IPFire-SCM October 2017

ipfire-scm@lists.ipfire.org

1 participants
57 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. f32174956eb8dc6d961c0fe09796e092b6846ae4
by git＠ipfire.org 17 Oct '17

17 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via f32174956eb8dc6d961c0fe09796e092b6846ae4 (commit) via 3a62dca68e411e90565ab4c9654cae88e56dcfdd (commit) from 440cd2cbfdfb2d386c200a05deb14fcd3a7cb1e6 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f32174956eb8dc6d961c0fe09796e092b6846ae4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Oct 17 12:43:42 2017 +0100 captive: Reindent code for better readability Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 3a62dca68e411e90565ab4c9654cae88e56dcfdd Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Oct 17 12:41:17 2017 +0100 captive: Localise GREEN/BLUE Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: html/cgi-bin/captive.cgi | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) Difference in files: diff --git a/html/cgi-bin/captive.cgi b/html/cgi-bin/captive.cgi index c595c0e..629acae 100755 --- a/html/cgi-bin/captive.cgi +++ b/html/cgi-bin/captive.cgi @@ -251,7 +251,6 @@ if ($errormessage) { print <<END <form method='post' action='$ENV{'SCRIPT_NAME'}' enctype="multipart/form-data">\n <table width='100%' border="0"> - <tr> END ; @@ -274,14 +273,34 @@ $selected{'AUTH'}{'TERMS'} = ""; $selected{'AUTH'}{$settings{'AUTH'}} = "selected"; if ($netsettings{'GREEN_DEV'}){ - print "<td width='30%'>$Lang::tr{'Captive active on'} <font color='$Header::colourgreen'>Green</font></td><td><input type='checkbox' name='ENABLE_GREEN' $checked{'ENABLE_GREEN'}{'on'} /></td></tr>"; + print <<END; + <tr> + <td width='30%'> + $Lang::tr{'Captive active on'} + <font color='$Header::colourgreen'>$Lang::tr{'green'}</font> + </td> + <td> + <input type='checkbox' name='ENABLE_GREEN' $checked{'ENABLE_GREEN'}{'on'} /> + </td> + </tr> +END } + if ($netsettings{'BLUE_DEV'}){ - print "<td width='30%'>$Lang::tr{'Captive active on'} <font color='$Header::colourblue'>Blue</font></td><td><input type='checkbox' name='ENABLE_BLUE' $checked{'ENABLE_BLUE'}{'on'} /></td></tr>"; + print <<END; + <tr> + <td width='30%'> + $Lang::tr{'Captive active on'} + <font color='$Header::colourblue'>$Lang::tr{'blue'}</font> + </td> + <td> + <input type='checkbox' name='ENABLE_BLUE' $checked{'ENABLE_BLUE'}{'on'} /> + </td> + </tr> +END } print<<END - </tr> <tr> <td> $Lang::tr{'Captive authentication'} hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 440cd2cbfdfb2d386c200a05deb14fcd3a7cb1e6
by git＠ipfire.org 17 Oct '17

17 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 440cd2cbfdfb2d386c200a05deb14fcd3a7cb1e6 (commit) from 7207d80c4ecf070495b3d3e65c9f50dfad6d6a1a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 440cd2cbfdfb2d386c200a05deb14fcd3a7cb1e6 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Oct 17 12:29:22 2017 +0100 Rootfile update Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/perl-Font-TTF | 6 +++--- config/rootfiles/common/perl-IO-String | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) Difference in files: diff --git a/config/rootfiles/common/perl-Font-TTF b/config/rootfiles/common/perl-Font-TTF index e5d01b0..e21941c 100644 --- a/config/rootfiles/common/perl-Font-TTF +++ b/config/rootfiles/common/perl-Font-TTF @@ -82,9 +82,9 @@ usr/lib/perl5/site_perl/5.12.3/Font/TTF/Woff/MetaData.pm usr/lib/perl5/site_perl/5.12.3/Font/TTF/Woff/PrivateData.pm usr/lib/perl5/site_perl/5.12.3/Font/TTF/XMLparse.pm #usr/lib/perl5/site_perl/5.12.3/ttfmod.pl -#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/Font -#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/Font/TTF -#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/Font/TTF/.packlist +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Font +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Font/TTF +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Font/TTF/.packlist #usr/share/man/man3/Font::TTF.3 #usr/share/man/man3/Font::TTF::AATKern.3 #usr/share/man/man3/Font::TTF::AATutils.3 diff --git a/config/rootfiles/common/perl-IO-String b/config/rootfiles/common/perl-IO-String index e0b5944..89be911 100644 --- a/config/rootfiles/common/perl-IO-String +++ b/config/rootfiles/common/perl-IO-String @@ -1,4 +1,4 @@ usr/lib/perl5/site_perl/5.12.3/IO/String.pm -#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/IO/String -#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/IO/String/.packlist +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/IO/String +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/IO/String/.packlist #usr/share/man/man3/IO::String.3 hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core115, created. 7207d80c4ecf070495b3d3e65c9f50dfad6d6a1a
by git＠ipfire.org 16 Oct '17

16 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core115 has been created at 7207d80c4ecf070495b3d3e65c9f50dfad6d6a1a (commit) - Log ----------------------------------------------------------------- commit 7207d80c4ecf070495b3d3e65c9f50dfad6d6a1a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 19:20:20 2017 +0100 core115: Ship logrotate Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5ed7bbd52fe8fc124100ece71df0052e23276569 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sat Oct 14 11:14:17 2017 +0200 logrotate: Update to 3.13.0 For details see: https://github.com/logrotate/logrotate/releases Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b62c826fd8f9b41ac6006d4af8d0d5851f3ba1b4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 17:43:32 2017 +0100 PDF-API2: Add optional dependencies to read TrueType fonts Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e3c3625c34f2ea370014b1a3798edd9909b03497 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 17:31:51 2017 +0100 Make perl-PDF-API2 part of the base system Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 30b0e0ca1bd991d737e527b11f3cf83c446104e3 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 17:28:51 2017 +0100 PDF-API2: Update to 2.033 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit d7d5774529358c4ccbfc841f7ac1726d384a6bc9 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 15:49:35 2017 +0100 KRACK attack: Patch wpa_supplicant & hostapd A vulnerability was found in how a number of implementations can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by replaying a specific frame that is used to manage the keys. Such reinstallation of the encryption key can result in two different types of vulnerabilities: disabling replay protection and significantly reducing the security of encryption to the point of allowing frames to be decrypted or some parts of the keys to be determined by an attacker depending on which cipher is used. This fixes: CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit a54350cdb9d56691644486a49b7e5b7594d8d504 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 16:36:24 2017 +0200 captive: Allow PDF export of coupons Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit ebfb8996930ec1e3b4f7d09208d2ab60a8f30603 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 15:03:39 2017 +0200 captive: Add headline to T&C box Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit c484679bb3ea4672bf34ba3fd1d5d7596f00a11a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Oct 12 15:56:34 2017 +0100 Download sources via HTTPS Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit fb76fc5144d9b072cace93c008da90aa4ccfcbfa Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Oct 12 15:50:31 2017 +0100 installer: Fix detection if we have the correct ISO image mounted Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit f754146b1eee3f7a78424959633680f593f36d92 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Oct 12 15:32:21 2017 +0100 installer: Allow download of ISO images over HTTPS Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 7ef43add025bd53142cb31c17240e1b3b031115b Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Oct 11 21:02:44 2017 +0100 ipfire-netboot: Update to v2.0 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e735d91f03adf2e0eed8780de52473fe40419bb3 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Wed Oct 11 17:37:23 2017 +0200 unbound: Update to 1.6.7 For details see: http://www.unbound.net/download.html Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 50846453cb2dee4bd80220a01c714ea7add2e7a3 Author: Peter Müller <peter.mueller(a)link38.eu> Date: Wed Oct 11 18:30:50 2017 +0200 also force TLS when requiring user authentication in WebUI Force TLS _and_ a valid login when accessing protected directories. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 78fa47700d39c3f84a5c31e72140472564328aea Author: Peter Müller <peter.mueller(a)link38.eu> Date: Wed Oct 11 19:46:35 2017 +0200 generate ECDSA key on existing installations This is required since Apache crashes if any of the key/certificate files does not exist. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit fbc9cfd7697ad09d6022c2c858f0d942d35ee388 Author: Peter Müller <peter.mueller(a)link38.eu> Date: Wed Oct 11 19:47:19 2017 +0200 ship changed files for Apache and ECDSA Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 73ba2286201fbcf2bfb9786f29d2758e6aa380c6 Author: Peter Müller <peter.mueller(a)link38.eu> Date: Wed Oct 11 19:45:19 2017 +0200 enable dual-stack ECDSA and RSA certificates in Apache Note: Apache crashes if any of these files does not exist. Thereof it is necessary to generate missing keys on existing installations. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5760f93a74dc8569f206b742b3aa3035d9d582fd Author: Peter Müller <peter.mueller(a)link38.eu> Date: Wed Oct 11 19:45:33 2017 +0200 generate ECDSA key on existing installations Generate ECDSA key (and sign it) in case it does not exist. That way, httpscert can be ran on existing installations without breaking already generated (RSA) keys. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit f227ae4fd2336f86b2e0ada26144bca7190e0548 Author: Peter Müller <peter.mueller(a)link38.eu> Date: Wed Oct 11 19:24:10 2017 +0200 prefer ECDSA over RSA and remove clutter Priorize ECDSA before RSA and remove unused cipher suites. Remove redundant OpenSSL directives to make SSL configuration more readable. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5c6ae344fc30101566d82fa44dbb7d11a3b7ee9b Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Wed Oct 11 18:08:30 2017 +0200 web-user-interface: Removed 'dial.cgi' from lfs-file 'dial.cgi' was removed in https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=dc6ed83537e1bcc1347ad16… Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 0b289b3af01080c802a8559a1c86327b77b1f7b9 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Oct 11 19:59:48 2017 +0100 netboot: Update to 1.2 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e2bd5a6eb9385b82970c0e0afff5825950772fe1 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Oct 11 14:52:03 2017 +0100 captive: Allow editing terms in coupon mode Since the terms are always shown when set, we need a way to edit them in coupon mode as well. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 2f27148cbbf9482a11bc05c1afb410e3bb1bebb0 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Oct 11 12:20:44 2017 +0100 core115: Ship updated extrahd.pl Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 3c3dfd165eec77898bd9e0bf72ee92dbe9987d61 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Tue Oct 3 15:40:25 2017 +0200 Remove PRINT-line in extrahd.pl As shown in https://forum.ipfire.org/viewtopic.php?f=50&t=19563#p111055 PRINT-output somehow garbles bash-prompt. Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit ebf697a097f38c11a603e22f7f742e24bba601a2 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Oct 11 11:56:07 2017 +0100 core115: Ship latest OpenVPN changes Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b66b02ab73863bcb9130300d8ef0eecdc51efde3 Author: Erik Kapfer <erik.kapfer(a)ipfire.org> Date: Fri Oct 6 15:14:48 2017 +0200 OpenVPN: Fix for '--ns-cert-type server is deprecated' . - Added extended key usage based on RFC3280 TLS rules for OpenVPNs OpenSSL configuration, so '--remote-cert-tls' can be used instead of the old and deprecated '--ns-cert-type' if the host certificate are newely generated with this options. Nevertheless both directives (old and new) will work also with old CAs. - Automatic detection if the host certificate uses the new options. If it does, '--remote-cert-tls server' will be automatically set into the client configuration files for Net-to-Net and Roadwarriors connections. If it does NOT, the old '--ns-cert-type server' directive will be set in the client configuration file. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b0b4d09c56774e84938109963a32916716e96f85 Author: Peter Müller <peter.mueller(a)link38.eu> Date: Tue Oct 10 15:31:07 2017 +0200 remove unused dial.cgi directives from Apache vhosts config Remove configuration lines in Apache vhosts files which are not used anymore (old dial.cgi stuff). Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit dc6ed83537e1bcc1347ad16bee095ef4d641bc69 Author: Peter Müller <peter.mueller(a)link38.eu> Date: Mon Oct 9 22:06:33 2017 +0200 delete unused dial.cgi file Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 436479a29fb81a66e66304a76862e48cddfaf424 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 9 14:58:41 2017 +0100 core115: No need to reload apache after it has been restarted Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit c8e03c7c53ba59acf4aed8dca38d23a88f2167c9 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 9 14:58:26 2017 +0100 core115: Regenerate IPsec configuration Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e34e72b6e1d0e4ac5b4e08b661b1ab6e7062d2f5 Author: Peter Müller <peter.mueller(a)link38.eu> Date: Sun Oct 8 20:41:10 2017 +0200 add missing check for Curve25519 in vpnmain.cgi This fixes bug #11501 which causes IPsec connections to crash if Curve25519 has been enabled. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit bfa0f1dfc0b85d81ff500cac4f13175fc260ba65 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 9 14:50:29 2017 +0100 core115: Rebuild language cache during update Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 2ac90665e8ca5684e811012f2923b0cfec93e065 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 9 14:49:34 2017 +0100 core115: Ship updated apache Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e3fc1d0a2b13e866ec2043c2c5309d4add2423da Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sun Oct 8 16:37:21 2017 +0200 apache: Update to 2.4.28 http://apache.mirror.digionline.de//httpd/CHANGES_2.4.28 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit bef7ad5bbecbb3ed36d8c3c38fcca67b84487213 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 9 14:34:21 2017 +0100 captive: Fix saving empty terms Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 6772cc8035ba6a03b2251380f61cc9a4100d9229 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Oct 6 13:03:40 2017 +0100 Download ISO images from https://downloads.ipfire.org Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5e6fcc884403ee428dec544b32565a33af54ba94 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Oct 6 12:15:26 2017 +0100 Pull latest translations for installer & setup from Transifex Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 1294c52ca5d01e9293b37b2f301c0c873098ab83 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Oct 6 11:48:49 2017 +0100 core115: Include captive portal in updater Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 112a09508e9538d67af9e60c207724eca49b1c51 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Oct 5 11:38:05 2017 +0100 core115: Add captive portal cron jobs to updater Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit bbc69f228db9e050e1b585a1ac09c495d32ef41a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Oct 5 10:42:04 2017 +0100 captive portal: Correctly initialise an array for 8h timeout Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit cb40ff6027c8eb06d4f2446c4a606084a39addc0 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Oct 5 12:09:58 2017 +0200 captive portal: Reload firewall rules after cleanup This is not necessary to stop any clients from accessing the Internet, but if we know that we don't need a line for certain any more, we can as well remove the firewall rule straight away. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 9c8395456753ac6b7fd0141a6b0be83415841bf0 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Oct 5 12:06:45 2017 +0200 captivectrl: Remove unused code Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b1773d1a37700ce2b07290750052d91983a65620 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Oct 5 12:04:29 2017 +0200 captive portal: Don't remove unlimited access after one hour Reported-by: Daniel Weismüller <daniel.weismueller(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 027614d2dc3107a4e071e8dac49ce8a74c36e4ea Merge: e2d934c 0a21916 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Oct 4 16:10:07 2017 +0100 Merge branch 'captive-portal' into next commit 0a219160ac7dfe243c94c1f04c182d29206df8ec Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Oct 4 14:21:12 2017 +0100 captive portal: Allow sessions to expire after 8 hours Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 1f06098ba7f4894c9e3dfb744c38f6ef5c576743 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Oct 4 12:55:17 2017 +0100 captive-portal: Serve Ubuntu font files locally Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 70f6cba43efc1269712ed17020c2e1cf9d6fe86e Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Oct 4 12:47:28 2017 +0100 Add Ubuntu font family package Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e2d934cf2bbc9409e878b719a6688476ab9b6874 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Sep 30 12:34:37 2017 +0100 core115: Ship update for OpenVPN Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 67970637d0965ee01255a4d3a27dfa186c57f54c Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sat Sep 30 07:41:56 2017 +0200 openvpn: Update to 2.3.18 Fixes CVE-2017-12166: out of bounds write in key-method 1 For details see: https://community.openvpn.net/openvpn/wiki/CVE-2017-12166 Changelog: https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.18 Removed an unrecognized 'configure'-option. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit fc9a434cbcef07ab3c5a81d5514036ac3962219c Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Fri Sep 29 20:42:31 2017 +0200 tor: Update to 3.1.7 Fixes TROVE-2017-008 and CVE-2017-0380 and others.... For details see https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.1.7 "Tor 0.3.1.7 is the first stable release in the 0.3.1 series." Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 36f5d20ef73844906b557808ecb651097238683f Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Sep 24 20:23:06 2017 +0100 core115: Ship cosmetic improvements in proxy.cgi Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 082771c1f4d61fd633c04081ddbfebe25494db14 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Thu Sep 21 01:46:27 2017 +0200 proxy.cgi: Some cosmetics for the absolutely lazy ones (V2) Added clickable links for 'URL filter' and 'Update accelerator' for faster access, this time without the need to alter the language-files. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit c42237247aec6de190d135b61213054b8b7e2e22 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Sep 24 15:51:12 2017 +0200 start core115 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit d62fd7553da8699bd60e3decb6b646d4436d372d Merge: 1b0ff72 2083519 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Sep 24 15:45:04 2017 +0200 Merge branch 'master' into next commit 1b0ff72dad0225f1b636605e17a42c465f96d884 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sat Sep 23 01:34:55 2017 +0200 wpa_supplicant: Update to 2.6 For details see: https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit fb96829a746d5a7ace9835c1aa566f5b0d8bc406 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Sep 22 19:34:29 2017 +0100 captive: Update configuration for Apache 2.4 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit afd0cd232fa0d545ebdb70a114f044cde7b99985 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri May 5 11:48:03 2017 +0100 Rootfile update Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5f1b9511022bca252c27b9e60284bf4f4486af46 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed May 3 15:39:50 2017 +0200 captive: Show access page in browser language Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Tested-by: Daniel Weismüller <daniel.weismüller(a)ipfire.org> commit 1d68e28753c7eae374924e0b4ba5ee7cc985c711 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed May 3 15:11:30 2017 +0200 captive: Do not try to execute the favicon Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 963beecdb8bf374d71f22fb0aaf39e5f215318d7 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed May 3 15:01:02 2017 +0200 captive: Fix passing redirection URL Reported-by: Daniel Weismüller <daniel.weismueller(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 78148cc1e55b0fc85e8433ef30e7e4652e6c6c63 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed May 3 14:58:23 2017 +0200 captive: Run apache in HTTP/1.0 mode Reported-by: Daniel Weismüller <daniel.weismueller(a)ipfire.org> Tested-by: Daniel Weismüller <daniel.weismueller(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5511fa319a68abcccd68e575f68383f58cb1a388 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 2 11:04:06 2017 +0100 captive: Fix another typo in captivectrl Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 94e1d35c541d7cbba43c1703a4a590b441bfd3e5 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 2 11:02:21 2017 +0100 captive: Fix typo in German translation Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 9b6227cc2a961148d007a3f5a2d388c231af47b4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 2 10:58:57 2017 +0100 captive: Let apache follow symlinks to load bootstrap Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 445b43f87732df392776964a82e3ed3058cfee6b Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 2 10:55:58 2017 +0100 captive: Fix directory permissions Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit c91899797b58c719132445778b3b1f1b017a80f4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 2 10:55:19 2017 +0100 captive: Logo directory no longer exists Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b020b6190f8dd8c5728731148ab11ded9687dcd0 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 2 10:37:54 2017 +0100 Rootfile update Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 22ce4c3ad6d93879955060e5582384f334ef15f6 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 2 10:37:41 2017 +0100 apache2: Create captive portal logging directory Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 6033b2710346f9bf4e1182db706775ccde59e5c1 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 2 10:36:43 2017 +0100 Actually build bootstrap Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 4eecd722b746fa325d126849c3f3cc0e743bf70c Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 16:13:06 2017 +0100 Update German translation for captive portal Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 02de682e2118769f1e80fab42f3adb284f60d7c6 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 16:08:24 2017 +0100 captive: Link .map files as well Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 733de0e4a0b16d4b03f193f7eec7ce51de071a30 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 16:07:40 2017 +0100 bootstrap: Install map files, too Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 115b5e624e22212b0b0ba8db852bfec7a402c3fe Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 12:39:42 2017 +0100 captive: Show message when an invalid coupon code was entered Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 45b1b7cf65ed067d4df4560716e401e4915e02d8 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 12:37:44 2017 +0100 captive: Do not show checkbox when in coupon mode Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 497b9108559e8eac8daba6e8e9e8ff83d5040c69 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 12:35:45 2017 +0100 captive: Verify that the user actually accepted the terms and conditions Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit eb3e3017cbd65d3b46bf1ca69195e72e56f64442 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 12:24:07 2017 +0100 captive: Style any error messages Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit aed55ef9f81ea07da49b5b051354911d87d428ce Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 12:06:11 2017 +0100 captive: Show a message when no coupon code was entered Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 8b0679cc89926ccd7e6f8b42e4a20dd3b3c4e371 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 11:47:04 2017 +0100 captive: Fix some template updates that I forgot Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 792f1a3bdf47eba051a752f27e30a92d53a523b3 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 11:41:51 2017 +0100 captive: Drop duplicate function to list active clients There was a function with different name but essentially same functionality which is already existant in &show_clients(). Therefore this patch drops the old function without any functional changes. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 41964aba093a6b37f7534c0990b25c29e38ea371 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 11:40:06 2017 +0100 captive: Redesign clients list box Mostly code cleanup Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit a0b271e4745dafb7daade5dcf4d18406daaddee9 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon May 1 11:26:04 2017 +0100 captive: Redesign generated coupons table Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 733932de749c1c92f8f4b38a53cdbf876dd7fe6e Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 28 15:39:05 2017 +0100 captive: Correctly set coupon lifetime Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 9cba29f119459e3ebf5964ee265edd8194042b5a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 28 15:12:08 2017 +0100 captive: Remember selected coupon expiry time Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5cd9e28bc407f9c3f01a2512a14adda83f89f92e Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 28 15:09:56 2017 +0100 captive: Allow creating multiple coupons in bulk Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 58fd5dd482d1e4fdf4a5eb554dd9c4a6ad93369b Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 28 14:56:48 2017 +0100 captive: Reformat times Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 4f75fbfe12ba48d8f4275d76259db8dd02bfe0fa Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 28 14:54:26 2017 +0100 captive: Cleanup coupon generation block No functional changes Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 810198110e60d29c6ca9e73b622ab350ae9f9f82 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 28 14:41:57 2017 +0100 captive: Cleanup logo upload Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e7d16ea553d56ad24240f1f6fe1276ecadaa647f Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 28 14:38:59 2017 +0100 captive: Cleanup authentication selection Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit a41fe924aefb1237c546fdebb55a4fd4c13d580c Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 28 14:34:14 2017 +0100 captive: Code cleanup No functional changes Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b7a126d9c8bfb9d03752672b90750a23bdd9119a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 28 14:29:15 2017 +0100 captive: Allow uploading JPEG images, too Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 8802d70a2836012e8e7a8c17eb5fbc589a944e5c Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 28 14:21:18 2017 +0100 captive: Serve logo through an extra CGI script This CGI script makes saving the logo easier (especially for backup purposes). Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e2752bfe719b51b1cb2f9153b8ddfab5d4483938 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 28 13:53:57 2017 +0100 captive: Save logo in /var/ipfire/captive Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 278309b9ef3d1a053b9cc201f1b6e0284334d233 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Apr 26 16:44:27 2017 +0100 captive: Allow selecting the session expiry time for terms Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 297ebdd47bbe5170c57f7ea0079c37830da61827 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Apr 26 12:59:36 2017 +0100 captive: Group settings together and create branding section Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 827d3f61da96ebc8881f3fbf283fd67c8bad6809 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Apr 26 12:55:40 2017 +0100 captive: Some more CGI cleanup Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 97b91e8a946233d1a5cf90ed36d744dd07f434f9 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Apr 26 12:50:43 2017 +0100 captive: Rename "Voucher" mode to "Coupon" Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 9735e1670aa846e8e022a88260943bfc348927fc Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Apr 26 12:27:35 2017 +0100 captive: Rename "License" mode to "Terms & Conditions" Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit f8d35875d8c83347c71a724e1d5af06d1660d4c9 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Apr 26 12:03:08 2017 +0100 captive: Allow selecting highlight colour in web interface To be able to customise the access page, we now allow the user to select a brand colour. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 4b33d29de7ea95d2ae9a128d6fb2304331d9bdc1 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Apr 26 11:53:15 2017 +0100 captive: Refactor the access page This brings no functional changes, but cleans up the code to re-use more and write less. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit dbfd2622f58727f4b0f9bed8934a770a2050491f Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Apr 25 12:52:29 2017 +0100 captive: Get MAC address of a device without calling arp Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 966971e58914ef254595532118d37dd604231a5c Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Apr 25 12:32:05 2017 +0100 captive: Don't compare action string Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 48fb1d3b6935e0c94f022df389e1212ef2dbf9d7 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Apr 25 12:24:45 2017 +0100 captive: Import new design This is the new design of the access page of the captive portal. It is based on the Bootstrap 4 grid system and reboot but does not use anything else from it. It is responsive and customisable. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 050ce7567826a0a45f092a74d8bdb180daa6a86d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 24 12:25:53 2017 +0100 bootstrap: New package Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit a2c26388dbc9cd388da37aa326bb9e6806d94f12 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 21 17:34:59 2017 +0100 captive-portal: Use template engine to render HTML template Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 0a02d9bb0c0dd52d2d0f3f45264bdf512eb66380 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 21 16:46:49 2017 +0100 captive-portal: Move CGI files to CGI directory Previously the assets directory has ExecCGI privileges which is not at all required and potentially dangerous. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit d57e8c67bc7ef3d71cb0c339734e49d9912cf581 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 21 16:29:39 2017 +0100 captive-portal: Code cleanup No functional changes Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 11fc9575d79644d7830eca59cf90b0d0393bf32b Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Sep 4 09:57:26 2016 +0100 captive: Fix bug with multiple license clients If one active client with a license existed, any other client authenticating will overwrite the configuration line. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit abc41f02dd31774d3bc311b4631fb5cf7f8992cd Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Sep 4 09:45:53 2016 +0100 captive: Do not generally allow access to TCP/1013 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 43834c49693a6c2ce25e31509e9ab2f8d6f32bd7 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Sep 4 09:31:46 2016 +0100 captive: Only make CGI script executable in document root Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 4ddf453804d10c387297fb1a5acb1e6694daddbc Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Sep 4 09:27:29 2016 +0100 captive: Reindent apache configuration Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit a79b220c5a6ad33126276958a506befe8b437a25 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Sep 4 09:25:41 2016 +0100 captive: Log into default apache log files Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 59a2d9c2d5ab9be52d437f890dcb513a0b4af0c1 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Tue Jul 12 08:13:04 2016 +0200 Captive-portal: Design changes When choosing voucher as authentication type there is no need to display the license agreement textbox Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 0806170370f87f949efd327e1ad7377050b3626f Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Jul 7 11:27:40 2016 +0200 BUG11141: Redesign of configuration website To improve the user experience, the configuration part of generating new vouchers has been reworked. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 213335372da6a5cb106e6ded17521b9a70d84d40 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Tue Jul 5 11:39:16 2016 +0200 BUG11140: Captive logo dimensions Now the min and max logo dimensions are shown in webinterface. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 6945954c445ff0af6196571bd352e8c8fe0e286b Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Wed Jun 29 12:47:55 2016 +0200 BUG11137: Captive save action messes up the form When configuring the captiveportal for the first time the form will be empty after clicking on save button if not all relevant fields are set. Now the settings are stored even if there is an error. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 1d77d1262a0b4b1d0fc975da799d7e85d29c94d3 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Wed Jun 29 12:36:18 2016 +0200 BUG11139: Captive voucher table too wide Set table to 100% and the remark textfield to 96% (cellwidth) Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 7ab3f84b2ab7a6bbf1428a1e04755ebd3742830f Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Jun 20 20:26:00 2016 +0100 Improve the wording of the Captive Portal configuration site Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 2d92a4eca4768b79c6cb2ce4604c0eced3f59a2c Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Jun 20 15:50:05 2016 +0100 Update translations Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit f339af27044567c36ddc8f27a15a0e4b90297c0b Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Jun 20 15:49:26 2016 +0100 Rootfile update Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 45129439bc2b16b712f015a661af4bdfbd815f60 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Feb 11 07:21:29 2016 +0100 Captive-Portal: fix fontsize of generated voucher Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 6820454e5436954c56f28116ee06d5266cd8484f Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Wed Feb 10 15:36:49 2016 +0100 Captive-Portal: Fix folder permissions Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 52383f583ed7602a7822564dd497165a1b0084f7 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Wed Feb 10 15:05:35 2016 +0100 Captive-Portal: fix some typos and missing dir Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit b32d9e92bee391e172236e4ee4d7661bfd5a1f11 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Wed Feb 10 10:20:52 2016 +0100 Captive-Portal: Add logo upload feature Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 83ba0896f6240a9110198e19a936e86b492cb766 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Wed Feb 10 10:09:23 2016 +0100 Captive-portal: Add directory for logo upload Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit fb1d26d1bc50a7a453026a600f763309150320ce Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Feb 8 16:38:34 2016 +0000 captivectrl: Add protection against DNS tunnels Limit the amount of DNS traffic for each client that has not registered, yet. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 76ece3236237626450838b2fb18d5ca213549f51 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Feb 8 16:37:21 2016 +0000 captivectrl: Skip all lines that start with # Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 07d56062a90d84c8504783b1c70fb06466a90dc2 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Mon Feb 8 10:56:01 2016 +0100 Captive-Portal: fix cleanup script The cleanup-script did not write back the hash after the expired voucher was delted Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 5dc32e5877f7cd8bb96ef6becc9a9370490a1c15 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Feb 4 13:26:35 2016 +0100 Captive-Portal: add Errormessage when wrong code is entered Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit f3802750ac9b03d7bfdb767e71436a1387607ec0 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Feb 4 12:04:47 2016 +0100 Captive-Portal: fix wrong expiretime of unused vouchers Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit facfdcd040d158b529da6134140bf42a1c5a2fca Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Feb 4 12:01:30 2016 +0100 Captive-Portal: fix voucher form Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 6d31cfdd58e5826373da4f5eaa07fd31dbcbee7d Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Feb 4 08:10:11 2016 +0100 Captive-Portal: add logging to syslog Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit e14adf759ae830dc6f36c97d31e42a449529c502 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Feb 4 07:30:05 2016 +0100 Captive-Portal: SHow always licencebox in config Also fix index.cgi to show individual title Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit c7e78cc62e6699f00962caf440ed25270c461334 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Tue Feb 2 14:30:13 2016 +0100 Captive-Portal: several design changes Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit e01c5ab71a78b4061cf98fd03be76112842a6bf2 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Mon Feb 1 16:14:50 2016 +0100 Captive-Portal: redesign Webinterface Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 47406df0fea9108a9b921884c58c53ca6ce6cb37 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Fri Jan 29 12:52:27 2016 +0100 Captive-Portal: fix some rootfiles Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit a6c985284d0d1a56ba8646a817b6bcd85aaa68e3 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Fri Jan 29 09:17:22 2016 +0100 Captive-Portal: add backup-part Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 8ef627839fa3e7fd636a243153ed68126f967871 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Fri Jan 29 09:02:31 2016 +0100 Captive-Portal: add captive logdir to apache2 rootfile Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit c04d2de74ee3b300b59dacdb29d0c174ed269025 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Fri Jan 29 08:56:16 2016 +0100 Captive-Portal: add files to configroot rootfile Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 585703d8a3da1ec4952851efa53d3ab926870b14 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Fri Jan 29 08:52:32 2016 +0100 Captive-Portal: Add files for webinterface tio rootfile Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 19cd2b6a7cd5951bb2c74004f27c5be82924880a Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Fri Jan 29 08:44:01 2016 +0100 Captive-Portal: add vhost config to apache2 rootfile Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 1fc9a43056d516e335e6761443d77bba77ba44d9 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Jan 28 16:21:51 2016 +0100 Captive-Portal: create dir for cative logfiles Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 5ca163cd82d651f5036cda30a4fa4c54c1559439 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Jan 28 16:14:34 2016 +0100 Captive-Portal: add captive dirs and files to configroot Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit bbaa3613b4e779fed958dc3f7918a65c57576fe8 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Jan 28 16:08:32 2016 +0100 Captive-Portal: add captive chains to firewall initscript When loading the initscript of the firewall the neccessary chains for the captive portalneed to be created. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 4d9002279f6cd5c73f0e6092c22ae2bfa49460bb Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Jan 28 16:05:53 2016 +0100 Captive-Portal: add crontab and cleanup scripts The cleanup script is called every hour and deletes expired clients from the clients file. every night the captivectrl warpper runs once to flush the chains and reload rules for active clients Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit 8b92078917ab3c3fdbdd2070ba803f23aff237d7 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Thu Jan 28 11:18:59 2016 +0100 Captive-Portal: add web-part Introduce new Captive-Portal. Here we add the menu, apache configuration (vhost), IPFire configuration website and Captive-Portal Access site. Also the languagefiles are updated. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> commit cec16b8242f27a7718cb54477403651f752c109e Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Feb 4 14:34:11 2016 +0000 captivectrl: Move sure that the settings are always initialised This just removes a compiler warning. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5906c96206c934e55883390aa0f931b851b4a8b3 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Feb 4 14:29:57 2016 +0000 wirelessctrl: Disable MAC filter on blue if captive portal is enabled Fixes #11038 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 0d6a599aba381244bd67de8bf6d6a7ed812cbe9e Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Jan 31 21:38:26 2016 +0000 captivectrl: Add missing space character The iptables argument list was botched. Oops. Sorry. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 0c24f0a9df0cee1c7c7e1cf804fe23856ea7bb6b Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Jan 30 14:46:55 2016 +0000 captivectrl: Support unlimited leases When the expiry time equals zero, the lease will have no time constraints. The IP address will also be removed as it might probably change. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5fbeaf133312d0ca8e28b842f6eb7d31a172d8ab Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Jan 30 14:30:13 2016 +0000 captivectrl: Allow empty IP addresses Probably required for very long leases Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 7ef66b6199e6215fd3b2b0fb42ec3e03ff1bddc7 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Jan 30 13:55:44 2016 +0000 captivectrl: Change format of clients configuration We store the start of the lease now and the time in seconds after the lease expires Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit ee40139d9ad0f5b1f07c5735641e45ebb6bd573a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Jan 28 14:24:07 2016 +0100 Captive Portal: add c-wrapper captivectrl This wrapper reads the captive settings and clients and sets the firewall access rules. It is called every time the config changed or everytime that a client changes. Also this wrapper is later called once hourly to flush the chains and rebuild rules for actual clients. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> ----------------------------------------------------------------------- hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 7207d80c4ecf070495b3d3e65c9f50dfad6d6a1a
by git＠ipfire.org 16 Oct '17

16 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 7207d80c4ecf070495b3d3e65c9f50dfad6d6a1a (commit) via 5ed7bbd52fe8fc124100ece71df0052e23276569 (commit) from b62c826fd8f9b41ac6006d4af8d0d5851f3ba1b4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 7207d80c4ecf070495b3d3e65c9f50dfad6d6a1a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 19:20:20 2017 +0100 core115: Ship logrotate Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5ed7bbd52fe8fc124100ece71df0052e23276569 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sat Oct 14 11:14:17 2017 +0200 logrotate: Update to 3.13.0 For details see: https://github.com/logrotate/logrotate/releases Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/111 => core/115}/filelists/logrotate | 0 lfs/logrotate | 4 ++-- 2 files changed, 2 insertions(+), 2 deletions(-) copy config/rootfiles/{oldcore/111 => core/115}/filelists/logrotate (100%) Difference in files: diff --git a/config/rootfiles/core/115/filelists/logrotate b/config/rootfiles/core/115/filelists/logrotate new file mode 120000 index 0000000..bc192c0 --- /dev/null +++ b/config/rootfiles/core/115/filelists/logrotate @@ -0,0 +1 @@ +../../../common/logrotate \ No newline at end of file diff --git a/lfs/logrotate b/lfs/logrotate index 70e9f48..3749fd7 100644 --- a/lfs/logrotate +++ b/lfs/logrotate @@ -24,7 +24,7 @@ include Config -VER = 3.12.3 +VER = 3.13.0 THISAPP = logrotate-$(VER) DL_FILE = logrotate-$(VER).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 3162ada6f1036c1a4a0a68262989ff73 +$(DL_FILE)_MD5 = 72c2c3028d060131b388a9b330215549 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 3.x development tree branch, master, updated. 11f10f24f1fb8098f35ffaec5756b76eb534ea95
by git＠ipfire.org 16 Oct '17

16 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via 11f10f24f1fb8098f35ffaec5756b76eb534ea95 (commit) from 00bd65c93f497ac7bbd1037ad8650f3077524ff2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 11f10f24f1fb8098f35ffaec5756b76eb534ea95 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Oct 12 12:40:22 2017 +0200 dbus: Update to 1.11.20 This is a minor update to the latest available version of dbus. * Enable testsuite. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: dbus/dbus.nm | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) Difference in files: diff --git a/dbus/dbus.nm b/dbus/dbus.nm index acdb939..bfa5ed0 100644 --- a/dbus/dbus.nm +++ b/dbus/dbus.nm @@ -4,7 +4,7 @@ ############################################################################### name = dbus -version = 1.11.16 +version = 1.11.20 release = 1 maintainer = Stefan Schantl <stefan.schantl(a)ipfire.org> @@ -33,6 +33,12 @@ build configure_options += \ --with-systemdsystemunitdir=%{unitdir} \ --with-dbus-user=dbus + + export LD_LIBRARY_PATH = %{DIR_APP}/dbus/.libs + + test + make check + end end packages hooks/post-receive -- IPFire 3.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. b62c826fd8f9b41ac6006d4af8d0d5851f3ba1b4
by git＠ipfire.org 16 Oct '17

16 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via b62c826fd8f9b41ac6006d4af8d0d5851f3ba1b4 (commit) via e3c3625c34f2ea370014b1a3798edd9909b03497 (commit) via 30b0e0ca1bd991d737e527b11f3cf83c446104e3 (commit) from d7d5774529358c4ccbfc841f7ac1726d384a6bc9 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b62c826fd8f9b41ac6006d4af8d0d5851f3ba1b4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 17:43:32 2017 +0100 PDF-API2: Add optional dependencies to read TrueType fonts Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e3c3625c34f2ea370014b1a3798edd9909b03497 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 17:31:51 2017 +0100 Make perl-PDF-API2 part of the base system Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 30b0e0ca1bd991d737e527b11f3cf83c446104e3 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 17:28:51 2017 +0100 PDF-API2: Update to 2.033 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/perl-Font-TTF | 164 +++++++++++++++++++++ config/rootfiles/common/perl-IO-String | 4 + .../rootfiles/{packages => common}/perl-PDF-API2 | 2 + config/rootfiles/core/115/filelists/perl-Font-TTF | 1 + config/rootfiles/core/115/filelists/perl-IO-String | 1 + config/rootfiles/core/115/filelists/perl-PDF-API2 | 1 + config/rootfiles/core/115/update.sh | 4 + lfs/{swig => perl-Font-TTF} | 9 +- lfs/{swig => perl-IO-String} | 9 +- lfs/perl-PDF-API2 | 10 +- lfs/squid-accounting | 4 +- make.sh | 2 + 12 files changed, 194 insertions(+), 17 deletions(-) create mode 100644 config/rootfiles/common/perl-Font-TTF create mode 100644 config/rootfiles/common/perl-IO-String rename config/rootfiles/{packages => common}/perl-PDF-API2 (98%) create mode 120000 config/rootfiles/core/115/filelists/perl-Font-TTF create mode 120000 config/rootfiles/core/115/filelists/perl-IO-String create mode 120000 config/rootfiles/core/115/filelists/perl-PDF-API2 copy lfs/{swig => perl-Font-TTF} (95%) copy lfs/{swig => perl-IO-String} (95%) Difference in files: diff --git a/config/rootfiles/common/perl-Font-TTF b/config/rootfiles/common/perl-Font-TTF new file mode 100644 index 0000000..e5d01b0 --- /dev/null +++ b/config/rootfiles/common/perl-Font-TTF @@ -0,0 +1,164 @@ +#usr/lib/perl5/site_perl/5.12.3/Font +#usr/lib/perl5/site_perl/5.12.3/Font/TTF +usr/lib/perl5/site_perl/5.12.3/Font/TTF.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/AATKern.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/AATutils.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Anchor.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Bsln.pm +#usr/lib/perl5/site_perl/5.12.3/Font/TTF/Changes_old.txt +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Cmap.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Coverage.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Cvt_.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/DSIG.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Delta.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Dumper.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/EBDT.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/EBLC.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Fdsc.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Feat.pm +#usr/lib/perl5/site_perl/5.12.3/Font/TTF/Features +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Features/Cvar.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Features/Size.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Features/Sset.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Fmtx.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Font.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Fpgm.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/GDEF.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/GPOS.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/GSUB.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Glat.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Gloc.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Glyf.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Glyph.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/GrFeat.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Hdmx.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Head.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Hhea.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Hmtx.pm +#usr/lib/perl5/site_perl/5.12.3/Font/TTF/Kern +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Kern.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Kern/ClassArray.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Kern/CompactClassArray.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Kern/OrderedList.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Kern/StateTable.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Kern/Subtable.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/LTSH.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Loca.pm +#usr/lib/perl5/site_perl/5.12.3/Font/TTF/Manual.pod +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Maxp.pm +#usr/lib/perl5/site_perl/5.12.3/Font/TTF/Mort +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Mort.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Mort/Chain.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Mort/Contextual.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Mort/Insertion.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Mort/Ligature.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Mort/Noncontextual.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Mort/Rearrangement.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Mort/Subtable.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Name.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/OS_2.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/OTTags.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/OldCmap.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/OldMort.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/PCLT.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/PSNames.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Post.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Prep.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Prop.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Segarr.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Silf.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Sill.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Table.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Ttc.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Ttopen.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Useall.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Utils.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Vhea.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Vmtx.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Win32.pm +#usr/lib/perl5/site_perl/5.12.3/Font/TTF/Woff +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Woff.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Woff/MetaData.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/Woff/PrivateData.pm +usr/lib/perl5/site_perl/5.12.3/Font/TTF/XMLparse.pm +#usr/lib/perl5/site_perl/5.12.3/ttfmod.pl +#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/Font +#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/Font/TTF +#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/Font/TTF/.packlist +#usr/share/man/man3/Font::TTF.3 +#usr/share/man/man3/Font::TTF::AATKern.3 +#usr/share/man/man3/Font::TTF::AATutils.3 +#usr/share/man/man3/Font::TTF::Anchor.3 +#usr/share/man/man3/Font::TTF::Bsln.3 +#usr/share/man/man3/Font::TTF::Cmap.3 +#usr/share/man/man3/Font::TTF::Coverage.3 +#usr/share/man/man3/Font::TTF::Cvt_.3 +#usr/share/man/man3/Font::TTF::DSIG.3 +#usr/share/man/man3/Font::TTF::Delta.3 +#usr/share/man/man3/Font::TTF::Dumper.3 +#usr/share/man/man3/Font::TTF::EBDT.3 +#usr/share/man/man3/Font::TTF::EBLC.3 +#usr/share/man/man3/Font::TTF::Fdsc.3 +#usr/share/man/man3/Font::TTF::Feat.3 +#usr/share/man/man3/Font::TTF::Features::Cvar.3 +#usr/share/man/man3/Font::TTF::Features::Size.3 +#usr/share/man/man3/Font::TTF::Features::Sset.3 +#usr/share/man/man3/Font::TTF::Fmtx.3 +#usr/share/man/man3/Font::TTF::Font.3 +#usr/share/man/man3/Font::TTF::Fpgm.3 +#usr/share/man/man3/Font::TTF::GDEF.3 +#usr/share/man/man3/Font::TTF::GPOS.3 +#usr/share/man/man3/Font::TTF::GSUB.3 +#usr/share/man/man3/Font::TTF::Glat.3 +#usr/share/man/man3/Font::TTF::Gloc.3 +#usr/share/man/man3/Font::TTF::Glyf.3 +#usr/share/man/man3/Font::TTF::Glyph.3 +#usr/share/man/man3/Font::TTF::GrFeat.3 +#usr/share/man/man3/Font::TTF::Hdmx.3 +#usr/share/man/man3/Font::TTF::Head.3 +#usr/share/man/man3/Font::TTF::Hhea.3 +#usr/share/man/man3/Font::TTF::Hmtx.3 +#usr/share/man/man3/Font::TTF::Kern.3 +#usr/share/man/man3/Font::TTF::Kern::ClassArray.3 +#usr/share/man/man3/Font::TTF::Kern::CompactClassArray.3 +#usr/share/man/man3/Font::TTF::Kern::OrderedList.3 +#usr/share/man/man3/Font::TTF::Kern::StateTable.3 +#usr/share/man/man3/Font::TTF::Kern::Subtable.3 +#usr/share/man/man3/Font::TTF::LTSH.3 +#usr/share/man/man3/Font::TTF::Loca.3 +#usr/share/man/man3/Font::TTF::Manual.3 +#usr/share/man/man3/Font::TTF::Maxp.3 +#usr/share/man/man3/Font::TTF::Mort.3 +#usr/share/man/man3/Font::TTF::Mort::Chain.3 +#usr/share/man/man3/Font::TTF::Mort::Contextual.3 +#usr/share/man/man3/Font::TTF::Mort::Insertion.3 +#usr/share/man/man3/Font::TTF::Mort::Ligature.3 +#usr/share/man/man3/Font::TTF::Mort::Noncontextual.3 +#usr/share/man/man3/Font::TTF::Mort::Rearrangement.3 +#usr/share/man/man3/Font::TTF::Mort::Subtable.3 +#usr/share/man/man3/Font::TTF::Name.3 +#usr/share/man/man3/Font::TTF::OS_2.3 +#usr/share/man/man3/Font::TTF::OTTags.3 +#usr/share/man/man3/Font::TTF::OldCmap.3 +#usr/share/man/man3/Font::TTF::OldMort.3 +#usr/share/man/man3/Font::TTF::PCLT.3 +#usr/share/man/man3/Font::TTF::PSNames.3 +#usr/share/man/man3/Font::TTF::Post.3 +#usr/share/man/man3/Font::TTF::Prep.3 +#usr/share/man/man3/Font::TTF::Prop.3 +#usr/share/man/man3/Font::TTF::Segarr.3 +#usr/share/man/man3/Font::TTF::Silf.3 +#usr/share/man/man3/Font::TTF::Sill.3 +#usr/share/man/man3/Font::TTF::Table.3 +#usr/share/man/man3/Font::TTF::Ttc.3 +#usr/share/man/man3/Font::TTF::Ttopen.3 +#usr/share/man/man3/Font::TTF::Useall.3 +#usr/share/man/man3/Font::TTF::Utils.3 +#usr/share/man/man3/Font::TTF::Vhea.3 +#usr/share/man/man3/Font::TTF::Vmtx.3 +#usr/share/man/man3/Font::TTF::Win32.3 +#usr/share/man/man3/Font::TTF::Woff.3 +#usr/share/man/man3/Font::TTF::Woff::MetaData.3 +#usr/share/man/man3/Font::TTF::Woff::PrivateData.3 +#usr/share/man/man3/Font::TTF::XMLparse.3 +#usr/share/man/man3/ttfmod.3 diff --git a/config/rootfiles/common/perl-IO-String b/config/rootfiles/common/perl-IO-String new file mode 100644 index 0000000..e0b5944 --- /dev/null +++ b/config/rootfiles/common/perl-IO-String @@ -0,0 +1,4 @@ +usr/lib/perl5/site_perl/5.12.3/IO/String.pm +#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/IO/String +#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/IO/String/.packlist +#usr/share/man/man3/IO::String.3 diff --git a/config/rootfiles/packages/perl-PDF-API2 b/config/rootfiles/common/perl-PDF-API2 similarity index 98% rename from config/rootfiles/packages/perl-PDF-API2 rename to config/rootfiles/common/perl-PDF-API2 index 642579a..17dc85a 100644 --- a/config/rootfiles/packages/perl-PDF-API2 +++ b/config/rootfiles/common/perl-PDF-API2 @@ -124,7 +124,9 @@ usr/lib/perl5/site_perl/5.12.3/PDF/API2/Resource/XObject/Image/GIF.pm usr/lib/perl5/site_perl/5.12.3/PDF/API2/Resource/XObject/Image/JPEG.pm usr/lib/perl5/site_perl/5.12.3/PDF/API2/Resource/XObject/Image/PNG.pm usr/lib/perl5/site_perl/5.12.3/PDF/API2/Resource/XObject/Image/PNM.pm +usr/lib/perl5/site_perl/5.12.3/PDF/API2/Resource/XObject/Image/TIFF usr/lib/perl5/site_perl/5.12.3/PDF/API2/Resource/XObject/Image/TIFF.pm +usr/lib/perl5/site_perl/5.12.3/PDF/API2/Resource/XObject/Image/TIFF/File.pm usr/lib/perl5/site_perl/5.12.3/PDF/API2/Resource/uniglyph.txt usr/lib/perl5/site_perl/5.12.3/PDF/API2/UniWrap.pm usr/lib/perl5/site_perl/5.12.3/PDF/API2/Util.pm diff --git a/config/rootfiles/core/115/filelists/perl-Font-TTF b/config/rootfiles/core/115/filelists/perl-Font-TTF new file mode 120000 index 0000000..6bb27c3 --- /dev/null +++ b/config/rootfiles/core/115/filelists/perl-Font-TTF @@ -0,0 +1 @@ +../../../common/perl-Font-TTF \ No newline at end of file diff --git a/config/rootfiles/core/115/filelists/perl-IO-String b/config/rootfiles/core/115/filelists/perl-IO-String new file mode 120000 index 0000000..2953e22 --- /dev/null +++ b/config/rootfiles/core/115/filelists/perl-IO-String @@ -0,0 +1 @@ +../../../common/perl-IO-String \ No newline at end of file diff --git a/config/rootfiles/core/115/filelists/perl-PDF-API2 b/config/rootfiles/core/115/filelists/perl-PDF-API2 new file mode 120000 index 0000000..8047841 --- /dev/null +++ b/config/rootfiles/core/115/filelists/perl-PDF-API2 @@ -0,0 +1 @@ +../../../common/perl-PDF-API2 \ No newline at end of file diff --git a/config/rootfiles/core/115/update.sh b/config/rootfiles/core/115/update.sh index 941f8df..61634a7 100644 --- a/config/rootfiles/core/115/update.sh +++ b/config/rootfiles/core/115/update.sh @@ -75,6 +75,10 @@ if grep -q "ENABLED=on" /var/ipfire/vpn/settings; then /etc/init.d/ipsec restart fi +# Let pakfire forget the perl-PDF-API2 package +rm -fv /opt/pakfire/db/rootfiles/perl-PDF-API2 +rm -fv /opt/pakfire/db/*/meta-perl-PDF-API2 + # This update need a reboot... #touch /var/run/need_reboot diff --git a/lfs/perl-Font-TTF b/lfs/perl-Font-TTF new file mode 100644 index 0000000..ea60a5e --- /dev/null +++ b/lfs/perl-Font-TTF @@ -0,0 +1,78 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2011 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 1.06 + +THISAPP = Font-TTF-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) + +TARGET = $(DIR_INFO)/$(THISAPP) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 241b59310ad4450e6e050d5e790f1b21 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && perl Makefile.PL + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/lfs/perl-IO-String b/lfs/perl-IO-String new file mode 100644 index 0000000..6bacfe2 --- /dev/null +++ b/lfs/perl-IO-String @@ -0,0 +1,78 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2011 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 1.08 + +THISAPP = IO-String-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) + +TARGET = $(DIR_INFO)/$(THISAPP) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 250e5424f290299fc3d6b5d1e9da3835 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && perl Makefile.PL + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/lfs/perl-PDF-API2 b/lfs/perl-PDF-API2 index 8b0af9a..a47a076 100644 --- a/lfs/perl-PDF-API2 +++ b/lfs/perl-PDF-API2 @@ -24,15 +24,14 @@ include Config -VER = 2.020 +VER = 2.033 THISAPP = PDF-API2-$(VER) DL_FILE = $(THISAPP).tar.gz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) + TARGET = $(DIR_INFO)/$(THISAPP) -PROG = perl-PDF-API2 -PAK_VER = 1 ############################################################################### # Top-level Rules @@ -42,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = c0d20bfd03883b5b2b2a7fd47455249a +$(DL_FILE)_MD5 = 4223a38add42741f996bd67d5f2f8e5b install : $(TARGET) @@ -52,9 +51,6 @@ download :$(patsubst %,$(DIR_DL)/%,$(objects)) md5 : $(subst %,%_MD5,$(objects)) -dist: - @$(PAK) - ############################################################################### # Downloading, checking, md5sum ############################################################################### diff --git a/lfs/squid-accounting b/lfs/squid-accounting index ff78d36..9bc75f0 100644 --- a/lfs/squid-accounting +++ b/lfs/squid-accounting @@ -15,9 +15,9 @@ THISAPP = squid-accounting-$(VER) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = squid-accounting -PAK_VER = 9 +PAK_VER = 10 -DEPS = "perl-DBI perl-DBD-SQLite perl-File-ReadBackwards perl-PDF-API2" +DEPS = "perl-DBI perl-DBD-SQLite perl-File-ReadBackwards" ############################################################################### # Top-level Rules diff --git a/make.sh b/make.sh index 790c6b8..5843527 100755 --- a/make.sh +++ b/make.sh @@ -866,6 +866,8 @@ buildipfire() { lfsmake2 owncloud lfsmake2 bacula lfsmake2 batctl + lfsmake2 perl-Font-TTF + lfsmake2 perl-IO-String lfsmake2 perl-PDF-API2 lfsmake2 squid-accounting lfsmake2 pigz hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. bee416e2829a5063819ee97f299482e4f894e9e5
by git＠ipfire.org 16 Oct '17

16 Oct '17

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. a10e6aaefe6cf2127b8b9f51ff45fef175f53e2c
by git＠ipfire.org 16 Oct '17

16 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via a10e6aaefe6cf2127b8b9f51ff45fef175f53e2c (commit) from de5862aaab0e73bffe32162de760b0f000d07d8f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a10e6aaefe6cf2127b8b9f51ff45fef175f53e2c Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 15:49:35 2017 +0100 KRACK attack: Patch wpa_supplicant & hostapd A vulnerability was found in how a number of implementations can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by replaying a specific frame that is used to manage the keys. Such reinstallation of the encryption key can result in two different types of vulnerabilities: disabling replay protection and significantly reducing the security of encryption to the point of allowing frames to be decrypted or some parts of the keys to be determined by an attacker depending on which cipher is used. This fixes: CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/hostapd | 12 +- lfs/wpa_supplicant | 11 + ...-Avoid-key-reinstallation-in-FT-handshake.patch | 174 ++++++++++++++ ...nstallation-of-an-already-in-use-group-ke.patch | 259 +++++++++++++++++++++ ...ection-of-GTK-IGTK-reinstallation-of-WNM-.patch | 193 +++++++++++++++ ...04-Prevent-installation-of-an-all-zero-TK.patch | 87 +++++++ ...Fix-PTK-rekeying-to-generate-a-new-ANonce.patch | 64 +++++ .../0006-TDLS-Reject-TPK-TK-reconfiguration.patch | 132 +++++++++++ ...WNM-Sleep-Mode-Response-without-pending-r.patch | 43 ++++ ...llow-multiple-Reassociation-Response-fram.patch | 82 +++++++ ...-Avoid-key-reinstallation-in-FT-handshake.patch | 174 ++++++++++++++ ...nstallation-of-an-already-in-use-group-ke.patch | 250 ++++++++++++++++++++ ...ection-of-GTK-IGTK-reinstallation-of-WNM-.patch | 184 +++++++++++++++ ...04-Prevent-installation-of-an-all-zero-TK.patch | 79 +++++++ ...Fix-PTK-rekeying-to-generate-a-new-ANonce.patch | 64 +++++ ...6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch | 132 +++++++++++ ...WNM-Sleep-Mode-Response-without-pending-r.patch | 43 ++++ ...llow-multiple-Reassociation-Response-fram.patch | 82 +++++++ 18 files changed, 2064 insertions(+), 1 deletion(-) create mode 100644 src/patches/wpa_supplicant/0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch create mode 100644 src/patches/wpa_supplicant/0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch create mode 100644 src/patches/wpa_supplicant/0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch create mode 100644 src/patches/wpa_supplicant/0004-Prevent-installation-of-an-all-zero-TK.patch create mode 100644 src/patches/wpa_supplicant/0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch create mode 100644 src/patches/wpa_supplicant/0006-TDLS-Reject-TPK-TK-reconfiguration.patch create mode 100644 src/patches/wpa_supplicant/0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch create mode 100644 src/patches/wpa_supplicant/0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch Difference in files: diff --git a/lfs/hostapd b/lfs/hostapd index 11b4d1c..3561c78 100644 --- a/lfs/hostapd +++ b/lfs/hostapd @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = hostapd -PAK_VER = 39 +PAK_VER = 40 DEPS = "" @@ -77,6 +77,16 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + + # Security Patches https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-message… + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/hostapd-2.3_increase_EAPOL-timeouts.patch cd $(DIR_APP)/hostapd && cp $(DIR_SRC)/config/hostapd/config ./.config cd $(DIR_APP)/hostapd && sed -e "s@/usr/local@/usr@g" -i Makefile diff --git a/lfs/wpa_supplicant b/lfs/wpa_supplicant index 76aa6c6..2bf427a 100644 --- a/lfs/wpa_supplicant +++ b/lfs/wpa_supplicant @@ -74,6 +74,17 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + + # Security Patches https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-message… + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch + cd $(DIR_APP)/wpa_supplicant && cp $(DIR_SRC)/config/wpa_supplicant/config ./.config cd $(DIR_APP)/wpa_supplicant && sed -e "s/wpa_cli\ dynamic_eap_methods/wpa_cli\ #dynamic_eap_methods/" -i Makefile cd $(DIR_APP)/wpa_supplicant && sed -e "s@/usr/local@/usr@g" -i Makefile diff --git a/src/patches/wpa_supplicant/0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch b/src/patches/wpa_supplicant/0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch new file mode 100644 index 0000000..9163083 --- /dev/null +++ b/src/patches/wpa_supplicant/0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch @@ -0,0 +1,174 @@ +From 3692833a62280a0270e4e1ba30f9acf5a8c8f808 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Fri, 14 Jul 2017 15:15:35 +0200 +Subject: [PATCH 1/8] hostapd: Avoid key reinstallation in FT handshake + +Do not reinstall TK to the driver during Reassociation Response frame +processing if the first attempt of setting the TK succeeded. This avoids +issues related to clearing the TX/RX PN that could result in reusing +same PN values for transmitted frames (e.g., due to CCM nonce reuse and +also hitting replay protection on the receiver) and accepting replayed +frames on RX side. + +This issue was introduced by the commit +0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in +authenticator') which allowed wpa_ft_install_ptk() to be called multiple +times with the same PTK. While the second configuration attempt is +needed with some drivers, it must be done only if the first attempt +failed. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/ap/ieee802_11.c | 16 +++++++++++++--- + src/ap/wpa_auth.c | 11 +++++++++++ + src/ap/wpa_auth.h | 3 ++- + src/ap/wpa_auth_ft.c | 10 ++++++++++ + src/ap/wpa_auth_i.h | 1 + + 5 files changed, 37 insertions(+), 4 deletions(-) + +diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c +index 5163139..174af8b 100644 +--- a/src/ap/ieee802_11.c ++++ b/src/ap/ieee802_11.c +@@ -2552,6 +2552,7 @@ static int add_associated_sta(struct hostapd_data *hapd, + { + struct ieee80211_ht_capabilities ht_cap; + struct ieee80211_vht_capabilities vht_cap; ++ int set = 1; + + /* + * Remove the STA entry to ensure the STA PS state gets cleared and +@@ -2559,9 +2560,18 @@ static int add_associated_sta(struct hostapd_data *hapd, + * FT-over-the-DS, where a station re-associates back to the same AP but + * skips the authentication flow, or if working with a driver that + * does not support full AP client state. ++ * ++ * Skip this if the STA has already completed FT reassociation and the ++ * TK has been configured since the TX/RX PN must not be reset to 0 for ++ * the same key. + */ +- if (!sta->added_unassoc) ++ if (!sta->added_unassoc && ++ (!(sta->flags & WLAN_STA_AUTHORIZED) || ++ !wpa_auth_sta_ft_tk_already_set(sta->wpa_sm))) { + hostapd_drv_sta_remove(hapd, sta->addr); ++ wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED); ++ set = 0; ++ } + + #ifdef CONFIG_IEEE80211N + if (sta->flags & WLAN_STA_HT) +@@ -2584,11 +2594,11 @@ static int add_associated_sta(struct hostapd_data *hapd, + sta->flags & WLAN_STA_VHT ? &vht_cap : NULL, + sta->flags | WLAN_STA_ASSOC, sta->qosinfo, + sta->vht_opmode, sta->p2p_ie ? 1 : 0, +- sta->added_unassoc)) { ++ set)) { + hostapd_logger(hapd, sta->addr, + HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE, + "Could not %s STA to kernel driver", +- sta->added_unassoc ? "set" : "add"); ++ set ? "set" : "add"); + + if (sta->added_unassoc) { + hostapd_drv_sta_remove(hapd, sta->addr); +diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c +index aca687c..42ef0bf 100644 +--- a/src/ap/wpa_auth.c ++++ b/src/ap/wpa_auth.c +@@ -1785,6 +1785,9 @@ int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event) + #else /* CONFIG_FILS */ + break; + #endif /* CONFIG_FILS */ ++ case WPA_DRV_STA_REMOVED: ++ sm->tk_already_set = FALSE; ++ return 0; + } + + #ifdef CONFIG_IEEE80211R_AP +@@ -3939,6 +3942,14 @@ int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm) + } + + ++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm) ++{ ++ if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt)) ++ return 0; ++ return sm->tk_already_set; ++} ++ ++ + int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, + struct rsn_pmksa_cache_entry *entry) + { +diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h +index 5e8a4cc..f92f8b6 100644 +--- a/src/ap/wpa_auth.h ++++ b/src/ap/wpa_auth.h +@@ -300,7 +300,7 @@ void wpa_receive(struct wpa_authenticator *wpa_auth, + u8 *data, size_t data_len); + enum wpa_event { + WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH, +- WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_ASSOC_FILS ++ WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_ASSOC_FILS, WPA_DRV_STA_REMOVED + }; + void wpa_remove_ptk(struct wpa_state_machine *sm); + int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event); +@@ -313,6 +313,7 @@ int wpa_auth_pairwise_set(struct wpa_state_machine *sm); + int wpa_auth_get_pairwise(struct wpa_state_machine *sm); + int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm); + int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm); ++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm); + int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, + struct rsn_pmksa_cache_entry *entry); + struct rsn_pmksa_cache_entry * +diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c +index dd99db7..2120cfd 100644 +--- a/src/ap/wpa_auth_ft.c ++++ b/src/ap/wpa_auth_ft.c +@@ -1937,6 +1937,14 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) + return; + } + ++ if (sm->tk_already_set) { ++ /* Must avoid TK reconfiguration to prevent clearing of TX/RX ++ * PN in the driver */ ++ wpa_printf(MSG_DEBUG, ++ "FT: Do not re-install same PTK to the driver"); ++ return; ++ } ++ + /* FIX: add STA entry to kernel/driver here? The set_key will fail + * most likely without this.. At the moment, STA entry is added only + * after association has been completed. This function will be called +@@ -1949,6 +1957,7 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) + + /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */ + sm->pairwise_set = TRUE; ++ sm->tk_already_set = TRUE; + } + + +@@ -2152,6 +2161,7 @@ static int wpa_ft_process_auth_req(struct wpa_state_machine *sm, + + sm->pairwise = pairwise; + sm->PTK_valid = TRUE; ++ sm->tk_already_set = FALSE; + wpa_ft_install_ptk(sm); + + buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + +diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h +index 23d2af3..b779af7 100644 +--- a/src/ap/wpa_auth_i.h ++++ b/src/ap/wpa_auth_i.h +@@ -61,6 +61,7 @@ struct wpa_state_machine { + struct wpa_ptk PTK; + Boolean PTK_valid; + Boolean pairwise_set; ++ Boolean tk_already_set; + int keycount; + Boolean Pair; + struct wpa_key_replay_counter { +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch b/src/patches/wpa_supplicant/0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch new file mode 100644 index 0000000..e372e32 --- /dev/null +++ b/src/patches/wpa_supplicant/0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch @@ -0,0 +1,259 @@ +From cf62cadcadc68377d72e2238a0f06b21c0777f90 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Wed, 12 Jul 2017 16:03:24 +0200 +Subject: [PATCH 2/8] Prevent reinstallation of an already in-use group key + +Track the current GTK and IGTK that is in use and when receiving a +(possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do +not install the given key if it is already in use. This prevents an +attacker from trying to trick the client into resetting or lowering the +sequence counter associated to the group key. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/common/wpa_common.h | 11 +++++ + src/rsn_supp/wpa.c | 118 ++++++++++++++++++++++++++++++------------------ + src/rsn_supp/wpa_i.h | 4 ++ + 3 files changed, 88 insertions(+), 45 deletions(-) + +diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h +index cc8edf8..0872b12 100644 +--- a/src/common/wpa_common.h ++++ b/src/common/wpa_common.h +@@ -221,6 +221,17 @@ struct wpa_ptk { + size_t tk_len; + }; + ++struct wpa_gtk { ++ u8 gtk[WPA_GTK_MAX_LEN]; ++ size_t gtk_len; ++}; ++ ++#ifdef CONFIG_IEEE80211W ++struct wpa_igtk { ++ u8 igtk[WPA_IGTK_MAX_LEN]; ++ size_t igtk_len; ++}; ++#endif /* CONFIG_IEEE80211W */ + + /* WPA IE version 1 + * 00-50-f2:1 (OUI:OUI type) +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 739689d..5e5fb2a 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -800,6 +800,15 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + const u8 *_gtk = gd->gtk; + u8 gtk_buf[32]; + ++ /* Detect possible key reinstallation */ ++ if (sm->gtk.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", ++ gd->keyidx, gd->tx, gd->gtk_len); ++ return 0; ++ } ++ + wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len); + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)", +@@ -834,6 +843,9 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + } + os_memset(gtk_buf, 0, sizeof(gtk_buf)); + ++ sm->gtk.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ + return 0; + } + +@@ -940,6 +952,48 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + } + + ++#ifdef CONFIG_IEEE80211W ++static int wpa_supplicant_install_igtk(struct wpa_sm *sm, ++ const struct wpa_igtk_kde *igtk) ++{ ++ size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); ++ u16 keyidx = WPA_GET_LE16(igtk->keyid); ++ ++ /* Detect possible key reinstallation */ ++ if (sm->igtk.igtk_len == len && ++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", ++ keyidx); ++ return 0; ++ } ++ ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x", ++ keyidx, MAC2STR(igtk->pn)); ++ wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len); ++ if (keyidx > 4095) { ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, ++ "WPA: Invalid IGTK KeyID %d", keyidx); ++ return -1; ++ } ++ if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), ++ broadcast_ether_addr, ++ keyidx, 0, igtk->pn, sizeof(igtk->pn), ++ igtk->igtk, len) < 0) { ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, ++ "WPA: Failed to configure IGTK to the driver"); ++ return -1; ++ } ++ ++ sm->igtk.igtk_len = len; ++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ ++ return 0; ++} ++#endif /* CONFIG_IEEE80211W */ ++ ++ + static int ieee80211w_set_keys(struct wpa_sm *sm, + struct wpa_eapol_ie_parse *ie) + { +@@ -950,30 +1004,14 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, + if (ie->igtk) { + size_t len; + const struct wpa_igtk_kde *igtk; +- u16 keyidx; ++ + len = wpa_cipher_key_len(sm->mgmt_group_cipher); + if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len) + return -1; ++ + igtk = (const struct wpa_igtk_kde *) ie->igtk; +- keyidx = WPA_GET_LE16(igtk->keyid); +- wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d " +- "pn %02x%02x%02x%02x%02x%02x", +- keyidx, MAC2STR(igtk->pn)); +- wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", +- igtk->igtk, len); +- if (keyidx > 4095) { +- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, +- "WPA: Invalid IGTK KeyID %d", keyidx); +- return -1; +- } +- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), +- broadcast_ether_addr, +- keyidx, 0, igtk->pn, sizeof(igtk->pn), +- igtk->igtk, len) < 0) { +- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, +- "WPA: Failed to configure IGTK to the driver"); ++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) + return -1; +- } + } + + return 0; +@@ -2491,7 +2529,7 @@ void wpa_sm_deinit(struct wpa_sm *sm) + */ + void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + { +- int clear_ptk = 1; ++ int clear_keys = 1; + + if (sm == NULL) + return; +@@ -2517,7 +2555,7 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + /* Prepare for the next transition */ + wpa_ft_prepare_auth_request(sm, NULL); + +- clear_ptk = 0; ++ clear_keys = 0; + } + #endif /* CONFIG_IEEE80211R */ + #ifdef CONFIG_FILS +@@ -2527,11 +2565,11 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + * AUTHENTICATED state to get the EAPOL port Authorized. + */ + wpa_supplicant_key_neg_complete(sm, sm->bssid, 1); +- clear_ptk = 0; ++ clear_keys = 0; + } + #endif /* CONFIG_FILS */ + +- if (clear_ptk) { ++ if (clear_keys) { + /* + * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if + * this is not part of a Fast BSS Transition. +@@ -2541,6 +2579,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + sm->tptk_set = 0; + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); ++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++#ifdef CONFIG_IEEE80211W ++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++#endif /* CONFIG_IEEE80211W */ + } + + #ifdef CONFIG_TDLS +@@ -3117,6 +3159,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) + os_memset(sm->pmk, 0, sizeof(sm->pmk)); + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); ++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++#ifdef CONFIG_IEEE80211W ++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++#endif /* CONFIG_IEEE80211W */ + #ifdef CONFIG_IEEE80211R + os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); + os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0)); +@@ -3189,29 +3235,11 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + os_memset(&gd, 0, sizeof(gd)); + #ifdef CONFIG_IEEE80211W + } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) { +- struct wpa_igtk_kde igd; +- u16 keyidx; +- +- os_memset(&igd, 0, sizeof(igd)); +- keylen = wpa_cipher_key_len(sm->mgmt_group_cipher); +- os_memcpy(igd.keyid, buf + 2, 2); +- os_memcpy(igd.pn, buf + 4, 6); +- +- keyidx = WPA_GET_LE16(igd.keyid); +- os_memcpy(igd.igtk, buf + 10, keylen); +- +- wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)", +- igd.igtk, keylen); +- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), +- broadcast_ether_addr, +- keyidx, 0, igd.pn, sizeof(igd.pn), +- igd.igtk, keylen) < 0) { +- wpa_printf(MSG_DEBUG, "Failed to install the IGTK in " +- "WNM mode"); +- os_memset(&igd, 0, sizeof(igd)); ++ const struct wpa_igtk_kde *igtk; ++ ++ igtk = (const struct wpa_igtk_kde *) (buf + 2); ++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) + return -1; +- } +- os_memset(&igd, 0, sizeof(igd)); + #endif /* CONFIG_IEEE80211W */ + } else { + wpa_printf(MSG_DEBUG, "Unknown element id"); +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 82e1941..2827ed6 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -31,6 +31,10 @@ struct wpa_sm { + u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN]; + int rx_replay_counter_set; + u8 request_counter[WPA_REPLAY_COUNTER_LEN]; ++ struct wpa_gtk gtk; ++#ifdef CONFIG_IEEE80211W ++ struct wpa_igtk igtk; ++#endif /* CONFIG_IEEE80211W */ + + struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ + +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch b/src/patches/wpa_supplicant/0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch new file mode 100644 index 0000000..68059de --- /dev/null +++ b/src/patches/wpa_supplicant/0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch @@ -0,0 +1,193 @@ +From a0d426a662997b87095c87edc1d2bdc6e1c8fd11 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Sun, 1 Oct 2017 12:12:24 +0300 +Subject: [PATCH 3/8] Extend protection of GTK/IGTK reinstallation of WNM-Sleep + Mode cases + +This extends the protection to track last configured GTK/IGTK value +separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a +corner case where these two different mechanisms may get used when the +GTK/IGTK has changed and tracking a single value is not sufficient to +detect a possible key reconfiguration. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/wpa.c | 55 +++++++++++++++++++++++++++++++++++++--------------- + src/rsn_supp/wpa_i.h | 2 ++ + 2 files changed, 41 insertions(+), 16 deletions(-) + +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 5e5fb2a..3c8871d 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -795,14 +795,17 @@ struct wpa_gtk_data { + + static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + const struct wpa_gtk_data *gd, +- const u8 *key_rsc) ++ const u8 *key_rsc, int wnm_sleep) + { + const u8 *_gtk = gd->gtk; + u8 gtk_buf[32]; + + /* Detect possible key reinstallation */ +- if (sm->gtk.gtk_len == (size_t) gd->gtk_len && +- os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { ++ if ((sm->gtk.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) || ++ (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk, ++ sm->gtk_wnm_sleep.gtk_len) == 0)) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", + gd->keyidx, gd->tx, gd->gtk_len); +@@ -843,8 +846,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + } + os_memset(gtk_buf, 0, sizeof(gtk_buf)); + +- sm->gtk.gtk_len = gd->gtk_len; +- os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ if (wnm_sleep) { ++ sm->gtk_wnm_sleep.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk, ++ sm->gtk_wnm_sleep.gtk_len); ++ } else { ++ sm->gtk.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ } + + return 0; + } +@@ -938,7 +947,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + (wpa_supplicant_check_group_cipher(sm, sm->group_cipher, + gtk_len, gtk_len, + &gd.key_rsc_len, &gd.alg) || +- wpa_supplicant_install_gtk(sm, &gd, key_rsc))) { ++ wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "RSN: Failed to install GTK"); + os_memset(&gd, 0, sizeof(gd)); +@@ -954,14 +963,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + + #ifdef CONFIG_IEEE80211W + static int wpa_supplicant_install_igtk(struct wpa_sm *sm, +- const struct wpa_igtk_kde *igtk) ++ const struct wpa_igtk_kde *igtk, ++ int wnm_sleep) + { + size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); + u16 keyidx = WPA_GET_LE16(igtk->keyid); + + /* Detect possible key reinstallation */ +- if (sm->igtk.igtk_len == len && +- os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { ++ if ((sm->igtk.igtk_len == len && ++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) || ++ (sm->igtk_wnm_sleep.igtk_len == len && ++ os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk, ++ sm->igtk_wnm_sleep.igtk_len) == 0)) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", + keyidx); +@@ -986,8 +999,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm, + return -1; + } + +- sm->igtk.igtk_len = len; +- os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ if (wnm_sleep) { ++ sm->igtk_wnm_sleep.igtk_len = len; ++ os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk, ++ sm->igtk_wnm_sleep.igtk_len); ++ } else { ++ sm->igtk.igtk_len = len; ++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ } + + return 0; + } +@@ -1010,7 +1029,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, + return -1; + + igtk = (const struct wpa_igtk_kde *) ie->igtk; +- if (wpa_supplicant_install_igtk(sm, igtk) < 0) ++ if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0) + return -1; + } + +@@ -1659,7 +1678,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm, + if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc)) + key_rsc = null_rsc; + +- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) || ++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) || + wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0) + goto failed; + os_memset(&gd, 0, sizeof(gd)); +@@ -2580,8 +2599,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + sm->tptk_set = 0; + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); + os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); + #ifdef CONFIG_IEEE80211W + os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); + #endif /* CONFIG_IEEE80211W */ + } + +@@ -3160,8 +3181,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); + os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); + #ifdef CONFIG_IEEE80211W + os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); + #endif /* CONFIG_IEEE80211W */ + #ifdef CONFIG_IEEE80211R + os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); +@@ -3226,7 +3249,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + + wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)", + gd.gtk, gd.gtk_len); +- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) { ++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) { + os_memset(&gd, 0, sizeof(gd)); + wpa_printf(MSG_DEBUG, "Failed to install the GTK in " + "WNM mode"); +@@ -3238,7 +3261,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + const struct wpa_igtk_kde *igtk; + + igtk = (const struct wpa_igtk_kde *) (buf + 2); +- if (wpa_supplicant_install_igtk(sm, igtk) < 0) ++ if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0) + return -1; + #endif /* CONFIG_IEEE80211W */ + } else { +@@ -4132,7 +4155,7 @@ int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len) + os_memcpy(gd.gtk, kde.gtk + 2, kde.gtk_len - 2); + + wpa_printf(MSG_DEBUG, "FILS: Set GTK to driver"); +- if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery) < 0) { ++ if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery, 0) < 0) { + wpa_printf(MSG_DEBUG, "FILS: Failed to set GTK"); + goto fail; + } +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 2827ed6..156e6cb 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -32,8 +32,10 @@ struct wpa_sm { + int rx_replay_counter_set; + u8 request_counter[WPA_REPLAY_COUNTER_LEN]; + struct wpa_gtk gtk; ++ struct wpa_gtk gtk_wnm_sleep; + #ifdef CONFIG_IEEE80211W + struct wpa_igtk igtk; ++ struct wpa_igtk igtk_wnm_sleep; + #endif /* CONFIG_IEEE80211W */ + + struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0004-Prevent-installation-of-an-all-zero-TK.patch b/src/patches/wpa_supplicant/0004-Prevent-installation-of-an-all-zero-TK.patch new file mode 100644 index 0000000..e3bfccb --- /dev/null +++ b/src/patches/wpa_supplicant/0004-Prevent-installation-of-an-all-zero-TK.patch @@ -0,0 +1,87 @@ +From 327b6d780f2667e99e9b74d4c064531c0208b22b Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Fri, 29 Sep 2017 04:22:51 +0200 +Subject: [PATCH 4/8] Prevent installation of an all-zero TK + +Properly track whether a PTK has already been installed to the driver +and the TK part cleared from memory. This prevents an attacker from +trying to trick the client into installing an all-zero TK. + +This fixes the earlier fix in commit +ad00d64e7d8827b3cebd665a0ceb08adabf15e1e ('Fix TK configuration to the +driver in EAPOL-Key 3/4 retry case') which did not take into account +possibility of an extra message 1/4 showing up between retries of +message 3/4. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/common/wpa_common.h | 1 + + src/rsn_supp/wpa.c | 6 +++--- + src/rsn_supp/wpa_i.h | 1 - + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h +index 0872b12..8411686 100644 +--- a/src/common/wpa_common.h ++++ b/src/common/wpa_common.h +@@ -219,6 +219,7 @@ struct wpa_ptk { + size_t kck_len; + size_t kek_len; + size_t tk_len; ++ int installed; /* 1 if key has already been installed to driver */ + }; + + struct wpa_gtk { +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 3c8871d..cf9bf1c 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -594,7 +594,6 @@ static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm, + os_memset(buf, 0, sizeof(buf)); + } + sm->tptk_set = 1; +- sm->tk_to_set = 1; + + kde = sm->assoc_wpa_ie; + kde_len = sm->assoc_wpa_ie_len; +@@ -701,7 +700,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, + enum wpa_alg alg; + const u8 *key_rsc; + +- if (!sm->tk_to_set) { ++ if (sm->ptk.installed) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Do not re-install same PTK to the driver"); + return 0; +@@ -745,7 +744,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, + + /* TK is not needed anymore in supplicant */ + os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN); +- sm->tk_to_set = 0; ++ sm->ptk.installed = 1; + + if (sm->wpa_ptk_rekey) { + eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL); +@@ -4183,6 +4182,7 @@ int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len) + * takes care of association frame encryption/decryption. */ + /* TK is not needed anymore in supplicant */ + os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN); ++ sm->ptk.installed = 1; + + /* FILS HLP Container */ + fils_process_hlp_container(sm, ie_start, end - ie_start); +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 156e6cb..3b42245 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -24,7 +24,6 @@ struct wpa_sm { + struct wpa_ptk ptk, tptk; + int ptk_set, tptk_set; + unsigned int msg_3_of_4_ok:1; +- unsigned int tk_to_set:1; + u8 snonce[WPA_NONCE_LEN]; + u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */ + int renew_snonce; +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch b/src/patches/wpa_supplicant/0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch new file mode 100644 index 0000000..b019152 --- /dev/null +++ b/src/patches/wpa_supplicant/0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch @@ -0,0 +1,64 @@ +From f1800cce24e8f81e909a68fe8ef1f13abfdec9e3 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Sun, 1 Oct 2017 12:32:57 +0300 +Subject: [PATCH 5/8] Fix PTK rekeying to generate a new ANonce + +The Authenticator state machine path for PTK rekeying ended up bypassing +the AUTHENTICATION2 state where a new ANonce is generated when going +directly to the PTKSTART state since there is no need to try to +determine the PMK again in such a case. This is far from ideal since the +new PTK would depend on a new nonce only from the supplicant. + +Fix this by generating a new ANonce when moving to the PTKSTART state +for the purpose of starting new 4-way handshake to rekey PTK. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/ap/wpa_auth.c | 24 +++++++++++++++++++++--- + 1 file changed, 21 insertions(+), 3 deletions(-) + +diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c +index 42ef0bf..3b2f97c 100644 +--- a/src/ap/wpa_auth.c ++++ b/src/ap/wpa_auth.c +@@ -1953,6 +1953,21 @@ SM_STATE(WPA_PTK, AUTHENTICATION2) + } + + ++static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm) ++{ ++ if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { ++ wpa_printf(MSG_ERROR, ++ "WPA: Failed to get random data for ANonce"); ++ sm->Disconnect = TRUE; ++ return -1; ++ } ++ wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce, ++ WPA_NONCE_LEN); ++ sm->TimeoutCtr = 0; ++ return 0; ++} ++ ++ + SM_STATE(WPA_PTK, INITPMK) + { + u8 msk[2 * PMK_LEN]; +@@ -3129,9 +3144,12 @@ SM_STEP(WPA_PTK) + SM_ENTER(WPA_PTK, AUTHENTICATION); + else if (sm->ReAuthenticationRequest) + SM_ENTER(WPA_PTK, AUTHENTICATION2); +- else if (sm->PTKRequest) +- SM_ENTER(WPA_PTK, PTKSTART); +- else switch (sm->wpa_ptk_state) { ++ else if (sm->PTKRequest) { ++ if (wpa_auth_sm_ptk_update(sm) < 0) ++ SM_ENTER(WPA_PTK, DISCONNECTED); ++ else ++ SM_ENTER(WPA_PTK, PTKSTART); ++ } else switch (sm->wpa_ptk_state) { + case WPA_PTK_INITIALIZE: + break; + case WPA_PTK_DISCONNECT: +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0006-TDLS-Reject-TPK-TK-reconfiguration.patch b/src/patches/wpa_supplicant/0006-TDLS-Reject-TPK-TK-reconfiguration.patch new file mode 100644 index 0000000..d857e50 --- /dev/null +++ b/src/patches/wpa_supplicant/0006-TDLS-Reject-TPK-TK-reconfiguration.patch @@ -0,0 +1,132 @@ +From 1b198fae80a4c97ecf358fe825c0488d6ac0e65e Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 11:03:15 +0300 +Subject: [PATCH 6/8] TDLS: Reject TPK-TK reconfiguration + +Do not try to reconfigure the same TPK-TK to the driver after it has +been successfully configured. This is an explicit check to avoid issues +related to resetting the TX/RX packet number. There was already a check +for this for TPK M2 (retries of that message are ignored completely), so +that behavior does not get modified. + +For TPK M3, the TPK-TK could have been reconfigured, but that was +followed by immediate teardown of the link due to an issue in updating +the STA entry. Furthermore, for TDLS with any real security (i.e., +ignoring open/WEP), the TPK message exchange is protected on the AP path +and simple replay attacks are not feasible. + +As an additional corner case, make sure the local nonce gets updated if +the peer uses a very unlikely "random nonce" of all zeros. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/tdls.c | 38 ++++++++++++++++++++++++++++++++++++-- + 1 file changed, 36 insertions(+), 2 deletions(-) + +diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c +index 7c95bed..5e350ed 100644 +--- a/src/rsn_supp/tdls.c ++++ b/src/rsn_supp/tdls.c +@@ -112,6 +112,7 @@ struct wpa_tdls_peer { + u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ + } tpk; + int tpk_set; ++ int tk_set; /* TPK-TK configured to the driver */ + int tpk_success; + int tpk_in_progress; + +@@ -192,6 +193,20 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + u8 rsc[6]; + enum wpa_alg alg; + ++ if (peer->tk_set) { ++ /* ++ * This same TPK-TK has already been configured to the driver ++ * and this new configuration attempt (likely due to an ++ * unexpected retransmitted frame) would result in clearing ++ * the TX/RX sequence number which can break security, so must ++ * not allow that to happen. ++ */ ++ wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR ++ " has already been configured to the driver - do not reconfigure", ++ MAC2STR(peer->addr)); ++ return -1; ++ } ++ + os_memset(rsc, 0, 6); + + switch (peer->cipher) { +@@ -209,12 +224,15 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + return -1; + } + ++ wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR, ++ MAC2STR(peer->addr)); + if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, + rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { + wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " + "driver"); + return -1; + } ++ peer->tk_set = 1; + return 0; + } + +@@ -693,7 +711,7 @@ static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + peer->cipher = 0; + peer->qos_info = 0; + peer->wmm_capable = 0; +- peer->tpk_set = peer->tpk_success = 0; ++ peer->tk_set = peer->tpk_set = peer->tpk_success = 0; + peer->chan_switch_enabled = 0; + os_memset(&peer->tpk, 0, sizeof(peer->tpk)); + os_memset(peer->inonce, 0, WPA_NONCE_LEN); +@@ -1156,6 +1174,7 @@ skip_rsnie: + wpa_tdls_peer_free(sm, peer); + return -1; + } ++ peer->tk_set = 0; /* A new nonce results in a new TK */ + wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", + peer->inonce, WPA_NONCE_LEN); + os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); +@@ -1749,6 +1768,19 @@ static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer, + } + + ++static int tdls_nonce_set(const u8 *nonce) ++{ ++ int i; ++ ++ for (i = 0; i < WPA_NONCE_LEN; i++) { ++ if (nonce[i]) ++ return 1; ++ } ++ ++ return 0; ++} ++ ++ + static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, + const u8 *buf, size_t len) + { +@@ -2002,7 +2034,8 @@ skip_rsn: + peer->rsnie_i_len = kde.rsn_ie_len; + peer->cipher = cipher; + +- if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { ++ if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 || ++ !tdls_nonce_set(peer->inonce)) { + /* + * There is no point in updating the RNonce for every obtained + * TPK M1 frame (e.g., retransmission due to timeout) with the +@@ -2018,6 +2051,7 @@ skip_rsn: + "TDLS: Failed to get random data for responder nonce"); + goto error; + } ++ peer->tk_set = 0; /* A new nonce results in a new TK */ + } + + #if 0 +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch b/src/patches/wpa_supplicant/0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch new file mode 100644 index 0000000..890eb34 --- /dev/null +++ b/src/patches/wpa_supplicant/0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch @@ -0,0 +1,43 @@ +From b839814391abb4f95486ef2e24eb5498267eccf5 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 11:25:02 +0300 +Subject: [PATCH 7/8] WNM: Ignore WNM-Sleep Mode Response without pending + request + +Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep +Mode Response if WNM-Sleep Mode has not been used') started ignoring the +response when no WNM-Sleep Mode Request had been used during the +association. This can be made tighter by clearing the used flag when +successfully processing a response. This adds an additional layer of +protection against unexpected retransmissions of the response frame. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + wpa_supplicant/wnm_sta.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c +index 7339ed2..28346ea 100644 +--- a/wpa_supplicant/wnm_sta.c ++++ b/wpa_supplicant/wnm_sta.c +@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, + + if (!wpa_s->wnmsleep_used) { + wpa_printf(MSG_DEBUG, +- "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association"); ++ "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested"); + return; + } + +@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, + return; + } + ++ wpa_s->wnmsleep_used = 0; ++ + if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT || + wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) { + wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response " +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch b/src/patches/wpa_supplicant/0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch new file mode 100644 index 0000000..e5c56b8 --- /dev/null +++ b/src/patches/wpa_supplicant/0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch @@ -0,0 +1,82 @@ +From dc55ea1e483125145459ae1e55be3b95e6263302 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 12:06:37 +0300 +Subject: [PATCH 8/8] FT: Do not allow multiple Reassociation Response frames + +The driver is expected to not report a second association event without +the station having explicitly request a new association. As such, this +case should not be reachable. However, since reconfiguring the same +pairwise or group keys to the driver could result in nonce reuse issues, +be extra careful here and do an additional state check to avoid this +even if the local driver ends up somehow accepting an unexpected +Reassociation Response frame. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/wpa.c | 3 +++ + src/rsn_supp/wpa_ft.c | 8 ++++++++ + src/rsn_supp/wpa_i.h | 1 + + 3 files changed, 12 insertions(+) + +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index cf9bf1c..ed467e6 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -2637,6 +2637,9 @@ void wpa_sm_notify_disassoc(struct wpa_sm *sm) + #ifdef CONFIG_FILS + sm->fils_completed = 0; + #endif /* CONFIG_FILS */ ++#ifdef CONFIG_IEEE80211R ++ sm->ft_reassoc_completed = 0; ++#endif /* CONFIG_IEEE80211R */ + + /* Keys are not needed in the WPA state machine anymore */ + wpa_sm_drop_sa(sm); +diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c +index aeb7aff..1ff7afe 100644 +--- a/src/rsn_supp/wpa_ft.c ++++ b/src/rsn_supp/wpa_ft.c +@@ -153,6 +153,7 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len, + u16 capab; + + sm->ft_completed = 0; ++ sm->ft_reassoc_completed = 0; + + buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + + 2 + sm->r0kh_id_len + ric_ies_len + 100; +@@ -687,6 +688,11 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, + return -1; + } + ++ if (sm->ft_reassoc_completed) { ++ wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission"); ++ return 0; ++ } ++ + if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) { + wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs"); + return -1; +@@ -787,6 +793,8 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, + return -1; + } + ++ sm->ft_reassoc_completed = 1; ++ + if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0) + return -1; + +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 3b42245..148c654 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -128,6 +128,7 @@ struct wpa_sm { + size_t r0kh_id_len; + u8 r1kh_id[FT_R1KH_ID_LEN]; + int ft_completed; ++ int ft_reassoc_completed; + int over_the_ds_in_progress; + u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */ + int set_ptk_after_assoc; +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch b/src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch new file mode 100644 index 0000000..7276848 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch @@ -0,0 +1,174 @@ +From cf4cab804c7afd5c45505528a8d16e46163243a2 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Fri, 14 Jul 2017 15:15:35 +0200 +Subject: [PATCH 1/8] hostapd: Avoid key reinstallation in FT handshake + +Do not reinstall TK to the driver during Reassociation Response frame +processing if the first attempt of setting the TK succeeded. This avoids +issues related to clearing the TX/RX PN that could result in reusing +same PN values for transmitted frames (e.g., due to CCM nonce reuse and +also hitting replay protection on the receiver) and accepting replayed +frames on RX side. + +This issue was introduced by the commit +0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in +authenticator') which allowed wpa_ft_install_ptk() to be called multiple +times with the same PTK. While the second configuration attempt is +needed with some drivers, it must be done only if the first attempt +failed. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/ap/ieee802_11.c | 16 +++++++++++++--- + src/ap/wpa_auth.c | 11 +++++++++++ + src/ap/wpa_auth.h | 3 ++- + src/ap/wpa_auth_ft.c | 10 ++++++++++ + src/ap/wpa_auth_i.h | 1 + + 5 files changed, 37 insertions(+), 4 deletions(-) + +diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c +index 4e04169..333035f 100644 +--- a/src/ap/ieee802_11.c ++++ b/src/ap/ieee802_11.c +@@ -1841,6 +1841,7 @@ static int add_associated_sta(struct hostapd_data *hapd, + { + struct ieee80211_ht_capabilities ht_cap; + struct ieee80211_vht_capabilities vht_cap; ++ int set = 1; + + /* + * Remove the STA entry to ensure the STA PS state gets cleared and +@@ -1848,9 +1849,18 @@ static int add_associated_sta(struct hostapd_data *hapd, + * FT-over-the-DS, where a station re-associates back to the same AP but + * skips the authentication flow, or if working with a driver that + * does not support full AP client state. ++ * ++ * Skip this if the STA has already completed FT reassociation and the ++ * TK has been configured since the TX/RX PN must not be reset to 0 for ++ * the same key. + */ +- if (!sta->added_unassoc) ++ if (!sta->added_unassoc && ++ (!(sta->flags & WLAN_STA_AUTHORIZED) || ++ !wpa_auth_sta_ft_tk_already_set(sta->wpa_sm))) { + hostapd_drv_sta_remove(hapd, sta->addr); ++ wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED); ++ set = 0; ++ } + + #ifdef CONFIG_IEEE80211N + if (sta->flags & WLAN_STA_HT) +@@ -1873,11 +1883,11 @@ static int add_associated_sta(struct hostapd_data *hapd, + sta->flags & WLAN_STA_VHT ? &vht_cap : NULL, + sta->flags | WLAN_STA_ASSOC, sta->qosinfo, + sta->vht_opmode, sta->p2p_ie ? 1 : 0, +- sta->added_unassoc)) { ++ set)) { + hostapd_logger(hapd, sta->addr, + HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE, + "Could not %s STA to kernel driver", +- sta->added_unassoc ? "set" : "add"); ++ set ? "set" : "add"); + + if (sta->added_unassoc) { + hostapd_drv_sta_remove(hapd, sta->addr); +diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c +index 3587086..707971d 100644 +--- a/src/ap/wpa_auth.c ++++ b/src/ap/wpa_auth.c +@@ -1745,6 +1745,9 @@ int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event) + #else /* CONFIG_IEEE80211R */ + break; + #endif /* CONFIG_IEEE80211R */ ++ case WPA_DRV_STA_REMOVED: ++ sm->tk_already_set = FALSE; ++ return 0; + } + + #ifdef CONFIG_IEEE80211R +@@ -3250,6 +3253,14 @@ int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm) + } + + ++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm) ++{ ++ if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt)) ++ return 0; ++ return sm->tk_already_set; ++} ++ ++ + int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, + struct rsn_pmksa_cache_entry *entry) + { +diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h +index 0de8d97..97461b0 100644 +--- a/src/ap/wpa_auth.h ++++ b/src/ap/wpa_auth.h +@@ -267,7 +267,7 @@ void wpa_receive(struct wpa_authenticator *wpa_auth, + u8 *data, size_t data_len); + enum wpa_event { + WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH, +- WPA_REAUTH_EAPOL, WPA_ASSOC_FT ++ WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_DRV_STA_REMOVED + }; + void wpa_remove_ptk(struct wpa_state_machine *sm); + int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event); +@@ -280,6 +280,7 @@ int wpa_auth_pairwise_set(struct wpa_state_machine *sm); + int wpa_auth_get_pairwise(struct wpa_state_machine *sm); + int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm); + int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm); ++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm); + int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, + struct rsn_pmksa_cache_entry *entry); + struct rsn_pmksa_cache_entry * +diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c +index 42242a5..e63b99a 100644 +--- a/src/ap/wpa_auth_ft.c ++++ b/src/ap/wpa_auth_ft.c +@@ -780,6 +780,14 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) + return; + } + ++ if (sm->tk_already_set) { ++ /* Must avoid TK reconfiguration to prevent clearing of TX/RX ++ * PN in the driver */ ++ wpa_printf(MSG_DEBUG, ++ "FT: Do not re-install same PTK to the driver"); ++ return; ++ } ++ + /* FIX: add STA entry to kernel/driver here? The set_key will fail + * most likely without this.. At the moment, STA entry is added only + * after association has been completed. This function will be called +@@ -792,6 +800,7 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) + + /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */ + sm->pairwise_set = TRUE; ++ sm->tk_already_set = TRUE; + } + + +@@ -898,6 +907,7 @@ static int wpa_ft_process_auth_req(struct wpa_state_machine *sm, + + sm->pairwise = pairwise; + sm->PTK_valid = TRUE; ++ sm->tk_already_set = FALSE; + wpa_ft_install_ptk(sm); + + buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + +diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h +index 72b7eb3..7fd8f05 100644 +--- a/src/ap/wpa_auth_i.h ++++ b/src/ap/wpa_auth_i.h +@@ -65,6 +65,7 @@ struct wpa_state_machine { + struct wpa_ptk PTK; + Boolean PTK_valid; + Boolean pairwise_set; ++ Boolean tk_already_set; + int keycount; + Boolean Pair; + struct wpa_key_replay_counter { +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch b/src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch new file mode 100644 index 0000000..1802d66 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch @@ -0,0 +1,250 @@ +From 927f891007c402fefd1ff384645b3f07597c3ede Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Wed, 12 Jul 2017 16:03:24 +0200 +Subject: [PATCH 2/8] Prevent reinstallation of an already in-use group key + +Track the current GTK and IGTK that is in use and when receiving a +(possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do +not install the given key if it is already in use. This prevents an +attacker from trying to trick the client into resetting or lowering the +sequence counter associated to the group key. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/common/wpa_common.h | 11 +++++ + src/rsn_supp/wpa.c | 116 ++++++++++++++++++++++++++++++------------------ + src/rsn_supp/wpa_i.h | 4 ++ + 3 files changed, 87 insertions(+), 44 deletions(-) + +diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h +index af1d0f0..d200285 100644 +--- a/src/common/wpa_common.h ++++ b/src/common/wpa_common.h +@@ -217,6 +217,17 @@ struct wpa_ptk { + size_t tk_len; + }; + ++struct wpa_gtk { ++ u8 gtk[WPA_GTK_MAX_LEN]; ++ size_t gtk_len; ++}; ++ ++#ifdef CONFIG_IEEE80211W ++struct wpa_igtk { ++ u8 igtk[WPA_IGTK_MAX_LEN]; ++ size_t igtk_len; ++}; ++#endif /* CONFIG_IEEE80211W */ + + /* WPA IE version 1 + * 00-50-f2:1 (OUI:OUI type) +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 3c47879..95bd7be 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -714,6 +714,15 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + const u8 *_gtk = gd->gtk; + u8 gtk_buf[32]; + ++ /* Detect possible key reinstallation */ ++ if (sm->gtk.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", ++ gd->keyidx, gd->tx, gd->gtk_len); ++ return 0; ++ } ++ + wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len); + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)", +@@ -748,6 +757,9 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + } + os_memset(gtk_buf, 0, sizeof(gtk_buf)); + ++ sm->gtk.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ + return 0; + } + +@@ -854,6 +866,48 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + } + + ++#ifdef CONFIG_IEEE80211W ++static int wpa_supplicant_install_igtk(struct wpa_sm *sm, ++ const struct wpa_igtk_kde *igtk) ++{ ++ size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); ++ u16 keyidx = WPA_GET_LE16(igtk->keyid); ++ ++ /* Detect possible key reinstallation */ ++ if (sm->igtk.igtk_len == len && ++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", ++ keyidx); ++ return 0; ++ } ++ ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x", ++ keyidx, MAC2STR(igtk->pn)); ++ wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len); ++ if (keyidx > 4095) { ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, ++ "WPA: Invalid IGTK KeyID %d", keyidx); ++ return -1; ++ } ++ if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), ++ broadcast_ether_addr, ++ keyidx, 0, igtk->pn, sizeof(igtk->pn), ++ igtk->igtk, len) < 0) { ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, ++ "WPA: Failed to configure IGTK to the driver"); ++ return -1; ++ } ++ ++ sm->igtk.igtk_len = len; ++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ ++ return 0; ++} ++#endif /* CONFIG_IEEE80211W */ ++ ++ + static int ieee80211w_set_keys(struct wpa_sm *sm, + struct wpa_eapol_ie_parse *ie) + { +@@ -864,30 +918,14 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, + if (ie->igtk) { + size_t len; + const struct wpa_igtk_kde *igtk; +- u16 keyidx; ++ + len = wpa_cipher_key_len(sm->mgmt_group_cipher); + if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len) + return -1; ++ + igtk = (const struct wpa_igtk_kde *) ie->igtk; +- keyidx = WPA_GET_LE16(igtk->keyid); +- wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d " +- "pn %02x%02x%02x%02x%02x%02x", +- keyidx, MAC2STR(igtk->pn)); +- wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", +- igtk->igtk, len); +- if (keyidx > 4095) { +- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, +- "WPA: Invalid IGTK KeyID %d", keyidx); +- return -1; +- } +- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), +- broadcast_ether_addr, +- keyidx, 0, igtk->pn, sizeof(igtk->pn), +- igtk->igtk, len) < 0) { +- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, +- "WPA: Failed to configure IGTK to the driver"); ++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) + return -1; +- } + } + + return 0; +@@ -2307,7 +2345,7 @@ void wpa_sm_deinit(struct wpa_sm *sm) + */ + void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + { +- int clear_ptk = 1; ++ int clear_keys = 1; + + if (sm == NULL) + return; +@@ -2333,11 +2371,11 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + /* Prepare for the next transition */ + wpa_ft_prepare_auth_request(sm, NULL); + +- clear_ptk = 0; ++ clear_keys = 0; + } + #endif /* CONFIG_IEEE80211R */ + +- if (clear_ptk) { ++ if (clear_keys) { + /* + * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if + * this is not part of a Fast BSS Transition. +@@ -2347,6 +2385,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + sm->tptk_set = 0; + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); ++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++#ifdef CONFIG_IEEE80211W ++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++#endif /* CONFIG_IEEE80211W */ + } + + #ifdef CONFIG_TDLS +@@ -2877,6 +2919,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) + os_memset(sm->pmk, 0, sizeof(sm->pmk)); + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); ++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++#ifdef CONFIG_IEEE80211W ++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++#endif /* CONFIG_IEEE80211W */ + #ifdef CONFIG_IEEE80211R + os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); + os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0)); +@@ -2949,29 +2995,11 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + os_memset(&gd, 0, sizeof(gd)); + #ifdef CONFIG_IEEE80211W + } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) { +- struct wpa_igtk_kde igd; +- u16 keyidx; +- +- os_memset(&igd, 0, sizeof(igd)); +- keylen = wpa_cipher_key_len(sm->mgmt_group_cipher); +- os_memcpy(igd.keyid, buf + 2, 2); +- os_memcpy(igd.pn, buf + 4, 6); +- +- keyidx = WPA_GET_LE16(igd.keyid); +- os_memcpy(igd.igtk, buf + 10, keylen); +- +- wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)", +- igd.igtk, keylen); +- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), +- broadcast_ether_addr, +- keyidx, 0, igd.pn, sizeof(igd.pn), +- igd.igtk, keylen) < 0) { +- wpa_printf(MSG_DEBUG, "Failed to install the IGTK in " +- "WNM mode"); +- os_memset(&igd, 0, sizeof(igd)); ++ const struct wpa_igtk_kde *igtk; ++ ++ igtk = (const struct wpa_igtk_kde *) (buf + 2); ++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) + return -1; +- } +- os_memset(&igd, 0, sizeof(igd)); + #endif /* CONFIG_IEEE80211W */ + } else { + wpa_printf(MSG_DEBUG, "Unknown element id"); +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index f653ba6..afc9e37 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -31,6 +31,10 @@ struct wpa_sm { + u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN]; + int rx_replay_counter_set; + u8 request_counter[WPA_REPLAY_COUNTER_LEN]; ++ struct wpa_gtk gtk; ++#ifdef CONFIG_IEEE80211W ++ struct wpa_igtk igtk; ++#endif /* CONFIG_IEEE80211W */ + + struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ + +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch b/src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch new file mode 100644 index 0000000..e2937b8 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch @@ -0,0 +1,184 @@ +From 8280294e74846ea342389a0cd17215050fa5afe8 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Sun, 1 Oct 2017 12:12:24 +0300 +Subject: [PATCH 3/8] Extend protection of GTK/IGTK reinstallation of WNM-Sleep + Mode cases + +This extends the protection to track last configured GTK/IGTK value +separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a +corner case where these two different mechanisms may get used when the +GTK/IGTK has changed and tracking a single value is not sufficient to +detect a possible key reconfiguration. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/wpa.c | 53 +++++++++++++++++++++++++++++++++++++--------------- + src/rsn_supp/wpa_i.h | 2 ++ + 2 files changed, 40 insertions(+), 15 deletions(-) + +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 95bd7be..7a2c68d 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -709,14 +709,17 @@ struct wpa_gtk_data { + + static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + const struct wpa_gtk_data *gd, +- const u8 *key_rsc) ++ const u8 *key_rsc, int wnm_sleep) + { + const u8 *_gtk = gd->gtk; + u8 gtk_buf[32]; + + /* Detect possible key reinstallation */ +- if (sm->gtk.gtk_len == (size_t) gd->gtk_len && +- os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { ++ if ((sm->gtk.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) || ++ (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk, ++ sm->gtk_wnm_sleep.gtk_len) == 0)) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", + gd->keyidx, gd->tx, gd->gtk_len); +@@ -757,8 +760,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + } + os_memset(gtk_buf, 0, sizeof(gtk_buf)); + +- sm->gtk.gtk_len = gd->gtk_len; +- os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ if (wnm_sleep) { ++ sm->gtk_wnm_sleep.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk, ++ sm->gtk_wnm_sleep.gtk_len); ++ } else { ++ sm->gtk.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ } + + return 0; + } +@@ -852,7 +861,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + (wpa_supplicant_check_group_cipher(sm, sm->group_cipher, + gtk_len, gtk_len, + &gd.key_rsc_len, &gd.alg) || +- wpa_supplicant_install_gtk(sm, &gd, key_rsc))) { ++ wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "RSN: Failed to install GTK"); + os_memset(&gd, 0, sizeof(gd)); +@@ -868,14 +877,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + + #ifdef CONFIG_IEEE80211W + static int wpa_supplicant_install_igtk(struct wpa_sm *sm, +- const struct wpa_igtk_kde *igtk) ++ const struct wpa_igtk_kde *igtk, ++ int wnm_sleep) + { + size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); + u16 keyidx = WPA_GET_LE16(igtk->keyid); + + /* Detect possible key reinstallation */ +- if (sm->igtk.igtk_len == len && +- os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { ++ if ((sm->igtk.igtk_len == len && ++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) || ++ (sm->igtk_wnm_sleep.igtk_len == len && ++ os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk, ++ sm->igtk_wnm_sleep.igtk_len) == 0)) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", + keyidx); +@@ -900,8 +913,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm, + return -1; + } + +- sm->igtk.igtk_len = len; +- os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ if (wnm_sleep) { ++ sm->igtk_wnm_sleep.igtk_len = len; ++ os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk, ++ sm->igtk_wnm_sleep.igtk_len); ++ } else { ++ sm->igtk.igtk_len = len; ++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ } + + return 0; + } +@@ -924,7 +943,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, + return -1; + + igtk = (const struct wpa_igtk_kde *) ie->igtk; +- if (wpa_supplicant_install_igtk(sm, igtk) < 0) ++ if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0) + return -1; + } + +@@ -1574,7 +1593,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm, + if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc)) + key_rsc = null_rsc; + +- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) || ++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) || + wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0) + goto failed; + os_memset(&gd, 0, sizeof(gd)); +@@ -2386,8 +2405,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + sm->tptk_set = 0; + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); + os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); + #ifdef CONFIG_IEEE80211W + os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); + #endif /* CONFIG_IEEE80211W */ + } + +@@ -2920,8 +2941,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); + os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); + #ifdef CONFIG_IEEE80211W + os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); + #endif /* CONFIG_IEEE80211W */ + #ifdef CONFIG_IEEE80211R + os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); +@@ -2986,7 +3009,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + + wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)", + gd.gtk, gd.gtk_len); +- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) { ++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) { + os_memset(&gd, 0, sizeof(gd)); + wpa_printf(MSG_DEBUG, "Failed to install the GTK in " + "WNM mode"); +@@ -2998,7 +3021,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + const struct wpa_igtk_kde *igtk; + + igtk = (const struct wpa_igtk_kde *) (buf + 2); +- if (wpa_supplicant_install_igtk(sm, igtk) < 0) ++ if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0) + return -1; + #endif /* CONFIG_IEEE80211W */ + } else { +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index afc9e37..9a54631 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -32,8 +32,10 @@ struct wpa_sm { + int rx_replay_counter_set; + u8 request_counter[WPA_REPLAY_COUNTER_LEN]; + struct wpa_gtk gtk; ++ struct wpa_gtk gtk_wnm_sleep; + #ifdef CONFIG_IEEE80211W + struct wpa_igtk igtk; ++ struct wpa_igtk igtk_wnm_sleep; + #endif /* CONFIG_IEEE80211W */ + + struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch b/src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch new file mode 100644 index 0000000..22ee217 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch @@ -0,0 +1,79 @@ +From 8f82bc94e8697a9d47fa8774dfdaaede1084912c Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Fri, 29 Sep 2017 04:22:51 +0200 +Subject: [PATCH 4/8] Prevent installation of an all-zero TK + +Properly track whether a PTK has already been installed to the driver +and the TK part cleared from memory. This prevents an attacker from +trying to trick the client into installing an all-zero TK. + +This fixes the earlier fix in commit +ad00d64e7d8827b3cebd665a0ceb08adabf15e1e ('Fix TK configuration to the +driver in EAPOL-Key 3/4 retry case') which did not take into account +possibility of an extra message 1/4 showing up between retries of +message 3/4. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/common/wpa_common.h | 1 + + src/rsn_supp/wpa.c | 5 ++--- + src/rsn_supp/wpa_i.h | 1 - + 3 files changed, 3 insertions(+), 4 deletions(-) + +diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h +index d200285..1021ccb 100644 +--- a/src/common/wpa_common.h ++++ b/src/common/wpa_common.h +@@ -215,6 +215,7 @@ struct wpa_ptk { + size_t kck_len; + size_t kek_len; + size_t tk_len; ++ int installed; /* 1 if key has already been installed to driver */ + }; + + struct wpa_gtk { +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 7a2c68d..0550a41 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -510,7 +510,6 @@ static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm, + os_memset(buf, 0, sizeof(buf)); + } + sm->tptk_set = 1; +- sm->tk_to_set = 1; + + kde = sm->assoc_wpa_ie; + kde_len = sm->assoc_wpa_ie_len; +@@ -615,7 +614,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, + enum wpa_alg alg; + const u8 *key_rsc; + +- if (!sm->tk_to_set) { ++ if (sm->ptk.installed) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Do not re-install same PTK to the driver"); + return 0; +@@ -659,7 +658,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, + + /* TK is not needed anymore in supplicant */ + os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN); +- sm->tk_to_set = 0; ++ sm->ptk.installed = 1; + + if (sm->wpa_ptk_rekey) { + eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL); +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 9a54631..41f371f 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -24,7 +24,6 @@ struct wpa_sm { + struct wpa_ptk ptk, tptk; + int ptk_set, tptk_set; + unsigned int msg_3_of_4_ok:1; +- unsigned int tk_to_set:1; + u8 snonce[WPA_NONCE_LEN]; + u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */ + int renew_snonce; +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch b/src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch new file mode 100644 index 0000000..c19c4c7 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch @@ -0,0 +1,64 @@ +From 12fac09b437a1dc8a0f253e265934a8aaf4d2f8b Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Sun, 1 Oct 2017 12:32:57 +0300 +Subject: [PATCH 5/8] Fix PTK rekeying to generate a new ANonce + +The Authenticator state machine path for PTK rekeying ended up bypassing +the AUTHENTICATION2 state where a new ANonce is generated when going +directly to the PTKSTART state since there is no need to try to +determine the PMK again in such a case. This is far from ideal since the +new PTK would depend on a new nonce only from the supplicant. + +Fix this by generating a new ANonce when moving to the PTKSTART state +for the purpose of starting new 4-way handshake to rekey PTK. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/ap/wpa_auth.c | 24 +++++++++++++++++++++--- + 1 file changed, 21 insertions(+), 3 deletions(-) + +diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c +index 707971d..bf10cc1 100644 +--- a/src/ap/wpa_auth.c ++++ b/src/ap/wpa_auth.c +@@ -1901,6 +1901,21 @@ SM_STATE(WPA_PTK, AUTHENTICATION2) + } + + ++static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm) ++{ ++ if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { ++ wpa_printf(MSG_ERROR, ++ "WPA: Failed to get random data for ANonce"); ++ sm->Disconnect = TRUE; ++ return -1; ++ } ++ wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce, ++ WPA_NONCE_LEN); ++ sm->TimeoutCtr = 0; ++ return 0; ++} ++ ++ + SM_STATE(WPA_PTK, INITPMK) + { + u8 msk[2 * PMK_LEN]; +@@ -2458,9 +2473,12 @@ SM_STEP(WPA_PTK) + SM_ENTER(WPA_PTK, AUTHENTICATION); + else if (sm->ReAuthenticationRequest) + SM_ENTER(WPA_PTK, AUTHENTICATION2); +- else if (sm->PTKRequest) +- SM_ENTER(WPA_PTK, PTKSTART); +- else switch (sm->wpa_ptk_state) { ++ else if (sm->PTKRequest) { ++ if (wpa_auth_sm_ptk_update(sm) < 0) ++ SM_ENTER(WPA_PTK, DISCONNECTED); ++ else ++ SM_ENTER(WPA_PTK, PTKSTART); ++ } else switch (sm->wpa_ptk_state) { + case WPA_PTK_INITIALIZE: + break; + case WPA_PTK_DISCONNECT: +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch b/src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch new file mode 100644 index 0000000..e1bd5a5 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch @@ -0,0 +1,132 @@ +From 6c4bed4f47d1960ec04981a9d50e5076aea5223d Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 11:03:15 +0300 +Subject: [PATCH 6/8] TDLS: Reject TPK-TK reconfiguration + +Do not try to reconfigure the same TPK-TK to the driver after it has +been successfully configured. This is an explicit check to avoid issues +related to resetting the TX/RX packet number. There was already a check +for this for TPK M2 (retries of that message are ignored completely), so +that behavior does not get modified. + +For TPK M3, the TPK-TK could have been reconfigured, but that was +followed by immediate teardown of the link due to an issue in updating +the STA entry. Furthermore, for TDLS with any real security (i.e., +ignoring open/WEP), the TPK message exchange is protected on the AP path +and simple replay attacks are not feasible. + +As an additional corner case, make sure the local nonce gets updated if +the peer uses a very unlikely "random nonce" of all zeros. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/tdls.c | 38 ++++++++++++++++++++++++++++++++++++-- + 1 file changed, 36 insertions(+), 2 deletions(-) + +diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c +index e424168..9eb9738 100644 +--- a/src/rsn_supp/tdls.c ++++ b/src/rsn_supp/tdls.c +@@ -112,6 +112,7 @@ struct wpa_tdls_peer { + u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ + } tpk; + int tpk_set; ++ int tk_set; /* TPK-TK configured to the driver */ + int tpk_success; + int tpk_in_progress; + +@@ -192,6 +193,20 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + u8 rsc[6]; + enum wpa_alg alg; + ++ if (peer->tk_set) { ++ /* ++ * This same TPK-TK has already been configured to the driver ++ * and this new configuration attempt (likely due to an ++ * unexpected retransmitted frame) would result in clearing ++ * the TX/RX sequence number which can break security, so must ++ * not allow that to happen. ++ */ ++ wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR ++ " has already been configured to the driver - do not reconfigure", ++ MAC2STR(peer->addr)); ++ return -1; ++ } ++ + os_memset(rsc, 0, 6); + + switch (peer->cipher) { +@@ -209,12 +224,15 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + return -1; + } + ++ wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR, ++ MAC2STR(peer->addr)); + if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, + rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { + wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " + "driver"); + return -1; + } ++ peer->tk_set = 1; + return 0; + } + +@@ -696,7 +714,7 @@ static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + peer->cipher = 0; + peer->qos_info = 0; + peer->wmm_capable = 0; +- peer->tpk_set = peer->tpk_success = 0; ++ peer->tk_set = peer->tpk_set = peer->tpk_success = 0; + peer->chan_switch_enabled = 0; + os_memset(&peer->tpk, 0, sizeof(peer->tpk)); + os_memset(peer->inonce, 0, WPA_NONCE_LEN); +@@ -1159,6 +1177,7 @@ skip_rsnie: + wpa_tdls_peer_free(sm, peer); + return -1; + } ++ peer->tk_set = 0; /* A new nonce results in a new TK */ + wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", + peer->inonce, WPA_NONCE_LEN); + os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); +@@ -1751,6 +1770,19 @@ static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer, + } + + ++static int tdls_nonce_set(const u8 *nonce) ++{ ++ int i; ++ ++ for (i = 0; i < WPA_NONCE_LEN; i++) { ++ if (nonce[i]) ++ return 1; ++ } ++ ++ return 0; ++} ++ ++ + static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, + const u8 *buf, size_t len) + { +@@ -2004,7 +2036,8 @@ skip_rsn: + peer->rsnie_i_len = kde.rsn_ie_len; + peer->cipher = cipher; + +- if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { ++ if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 || ++ !tdls_nonce_set(peer->inonce)) { + /* + * There is no point in updating the RNonce for every obtained + * TPK M1 frame (e.g., retransmission due to timeout) with the +@@ -2020,6 +2053,7 @@ skip_rsn: + "TDLS: Failed to get random data for responder nonce"); + goto error; + } ++ peer->tk_set = 0; /* A new nonce results in a new TK */ + } + + #if 0 +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch b/src/patches/wpa_supplicant/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch new file mode 100644 index 0000000..85ea1d6 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch @@ -0,0 +1,43 @@ +From 53c5eb58e95004f86e65ee9fbfccbc291b139057 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 11:25:02 +0300 +Subject: [PATCH 7/8] WNM: Ignore WNM-Sleep Mode Response without pending + request + +Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep +Mode Response if WNM-Sleep Mode has not been used') started ignoring the +response when no WNM-Sleep Mode Request had been used during the +association. This can be made tighter by clearing the used flag when +successfully processing a response. This adds an additional layer of +protection against unexpected retransmissions of the response frame. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + wpa_supplicant/wnm_sta.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c +index 1b3409c..67a07ff 100644 +--- a/wpa_supplicant/wnm_sta.c ++++ b/wpa_supplicant/wnm_sta.c +@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, + + if (!wpa_s->wnmsleep_used) { + wpa_printf(MSG_DEBUG, +- "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association"); ++ "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested"); + return; + } + +@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, + return; + } + ++ wpa_s->wnmsleep_used = 0; ++ + if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT || + wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) { + wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response " +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch b/src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch new file mode 100644 index 0000000..b9678f6 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch @@ -0,0 +1,82 @@ +From b372ab0b7daea719749194dc554b26e6367603f2 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 12:06:37 +0300 +Subject: [PATCH 8/8] FT: Do not allow multiple Reassociation Response frames + +The driver is expected to not report a second association event without +the station having explicitly request a new association. As such, this +case should not be reachable. However, since reconfiguring the same +pairwise or group keys to the driver could result in nonce reuse issues, +be extra careful here and do an additional state check to avoid this +even if the local driver ends up somehow accepting an unexpected +Reassociation Response frame. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/wpa.c | 3 +++ + src/rsn_supp/wpa_ft.c | 8 ++++++++ + src/rsn_supp/wpa_i.h | 1 + + 3 files changed, 12 insertions(+) + +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 0550a41..2a53c6f 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -2440,6 +2440,9 @@ void wpa_sm_notify_disassoc(struct wpa_sm *sm) + #ifdef CONFIG_TDLS + wpa_tdls_disassoc(sm); + #endif /* CONFIG_TDLS */ ++#ifdef CONFIG_IEEE80211R ++ sm->ft_reassoc_completed = 0; ++#endif /* CONFIG_IEEE80211R */ + + /* Keys are not needed in the WPA state machine anymore */ + wpa_sm_drop_sa(sm); +diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c +index 205793e..d45bb45 100644 +--- a/src/rsn_supp/wpa_ft.c ++++ b/src/rsn_supp/wpa_ft.c +@@ -153,6 +153,7 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len, + u16 capab; + + sm->ft_completed = 0; ++ sm->ft_reassoc_completed = 0; + + buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + + 2 + sm->r0kh_id_len + ric_ies_len + 100; +@@ -681,6 +682,11 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, + return -1; + } + ++ if (sm->ft_reassoc_completed) { ++ wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission"); ++ return 0; ++ } ++ + if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) { + wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs"); + return -1; +@@ -781,6 +787,8 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, + return -1; + } + ++ sm->ft_reassoc_completed = 1; ++ + if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0) + return -1; + +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 41f371f..56f88dc 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -128,6 +128,7 @@ struct wpa_sm { + size_t r0kh_id_len; + u8 r1kh_id[FT_R1KH_ID_LEN]; + int ft_completed; ++ int ft_reassoc_completed; + int over_the_ds_in_progress; + u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */ + int set_ptk_after_assoc; +-- +2.7.4 + hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. d7d5774529358c4ccbfc841f7ac1726d384a6bc9
by git＠ipfire.org 16 Oct '17

16 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via d7d5774529358c4ccbfc841f7ac1726d384a6bc9 (commit) from a54350cdb9d56691644486a49b7e5b7594d8d504 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d7d5774529358c4ccbfc841f7ac1726d384a6bc9 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 15:49:35 2017 +0100 KRACK attack: Patch wpa_supplicant & hostapd A vulnerability was found in how a number of implementations can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by replaying a specific frame that is used to manage the keys. Such reinstallation of the encryption key can result in two different types of vulnerabilities: disabling replay protection and significantly reducing the security of encryption to the point of allowing frames to be decrypted or some parts of the keys to be determined by an attacker depending on which cipher is used. This fixes: CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/hostapd | 12 +- lfs/wpa_supplicant | 11 + ...-Avoid-key-reinstallation-in-FT-handshake.patch | 174 ++++++++++++++ ...nstallation-of-an-already-in-use-group-ke.patch | 259 +++++++++++++++++++++ ...ection-of-GTK-IGTK-reinstallation-of-WNM-.patch | 193 +++++++++++++++ ...04-Prevent-installation-of-an-all-zero-TK.patch | 87 +++++++ ...Fix-PTK-rekeying-to-generate-a-new-ANonce.patch | 64 +++++ .../0006-TDLS-Reject-TPK-TK-reconfiguration.patch | 132 +++++++++++ ...WNM-Sleep-Mode-Response-without-pending-r.patch | 43 ++++ ...llow-multiple-Reassociation-Response-fram.patch | 82 +++++++ ...-Avoid-key-reinstallation-in-FT-handshake.patch | 174 ++++++++++++++ ...nstallation-of-an-already-in-use-group-ke.patch | 250 ++++++++++++++++++++ ...ection-of-GTK-IGTK-reinstallation-of-WNM-.patch | 184 +++++++++++++++ ...04-Prevent-installation-of-an-all-zero-TK.patch | 79 +++++++ ...Fix-PTK-rekeying-to-generate-a-new-ANonce.patch | 64 +++++ ...6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch | 132 +++++++++++ ...WNM-Sleep-Mode-Response-without-pending-r.patch | 43 ++++ ...llow-multiple-Reassociation-Response-fram.patch | 82 +++++++ 18 files changed, 2064 insertions(+), 1 deletion(-) create mode 100644 src/patches/wpa_supplicant/0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch create mode 100644 src/patches/wpa_supplicant/0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch create mode 100644 src/patches/wpa_supplicant/0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch create mode 100644 src/patches/wpa_supplicant/0004-Prevent-installation-of-an-all-zero-TK.patch create mode 100644 src/patches/wpa_supplicant/0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch create mode 100644 src/patches/wpa_supplicant/0006-TDLS-Reject-TPK-TK-reconfiguration.patch create mode 100644 src/patches/wpa_supplicant/0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch create mode 100644 src/patches/wpa_supplicant/0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch create mode 100644 src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch Difference in files: diff --git a/lfs/hostapd b/lfs/hostapd index 11b4d1c..3561c78 100644 --- a/lfs/hostapd +++ b/lfs/hostapd @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = hostapd -PAK_VER = 39 +PAK_VER = 40 DEPS = "" @@ -77,6 +77,16 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + + # Security Patches https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-message… + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/hostapd-2.3_increase_EAPOL-timeouts.patch cd $(DIR_APP)/hostapd && cp $(DIR_SRC)/config/hostapd/config ./.config cd $(DIR_APP)/hostapd && sed -e "s@/usr/local@/usr@g" -i Makefile diff --git a/lfs/wpa_supplicant b/lfs/wpa_supplicant index 02e78ea..32cecfd 100644 --- a/lfs/wpa_supplicant +++ b/lfs/wpa_supplicant @@ -74,6 +74,17 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + + # Security Patches https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-message… + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch + cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch + cd $(DIR_APP)/wpa_supplicant && cp $(DIR_SRC)/config/wpa_supplicant/config ./.config cd $(DIR_APP)/wpa_supplicant && sed -e "s/wpa_cli\ dynamic_eap_methods/wpa_cli\ #dynamic_eap_methods/" -i Makefile cd $(DIR_APP)/wpa_supplicant && sed -e "s@/usr/local@/usr@g" -i Makefile diff --git a/src/patches/wpa_supplicant/0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch b/src/patches/wpa_supplicant/0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch new file mode 100644 index 0000000..9163083 --- /dev/null +++ b/src/patches/wpa_supplicant/0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch @@ -0,0 +1,174 @@ +From 3692833a62280a0270e4e1ba30f9acf5a8c8f808 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Fri, 14 Jul 2017 15:15:35 +0200 +Subject: [PATCH 1/8] hostapd: Avoid key reinstallation in FT handshake + +Do not reinstall TK to the driver during Reassociation Response frame +processing if the first attempt of setting the TK succeeded. This avoids +issues related to clearing the TX/RX PN that could result in reusing +same PN values for transmitted frames (e.g., due to CCM nonce reuse and +also hitting replay protection on the receiver) and accepting replayed +frames on RX side. + +This issue was introduced by the commit +0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in +authenticator') which allowed wpa_ft_install_ptk() to be called multiple +times with the same PTK. While the second configuration attempt is +needed with some drivers, it must be done only if the first attempt +failed. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/ap/ieee802_11.c | 16 +++++++++++++--- + src/ap/wpa_auth.c | 11 +++++++++++ + src/ap/wpa_auth.h | 3 ++- + src/ap/wpa_auth_ft.c | 10 ++++++++++ + src/ap/wpa_auth_i.h | 1 + + 5 files changed, 37 insertions(+), 4 deletions(-) + +diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c +index 5163139..174af8b 100644 +--- a/src/ap/ieee802_11.c ++++ b/src/ap/ieee802_11.c +@@ -2552,6 +2552,7 @@ static int add_associated_sta(struct hostapd_data *hapd, + { + struct ieee80211_ht_capabilities ht_cap; + struct ieee80211_vht_capabilities vht_cap; ++ int set = 1; + + /* + * Remove the STA entry to ensure the STA PS state gets cleared and +@@ -2559,9 +2560,18 @@ static int add_associated_sta(struct hostapd_data *hapd, + * FT-over-the-DS, where a station re-associates back to the same AP but + * skips the authentication flow, or if working with a driver that + * does not support full AP client state. ++ * ++ * Skip this if the STA has already completed FT reassociation and the ++ * TK has been configured since the TX/RX PN must not be reset to 0 for ++ * the same key. + */ +- if (!sta->added_unassoc) ++ if (!sta->added_unassoc && ++ (!(sta->flags & WLAN_STA_AUTHORIZED) || ++ !wpa_auth_sta_ft_tk_already_set(sta->wpa_sm))) { + hostapd_drv_sta_remove(hapd, sta->addr); ++ wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED); ++ set = 0; ++ } + + #ifdef CONFIG_IEEE80211N + if (sta->flags & WLAN_STA_HT) +@@ -2584,11 +2594,11 @@ static int add_associated_sta(struct hostapd_data *hapd, + sta->flags & WLAN_STA_VHT ? &vht_cap : NULL, + sta->flags | WLAN_STA_ASSOC, sta->qosinfo, + sta->vht_opmode, sta->p2p_ie ? 1 : 0, +- sta->added_unassoc)) { ++ set)) { + hostapd_logger(hapd, sta->addr, + HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE, + "Could not %s STA to kernel driver", +- sta->added_unassoc ? "set" : "add"); ++ set ? "set" : "add"); + + if (sta->added_unassoc) { + hostapd_drv_sta_remove(hapd, sta->addr); +diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c +index aca687c..42ef0bf 100644 +--- a/src/ap/wpa_auth.c ++++ b/src/ap/wpa_auth.c +@@ -1785,6 +1785,9 @@ int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event) + #else /* CONFIG_FILS */ + break; + #endif /* CONFIG_FILS */ ++ case WPA_DRV_STA_REMOVED: ++ sm->tk_already_set = FALSE; ++ return 0; + } + + #ifdef CONFIG_IEEE80211R_AP +@@ -3939,6 +3942,14 @@ int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm) + } + + ++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm) ++{ ++ if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt)) ++ return 0; ++ return sm->tk_already_set; ++} ++ ++ + int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, + struct rsn_pmksa_cache_entry *entry) + { +diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h +index 5e8a4cc..f92f8b6 100644 +--- a/src/ap/wpa_auth.h ++++ b/src/ap/wpa_auth.h +@@ -300,7 +300,7 @@ void wpa_receive(struct wpa_authenticator *wpa_auth, + u8 *data, size_t data_len); + enum wpa_event { + WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH, +- WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_ASSOC_FILS ++ WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_ASSOC_FILS, WPA_DRV_STA_REMOVED + }; + void wpa_remove_ptk(struct wpa_state_machine *sm); + int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event); +@@ -313,6 +313,7 @@ int wpa_auth_pairwise_set(struct wpa_state_machine *sm); + int wpa_auth_get_pairwise(struct wpa_state_machine *sm); + int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm); + int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm); ++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm); + int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, + struct rsn_pmksa_cache_entry *entry); + struct rsn_pmksa_cache_entry * +diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c +index dd99db7..2120cfd 100644 +--- a/src/ap/wpa_auth_ft.c ++++ b/src/ap/wpa_auth_ft.c +@@ -1937,6 +1937,14 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) + return; + } + ++ if (sm->tk_already_set) { ++ /* Must avoid TK reconfiguration to prevent clearing of TX/RX ++ * PN in the driver */ ++ wpa_printf(MSG_DEBUG, ++ "FT: Do not re-install same PTK to the driver"); ++ return; ++ } ++ + /* FIX: add STA entry to kernel/driver here? The set_key will fail + * most likely without this.. At the moment, STA entry is added only + * after association has been completed. This function will be called +@@ -1949,6 +1957,7 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) + + /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */ + sm->pairwise_set = TRUE; ++ sm->tk_already_set = TRUE; + } + + +@@ -2152,6 +2161,7 @@ static int wpa_ft_process_auth_req(struct wpa_state_machine *sm, + + sm->pairwise = pairwise; + sm->PTK_valid = TRUE; ++ sm->tk_already_set = FALSE; + wpa_ft_install_ptk(sm); + + buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + +diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h +index 23d2af3..b779af7 100644 +--- a/src/ap/wpa_auth_i.h ++++ b/src/ap/wpa_auth_i.h +@@ -61,6 +61,7 @@ struct wpa_state_machine { + struct wpa_ptk PTK; + Boolean PTK_valid; + Boolean pairwise_set; ++ Boolean tk_already_set; + int keycount; + Boolean Pair; + struct wpa_key_replay_counter { +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch b/src/patches/wpa_supplicant/0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch new file mode 100644 index 0000000..e372e32 --- /dev/null +++ b/src/patches/wpa_supplicant/0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch @@ -0,0 +1,259 @@ +From cf62cadcadc68377d72e2238a0f06b21c0777f90 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Wed, 12 Jul 2017 16:03:24 +0200 +Subject: [PATCH 2/8] Prevent reinstallation of an already in-use group key + +Track the current GTK and IGTK that is in use and when receiving a +(possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do +not install the given key if it is already in use. This prevents an +attacker from trying to trick the client into resetting or lowering the +sequence counter associated to the group key. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/common/wpa_common.h | 11 +++++ + src/rsn_supp/wpa.c | 118 ++++++++++++++++++++++++++++++------------------ + src/rsn_supp/wpa_i.h | 4 ++ + 3 files changed, 88 insertions(+), 45 deletions(-) + +diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h +index cc8edf8..0872b12 100644 +--- a/src/common/wpa_common.h ++++ b/src/common/wpa_common.h +@@ -221,6 +221,17 @@ struct wpa_ptk { + size_t tk_len; + }; + ++struct wpa_gtk { ++ u8 gtk[WPA_GTK_MAX_LEN]; ++ size_t gtk_len; ++}; ++ ++#ifdef CONFIG_IEEE80211W ++struct wpa_igtk { ++ u8 igtk[WPA_IGTK_MAX_LEN]; ++ size_t igtk_len; ++}; ++#endif /* CONFIG_IEEE80211W */ + + /* WPA IE version 1 + * 00-50-f2:1 (OUI:OUI type) +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 739689d..5e5fb2a 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -800,6 +800,15 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + const u8 *_gtk = gd->gtk; + u8 gtk_buf[32]; + ++ /* Detect possible key reinstallation */ ++ if (sm->gtk.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", ++ gd->keyidx, gd->tx, gd->gtk_len); ++ return 0; ++ } ++ + wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len); + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)", +@@ -834,6 +843,9 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + } + os_memset(gtk_buf, 0, sizeof(gtk_buf)); + ++ sm->gtk.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ + return 0; + } + +@@ -940,6 +952,48 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + } + + ++#ifdef CONFIG_IEEE80211W ++static int wpa_supplicant_install_igtk(struct wpa_sm *sm, ++ const struct wpa_igtk_kde *igtk) ++{ ++ size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); ++ u16 keyidx = WPA_GET_LE16(igtk->keyid); ++ ++ /* Detect possible key reinstallation */ ++ if (sm->igtk.igtk_len == len && ++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", ++ keyidx); ++ return 0; ++ } ++ ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x", ++ keyidx, MAC2STR(igtk->pn)); ++ wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len); ++ if (keyidx > 4095) { ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, ++ "WPA: Invalid IGTK KeyID %d", keyidx); ++ return -1; ++ } ++ if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), ++ broadcast_ether_addr, ++ keyidx, 0, igtk->pn, sizeof(igtk->pn), ++ igtk->igtk, len) < 0) { ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, ++ "WPA: Failed to configure IGTK to the driver"); ++ return -1; ++ } ++ ++ sm->igtk.igtk_len = len; ++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ ++ return 0; ++} ++#endif /* CONFIG_IEEE80211W */ ++ ++ + static int ieee80211w_set_keys(struct wpa_sm *sm, + struct wpa_eapol_ie_parse *ie) + { +@@ -950,30 +1004,14 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, + if (ie->igtk) { + size_t len; + const struct wpa_igtk_kde *igtk; +- u16 keyidx; ++ + len = wpa_cipher_key_len(sm->mgmt_group_cipher); + if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len) + return -1; ++ + igtk = (const struct wpa_igtk_kde *) ie->igtk; +- keyidx = WPA_GET_LE16(igtk->keyid); +- wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d " +- "pn %02x%02x%02x%02x%02x%02x", +- keyidx, MAC2STR(igtk->pn)); +- wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", +- igtk->igtk, len); +- if (keyidx > 4095) { +- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, +- "WPA: Invalid IGTK KeyID %d", keyidx); +- return -1; +- } +- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), +- broadcast_ether_addr, +- keyidx, 0, igtk->pn, sizeof(igtk->pn), +- igtk->igtk, len) < 0) { +- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, +- "WPA: Failed to configure IGTK to the driver"); ++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) + return -1; +- } + } + + return 0; +@@ -2491,7 +2529,7 @@ void wpa_sm_deinit(struct wpa_sm *sm) + */ + void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + { +- int clear_ptk = 1; ++ int clear_keys = 1; + + if (sm == NULL) + return; +@@ -2517,7 +2555,7 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + /* Prepare for the next transition */ + wpa_ft_prepare_auth_request(sm, NULL); + +- clear_ptk = 0; ++ clear_keys = 0; + } + #endif /* CONFIG_IEEE80211R */ + #ifdef CONFIG_FILS +@@ -2527,11 +2565,11 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + * AUTHENTICATED state to get the EAPOL port Authorized. + */ + wpa_supplicant_key_neg_complete(sm, sm->bssid, 1); +- clear_ptk = 0; ++ clear_keys = 0; + } + #endif /* CONFIG_FILS */ + +- if (clear_ptk) { ++ if (clear_keys) { + /* + * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if + * this is not part of a Fast BSS Transition. +@@ -2541,6 +2579,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + sm->tptk_set = 0; + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); ++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++#ifdef CONFIG_IEEE80211W ++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++#endif /* CONFIG_IEEE80211W */ + } + + #ifdef CONFIG_TDLS +@@ -3117,6 +3159,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) + os_memset(sm->pmk, 0, sizeof(sm->pmk)); + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); ++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++#ifdef CONFIG_IEEE80211W ++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++#endif /* CONFIG_IEEE80211W */ + #ifdef CONFIG_IEEE80211R + os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); + os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0)); +@@ -3189,29 +3235,11 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + os_memset(&gd, 0, sizeof(gd)); + #ifdef CONFIG_IEEE80211W + } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) { +- struct wpa_igtk_kde igd; +- u16 keyidx; +- +- os_memset(&igd, 0, sizeof(igd)); +- keylen = wpa_cipher_key_len(sm->mgmt_group_cipher); +- os_memcpy(igd.keyid, buf + 2, 2); +- os_memcpy(igd.pn, buf + 4, 6); +- +- keyidx = WPA_GET_LE16(igd.keyid); +- os_memcpy(igd.igtk, buf + 10, keylen); +- +- wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)", +- igd.igtk, keylen); +- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), +- broadcast_ether_addr, +- keyidx, 0, igd.pn, sizeof(igd.pn), +- igd.igtk, keylen) < 0) { +- wpa_printf(MSG_DEBUG, "Failed to install the IGTK in " +- "WNM mode"); +- os_memset(&igd, 0, sizeof(igd)); ++ const struct wpa_igtk_kde *igtk; ++ ++ igtk = (const struct wpa_igtk_kde *) (buf + 2); ++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) + return -1; +- } +- os_memset(&igd, 0, sizeof(igd)); + #endif /* CONFIG_IEEE80211W */ + } else { + wpa_printf(MSG_DEBUG, "Unknown element id"); +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 82e1941..2827ed6 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -31,6 +31,10 @@ struct wpa_sm { + u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN]; + int rx_replay_counter_set; + u8 request_counter[WPA_REPLAY_COUNTER_LEN]; ++ struct wpa_gtk gtk; ++#ifdef CONFIG_IEEE80211W ++ struct wpa_igtk igtk; ++#endif /* CONFIG_IEEE80211W */ + + struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ + +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch b/src/patches/wpa_supplicant/0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch new file mode 100644 index 0000000..68059de --- /dev/null +++ b/src/patches/wpa_supplicant/0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch @@ -0,0 +1,193 @@ +From a0d426a662997b87095c87edc1d2bdc6e1c8fd11 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Sun, 1 Oct 2017 12:12:24 +0300 +Subject: [PATCH 3/8] Extend protection of GTK/IGTK reinstallation of WNM-Sleep + Mode cases + +This extends the protection to track last configured GTK/IGTK value +separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a +corner case where these two different mechanisms may get used when the +GTK/IGTK has changed and tracking a single value is not sufficient to +detect a possible key reconfiguration. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/wpa.c | 55 +++++++++++++++++++++++++++++++++++++--------------- + src/rsn_supp/wpa_i.h | 2 ++ + 2 files changed, 41 insertions(+), 16 deletions(-) + +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 5e5fb2a..3c8871d 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -795,14 +795,17 @@ struct wpa_gtk_data { + + static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + const struct wpa_gtk_data *gd, +- const u8 *key_rsc) ++ const u8 *key_rsc, int wnm_sleep) + { + const u8 *_gtk = gd->gtk; + u8 gtk_buf[32]; + + /* Detect possible key reinstallation */ +- if (sm->gtk.gtk_len == (size_t) gd->gtk_len && +- os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { ++ if ((sm->gtk.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) || ++ (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk, ++ sm->gtk_wnm_sleep.gtk_len) == 0)) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", + gd->keyidx, gd->tx, gd->gtk_len); +@@ -843,8 +846,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + } + os_memset(gtk_buf, 0, sizeof(gtk_buf)); + +- sm->gtk.gtk_len = gd->gtk_len; +- os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ if (wnm_sleep) { ++ sm->gtk_wnm_sleep.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk, ++ sm->gtk_wnm_sleep.gtk_len); ++ } else { ++ sm->gtk.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ } + + return 0; + } +@@ -938,7 +947,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + (wpa_supplicant_check_group_cipher(sm, sm->group_cipher, + gtk_len, gtk_len, + &gd.key_rsc_len, &gd.alg) || +- wpa_supplicant_install_gtk(sm, &gd, key_rsc))) { ++ wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "RSN: Failed to install GTK"); + os_memset(&gd, 0, sizeof(gd)); +@@ -954,14 +963,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + + #ifdef CONFIG_IEEE80211W + static int wpa_supplicant_install_igtk(struct wpa_sm *sm, +- const struct wpa_igtk_kde *igtk) ++ const struct wpa_igtk_kde *igtk, ++ int wnm_sleep) + { + size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); + u16 keyidx = WPA_GET_LE16(igtk->keyid); + + /* Detect possible key reinstallation */ +- if (sm->igtk.igtk_len == len && +- os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { ++ if ((sm->igtk.igtk_len == len && ++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) || ++ (sm->igtk_wnm_sleep.igtk_len == len && ++ os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk, ++ sm->igtk_wnm_sleep.igtk_len) == 0)) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", + keyidx); +@@ -986,8 +999,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm, + return -1; + } + +- sm->igtk.igtk_len = len; +- os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ if (wnm_sleep) { ++ sm->igtk_wnm_sleep.igtk_len = len; ++ os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk, ++ sm->igtk_wnm_sleep.igtk_len); ++ } else { ++ sm->igtk.igtk_len = len; ++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ } + + return 0; + } +@@ -1010,7 +1029,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, + return -1; + + igtk = (const struct wpa_igtk_kde *) ie->igtk; +- if (wpa_supplicant_install_igtk(sm, igtk) < 0) ++ if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0) + return -1; + } + +@@ -1659,7 +1678,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm, + if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc)) + key_rsc = null_rsc; + +- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) || ++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) || + wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0) + goto failed; + os_memset(&gd, 0, sizeof(gd)); +@@ -2580,8 +2599,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + sm->tptk_set = 0; + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); + os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); + #ifdef CONFIG_IEEE80211W + os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); + #endif /* CONFIG_IEEE80211W */ + } + +@@ -3160,8 +3181,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); + os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); + #ifdef CONFIG_IEEE80211W + os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); + #endif /* CONFIG_IEEE80211W */ + #ifdef CONFIG_IEEE80211R + os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); +@@ -3226,7 +3249,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + + wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)", + gd.gtk, gd.gtk_len); +- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) { ++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) { + os_memset(&gd, 0, sizeof(gd)); + wpa_printf(MSG_DEBUG, "Failed to install the GTK in " + "WNM mode"); +@@ -3238,7 +3261,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + const struct wpa_igtk_kde *igtk; + + igtk = (const struct wpa_igtk_kde *) (buf + 2); +- if (wpa_supplicant_install_igtk(sm, igtk) < 0) ++ if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0) + return -1; + #endif /* CONFIG_IEEE80211W */ + } else { +@@ -4132,7 +4155,7 @@ int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len) + os_memcpy(gd.gtk, kde.gtk + 2, kde.gtk_len - 2); + + wpa_printf(MSG_DEBUG, "FILS: Set GTK to driver"); +- if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery) < 0) { ++ if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery, 0) < 0) { + wpa_printf(MSG_DEBUG, "FILS: Failed to set GTK"); + goto fail; + } +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 2827ed6..156e6cb 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -32,8 +32,10 @@ struct wpa_sm { + int rx_replay_counter_set; + u8 request_counter[WPA_REPLAY_COUNTER_LEN]; + struct wpa_gtk gtk; ++ struct wpa_gtk gtk_wnm_sleep; + #ifdef CONFIG_IEEE80211W + struct wpa_igtk igtk; ++ struct wpa_igtk igtk_wnm_sleep; + #endif /* CONFIG_IEEE80211W */ + + struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0004-Prevent-installation-of-an-all-zero-TK.patch b/src/patches/wpa_supplicant/0004-Prevent-installation-of-an-all-zero-TK.patch new file mode 100644 index 0000000..e3bfccb --- /dev/null +++ b/src/patches/wpa_supplicant/0004-Prevent-installation-of-an-all-zero-TK.patch @@ -0,0 +1,87 @@ +From 327b6d780f2667e99e9b74d4c064531c0208b22b Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Fri, 29 Sep 2017 04:22:51 +0200 +Subject: [PATCH 4/8] Prevent installation of an all-zero TK + +Properly track whether a PTK has already been installed to the driver +and the TK part cleared from memory. This prevents an attacker from +trying to trick the client into installing an all-zero TK. + +This fixes the earlier fix in commit +ad00d64e7d8827b3cebd665a0ceb08adabf15e1e ('Fix TK configuration to the +driver in EAPOL-Key 3/4 retry case') which did not take into account +possibility of an extra message 1/4 showing up between retries of +message 3/4. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/common/wpa_common.h | 1 + + src/rsn_supp/wpa.c | 6 +++--- + src/rsn_supp/wpa_i.h | 1 - + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h +index 0872b12..8411686 100644 +--- a/src/common/wpa_common.h ++++ b/src/common/wpa_common.h +@@ -219,6 +219,7 @@ struct wpa_ptk { + size_t kck_len; + size_t kek_len; + size_t tk_len; ++ int installed; /* 1 if key has already been installed to driver */ + }; + + struct wpa_gtk { +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 3c8871d..cf9bf1c 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -594,7 +594,6 @@ static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm, + os_memset(buf, 0, sizeof(buf)); + } + sm->tptk_set = 1; +- sm->tk_to_set = 1; + + kde = sm->assoc_wpa_ie; + kde_len = sm->assoc_wpa_ie_len; +@@ -701,7 +700,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, + enum wpa_alg alg; + const u8 *key_rsc; + +- if (!sm->tk_to_set) { ++ if (sm->ptk.installed) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Do not re-install same PTK to the driver"); + return 0; +@@ -745,7 +744,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, + + /* TK is not needed anymore in supplicant */ + os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN); +- sm->tk_to_set = 0; ++ sm->ptk.installed = 1; + + if (sm->wpa_ptk_rekey) { + eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL); +@@ -4183,6 +4182,7 @@ int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len) + * takes care of association frame encryption/decryption. */ + /* TK is not needed anymore in supplicant */ + os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN); ++ sm->ptk.installed = 1; + + /* FILS HLP Container */ + fils_process_hlp_container(sm, ie_start, end - ie_start); +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 156e6cb..3b42245 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -24,7 +24,6 @@ struct wpa_sm { + struct wpa_ptk ptk, tptk; + int ptk_set, tptk_set; + unsigned int msg_3_of_4_ok:1; +- unsigned int tk_to_set:1; + u8 snonce[WPA_NONCE_LEN]; + u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */ + int renew_snonce; +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch b/src/patches/wpa_supplicant/0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch new file mode 100644 index 0000000..b019152 --- /dev/null +++ b/src/patches/wpa_supplicant/0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch @@ -0,0 +1,64 @@ +From f1800cce24e8f81e909a68fe8ef1f13abfdec9e3 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Sun, 1 Oct 2017 12:32:57 +0300 +Subject: [PATCH 5/8] Fix PTK rekeying to generate a new ANonce + +The Authenticator state machine path for PTK rekeying ended up bypassing +the AUTHENTICATION2 state where a new ANonce is generated when going +directly to the PTKSTART state since there is no need to try to +determine the PMK again in such a case. This is far from ideal since the +new PTK would depend on a new nonce only from the supplicant. + +Fix this by generating a new ANonce when moving to the PTKSTART state +for the purpose of starting new 4-way handshake to rekey PTK. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/ap/wpa_auth.c | 24 +++++++++++++++++++++--- + 1 file changed, 21 insertions(+), 3 deletions(-) + +diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c +index 42ef0bf..3b2f97c 100644 +--- a/src/ap/wpa_auth.c ++++ b/src/ap/wpa_auth.c +@@ -1953,6 +1953,21 @@ SM_STATE(WPA_PTK, AUTHENTICATION2) + } + + ++static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm) ++{ ++ if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { ++ wpa_printf(MSG_ERROR, ++ "WPA: Failed to get random data for ANonce"); ++ sm->Disconnect = TRUE; ++ return -1; ++ } ++ wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce, ++ WPA_NONCE_LEN); ++ sm->TimeoutCtr = 0; ++ return 0; ++} ++ ++ + SM_STATE(WPA_PTK, INITPMK) + { + u8 msk[2 * PMK_LEN]; +@@ -3129,9 +3144,12 @@ SM_STEP(WPA_PTK) + SM_ENTER(WPA_PTK, AUTHENTICATION); + else if (sm->ReAuthenticationRequest) + SM_ENTER(WPA_PTK, AUTHENTICATION2); +- else if (sm->PTKRequest) +- SM_ENTER(WPA_PTK, PTKSTART); +- else switch (sm->wpa_ptk_state) { ++ else if (sm->PTKRequest) { ++ if (wpa_auth_sm_ptk_update(sm) < 0) ++ SM_ENTER(WPA_PTK, DISCONNECTED); ++ else ++ SM_ENTER(WPA_PTK, PTKSTART); ++ } else switch (sm->wpa_ptk_state) { + case WPA_PTK_INITIALIZE: + break; + case WPA_PTK_DISCONNECT: +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0006-TDLS-Reject-TPK-TK-reconfiguration.patch b/src/patches/wpa_supplicant/0006-TDLS-Reject-TPK-TK-reconfiguration.patch new file mode 100644 index 0000000..d857e50 --- /dev/null +++ b/src/patches/wpa_supplicant/0006-TDLS-Reject-TPK-TK-reconfiguration.patch @@ -0,0 +1,132 @@ +From 1b198fae80a4c97ecf358fe825c0488d6ac0e65e Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 11:03:15 +0300 +Subject: [PATCH 6/8] TDLS: Reject TPK-TK reconfiguration + +Do not try to reconfigure the same TPK-TK to the driver after it has +been successfully configured. This is an explicit check to avoid issues +related to resetting the TX/RX packet number. There was already a check +for this for TPK M2 (retries of that message are ignored completely), so +that behavior does not get modified. + +For TPK M3, the TPK-TK could have been reconfigured, but that was +followed by immediate teardown of the link due to an issue in updating +the STA entry. Furthermore, for TDLS with any real security (i.e., +ignoring open/WEP), the TPK message exchange is protected on the AP path +and simple replay attacks are not feasible. + +As an additional corner case, make sure the local nonce gets updated if +the peer uses a very unlikely "random nonce" of all zeros. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/tdls.c | 38 ++++++++++++++++++++++++++++++++++++-- + 1 file changed, 36 insertions(+), 2 deletions(-) + +diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c +index 7c95bed..5e350ed 100644 +--- a/src/rsn_supp/tdls.c ++++ b/src/rsn_supp/tdls.c +@@ -112,6 +112,7 @@ struct wpa_tdls_peer { + u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ + } tpk; + int tpk_set; ++ int tk_set; /* TPK-TK configured to the driver */ + int tpk_success; + int tpk_in_progress; + +@@ -192,6 +193,20 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + u8 rsc[6]; + enum wpa_alg alg; + ++ if (peer->tk_set) { ++ /* ++ * This same TPK-TK has already been configured to the driver ++ * and this new configuration attempt (likely due to an ++ * unexpected retransmitted frame) would result in clearing ++ * the TX/RX sequence number which can break security, so must ++ * not allow that to happen. ++ */ ++ wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR ++ " has already been configured to the driver - do not reconfigure", ++ MAC2STR(peer->addr)); ++ return -1; ++ } ++ + os_memset(rsc, 0, 6); + + switch (peer->cipher) { +@@ -209,12 +224,15 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + return -1; + } + ++ wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR, ++ MAC2STR(peer->addr)); + if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, + rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { + wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " + "driver"); + return -1; + } ++ peer->tk_set = 1; + return 0; + } + +@@ -693,7 +711,7 @@ static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + peer->cipher = 0; + peer->qos_info = 0; + peer->wmm_capable = 0; +- peer->tpk_set = peer->tpk_success = 0; ++ peer->tk_set = peer->tpk_set = peer->tpk_success = 0; + peer->chan_switch_enabled = 0; + os_memset(&peer->tpk, 0, sizeof(peer->tpk)); + os_memset(peer->inonce, 0, WPA_NONCE_LEN); +@@ -1156,6 +1174,7 @@ skip_rsnie: + wpa_tdls_peer_free(sm, peer); + return -1; + } ++ peer->tk_set = 0; /* A new nonce results in a new TK */ + wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", + peer->inonce, WPA_NONCE_LEN); + os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); +@@ -1749,6 +1768,19 @@ static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer, + } + + ++static int tdls_nonce_set(const u8 *nonce) ++{ ++ int i; ++ ++ for (i = 0; i < WPA_NONCE_LEN; i++) { ++ if (nonce[i]) ++ return 1; ++ } ++ ++ return 0; ++} ++ ++ + static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, + const u8 *buf, size_t len) + { +@@ -2002,7 +2034,8 @@ skip_rsn: + peer->rsnie_i_len = kde.rsn_ie_len; + peer->cipher = cipher; + +- if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { ++ if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 || ++ !tdls_nonce_set(peer->inonce)) { + /* + * There is no point in updating the RNonce for every obtained + * TPK M1 frame (e.g., retransmission due to timeout) with the +@@ -2018,6 +2051,7 @@ skip_rsn: + "TDLS: Failed to get random data for responder nonce"); + goto error; + } ++ peer->tk_set = 0; /* A new nonce results in a new TK */ + } + + #if 0 +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch b/src/patches/wpa_supplicant/0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch new file mode 100644 index 0000000..890eb34 --- /dev/null +++ b/src/patches/wpa_supplicant/0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch @@ -0,0 +1,43 @@ +From b839814391abb4f95486ef2e24eb5498267eccf5 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 11:25:02 +0300 +Subject: [PATCH 7/8] WNM: Ignore WNM-Sleep Mode Response without pending + request + +Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep +Mode Response if WNM-Sleep Mode has not been used') started ignoring the +response when no WNM-Sleep Mode Request had been used during the +association. This can be made tighter by clearing the used flag when +successfully processing a response. This adds an additional layer of +protection against unexpected retransmissions of the response frame. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + wpa_supplicant/wnm_sta.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c +index 7339ed2..28346ea 100644 +--- a/wpa_supplicant/wnm_sta.c ++++ b/wpa_supplicant/wnm_sta.c +@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, + + if (!wpa_s->wnmsleep_used) { + wpa_printf(MSG_DEBUG, +- "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association"); ++ "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested"); + return; + } + +@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, + return; + } + ++ wpa_s->wnmsleep_used = 0; ++ + if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT || + wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) { + wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response " +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch b/src/patches/wpa_supplicant/0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch new file mode 100644 index 0000000..e5c56b8 --- /dev/null +++ b/src/patches/wpa_supplicant/0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch @@ -0,0 +1,82 @@ +From dc55ea1e483125145459ae1e55be3b95e6263302 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 12:06:37 +0300 +Subject: [PATCH 8/8] FT: Do not allow multiple Reassociation Response frames + +The driver is expected to not report a second association event without +the station having explicitly request a new association. As such, this +case should not be reachable. However, since reconfiguring the same +pairwise or group keys to the driver could result in nonce reuse issues, +be extra careful here and do an additional state check to avoid this +even if the local driver ends up somehow accepting an unexpected +Reassociation Response frame. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/wpa.c | 3 +++ + src/rsn_supp/wpa_ft.c | 8 ++++++++ + src/rsn_supp/wpa_i.h | 1 + + 3 files changed, 12 insertions(+) + +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index cf9bf1c..ed467e6 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -2637,6 +2637,9 @@ void wpa_sm_notify_disassoc(struct wpa_sm *sm) + #ifdef CONFIG_FILS + sm->fils_completed = 0; + #endif /* CONFIG_FILS */ ++#ifdef CONFIG_IEEE80211R ++ sm->ft_reassoc_completed = 0; ++#endif /* CONFIG_IEEE80211R */ + + /* Keys are not needed in the WPA state machine anymore */ + wpa_sm_drop_sa(sm); +diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c +index aeb7aff..1ff7afe 100644 +--- a/src/rsn_supp/wpa_ft.c ++++ b/src/rsn_supp/wpa_ft.c +@@ -153,6 +153,7 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len, + u16 capab; + + sm->ft_completed = 0; ++ sm->ft_reassoc_completed = 0; + + buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + + 2 + sm->r0kh_id_len + ric_ies_len + 100; +@@ -687,6 +688,11 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, + return -1; + } + ++ if (sm->ft_reassoc_completed) { ++ wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission"); ++ return 0; ++ } ++ + if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) { + wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs"); + return -1; +@@ -787,6 +793,8 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, + return -1; + } + ++ sm->ft_reassoc_completed = 1; ++ + if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0) + return -1; + +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 3b42245..148c654 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -128,6 +128,7 @@ struct wpa_sm { + size_t r0kh_id_len; + u8 r1kh_id[FT_R1KH_ID_LEN]; + int ft_completed; ++ int ft_reassoc_completed; + int over_the_ds_in_progress; + u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */ + int set_ptk_after_assoc; +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch b/src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch new file mode 100644 index 0000000..7276848 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch @@ -0,0 +1,174 @@ +From cf4cab804c7afd5c45505528a8d16e46163243a2 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Fri, 14 Jul 2017 15:15:35 +0200 +Subject: [PATCH 1/8] hostapd: Avoid key reinstallation in FT handshake + +Do not reinstall TK to the driver during Reassociation Response frame +processing if the first attempt of setting the TK succeeded. This avoids +issues related to clearing the TX/RX PN that could result in reusing +same PN values for transmitted frames (e.g., due to CCM nonce reuse and +also hitting replay protection on the receiver) and accepting replayed +frames on RX side. + +This issue was introduced by the commit +0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in +authenticator') which allowed wpa_ft_install_ptk() to be called multiple +times with the same PTK. While the second configuration attempt is +needed with some drivers, it must be done only if the first attempt +failed. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/ap/ieee802_11.c | 16 +++++++++++++--- + src/ap/wpa_auth.c | 11 +++++++++++ + src/ap/wpa_auth.h | 3 ++- + src/ap/wpa_auth_ft.c | 10 ++++++++++ + src/ap/wpa_auth_i.h | 1 + + 5 files changed, 37 insertions(+), 4 deletions(-) + +diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c +index 4e04169..333035f 100644 +--- a/src/ap/ieee802_11.c ++++ b/src/ap/ieee802_11.c +@@ -1841,6 +1841,7 @@ static int add_associated_sta(struct hostapd_data *hapd, + { + struct ieee80211_ht_capabilities ht_cap; + struct ieee80211_vht_capabilities vht_cap; ++ int set = 1; + + /* + * Remove the STA entry to ensure the STA PS state gets cleared and +@@ -1848,9 +1849,18 @@ static int add_associated_sta(struct hostapd_data *hapd, + * FT-over-the-DS, where a station re-associates back to the same AP but + * skips the authentication flow, or if working with a driver that + * does not support full AP client state. ++ * ++ * Skip this if the STA has already completed FT reassociation and the ++ * TK has been configured since the TX/RX PN must not be reset to 0 for ++ * the same key. + */ +- if (!sta->added_unassoc) ++ if (!sta->added_unassoc && ++ (!(sta->flags & WLAN_STA_AUTHORIZED) || ++ !wpa_auth_sta_ft_tk_already_set(sta->wpa_sm))) { + hostapd_drv_sta_remove(hapd, sta->addr); ++ wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED); ++ set = 0; ++ } + + #ifdef CONFIG_IEEE80211N + if (sta->flags & WLAN_STA_HT) +@@ -1873,11 +1883,11 @@ static int add_associated_sta(struct hostapd_data *hapd, + sta->flags & WLAN_STA_VHT ? &vht_cap : NULL, + sta->flags | WLAN_STA_ASSOC, sta->qosinfo, + sta->vht_opmode, sta->p2p_ie ? 1 : 0, +- sta->added_unassoc)) { ++ set)) { + hostapd_logger(hapd, sta->addr, + HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE, + "Could not %s STA to kernel driver", +- sta->added_unassoc ? "set" : "add"); ++ set ? "set" : "add"); + + if (sta->added_unassoc) { + hostapd_drv_sta_remove(hapd, sta->addr); +diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c +index 3587086..707971d 100644 +--- a/src/ap/wpa_auth.c ++++ b/src/ap/wpa_auth.c +@@ -1745,6 +1745,9 @@ int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event) + #else /* CONFIG_IEEE80211R */ + break; + #endif /* CONFIG_IEEE80211R */ ++ case WPA_DRV_STA_REMOVED: ++ sm->tk_already_set = FALSE; ++ return 0; + } + + #ifdef CONFIG_IEEE80211R +@@ -3250,6 +3253,14 @@ int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm) + } + + ++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm) ++{ ++ if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt)) ++ return 0; ++ return sm->tk_already_set; ++} ++ ++ + int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, + struct rsn_pmksa_cache_entry *entry) + { +diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h +index 0de8d97..97461b0 100644 +--- a/src/ap/wpa_auth.h ++++ b/src/ap/wpa_auth.h +@@ -267,7 +267,7 @@ void wpa_receive(struct wpa_authenticator *wpa_auth, + u8 *data, size_t data_len); + enum wpa_event { + WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH, +- WPA_REAUTH_EAPOL, WPA_ASSOC_FT ++ WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_DRV_STA_REMOVED + }; + void wpa_remove_ptk(struct wpa_state_machine *sm); + int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event); +@@ -280,6 +280,7 @@ int wpa_auth_pairwise_set(struct wpa_state_machine *sm); + int wpa_auth_get_pairwise(struct wpa_state_machine *sm); + int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm); + int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm); ++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm); + int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, + struct rsn_pmksa_cache_entry *entry); + struct rsn_pmksa_cache_entry * +diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c +index 42242a5..e63b99a 100644 +--- a/src/ap/wpa_auth_ft.c ++++ b/src/ap/wpa_auth_ft.c +@@ -780,6 +780,14 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) + return; + } + ++ if (sm->tk_already_set) { ++ /* Must avoid TK reconfiguration to prevent clearing of TX/RX ++ * PN in the driver */ ++ wpa_printf(MSG_DEBUG, ++ "FT: Do not re-install same PTK to the driver"); ++ return; ++ } ++ + /* FIX: add STA entry to kernel/driver here? The set_key will fail + * most likely without this.. At the moment, STA entry is added only + * after association has been completed. This function will be called +@@ -792,6 +800,7 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm) + + /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */ + sm->pairwise_set = TRUE; ++ sm->tk_already_set = TRUE; + } + + +@@ -898,6 +907,7 @@ static int wpa_ft_process_auth_req(struct wpa_state_machine *sm, + + sm->pairwise = pairwise; + sm->PTK_valid = TRUE; ++ sm->tk_already_set = FALSE; + wpa_ft_install_ptk(sm); + + buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + +diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h +index 72b7eb3..7fd8f05 100644 +--- a/src/ap/wpa_auth_i.h ++++ b/src/ap/wpa_auth_i.h +@@ -65,6 +65,7 @@ struct wpa_state_machine { + struct wpa_ptk PTK; + Boolean PTK_valid; + Boolean pairwise_set; ++ Boolean tk_already_set; + int keycount; + Boolean Pair; + struct wpa_key_replay_counter { +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch b/src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch new file mode 100644 index 0000000..1802d66 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch @@ -0,0 +1,250 @@ +From 927f891007c402fefd1ff384645b3f07597c3ede Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Wed, 12 Jul 2017 16:03:24 +0200 +Subject: [PATCH 2/8] Prevent reinstallation of an already in-use group key + +Track the current GTK and IGTK that is in use and when receiving a +(possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do +not install the given key if it is already in use. This prevents an +attacker from trying to trick the client into resetting or lowering the +sequence counter associated to the group key. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/common/wpa_common.h | 11 +++++ + src/rsn_supp/wpa.c | 116 ++++++++++++++++++++++++++++++------------------ + src/rsn_supp/wpa_i.h | 4 ++ + 3 files changed, 87 insertions(+), 44 deletions(-) + +diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h +index af1d0f0..d200285 100644 +--- a/src/common/wpa_common.h ++++ b/src/common/wpa_common.h +@@ -217,6 +217,17 @@ struct wpa_ptk { + size_t tk_len; + }; + ++struct wpa_gtk { ++ u8 gtk[WPA_GTK_MAX_LEN]; ++ size_t gtk_len; ++}; ++ ++#ifdef CONFIG_IEEE80211W ++struct wpa_igtk { ++ u8 igtk[WPA_IGTK_MAX_LEN]; ++ size_t igtk_len; ++}; ++#endif /* CONFIG_IEEE80211W */ + + /* WPA IE version 1 + * 00-50-f2:1 (OUI:OUI type) +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 3c47879..95bd7be 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -714,6 +714,15 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + const u8 *_gtk = gd->gtk; + u8 gtk_buf[32]; + ++ /* Detect possible key reinstallation */ ++ if (sm->gtk.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", ++ gd->keyidx, gd->tx, gd->gtk_len); ++ return 0; ++ } ++ + wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len); + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)", +@@ -748,6 +757,9 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + } + os_memset(gtk_buf, 0, sizeof(gtk_buf)); + ++ sm->gtk.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ + return 0; + } + +@@ -854,6 +866,48 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + } + + ++#ifdef CONFIG_IEEE80211W ++static int wpa_supplicant_install_igtk(struct wpa_sm *sm, ++ const struct wpa_igtk_kde *igtk) ++{ ++ size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); ++ u16 keyidx = WPA_GET_LE16(igtk->keyid); ++ ++ /* Detect possible key reinstallation */ ++ if (sm->igtk.igtk_len == len && ++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", ++ keyidx); ++ return 0; ++ } ++ ++ wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, ++ "WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x", ++ keyidx, MAC2STR(igtk->pn)); ++ wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len); ++ if (keyidx > 4095) { ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, ++ "WPA: Invalid IGTK KeyID %d", keyidx); ++ return -1; ++ } ++ if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), ++ broadcast_ether_addr, ++ keyidx, 0, igtk->pn, sizeof(igtk->pn), ++ igtk->igtk, len) < 0) { ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, ++ "WPA: Failed to configure IGTK to the driver"); ++ return -1; ++ } ++ ++ sm->igtk.igtk_len = len; ++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ ++ return 0; ++} ++#endif /* CONFIG_IEEE80211W */ ++ ++ + static int ieee80211w_set_keys(struct wpa_sm *sm, + struct wpa_eapol_ie_parse *ie) + { +@@ -864,30 +918,14 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, + if (ie->igtk) { + size_t len; + const struct wpa_igtk_kde *igtk; +- u16 keyidx; ++ + len = wpa_cipher_key_len(sm->mgmt_group_cipher); + if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len) + return -1; ++ + igtk = (const struct wpa_igtk_kde *) ie->igtk; +- keyidx = WPA_GET_LE16(igtk->keyid); +- wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d " +- "pn %02x%02x%02x%02x%02x%02x", +- keyidx, MAC2STR(igtk->pn)); +- wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", +- igtk->igtk, len); +- if (keyidx > 4095) { +- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, +- "WPA: Invalid IGTK KeyID %d", keyidx); +- return -1; +- } +- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), +- broadcast_ether_addr, +- keyidx, 0, igtk->pn, sizeof(igtk->pn), +- igtk->igtk, len) < 0) { +- wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, +- "WPA: Failed to configure IGTK to the driver"); ++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) + return -1; +- } + } + + return 0; +@@ -2307,7 +2345,7 @@ void wpa_sm_deinit(struct wpa_sm *sm) + */ + void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + { +- int clear_ptk = 1; ++ int clear_keys = 1; + + if (sm == NULL) + return; +@@ -2333,11 +2371,11 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + /* Prepare for the next transition */ + wpa_ft_prepare_auth_request(sm, NULL); + +- clear_ptk = 0; ++ clear_keys = 0; + } + #endif /* CONFIG_IEEE80211R */ + +- if (clear_ptk) { ++ if (clear_keys) { + /* + * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if + * this is not part of a Fast BSS Transition. +@@ -2347,6 +2385,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + sm->tptk_set = 0; + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); ++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++#ifdef CONFIG_IEEE80211W ++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++#endif /* CONFIG_IEEE80211W */ + } + + #ifdef CONFIG_TDLS +@@ -2877,6 +2919,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) + os_memset(sm->pmk, 0, sizeof(sm->pmk)); + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); ++ os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++#ifdef CONFIG_IEEE80211W ++ os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++#endif /* CONFIG_IEEE80211W */ + #ifdef CONFIG_IEEE80211R + os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); + os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0)); +@@ -2949,29 +2995,11 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + os_memset(&gd, 0, sizeof(gd)); + #ifdef CONFIG_IEEE80211W + } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) { +- struct wpa_igtk_kde igd; +- u16 keyidx; +- +- os_memset(&igd, 0, sizeof(igd)); +- keylen = wpa_cipher_key_len(sm->mgmt_group_cipher); +- os_memcpy(igd.keyid, buf + 2, 2); +- os_memcpy(igd.pn, buf + 4, 6); +- +- keyidx = WPA_GET_LE16(igd.keyid); +- os_memcpy(igd.igtk, buf + 10, keylen); +- +- wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)", +- igd.igtk, keylen); +- if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher), +- broadcast_ether_addr, +- keyidx, 0, igd.pn, sizeof(igd.pn), +- igd.igtk, keylen) < 0) { +- wpa_printf(MSG_DEBUG, "Failed to install the IGTK in " +- "WNM mode"); +- os_memset(&igd, 0, sizeof(igd)); ++ const struct wpa_igtk_kde *igtk; ++ ++ igtk = (const struct wpa_igtk_kde *) (buf + 2); ++ if (wpa_supplicant_install_igtk(sm, igtk) < 0) + return -1; +- } +- os_memset(&igd, 0, sizeof(igd)); + #endif /* CONFIG_IEEE80211W */ + } else { + wpa_printf(MSG_DEBUG, "Unknown element id"); +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index f653ba6..afc9e37 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -31,6 +31,10 @@ struct wpa_sm { + u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN]; + int rx_replay_counter_set; + u8 request_counter[WPA_REPLAY_COUNTER_LEN]; ++ struct wpa_gtk gtk; ++#ifdef CONFIG_IEEE80211W ++ struct wpa_igtk igtk; ++#endif /* CONFIG_IEEE80211W */ + + struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ + +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch b/src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch new file mode 100644 index 0000000..e2937b8 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch @@ -0,0 +1,184 @@ +From 8280294e74846ea342389a0cd17215050fa5afe8 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Sun, 1 Oct 2017 12:12:24 +0300 +Subject: [PATCH 3/8] Extend protection of GTK/IGTK reinstallation of WNM-Sleep + Mode cases + +This extends the protection to track last configured GTK/IGTK value +separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a +corner case where these two different mechanisms may get used when the +GTK/IGTK has changed and tracking a single value is not sufficient to +detect a possible key reconfiguration. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/wpa.c | 53 +++++++++++++++++++++++++++++++++++++--------------- + src/rsn_supp/wpa_i.h | 2 ++ + 2 files changed, 40 insertions(+), 15 deletions(-) + +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 95bd7be..7a2c68d 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -709,14 +709,17 @@ struct wpa_gtk_data { + + static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + const struct wpa_gtk_data *gd, +- const u8 *key_rsc) ++ const u8 *key_rsc, int wnm_sleep) + { + const u8 *_gtk = gd->gtk; + u8 gtk_buf[32]; + + /* Detect possible key reinstallation */ +- if (sm->gtk.gtk_len == (size_t) gd->gtk_len && +- os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { ++ if ((sm->gtk.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) || ++ (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len && ++ os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk, ++ sm->gtk_wnm_sleep.gtk_len) == 0)) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", + gd->keyidx, gd->tx, gd->gtk_len); +@@ -757,8 +760,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, + } + os_memset(gtk_buf, 0, sizeof(gtk_buf)); + +- sm->gtk.gtk_len = gd->gtk_len; +- os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ if (wnm_sleep) { ++ sm->gtk_wnm_sleep.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk, ++ sm->gtk_wnm_sleep.gtk_len); ++ } else { ++ sm->gtk.gtk_len = gd->gtk_len; ++ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); ++ } + + return 0; + } +@@ -852,7 +861,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + (wpa_supplicant_check_group_cipher(sm, sm->group_cipher, + gtk_len, gtk_len, + &gd.key_rsc_len, &gd.alg) || +- wpa_supplicant_install_gtk(sm, &gd, key_rsc))) { ++ wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "RSN: Failed to install GTK"); + os_memset(&gd, 0, sizeof(gd)); +@@ -868,14 +877,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, + + #ifdef CONFIG_IEEE80211W + static int wpa_supplicant_install_igtk(struct wpa_sm *sm, +- const struct wpa_igtk_kde *igtk) ++ const struct wpa_igtk_kde *igtk, ++ int wnm_sleep) + { + size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); + u16 keyidx = WPA_GET_LE16(igtk->keyid); + + /* Detect possible key reinstallation */ +- if (sm->igtk.igtk_len == len && +- os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { ++ if ((sm->igtk.igtk_len == len && ++ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) || ++ (sm->igtk_wnm_sleep.igtk_len == len && ++ os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk, ++ sm->igtk_wnm_sleep.igtk_len) == 0)) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", + keyidx); +@@ -900,8 +913,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm, + return -1; + } + +- sm->igtk.igtk_len = len; +- os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ if (wnm_sleep) { ++ sm->igtk_wnm_sleep.igtk_len = len; ++ os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk, ++ sm->igtk_wnm_sleep.igtk_len); ++ } else { ++ sm->igtk.igtk_len = len; ++ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); ++ } + + return 0; + } +@@ -924,7 +943,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, + return -1; + + igtk = (const struct wpa_igtk_kde *) ie->igtk; +- if (wpa_supplicant_install_igtk(sm, igtk) < 0) ++ if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0) + return -1; + } + +@@ -1574,7 +1593,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm, + if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc)) + key_rsc = null_rsc; + +- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) || ++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) || + wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0) + goto failed; + os_memset(&gd, 0, sizeof(gd)); +@@ -2386,8 +2405,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) + sm->tptk_set = 0; + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); + os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); + #ifdef CONFIG_IEEE80211W + os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); + #endif /* CONFIG_IEEE80211W */ + } + +@@ -2920,8 +2941,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) + os_memset(&sm->ptk, 0, sizeof(sm->ptk)); + os_memset(&sm->tptk, 0, sizeof(sm->tptk)); + os_memset(&sm->gtk, 0, sizeof(sm->gtk)); ++ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); + #ifdef CONFIG_IEEE80211W + os_memset(&sm->igtk, 0, sizeof(sm->igtk)); ++ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); + #endif /* CONFIG_IEEE80211W */ + #ifdef CONFIG_IEEE80211R + os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); +@@ -2986,7 +3009,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + + wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)", + gd.gtk, gd.gtk_len); +- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) { ++ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) { + os_memset(&gd, 0, sizeof(gd)); + wpa_printf(MSG_DEBUG, "Failed to install the GTK in " + "WNM mode"); +@@ -2998,7 +3021,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) + const struct wpa_igtk_kde *igtk; + + igtk = (const struct wpa_igtk_kde *) (buf + 2); +- if (wpa_supplicant_install_igtk(sm, igtk) < 0) ++ if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0) + return -1; + #endif /* CONFIG_IEEE80211W */ + } else { +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index afc9e37..9a54631 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -32,8 +32,10 @@ struct wpa_sm { + int rx_replay_counter_set; + u8 request_counter[WPA_REPLAY_COUNTER_LEN]; + struct wpa_gtk gtk; ++ struct wpa_gtk gtk_wnm_sleep; + #ifdef CONFIG_IEEE80211W + struct wpa_igtk igtk; ++ struct wpa_igtk igtk_wnm_sleep; + #endif /* CONFIG_IEEE80211W */ + + struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch b/src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch new file mode 100644 index 0000000..22ee217 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch @@ -0,0 +1,79 @@ +From 8f82bc94e8697a9d47fa8774dfdaaede1084912c Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +Date: Fri, 29 Sep 2017 04:22:51 +0200 +Subject: [PATCH 4/8] Prevent installation of an all-zero TK + +Properly track whether a PTK has already been installed to the driver +and the TK part cleared from memory. This prevents an attacker from +trying to trick the client into installing an all-zero TK. + +This fixes the earlier fix in commit +ad00d64e7d8827b3cebd665a0ceb08adabf15e1e ('Fix TK configuration to the +driver in EAPOL-Key 3/4 retry case') which did not take into account +possibility of an extra message 1/4 showing up between retries of +message 3/4. + +Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)cs.kuleuven.be> +--- + src/common/wpa_common.h | 1 + + src/rsn_supp/wpa.c | 5 ++--- + src/rsn_supp/wpa_i.h | 1 - + 3 files changed, 3 insertions(+), 4 deletions(-) + +diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h +index d200285..1021ccb 100644 +--- a/src/common/wpa_common.h ++++ b/src/common/wpa_common.h +@@ -215,6 +215,7 @@ struct wpa_ptk { + size_t kck_len; + size_t kek_len; + size_t tk_len; ++ int installed; /* 1 if key has already been installed to driver */ + }; + + struct wpa_gtk { +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 7a2c68d..0550a41 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -510,7 +510,6 @@ static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm, + os_memset(buf, 0, sizeof(buf)); + } + sm->tptk_set = 1; +- sm->tk_to_set = 1; + + kde = sm->assoc_wpa_ie; + kde_len = sm->assoc_wpa_ie_len; +@@ -615,7 +614,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, + enum wpa_alg alg; + const u8 *key_rsc; + +- if (!sm->tk_to_set) { ++ if (sm->ptk.installed) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "WPA: Do not re-install same PTK to the driver"); + return 0; +@@ -659,7 +658,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm, + + /* TK is not needed anymore in supplicant */ + os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN); +- sm->tk_to_set = 0; ++ sm->ptk.installed = 1; + + if (sm->wpa_ptk_rekey) { + eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL); +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 9a54631..41f371f 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -24,7 +24,6 @@ struct wpa_sm { + struct wpa_ptk ptk, tptk; + int ptk_set, tptk_set; + unsigned int msg_3_of_4_ok:1; +- unsigned int tk_to_set:1; + u8 snonce[WPA_NONCE_LEN]; + u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */ + int renew_snonce; +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch b/src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch new file mode 100644 index 0000000..c19c4c7 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch @@ -0,0 +1,64 @@ +From 12fac09b437a1dc8a0f253e265934a8aaf4d2f8b Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Sun, 1 Oct 2017 12:32:57 +0300 +Subject: [PATCH 5/8] Fix PTK rekeying to generate a new ANonce + +The Authenticator state machine path for PTK rekeying ended up bypassing +the AUTHENTICATION2 state where a new ANonce is generated when going +directly to the PTKSTART state since there is no need to try to +determine the PMK again in such a case. This is far from ideal since the +new PTK would depend on a new nonce only from the supplicant. + +Fix this by generating a new ANonce when moving to the PTKSTART state +for the purpose of starting new 4-way handshake to rekey PTK. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/ap/wpa_auth.c | 24 +++++++++++++++++++++--- + 1 file changed, 21 insertions(+), 3 deletions(-) + +diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c +index 707971d..bf10cc1 100644 +--- a/src/ap/wpa_auth.c ++++ b/src/ap/wpa_auth.c +@@ -1901,6 +1901,21 @@ SM_STATE(WPA_PTK, AUTHENTICATION2) + } + + ++static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm) ++{ ++ if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { ++ wpa_printf(MSG_ERROR, ++ "WPA: Failed to get random data for ANonce"); ++ sm->Disconnect = TRUE; ++ return -1; ++ } ++ wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce, ++ WPA_NONCE_LEN); ++ sm->TimeoutCtr = 0; ++ return 0; ++} ++ ++ + SM_STATE(WPA_PTK, INITPMK) + { + u8 msk[2 * PMK_LEN]; +@@ -2458,9 +2473,12 @@ SM_STEP(WPA_PTK) + SM_ENTER(WPA_PTK, AUTHENTICATION); + else if (sm->ReAuthenticationRequest) + SM_ENTER(WPA_PTK, AUTHENTICATION2); +- else if (sm->PTKRequest) +- SM_ENTER(WPA_PTK, PTKSTART); +- else switch (sm->wpa_ptk_state) { ++ else if (sm->PTKRequest) { ++ if (wpa_auth_sm_ptk_update(sm) < 0) ++ SM_ENTER(WPA_PTK, DISCONNECTED); ++ else ++ SM_ENTER(WPA_PTK, PTKSTART); ++ } else switch (sm->wpa_ptk_state) { + case WPA_PTK_INITIALIZE: + break; + case WPA_PTK_DISCONNECT: +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch b/src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch new file mode 100644 index 0000000..e1bd5a5 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch @@ -0,0 +1,132 @@ +From 6c4bed4f47d1960ec04981a9d50e5076aea5223d Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 11:03:15 +0300 +Subject: [PATCH 6/8] TDLS: Reject TPK-TK reconfiguration + +Do not try to reconfigure the same TPK-TK to the driver after it has +been successfully configured. This is an explicit check to avoid issues +related to resetting the TX/RX packet number. There was already a check +for this for TPK M2 (retries of that message are ignored completely), so +that behavior does not get modified. + +For TPK M3, the TPK-TK could have been reconfigured, but that was +followed by immediate teardown of the link due to an issue in updating +the STA entry. Furthermore, for TDLS with any real security (i.e., +ignoring open/WEP), the TPK message exchange is protected on the AP path +and simple replay attacks are not feasible. + +As an additional corner case, make sure the local nonce gets updated if +the peer uses a very unlikely "random nonce" of all zeros. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/tdls.c | 38 ++++++++++++++++++++++++++++++++++++-- + 1 file changed, 36 insertions(+), 2 deletions(-) + +diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c +index e424168..9eb9738 100644 +--- a/src/rsn_supp/tdls.c ++++ b/src/rsn_supp/tdls.c +@@ -112,6 +112,7 @@ struct wpa_tdls_peer { + u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ + } tpk; + int tpk_set; ++ int tk_set; /* TPK-TK configured to the driver */ + int tpk_success; + int tpk_in_progress; + +@@ -192,6 +193,20 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + u8 rsc[6]; + enum wpa_alg alg; + ++ if (peer->tk_set) { ++ /* ++ * This same TPK-TK has already been configured to the driver ++ * and this new configuration attempt (likely due to an ++ * unexpected retransmitted frame) would result in clearing ++ * the TX/RX sequence number which can break security, so must ++ * not allow that to happen. ++ */ ++ wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR ++ " has already been configured to the driver - do not reconfigure", ++ MAC2STR(peer->addr)); ++ return -1; ++ } ++ + os_memset(rsc, 0, 6); + + switch (peer->cipher) { +@@ -209,12 +224,15 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + return -1; + } + ++ wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR, ++ MAC2STR(peer->addr)); + if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, + rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { + wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " + "driver"); + return -1; + } ++ peer->tk_set = 1; + return 0; + } + +@@ -696,7 +714,7 @@ static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer) + peer->cipher = 0; + peer->qos_info = 0; + peer->wmm_capable = 0; +- peer->tpk_set = peer->tpk_success = 0; ++ peer->tk_set = peer->tpk_set = peer->tpk_success = 0; + peer->chan_switch_enabled = 0; + os_memset(&peer->tpk, 0, sizeof(peer->tpk)); + os_memset(peer->inonce, 0, WPA_NONCE_LEN); +@@ -1159,6 +1177,7 @@ skip_rsnie: + wpa_tdls_peer_free(sm, peer); + return -1; + } ++ peer->tk_set = 0; /* A new nonce results in a new TK */ + wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", + peer->inonce, WPA_NONCE_LEN); + os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); +@@ -1751,6 +1770,19 @@ static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer, + } + + ++static int tdls_nonce_set(const u8 *nonce) ++{ ++ int i; ++ ++ for (i = 0; i < WPA_NONCE_LEN; i++) { ++ if (nonce[i]) ++ return 1; ++ } ++ ++ return 0; ++} ++ ++ + static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, + const u8 *buf, size_t len) + { +@@ -2004,7 +2036,8 @@ skip_rsn: + peer->rsnie_i_len = kde.rsn_ie_len; + peer->cipher = cipher; + +- if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { ++ if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 || ++ !tdls_nonce_set(peer->inonce)) { + /* + * There is no point in updating the RNonce for every obtained + * TPK M1 frame (e.g., retransmission due to timeout) with the +@@ -2020,6 +2053,7 @@ skip_rsn: + "TDLS: Failed to get random data for responder nonce"); + goto error; + } ++ peer->tk_set = 0; /* A new nonce results in a new TK */ + } + + #if 0 +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch b/src/patches/wpa_supplicant/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch new file mode 100644 index 0000000..85ea1d6 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch @@ -0,0 +1,43 @@ +From 53c5eb58e95004f86e65ee9fbfccbc291b139057 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 11:25:02 +0300 +Subject: [PATCH 7/8] WNM: Ignore WNM-Sleep Mode Response without pending + request + +Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep +Mode Response if WNM-Sleep Mode has not been used') started ignoring the +response when no WNM-Sleep Mode Request had been used during the +association. This can be made tighter by clearing the used flag when +successfully processing a response. This adds an additional layer of +protection against unexpected retransmissions of the response frame. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + wpa_supplicant/wnm_sta.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c +index 1b3409c..67a07ff 100644 +--- a/wpa_supplicant/wnm_sta.c ++++ b/wpa_supplicant/wnm_sta.c +@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, + + if (!wpa_s->wnmsleep_used) { + wpa_printf(MSG_DEBUG, +- "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association"); ++ "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested"); + return; + } + +@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s, + return; + } + ++ wpa_s->wnmsleep_used = 0; ++ + if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT || + wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) { + wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response " +-- +2.7.4 + diff --git a/src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch b/src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch new file mode 100644 index 0000000..b9678f6 --- /dev/null +++ b/src/patches/wpa_supplicant/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch @@ -0,0 +1,82 @@ +From b372ab0b7daea719749194dc554b26e6367603f2 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j(a)w1.fi> +Date: Fri, 22 Sep 2017 12:06:37 +0300 +Subject: [PATCH 8/8] FT: Do not allow multiple Reassociation Response frames + +The driver is expected to not report a second association event without +the station having explicitly request a new association. As such, this +case should not be reachable. However, since reconfiguring the same +pairwise or group keys to the driver could result in nonce reuse issues, +be extra careful here and do an additional state check to avoid this +even if the local driver ends up somehow accepting an unexpected +Reassociation Response frame. + +Signed-off-by: Jouni Malinen <j(a)w1.fi> +--- + src/rsn_supp/wpa.c | 3 +++ + src/rsn_supp/wpa_ft.c | 8 ++++++++ + src/rsn_supp/wpa_i.h | 1 + + 3 files changed, 12 insertions(+) + +diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c +index 0550a41..2a53c6f 100644 +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -2440,6 +2440,9 @@ void wpa_sm_notify_disassoc(struct wpa_sm *sm) + #ifdef CONFIG_TDLS + wpa_tdls_disassoc(sm); + #endif /* CONFIG_TDLS */ ++#ifdef CONFIG_IEEE80211R ++ sm->ft_reassoc_completed = 0; ++#endif /* CONFIG_IEEE80211R */ + + /* Keys are not needed in the WPA state machine anymore */ + wpa_sm_drop_sa(sm); +diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c +index 205793e..d45bb45 100644 +--- a/src/rsn_supp/wpa_ft.c ++++ b/src/rsn_supp/wpa_ft.c +@@ -153,6 +153,7 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len, + u16 capab; + + sm->ft_completed = 0; ++ sm->ft_reassoc_completed = 0; + + buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) + + 2 + sm->r0kh_id_len + ric_ies_len + 100; +@@ -681,6 +682,11 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, + return -1; + } + ++ if (sm->ft_reassoc_completed) { ++ wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission"); ++ return 0; ++ } ++ + if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) { + wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs"); + return -1; +@@ -781,6 +787,8 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies, + return -1; + } + ++ sm->ft_reassoc_completed = 1; ++ + if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0) + return -1; + +diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h +index 41f371f..56f88dc 100644 +--- a/src/rsn_supp/wpa_i.h ++++ b/src/rsn_supp/wpa_i.h +@@ -128,6 +128,7 @@ struct wpa_sm { + size_t r0kh_id_len; + u8 r1kh_id[FT_R1KH_ID_LEN]; + int ft_completed; ++ int ft_reassoc_completed; + int over_the_ds_in_progress; + u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */ + int set_ptk_after_assoc; +-- +2.7.4 + hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. a54350cdb9d56691644486a49b7e5b7594d8d504
by git＠ipfire.org 16 Oct '17

16 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via a54350cdb9d56691644486a49b7e5b7594d8d504 (commit) via ebfb8996930ec1e3b4f7d09208d2ab60a8f30603 (commit) from c484679bb3ea4672bf34ba3fd1d5d7596f00a11a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a54350cdb9d56691644486a49b7e5b7594d8d504 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 16:36:24 2017 +0200 captive: Allow PDF export of coupons Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit ebfb8996930ec1e3b4f7d09208d2ab60a8f30603 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 16 15:03:39 2017 +0200 captive: Add headline to T&C box Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: doc/language_issues.es | 8 +++ doc/language_issues.fr | 8 ++- doc/language_issues.it | 8 +++ doc/language_issues.nl | 8 +++ doc/language_issues.pl | 8 +++ doc/language_issues.ru | 8 +++ doc/language_issues.tr | 8 +++ doc/language_missings | 29 ++++++++- html/cgi-bin/captive.cgi | 160 ++++++++++++++++++++++++++++++++++++++++++++++- langs/de/cgi-bin/de.pl | 5 ++ langs/en/cgi-bin/en.pl | 5 ++ 11 files changed, 252 insertions(+), 3 deletions(-) Difference in files: diff --git a/doc/language_issues.es b/doc/language_issues.es index a701010..38cf210 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -613,6 +613,7 @@ WARNING: translation string unused: web proxy configuration WARNING: translation string unused: week-graph WARNING: translation string unused: weekly firewallhits WARNING: translation string unused: wildcards +WARNING: translation string unused: wlanap access point WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -621,6 +622,7 @@ WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: 24 hours WARNING: untranslated string: Captive ACTIVATE WARNING: untranslated string: Captive GAIN ACCESS +WARNING: untranslated string: Captive WiFi coupon WARNING: untranslated string: Captive activated WARNING: untranslated string: Captive active on WARNING: untranslated string: Captive agree tac @@ -632,6 +634,7 @@ WARNING: untranslated string: Captive clients WARNING: untranslated string: Captive config WARNING: untranslated string: Captive coupon WARNING: untranslated string: Captive expiry time +WARNING: untranslated string: Captive export coupons WARNING: untranslated string: Captive generate coupon WARNING: untranslated string: Captive issued coupons WARNING: untranslated string: Captive logo uploaded @@ -640,11 +643,14 @@ WARNING: untranslated string: Captive menu WARNING: untranslated string: Captive noexpiretime WARNING: untranslated string: Captive nolimit WARNING: untranslated string: Captive please accept the terms and conditions +WARNING: untranslated string: Captive portal +WARNING: untranslated string: Captive portal coupons WARNING: untranslated string: Captive terms WARNING: untranslated string: Captive terms short WARNING: untranslated string: Captive title WARNING: untranslated string: Captive upload logo WARNING: untranslated string: Captive upload logo recommendations +WARNING: untranslated string: Captive valid for WARNING: untranslated string: Captive vouchervalid WARNING: untranslated string: Captive wrong ext WARNING: untranslated string: ConnSched dial @@ -1243,4 +1249,6 @@ WARNING: untranslated string: wlan client wpa mode ccmp ccmp WARNING: untranslated string: wlan client wpa mode ccmp tkip WARNING: untranslated string: wlan client wpa mode tkip tkip WARNING: untranslated string: wlan clients +WARNING: untranslated string: wlanap +WARNING: untranslated string: wlanap configuration WARNING: untranslated string: wlanap country diff --git a/doc/language_issues.fr b/doc/language_issues.fr index 1389cbb..351d8a2 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -631,6 +631,7 @@ WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: 24 hours WARNING: untranslated string: Captive ACTIVATE WARNING: untranslated string: Captive GAIN ACCESS +WARNING: untranslated string: Captive WiFi coupon WARNING: untranslated string: Captive activated WARNING: untranslated string: Captive active on WARNING: untranslated string: Captive agree tac @@ -642,6 +643,7 @@ WARNING: untranslated string: Captive clients WARNING: untranslated string: Captive config WARNING: untranslated string: Captive coupon WARNING: untranslated string: Captive expiry time +WARNING: untranslated string: Captive export coupons WARNING: untranslated string: Captive generate coupon WARNING: untranslated string: Captive issued coupons WARNING: untranslated string: Captive logo uploaded @@ -650,11 +652,14 @@ WARNING: untranslated string: Captive menu WARNING: untranslated string: Captive noexpiretime WARNING: untranslated string: Captive nolimit WARNING: untranslated string: Captive please accept the terms and conditions +WARNING: untranslated string: Captive portal +WARNING: untranslated string: Captive portal coupons WARNING: untranslated string: Captive terms WARNING: untranslated string: Captive terms short WARNING: untranslated string: Captive title WARNING: untranslated string: Captive upload logo WARNING: untranslated string: Captive upload logo recommendations +WARNING: untranslated string: Captive valid for WARNING: untranslated string: Captive vouchervalid WARNING: untranslated string: Captive wrong ext WARNING: untranslated string: ConnSched dial @@ -1260,8 +1265,9 @@ WARNING: untranslated string: wlan client wpa mode ccmp ccmp WARNING: untranslated string: wlan client wpa mode ccmp tkip WARNING: untranslated string: wlan client wpa mode tkip tkip WARNING: untranslated string: wlan clients -WARNING: untranslated string: wlanap access point +WARNING: untranslated string: wlanap WARNING: untranslated string: wlanap channel +WARNING: untranslated string: wlanap configuration WARNING: untranslated string: wlanap country WARNING: untranslated string: wlanap debugging WARNING: untranslated string: wlanap del interface diff --git a/doc/language_issues.it b/doc/language_issues.it index 5b921a8..36af273 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -690,6 +690,7 @@ WARNING: translation string unused: web proxy configuration WARNING: translation string unused: week-graph WARNING: translation string unused: weekly firewallhits WARNING: translation string unused: wildcards +WARNING: translation string unused: wlanap access point WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -698,6 +699,7 @@ WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: 24 hours WARNING: untranslated string: Captive ACTIVATE WARNING: untranslated string: Captive GAIN ACCESS +WARNING: untranslated string: Captive WiFi coupon WARNING: untranslated string: Captive activated WARNING: untranslated string: Captive active on WARNING: untranslated string: Captive agree tac @@ -709,6 +711,7 @@ WARNING: untranslated string: Captive clients WARNING: untranslated string: Captive config WARNING: untranslated string: Captive coupon WARNING: untranslated string: Captive expiry time +WARNING: untranslated string: Captive export coupons WARNING: untranslated string: Captive generate coupon WARNING: untranslated string: Captive issued coupons WARNING: untranslated string: Captive logo uploaded @@ -717,11 +720,14 @@ WARNING: untranslated string: Captive menu WARNING: untranslated string: Captive noexpiretime WARNING: untranslated string: Captive nolimit WARNING: untranslated string: Captive please accept the terms and conditions +WARNING: untranslated string: Captive portal +WARNING: untranslated string: Captive portal coupons WARNING: untranslated string: Captive terms WARNING: untranslated string: Captive terms short WARNING: untranslated string: Captive title WARNING: untranslated string: Captive upload logo WARNING: untranslated string: Captive upload logo recommendations +WARNING: untranslated string: Captive valid for WARNING: untranslated string: Captive vouchervalid WARNING: untranslated string: Captive wrong ext WARNING: untranslated string: MTU settings @@ -887,3 +893,5 @@ WARNING: untranslated string: wlan client method WARNING: untranslated string: wlan client password WARNING: untranslated string: wlan client tls cipher WARNING: untranslated string: wlan client tls version +WARNING: untranslated string: wlanap +WARNING: untranslated string: wlanap configuration diff --git a/doc/language_issues.nl b/doc/language_issues.nl index 16f6c0d..91fca78 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -686,6 +686,7 @@ WARNING: translation string unused: web proxy configuration WARNING: translation string unused: week-graph WARNING: translation string unused: weekly firewallhits WARNING: translation string unused: wildcards +WARNING: translation string unused: wlanap access point WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -694,6 +695,7 @@ WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: 24 hours WARNING: untranslated string: Captive ACTIVATE WARNING: untranslated string: Captive GAIN ACCESS +WARNING: untranslated string: Captive WiFi coupon WARNING: untranslated string: Captive activated WARNING: untranslated string: Captive active on WARNING: untranslated string: Captive agree tac @@ -705,6 +707,7 @@ WARNING: untranslated string: Captive clients WARNING: untranslated string: Captive config WARNING: untranslated string: Captive coupon WARNING: untranslated string: Captive expiry time +WARNING: untranslated string: Captive export coupons WARNING: untranslated string: Captive generate coupon WARNING: untranslated string: Captive issued coupons WARNING: untranslated string: Captive logo uploaded @@ -713,11 +716,14 @@ WARNING: untranslated string: Captive menu WARNING: untranslated string: Captive noexpiretime WARNING: untranslated string: Captive nolimit WARNING: untranslated string: Captive please accept the terms and conditions +WARNING: untranslated string: Captive portal +WARNING: untranslated string: Captive portal coupons WARNING: untranslated string: Captive terms WARNING: untranslated string: Captive terms short WARNING: untranslated string: Captive title WARNING: untranslated string: Captive upload logo WARNING: untranslated string: Captive upload logo recommendations +WARNING: untranslated string: Captive valid for WARNING: untranslated string: Captive vouchervalid WARNING: untranslated string: Captive wrong ext WARNING: untranslated string: MTU settings @@ -935,3 +941,5 @@ WARNING: untranslated string: wlan client method WARNING: untranslated string: wlan client password WARNING: untranslated string: wlan client tls cipher WARNING: untranslated string: wlan client tls version +WARNING: untranslated string: wlanap +WARNING: untranslated string: wlanap configuration diff --git a/doc/language_issues.pl b/doc/language_issues.pl index a701010..38cf210 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -613,6 +613,7 @@ WARNING: translation string unused: web proxy configuration WARNING: translation string unused: week-graph WARNING: translation string unused: weekly firewallhits WARNING: translation string unused: wildcards +WARNING: translation string unused: wlanap access point WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -621,6 +622,7 @@ WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: 24 hours WARNING: untranslated string: Captive ACTIVATE WARNING: untranslated string: Captive GAIN ACCESS +WARNING: untranslated string: Captive WiFi coupon WARNING: untranslated string: Captive activated WARNING: untranslated string: Captive active on WARNING: untranslated string: Captive agree tac @@ -632,6 +634,7 @@ WARNING: untranslated string: Captive clients WARNING: untranslated string: Captive config WARNING: untranslated string: Captive coupon WARNING: untranslated string: Captive expiry time +WARNING: untranslated string: Captive export coupons WARNING: untranslated string: Captive generate coupon WARNING: untranslated string: Captive issued coupons WARNING: untranslated string: Captive logo uploaded @@ -640,11 +643,14 @@ WARNING: untranslated string: Captive menu WARNING: untranslated string: Captive noexpiretime WARNING: untranslated string: Captive nolimit WARNING: untranslated string: Captive please accept the terms and conditions +WARNING: untranslated string: Captive portal +WARNING: untranslated string: Captive portal coupons WARNING: untranslated string: Captive terms WARNING: untranslated string: Captive terms short WARNING: untranslated string: Captive title WARNING: untranslated string: Captive upload logo WARNING: untranslated string: Captive upload logo recommendations +WARNING: untranslated string: Captive valid for WARNING: untranslated string: Captive vouchervalid WARNING: untranslated string: Captive wrong ext WARNING: untranslated string: ConnSched dial @@ -1243,4 +1249,6 @@ WARNING: untranslated string: wlan client wpa mode ccmp ccmp WARNING: untranslated string: wlan client wpa mode ccmp tkip WARNING: untranslated string: wlan client wpa mode tkip tkip WARNING: untranslated string: wlan clients +WARNING: untranslated string: wlanap +WARNING: untranslated string: wlanap configuration WARNING: untranslated string: wlanap country diff --git a/doc/language_issues.ru b/doc/language_issues.ru index a2a771e..25227c4 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -615,6 +615,7 @@ WARNING: translation string unused: warn when traffic reaches WARNING: translation string unused: web proxy configuration WARNING: translation string unused: weekly firewallhits WARNING: translation string unused: wildcards +WARNING: translation string unused: wlanap access point WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -623,6 +624,7 @@ WARNING: untranslated string: 24 hours WARNING: untranslated string: Add a route WARNING: untranslated string: Captive ACTIVATE WARNING: untranslated string: Captive GAIN ACCESS +WARNING: untranslated string: Captive WiFi coupon WARNING: untranslated string: Captive activated WARNING: untranslated string: Captive active on WARNING: untranslated string: Captive agree tac @@ -634,6 +636,7 @@ WARNING: untranslated string: Captive clients WARNING: untranslated string: Captive config WARNING: untranslated string: Captive coupon WARNING: untranslated string: Captive expiry time +WARNING: untranslated string: Captive export coupons WARNING: untranslated string: Captive generate coupon WARNING: untranslated string: Captive issued coupons WARNING: untranslated string: Captive logo uploaded @@ -642,11 +645,14 @@ WARNING: untranslated string: Captive menu WARNING: untranslated string: Captive noexpiretime WARNING: untranslated string: Captive nolimit WARNING: untranslated string: Captive please accept the terms and conditions +WARNING: untranslated string: Captive portal +WARNING: untranslated string: Captive portal coupons WARNING: untranslated string: Captive terms WARNING: untranslated string: Captive terms short WARNING: untranslated string: Captive title WARNING: untranslated string: Captive upload logo WARNING: untranslated string: Captive upload logo recommendations +WARNING: untranslated string: Captive valid for WARNING: untranslated string: Captive vouchervalid WARNING: untranslated string: Captive wrong ext WARNING: untranslated string: ConnSched dial @@ -1238,4 +1244,6 @@ WARNING: untranslated string: wlan client wpa mode ccmp ccmp WARNING: untranslated string: wlan client wpa mode ccmp tkip WARNING: untranslated string: wlan client wpa mode tkip tkip WARNING: untranslated string: wlan clients +WARNING: untranslated string: wlanap +WARNING: untranslated string: wlanap configuration WARNING: untranslated string: wlanap country diff --git a/doc/language_issues.tr b/doc/language_issues.tr index 96849cd..733c664 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -698,6 +698,7 @@ WARNING: translation string unused: web proxy configuration WARNING: translation string unused: week-graph WARNING: translation string unused: weekly firewallhits WARNING: translation string unused: wildcards +WARNING: translation string unused: wlanap access point WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -706,6 +707,7 @@ WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: 24 hours WARNING: untranslated string: Captive ACTIVATE WARNING: untranslated string: Captive GAIN ACCESS +WARNING: untranslated string: Captive WiFi coupon WARNING: untranslated string: Captive activated WARNING: untranslated string: Captive active on WARNING: untranslated string: Captive agree tac @@ -717,6 +719,7 @@ WARNING: untranslated string: Captive clients WARNING: untranslated string: Captive config WARNING: untranslated string: Captive coupon WARNING: untranslated string: Captive expiry time +WARNING: untranslated string: Captive export coupons WARNING: untranslated string: Captive generate coupon WARNING: untranslated string: Captive issued coupons WARNING: untranslated string: Captive logo uploaded @@ -725,11 +728,14 @@ WARNING: untranslated string: Captive menu WARNING: untranslated string: Captive noexpiretime WARNING: untranslated string: Captive nolimit WARNING: untranslated string: Captive please accept the terms and conditions +WARNING: untranslated string: Captive portal +WARNING: untranslated string: Captive portal coupons WARNING: untranslated string: Captive terms WARNING: untranslated string: Captive terms short WARNING: untranslated string: Captive title WARNING: untranslated string: Captive upload logo WARNING: untranslated string: Captive upload logo recommendations +WARNING: untranslated string: Captive valid for WARNING: untranslated string: Captive vouchervalid WARNING: untranslated string: Captive wrong ext WARNING: untranslated string: Scan for Songs @@ -818,3 +824,5 @@ WARNING: untranslated string: wlan client method WARNING: untranslated string: wlan client password WARNING: untranslated string: wlan client tls cipher WARNING: untranslated string: wlan client tls version +WARNING: untranslated string: wlanap +WARNING: untranslated string: wlanap configuration diff --git a/doc/language_missings b/doc/language_missings index 46f6d69..64c184d 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -56,6 +56,7 @@ < Captive err doublevoucher < Captive expire < Captive expiry time +< Captive export coupons < Captive GAIN ACCESS < Captive generate coupon < Captive genvoucher @@ -73,16 +74,20 @@ < Captive nolimit < Captive nr < Captive please accept the terms and conditions +< Captive portal +< Captive portal coupons < Captive terms < Captive terms short < Captive time < Captive title < Captive upload logo < Captive upload logo recommendations +< Captive valid for < Captive voactive < Captive voucher < Captive vouchervalid < Captive vout +< Captive WiFi coupon < Captive wrong ext < ccd add < ccd choose net @@ -632,8 +637,9 @@ < vpn statistic rw < vpn weak < wireless network -< wlanap access point +< wlanap < wlanap channel +< wlanap configuration < wlanap country < wlanap debugging < wlanap del interface @@ -747,6 +753,7 @@ < Captive err doublevoucher < Captive expire < Captive expiry time +< Captive export coupons < Captive GAIN ACCESS < Captive generate coupon < Captive genvoucher @@ -764,16 +771,20 @@ < Captive nolimit < Captive nr < Captive please accept the terms and conditions +< Captive portal +< Captive portal coupons < Captive terms < Captive terms short < Captive time < Captive title < Captive upload logo < Captive upload logo recommendations +< Captive valid for < Captive voactive < Captive voucher < Captive vouchervalid < Captive vout +< Captive WiFi coupon < Captive wrong ext < ccd add < ccd choose net @@ -1325,6 +1336,8 @@ < vpn statistic rw < vpn weak < wireless network +< wlanap +< wlanap configuration < wlanap country < wlan client < wlan client advanced settings @@ -1419,6 +1432,7 @@ < Captive err doublevoucher < Captive expire < Captive expiry time +< Captive export coupons < Captive GAIN ACCESS < Captive generate coupon < Captive genvoucher @@ -1436,16 +1450,20 @@ < Captive nolimit < Captive nr < Captive please accept the terms and conditions +< Captive portal +< Captive portal coupons < Captive terms < Captive terms short < Captive time < Captive title < Captive upload logo < Captive upload logo recommendations +< Captive valid for < Captive voactive < Captive voucher < Captive vouchervalid < Captive vout +< Captive WiFi coupon < Captive wrong ext < ccd add < ccd choose net @@ -1983,6 +2001,8 @@ < vpn statistic rw < vpn weak < wireless network +< wlanap +< wlanap configuration < wlanap country < wlan client < wlan client advanced settings @@ -2078,6 +2098,7 @@ < Captive err doublevoucher < Captive expire < Captive expiry time +< Captive export coupons < Captive GAIN ACCESS < Captive generate coupon < Captive genvoucher @@ -2095,16 +2116,20 @@ < Captive nolimit < Captive nr < Captive please accept the terms and conditions +< Captive portal +< Captive portal coupons < Captive terms < Captive terms short < Captive time < Captive title < Captive upload logo < Captive upload logo recommendations +< Captive valid for < Captive voactive < Captive voucher < Captive vouchervalid < Captive vout +< Captive WiFi coupon < Captive wrong ext < ccd add < ccd choose net @@ -2647,6 +2672,8 @@ < vpn weak < week-graph < wireless network +< wlanap +< wlanap configuration < wlanap country < wlan client < wlan client advanced settings diff --git a/html/cgi-bin/captive.cgi b/html/cgi-bin/captive.cgi index 501bd87..c595c0e 100755 --- a/html/cgi-bin/captive.cgi +++ b/html/cgi-bin/captive.cgi @@ -20,8 +20,11 @@ ############################################################################### #use strict; +use Encode; use HTML::Entities(); use File::Basename; +use PDF::API2; +use constant mm => 25.4 / 72; # enable only the following on debugging purpose #use warnings; @@ -57,6 +60,20 @@ unless (-e $settingsfile) { system("touch $settingsfile"); } &General::readhash("$settingsfile", \%settings) if(-f $settingsfile); &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); +if ($cgiparams{'ACTION'} eq "export-coupons") { + my $pdf = &generate_pdf(); + + print "Content-Type: application/pdf\n"; + print "Content-Disposition: attachment; filename=captive-portal-coupons.pdf\n"; + print "\n"; # end headers + + # Send PDF + print $pdf; + + exit(0); +} + + &Header::showhttpheaders(); if ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) { @@ -350,7 +367,7 @@ END my $terms = &getterms(); print <<END; <tr> - <td></td> + <td>$Lang::tr{'Captive terms'}</td> <td> <textarea cols="50" rows="10" name="TERMS">$terms</textarea> </td> @@ -572,6 +589,16 @@ END print "</table>"; + # Download PDF + print <<END; + <div align="right"> + <form method="POST"> + <input type="hidden" name="ACTION" value="export-coupons"> + <input type="submit" value="$Lang::tr{'Captive export coupons'}"> + </form> + </div> +END + &Header::closebox(); } @@ -660,5 +687,136 @@ sub validremark return 1; } +sub generate_pdf() { + my $pdf = PDF::API2->new(); + + my ($sec, $min, $hour, $mday, $mon, $year, $wday, $yday, $isdst) = gmtime(time); + my $timestamp = sprintf("D:%04d%02d%02d%02d%02d%02d+00;00", $year+1900, $mon+1, $mday, $hour, $min, $sec); + + $pdf->info( + "Creator" => $Lang::tr{'Captive portal'}, + "Title" => $Lang::tr{'Captive portal coupons'}, + "CreationDate" => $timestamp, + "ModDate" => $timestamp, + ); + + # Set page size + $pdf->mediabox("A4"); + $pdf->trimbox(28/mm, 27/mm, 182/mm, 270/mm); + + # Set font + my $font = $pdf->ttfont("/usr/share/fonts/Ubuntu-R.ttf"); + + my $page_h_margin = 27/mm; + my $page_v_margin = 28/mm; + + my $height = 68/mm; + my $width = 91/mm; + my $margin = 2/mm; + + # Tux Image + my $tux_image = $pdf->image_png("/srv/web/ipfire/html/captive/assets/ipfire.png"); + my $logo_height = 12/mm; + my $logo_width = 12/mm; + + my @coupons = (); + my %coupon_expiry_times = (); + + # Read coupons + &General::readhasharray($coupons, \%couponhash) if (-e $coupons); + foreach my $key (keys %couponhash) { + $coupon_expiry_times{$couponhash{$key}[1]} = $couponhash{$key}[2]; + push @coupons, $couponhash{$key}[1]; + } + + while (@coupons) { + # Make a new page + my $page = $pdf->page(); + + # Graphics + $gfx = $page->gfx(); + + # Headline font + my $f_headline = $page->text(); + $f_headline->font($font, 20); + + # Subheadline font + my $f_subheadline = $page->text(); + $f_subheadline->font($font, 14); + + # Coupon font + my $f_coupon = $page->text(); + $f_coupon->font($font, 36); + + # Lifetime + my $f_lifetime = $page->text(); + $f_lifetime->font($font, 14); + + # Watermark font + my $f_watermark = $page->text(); + $f_watermark->fillcolor("#666666"); + $f_watermark->font($font, 10); + + my $i = 0; + while (@coupons && $i < 8) { + my $coupon = shift @coupons; + + # Box corners + my $x = ($page_v_margin / 2) + (($i % 2) ? $width : 0); + my $y = ($page_h_margin / 2) + (int($i / 2) * $height); + + # Weidth and height of the box + my $w = $width - $margin; + my $h = $height - $margin; + + # Center + my $cx = $x + ($w / 2); + my $cy = $y + ($h / 2); + + # Draw border box + $gfx->strokecolor("#333333"); + $gfx->linedash(1/mm, 1/mm); + $gfx->rect($x, $y, $w, $h); + $gfx->stroke(); + $gfx->endpath(); + + # Headline + $f_headline->translate($cx, ($y + $h - $cy) / 1.7 + $cy); + $f_subheadline->translate($cx, ($y + $h - $cy) / 2.4 + $cy); + + if ($settings{'TITLE'}) { + $f_headline->text_center($settings{'TITLE'}); + $f_subheadline->text_center(decode("utf8", $Lang::tr{'Captive WiFi coupon'})); + } else { + $f_headline->text_center(decode("utf8", $Lang::tr{'Captive WiFi coupon'})); + } + + # Coupon + $f_coupon->translate($cx, $cy); + $f_coupon->text_center(decode("utf8", $coupon)); + + # Show lifetime + my $expiry_time = $coupon_expiry_times{$coupon}; + $f_lifetime->translate($cx, $cy - ($y + $h - $cy) / 4); + if ($expiry_time > 0) { + my $lifetime = &General::format_time($expiry_time); + $f_lifetime->text_center(decode("utf8", $Lang::tr{'Captive valid for'} . " " . $lifetime)); + } else { + $f_lifetime->text_center(decode("utf8", $Lang::tr{'Captive nolimit'})); + } + + # Add watermark + $gfx->image($tux_image, $x + $w - $logo_width - $margin, $y + $margin, $logo_width, $logo_height); + $f_watermark->translate($x + $w - ($margin * 2) - $logo_width, $y + ($logo_height / 2)); + $f_watermark->text_right("Powered by IPFire"); + + $i++; + } + } + + # Write out the PDF document + return $pdf->stringify(); +} + &Header::closebigbox(); &Header::closepage(); diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index af96a64..1398329 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -12,6 +12,7 @@ 'Captive 1week' => '1 Woche', 'Captive ACTIVATE' => 'AKTIVIEREN', 'Captive GAIN ACCESS' => 'ZUGANG', +'Captive WiFi coupon' => 'WLAN-Coupon', 'Captive activate' => 'Aktivieren', 'Captive activated' => 'Aktiviert', 'Captive active on' => 'Aktiviert auf', @@ -28,6 +29,7 @@ 'Captive err doublevoucher' => 'Ein Gutschein mit diesem Code ist bereits im Umlauf', 'Captive expire' => 'Ablauf', 'Captive expiry time' => 'Ablaufzeit', +'Captive export coupons' => 'Coupons exportieren', 'Captive generate coupon' => 'Coupon generieren', 'Captive genvoucher' => 'Gutschein generieren', 'Captive invalid logosize' => 'Die hochgeladene Datei entspricht nicht der vorgegeben Auflösung von mindestens 1280x400 und maximal 1920x800 Pixeln', @@ -44,12 +46,15 @@ 'Captive nolimit' => 'Unbegrenzt', 'Captive nr' => 'Nummer', 'Captive please accept the terms and conditions' => 'Bitte akzeptieren Sie die Bedingungen', +'Captive portal' => 'IPFire Captive-Portal', +'Captive portal coupons' => 'Captive-Portal-Coupons', 'Captive terms' => 'Bedingungen', 'Captive terms short' => 'Bedingungen', 'Captive time' => 'Erlaubter Nutzungszeitraum nach Aktivierung (Stunden)', 'Captive title' => 'Titel der Anmeldeseite', 'Captive upload logo' => 'Logo hochladen', 'Captive upload logo recommendations' => '(PNG oder JPEG, 1280x720 Pixel empfohlen)', +'Captive valid for' => 'Gültig für', 'Captive voactive' => 'Aktive Gutscheine', 'Captive voucher' => 'Gutschein', 'Captive vouchervalid' => 'Erlaubter Zeitraum für Gutschein', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 7e4f95c..29c87db 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -13,6 +13,7 @@ 'Captive 1week' => '1 week', 'Captive ACTIVATE' => 'ACTIVATE', 'Captive GAIN ACCESS' => 'GAIN ACCESS', +'Captive WiFi coupon' => 'WiFi Coupon', 'Captive activate' => 'Activate', 'Captive activated' => 'Activated', 'Captive active on' => 'Activated on', @@ -28,6 +29,7 @@ 'Captive err doublevoucher' => 'A voucher with this code already exists', 'Captive expire' => 'Expire', 'Captive expiry time' => 'Expiry Time', +'Captive export coupons' => 'Export Coupons', 'Captive generate coupon' => 'Generate Coupon', 'Captive heading terms' => 'Terms & Conditions', 'Captive heading voucher' => 'Voucher or Access Code', @@ -45,12 +47,15 @@ 'Captive nr' => 'Number', 'Captive please accept the terms and conditions' => 'Please accept the terms & conditions', 'Captive please enter a coupon code' => 'Please enter a coupon code', +'Captive portal' => 'IPFire Captive Portal', +'Captive portal coupons' => 'Captive Portal Coupons', 'Captive terms' => 'Terms & Conditions', 'Captive terms short' => 'T&Cs', 'Captive time' => 'Access time post activation (hours)', 'Captive title' => 'Title of Login Page', 'Captive upload logo' => 'Upload Logo', 'Captive upload logo recommendations' => '(PNG or JPEG, recommended 1280x720 pixels)', +'Captive valid for' => 'Valid for', 'Captive voactive' => 'Active Vouchers', 'Captive voucher' => 'Voucher', 'Captive vouchervalid' => 'Allowed time for this voucher', hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM October 2017