Commit Graph

56 Commits

Author SHA1 Message Date
Cy Schubert
55fc118be8 contrib/wpa: Complete the revert of Import wpa.
Remove files added by b51f459a20.
The util/config.c conflicts with wpa_supplicant/config.c causing
the linker error.

The proper approach would have been to prepare the wpa build to
build the various subdirectories into .a libraries. SRCS makes no
distinction between files of the same name. The MFV accounted for this
but the revert failed to remove the additional files, including the
conflicting utils/config.c.
2021-04-17 17:33:36 -07:00
Cy Schubert
0aad5de37c Revert wpa import.
b51f459a20 resulted in a mismerge
due to having to do a remerge because my tree was over a week out of
date. Changes that were made to fix the build were lost in the remerge
resulting in build errors that were fixed a week ago.
2021-04-17 08:44:52 -07:00
Cy Schubert
b51f459a20 wpa: Import wpa_supplicant/hostapd commit f91680c15
This is the April update to vendor/wpa committed upstream
2021/04/07.

This is MFV efec822389.

Suggested by:		philip
Reviewed by:		philip
MFC after:		2 months
Differential Revision:	https://reviews.freebsd.org/D29744
2021-04-17 07:21:12 -07:00
Cy Schubert
eeb26cf52c wpa: import fix for P2P provision discovery processing vulnerability
Latest version available from: https://w1.fi/security/2021-1/

Vulnerability

A vulnerability was discovered in how wpa_supplicant processes P2P
(Wi-Fi Direct) provision discovery requests. Under a corner case
condition, an invalid Provision Discovery Request frame could end up
reaching a state where the oldest peer entry needs to be removed. With
a suitably constructed invalid frame, this could result in use
(read+write) of freed memory. This can result in an attacker within
radio range of the device running P2P discovery being able to cause
unexpected behavior, including termination of the wpa_supplicant process
and potentially code execution.

Vulnerable versions/configurations

wpa_supplicant v1.0-v2.9 with CONFIG_P2P build option enabled

An attacker (or a system controlled by the attacker) needs to be within
radio range of the vulnerable system to send a set of suitably
constructed management frames that trigger the corner case to be reached
in the management of the P2P peer table.

Note: FreeBSD base does not enable P2P.
2021-03-17 06:06:55 -07:00
Cy Schubert
1fc148624f Fix build following bfc99943b0.
bfc99943b0 removed ndis(4) support however
wpa as delivered by the wpa upstream (w1.fi) enables NDIS by default.
This commit disables NDIS suppport in the w1.fi delivered build config,
circumventing the build failure.
2021-01-25 14:46:45 -08:00
Cy Schubert
d70886d063 wpa_supplicant uses PF_ROUTE to return the routing table in order to
determine the length of the routing table buffer. As of 81728a538d
wpa_supplicant is started before the routing table has been populated
resulting in the length of zero to be returned. This causes
wpa_supplicant to loop endlessly. (The workaround is to kill and restart
wpa_supplicant as by the time it is restarted the routing table is
populated.)

(Personally, I was not able to reproduce this unless wlan0 was a member of
lagg0. However, others experienced this problem on standalone wlan0.)

PR:		252844
Submitted by:	shu <ankohuu _ outlook.com>
Reported by:	shu <ankohuu _ outlook.com>
Reviewed by:	cy
X-MFC with:	81728a538d
Differential Revision:	https://reviews.freebsd.org/D28249
2021-01-20 07:45:18 -08:00
Cy Schubert
ee7b7f3f05 Post CVE-2020-12695 cleanup patch:
Resolve a Linuxism to fix the build.

MFC after:	3 days
X-MFC with:	r361957, r361958, r361959
2020-06-09 05:43:51 +00:00
Cy Schubert
7d748adc91 MFV r361938:
Upstream commit message:

[PATCH 3/3] WPS UPnP: Handle HTTP initiation failures for events more
properly

While it is appropriate to try to retransmit the event to another
callback URL on a failure to initiate the HTTP client connection, there
is no point in trying the exact same operation multiple times in a row.
Replve the event_retry() calls with event_addr_failure() for these cases
to avoid busy loops trying to repeat the same failing operation.

These potential busy loops would go through eloop callbacks, so the
process is not completely stuck on handling them, but unnecessary CPU
would be used to process the continues retries that will keep failing
for the same reason.

Obtained from:	https://w1.fi/security/2020-1/\
	0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch
MFC after:	3 days
Security:	VU#339275 and CVE-2020-12695
2020-06-09 05:39:37 +00:00
Cy Schubert
b266d2f206 MFV r361937:
Upstream commit message:

[PATCH 2/3] WPS UPnP: Fix event message generation using a long URL path

More than about 700 character URL ended up overflowing the wpabuf used
for building the event notification and this resulted in the wpabuf
buffer overflow checks terminating the hostapd process. Fix this by
allocating the buffer to be large enough to contain the full URL path.
However, since that around 700 character limit has been the practical
limit for more than ten years, start explicitly enforcing that as the
limit or the callback URLs since any longer ones had not worked before
and there is no need to enable them now either.

Obtained from:	https://w1.fi/security/2020-1/\
	0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch
MFC after:	3 days
Security:	VU#339275 and CVE-2020-12695
2020-06-09 05:38:12 +00:00
Cy Schubert
a3557ef05f MFV r361936:
Upstream commit message:

[PATCH 1/3] WPS UPnP: Do not allow event subscriptions with URLs to
other networks

The UPnP Device Architecture 2.0 specification errata ("UDA errata
16-04-2020.docx") addresses a problem with notifications being allowed
to go out to other domains by disallowing such cases. Do such filtering
for the notification callback URLs to avoid undesired connections to
external networks based on subscriptions that any device in the local
network could request when WPS support for external registrars is
enabled (the upnp_iface parameter in hostapd configuration).

Obtained from:	https://w1.fi/security/2020-1/\
	0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch
MFC after:	3 days
Security:	VU#339275 and CVE-2020-12695
2020-06-09 05:35:38 +00:00
Cy Schubert
2ecd01c7c1 Silence the once per second CTRL-EVENT-SCAN-FAILED errors when the WiFi
radio is disabled through the communication device toggle key (also known
as the RF raidio kill button). Only the CTRL-EVENT-DISCONNECTED will be
issued.

Submitted by:	avg
Reported by:	avg
MFC after:	1 week
2020-05-20 04:16:13 +00:00
Cy Schubert
206b73d042 MFV r346563:
Update wpa 2.8 --> 2.9

hostapd:
* SAE changes
  - disable use of groups using Brainpool curves
  - improved protection against side channel attacks
  [https://w1.fi/security/2019-6/]
* EAP-pwd changes
  - disable use of groups using Brainpool curves
  - improved protection against side channel attacks
  [https://w1.fi/security/2019-6/]
* fixed FT-EAP initial mobility domain association using PMKSA caching
* added configuration of airtime policy
* fixed FILS to and RSNE into (Re)Association Response frames
* fixed DPP bootstrapping URI parser of channel list
* added support for regulatory WMM limitation (for ETSI)
* added support for MACsec Key Agreement using IEEE 802.1X/PSK
* added experimental support for EAP-TEAP server (RFC 7170)
* added experimental support for EAP-TLS server with TLS v1.3
* added support for two server certificates/keys (RSA/ECC)
* added AKMSuiteSelector into "STA <addr>" control interface data to
  determine with AKM was used for an association
* added eap_sim_id parameter to allow EAP-SIM/AKA server pseudonym and
  fast reauthentication use to be disabled
* fixed an ECDH operation corner case with OpenSSL

wpa_supplicant:
* SAE changes
  - disable use of groups using Brainpool curves
  - improved protection against side channel attacks
  [https://w1.fi/security/2019-6/]
* EAP-pwd changes
  - disable use of groups using Brainpool curves
  - allow the set of groups to be configured (eap_pwd_groups)
  - improved protection against side channel attacks
  [https://w1.fi/security/2019-6/]
* fixed FT-EAP initial mobility domain association using PMKSA caching
  (disabled by default for backwards compatibility; can be enabled
  with ft_eap_pmksa_caching=1)
* fixed a regression in OpenSSL 1.1+ engine loading
* added validation of RSNE in (Re)Association Response frames
* fixed DPP bootstrapping URI parser of channel list
* extended EAP-SIM/AKA fast re-authentication to allow use with FILS
* extended ca_cert_blob to support PEM format
* improved robustness of P2P Action frame scheduling
* added support for EAP-SIM/AKA using anonymous@realm identity
* fixed Hotspot 2.0 credential selection based on roaming consortium
  to ignore credentials without a specific EAP method
* added experimental support for EAP-TEAP peer (RFC 7170)
* added experimental support for EAP-TLS peer with TLS v1.3
* fixed a regression in WMM parameter configuration for a TDLS peer
* fixed a regression in operation with drivers that offload 802.1X
  4-way handshake
* fixed an ECDH operation corner case with OpenSSL

MFC after:	1 week
Security:	https://w1.fi/security/2019-6/\
		sae-eap-pwd-side-channel-attack-update.txt
2019-08-22 18:52:30 +00:00
Cy Schubert
e1c50020af The driver list prints "(null)" for the NDIS driver when -h (help) or
an unknown switch is passed outputting the command usage. This is
because the NDIS driver is uninitialized when usage help is printed.
To resolve this we initialize the driver prior to the possibility of
printing the usage help message.

Obtained from:	The wpa_supplicant port
MFC after:	1 week
2019-05-16 02:41:25 +00:00
Cy Schubert
4bc523382c MFV r346563:
Update wpa_supplicant/hostapd 2.7 --> 2.8

Upstream documents the following advisories:

- https://w1.fi/security/2019-1/sae-side-channel-attacks.txt
- https://w1.fi/security/2019-2/eap-pwd-side-channel-attack.txt
- https://w1.fi/security/2019-3/sae-confirm-missing-state-validation.txt
- https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt
- https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-\
  with-unexpected-fragment.txt

Relnotes:	yes
MFC after:	1 week (or less)
Security:	CVE-2019-9494, VU#871675, CVE-2019-9495, CVE-2019-9496,
		CVE-2019-9497, CVE-2019-9498, CVE-2019-9499
2019-04-23 03:52:43 +00:00
Cy Schubert
85732ac8bc MFV r341618:
Update wpa 2.6 --> 2.7.
2018-12-09 06:45:49 +00:00
Cy Schubert
cdba33f23c For CID 1394785, add a comment explaining that global->event_buf is
not really a char * but a struct rt_msghdr *.

MFC after:	3 days
2018-08-21 19:17:35 +00:00
Cy Schubert
0ec68024a0 MFV r337818:
WPA: Ignore unauthenticated encrypted EAPOL-Key data

Ignore unauthenticated encrypted EAPOL-Key data in supplicant
processing. When using WPA2, these are frames that have the Encrypted
flag set, but not the MIC flag.

When using WPA2, EAPOL-Key frames that had the Encrypted flag set but
not the MIC flag, had their data field decrypted without first verifying
the MIC. In case the data field was encrypted using RC4 (i.e., when
negotiating TKIP as the pairwise cipher), this meant that
unauthenticated but decrypted data would then be processed. An adversary
could abuse this as a decryption oracle to recover sensitive information
in the data field of EAPOL-Key messages (e.g., the group key).
(CVE-2018-14526)

Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>

Obtained from:  git://w1.fi/hostap.git
MFC after:      1 day
Security:       CVE-2018-14526
Security:       VuXML: 6bedc863-9fbe-11e8-945f-206a8a720317
2018-08-14 20:24:10 +00:00
Cy Schubert
dfbd3c8d91 Remove a redundant declaration.
While at it add a blank line, conforming with the convention
used in this file.

X-MFC-with:	r336203
2018-07-20 02:25:39 +00:00
Cy Schubert
64987377c2 To reduce our diff between our sources and our upline, sync up
with upline. Also making it easier to read.

Obtained from:	diffing base with ports
X-MFC-with:	r336203
2018-07-20 02:17:19 +00:00
Cy Schubert
e581761876 MFV: r336486
Prevent reinstallation of an already in-use group key.
Upline git commit cb5132bb35698cc0c743e34fe0e845dfc4c3e410.

Obtained from:	https://w1.fi/security/2017-1/\
		rebased-v2.6-0002-Prevent-reinstallation-\
		of-an-already-in-use-group-ke.patch
X-MFC-with:	r336203
2018-07-20 02:04:10 +00:00
Cy Schubert
84c260fb1b Revert r336501. It was a of the wrong rev from the vendor branch. 2018-07-20 01:53:28 +00:00
Cy Schubert
1b911983db MFV r336490:
Prevent installation of an all-zero TK.
This is also upline git commit 53bb18cc8b7a4da72e47e4b3752d0d2135cffb23.

Obtained from:	https://w1.fi/security/2017-1/\
		rebased-v2.6-0004-Prevent-installation-\
		of-an-all-zero-TK.patch
X-MFC-with:	r336203
2018-07-19 20:10:34 +00:00
Cy Schubert
e2b89ca9cb MFV: r336486
Prevent reinstallation of an already in-use group key.
Upline git commit cb5132bb35698cc0c743e34fe0e845dfc4c3e410.

Obtained from:	https://w1.fi/security/2017-1/\
		rebased-v2.6-0002-Prevent-reinstallation-\
		of-an-already-in-use-group-ke.patch
X-MFC-with:	r336203
2018-07-19 19:22:26 +00:00
Cy Schubert
8d6dfc9ece MFV: r336485
Address: hostapd: Avoid key reinstallation in FT handshake

Obtained from:	https://w1.fi/security/2017-1/\
		rebased-v2.6-0001-hostapd-Avoid-key-\
		reinstallation-in-FT-handshake.patch
X-MFC-with:	r336203
2018-07-19 19:04:30 +00:00
Cy Schubert
780fb4a2fa MFV r324714:
Update wpa 2.5 --> 2.6.

MFC after:	1 month
2018-07-11 18:53:18 +00:00
Hans Petter Selasky
5fd1ea0810 Re-apply r190640.
- Restore local change to include <net/bpf.h> inside pcap.h.
This fixes ports build problems.
- Update local copy of dlt.h with new DLT types.
- Revert no longer needed <net/bpf.h> includes which were added
as part of r334277.

Suggested by:	antoine@, delphij@, np@
MFC after:	3 weeks
Sponsored by:	Mellanox Technologies
2018-05-31 09:11:21 +00:00
Hans Petter Selasky
b00ab7548b MFV r333789: libpcap 1.9.0 (pre-release)
MFC after:	1 month
Sponsored by:	Mellanox Technologies
2018-05-28 08:12:18 +00:00
Gordon Tetlow
a2063804a2 Update wpa_supplicant/hostapd for 2017-01 vulnerability release.
hostapd: Avoid key reinstallation in FT handshake
Prevent reinstallation of an already in-use group key
Extend protection of GTK/IGTK reinstallation of WNM-Sleep Mode cases
Fix TK configuration to the driver in EAPOL-Key 3/4 retry case
Prevent installation of an all-zero TK
Fix PTK rekeying to generate a new ANonce
TDLS: Reject TPK-TK reconfiguration
WNM: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use
WNM: Ignore WNM-Sleep Mode Response if WNM-Sleep Mode has not been used
WNM: Ignore WNM-Sleep Mode Response without pending request
FT: Do not allow multiple Reassociation Response frames
TDLS: Ignore incoming TDLS Setup Response retries

Submitted by:	jhb
Obtained from:	https://w1.fi/security/2017-01/ (against later version)
Security:	FreeBSD-SA-17:07
Security:	CERT VU#228519
Security:	CVE-2017-13077
Security:	CVE-2017-13078
Security:	CVE-2017-13079
Security:	CVE-2017-13080
Security:	CVE-2017-13081
Security:	CVE-2017-13082
Security:	CVE-2017-13086
Security:	CVE-2017-13087
Security:	CVE-2017-13088
Differential Revision:	https://reviews.freebsd.org/D12693
2017-10-17 17:22:36 +00:00
Adrian Chadd
ce276fe26d [wpa] use IFM_IEEE80211_ADHOC for now on FreeBSD for IBSS operation.
PR:		bin/203086
Submitted by:	avos
2015-11-26 17:28:40 +00:00
Adrian Chadd
7424f50fa8 [wpa] bring up interface in ap_mode=2
This is required for WPA-NONE operation.

PR:		bin/203086
Submitted by:	avos@
2015-11-26 17:26:28 +00:00
Adrian Chadd
e1f2d1f39f [wpa] handle IBSS mediatype.
same as the previous commit to ifconfig - handle a mediatype of IBSS
without failing/complaining.

Internally inside wpa_s things treat IBSS/ADHOC as equivalent.
2015-11-26 02:00:37 +00:00
Rui Paulo
325151a32e Update hostapd/wpa_supplicant to version 2.5.
Tested by several people on current@/wireless@.

Relnotes:	yes
2015-10-18 21:38:25 +00:00
Rui Paulo
5b9c547c07 Merge wpa_supplicant/hostapd 2.4.
Major changes are: SAE, Suite B, RFC 7268, EAP-PKE, ACS, and tons of
bug fixes.

Relnotes:	yes
2015-04-21 01:45:11 +00:00
John-Mark Gurney
a061720cbb convert to using pidfile... This prevents multiple wpa_supplicants
running at the same time causing problems w/ wifi not working..

the patch will be submitted upstream...  The next step if someone wants
to push it upstream is to break os_unix.c up so that all these other
utilities don't need libutil..

Reviewed by:	rpaulo
2014-06-22 10:00:33 +00:00
Rui Paulo
6f51bc45db Enable all cryptocaps because net80211 can do software encryption.
MFC after:	1 week
2014-03-29 23:25:09 +00:00
Ed Maste
3901c6c9af Revert to upstream literal $FreeBSD tag
radiotap.h in upstream wpa originally came from the FreeBSD CVS
repository.  The copy in vendor/ matched the upstream one; with this
change the contrib copy now matches too.

Discussed with:	jhb@
2013-10-30 18:33:40 +00:00
Rui Paulo
bfd13d9679 Fix previous commit: both flags must be set. 2013-08-07 15:55:12 +00:00
Rui Paulo
e7b969bbee Make sure IFM_AVALID is also set when checking ifm_status.
Submitted by:	yongari
2013-08-07 04:03:30 +00:00
Rui Paulo
43673d4bfc Fix a timing issue with the wired driver.
After configuring the interface, wait for the link to become active.
Many ethernet drivers reset the chip when we set multicast filters
(causing significant delays due to link re-negotiation) and, by the time
we start sending packets, they are discared instead of going to the ether.

Tested by:	dumbbell
2013-08-07 01:01:58 +00:00
Hiren Panchasara
3eb0227259 Move to MSG_DEBUG to print it via syslog only when requested.
Reviewed by:	rpaulo, adrian
Approved by:	sbruno (mentor)
2013-07-08 16:03:18 +00:00
Rui Paulo
a61123749d Delete .gitignore files. 2013-07-04 23:05:28 +00:00
Rui Paulo
d4f2939c85 Restore the dbus directory that was not meant to be deleted in r252729. 2013-07-04 23:01:24 +00:00
Rui Paulo
521fc850a0 Remove unused files / directories. 2013-07-04 21:31:28 +00:00
Rui Paulo
f05cddf940 Merge hostapd / wpa_supplicant 2.0.
Reviewed by:	adrian (driver_bsd + usr.sbin/wpa)
2013-07-04 21:12:58 +00:00
Sergey Kandaurov
c222608952 Import change e4ac6417c7504e1c55ec556ce908974c04e29e3c from upstream wpa:
From: Guy Eilam <guy@wizery.com>
  Date: Mon, 21 Feb 2011 20:44:46 +0000 (+0200)
  Subject: utils: Corrected a typo in header's name definition

  utils: Corrected a typo in header's name definition

  Corrected a typo in the BASE64_H definition that
  might cause the header file to be included more than once.

  Signed-off-by: Guy Eilam <guy@wizery.com>

Submitted by:	<dt71@gmx.com>
MFC after:	3 days
2013-06-17 14:46:54 +00:00
Dimitry Andric
5f33039834 Import change 40eebf235370b6fe6353784ccf01ab92eed062a5 from upstream wpa:
From: Jouni Malinen <j@w1.fi>
  Date: Fri, 15 Jul 2011 13:42:06 +0300
  Subject: [PATCH] MD5: Fix clearing of temporary stack memory to use correct length

  sizeof of the structure instead of the pointer was supposed to be used
  here. Fix this to clear the full structure at the end of MD5Final().

Found by:	clang ToT
Reviewed by:	rpaulo
MFC after:	3 days
2013-02-16 12:52:40 +00:00
Colin Percival
43f13bea35 MFS security patches which seem to have accidentally not reached HEAD:
Fix insufficient message length validation for EAP-TLS messages.

Fix Linux compatibility layer input validation error.

Security:	FreeBSD-SA-12:07.hostapd
Security:	FreeBSD-SA-12:08.linux
Security:	CVE-2012-4445, CVE-2012-4576
With hat:	so@
2012-11-23 01:48:31 +00:00
Rui Paulo
b894cc9352 Remove unused files. 2010-11-03 10:46:39 +00:00
Rui Paulo
e28a4053b1 Merge wpa_supplicant and hostapd 0.7.3. 2010-11-03 10:43:38 +00:00
Rui Paulo
4f95cb6e9c Remove unused files. 2010-06-14 15:52:50 +00:00