package/network/services: adds, probably from OpenWRT

4 files changed, 250 insertions, 0 deletions

diff --git a/package/network/services/hostapd/patches/001-fix_pmksa_cache.patch b/package/network/services/hostapd/patches/001-fix_pmksa_cache.patch
new file mode 100755
index 0000000..76a3968
--- /dev/null
+++ b/package/network/services/hostapd/patches/001-fix_pmksa_cache.patch
@@ -0,0 +1,32 @@
+From 9c829900bb01d6fb22e78ba78195c78de39f64b9 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sat, 04 Oct 2014 19:11:00 +0000
+Subject: Fix authenticator OKC fetch from PMKSA cache to avoid infinite loop
+
+If the first entry in the PMKSA cache did not match the station's MAC
+address, an infinite loop could be reached in pmksa_cache_get_okc() when
+trying to find a PMKSA cache entry for opportunistic key caching cases.
+This would only happen if OKC is enabled (okc=1 included in the
+configuration file).
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+--- a/src/ap/pmksa_cache_auth.c
++++ b/src/ap/pmksa_cache_auth.c
+@@ -394,15 +394,13 @@ struct rsn_pmksa_cache_entry * pmksa_cac
+ 	struct rsn_pmksa_cache_entry *entry;
+ 	u8 new_pmkid[PMKID_LEN];
+ 
+-	entry = pmksa->pmksa;
+-	while (entry) {
++	for (entry = pmksa->pmksa; entry; entry = entry->next) {
+ 		if (os_memcmp(entry->spa, spa, ETH_ALEN) != 0)
+ 			continue;
+ 		rsn_pmkid(entry->pmk, entry->pmk_len, aa, spa, new_pmkid,
+ 			  wpa_key_mgmt_sha256(entry->akmp));
+ 		if (os_memcmp(new_pmkid, pmkid, PMKID_LEN) == 0)
+ 			return entry;
+-		entry = entry->next;
+ 	}
+ 	return NULL;
+ }
diff --git a/package/network/services/hostapd/patches/002-Add-os_exec-helper-to-run-external-programs.patch b/package/network/services/hostapd/patches/002-Add-os_exec-helper-to-run-external-programs.patch
new file mode 100755
index 0000000..c1db046
--- /dev/null
+++ b/package/network/services/hostapd/patches/002-Add-os_exec-helper-to-run-external-programs.patch
@@ -0,0 +1,110 @@
+From 89de07a9442072f88d49869d8ecd8d42bae050a0 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Mon, 6 Oct 2014 16:27:44 +0300
+Subject: [PATCH 1/3] Add os_exec() helper to run external programs
+
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+---
+ src/utils/os.h       |  9 +++++++++
+ src/utils/os_unix.c  | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++
+ src/utils/os_win32.c |  6 ++++++
+ 3 files changed, 70 insertions(+)
+
+--- a/src/utils/os.h
++++ b/src/utils/os.h
+@@ -584,6 +584,15 @@ static inline void os_remove_in_array(vo
+  */
+ size_t os_strlcpy(char *dest, const char *src, size_t siz);
+ 
++/**
++ * os_exec - Execute an external program
++ * @program: Path to the program
++ * @arg: Command line argument string
++ * @wait_completion: Whether to wait until the program execution completes
++ * Returns: 0 on success, -1 on error
++ */
++int os_exec(const char *program, const char *arg, int wait_completion);
++
+ 
+ #ifdef OS_REJECT_C_LIB_FUNCTIONS
+ #define malloc OS_DO_NOT_USE_malloc
+--- a/src/utils/os_unix.c
++++ b/src/utils/os_unix.c
+@@ -9,6 +9,7 @@
+ #include "includes.h"
+ 
+ #include <time.h>
++#include <sys/wait.h>
+ 
+ #ifdef ANDROID
+ #include <sys/capability.h>
+@@ -540,3 +541,57 @@ char * os_strdup(const char *s)
+ }
+ 
+ #endif /* WPA_TRACE */
++
++
++int os_exec(const char *program, const char *arg, int wait_completion)
++{
++	pid_t pid;
++	int pid_status;
++
++	pid = fork();
++	if (pid < 0) {
++		perror("fork");
++		return -1;
++	}
++
++	if (pid == 0) {
++		/* run the external command in the child process */
++		const int MAX_ARG = 30;
++		char *_program, *_arg, *pos;
++		char *argv[MAX_ARG + 1];
++		int i;
++
++		_program = os_strdup(program);
++		_arg = os_strdup(arg);
++
++		argv[0] = _program;
++
++		i = 1;
++		pos = _arg;
++		while (i < MAX_ARG && pos && *pos) {
++			while (*pos == ' ')
++				pos++;
++			if (*pos == '\0')
++				break;
++			argv[i++] = pos;
++			pos = os_strchr(pos, ' ');
++			if (pos)
++				*pos++ = '\0';
++		}
++		argv[i] = NULL;
++
++		execv(program, argv);
++		perror("execv");
++		os_free(_program);
++		os_free(_arg);
++		exit(0);
++		return -1;
++	}
++
++	if (wait_completion) {
++		/* wait for the child process to complete in the parent */
++		waitpid(pid, &pid_status, 0);
++	}
++
++	return 0;
++}
+--- a/src/utils/os_win32.c
++++ b/src/utils/os_win32.c
+@@ -244,3 +244,9 @@ size_t os_strlcpy(char *dest, const char
+ 
+ 	return s - src - 1;
+ }
++
++
++int os_exec(const char *program, const char *arg, int wait_completion)
++{
++	return -1;
++}
diff --git a/package/network/services/hostapd/patches/003-wpa_cli-Use-os_exec-for-action-script-execution.patch b/package/network/services/hostapd/patches/003-wpa_cli-Use-os_exec-for-action-script-execution.patch
new file mode 100755
index 0000000..7fe44bf
--- /dev/null
+++ b/package/network/services/hostapd/patches/003-wpa_cli-Use-os_exec-for-action-script-execution.patch
@@ -0,0 +1,54 @@
+From c5f258de76dbb67fb64beab39a99e5c5711f41fe Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Mon, 6 Oct 2014 17:25:52 +0300
+Subject: [PATCH 2/3] wpa_cli: Use os_exec() for action script execution
+
+Use os_exec() to run the action script operations to avoid undesired
+command line processing for control interface event strings. Previously,
+it could have been possible for some of the event strings to include
+unsanitized data which is not suitable for system() use. (CVE-2014-3686)
+
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+---
+ wpa_supplicant/wpa_cli.c | 25 ++++++++-----------------
+ 1 file changed, 8 insertions(+), 17 deletions(-)
+
+--- a/wpa_supplicant/wpa_cli.c
++++ b/wpa_supplicant/wpa_cli.c
+@@ -3149,28 +3149,19 @@ static int str_match(const char *a, cons
+ static int wpa_cli_exec(const char *program, const char *arg1,
+ 			const char *arg2)
+ {
+-	char *cmd;
++	char *arg;
+ 	size_t len;
+ 	int res;
+-	int ret = 0;
+ 
+-	len = os_strlen(program) + os_strlen(arg1) + os_strlen(arg2) + 3;
+-	cmd = os_malloc(len);
+-	if (cmd == NULL)
++	len = os_strlen(arg1) + os_strlen(arg2) + 2;
++	arg = os_malloc(len);
++	if (arg == NULL)
+ 		return -1;
+-	res = os_snprintf(cmd, len, "%s %s %s", program, arg1, arg2);
+-	if (res < 0 || (size_t) res >= len) {
+-		os_free(cmd);
+-		return -1;
+-	}
+-	cmd[len - 1] = '\0';
+-#ifndef _WIN32_WCE
+-	if (system(cmd) < 0)
+-		ret = -1;
+-#endif /* _WIN32_WCE */
+-	os_free(cmd);
++	os_snprintf(arg, len, "%s %s", arg1, arg2);
++	res = os_exec(program, arg, 1);
++	os_free(arg);
+ 
+-	return ret;
++	return res;
+ }
+ 
+ 
diff --git a/package/network/services/hostapd/patches/004-hostapd_cli-Use-os_exec-for-action-script-execution.patch b/package/network/services/hostapd/patches/004-hostapd_cli-Use-os_exec-for-action-script-execution.patch
new file mode 100755
index 0000000..4f08ee5
--- /dev/null
+++ b/package/network/services/hostapd/patches/004-hostapd_cli-Use-os_exec-for-action-script-execution.patch
@@ -0,0 +1,54 @@
+From 5d4fa2a29bef013e61185beb21a3ec110885eb9a Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Mon, 6 Oct 2014 18:49:01 +0300
+Subject: [PATCH 3/3] hostapd_cli: Use os_exec() for action script execution
+
+Use os_exec() to run the action script operations to avoid undesired
+command line processing for control interface event strings. Previously,
+it could have been possible for some of the event strings to include
+unsanitized data which is not suitable for system() use. (CVE-2014-3686)
+
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+---
+ hostapd/hostapd_cli.c | 25 ++++++++-----------------
+ 1 file changed, 8 insertions(+), 17 deletions(-)
+
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -238,28 +238,19 @@ static int hostapd_cli_cmd_mib(struct wp
+ static int hostapd_cli_exec(const char *program, const char *arg1,
+ 			    const char *arg2)
+ {
+-	char *cmd;
++	char *arg;
+ 	size_t len;
+ 	int res;
+-	int ret = 0;
+ 
+-	len = os_strlen(program) + os_strlen(arg1) + os_strlen(arg2) + 3;
+-	cmd = os_malloc(len);
+-	if (cmd == NULL)
++	len = os_strlen(arg1) + os_strlen(arg2) + 2;
++	arg = os_malloc(len);
++	if (arg == NULL)
+ 		return -1;
+-	res = os_snprintf(cmd, len, "%s %s %s", program, arg1, arg2);
+-	if (res < 0 || (size_t) res >= len) {
+-		os_free(cmd);
+-		return -1;
+-	}
+-	cmd[len - 1] = '\0';
+-#ifndef _WIN32_WCE
+-	if (system(cmd) < 0)
+-		ret = -1;
+-#endif /* _WIN32_WCE */
+-	os_free(cmd);
++	os_snprintf(arg, len, "%s %s", arg1, arg2);
++	res = os_exec(program, arg, 1);
++	os_free(arg);
+ 
+-	return ret;
++	return res;
+ }
+ 
+