From 4d51047957f22aa1313dbac3a59177bfd0ffaf17 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Wed, 23 Mar 2022 11:56:45 +0100 Subject: New upstream version 1.36.4 --- debian/changelog | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'debian') diff --git a/debian/changelog b/debian/changelog index 80aec69c..2b3ca491 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +network-manager (1.36.4-1) UNRELEASED; urgency=medium + + * New upstream version 1.36.4 + + -- Michael Biebl Wed, 23 Mar 2022 11:56:43 +0100 + network-manager (1.36.2-1) unstable; urgency=medium * New upstream version 1.36.2 -- cgit 1.3.0-6-gf8a5 From 6682a2c089e8653d7d4e958b49ebb6b7801c4e49 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Wed, 23 Mar 2022 20:39:32 +0100 Subject: Release version 1.36.4-1 to unstable --- debian/changelog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'debian') diff --git a/debian/changelog b/debian/changelog index 2b3ca491..f319ac30 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,8 +1,8 @@ -network-manager (1.36.4-1) UNRELEASED; urgency=medium +network-manager (1.36.4-1) unstable; urgency=medium * New upstream version 1.36.4 - -- Michael Biebl Wed, 23 Mar 2022 11:56:43 +0100 + -- Michael Biebl Wed, 23 Mar 2022 20:39:16 +0100 network-manager (1.36.2-1) unstable; urgency=medium -- cgit 1.3.0-6-gf8a5 From 957c3298dd5b76319db7958e9afdb56a010d4e68 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Mon, 4 Apr 2022 11:28:20 +0200 Subject: supplicant: enable WPA3 transition mode only when interface supports PMF See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1003907 --- debian/patches/series | 2 + .../supplicant-add-BIP-interface-capability.patch | 117 +++++++++++++++++++++ ...e-WPA3-transition-mode-only-when-interfac.patch | 58 ++++++++++ 3 files changed, 177 insertions(+) create mode 100644 debian/patches/supplicant-add-BIP-interface-capability.patch create mode 100644 debian/patches/supplicant-enable-WPA3-transition-mode-only-when-interfac.patch (limited to 'debian') diff --git a/debian/patches/series b/debian/patches/series index a2d7e06d..c61b47cb 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1 +1,3 @@ Force-online-state-with-unmanaged-devices.patch +supplicant-add-BIP-interface-capability.patch +supplicant-enable-WPA3-transition-mode-only-when-interfac.patch diff --git a/debian/patches/supplicant-add-BIP-interface-capability.patch b/debian/patches/supplicant-add-BIP-interface-capability.patch new file mode 100644 index 00000000..e1cc05e2 --- /dev/null +++ b/debian/patches/supplicant-add-BIP-interface-capability.patch @@ -0,0 +1,117 @@ +From: Beniamino Galvani +Date: Fri, 1 Apr 2022 15:32:34 +0200 +Subject: supplicant: add BIP interface capability + +Introduce a new capability indicating whether the interface supports +any of the BIP ciphers that can be used for 802.11w (PMF). + +(cherry picked from commit cd1e0193abcf26f523bd52d83af5aab086ceaa92) +(cherry picked from commit 55ee796c3b14cb6bb7ff4916d6580202a95a00d1) +--- + src/core/supplicant/nm-supplicant-interface.c | 28 +++++++++++++++++++++++++-- + src/core/supplicant/nm-supplicant-types.h | 4 ++++ + 2 files changed, 30 insertions(+), 2 deletions(-) + +diff --git a/src/core/supplicant/nm-supplicant-interface.c b/src/core/supplicant/nm-supplicant-interface.c +index d827614..e502ae8 100644 +--- a/src/core/supplicant/nm-supplicant-interface.c ++++ b/src/core/supplicant/nm-supplicant-interface.c +@@ -1225,8 +1225,10 @@ parse_capabilities(NMSupplicantInterface *self, GVariant *capabilities) + const guint32 old_max_scan_ssids = priv->max_scan_ssids; + gboolean have_ft = FALSE; + gboolean have_sae = FALSE; ++ gboolean have_bip = FALSE; + gint32 max_scan_ssids; + const char **array; ++ guint i; + + nm_assert(capabilities && g_variant_is_of_type(capabilities, G_VARIANT_TYPE_VARDICT)); + +@@ -1236,12 +1238,28 @@ parse_capabilities(NMSupplicantInterface *self, GVariant *capabilities) + g_free(array); + } + ++ if (g_variant_lookup(capabilities, "GroupMgmt", "^a&s", &array)) { ++ for (i = 0; array[i]; i++) { ++ if (NM_IN_STRSET(array[i], ++ "aes-128-cmac", ++ "bip-gmac-128", ++ "bip-gmac-256", ++ "bip-cmac-256")) { ++ have_bip = TRUE; ++ break; ++ } ++ } ++ } ++ + priv->iface_capabilities = NM_SUPPL_CAP_MASK_SET(priv->iface_capabilities, + NM_SUPPL_CAP_TYPE_FT, + have_ft ? NM_TERNARY_TRUE : NM_TERNARY_FALSE); + priv->iface_capabilities = NM_SUPPL_CAP_MASK_SET(priv->iface_capabilities, + NM_SUPPL_CAP_TYPE_SAE, + have_sae ? NM_TERNARY_TRUE : NM_TERNARY_FALSE); ++ priv->iface_capabilities = NM_SUPPL_CAP_MASK_SET(priv->iface_capabilities, ++ NM_SUPPL_CAP_TYPE_BIP, ++ have_bip ? NM_TERNARY_TRUE : NM_TERNARY_FALSE); + + if (g_variant_lookup(capabilities, "Modes", "^a&s", &array)) { + /* Setting p2p_capable might toggle _prop_p2p_available_get(). However, +@@ -1317,10 +1335,12 @@ _starting_check_ready(NMSupplicantInterface *self) + " AP%c" + " FT%c" + " SAE%c" ++ " BIP%c" + "", + NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_AP), + NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_FT), +- NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_SAE)); ++ NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_SAE), ++ NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_BIP)); + + /* Other global properties are set in constructed() because they don't + * depend on interface capabilities. */ +@@ -1362,6 +1382,7 @@ _get_capability(NMSupplicantInterfacePrivate *priv, NMSupplCapType type) + } + break; + case NM_SUPPL_CAP_TYPE_SAE: ++ case NM_SUPPL_CAP_TYPE_BIP: + nm_assert(NM_SUPPL_CAP_MASK_GET(priv->global_capabilities, type) == NM_TERNARY_DEFAULT); + value = NM_SUPPL_CAP_MASK_GET(priv->iface_capabilities, type); + break; +@@ -1395,10 +1416,13 @@ nm_supplicant_interface_get_capabilities(NMSupplicantInterface *self) + caps = NM_SUPPL_CAP_MASK_SET(caps, + NM_SUPPL_CAP_TYPE_SAE, + _get_capability(priv, NM_SUPPL_CAP_TYPE_SAE)); ++ caps = NM_SUPPL_CAP_MASK_SET(caps, ++ NM_SUPPL_CAP_TYPE_BIP, ++ _get_capability(priv, NM_SUPPL_CAP_TYPE_BIP)); + + nm_assert(!NM_FLAGS_ANY(priv->iface_capabilities, + ~(NM_SUPPL_CAP_MASK_T_AP_MASK | NM_SUPPL_CAP_MASK_T_FT_MASK +- | NM_SUPPL_CAP_MASK_T_SAE_MASK))); ++ | NM_SUPPL_CAP_MASK_T_SAE_MASK | NM_SUPPL_CAP_MASK_T_BIP_MASK))); + + #if NM_MORE_ASSERTS > 10 + { +diff --git a/src/core/supplicant/nm-supplicant-types.h b/src/core/supplicant/nm-supplicant-types.h +index d5cf1bf..8904372 100644 +--- a/src/core/supplicant/nm-supplicant-types.h ++++ b/src/core/supplicant/nm-supplicant-types.h +@@ -48,6 +48,9 @@ typedef enum { + NM_SUPPL_CAP_TYPE_FAST, + NM_SUPPL_CAP_TYPE_WFD, + NM_SUPPL_CAP_TYPE_SUITEB192, ++ NM_SUPPL_CAP_TYPE_BIP, ++ /* Note: if you're adding a capability here, log its presence at the ++ * bottom of _dbus_get_capabilities_cb(). */ + _NM_SUPPL_CAP_TYPE_NUM, + } NMSupplCapType; + +@@ -75,6 +78,7 @@ typedef enum { + _NM_SUPPL_CAP_MASK_DEFINE(FT), + _NM_SUPPL_CAP_MASK_DEFINE(SAE), + _NM_SUPPL_CAP_MASK_DEFINE(SHA384), ++ _NM_SUPPL_CAP_MASK_DEFINE(BIP), + #undef _NM_SUPPL_CAP_MASK_DEFINE + } NMSupplCapMask; + diff --git a/debian/patches/supplicant-enable-WPA3-transition-mode-only-when-interfac.patch b/debian/patches/supplicant-enable-WPA3-transition-mode-only-when-interfac.patch new file mode 100644 index 00000000..2e79268b --- /dev/null +++ b/debian/patches/supplicant-enable-WPA3-transition-mode-only-when-interfac.patch @@ -0,0 +1,58 @@ +From: Beniamino Galvani +Date: Fri, 1 Apr 2022 15:49:13 +0200 +Subject: supplicant: enable WPA3 transition mode only when interface supports + PMF + +We have some reports of APs that advertise WPA2/WPA3 with +MFP-required=0/MFP-capable=0, and reject the association when the +client doesn't support 802.11w. + +According to WPA3_Specification_v3.0 section 2.3, when operating in +WPA3-Personal transition mode a STA: + +- should allow AKM suite selector: 00-0F-AC:6 (WPA-PSK-SHA256) to be + selected for an association; + +- shall negotiate PMF when associating to an AP using SAE. + +The first is guaranteed by capability PMF; the second by checking that +the interface supports BIP ciphers suitable for PMF. + +https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/964 +https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1003907 +(cherry picked from commit 1a7db1d7f712d7696f64b089011bc45fc86e7924) +(cherry picked from commit 4dbf7778acef65fb7f5258e5b69d321bc79a490e) +--- + src/core/supplicant/nm-supplicant-config.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/src/core/supplicant/nm-supplicant-config.c b/src/core/supplicant/nm-supplicant-config.c +index 96c2357..8626042 100644 +--- a/src/core/supplicant/nm-supplicant-config.c ++++ b/src/core/supplicant/nm-supplicant-config.c +@@ -854,7 +854,24 @@ nm_supplicant_config_add_setting_wireless_security(NMSupplicantConfig + g_string_append(key_mgmt_conf, " WPA-PSK-SHA256"); + if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT)) + g_string_append(key_mgmt_conf, " FT-PSK"); +- if (_get_capability(priv, NM_SUPPL_CAP_TYPE_SAE)) { ++ ++ /* For NM "key-mgmt=wpa-psk" doesn't strictly mean WPA1/wPA2 only, ++ * but also allows WPA3 (SAE), so that existing connections can ++ * benefit from the improved security when the AP gets upgraded. ++ * ++ * According to WPA3_Specification_v3.0 section 2.3, when operating ++ * in WPA3-Personal transition mode a STA: ++ * ++ * - should allow AKM suite selector: 00-0F-AC:6 (WPA-PSK-SHA256) to ++ * be selected for an association; ++ * - shall negotiate PMF when associating to an AP using SAE. ++ * ++ * Those conditions are met when the interface has capabilities ++ * SAE, PMF, BIP. ++ */ ++ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_SAE) ++ && _get_capability(priv, NM_SUPPL_CAP_TYPE_PMF) ++ && _get_capability(priv, NM_SUPPL_CAP_TYPE_BIP)) { + g_string_append(key_mgmt_conf, " SAE"); + if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT)) + g_string_append(key_mgmt_conf, " FT-SAE"); -- cgit 1.3.0-6-gf8a5 From 16cc38ed3d1761b178512c9a6c291ad366c6fad8 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Mon, 4 Apr 2022 11:39:36 +0200 Subject: Release version 1.36.4-2 to unstable --- debian/changelog | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'debian') diff --git a/debian/changelog b/debian/changelog index f319ac30..80402463 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +network-manager (1.36.4-2) unstable; urgency=medium + + * supplicant: enable WPA3 transition mode only when interface supports PMF. + See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1003907 + + -- Michael Biebl Mon, 04 Apr 2022 11:39:20 +0200 + network-manager (1.36.4-1) unstable; urgency=medium * New upstream version 1.36.4 -- cgit 1.3.0-6-gf8a5 From 3917b77bbf1354a1e9374bce817fbbd7d00250ef Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Wed, 4 May 2022 15:38:52 +0200 Subject: New upstream version 1.37.92 (1.38 rc3) --- debian/changelog | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'debian') diff --git a/debian/changelog b/debian/changelog index 80402463..b1aad882 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +network-manager (1.37.92-1) UNRELEASED; urgency=medium + + * New upstream version 1.37.92 (1.38 rc3) + + -- Michael Biebl Wed, 04 May 2022 15:38:10 +0200 + network-manager (1.36.4-2) unstable; urgency=medium * supplicant: enable WPA3 transition mode only when interface supports PMF. @@ -35,7 +41,7 @@ network-manager (1.36.0-1) unstable; urgency=medium network-manager (1.35.92-1) unstable; urgency=medium - * New upstream version 1.35.92 ((1.36 rc3) + * New upstream version 1.35.92 (1.36 rc3) * Rename polkit rules file to org.freedesktop.NetworkManager.rules * Set path to nft binary * Demote iptables to Suggests -- cgit 1.3.0-6-gf8a5 From a87b4908083d09f67c4ec868aa8b9800380369a5 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Wed, 4 May 2022 15:42:51 +0200 Subject: Rebase patches --- ...Force-online-state-with-unmanaged-devices.patch | 22 ++-- debian/patches/series | 2 - .../supplicant-add-BIP-interface-capability.patch | 117 --------------------- ...e-WPA3-transition-mode-only-when-interfac.patch | 58 ---------- 4 files changed, 11 insertions(+), 188 deletions(-) delete mode 100644 debian/patches/supplicant-add-BIP-interface-capability.patch delete mode 100644 debian/patches/supplicant-enable-WPA3-transition-mode-only-when-interfac.patch (limited to 'debian') diff --git a/debian/patches/Force-online-state-with-unmanaged-devices.patch b/debian/patches/Force-online-state-with-unmanaged-devices.patch index 4765891f..e6b80752 100644 --- a/debian/patches/Force-online-state-with-unmanaged-devices.patch +++ b/debian/patches/Force-online-state-with-unmanaged-devices.patch @@ -12,7 +12,7 @@ Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512286 1 file changed, 115 insertions(+) diff --git a/src/core/nm-manager.c b/src/core/nm-manager.c -index 6c73d23..9a73a16 100644 +index 5215369..462b887 100644 --- a/src/core/nm-manager.c +++ b/src/core/nm-manager.c @@ -51,6 +51,8 @@ @@ -24,7 +24,7 @@ index 6c73d23..9a73a16 100644 /*****************************************************************************/ typedef struct { -@@ -186,6 +188,10 @@ typedef struct { +@@ -191,6 +193,10 @@ typedef struct { GFileMonitor *fw_monitor; guint fw_changed_id; @@ -35,7 +35,7 @@ index 6c73d23..9a73a16 100644 guint timestamp_update_id; guint devices_inited_id; -@@ -1477,6 +1483,27 @@ find_best_device_state(NMManager *manager) +@@ -1491,6 +1497,27 @@ find_best_device_state(NMManager *manager) return best_state; } @@ -63,7 +63,7 @@ index 6c73d23..9a73a16 100644 static void nm_manager_update_metered(NMManager *self) { -@@ -1523,6 +1550,9 @@ nm_manager_update_state(NMManager *self) +@@ -1537,6 +1564,9 @@ nm_manager_update_state(NMManager *self) else new_state = find_best_device_state(self); @@ -73,7 +73,7 @@ index 6c73d23..9a73a16 100644 if (new_state >= NM_STATE_CONNECTED_LOCAL && priv->connectivity_state == NM_CONNECTIVITY_FULL) { new_state = NM_STATE_CONNECTED_GLOBAL; } -@@ -6673,6 +6703,62 @@ impl_manager_get_logging(NMDBusObject *obj, +@@ -6872,6 +6902,62 @@ impl_manager_get_logging(NMDBusObject *obj, g_variant_new("(ss)", nm_logging_level_to_string(), nm_logging_domains_to_string())); } @@ -136,7 +136,7 @@ index 6c73d23..9a73a16 100644 typedef struct { NMManager *self; GDBusMethodInvocation *context; -@@ -6987,6 +7073,9 @@ nm_manager_start(NMManager *self, GError **error) +@@ -7182,6 +7268,9 @@ nm_manager_start(NMManager *self, GError **error) nm_clear_g_source(&priv->devices_inited_id); priv->devices_inited_id = g_idle_add_full(G_PRIORITY_LOW + 10, devices_inited_cb, self, NULL); @@ -146,7 +146,7 @@ index 6c73d23..9a73a16 100644 return TRUE; } -@@ -7984,6 +8073,22 @@ nm_manager_init(NMManager *self) +@@ -8035,6 +8124,22 @@ nm_manager_init(NMManager *self) _LOGW(LOGD_CORE, "failed to monitor kernel firmware directory '%s'.", KERNEL_FIRMWARE_DIR); } @@ -166,10 +166,10 @@ index 6c73d23..9a73a16 100644 + IFUPDOWN_STATE_FILE); + } + - /* Update timestamps in active connections */ - priv->timestamp_update_id = - g_timeout_add_seconds(300, -@@ -8269,6 +8374,16 @@ dispose(GObject *object) + priv->metered = NM_METERED_UNKNOWN; + priv->sleep_devices = g_hash_table_new(nm_direct_hash, NULL); + } +@@ -8317,6 +8422,16 @@ dispose(GObject *object) g_clear_object(&priv->fw_monitor); } diff --git a/debian/patches/series b/debian/patches/series index c61b47cb..a2d7e06d 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,3 +1 @@ Force-online-state-with-unmanaged-devices.patch -supplicant-add-BIP-interface-capability.patch -supplicant-enable-WPA3-transition-mode-only-when-interfac.patch diff --git a/debian/patches/supplicant-add-BIP-interface-capability.patch b/debian/patches/supplicant-add-BIP-interface-capability.patch deleted file mode 100644 index e1cc05e2..00000000 --- a/debian/patches/supplicant-add-BIP-interface-capability.patch +++ /dev/null @@ -1,117 +0,0 @@ -From: Beniamino Galvani -Date: Fri, 1 Apr 2022 15:32:34 +0200 -Subject: supplicant: add BIP interface capability - -Introduce a new capability indicating whether the interface supports -any of the BIP ciphers that can be used for 802.11w (PMF). - -(cherry picked from commit cd1e0193abcf26f523bd52d83af5aab086ceaa92) -(cherry picked from commit 55ee796c3b14cb6bb7ff4916d6580202a95a00d1) ---- - src/core/supplicant/nm-supplicant-interface.c | 28 +++++++++++++++++++++++++-- - src/core/supplicant/nm-supplicant-types.h | 4 ++++ - 2 files changed, 30 insertions(+), 2 deletions(-) - -diff --git a/src/core/supplicant/nm-supplicant-interface.c b/src/core/supplicant/nm-supplicant-interface.c -index d827614..e502ae8 100644 ---- a/src/core/supplicant/nm-supplicant-interface.c -+++ b/src/core/supplicant/nm-supplicant-interface.c -@@ -1225,8 +1225,10 @@ parse_capabilities(NMSupplicantInterface *self, GVariant *capabilities) - const guint32 old_max_scan_ssids = priv->max_scan_ssids; - gboolean have_ft = FALSE; - gboolean have_sae = FALSE; -+ gboolean have_bip = FALSE; - gint32 max_scan_ssids; - const char **array; -+ guint i; - - nm_assert(capabilities && g_variant_is_of_type(capabilities, G_VARIANT_TYPE_VARDICT)); - -@@ -1236,12 +1238,28 @@ parse_capabilities(NMSupplicantInterface *self, GVariant *capabilities) - g_free(array); - } - -+ if (g_variant_lookup(capabilities, "GroupMgmt", "^a&s", &array)) { -+ for (i = 0; array[i]; i++) { -+ if (NM_IN_STRSET(array[i], -+ "aes-128-cmac", -+ "bip-gmac-128", -+ "bip-gmac-256", -+ "bip-cmac-256")) { -+ have_bip = TRUE; -+ break; -+ } -+ } -+ } -+ - priv->iface_capabilities = NM_SUPPL_CAP_MASK_SET(priv->iface_capabilities, - NM_SUPPL_CAP_TYPE_FT, - have_ft ? NM_TERNARY_TRUE : NM_TERNARY_FALSE); - priv->iface_capabilities = NM_SUPPL_CAP_MASK_SET(priv->iface_capabilities, - NM_SUPPL_CAP_TYPE_SAE, - have_sae ? NM_TERNARY_TRUE : NM_TERNARY_FALSE); -+ priv->iface_capabilities = NM_SUPPL_CAP_MASK_SET(priv->iface_capabilities, -+ NM_SUPPL_CAP_TYPE_BIP, -+ have_bip ? NM_TERNARY_TRUE : NM_TERNARY_FALSE); - - if (g_variant_lookup(capabilities, "Modes", "^a&s", &array)) { - /* Setting p2p_capable might toggle _prop_p2p_available_get(). However, -@@ -1317,10 +1335,12 @@ _starting_check_ready(NMSupplicantInterface *self) - " AP%c" - " FT%c" - " SAE%c" -+ " BIP%c" - "", - NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_AP), - NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_FT), -- NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_SAE)); -+ NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_SAE), -+ NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_BIP)); - - /* Other global properties are set in constructed() because they don't - * depend on interface capabilities. */ -@@ -1362,6 +1382,7 @@ _get_capability(NMSupplicantInterfacePrivate *priv, NMSupplCapType type) - } - break; - case NM_SUPPL_CAP_TYPE_SAE: -+ case NM_SUPPL_CAP_TYPE_BIP: - nm_assert(NM_SUPPL_CAP_MASK_GET(priv->global_capabilities, type) == NM_TERNARY_DEFAULT); - value = NM_SUPPL_CAP_MASK_GET(priv->iface_capabilities, type); - break; -@@ -1395,10 +1416,13 @@ nm_supplicant_interface_get_capabilities(NMSupplicantInterface *self) - caps = NM_SUPPL_CAP_MASK_SET(caps, - NM_SUPPL_CAP_TYPE_SAE, - _get_capability(priv, NM_SUPPL_CAP_TYPE_SAE)); -+ caps = NM_SUPPL_CAP_MASK_SET(caps, -+ NM_SUPPL_CAP_TYPE_BIP, -+ _get_capability(priv, NM_SUPPL_CAP_TYPE_BIP)); - - nm_assert(!NM_FLAGS_ANY(priv->iface_capabilities, - ~(NM_SUPPL_CAP_MASK_T_AP_MASK | NM_SUPPL_CAP_MASK_T_FT_MASK -- | NM_SUPPL_CAP_MASK_T_SAE_MASK))); -+ | NM_SUPPL_CAP_MASK_T_SAE_MASK | NM_SUPPL_CAP_MASK_T_BIP_MASK))); - - #if NM_MORE_ASSERTS > 10 - { -diff --git a/src/core/supplicant/nm-supplicant-types.h b/src/core/supplicant/nm-supplicant-types.h -index d5cf1bf..8904372 100644 ---- a/src/core/supplicant/nm-supplicant-types.h -+++ b/src/core/supplicant/nm-supplicant-types.h -@@ -48,6 +48,9 @@ typedef enum { - NM_SUPPL_CAP_TYPE_FAST, - NM_SUPPL_CAP_TYPE_WFD, - NM_SUPPL_CAP_TYPE_SUITEB192, -+ NM_SUPPL_CAP_TYPE_BIP, -+ /* Note: if you're adding a capability here, log its presence at the -+ * bottom of _dbus_get_capabilities_cb(). */ - _NM_SUPPL_CAP_TYPE_NUM, - } NMSupplCapType; - -@@ -75,6 +78,7 @@ typedef enum { - _NM_SUPPL_CAP_MASK_DEFINE(FT), - _NM_SUPPL_CAP_MASK_DEFINE(SAE), - _NM_SUPPL_CAP_MASK_DEFINE(SHA384), -+ _NM_SUPPL_CAP_MASK_DEFINE(BIP), - #undef _NM_SUPPL_CAP_MASK_DEFINE - } NMSupplCapMask; - diff --git a/debian/patches/supplicant-enable-WPA3-transition-mode-only-when-interfac.patch b/debian/patches/supplicant-enable-WPA3-transition-mode-only-when-interfac.patch deleted file mode 100644 index 2e79268b..00000000 --- a/debian/patches/supplicant-enable-WPA3-transition-mode-only-when-interfac.patch +++ /dev/null @@ -1,58 +0,0 @@ -From: Beniamino Galvani -Date: Fri, 1 Apr 2022 15:49:13 +0200 -Subject: supplicant: enable WPA3 transition mode only when interface supports - PMF - -We have some reports of APs that advertise WPA2/WPA3 with -MFP-required=0/MFP-capable=0, and reject the association when the -client doesn't support 802.11w. - -According to WPA3_Specification_v3.0 section 2.3, when operating in -WPA3-Personal transition mode a STA: - -- should allow AKM suite selector: 00-0F-AC:6 (WPA-PSK-SHA256) to be - selected for an association; - -- shall negotiate PMF when associating to an AP using SAE. - -The first is guaranteed by capability PMF; the second by checking that -the interface supports BIP ciphers suitable for PMF. - -https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/964 -https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1003907 -(cherry picked from commit 1a7db1d7f712d7696f64b089011bc45fc86e7924) -(cherry picked from commit 4dbf7778acef65fb7f5258e5b69d321bc79a490e) ---- - src/core/supplicant/nm-supplicant-config.c | 19 ++++++++++++++++++- - 1 file changed, 18 insertions(+), 1 deletion(-) - -diff --git a/src/core/supplicant/nm-supplicant-config.c b/src/core/supplicant/nm-supplicant-config.c -index 96c2357..8626042 100644 ---- a/src/core/supplicant/nm-supplicant-config.c -+++ b/src/core/supplicant/nm-supplicant-config.c -@@ -854,7 +854,24 @@ nm_supplicant_config_add_setting_wireless_security(NMSupplicantConfig - g_string_append(key_mgmt_conf, " WPA-PSK-SHA256"); - if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT)) - g_string_append(key_mgmt_conf, " FT-PSK"); -- if (_get_capability(priv, NM_SUPPL_CAP_TYPE_SAE)) { -+ -+ /* For NM "key-mgmt=wpa-psk" doesn't strictly mean WPA1/wPA2 only, -+ * but also allows WPA3 (SAE), so that existing connections can -+ * benefit from the improved security when the AP gets upgraded. -+ * -+ * According to WPA3_Specification_v3.0 section 2.3, when operating -+ * in WPA3-Personal transition mode a STA: -+ * -+ * - should allow AKM suite selector: 00-0F-AC:6 (WPA-PSK-SHA256) to -+ * be selected for an association; -+ * - shall negotiate PMF when associating to an AP using SAE. -+ * -+ * Those conditions are met when the interface has capabilities -+ * SAE, PMF, BIP. -+ */ -+ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_SAE) -+ && _get_capability(priv, NM_SUPPL_CAP_TYPE_PMF) -+ && _get_capability(priv, NM_SUPPL_CAP_TYPE_BIP)) { - g_string_append(key_mgmt_conf, " SAE"); - if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT)) - g_string_append(key_mgmt_conf, " FT-SAE"); -- cgit 1.3.0-6-gf8a5 From d71d738bbb29ca8c78dfacb247e12b31bfbd1076 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Wed, 4 May 2022 15:55:59 +0200 Subject: Update network-manager.docs --- debian/network-manager.docs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'debian') diff --git a/debian/network-manager.docs b/debian/network-manager.docs index eb9b151c..d379acf2 100644 --- a/debian/network-manager.docs +++ b/debian/network-manager.docs @@ -1,3 +1,3 @@ NEWS -README +README.md AUTHORS -- cgit 1.3.0-6-gf8a5 From f873b990628c74a8d322976e6fd240881d7da417 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Wed, 4 May 2022 16:45:18 +0200 Subject: Update symbols file for libnm0 --- debian/libnm0.symbols | 3 +++ 1 file changed, 3 insertions(+) (limited to 'debian') diff --git a/debian/libnm0.symbols b/debian/libnm0.symbols index 9efe8fac..4808948d 100644 --- a/debian/libnm0.symbols +++ b/debian/libnm0.symbols @@ -29,6 +29,7 @@ libnm.so.0 libnm0 #MINVER# libnm_1_32_4@libnm_1_32_4 1.32.12 libnm_1_34_0@libnm_1_34_0 1.34.0 libnm_1_36_0@libnm_1_36_0 1.36.0 + libnm_1_38_0@libnm_1_38_0 1.37.92 libnm_1_4_0@libnm_1_4_0 1.4.0 libnm_1_6_0@libnm_1_6_0 1.6.0 libnm_1_8_0@libnm_1_8_0 1.8.0 @@ -156,6 +157,7 @@ libnm.so.0 libnm0 #MINVER# nm_client_get_permission_result@libnm_1_0_0 1.0.0 nm_client_get_permissions_state@libnm_1_24_0 1.24.0 nm_client_get_primary_connection@libnm_1_0_0 1.0.0 + nm_client_get_radio_flags@libnm_1_38_0 1.37.92 nm_client_get_startup@libnm_1_0_0 1.0.0 nm_client_get_state@libnm_1_0_0 1.0.0 nm_client_get_type@libnm_1_0_0 1.0.0 @@ -630,6 +632,7 @@ libnm.so.0 libnm0 #MINVER# nm_object_get_client@libnm_1_24_0 1.24.0 nm_object_get_path@libnm_1_0_0 1.0.0 nm_object_get_type@libnm_1_0_0 1.0.0 + nm_radio_flags_get_type@libnm_1_38_0 1.37.92 nm_remote_connection_commit_changes@libnm_1_0_0 1.0.0 nm_remote_connection_commit_changes_async@libnm_1_0_0 1.0.0 nm_remote_connection_commit_changes_finish@libnm_1_0_0 1.0.0 -- cgit 1.3.0-6-gf8a5 From d26308b229deb999da934f582aa8f3d5caaa63c0 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Wed, 4 May 2022 16:46:07 +0200 Subject: Release version 1.37.92-1 to unstable --- debian/changelog | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'debian') diff --git a/debian/changelog b/debian/changelog index b1aad882..c4466b6d 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,8 +1,11 @@ -network-manager (1.37.92-1) UNRELEASED; urgency=medium +network-manager (1.37.92-1) unstable; urgency=medium * New upstream version 1.37.92 (1.38 rc3) + * Rebase patches + * Update network-manager.docs + * Update symbols file for libnm0 - -- Michael Biebl Wed, 04 May 2022 15:38:10 +0200 + -- Michael Biebl Wed, 04 May 2022 16:45:54 +0200 network-manager (1.36.4-2) unstable; urgency=medium -- cgit 1.3.0-6-gf8a5 From 7180d4b2afcd738496ee25b94434266ec15e8ba0 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Fri, 13 May 2022 15:12:36 +0200 Subject: New upstream version 1.38.0 --- debian/changelog | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'debian') diff --git a/debian/changelog b/debian/changelog index c4466b6d..209092f0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +network-manager (1.38.0-1) UNRELEASED; urgency=medium + + * New upstream version 1.38.0 + + -- Michael Biebl Fri, 13 May 2022 15:12:34 +0200 + network-manager (1.37.92-1) unstable; urgency=medium * New upstream version 1.37.92 (1.38 rc3) -- cgit 1.3.0-6-gf8a5 From 1b0c5b7ddb3f1143767beb87cd18f1be3ae4de18 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Fri, 13 May 2022 15:42:23 +0200 Subject: Bump symbol versions to final 1.38.0 release --- debian/libnm0.symbols | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'debian') diff --git a/debian/libnm0.symbols b/debian/libnm0.symbols index 4808948d..f90d3ac2 100644 --- a/debian/libnm0.symbols +++ b/debian/libnm0.symbols @@ -29,7 +29,7 @@ libnm.so.0 libnm0 #MINVER# libnm_1_32_4@libnm_1_32_4 1.32.12 libnm_1_34_0@libnm_1_34_0 1.34.0 libnm_1_36_0@libnm_1_36_0 1.36.0 - libnm_1_38_0@libnm_1_38_0 1.37.92 + libnm_1_38_0@libnm_1_38_0 1.38.0 libnm_1_4_0@libnm_1_4_0 1.4.0 libnm_1_6_0@libnm_1_6_0 1.6.0 libnm_1_8_0@libnm_1_8_0 1.8.0 @@ -157,7 +157,7 @@ libnm.so.0 libnm0 #MINVER# nm_client_get_permission_result@libnm_1_0_0 1.0.0 nm_client_get_permissions_state@libnm_1_24_0 1.24.0 nm_client_get_primary_connection@libnm_1_0_0 1.0.0 - nm_client_get_radio_flags@libnm_1_38_0 1.37.92 + nm_client_get_radio_flags@libnm_1_38_0 1.38.0 nm_client_get_startup@libnm_1_0_0 1.0.0 nm_client_get_state@libnm_1_0_0 1.0.0 nm_client_get_type@libnm_1_0_0 1.0.0 @@ -632,7 +632,7 @@ libnm.so.0 libnm0 #MINVER# nm_object_get_client@libnm_1_24_0 1.24.0 nm_object_get_path@libnm_1_0_0 1.0.0 nm_object_get_type@libnm_1_0_0 1.0.0 - nm_radio_flags_get_type@libnm_1_38_0 1.37.92 + nm_radio_flags_get_type@libnm_1_38_0 1.38.0 nm_remote_connection_commit_changes@libnm_1_0_0 1.0.0 nm_remote_connection_commit_changes_async@libnm_1_0_0 1.0.0 nm_remote_connection_commit_changes_finish@libnm_1_0_0 1.0.0 -- cgit 1.3.0-6-gf8a5 From 1a31bc3c63474ca02c83b02add85ea4e740e5597 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Fri, 13 May 2022 15:42:45 +0200 Subject: Release version 1.38.0-1 to unstable --- debian/changelog | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'debian') diff --git a/debian/changelog b/debian/changelog index 209092f0..ebbfb8a0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,8 +1,9 @@ -network-manager (1.38.0-1) UNRELEASED; urgency=medium +network-manager (1.38.0-1) unstable; urgency=medium * New upstream version 1.38.0 + * Bump symbol versions to final 1.38.0 release - -- Michael Biebl Fri, 13 May 2022 15:12:34 +0200 + -- Michael Biebl Fri, 13 May 2022 15:42:33 +0200 network-manager (1.37.92-1) unstable; urgency=medium -- cgit 1.3.0-6-gf8a5