git: 28460afd5dd5 - main - security/wpa_supplicant: Update to 2.12
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 10 Aug 2026 15:38:03 UTC
The branch main has been updated by cy:
URL: https://cgit.FreeBSD.org/ports/commit/?id=28460afd5dd59ec072e978783bfc3ef92bca9f28
commit 28460afd5dd59ec072e978783bfc3ef92bca9f28
Author: Cy Schubert <cy@FreeBSD.org>
AuthorDate: 2026-08-10 15:26:44 +0000
Commit: Cy Schubert <cy@FreeBSD.org>
CommitDate: 2026-08-10 15:37:54 +0000
security/wpa_supplicant: Update to 2.12
This includes the following changes:
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* improve BSS transition management support
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
* support Wi-Fi Direct R2
* support Wi-Fi Aware (add synchronized NAN; extend USD support)
* support Proximity Ranging
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
- IEEE 802.1X/EAP in Authentication frames
- Association frame encryption
- PMKID privacy
* enable layer 2/Wi-Fi multicast filtering for all networks (not
just some Passpoint networks which enabled this before)
* wpa_gui: port to Qt6
* support OpenSSL 3.0 API changes
* EAP-TEAP: protocol changes based on RFC 9930; this is not compatible
with previous versions
* maintain configuration file permissions when writing updated
configuration
* add option to validate PKCS#11/OpenSC engine and module paths
* fix PMKSA caching to enforce network context to avoid misuse of
unexpected PMKSA cache entries
* fix a potential DoS attack in SAE processing of an unexpected element
* fix incomplete bounds checking of mesh AMPE messages that could have
resulted in DoS attacks and memory corruption
* a large number of other fixes, cleanup, and extensions
---
security/wpa_supplicant/Makefile | 59 ++++++++++++----------
security/wpa_supplicant/distinfo | 6 +--
.../files/patch-src_utils_os__unix.c | 20 ++++----
.../files/patch-wpa__supplicant_main.c | 24 +++------
4 files changed, 53 insertions(+), 56 deletions(-)
diff --git a/security/wpa_supplicant/Makefile b/security/wpa_supplicant/Makefile
index ec6d4fd694dc..1de61895073a 100644
--- a/security/wpa_supplicant/Makefile
+++ b/security/wpa_supplicant/Makefile
@@ -1,6 +1,5 @@
PORTNAME= wpa_supplicant
-PORTVERSION= 2.11
-PORTREVISION= 7
+PORTVERSION= 2.12
CATEGORIES= security net
MASTER_SITES= https://w1.fi/releases/
@@ -16,7 +15,9 @@ CPE_VENDOR= w1.fi
USE_LDCONFIG= yes
BUILD_WRKSRC= ${WRKSRC}/wpa_supplicant
INSTALL_WRKSRC= ${WRKSRC}/src
+CPPFLAGS+= -Wno-incompatible-function-pointer-types
CFLAGS+= ${CPPFLAGS} # USES=readline only augments CPPFLAGS and LDFLAGS
+CFLAGS+= -Wno-undefined-internal
CFLAGS+= -I${OPENSSLINC}
CFLAGS+= -Wno-deprecated-declarations
LDFLAGS+= -L${OPENSSLLIB} -lutil
@@ -39,15 +40,16 @@ OPTIONS_DEFINE= WPS WPS_ER WPS_NOREG WPS_NFC WPS_UPNP PKCS12 SMARTCARD \
HT_OVERRIDES VHT_OVERRIDES TLSV12 IEEE80211W \
IEEE80211R DEBUG_FILE DEBUG_SYSLOG PRIVSEP \
DELAYED_MIC IEEE80211N IEEE80211AC INTERWORKING \
- IEEE8021X_EAPOL EAPOL_TEST IPV6 \
- HS20 NO_ROAMING P2P TDLS DBUS MATCH DOCS \
- SIM_SIMULATOR USIM_SIMULATOR WEP PASN LIBWPA
+ IEEE8021X_EAPOL EAPOL_TEST IPV6 LIBWPA\
+ HS20 NO_ROAMING P2P PASN TDLS DBUS MATCH DOCS \
+ SIM_SIMULATOR USIM_SIMULATOR WNM MBO RSN_PREAUTH WEP
OPTIONS_DEFAULT= BSD WIRED \
TLS PEAP TTLS MD5 MSCHAPV2 GTC LEAP OTP PSK \
WPS PKCS12 SMARTCARD IEEE80211R DEBUG_SYSLOG \
INTERWORKING HS20 DBUS MATCH IEEE80211R IEEE80211W \
IEEE8021X_EAPOL WPS_ER WPS_NFC WPS_UPNP \
- FAST PWD PAX SAKE GPSK TNC IKEV2 EKE WEP PASN LIBWPA IPV6
+ FAST PWD PAX SAKE GPSK TNC IKEV2 EKE \
+ WNM MBO RSN_PREAUTH WEP PASN IPV6 LIBWPA
OPTIONS_SUB=
WPS_DESC= Wi-Fi Protected Setup
@@ -75,6 +77,7 @@ INTERWORKING_DESC= Improve ext. network interworking (IEEE 802.11u)
HS20_DESC= Hotspot 2.0
NO_ROAMING_DESC= Disable roaming
P2P_DESC= Peer-to-Peer support
+PASN_DESC= Pre-Association Security Negotiation
TDLS_DESC= Tunneled Direct Link Setup
MATCH_DESC= Interface match mode
@@ -110,24 +113,23 @@ PAX_DESC= Password Authenticated Exchange
SAKE_DESC= Shared-Secret Authentication & Key Establishment
GPSK_DESC= Generalized Pre-Shared Key
TNC_DESC= Trusted Network Connect
-PASN_DESC= Pre-Association Security Negotiation
+WNM_DESC= Wireless Network Monitoring
+MBO_DESC= Multi Band Operation (Enables WNM)
+RSN_PREAUTH= RSN Preauthentication
LIBWPA_DESC= libwpa_client Shared Library
PRIVSEP_PLIST_FILES= sbin/wpa_priv
DBUS_PLIST_FILES= share/dbus-1/system-services/fi.w1.wpa_supplicant1.service \
etc/dbus-1/system.d/dbus-wpa_supplicant.conf
-LIBWPA_PLIST_FILES= lib/libwpa_client.so \
- lib/libwpa_client.so.2 \
- include/wpa_ctrl.h
.include <bsd.port.pre.mk>
-.if ${PORT_OPTIONS:MNDIS} && ${PORT_OPTIONS:MPRIVSEP}
-BROKEN= Fails to compile with both NDIS and PRIVSEP
+.if ! ${PORT_OPTIONS:MPASN}
+BROKEN= PASN is now a hard requirement
.endif
-.if ${PORT_OPTIONS:MIEEE80211AC} && ${PORT_OPTIONS:MIEEE80211N}
-BROKEN= Fails to compile with both IEEE80211AC and IEEE80211N
+.if ${PORT_OPTIONS:MNDIS} && ${PORT_OPTIONS:MPRIVSEP}
+BROKEN= Fails to compile with both NDIS and PRIVSEP
.endif
.if ${PORT_OPTIONS:MSIM} || ${PORT_OPTIONS:MAKA} || ${PORT_OPTIONS:MAKA_PRIME}
@@ -144,6 +146,9 @@ post-patch:
@${CP} ${FILESDIR}/Packet32.[ch] ${FILESDIR}/ntddndis.h \
${WRKSRC}/src/utils
# Set driver(s)
+ # SAE and ENC_ASSOC are always required.
+ @${ECHO_CMD} CONFIG_SAE=y >> ${CFG}
+ @${ECHO_CMD} CONFIG_ENC_ASSOC=y >> ${CFG}
.for item in BSD NDIS WIRED ROBOSWITCH TEST NONE
. if ${PORT_OPTIONS:M${item}}
@${ECHO_CMD} CONFIG_DRIVER_${item}=y >> ${CFG}
@@ -159,13 +164,23 @@ post-patch:
.if ${PORT_OPTIONS:MSIM} || ${PORT_OPTIONS:MAKA} || ${PORT_OPTIONS:MAKA_PRIME}
@${ECHO_CMD} CONFIG_PCSC=y >> ${CFG}
.endif
+.if ${PORT_OPTIONS:MMBO}
+ @${ECHO_CMD} CONFIG_WNM=y >> ${CFG}
+.endif
.for simple in WPS WPS_ER WPS_NFC WPS_UPNP PKCS12 SMARTCARD HT_OVERRIDES \
VHT_OVERRIDES TLSV12 IEEE80211AC IEEE80211N IEEE80211R IEEE80211W \
- IEEE8021X_EAPOL EAPOL_TEST IPV6\
- INTERWORKING DEBUG_FILE DEBUG_SYSLOG HS20 NO_ROAMING PRIVSEP P2P TDLS \
- PASN
+ IEEE8021X_EAPOL EAPOL_TEST IPV6 \
+ INTERWORKING DEBUG_FILE DEBUG_SYSLOG HS20 NO_ROAMING PRIVSEP P2P \
+ PASN TDLS WNM MBO RSN_PREAUTH
. if ${PORT_OPTIONS:M${simple}}
@${ECHO_CMD} CONFIG_${simple}=y >> ${CFG}
+. if ${simple} == "IEEE80211N"
+ @${ECHO_CMD} CONFIG_IEEE80211BE=y >> ${CFG}
+ @${ECHO_CMD} CONFIG_IEEE80211AX=y >> ${CFG}
+ @${ECHO_CMD} CONFIG_IEEE80211AC=y >> ${CFG}
+ @${ECHO_CMD} CONFIG_AP=y >> ${CFG}
+ @${ECHO_CMD} NEED_AP_MLME=y >> ${CFG}
+. endif
. endif
.endfor
.for item in READLINE PEERKEY
@@ -196,9 +211,6 @@ post-patch:
.endif
.if ${PORT_OPTIONS:MSIM_SIMULATOR}
@${ECHO_CMD} CONFIG_SIM_SIMULATOR=y >> ${CFG}
-.endif
-.if ${PORT_OPTIONS:MLIBWPA}
- @${ECHO_CMD} CONFIG_BUILD_WPA_CLIENT_SO=y >> ${CFG}
.endif
@${ECHO_CMD} CONFIG_OS=unix >> ${CFG}
@${ECHO_CMD} CONFIG_CTRL_IFACE=unix >> ${CFG}
@@ -234,11 +246,4 @@ do-install-DBUS-on:
${INSTALL_DATA} ${BUILD_WRKSRC}/dbus/dbus-wpa_supplicant.conf \
${STAGEDIR}${PREFIX}/etc/dbus-1/system.d/
-do-install-LIBWPA-on:
- ${INSTALL_LIB} ${BUILD_WRKSRC}/libwpa_client.so \
- ${STAGEDIR}${PREFIX}/lib/libwpa_client.so.2
- ${LN} -s libwpa_client.so.2 ${STAGEDIR}${PREFIX}/lib/libwpa_client.so
- ${INSTALL_DATA} ${INSTALL_WRKSRC}/common/wpa_ctrl.h \
- ${STAGEDIR}${PREFIX}/include
-
.include <bsd.port.post.mk>
diff --git a/security/wpa_supplicant/distinfo b/security/wpa_supplicant/distinfo
index dbb8c846cb3b..249b2a0e03d6 100644
--- a/security/wpa_supplicant/distinfo
+++ b/security/wpa_supplicant/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1721563533
-SHA256 (wpa_supplicant-2.11.tar.gz) = 912ea06f74e30a8e36fbb68064d6cdff218d8d591db0fc5d75dee6c81ac7fc0a
-SIZE (wpa_supplicant-2.11.tar.gz) = 3841433
+TIMESTAMP = 1786259259
+SHA256 (wpa_supplicant-2.12.tar.gz) = 08e23937e16d0155e55cab2b51f51fbe10d80a1aa91c4e15442645059b737ef6
+SIZE (wpa_supplicant-2.12.tar.gz) = 4247413
diff --git a/security/wpa_supplicant/files/patch-src_utils_os__unix.c b/security/wpa_supplicant/files/patch-src_utils_os__unix.c
index 3feccd7f0b28..be7cf80db233 100644
--- a/security/wpa_supplicant/files/patch-src_utils_os__unix.c
+++ b/security/wpa_supplicant/files/patch-src_utils_os__unix.c
@@ -1,14 +1,16 @@
---- src/utils/os_unix.c.orig 2024-07-20 18:04:37 UTC
-+++ src/utils/os_unix.c
-@@ -103,9 +103,11 @@ int os_get_reltime(struct os_reltime *t)
- break;
+--- src/utils/os_unix.c.orig 2026-08-07 06:10:53.000000000 -0700
++++ src/utils/os_unix.c 2026-08-10 07:55:55.825032000 -0700
+@@ -124,11 +124,13 @@
#endif
+
#ifdef CLOCK_MONOTONIC
+#if !(defined(CLOCK_BOOTTIME) && CLOCK_BOOTTIME == CLOCK_MONOTONIC)
- case CLOCK_MONOTONIC:
+ if (clock_id == CLOCK_MONOTONIC) {
clock_id = CLOCK_REALTIME;
- break;
-+#endif
+ continue;
+ }
#endif
- case CLOCK_REALTIME:
- return -1;
++#endif
+
+ /* No additional clockid_t values to fall back to */
+ return -1;
diff --git a/security/wpa_supplicant/files/patch-wpa__supplicant_main.c b/security/wpa_supplicant/files/patch-wpa__supplicant_main.c
index f9db90635a4c..cc1a8a0aeadb 100644
--- a/security/wpa_supplicant/files/patch-wpa__supplicant_main.c
+++ b/security/wpa_supplicant/files/patch-wpa__supplicant_main.c
@@ -1,6 +1,6 @@
---- wpa_supplicant/main.c.orig 2024-07-20 18:04:37 UTC
-+++ wpa_supplicant/main.c
-@@ -67,7 +67,7 @@ static void usage(void)
+--- wpa_supplicant/main.c.orig 2026-08-07 06:10:53.000000000 -0700
++++ wpa_supplicant/main.c 2026-08-10 07:46:07.856385000 -0700
+@@ -70,7 +70,7 @@
" -c = Configuration file\n"
" -C = ctrl_interface parameter (only used if -c is not)\n"
" -d = increase debugging verbosity (-dd even more)\n"
@@ -9,25 +9,15 @@
" -e = entropy file\n"
#ifdef CONFIG_DEBUG_FILE
" -f = log output to debug file instead of stdout\n"
-@@ -106,8 +106,7 @@ static void usage(void)
- " -W = wait for a control interface monitor before starting\n");
-
- printf("example:\n"
-- " wpa_supplicant -D%s -iwlan0 -c/etc/wpa_supplicant.conf\n",
-- wpa_drivers[0] ? wpa_drivers[0]->name : "nl80211");
-+ " wpa_supplicant -Dbsd -iwlan0 -c/etc/wpa_supplicant.conf\n");
- #endif /* CONFIG_NO_STDOUT_DEBUG */
- }
-
-@@ -199,6 +198,11 @@ int main(int argc, char *argv[])
- iface_count = 1;
+@@ -211,6 +211,11 @@
wpa_supplicant_fd_workaround(1);
-+
+
+#ifdef CONFIG_DRIVER_NDIS
+ void driver_ndis_init_ops(void);
+ driver_ndis_init_ops();
+#endif /* CONFIG_DRIVER_NDIS */
-
++
for (;;) {
c = getopt(argc, argv,
+ "b:Bc:C:D:de:f:g:G:hi:I:KLMm:No:O:p:P:qsTtuvWyz:");