{"id":103000,"date":"2022-01-18T15:36:39","date_gmt":"2022-01-18T13:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d0%b2%d1%8b%d0%bf%d1%83%d1%81%d0%ba-hostapd-%d0%b8-wpa_supplicant-2-10"},"modified":"2022-01-18T15:36:39","modified_gmt":"2022-01-18T13:36:39","slug":"%d0%b2%d1%8b%d0%bf%d1%83%d1%81%d0%ba-hostapd-%d0%b8-wpa_supplicant-2-10","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/%d0%b2%d1%8b%d0%bf%d1%83%d1%81%d0%ba-hostapd-%d0%b8-wpa_supplicant-2-10","title":{"rendered":"Shp\u00ebrndarja e hostapd dhe wpa_supplicant 2.10","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Pas nj\u00eb vit e gjysm\u00eb zhvillimi, u p\u00ebrgatit l\u00ebshimi i hostapd\/wpa_supplicant 2.10, nj\u00eb paket\u00eb p\u00ebr sigurimin e funksionimit t\u00eb protokolleve t\u00eb wireless IEEE 802.1X, WPA, WPA2, WPA3 dhe EAP, e cila p\u00ebrmban aplikacionin wpa_supplicant p\u00ebr lidhjen me rrjetin wireless si klient dhe procesin n\u00eb background hostapd p\u00ebr funksionimin e pik\u00ebs s\u00eb qasjes dhe serverit t\u00eb autentifikimit, duke p\u00ebrfshir\u00eb komponent\u00eb si WPA Authenticator, klient\/server autenticimi RADIUS, dhe server EAP. Kodet burimore t\u00eb projektit shp\u00ebrndahen n\u00ebn licenc\u00ebn BSD. <\/p>\n
P\u00ebrve\u00e7 ndryshimeve funksionale n\u00eb versionin e ri, \u00ebsht\u00eb bllokuar nj\u00eb vektor i ri sulmi p\u00ebrmes kanaleve t\u00eb jashtme, q\u00eb prekte metod\u00ebn e negociat\u00ebs s\u00eb lidhjeve SAE (Autentikimi i Nj\u00ebkohsh\u00ebm i Barabart\u00eb) dhe protokollin EAP-pwd. Nj\u00eb sulmues, q\u00eb ka mund\u00ebsin\u00eb t\u00eb ekzekutoj\u00eb kod t\u00eb paregjistruar n\u00eb sistemin e p\u00ebrdoruesit q\u00eb lidhet me rrjetin wireless, mund t\u00eb marr\u00eb informacion mbi karakteristikat e fjal\u00ebkalimit duke ndjekur aktivitetin n\u00eb sistem dhe ta p\u00ebrdor\u00eb at\u00eb p\u00ebr t\u00eb thjeshtuar gjetjen e fjal\u00ebkalimit n\u00eb m\u00ebnyr\u00eb offline. Problemi shkaktohet nga rrjedhja p\u00ebrmes kanaleve t\u00eb jashtme t\u00eb informacionit mbi karakteristikat e fjal\u00ebkalimit, t\u00eb cilat lejojn\u00eb, p\u00ebrmes t\u00eb dh\u00ebnave t\u00eb t\u00ebrthorta, si ndryshimi i vonesave gjat\u00eb ekzekutimit t\u00eb operacioneve, q\u00eb t\u00eb sakt\u00ebsohet sakt\u00ebsia e zgjedhjes s\u00eb pjes\u00ebve t\u00eb fjal\u00ebkalimit gjat\u00eb procesit t\u00eb p\u00ebrzgjedhjes. <\/p>\n
Ndryshe nga problemet e ngjashme t\u00eb zgjidhura n\u00eb vitin 2019, vulnerabiliteti i ri lidhet me faktin se primitive t\u00eb jashtme kriptografike t\u00eb p\u00ebrdorura n\u00eb funksionin crypto_ec_point_solve_y_coord() nuk ofronin nj\u00eb koha t\u00eb vazhdueshme t\u00eb ekzekutimit t\u00eb operacioneve, e cila nuk varej nga natyra e t\u00eb dh\u00ebnave t\u00eb p\u00ebrpunuara. Bazuar n\u00eb analiz\u00ebn e sjelljes s\u00eb caches s\u00eb procesorit, nj\u00eb sulmues q\u00eb kishte mund\u00ebsin\u00eb t\u00eb ekzekutonte kod t\u00eb paprivilegjuar n\u00eb t\u00eb nj\u00ebjtin b\u00ebrtham\u00eb procesori mund t\u00eb merrte informacione mbi zhvillimin e operacioneve me fjal\u00ebkalim n\u00eb SAE\/EAP-pwd. T\u00eb gjitha versionet e wpa_supplicant dhe hostapd, t\u00eb nd\u00ebrtuara me mb\u00ebshtetje p\u00ebr SAE (CONFIG_SAE=y) dhe EAP-pwd (CONFIG_EAP_PWD=y), jan\u00eb t\u00eb ndjesh\u00ebm ndaj k\u00ebtij problemi. <\/p>\n
Ndryshime t\u00eb tjera n\u00eb l\u00ebshimet e reja t\u00eb hostapd dhe wpa_supplicant: <\/p>\n
\n
Shtuar mund\u00ebsia e nd\u00ebrtimit me bibliotek\u00ebn kriptografike OpenSSL 3.0.\n
Implementuar mekanizmin e propozuar n\u00eb p\u00ebrdit\u00ebsimin e specifikimit WPA3, Beacon Protection, i dizajnuar p\u00ebr t\u00eb mbrojtur nga sulmet aktive n\u00eb rrjetin wireless, duke manipuluar ndryshimet n\u00eb kornisat Beacon.\n
Shtohet mb\u00ebshtetje p\u00ebr protokollin DPP 2 (Wi-Fi Device Provisioning Protocol), q\u00eb p\u00ebrcakton metod\u00ebn e autentifikimit me \u00e7el\u00ebsa publik\u00eb, e angazhuar n\u00eb standardin WPA3 p\u00ebr t\u00eb organizuar nj\u00eb konfigurim m\u00eb t\u00eb leht\u00eb t\u00eb pajisjeve pa nj\u00eb nd\u00ebrfaqe ekrani. Konfigurimi b\u00ebhet duke p\u00ebrdorur nj\u00eb pajisje tjet\u00ebr m\u00eb t\u00eb avancuar, e cila tashm\u00eb \u00ebsht\u00eb e lidhur n\u00eb rrjetin pa tel. P\u00ebr shembull, parametrat p\u00ebr nj\u00eb pajisje IoT pa ekran mund t\u00eb vendosen nga nj\u00eb smartphone mbi baz\u00ebn e nj\u00eb snapshot-i t\u00eb kodit QR, t\u00eb printuar n\u00eb trupin e saj;\n
Metoda e negociimit t\u00eb lidhjeve SAE ka p\u00ebrfshir\u00eb mb\u00ebshtetje p\u00ebr mekanizmin e mbrojtjes SAE-PK (\u00c7el\u00ebsi Publik SAE). \u00cbsht\u00eb zbatuar nj\u00eb mod i menj\u00ebhersh\u00ebm i d\u00ebrgimit t\u00eb konfirmimit, i aktivizuar nga opsioni «sae_config_immediate=1», si dhe mekanizmi hash-to-element, i aktivizuar kur parametri sae_pwe vendoset n\u00eb 1 ose 2.\n
N\u00eb realizimin e EAP-TLS \u00ebsht\u00eb shtuar mb\u00ebshtetje p\u00ebr TLS 1.3 (e \u00e7aktivizuar nga e drejta).\n
Shtohen cil\u00ebsime t\u00eb reja (max_auth_rounds, max_auth_rounds_short) p\u00ebr t\u00eb ndryshuar kufijt\u00eb e numrit t\u00eb mesazheve EAP gjat\u00eb procesit t\u00eb autentifikimit (ndryshimi i kufijve mund t\u00eb k\u00ebrkohet kur p\u00ebrdoren certifikata shum\u00eb t\u00eb m\u00ebdha).\n
Shtuar mb\u00ebshtetje p\u00ebr mekanizmin PASN (Pre Association Security Negotiation) p\u00ebr t\u00eb vendosur nj\u00eb lidhje t\u00eb sigurt dhe p\u00ebr t\u00eb mbrojtur k\u00ebmbimet e t\u00eb dh\u00ebnave menaxheriale n\u00eb nj\u00eb stad t\u00eb m\u00ebparsh\u00ebm t\u00eb lidhjes.\n
Implementuar mekanizmi Transition Disable, i cili automatikisht \u00e7on n\u00eb disaktivan e modit t\u00eb roaming-ut p\u00ebr t\u00eb rritur sigurin\u00eb, duke lejuar kalimin nd\u00ebrmjet pikave t\u00eb aksesit sipas l\u00ebvizjes.\n
M\u00ebnyrat p\u00ebr default p\u00ebrjashtuan mb\u00ebshtetje p\u00ebr protokollin WEP (p\u00ebr t\u00eb rikthyer mb\u00ebshtetje p\u00ebr WEP k\u00ebrkohet ri-nd\u00ebrtimi me opsionin CONFIG_WEP=y). Funksionaliteti i vjetruar q\u00eb lidhet me protokollin IAPP (Inter-Access Point Protocol) \u00ebsht\u00eb eliminuar. Mb\u00ebshtetje p\u00ebr libnl 1.1 \u00ebsht\u00eb ndalur. Shtuar opsioni i nd\u00ebrtimit CONFIG_NO_TKIP=y p\u00ebr nd\u00ebrtim pa mb\u00ebshtetje p\u00ebr TKIP.\n
Eliminuar vulnerabilitetet n\u00eb implementimin e UPnP (CVE-2020-12695), n\u00eb menaxhuesin P2P\/Wi-Fi Direct (CVE-2021-27803) dhe mekanizmin e mbrojtjes PMF (CVE-2019-16275).\n
Nga ndryshimet specifike p\u00ebr hostapd, mund t\u00eb theksohet zgjerimi i mb\u00ebshtetjes p\u00ebr rrjetet wireless HEW (High-Efficiency Wireless, IEEE 802.11ax), duke p\u00ebrfshir\u00eb mund\u00ebsin\u00eb e p\u00ebrdorimit t\u00eb gam\u00ebs frekuencave 6 GHz.\n
P\u00ebrmir\u00ebsuar parashikimi i kapacitetit dhe zgjedhjes BSS.\n
Zgjeruar nd\u00ebrfaqja e menaxhimit p\u00ebrmes D-Bus.\n
Shtuar nj\u00eb backend t\u00eb ri p\u00ebr ruajtjen e fjal\u00ebkalimeve n\u00eb nj\u00eb skedar t\u00eb ve\u00e7ant\u00eb, duke lejuar nxjerrjen e informacionit t\u00eb ndjesh\u00ebm nga skedari kryesor i konfigurimit.\n
Shtuar politika t\u00eb reja p\u00ebr SCS, MSCS dhe DSCP. <\/ul>\n<\/ul>\n