[Midnightbsd-cvs] [MidnightBSD/src] 0b6ceb: Apply wpa supplicant patch for CVE-2023-52160

[Lucas Holt]

  Branch: refs/heads/stable/3.1
  Home:   https://github.com/MidnightBSD/src
  Commit: 0b6ceb1a014ec5069bed5aaaa119a9e3a8a7ea1d
      https://github.com/MidnightBSD/src/commit/0b6ceb1a014ec5069bed5aaaa119a9e3a8a7ea1d
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2024-04-06 (Sat, 06 Apr 2024)

  Changed paths:
    M contrib/wpa/src/eap_peer/eap_config.h
    M contrib/wpa/src/eap_peer/eap_peap.c
    M contrib/wpa/src/eap_peer/eap_tls_common.c
    M contrib/wpa/src/eap_peer/eap_tls_common.h
    M contrib/wpa/wpa_supplicant/wpa_supplicant.conf

  Log Message:
  -----------
  Apply wpa supplicant patch for CVE-2023-52160

The previous PEAP client behavior allowed the server to skip Phase 2
authentication with the expectation that the server was authenticated
during Phase 1 through TLS server certificate validation. Various PEAP
specifications are not exactly clear on what the behavior on this front
is supposed to be and as such, this ended up being more flexible than
the TTLS/FAST/TEAP cases. However, this is not really ideal when
unfortunately common misconfiguration of PEAP is used in deployed
devices where the server trust root (ca_cert) is not configured or the
user has an easy option for allowing this validation step to be skipped.

Change the default PEAP client behavior to be to require Phase 2
authentication to be successfully completed for cases where TLS session
resumption is not used and the client certificate has not been
configured. Those two exceptions are the main cases where a deployed
authentication server might skip Phase 2 and as such, where a more
strict default behavior could result in undesired interoperability
issues. Requiring Phase 2 authentication will end up disabling TLS
session resumption automatically to avoid interoperability issues.

Allow Phase 2 authentication behavior to be configured with a new phase1
configuration parameter option:
'phase2_auth' option can be used to control Phase 2 (i.e., within TLS
tunnel) behavior for PEAP:
 * 0 = do not require Phase 2 authentication
 * 1 = require Phase 2 authentication when client certificate
   (private_key/client_cert) is no used and TLS session resumption was
   not used (default)
 * 2 = require Phase 2 authentication in all cases


  Commit: bf6992d06bc1e4eb9827bb33d7d5daa4695c7ac3
      https://github.com/MidnightBSD/src/commit/bf6992d06bc1e4eb9827bb33d7d5daa4695c7ac3
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2024-04-06 (Sat, 06 Apr 2024)

  Changed paths:
    M UPDATING
    M sys/conf/newvers.sh

  Log Message:
  -----------
  bump after release.


Compare: https://github.com/MidnightBSD/src/compare/b22025c6819c...bf6992d06bc1

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications