pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/net/wpa_supplicant
Module Name: pkgsrc
Committed By: maya
Date: Mon Nov 2 18:23:57 UTC 2026
Modified Files:
pkgsrc/net/wpa_supplicant: Makefile distinfo
pkgsrc/net/wpa_supplicant/patches: patch-aa
Removed Files:
pkgsrc/net/wpa_supplicant/patches: patch-src_ap_ieee802__11.c
patch-src_ap_wpa__auth.c patch-src_ap_wpa__auth.h
patch-src_ap_wpa__auth__ft.c patch-src_ap_wpa__auth__i.h
patch-src_common_wpa__common.h patch-src_rsn__supp_tdls.c
patch-src_rsn__supp_wpa.c patch-src_rsn__supp_wpa__ft.c
patch-src_rsn__supp_wpa__i.h patch-wpa__supplicant_wnm__sta.c
Log Message:
wpa_supplicant: Update to 2.12. ok reed@
Remove upstream patch to fix security issue.
2026-08-07 - v2.12
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* improve BSS transition management support
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
* support Wi-Fi Direct R2
* support Wi-Fi Aware (add synchronized NAN; extend USD support)
* support Proximity Ranging
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
- IEEE 802.1X/EAP in Authentication frames
- Association frame encryption
- PMKID privacy
* enable layer 2/Wi-Fi multicast filtering for all networks (not
just some Passpoint networks which enabled this before)
* wpa_gui: port to Qt6
* support OpenSSL 3.0 API changes
* EAP-TEAP: protocol changes based on RFC 9930; this is not compatible
with previous versions
* maintain configuration file permissions when writing updated
configuration
* add option to validate PKCS#11/OpenSC engine and module paths
* fix PMKSA caching to enforce network context to avoid misuse of
unexpected PMKSA cache entries
* fix a potential DoS attack in SAE processing of an unexpected element
* fix incomplete bounds checking of mesh AMPE messages that could have
resulted in DoS attacks and memory corruption
* a large number of other fixes, cleanup, and extensions
2024-07-20 - v2.11
* Wi-Fi Easy Connect
- add support for DPP release 3
- allow Configurator parameters to be provided during config exchange
* MACsec
- add support for GCM-AES-256 cipher suite
- remove incorrect EAP Session-Id length constraint
- add hardware offload support for additional drivers
* HE/IEEE 802.11ax/Wi-Fi 6
- support BSS color updates
- various fixes
* EHT/IEEE 802.11be/Wi-Fi 7
- add preliminary support
* support OpenSSL 3.0 API changes
* improve EAP-TLS support for TLSv1.3
* EAP-SIM/AKA: support IMSI privacy
* improve mitigation against DoS attacks when PMF is used
* improve 4-way handshake operations
- discard unencrypted EAPOL frames in additional cases
- use Secure=1 in message 2 during PTK rekeying
* OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases
to avoid interoperability issues
* support new SAE AKM suites with variable length keys
* support new AKM for 802.1X/EAP with SHA384
* improve cross-AKM roaming with driver-based SME/BSS selection
* PASN
- extend support for secure ranging
- allow PASN implementation to be used with external programs for
Wi-Fi Aware
* FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
- this is based on additional details being added in the IEEE 802.11
standard
- the new implementation is not backwards compatible, but PMKSA
caching with FT-EAP was, and still is, disabled by default
* support a pregenerated MAC (mac_addr=3) as an alternative mechanism
for using per-network random MAC addresses
* EAP-PEAP: require Phase 2 authentication by default (phase2_auth=1)
to improve security for still unfortunately common invalid
configurations that do not set ca_cert
* extend SCS support for QoS Characteristics
* extend MSCS support
* support unsynchronized service discovery (USD)
* add support for explicit SSID protection in 4-way handshake
(a mitigation for CVE-2023-52424; disabled by default for now, can be
enabled with ssid_protection=1)
- in addition, verify SSID after key setup when beacon protection is
used
* fix SAE H2E rejected groups validation to avoid downgrade attacks
* a large number of other fixes, cleanup, and extensions
2022-01-16 - v2.10
* SAE changes
- improved protection against side channel attacks
[https://w1.fi/security/2022-1/]
- added support for the hash-to-element mechanism (sae_pwe=1 or
sae_pwe=2); this is currently disabled by default, but will likely
get enabled by default in the future
- fixed PMKSA caching with OKC
- added support for SAE-PK
* EAP-pwd changes
- improved protection against side channel attacks
[https://w1.fi/security/2022-1/]
* fixed P2P provision discovery processing of a specially constructed
invalid frame
[https://w1.fi/security/2021-1/]
* fixed P2P group information processing of a specially constructed
invalid frame
[https://w1.fi/security/2020-2/]
* fixed PMF disconnection protection bypass in AP mode
[https://w1.fi/security/2019-7/]
* added support for using OpenSSL 3.0
* increased the maximum number of EAP message exchanges (mainly to
support cases with very large certificates)
* fixed various issues in experimental support for EAP-TEAP peer
* added support for DPP release 2 (Wi-Fi Device Provisioning Protocol)
* a number of MKA/MACsec fixes and extensions
* added support for SAE (WPA3-Personal) AP mode configuration
* added P2P support for EDMG (IEEE 802.11ay) channels
* fixed EAP-FAST peer with TLS GCM/CCM ciphers
* improved throughput estimation and BSS selection
* dropped support for libnl 1.1
* added support for nl80211 control port for EAPOL frame TX/RX
* fixed OWE key derivation with groups 20 and 21; this breaks backwards
compatibility for these groups while the default group 19 remains
backwards compatible
* added support for Beacon protection
* added support for Extended Key ID for pairwise keys
* removed WEP support from the default build (CONFIG_WEP=y can be used
to enable it, if really needed)
* added a build option to remove TKIP support (CONFIG_NO_TKIP=y)
* added support for Transition Disable mechanism to allow the AP to
automatically disable transition mode to improve security
* extended D-Bus interface
* added support for PASN
* added a file-based backend for external password storage to allow
secret information to be moved away from the main configuration file
without requiring external tools
* added EAP-TLS peer support for TLS 1.3 (disabled by default for now)
* added support for SCS, MSCS, DSCP policy
* changed driver interface selection to default to automatic fallback
to other compiled in options
* a large number of other fixes, cleanup, and extensions
2019-08-07 - v2.9
* SAE changes
- disable use of groups using Brainpool curves
- improved protection against side channel attacks
[https://w1.fi/security/2019-6/]
* EAP-pwd changes
- disable use of groups using Brainpool curves
- allow the set of groups to be configured (eap_pwd_groups)
- improved protection against side channel attacks
[https://w1.fi/security/2019-6/]
* fixed FT-EAP initial mobility domain association using PMKSA caching
(disabled by default for backwards compatibility; can be enabled
with ft_eap_pmksa_caching=1)
* fixed a regression in OpenSSL 1.1+ engine loading
* added validation of RSNE in (Re)Association Response frames
* fixed DPP bootstrapping URI parser of channel list
* extended EAP-SIM/AKA fast re-authentication to allow use with FILS
* extended ca_cert_blob to support PEM format
* improved robustness of P2P Action frame scheduling
* added support for EAP-SIM/AKA using anonymous@realm identity
* fixed Hotspot 2.0 credential selection based on roaming consortium
to ignore credentials without a specific EAP method
* added experimental support for EAP-TEAP peer (RFC 7170)
* added experimental support for EAP-TLS peer with TLS v1.3
* fixed a regression in WMM parameter configuration for a TDLS peer
* fixed a regression in operation with drivers that offload 802.1X
4-way handshake
* fixed an ECDH operation corner case with OpenSSL
2019-04-21 - v2.8
* SAE changes
- added support for SAE Password Identifier
- changed default configuration to enable only groups 19, 20, 21
(i.e., disable groups 25 and 26) and disable all unsuitable groups
completely based on REVmd changes
- do not regenerate PWE unnecessarily when the AP uses the
anti-clogging token mechanisms
- fixed some association cases where both SAE and FT-SAE were enabled
on both the station and the selected AP
- started to prefer FT-SAE over SAE AKM if both are enabled
- started to prefer FT-SAE over FT-PSK if both are enabled
- fixed FT-SAE when SAE PMKSA caching is used
- reject use of unsuitable groups based on new implementation guidance
in REVmd (allow only FFC groups with prime >= 3072 bits and ECC
groups with prime >= 256)
- minimize timing and memory use differences in PWE derivation
[https://w1.fi/security/2019-1/] (CVE-2019-9494)
* EAP-pwd changes
- minimize timing and memory use differences in PWE derivation
[https://w1.fi/security/2019-2/] (CVE-2019-9495)
- verify server scalar/element
[https://w1.fi/security/2019-4/] (CVE-2019-9499)
- fix message reassembly issue with unexpected fragment
[https://w1.fi/security/2019-5/]
- enforce rand,mask generation rules more strictly
- fix a memory leak in PWE derivation
- disallow ECC groups with a prime under 256 bits (groups 25, 26, and
27)
* fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
* Hotspot 2.0 changes
- do not indicate release number that is higher than the one
AP supports
- added support for release number 3
- enable PMF automatically for network profiles created from
credentials
* fixed OWE network profile saving
* fixed DPP network profile saving
* added support for RSN operating channel validation
(CONFIG_OCV=y and network profile parameter ocv=1)
* added Multi-AP backhaul STA support
* fixed build with LibreSSL
* number of MKA/MACsec fixes and extensions
* extended domain_match and domain_suffix_match to allow list of values
* fixed dNSName matching in domain_match and domain_suffix_match when
using wolfSSL
* started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both
are enabled
* extended nl80211 Connect and external authentication to support
SAE, FT-SAE, FT-EAP-SHA384
* fixed KEK2 derivation for FILS+FT
* extended client_cert file to allow loading of a chain of PEM
encoded certificates
* extended beacon reporting functionality
* extended D-Bus interface with number of new properties
* fixed a regression in FT-over-DS with mac80211-based drivers
* OpenSSL: allow systemwide policies to be overridden
* extended driver flags indication for separate 802.1X and PSK
4-way handshake offload capability
* added support for random P2P Device/Interface Address use
* extended PEAP to derive EMSK to enable use with ERP/FILS
* extended WPS to allow SAE configuration to be added automatically
for PSK (wps_cred_add_sae=1)
* removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)
* extended domain_match and domain_suffix_match to allow list of values
* added a RSN workaround for misbehaving PMF APs that advertise
IGTK/BIP KeyID using incorrect byte order
* fixed PTK rekeying with FILS and FT
2018-12-02 - v2.7
* fixed WPA packet number reuse with replayed messages and key
reinstallation
[https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078,
CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082,
CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)
* fixed unauthenticated EAPOL-Key decryption in wpa_supplicant
[https://w1.fi/security/2018-1/] (CVE-2018-14526)
* added support for FILS (IEEE 802.11ai) shared key authentication
* added support for OWE (Opportunistic Wireless Encryption, RFC 8110;
and transition mode defined by WFA)
* added support for DPP (Wi-Fi Device Provisioning Protocol)
* added support for RSA 3k key case with Suite B 192-bit level
* fixed Suite B PMKSA caching not to update PMKID during each 4-way
handshake
* fixed EAP-pwd pre-processing with PasswordHashHash
* added EAP-pwd client support for salted passwords
* fixed a regression in TDLS prohibited bit validation
* started to use estimated throughput to avoid undesired signal
strength based roaming decision
* MACsec/MKA:
- new macsec_linux driver interface support for the Linux
kernel macsec module
- number of fixes and extensions
* added support for external persistent storage of PMKSA cache
(PMKSA_GET/PMKSA_ADD control interface commands; and
MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case)
* fixed mesh channel configuration pri/sec switch case
* added support for beacon report
* large number of other fixes, cleanup, and extensions
* added support for randomizing local address for GAS queries
(gas_rand_mac_addr parameter)
* fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel
* added option for using random WPS UUID (auto_uuid=1)
* added SHA256-hash support for OCSP certificate matching
* fixed EAP-AKA' to add AT_KDF into Synchronization-Failure
* fixed a regression in RSN pre-authentication candidate selection
* added option to configure allowed group management cipher suites
(group_mgmt network profile parameter)
* removed all PeerKey functionality
* fixed nl80211 AP and mesh mode configuration regression with
Linux 4.15 and newer
* added ap_isolate configuration option for AP mode
* added support for nl80211 to offload 4-way handshake into the driver
* added support for using wolfSSL cryptographic library
* SAE
- added support for configuring SAE password separately of the
WPA2 PSK/passphrase
- fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection
for SAE;
note: this is not backwards compatible, i.e., both the AP and
station side implementations will need to be update at the same
time to maintain interoperability
- added support for Password Identifier
- fixed FT-SAE PMKID matching
* Hotspot 2.0
- added support for fetching of Operator Icon Metadata ANQP-element
- added support for Roaming Consortium Selection element
- added support for Terms and Conditions
- added support for OSEN connection in a shared RSN BSS
- added support for fetching Venue URL information
* added support for using OpenSSL 1.1.1
* FT
- disabled PMKSA caching with FT since it is not fully functional
- added support for SHA384 based AKM
- added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128,
BIP-GMAC-256 in addition to previously supported BIP-CMAC-128
- fixed additional IE inclusion in Reassociation Request frame when
using FT protocol
To generate a diff of this commit:
cvs rdiff -u -r1.21 -r1.22 pkgsrc/net/wpa_supplicant/Makefile
cvs rdiff -u -r1.12 -r1.13 pkgsrc/net/wpa_supplicant/distinfo
cvs rdiff -u -r1.4 -r1.5 pkgsrc/net/wpa_supplicant/patches/patch-aa
cvs rdiff -u -r1.1 -r0 \
pkgsrc/net/wpa_supplicant/patches/patch-src_ap_ieee802__11.c \
pkgsrc/net/wpa_supplicant/patches/patch-src_ap_wpa__auth.c \
pkgsrc/net/wpa_supplicant/patches/patch-src_ap_wpa__auth.h \
pkgsrc/net/wpa_supplicant/patches/patch-src_ap_wpa__auth__ft.c \
pkgsrc/net/wpa_supplicant/patches/patch-src_ap_wpa__auth__i.h \
pkgsrc/net/wpa_supplicant/patches/patch-src_common_wpa__common.h \
pkgsrc/net/wpa_supplicant/patches/patch-src_rsn__supp_tdls.c \
pkgsrc/net/wpa_supplicant/patches/patch-src_rsn__supp_wpa.c \
pkgsrc/net/wpa_supplicant/patches/patch-src_rsn__supp_wpa__ft.c \
pkgsrc/net/wpa_supplicant/patches/patch-src_rsn__supp_wpa__i.h \
pkgsrc/net/wpa_supplicant/patches/patch-wpa__supplicant_wnm__sta.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/net/wpa_supplicant/Makefile
diff -u pkgsrc/net/wpa_supplicant/Makefile:1.21 pkgsrc/net/wpa_supplicant/Makefile:1.22
--- pkgsrc/net/wpa_supplicant/Makefile:1.21 Tue Oct 24 22:10:38 2023
+++ pkgsrc/net/wpa_supplicant/Makefile Mon Nov 2 18:23:56 2026
@@ -1,13 +1,12 @@
-# $NetBSD: Makefile,v 1.21 2023/10/24 22:10:38 wiz Exp $
+# $NetBSD: Makefile,v 1.22 2026/11/02 18:23:56 maya Exp $
#
-DISTNAME= wpa_supplicant-2.6
-PKGREVISION= 3
+DISTNAME= wpa_supplicant-2.12
CATEGORIES= net
-MASTER_SITES= http://hostap.epitest.fi/releases/
+MASTER_SITES= http://w1.fi/releases/
MAINTAINER= reed%reedmedia.net@localhost
-HOMEPAGE= https://hostap.epitest.fi/wpa_supplicant/
+HOMEPAGE= https://w1.fi/wpa_supplicant/
COMMENT= Wireless connection client daemon for WPA, WPA2, and WEP
LICENSE= modified-bsd
Index: pkgsrc/net/wpa_supplicant/distinfo
diff -u pkgsrc/net/wpa_supplicant/distinfo:1.12 pkgsrc/net/wpa_supplicant/distinfo:1.13
--- pkgsrc/net/wpa_supplicant/distinfo:1.12 Tue Oct 26 11:07:12 2021
+++ pkgsrc/net/wpa_supplicant/distinfo Mon Nov 2 18:23:56 2026
@@ -1,17 +1,6 @@
-$NetBSD: distinfo,v 1.12 2021/10/26 11:07:12 nia Exp $
+$NetBSD: distinfo,v 1.13 2026/11/02 18:23:56 maya Exp $
-BLAKE2s (wpa_supplicant-2.6.tar.gz) = bdeb2a8215ebac396d722ce37908fd90b3eb5eff3b1302d1bbcba2d71a0960c2
-SHA512 (wpa_supplicant-2.6.tar.gz) = 46442cddb6ca043b8b08d143908f149954c238e0f3a57a0df73ca4fab9c1acd91b078f3f26375a1d99cd1d65625986328018c735d8705882c8f91e389cad28a6
-Size (wpa_supplicant-2.6.tar.gz) = 2753524 bytes
-SHA1 (patch-aa) = 998ba9cc4ef9ebd0b629a6368957da0f1159dda0
-SHA1 (patch-src_ap_ieee802__11.c) = 8edce32847c55e0ac49b395b2aa5f370c6055bd5
-SHA1 (patch-src_ap_wpa__auth.c) = 2631770dfe42fba748ab4be4174998fff30e1f24
-SHA1 (patch-src_ap_wpa__auth.h) = 8e44f75449e656a710747a8cd581ff9d05c5eff6
-SHA1 (patch-src_ap_wpa__auth__ft.c) = ed4a15b05c46bb88ce9bf597c65088311fa47852
-SHA1 (patch-src_ap_wpa__auth__i.h) = f33a5214d0c8071f7eed9dd5fd67b6b32f0e856c
-SHA1 (patch-src_common_wpa__common.h) = 853adbcf1749d7ccd80feeb4aa6aa8ba8ac0a7e8
-SHA1 (patch-src_rsn__supp_tdls.c) = b695b8096661894e8e473ccb09386c33a8353a45
-SHA1 (patch-src_rsn__supp_wpa.c) = 4a4d966e68481eef76e7323e3d69c4c5bf8e6432
-SHA1 (patch-src_rsn__supp_wpa__ft.c) = c48b83ee5e10289d21ac3310ab92684dc69bdced
-SHA1 (patch-src_rsn__supp_wpa__i.h) = f2c9260cf6bdf59493f9870fbedc0d4e0881b641
-SHA1 (patch-wpa__supplicant_wnm__sta.c) = 818b9fcabeac9d3c6ced075a5a804b34c0d56774
+BLAKE2s (wpa_supplicant-2.12.tar.gz) = d7135cc3cb5cb5d8347217ec88660812434693ff9ad4718e3e1a158854a88df0
+SHA512 (wpa_supplicant-2.12.tar.gz) = 5e996323fea2a5f6fefe4f2456481b9e8409adb5bf1d7a72d4489f3db2e3a968d6d9fe5cc0959b820f5b18faa330adb1245da98aad49631009609fbd0f447901
+Size (wpa_supplicant-2.12.tar.gz) = 4247413 bytes
+SHA1 (patch-aa) = af6f9d11fb1f6180fd17af682af7a6d52e5611b2
Index: pkgsrc/net/wpa_supplicant/patches/patch-aa
diff -u pkgsrc/net/wpa_supplicant/patches/patch-aa:1.4 pkgsrc/net/wpa_supplicant/patches/patch-aa:1.5
--- pkgsrc/net/wpa_supplicant/patches/patch-aa:1.4 Sun Mar 24 14:17:31 2013
+++ pkgsrc/net/wpa_supplicant/patches/patch-aa Mon Nov 2 18:23:56 2026
@@ -1,10 +1,10 @@
-$NetBSD: patch-aa,v 1.4 2013/03/24 14:17:31 rodent Exp $
+$NetBSD: patch-aa,v 1.5 2026/11/02 18:23:56 maya Exp $
Add NetBSD support.
---- src/l2_packet/l2_packet_freebsd.c.orig 2010-09-07 15:43:39.000000000 +0000
+--- src/l2_packet/l2_packet_freebsd.c.orig 2026-08-07 13:10:53.000000000 +0000
+++ src/l2_packet/l2_packet_freebsd.c
-@@ -14,9 +14,12 @@
+@@ -8,9 +8,12 @@
*/
#include "includes.h"
@@ -18,3 +18,13 @@ Add NetBSD support.
#include <pcap.h>
#include <sys/ioctl.h>
+@@ -20,7 +23,9 @@
+ #include <sys/sysctl.h>
+ #endif /* __sun__ */
+
++#if __has_include("net/ethernet.h")
+ #include <net/ethernet.h>
++#endif
+ #include <net/if.h>
+ #include <net/if_dl.h>
+ #include <net/route.h>
Home |
Main Index |
Thread Index |
Old Index