This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, master has been updated via 9aa6f9a89f4e57a93bf6b1a751ef6abb9dc7812e (commit) via 08c83af39fbd226728f0da40d25ea62e77e05fb4 (commit) via b31cd7d0fc12e45c2875c9619d063e1e7310e9fe (commit) via 55209df391e11bf97ec1cda2dbf90aa365c75761 (commit) via e902ebe3be6931f6c632b105ad8fe6997afb305c (commit) via 5cdf3b8c78b4c7292b304af6c0b928a3083cd5f4 (commit) via d95f3606831fd03f4bdfdd4bed0f891489907d0d (commit) from 896fa74d68e83b344235dbd147b0e429aafb14d3 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 9aa6f9a89f4e57a93bf6b1a751ef6abb9dc7812e Merge: 08c83af39 55209df39 Author: Michael Tremer michael.tremer@ipfire.org Date: Tue Feb 16 17:36:41 2021 +0000

Merge remote-tracking branch 'ms/wifi-fixes'

commit 08c83af39fbd226728f0da40d25ea62e77e05fb4 Author: Michael Tremer michael.tremer@ipfire.org Date: Tue Feb 16 17:36:22 2021 +0000

core154: Ship openssl

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit b31cd7d0fc12e45c2875c9619d063e1e7310e9fe Author: Michael Tremer michael.tremer@ipfire.org Date: Tue Feb 16 17:28:17 2021 +0000

openssl: Update to 1.1.1j

Null pointer deref in X509_issuer_and_serial_hash() (CVE-2021-23841) ====================================================================

Severity: Moderate

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack.

The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources.

OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j.

OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j.

This issue was reported to OpenSSL on 15th December 2020 by Tavis Ormandy from Google. The fix was developed by Matt Caswell.

Incorrect SSLv2 rollback protection (CVE-2021-23839) ====================================================

Severity: Low

OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed to use a special form of padding. A server that supports greater than SSLv2 is supposed to reject connection attempts from a client where this special form of padding is present, because this indicates that a version rollback has occurred (i.e. both client and server support greater than SSLv2, and yet this is the version that is being requested).

The implementation of this padding check inverted the logic so that the connection attempt is accepted if the padding is present, and rejected if it is absent. This means that such as server will accept a connection if a version rollback attack has occurred. Further the server will erroneously reject a connection if a normal SSLv2 connection attempt is made.

Only OpenSSL 1.0.2 servers from version 1.0.2s to 1.0.2x are affected by this issue. In order to be vulnerable a 1.0.2 server must:

1) have configured SSLv2 support at compile time (this is off by default), 2) have configured SSLv2 support at runtime (this is off by default), 3) have configured SSLv2 ciphersuites (these are not in the default ciphersuite list)

OpenSSL 1.1.1 does not have SSLv2 support and therefore is not vulnerable to this issue. The underlying error is in the implementation of the RSA_padding_check_SSLv23() function. This also affects the RSA_SSLV23_PADDING padding mode used by various other functions. Although 1.1.1 does not support SSLv2 the RSA_padding_check_SSLv23() function still exists, as does the RSA_SSLV23_PADDING padding mode. Applications that directly call that function or use that padding mode will encounter this issue. However since there is no support for the SSLv2 protocol in 1.1.1 this is considered a bug and not a security issue in that version.

OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j.

This issue was reported to OpenSSL on 21st January 2021 by D. Katz and Joel Luellwitz from Trustwave. The fix was developed by Matt Caswell.

Integer overflow in CipherUpdate (CVE-2021-23840) =================================================

Severity: Low

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash.

OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j.

OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j.

This issue was reported to OpenSSL on 13th December 2020 by Paul Kehrer. The fix was developed by Matt Caswell.

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit 55209df391e11bf97ec1cda2dbf90aa365c75761 Author: Michael Tremer michael.tremer@ipfire.org Date: Tue Feb 16 17:44:45 2021 +0100

wlanclient: Do not force using legacy interface to talk to the kernel

"wireless extensions" is the old interface to speak to the kernel.

All newer drivers support nl80211 now.

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit e902ebe3be6931f6c632b105ad8fe6997afb305c Author: Michael Tremer michael.tremer@ipfire.org Date: Tue Feb 16 17:41:23 2021 +0100

wirelessclient.cgi: Show when 802.11w is active

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit 5cdf3b8c78b4c7292b304af6c0b928a3083cd5f4 Author: Michael Tremer michael.tremer@ipfire.org Date: Tue Feb 16 17:37:07 2021 +0100

wirelessclient.cgi: Show when actually connected using WPA3

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit d95f3606831fd03f4bdfdd4bed0f891489907d0d Author: Michael Tremer michael.tremer@ipfire.org Date: Tue Feb 16 17:34:02 2021 +0100

wirelessclient.cgi: Show when using WPA3

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: config/rootfiles/common/openssl | 4 +++ .../100 => core/154}/filelists/i586/openssl-sse2 | 0 .../{oldcore/100 => core/154}/filelists/openssl | 0 doc/language_issues.de | 1 + doc/language_issues.en | 1 + doc/language_issues.es | 1 + doc/language_issues.fr | 1 + doc/language_issues.it | 1 + doc/language_issues.nl | 1 + doc/language_issues.pl | 1 + doc/language_issues.ru | 1 + doc/language_issues.tr | 1 + doc/language_missings | 8 ++++++ html/cgi-bin/wirelessclient.cgi | 30 +++++++++++++++++++++- langs/en/cgi-bin/en.pl | 1 + lfs/openssl | 4 +-- src/initscripts/system/wlanclient | 4 +-- 17 files changed, 54 insertions(+), 6 deletions(-) copy config/rootfiles/{oldcore/100 => core/154}/filelists/i586/openssl-sse2 (100%) copy config/rootfiles/{oldcore/100 => core/154}/filelists/openssl (100%)

Difference in files: diff --git a/config/rootfiles/common/openssl b/config/rootfiles/common/openssl index df6bbe320..989670262 100644 --- a/config/rootfiles/common/openssl +++ b/config/rootfiles/common/openssl @@ -869,6 +869,7 @@ usr/lib/libssl.so.1.1 #usr/share/doc/openssl/html/man3/DH_check_pub_key_ex.html #usr/share/doc/openssl/html/man3/DH_clear_flags.html #usr/share/doc/openssl/html/man3/DH_compute_key.html +#usr/share/doc/openssl/html/man3/DH_compute_key_padded.html #usr/share/doc/openssl/html/man3/DH_free.html #usr/share/doc/openssl/html/man3/DH_generate_key.html #usr/share/doc/openssl/html/man3/DH_generate_parameters.html @@ -1983,6 +1984,7 @@ usr/lib/libssl.so.1.1 #usr/share/doc/openssl/html/man3/OCSP_REQUEST_new.html #usr/share/doc/openssl/html/man3/OCSP_REQ_CTX_add1_header.html #usr/share/doc/openssl/html/man3/OCSP_REQ_CTX_free.html +#usr/share/doc/openssl/html/man3/OCSP_REQ_CTX_i2d.html #usr/share/doc/openssl/html/man3/OCSP_REQ_CTX_set1_req.html #usr/share/doc/openssl/html/man3/OCSP_RESPBYTES_free.html #usr/share/doc/openssl/html/man3/OCSP_RESPBYTES_new.html @@ -4838,6 +4840,7 @@ usr/lib/libssl.so.1.1 #usr/share/man/man3/DH_check_pub_key_ex.3 #usr/share/man/man3/DH_clear_flags.3 #usr/share/man/man3/DH_compute_key.3 +#usr/share/man/man3/DH_compute_key_padded.3 #usr/share/man/man3/DH_free.3 #usr/share/man/man3/DH_generate_key.3 #usr/share/man/man3/DH_generate_parameters.3 @@ -5952,6 +5955,7 @@ usr/lib/libssl.so.1.1 #usr/share/man/man3/OCSP_REQUEST_new.3 #usr/share/man/man3/OCSP_REQ_CTX_add1_header.3 #usr/share/man/man3/OCSP_REQ_CTX_free.3 +#usr/share/man/man3/OCSP_REQ_CTX_i2d.3 #usr/share/man/man3/OCSP_REQ_CTX_set1_req.3 #usr/share/man/man3/OCSP_RESPBYTES_free.3 #usr/share/man/man3/OCSP_RESPBYTES_new.3 diff --git a/config/rootfiles/core/154/filelists/i586/openssl-sse2 b/config/rootfiles/core/154/filelists/i586/openssl-sse2 new file mode 120000 index 000000000..f424713d6 --- /dev/null +++ b/config/rootfiles/core/154/filelists/i586/openssl-sse2 @@ -0,0 +1 @@ +../../../../common/i586/openssl-sse2 \ No newline at end of file diff --git a/config/rootfiles/core/154/filelists/openssl b/config/rootfiles/core/154/filelists/openssl new file mode 120000 index 000000000..e011a9266 --- /dev/null +++ b/config/rootfiles/core/154/filelists/openssl @@ -0,0 +1 @@ +../../../common/openssl \ No newline at end of file diff --git a/doc/language_issues.de b/doc/language_issues.de index aae7ca565..5d079036a 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -889,6 +889,7 @@ WARNING: untranslated string: smb daemon = SMB Daemon WARNING: untranslated string: user management = User Management WARNING: untranslated string: winbind daemon = Winbind Daemon WARNING: untranslated string: wlan client encryption wpa3 = WPA3 +WARNING: untranslated string: wlan client management frame protection = Management Frame Protection WARNING: untranslated string: wlanap 802.11w disabled = Disabled WARNING: untranslated string: wlanap 802.11w enforced = Enforced WARNING: untranslated string: wlanap 802.11w optional = Optional diff --git a/doc/language_issues.en b/doc/language_issues.en index 434115902..6e30eb995 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -2132,6 +2132,7 @@ WARNING: untranslated string: wlan client group cipher = Group cipher WARNING: untranslated string: wlan client group key algorithm = GKA WARNING: untranslated string: wlan client identity = Identity WARNING: untranslated string: wlan client invalid key length = Invalid key length. +WARNING: untranslated string: wlan client management frame protection = Management Frame Protection WARNING: untranslated string: wlan client method = Method WARNING: untranslated string: wlan client new entry = Create new wireless client configuration WARNING: untranslated string: wlan client new network = New network diff --git a/doc/language_issues.es b/doc/language_issues.es index 2feec8924..82d65d99c 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -1509,6 +1509,7 @@ WARNING: untranslated string: wlan client group cipher = Group cipher WARNING: untranslated string: wlan client group key algorithm = GKA WARNING: untranslated string: wlan client identity = Identity WARNING: untranslated string: wlan client invalid key length = Invalid key length. +WARNING: untranslated string: wlan client management frame protection = Management Frame Protection WARNING: untranslated string: wlan client method = Method WARNING: untranslated string: wlan client new entry = Create new wireless client configuration WARNING: untranslated string: wlan client new network = New network diff --git a/doc/language_issues.fr b/doc/language_issues.fr index 835352cf5..942be73ec 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -919,3 +919,4 @@ WARNING: untranslated string: routing config changed = unknown string WARNING: untranslated string: token = Token: WARNING: untranslated string: token not set = No Token has been given. WARNING: untranslated string: wlan client encryption wpa3 = WPA3 +WARNING: untranslated string: wlan client management frame protection = Management Frame Protection diff --git a/doc/language_issues.it b/doc/language_issues.it index 152ce4786..98074e59f 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -1197,6 +1197,7 @@ WARNING: untranslated string: wlan client eap state = EAP Status WARNING: untranslated string: wlan client encryption eap = EAP WARNING: untranslated string: wlan client encryption wpa3 = WPA3 WARNING: untranslated string: wlan client identity = Identity +WARNING: untranslated string: wlan client management frame protection = Management Frame Protection WARNING: untranslated string: wlan client method = Method WARNING: untranslated string: wlan client password = Password WARNING: untranslated string: wlan client tls cipher = TLS Cipher diff --git a/doc/language_issues.nl b/doc/language_issues.nl index 683c08f44..8eebbd57f 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -1237,6 +1237,7 @@ WARNING: untranslated string: wlan client eap state = EAP Status WARNING: untranslated string: wlan client encryption eap = EAP WARNING: untranslated string: wlan client encryption wpa3 = WPA3 WARNING: untranslated string: wlan client identity = Identity +WARNING: untranslated string: wlan client management frame protection = Management Frame Protection WARNING: untranslated string: wlan client method = Method WARNING: untranslated string: wlan client password = Password WARNING: untranslated string: wlan client tls cipher = TLS Cipher diff --git a/doc/language_issues.pl b/doc/language_issues.pl index 2feec8924..82d65d99c 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -1509,6 +1509,7 @@ WARNING: untranslated string: wlan client group cipher = Group cipher WARNING: untranslated string: wlan client group key algorithm = GKA WARNING: untranslated string: wlan client identity = Identity WARNING: untranslated string: wlan client invalid key length = Invalid key length. +WARNING: untranslated string: wlan client management frame protection = Management Frame Protection WARNING: untranslated string: wlan client method = Method WARNING: untranslated string: wlan client new entry = Create new wireless client configuration WARNING: untranslated string: wlan client new network = New network diff --git a/doc/language_issues.ru b/doc/language_issues.ru index cbd25d176..43c1f8c08 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -1502,6 +1502,7 @@ WARNING: untranslated string: wlan client group cipher = Group cipher WARNING: untranslated string: wlan client group key algorithm = GKA WARNING: untranslated string: wlan client identity = Identity WARNING: untranslated string: wlan client invalid key length = Invalid key length. +WARNING: untranslated string: wlan client management frame protection = Management Frame Protection WARNING: untranslated string: wlan client method = Method WARNING: untranslated string: wlan client new entry = Create new wireless client configuration WARNING: untranslated string: wlan client new network = New network diff --git a/doc/language_issues.tr b/doc/language_issues.tr index e4c25f931..439a58890 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -1067,6 +1067,7 @@ WARNING: untranslated string: vulnerable = Vulnerable WARNING: untranslated string: whois results from = WHOIS results from WARNING: untranslated string: winbind daemon = Winbind Daemon WARNING: untranslated string: wlan client encryption wpa3 = WPA3 +WARNING: untranslated string: wlan client management frame protection = Management Frame Protection WARNING: untranslated string: wlanap 802.11w disabled = Disabled WARNING: untranslated string: wlanap 802.11w enforced = Enforced WARNING: untranslated string: wlanap 802.11w optional = Optional diff --git a/doc/language_missings b/doc/language_missings index 1956eac48..0d89426ca 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -65,6 +65,7 @@ < wlanap 802.11w enforced < wlanap 802.11w optional < wlan client encryption wpa3 +< wlan client management frame protection ############################################################################ # Checking cgi-bin translations for language: es # ############################################################################ @@ -927,6 +928,7 @@ < wlan client group key algorithm < wlan client identity < wlan client invalid key length +< wlan client management frame protection < wlan client method < wlan client new entry < wlan client new network @@ -974,6 +976,7 @@ < token not set < upload fcdsl.o < wlan client encryption wpa3 +< wlan client management frame protection ############################################################################ # Checking cgi-bin translations for language: it # ############################################################################ @@ -1339,6 +1342,7 @@ < wlan client encryption eap < wlan client encryption wpa3 < wlan client identity +< wlan client management frame protection < wlan client method < wlan client password < wlan client tls cipher @@ -1777,6 +1781,7 @@ < wlan client encryption eap < wlan client encryption wpa3 < wlan client identity +< wlan client management frame protection < wlan client method < wlan client password < wlan client tls cipher @@ -2643,6 +2648,7 @@ < wlan client group key algorithm < wlan client identity < wlan client invalid key length +< wlan client management frame protection < wlan client method < wlan client new entry < wlan client new network @@ -3529,6 +3535,7 @@ < wlan client group key algorithm < wlan client identity < wlan client invalid key length +< wlan client management frame protection < wlan client method < wlan client new entry < wlan client new network @@ -3738,6 +3745,7 @@ < wlanap neighbor scan warning < wlanap ssid < wlan client encryption wpa3 +< wlan client management frame protection < working < zoneconf access native < zoneconf access none diff --git a/html/cgi-bin/wirelessclient.cgi b/html/cgi-bin/wirelessclient.cgi index e8c3c9628..d8637ccd2 100644 --- a/html/cgi-bin/wirelessclient.cgi +++ b/html/cgi-bin/wirelessclient.cgi @@ -324,6 +324,8 @@ END $encryption_mode = $Lang::tr{'wlan client encryption wpa'}; } elsif ($config[3] eq "WPA2") { $encryption_mode = $Lang::tr{'wlan client encryption wpa2'}; + } elsif ($config[3] eq "WPA3") { + $encryption_mode = $Lang::tr{'wlan client encryption wpa3'}; } elsif ($config[3] eq "EAP") { $encryption_mode = $Lang::tr{'wlan client encryption eap'}; } @@ -682,6 +684,19 @@ sub ShowStatus() { </tr> END

+ if ($status{'pmf'} eq "1") { + print <<END; + <tr> + <td width='20%'> + $Lang::tr{'wlan client management frame protection'} + </td> + <td width='80%'> + $Lang::tr{'active'} + </td> + </tr> +END + } + if ($status{'EAP state'}) { my $selected_method = $status{'selectedMethod'}; $selected_method =~ s/\d+ ((.*))/$1/e; @@ -736,12 +751,25 @@ END }

if (($status{'pairwise_cipher'} ne "NONE") || ($status{'group_cipher'} ne "NONE")) { - print <<END; + if ($status{'key_mgmt'} eq "SAE") { + print <<END; + <tr> + <td colspan='2'> + <strong>$Lang::tr{'wlan client encryption wpa3'}</strong> + </td> + </tr> +END + } else { + print <<END; <tr> <td colspan='2'> <strong>$Lang::tr{'wlan client encryption wpa'}</strong> </td> </tr> +END + } + + print <<END; <tr> <td width='20%'> $Lang::tr{'wlan client pairwise cipher'} diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 22e8a4cc6..95a1cfda4 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -2956,6 +2956,7 @@ 'wlan client group key algorithm' => 'GKA', 'wlan client identity' => 'Identity', 'wlan client invalid key length' => 'Invalid key length.', +'wlan client management frame protection' => 'Management Frame Protection', 'wlan client method' => 'Method', 'wlan client new entry' => 'Create new wireless client configuration', 'wlan client new network' => 'New network', diff --git a/lfs/openssl b/lfs/openssl index 16e20b439..ea7eff135 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -24,7 +24,7 @@

include Config

-VER = 1.1.1i +VER = 1.1.1j

THISAPP = openssl-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -87,7 +87,7 @@ objects = $(DL_FILE)

$(DL_FILE) = $(DL_FROM)/$(DL_FILE)

-$(DL_FILE)_MD5 = 08987c3cf125202e2b0840035efb392c +$(DL_FILE)_MD5 = cccaa064ed860a2b4d1303811bf5c682

install : $(TARGET)

diff --git a/src/initscripts/system/wlanclient b/src/initscripts/system/wlanclient index 4b3938b46..338a743ab 100644 --- a/src/initscripts/system/wlanclient +++ b/src/initscripts/system/wlanclient @@ -275,9 +275,7 @@ function wpa_supplicant_start() { # Build wpa_supplicant command line. local wpa_suppl_cmd="wpa_supplicant -B -qqq -i${device} -c${config}"

- if device_is_wireless ${device}; then - wpa_suppl_cmd="${wpa_suppl_cmd} -Dwext" - else + if ! device_is_wireless ${device}; then wpa_suppl_cmd="${wpa_suppl_cmd} -Dwired" fi

hooks/post-receive -- IPFire 2.x development tree