1 |
commit: 26f3af490963324c8f66f25ec281645368eb163b |
2 |
Author: Bjarke Istrup Pedersen <gurligebis <AT> gentoo <DOT> org> |
3 |
AuthorDate: Tue Jun 28 08:37:57 2016 +0000 |
4 |
Commit: Bjarke Istrup Pedersen <gurligebis <AT> gentoo <DOT> org> |
5 |
CommitDate: Tue Jun 28 08:38:57 2016 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=26f3af49 |
7 |
|
8 |
net-wireless/wpa_supplicant: Bumping to 2.5-r2, adding several security fixes. |
9 |
|
10 |
Package-Manager: portage-2.3.0 |
11 |
|
12 |
...-peer-Fix-last-fragment-length-validation.patch | 54 +++ |
13 |
...erver-Fix-last-fragment-length-validation.patch | 51 +++ |
14 |
...r-Fix-error-path-for-unexpected-Confirm-m.patch | 34 ++ |
15 |
...ject-a-Credential-with-invalid-passphrase.patch | 82 +++++ |
16 |
...parameter-set-with-invalid-passphrase-cha.patch | 51 +++ |
17 |
...ines-from-wpa_supplicant-config-network-o.patch | 82 +++++ |
18 |
...CRED-commands-with-newline-characters-in-.patch | 62 ++++ |
19 |
...commands-with-newline-characters-in-the-s.patch | 50 +++ |
20 |
.../wpa_supplicant/wpa_supplicant-2.5-r2.ebuild | 408 +++++++++++++++++++++ |
21 |
9 files changed, 874 insertions(+) |
22 |
|
23 |
diff --git a/net-wireless/wpa_supplicant/files/2015-7/0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch b/net-wireless/wpa_supplicant/files/2015-7/0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch |
24 |
new file mode 100644 |
25 |
index 0000000..82c2639 |
26 |
--- /dev/null |
27 |
+++ b/net-wireless/wpa_supplicant/files/2015-7/0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch |
28 |
@@ -0,0 +1,54 @@ |
29 |
+From 8057821706784608b828e769ccefbced95591e50 Mon Sep 17 00:00:00 2001 |
30 |
+From: Jouni Malinen <j@××.fi> |
31 |
+Date: Sun, 1 Nov 2015 18:18:17 +0200 |
32 |
+Subject: [PATCH] EAP-pwd peer: Fix last fragment length validation |
33 |
+ |
34 |
+All but the last fragment had their length checked against the remaining |
35 |
+room in the reassembly buffer. This allowed a suitably constructed last |
36 |
+fragment frame to try to add extra data that would go beyond the buffer. |
37 |
+The length validation code in wpabuf_put_data() prevents an actual |
38 |
+buffer write overflow from occurring, but this results in process |
39 |
+termination. (CVE-2015-5315) |
40 |
+ |
41 |
+Signed-off-by: Jouni Malinen <j@××.fi> |
42 |
+--- |
43 |
+ src/eap_peer/eap_pwd.c | 7 +++---- |
44 |
+ 1 file changed, 3 insertions(+), 4 deletions(-) |
45 |
+ |
46 |
+diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c |
47 |
+index 1f78544..75ceef1 100644 |
48 |
+--- a/src/eap_peer/eap_pwd.c |
49 |
++++ b/src/eap_peer/eap_pwd.c |
50 |
+@@ -903,7 +903,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, |
51 |
+ /* |
52 |
+ * buffer and ACK the fragment |
53 |
+ */ |
54 |
+- if (EAP_PWD_GET_MORE_BIT(lm_exch)) { |
55 |
++ if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { |
56 |
+ data->in_frag_pos += len; |
57 |
+ if (data->in_frag_pos > wpabuf_size(data->inbuf)) { |
58 |
+ wpa_printf(MSG_INFO, "EAP-pwd: Buffer overflow attack " |
59 |
+@@ -916,7 +916,8 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, |
60 |
+ return NULL; |
61 |
+ } |
62 |
+ wpabuf_put_data(data->inbuf, pos, len); |
63 |
+- |
64 |
++ } |
65 |
++ if (EAP_PWD_GET_MORE_BIT(lm_exch)) { |
66 |
+ resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, |
67 |
+ EAP_PWD_HDR_SIZE, |
68 |
+ EAP_CODE_RESPONSE, eap_get_id(reqData)); |
69 |
+@@ -930,10 +931,8 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, |
70 |
+ * we're buffering and this is the last fragment |
71 |
+ */ |
72 |
+ if (data->in_frag_pos) { |
73 |
+- wpabuf_put_data(data->inbuf, pos, len); |
74 |
+ wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", |
75 |
+ (int) len); |
76 |
+- data->in_frag_pos += len; |
77 |
+ pos = wpabuf_head_u8(data->inbuf); |
78 |
+ len = data->in_frag_pos; |
79 |
+ } |
80 |
+-- |
81 |
+1.9.1 |
82 |
+ |
83 |
|
84 |
diff --git a/net-wireless/wpa_supplicant/files/2015-7/0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch b/net-wireless/wpa_supplicant/files/2015-7/0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch |
85 |
new file mode 100644 |
86 |
index 0000000..bfc4c74 |
87 |
--- /dev/null |
88 |
+++ b/net-wireless/wpa_supplicant/files/2015-7/0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch |
89 |
@@ -0,0 +1,51 @@ |
90 |
+From bef802ece03f9ae9d52a21f0cf4f1bc2c5a1f8aa Mon Sep 17 00:00:00 2001 |
91 |
+From: Jouni Malinen <j@××.fi> |
92 |
+Date: Sun, 1 Nov 2015 18:24:16 +0200 |
93 |
+Subject: [PATCH] EAP-pwd server: Fix last fragment length validation |
94 |
+ |
95 |
+All but the last fragment had their length checked against the remaining |
96 |
+room in the reassembly buffer. This allowed a suitably constructed last |
97 |
+fragment frame to try to add extra data that would go beyond the buffer. |
98 |
+The length validation code in wpabuf_put_data() prevents an actual |
99 |
+buffer write overflow from occurring, but this results in process |
100 |
+termination. (CVE-2015-5314) |
101 |
+ |
102 |
+Signed-off-by: Jouni Malinen <j@××.fi> |
103 |
+--- |
104 |
+ src/eap_server/eap_server_pwd.c | 6 +++--- |
105 |
+ 1 file changed, 3 insertions(+), 3 deletions(-) |
106 |
+ |
107 |
+diff --git a/src/eap_server/eap_server_pwd.c b/src/eap_server/eap_server_pwd.c |
108 |
+index cb83ff7..9f787ab 100644 |
109 |
+--- a/src/eap_server/eap_server_pwd.c |
110 |
++++ b/src/eap_server/eap_server_pwd.c |
111 |
+@@ -970,7 +970,7 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv, |
112 |
+ /* |
113 |
+ * the first and all intermediate fragments have the M bit set |
114 |
+ */ |
115 |
+- if (EAP_PWD_GET_MORE_BIT(lm_exch)) { |
116 |
++ if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { |
117 |
+ if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) { |
118 |
+ wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow " |
119 |
+ "attack detected! (%d+%d > %d)", |
120 |
+@@ -981,6 +981,8 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv, |
121 |
+ } |
122 |
+ wpabuf_put_data(data->inbuf, pos, len); |
123 |
+ data->in_frag_pos += len; |
124 |
++ } |
125 |
++ if (EAP_PWD_GET_MORE_BIT(lm_exch)) { |
126 |
+ wpa_printf(MSG_DEBUG, "EAP-pwd: Got a %d byte fragment", |
127 |
+ (int) len); |
128 |
+ return; |
129 |
+@@ -990,8 +992,6 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv, |
130 |
+ * buffering fragments so that's how we know it's the last) |
131 |
+ */ |
132 |
+ if (data->in_frag_pos) { |
133 |
+- wpabuf_put_data(data->inbuf, pos, len); |
134 |
+- data->in_frag_pos += len; |
135 |
+ pos = wpabuf_head_u8(data->inbuf); |
136 |
+ len = data->in_frag_pos; |
137 |
+ wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", |
138 |
+-- |
139 |
+1.9.1 |
140 |
+ |
141 |
|
142 |
diff --git a/net-wireless/wpa_supplicant/files/2015-8/0001-EAP-pwd-peer-Fix-error-path-for-unexpected-Confirm-m.patch b/net-wireless/wpa_supplicant/files/2015-8/0001-EAP-pwd-peer-Fix-error-path-for-unexpected-Confirm-m.patch |
143 |
new file mode 100644 |
144 |
index 0000000..3088f6a |
145 |
--- /dev/null |
146 |
+++ b/net-wireless/wpa_supplicant/files/2015-8/0001-EAP-pwd-peer-Fix-error-path-for-unexpected-Confirm-m.patch |
147 |
@@ -0,0 +1,34 @@ |
148 |
+From 95577884ca4fa76be91344ff7a8d5d1e6dc3da61 Mon Sep 17 00:00:00 2001 |
149 |
+From: Jouni Malinen <j@××.fi> |
150 |
+Date: Sun, 1 Nov 2015 19:35:44 +0200 |
151 |
+Subject: [PATCH] EAP-pwd peer: Fix error path for unexpected Confirm message |
152 |
+ |
153 |
+If the Confirm message is received from the server before the Identity |
154 |
+exchange has been completed, the group has not yet been determined and |
155 |
+data->grp is NULL. The error path in eap_pwd_perform_confirm_exchange() |
156 |
+did not take this corner case into account and could end up |
157 |
+dereferencing a NULL pointer and terminating the process if invalid |
158 |
+message sequence is received. (CVE-2015-5316) |
159 |
+ |
160 |
+Signed-off-by: Jouni Malinen <j@××.fi> |
161 |
+--- |
162 |
+ src/eap_peer/eap_pwd.c | 3 ++- |
163 |
+ 1 file changed, 2 insertions(+), 1 deletion(-) |
164 |
+ |
165 |
+diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c |
166 |
+index 75ceef1..892b590 100644 |
167 |
+--- a/src/eap_peer/eap_pwd.c |
168 |
++++ b/src/eap_peer/eap_pwd.c |
169 |
+@@ -774,7 +774,8 @@ eap_pwd_perform_confirm_exchange(struct eap_sm *sm, struct eap_pwd_data *data, |
170 |
+ wpabuf_put_data(data->outbuf, conf, SHA256_MAC_LEN); |
171 |
+ |
172 |
+ fin: |
173 |
+- bin_clear_free(cruft, BN_num_bytes(data->grp->prime)); |
174 |
++ if (data->grp) |
175 |
++ bin_clear_free(cruft, BN_num_bytes(data->grp->prime)); |
176 |
+ BN_clear_free(x); |
177 |
+ BN_clear_free(y); |
178 |
+ if (data->outbuf == NULL) { |
179 |
+-- |
180 |
+1.9.1 |
181 |
+ |
182 |
|
183 |
diff --git a/net-wireless/wpa_supplicant/files/2016-1/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch b/net-wireless/wpa_supplicant/files/2016-1/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch |
184 |
new file mode 100644 |
185 |
index 0000000..acad6be |
186 |
--- /dev/null |
187 |
+++ b/net-wireless/wpa_supplicant/files/2016-1/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch |
188 |
@@ -0,0 +1,82 @@ |
189 |
+From ecbb0b3dc122b0d290987cf9c84010bbe53e1022 Mon Sep 17 00:00:00 2001 |
190 |
+From: Jouni Malinen <jouni@××××××××××××.com> |
191 |
+Date: Fri, 4 Mar 2016 17:20:18 +0200 |
192 |
+Subject: [PATCH 1/5] WPS: Reject a Credential with invalid passphrase |
193 |
+ |
194 |
+WPA/WPA2-Personal passphrase is not allowed to include control |
195 |
+characters. Reject a Credential received from a WPS Registrar both as |
196 |
+STA (Credential) and AP (AP Settings) if the credential is for WPAPSK or |
197 |
+WPA2PSK authentication type and includes an invalid passphrase. |
198 |
+ |
199 |
+This fixes an issue where hostapd or wpa_supplicant could have updated |
200 |
+the configuration file PSK/passphrase parameter with arbitrary data from |
201 |
+an external device (Registrar) that may not be fully trusted. Should |
202 |
+such data include a newline character, the resulting configuration file |
203 |
+could become invalid and fail to be parsed. |
204 |
+ |
205 |
+Signed-off-by: Jouni Malinen <jouni@××××××××××××.com> |
206 |
+--- |
207 |
+ src/utils/common.c | 12 ++++++++++++ |
208 |
+ src/utils/common.h | 1 + |
209 |
+ src/wps/wps_attr_process.c | 10 ++++++++++ |
210 |
+ 3 files changed, 23 insertions(+) |
211 |
+ |
212 |
+diff --git a/src/utils/common.c b/src/utils/common.c |
213 |
+index 450e2c6..27b7c02 100644 |
214 |
+--- a/src/utils/common.c |
215 |
++++ b/src/utils/common.c |
216 |
+@@ -697,6 +697,18 @@ int is_hex(const u8 *data, size_t len) |
217 |
+ } |
218 |
+ |
219 |
+ |
220 |
++int has_ctrl_char(const u8 *data, size_t len) |
221 |
++{ |
222 |
++ size_t i; |
223 |
++ |
224 |
++ for (i = 0; i < len; i++) { |
225 |
++ if (data[i] < 32 || data[i] == 127) |
226 |
++ return 1; |
227 |
++ } |
228 |
++ return 0; |
229 |
++} |
230 |
++ |
231 |
++ |
232 |
+ size_t merge_byte_arrays(u8 *res, size_t res_len, |
233 |
+ const u8 *src1, size_t src1_len, |
234 |
+ const u8 *src2, size_t src2_len) |
235 |
+diff --git a/src/utils/common.h b/src/utils/common.h |
236 |
+index 701dbb2..a972240 100644 |
237 |
+--- a/src/utils/common.h |
238 |
++++ b/src/utils/common.h |
239 |
+@@ -488,6 +488,7 @@ const char * wpa_ssid_txt(const u8 *ssid, size_t ssid_len); |
240 |
+ |
241 |
+ char * wpa_config_parse_string(const char *value, size_t *len); |
242 |
+ int is_hex(const u8 *data, size_t len); |
243 |
++int has_ctrl_char(const u8 *data, size_t len); |
244 |
+ size_t merge_byte_arrays(u8 *res, size_t res_len, |
245 |
+ const u8 *src1, size_t src1_len, |
246 |
+ const u8 *src2, size_t src2_len); |
247 |
+diff --git a/src/wps/wps_attr_process.c b/src/wps/wps_attr_process.c |
248 |
+index eadb22f..e8c4579 100644 |
249 |
+--- a/src/wps/wps_attr_process.c |
250 |
++++ b/src/wps/wps_attr_process.c |
251 |
+@@ -229,6 +229,16 @@ static int wps_workaround_cred_key(struct wps_credential *cred) |
252 |
+ cred->key_len--; |
253 |
+ #endif /* CONFIG_WPS_STRICT */ |
254 |
+ } |
255 |
++ |
256 |
++ |
257 |
++ if (cred->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK) && |
258 |
++ (cred->key_len < 8 || has_ctrl_char(cred->key, cred->key_len))) { |
259 |
++ wpa_printf(MSG_INFO, "WPS: Reject credential with invalid WPA/WPA2-Personal passphrase"); |
260 |
++ wpa_hexdump_ascii_key(MSG_INFO, "WPS: Network Key", |
261 |
++ cred->key, cred->key_len); |
262 |
++ return -1; |
263 |
++ } |
264 |
++ |
265 |
+ return 0; |
266 |
+ } |
267 |
+ |
268 |
+-- |
269 |
+1.9.1 |
270 |
+ |
271 |
|
272 |
diff --git a/net-wireless/wpa_supplicant/files/2016-1/0002-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch b/net-wireless/wpa_supplicant/files/2016-1/0002-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch |
273 |
new file mode 100644 |
274 |
index 0000000..507a96e |
275 |
--- /dev/null |
276 |
+++ b/net-wireless/wpa_supplicant/files/2016-1/0002-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch |
277 |
@@ -0,0 +1,51 @@ |
278 |
+From 73e4abb24a936014727924d8b0b2965edfc117dd Mon Sep 17 00:00:00 2001 |
279 |
+From: Jouni Malinen <jouni@××××××××××××.com> |
280 |
+Date: Fri, 4 Mar 2016 18:46:41 +0200 |
281 |
+Subject: [PATCH 2/5] Reject psk parameter set with invalid passphrase |
282 |
+ character |
283 |
+ |
284 |
+WPA/WPA2-Personal passphrase is not allowed to include control |
285 |
+characters. Reject a passphrase configuration attempt if that passphrase |
286 |
+includes an invalid passphrase. |
287 |
+ |
288 |
+This fixes an issue where wpa_supplicant could have updated the |
289 |
+configuration file psk parameter with arbitrary data from the control |
290 |
+interface or D-Bus interface. While those interfaces are supposed to be |
291 |
+accessible only for trusted users/applications, it may be possible that |
292 |
+an untrusted user has access to a management software component that |
293 |
+does not validate the passphrase value before passing it to |
294 |
+wpa_supplicant. |
295 |
+ |
296 |
+This could allow such an untrusted user to inject up to 63 characters of |
297 |
+almost arbitrary data into the configuration file. Such configuration |
298 |
+file could result in wpa_supplicant trying to load a library (e.g., |
299 |
+opensc_engine_path, pkcs11_engine_path, pkcs11_module_path, |
300 |
+load_dynamic_eap) from user controlled location when starting again. |
301 |
+This would allow code from that library to be executed under the |
302 |
+wpa_supplicant process privileges. |
303 |
+ |
304 |
+Signed-off-by: Jouni Malinen <jouni@××××××××××××.com> |
305 |
+--- |
306 |
+ wpa_supplicant/config.c | 6 ++++++ |
307 |
+ 1 file changed, 6 insertions(+) |
308 |
+ |
309 |
+diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c |
310 |
+index b1c7870..fdd9643 100644 |
311 |
+--- a/wpa_supplicant/config.c |
312 |
++++ b/wpa_supplicant/config.c |
313 |
+@@ -478,6 +478,12 @@ static int wpa_config_parse_psk(const struct parse_data *data, |
314 |
+ } |
315 |
+ wpa_hexdump_ascii_key(MSG_MSGDUMP, "PSK (ASCII passphrase)", |
316 |
+ (u8 *) value, len); |
317 |
++ if (has_ctrl_char((u8 *) value, len)) { |
318 |
++ wpa_printf(MSG_ERROR, |
319 |
++ "Line %d: Invalid passphrase character", |
320 |
++ line); |
321 |
++ return -1; |
322 |
++ } |
323 |
+ if (ssid->passphrase && os_strlen(ssid->passphrase) == len && |
324 |
+ os_memcmp(ssid->passphrase, value, len) == 0) { |
325 |
+ /* No change to the previously configured value */ |
326 |
+-- |
327 |
+1.9.1 |
328 |
+ |
329 |
|
330 |
diff --git a/net-wireless/wpa_supplicant/files/2016-1/0003-Remove-newlines-from-wpa_supplicant-config-network-o.patch b/net-wireless/wpa_supplicant/files/2016-1/0003-Remove-newlines-from-wpa_supplicant-config-network-o.patch |
331 |
new file mode 100644 |
332 |
index 0000000..684d25d |
333 |
--- /dev/null |
334 |
+++ b/net-wireless/wpa_supplicant/files/2016-1/0003-Remove-newlines-from-wpa_supplicant-config-network-o.patch |
335 |
@@ -0,0 +1,82 @@ |
336 |
+From 0fe5a234240a108b294a87174ad197f6b5cb38e9 Mon Sep 17 00:00:00 2001 |
337 |
+From: Paul Stewart <pstew@××××××.com> |
338 |
+Date: Thu, 3 Mar 2016 15:40:19 -0800 |
339 |
+Subject: [PATCH 3/5] Remove newlines from wpa_supplicant config network |
340 |
+ output |
341 |
+ |
342 |
+Spurious newlines output while writing the config file can corrupt the |
343 |
+wpa_supplicant configuration. Avoid writing these for the network block |
344 |
+parameters. This is a generic filter that cover cases that may not have |
345 |
+been explicitly addressed with a more specific commit to avoid control |
346 |
+characters in the psk parameter. |
347 |
+ |
348 |
+Signed-off-by: Paul Stewart <pstew@××××××.com> |
349 |
+--- |
350 |
+ src/utils/common.c | 11 +++++++++++ |
351 |
+ src/utils/common.h | 1 + |
352 |
+ wpa_supplicant/config.c | 15 +++++++++++++-- |
353 |
+ 3 files changed, 25 insertions(+), 2 deletions(-) |
354 |
+ |
355 |
+diff --git a/src/utils/common.c b/src/utils/common.c |
356 |
+index 27b7c02..9856463 100644 |
357 |
+--- a/src/utils/common.c |
358 |
++++ b/src/utils/common.c |
359 |
+@@ -709,6 +709,17 @@ int has_ctrl_char(const u8 *data, size_t len) |
360 |
+ } |
361 |
+ |
362 |
+ |
363 |
++int has_newline(const char *str) |
364 |
++{ |
365 |
++ while (*str) { |
366 |
++ if (*str == '\n' || *str == '\r') |
367 |
++ return 1; |
368 |
++ str++; |
369 |
++ } |
370 |
++ return 0; |
371 |
++} |
372 |
++ |
373 |
++ |
374 |
+ size_t merge_byte_arrays(u8 *res, size_t res_len, |
375 |
+ const u8 *src1, size_t src1_len, |
376 |
+ const u8 *src2, size_t src2_len) |
377 |
+diff --git a/src/utils/common.h b/src/utils/common.h |
378 |
+index a972240..d19927b 100644 |
379 |
+--- a/src/utils/common.h |
380 |
++++ b/src/utils/common.h |
381 |
+@@ -489,6 +489,7 @@ const char * wpa_ssid_txt(const u8 *ssid, size_t ssid_len); |
382 |
+ char * wpa_config_parse_string(const char *value, size_t *len); |
383 |
+ int is_hex(const u8 *data, size_t len); |
384 |
+ int has_ctrl_char(const u8 *data, size_t len); |
385 |
++int has_newline(const char *str); |
386 |
+ size_t merge_byte_arrays(u8 *res, size_t res_len, |
387 |
+ const u8 *src1, size_t src1_len, |
388 |
+ const u8 *src2, size_t src2_len); |
389 |
+diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c |
390 |
+index fdd9643..eb97cd5 100644 |
391 |
+--- a/wpa_supplicant/config.c |
392 |
++++ b/wpa_supplicant/config.c |
393 |
+@@ -2699,8 +2699,19 @@ char * wpa_config_get(struct wpa_ssid *ssid, const char *var) |
394 |
+ |
395 |
+ for (i = 0; i < NUM_SSID_FIELDS; i++) { |
396 |
+ const struct parse_data *field = &ssid_fields[i]; |
397 |
+- if (os_strcmp(var, field->name) == 0) |
398 |
+- return field->writer(field, ssid); |
399 |
++ if (os_strcmp(var, field->name) == 0) { |
400 |
++ char *ret = field->writer(field, ssid); |
401 |
++ |
402 |
++ if (ret && has_newline(ret)) { |
403 |
++ wpa_printf(MSG_ERROR, |
404 |
++ "Found newline in value for %s; not returning it", |
405 |
++ var); |
406 |
++ os_free(ret); |
407 |
++ ret = NULL; |
408 |
++ } |
409 |
++ |
410 |
++ return ret; |
411 |
++ } |
412 |
+ } |
413 |
+ |
414 |
+ return NULL; |
415 |
+-- |
416 |
+1.9.1 |
417 |
+ |
418 |
|
419 |
diff --git a/net-wireless/wpa_supplicant/files/2016-1/0004-Reject-SET_CRED-commands-with-newline-characters-in-.patch b/net-wireless/wpa_supplicant/files/2016-1/0004-Reject-SET_CRED-commands-with-newline-characters-in-.patch |
420 |
new file mode 100644 |
421 |
index 0000000..2dd38fe |
422 |
--- /dev/null |
423 |
+++ b/net-wireless/wpa_supplicant/files/2016-1/0004-Reject-SET_CRED-commands-with-newline-characters-in-.patch |
424 |
@@ -0,0 +1,62 @@ |
425 |
+From b166cd84a77a6717be9600bf95378a0055d6f5a5 Mon Sep 17 00:00:00 2001 |
426 |
+From: Jouni Malinen <jouni@××××××××××××.com> |
427 |
+Date: Tue, 5 Apr 2016 23:33:10 +0300 |
428 |
+Subject: [PATCH 4/5] Reject SET_CRED commands with newline characters in the |
429 |
+ string values |
430 |
+ |
431 |
+Most of the cred block parameters are written as strings without |
432 |
+filtering and if there is an embedded newline character in the value, |
433 |
+unexpected configuration file data might be written. |
434 |
+ |
435 |
+This fixes an issue where wpa_supplicant could have updated the |
436 |
+configuration file cred parameter with arbitrary data from the control |
437 |
+interface or D-Bus interface. While those interfaces are supposed to be |
438 |
+accessible only for trusted users/applications, it may be possible that |
439 |
+an untrusted user has access to a management software component that |
440 |
+does not validate the credential value before passing it to |
441 |
+wpa_supplicant. |
442 |
+ |
443 |
+This could allow such an untrusted user to inject almost arbitrary data |
444 |
+into the configuration file. Such configuration file could result in |
445 |
+wpa_supplicant trying to load a library (e.g., opensc_engine_path, |
446 |
+pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user |
447 |
+controlled location when starting again. This would allow code from that |
448 |
+library to be executed under the wpa_supplicant process privileges. |
449 |
+ |
450 |
+Signed-off-by: Jouni Malinen <jouni@××××××××××××.com> |
451 |
+--- |
452 |
+ wpa_supplicant/config.c | 9 ++++++++- |
453 |
+ 1 file changed, 8 insertions(+), 1 deletion(-) |
454 |
+ |
455 |
+diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c |
456 |
+index eb97cd5..69152ef 100644 |
457 |
+--- a/wpa_supplicant/config.c |
458 |
++++ b/wpa_supplicant/config.c |
459 |
+@@ -2896,6 +2896,8 @@ int wpa_config_set_cred(struct wpa_cred *cred, const char *var, |
460 |
+ |
461 |
+ if (os_strcmp(var, "password") == 0 && |
462 |
+ os_strncmp(value, "ext:", 4) == 0) { |
463 |
++ if (has_newline(value)) |
464 |
++ return -1; |
465 |
+ str_clear_free(cred->password); |
466 |
+ cred->password = os_strdup(value); |
467 |
+ cred->ext_password = 1; |
468 |
+@@ -2946,9 +2948,14 @@ int wpa_config_set_cred(struct wpa_cred *cred, const char *var, |
469 |
+ } |
470 |
+ |
471 |
+ val = wpa_config_parse_string(value, &len); |
472 |
+- if (val == NULL) { |
473 |
++ if (val == NULL || |
474 |
++ (os_strcmp(var, "excluded_ssid") != 0 && |
475 |
++ os_strcmp(var, "roaming_consortium") != 0 && |
476 |
++ os_strcmp(var, "required_roaming_consortium") != 0 && |
477 |
++ has_newline(val))) { |
478 |
+ wpa_printf(MSG_ERROR, "Line %d: invalid field '%s' string " |
479 |
+ "value '%s'.", line, var, value); |
480 |
++ os_free(val); |
481 |
+ return -1; |
482 |
+ } |
483 |
+ |
484 |
+-- |
485 |
+1.9.1 |
486 |
+ |
487 |
|
488 |
diff --git a/net-wireless/wpa_supplicant/files/2016-1/0005-Reject-SET-commands-with-newline-characters-in-the-s.patch b/net-wireless/wpa_supplicant/files/2016-1/0005-Reject-SET-commands-with-newline-characters-in-the-s.patch |
489 |
new file mode 100644 |
490 |
index 0000000..5f42aa9 |
491 |
--- /dev/null |
492 |
+++ b/net-wireless/wpa_supplicant/files/2016-1/0005-Reject-SET-commands-with-newline-characters-in-the-s.patch |
493 |
@@ -0,0 +1,50 @@ |
494 |
+From 2a3f56502b52375c3bf113cf92adfa99bad6b488 Mon Sep 17 00:00:00 2001 |
495 |
+From: Jouni Malinen <jouni@××××××××××××.com> |
496 |
+Date: Tue, 5 Apr 2016 23:55:48 +0300 |
497 |
+Subject: [PATCH 5/5] Reject SET commands with newline characters in the |
498 |
+ string values |
499 |
+ |
500 |
+Many of the global configuration parameters are written as strings |
501 |
+without filtering and if there is an embedded newline character in the |
502 |
+value, unexpected configuration file data might be written. |
503 |
+ |
504 |
+This fixes an issue where wpa_supplicant could have updated the |
505 |
+configuration file global parameter with arbitrary data from the control |
506 |
+interface or D-Bus interface. While those interfaces are supposed to be |
507 |
+accessible only for trusted users/applications, it may be possible that |
508 |
+an untrusted user has access to a management software component that |
509 |
+does not validate the value of a parameter before passing it to |
510 |
+wpa_supplicant. |
511 |
+ |
512 |
+This could allow such an untrusted user to inject almost arbitrary data |
513 |
+into the configuration file. Such configuration file could result in |
514 |
+wpa_supplicant trying to load a library (e.g., opensc_engine_path, |
515 |
+pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user |
516 |
+controlled location when starting again. This would allow code from that |
517 |
+library to be executed under the wpa_supplicant process privileges. |
518 |
+ |
519 |
+Signed-off-by: Jouni Malinen <jouni@××××××××××××.com> |
520 |
+--- |
521 |
+ wpa_supplicant/config.c | 6 ++++++ |
522 |
+ 1 file changed, 6 insertions(+) |
523 |
+ |
524 |
+diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c |
525 |
+index 69152ef..d9a1603 100644 |
526 |
+--- a/wpa_supplicant/config.c |
527 |
++++ b/wpa_supplicant/config.c |
528 |
+@@ -3764,6 +3764,12 @@ static int wpa_global_config_parse_str(const struct global_parse_data *data, |
529 |
+ return -1; |
530 |
+ } |
531 |
+ |
532 |
++ if (has_newline(pos)) { |
533 |
++ wpa_printf(MSG_ERROR, "Line %d: invalid %s value with newline", |
534 |
++ line, data->name); |
535 |
++ return -1; |
536 |
++ } |
537 |
++ |
538 |
+ tmp = os_strdup(pos); |
539 |
+ if (tmp == NULL) |
540 |
+ return -1; |
541 |
+-- |
542 |
+1.9.1 |
543 |
+ |
544 |
|
545 |
diff --git a/net-wireless/wpa_supplicant/wpa_supplicant-2.5-r2.ebuild b/net-wireless/wpa_supplicant/wpa_supplicant-2.5-r2.ebuild |
546 |
new file mode 100644 |
547 |
index 0000000..fd19716 |
548 |
--- /dev/null |
549 |
+++ b/net-wireless/wpa_supplicant/wpa_supplicant-2.5-r2.ebuild |
550 |
@@ -0,0 +1,408 @@ |
551 |
+# Copyright 1999-2016 Gentoo Foundation |
552 |
+# Distributed under the terms of the GNU General Public License v2 |
553 |
+# $Id$ |
554 |
+ |
555 |
+EAPI=5 |
556 |
+ |
557 |
+inherit eutils toolchain-funcs qt4-r2 qmake-utils systemd multilib |
558 |
+ |
559 |
+DESCRIPTION="IEEE 802.1X/WPA supplicant for secure wireless transfers" |
560 |
+HOMEPAGE="http://hostap.epitest.fi/wpa_supplicant/" |
561 |
+SRC_URI="http://hostap.epitest.fi/releases/${P}.tar.gz" |
562 |
+LICENSE="|| ( GPL-2 BSD )" |
563 |
+ |
564 |
+SLOT="0" |
565 |
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd" |
566 |
+IUSE="ap dbus gnutls eap-sim fasteap +hs2-0 libressl p2p ps3 qt4 qt5 readline selinux smartcard ssl tdls uncommon-eap-types wimax wps kernel_linux kernel_FreeBSD" |
567 |
+REQUIRED_USE="fasteap? ( !gnutls !ssl ) smartcard? ( ssl ) ?? ( qt4 qt5 )" |
568 |
+ |
569 |
+CDEPEND="dbus? ( sys-apps/dbus ) |
570 |
+ kernel_linux? ( |
571 |
+ eap-sim? ( sys-apps/pcsc-lite ) |
572 |
+ dev-libs/libnl:3 |
573 |
+ net-wireless/crda |
574 |
+ ) |
575 |
+ !kernel_linux? ( net-libs/libpcap ) |
576 |
+ qt4? ( |
577 |
+ dev-qt/qtcore:4 |
578 |
+ dev-qt/qtgui:4 |
579 |
+ dev-qt/qtsvg:4 |
580 |
+ ) |
581 |
+ qt5? ( |
582 |
+ dev-qt/qtcore:5 |
583 |
+ dev-qt/qtgui:5 |
584 |
+ dev-qt/qtwidgets:5 |
585 |
+ dev-qt/qtsvg:5 |
586 |
+ ) |
587 |
+ readline? ( |
588 |
+ sys-libs/ncurses:0= |
589 |
+ sys-libs/readline:0 |
590 |
+ ) |
591 |
+ ssl? ( |
592 |
+ !libressl? ( dev-libs/openssl:0 ) |
593 |
+ libressl? ( dev-libs/libressl ) |
594 |
+ ) |
595 |
+ !ssl? ( |
596 |
+ gnutls? ( |
597 |
+ net-libs/gnutls |
598 |
+ dev-libs/libgcrypt:* |
599 |
+ ) |
600 |
+ !gnutls? ( dev-libs/libtommath ) |
601 |
+ ) |
602 |
+" |
603 |
+DEPEND="${CDEPEND} |
604 |
+ virtual/pkgconfig |
605 |
+" |
606 |
+RDEPEND="${CDEPEND} |
607 |
+ selinux? ( sec-policy/selinux-networkmanager ) |
608 |
+" |
609 |
+ |
610 |
+S="${WORKDIR}/${P}/${PN}" |
611 |
+ |
612 |
+Kconfig_style_config() { |
613 |
+ #param 1 is CONFIG_* item |
614 |
+ #param 2 is what to set it = to, defaulting in y |
615 |
+ CONFIG_PARAM="${CONFIG_HEADER:-CONFIG_}$1" |
616 |
+ setting="${2:-y}" |
617 |
+ |
618 |
+ if [ ! $setting = n ]; then |
619 |
+ #first remove any leading "# " if $2 is not n |
620 |
+ sed -i "/^# *$CONFIG_PARAM=/s/^# *//" .config || echo "Kconfig_style_config error uncommenting $CONFIG_PARAM" |
621 |
+ #set item = $setting (defaulting to y) |
622 |
+ sed -i "/^$CONFIG_PARAM/s/=.*/=$setting/" .config || echo "Kconfig_style_config error setting $CONFIG_PARAM=$setting" |
623 |
+ else |
624 |
+ #ensure item commented out |
625 |
+ sed -i "/^$CONFIG_PARAM/s/$CONFIG_PARAM/# $CONFIG_PARAM/" .config || echo "Kconfig_style_config error commenting $CONFIG_PARAM" |
626 |
+ fi |
627 |
+} |
628 |
+ |
629 |
+pkg_setup() { |
630 |
+ if use gnutls && use ssl ; then |
631 |
+ elog "You have both 'gnutls' and 'ssl' USE flags enabled: defaulting to USE=\"ssl\"" |
632 |
+ fi |
633 |
+} |
634 |
+ |
635 |
+src_prepare() { |
636 |
+ # net/bpf.h needed for net-libs/libpcap on Gentoo/FreeBSD |
637 |
+ sed -i \ |
638 |
+ -e "s:\(#include <pcap\.h>\):#include <net/bpf.h>\n\1:" \ |
639 |
+ ../src/l2_packet/l2_packet_freebsd.c || die |
640 |
+ |
641 |
+ # People seem to take the example configuration file too literally (bug #102361) |
642 |
+ sed -i \ |
643 |
+ -e "s:^\(opensc_engine_path\):#\1:" \ |
644 |
+ -e "s:^\(pkcs11_engine_path\):#\1:" \ |
645 |
+ -e "s:^\(pkcs11_module_path\):#\1:" \ |
646 |
+ wpa_supplicant.conf || die |
647 |
+ |
648 |
+ # Change configuration to match Gentoo locations (bug #143750) |
649 |
+ sed -i \ |
650 |
+ -e "s:/usr/lib/opensc:/usr/$(get_libdir):" \ |
651 |
+ -e "s:/usr/lib/pkcs11:/usr/$(get_libdir):" \ |
652 |
+ wpa_supplicant.conf || die |
653 |
+ |
654 |
+ #if use dbus; then |
655 |
+ # epatch "${FILESDIR}/${P}-dbus-path-fix.patch" |
656 |
+ #fi |
657 |
+ |
658 |
+ # systemd entries to D-Bus service files (bug #372877) |
659 |
+ echo 'SystemdService=wpa_supplicant.service' \ |
660 |
+ | tee -a dbus/*.service >/dev/null || die |
661 |
+ |
662 |
+ cd "${WORKDIR}/${P}" |
663 |
+ |
664 |
+ if use wimax; then |
665 |
+ # generate-libeap-peer.patch comes before |
666 |
+ # fix-undefined-reference-to-random_get_bytes.patch |
667 |
+ epatch "${FILESDIR}/${P}-generate-libeap-peer.patch" |
668 |
+ |
669 |
+ # multilib-strict fix (bug #373685) |
670 |
+ sed -e "s/\/usr\/lib/\/usr\/$(get_libdir)/" -i src/eap_peer/Makefile |
671 |
+ fi |
672 |
+ |
673 |
+ # bug (320097) |
674 |
+ epatch "${FILESDIR}/${P}-do-not-call-dbus-functions-with-NULL-path.patch" |
675 |
+ |
676 |
+ # TODO - NEED TESTING TO SEE IF STILL NEEDED, NOT COMPATIBLE WITH 1.0 OUT OF THE BOX, |
677 |
+ # SO WOULD BE NICE TO JUST DROP IT, IF IT IS NOT NEEDED. |
678 |
+ # bug (374089) |
679 |
+ #epatch "${FILESDIR}/${P}-dbus-WPAIE-fix.patch" |
680 |
+ |
681 |
+ # bug (565270) |
682 |
+ epatch "${FILESDIR}/${P}-libressl.patch" |
683 |
+ |
684 |
+ # Security patches |
685 |
+ epatch "${FILESDIR}/2015-7/0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch" |
686 |
+ epatch "${FILESDIR}/2015-7/0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch" |
687 |
+ epatch "${FILESDIR}/2015-8/0001-EAP-pwd-peer-Fix-error-path-for-unexpected-Confirm-m.patch" |
688 |
+ epatch "${FILESDIR}/2016-1/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch" |
689 |
+ epatch "${FILESDIR}/2016-1/0002-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch" |
690 |
+ epatch "${FILESDIR}/2016-1/0003-Remove-newlines-from-wpa_supplicant-config-network-o.patch" |
691 |
+ epatch "${FILESDIR}/2016-1/0004-Reject-SET_CRED-commands-with-newline-characters-in-.patch" |
692 |
+ epatch "${FILESDIR}/2016-1/0005-Reject-SET-commands-with-newline-characters-in-the-s.patch" |
693 |
+} |
694 |
+ |
695 |
+src_configure() { |
696 |
+ # Toolchain setup |
697 |
+ tc-export CC |
698 |
+ |
699 |
+ cp defconfig .config |
700 |
+ |
701 |
+ # Basic setup |
702 |
+ Kconfig_style_config CTRL_IFACE |
703 |
+ Kconfig_style_config BACKEND file |
704 |
+ Kconfig_style_config IBSS_RSN |
705 |
+ Kconfig_style_config IEEE80211W |
706 |
+ Kconfig_style_config IEEE80211R |
707 |
+ |
708 |
+ # Basic authentication methods |
709 |
+ # NOTE: we don't set GPSK or SAKE as they conflict |
710 |
+ # with the below options |
711 |
+ Kconfig_style_config EAP_GTC |
712 |
+ Kconfig_style_config EAP_MD5 |
713 |
+ Kconfig_style_config EAP_OTP |
714 |
+ Kconfig_style_config EAP_PAX |
715 |
+ Kconfig_style_config EAP_PSK |
716 |
+ Kconfig_style_config EAP_TLV |
717 |
+ Kconfig_style_config EAP_EXE |
718 |
+ Kconfig_style_config IEEE8021X_EAPOL |
719 |
+ Kconfig_style_config PKCS12 |
720 |
+ Kconfig_style_config PEERKEY |
721 |
+ Kconfig_style_config EAP_LEAP |
722 |
+ Kconfig_style_config EAP_MSCHAPV2 |
723 |
+ Kconfig_style_config EAP_PEAP |
724 |
+ Kconfig_style_config EAP_TLS |
725 |
+ Kconfig_style_config EAP_TTLS |
726 |
+ |
727 |
+ # Enabling background scanning. |
728 |
+ Kconfig_style_config BGSCAN_SIMPLE |
729 |
+ Kconfig_style_config BGSCAN_LEARN |
730 |
+ |
731 |
+ # Enabling mesh networks. |
732 |
+ Kconfig_style_config MESH |
733 |
+ |
734 |
+ if use dbus ; then |
735 |
+ Kconfig_style_config CTRL_IFACE_DBUS |
736 |
+ Kconfig_style_config CTRL_IFACE_DBUS_NEW |
737 |
+ Kconfig_style_config CTRL_IFACE_DBUS_INTRO |
738 |
+ fi |
739 |
+ |
740 |
+ # Enable support for writing debug info to a log file and syslog. |
741 |
+ Kconfig_style_config DEBUG_FILE |
742 |
+ Kconfig_style_config DEBUG_SYSLOG |
743 |
+ |
744 |
+ if use hs2-0 ; then |
745 |
+ Kconfig_style_config INTERWORKING |
746 |
+ Kconfig_style_config HS20 |
747 |
+ fi |
748 |
+ |
749 |
+ if use uncommon-eap-types; then |
750 |
+ Kconfig_style_config EAP_GPSK |
751 |
+ Kconfig_style_config EAP_SAKE |
752 |
+ Kconfig_style_config EAP_GPSK_SHA256 |
753 |
+ Kconfig_style_config EAP_IKEV2 |
754 |
+ Kconfig_style_config EAP_EKE |
755 |
+ fi |
756 |
+ |
757 |
+ if use eap-sim ; then |
758 |
+ # Smart card authentication |
759 |
+ Kconfig_style_config EAP_SIM |
760 |
+ Kconfig_style_config EAP_AKA |
761 |
+ Kconfig_style_config EAP_AKA_PRIME |
762 |
+ Kconfig_style_config PCSC |
763 |
+ fi |
764 |
+ |
765 |
+ if use fasteap ; then |
766 |
+ Kconfig_style_config EAP_FAST |
767 |
+ fi |
768 |
+ |
769 |
+ if use readline ; then |
770 |
+ # readline/history support for wpa_cli |
771 |
+ Kconfig_style_config READLINE |
772 |
+ else |
773 |
+ #internal line edit mode for wpa_cli |
774 |
+ Kconfig_style_config WPA_CLI_EDIT |
775 |
+ fi |
776 |
+ |
777 |
+ # SSL authentication methods |
778 |
+ if use ssl ; then |
779 |
+ Kconfig_style_config TLS openssl |
780 |
+ elif use gnutls ; then |
781 |
+ Kconfig_style_config TLS gnutls |
782 |
+ Kconfig_style_config GNUTLS_EXTRA |
783 |
+ else |
784 |
+ Kconfig_style_config TLS internal |
785 |
+ fi |
786 |
+ |
787 |
+ if use smartcard ; then |
788 |
+ Kconfig_style_config SMARTCARD |
789 |
+ fi |
790 |
+ |
791 |
+ if use tdls ; then |
792 |
+ Kconfig_style_config TDLS |
793 |
+ fi |
794 |
+ |
795 |
+ if use kernel_linux ; then |
796 |
+ # Linux specific drivers |
797 |
+ Kconfig_style_config DRIVER_ATMEL |
798 |
+ Kconfig_style_config DRIVER_HOSTAP |
799 |
+ Kconfig_style_config DRIVER_IPW |
800 |
+ Kconfig_style_config DRIVER_NL80211 |
801 |
+ Kconfig_style_config DRIVER_RALINK |
802 |
+ Kconfig_style_config DRIVER_WEXT |
803 |
+ Kconfig_style_config DRIVER_WIRED |
804 |
+ |
805 |
+ if use ps3 ; then |
806 |
+ Kconfig_style_config DRIVER_PS3 |
807 |
+ fi |
808 |
+ |
809 |
+ elif use kernel_FreeBSD ; then |
810 |
+ # FreeBSD specific driver |
811 |
+ Kconfig_style_config DRIVER_BSD |
812 |
+ fi |
813 |
+ |
814 |
+ # Wi-Fi Protected Setup (WPS) |
815 |
+ if use wps ; then |
816 |
+ Kconfig_style_config WPS |
817 |
+ Kconfig_style_config WPS2 |
818 |
+ # USB Flash Drive |
819 |
+ Kconfig_style_config WPS_UFD |
820 |
+ # External Registrar |
821 |
+ Kconfig_style_config WPS_ER |
822 |
+ # Universal Plug'n'Play |
823 |
+ Kconfig_style_config WPS_UPNP |
824 |
+ # Near Field Communication |
825 |
+ Kconfig_style_config WPS_NFC |
826 |
+ fi |
827 |
+ |
828 |
+ # Wi-Fi Direct (WiDi) |
829 |
+ if use p2p ; then |
830 |
+ Kconfig_style_config P2P |
831 |
+ Kconfig_style_config WIFI_DISPLAY |
832 |
+ fi |
833 |
+ |
834 |
+ # Access Point Mode |
835 |
+ if use ap ; then |
836 |
+ Kconfig_style_config AP |
837 |
+ fi |
838 |
+ |
839 |
+ # Enable mitigation against certain attacks against TKIP |
840 |
+ Kconfig_style_config DELAYED_MIC_ERROR_REPORT |
841 |
+ |
842 |
+ # If we are using libnl 2.0 and above, enable support for it |
843 |
+ # Bug 382159 |
844 |
+ # Removed for now, since the 3.2 version is broken, and we don't |
845 |
+ # support it. |
846 |
+ if has_version ">=dev-libs/libnl-3.2"; then |
847 |
+ Kconfig_style_config LIBNL32 |
848 |
+ fi |
849 |
+ |
850 |
+ if use qt4 ; then |
851 |
+ pushd "${S}"/wpa_gui-qt4 > /dev/null |
852 |
+ eqmake4 wpa_gui.pro |
853 |
+ popd > /dev/null |
854 |
+ fi |
855 |
+ if use qt5 ; then |
856 |
+ pushd "${S}"/wpa_gui-qt4 > /dev/null |
857 |
+ eqmake5 wpa_gui.pro |
858 |
+ popd > /dev/null |
859 |
+ fi |
860 |
+} |
861 |
+ |
862 |
+src_compile() { |
863 |
+ einfo "Building wpa_supplicant" |
864 |
+ emake V=1 BINDIR=/usr/sbin |
865 |
+ |
866 |
+ if use wimax; then |
867 |
+ emake -C ../src/eap_peer clean |
868 |
+ emake -C ../src/eap_peer |
869 |
+ fi |
870 |
+ |
871 |
+ if use qt4 || use qt5; then |
872 |
+ pushd "${S}"/wpa_gui-qt4 > /dev/null |
873 |
+ einfo "Building wpa_gui" |
874 |
+ emake |
875 |
+ popd > /dev/null |
876 |
+ fi |
877 |
+} |
878 |
+ |
879 |
+src_install() { |
880 |
+ dosbin wpa_supplicant |
881 |
+ dobin wpa_cli wpa_passphrase |
882 |
+ |
883 |
+ # baselayout-1 compat |
884 |
+ if has_version "<sys-apps/baselayout-2.0.0"; then |
885 |
+ dodir /sbin |
886 |
+ dosym /usr/sbin/wpa_supplicant /sbin/wpa_supplicant |
887 |
+ dodir /bin |
888 |
+ dosym /usr/bin/wpa_cli /bin/wpa_cli |
889 |
+ fi |
890 |
+ |
891 |
+ if has_version ">=sys-apps/openrc-0.5.0"; then |
892 |
+ newinitd "${FILESDIR}/${PN}-init.d" wpa_supplicant |
893 |
+ newconfd "${FILESDIR}/${PN}-conf.d" wpa_supplicant |
894 |
+ fi |
895 |
+ |
896 |
+ exeinto /etc/wpa_supplicant/ |
897 |
+ newexe "${FILESDIR}/wpa_cli.sh" wpa_cli.sh |
898 |
+ |
899 |
+ dodoc ChangeLog {eap_testing,todo}.txt README{,-WPS} \ |
900 |
+ wpa_supplicant.conf |
901 |
+ |
902 |
+ newdoc .config build-config |
903 |
+ |
904 |
+ doman doc/docbook/*.{5,8} |
905 |
+ |
906 |
+ if use qt4 || use qt5 ; then |
907 |
+ into /usr |
908 |
+ dobin wpa_gui-qt4/wpa_gui |
909 |
+ doicon wpa_gui-qt4/icons/wpa_gui.svg |
910 |
+ make_desktop_entry wpa_gui "WPA Supplicant Administration GUI" "wpa_gui" "Qt;Network;" |
911 |
+ fi |
912 |
+ |
913 |
+ use wimax && emake DESTDIR="${D}" -C ../src/eap_peer install |
914 |
+ |
915 |
+ if use dbus ; then |
916 |
+ pushd "${S}"/dbus > /dev/null |
917 |
+ insinto /etc/dbus-1/system.d |
918 |
+ newins dbus-wpa_supplicant.conf wpa_supplicant.conf |
919 |
+ insinto /usr/share/dbus-1/system-services |
920 |
+ doins fi.epitest.hostap.WPASupplicant.service fi.w1.wpa_supplicant1.service |
921 |
+ popd > /dev/null |
922 |
+ |
923 |
+ # This unit relies on dbus support, bug 538600. |
924 |
+ systemd_dounit systemd/wpa_supplicant.service |
925 |
+ fi |
926 |
+ |
927 |
+ systemd_dounit "systemd/wpa_supplicant@.service" |
928 |
+ systemd_dounit "systemd/wpa_supplicant-nl80211@.service" |
929 |
+ systemd_dounit "systemd/wpa_supplicant-wired@.service" |
930 |
+} |
931 |
+ |
932 |
+pkg_postinst() { |
933 |
+ elog "If this is a clean installation of wpa_supplicant, you" |
934 |
+ elog "have to create a configuration file named" |
935 |
+ elog "/etc/wpa_supplicant/wpa_supplicant.conf" |
936 |
+ elog |
937 |
+ elog "An example configuration file is available for reference in" |
938 |
+ elog "/usr/share/doc/${PF}/" |
939 |
+ |
940 |
+ if [[ -e ${ROOT}etc/wpa_supplicant.conf ]] ; then |
941 |
+ echo |
942 |
+ ewarn "WARNING: your old configuration file ${ROOT}etc/wpa_supplicant.conf" |
943 |
+ ewarn "needs to be moved to ${ROOT}etc/wpa_supplicant/wpa_supplicant.conf" |
944 |
+ fi |
945 |
+ |
946 |
+ # Mea culpa, feel free to remove that after some time --mgorny. |
947 |
+ local fn |
948 |
+ for fn in wpa_supplicant{,@wlan0}.service; do |
949 |
+ if [[ -e "${ROOT}"/etc/systemd/system/network.target.wants/${fn} ]] |
950 |
+ then |
951 |
+ ebegin "Moving ${fn} to multi-user.target" |
952 |
+ mv "${ROOT}"/etc/systemd/system/network.target.wants/${fn} \ |
953 |
+ "${ROOT}"/etc/systemd/system/multi-user.target.wants/ |
954 |
+ eend ${?} \ |
955 |
+ "Please try to re-enable ${fn}" |
956 |
+ fi |
957 |
+ done |
958 |
+} |