[rdkb][common][bsp][Refactor and sync wifi from openwrt]
[Description]
bb1ab020 [MAC80211][WiFi6][mt76][Fix STA channel switch reason during auth/assoc for DFS channel]
e1340c0f [MAC80211][WiFi6][core][Fix STA channel switch reason during auth/assoc for DFS channel]
cf503970 [MAC80211][WiFi7][misc][Remove testmode default eeprom bin]
b37abd10 [MAC80211][WiFi6/7][Misc][Fix build fail because of mt76 version upgradation]
b7b7f0c4 [MAC80211][WiFi6][core][Fix build fail]
8097da40 [MAC80211][wifi6][MT76][Rebase mt76 to 2024-03-18]
c0f79602 [MAC80211][WiFi7][app][Add ibf ver2 command support in iwpriv wrapper]
36839dc7 [MAC80211][WiFi6][core][Sync wifi7 cert SQC fix to wifi6]
159f6fc1 [MAC82011][Wifi6][MT76][Fix power on sequence]
0e60d7d6 [MAC80211][wifi6][MT76][Add adie id and version in debugfs]
0dfc6240 [MAC80211][WiFi6][core][Refactor STA CSA paring flow]
d2f1ea53 [MAC80211][mt76][fix issue that when one phy is scanning and another phy occur packet loss]
eae6a6c1 [MAC80211][WED][Fix Eagle mlo tx T.P too low issue]
4c3ca8f0 [MAC80211][WiFi6][mt76][Fix HE Phy cap IE for station mode]
602ca651 [MAC80211][WiFi6][mt76][Add ZWDFS foolproof mechanism during radar trigger & detection]
df0ebcec [MAC80211][WiFi7][misc][Add WiFi7 MLO autobuild folder]
e318c6da [mac80211][wifi6][mt76][Remove unnecessary register settings]
c6a3c4c3 [MAC80211][WiFi6][mt76][Add background radar hw cap checking mechanism]
c25db7a0 [MAC80211][WiFi6][Misc][Fix default /etc/config/wireless setting and backport wpa_supp patch of CVE-2023-52160]
839f446d [MAC80211][WiFi6][Rebase Patches][Fix patch fail]
66194787 [MAC80211][wifi6][mt76][Add per-band token limits and debugfs]
85e8e415 [MAC80211][WiFi6][Misc][Change default WiFi 5GHz setting to BW160 expect for MT7915]
64256fee [MAC80211][WED][Fix kite RX T.P ~0 due to sync upstream]
6be2154a [MAC80211][WiFi6][core][fix AP mgmt not encrypted in WDS mode with PMF on]
92223c79 [MAC80211][mt76][sync SER patch.]
0c7cec54 [MAC80211][WiFi7][MT76][Sync internal patches to release build]
421f7b74 [MAC80211][WiFi6][mt76][Refactor backaward patch due to wed sync to upstream]
0471b20c [MAC80211][WED][Refactor and sync wed patches from upstream]
e0ab6314 [mac80211][wifi6][mt76][Fix unusual Tx/Rx airtime duration values]
632ed0a5 [MAC80211][WiFi7][core][Sync to backports-6.6.15]
[Release-log]
Change-Id: I8731a065c32a92b78d3cb8ac6fc292f493d1be65
diff --git a/recipes-wifi/wpa-supplicant/files/patches/bp-0005-PEAP-client-Update-Phase-2-authentication-requiremen.patch b/recipes-wifi/wpa-supplicant/files/patches/bp-0005-PEAP-client-Update-Phase-2-authentication-requiremen.patch
new file mode 100644
index 0000000..82cccd5
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/bp-0005-PEAP-client-Update-Phase-2-authentication-requiremen.patch
@@ -0,0 +1,210 @@
+From 8e6485a1bcb0baffdea9e55255a81270b768439c Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sat, 8 Jul 2023 19:55:32 +0300
+Subject: [PATCH] PEAP client: Update Phase 2 authentication requirements
+
+The previous PEAP client behavior allowed the server to skip Phase 2
+authentication with the expectation that the server was authenticated
+during Phase 1 through TLS server certificate validation. Various PEAP
+specifications are not exactly clear on what the behavior on this front
+is supposed to be and as such, this ended up being more flexible than
+the TTLS/FAST/TEAP cases. However, this is not really ideal when
+unfortunately common misconfiguration of PEAP is used in deployed
+devices where the server trust root (ca_cert) is not configured or the
+user has an easy option for allowing this validation step to be skipped.
+
+Change the default PEAP client behavior to be to require Phase 2
+authentication to be successfully completed for cases where TLS session
+resumption is not used and the client certificate has not been
+configured. Those two exceptions are the main cases where a deployed
+authentication server might skip Phase 2 and as such, where a more
+strict default behavior could result in undesired interoperability
+issues. Requiring Phase 2 authentication will end up disabling TLS
+session resumption automatically to avoid interoperability issues.
+
+Allow Phase 2 authentication behavior to be configured with a new phase1
+configuration parameter option:
+'phase2_auth' option can be used to control Phase 2 (i.e., within TLS
+tunnel) behavior for PEAP:
+ * 0 = do not require Phase 2 authentication
+ * 1 = require Phase 2 authentication when client certificate
+ (private_key/client_cert) is no used and TLS session resumption was
+ not used (default)
+ * 2 = require Phase 2 authentication in all cases
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/eap_peer/eap_config.h | 8 ++++++
+ src/eap_peer/eap_peap.c | 40 +++++++++++++++++++++++++++---
+ src/eap_peer/eap_tls_common.c | 6 +++++
+ src/eap_peer/eap_tls_common.h | 5 ++++
+ wpa_supplicant/wpa_supplicant.conf | 7 ++++++
+ 5 files changed, 63 insertions(+), 3 deletions(-)
+
+diff --git a/src/eap_peer/eap_config.h b/src/eap_peer/eap_config.h
+index 26744ab68..58d5a1359 100644
+--- a/src/eap_peer/eap_config.h
++++ b/src/eap_peer/eap_config.h
+@@ -471,6 +471,14 @@ struct eap_peer_config {
+ * 1 = use cryptobinding if server supports it
+ * 2 = require cryptobinding
+ *
++ * phase2_auth option can be used to control Phase 2 (i.e., within TLS
++ * tunnel) behavior for PEAP:
++ * 0 = do not require Phase 2 authentication
++ * 1 = require Phase 2 authentication when client certificate
++ * (private_key/client_cert) is no used and TLS session resumption was
++ * not used (default)
++ * 2 = require Phase 2 authentication in all cases
++ *
+ * EAP-WSC (WPS) uses following options: pin=Device_Password and
+ * uuid=Device_UUID
+ *
+diff --git a/src/eap_peer/eap_peap.c b/src/eap_peer/eap_peap.c
+index 12e30df29..608069719 100644
+--- a/src/eap_peer/eap_peap.c
++++ b/src/eap_peer/eap_peap.c
+@@ -67,6 +67,7 @@ struct eap_peap_data {
+ u8 cmk[20];
+ int soh; /* Whether IF-TNCCS-SOH (Statement of Health; Microsoft NAP)
+ * is enabled. */
++ enum { NO_AUTH, FOR_INITIAL, ALWAYS } phase2_auth;
+ };
+
+
+@@ -114,6 +115,19 @@ static void eap_peap_parse_phase1(struct eap_peap_data *data,
+ wpa_printf(MSG_DEBUG, "EAP-PEAP: Require cryptobinding");
+ }
+
++ if (os_strstr(phase1, "phase2_auth=0")) {
++ data->phase2_auth = NO_AUTH;
++ wpa_printf(MSG_DEBUG,
++ "EAP-PEAP: Do not require Phase 2 authentication");
++ } else if (os_strstr(phase1, "phase2_auth=1")) {
++ data->phase2_auth = FOR_INITIAL;
++ wpa_printf(MSG_DEBUG,
++ "EAP-PEAP: Require Phase 2 authentication for initial connection");
++ } else if (os_strstr(phase1, "phase2_auth=2")) {
++ data->phase2_auth = ALWAYS;
++ wpa_printf(MSG_DEBUG,
++ "EAP-PEAP: Require Phase 2 authentication for all cases");
++ }
+ #ifdef EAP_TNC
+ if (os_strstr(phase1, "tnc=soh2")) {
+ data->soh = 2;
+@@ -142,6 +156,7 @@ static void * eap_peap_init(struct eap_sm *sm)
+ data->force_peap_version = -1;
+ data->peap_outer_success = 2;
+ data->crypto_binding = OPTIONAL_BINDING;
++ data->phase2_auth = FOR_INITIAL;
+
+ if (config && config->phase1)
+ eap_peap_parse_phase1(data, config->phase1);
+@@ -454,6 +469,20 @@ static int eap_tlv_validate_cryptobinding(struct eap_sm *sm,
+ }
+
+
++static bool peap_phase2_sufficient(struct eap_sm *sm,
++ struct eap_peap_data *data)
++{
++ if ((data->phase2_auth == ALWAYS ||
++ (data->phase2_auth == FOR_INITIAL &&
++ !tls_connection_resumed(sm->ssl_ctx, data->ssl.conn) &&
++ !data->ssl.client_cert_conf) ||
++ data->phase2_eap_started) &&
++ !data->phase2_eap_success)
++ return false;
++ return true;
++}
++
++
+ /**
+ * eap_tlv_process - Process a received EAP-TLV message and generate a response
+ * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
+@@ -568,6 +597,11 @@ static int eap_tlv_process(struct eap_sm *sm, struct eap_peap_data *data,
+ " - force failed Phase 2");
+ resp_status = EAP_TLV_RESULT_FAILURE;
+ ret->decision = DECISION_FAIL;
++ } else if (!peap_phase2_sufficient(sm, data)) {
++ wpa_printf(MSG_INFO,
++ "EAP-PEAP: Server indicated Phase 2 success, but sufficient Phase 2 authentication has not been completed");
++ resp_status = EAP_TLV_RESULT_FAILURE;
++ ret->decision = DECISION_FAIL;
+ } else {
+ resp_status = EAP_TLV_RESULT_SUCCESS;
+ ret->decision = DECISION_UNCOND_SUCC;
+@@ -887,8 +921,7 @@ continue_req:
+ /* EAP-Success within TLS tunnel is used to indicate
+ * shutdown of the TLS channel. The authentication has
+ * been completed. */
+- if (data->phase2_eap_started &&
+- !data->phase2_eap_success) {
++ if (!peap_phase2_sufficient(sm, data)) {
+ wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase 2 "
+ "Success used to indicate success, "
+ "but Phase 2 EAP was not yet "
+@@ -1199,8 +1232,9 @@ static struct wpabuf * eap_peap_process(struct eap_sm *sm, void *priv,
+ static bool eap_peap_has_reauth_data(struct eap_sm *sm, void *priv)
+ {
+ struct eap_peap_data *data = priv;
++
+ return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
+- data->phase2_success;
++ data->phase2_success && data->phase2_auth != ALWAYS;
+ }
+
+
+diff --git a/src/eap_peer/eap_tls_common.c b/src/eap_peer/eap_tls_common.c
+index 6193b4bdb..966cbd6c7 100644
+--- a/src/eap_peer/eap_tls_common.c
++++ b/src/eap_peer/eap_tls_common.c
+@@ -242,6 +242,12 @@ static int eap_tls_params_from_conf(struct eap_sm *sm,
+
+ sm->ext_cert_check = !!(params->flags & TLS_CONN_EXT_CERT_CHECK);
+
++ if (!phase2)
++ data->client_cert_conf = params->client_cert ||
++ params->client_cert_blob ||
++ params->private_key ||
++ params->private_key_blob;
++
+ return 0;
+ }
+
+diff --git a/src/eap_peer/eap_tls_common.h b/src/eap_peer/eap_tls_common.h
+index 9ac00121f..334863413 100644
+--- a/src/eap_peer/eap_tls_common.h
++++ b/src/eap_peer/eap_tls_common.h
+@@ -79,6 +79,11 @@ struct eap_ssl_data {
+ * tls_v13 - Whether TLS v1.3 or newer is used
+ */
+ int tls_v13;
++
++ /**
++ * client_cert_conf: Whether client certificate has been configured
++ */
++ bool client_cert_conf;
+ };
+
+
+diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
+index f0b82443e..1b09f57d3 100644
+--- a/wpa_supplicant/wpa_supplicant.conf
++++ b/wpa_supplicant/wpa_supplicant.conf
+@@ -1370,6 +1370,13 @@ fast_reauth=1
+ # * 0 = do not use cryptobinding (default)
+ # * 1 = use cryptobinding if server supports it
+ # * 2 = require cryptobinding
++# 'phase2_auth' option can be used to control Phase 2 (i.e., within TLS
++# tunnel) behavior for PEAP:
++# * 0 = do not require Phase 2 authentication
++# * 1 = require Phase 2 authentication when client certificate
++# (private_key/client_cert) is no used and TLS session resumption was
++# not used (default)
++# * 2 = require Phase 2 authentication in all cases
+ # EAP-WSC (WPS) uses following options: pin=<Device Password> or
+ # pbc=1.
+ #
+--
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/patches.inc b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
index 73393d2..ad63af1 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
@@ -66,6 +66,7 @@
file://bp-0002-ACS-Introduce-acs_get_bw_center_chan.patch \
file://bp-0003-ACS-introduce-acs_adjust_secondary.patch \
file://bp-0004-ACS-Allow-selecting-a-better-channel-when-using-40-8.patch \
+ file://bp-0005-PEAP-client-Update-Phase-2-authentication-requiremen.patch \
file://mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch \
file://mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
file://mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch \