From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-1345387-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by finch.gentoo.org (Postfix) with ESMTPS id 7331F158087
for <garchives@archives.gentoo.org>; Fri, 3 Dec 2021 04:26:33 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id 60FC2E0826;
Fri, 3 Dec 2021 04:26:32 +0000 (UTC)
Received: from smtp.gentoo.org (mail.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits))
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id 32EF6E0825
for <gentoo-commits@lists.gentoo.org>; Fri, 3 Dec 2021 04:26:32 +0000 (UTC)
Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits))
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id 59D8D3431B4
for <gentoo-commits@lists.gentoo.org>; Fri, 3 Dec 2021 04:26:31 +0000 (UTC)
Received: from localhost.localdomain (localhost [IPv6:::1])
by oystercatcher.gentoo.org (Postfix) with ESMTP id E210C14D
for <gentoo-commits@lists.gentoo.org>; Fri, 3 Dec 2021 04:26:29 +0000 (UTC)
From: "Sam James" <sam@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" <sam@gentoo.org>
Message-ID: <1638505578.f448b05c0c596479972d0fed25847fabd277f26b.sam@gentoo>
Subject: [gentoo-commits] repo/gentoo:master commit in: net-wireless/wpa_supplicant/
X-VCS-Repository: repo/gentoo
X-VCS-Files: net-wireless/wpa_supplicant/wpa_supplicant-2.9-r6.ebuild net-wireless/wpa_supplicant/wpa_supplicant-2.9-r7.ebuild net-wireless/wpa_supplicant/wpa_supplicant-9999.ebuild
X-VCS-Directories: net-wireless/wpa_supplicant/
X-VCS-Committer: sam
X-VCS-Committer-Name: Sam James
X-VCS-Revision: f448b05c0c596479972d0fed25847fabd277f26b
X-VCS-Branch: master
Date: Fri, 3 Dec 2021 04:26:29 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
X-Archives-Salt: 204f76d9-3ada-4746-8b6c-be1ff9ae8b79
X-Archives-Hash: 8d2f64c71a11dc254f64458daa2df40e
commit: f448b05c0c596479972d0fed25847fabd277f26b
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 3 04:06:43 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 3 04:26:18 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f448b05c
net-wireless/wpa_supplicant: drop OpenSSL bindist kludge
Not needed anymore now that (stable) OpenSSL now lacks USE=bindist;
see news item for more information.
Originally added in fed37693d6442a4ec65e121c80ad2f52b6d93335, the
changes were/are just to allow building wpa_supplicant against
openssl[bindist] rather than anything shipped within wpa_supplicant
that might have patent issues, etc.
Bug: https://bugs.gentoo.org/762850
Signed-off-by: Sam James <sam <AT> gentoo.org>
...-2.9-r6.ebuild => wpa_supplicant-2.9-r7.ebuild} | 40 ++++++++----------
.../wpa_supplicant/wpa_supplicant-9999.ebuild | 49 ++++++++++++----------
2 files changed, 43 insertions(+), 46 deletions(-)
diff --git a/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r6.ebuild b/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r7.ebuild
similarity index 94%
rename from net-wireless/wpa_supplicant/wpa_supplicant-2.9-r6.ebuild
rename to net-wireless/wpa_supplicant/wpa_supplicant-2.9-r7.ebuild
index 5e770398c338..2935a7227ab1 100644
--- a/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r6.ebuild
+++ b/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r7.ebuild
@@ -19,7 +19,7 @@ else
fi
SLOT="0"
-IUSE="ap bindist +crda broadcom-sta dbus eap-sim eapol-test fasteap +fils +hs2-0 macsec +mbo +mesh p2p privsep ps3 qt5 readline selinux smartcard tdls uncommon-eap-types wimax wps kernel_linux kernel_FreeBSD"
+IUSE="ap +crda broadcom-sta dbus eap-sim eapol-test fasteap +fils +hs2-0 macsec +mbo +mesh p2p privsep ps3 qt5 readline selinux smartcard tdls uncommon-eap-types wimax wps kernel_linux kernel_FreeBSD"
# CONFIG_PRIVSEP=y does not have sufficient support for the new driver
# interface functions used for MACsec, so this combination cannot be used
@@ -264,24 +264,23 @@ src_configure() {
Kconfig_style_config TLS openssl
Kconfig_style_config FST
- if ! use bindist ; then
- Kconfig_style_config EAP_PWD
- if use fils; then
- Kconfig_style_config FILS
- Kconfig_style_config FILS_SK_PFS
- fi
- if use mesh; then
- Kconfig_style_config MESH
- else
- Kconfig_style_config MESH n
- fi
- #WPA3
- Kconfig_style_config OWE
- Kconfig_style_config SAE
- Kconfig_style_config DPP
- Kconfig_style_config SUITEB192
- Kconfig_style_config SUITEB
+
+ Kconfig_style_config EAP_PWD
+ if use fils; then
+ Kconfig_style_config FILS
+ Kconfig_style_config FILS_SK_PFS
fi
+ if use mesh; then
+ Kconfig_style_config MESH
+ else
+ Kconfig_style_config MESH n
+ fi
+ # WPA3
+ Kconfig_style_config OWE
+ Kconfig_style_config SAE
+ Kconfig_style_config DPP
+ Kconfig_style_config SUITEB192
+ Kconfig_style_config SUITEB
if use smartcard ; then
Kconfig_style_config SMARTCARD
@@ -478,11 +477,6 @@ pkg_postinst() {
ewarn "needs to be moved to ${EROOT}/etc/wpa_supplicant/wpa_supplicant.conf"
fi
- if use bindist; then
- ewarn "Using bindist use flag presently breaks WPA3 (specifically SAE, OWE, DPP, and FILS)."
- ewarn "This is incredibly undesirable"
- fi
-
# Mea culpa, feel free to remove that after some time --mgorny.
local fn
for fn in wpa_supplicant{,@wlan0}.service; do
diff --git a/net-wireless/wpa_supplicant/wpa_supplicant-9999.ebuild b/net-wireless/wpa_supplicant/wpa_supplicant-9999.ebuild
index 0420a22e8dc9..2935a7227ab1 100644
--- a/net-wireless/wpa_supplicant/wpa_supplicant-9999.ebuild
+++ b/net-wireless/wpa_supplicant/wpa_supplicant-9999.ebuild
@@ -15,10 +15,11 @@ if [ "${PV}" = "9999" ]; then
else
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
SRC_URI="https://w1.fi/releases/${P}.tar.gz"
+ SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-2.9-r3-patches.tar.bz2"
fi
SLOT="0"
-IUSE="ap bindist +crda broadcom-sta dbus eap-sim eapol-test fasteap +fils +hs2-0 macsec +mbo +mesh p2p privsep ps3 qt5 readline selinux smartcard tdls uncommon-eap-types wimax wps kernel_linux kernel_FreeBSD"
+IUSE="ap +crda broadcom-sta dbus eap-sim eapol-test fasteap +fils +hs2-0 macsec +mbo +mesh p2p privsep ps3 qt5 readline selinux smartcard tdls uncommon-eap-types wimax wps kernel_linux kernel_FreeBSD"
# CONFIG_PRIVSEP=y does not have sufficient support for the new driver
# interface functions used for MACsec, so this combination cannot be used
@@ -150,6 +151,14 @@ src_prepare() {
# bug (640492)
sed -i 's#-Werror ##' wpa_supplicant/Makefile || die
+
+ ## Security patches
+ # CVE-2019-16275 (bug #696030)
+ eapply "${FILESDIR}/wpa_supplicant-2.9-AP-Silently-ignore-management-frame-from-unexpected.patch"
+ # 2020-2, 2021-1 security advisories (bug #768759)
+ eapply "${WORKDIR}"/wpa_supplicant-2.9-r3-patches/security-{2020-2,2021-1}/*.patch
+ # CVE-2021-30004 (bug #780138)
+ eapply "${WORKDIR}"/wpa_supplicant-2.9-r3-patches/misc/CVE-2021-30004.patch
}
src_configure() {
@@ -255,24 +264,23 @@ src_configure() {
Kconfig_style_config TLS openssl
Kconfig_style_config FST
- if ! use bindist ; then
- Kconfig_style_config EAP_PWD
- if use fils; then
- Kconfig_style_config FILS
- Kconfig_style_config FILS_SK_PFS
- fi
- if use mesh; then
- Kconfig_style_config MESH
- else
- Kconfig_style_config MESH n
- fi
- #WPA3
- Kconfig_style_config OWE
- Kconfig_style_config SAE
- Kconfig_style_config DPP
- Kconfig_style_config SUITEB192
- Kconfig_style_config SUITEB
+
+ Kconfig_style_config EAP_PWD
+ if use fils; then
+ Kconfig_style_config FILS
+ Kconfig_style_config FILS_SK_PFS
fi
+ if use mesh; then
+ Kconfig_style_config MESH
+ else
+ Kconfig_style_config MESH n
+ fi
+ # WPA3
+ Kconfig_style_config OWE
+ Kconfig_style_config SAE
+ Kconfig_style_config DPP
+ Kconfig_style_config SUITEB192
+ Kconfig_style_config SUITEB
if use smartcard ; then
Kconfig_style_config SMARTCARD
@@ -469,11 +477,6 @@ pkg_postinst() {
ewarn "needs to be moved to ${EROOT}/etc/wpa_supplicant/wpa_supplicant.conf"
fi
- if use bindist; then
- ewarn "Using bindist use flag presently breaks WPA3 (specifically SAE, OWE, DPP, and FILS)."
- ewarn "This is incredibly undesirable"
- fi
-
# Mea culpa, feel free to remove that after some time --mgorny.
local fn
for fn in wpa_supplicant{,@wlan0}.service; do