{"id":103000,"date":"2022-01-18T15:36:39","date_gmt":"2022-01-18T13:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d0%b2%d1%8b%d0%bf%d1%83%d1%81%d0%ba-hostapd-%d0%b8-wpa_supplicant-2-10"},"modified":"2022-01-18T15:36:39","modified_gmt":"2022-01-18T13:36:39","slug":"%d0%b2%d1%8b%d0%bf%d1%83%d1%81%d0%ba-hostapd-%d0%b8-wpa_supplicant-2-10","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/%d0%b2%d1%8b%d0%bf%d1%83%d1%81%d0%ba-hostapd-%d0%b8-wpa_supplicant-2-10","title":{"rendered":"L\u00ebshimi i hostapd dhe wpa_supplicant 2.10","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Pas nj\u00eb vit e gjysm\u00eb zhvillimi, \u00ebsht\u00eb p\u00ebrgatitur l\u00ebshimi i hostapd\/wpa_supplicant 2.10, nj\u00eb paket\u00eb p\u00ebr mb\u00ebshtetje t\u00eb protokolleve wireless IEEE 802.1X, WPA, WPA2, WPA3 dhe EAP, e cila p\u00ebrfshin aplikacionin wpa_supplicant p\u00ebr lidhjen me rrjetin wireless si klient dhe procesin n\u00eb sfond hostapd p\u00ebr operimin e pikave t\u00eb qasjes dhe serverit t\u00eb autentifikimit, duke p\u00ebrfshir\u00eb komponent\u00eb si WPA Authenticator, klienti\/serveri i autentifikimit RADIUS, dhe serveri EAP. Kodet burimore t\u00eb projektit shp\u00ebrndahen n\u00ebn licenc\u00ebn BSD. <\/p>\n
P\u00ebrve\u00e7 ndryshimeve funksionale n\u00eb versionin e ri, \u00ebsht\u00eb bllokuar nj\u00eb vektor i ri sulmi p\u00ebr kanale t\u00eb jashtme, i cili prek metod\u00ebn e negociat\u00ebs s\u00eb lidhjeve SAE (Autentikimi i Posa\u00e7\u00ebm i Barabart\u00eb) dhe protokollin EAP-pwd. Nj\u00eb sulmues, q\u00eb ka mund\u00ebsin\u00eb t\u00eb ekzekutoj\u00eb kod t\u00eb papreksh\u00ebm n\u00eb sistemin e p\u00ebrdoruesit q\u00eb lidhet me rrjetin wireless, mund t\u00eb marr\u00eb informacione n\u00eb lidhje me karakteristikat e fjal\u00ebkalimit p\u00ebrmes ndjekjes s\u00eb aktivitetit n\u00eb sistem dhe t'i p\u00ebrdor\u00eb ato p\u00ebr t\u00eb p\u00ebrmir\u00ebsuar procesin e thyerjes s\u00eb fjal\u00ebkalimit n\u00eb m\u00ebnyr\u00eb offline. Problemi shkaktohet nga rrjedhja e informacioneve p\u00ebr karakteristikat e fjal\u00ebkalimit n\u00eb kanale t\u00eb jashtme, t\u00eb cilat lejojn\u00eb, p\u00ebrmes t\u00eb dh\u00ebnave t\u00eb t\u00ebrthor\u00eb, si\u00e7 \u00ebsht\u00eb ndryshimi n\u00eb vonesa gjat\u00eb kryerjes s\u00eb operacioneve, t\u00eb sakt\u00ebsojn\u00eb sakt\u00ebsin\u00eb e zgjedhjes s\u00eb pjes\u00ebve t\u00eb fjal\u00ebkalimit gjat\u00eb procesit t\u00eb thyerjes. <\/p>\n
Ndryshe nga problemet e ngjashme q\u00eb u zgjidh\u00ebn n\u00eb vitin 2019, kjo vulnerabilitet i ri shkaktohet nga p\u00ebrdorimi i primitivave kriptografike t\u00eb jashtme n\u00eb funksionin crypto_ec_point_solve_y_coord(), t\u00eb cilat nuk siguruan nj\u00eb koh\u00eb t\u00eb vazhdueshme t\u00eb operacioneve, e cila nuk varet nga natyra e t\u00eb dh\u00ebnave t\u00eb p\u00ebrpunuara. Bazuar n\u00eb analiz\u00ebn e sjelljes s\u00eb caches t\u00eb procesor\u00ebve, nj\u00eb sulmues q\u00eb mund t\u00eb ekzekutoj\u00eb kod t\u00eb papreksh\u00ebm n\u00eb t\u00eb nj\u00ebjtin b\u00ebrtham\u00eb procesori, mund t\u00eb marr\u00eb informacione mbi zhvillimin e operacioneve me fjal\u00ebkalim n\u00eb SAE\/EAP-pwd. Problemi i prekur \u00ebsht\u00eb n\u00eb t\u00eb gjitha versionet e wpa_supplicant dhe hostapd, t\u00eb nd\u00ebrtuara me mb\u00ebshtetje p\u00ebr SAE (CONFIG_SAE=y) dhe EAP-pwd (CONFIG_EAP_PWD=y). <\/p>\n
Ndryshime t\u00eb tjera n\u00eb l\u00ebshimet e reja t\u00eb hostapd dhe wpa_supplicant: <\/p>\n
\n
Shtuar mund\u00ebsin\u00eb e nd\u00ebrtimit me bibliotek\u00ebn kriptografike OpenSSL 3.0.\n
Implementuar mekanizmin e mbrojtjes s\u00eb Beacon-it, t\u00eb propozuar n\u00eb p\u00ebrdit\u00ebsimin e specifikimit WPA3, i cili \u00ebsht\u00eb i destinuar p\u00ebr t\u00eb mbrojtur nga sulmet aktive n\u00eb rrjetin wireless q\u00eb manipulojn\u00eb ndryshimin e kadrove Beacon.\n
U shtua mb\u00ebshtetje p\u00ebr protokollin DPP 2 (Wi-Fi Device Provisioning Protocol), i cili p\u00ebrcakton metod\u00ebn e autentifikimit me \u00e7el\u00ebsa publik, e cila p\u00ebrdoret n\u00eb standardin WPA3 p\u00ebr t\u00eb leht\u00ebsuar konfigurimin e pajisjeve pa nd\u00ebrfaqe t\u00eb ekranit. Konfigurimi b\u00ebhet duke p\u00ebrdorur nj\u00eb pajisje tjet\u00ebr m\u00eb t\u00eb avancuar, e cila \u00ebsht\u00eb tashm\u00eb e lidhur me rrjetin wireless. P\u00ebr shembull, parametrat p\u00ebr pajisje IoT pa ekran mund t\u00eb vendosen me nj\u00eb smartphone n\u00eb baz\u00eb t\u00eb nj\u00eb fotografi t\u00eb nj\u00eb kodi QR, i cili \u00ebsht\u00eb printuar n\u00eb trupin e pajisjes;\n
U shtua mb\u00ebshtetje p\u00ebr identifikuesit e zgjeruar t\u00eb \u00e7el\u00ebsave (Extended Key ID, IEEE 802.11-2016).\n
N\u00eb zbatimin e metod\u00ebs s\u00eb pajtimit t\u00eb lidhjeve SAE \u00ebsht\u00eb shtuar mb\u00ebshtetje p\u00ebr mekanizmin e mbrojtjes SAE-PK (\u00c7el\u00ebsi Publik SAE). \u00cbsht\u00eb realizuar nj\u00eb modalitet i menj\u00ebhersh\u00ebm p\u00ebr d\u00ebrgimin e konfirmimit, i aktivizuar me opsionin «sae_config_immediate=1», si dhe mekanizmi hash-to-element, i aktivizuar kur vendoset parametri sae_pwe n\u00eb vlerat 1 ose 2.\n
N\u00eb realizimin e EAP-TLS, u shtua mb\u00ebshtetje p\u00ebr TLS 1.3 (e \u00e7aktivizuar si parazgjedhje).\n
U shtuan cil\u00ebsime t\u00eb reja (max_auth_rounds, max_auth_rounds_short) p\u00ebr t\u00eb ndryshuar kufijt\u00eb n\u00eb numrin e mesazheve EAP gjat\u00eb procesit t\u00eb autentifikimit (ndryshimi i kufijve mund t\u00eb jet\u00eb i nevojsh\u00ebm kur p\u00ebrdoren certifikata shum\u00eb t\u00eb m\u00ebdha).\n
U shtua mb\u00ebshtetje p\u00ebr mekanizmin PASN (Pre Association Security Negotiation) p\u00ebr t\u00eb vendosur nj\u00eb lidhje t\u00eb sigurt dhe p\u00ebr t\u00eb mbrojtur shk\u00ebmbimin e kadrove kontroluese n\u00eb nj\u00eb faz\u00eb t\u00eb m\u00ebparshme t\u00eb lidhjes.\n
U realizua mekanizmi Transition Disable, i cili lejon q\u00eb p\u00ebr t\u00eb forcuar sigurin\u00eb t\u00eb \u00e7aktivizohet automatikisht m\u00ebnyra e roaming-ut, e cila lejon kalimin mes pikave t\u00eb qasjes nd\u00ebrsa l\u00ebvizesh.\n
U p\u00ebrjashtua mb\u00ebshtetja p\u00ebr protokollin WEP nga nd\u00ebrtimet e parazgjedhura (p\u00ebr t\u00eb rikthyer mb\u00ebshtetjen WEP, k\u00ebrkohet rind\u00ebrtim me opsionin CONFIG_WEP=y). U hoq funksionaliteti i vjet\u00ebruar lidhur me protokollin IAPP (Inter-Access Point Protocol). U nd\u00ebrpre mb\u00ebshtetja p\u00ebr libnl 1.1. U shtua opsioni i nd\u00ebrtimit CONFIG_NO_TKIP=y p\u00ebr nd\u00ebrtim pa mb\u00ebshtetje TKIP.\n
U eliminuan vulnerabilitetet n\u00eb realizimin e UPnP (CVE-2020-12695), n\u00eb p\u00ebrpunuesin P2P\/Wi-Fi Direct (CVE-2021-27803) dhe mekanizmin e mbrojtjes PMF (CVE-2019-16275).\n
Nga ndryshimet specifike p\u00ebr hostapd, mund t\u00eb p\u00ebrmendet zgjerimi i mb\u00ebshtetjes p\u00ebr rrjetet wireless HEW (High-Efficiency Wireless, IEEE 802.11ax), duke p\u00ebrfshir\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb p\u00ebrdorur band\u00ebn frekuencore 6 GHz.\n
Ndryshimet specifike p\u00ebr wpa_supplicant:\n
\n
U shtua mb\u00ebshtetje p\u00ebr cil\u00ebsimet e modit t\u00eb pik\u00ebs s\u00eb qasjes p\u00ebr SAE (WPA3-Personal).\n
E p\u00ebrmir\u00ebsuar parashikimin e kapacitetit dhe zgjedhjen e BSS.\n
Zgjeruar nd\u00ebrfaqen e menaxhimit p\u00ebrmes D-Bus.\n
Shtuar nj\u00eb backend t\u00eb ri p\u00ebr ruajtjen e fjal\u00ebkalimeve n\u00eb nj\u00eb skedar t\u00eb ve\u00e7ant\u00eb, duke lejuar nxjerrjen e informacionit t\u00eb ndjesh\u00ebm nga skedari kryesor i konfigurimit.\n
Shtuar politika t\u00eb reja p\u00ebr SCS, MSCS dhe DSCP. <\/ul>\n<\/ul>\n