aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services
Commit message (Collapse)AuthorAgeFilesLines
...
* wireguard: bump to 0.0.20190702Jason A. Donenfeld2019-07-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * curve25519: not all linkers support bmi2 and adx This should allow WireGuard to build on older toolchains. * global: switch to coarse ktime Our prior use of fast ktime before meant that sometimes, depending on how broken the motherboard was, we'd wind up calling into the HPET slow path. Here we move to coarse ktime which is always super speedy. In the process we had to fix the resolution of the clock, as well as introduce a new interface for it, landing in 5.3. Older kernels fall back to a fast-enough mechanism based on jiffies. https://lore.kernel.org/lkml/tip-e3ff9c3678b4d80e22d2557b68726174578eaf52@git.kernel.org/ https://lore.kernel.org/lkml/20190621203249.3909-3-Jason@zx2c4.com/ * netlink: cast struct over cb->args for type safety This follow recent upstream changes such as: https://lore.kernel.org/lkml/20190628144022.31376-1-Jason@zx2c4.com/ * peer: use LIST_HEAD macro Style nit. * receive: queue dead packets to napi queue instead of empty rx_queue This mitigates a WARN_ON being triggered by the workqueue code. It was quite hard to trigger, except sporadically, or reliably with a PC Engines ALIX, an extremely slow board with an AMD LX800 that Ryan Whelan of Axatrax was kind enough to mail me. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* hostapd: remove stale WPA_SUPPLICANT_NO_TIMESTAMP_CHECK optionChristian Lamparter2019-06-202-26/+0
| | | | | | | | | | Support to disable the timestamp check for certificates in wpa_supplicant (Useful for devices without RTC that cannot reliably get the real date/time) has been accepted in the upstream hostapd. It's implemented in wpa_supplicant as a per-AP flag tls_disable_time_checks=[0|1]. Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* uhttpd: add direct dependency on libjson-cJo-Philipp Wich2019-06-201-1/+1
| | | | | | | | | | | The OpenWrt buildroot ABI version rebuild tracker does not handle transient dependencies, therefor add all libraries linked by uhttpd as direct dependencies to the corresponding binary package definition. This ensures that uhttpd is automatically rebuilt and relinked if any of these libraries has its ABI_VERSION updated in the future. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uhttpd: Fix format string build problemsHauke Mehrtens2019-06-161-3/+3
| | | | | | | | 91fcac34ac uhttpd: Fix multiple format string problems Fixes: fc454ca15305 libubox: update to latest git HEAD Reported-by: Hannu Nyman <hannu.nyman@iki.fi> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: move feature detection inside a shell funcYousong Zhou2019-06-112-7/+10
| | | | | | Resolves openwrt/packages#9219 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* dnsmasq: skip options that are not compiled inYousong Zhou2019-06-092-3/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is to make life easier for users with customized build of dnsmasq-full variant. Currently dnsmasq config generated by current service script will be rejected by dnsmasq build lacking DHCP feature - Options like --dhcp-leasefile have default values. Deleting them from uci config or setting them to empty value will make them take on default value in the end - Options like --dhcp-broadcast are output unconditionally Tackle this by - Check availablility of features from output of "dnsmasq --version" - Make a list of options guarded by HAVE_xx macros in src/options.c of dnsmasq source code - Ignore these options in xappend() Two things to note in this implementation - The option list is not exhaustive. Supposedly only those options that may cause dnsmasq to reject with "unsupported option (check that dnsmasq was compiled with DHCP/TFTP/DNSSEC/DBus support)" are taken into account here - This provides a way out but users' cooperation is still needed. E.g. option dnssec needs to be turned off, otherwise the service script will try to add --conf-file pointing to dnssec specific anchor file which dnsmasq lacking dnssec support will reject Resolves FS#2281 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* wireguard: bump to 0.0.20190601Jason A. Donenfeld2019-06-011-2/+2
| | | | | | | | | | | | | | There was an issue with the backport compat layer in yesterday's snapshot, causing issues on certain (mostly Atom) Intel chips on kernels older than 4.2, due to the use of xgetbv without checking cpu flags for xsave support. This manifested itself simply at module load time. Indeed it's somewhat tricky to support 33 different kernel versions (3.10+), plus weird distro frankenkernels. If OpenWRT doesn't support < 4.2, you probably don't need to apply this. But it also can't hurt, and probably best to stay updated. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wireguard: bump to 0.0.20190531Jason A. Donenfeld2019-05-311-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * tools: add wincompat layer to wg(8) Consistent with a lot of the Windows work we've been doing this last cycle, wg(8) now supports the WireGuard for Windows app by talking through a named pipe. You can compile this as `PLATFORM=windows make -C src/tools` with mingw. Because programming things for Windows is pretty ugly, we've done this via a separate standalone wincompat layer, so that we don't pollute our pretty *nix utility. * compat: udp_tunnel: force cast sk_data_ready This is a hack to work around broken Android kernel wrapper scripts. * wg-quick: freebsd: workaround SIOCGIFSTATUS race in FreeBSD kernel FreeBSD had a number of kernel race conditions, some of which we can vaguely work around. These are in the process of being fixed upstream, but probably people won't update for a while. * wg-quick: make darwin and freebsd path search strict like linux Correctness. * socket: set ignore_df=1 on xmit This was intended from early on but didn't work on IPv6 without the ignore_df flag. It allows sending fragments over IPv6. * qemu: use newer iproute2 and kernel * qemu: build iproute2 with libmnl support * qemu: do not check for alignment with ubsan The QEMU build system has been improved to compile newer versions. Linking against libmnl gives us better error messages. As well, enabling the alignment check on x86 UBSAN isn't realistic. * wg-quick: look up existing routes properly * wg-quick: specify protocol to ip(8), because of inconsistencies The route inclusion check was wrong prior, and Linux 5.1 made it break entirely. This makes a better invocation of `ip route show match`. * netlink: use new strict length types in policy for 5.2 * kbuild: account for recent upstream changes * zinc: arm64: use cpu_get_elf_hwcap accessor for 5.2 The usual churn of changes required for the upcoming 5.2. * timers: add jitter on ack failure reinitiation Correctness tweak in the timer system. * blake2s,chacha: latency tweak * blake2s: shorten ssse3 loop In every odd-numbered round, instead of operating over the state x00 x01 x02 x03 x05 x06 x07 x04 x10 x11 x08 x09 x15 x12 x13 x14 we operate over the rotated state x03 x00 x01 x02 x04 x05 x06 x07 x09 x10 x11 x08 x14 x15 x12 x13 The advantage here is that this requires no changes to the 'x04 x05 x06 x07' row, which is in the critical path. This results in a noticeable latency improvement of roughly R cycles, for R diagonal rounds in the primitive. As well, the blake2s AVX implementation is now SSSE3 and considerably shorter. * tools: allow setting WG_ENDPOINT_RESOLUTION_RETRIES System integrators can now specify things like WG_ENDPOINT_RESOLUTION_RETRIES=infinity when building wg(8)-based init scripts and services, or 0, or any other integer. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ppp: add config options to tune discovery timeout and attemptsHans Dedecker2019-05-312-1/+8
| | | | | | | | | | | Upstream PPP project has added in commit 8e77984 options to tune discovery timeout and attempts in the rp-pppoe plugin. Expose these options in the uci datamodel for pppoe: padi_attempts: Number of discovery attempts padi_timeout: Initial timeout for discovery packets in seconds Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* ppp: update to version 2.4.7.git-2019-05-25Hans Dedecker2019-05-311-3/+3
| | | | | | 8e77984 rp-pppoe plugin: Add options to tune discovery timeout and number of attempts Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* ppp: update to version 2.4.7.git-2019-05-18Hans Dedecker2019-05-186-287/+7
| | | | | | | | | | | c9d9dbf pppoe: Custom host-uniq tag 44012ae plugins/rp-pppoe: Fix compile errors Refresh patches Drop 520-uniq patch as upstream accepted Drop 150-debug_compile_fix patch as fixed upstream Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcpd: update to latest git HEAD (FS#2242)Hans Dedecker2019-05-171-3/+3
| | | | | | | | | | | | | | | | | | 41a74cb config: remove 'ignore' config option c0c8034 treewide: init assignment lists head f98b7ee config: use list safe iterator in lease_delete 3c9810b dhcpv4: fix lease ordering by ip address b60c384 config: use multi-stage parsing of uci sections a2dd8d6 treewide: always init interface list heads during initialization a17665e dhcpv4: do not allow pool end address to overlap with broadcast address 6b951c5 treewide: give file descriptors safe initial value 39e11ed dhcpv4: DHCP pool size is off-by-one 4a600ce dhcpv4: add support for Parameter Request List option 55 09e5eca dhcpv4: fix DHCP packet size 3cd4876 ndp: fix syslog flooding (FS#2242) 79fbba1 config: set default loglevel to LOG_WARNING Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* ppp: update to version 2.4.7.git-2019-05-06Hans Dedecker2019-05-138-32/+32
| | | | | | | fcb076c Various fixes for errors found by coverity static analysis (#109) d98ab38 Merge branch 'pppd_print_changes' of https://github.com/nlhintz/ppp into nlhintz-pppd_print_changes Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* lldpd: add option to edit hostnameLucian Cristian2019-05-112-0/+5
| | | | | | | also fixes the annoying repeating syslog lldp[]: unable to get system name Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
* lldpd: update to 1.0.3Lucian Cristian2019-05-112-11/+25
| | | | | | Support for CDP PD PoE Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
* Revert "uhttpd: disable concurrent requests by default"Jo-Philipp Wich2019-04-232-2/+2
| | | | | | | | | | This reverts commit c6aa9ff38870a30dbe6da17e4edad6039fe10ddf. Further testing has revealed that we will need to allow concurrent requests after all, especially for situations where CGI processes initiate further HTTP requests to the local host. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* odhcpd: update to latest git HEAD (FS#2243, FS#2244)Hans Dedecker2019-04-191-3/+3
| | | | | | 6633efe router: fix dns search list option Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* dropbear: allow build without dbclientRosy Song2019-04-182-4/+9
| | | | | | This can save ~16KBytes size for the ipk Signed-off-by: Rosy Song <rosysong@rosinson.com>
* odhcpd: update to latest git HEAD (FS#2206)Hans Dedecker2019-04-171-3/+3
| | | | | | | | | | | | 38bc630 router: use ra_lifetime as lifetime for RA options (FS#2206) 0523bdd router: improve code readibility 0a3b279 Revert "router:" 207f8e0 treewide: align syslog loglevels f1d7da9 router: 0e048ac treewide: fix compiler warnings 83698f6 CMakeList.txt: enable extra compiler checks Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* hostapd: fix CVE-2019-9497, CVE-2019-9498, CVE-2019-9499Stefan Lippers-Hollmann2019-04-115-1/+467
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EAP-pwd missing commit validation Published: April 10, 2019 Identifiers: - CVE-2019-9497 (EAP-pwd server not checking for reflection attack) - CVE-2019-9498 (EAP-pwd server missing commit validation for scalar/element) - CVE-2019-9499 (EAP-pwd peer missing commit validation for scalar/element) Latest version available from: https://w1.fi/security/2019-4/ Vulnerability EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant (EAP peer) was discovered not to validate the received scalar and element values in EAP-pwd-Commit messages properly. This could result in attacks that would be able to complete EAP-pwd authentication exchange without the attacker having to know the used password. A reflection attack is possible against the EAP-pwd server since the hostapd EAP server did not verify that the EAP-pwd-Commit contains scalar/element values that differ from the ones the server sent out itself. This allows the attacker to complete EAP-pwd authentication without knowing the password, but this does not result in the attacker being able to derive the session key (MSK), i.e., the attacker would not be able to complete the following key exchange (e.g., 4-way handshake in RSN/WPA). An attack using invalid scalar/element values is possible against both the EAP-pwd server and peer since hostapd and wpa_supplicant did not validate these values in the received EAP-pwd-Commit messages. If the used crypto library does not implement additional checks for the element (EC point), this could result in attacks where the attacker could use a specially crafted commit message values to manipulate the exchange to result in deriving a session key value from a very small set of possible values. This could further be used to attack the EAP-pwd server in a practical manner. An attack against the EAP-pwd peer is slightly more complex, but still consider practical. These invalid scalar/element attacks could result in the attacker being able to complete authentication and learn the session key and MSK to allow the key exchange to be completed as well, i.e., the attacker gaining access to the network in case of the attack against the EAP server or the attacker being able to operate a rogue AP in case of the attack against the EAP peer. While similar attacks might be applicable against SAE, it should be noted that the SAE implementation in hostapd and wpa_supplicant does have the validation steps that were missing from the EAP-pwd implementation and as such, these attacks do not apply to the current SAE implementation. Old versions of wpa_supplicant/hostapd did not include the reflection attack check in the SAE implementation, though, since that was added in June 2015 for v2.5 (commit 6a58444d27fd 'SAE: Verify that own/peer commit-scalar and COMMIT-ELEMENT are different'). Vulnerable versions/configurations All hostapd versions with EAP-pwd support (CONFIG_EAP_PWD=y in the build configuration and EAP-pwd being enabled in the runtime configuration) are vulnerable against the reflection attack. All wpa_supplicant and hostapd versions with EAP-pwd support (CONFIG_EAP_PWD=y in the build configuration and EAP-pwd being enabled in the runtime configuration) are vulnerable against the invalid scalar/element attack when built against a crypto library that does not have an explicit validation step on imported EC points. The following list indicates which cases are vulnerable/not vulnerable: - OpenSSL v1.0.2 or older: vulnerable - OpenSSL v1.1.0 or newer: not vulnerable - BoringSSL with commit 38feb990a183 ('Require that EC points are on the curve.') from September 2015: not vulnerable - BoringSSL without commit 38feb990a183: vulnerable - LibreSSL: vulnerable - wolfssl: vulnerable Acknowledgments Thanks to Mathy Vanhoef (New York University Abu Dhabi) for discovering and reporting the issues and for proposing changes to address them in the implementation. Possible mitigation steps - Merge the following commits to wpa_supplicant/hostapd and rebuild: CVE-2019-9497: EAP-pwd server: Detect reflection attacks CVE-2019-9498: EAP-pwd server: Verify received scalar and element EAP-pwd: Check element x,y coordinates explicitly CVE-2019-9499: EAP-pwd client: Verify received scalar and element EAP-pwd: Check element x,y coordinates explicitly These patches are available from https://w1.fi/security/2019-4/ - Update to wpa_supplicant/hostapd v2.8 or newer, once available Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> [bump PKG_RELEASE] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: fix CVE-2019-9496Stefan Lippers-Hollmann2019-04-112-1/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | hostapd: fix SAE confirm missing state validation Published: April 10, 2019 Identifiers: - CVE-2019-9496 (SAE confirm missing state validation in hostapd/AP) Latest version available from: https://w1.fi/security/2019-3/ Vulnerability When hostapd is used to operate an access point with SAE (Simultaneous Authentication of Equals; also known as WPA3-Personal), an invalid authentication sequence could result in the hostapd process terminating due to a NULL pointer dereference when processing SAE confirm message. This was caused by missing state validation steps when processing the SAE confirm message in hostapd/AP mode. Similar cases against the wpa_supplicant SAE station implementation had already been tested by the hwsim test cases, but those sequences did not trigger this specific code path in AP mode which is why the issue was not discovered earlier. An attacker in radio range of an access point using hostapd in SAE configuration could use this issue to perform a denial of service attack by forcing the hostapd process to terminate. Vulnerable versions/configurations All hostapd versions with SAE support (CONFIG_SAE=y in the build configuration and SAE being enabled in the runtime configuration). Possible mitigation steps - Merge the following commit to hostapd and rebuild: SAE: Fix confirm message validation in error cases These patches are available from https://w1.fi/security/2019-3/ - Update to hostapd v2.8 or newer, once available Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> [bump PKG_RELEASE] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: fix CVE-2019-9495Stefan Lippers-Hollmann2019-04-112-1/+320
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EAP-pwd side-channel attack Published: April 10, 2019 Identifiers: - CVE-2019-9495 (cache attack against EAP-pwd) Latest version available from: https://w1.fi/security/2019-2/ Vulnerability Number of potential side channel attacks were recently discovered in the SAE implementations used by both hostapd and wpa_supplicant (see security advisory 2019-1 and VU#871675). EAP-pwd uses a similar design for deriving PWE from the password and while a specific attack against EAP-pwd is not yet known to be tested, there is no reason to believe that the EAP-pwd implementation would be immune against the type of cache attack that was identified for the SAE implementation. Since the EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant (EAP peer) does not support MODP groups, the timing attack described against SAE is not applicable for the EAP-pwd implementation. A novel cache-based attack against SAE handshake would likely be applicable against the EAP-pwd implementation. Even though the wpa_supplicant/hostapd PWE derivation iteration for EAP-pwd has protections against timing attacks, this new cache-based attack might enable an attacker to determine which code branch is taken in the iteration if the attacker is able to run unprivileged code on the victim machine (e.g., an app installed on a smart phone or potentially a JavaScript code on a web site loaded by a web browser). This depends on the used CPU not providing sufficient protection to prevent unprivileged applications from observing memory access patterns through the shared cache (which is the most likely case with today's designs). The attacker could use information about the selected branch to learn information about the password and combine this information from number of handshake instances with an offline dictionary attack. With sufficient number of handshakes and sufficiently weak password, this might result in full recovery of the used password if that password is not strong enough to protect against dictionary attacks. This attack requires the attacker to be able to run a program on the target device. This is not commonly the case on an authentication server (EAP server), so the most likely target for this would be a client device using EAP-pwd. The commits listed in the end of this advisory change the EAP-pwd implementation shared by hostapd and wpa_supplicant to perform the PWE derivation loop using operations that use constant time and memory access pattern to minimize the externally observable differences from operations that depend on the password even for the case where the attacker might be able to run unprivileged code on the same device. Vulnerable versions/configurations All wpa_supplicant and hostapd versions with EAP-pwd support (CONFIG_EAP_PWD=y in the build configuration and EAP-pwd being enabled in the runtime configuration). It should also be noted that older versions of wpa_supplicant/hostapd prior to v2.7 did not include additional protection against certain timing differences. The definition of the EAP-pwd (RFC 5931) does not describe such protection, but the same issue that was addressed in SAE earlier can be applicable against EAP-pwd as well and as such, that implementation specific extra protection (commit 22ac3dfebf7b, "EAP-pwd: Mask timing of PWE derivation") is needed to avoid showing externally visible timing differences that could leak information about the password. Any uses of older wpa_supplicant/hostapd versions with EAP-pwd are recommended to update to v2.7 or newer in addition to the mitigation steps listed below for the more recently discovered issue. Possible mitigation steps - Merge the following commits to wpa_supplicant/hostapd and rebuild: OpenSSL: Use constant time operations for private bignums Add helper functions for constant time operations OpenSSL: Use constant time selection for crypto_bignum_legendre() EAP-pwd: Use constant time and memory access for finding the PWE These patches are available from https://w1.fi/security/2019-2/ - Update to wpa_supplicant/hostapd v2.8 or newer, once available - Use strong passwords to prevent dictionary attacks Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> [bump PKG_RELEASE] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: fix CVE-2019-9494Stefan Lippers-Hollmann2019-04-119-1/+1083
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SAE side-channel attacks Published: April 10, 2019 Identifiers: - VU#871675 - CVE-2019-9494 (cache attack against SAE) Latest version available from: https://w1.fi/security/2019-1/ Vulnerability Number of potential side channel attacks were discovered in the SAE implementations used by both hostapd (AP) and wpa_supplicant (infrastructure BSS station/mesh station). SAE (Simultaneous Authentication of Equals) is also known as WPA3-Personal. The discovered side channel attacks may be able to leak information about the used password based on observable timing differences and cache access patterns. This might result in full password recovery when combined with an offline dictionary attack and if the password is not strong enough to protect against dictionary attacks. Cache attack A novel cache-based attack against SAE handshake was discovered. This attack targets SAE with ECC groups. ECC group 19 being the mandatory group to support and the most likely used group for SAE today, so this attack applies to the most common SAE use case. Even though the PWE derivation iteration in SAE has protections against timing attacks, this new cache-based attack enables an attacker to determine which code branch is taken in the iteration if the attacker is able to run unprivileged code on the victim machine (e.g., an app installed on a smart phone or potentially a JavaScript code on a web site loaded by a web browser). This depends on the used CPU not providing sufficient protection to prevent unprivileged applications from observing memory access patterns through the shared cache (which is the most likely case with today's designs). The attacker can use information about the selected branch to learn information about the password and combine this information from number of handshake instances with an offline dictionary attack. With sufficient number of handshakes and sufficiently weak password, this might result in full discovery of the used password. This attack requires the attacker to be able to run a program on the target device. This is not commonly the case on access points, so the most likely target for this would be a client device using SAE in an infrastructure BSS or mesh BSS. The commits listed in the end of this advisory change the SAE implementation shared by hostapd and wpa_supplicant to perform the PWE derivation loop using operations that use constant time and memory access pattern to minimize the externally observable differences from operations that depend on the password even for the case where the attacker might be able to run unprivileged code on the same device. Timing attack The timing attack applies to the MODP groups 22, 23, and 24 where the PWE generation algorithm defined for SAE can have sufficient timing differences for an attacker to be able to determine how many rounds were needed to find the PWE based on the used password and MAC addresses. When the attack is repeated with multiple times, the attacker may be able to gather enough information about the password to be able to recover it fully using an offline dictionary attack if the password is not strong enough to protect against dictionary attacks. This attack could be performed by an attacker in radio range of an access point or a station enabling the specific MODP groups. This timing attack requires the applicable MODP groups to be enabled explicitly in hostapd/wpa_supplicant configuration (sae_groups parameter). All versions of hostapd/wpa_supplicant have disabled these groups by default. While this security advisory lists couple of commits introducing additional protection for MODP groups in SAE, it should be noted that the groups 22, 23, and 24 are not considered strong enough to meet the current expectation for a secure system. As such, their use is discouraged even if the additional protection mechanisms in the implementation are included. Vulnerable versions/configurations All wpa_supplicant and hostapd versions with SAE support (CONFIG_SAE=y in the build configuration and SAE being enabled in the runtime configuration). Acknowledgments Thanks to Mathy Vanhoef (New York University Abu Dhabi) and Eyal Ronen (Tel Aviv University) for discovering the issues and for discussions on how to address them. Possible mitigation steps - Merge the following commits to wpa_supplicant/hostapd and rebuild: OpenSSL: Use constant time operations for private bignums Add helper functions for constant time operations OpenSSL: Use constant time selection for crypto_bignum_legendre() SAE: Minimize timing differences in PWE derivation SAE: Avoid branches in is_quadratic_residue_blind() SAE: Mask timing of MODP groups 22, 23, 24 SAE: Use const_time selection for PWE in FFC SAE: Use constant time operations in sae_test_pwd_seed_ffc() These patches are available from https://w1.fi/security/2019-1/ - Update to wpa_supplicant/hostapd v2.8 or newer, once available - In addition to either of the above alternatives, disable MODP groups 1, 2, 5, 22, 23, and 24 by removing them from hostapd/wpa_supplicant sae_groups runtime configuration parameter, if they were explicitly enabled since those groups are not considered strong enough to meet current security expectations. The groups 22, 23, and 24 are related to the discovered side channel (timing) attack. The other groups in the list are consider too weak to provide sufficient security. Note that all these groups have been disabled by default in all hostapd/wpa_supplicant versions and these would be used only if explicitly enabled in the configuration. - Use strong passwords to prevent dictionary attacks Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> [bump PKG_RELEASE] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* wireguard: remove obvious commentsFlorian Eckert2019-04-091-9/+0
| | | | | | Remove obvious comments to save disk space. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* wireguard: converted whitespaces from space to tabFlorian Eckert2019-04-091-176/+169
| | | | | | | | | With this change, the file is reduced from 5186 bytes to 4649 bytes that its approximately 10.5 percent less memory consumption. For small devices, sometimes every byte counts. Also, all other protocol handler use tabs instead of spaces. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* dropbear: bump to 2019.78Hans Dedecker2019-04-072-48/+2
| | | | | | | | | | Fix dbclient regression in 2019.77. After exiting the terminal would be left in a bad state. Reported by Ryan Woodsmall drop patch applied upstream: 010-tty-modes-werent-reset-for-client.patch Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* wireguard: bump to 0.0.20190406Jason A. Donenfeld2019-04-061-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * allowedips: initialize list head when removing intermediate nodes Fix for an important regression in removing allowed IPs from the last snapshot. We have new test cases to catch these in the future as well. * tools: warn if an AllowedIP has a nonzero host part If you try to run `wg set wg0 peer ... allowed-ips 192.168.1.82/24`, wg(8) will now print a warning. Even though we mask this automatically down to 192.168.1.0/24, usually when people specify it like this, it's a mistake. * wg-quick: add 'strip' subcommand The new strip subcommand prints the config file to stdout after stripping it of all wg-quick-specific options. This enables tricks such as: `wg addconf $DEV <(wg-quick strip $DEV)`. * tools: avoid unneccessary next_peer assignments in sort_peers() Small C optimization the compiler was probably already doing. * peerlookup: rename from hashtables * allowedips: do not use __always_inline * device: use skb accessor functions where possible Suggested tweaks from Dave Miller. * blake2s: simplify * blake2s: remove outlen parameter from final The blake2s implementation has been simplified, since we don't use any of the fancy tree hashing parameters or the like. We also no longer separate the output length at initialization time from the output length at finalization time. * global: the _bh variety of rcu helpers have been unified * compat: nf_nat_core.h was removed upstream * compat: backport skb_mark_not_on_list The usual assortment of compat fixes for Linux 5.1. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* odhcpd: update to latest git HEADHans Dedecker2019-04-051-3/+3
| | | | | | | | 65a9519 ndp: create ICMPv6 socket per interface c6dae8e router: create ICMPv6 socket per interface e7b1d4b treewide: initialize properly file descriptors Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* openvpn: openssl: explicitly depend on deprecated APIsMagnus Kroken2019-04-031-1/+1
| | | | | | | | OpenVPN as of 2.4.7 uses some OpenSSL APIs that are deprecated in OpenSSL >= 1.1.0. Signed-off-by: Magnus Kroken <mkroken@gmail.com> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [white space fix]
* openvpn: update to 2.4.7Magnus Kroken2019-04-013-5/+5
| | | | Signed-off-by: Magnus Kroken <mkroken@gmail.com>
* odhcpd: update to latest git HEADHans Dedecker2019-03-291-3/+3
| | | | | | | 7798d50 netlink: rework IPv4 address refresh logic 0b20876 netlink: rework IPv6 address refresh logic Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* wireguard: introduce 'nohostroute' optionDaniel Golle2019-03-271-1/+2
| | | | | | | | | | Instead of creating host-routes depending on fwmark as (accidentally) pushed by commit 1e8bb50b93 ("wireguard: do not add host-dependencies if fwmark is set") use a new config option 'nohostroute' to explicitely prevent creation of the route to the endpoint. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* wireguard: do not add host-dependencies if fwmark is setDaniel Golle2019-03-271-6/+8
| | | | | | | | | | The 'fwmark' option is used to define routing traffic to wireguard endpoints to go through specific routing tables. In that case it doesn't make sense to setup routes for host-dependencies in the 'main' table, so skip setting host dependencies if 'fwmark' is set. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* odhcpd: update to latest git HEAD (FS#2204)Hans Dedecker2019-03-271-3/+3
| | | | | | 420945c netlink: fix IPv6 address updates (FS#2204) Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* dropbear: split ECC support to basic and fullKonstantin Demin2019-03-252-8/+31
| | | | | | | | | | - limit ECC support to ec*-sha2-nistp256: * DROPBEAR_ECC now provides only basic support for ECC - provide full ECC support as an option: * DROPBEAR_ECC_FULL brings back support for ec{dh,dsa}-sha2-nistp{384,521} - update feature costs in binary size Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: rewrite init script startup logic to handle both host key filesKonstantin Demin2019-03-251-24/+38
| | | | Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: change type of config option "Port" to scalar type "port"Konstantin Demin2019-03-251-1/+1
| | | | | | it was never used anywhere, even LuCI works with "Port" as scalar type. Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: introduce config option "keyfile" (replacement for "rsakeyfile")Konstantin Demin2019-03-251-1/+56
| | | | | | | | | | | | * option "keyfile" is more generic than "rsakeyfile". * option "rsakeyfile" is considered to be deprecated and should be removed in future releases. * warn user (in syslog) if option "rsakeyfile" is used * better check options ("rsakeyfile" and "keyfile"): don't append "-r keyfile" to command line if file is absent (doesn't exist or empty), warn user (in syslog) about such files Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: add initial support for ECC host keyKonstantin Demin2019-03-251-0/+2
| | | | Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: fix regression where TTY modes weren't reset for clientKonstantin Demin2019-03-251-0/+46
| | | | | | cherry-pick upstream commit 7bc6280613f5ab4ee86c14c779739070e5784dfe Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: honour CFLAGS while building bundled libtomcrypt/libtommathKonstantin Demin2019-03-251-0/+48
| | | | | | | | Felix Fietkau pointed out that bundled libtomcrypt/libtommath do funny stuff with CFLAGS. fix this with checking environment variable OPENWRT_BUILD in both libs. change in dropbear binary size is drastical: 221621 -> 164277. Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: fix hardening flags during configureKonstantin Demin2019-03-251-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | compiler complains about messed up CFLAGS in build log: <command-line>: warning: "_FORTIFY_SOURCE" redefined <command-line>: note: this is the location of the previous definition and then linker fails: mips-openwrt-linux-musl-gcc [...] -o dropbearmulti [...] collect2: fatal error: ld terminated with signal 11 [Segmentation fault] compilation terminated. /staging_dir/toolchain-mips_24kc_gcc-8.2.0_musl/mips-openwrt-linux-musl/bin/ld: /tmp/cc27zORz.ltrans0.ltrans.o: relocation R_MIPS_HI16 against `cipher_descriptor' can not be used when making a shared object; recompile with -fPIC /staging_dir/toolchain-mips_24kc_gcc-8.2.0_musl/mips-openwrt-linux-musl/bin/ld: /tmp/cc27zORz.ltrans1.ltrans.o: relocation R_MIPS_HI16 against `ses' can not be used when making a shared object; recompile with -fPIC /staging_dir/toolchain-mips_24kc_gcc-8.2.0_musl/mips-openwrt-linux-musl/bin/ld: /tmp/cc27zORz.ltrans2.ltrans.o: relocation R_MIPS_HI16 against `cipher_descriptor' can not be used when making a shared object; recompile with -fPIC /staging_dir/toolchain-mips_24kc_gcc-8.2.0_musl/mips-openwrt-linux-musl/bin/ld: BFD (GNU Binutils) 2.31.1 assertion fail elfxx-mips.c:6550 [...] /staging_dir/toolchain-mips_24kc_gcc-8.2.0_musl/mips-openwrt-linux-musl/bin/ld: BFD (GNU Binutils) 2.31.1 assertion fail elfxx-mips.c:6550 make[3]: *** [Makefile:198: dropbearmulti] Error 1 make[3]: *** Deleting file 'dropbearmulti' make[3]: Leaving directory '/build_dir/target-mips_24kc_musl/dropbear-2018.76' make[2]: *** [Makefile:158: /build_dir/target-mips_24kc_musl/dropbear-2018.76/.built] Error 2 make[2]: Leaving directory '/package/network/services/dropbear' This FTBFS issue was caused by hardening flags set up by dropbear's configure script. By default, Dropbear offers hardening via CFLAGS and LDFLAGS, but this may break or confuse OpenWrt settings. Remove most Dropbear's hardening settings in favour of precise build, but preserve Spectre v2 mitigations: * -mfunction-return=thunk * -mindirect-branch=thunk Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: bump to 2019.77Konstantin Demin2019-03-2512-517/+52
| | | | | | | | | | | | | - drop patches applied upstream: * 010-runtime-maxauthtries.patch * 020-Wait-to-fail-invalid-usernames.patch * 150-dbconvert_standalone.patch * 610-skip-default-keys-in-custom-runs.patch - refresh patches - move OpenWrt configuration from patch to Build/Configure recipe, thus drop patch 120-openwrt_options.patch Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* odhcpd: update to latest git HEAD (FS#2160)Hans Dedecker2019-03-211-3/+3
| | | | | | | | | | 6d23385 dhcpv6: extra syslog tracing b076916 dhcpv6/router: add support for mutiple master interfaces e4a24dc ndp: fix adding proxy neighbor entries 4ca7f7e router: add extra syslog tracing 8318e93 netlink: fix neighbor event handling (FS#2160) Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* wireguard: bump to 0.0.20190227Jason A. Donenfeld2019-02-281-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * wg-quick: freebsd: allow loopback to work FreeBSD adds a route for point-to-point destination addresses. We don't really want to specify any destination address, but unfortunately we have to. Before we tried to cheat by giving our own address as the destination, but this had the unfortunate effect of preventing loopback from working on our local ip address. We work around this with yet another kludge: we set the destination address to 127.0.0.1. Since 127.0.0.1 is already assigned to an interface, this has the same effect of not specifying a destination address, and therefore we accomplish the intended behavior. Note that the bad behavior is still present in Darwin, where such workaround does not exist. * tools: remove unused check phony declaration * highlighter: when subtracting char, cast to unsigned * chacha20: name enums * tools: fight compiler slightly harder * tools: c_acc doesn't need to be initialized * queueing: more reasonable allocator function convention Usual nits. * systemd: wg-quick should depend on nss-lookup.target Since wg-quick(8) calls wg(8) which does hostname lookups, we should probably only run this after we're allowed to look up hostnames. * compat: backport ALIGN_DOWN * noise: whiten the nanoseconds portion of the timestamp This mitigates unrelated sidechannel attacks that think they can turn WireGuard into a useful time oracle. * hashtables: decouple hashtable allocations from the main device allocation The hashtable allocations are quite large, and cause the device allocation in the net framework to stall sometimes while it tries to find a contiguous region that can fit the device struct. To fix the allocation stalls, decouple the hashtable allocations from the device allocation and allocate the hashtables with kvmalloc's implicit __GFP_NORETRY so that the allocations fall back to vmalloc with little resistance. * chacha20poly1305: permit unaligned strides on certain platforms The map allocations required to fix this are mostly slower than unaligned paths. * noise: store clamped key instead of raw key This causes `wg show` to now show the right thing. Useful for doing comparisons. * compat: ipv6_stub is sometimes null On ancient kernels, ipv6_stub is sometimes null in cases where IPv6 has been disabled with a command line flag or other failures. * Makefile: don't duplicate code in install and modules-install * Makefile: make the depmod path configurable * queueing: net-next has changed signature of skb_probe_transport_header A 5.1 change. This could change again, but for now it allows us to keep this snapshot aligned with our upstream submissions. * netlink: don't remove allowed ips for new peers * peer: only synchronize_rcu_bh and traverse trie once when removing all peers * allowedips: maintain per-peer list of allowedips This is a rather big and important change that makes it much much faster to do operations involving thousands of peers. Batch peer/allowedip addition and clearing is several orders of magnitude faster now. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* odhcpd: update to latest git HEADHans Dedecker2019-02-271-3/+3
| | | | | | 16c5b6c ubus: always trigger an update if interface is not found Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* omcproxy: define configuration fileDavid Santamaría Rogado2019-02-271-1/+5
| | | | | | | omcproxy's configuration is lost on every update or installation. Avoid it by defining the configuration file. Signed-off-by: David Santamaría Rogado <howl.nsp@gmail.com>
* odhcpd: update to latest git HEAD (FS#2142)Hans Dedecker2019-02-251-3/+3
| | | | | | | | 9e9389c dhcpv4: fix adding assignment in list (FS#2142) e69265b dhcpv4: fix static lease lookup afbd7dd dhcp: rework assignment free logic Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* package/dnsmasq: add max_ttl/min_cache_ttl/max_cache_ttlAlexander Couzens2019-02-242-1/+4
| | | | | | | | | max_ttl - limit the ttl in the dns answer if greater as $max_ttl min_cache_ttl - force caching of dns answers even the ttl in the answer is lower than the $min_cache_ttl max_cache_ttl - cache only dns answer for $max_cache_ttl. Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
* dnsmasq: prefer localuse over resolvfile guessworkYousong Zhou2019-02-232-5/+5
| | | | | | | | | This makes it clear that localuse when explicitly specified in the config will have its final say on whether or not the initscript should touch /etc/resolv.conf, no matter whatever the result of previous guesswork would be Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-02 14:23:41 +0000