aboutsummaryrefslogtreecommitdiff
path: root/net/hostapd
Commit message (Collapse)AuthorAgeFilesLines
* all: Remove all other $FreeBSD keywords.Mathieu Arnold2021-04-061-3/+0
|
* Remove # $FreeBSD$ from Makefiles.Mathieu Arnold2021-04-061-1/+0
|
* This is the ports version of src commitCy Schubert2021-01-202-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | d70886d063166786ded0007af8cdcbf57b7b4827. wpa_supplicant uses PF_ROUTE to return the routing table in order to determine the length of the routing table buffer. As of 81728a538d24 wpa_supplicant is started before the routing table has been populated resulting in the length of zero to be returned. This causes wpa_supplicant to loop endlessly. (The workaround is to kill and restart wpa_supplicant as by the time it is restarted the routing table is populated.) (Personally, I was not able to reproduce this unless wlan0 was a member of lagg0. However, others experienced this problem on standalone wlan0.) PR: 252844 Submitted by: shu <ankohuu _ outlook.com> Reported by: shu <ankohuu _ outlook.com> Reviewed by: cy Differential Revision: https://reviews.freebsd.org/D28249 Notes: svn path=/head/; revision=562150
* UPnP SUBSCRIBE misbehavior in hostapd WPS APCy Schubert2020-06-092-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As published by our hostapd upstream Vulnerability General security vulnerability in the way the callback URLs in the UPnP SUBSCRIBE command are used were reported (VU#339275, CVE-2020-12695). Some of the described issues may be applicable to the use of UPnP in WPS AP mode functionality for supporting external registrars. Such issues could allow a device connected to the local network (i.e., a device that has been authorized to transmit packets in the network in which the AP is located) could trigger the AP to initiate a HTTP (TCP/IP) connection to an arbitrary URL, including connections to servers in external networks. This could have a security implication if traffic from the local network to external destinations have different rules (e.g., firewall and packet inspection) for different local hosts and the AP having access to external hosts while the attacker controlled local device not having such access. Such deployment cases may not be common for networks where WPS would be enabled, but it is not possible to completely rule out the applicability to cases where hostapd is used to control a WPS enabled AP. In addition to the more generic issues with the UPnP protocol, couple of implementation specific issues in hostapd were discovered while reviewing this area of the WPS implementation. These issues could allow local devices (i.e., devices that have been authorized to transmit packets in the network in which the AP is located) to trigger misbehavior in hostapd and cause the process to either get terminated or to start using more CPU resources by using a specially constructed SUBSCRIBE command. All these issues require the attacker to be able to discover the UPnP service provided by hostapd and to open a TCP connection toward the IP address of the AP. The former requires access to the local network to be able to receive broadcast packets and the latter requires access to initiate TCP/IP connection to the IP address used by the AP. In most common AP deployment cases, both of these operations are available only from the local network. Vulnerable versions/configurations All hostapd versions with WPS AP support with UPnP enabled in the build parameters (CONFIG_WPS_UPNP=y) and in the runtime configuration (upnp_iface). Possible mitigation steps - Disable WPS UPnP support in the hostapd runtime configuration by removing the upnp_iface parameter. - Merge the following commits to hostapd and rebuild: For CVE-2020-12695: WPS UPnP: Do not allow event subscriptions with URLs to other networks For the other issues: WPS UPnP: Fix event message generation using a long URL path WPS UPnP: Handle HTTP initiation failures for events more properly These patches are available from https://w1.fi/security/2020-1/ - Update to hostapd v2.10 or newer, once available Obtained from: https://w1.fi/security/2020-1/ MFH: 2020Q2 Security: VU#339275 and CVE-2020-12695 Notes: svn path=/head/; revision=538281
* Chase src r361272:Cy Schubert2020-05-202-4/+27
| | | | | | | | | | | | | | Silence the once per second CTRL-EVENT-SCAN-FAILED errors when the WiFi radio is disabled through the communication device toggle key (also known as the RF raidio kill button). Only the CTRL-EVENT-DISCONNECTED will be issued. Submitted by: avg Reported by: avg MFH: 2020Q2 Notes: svn path=/head/; revision=535967
* Update 2.8 --> 2.9Cy Schubert2019-08-222-4/+4
| | | | Notes: svn path=/head/; revision=509577
* Convert to UCL & cleanup pkg-message (categories n)Mathieu Arnold2019-08-141-0/+6
| | | | | | | (and missed 3 missed files from previous categories.) Notes: svn path=/head/; revision=508903
* For users who build and install FreeBSD using WITHOUT_WIRELESSCy Schubert2019-06-172-0/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | simply altering /etc/rc.conf isn't enough to make use of the ports versions of hostapd and wpa_supplicant. This is because the rc.d scripts are not installed when WITHOUT_WIRELESS is specified as a build option. This patch checks for the rc scripts existence and if they do not exist, installs the ports versions of the same scripts, which are added by this revision. This patch does not change the package in any way and there is no way to enable this outside of removal of hostapd or wpa_supplicant (depending on the port). Users who build their own world using the WITHOUT_WIRELESS flag will almost always not use binary packages. Hence the automatic detection and install of the rc scripts. Making this an option would IMO increase the number of bug reports due to people inadvertently setting or not setting an option. To enable this a person must: 1. buildworld and installworld -DWITHOUT_WIRELESS 2. Build and install the desired wpa_supplicant and/or hostapd port on servers one wishes to install them on. PR: 238571 Notes: svn path=/head/; revision=504433
* Update wpa_supplicant/hostapd 2.7 --> 2.8Cy Schubert2019-04-222-5/+4
| | | | Notes: svn path=/head/; revision=499654
* Also document usage in pkg-message for binary package users.Cy Schubert2019-03-053-3/+7
| | | | | | | | | PR: 236230 Reported by: mt@markoturk.info MFH: 2019Q1 Notes: svn path=/head/; revision=494674
* Update 2.6 --> 2.7Cy Schubert2018-12-065-74/+30
| | | | Notes: svn path=/head/; revision=486778
* Pet portlint.Cy Schubert2018-08-171-0/+1
| | | | Notes: svn path=/head/; revision=477405
* leres@ suggested in D16718 and offline that I assume maintainershipCy Schubert2018-08-171-1/+1
| | | | | | | | | | of net/hostapd. Suggested by: leres@ Approved by: leres@ Notes: svn path=/head/; revision=477404
* Chase net/wpa_supplicant r477202 and base contrib/wpa r337819.Cy Schubert2018-08-172-4/+9
| | | | | | | | | | | | | | | WPA: Ignore unauthenticated encrypted EAPOL-Key data Though hostapd is technically not vulnerable, the mitigation for CVE-2018-14526 does apply cleanly, therefore it is applied to maintain consistency with net/wpa_supplicant and wpa in base. Approved by: leres@ MFH: 2018Q3 Differential Revision: https://reviews.freebsd.org/D16718 Notes: svn path=/head/; revision=477403
* In preparation for applying security patches, switch to grouping ofCy Schubert2018-08-171-8/+8
| | | | | | | | | | patches per site as suggested by mat@. Suggested by: mat@ Differential Revision: https://reviews.freebsd.org/D16718 Notes: svn path=/head/; revision=477402
* Update patches to unbreak build with LibreSSL 2.7 and theCraig Leres2018-04-032-3/+24
| | | | | | | | | | | | | | OpenSSL 1.1 API. PR: 227172 Submitted by: brnrd Reported by: brnrd Reviewed by: ler (mentor) Approved by: ler (mentor) Differential Revision: https://reviews.freebsd.org/D14957 Notes: svn path=/head/; revision=466381
* Update pkg-descr and Makefile in my ports to use https where possible.Craig Leres2017-10-211-1/+1
| | | | | | | | | | | | | | | | | | | Remove obsolete mirrors. - devel/arduino - devel/arduino-irremote - net/hostapd - security/broccoli - sysutils/lbl-cf - sysutils/lbl-hf - www/mini_httpd Reviewed by: ler (mentor), matthew (mentor) Approved by: ler (mentor), matthew (mentor) Differential Revision: https://reviews.freebsd.org/D12748 Notes: svn path=/head/; revision=452566
* Add patch set 2017-1.Cy Schubert2017-10-172-1/+25
| | | | | | | | | | | | | | | | | | | | | A vulnerability was found in how a number of implementations can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by replaying a specific frame that is used to manage the keys. Such reinstallation of the encryption key can result in two different types of vulnerabilities: disabling replay protection and significantly reducing the security of encryption to the point of allowing frames to be decrypted or some parts of the keys to be determined by an attacker depending on which cipher is used. Approved by: leres (maintainer) Security: https://w1.fi/security/2017-1/ \ wpa-packet-number-reuse-with-replayed-messages.txt Security: https://www.krackattacks.com/ MFH: 2017Q4 Differential Revision: D12691 Notes: svn path=/head/; revision=452257
* Use https site.Cy Schubert2017-10-171-1/+1
| | | | | | | | | Approved by: leres (maintainer) MFH: 2017Q4 Differential Revision: D12691 (part of) Notes: svn path=/head/; revision=452256
* Update MAINTAINER on my ports and "Created by" on the ones I createdCraig Leres2017-09-151-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | to use my @FreeBSD.org email address. - devel/arduino - devel/arduino-glcd - devel/arduino-irremote - devel/arduino-mk - devel/arduino-sevseg - net/hostapd - net/py-pcap - security/bro - security/broccoli - security/create-cert - sysutils/lbl-cf - sysutils/lbl-hf - www/mini_httpd Reviewed by: ler (mentor) Approved by: ler (mentor) Differential Revision: https://reviews.freebsd.org/D12374 Notes: svn path=/head/; revision=449916
* net/hostapd fails to compile with libresslLarry Rosenman2017-05-071-0/+20
| | | | | | | | | | | Not bumping PORTREVISION as default options are NOT libressl PR: 218802 Submitted by: w.schwarzenfeld@utanet.at Approved by: adamw (mentor, implicit), leres@ee.lbl.gov (maintainer) Notes: svn path=/head/; revision=440391
* Fix build broken by r436625.Cy Schubert2017-03-291-0/+14
| | | | | | | PR: 218036 Notes: svn path=/head/; revision=437179
* Update net/hostapd to 2.6 and fix multiple vulnerabilitiesKirill Ponomarev2017-03-214-83/+4
| | | | | | | | | | PR: 217907 Submitted by: maintainer Approved by: mat (mentor) Differential Revision: https://reviews.freebsd.org/D10051 Notes: svn path=/head/; revision=436625
* net/hostapd: Update os_unix.h to follow os_unix.c changeJohn Marino2016-09-301-1/+1
| | | | | | | | For completeness, make update os_unix.h patch to match the previous commit to os_unix.c (no impact for FreeBSD) Notes: svn path=/head/; revision=423019
* net/hostapd: Fix build on DragonFly and with LibreSSLJohn Marino2016-09-304-2/+82
| | | | | | | | | | | | | 1. Return the driver_bsd.c patch, it's still required for DF 2. Modify the os_unix.c patch to include exception for DF 3. Add patch to fix build with LibreSSL (originates from OpenBSD) 4. There's no configure set, so replace ineffective configure arg with CFLAGS and LDFLAGS for non-base SSL library Approved by: SSL blanket and DF blanket Notes: svn path=/head/; revision=423004
* Update to 2.5Guido Falsi2016-09-239-183/+39
| | | | | | | | PR: 212779 Submitted by: leres at ee.lbl.gov (maintainer) Notes: svn path=/head/; revision=422688
* net/hostapd: Remove PORTS_SSL option and use SSL_DEFAULTJohn Marino2016-09-131-21/+4
| | | | | | | | | | | | The port is now configured depending on the SSL base specified by the SSL_DEFAULT variable. Before it would break by default if SSL_DEFAULT was set to non-base. This changes puts hostapd in line with the rest of the ports tree. Approved by: SSL blanket Notes: svn path=/head/; revision=421977
* Fix usage of WITH_OPENSSL_BASE, WITH_OPENSSL_PORT and OPENSSL_PORT.Mathieu Arnold2016-06-161-6/+6
| | | | | | | | | | | | | | WITH_OPENSSL_* can't be set after bsd.port.pre.mk. Fold all other usage into using SSL_DEFAULT == foo PR: 210149 Submitted by: mat Exp-run by: antoine Sponsored by: The FreeBSD Foundation, Absolight Differential Revision: https://reviews.freebsd.org/D6577 Notes: svn path=/head/; revision=416966
* Remove BROKEN_* statements, the port builds fine everywhere.Alexey Dokuchaev2015-09-061-4/+0
| | | | Notes: svn path=/head/; revision=396228
* net/hostapd: Address 3 latest security advisoriesJohn Marino2015-06-025-0/+166
| | | | | | | | | | | | | | | | | | | | | These are combined upstream patches 2015-2, 2015-3, 2015-4 They address the following security advisories: * CVE-2015-4141 * CVE-2015-4142 * CVE-2015-4143 * CVE-2015-4144 * CVE-2015-4145 * CVE-2015-4146 These advisories also apply to security/wpa_supplicant PR: 200567 Submitted by: Jason Unovitch Approved by: maintainer (Craig Leres) Notes: svn path=/head/; revision=388314
* - Add CPE infoDmitry Marakasov2015-05-031-1/+2
| | | | | | | Approved by: portmgr blanket Notes: svn path=/head/; revision=385279
* net/hostapd: Unbreak new version on DragonFlyJohn Marino2015-04-012-0/+34
| | | | Notes: svn path=/head/; revision=382939
* net/hostapd: Upgrade version 2.3 => 2.4, add PORTS_SSL optionJohn Marino2015-03-292-4/+20
| | | | | | | | PR: 198889 Submitted by: maintainer (leres - ee.lbl.gov) Notes: svn path=/head/; revision=382595
* Add missing USE_OPENSSL=yesTijl Coosemans2015-01-151-0/+2
| | | | | | | PR: 195796 Notes: svn path=/head/; revision=377064
* net/hostapd: Upgrade version 2.2 => 2.3John Marino2014-10-163-26/+66
| | | | | | | | | | | | | While upgrading to the latest version released last week: * Rebase .config file on latest sample versoin * Support non-default prefixes * Merge new contents of do-configure target into post-patch target PR: 194315 Approved by: maintainer: (Craig Leres) Notes: svn path=/head/; revision=370974
* net/hostapd: Update WWW + MASTER_SITES and support DragonFlyJohn Marino2014-10-123-13/+14
| | | | | | | | | | | | | | | The domain for hostapd has changed from hostap.epitest.fi to w1.fi although the former still redirects. Update WWW and MASTER_SITES to reflect the new name. Regenerate the l2 packet patch so that hostapd also builds on DragonFly (no-op for FreeBSD). While here, rearrange makefile to remove need for <pre> and <post> and use of $PORTNAME in $WRKSRC which would break if PORTNAME changes. Notes: svn path=/head/; revision=370693
* - Update from 2.1 to 2.2 [1]Danilo Egea Gondolfo2014-06-072-5/+4
| | | | | | | | | | - Use just BSD3CLAUSE as LICENSE (according to README) PR: ports/190726 Submitted by: leres@ee.lbl.gov [1] Notes: svn path=/head/; revision=356881
* s/-script://Baptiste Daroussin2014-04-041-1/+1
| | | | Notes: svn path=/head/; revision=350124
* Update to version 2.1Pawel Pekala2014-03-132-3/+3
| | | | | | | | PR: ports/187459 Submitted by: maintainer Notes: svn path=/head/; revision=348049
* Support stagingEmanuel Haupt2014-02-281-11/+10
| | | | Notes: svn path=/head/; revision=346465
* Add NO_STAGE all over the place in preparation for the staging support (cat: ↵Baptiste Daroussin2013-09-201-0/+1
| | | | | | | net) Notes: svn path=/head/; revision=327755
* - Remove MAKE_JOBS_SAFE variableAlex Kozlov2013-08-141-1/+0
| | | | | | | Approved by: portmgr (bdrewery) Notes: svn path=/head/; revision=324744
* Update to version 2.0Pawel Pekala2013-02-023-8/+104
| | | | | | | | PR: ports/175438 Submitted by: Craig Leres <leres@ee.lbl.gov> (maintainer) Notes: svn path=/head/; revision=311422
* - Update to 1.0Jason Helfman2012-06-182-22/+21
| | | | | | | | | | | | | | | | | | | - Use ports framework for build: - Bonus: Now honours CC/CFLAGS/LDFLAGS - Remove DISTNAME override - Update LICENSE (GPLv2 not GPLv1) - Mark MAKE_JOBS_SAFE - Patch Makefile to see $(CC) not "CC" when not verbose - Pet portlint (LICENSE order) - while here shift where arch is tested, and use MAN{1,8}PREFIX PR: ports/169154 (based on) Submitted by: koobs.freebsd@gmail.com Approved by: maintainer, leres@ee.lbl.gov Notes: svn path=/head/; revision=299587
* Mark broken on powerpc as well as sparc64. (In fact, on all the tier-2s.)Mark Linimon2011-11-101-2/+2
| | | | | | | Hat: portmgr Notes: svn path=/head/; revision=285419
* Mark as broken on sparc64: does not compile.Mark Linimon2011-08-101-1/+7
| | | | Notes: svn path=/head/; revision=279399
* hostapd is a user space daemon for access point and authenticationMartin Wilke2011-02-125-0/+244
servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators, RADIUS client, EAP server, and RADIUS authentication server. The current version supports Linux (Host AP, madwifi, mac80211-based drivers) and FreeBSD (net80211). WWW: http://hostap.epitest.fi/hostapd/ PR: ports/154621 Submitted by: leres at ee.lbl.gov Notes: svn path=/head/; revision=268964
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-29 07:38:45 +0000