mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 00:04:06 -09:00
package/wpa_supplicant: security bump to 2.12
See here for a Changelog:
https://git.w1.fi/cgit/hostap/tree/wpa_supplicant/ChangeLog?id=e6386389448a4e0ec568fa7a27026e03f95bb768
Security issues fixed in this release:
https://w1.fi/security/2026-4/incomplete-bounds-checking-of-mesh-ampe-messages-in-wpa_supplicant.txt
https://w1.fi/security/2026-3/unexpected-sae-commit-message-contents-terminating-wpa_suppliant.txt
https://w1.fi/security/2026-2/missing-network-context-validation-for-pmksa-caching.txt
https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
Patches 0001 and 0002 are upstream.
Tested on Raspberry PI4 (64 Bit).
License changed:
-Copyright (c) 2002-2024, Jouni Malinen <j@w1.fi> and contributors
+Copyright (c) 2002-2026, Jouni Malinen <j@w1.fi> and contributors
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9ec3435c0a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
This commit is contained in:
Waldemar Brodkorb
committed by
Titouan Christophe
Titouan Christophe
parent
da203b8b8f
commit
f627aa27f7
@@ -1,55 +0,0 @@
|
||||
From 170d8a433308ee39f87af94acaef461f8e80b67b Mon Sep 17 00:00:00 2001
|
||||
From: Janne Grunau <janne-fdr@jannau.net>
|
||||
Date: Sun, 4 Aug 2024 13:24:42 +0200
|
||||
Subject: [PATCH] Revert "Mark authorization completed on driver indication during 4-way HS offload"
|
||||
|
||||
This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5.
|
||||
|
||||
Signed-off-by: Janne Grunau <janne-fdr@jannau.net>
|
||||
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
|
||||
|
||||
Upstream: not yet sent, ongoing discussion http://lists.infradead.org/pipermail/hostap/2024-August/042893.html
|
||||
|
||||
---
|
||||
wpa_supplicant/events.c | 25 ++++++++-----------------
|
||||
1 file changed, 8 insertions(+), 17 deletions(-)
|
||||
|
||||
diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
|
||||
index 49917f7aa..bbb3a3eda 100644
|
||||
--- a/wpa_supplicant/events.c
|
||||
+++ b/wpa_supplicant/events.c
|
||||
@@ -4327,23 +4327,14 @@ static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,
|
||||
eapol_sm_notify_eap_success(wpa_s->eapol, true);
|
||||
} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) &&
|
||||
wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
|
||||
- if (already_authorized) {
|
||||
- /*
|
||||
- * We are done; the driver will take care of RSN 4-way
|
||||
- * handshake.
|
||||
- */
|
||||
- wpa_supplicant_cancel_auth_timeout(wpa_s);
|
||||
- wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
|
||||
- eapol_sm_notify_portValid(wpa_s->eapol, true);
|
||||
- eapol_sm_notify_eap_success(wpa_s->eapol, true);
|
||||
- } else {
|
||||
- /* Update port, WPA_COMPLETED state from the
|
||||
- * EVENT_PORT_AUTHORIZED handler when the driver is done
|
||||
- * with the 4-way handshake.
|
||||
- */
|
||||
- wpa_msg(wpa_s, MSG_DEBUG,
|
||||
- "ASSOC INFO: wait for driver port authorized indication");
|
||||
- }
|
||||
+ /*
|
||||
+ * We are done; the driver will take care of RSN 4-way
|
||||
+ * handshake.
|
||||
+ */
|
||||
+ wpa_supplicant_cancel_auth_timeout(wpa_s);
|
||||
+ wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
|
||||
+ eapol_sm_notify_portValid(wpa_s->eapol, true);
|
||||
+ eapol_sm_notify_eap_success(wpa_s->eapol, true);
|
||||
} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) &&
|
||||
wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
|
||||
/*
|
||||
--
|
||||
2.45.2
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
From 809d9d8172db8e2a08ff639875f838b5b86d2641 Mon Sep 17 00:00:00 2001
|
||||
From: Sergey Matyukevich <geomatsi@gmail.com>
|
||||
Date: Thu, 22 Aug 2024 00:03:41 +0300
|
||||
Subject: [PATCH] macsec_linux: Hardware offload requires Linux headers >= v5.7
|
||||
|
||||
Hardware offload in Linux macsec driver is enabled in compile time if
|
||||
libnl version is >= v3.6. This is not sufficient for successful build
|
||||
since enum 'macsec_offload' has been added to Linux header if_link.h
|
||||
in kernels v5.6 and v5.7, see commits:
|
||||
- https://github.com/torvalds/linux/commit/21114b7feec29e4425a3ac48a037569c016a46c8
|
||||
- https://github.com/torvalds/linux/commit/76564261a7db80c5f5c624e0122a28787f266bdf
|
||||
|
||||
New libnl with older Linux headers is a valid combination. This is how
|
||||
hostapd build failure has been detected by Buildroot autobuilder, see:
|
||||
- http://autobuild.buildroot.net/results/b59d5bc5bd17683a3a1e3577c40c802e81911f84/
|
||||
|
||||
Extend compile time condition for the enablement of the macsec hardware
|
||||
offload adding Linux headers version check.
|
||||
|
||||
Fixes: 40c139664439 ("macsec_linux: Add support for MACsec hardware offload")
|
||||
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
|
||||
|
||||
Upstream: https://w1.fi/cgit/hostap/commit/?id=809d9d8172db8e2a08ff639875f838b5b86d2641
|
||||
|
||||
---
|
||||
src/drivers/driver_macsec_linux.c | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/drivers/driver_macsec_linux.c b/src/drivers/driver_macsec_linux.c
|
||||
index c86715498..fad47a292 100644
|
||||
--- a/src/drivers/driver_macsec_linux.c
|
||||
+++ b/src/drivers/driver_macsec_linux.c
|
||||
@@ -19,6 +19,7 @@
|
||||
#include <netlink/route/link.h>
|
||||
#include <netlink/route/link/macsec.h>
|
||||
#include <linux/if_macsec.h>
|
||||
+#include <linux/version.h>
|
||||
#include <inttypes.h>
|
||||
|
||||
#include "utils/common.h"
|
||||
@@ -32,7 +33,8 @@
|
||||
|
||||
#define UNUSED_SCI 0xffffffffffffffff
|
||||
|
||||
-#if LIBNL_VER_NUM >= LIBNL_VER(3, 6)
|
||||
+#if (LIBNL_VER_NUM >= LIBNL_VER(3, 6) && \
|
||||
+ LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0))
|
||||
#define LIBNL_HAS_OFFLOAD
|
||||
#endif
|
||||
|
||||
--
|
||||
2.46.0
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
# Locally calculated
|
||||
sha256 912ea06f74e30a8e36fbb68064d6cdff218d8d591db0fc5d75dee6c81ac7fc0a wpa_supplicant-2.11.tar.gz
|
||||
sha256 f1b5992bbdd015c3ccb7faaadd62ef58ed821e15b9329bf2ceb27511ccc3f562 README
|
||||
sha256 08e23937e16d0155e55cab2b51f51fbe10d80a1aa91c4e15442645059b737ef6 wpa_supplicant-2.12.tar.gz
|
||||
sha256 83be1b142c59ccf0d6c5dde0695d8f84dfba109bea058e78ec2942389ccf327f README
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
################################################################################
|
||||
|
||||
WPA_SUPPLICANT_VERSION = 2.11
|
||||
WPA_SUPPLICANT_VERSION = 2.12
|
||||
WPA_SUPPLICANT_SITE = http://w1.fi/releases
|
||||
WPA_SUPPLICANT_LICENSE = BSD-3-Clause
|
||||
WPA_SUPPLICANT_LICENSE_FILES = README
|
||||
|
||||
Reference in New Issue
Block a user