rpi/domo
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update buidlroot to version 2016.08.1

Browse Source
This commit is contained in:
NADAL Jean-Baptiste
2016-11-16 22:07:29 +01:00
parent 807ab03547
commit a1061efbc2
3636 changed files with 59539 additions and 25783 deletions
Download Patch File Download Diff File Expand all files Collapse all files

77
bsp/buildroot/package/wpa_supplicant/0007-systemd-Update-service-files-according-to-dbus-inter.patch Normal file
View File

@@ -0,0 +1,77 @@
From b6cea24d6191d9ccdcd1ac38a5322e3da73218db Mon Sep 17 00:00:00 2001
From: Marcin Niestroj <m.niestroj@grinn-global.com>
Date: Mon, 11 Apr 2016 13:23:54 +0200
Subject: [PATCH] systemd: Update service files according to dbus interface
version used
systemd service files were supplied with old DBus bus name. After
service activation systemd was waiting for appearance of specified bus
name to consider it started successfully. However, if wpa_supplicant was
compiled only with new dbus interface name, then systemd didn't notice
configured (old) DBus bus name appearance. In the end service was
considered malfunctioning and it was deactivated.
Update systemd service BusName property according to supported DBus
interface version.
Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
---
wpa_supplicant/Makefile | 8 ++++++--
wpa_supplicant/systemd/wpa_supplicant.service.in | 4 ++--
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
index ad9ead9..fbd1b25 100644
--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
@@ -1374,6 +1374,7 @@ ifndef DBUS_INCLUDE
DBUS_INCLUDE := $(shell $(PKG_CONFIG) --cflags dbus-1)
endif
DBUS_CFLAGS += $(DBUS_INCLUDE)
+DBUS_INTERFACE=fi.epitest.hostap.WPASupplicant
endif
ifdef CONFIG_CTRL_IFACE_DBUS_NEW
@@ -1399,6 +1400,7 @@ DBUS_OBJS += dbus/dbus_new_introspect.o
DBUS_CFLAGS += -DCONFIG_CTRL_IFACE_DBUS_INTRO
endif
DBUS_CFLAGS += $(DBUS_INCLUDE)
+DBUS_INTERFACE=fi.w1.wpa_supplicant1
endif
ifdef DBUS
@@ -1760,11 +1762,13 @@ else
endif
%.service: %.service.in
- $(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' $< >$@
+ $(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' \
+ -e 's|\@DBUS_INTERFACE\@|$(DBUS_INTERFACE)|g' $< >$@
@$(E) " sed" $<
%@.service: %.service.arg.in
- $(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' $< >$@
+ $(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' \
+ -e 's|\@DBUS_INTERFACE\@|$(DBUS_INTERFACE)|g' $< >$@
@$(E) " sed" $<
wpa_supplicant.exe: wpa_supplicant
diff --git a/wpa_supplicant/systemd/wpa_supplicant.service.in b/wpa_supplicant/systemd/wpa_supplicant.service.in
index ea964ce..bc5d49a 100644
--- a/wpa_supplicant/systemd/wpa_supplicant.service.in
+++ b/wpa_supplicant/systemd/wpa_supplicant.service.in
@@ -5,9 +5,9 @@ Wants=network.target
[Service]
Type=dbus
-BusName=fi.epitest.hostap.WPASupplicant
+BusName=@DBUS_INTERFACE@
ExecStart=@BINDIR@/wpa_supplicant -u
[Install]
WantedBy=multi-user.target
-Alias=dbus-fi.epitest.hostap.WPASupplicant.service
+Alias=dbus-@DBUS_INTERFACE@.service
--
2.8.0

85
bsp/buildroot/package/wpa_supplicant/0008-WPS-Reject-a-Credential-with-invalid-passphrase.patch Normal file
View File

@@ -0,0 +1,85 @@
From ecbb0b3dc122b0d290987cf9c84010bbe53e1022 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Fri, 4 Mar 2016 17:20:18 +0200
Subject: [PATCH] WPS: Reject a Credential with invalid passphrase
WPA/WPA2-Personal passphrase is not allowed to include control
characters. Reject a Credential received from a WPS Registrar both as
STA (Credential) and AP (AP Settings) if the credential is for WPAPSK or
WPA2PSK authentication type and includes an invalid passphrase.
This fixes an issue where hostapd or wpa_supplicant could have updated
the configuration file PSK/passphrase parameter with arbitrary data from
an external device (Registrar) that may not be fully trusted. Should
such data include a newline character, the resulting configuration file
could become invalid and fail to be parsed.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
Patch status: upstream (ecbb0b3dc122b0d290987cf9c84010bbe53e1022)
src/utils/common.c | 12 ++++++++++++
src/utils/common.h | 1 +
src/wps/wps_attr_process.c | 10 ++++++++++
3 files changed, 23 insertions(+)
diff --git a/src/utils/common.c b/src/utils/common.c
index 450e2c6519ba..27b7c02de10b 100644
--- a/src/utils/common.c
+++ b/src/utils/common.c
@@ -697,6 +697,18 @@ int is_hex(const u8 *data, size_t len)
}
+int has_ctrl_char(const u8 *data, size_t len)
+{
+ size_t i;
+
+ for (i = 0; i < len; i++) {
+ if (data[i] < 32 || data[i] == 127)
+ return 1;
+ }
+ return 0;
+}
+
+
size_t merge_byte_arrays(u8 *res, size_t res_len,
const u8 *src1, size_t src1_len,
const u8 *src2, size_t src2_len)
diff --git a/src/utils/common.h b/src/utils/common.h
index 701dbb236ed5..a97224070385 100644
--- a/src/utils/common.h
+++ b/src/utils/common.h
@@ -488,6 +488,7 @@ const char * wpa_ssid_txt(const u8 *ssid, size_t ssid_len);
char * wpa_config_parse_string(const char *value, size_t *len);
int is_hex(const u8 *data, size_t len);
+int has_ctrl_char(const u8 *data, size_t len);
size_t merge_byte_arrays(u8 *res, size_t res_len,
const u8 *src1, size_t src1_len,
const u8 *src2, size_t src2_len);
diff --git a/src/wps/wps_attr_process.c b/src/wps/wps_attr_process.c
index eadb22fe2e78..e8c4579309ab 100644
--- a/src/wps/wps_attr_process.c
+++ b/src/wps/wps_attr_process.c
@@ -229,6 +229,16 @@ static int wps_workaround_cred_key(struct wps_credential *cred)
cred->key_len--;
#endif /* CONFIG_WPS_STRICT */
}
+
+
+ if (cred->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK) &&
+ (cred->key_len < 8 || has_ctrl_char(cred->key, cred->key_len))) {
+ wpa_printf(MSG_INFO, "WPS: Reject credential with invalid WPA/WPA2-Personal passphrase");
+ wpa_hexdump_ascii_key(MSG_INFO, "WPS: Network Key",
+ cred->key, cred->key_len);
+ return -1;
+ }
+
return 0;
}
--
2.8.1

53
bsp/buildroot/package/wpa_supplicant/0009-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch Normal file
View File

@@ -0,0 +1,53 @@
From 73e4abb24a936014727924d8b0b2965edfc117dd Mon Sep 17 00:00:00 2001
From: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Fri, 4 Mar 2016 18:46:41 +0200
Subject: [PATCH] Reject psk parameter set with invalid passphrase character
WPA/WPA2-Personal passphrase is not allowed to include control
characters. Reject a passphrase configuration attempt if that passphrase
includes an invalid passphrase.
This fixes an issue where wpa_supplicant could have updated the
configuration file psk parameter with arbitrary data from the control
interface or D-Bus interface. While those interfaces are supposed to be
accessible only for trusted users/applications, it may be possible that
an untrusted user has access to a management software component that
does not validate the passphrase value before passing it to
wpa_supplicant.
This could allow such an untrusted user to inject up to 63 characters of
almost arbitrary data into the configuration file. Such configuration
file could result in wpa_supplicant trying to load a library (e.g.,
opensc_engine_path, pkcs11_engine_path, pkcs11_module_path,
load_dynamic_eap) from user controlled location when starting again.
This would allow code from that library to be executed under the
wpa_supplicant process privileges.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
Patch status: upstream (73e4abb24a936014727924d8b0b2965edfc117dd)
wpa_supplicant/config.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index b1c7870dafe0..fdd964356afa 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -478,6 +478,12 @@ static int wpa_config_parse_psk(const struct parse_data *data,
}
wpa_hexdump_ascii_key(MSG_MSGDUMP, "PSK (ASCII passphrase)",
(u8 *) value, len);
+ if (has_ctrl_char((u8 *) value, len)) {
+ wpa_printf(MSG_ERROR,
+ "Line %d: Invalid passphrase character",
+ line);
+ return -1;
+ }
if (ssid->passphrase && os_strlen(ssid->passphrase) == len &&
os_memcmp(ssid->passphrase, value, len) == 0) {
/* No change to the previously configured value */
--
2.8.1

84
bsp/buildroot/package/wpa_supplicant/0010-Remove-newlines-from-wpa_supplicant-config-network-o.patch Normal file
View File

@@ -0,0 +1,84 @@
From 0fe5a234240a108b294a87174ad197f6b5cb38e9 Mon Sep 17 00:00:00 2001
From: Paul Stewart <pstew@google.com>
Date: Thu, 3 Mar 2016 15:40:19 -0800
Subject: [PATCH] Remove newlines from wpa_supplicant config network output
Spurious newlines output while writing the config file can corrupt the
wpa_supplicant configuration. Avoid writing these for the network block
parameters. This is a generic filter that cover cases that may not have
been explicitly addressed with a more specific commit to avoid control
characters in the psk parameter.
Signed-off-by: Paul Stewart <pstew@google.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
Patch status: upstream (0fe5a234240a108b294a87174ad197f6b5cb38e9)
src/utils/common.c | 11 +++++++++++
src/utils/common.h | 1 +
wpa_supplicant/config.c | 15 +++++++++++++--
3 files changed, 25 insertions(+), 2 deletions(-)
diff --git a/src/utils/common.c b/src/utils/common.c
index 27b7c02de10b..9856463242c7 100644
--- a/src/utils/common.c
+++ b/src/utils/common.c
@@ -709,6 +709,17 @@ int has_ctrl_char(const u8 *data, size_t len)
}
+int has_newline(const char *str)
+{
+ while (*str) {
+ if (*str == '\n' || *str == '\r')
+ return 1;
+ str++;
+ }
+ return 0;
+}
+
+
size_t merge_byte_arrays(u8 *res, size_t res_len,
const u8 *src1, size_t src1_len,
const u8 *src2, size_t src2_len)
diff --git a/src/utils/common.h b/src/utils/common.h
index a97224070385..d19927b375bf 100644
--- a/src/utils/common.h
+++ b/src/utils/common.h
@@ -489,6 +489,7 @@ const char * wpa_ssid_txt(const u8 *ssid, size_t ssid_len);
char * wpa_config_parse_string(const char *value, size_t *len);
int is_hex(const u8 *data, size_t len);
int has_ctrl_char(const u8 *data, size_t len);
+int has_newline(const char *str);
size_t merge_byte_arrays(u8 *res, size_t res_len,
const u8 *src1, size_t src1_len,
const u8 *src2, size_t src2_len);
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index fdd964356afa..eb97cd5e4e6e 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -2699,8 +2699,19 @@ char * wpa_config_get(struct wpa_ssid *ssid, const char *var)
for (i = 0; i < NUM_SSID_FIELDS; i++) {
const struct parse_data *field = &ssid_fields[i];
- if (os_strcmp(var, field->name) == 0)
- return field->writer(field, ssid);
+ if (os_strcmp(var, field->name) == 0) {
+ char *ret = field->writer(field, ssid);
+
+ if (ret && has_newline(ret)) {
+ wpa_printf(MSG_ERROR,
+ "Found newline in value for %s; not returning it",
+ var);
+ os_free(ret);
+ ret = NULL;
+ }
+
+ return ret;
+ }
}
return NULL;
--
2.8.1

65
bsp/buildroot/package/wpa_supplicant/0011-Reject-SET_CRED-commands-with-newline-characters-in-.patch Normal file
View File

@@ -0,0 +1,65 @@
From b166cd84a77a6717be9600bf95378a0055d6f5a5 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Tue, 5 Apr 2016 23:33:10 +0300
Subject: [PATCH] Reject SET_CRED commands with newline characters in the
string values
Most of the cred block parameters are written as strings without
filtering and if there is an embedded newline character in the value,
unexpected configuration file data might be written.
This fixes an issue where wpa_supplicant could have updated the
configuration file cred parameter with arbitrary data from the control
interface or D-Bus interface. While those interfaces are supposed to be
accessible only for trusted users/applications, it may be possible that
an untrusted user has access to a management software component that
does not validate the credential value before passing it to
wpa_supplicant.
This could allow such an untrusted user to inject almost arbitrary data
into the configuration file. Such configuration file could result in
wpa_supplicant trying to load a library (e.g., opensc_engine_path,
pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user
controlled location when starting again. This would allow code from that
library to be executed under the wpa_supplicant process privileges.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
Patch status: upstream (b166cd84a77a6717be9600bf95378a0055d6f5a5)
wpa_supplicant/config.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index eb97cd5e4e6e..69152efdea1a 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -2896,6 +2896,8 @@ int wpa_config_set_cred(struct wpa_cred *cred, const char *var,
if (os_strcmp(var, "password") == 0 &&
os_strncmp(value, "ext:", 4) == 0) {
+ if (has_newline(value))
+ return -1;
str_clear_free(cred->password);
cred->password = os_strdup(value);
cred->ext_password = 1;
@@ -2946,9 +2948,14 @@ int wpa_config_set_cred(struct wpa_cred *cred, const char *var,
}
val = wpa_config_parse_string(value, &len);
- if (val == NULL) {
+ if (val == NULL ||
+ (os_strcmp(var, "excluded_ssid") != 0 &&
+ os_strcmp(var, "roaming_consortium") != 0 &&
+ os_strcmp(var, "required_roaming_consortium") != 0 &&
+ has_newline(val))) {
wpa_printf(MSG_ERROR, "Line %d: invalid field '%s' string "
"value '%s'.", line, var, value);
+ os_free(val);
return -1;
}
--
2.8.1

53
bsp/buildroot/package/wpa_supplicant/0012-Reject-SET-commands-with-newline-characters-in-the-s.patch Normal file
View File

@@ -0,0 +1,53 @@
From 2a3f56502b52375c3bf113cf92adfa99bad6b488 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Tue, 5 Apr 2016 23:55:48 +0300
Subject: [PATCH] Reject SET commands with newline characters in the string
values
Many of the global configuration parameters are written as strings
without filtering and if there is an embedded newline character in the
value, unexpected configuration file data might be written.
This fixes an issue where wpa_supplicant could have updated the
configuration file global parameter with arbitrary data from the control
interface or D-Bus interface. While those interfaces are supposed to be
accessible only for trusted users/applications, it may be possible that
an untrusted user has access to a management software component that
does not validate the value of a parameter before passing it to
wpa_supplicant.
This could allow such an untrusted user to inject almost arbitrary data
into the configuration file. Such configuration file could result in
wpa_supplicant trying to load a library (e.g., opensc_engine_path,
pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user
controlled location when starting again. This would allow code from that
library to be executed under the wpa_supplicant process privileges.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
Patch status: upstream (2a3f56502b52375c3bf113cf92adfa99bad6b488)
wpa_supplicant/config.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index 69152efdea1a..d9a1603f6d7e 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -3764,6 +3764,12 @@ static int wpa_global_config_parse_str(const struct global_parse_data *data,
return -1;
}
+ if (has_newline(pos)) {
+ wpa_printf(MSG_ERROR, "Line %d: invalid %s value with newline",
+ line, data->name);
+ return -1;
+ }
+
tmp = os_strdup(pos);
if (tmp == NULL)
return -1;
--
2.8.1

11
bsp/buildroot/package/wpa_supplicant/Config.in
View File

@@ -38,6 +38,17 @@ config BR2_PACKAGE_WPA_SUPPLICANT_AP_SUPPORT
making it bigger but dispensing the need for a separate hostapd
binary in some applications hence being smaller overall.
config BR2_PACKAGE_WPA_SUPPLICANT_WIFI_DISPLAY
bool "Enable Wi-Fi Display"
depends on BR2_PACKAGE_WPA_SUPPLICANT_AP_SUPPORT
help
Enable support for Wi-Fi Display
config BR2_PACKAGE_WPA_SUPPLICANT_AUTOSCAN
bool "Enable autoscan"
help
Enable support for the autoscan feature (allow periodic scan)
config BR2_PACKAGE_WPA_SUPPLICANT_EAP
bool "Enable EAP"
help

13
bsp/buildroot/package/wpa_supplicant/wpa_supplicant.mk
View File

@@ -20,7 +20,8 @@ WPA_SUPPLICANT_INSTALL_STAGING = YES
WPA_SUPPLICANT_CONFIG_EDITS =
WPA_SUPPLICANT_CONFIG_SET =
# Add support for simple background scan
WPA_SUPPLICANT_CONFIG_SET = CONFIG_BGSCAN_SIMPLE
WPA_SUPPLICANT_CONFIG_ENABLE = \
CONFIG_IEEE80211AC \
@@ -67,6 +68,16 @@ WPA_SUPPLICANT_CONFIG_ENABLE += \
CONFIG_P2P
endif
ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_WIFI_DISPLAY),y)
WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_WIFI_DISPLAY
endif
ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_AUTOSCAN),y)
WPA_SUPPLICANT_CONFIG_ENABLE += \
CONFIG_AUTOSCAN_EXPONENTIAL \
CONFIG_AUTOSCAN_PERIODIC
endif
ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_WPS),y)
WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_WPS
endif