/* throw away chunk header
* so we have only real data
*/

21
security/wpa_supplicant/files/patch-src_wps_ndef.c
View File

@ -1,21 +0,0 @@
--- src/wps/ndef.c.orig 2015-03-15 17:30:39 UTC
+++ src/wps/ndef.c
@@ -48,6 +48,8 @@ static int ndef_parse_record(const u8 *d
if (size < 6)
return -1;
record->payload_length = ntohl(*(u32 *)pos);
+ if (record->payload_length > size - 6)
+ return -1;
pos += sizeof(u32);
}
@@ -68,7 +70,8 @@ static int ndef_parse_record(const u8 *d
pos += record->payload_length;
record->total_length = pos - data;
- if (record->total_length > size)
+ if (record->total_length > size ||
+ record->total_length < record->payload_length)
return -1;
return 0;
}

12
security/wpa_supplicant/files/patch-wpa__supplicant_scan.c
View File

@ -1,6 +1,6 @@
--- wpa_supplicant/scan.c.orig 2015-03-15 17:30:39 UTC
--- wpa_supplicant/scan.c.orig 2015-09-27 19:02:05 UTC
+++ wpa_supplicant/scan.c
@@ -1621,7 +1621,7 @@ struct wpabuf * wpa_scan_get_vendor_ie_m
@@ -1657,7 +1657,7 @@ struct wpabuf * wpa_scan_get_vendor_ie_m
* better. */
static int wpa_scan_result_compar(const void *a, const void *b)
{
@ -9,19 +9,19 @@
struct wpa_scan_res **_wa = (void *) a;
struct wpa_scan_res **_wb = (void *) b;
struct wpa_scan_res *wa = *_wa;
@@ -1650,9 +1650,9 @@ static int wpa_scan_result_compar(const
@@ -1686,9 +1686,9 @@ static int wpa_scan_result_compar(const
if (wa->flags & wb->flags & WPA_SCAN_LEVEL_DBM) {
snr_a_full = wa->snr;
- snr_a = MIN(wa->snr, GREAT_SNR);
+ snr_a = MINAB(wa->snr, GREAT_SNR);
snr_b_full = wb->snr;
- snr_b = MIN(wa->snr, GREAT_SNR);
+ snr_b = MINAB(wa->snr, GREAT_SNR);
- snr_b = MIN(wb->snr, GREAT_SNR);
+ snr_b = MINAB(wb->snr, GREAT_SNR);
} else {
/* Level is not in dBm, so we can't calculate
* SNR. Just use raw level (units unknown). */
@@ -1675,7 +1675,7 @@ static int wpa_scan_result_compar(const
@@ -1711,7 +1711,7 @@ static int wpa_scan_result_compar(const
if (snr_b_full == snr_a_full)
return wb->qual - wa->qual;
return snr_b_full - snr_a_full;