package/hostapd: fix build with CVE-2021-30004 changes
PATCH v2 1/1 package/hostapd: fix build with CVE-2021-30004 changes
Commit d65586f45a22 ("package/hostapd: add upstream patch to fix CVE-2021-30004") added security patch from hostapd upstream without required ASN.1 helpers. Backport and adapt two commits from the hostapd upstream to add missing headers and helpers.
Fixes:
http://autobuild.buildroot.net/results/8f56cf556efbf447633ce873a21635f5adbc3cd2/
--- ...dbool.h-to-allow-C99-bool-to-be-used.patch | 32 +++++++++++++++++ .../0004-ASN.1-add-asn1_is_null-helper.patch | 34 +++++++++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 package/hostapd/0003-Include-stdbool.h-to-allow-C99-bool-to-be-used.patch create mode 100644 package/hostapd/0004-ASN.1-add-asn1_is_null-helper.patch
package/hostapd/0003-Include-stdbool.h-to-allow-C99-bool-to-be-used.patch new file +32 -0
@@ -0,0 +1,32 @@ +From b2feaf8fc6f3b1bed6c17cb1871889c66a2877dc Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <[email protected]> +Date: Mon, 20 Apr 2020 20:29:31 +0300 +Subject: [PATCH 3/4] Include stdbool.h to allow C99 bool to be used + +We have practically started requiring some C99 features, so might as +well finally go ahead and bring in the C99 bool as well. + +Signed-off-by: Jouni Malinen <[email protected]> +Signed-off-by: Sergey Matyukevich <[email protected]> + +Backport of commit 99cf89555313 ("Include stdbool.h to allow C99 bool +to be used") to hostapd v2.9. +--- + src/utils/includes.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/utils/includes.h b/src/utils/includes.h +index 75513fc8c..741fc9c14 100644 +--- a/src/utils/includes.h ++++ b/src/utils/includes.h +@@ -18,6 +18,7 @@ + + #include <stdlib.h> + #include <stddef.h> ++#include <stdbool.h> + #include <stdio.h> + #include <stdarg.h> + #include <string.h> +-- +2.31.1 +
package/hostapd/0004-ASN.1-add-asn1_is_null-helper.patch new file +34 -0
@@ -0,0 +1,34 @@ +From 93179bfeed9282c5a17fc62f6cafaf9d95f91f3f Mon Sep 17 00:00:00 2001 +From: Sergey Matyukevich <[email protected]> +Date: Thu, 20 May 2021 08:29:55 +0300 +Subject: [PATCH 4/4] ASN.1: add asn1_is_null helper + +Partially backport commit 9a990e8c4eb9 ("ASN.1: Add helper functions for +recognizing tag values") to hostapd v2.9: add ASN.1 helper required to +backport CVE-2021-30004 fix. + +Signed-off-by: Sergey Matyukevich <[email protected]> +--- + src/tls/asn1.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/tls/asn1.h b/src/tls/asn1.h +index 6bd7df565..77b94ef34 100644 +--- a/src/tls/asn1.h ++++ b/src/tls/asn1.h +@@ -66,6 +66,12 @@ void asn1_oid_to_str(const struct asn1_oid *oid, char *buf, size_t len); + unsigned long asn1_bit_string_to_long(const u8 *buf, size_t len); + int asn1_oid_equal(const struct asn1_oid *a, const struct asn1_oid *b); + ++static inline bool asn1_is_null(const struct asn1_hdr *hdr) ++{ ++ return hdr->class == ASN1_CLASS_UNIVERSAL && ++ hdr->tag == ASN1_TAG_NULL; ++} ++ + extern struct asn1_oid asn1_sha1_oid; + extern struct asn1_oid asn1_sha256_oid; + +-- +2.31.1 +
Signature · 1 line
2.31.1
Yann E. MORIN
AppliedPATCH v2 1/1 package/hostapd: fix build with CVE-2021-30004 changes
Sergey, All,
On 2021-05-20 08:48 +0300, Sergey Matyukevich spake thusly:
Quoted 9 lines
Commit
d65586f45a22("package/hostapd: add upstream patch to fix CVE-2021-30004") added security patch from hostapd upstream without required ASN.1 helpers. Backport and adapt two commits from the hostapd upstream to add missing headers and helpers.Fixes:
http://autobuild.buildroot.net/results/8f56cf556efbf447633ce873a21635f5adbc3cd2/Signed-off-by Sergey Matyukevich <[email protected]>
Applied to master, thanks.
I've slightly adapated the commits, as we do nmot want the numbering in the patches, and I took the opportunity to slightly update the backports.
While at it, I noticed that wpa_supplicant is also impacted by CVE-2021-30004, and we have backported a few patches too:
a8fbe67b9b16 package/wpa_supplicant: add upstream patch to fix CVE-2021-30004
And those patches also contain references to asn1_is_null(). I could not find any autobuilder issu about that, though... Could you check if we also need to carry similar patches for wpa_supplicant, please?
Thanks! :-)
Regards,
Yann E. MORIN.
Quoted 92 lines
--- ...dbool.h-to-allow-C99-bool-to-be-used.patch | 32 +++++++++++++++++ .../0004-ASN.1-add-asn1_is_null-helper.patch | 34 +++++++++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 package/hostapd/0003-Include-stdbool.h-to-allow-C99-bool-to-be-used.patch create mode 100644 package/hostapd/0004-ASN.1-add-asn1_is_null-helper.patchpackage/hostapd/0003-Include-stdbool.h-to-allow-C99-bool-to-be-used.patch new file +32
-0@@ -0,0 +1,32 @@ +From b2feaf8fc6f3b1bed6c17cb1871889c66a2877dc Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <[email protected]> +Date: Mon, 20 Apr 2020 20:29:31 +0300 +Subject: [PATCH 3/4] Include stdbool.h to allow C99 bool to be used + +We have practically started requiring some C99 features, so might as +well finally go ahead and bring in the C99 bool as well. + +Signed-off-by: Jouni Malinen <[email protected]> +Signed-off-by: Sergey Matyukevich <[email protected]> + +Backport of commit 99cf89555313 ("Include stdbool.h to allow C99 bool +to be used") to hostapd v2.9. +--- + src/utils/includes.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/utils/includes.h b/src/utils/includes.h +index 75513fc8c..741fc9c14 100644 +--- a/src/utils/includes.h ++++ b/src/utils/includes.h +@@ -18,6 +18,7 @@ + + #include <stdlib.h> + #include <stddef.h> ++#include <stdbool.h> + #include <stdio.h> + #include <stdarg.h> + #include <string.h> +-- +2.31.1 +package/hostapd/0004-ASN.1-add-asn1_is_null-helper.patch new file +34
-0@@ -0,0 +1,34 @@ +From 93179bfeed9282c5a17fc62f6cafaf9d95f91f3f Mon Sep 17 00:00:00 2001 +From: Sergey Matyukevich <[email protected]> +Date: Thu, 20 May 2021 08:29:55 +0300 +Subject: [PATCH 4/4] ASN.1: add asn1_is_null helper + +Partially backport commit 9a990e8c4eb9 ("ASN.1: Add helper functions for +recognizing tag values") to hostapd v2.9: add ASN.1 helper required to +backport CVE-2021-30004 fix. + +Signed-off-by: Sergey Matyukevich <[email protected]> +--- + src/tls/asn1.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/tls/asn1.h b/src/tls/asn1.h +index 6bd7df565..77b94ef34 100644 +--- a/src/tls/asn1.h ++++ b/src/tls/asn1.h +@@ -66,6 +66,12 @@ void asn1_oid_to_str(const struct asn1_oid *oid, char *buf, size_t len); + unsigned long asn1_bit_string_to_long(const u8 *buf, size_t len); + int asn1_oid_equal(const struct asn1_oid *a, const struct asn1_oid *b); + ++static inline bool asn1_is_null(const struct asn1_hdr *hdr) ++{ ++ return hdr->class == ASN1_CLASS_UNIVERSAL && ++ hdr->tag == ASN1_TAG_NULL; ++} ++ + extern struct asn1_oid asn1_sha1_oid; + extern struct asn1_oid asn1_sha256_oid; + +-- +2.31.1 +Signature · 6 lines
2.31.1 _______________________________________________ buildroot mailing list buildroot at busybox.net http://lists.busybox.net/mailman/listinfo/buildroot
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------'
PATCH v2 1/1 package/hostapd: fix build with CVE-2021-30004 changes
Hello Yann,
Quoted 16 lines
Quoted 9 lines
Commit
d65586f45a22("package/hostapd: add upstream patch to fix CVE-2021-30004") added security patch from hostapd upstream without required ASN.1 helpers. Backport and adapt two commits from the hostapd upstream to add missing headers and helpers.Fixes:
http://autobuild.buildroot.net/results/8f56cf556efbf447633ce873a21635f5adbc3cd2/Signed-off-by Sergey Matyukevich <[email protected]>Applied to master, thanks.
I've slightly adapated the commits, as we do nmot want the numbering in the patches, and I took the opportunity to slightly update the backports.
Quoted 8 lines
While at it, I noticed that
wpa_supplicantis also impacted by CVE-2021-30004, and we have backported a few patches too:a8fbe67b9b16 package/wpa_supplicant: add upstream patch to fix CVE-2021-30004And those patches also contain references to
asn1_is_null(). I could not find any autobuilder issu about that, though... Could you check if we also need to carry similar patches forwpa_supplicant, please?
Yes, wpa_supplicant also fails in a similar configuration. I will check the same fix and send a patch.
Regards,
Sergey
PATCH v2 1/1 package/hostapd: fix build with CVE-2021-30004 changes
In reply to Yann E. MORINQuoted 9 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Yann" == Yann E MORIN <[email protected]> writes:
Sergey, All,
On 2021-05-20 08:48 +0300, Sergey Matyukevich spake thusly:Quoted 5 lines
Commit
d65586f45a22("package/hostapd: add upstream patch to fix CVE-2021-30004") added security patch from hostapd upstream without required ASN.1 helpers. Backport and adapt two commits from the hostapd upstream to add missing headers and helpers.
Quoted 6 lines
Quoted 4 lines
Fixes:
http://autobuild.buildroot.net/results/8f56cf556efbf447633ce873a21635f5adbc3cd2/Signed-off-by Sergey Matyukevich <[email protected]>Applied to master, thanks.
Committed to 2021.02.x, thanks.
Signature · 1 line
Bye, Peter Korsgaard