security/wpa_supplicant*: Fix EAPOL_TEST build for non-standard SSL_DEFAULT
The post-build target does not have the same environment variables setup
as the do-build target. This results in the eapol_test binary getting
compiled against the headers of the TLS library specified in
SSL_DEFAULT, but getting linked against the TLS library from the base
system regardless of SSL_DEFAULT, causing build failures when
SSL_DEFAULT is set to a different TLS library/version than the on from
the base system.
Fix this by not using the post-build target to build the eapol_test
binary, but instead conditionally add the eapol_test target to
TARGET_ALL if the EAPOL_TEST option is enabled for the port.
Signed-off-by: Pascal Ernster <git@hardfalcon.net>
security/wpa_supplicant: Update to 2.12
This includes the following changes:
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* improve BSS transition management support
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
* support Wi-Fi Direct R2
* support Wi-Fi Aware (add synchronized NAN; extend USD support)
* support Proximity Ranging
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
- IEEE 802.1X/EAP in Authentication frames
- Association frame encryption
- PMKID privacy
* enable layer 2/Wi-Fi multicast filtering for all networks (not
just some Passpoint networks which enabled this before)
* wpa_gui: port to Qt6
* support OpenSSL 3.0 API changes
* EAP-TEAP: protocol changes based on RFC 9930; this is not compatible
with previous versions
* maintain configuration file permissions when writing updated
configuration
* add option to validate PKCS#11/OpenSC engine and module paths
* fix PMKSA caching to enforce network context to avoid misuse of
unexpected PMKSA cache entries
* fix a potential DoS attack in SAE processing of an unexpected element
* fix incomplete bounds checking of mesh AMPE messages that could have
resulted in DoS attacks and memory corruption
* a large number of other fixes, cleanup, and extensions
security/wpa_supplicant: Add option to build libwpa_client
CONFIG_BUILD_WPA_CLIENT_SO allows building the libwpa_client shared
library and the wpa_ctrl.h header file. This library provides helpers
to interact with the wpa_supplicant control interface.
This is required for net/wutil.
Approved by: cy (maintainer timeout)
PR: 288933
Sponsored by: Google LLC (GSoC 2025)
net/hostapd* security/wpa-supplicant*: Fix 13 and 14 builds
The updates imported from 15-CURRENT included features not implemented
in FreeBSD 13 and 14. #ifdef them out.
Fixes: 995f5b9b0e4d
PR: 285371
net/nhostapd*, security/wpa_supplicant*: Sync drivers_bsd.c from src
src/ commits to drviers_bsd.c in src have fixed a number of problems
with wpa_supplicant/hostapd and FreeBSD. Bring those changes into the
ports.
PR: 285371
Tested by: Matthias Apitz <guru@unixarea.de>
MFH 2025Q1
security/wpa_supplicant: Sync driver_bsd.c with base system
Replace driver_bsd.c with the one from src. It utilizes facilities
and features already in FreeBSD.
security/wpa_supplicant: Fix 15-CURRENT 108de784513d build
On FreeBSD systems without 108de784513d the old definition will be used
while on 108de784513d and newer the duplicate case will be removed.
Obtained from: src 676041c41ba5
Discussed with: imp
security/wpa_supplicant*: ctrl_iface set sendbuf size
In order to avoid running into the default net.local.dgram.maxdgram
of 2K currently when calling sendto(2) try to set the sndbuf size to
the maximum ctrl message size.
The problem occured, e.g., when the scan_list result had enough BSSIDs
so the text output would exceed 2048 bytes.
Written by: bz
PR: 274990
Obtained from: https://reviews.freebsd.org/D42558
security/wpa_supplicant: wpa: Enable receiving priority tagged (VID 0) frames
Certain internet service providers transmit vlan 0 priority tagged
EAPOL frames from the ONT towards the residential gateway. VID 0
should be ignored, and the frame processed according to the priority
set in the 802.1P bits and the encapsulated EtherType (i.e. EAPOL).
The pcap filter utilized by l2_packet is inadquate for this use case.
Here we modify the pcap filter to accept both unencapsulated and
encapsulated (with VLAN 0) EAPOL EtherTypes. This preserves the
original filter behavior while also matching on encapsulated EAPOL.
Sponsored by: Rubicon Communications, LLC ("Netgate")
Reviewed by: cy
Obtained from: src bb5d6d14d81b
PR: 273696
MFH: 2023Q3
security/wpa_supplicant: Fix uninitialized packet pointer on error
The packet pointer (called packet) will remain uninitialized when
pcap_next_ex() returns an error. This occurs when the wlan
interface is shut down using ifconfig destroy. Adding a NULL
assignment to packet duplicates what pcap_next() does.
The reason we use pcap_next_ex() in this instance is because with
pacp_next() when we receive a null pointer if there was an error
or if no packets were read. With pcap_next_ex() we can differentiate
between an error and legitimately no packets were received.
PR: 270649, 273696
Obtained from: src 953efa5b200f
Reported by: Robert Morris <rtm@lcs.mit.edu>
MFH: 2023Q3
security/wpa_supplicant: driver_bsd.c: backout upstream IFF_ change and add logging
This reverts the state to our old supplicant logic setting or clearing
IFF_UP if needed. In addition this adds logging for the cases in which
we do (not) change the interface state.
Depending on testing this seems to help bringing WiFi up or not log
any needed changes (which would be the expected wpa_supplicant logic
now). People should look out for ``(changed)`` log entries (at least
if debugging the issue; this way we will at least have data points).
There is a hypothesis still pondered that the entire IFF_UP toggling
only exploits a race in net80211 (see further discssussions for more
debugging and alternative solutions see D38508 and D38753).
That may also explain why the changes to the rc startup script [1]
only helped partially for some people to no longer see the
continuous CTRL-EVENT-SCAN-FAILED.
It is highly likely that we will want further changes and until
we know for sure that people are seeing ''(changed)'' events
this should stay local. Should we need to upstream this we'll
likely need #ifdef __FreeBSD__ around this code.
Obtained from: src bfb202c4554a
PR: 273696
MFH: 2023Q3
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
security/wpa_supplicant-devel: Enable WEP by default
As of hostap 2.10, WEP is disabled by default. This of course is not a
bad thing but requires some planning and an announcment to remove WEP
support by default. At some point this option will default to off, to
coincide with the removal of WEP support from FreeBSD base.
MFH: 2022Q3
wpa_supplicant* hostapd*: Resolve secondary VAP association issue
Association will fail on a secondary open unprotected VAP when the
primary VAP is configured for WPA. Examples of secondary VAPs are,
hotels, universities, and commodity routers' guest networks.
A broadly similar bug was discussed on Red Hat's bugzilla affecting
association to a D-Link DIR-842.
This suggests that as IEs were added to the 802.11 protocol the old code
was increasingly inadaquate to handle the additional IEs, not only a
secondary VAP.
This duplcates src commit 775611ea11db here in ports.
PR: 264238
Reported by: Jaskie <jiangjun12321@gmail.com>
"J.R. Oldroyd" <fbsd@opal.com>
Submitted by: "J.R. Oldroyd" <fbsd@opal.com>
MFH: 2022Q3
*/*: Restore a missing wpa BSD driver patch
These patches were removed to sync with base where in fact base was
missing these patches and base should have been synced with the ports.
PR: 264238
Fixes: b8477825c2dc42f6c595697a36f593c71f39fbad
c86f32d652eb9dd023049122d8ca37cb13ed07b6
MFH: 2022Q2
*/*: Restore non-IBSS part of wpa patches
b8477825c2dc42f6c595697a36f593c71f39fbad removed some non-IBSS patches.
Restore them. We only want to remove the patches that make IBSS use
ADHOC mode.
Fixes: b8477825c2dc42f6c595697a36f593c71f39fbad
*/{wpa_supplicant*,hostapd*}: Fix wpa 100% CPU when USB wlan NIC removed
hostapd calls pcap_next(3) to read the next packet off the wlan interface.
pcap_next() returns a pointer to the packet header but does not indicate
success or failure. Unfortunately this results in an infinite loop (100%
CPU) when the wlan device disappears, i.e. when a USB wlan device is
manually removed or a USB error results in the device removal. However
pcap_next_ex(3) does return success or failure. To resolve this we use
pcap_next_ex(), forcing hostapd to exit when the error is encountered.
An error message is printed to syslog or stderr when debugging (-d flag)
is enabled. Unfortunately wpa_printf() only works when debugging is enabled.
PR: 253608
Reported by: Damjan Jovanovic <damjan.jov@gmail.com>,
bz (privately)
MFH: 2022Q2
*/*: Fix wpa_supplicant* and hostapd* EAPOL_TEST build
Fix EAPOL_TEST build. Local funcion os_fdatasync() is valid under
FreeBSD as fdatasync(2) is supported.
PR: 261636
Reported by: David Siebörger <drs-freebsd@sieborger.nom.za>
MFH: 2022Q1
*/*: Sync hostapd* and wpa_supplicant* with base ce276fe26d92010776
Use IFM_IEEE80211_ADHOC for now on FreeBSD for IBSS operation.
Base commit by adrian@ on Nov 26, 2015.
This commit syncs ports with base.
PR: 203086
Submitted by: avos
MFH: 2020Q2
security/wpa_supplicant: fix for P2P provision vulnerability
Latest version available from: https://w1.fi/security/2021-1/
Vulnerability
A vulnerability was discovered in how wpa_supplicant processes P2P
(Wi-Fi Direct) provision discovery requests. Under a corner case
condition, an invalid Provision Discovery Request frame could end up
reaching a state where the oldest peer entry needs to be removed. With
a suitably constructed invalid frame, this could result in use
(read+write) of freed memory. This can result in an attacker within
radio range of the device running P2P discovery being able to cause
unexpected behavior, including termination of the wpa_supplicant process
and potentially code execution.
Vulnerable versions/configurations
wpa_supplicant v1.0-v2.9 with CONFIG_P2P build option enabled
An attacker (or a system controlled by the attacker) needs to be within
radio range of the vulnerable system to send a set of suitably
constructed management frames that trigger the corner case to be reached
in the management of the P2P peer table.
Note: The P2P option is not default.
MFH: 2021Q1
Security: https://w1.fi/security/2021-1/\
wpa_supplicant-p2p-provision-discovery-processing-vulnerability.txt
Disable NDIS by default.
From src/bfc99943b04b46a6c1c885ce7bcc6f235b7422aa (brooks):
nids(4) was a clever idea in the early 2000's when the market was
flooded with 10/100 NICs with Windows-only drivers, but that hasn't
been the case for ages and the driver has had no meaningful maintenance
in ages. It only supports Windows-XP era drivers.
Therefore NDIS has been removed from 14-CURRENT. Those who still want or
need NDIS on older supported versions of FreeBSD can still enable the
options and rebuild the port.
This is the ports version of src commit d70886d063166786ded0007af8cdcbf57b7b4827.
wpa_supplicant uses PF_ROUTE to return the routing table in order to
determine the length of the routing table buffer. As of 81728a538d24
wpa_supplicant is started before the routing table has been populated
resulting in the length of zero to be returned. This causes
wpa_supplicant to loop endlessly. (The workaround is to kill and restart
wpa_supplicant as by the time it is restarted the routing table is
populated.)
(Personally, I was not able to reproduce this unless wlan0 was a member of
lagg0. However, others experienced this problem on standalone wlan0.)
PR: 252844
Submitted by: shu <ankohuu _ outlook.com>
Reported by: shu <ankohuu _ outlook.com>
Reviewed by: cy
Differential Revision: https://reviews.freebsd.org/D28249
Add SIM_SIMULATOR and USIM_SIMULATOR options.
SIM_SIMULATOR and USIM_SIMULATOR options enable features that are used for
testing EAP-AKA and EAP-SIM authentication.
PR: 252276
Submitted by: Terry Burton <tez _ terryburton.co.uk>
UPnP SUBSCRIBE misbehavior in hostapd WPS AP
As published by our hostapd upstream
Vulnerability
General security vulnerability in the way the callback URLs in the UPnP
SUBSCRIBE command are used were reported (VU#339275, CVE-2020-12695).
Some of the described issues may be applicable to the use of UPnP in WPS
AP mode functionality for supporting external registrars.
Such issues could allow a device connected to the local network (i.e., a
device that has been authorized to transmit packets in the network in
which the AP is located) could trigger the AP to initiate a HTTP
(TCP/IP) connection to an arbitrary URL, including connections to
servers in external networks. This could have a security implication if
traffic from the local network to external destinations have different
rules (e.g., firewall and packet inspection) for different local hosts
and the AP having access to external hosts while the attacker controlled
local device not having such access. Such deployment cases may not be
common for networks where WPS would be enabled, but it is not possible
to completely rule out the applicability to cases where hostapd is used
to control a WPS enabled AP.
In addition to the more generic issues with the UPnP protocol, couple of
implementation specific issues in hostapd were discovered while
reviewing this area of the WPS implementation. These issues could allow
local devices (i.e., devices that have been authorized to transmit
packets in the network in which the AP is located) to trigger
misbehavior in hostapd and cause the process to either get terminated or
to start using more CPU resources by using a specially constructed
SUBSCRIBE command.
All these issues require the attacker to be able to discover the UPnP
service provided by hostapd and to open a TCP connection toward the IP
address of the AP. The former requires access to the local network to be
able to receive broadcast packets and the latter requires access to
initiate TCP/IP connection to the IP address used by the AP. In most
common AP deployment cases, both of these operations are available only
from the local network.
Vulnerable versions/configurations
All hostapd versions with WPS AP support with UPnP enabled in the build
parameters (CONFIG_WPS_UPNP=y) and in the runtime configuration
(upnp_iface).
Possible mitigation steps
- Disable WPS UPnP support in the hostapd runtime configuration by
removing the upnp_iface parameter.
- Merge the following commits to hostapd and rebuild:
For CVE-2020-12695:
WPS UPnP: Do not allow event subscriptions with URLs to other networks
For the other issues:
WPS UPnP: Fix event message generation using a long URL path
WPS UPnP: Handle HTTP initiation failures for events more properly
These patches are available from https://w1.fi/security/2020-1/
- Update to hostapd v2.10 or newer, once available
Obtained from: https://w1.fi/security/2020-1/
MFH: 2020Q2
Security: VU#339275 and CVE-2020-12695
Chase src r361272:
Silence the once per second CTRL-EVENT-SCAN-FAILED errors when the WiFi
radio is disabled through the communication device toggle key (also known
as the RF raidio kill button). Only the CTRL-EVENT-DISCONNECTED will be
issued.
Submitted by: avg
Reported by: avg
MFH: 2020Q2
security/wpa_supplicant: Add EAPOL_TEST option
Add an option option to builds and installs the eapol_test program.
Update/patch to solve new compilation errors that result with the
option enabled.
Note: Leaving the changes to Packet32.c out of the PR patch set as
it is not needed.
PR: 245809
Approved by: cy (maintainer)
Add two new selectable options which allow the user to build wpa_supplicant to parity with the same in base. The new options, which are enabled in base are:
WPS_UPNP_DESC: Universal Plug and Play
IEEE8021X_EAPOL_DESC: EAP over LAN support