Skip to content

GitLab

Switch branch/tag
  1. 09 Nov, 2015 7 commits
  3. 06 Nov, 2015 1 commit
    • Jouni Malinen's avatar
      EAP-pwd peer: Fix last fragment length validation · 3aa9ad54
      Jouni Malinen authored 
      
All but the last fragment had their length checked against the remaining
room in the reassembly buffer. This allowed a suitably constructed last
fragment frame to try to add extra data that would go beyond the buffer.
The length validation code in wpabuf_put_data() prevents an actual
buffer write overflow from occurring, but this results in process
termination. (CVE-2015-5315)

Bug: 25510821

Change-Id: Ic509a6efedc3da9ff40f2842fab5547d087f64de
Signed-off-by: default avatarJouni Malinen <j@w1.fi>
Signed-off-by: default avatarDmitry Shmidt <dimitrysh@google.com>
      3aa9ad54
  5. 03 Nov, 2015 2 commits
  7. 02 Nov, 2015 6 commits
  9. 01 Nov, 2015 2 commits
    • Lee Campbell's avatar
      Fix pointer arithmetic on a void* · 2e30bb3e
      Lee Campbell authored 
      Fails to compile on x86 gcc due to pointer arithmetic on
a void*

Change-Id: Icae95d28d82c1a406ec684aa03327c0f523e3985
      2e30bb3e
    • Samuel Tan's avatar
      external/wpa_supplicant8: Use libdbus rather than dbus-1 · b7983999
      Samuel Tan authored 
      The upstream wpa_supplicant uses the dbus-1 library when
it is compiled with D-Bus support. In Android, we imported
the D-Bus shared libraries under the name "libdbus", so
use this shared library instead of dbus-1 when compiling
WPA supplicant with D-Bus support.

CQ-DEPEND=CL:746796
BUG: 22957177
TEST: Compile brillo for dragon/emulator succeeds.

Change-Id: I1b30f0c2302e6c95815508e43a69bd78cf218e16
      b7983999
  11. 23 Oct, 2015 1 commit
  13. 21 Oct, 2015 1 commit
    • Jouni Malinen's avatar
      RSN: Stop connection attempt on apparent PMK mismatch · 6ec3038c
      Jouni Malinen authored 
      
If WPA2-Enterprise connection with full EAP authentication (i.e., no
PMKSA caching used) results in a PMKID that does not match the one the
AP/Authenticator indicates in EAPOL-Key msg 1/4, there is not much point
in trying to trigger full EAP authentication by sending EAPOL-Start
since this sequence was immediately after such full authentication
attempt.

There are known examples of authentication servers with incorrect MSK
derivation when TLS v1.2 is used (e.g., FreeRADIUS 2.2.6 or 3.0.7 when
built with OpenSSL 1.0.2). Write a clear debug log entry and also send
it to control interface monitors when it looks likely that this case has
been hit. After doing that, stop the connection attempt by
disassociating instead of trying to send out EAPOL-Start to trigger new
EAP authentication round (such another try can be tried with a new
association).

b/24253154

From upstream commit bddc51e8e422463dc96c263666b6fc4c26375cb6

Change-Id: I1e72c9d0232492103a10c0f4125170c000754ac5
Signed-off-by: default avatarJouni Malinen <j@w1.fi>
      6ec3038c
  15. 13 Oct, 2015 4 commits
  17. 07 Oct, 2015 4 commits
  19. 19 Sep, 2015 1 commit
  21. 18 Sep, 2015 1 commit
    • Amarnath Hullur Subramanyam's avatar
      Update AP WPA/RSN IE on all associations if driver can select BSS · a82c83cf
      Amarnath Hullur Subramanyam authored 
      
It is possible for driver-based BSS selection to end up reassociating
back to the current AP. If wpa_supplicant preferred another BSS, it
would have updated the internal knowledge of the AP's WPA/RSN IE when
requesting a new connection. In the special case of existing association
and new association being with the same BSS that is different from the
wpa_supplicant preference, association event processing skipped the
WPA/RSN IE update. This could result in the following 4-way handshake
getting rejected due to incorrectly detected mismatch with AP's RSN/WPA
IE between Beacon/Probe Response frame and EAPOL-Key msg 3/4.

Fix this by updating the AP WPA/RSN IE on all association events when
driver-based BSS selection is used regardless of whether the BSSID
changes. This could also cover a theoretical case of the AP changing its
RSN/WPA IE at the very moment we try to reassociate back to the same
BSS.
Signed-off-by: default avatarJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: default avatarDmitry Shmidt <dimitrysh@google.com>

Change-Id: If37977900badf39603fad6c8ffadfe7d16e826ae
Bug: 24110113
      a82c83cf
  23. 28 Aug, 2015 2 commits
  25. 27 Aug, 2015 3 commits
  27. 26 Aug, 2015 3 commits
  29. 25 Aug, 2015 1 commit
  31. 24 Aug, 2015 1 commit