[bug#35563] WPA Supplicant 2.8

["Ludovic Courtès" <ludo@gnu.org>]

Hello Marius,

Marius Bakke <mbakke@fastmail.com> skribis:

> Attached is a security update for WPA Supplicant.
>
> The new version toggles a lot of build-time options to more closely
> resemble what Debian and Arch do.  Unfortunately the new defaults
> appears to require OpenSSL instead of GnuTLS.

What happens when you keep CONFIG_TLS=gnutls?

> From 194bb2914a0724587f04dd03cb4dd40465887248 Mon Sep 17 00:00:00 2001
> From: Marius Bakke <mbakke@fastmail.com>
> Date: Tue, 30 Apr 2019 00:05:36 +0200
> Subject: [PATCH] gnu: wpa_supplicant: Update to 2.8 [security fixes].
>
> This release fixes CVE-2019-9494, CVE-2019-9495, CVE-2019-9496, CVE-2019-9497,
> CVE-2019-9498, CVE-2019-9499, and CVE-2019-11555.
>
> * gnu/packages/admin.scm (wpa-supplicant-minimal): Update to 2.8.
> [source](snippet): New field.  Disable D-Bus.
> [arguments]: Remove now-default CONFIG_DEBUG_SYSLOG=y.  Change CONFIG_TLS to
> use OpenSSL rather than GnuTLS.
> [inputs]: Remove GNUTLS and LIBGCRYPT.  Add OPENSSL-NEXT.
> (wpa-supplicant)[arguments]: Remove obsolete CONFIG_CTRL_IFACE_DBUS=y.

[...]

> +                  (substitute* "wpa_supplicant/defconfig"
> +                    ;; Disable D-Bus by default.
> +                    (("^CONFIG_CTRL_IFACE_DBUS_" line _)
> +                     (string-append "#" line)))

This change is unrelated to the upgrade, right?  It would break Connman
(which expects to talk to wpa_supplicant over D-Bus), as well as
NetworkManager probably, no?  Or am I missing something?

I’d like to have to make sure wpa_supplicant works well in the 1.0.1
installer.  :-)

Thanks for looking into it!

Ludo’.