1 |
commit: b8c17aa77fa1271caf2d881c92e36cc121578b94 |
2 |
Author: Alarig Le Lay <alarig <AT> swordarmor <DOT> fr> |
3 |
AuthorDate: Sat Sep 12 11:38:05 2020 +0000 |
4 |
Commit: Sam James <sam <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Sep 27 16:56:39 2020 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b8c17aa7 |
7 |
|
8 |
net-wireless/hostapd: fix CVE-2020-12695 |
9 |
|
10 |
Bug: https://bugs.gentoo.org/727542 |
11 |
Package-Manager: Portage-3.0.4, Repoman-3.0.1 |
12 |
Signed-off-by: Alarig Le Lay <alarig <AT> swordarmor.fr> |
13 |
Closes: https://github.com/gentoo/gentoo/pull/15990 |
14 |
Signed-off-by: Sam James <sam <AT> gentoo.org> |
15 |
|
16 |
...-not-allow-event-subscriptions-with-URLs-.patch | 150 +++++++++++++++++++++ |
17 |
...x-event-message-generation-using-a-long-U.patch | 59 ++++++++ |
18 |
...ndle-HTTP-initiation-failures-for-events-.patch | 47 +++++++ |
19 |
net-wireless/hostapd/hostapd-2.9-r1.ebuild | 2 +- |
20 |
...hostapd-2.9-r1.ebuild => hostapd-2.9-r3.ebuild} | 21 ++- |
21 |
5 files changed, 275 insertions(+), 4 deletions(-) |
22 |
|
23 |
diff --git a/net-wireless/hostapd/files/hostapd-2.9-0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch b/net-wireless/hostapd/files/hostapd-2.9-0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch |
24 |
new file mode 100644 |
25 |
index 00000000000..0aa8a5ea1de |
26 |
--- /dev/null |
27 |
+++ b/net-wireless/hostapd/files/hostapd-2.9-0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch |
28 |
@@ -0,0 +1,150 @@ |
29 |
+From 5b78c8f961f25f4dc22d6f2b77ddd06d712cec63 Mon Sep 17 00:00:00 2001 |
30 |
+From: Jouni Malinen <jouni@××××××××××.org> |
31 |
+Date: Wed, 3 Jun 2020 23:17:35 +0300 |
32 |
+Subject: [PATCH 1/3] WPS UPnP: Do not allow event subscriptions with URLs to |
33 |
+ other networks |
34 |
+ |
35 |
+The UPnP Device Architecture 2.0 specification errata ("UDA errata |
36 |
+16-04-2020.docx") addresses a problem with notifications being allowed |
37 |
+to go out to other domains by disallowing such cases. Do such filtering |
38 |
+for the notification callback URLs to avoid undesired connections to |
39 |
+external networks based on subscriptions that any device in the local |
40 |
+network could request when WPS support for external registrars is |
41 |
+enabled (the upnp_iface parameter in hostapd configuration). |
42 |
+ |
43 |
+Signed-off-by: Jouni Malinen <jouni@××××××××××.org> |
44 |
+--- |
45 |
+ src/wps/wps_er.c | 2 +- |
46 |
+ src/wps/wps_upnp.c | 38 ++++++++++++++++++++++++++++++++++++-- |
47 |
+ src/wps/wps_upnp_i.h | 3 ++- |
48 |
+ 3 files changed, 39 insertions(+), 4 deletions(-) |
49 |
+ |
50 |
+diff --git a/src/wps/wps_er.c b/src/wps/wps_er.c |
51 |
+index 6bded14327f8..31d2e50e4cff 100644 |
52 |
+--- a/src/wps/wps_er.c |
53 |
++++ b/src/wps/wps_er.c |
54 |
+@@ -1298,7 +1298,7 @@ wps_er_init(struct wps_context *wps, const char *ifname, const char *filter) |
55 |
+ "with %s", filter); |
56 |
+ } |
57 |
+ if (get_netif_info(er->ifname, &er->ip_addr, &er->ip_addr_text, |
58 |
+- er->mac_addr)) { |
59 |
++ NULL, er->mac_addr)) { |
60 |
+ wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address " |
61 |
+ "for %s. Does it have IP address?", er->ifname); |
62 |
+ wps_er_deinit(er, NULL, NULL); |
63 |
+diff --git a/src/wps/wps_upnp.c b/src/wps/wps_upnp.c |
64 |
+index 6e10e4bc0c3f..7d4b7439940e 100644 |
65 |
+--- a/src/wps/wps_upnp.c |
66 |
++++ b/src/wps/wps_upnp.c |
67 |
+@@ -303,6 +303,14 @@ static void subscr_addr_free_all(struct subscription *s) |
68 |
+ } |
69 |
+ |
70 |
+ |
71 |
++static int local_network_addr(struct upnp_wps_device_sm *sm, |
72 |
++ struct sockaddr_in *addr) |
73 |
++{ |
74 |
++ return (addr->sin_addr.s_addr & sm->netmask.s_addr) == |
75 |
++ (sm->ip_addr & sm->netmask.s_addr); |
76 |
++} |
77 |
++ |
78 |
++ |
79 |
+ /* subscr_addr_add_url -- add address(es) for one url to subscription */ |
80 |
+ static void subscr_addr_add_url(struct subscription *s, const char *url, |
81 |
+ size_t url_len) |
82 |
+@@ -381,6 +389,7 @@ static void subscr_addr_add_url(struct subscription *s, const char *url, |
83 |
+ |
84 |
+ for (rp = result; rp; rp = rp->ai_next) { |
85 |
+ struct subscr_addr *a; |
86 |
++ struct sockaddr_in *addr = (struct sockaddr_in *) rp->ai_addr; |
87 |
+ |
88 |
+ /* Limit no. of address to avoid denial of service attack */ |
89 |
+ if (dl_list_len(&s->addr_list) >= MAX_ADDR_PER_SUBSCRIPTION) { |
90 |
+@@ -389,6 +398,13 @@ static void subscr_addr_add_url(struct subscription *s, const char *url, |
91 |
+ break; |
92 |
+ } |
93 |
+ |
94 |
++ if (!local_network_addr(s->sm, addr)) { |
95 |
++ wpa_printf(MSG_INFO, |
96 |
++ "WPS UPnP: Ignore a delivery URL that points to another network %s", |
97 |
++ inet_ntoa(addr->sin_addr)); |
98 |
++ continue; |
99 |
++ } |
100 |
++ |
101 |
+ a = os_zalloc(sizeof(*a) + alloc_len); |
102 |
+ if (a == NULL) |
103 |
+ break; |
104 |
+@@ -890,11 +906,12 @@ static int eth_get(const char *device, u8 ea[ETH_ALEN]) |
105 |
+ * @net_if: Selected network interface name |
106 |
+ * @ip_addr: Buffer for returning IP address in network byte order |
107 |
+ * @ip_addr_text: Buffer for returning a pointer to allocated IP address text |
108 |
++ * @netmask: Buffer for returning netmask or %NULL if not needed |
109 |
+ * @mac: Buffer for returning MAC address |
110 |
+ * Returns: 0 on success, -1 on failure |
111 |
+ */ |
112 |
+ int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text, |
113 |
+- u8 mac[ETH_ALEN]) |
114 |
++ struct in_addr *netmask, u8 mac[ETH_ALEN]) |
115 |
+ { |
116 |
+ struct ifreq req; |
117 |
+ int sock = -1; |
118 |
+@@ -920,6 +937,19 @@ int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text, |
119 |
+ in_addr.s_addr = *ip_addr; |
120 |
+ os_snprintf(*ip_addr_text, 16, "%s", inet_ntoa(in_addr)); |
121 |
+ |
122 |
++ if (netmask) { |
123 |
++ os_memset(&req, 0, sizeof(req)); |
124 |
++ os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name)); |
125 |
++ if (ioctl(sock, SIOCGIFNETMASK, &req) < 0) { |
126 |
++ wpa_printf(MSG_ERROR, |
127 |
++ "WPS UPnP: SIOCGIFNETMASK failed: %d (%s)", |
128 |
++ errno, strerror(errno)); |
129 |
++ goto fail; |
130 |
++ } |
131 |
++ addr = (struct sockaddr_in *) &req.ifr_netmask; |
132 |
++ netmask->s_addr = addr->sin_addr.s_addr; |
133 |
++ } |
134 |
++ |
135 |
+ #ifdef __linux__ |
136 |
+ os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name)); |
137 |
+ if (ioctl(sock, SIOCGIFHWADDR, &req) < 0) { |
138 |
+@@ -1026,11 +1056,15 @@ static int upnp_wps_device_start(struct upnp_wps_device_sm *sm, char *net_if) |
139 |
+ |
140 |
+ /* Determine which IP and mac address we're using */ |
141 |
+ if (get_netif_info(net_if, &sm->ip_addr, &sm->ip_addr_text, |
142 |
+- sm->mac_addr)) { |
143 |
++ &sm->netmask, sm->mac_addr)) { |
144 |
+ wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address " |
145 |
+ "for %s. Does it have IP address?", net_if); |
146 |
+ goto fail; |
147 |
+ } |
148 |
++ wpa_printf(MSG_DEBUG, "WPS UPnP: Local IP address %s netmask %s hwaddr " |
149 |
++ MACSTR, |
150 |
++ sm->ip_addr_text, inet_ntoa(sm->netmask), |
151 |
++ MAC2STR(sm->mac_addr)); |
152 |
+ |
153 |
+ /* Listen for incoming TCP connections so that others |
154 |
+ * can fetch our "xml files" from us. |
155 |
+diff --git a/src/wps/wps_upnp_i.h b/src/wps/wps_upnp_i.h |
156 |
+index e87a93232df1..6ead7b4e9a30 100644 |
157 |
+--- a/src/wps/wps_upnp_i.h |
158 |
++++ b/src/wps/wps_upnp_i.h |
159 |
+@@ -128,6 +128,7 @@ struct upnp_wps_device_sm { |
160 |
+ u8 mac_addr[ETH_ALEN]; /* mac addr of network i.f. we use */ |
161 |
+ char *ip_addr_text; /* IP address of network i.f. we use */ |
162 |
+ unsigned ip_addr; /* IP address of network i.f. we use (host order) */ |
163 |
++ struct in_addr netmask; |
164 |
+ int multicast_sd; /* send multicast messages over this socket */ |
165 |
+ int ssdp_sd; /* receive discovery UPD packets on socket */ |
166 |
+ int ssdp_sd_registered; /* nonzero if we must unregister */ |
167 |
+@@ -158,7 +159,7 @@ struct subscription * subscription_find(struct upnp_wps_device_sm *sm, |
168 |
+ const u8 uuid[UUID_LEN]); |
169 |
+ void subscr_addr_delete(struct subscr_addr *a); |
170 |
+ int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text, |
171 |
+- u8 mac[ETH_ALEN]); |
172 |
++ struct in_addr *netmask, u8 mac[ETH_ALEN]); |
173 |
+ |
174 |
+ /* wps_upnp_ssdp.c */ |
175 |
+ void msearchreply_state_machine_stop(struct advertisement_state_machine *a); |
176 |
+-- |
177 |
+2.20.1 |
178 |
+ |
179 |
|
180 |
diff --git a/net-wireless/hostapd/files/hostapd-2.9-0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch b/net-wireless/hostapd/files/hostapd-2.9-0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch |
181 |
new file mode 100644 |
182 |
index 00000000000..c7a449e0b5c |
183 |
--- /dev/null |
184 |
+++ b/net-wireless/hostapd/files/hostapd-2.9-0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch |
185 |
@@ -0,0 +1,59 @@ |
186 |
+From f7d268864a2660b7239b9a8ff5ad37faeeb751ba Mon Sep 17 00:00:00 2001 |
187 |
+From: Jouni Malinen <jouni@××××××××××.org> |
188 |
+Date: Wed, 3 Jun 2020 22:41:02 +0300 |
189 |
+Subject: [PATCH 2/3] WPS UPnP: Fix event message generation using a long URL |
190 |
+ path |
191 |
+ |
192 |
+More than about 700 character URL ended up overflowing the wpabuf used |
193 |
+for building the event notification and this resulted in the wpabuf |
194 |
+buffer overflow checks terminating the hostapd process. Fix this by |
195 |
+allocating the buffer to be large enough to contain the full URL path. |
196 |
+However, since that around 700 character limit has been the practical |
197 |
+limit for more than ten years, start explicitly enforcing that as the |
198 |
+limit or the callback URLs since any longer ones had not worked before |
199 |
+and there is no need to enable them now either. |
200 |
+ |
201 |
+Signed-off-by: Jouni Malinen <jouni@××××××××××.org> |
202 |
+--- |
203 |
+ src/wps/wps_upnp.c | 9 +++++++-- |
204 |
+ src/wps/wps_upnp_event.c | 3 ++- |
205 |
+ 2 files changed, 9 insertions(+), 3 deletions(-) |
206 |
+ |
207 |
+diff --git a/src/wps/wps_upnp.c b/src/wps/wps_upnp.c |
208 |
+index 7d4b7439940e..ab685d52ecab 100644 |
209 |
+--- a/src/wps/wps_upnp.c |
210 |
++++ b/src/wps/wps_upnp.c |
211 |
+@@ -328,9 +328,14 @@ static void subscr_addr_add_url(struct subscription *s, const char *url, |
212 |
+ int rerr; |
213 |
+ size_t host_len, path_len; |
214 |
+ |
215 |
+- /* url MUST begin with http: */ |
216 |
+- if (url_len < 7 || os_strncasecmp(url, "http://", 7)) |
217 |
++ /* URL MUST begin with HTTP scheme. In addition, limit the length of |
218 |
++ * the URL to 700 characters which is around the limit that was |
219 |
++ * implicitly enforced for more than 10 years due to a bug in |
220 |
++ * generating the event messages. */ |
221 |
++ if (url_len < 7 || os_strncasecmp(url, "http://", 7) || url_len > 700) { |
222 |
++ wpa_printf(MSG_DEBUG, "WPS UPnP: Reject an unacceptable URL"); |
223 |
+ goto fail; |
224 |
++ } |
225 |
+ url += 7; |
226 |
+ url_len -= 7; |
227 |
+ |
228 |
+diff --git a/src/wps/wps_upnp_event.c b/src/wps/wps_upnp_event.c |
229 |
+index d7e6edcc6503..08a23612f338 100644 |
230 |
+--- a/src/wps/wps_upnp_event.c |
231 |
++++ b/src/wps/wps_upnp_event.c |
232 |
+@@ -147,7 +147,8 @@ static struct wpabuf * event_build_message(struct wps_event_ *e) |
233 |
+ struct wpabuf *buf; |
234 |
+ char *b; |
235 |
+ |
236 |
+- buf = wpabuf_alloc(1000 + wpabuf_len(e->data)); |
237 |
++ buf = wpabuf_alloc(1000 + os_strlen(e->addr->path) + |
238 |
++ wpabuf_len(e->data)); |
239 |
+ if (buf == NULL) |
240 |
+ return NULL; |
241 |
+ wpabuf_printf(buf, "NOTIFY %s HTTP/1.1\r\n", e->addr->path); |
242 |
+-- |
243 |
+2.20.1 |
244 |
+ |
245 |
|
246 |
diff --git a/net-wireless/hostapd/files/hostapd-2.9-0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch b/net-wireless/hostapd/files/hostapd-2.9-0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch |
247 |
new file mode 100644 |
248 |
index 00000000000..9d0376043d0 |
249 |
--- /dev/null |
250 |
+++ b/net-wireless/hostapd/files/hostapd-2.9-0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch |
251 |
@@ -0,0 +1,47 @@ |
252 |
+From 85aac526af8612c21b3117dadc8ef5944985b476 Mon Sep 17 00:00:00 2001 |
253 |
+From: Jouni Malinen <jouni@××××××××××.org> |
254 |
+Date: Thu, 4 Jun 2020 21:24:04 +0300 |
255 |
+Subject: [PATCH 3/3] WPS UPnP: Handle HTTP initiation failures for events more |
256 |
+ properly |
257 |
+ |
258 |
+While it is appropriate to try to retransmit the event to another |
259 |
+callback URL on a failure to initiate the HTTP client connection, there |
260 |
+is no point in trying the exact same operation multiple times in a row. |
261 |
+Replve the event_retry() calls with event_addr_failure() for these cases |
262 |
+to avoid busy loops trying to repeat the same failing operation. |
263 |
+ |
264 |
+These potential busy loops would go through eloop callbacks, so the |
265 |
+process is not completely stuck on handling them, but unnecessary CPU |
266 |
+would be used to process the continues retries that will keep failing |
267 |
+for the same reason. |
268 |
+ |
269 |
+Signed-off-by: Jouni Malinen <jouni@××××××××××.org> |
270 |
+--- |
271 |
+ src/wps/wps_upnp_event.c | 4 ++-- |
272 |
+ 1 file changed, 2 insertions(+), 2 deletions(-) |
273 |
+ |
274 |
+diff --git a/src/wps/wps_upnp_event.c b/src/wps/wps_upnp_event.c |
275 |
+index 08a23612f338..c0d9e41d9a38 100644 |
276 |
+--- a/src/wps/wps_upnp_event.c |
277 |
++++ b/src/wps/wps_upnp_event.c |
278 |
+@@ -294,7 +294,7 @@ static int event_send_start(struct subscription *s) |
279 |
+ |
280 |
+ buf = event_build_message(e); |
281 |
+ if (buf == NULL) { |
282 |
+- event_retry(e, 0); |
283 |
++ event_addr_failure(e); |
284 |
+ return -1; |
285 |
+ } |
286 |
+ |
287 |
+@@ -302,7 +302,7 @@ static int event_send_start(struct subscription *s) |
288 |
+ event_http_cb, e); |
289 |
+ if (e->http_event == NULL) { |
290 |
+ wpabuf_free(buf); |
291 |
+- event_retry(e, 0); |
292 |
++ event_addr_failure(e); |
293 |
+ return -1; |
294 |
+ } |
295 |
+ |
296 |
+-- |
297 |
+2.20.1 |
298 |
+ |
299 |
|
300 |
diff --git a/net-wireless/hostapd/hostapd-2.9-r1.ebuild b/net-wireless/hostapd/hostapd-2.9-r1.ebuild |
301 |
index a2fbc42dc16..379f8c74ea7 100644 |
302 |
--- a/net-wireless/hostapd/hostapd-2.9-r1.ebuild |
303 |
+++ b/net-wireless/hostapd/hostapd-2.9-r1.ebuild |
304 |
@@ -1,4 +1,4 @@ |
305 |
-# Copyright 1999-2019 Gentoo Authors |
306 |
+# Copyright 1999-2020 Gentoo Authors |
307 |
# Distributed under the terms of the GNU General Public License v2 |
308 |
|
309 |
EAPI="6" |
310 |
|
311 |
diff --git a/net-wireless/hostapd/hostapd-2.9-r1.ebuild b/net-wireless/hostapd/hostapd-2.9-r3.ebuild |
312 |
similarity index 89% |
313 |
copy from net-wireless/hostapd/hostapd-2.9-r1.ebuild |
314 |
copy to net-wireless/hostapd/hostapd-2.9-r3.ebuild |
315 |
index a2fbc42dc16..2fed1676ff6 100644 |
316 |
--- a/net-wireless/hostapd/hostapd-2.9-r1.ebuild |
317 |
+++ b/net-wireless/hostapd/hostapd-2.9-r3.ebuild |
318 |
@@ -1,4 +1,4 @@ |
319 |
-# Copyright 1999-2019 Gentoo Authors |
320 |
+# Copyright 1999-2020 Gentoo Authors |
321 |
# Distributed under the terms of the GNU General Public License v2 |
322 |
|
323 |
EAPI="6" |
324 |
@@ -21,12 +21,15 @@ else |
325 |
SRC_URI+=" https://w1.fi/releases/${P}.tar.gz" |
326 |
fi |
327 |
# Never stabilize snapshot ebuilds please |
328 |
- KEYWORDS="amd64 arm arm64 ~mips ppc x86" |
329 |
+ KEYWORDS="~amd64 ~arm ~arm64 ~mips ~ppc ~x86" |
330 |
fi |
331 |
|
332 |
LICENSE="BSD" |
333 |
SLOT="0" |
334 |
-IUSE="internal-tls ipv6 libressl logwatch netlink sqlite +wps +crda" |
335 |
+IUSE="internal-tls ipv6 libressl logwatch netlink sqlite +suiteb +wps +crda" |
336 |
+ |
337 |
+# suiteb impl uses openssl feature not available in libressl, see bug 710992 |
338 |
+REQUIRED_USE="?? ( libressl suiteb )" |
339 |
|
340 |
DEPEND=" |
341 |
libressl? ( dev-libs/libressl:0= ) |
342 |
@@ -70,6 +73,10 @@ src_prepare() { |
343 |
default |
344 |
#CVE-2019-16275 bug #696032 |
345 |
eapply "${FILESDIR}/hostapd-2.9-AP-Silently-ignore-management-frame-from-unexpected.patch" |
346 |
+ # CVE-2020-12695 bug #727542 |
347 |
+ eapply "${FILESDIR}/${P}-0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch" |
348 |
+ eapply "${FILESDIR}/${P}-0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch" |
349 |
+ eapply "${FILESDIR}/${P}-0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch" |
350 |
popd >/dev/null || die |
351 |
|
352 |
sed -i -e "s:/etc/hostapd:/etc/hostapd/hostapd:g" \ |
353 |
@@ -92,6 +99,14 @@ src_configure() { |
354 |
echo "CONFIG_EAP=y" >> ${CONFIG} |
355 |
echo "CONFIG_ERP=y" >> ${CONFIG} |
356 |
echo "CONFIG_EAP_MD5=y" >> ${CONFIG} |
357 |
+ echo "CONFIG_SAE=y" >> ${CONFIG} |
358 |
+ echo "CONFIG_OWE=y" >> ${CONFIG} |
359 |
+ echo "CONFIG_DPP=y" >> ${CONFIG} |
360 |
+ |
361 |
+ if use suiteb; then |
362 |
+ echo "CONFIG_SUITEB=y" >> ${CONFIG} |
363 |
+ echo "CONFIG_SUITEB192=y" >> ${CONFIG} |
364 |
+ fi |
365 |
|
366 |
if use internal-tls && ! use libressl; then |
367 |
echo "CONFIG_TLS=internal" >> ${CONFIG} |