From owner-svn-ports-all@FreeBSD.ORG Tue Jun 2 09:52:03 2015 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 2E565C9D; Tue, 2 Jun 2015 09:52:03 +0000 (UTC) (envelope-from marino@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 1070C1181; Tue, 2 Jun 2015 09:52:03 +0000 (UTC) (envelope-from marino@FreeBSD.org) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t529q2XF006856; Tue, 2 Jun 2015 09:52:02 GMT (envelope-from marino@FreeBSD.org) Received: (from marino@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t529q1r9006847; Tue, 2 Jun 2015 09:52:01 GMT (envelope-from marino@FreeBSD.org) Message-Id: <201506020952.t529q1r9006847@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: marino set sender to marino@FreeBSD.org using -f From: John Marino Date: Tue, 2 Jun 2015 09:52:01 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r388314 - in head/net/hostapd: . files X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jun 2015 09:52:03 -0000 Author: marino Date: Tue Jun 2 09:52:01 2015 New Revision: 388314 URL: https://svnweb.freebsd.org/changeset/ports/388314 Log: net/hostapd: Address 3 latest security advisories These are combined upstream patches 2015-2, 2015-3, 2015-4 They address the following security advisories: * CVE-2015-4141 * CVE-2015-4142 * CVE-2015-4143 * CVE-2015-4144 * CVE-2015-4145 * CVE-2015-4146 These advisories also apply to security/wpa_supplicant PR: 200567 Submitted by: Jason Unovitch Approved by: maintainer (Craig Leres) Added: head/net/hostapd/files/patch-src_ap_wmm.c (contents, props changed) head/net/hostapd/files/patch-src_eap__peer_eap__pwd.c (contents, props changed) head/net/hostapd/files/patch-src_eap__server_eap__server__pwd.c (contents, props changed) head/net/hostapd/files/patch-src_wps_httpread.c (contents, props changed) Modified: head/net/hostapd/Makefile Modified: head/net/hostapd/Makefile ============================================================================== --- head/net/hostapd/Makefile Tue Jun 2 09:44:25 2015 (r388313) +++ head/net/hostapd/Makefile Tue Jun 2 09:52:01 2015 (r388314) @@ -3,6 +3,7 @@ PORTNAME= hostapd PORTVERSION= 2.4 +PORTREVISION= 1 CATEGORIES= net MASTER_SITES= http://w1.fi/releases/ Added: head/net/hostapd/files/patch-src_ap_wmm.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/net/hostapd/files/patch-src_ap_wmm.c Tue Jun 2 09:52:01 2015 (r388314) @@ -0,0 +1,12 @@ +--- src/ap/wmm.c.orig 2015-03-15 17:30:39 UTC ++++ src/ap/wmm.c +@@ -274,6 +274,9 @@ void hostapd_wmm_action(struct hostapd_d + return; + } + ++ if (left < 0) ++ return; /* not a valid WMM Action frame */ ++ + /* extract the tspec info element */ + if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) { + hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, Added: head/net/hostapd/files/patch-src_eap__peer_eap__pwd.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/net/hostapd/files/patch-src_eap__peer_eap__pwd.c Tue Jun 2 09:52:01 2015 (r388314) @@ -0,0 +1,77 @@ +--- src/eap_peer/eap_pwd.c.orig 2015-03-15 17:30:39 UTC ++++ src/eap_peer/eap_pwd.c +@@ -301,6 +301,23 @@ eap_pwd_perform_commit_exchange(struct e + BIGNUM *mask = NULL, *x = NULL, *y = NULL, *cofactor = NULL; + u16 offset; + u8 *ptr, *scalar = NULL, *element = NULL; ++ size_t prime_len, order_len; ++ ++ if (data->state != PWD_Commit_Req) { ++ ret->ignore = TRUE; ++ goto fin; ++ } ++ ++ prime_len = BN_num_bytes(data->grp->prime); ++ order_len = BN_num_bytes(data->grp->order); ++ ++ if (payload_len != 2 * prime_len + order_len) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: Unexpected Commit payload length %u (expected %u)", ++ (unsigned int) payload_len, ++ (unsigned int) (2 * prime_len + order_len)); ++ goto fin; ++ } + + if (((data->private_value = BN_new()) == NULL) || + ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) || +@@ -500,6 +517,18 @@ eap_pwd_perform_confirm_exchange(struct + u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr; + int offset; + ++ if (data->state != PWD_Confirm_Req) { ++ ret->ignore = TRUE; ++ goto fin; ++ } ++ ++ if (payload_len != SHA256_MAC_LEN) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: Unexpected Confirm payload length %u (expected %u)", ++ (unsigned int) payload_len, SHA256_MAC_LEN); ++ goto fin; ++ } ++ + /* + * first build up the ciphersuite which is group | random_function | + * prf +@@ -783,11 +812,23 @@ eap_pwd_process(struct eap_sm *sm, void + * if it's the first fragment there'll be a length field + */ + if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) { ++ if (len < 2) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: Frame too short to contain Total-Length field"); ++ ret->ignore = TRUE; ++ return NULL; ++ } + tot_len = WPA_GET_BE16(pos); + wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments whose " + "total length = %d", tot_len); + if (tot_len > 15000) + return NULL; ++ if (data->inbuf) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: Unexpected new fragment start when previous fragment is still in use"); ++ ret->ignore = TRUE; ++ return NULL; ++ } + data->inbuf = wpabuf_alloc(tot_len); + if (data->inbuf == NULL) { + wpa_printf(MSG_INFO, "Out of memory to buffer " +@@ -873,6 +914,7 @@ eap_pwd_process(struct eap_sm *sm, void + /* + * we have output! Do we need to fragment it? + */ ++ lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch); + len = wpabuf_len(data->outbuf); + if ((len + EAP_PWD_HDR_SIZE) > data->mtu) { + resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu, Added: head/net/hostapd/files/patch-src_eap__server_eap__server__pwd.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/net/hostapd/files/patch-src_eap__server_eap__server__pwd.c Tue Jun 2 09:52:01 2015 (r388314) @@ -0,0 +1,60 @@ +--- src/eap_server/eap_server_pwd.c.orig 2015-03-15 17:30:39 UTC ++++ src/eap_server/eap_server_pwd.c +@@ -634,9 +634,21 @@ eap_pwd_process_commit_resp(struct eap_s + BIGNUM *x = NULL, *y = NULL, *cofactor = NULL; + EC_POINT *K = NULL, *point = NULL; + int res = 0; ++ size_t prime_len, order_len; + + wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response"); + ++ prime_len = BN_num_bytes(data->grp->prime); ++ order_len = BN_num_bytes(data->grp->order); ++ ++ if (payload_len != 2 * prime_len + order_len) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: Unexpected Commit payload length %u (expected %u)", ++ (unsigned int) payload_len, ++ (unsigned int) (2 * prime_len + order_len)); ++ goto fin; ++ } ++ + if (((data->peer_scalar = BN_new()) == NULL) || + ((data->k = BN_new()) == NULL) || + ((cofactor = BN_new()) == NULL) || +@@ -752,6 +764,13 @@ eap_pwd_process_confirm_resp(struct eap_ + u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr; + int offset; + ++ if (payload_len != SHA256_MAC_LEN) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: Unexpected Confirm payload length %u (expected %u)", ++ (unsigned int) payload_len, SHA256_MAC_LEN); ++ goto fin; ++ } ++ + /* build up the ciphersuite: group | random_function | prf */ + grp = htons(data->group_num); + ptr = (u8 *) &cs; +@@ -901,11 +920,21 @@ static void eap_pwd_process(struct eap_s + * the first fragment has a total length + */ + if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) { ++ if (len < 2) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: Frame too short to contain Total-Length field"); ++ return; ++ } + tot_len = WPA_GET_BE16(pos); + wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments, total " + "length = %d", tot_len); + if (tot_len > 15000) + return; ++ if (data->inbuf) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: Unexpected new fragment start when previous fragment is still in use"); ++ return; ++ } + data->inbuf = wpabuf_alloc(tot_len); + if (data->inbuf == NULL) { + wpa_printf(MSG_INFO, "EAP-pwd: Out of memory to " Added: head/net/hostapd/files/patch-src_wps_httpread.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/net/hostapd/files/patch-src_wps_httpread.c Tue Jun 2 09:52:01 2015 (r388314) @@ -0,0 +1,16 @@ +--- src/wps/httpread.c.orig 2015-03-15 17:30:39 UTC ++++ src/wps/httpread.c +@@ -533,6 +533,13 @@ static void httpread_read_handler(int sd + if (!isxdigit(*cbp)) + goto bad; + h->chunk_size = strtoul(cbp, NULL, 16); ++ if (h->chunk_size < 0 || ++ h->chunk_size > h->max_bytes) { ++ wpa_printf(MSG_DEBUG, ++ "httpread: Invalid chunk size %d", ++ h->chunk_size); ++ goto bad; ++ } + /* throw away chunk header + * so we have only real data + */