1 |
commit: 319c86d1f048618da77824081843a43f049eadb5 |
2 |
Author: Zero_Chaos <zerochaos <AT> gentoo <DOT> org> |
3 |
AuthorDate: Mon Oct 16 13:35:32 2017 +0000 |
4 |
Commit: Richard Farina <zerochaos <AT> gentoo <DOT> org> |
5 |
CommitDate: Mon Oct 16 13:35:32 2017 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=319c86d1 |
7 |
|
8 |
net-wireless/wpa_supplicant: fix for KRACK (bug #634436) |
9 |
|
10 |
with bonus minor syntax fix |
11 |
|
12 |
Package-Manager: Portage-2.3.11, Repoman-2.3.3 |
13 |
|
14 |
...-Avoid-key-reinstallation-in-FT-handshake.patch | 174 +++++++++ |
15 |
...nstallation-of-an-already-in-use-group-ke.patch | 250 +++++++++++++ |
16 |
...ection-of-GTK-IGTK-reinstallation-of-WNM-.patch | 184 ++++++++++ |
17 |
...04-Prevent-installation-of-an-all-zero-TK.patch | 79 ++++ |
18 |
...Fix-PTK-rekeying-to-generate-a-new-ANonce.patch | 64 ++++ |
19 |
...6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch | 132 +++++++ |
20 |
...WNM-Sleep-Mode-Response-without-pending-r.patch | 43 +++ |
21 |
...llow-multiple-Reassociation-Response-fram.patch | 82 +++++ |
22 |
.../wpa_supplicant/wpa_supplicant-2.6-r3.ebuild | 397 +++++++++++++++++++++ |
23 |
9 files changed, 1405 insertions(+) |
24 |
|
25 |
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch |
26 |
new file mode 100644 |
27 |
index 00000000000..727684865db |
28 |
--- /dev/null |
29 |
+++ b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch |
30 |
@@ -0,0 +1,174 @@ |
31 |
+From cf4cab804c7afd5c45505528a8d16e46163243a2 Mon Sep 17 00:00:00 2001 |
32 |
+From: Mathy Vanhoef <Mathy.Vanhoef@×××××××××××.be> |
33 |
+Date: Fri, 14 Jul 2017 15:15:35 +0200 |
34 |
+Subject: [PATCH 1/8] hostapd: Avoid key reinstallation in FT handshake |
35 |
+ |
36 |
+Do not reinstall TK to the driver during Reassociation Response frame |
37 |
+processing if the first attempt of setting the TK succeeded. This avoids |
38 |
+issues related to clearing the TX/RX PN that could result in reusing |
39 |
+same PN values for transmitted frames (e.g., due to CCM nonce reuse and |
40 |
+also hitting replay protection on the receiver) and accepting replayed |
41 |
+frames on RX side. |
42 |
+ |
43 |
+This issue was introduced by the commit |
44 |
+0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in |
45 |
+authenticator') which allowed wpa_ft_install_ptk() to be called multiple |
46 |
+times with the same PTK. While the second configuration attempt is |
47 |
+needed with some drivers, it must be done only if the first attempt |
48 |
+failed. |
49 |
+ |
50 |
+Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@×××××××××××.be> |
51 |
+--- |
52 |
+ src/ap/ieee802_11.c | 16 +++++++++++++--- |
53 |
+ src/ap/wpa_auth.c | 11 +++++++++++ |
54 |
+ src/ap/wpa_auth.h | 3 ++- |
55 |
+ src/ap/wpa_auth_ft.c | 10 ++++++++++ |
56 |
+ src/ap/wpa_auth_i.h | 1 + |
57 |
+ 5 files changed, 37 insertions(+), 4 deletions(-) |
58 |
+ |
59 |
+diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c |
60 |
+index 4e04169..333035f 100644 |
61 |
+--- a/src/ap/ieee802_11.c |
62 |
++++ b/src/ap/ieee802_11.c |
63 |
+@@ -1841,6 +1841,7 @@ static int add_associated_sta(struct hostapd_data *hapd, |
64 |
+ { |
65 |
+ struct ieee80211_ht_capabilities ht_cap; |
66 |
+ struct ieee80211_vht_capabilities vht_cap; |
67 |
++ int set = 1; |
68 |
+ |
69 |
+ /* |
70 |
+ * Remove the STA entry to ensure the STA PS state gets cleared and |
71 |
+@@ -1848,9 +1849,18 @@ static int add_associated_sta(struct hostapd_data *hapd, |
72 |
+ * FT-over-the-DS, where a station re-associates back to the same AP but |
73 |
+ * skips the authentication flow, or if working with a driver that |
74 |
+ * does not support full AP client state. |
75 |
++ * |
76 |
++ * Skip this if the STA has already completed FT reassociation and the |
77 |
++ * TK has been configured since the TX/RX PN must not be reset to 0 for |
78 |
++ * the same key. |
79 |
+ */ |
80 |
+- if (!sta->added_unassoc) |
81 |
++ if (!sta->added_unassoc && |
82 |
++ (!(sta->flags & WLAN_STA_AUTHORIZED) || |
83 |
++ !wpa_auth_sta_ft_tk_already_set(sta->wpa_sm))) { |
84 |
+ hostapd_drv_sta_remove(hapd, sta->addr); |
85 |
++ wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED); |
86 |
++ set = 0; |
87 |
++ } |
88 |
+ |
89 |
+ #ifdef CONFIG_IEEE80211N |
90 |
+ if (sta->flags & WLAN_STA_HT) |
91 |
+@@ -1873,11 +1883,11 @@ static int add_associated_sta(struct hostapd_data *hapd, |
92 |
+ sta->flags & WLAN_STA_VHT ? &vht_cap : NULL, |
93 |
+ sta->flags | WLAN_STA_ASSOC, sta->qosinfo, |
94 |
+ sta->vht_opmode, sta->p2p_ie ? 1 : 0, |
95 |
+- sta->added_unassoc)) { |
96 |
++ set)) { |
97 |
+ hostapd_logger(hapd, sta->addr, |
98 |
+ HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE, |
99 |
+ "Could not %s STA to kernel driver", |
100 |
+- sta->added_unassoc ? "set" : "add"); |
101 |
++ set ? "set" : "add"); |
102 |
+ |
103 |
+ if (sta->added_unassoc) { |
104 |
+ hostapd_drv_sta_remove(hapd, sta->addr); |
105 |
+diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c |
106 |
+index 3587086..707971d 100644 |
107 |
+--- a/src/ap/wpa_auth.c |
108 |
++++ b/src/ap/wpa_auth.c |
109 |
+@@ -1745,6 +1745,9 @@ int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event) |
110 |
+ #else /* CONFIG_IEEE80211R */ |
111 |
+ break; |
112 |
+ #endif /* CONFIG_IEEE80211R */ |
113 |
++ case WPA_DRV_STA_REMOVED: |
114 |
++ sm->tk_already_set = FALSE; |
115 |
++ return 0; |
116 |
+ } |
117 |
+ |
118 |
+ #ifdef CONFIG_IEEE80211R |
119 |
+@@ -3250,6 +3253,14 @@ int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm) |
120 |
+ } |
121 |
+ |
122 |
+ |
123 |
++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm) |
124 |
++{ |
125 |
++ if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt)) |
126 |
++ return 0; |
127 |
++ return sm->tk_already_set; |
128 |
++} |
129 |
++ |
130 |
++ |
131 |
+ int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, |
132 |
+ struct rsn_pmksa_cache_entry *entry) |
133 |
+ { |
134 |
+diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h |
135 |
+index 0de8d97..97461b0 100644 |
136 |
+--- a/src/ap/wpa_auth.h |
137 |
++++ b/src/ap/wpa_auth.h |
138 |
+@@ -267,7 +267,7 @@ void wpa_receive(struct wpa_authenticator *wpa_auth, |
139 |
+ u8 *data, size_t data_len); |
140 |
+ enum wpa_event { |
141 |
+ WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH, |
142 |
+- WPA_REAUTH_EAPOL, WPA_ASSOC_FT |
143 |
++ WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_DRV_STA_REMOVED |
144 |
+ }; |
145 |
+ void wpa_remove_ptk(struct wpa_state_machine *sm); |
146 |
+ int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event); |
147 |
+@@ -280,6 +280,7 @@ int wpa_auth_pairwise_set(struct wpa_state_machine *sm); |
148 |
+ int wpa_auth_get_pairwise(struct wpa_state_machine *sm); |
149 |
+ int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm); |
150 |
+ int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm); |
151 |
++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm); |
152 |
+ int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, |
153 |
+ struct rsn_pmksa_cache_entry *entry); |
154 |
+ struct rsn_pmksa_cache_entry * |
155 |
+diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c |
156 |
+index 42242a5..e63b99a 100644 |
157 |
+--- a/src/ap/wpa_auth_ft.c |
158 |
++++ b/src/ap/wpa_auth_ft.c |
159 |
+@@ -780,6 +780,14 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) |
160 |
+ return; |
161 |
+ } |
162 |
+ |
163 |
++ if (sm->tk_already_set) { |
164 |
++ /* Must avoid TK reconfiguration to prevent clearing of TX/RX |
165 |
++ * PN in the driver */ |
166 |
++ wpa_printf(MSG_DEBUG, |
167 |
++ "FT: Do not re-install same PTK to the driver"); |
168 |
++ return; |
169 |
++ } |
170 |
++ |
171 |
+ /* FIX: add STA entry to kernel/driver here? The set_key will fail |
172 |
+ * most likely without this.. At the moment, STA entry is added only |
173 |
+ * after association has been completed. This function will be called |
174 |
+@@ -792,6 +800,7 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) |
175 |
+ |
176 |
+ /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */ |
177 |
+ sm->pairwise_set = TRUE; |
178 |
++ sm->tk_already_set = TRUE; |
179 |
+ } |
180 |
+ |
181 |
+ |
182 |
+@@ -898,6 +907,7 @@ static int wpa_ft_process_auth_req(struct wpa_state_machine *sm, |
183 |
+ |
184 |
+ sm->pairwise = pairwise; |
185 |
+ sm->PTK_valid = TRUE; |
186 |
++ sm->tk_already_set = FALSE; |
187 |
+ wpa_ft_install_ptk(sm); |
188 |
+ |
189 |
+ buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + |
190 |
+diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h |
191 |
+index 72b7eb3..7fd8f05 100644 |
192 |
+--- a/src/ap/wpa_auth_i.h |
193 |
++++ b/src/ap/wpa_auth_i.h |
194 |
+@@ -65,6 +65,7 @@ struct wpa_state_machine { |
195 |
+ struct wpa_ptk PTK; |
196 |
+ Boolean PTK_valid; |
197 |
+ Boolean pairwise_set; |
198 |
++ Boolean tk_already_set; |
199 |
+ int keycount; |
200 |
+ Boolean Pair; |
201 |
+ struct wpa_key_replay_counter { |
202 |
+-- |
203 |
+2.7.4 |
204 |
+ |
205 |
|
206 |
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch |
207 |
new file mode 100644 |
208 |
index 00000000000..1802d664add |
209 |
--- /dev/null |
210 |
+++ b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch |
211 |
@@ -0,0 +1,250 @@ |
212 |
+From 927f891007c402fefd1ff384645b3f07597c3ede Mon Sep 17 00:00:00 2001 |
213 |
+From: Mathy Vanhoef <Mathy.Vanhoef@×××××××××××.be> |
214 |
+Date: Wed, 12 Jul 2017 16:03:24 +0200 |
215 |
+Subject: [PATCH 2/8] Prevent reinstallation of an already in-use group key |
216 |
+ |
217 |
+Track the current GTK and IGTK that is in use and when receiving a |
218 |
+(possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do |
219 |
+not install the given key if it is already in use. This prevents an |
220 |
+attacker from trying to trick the client into resetting or lowering the |
221 |
+sequence counter associated to the group key. |
222 |
+ |
223 |
+Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@×××××××××××.be> |
224 |
+--- |
225 |
+ src/common/wpa_common.h | 11 +++++ |
226 |
+ src/rsn_supp/wpa.c | 116 ++++++++++++++++++++++++++++++------------------ |
227 |
+ src/rsn_supp/wpa_i.h | 4 ++ |
228 |
+ 3 files changed, 87 insertions(+), 44 deletions(-) |
229 |
+ |
230 |
+diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h |
231 |
+index af1d0f0..d200285 100644 |
232 |
+--- a/src/common/wpa_common.h |
233 |
++++ b/src/common/wpa_common.h |
234 |
+@@ -217,6 +217,17 @@ struct wpa_ptk { |
235 |
+ size_t tk_len; |
236 |
+ }; |
237 |
+ |
238 |
++struct wpa_gtk { |
239 |
++ u8 gtk[WPA_GTK_MAX_LEN]; |
240 |
++ size_t gtk_len; |
241 |
++}; |
242 |
++ |
243 |
++#ifdef CONFIG_IEEE80211W |
244 |
++struct wpa_igtk { |
245 |
++ u8 igtk[WPA_IGTK_MAX_LEN]; |
246 |
++ size_t igtk_len; |
247 |
++}; |
248 |
++#endif /* CONFIG_IEEE80211W */ |
249 |
+ |
250 |
+ /* WPA IE version 1 |
251 |
+ * 00-50-f2:1 (OUI:OUI type) |
252 |
+diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c |
253 |
+index 3c47879..95bd7be 100644 |
254 |
+--- a/src/rsn_supp/wpa.c |
255 |
++++ b/src/rsn_supp/wpa.c |
256 |
+@@ -714,6 +714,15 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, |
257 |
+ const u8 *_gtk = gd->gtk; |
258 |
+ u8 gtk_buf[32]; |
259 |
+ |
260 |
++ /* Detect possible key reinstallation */ |
261 |
++ if (sm->gtk.gtk_len == (size_t) gd->gtk_len && |
262 |
++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { |
263 |
++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, |
264 |
++ "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", |
265 |
++ gd->keyidx, gd->tx, gd->gtk_len); |
266 |
++ return 0; |
267 |
++ } |
268 |
++ |
269 |
+ wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len); |
270 |
+ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, |
271 |
+ "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)", |
272 |
+@@ -748,6 +757,9 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, |
273 |
+ } |
274 |
+ os_memset(gtk_buf, 0, sizeof(gtk_buf)); |
275 |
+ |
276 |
++ sm->gtk.gtk_len = gd->gtk_len; |
277 |
++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); |
278 |
++ |
279 |
+ return 0; |
280 |
+ } |
281 |
+ |
282 |
+@@ -854,6 +866,48 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, |
283 |
+ } |
284 |
+ |
285 |
+ |
286 |
++#ifdef CONFIG_IEEE80211W |
287 |
++static int wpa_supplicant_install_igtk(struct wpa_sm *sm, |
288 |
++ const struct wpa_igtk_kde *igtk) |
289 |
++{ |
290 |
++ size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); |
291 |
++ u16 keyidx = WPA_GET_LE16(igtk->keyid); |
292 |
++ |
293 |
++ /* Detect possible key reinstallation */ |
294 |
++ if (sm->igtk.igtk_len == len && |
295 |
++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { |
296 |
++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, |
297 |
++ "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", |
298 |
++ keyidx); |
299 |
++ return 0; |
300 |
++ } |
301 |
++ |
302 |
++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, |
303 |
++ "WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x", |
304 |
++ keyidx, MAC2STR(igtk->pn)); |
305 |
++ wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len); |
306 |
++ if (keyidx > 4095) { |
307 |
++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, |
308 |
++ "WPA: Invalid IGTK KeyID %d", keyidx); |
309 |
++ return -1; |
310 |
++ } |
311 |
++ if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), |
312 |
++ broadcast_ether_addr, |
313 |
++ keyidx, 0, igtk->pn, sizeof(igtk->pn), |
314 |
++ igtk->igtk, len) < 0) { |
315 |
++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, |
316 |
++ "WPA: Failed to configure IGTK to the driver"); |
317 |
++ return -1; |
318 |
++ } |
319 |
++ |
320 |
++ sm->igtk.igtk_len = len; |
321 |
++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); |
322 |
++ |
323 |
++ return 0; |
324 |
++} |
325 |
++#endif /* CONFIG_IEEE80211W */ |
326 |
++ |
327 |
++ |
328 |
+ static int ieee80211w_set_keys(struct wpa_sm *sm, |
329 |
+ struct wpa_eapol_ie_parse *ie) |
330 |
+ { |
331 |
+@@ -864,30 +918,14 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, |
332 |
+ if (ie->igtk) { |
333 |
+ size_t len; |
334 |
+ const struct wpa_igtk_kde *igtk; |
335 |
+- u16 keyidx; |
336 |
++ |
337 |
+ len = wpa_cipher_key_len(sm->mgmt_group_cipher); |
338 |
+ if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len) |
339 |
+ return -1; |
340 |
++ |
341 |
+ igtk = (const struct wpa_igtk_kde *) ie->igtk; |
342 |
+- keyidx = WPA_GET_LE16(igtk->keyid); |
343 |
+- wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d " |
344 |
+- "pn %02x%02x%02x%02x%02x%02x", |
345 |
+- keyidx, MAC2STR(igtk->pn)); |
346 |
+- wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", |
347 |
+- igtk->igtk, len); |
348 |
+- if (keyidx > 4095) { |
349 |
+- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, |
350 |
+- "WPA: Invalid IGTK KeyID %d", keyidx); |
351 |
+- return -1; |
352 |
+- } |
353 |
+- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), |
354 |
+- broadcast_ether_addr, |
355 |
+- keyidx, 0, igtk->pn, sizeof(igtk->pn), |
356 |
+- igtk->igtk, len) < 0) { |
357 |
+- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, |
358 |
+- "WPA: Failed to configure IGTK to the driver"); |
359 |
++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) |
360 |
+ return -1; |
361 |
+- } |
362 |
+ } |
363 |
+ |
364 |
+ return 0; |
365 |
+@@ -2307,7 +2345,7 @@ void wpa_sm_deinit(struct wpa_sm *sm) |
366 |
+ */ |
367 |
+ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) |
368 |
+ { |
369 |
+- int clear_ptk = 1; |
370 |
++ int clear_keys = 1; |
371 |
+ |
372 |
+ if (sm == NULL) |
373 |
+ return; |
374 |
+@@ -2333,11 +2371,11 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) |
375 |
+ /* Prepare for the next transition */ |
376 |
+ wpa_ft_prepare_auth_request(sm, NULL); |
377 |
+ |
378 |
+- clear_ptk = 0; |
379 |
++ clear_keys = 0; |
380 |
+ } |
381 |
+ #endif /* CONFIG_IEEE80211R */ |
382 |
+ |
383 |
+- if (clear_ptk) { |
384 |
++ if (clear_keys) { |
385 |
+ /* |
386 |
+ * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if |
387 |
+ * this is not part of a Fast BSS Transition. |
388 |
+@@ -2347,6 +2385,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) |
389 |
+ os_memset(&sm->ptk, 0, sizeof(sm->ptk)); |
390 |
+ sm->tptk_set = 0; |
391 |
+ os_memset(&sm->tptk, 0, sizeof(sm->tptk)); |
392 |
++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); |
393 |
++#ifdef CONFIG_IEEE80211W |
394 |
++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); |
395 |
++#endif /* CONFIG_IEEE80211W */ |
396 |
+ } |
397 |
+ |
398 |
+ #ifdef CONFIG_TDLS |
399 |
+@@ -2877,6 +2919,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) |
400 |
+ os_memset(sm->pmk, 0, sizeof(sm->pmk)); |
401 |
+ os_memset(&sm->ptk, 0, sizeof(sm->ptk)); |
402 |
+ os_memset(&sm->tptk, 0, sizeof(sm->tptk)); |
403 |
++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); |
404 |
++#ifdef CONFIG_IEEE80211W |
405 |
++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); |
406 |
++#endif /* CONFIG_IEEE80211W */ |
407 |
+ #ifdef CONFIG_IEEE80211R |
408 |
+ os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); |
409 |
+ os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0)); |
410 |
+@@ -2949,29 +2995,11 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) |
411 |
+ os_memset(&gd, 0, sizeof(gd)); |
412 |
+ #ifdef CONFIG_IEEE80211W |
413 |
+ } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) { |
414 |
+- struct wpa_igtk_kde igd; |
415 |
+- u16 keyidx; |
416 |
+- |
417 |
+- os_memset(&igd, 0, sizeof(igd)); |
418 |
+- keylen = wpa_cipher_key_len(sm->mgmt_group_cipher); |
419 |
+- os_memcpy(igd.keyid, buf + 2, 2); |
420 |
+- os_memcpy(igd.pn, buf + 4, 6); |
421 |
+- |
422 |
+- keyidx = WPA_GET_LE16(igd.keyid); |
423 |
+- os_memcpy(igd.igtk, buf + 10, keylen); |
424 |
+- |
425 |
+- wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)", |
426 |
+- igd.igtk, keylen); |
427 |
+- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), |
428 |
+- broadcast_ether_addr, |
429 |
+- keyidx, 0, igd.pn, sizeof(igd.pn), |
430 |
+- igd.igtk, keylen) < 0) { |
431 |
+- wpa_printf(MSG_DEBUG, "Failed to install the IGTK in " |
432 |
+- "WNM mode"); |
433 |
+- os_memset(&igd, 0, sizeof(igd)); |
434 |
++ const struct wpa_igtk_kde *igtk; |
435 |
++ |
436 |
++ igtk = (const struct wpa_igtk_kde *) (buf + 2); |
437 |
++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) |
438 |
+ return -1; |
439 |
+- } |
440 |
+- os_memset(&igd, 0, sizeof(igd)); |
441 |
+ #endif /* CONFIG_IEEE80211W */ |
442 |
+ } else { |
443 |
+ wpa_printf(MSG_DEBUG, "Unknown element id"); |
444 |
+diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h |
445 |
+index f653ba6..afc9e37 100644 |
446 |
+--- a/src/rsn_supp/wpa_i.h |
447 |
++++ b/src/rsn_supp/wpa_i.h |
448 |
+@@ -31,6 +31,10 @@ struct wpa_sm { |
449 |
+ u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN]; |
450 |
+ int rx_replay_counter_set; |
451 |
+ u8 request_counter[WPA_REPLAY_COUNTER_LEN]; |
452 |
++ struct wpa_gtk gtk; |
453 |
++#ifdef CONFIG_IEEE80211W |
454 |
++ struct wpa_igtk igtk; |
455 |
++#endif /* CONFIG_IEEE80211W */ |
456 |
+ |
457 |
+ struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ |
458 |
+ |
459 |
+-- |
460 |
+2.7.4 |
461 |
+ |
462 |
|
463 |
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch |
464 |
new file mode 100644 |
465 |
index 00000000000..e2937b851ad |
466 |
--- /dev/null |
467 |
+++ b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch |
468 |
@@ -0,0 +1,184 @@ |
469 |
+From 8280294e74846ea342389a0cd17215050fa5afe8 Mon Sep 17 00:00:00 2001 |
470 |
+From: Jouni Malinen <j@××.fi> |
471 |
+Date: Sun, 1 Oct 2017 12:12:24 +0300 |
472 |
+Subject: [PATCH 3/8] Extend protection of GTK/IGTK reinstallation of WNM-Sleep |
473 |
+ Mode cases |
474 |
+ |
475 |
+This extends the protection to track last configured GTK/IGTK value |
476 |
+separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a |
477 |
+corner case where these two different mechanisms may get used when the |
478 |
+GTK/IGTK has changed and tracking a single value is not sufficient to |
479 |
+detect a possible key reconfiguration. |
480 |
+ |
481 |
+Signed-off-by: Jouni Malinen <j@××.fi> |
482 |
+--- |
483 |
+ src/rsn_supp/wpa.c | 53 +++++++++++++++++++++++++++++++++++++--------------- |
484 |
+ src/rsn_supp/wpa_i.h | 2 ++ |
485 |
+ 2 files changed, 40 insertions(+), 15 deletions(-) |
486 |
+ |
487 |
+diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c |
488 |
+index 95bd7be..7a2c68d 100644 |
489 |
+--- a/src/rsn_supp/wpa.c |
490 |
++++ b/src/rsn_supp/wpa.c |
491 |
+@@ -709,14 +709,17 @@ struct wpa_gtk_data { |
492 |
+ |
493 |
+ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, |
494 |
+ const struct wpa_gtk_data *gd, |
495 |
+- const u8 *key_rsc) |
496 |
++ const u8 *key_rsc, int wnm_sleep) |
497 |
+ { |
498 |
+ const u8 *_gtk = gd->gtk; |
499 |
+ u8 gtk_buf[32]; |
500 |
+ |
501 |
+ /* Detect possible key reinstallation */ |
502 |
+- if (sm->gtk.gtk_len == (size_t) gd->gtk_len && |
503 |
+- os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { |
504 |
++ if ((sm->gtk.gtk_len == (size_t) gd->gtk_len && |
505 |
++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) || |
506 |
++ (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len && |
507 |
++ os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk, |
508 |
++ sm->gtk_wnm_sleep.gtk_len) == 0)) { |
509 |
+ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, |
510 |
+ "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", |
511 |
+ gd->keyidx, gd->tx, gd->gtk_len); |
512 |
+@@ -757,8 +760,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, |
513 |
+ } |
514 |
+ os_memset(gtk_buf, 0, sizeof(gtk_buf)); |
515 |
+ |
516 |
+- sm->gtk.gtk_len = gd->gtk_len; |
517 |
+- os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); |
518 |
++ if (wnm_sleep) { |
519 |
++ sm->gtk_wnm_sleep.gtk_len = gd->gtk_len; |
520 |
++ os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk, |
521 |
++ sm->gtk_wnm_sleep.gtk_len); |
522 |
++ } else { |
523 |
++ sm->gtk.gtk_len = gd->gtk_len; |
524 |
++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); |
525 |
++ } |
526 |
+ |
527 |
+ return 0; |
528 |
+ } |
529 |
+@@ -852,7 +861,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, |
530 |
+ (wpa_supplicant_check_group_cipher(sm, sm->group_cipher, |
531 |
+ gtk_len, gtk_len, |
532 |
+ &gd.key_rsc_len, &gd.alg) || |
533 |
+- wpa_supplicant_install_gtk(sm, &gd, key_rsc))) { |
534 |
++ wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) { |
535 |
+ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, |
536 |
+ "RSN: Failed to install GTK"); |
537 |
+ os_memset(&gd, 0, sizeof(gd)); |
538 |
+@@ -868,14 +877,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, |
539 |
+ |
540 |
+ #ifdef CONFIG_IEEE80211W |
541 |
+ static int wpa_supplicant_install_igtk(struct wpa_sm *sm, |
542 |
+- const struct wpa_igtk_kde *igtk) |
543 |
++ const struct wpa_igtk_kde *igtk, |
544 |
++ int wnm_sleep) |
545 |
+ { |
546 |
+ size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); |
547 |
+ u16 keyidx = WPA_GET_LE16(igtk->keyid); |
548 |
+ |
549 |
+ /* Detect possible key reinstallation */ |
550 |
+- if (sm->igtk.igtk_len == len && |
551 |
+- os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { |
552 |
++ if ((sm->igtk.igtk_len == len && |
553 |
++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) || |
554 |
++ (sm->igtk_wnm_sleep.igtk_len == len && |
555 |
++ os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk, |
556 |
++ sm->igtk_wnm_sleep.igtk_len) == 0)) { |
557 |
+ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, |
558 |
+ "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", |
559 |
+ keyidx); |
560 |
+@@ -900,8 +913,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm, |
561 |
+ return -1; |
562 |
+ } |
563 |
+ |
564 |
+- sm->igtk.igtk_len = len; |
565 |
+- os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); |
566 |
++ if (wnm_sleep) { |
567 |
++ sm->igtk_wnm_sleep.igtk_len = len; |
568 |
++ os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk, |
569 |
++ sm->igtk_wnm_sleep.igtk_len); |
570 |
++ } else { |
571 |
++ sm->igtk.igtk_len = len; |
572 |
++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); |
573 |
++ } |
574 |
+ |
575 |
+ return 0; |
576 |
+ } |
577 |
+@@ -924,7 +943,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, |
578 |
+ return -1; |
579 |
+ |
580 |
+ igtk = (const struct wpa_igtk_kde *) ie->igtk; |
581 |
+- if (wpa_supplicant_install_igtk(sm, igtk) < 0) |
582 |
++ if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0) |
583 |
+ return -1; |
584 |
+ } |
585 |
+ |
586 |
+@@ -1574,7 +1593,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm, |
587 |
+ if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc)) |
588 |
+ key_rsc = null_rsc; |
589 |
+ |
590 |
+- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) || |
591 |
++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) || |
592 |
+ wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0) |
593 |
+ goto failed; |
594 |
+ os_memset(&gd, 0, sizeof(gd)); |
595 |
+@@ -2386,8 +2405,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) |
596 |
+ sm->tptk_set = 0; |
597 |
+ os_memset(&sm->tptk, 0, sizeof(sm->tptk)); |
598 |
+ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); |
599 |
++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); |
600 |
+ #ifdef CONFIG_IEEE80211W |
601 |
+ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); |
602 |
++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); |
603 |
+ #endif /* CONFIG_IEEE80211W */ |
604 |
+ } |
605 |
+ |
606 |
+@@ -2920,8 +2941,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) |
607 |
+ os_memset(&sm->ptk, 0, sizeof(sm->ptk)); |
608 |
+ os_memset(&sm->tptk, 0, sizeof(sm->tptk)); |
609 |
+ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); |
610 |
++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); |
611 |
+ #ifdef CONFIG_IEEE80211W |
612 |
+ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); |
613 |
++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); |
614 |
+ #endif /* CONFIG_IEEE80211W */ |
615 |
+ #ifdef CONFIG_IEEE80211R |
616 |
+ os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); |
617 |
+@@ -2986,7 +3009,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) |
618 |
+ |
619 |
+ wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)", |
620 |
+ gd.gtk, gd.gtk_len); |
621 |
+- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) { |
622 |
++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) { |
623 |
+ os_memset(&gd, 0, sizeof(gd)); |
624 |
+ wpa_printf(MSG_DEBUG, "Failed to install the GTK in " |
625 |
+ "WNM mode"); |
626 |
+@@ -2998,7 +3021,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) |
627 |
+ const struct wpa_igtk_kde *igtk; |
628 |
+ |
629 |
+ igtk = (const struct wpa_igtk_kde *) (buf + 2); |
630 |
+- if (wpa_supplicant_install_igtk(sm, igtk) < 0) |
631 |
++ if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0) |
632 |
+ return -1; |
633 |
+ #endif /* CONFIG_IEEE80211W */ |
634 |
+ } else { |
635 |
+diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h |
636 |
+index afc9e37..9a54631 100644 |
637 |
+--- a/src/rsn_supp/wpa_i.h |
638 |
++++ b/src/rsn_supp/wpa_i.h |
639 |
+@@ -32,8 +32,10 @@ struct wpa_sm { |
640 |
+ int rx_replay_counter_set; |
641 |
+ u8 request_counter[WPA_REPLAY_COUNTER_LEN]; |
642 |
+ struct wpa_gtk gtk; |
643 |
++ struct wpa_gtk gtk_wnm_sleep; |
644 |
+ #ifdef CONFIG_IEEE80211W |
645 |
+ struct wpa_igtk igtk; |
646 |
++ struct wpa_igtk igtk_wnm_sleep; |
647 |
+ #endif /* CONFIG_IEEE80211W */ |
648 |
+ |
649 |
+ struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ |
650 |
+-- |
651 |
+2.7.4 |
652 |
+ |
653 |
|
654 |
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch |
655 |
new file mode 100644 |
656 |
index 00000000000..22ee217947d |
657 |
--- /dev/null |
658 |
+++ b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch |
659 |
@@ -0,0 +1,79 @@ |
660 |
+From 8f82bc94e8697a9d47fa8774dfdaaede1084912c Mon Sep 17 00:00:00 2001 |
661 |
+From: Mathy Vanhoef <Mathy.Vanhoef@×××××××××××.be> |
662 |
+Date: Fri, 29 Sep 2017 04:22:51 +0200 |
663 |
+Subject: [PATCH 4/8] Prevent installation of an all-zero TK |
664 |
+ |
665 |
+Properly track whether a PTK has already been installed to the driver |
666 |
+and the TK part cleared from memory. This prevents an attacker from |
667 |
+trying to trick the client into installing an all-zero TK. |
668 |
+ |
669 |
+This fixes the earlier fix in commit |
670 |
+ad00d64e7d8827b3cebd665a0ceb08adabf15e1e ('Fix TK configuration to the |
671 |
+driver in EAPOL-Key 3/4 retry case') which did not take into account |
672 |
+possibility of an extra message 1/4 showing up between retries of |
673 |
+message 3/4. |
674 |
+ |
675 |
+Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@×××××××××××.be> |
676 |
+--- |
677 |
+ src/common/wpa_common.h | 1 + |
678 |
+ src/rsn_supp/wpa.c | 5 ++--- |
679 |
+ src/rsn_supp/wpa_i.h | 1 - |
680 |
+ 3 files changed, 3 insertions(+), 4 deletions(-) |
681 |
+ |
682 |
+diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h |
683 |
+index d200285..1021ccb 100644 |
684 |
+--- a/src/common/wpa_common.h |
685 |
++++ b/src/common/wpa_common.h |
686 |
+@@ -215,6 +215,7 @@ struct wpa_ptk { |
687 |
+ size_t kck_len; |
688 |
+ size_t kek_len; |
689 |
+ size_t tk_len; |
690 |
++ int installed; /* 1 if key has already been installed to driver */ |
691 |
+ }; |
692 |
+ |
693 |
+ struct wpa_gtk { |
694 |
+diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c |
695 |
+index 7a2c68d..0550a41 100644 |
696 |
+--- a/src/rsn_supp/wpa.c |
697 |
++++ b/src/rsn_supp/wpa.c |
698 |
+@@ -510,7 +510,6 @@ static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm, |
699 |
+ os_memset(buf, 0, sizeof(buf)); |
700 |
+ } |
701 |
+ sm->tptk_set = 1; |
702 |
+- sm->tk_to_set = 1; |
703 |
+ |
704 |
+ kde = sm->assoc_wpa_ie; |
705 |
+ kde_len = sm->assoc_wpa_ie_len; |
706 |
+@@ -615,7 +614,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, |
707 |
+ enum wpa_alg alg; |
708 |
+ const u8 *key_rsc; |
709 |
+ |
710 |
+- if (!sm->tk_to_set) { |
711 |
++ if (sm->ptk.installed) { |
712 |
+ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, |
713 |
+ "WPA: Do not re-install same PTK to the driver"); |
714 |
+ return 0; |
715 |
+@@ -659,7 +658,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, |
716 |
+ |
717 |
+ /* TK is not needed anymore in supplicant */ |
718 |
+ os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN); |
719 |
+- sm->tk_to_set = 0; |
720 |
++ sm->ptk.installed = 1; |
721 |
+ |
722 |
+ if (sm->wpa_ptk_rekey) { |
723 |
+ eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL); |
724 |
+diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h |
725 |
+index 9a54631..41f371f 100644 |
726 |
+--- a/src/rsn_supp/wpa_i.h |
727 |
++++ b/src/rsn_supp/wpa_i.h |
728 |
+@@ -24,7 +24,6 @@ struct wpa_sm { |
729 |
+ struct wpa_ptk ptk, tptk; |
730 |
+ int ptk_set, tptk_set; |
731 |
+ unsigned int msg_3_of_4_ok:1; |
732 |
+- unsigned int tk_to_set:1; |
733 |
+ u8 snonce[WPA_NONCE_LEN]; |
734 |
+ u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */ |
735 |
+ int renew_snonce; |
736 |
+-- |
737 |
+2.7.4 |
738 |
+ |
739 |
|
740 |
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch |
741 |
new file mode 100644 |
742 |
index 00000000000..c19c4c71023 |
743 |
--- /dev/null |
744 |
+++ b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch |
745 |
@@ -0,0 +1,64 @@ |
746 |
+From 12fac09b437a1dc8a0f253e265934a8aaf4d2f8b Mon Sep 17 00:00:00 2001 |
747 |
+From: Jouni Malinen <j@××.fi> |
748 |
+Date: Sun, 1 Oct 2017 12:32:57 +0300 |
749 |
+Subject: [PATCH 5/8] Fix PTK rekeying to generate a new ANonce |
750 |
+ |
751 |
+The Authenticator state machine path for PTK rekeying ended up bypassing |
752 |
+the AUTHENTICATION2 state where a new ANonce is generated when going |
753 |
+directly to the PTKSTART state since there is no need to try to |
754 |
+determine the PMK again in such a case. This is far from ideal since the |
755 |
+new PTK would depend on a new nonce only from the supplicant. |
756 |
+ |
757 |
+Fix this by generating a new ANonce when moving to the PTKSTART state |
758 |
+for the purpose of starting new 4-way handshake to rekey PTK. |
759 |
+ |
760 |
+Signed-off-by: Jouni Malinen <j@××.fi> |
761 |
+--- |
762 |
+ src/ap/wpa_auth.c | 24 +++++++++++++++++++++--- |
763 |
+ 1 file changed, 21 insertions(+), 3 deletions(-) |
764 |
+ |
765 |
+diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c |
766 |
+index 707971d..bf10cc1 100644 |
767 |
+--- a/src/ap/wpa_auth.c |
768 |
++++ b/src/ap/wpa_auth.c |
769 |
+@@ -1901,6 +1901,21 @@ SM_STATE(WPA_PTK, AUTHENTICATION2) |
770 |
+ } |
771 |
+ |
772 |
+ |
773 |
++static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm) |
774 |
++{ |
775 |
++ if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { |
776 |
++ wpa_printf(MSG_ERROR, |
777 |
++ "WPA: Failed to get random data for ANonce"); |
778 |
++ sm->Disconnect = TRUE; |
779 |
++ return -1; |
780 |
++ } |
781 |
++ wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce, |
782 |
++ WPA_NONCE_LEN); |
783 |
++ sm->TimeoutCtr = 0; |
784 |
++ return 0; |
785 |
++} |
786 |
++ |
787 |
++ |
788 |
+ SM_STATE(WPA_PTK, INITPMK) |
789 |
+ { |
790 |
+ u8 msk[2 * PMK_LEN]; |
791 |
+@@ -2458,9 +2473,12 @@ SM_STEP(WPA_PTK) |
792 |
+ SM_ENTER(WPA_PTK, AUTHENTICATION); |
793 |
+ else if (sm->ReAuthenticationRequest) |
794 |
+ SM_ENTER(WPA_PTK, AUTHENTICATION2); |
795 |
+- else if (sm->PTKRequest) |
796 |
+- SM_ENTER(WPA_PTK, PTKSTART); |
797 |
+- else switch (sm->wpa_ptk_state) { |
798 |
++ else if (sm->PTKRequest) { |
799 |
++ if (wpa_auth_sm_ptk_update(sm) < 0) |
800 |
++ SM_ENTER(WPA_PTK, DISCONNECTED); |
801 |
++ else |
802 |
++ SM_ENTER(WPA_PTK, PTKSTART); |
803 |
++ } else switch (sm->wpa_ptk_state) { |
804 |
+ case WPA_PTK_INITIALIZE: |
805 |
+ break; |
806 |
+ case WPA_PTK_DISCONNECT: |
807 |
+-- |
808 |
+2.7.4 |
809 |
+ |
810 |
|
811 |
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch |
812 |
new file mode 100644 |
813 |
index 00000000000..e1bd5a57262 |
814 |
--- /dev/null |
815 |
+++ b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch |
816 |
@@ -0,0 +1,132 @@ |
817 |
+From 6c4bed4f47d1960ec04981a9d50e5076aea5223d Mon Sep 17 00:00:00 2001 |
818 |
+From: Jouni Malinen <j@××.fi> |
819 |
+Date: Fri, 22 Sep 2017 11:03:15 +0300 |
820 |
+Subject: [PATCH 6/8] TDLS: Reject TPK-TK reconfiguration |
821 |
+ |
822 |
+Do not try to reconfigure the same TPK-TK to the driver after it has |
823 |
+been successfully configured. This is an explicit check to avoid issues |
824 |
+related to resetting the TX/RX packet number. There was already a check |
825 |
+for this for TPK M2 (retries of that message are ignored completely), so |
826 |
+that behavior does not get modified. |
827 |
+ |
828 |
+For TPK M3, the TPK-TK could have been reconfigured, but that was |
829 |
+followed by immediate teardown of the link due to an issue in updating |
830 |
+the STA entry. Furthermore, for TDLS with any real security (i.e., |
831 |
+ignoring open/WEP), the TPK message exchange is protected on the AP path |
832 |
+and simple replay attacks are not feasible. |
833 |
+ |
834 |
+As an additional corner case, make sure the local nonce gets updated if |
835 |
+the peer uses a very unlikely "random nonce" of all zeros. |
836 |
+ |
837 |
+Signed-off-by: Jouni Malinen <j@××.fi> |
838 |
+--- |
839 |
+ src/rsn_supp/tdls.c | 38 ++++++++++++++++++++++++++++++++++++-- |
840 |
+ 1 file changed, 36 insertions(+), 2 deletions(-) |
841 |
+ |
842 |
+diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c |
843 |
+index e424168..9eb9738 100644 |
844 |
+--- a/src/rsn_supp/tdls.c |
845 |
++++ b/src/rsn_supp/tdls.c |
846 |
+@@ -112,6 +112,7 @@ struct wpa_tdls_peer { |
847 |
+ u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ |
848 |
+ } tpk; |
849 |
+ int tpk_set; |
850 |
++ int tk_set; /* TPK-TK configured to the driver */ |
851 |
+ int tpk_success; |
852 |
+ int tpk_in_progress; |
853 |
+ |
854 |
+@@ -192,6 +193,20 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) |
855 |
+ u8 rsc[6]; |
856 |
+ enum wpa_alg alg; |
857 |
+ |
858 |
++ if (peer->tk_set) { |
859 |
++ /* |
860 |
++ * This same TPK-TK has already been configured to the driver |
861 |
++ * and this new configuration attempt (likely due to an |
862 |
++ * unexpected retransmitted frame) would result in clearing |
863 |
++ * the TX/RX sequence number which can break security, so must |
864 |
++ * not allow that to happen. |
865 |
++ */ |
866 |
++ wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR |
867 |
++ " has already been configured to the driver - do not reconfigure", |
868 |
++ MAC2STR(peer->addr)); |
869 |
++ return -1; |
870 |
++ } |
871 |
++ |
872 |
+ os_memset(rsc, 0, 6); |
873 |
+ |
874 |
+ switch (peer->cipher) { |
875 |
+@@ -209,12 +224,15 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) |
876 |
+ return -1; |
877 |
+ } |
878 |
+ |
879 |
++ wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR, |
880 |
++ MAC2STR(peer->addr)); |
881 |
+ if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, |
882 |
+ rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { |
883 |
+ wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " |
884 |
+ "driver"); |
885 |
+ return -1; |
886 |
+ } |
887 |
++ peer->tk_set = 1; |
888 |
+ return 0; |
889 |
+ } |
890 |
+ |
891 |
+@@ -696,7 +714,7 @@ static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer) |
892 |
+ peer->cipher = 0; |
893 |
+ peer->qos_info = 0; |
894 |
+ peer->wmm_capable = 0; |
895 |
+- peer->tpk_set = peer->tpk_success = 0; |
896 |
++ peer->tk_set = peer->tpk_set = peer->tpk_success = 0; |
897 |
+ peer->chan_switch_enabled = 0; |
898 |
+ os_memset(&peer->tpk, 0, sizeof(peer->tpk)); |
899 |
+ os_memset(peer->inonce, 0, WPA_NONCE_LEN); |
900 |
+@@ -1159,6 +1177,7 @@ skip_rsnie: |
901 |
+ wpa_tdls_peer_free(sm, peer); |
902 |
+ return -1; |
903 |
+ } |
904 |
++ peer->tk_set = 0; /* A new nonce results in a new TK */ |
905 |
+ wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", |
906 |
+ peer->inonce, WPA_NONCE_LEN); |
907 |
+ os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); |
908 |
+@@ -1751,6 +1770,19 @@ static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer, |
909 |
+ } |
910 |
+ |
911 |
+ |
912 |
++static int tdls_nonce_set(const u8 *nonce) |
913 |
++{ |
914 |
++ int i; |
915 |
++ |
916 |
++ for (i = 0; i < WPA_NONCE_LEN; i++) { |
917 |
++ if (nonce[i]) |
918 |
++ return 1; |
919 |
++ } |
920 |
++ |
921 |
++ return 0; |
922 |
++} |
923 |
++ |
924 |
++ |
925 |
+ static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, |
926 |
+ const u8 *buf, size_t len) |
927 |
+ { |
928 |
+@@ -2004,7 +2036,8 @@ skip_rsn: |
929 |
+ peer->rsnie_i_len = kde.rsn_ie_len; |
930 |
+ peer->cipher = cipher; |
931 |
+ |
932 |
+- if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { |
933 |
++ if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 || |
934 |
++ !tdls_nonce_set(peer->inonce)) { |
935 |
+ /* |
936 |
+ * There is no point in updating the RNonce for every obtained |
937 |
+ * TPK M1 frame (e.g., retransmission due to timeout) with the |
938 |
+@@ -2020,6 +2053,7 @@ skip_rsn: |
939 |
+ "TDLS: Failed to get random data for responder nonce"); |
940 |
+ goto error; |
941 |
+ } |
942 |
++ peer->tk_set = 0; /* A new nonce results in a new TK */ |
943 |
+ } |
944 |
+ |
945 |
+ #if 0 |
946 |
+-- |
947 |
+2.7.4 |
948 |
+ |
949 |
|
950 |
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch |
951 |
new file mode 100644 |
952 |
index 00000000000..85ea1d62bcf |
953 |
--- /dev/null |
954 |
+++ b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch |
955 |
@@ -0,0 +1,43 @@ |
956 |
+From 53c5eb58e95004f86e65ee9fbfccbc291b139057 Mon Sep 17 00:00:00 2001 |
957 |
+From: Jouni Malinen <j@××.fi> |
958 |
+Date: Fri, 22 Sep 2017 11:25:02 +0300 |
959 |
+Subject: [PATCH 7/8] WNM: Ignore WNM-Sleep Mode Response without pending |
960 |
+ request |
961 |
+ |
962 |
+Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep |
963 |
+Mode Response if WNM-Sleep Mode has not been used') started ignoring the |
964 |
+response when no WNM-Sleep Mode Request had been used during the |
965 |
+association. This can be made tighter by clearing the used flag when |
966 |
+successfully processing a response. This adds an additional layer of |
967 |
+protection against unexpected retransmissions of the response frame. |
968 |
+ |
969 |
+Signed-off-by: Jouni Malinen <j@××.fi> |
970 |
+--- |
971 |
+ wpa_supplicant/wnm_sta.c | 4 +++- |
972 |
+ 1 file changed, 3 insertions(+), 1 deletion(-) |
973 |
+ |
974 |
+diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c |
975 |
+index 1b3409c..67a07ff 100644 |
976 |
+--- a/wpa_supplicant/wnm_sta.c |
977 |
++++ b/wpa_supplicant/wnm_sta.c |
978 |
+@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, |
979 |
+ |
980 |
+ if (!wpa_s->wnmsleep_used) { |
981 |
+ wpa_printf(MSG_DEBUG, |
982 |
+- "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association"); |
983 |
++ "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested"); |
984 |
+ return; |
985 |
+ } |
986 |
+ |
987 |
+@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, |
988 |
+ return; |
989 |
+ } |
990 |
+ |
991 |
++ wpa_s->wnmsleep_used = 0; |
992 |
++ |
993 |
+ if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT || |
994 |
+ wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) { |
995 |
+ wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response " |
996 |
+-- |
997 |
+2.7.4 |
998 |
+ |
999 |
|
1000 |
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch |
1001 |
new file mode 100644 |
1002 |
index 00000000000..b9678f6815a |
1003 |
--- /dev/null |
1004 |
+++ b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch |
1005 |
@@ -0,0 +1,82 @@ |
1006 |
+From b372ab0b7daea719749194dc554b26e6367603f2 Mon Sep 17 00:00:00 2001 |
1007 |
+From: Jouni Malinen <j@××.fi> |
1008 |
+Date: Fri, 22 Sep 2017 12:06:37 +0300 |
1009 |
+Subject: [PATCH 8/8] FT: Do not allow multiple Reassociation Response frames |
1010 |
+ |
1011 |
+The driver is expected to not report a second association event without |
1012 |
+the station having explicitly request a new association. As such, this |
1013 |
+case should not be reachable. However, since reconfiguring the same |
1014 |
+pairwise or group keys to the driver could result in nonce reuse issues, |
1015 |
+be extra careful here and do an additional state check to avoid this |
1016 |
+even if the local driver ends up somehow accepting an unexpected |
1017 |
+Reassociation Response frame. |
1018 |
+ |
1019 |
+Signed-off-by: Jouni Malinen <j@××.fi> |
1020 |
+--- |
1021 |
+ src/rsn_supp/wpa.c | 3 +++ |
1022 |
+ src/rsn_supp/wpa_ft.c | 8 ++++++++ |
1023 |
+ src/rsn_supp/wpa_i.h | 1 + |
1024 |
+ 3 files changed, 12 insertions(+) |
1025 |
+ |
1026 |
+diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c |
1027 |
+index 0550a41..2a53c6f 100644 |
1028 |
+--- a/src/rsn_supp/wpa.c |
1029 |
++++ b/src/rsn_supp/wpa.c |
1030 |
+@@ -2440,6 +2440,9 @@ void wpa_sm_notify_disassoc(struct wpa_sm *sm) |
1031 |
+ #ifdef CONFIG_TDLS |
1032 |
+ wpa_tdls_disassoc(sm); |
1033 |
+ #endif /* CONFIG_TDLS */ |
1034 |
++#ifdef CONFIG_IEEE80211R |
1035 |
++ sm->ft_reassoc_completed = 0; |
1036 |
++#endif /* CONFIG_IEEE80211R */ |
1037 |
+ |
1038 |
+ /* Keys are not needed in the WPA state machine anymore */ |
1039 |
+ wpa_sm_drop_sa(sm); |
1040 |
+diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c |
1041 |
+index 205793e..d45bb45 100644 |
1042 |
+--- a/src/rsn_supp/wpa_ft.c |
1043 |
++++ b/src/rsn_supp/wpa_ft.c |
1044 |
+@@ -153,6 +153,7 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len, |
1045 |
+ u16 capab; |
1046 |
+ |
1047 |
+ sm->ft_completed = 0; |
1048 |
++ sm->ft_reassoc_completed = 0; |
1049 |
+ |
1050 |
+ buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + |
1051 |
+ 2 + sm->r0kh_id_len + ric_ies_len + 100; |
1052 |
+@@ -681,6 +682,11 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, |
1053 |
+ return -1; |
1054 |
+ } |
1055 |
+ |
1056 |
++ if (sm->ft_reassoc_completed) { |
1057 |
++ wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission"); |
1058 |
++ return 0; |
1059 |
++ } |
1060 |
++ |
1061 |
+ if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) { |
1062 |
+ wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs"); |
1063 |
+ return -1; |
1064 |
+@@ -781,6 +787,8 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, |
1065 |
+ return -1; |
1066 |
+ } |
1067 |
+ |
1068 |
++ sm->ft_reassoc_completed = 1; |
1069 |
++ |
1070 |
+ if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0) |
1071 |
+ return -1; |
1072 |
+ |
1073 |
+diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h |
1074 |
+index 41f371f..56f88dc 100644 |
1075 |
+--- a/src/rsn_supp/wpa_i.h |
1076 |
++++ b/src/rsn_supp/wpa_i.h |
1077 |
+@@ -128,6 +128,7 @@ struct wpa_sm { |
1078 |
+ size_t r0kh_id_len; |
1079 |
+ u8 r1kh_id[FT_R1KH_ID_LEN]; |
1080 |
+ int ft_completed; |
1081 |
++ int ft_reassoc_completed; |
1082 |
+ int over_the_ds_in_progress; |
1083 |
+ u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */ |
1084 |
+ int set_ptk_after_assoc; |
1085 |
+-- |
1086 |
+2.7.4 |
1087 |
+ |
1088 |
|
1089 |
diff --git a/net-wireless/wpa_supplicant/wpa_supplicant-2.6-r3.ebuild b/net-wireless/wpa_supplicant/wpa_supplicant-2.6-r3.ebuild |
1090 |
new file mode 100644 |
1091 |
index 00000000000..51b710f07c6 |
1092 |
--- /dev/null |
1093 |
+++ b/net-wireless/wpa_supplicant/wpa_supplicant-2.6-r3.ebuild |
1094 |
@@ -0,0 +1,397 @@ |
1095 |
+# Copyright 1999-2017 Gentoo Foundation |
1096 |
+# Distributed under the terms of the GNU General Public License v2 |
1097 |
+ |
1098 |
+EAPI=6 |
1099 |
+ |
1100 |
+inherit eutils qmake-utils systemd toolchain-funcs |
1101 |
+ |
1102 |
+DESCRIPTION="IEEE 802.1X/WPA supplicant for secure wireless transfers" |
1103 |
+HOMEPAGE="http://hostap.epitest.fi/wpa_supplicant/" |
1104 |
+SRC_URI="http://hostap.epitest.fi/releases/${P}.tar.gz" |
1105 |
+LICENSE="|| ( GPL-2 BSD )" |
1106 |
+ |
1107 |
+SLOT="0" |
1108 |
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd" |
1109 |
+IUSE="ap dbus gnutls eap-sim fasteap +hs2-0 libressl p2p ps3 qt5 readline selinux smartcard ssl tdls uncommon-eap-types wimax wps kernel_linux kernel_FreeBSD" |
1110 |
+REQUIRED_USE="fasteap? ( !ssl ) smartcard? ( ssl )" |
1111 |
+ |
1112 |
+CDEPEND="dbus? ( sys-apps/dbus ) |
1113 |
+ kernel_linux? ( |
1114 |
+ dev-libs/libnl:3 |
1115 |
+ net-wireless/crda |
1116 |
+ eap-sim? ( sys-apps/pcsc-lite ) |
1117 |
+ ) |
1118 |
+ !kernel_linux? ( net-libs/libpcap ) |
1119 |
+ qt5? ( |
1120 |
+ dev-qt/qtcore:5 |
1121 |
+ dev-qt/qtgui:5 |
1122 |
+ dev-qt/qtsvg:5 |
1123 |
+ dev-qt/qtwidgets:5 |
1124 |
+ ) |
1125 |
+ readline? ( |
1126 |
+ sys-libs/ncurses:0= |
1127 |
+ sys-libs/readline:0= |
1128 |
+ ) |
1129 |
+ ssl? ( |
1130 |
+ gnutls? ( |
1131 |
+ dev-libs/libgcrypt:0= |
1132 |
+ net-libs/gnutls:= |
1133 |
+ ) |
1134 |
+ !gnutls? ( |
1135 |
+ !libressl? ( dev-libs/openssl:0= ) |
1136 |
+ libressl? ( dev-libs/libressl:0= ) |
1137 |
+ ) |
1138 |
+ ) |
1139 |
+ !ssl? ( dev-libs/libtommath ) |
1140 |
+" |
1141 |
+DEPEND="${CDEPEND} |
1142 |
+ virtual/pkgconfig |
1143 |
+" |
1144 |
+RDEPEND="${CDEPEND} |
1145 |
+ selinux? ( sec-policy/selinux-networkmanager ) |
1146 |
+" |
1147 |
+ |
1148 |
+S="${WORKDIR}/${P}/${PN}" |
1149 |
+ |
1150 |
+Kconfig_style_config() { |
1151 |
+ #param 1 is CONFIG_* item |
1152 |
+ #param 2 is what to set it = to, defaulting in y |
1153 |
+ CONFIG_PARAM="${CONFIG_HEADER:-CONFIG_}$1" |
1154 |
+ setting="${2:-y}" |
1155 |
+ |
1156 |
+ if [ ! $setting = n ]; then |
1157 |
+ #first remove any leading "# " if $2 is not n |
1158 |
+ sed -i "/^# *$CONFIG_PARAM=/s/^# *//" .config || echo "Kconfig_style_config error uncommenting $CONFIG_PARAM" |
1159 |
+ #set item = $setting (defaulting to y) |
1160 |
+ sed -i "/^$CONFIG_PARAM/s/=.*/=$setting/" .config || echo "Kconfig_style_config error setting $CONFIG_PARAM=$setting" |
1161 |
+ else |
1162 |
+ #ensure item commented out |
1163 |
+ sed -i "/^$CONFIG_PARAM/s/$CONFIG_PARAM/# $CONFIG_PARAM/" .config || echo "Kconfig_style_config error commenting $CONFIG_PARAM" |
1164 |
+ fi |
1165 |
+} |
1166 |
+ |
1167 |
+pkg_setup() { |
1168 |
+ if use ssl ; then |
1169 |
+ if use gnutls && use libressl ; then |
1170 |
+ elog "You have both 'gnutls' and 'libressl' USE flags enabled: defaulting to USE=\"gnutls\"" |
1171 |
+ fi |
1172 |
+ else |
1173 |
+ elog "You have 'ssl' USE flag disabled: defaulting to internal TLS implementation" |
1174 |
+ fi |
1175 |
+} |
1176 |
+ |
1177 |
+src_prepare() { |
1178 |
+ default |
1179 |
+ |
1180 |
+ # net/bpf.h needed for net-libs/libpcap on Gentoo/FreeBSD |
1181 |
+ sed -i \ |
1182 |
+ -e "s:\(#include <pcap\.h>\):#include <net/bpf.h>\n\1:" \ |
1183 |
+ ../src/l2_packet/l2_packet_freebsd.c || die |
1184 |
+ |
1185 |
+ # People seem to take the example configuration file too literally (bug #102361) |
1186 |
+ sed -i \ |
1187 |
+ -e "s:^\(opensc_engine_path\):#\1:" \ |
1188 |
+ -e "s:^\(pkcs11_engine_path\):#\1:" \ |
1189 |
+ -e "s:^\(pkcs11_module_path\):#\1:" \ |
1190 |
+ wpa_supplicant.conf || die |
1191 |
+ |
1192 |
+ # Change configuration to match Gentoo locations (bug #143750) |
1193 |
+ sed -i \ |
1194 |
+ -e "s:/usr/lib/opensc:/usr/$(get_libdir):" \ |
1195 |
+ -e "s:/usr/lib/pkcs11:/usr/$(get_libdir):" \ |
1196 |
+ wpa_supplicant.conf || die |
1197 |
+ |
1198 |
+ # systemd entries to D-Bus service files (bug #372877) |
1199 |
+ echo 'SystemdService=wpa_supplicant.service' \ |
1200 |
+ | tee -a dbus/*.service >/dev/null || die |
1201 |
+ |
1202 |
+ cd "${WORKDIR}/${P}" || die |
1203 |
+ |
1204 |
+ if use wimax; then |
1205 |
+ # generate-libeap-peer.patch comes before |
1206 |
+ # fix-undefined-reference-to-random_get_bytes.patch |
1207 |
+ eapply "${FILESDIR}/${P}-generate-libeap-peer.patch" |
1208 |
+ |
1209 |
+ # multilib-strict fix (bug #373685) |
1210 |
+ sed -e "s/\/usr\/lib/\/usr\/$(get_libdir)/" -i src/eap_peer/Makefile || die |
1211 |
+ fi |
1212 |
+ |
1213 |
+ # bug (320097) |
1214 |
+ eapply "${FILESDIR}/${P}-do-not-call-dbus-functions-with-NULL-path.patch" |
1215 |
+ |
1216 |
+ # bug (596332) |
1217 |
+ eapply "${FILESDIR}/${P}-libressl.patch" |
1218 |
+ |
1219 |
+ # https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt |
1220 |
+ eapply "${FILESDIR}/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch" |
1221 |
+ eapply "${FILESDIR}/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch" |
1222 |
+ eapply "${FILESDIR}/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch" |
1223 |
+ eapply "${FILESDIR}/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch" |
1224 |
+ eapply "${FILESDIR}/2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch" |
1225 |
+ eapply "${FILESDIR}/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch" |
1226 |
+ eapply "${FILESDIR}/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch" |
1227 |
+ eapply "${FILESDIR}/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch" |
1228 |
+} |
1229 |
+ |
1230 |
+src_configure() { |
1231 |
+ # Toolchain setup |
1232 |
+ tc-export CC |
1233 |
+ |
1234 |
+ cp defconfig .config || die |
1235 |
+ |
1236 |
+ # Basic setup |
1237 |
+ Kconfig_style_config CTRL_IFACE |
1238 |
+ Kconfig_style_config MATCH_IFACE |
1239 |
+ Kconfig_style_config BACKEND file |
1240 |
+ Kconfig_style_config IBSS_RSN |
1241 |
+ Kconfig_style_config IEEE80211W |
1242 |
+ Kconfig_style_config IEEE80211R |
1243 |
+ |
1244 |
+ # Basic authentication methods |
1245 |
+ # NOTE: we don't set GPSK or SAKE as they conflict |
1246 |
+ # with the below options |
1247 |
+ Kconfig_style_config EAP_GTC |
1248 |
+ Kconfig_style_config EAP_MD5 |
1249 |
+ Kconfig_style_config EAP_OTP |
1250 |
+ Kconfig_style_config EAP_PAX |
1251 |
+ Kconfig_style_config EAP_PSK |
1252 |
+ Kconfig_style_config EAP_TLV |
1253 |
+ Kconfig_style_config EAP_EXE |
1254 |
+ Kconfig_style_config IEEE8021X_EAPOL |
1255 |
+ Kconfig_style_config PKCS12 |
1256 |
+ Kconfig_style_config PEERKEY |
1257 |
+ Kconfig_style_config EAP_LEAP |
1258 |
+ Kconfig_style_config EAP_MSCHAPV2 |
1259 |
+ Kconfig_style_config EAP_PEAP |
1260 |
+ Kconfig_style_config EAP_TLS |
1261 |
+ Kconfig_style_config EAP_TTLS |
1262 |
+ |
1263 |
+ # Enabling background scanning. |
1264 |
+ Kconfig_style_config BGSCAN_SIMPLE |
1265 |
+ Kconfig_style_config BGSCAN_LEARN |
1266 |
+ |
1267 |
+ # Enabling mesh networks. |
1268 |
+ Kconfig_style_config MESH |
1269 |
+ |
1270 |
+ if use dbus ; then |
1271 |
+ Kconfig_style_config CTRL_IFACE_DBUS |
1272 |
+ Kconfig_style_config CTRL_IFACE_DBUS_NEW |
1273 |
+ Kconfig_style_config CTRL_IFACE_DBUS_INTRO |
1274 |
+ fi |
1275 |
+ |
1276 |
+ # Enable support for writing debug info to a log file and syslog. |
1277 |
+ Kconfig_style_config DEBUG_FILE |
1278 |
+ Kconfig_style_config DEBUG_SYSLOG |
1279 |
+ |
1280 |
+ if use hs2-0 ; then |
1281 |
+ Kconfig_style_config INTERWORKING |
1282 |
+ Kconfig_style_config HS20 |
1283 |
+ fi |
1284 |
+ |
1285 |
+ if use uncommon-eap-types; then |
1286 |
+ Kconfig_style_config EAP_GPSK |
1287 |
+ Kconfig_style_config EAP_SAKE |
1288 |
+ Kconfig_style_config EAP_GPSK_SHA256 |
1289 |
+ Kconfig_style_config EAP_IKEV2 |
1290 |
+ Kconfig_style_config EAP_EKE |
1291 |
+ fi |
1292 |
+ |
1293 |
+ if use eap-sim ; then |
1294 |
+ # Smart card authentication |
1295 |
+ Kconfig_style_config EAP_SIM |
1296 |
+ Kconfig_style_config EAP_AKA |
1297 |
+ Kconfig_style_config EAP_AKA_PRIME |
1298 |
+ Kconfig_style_config PCSC |
1299 |
+ fi |
1300 |
+ |
1301 |
+ if use fasteap ; then |
1302 |
+ Kconfig_style_config EAP_FAST |
1303 |
+ fi |
1304 |
+ |
1305 |
+ if use readline ; then |
1306 |
+ # readline/history support for wpa_cli |
1307 |
+ Kconfig_style_config READLINE |
1308 |
+ else |
1309 |
+ #internal line edit mode for wpa_cli |
1310 |
+ Kconfig_style_config WPA_CLI_EDIT |
1311 |
+ fi |
1312 |
+ |
1313 |
+ # SSL authentication methods |
1314 |
+ if use ssl ; then |
1315 |
+ if use gnutls ; then |
1316 |
+ Kconfig_style_config TLS gnutls |
1317 |
+ Kconfig_style_config GNUTLS_EXTRA |
1318 |
+ else |
1319 |
+ Kconfig_style_config TLS openssl |
1320 |
+ fi |
1321 |
+ else |
1322 |
+ Kconfig_style_config TLS internal |
1323 |
+ fi |
1324 |
+ |
1325 |
+ if use smartcard ; then |
1326 |
+ Kconfig_style_config SMARTCARD |
1327 |
+ fi |
1328 |
+ |
1329 |
+ if use tdls ; then |
1330 |
+ Kconfig_style_config TDLS |
1331 |
+ fi |
1332 |
+ |
1333 |
+ if use kernel_linux ; then |
1334 |
+ # Linux specific drivers |
1335 |
+ Kconfig_style_config DRIVER_ATMEL |
1336 |
+ Kconfig_style_config DRIVER_HOSTAP |
1337 |
+ Kconfig_style_config DRIVER_IPW |
1338 |
+ Kconfig_style_config DRIVER_NL80211 |
1339 |
+ Kconfig_style_config DRIVER_RALINK |
1340 |
+ Kconfig_style_config DRIVER_WEXT |
1341 |
+ Kconfig_style_config DRIVER_WIRED |
1342 |
+ |
1343 |
+ if use ps3 ; then |
1344 |
+ Kconfig_style_config DRIVER_PS3 |
1345 |
+ fi |
1346 |
+ |
1347 |
+ elif use kernel_FreeBSD ; then |
1348 |
+ # FreeBSD specific driver |
1349 |
+ Kconfig_style_config DRIVER_BSD |
1350 |
+ fi |
1351 |
+ |
1352 |
+ # Wi-Fi Protected Setup (WPS) |
1353 |
+ if use wps ; then |
1354 |
+ Kconfig_style_config WPS |
1355 |
+ Kconfig_style_config WPS2 |
1356 |
+ # USB Flash Drive |
1357 |
+ Kconfig_style_config WPS_UFD |
1358 |
+ # External Registrar |
1359 |
+ Kconfig_style_config WPS_ER |
1360 |
+ # Universal Plug'n'Play |
1361 |
+ Kconfig_style_config WPS_UPNP |
1362 |
+ # Near Field Communication |
1363 |
+ Kconfig_style_config WPS_NFC |
1364 |
+ fi |
1365 |
+ |
1366 |
+ # Wi-Fi Direct (WiDi) |
1367 |
+ if use p2p ; then |
1368 |
+ Kconfig_style_config P2P |
1369 |
+ Kconfig_style_config WIFI_DISPLAY |
1370 |
+ fi |
1371 |
+ |
1372 |
+ # Access Point Mode |
1373 |
+ if use ap ; then |
1374 |
+ Kconfig_style_config AP |
1375 |
+ fi |
1376 |
+ |
1377 |
+ # Enable mitigation against certain attacks against TKIP |
1378 |
+ Kconfig_style_config DELAYED_MIC_ERROR_REPORT |
1379 |
+ |
1380 |
+ # If we are using libnl 2.0 and above, enable support for it |
1381 |
+ # Bug 382159 |
1382 |
+ # Removed for now, since the 3.2 version is broken, and we don't |
1383 |
+ # support it. |
1384 |
+ if has_version ">=dev-libs/libnl-3.2"; then |
1385 |
+ Kconfig_style_config LIBNL32 |
1386 |
+ fi |
1387 |
+ |
1388 |
+ if use qt5 ; then |
1389 |
+ pushd "${S}"/wpa_gui-qt4 > /dev/null || die |
1390 |
+ eqmake5 wpa_gui.pro |
1391 |
+ popd > /dev/null || die |
1392 |
+ fi |
1393 |
+} |
1394 |
+ |
1395 |
+src_compile() { |
1396 |
+ einfo "Building wpa_supplicant" |
1397 |
+ emake V=1 BINDIR=/usr/sbin |
1398 |
+ |
1399 |
+ if use wimax; then |
1400 |
+ emake -C ../src/eap_peer clean |
1401 |
+ emake -C ../src/eap_peer |
1402 |
+ fi |
1403 |
+ |
1404 |
+ if use qt5; then |
1405 |
+ einfo "Building wpa_gui" |
1406 |
+ emake -C "${S}"/wpa_gui-qt4 |
1407 |
+ fi |
1408 |
+} |
1409 |
+ |
1410 |
+src_install() { |
1411 |
+ dosbin wpa_supplicant |
1412 |
+ dobin wpa_cli wpa_passphrase |
1413 |
+ |
1414 |
+ # baselayout-1 compat |
1415 |
+ if has_version "<sys-apps/baselayout-2.0.0"; then |
1416 |
+ dodir /sbin |
1417 |
+ dosym ../usr/sbin/wpa_supplicant /sbin/wpa_supplicant |
1418 |
+ dodir /bin |
1419 |
+ dosym ../usr/bin/wpa_cli /bin/wpa_cli |
1420 |
+ fi |
1421 |
+ |
1422 |
+ if has_version ">=sys-apps/openrc-0.5.0"; then |
1423 |
+ newinitd "${FILESDIR}/${PN}-init.d" wpa_supplicant |
1424 |
+ newconfd "${FILESDIR}/${PN}-conf.d" wpa_supplicant |
1425 |
+ fi |
1426 |
+ |
1427 |
+ exeinto /etc/wpa_supplicant/ |
1428 |
+ newexe "${FILESDIR}/wpa_cli.sh" wpa_cli.sh |
1429 |
+ |
1430 |
+ dodoc ChangeLog {eap_testing,todo}.txt README{,-WPS} \ |
1431 |
+ wpa_supplicant.conf |
1432 |
+ |
1433 |
+ newdoc .config build-config |
1434 |
+ |
1435 |
+ doman doc/docbook/*.{5,8} |
1436 |
+ |
1437 |
+ if use qt5 ; then |
1438 |
+ into /usr |
1439 |
+ dobin wpa_gui-qt4/wpa_gui |
1440 |
+ doicon wpa_gui-qt4/icons/wpa_gui.svg |
1441 |
+ make_desktop_entry wpa_gui "WPA Supplicant Administration GUI" "wpa_gui" "Qt;Network;" |
1442 |
+ fi |
1443 |
+ |
1444 |
+ use wimax && emake DESTDIR="${D}" -C ../src/eap_peer install |
1445 |
+ |
1446 |
+ if use dbus ; then |
1447 |
+ pushd "${S}"/dbus > /dev/null || die |
1448 |
+ insinto /etc/dbus-1/system.d |
1449 |
+ newins dbus-wpa_supplicant.conf wpa_supplicant.conf |
1450 |
+ insinto /usr/share/dbus-1/system-services |
1451 |
+ doins fi.epitest.hostap.WPASupplicant.service fi.w1.wpa_supplicant1.service |
1452 |
+ popd > /dev/null || die |
1453 |
+ |
1454 |
+ # This unit relies on dbus support, bug 538600. |
1455 |
+ systemd_dounit systemd/wpa_supplicant.service |
1456 |
+ fi |
1457 |
+ |
1458 |
+ systemd_dounit "systemd/wpa_supplicant@.service" |
1459 |
+ systemd_dounit "systemd/wpa_supplicant-nl80211@.service" |
1460 |
+ systemd_dounit "systemd/wpa_supplicant-wired@.service" |
1461 |
+} |
1462 |
+ |
1463 |
+pkg_postinst() { |
1464 |
+ elog "If this is a clean installation of wpa_supplicant, you" |
1465 |
+ elog "have to create a configuration file named" |
1466 |
+ elog "${EROOT%/}/etc/wpa_supplicant/wpa_supplicant.conf" |
1467 |
+ elog |
1468 |
+ elog "An example configuration file is available for reference in" |
1469 |
+ elog "${EROOT%/}/usr/share/doc/${PF}/" |
1470 |
+ |
1471 |
+ if [[ -e "${EROOT%/}"/etc/wpa_supplicant.conf ]] ; then |
1472 |
+ echo |
1473 |
+ ewarn "WARNING: your old configuration file ${EROOT%/}/etc/wpa_supplicant.conf" |
1474 |
+ ewarn "needs to be moved to ${EROOT%/}/etc/wpa_supplicant/wpa_supplicant.conf" |
1475 |
+ fi |
1476 |
+ |
1477 |
+ # Mea culpa, feel free to remove that after some time --mgorny. |
1478 |
+ local fn |
1479 |
+ for fn in wpa_supplicant{,@wlan0}.service; do |
1480 |
+ if [[ -e "${EROOT%/}"/etc/systemd/system/network.target.wants/${fn} ]] |
1481 |
+ then |
1482 |
+ ebegin "Moving ${fn} to multi-user.target" |
1483 |
+ mv "${EROOT%/}"/etc/systemd/system/network.target.wants/${fn} \ |
1484 |
+ "${EROOT%/}"/etc/systemd/system/multi-user.target.wants/ || die |
1485 |
+ eend ${?} \ |
1486 |
+ "Please try to re-enable ${fn}" |
1487 |
+ fi |
1488 |
+ done |
1489 |
+ |
1490 |
+ systemd_reenable wpa_supplicant.service |
1491 |
+} |