Merge lp:~logan/ubuntu/raring/wpa/debian-merge into lp:ubuntu/raring/wpa

[Logan Rosen]

[James Page (james-page)]

Uploaded - thanks!

review: Approve

=== modified file '.pc/applied-patches'
--- .pc/applied-patches	2012-09-12 15:57:50 +0000
+++ .pc/applied-patches	2012-11-30 16:58:20 +0000
@@ -8,3 +8,4 @@
 libnl3-includes.patch
 dbus-activation-cmdline.patch
 session-ticket.patch
+EAP-TLS-server_fix-TLS-Message-length-validation.patch

=== modified file 'debian/changelog'
--- debian/changelog	2012-09-12 15:57:50 +0000
+++ debian/changelog	2012-11-30 16:58:20 +0000
@@ -1,3 +1,30 @@
+wpa (1.0-3ubuntu1) raring; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Enable CONFIG_IBSS_RSN, so that we can turn back on "secure" adhoc
+      support in NetworkManager using IBSS RSN (WPA2).
+    - debian/wpasupplicant.postinst, debian/hostapd.postinst: Only move
+      sendsigs.omit.d/*.pid if the target isn't the same as the source (as is
+      the case when /lib/init/rw is a symlink to /run)
+    - debian/patches/dbus-activation-cmdline.patch: have wpasupplicant create
+      a pid file in /run/sendsigs.omit.d when activated by DBus.
+    - debian/patches/session-ticket.patch: disable the TLS Session Ticket
+      extension to fix auth with 802.1x PEAP on some hardware.
+
+ -- Logan Rosen <[e-mail]>  Fri, 30 Nov 2012 11:49:00 -0500
+
+wpa (1.0-3) unstable; urgency=high
+
+  * ship forgotten README-P2P.
+  * revert to GNU readline for wpa_cli, instead of using the internal readline
+    implementation added in wpa 1~. Prefer libreadline-gplv2-dev, because libnl
+    is GPL-2 (only) - switching back to the internal readline implementation is
+    targeted for wheezy+1 (Closes: #677993, #678077).
+  * Fix DoS via specially crafted EAP-TLS messages with longer message
+    length than TLS data length (CVE-2012-4445, DSA 2557-1, Closes: #689990).
+
+ -- Stefan Lippers-Hollmann <[e-mail]>  Mon, 08 Oct 2012 17:48:04 +0200
+
 wpa (1.0-2ubuntu5) quantal; urgency=low
 
   * debian/patches/session-ticket.patch: disable the TLS Session Ticket

=== modified file 'debian/config/wpasupplicant/kfreebsd'
--- debian/config/wpasupplicant/kfreebsd	2012-04-21 15:59:32 +0000
+++ debian/config/wpasupplicant/kfreebsd	2012-11-30 16:58:20 +0000
@@ -238,11 +238,11 @@
 # When building a wpa_cli binary for distribution, please note that these
 # libraries are licensed under GPL and as such, BSD license may not apply for
 # the resulting binary.
-#CONFIG_READLINE=y
+CONFIG_READLINE=y
 
 # Include internal line edit mode in wpa_cli. This can be used as a replacement
 # for GNU Readline to provide limited command line editing and history support.
-CONFIG_WPA_CLI_EDIT=y
+#CONFIG_WPA_CLI_EDIT=y
 
 # Remove debugging code that is printing out debug message to stdout.
 # This can be used to reduce the size of the wpa_supplicant considerably

=== modified file 'debian/config/wpasupplicant/linux'
--- debian/config/wpasupplicant/linux	2012-09-07 15:49:45 +0000
+++ debian/config/wpasupplicant/linux	2012-11-30 16:58:20 +0000
@@ -237,11 +237,11 @@
 # When building a wpa_cli binary for distribution, please note that these
 # libraries are licensed under GPL and as such, BSD license may not apply for
 # the resulting binary.
-#CONFIG_READLINE=y
+CONFIG_READLINE=y
 
 # Include internal line edit mode in wpa_cli. This can be used as a replacement
 # for GNU Readline to provide limited command line editing and history support.
-CONFIG_WPA_CLI_EDIT=y
+#CONFIG_WPA_CLI_EDIT=y
 
 # Remove debugging code that is printing out debug message to stdout.
 # This can be used to reduce the size of the wpa_supplicant considerably

=== modified file 'debian/control'
--- debian/control	2012-05-25 14:07:55 +0000
+++ debian/control	2012-11-30 16:58:20 +0000
@@ -17,6 +17,7 @@
  libnl-genl-3-dev (>= 3.2.3-2~) [linux-any],
  libpcap-dev [kfreebsd-any],
  libbsd-dev [kfreebsd-any],
+ libreadline-gplv2-dev,
  pkg-config,
  qt4-qmake,
  docbook-to-man,

=== added file 'debian/patches/EAP-TLS-server_fix-TLS-Message-length-validation.patch'
--- debian/patches/EAP-TLS-server_fix-TLS-Message-length-validation.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/EAP-TLS-server_fix-TLS-Message-length-validation.patch	2012-11-30 16:58:20 +0000
@@ -0,0 +1,43 @@
+From: Jouni Malinen <[e-mail]>
+Date: Sun, 7 Oct 2012 17:06:29 +0000 (+0300)
+Subject: EAP-TLS server: Fix TLS Message Length validation
+X-Git-Url: http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff_plain;h=586c446e0ff42ae00315b014924ec669023bd8de
+
+EAP-TLS server: Fix TLS Message Length validation
+
+EAP-TLS/PEAP/TTLS/FAST server implementation did not validate TLS
+Message Length value properly and could end up trying to store more
+information into the message buffer than the allocated size if the first
+fragment is longer than the indicated size. This could result in hostapd
+process terminating in wpabuf length validation. Fix this by rejecting
+messages that have invalid TLS Message Length value.
+
+This would affect cases that use the internal EAP authentication server
+in hostapd either directly with IEEE 802.1X or when using hostapd as a
+RADIUS authentication server and when receiving an incorrectly
+constructed EAP-TLS message. Cases where hostapd uses an external
+authentication are not affected.
+
+Thanks to Timo Warns for finding and reporting this issue.
+
+Signed-hostap: Jouni Malinen <[e-mail]>
+intended-for: hostap-1
+---
+
+--- a/src/eap_server/eap_server_tls_common.c
++++ b/src/eap_server/eap_server_tls_common.c
+@@ -224,6 +224,14 @@ static int eap_server_tls_process_fragme
+ 			return -1;
+ 		}
+ 
++		if (len > message_length) {
++			wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
++				   "first fragment of frame (TLS Message "
++				   "Length %d bytes)",
++				   (int) len, (int) message_length);
++			return -1;
++		}
++
+ 		data->tls_in = wpabuf_alloc(message_length);
+ 		if (data->tls_in == NULL) {
+ 			wpa_printf(MSG_DEBUG, "SSL: No memory for message");

=== modified file 'debian/patches/series'
--- debian/patches/series	2012-09-12 15:57:50 +0000
+++ debian/patches/series	2012-11-30 16:58:20 +0000
@@ -8,3 +8,4 @@
 libnl3-includes.patch
 dbus-activation-cmdline.patch
 session-ticket.patch
+EAP-TLS-server_fix-TLS-Message-length-validation.patch

=== modified file 'debian/wpasupplicant.docs'
--- debian/wpasupplicant.docs	2012-04-21 15:59:32 +0000
+++ debian/wpasupplicant.docs	2012-11-30 16:58:20 +0000
@@ -1,2 +1,3 @@
 wpa_supplicant/README
 wpa_supplicant/README-WPS
+wpa_supplicant/README-P2P

=== modified file 'src/eap_server/eap_server_tls_common.c'
--- src/eap_server/eap_server_tls_common.c	2012-04-21 15:59:32 +0000
+++ src/eap_server/eap_server_tls_common.c	2012-11-30 16:58:20 +0000
@@ -224,6 +224,14 @@
 			return -1;
 		}
 
+		if (len > message_length) {
+			wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
+				   "first fragment of frame (TLS Message "
+				   "Length %d bytes)",
+				   (int) len, (int) message_length);
+			return -1;
+		}
+
 		data->tls_in = wpabuf_alloc(message_length);
 		if (data->tls_in == NULL) {
 			wpa_printf(MSG_DEBUG, "SSL: No memory for message");