K 10
svn:author
V 2
cy
K 8
svn:date
V 27
2020-06-12T01:03:51.767647Z
K 7
svn:log
V 2538
MFC r361957-r361960

r361957:
MFV r361936:

Upstream commit message:

[PATCH 1/3] WPS UPnP: Do not allow event subscriptions with URLs to
other networks

The UPnP Device Architecture 2.0 specification errata ("UDA errata
16-04-2020.docx") addresses a problem with notifications being allowed
to go out to other domains by disallowing such cases. Do such filtering
for the notification callback URLs to avoid undesired connections to
external networks based on subscriptions that any device in the local
network could request when WPS support for external registrars is
enabled (the upnp_iface parameter in hostapd configuration).

Obtained from:	https://w1.fi/security/2020-1/\
	0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch
Security:	VU#339275 and CVE-2020-12695

r361958:
MFV r361937:

Upstream commit message:

[PATCH 2/3] WPS UPnP: Fix event message generation using a long URL path

More than about 700 character URL ended up overflowing the wpabuf used
for building the event notification and this resulted in the wpabuf
buffer overflow checks terminating the hostapd process. Fix this by
allocating the buffer to be large enough to contain the full URL path.
However, since that around 700 character limit has been the practical
limit for more than ten years, start explicitly enforcing that as the
limit or the callback URLs since any longer ones had not worked before
and there is no need to enable them now either.

Obtained from:	https://w1.fi/security/2020-1/\
	0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch
Security:	VU#339275 and CVE-2020-12695

r361959:
MFV r361938:

Upstream commit message:

[PATCH 3/3] WPS UPnP: Handle HTTP initiation failures for events more
properly

While it is appropriate to try to retransmit the event to another
callback URL on a failure to initiate the HTTP client connection, there
is no point in trying the exact same operation multiple times in a row.
Replve the event_retry() calls with event_addr_failure() for these cases
to avoid busy loops trying to repeat the same failing operation.

These potential busy loops would go through eloop callbacks, so the
process is not completely stuck on handling them, but unnecessary CPU
would be used to process the continues retries that will keep failing
for the same reason.

Obtained from:	https://w1.fi/security/2020-1/\
	0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch
Security:	VU#339275 and CVE-2020-12695

r361960:
Post CVE-2020-12695 cleanup patch:

Resolve a Linuxism to fix the build.

END