Hi,
for being able to build wpa 2.6, all that is needed is to refresh the
patches (as I did with the attached patch).
Cheers,
Julian
diff --git a/debian/patches/01_use_pkg-config_for_pcsc-lite_module.patch b/debian/patches/01_use_pkg-config_for_pcsc-lite_module.patch
index 2958bab9d820..8fc85080d50a 100644
--- a/debian/patches/01_use_pkg-config_for_pcsc-lite_module.patch
+++ b/debian/patches/01_use_pkg-config_for_pcsc-lite_module.patch
@@ -1,16 +1,13 @@
-Description: Use pkg-config for libpcsclite linkage flags
- At least in debian, we can rely on pkg-config being available and
- returning more accurate ldflags.
-Author: Reinhard Tartler <siret...@tauware.de>
----
+diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
+index f3e86c1de6c0..ba3fe350675a 100644
--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
-@@ -933,7 +933,7 @@ ifdef CONFIG_NATIVE_WINDOWS
- #dynamic symbol loading that is now used in pcsc_funcs.c
- #LIBS += -lwinscard
+@@ -934,7 +934,7 @@ else
+ ifdef CONFIG_OSX
+ LIBS += -framework PCSC
else
-LIBS += -lpcsclite -lpthread
+LIBS += $(shell pkg-config --libs libpcsclite)
endif
endif
-
+ endif
diff --git a/debian/patches/07_dbus_service_syslog.patch b/debian/patches/07_dbus_service_syslog.patch
index c02acf8057a4..639ec3a70165 100644
--- a/debian/patches/07_dbus_service_syslog.patch
+++ b/debian/patches/07_dbus_service_syslog.patch
@@ -1,9 +1,5 @@
-Description: Tweak D-Bus/systemd service activation configuration files:
- * log wpa_supplicant messages to syslog
- * activate control socket interface so that wpa_cli can be used by D-Bus
- activated wpa_supplicant daemon
-Author: Kel Modderman <k...@otaku42.de>
----
+diff --git a/wpa_supplicant/dbus/fi.epitest.hostap.WPASupplicant.service.in b/wpa_supplicant/dbus/fi.epitest.hostap.WPASupplicant.service.in
+index a75918f9380b..714ef9ea556f 100644
--- a/wpa_supplicant/dbus/fi.epitest.hostap.WPASupplicant.service.in
+++ b/wpa_supplicant/dbus/fi.epitest.hostap.WPASupplicant.service.in
@@ -1,5 +1,5 @@
@@ -13,6 +9,8 @@ Author: Kel Modderman <k...@otaku42.de>
+Exec=@BINDIR@/wpa_supplicant -u -s -O /run/wpa_supplicant
User=root
SystemdService=wpa_supplicant.service
+diff --git a/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in b/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in
+index d97ff392175d..3b0af67afde0 100644
--- a/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in
+++ b/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in
@@ -1,5 +1,5 @@
@@ -22,12 +20,14 @@ Author: Kel Modderman <k...@otaku42.de>
+Exec=@BINDIR@/wpa_supplicant -u -s -O /run/wpa_supplicant
User=root
SystemdService=wpa_supplicant.service
+diff --git a/wpa_supplicant/systemd/wpa_supplicant.service.in b/wpa_supplicant/systemd/wpa_supplicant.service.in
+index bc5d49af8655..29c949bb32d2 100644
--- a/wpa_supplicant/systemd/wpa_supplicant.service.in
+++ b/wpa_supplicant/systemd/wpa_supplicant.service.in
-@@ -6,7 +6,7 @@
+@@ -6,7 +6,7 @@ Wants=network.target
[Service]
Type=dbus
- BusName=fi.epitest.hostap.WPASupplicant
+ BusName=@DBUS_INTERFACE@
-ExecStart=@BINDIR@/wpa_supplicant -u
+ExecStart=@BINDIR@/wpa_supplicant -u -s -O /run/wpa_supplicant
diff --git a/debian/patches/2015-6/backported-WNM-Ignore-Key-Data-in-WNM-Sleep-Mode-Response-frame.patch b/debian/patches/2015-6/backported-WNM-Ignore-Key-Data-in-WNM-Sleep-Mode-Response-frame.patch
deleted file mode 100644
index d36c589b7ac8..000000000000
--- a/debian/patches/2015-6/backported-WNM-Ignore-Key-Data-in-WNM-Sleep-Mode-Response-frame.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 6b12d93d2c7428a34bfd4b3813ba339ed57b698a Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j...@w1.fi>
-Date: Sun, 25 Oct 2015 15:45:50 +0200
-Subject: [PATCH] WNM: Ignore Key Data in WNM Sleep Mode Response frame if no
- PMF in use
-
-WNM Sleep Mode Response frame is used to update GTK/IGTK only if PMF is
-enabled. Verify that PMF is in use before using this field on station
-side to avoid accepting unauthenticated key updates. (CVE-2015-5310)
-
-Signed-off-by: Jouni Malinen <j...@w1.fi>
----
- wpa_supplicant/wnm_sta.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/wpa_supplicant/wnm_sta.c
-+++ b/wpa_supplicant/wnm_sta.c
-@@ -187,6 +187,12 @@
- end = ptr + key_len_total;
- wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total);
-
-+ if (key_len_total && !wpa_sm_pmf_enabled(wpa_s->wpa)) {
-+ wpa_msg(wpa_s, MSG_INFO,
-+ "WNM: Ignore Key Data in WNM-Sleep Mode Response - PMF not enabled");
-+ return;
-+ }
-+
- while (ptr + 1 < end) {
- if (ptr + 2 + ptr[1] > end) {
- wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element "
diff --git a/debian/patches/2015-7/0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch b/debian/patches/2015-7/0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch
deleted file mode 100644
index d2c5af8a06a3..000000000000
--- a/debian/patches/2015-7/0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 8057821706784608b828e769ccefbced95591e50 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j...@w1.fi>
-Date: Sun, 1 Nov 2015 18:18:17 +0200
-Subject: [PATCH] EAP-pwd peer: Fix last fragment length validation
-
-All but the last fragment had their length checked against the remaining
-room in the reassembly buffer. This allowed a suitably constructed last
-fragment frame to try to add extra data that would go beyond the buffer.
-The length validation code in wpabuf_put_data() prevents an actual
-buffer write overflow from occurring, but this results in process
-termination. (CVE-2015-5315)
-
-Signed-off-by: Jouni Malinen <j...@w1.fi>
----
- src/eap_peer/eap_pwd.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
---- a/src/eap_peer/eap_pwd.c
-+++ b/src/eap_peer/eap_pwd.c
-@@ -903,7 +903,7 @@
- /*
- * buffer and ACK the fragment
- */
-- if (EAP_PWD_GET_MORE_BIT(lm_exch)) {
-+ if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) {
- data->in_frag_pos += len;
- if (data->in_frag_pos > wpabuf_size(data->inbuf)) {
- wpa_printf(MSG_INFO, "EAP-pwd: Buffer overflow attack "
-@@ -916,7 +916,8 @@
- return NULL;
- }
- wpabuf_put_data(data->inbuf, pos, len);
--
-+ }
-+ if (EAP_PWD_GET_MORE_BIT(lm_exch)) {
- resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
- EAP_PWD_HDR_SIZE,
- EAP_CODE_RESPONSE, eap_get_id(reqData));
-@@ -930,10 +931,8 @@
- * we're buffering and this is the last fragment
- */
- if (data->in_frag_pos) {
-- wpabuf_put_data(data->inbuf, pos, len);
- wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes",
- (int) len);
-- data->in_frag_pos += len;
- pos = wpabuf_head_u8(data->inbuf);
- len = data->in_frag_pos;
- }
diff --git a/debian/patches/2015-7/0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch b/debian/patches/2015-7/0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch
deleted file mode 100644
index 084083dadd9b..000000000000
--- a/debian/patches/2015-7/0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From bef802ece03f9ae9d52a21f0cf4f1bc2c5a1f8aa Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j...@w1.fi>
-Date: Sun, 1 Nov 2015 18:24:16 +0200
-Subject: [PATCH] EAP-pwd server: Fix last fragment length validation
-
-All but the last fragment had their length checked against the remaining
-room in the reassembly buffer. This allowed a suitably constructed last
-fragment frame to try to add extra data that would go beyond the buffer.
-The length validation code in wpabuf_put_data() prevents an actual
-buffer write overflow from occurring, but this results in process
-termination. (CVE-2015-5314)
-
-Signed-off-by: Jouni Malinen <j...@w1.fi>
----
- src/eap_server/eap_server_pwd.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
---- a/src/eap_server/eap_server_pwd.c
-+++ b/src/eap_server/eap_server_pwd.c
-@@ -970,7 +970,7 @@
- /*
- * the first and all intermediate fragments have the M bit set
- */
-- if (EAP_PWD_GET_MORE_BIT(lm_exch)) {
-+ if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) {
- if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) {
- wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow "
- "attack detected! (%d+%d > %d)",
-@@ -981,6 +981,8 @@
- }
- wpabuf_put_data(data->inbuf, pos, len);
- data->in_frag_pos += len;
-+ }
-+ if (EAP_PWD_GET_MORE_BIT(lm_exch)) {
- wpa_printf(MSG_DEBUG, "EAP-pwd: Got a %d byte fragment",
- (int) len);
- return;
-@@ -990,8 +992,6 @@
- * buffering fragments so that's how we know it's the last)
- */
- if (data->in_frag_pos) {
-- wpabuf_put_data(data->inbuf, pos, len);
-- data->in_frag_pos += len;
- pos = wpabuf_head_u8(data->inbuf);
- len = data->in_frag_pos;
- wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes",
diff --git a/debian/patches/2015-8/0001-EAP-pwd-peer-Fix-error-path-for-unexpected-Confirm-m.patch b/debian/patches/2015-8/0001-EAP-pwd-peer-Fix-error-path-for-unexpected-Confirm-m.patch
deleted file mode 100644
index 0f8aec59edd7..000000000000
--- a/debian/patches/2015-8/0001-EAP-pwd-peer-Fix-error-path-for-unexpected-Confirm-m.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 95577884ca4fa76be91344ff7a8d5d1e6dc3da61 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j...@w1.fi>
-Date: Sun, 1 Nov 2015 19:35:44 +0200
-Subject: [PATCH] EAP-pwd peer: Fix error path for unexpected Confirm message
-
-If the Confirm message is received from the server before the Identity
-exchange has been completed, the group has not yet been determined and
-data->grp is NULL. The error path in eap_pwd_perform_confirm_exchange()
-did not take this corner case into account and could end up
-dereferencing a NULL pointer and terminating the process if invalid
-message sequence is received. (CVE-2015-5316)
-
-Signed-off-by: Jouni Malinen <j...@w1.fi>
----
- src/eap_peer/eap_pwd.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/src/eap_peer/eap_pwd.c
-+++ b/src/eap_peer/eap_pwd.c
-@@ -774,7 +774,8 @@
- wpabuf_put_data(data->outbuf, conf, SHA256_MAC_LEN);
-
- fin:
-- bin_clear_free(cruft, BN_num_bytes(data->grp->prime));
-+ if (data->grp)
-+ bin_clear_free(cruft, BN_num_bytes(data->grp->prime));
- BN_clear_free(x);
- BN_clear_free(y);
- if (data->outbuf == NULL) {
diff --git a/debian/patches/2016-1/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch b/debian/patches/2016-1/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch
deleted file mode 100644
index 5c6df59ef279..000000000000
--- a/debian/patches/2016-1/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From ecbb0b3dc122b0d290987cf9c84010bbe53e1022 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jo...@qca.qualcomm.com>
-Date: Fri, 4 Mar 2016 17:20:18 +0200
-Subject: [PATCH 1/5] WPS: Reject a Credential with invalid passphrase
-
-WPA/WPA2-Personal passphrase is not allowed to include control
-characters. Reject a Credential received from a WPS Registrar both as
-STA (Credential) and AP (AP Settings) if the credential is for WPAPSK or
-WPA2PSK authentication type and includes an invalid passphrase.
-
-This fixes an issue where hostapd or wpa_supplicant could have updated
-the configuration file PSK/passphrase parameter with arbitrary data from
-an external device (Registrar) that may not be fully trusted. Should
-such data include a newline character, the resulting configuration file
-could become invalid and fail to be parsed.
-
-Signed-off-by: Jouni Malinen <jo...@qca.qualcomm.com>
----
- src/utils/common.c | 12 ++++++++++++
- src/utils/common.h | 1 +
- src/wps/wps_attr_process.c | 10 ++++++++++
- 3 files changed, 23 insertions(+)
-
---- a/src/utils/common.c
-+++ b/src/utils/common.c
-@@ -697,6 +697,18 @@
- }
-
-
-+int has_ctrl_char(const u8 *data, size_t len)
-+{
-+ size_t i;
-+
-+ for (i = 0; i < len; i++) {
-+ if (data[i] < 32 || data[i] == 127)
-+ return 1;
-+ }
-+ return 0;
-+}
-+
-+
- size_t merge_byte_arrays(u8 *res, size_t res_len,
- const u8 *src1, size_t src1_len,
- const u8 *src2, size_t src2_len)
---- a/src/utils/common.h
-+++ b/src/utils/common.h
-@@ -477,6 +477,7 @@
-
- char * wpa_config_parse_string(const char *value, size_t *len);
- int is_hex(const u8 *data, size_t len);
-+int has_ctrl_char(const u8 *data, size_t len);
- size_t merge_byte_arrays(u8 *res, size_t res_len,
- const u8 *src1, size_t src1_len,
- const u8 *src2, size_t src2_len);
---- a/src/wps/wps_attr_process.c
-+++ b/src/wps/wps_attr_process.c
-@@ -229,6 +229,16 @@
- cred->key_len--;
- #endif /* CONFIG_WPS_STRICT */
- }
-+
-+
-+ if (cred->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK) &&
-+ (cred->key_len < 8 || has_ctrl_char(cred->key, cred->key_len))) {
-+ wpa_printf(MSG_INFO, "WPS: Reject credential with invalid WPA/WPA2-Personal passphrase");
-+ wpa_hexdump_ascii_key(MSG_INFO, "WPS: Network Key",
-+ cred->key, cred->key_len);
-+ return -1;
-+ }
-+
- return 0;
- }
-
diff --git a/debian/patches/2016-1/0002-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch b/debian/patches/2016-1/0002-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch
deleted file mode 100644
index dc2bba480600..000000000000
--- a/debian/patches/2016-1/0002-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 73e4abb24a936014727924d8b0b2965edfc117dd Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jo...@qca.qualcomm.com>
-Date: Fri, 4 Mar 2016 18:46:41 +0200
-Subject: [PATCH 2/5] Reject psk parameter set with invalid passphrase
- character
-
-WPA/WPA2-Personal passphrase is not allowed to include control
-characters. Reject a passphrase configuration attempt if that passphrase
-includes an invalid passphrase.
-
-This fixes an issue where wpa_supplicant could have updated the
-configuration file psk parameter with arbitrary data from the control
-interface or D-Bus interface. While those interfaces are supposed to be
-accessible only for trusted users/applications, it may be possible that
-an untrusted user has access to a management software component that
-does not validate the passphrase value before passing it to
-wpa_supplicant.
-
-This could allow such an untrusted user to inject up to 63 characters of
-almost arbitrary data into the configuration file. Such configuration
-file could result in wpa_supplicant trying to load a library (e.g.,
-opensc_engine_path, pkcs11_engine_path, pkcs11_module_path,
-load_dynamic_eap) from user controlled location when starting again.
-This would allow code from that library to be executed under the
-wpa_supplicant process privileges.
-
-Signed-off-by: Jouni Malinen <jo...@qca.qualcomm.com>
----
- wpa_supplicant/config.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/wpa_supplicant/config.c
-+++ b/wpa_supplicant/config.c
-@@ -456,6 +456,12 @@
- }
- wpa_hexdump_ascii_key(MSG_MSGDUMP, "PSK (ASCII passphrase)",
- (u8 *) value, len);
-+ if (has_ctrl_char((u8 *) value, len)) {
-+ wpa_printf(MSG_ERROR,
-+ "Line %d: Invalid passphrase character",
-+ line);
-+ return -1;
-+ }
- if (ssid->passphrase && os_strlen(ssid->passphrase) == len &&
- os_memcmp(ssid->passphrase, value, len) == 0)
- return 0;
diff --git a/debian/patches/2016-1/0003-Remove-newlines-from-wpa_supplicant-config-network-o.patch b/debian/patches/2016-1/0003-Remove-newlines-from-wpa_supplicant-config-network-o.patch
deleted file mode 100644
index bb75e987d4a4..000000000000
--- a/debian/patches/2016-1/0003-Remove-newlines-from-wpa_supplicant-config-network-o.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 0fe5a234240a108b294a87174ad197f6b5cb38e9 Mon Sep 17 00:00:00 2001
-From: Paul Stewart <ps...@google.com>
-Date: Thu, 3 Mar 2016 15:40:19 -0800
-Subject: [PATCH 3/5] Remove newlines from wpa_supplicant config network
- output
-
-Spurious newlines output while writing the config file can corrupt the
-wpa_supplicant configuration. Avoid writing these for the network block
-parameters. This is a generic filter that cover cases that may not have
-been explicitly addressed with a more specific commit to avoid control
-characters in the psk parameter.
-
-Signed-off-by: Paul Stewart <ps...@google.com>
----
- src/utils/common.c | 11 +++++++++++
- src/utils/common.h | 1 +
- wpa_supplicant/config.c | 15 +++++++++++++--
- 3 files changed, 25 insertions(+), 2 deletions(-)
-
---- a/src/utils/common.c
-+++ b/src/utils/common.c
-@@ -709,6 +709,17 @@
- }
-
-
-+int has_newline(const char *str)
-+{
-+ while (*str) {
-+ if (*str == '\n' || *str == '\r')
-+ return 1;
-+ str++;
-+ }
-+ return 0;
-+}
-+
-+
- size_t merge_byte_arrays(u8 *res, size_t res_len,
- const u8 *src1, size_t src1_len,
- const u8 *src2, size_t src2_len)
---- a/src/utils/common.h
-+++ b/src/utils/common.h
-@@ -478,6 +478,7 @@
- char * wpa_config_parse_string(const char *value, size_t *len);
- int is_hex(const u8 *data, size_t len);
- int has_ctrl_char(const u8 *data, size_t len);
-+int has_newline(const char *str);
- size_t merge_byte_arrays(u8 *res, size_t res_len,
- const u8 *src1, size_t src1_len,
- const u8 *src2, size_t src2_len);
---- a/wpa_supplicant/config.c
-+++ b/wpa_supplicant/config.c
-@@ -2610,8 +2610,19 @@
-
- for (i = 0; i < NUM_SSID_FIELDS; i++) {
- const struct parse_data *field = &ssid_fields[i];
-- if (os_strcmp(var, field->name) == 0)
-- return field->writer(field, ssid);
-+ if (os_strcmp(var, field->name) == 0) {
-+ char *ret = field->writer(field, ssid);
-+
-+ if (ret && has_newline(ret)) {
-+ wpa_printf(MSG_ERROR,
-+ "Found newline in value for %s; not returning it",
-+ var);
-+ os_free(ret);
-+ ret = NULL;
-+ }
-+
-+ return ret;
-+ }
- }
-
- return NULL;
diff --git a/debian/patches/2016-1/0004-Reject-SET_CRED-commands-with-newline-characters-in-.patch b/debian/patches/2016-1/0004-Reject-SET_CRED-commands-with-newline-characters-in-.patch
deleted file mode 100644
index 15b30a7981a1..000000000000
--- a/debian/patches/2016-1/0004-Reject-SET_CRED-commands-with-newline-characters-in-.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From b166cd84a77a6717be9600bf95378a0055d6f5a5 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jo...@qca.qualcomm.com>
-Date: Tue, 5 Apr 2016 23:33:10 +0300
-Subject: [PATCH 4/5] Reject SET_CRED commands with newline characters in the
- string values
-
-Most of the cred block parameters are written as strings without
-filtering and if there is an embedded newline character in the value,
-unexpected configuration file data might be written.
-
-This fixes an issue where wpa_supplicant could have updated the
-configuration file cred parameter with arbitrary data from the control
-interface or D-Bus interface. While those interfaces are supposed to be
-accessible only for trusted users/applications, it may be possible that
-an untrusted user has access to a management software component that
-does not validate the credential value before passing it to
-wpa_supplicant.
-
-This could allow such an untrusted user to inject almost arbitrary data
-into the configuration file. Such configuration file could result in
-wpa_supplicant trying to load a library (e.g., opensc_engine_path,
-pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user
-controlled location when starting again. This would allow code from that
-library to be executed under the wpa_supplicant process privileges.
-
-Signed-off-by: Jouni Malinen <jo...@qca.qualcomm.com>
----
- wpa_supplicant/config.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
---- a/wpa_supplicant/config.c
-+++ b/wpa_supplicant/config.c
-@@ -2807,6 +2807,8 @@
-
- if (os_strcmp(var, "password") == 0 &&
- os_strncmp(value, "ext:", 4) == 0) {
-+ if (has_newline(value))
-+ return -1;
- str_clear_free(cred->password);
- cred->password = os_strdup(value);
- cred->ext_password = 1;
-@@ -2857,9 +2859,14 @@
- }
-
- val = wpa_config_parse_string(value, &len);
-- if (val == NULL) {
-+ if (val == NULL ||
-+ (os_strcmp(var, "excluded_ssid") != 0 &&
-+ os_strcmp(var, "roaming_consortium") != 0 &&
-+ os_strcmp(var, "required_roaming_consortium") != 0 &&
-+ has_newline(val))) {
- wpa_printf(MSG_ERROR, "Line %d: invalid field '%s' string "
- "value '%s'.", line, var, value);
-+ os_free(val);
- return -1;
- }
-
diff --git a/debian/patches/2016-1/0005-Reject-SET-commands-with-newline-characters-in-the-s.patch b/debian/patches/2016-1/0005-Reject-SET-commands-with-newline-characters-in-the-s.patch
deleted file mode 100644
index 9ce51496e127..000000000000
--- a/debian/patches/2016-1/0005-Reject-SET-commands-with-newline-characters-in-the-s.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 2a3f56502b52375c3bf113cf92adfa99bad6b488 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jo...@qca.qualcomm.com>
-Date: Tue, 5 Apr 2016 23:55:48 +0300
-Subject: [PATCH 5/5] Reject SET commands with newline characters in the
- string values
-
-Many of the global configuration parameters are written as strings
-without filtering and if there is an embedded newline character in the
-value, unexpected configuration file data might be written.
-
-This fixes an issue where wpa_supplicant could have updated the
-configuration file global parameter with arbitrary data from the control
-interface or D-Bus interface. While those interfaces are supposed to be
-accessible only for trusted users/applications, it may be possible that
-an untrusted user has access to a management software component that
-does not validate the value of a parameter before passing it to
-wpa_supplicant.
-
-This could allow such an untrusted user to inject almost arbitrary data
-into the configuration file. Such configuration file could result in
-wpa_supplicant trying to load a library (e.g., opensc_engine_path,
-pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user
-controlled location when starting again. This would allow code from that
-library to be executed under the wpa_supplicant process privileges.
-
-Signed-off-by: Jouni Malinen <jo...@qca.qualcomm.com>
----
- wpa_supplicant/config.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/wpa_supplicant/config.c
-+++ b/wpa_supplicant/config.c
-@@ -3670,6 +3670,12 @@
- return -1;
- }
-
-+ if (has_newline(pos)) {
-+ wpa_printf(MSG_ERROR, "Line %d: invalid %s value with newline",
-+ line, data->name);
-+ return -1;
-+ }
-+
- tmp = os_strdup(pos);
- if (tmp == NULL)
- return -1;
diff --git a/debian/patches/2016-1/psk-parameter-config-update.txt b/debian/patches/2016-1/psk-parameter-config-update.txt
deleted file mode 100644
index d5c15f069748..000000000000
--- a/debian/patches/2016-1/psk-parameter-config-update.txt
+++ /dev/null
@@ -1,101 +0,0 @@
-psk configuration parameter update allowing arbitrary data to be written
-
-Published: May 2, 2016
-Identifiers: CVE-2016-4476 and CVE-2016-4477
- (CVE-2016-2447 is an instance of CVE-2016-4477 on Android)
-Latest version available from: http://w1.fi/security/2016-1/
-
-
-Vulnerability
-
-A vulnerability was found in how hostapd and wpa_supplicant writes the
-configuration file update for the WPA/WPA2 passphrase parameter. If this
-parameter has been updated to include control characters either through
-a WPS operation (CVE-2016-4476) or through local configuration change
-over the wpa_supplicant control interface (CVE-2016-4477), the resulting
-configuration file may prevent the hostapd and wpa_supplicant from
-starting when the updated file is used. In addition for wpa_supplicant,
-it may be possible to load a local library file and execute code from
-there with the same privileges under which the wpa_supplicant process
-runs.
-
-The WPS trigger for this requires local user action to authorize the WPS
-operation in which a new configuration would be received. The attacker
-would also need to be in radio range of the device or have access to the
-IP network to act as a WPS External Registrar. Such an attack could
-result in denial of service by not allowing hostapd or wpa_supplicant to
-start after they have been stopped.
-
-The local configuration update through the control interface SET_NETWORK
-command could allow privilege escalation for the local user to run code
-from a locally stored library file under the same privileges as the
-wpa_supplicant process has. The assumption here is that a not fully
-trusted user/application might have access through a connection manager
-to set network profile parameters like psk, but would not have access to
-set other configuration file parameters. If the connection manager in
-such a case does not filter out control characters from the psk value,
-it could have been possible to practically update the global parameters
-by embedding a newline character within the psk value. In addition, the
-untrusted user/application would need to be able to install a library
-file somewhere on the device from where the wpa_supplicant process has
-privileges to load the library.
-
-Similarly to the SET_NETWORK case, if a connection manager exposes
-access to the SET_CRED or SET commands, similar issue with newline
-characters can exist as those commands do not filter out control
-characters from the value.
-
-It should also be noted that providing unlimited access to the
-wpa_supplicant control interface would allow arbitrary SET commands to
-be issued. Such unlimited access should not be provided to untrusted
-users/applications.
-
-
-Vulnerable versions/configurations
-
-For the local control interface attack vector (CVE-2016-4477):
-
-wpa_supplicant v0.4.0-v2.5 with control interface enabled
-
-update_config=1 must have been enabled in the configuration file.
-
-
-For the WPS attack vector (CVE-2016-4476):
-
-wpa_supplicant v0.6.7-v2.5 with CONFIG_WPS build option enabled
-hostapd v0.6.7-v2.5 with CONFIG_WPS build option enabled
-
-WPS needs to be enabled in the runtime operation and the WPS operation
-needs to have been authorized by the local user over the control
-interface. For wpa_supplicant, update_config=1 must have been enabled in
-the configuration file.
-
-
-Acknowledgments
-
-Thanks to Google for reporting this issue and Imre Rad of SEARCH-LAB
-Ltd. discovering it.
-
-
-Possible mitigation steps
-
-- Merge the following commits to hostapd/wpa_supplicant and rebuild it:
-
- CVE-2016-4476:
- WPS: Reject a Credential with invalid passphrase
- CVE-2016-4477:
- Reject psk parameter set with invalid passphrase character
- Reject SET_CRED commands with newline characters in the string values
- Reject SET commands with newline characters in the string values
- CVE-2016-4476 and CVE-2016-4477:
- Remove newlines from wpa_supplicant config network output
-
- These patches are available from http://w1.fi/security/2016-1/
-
-- Update to hostapd/wpa_supplicant v2.6 or newer, once available
-
-
-Change history
-
-May 3, 2016
-- Added CVE IDs
diff --git a/debian/patches/do_not_wait_for_monitor_to_attach_if_no_control_interface.patch b/debian/patches/do_not_wait_for_monitor_to_attach_if_no_control_interface.patch
deleted file mode 100644
index 9e44b4b911b9..000000000000
--- a/debian/patches/do_not_wait_for_monitor_to_attach_if_no_control_interface.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 1c94570f1b4d12d5fdcfe072b4b2f2042e8268f0 Mon Sep 17 00:00:00 2001
-From: Ilan Peer <ilan.p...@intel.com>
-Date: Sun, 27 Dec 2015 16:25:06 +0200
-Subject: Do not wait for monitor to attach if no control interface
-
-In case an interface has started without a control interface
-initialized, skip waiting for monitor to attach at the start of
-wpa_supplicant (-W).
-
-Signed-off-by: Ilan Peer <ilan.p...@intel.com>
----
- wpa_supplicant/ctrl_iface_unix.c | 3 +++
- 1 file changed, 3 insertions(+)
-
---- a/wpa_supplicant/ctrl_iface_unix.c
-+++ b/wpa_supplicant/ctrl_iface_unix.c
-@@ -848,6 +848,9 @@
- struct sockaddr_un from;
- socklen_t fromlen = sizeof(from);
-
-+ if (priv->sock == -1)
-+ return;
-+
- for (;;) {
- wpa_printf(MSG_DEBUG, "CTRL_IFACE - %s - wait for monitor to "
- "attach", priv->wpa_s->ifname);
diff --git a/debian/patches/nl80211_dont_call_linux_iface_up_for_a_dedicated_p2p_device.patch b/debian/patches/nl80211_dont_call_linux_iface_up_for_a_dedicated_p2p_device.patch
deleted file mode 100644
index efdec059d894..000000000000
--- a/debian/patches/nl80211_dont_call_linux_iface_up_for_a_dedicated_p2p_device.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From ef3866ab016e8ff58c2adbfb1ec673a7f7e1dfd8 Mon Sep 17 00:00:00 2001
-From: Ilan Peer <ilan.p...@intel.com>
-Date: Sun, 27 Dec 2015 14:36:11 +0200
-Subject: nl80211: Don't call linux_iface_up() for a dedicated P2P Device
-
-As a dedicated P2P Device interface does not have a network
-interface associated with it, trying to call linux_iface_up()
-on it would always fail so this call can be skipped for
-such an interface.
-
-Getting interface nlmode can be done only after bss->wdev_id is
-set, so move this call to wpa_driver_nl80211_finish_drv_init(),
-and do it only in case the nlmode != NL80211_IFTYPE_P2P_DEVICE.
-
-Signed-off-by: Ilan Peer <ilan.p...@intel.com>
----
- src/drivers/driver_nl80211.c | 8 +++++---
- 1 file changed, 5 insertions(+), 3 deletions(-)
-
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -1681,9 +1681,6 @@
- os_free(rcfg);
- }
-
-- if (linux_iface_up(drv->global->ioctl_sock, ifname) > 0)
-- drv->start_iface_up = 1;
--
- if (wpa_driver_nl80211_finish_drv_init(drv, set_addr, 1, driver_params))
- goto failed;
-
-@@ -2186,6 +2183,11 @@
- if (!bss->if_dynamic && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
- bss->static_ap = 1;
-
-+ if (first &&
-+ nl80211_get_ifmode(bss) != NL80211_IFTYPE_P2P_DEVICE &&
-+ linux_iface_up(drv->global->ioctl_sock, bss->ifname) > 0)
-+ drv->start_iface_up = 1;
-+
- if (wpa_driver_nl80211_capa(drv))
- return -1;
-
diff --git a/debian/patches/openssl-initialise-pkcs-11.patch b/debian/patches/openssl-initialise-pkcs-11.patch
deleted file mode 100644
index e9180c40cb3c..000000000000
--- a/debian/patches/openssl-initialise-pkcs-11.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From c3d7fb7e2724150950e1a1eac29460ea255811c3 Mon Sep 17 00:00:00 2001
-From: David Woodhouse <dw...@infradead.org>
-Date: Wed, 8 Jun 2016 21:03:40 +0100
-Subject: OpenSSL: Initialise PKCS#11 engine even if found with ENGINE_by_id()
-
-Recent versions of engine_pkcs11 are set up to be autoloaded on demand
-with ENGINE_by_id() because they don't need explicit configuration.
-
-But if we *do* want to explicitly configure them with a PKCS#11 module
-path, we should still do so.
-
-We can't tell whether it was already initialised, but it's harmless to
-repeat the MODULE_PATH command if it was.
-
-Signed-off-by: David Woodhouse <david.woodho...@intel.com>
-Tested-by: Michael Schaller <mi...@google.com>
----
- src/crypto/tls_openssl.c | 12 +++++++++---
- 1 file changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
-index c831fba..23ac64b 100644
---- a/src/crypto/tls_openssl.c
-+++ b/src/crypto/tls_openssl.c
-@@ -624,10 +624,16 @@
-
- engine = ENGINE_by_id(id);
- if (engine) {
-- ENGINE_free(engine);
- wpa_printf(MSG_DEBUG, "ENGINE: engine '%s' is already "
- "available", id);
-- return 0;
-+ /*
-+ * If it was auto-loaded by ENGINE_by_id() we might still
-+ * need to tell it which PKCS#11 module to use in legacy
-+ * (non-p11-kit) environments. Do so now; even if it was
-+ * properly initialised before, setting it again will be
-+ * harmless.
-+ */
-+ goto found;
- }
- ERR_clear_error();
-
-@@ -664,7 +670,7 @@
- id, ERR_error_string(ERR_get_error(), NULL));
- return -1;
- }
--
-+ found:
- while (post && post[0]) {
- wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", post[0], post[1]);
- if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == 0) {
---
-cgit v0.12
-
diff --git a/debian/patches/series b/debian/patches/series
index 3c9ca88091af..06c8941677a2 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,18 +3,5 @@
06_wpa_gui_menu_exec_path.patch
07_dbus_service_syslog.patch
12_wpa_gui_knotify_support.patch
-2015-6/backported-WNM-Ignore-Key-Data-in-WNM-Sleep-Mode-Response-frame.patch
-2015-7/0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch
-2015-7/0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch
-2015-8/0001-EAP-pwd-peer-Fix-error-path-for-unexpected-Confirm-m.patch
networkd-driver-fallback.patch
wpa_supplicant_fix-dependency-odering-when-invoked-with-dbus.patch
-2016-1/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch
-2016-1/0002-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch
-2016-1/0003-Remove-newlines-from-wpa_supplicant-config-network-o.patch
-2016-1/0004-Reject-SET_CRED-commands-with-newline-characters-in-.patch
-2016-1/0005-Reject-SET-commands-with-newline-characters-in-the-s.patch
-openssl-initialise-pkcs-11.patch
-nl80211_dont_call_linux_iface_up_for_a_dedicated_p2p_device.patch
-do_not_wait_for_monitor_to_attach_if_no_control_interface.patch
-wpa_supplicant_do_not_wait_for_monitor_on_p2p_device_interface.patch
diff --git a/debian/patches/wpa_gui_desktop_add-keywords-entry.patch b/debian/patches/wpa_gui_desktop_add-keywords-entry.patch
deleted file mode 100644
index c3408a60ce78..000000000000
--- a/debian/patches/wpa_gui_desktop_add-keywords-entry.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-wpa_gui.desktop: add keywords entry
-
-According to the XDG, desktop files should have a Keywords entry, see:
-http://standards.freedesktop.org/desktop-entry-spec/latest/ar01s05.html
-
-Signed-off-by: Stefan Lippers-Hollmann <s....@gmx.de>
-
---- a/wpa_supplicant/wpa_gui-qt4/wpa_gui.desktop
-+++ b/wpa_supplicant/wpa_gui-qt4/wpa_gui.desktop
-@@ -8,3 +8,4 @@ GenericName=wpa_supplicant user interfac
- Terminal=false
- Type=Application
- Categories=Qt;Network;
-+Keywords=wlan;wifi;configuration;
diff --git a/debian/patches/wpa_supplicant_do_not_wait_for_monitor_on_p2p_device_interface.patch b/debian/patches/wpa_supplicant_do_not_wait_for_monitor_on_p2p_device_interface.patch
deleted file mode 100644
index ec0e444142ca..000000000000
--- a/debian/patches/wpa_supplicant_do_not_wait_for_monitor_on_p2p_device_interface.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From ede7770180f6ad27f1cade7ed0cf782e39400e79 Mon Sep 17 00:00:00 2001
-From: Ilan Peer <ilan.p...@intel.com>
-Date: Sun, 27 Dec 2015 16:25:07 +0200
-Subject: wpa_supplicant: Do not wait for monitor on P2P Device interface
-
-External programs are not aware of the creation of a
-dedicated P2P Device interface, so it does not make sense
-to wait for a monitor to connect on such an interface.
-
-Fix this by not waiting on a dedicated P2P Device interface
-for monitor to attach.
-
-Signed-off-by: Ilan Peer <ilan.p...@intel.com>
----
- wpa_supplicant/wpa_supplicant.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/wpa_supplicant/wpa_supplicant.c
-+++ b/wpa_supplicant/wpa_supplicant.c
-@@ -4944,7 +4944,7 @@
-
- if (global->params.wait_for_monitor) {
- for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
-- if (wpa_s->ctrl_iface)
-+ if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
- wpa_supplicant_ctrl_iface_wait(
- wpa_s->ctrl_iface);
- }
