Skip to content

Commit

Permalink
wpa_supplicant: 2.9 -> 2.10
Browse files Browse the repository at this point in the history
  • Loading branch information
@mweinelt
mweinelt committed Jan 17, 2022
1 parent 9048228 commit 738ff6b
Showing 1 changed file with 3 additions and 32 deletions.
35 changes: 3 additions & 32 deletions pkgs/os-specific/linux/wpa_supplicant/default.nix
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{ lib, stdenv, fetchurl, fetchpatch, openssl, pkg-config, libnl
{ lib, stdenv, fetchurl, openssl, pkg-config, libnl
, nixosTests
, withDbus ? true, dbus
, withReadline ? true, readline
Expand All @@ -8,45 +8,16 @@

with lib;
stdenv.mkDerivation rec {
version = "2.9";
version = "2.10";

pname = "wpa_supplicant";

src = fetchurl {
url = "https://w1.fi/releases/${pname}-${version}.tar.gz";
sha256 = "05qzak1mssnxcgdrafifxh9w86a4ha69qabkg4bsigk499xyxggw";
sha256 = "sha256-IN965RVLODA1X4q0JpEjqHr/3qWf50/pKSqR0Nfhey8=";
};

patches = [
(fetchurl {
name = "CVE-2019-16275.patch";
url = "https://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch";
sha256 = "15xjyy7crb557wxpx898b5lnyblxghlij0xby5lmj9hpwwss34dz";
})
(fetchpatch {
# Expose OWE key management capability over DBus, remove >= 2.10
name = "dbus-Export-OWE-capability-and-OWE-BSS-key_mgmt.patch";
url = "https://w1.fi/cgit/hostap/patch/?id=7800725afb27397f7d6033d4969e2aeb61af4737";
sha256 = "0c1la7inf4m5y9gzdjjdnhpkx32pm8vi6m5knih8p77q4mbrdgg8";
})
# P2P: Fix copying of secondary device types for P2P group client (https://w1.fi/security/2020-2/)
(fetchurl {
name = "CVE-2021-0326.patch";
url = "https://w1.fi/security/2020-2/0001-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch";
sha256 = "19f4hx0p547mdx8y8arb3vclwyy4w9c8a6a40ryj7q33730mrmn4";
})
# P2P: Fix a corner case in peer addition based on PD Request (https://w1.fi/security/2021-1/)
(fetchurl {
name = "CVE-2021-27803.patch";
url = "https://w1.fi/security/2021-1/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch";
sha256 = "04cnds7hmbqc44jasabjvrdnh66i5hwvk2h2m5z94pmgbzncyh3z";
})
# In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
(fetchpatch {
name = "CVE-2021-30004.patch";
url = "https://w1.fi/cgit/hostap/patch/?id=a0541334a6394f8237a4393b7372693cd7e96f15";
sha256 = "1gbhlz41x1ar1hppnb76pqxj6vimiypy7c4kq6h658637s4am3xg";
})
] ++ lib.optionals readOnlyModeSSIDs [
# Allow read-only networks
./0001-Implement-read-only-mode-for-ssids.patch
Expand Down

8 comments on commit 738ff6b

@vcunat
Copy link
Member

@vcunat vcunat commented on 738ff6b Jan 18, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This commit makes the gnome test hang, thus blocking nixos-unstable channel. Example:
https://hydra.nixos.org/build/164881244

I haven't tried much to look what got wrong.

@vcunat
Copy link
Member

@vcunat vcunat commented on 738ff6b Jan 18, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/cc @NixOS/gnome

@vcunat
Copy link
Member

@vcunat vcunat commented on 738ff6b Jan 20, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After several more retries, the test succeeded on this commit as well (locally but also a later one on Hydra).

So, this commit is a red herring, probably. This flakiness will still be problematic. It seems likely that it started not long before this commit, but it's harder to pinpoint. Though with enough retries on each step, the bisection process for this would be relatively mechanical, too.

@jtojnar
Copy link
Member

@jtojnar jtojnar commented on 738ff6b Jan 20, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Possibly, this #150980 will fix it.

@vcunat
Copy link
Member

@vcunat vcunat commented on 738ff6b Jan 20, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think so; maybe I misunderstand. That PR got to master earlier than this commit, i.e. earlier than I noticed the problem.

@vcunat
Copy link
Member

@vcunat vcunat commented on 738ff6b Jan 20, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The timing would rather suggest that the PR might've started the increased flakiness.

@jtojnar
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, meant to link the revert PR #155862

@vcunat
Copy link
Member

@vcunat vcunat commented on 738ff6b Jan 23, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh right, I could've figured that out :-) Either way, on current master I tried roughly 10 attempts locally and all were successful, so I'd consider the problem solved now.

Please sign in to comment.