git: 3e4c62b92093 - stable/15 - wpa: Update to 2.12
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 13 Oct 2026 19:19:48 UTC
The branch stable/15 has been updated by cy:
URL: https://cgit.FreeBSD.org/src/commit/?id=3e4c62b920933a706213670049b2e5287d553afd
commit 3e4c62b920933a706213670049b2e5287d553afd
Author: Cy Schubert <cy@FreeBSD.org>
AuthorDate: 2026-08-10 14:23:31 +0000
Commit: Cy Schubert <cy@FreeBSD.org>
CommitDate: 2026-10-13 19:19:21 +0000
wpa: Update to 2.12
Fixes and new features include:
hostapd:
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
- fix group key rekeying
* enable SAE group 20 by default if SAE-EXT-KEY is enabled
* reject unexpected SAE password identifier to avoid DoS attack against
a specific STA
* mandate use of SAE H2E when using password identifiers
* assign VLAN when using SAE with PMKSA caching
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
- IEEE 802.1X/EAP in Authentication frames
- Association frame encryption
- PMKID privacy
* remove the driver interface for now obsolete Host AP driver
* remove the driver interface for now obsolete Atheros WEXT interface
* move supported, basic, and Beacon TX rate configuration to be at BSS
level instead of per-radio for all BSSs
* fix various issues in Multiple-BSSID functionality
* support OpenSSL 3.0 API changes
* EAP-TEAP: protocol changes based on RFC 9930; this is not compatible
with previous versions
* support Automated Frequency Coordination (AFC) on the 6 GHz band
* improve GAS/ANQP processing to support larger ANQP responses
* a large number of other fixes, cleanup, and extensions
wpa_supplicant:
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* improve BSS transition management support
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
* support Wi-Fi Direct R2
* support Wi-Fi Aware (add synchronized NAN; extend USD support)
* support Proximity Ranging
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
- IEEE 802.1X/EAP in Authentication frames
- Association frame encryption
- PMKID privacy
* enable layer 2/Wi-Fi multicast filtering for all networks (not
just some Passpoint networks which enabled this before)
* wpa_gui: port to Qt6
* support OpenSSL 3.0 API changes
* EAP-TEAP: protocol changes based on RFC 9930; this is not compatible
with previous versions
* maintain configuration file permissions when writing updated
configuration
* add option to validate PKCS#11/OpenSC engine and module paths
* fix PMKSA caching to enforce network context to avoid misuse of
unexpected PMKSA cache entries
* fix a potential DoS attack in SAE processing of an unexpected element
* fix incomplete bounds checking of mesh AMPE messages that could have
resulted in DoS attacks and memory corruption
* a large number of other fixes, cleanup, and extensions
Merge commit '513264698a892550ba20aeb9da7f360417fdc63b'
(cherry picked from commit 71e72c9e91c4b8007a4292e09669e8b549c29e97)
---
contrib/wpa/Makefile | 10 +
contrib/wpa/README | 2 +-
contrib/wpa/hostapd/Android.mk | 40 +-
contrib/wpa/hostapd/ChangeLog | 30 +
contrib/wpa/hostapd/Makefile | 67 +-
contrib/wpa/hostapd/README | 11 +-
contrib/wpa/hostapd/README-MULTI-AP | 2 +-
contrib/wpa/hostapd/android.config | 3 -
contrib/wpa/hostapd/config_file.c | 734 ++-
contrib/wpa/hostapd/ctrl_iface.c | 1057 +++-
contrib/wpa/hostapd/ctrl_iface.h | 2 +
contrib/wpa/hostapd/defconfig | 34 +-
contrib/wpa/hostapd/eap_register.c | 7 -
contrib/wpa/hostapd/hlr_auc_gw.c | 29 +-
contrib/wpa/hostapd/hostapd.conf | 370 +-
contrib/wpa/hostapd/hostapd_cli.c | 130 +-
contrib/wpa/hostapd/main.c | 96 +-
contrib/wpa/hs20/client/Android.mk | 5 +-
contrib/wpa/hs20/client/Makefile | 5 +-
contrib/wpa/hs20/client/devdetail.xml | 47 -
contrib/wpa/hs20/client/devinfo.xml | 7 -
contrib/wpa/hs20/client/est.c | 742 ---
contrib/wpa/hs20/client/oma_dm_client.c | 1398 -----
contrib/wpa/hs20/client/osu_client.c | 2304 +-------
contrib/wpa/hs20/client/osu_client.h | 97 -
contrib/wpa/hs20/client/spp_client.c | 1003 ----
contrib/wpa/src/ap/Makefile | 6 +
contrib/wpa/src/ap/acs.c | 178 +-
contrib/wpa/src/ap/afc.c | 1123 ++++
contrib/wpa/src/ap/airtime_policy.c | 7 +-
contrib/wpa/src/ap/ap_config.c | 176 +-
contrib/wpa/src/ap/ap_config.h | 168 +-
contrib/wpa/src/ap/ap_drv_ops.c | 238 +-
contrib/wpa/src/ap/ap_drv_ops.h | 40 +-
contrib/wpa/src/ap/ap_mlme.c | 8 +-
contrib/wpa/src/ap/authsrv.c | 116 +-
contrib/wpa/src/ap/beacon.c | 1039 +++-
contrib/wpa/src/ap/ctrl_iface_ap.c | 495 +-
contrib/wpa/src/ap/ctrl_iface_ap.h | 6 +-
contrib/wpa/src/ap/dfs.c | 97 +-
contrib/wpa/src/ap/dfs.h | 2 +-
contrib/wpa/src/ap/dpp_hostapd.c | 56 +-
contrib/wpa/src/ap/drv_callbacks.c | 540 +-
contrib/wpa/src/ap/eap_user_db.c | 2 -
contrib/wpa/src/ap/gas_query_ap.c | 12 +-
contrib/wpa/src/ap/gas_serv.c | 917 +--
contrib/wpa/src/ap/hostapd.c | 1010 +++-
contrib/wpa/src/ap/hostapd.h | 187 +-
contrib/wpa/src/ap/hs20.c | 107 -
contrib/wpa/src/ap/hw_features.c | 328 +-
contrib/wpa/src/ap/hw_features.h | 22 +-
contrib/wpa/src/ap/ieee802_11.c | 3784 +++++++++---
contrib/wpa/src/ap/ieee802_11.h | 78 +-
contrib/wpa/src/ap/ieee802_11_eht.c | 1781 +++++-
contrib/wpa/src/ap/ieee802_11_he.c | 75 +-
contrib/wpa/src/ap/ieee802_11_ht.c | 61 +-
contrib/wpa/src/ap/ieee802_11_shared.c | 105 +-
contrib/wpa/src/ap/ieee802_11_vht.c | 49 +-
contrib/wpa/src/ap/ieee802_1x.c | 196 +-
contrib/wpa/src/ap/ieee802_1x.h | 2 +
contrib/wpa/src/ap/interference.c | 592 ++
contrib/wpa/src/ap/interference.h | 18 +
contrib/wpa/src/ap/nan_usd_ap.c | 64 +-
contrib/wpa/src/ap/nan_usd_ap.h | 7 +-
contrib/wpa/src/ap/neighbor_db.c | 66 +-
contrib/wpa/src/ap/pmksa_cache_auth.c | 30 +-
contrib/wpa/src/ap/pmksa_cache_auth.h | 14 +-
contrib/wpa/src/ap/rrm.c | 7 +-
contrib/wpa/src/ap/sta_info.c | 503 +-
contrib/wpa/src/ap/sta_info.h | 95 +-
contrib/wpa/src/ap/vlan_full.c | 22 +-
contrib/wpa/src/ap/wnm_ap.c | 14 +-
contrib/wpa/src/ap/wpa_auth.c | 1501 ++++-
contrib/wpa/src/ap/wpa_auth.h | 147 +-
contrib/wpa/src/ap/wpa_auth_ft.c | 116 +-
contrib/wpa/src/ap/wpa_auth_glue.c | 349 +-
contrib/wpa/src/ap/wpa_auth_i.h | 13 +
contrib/wpa/src/ap/wpa_auth_ie.c | 698 ++-
contrib/wpa/src/ap/wpa_auth_kay.c | 3 +-
contrib/wpa/src/ap/wps_hostapd.c | 2 +
contrib/wpa/src/build.rules | 3 +
contrib/wpa/src/common/Makefile | 1 +
contrib/wpa/src/common/common_module_tests.c | 15 +-
contrib/wpa/src/common/defs.h | 65 +-
contrib/wpa/src/common/dpp.c | 83 +-
contrib/wpa/src/common/dpp.h | 10 +-
contrib/wpa/src/common/dpp_auth.c | 2 +-
contrib/wpa/src/common/dpp_backup.c | 3 +-
contrib/wpa/src/common/dpp_crypto.c | 1 +
contrib/wpa/src/common/dpp_i.h | 2 +-
contrib/wpa/src/common/dpp_reconfig.c | 2 +-
contrib/wpa/src/common/dpp_tcp.c | 4 +-
contrib/wpa/src/common/gas.c | 6 +
contrib/wpa/src/common/gas_server.c | 14 +-
contrib/wpa/src/common/gas_server.h | 2 +-
contrib/wpa/src/common/hw_features_common.c | 48 +-
contrib/wpa/src/common/hw_features_common.h | 2 +
contrib/wpa/src/common/ieee802_11_common.c | 975 +++-
contrib/wpa/src/common/ieee802_11_common.h | 75 +-
contrib/wpa/src/common/ieee802_11_defs.h | 433 +-
contrib/wpa/src/common/nan.h | 98 -
contrib/wpa/src/common/nan_de.c | 2012 ++++++-
contrib/wpa/src/common/nan_de.h | 193 +-
contrib/wpa/src/common/nan_defs.h | 663 +++
contrib/wpa/src/common/proc_coord.c | 817 +++
contrib/wpa/src/common/proc_coord.h | 139 +
contrib/wpa/src/common/proximity_ranging.c | 2707 +++++++++
contrib/wpa/src/common/proximity_ranging.h | 683 +++
contrib/wpa/src/common/ptksa_cache.c | 27 +-
contrib/wpa/src/common/ptksa_cache.h | 4 +-
contrib/wpa/src/common/qca-vendor.h | 6163 +++++++++++++++++++-
contrib/wpa/src/common/sae.c | 145 +-
contrib/wpa/src/common/sae.h | 21 +-
contrib/wpa/src/common/sae_pk.c | 6 +
contrib/wpa/src/common/version.h | 2 +-
contrib/wpa/src/common/wpa_common.c | 1097 +++-
contrib/wpa/src/common/wpa_common.h | 96 +-
contrib/wpa/src/common/wpa_ctrl.h | 76 +-
contrib/wpa/src/crypto/crypto.h | 2 +-
contrib/wpa/src/crypto/crypto_gnutls.c | 8 -
contrib/wpa/src/crypto/crypto_libtomcrypt.c | 3 -
contrib/wpa/src/crypto/crypto_linux.c | 5 +-
contrib/wpa/src/crypto/crypto_openssl.c | 193 +-
contrib/wpa/src/crypto/crypto_wolfssl.c | 285 +-
contrib/wpa/src/crypto/sha256-prf.c | 2 +-
contrib/wpa/src/crypto/sha256.h | 2 +
contrib/wpa/src/crypto/sha384-prf.c | 2 +-
contrib/wpa/src/crypto/sha384.h | 2 +
contrib/wpa/src/crypto/sha512-prf.c | 2 +-
contrib/wpa/src/crypto/tls_gnutls.c | 20 +-
contrib/wpa/src/crypto/tls_openssl.c | 536 +-
contrib/wpa/src/crypto/tls_wolfssl.c | 668 ++-
contrib/wpa/src/drivers/driver.h | 1203 +++-
contrib/wpa/src/drivers/driver_atheros.c | 2286 --------
contrib/wpa/src/drivers/driver_bsd.c | 8 +-
contrib/wpa/src/drivers/driver_common.c | 26 +
contrib/wpa/src/drivers/driver_hostap.c | 1208 ----
contrib/wpa/src/drivers/driver_hostap.h | 208 -
contrib/wpa/src/drivers/driver_macsec_linux.c | 11 +-
contrib/wpa/src/drivers/driver_ndis.c | 3 +
contrib/wpa/src/drivers/driver_nl80211.c | 4850 +++++++++++----
contrib/wpa/src/drivers/driver_nl80211.h | 116 +-
contrib/wpa/src/drivers/driver_nl80211_capa.c | 701 ++-
contrib/wpa/src/drivers/driver_nl80211_event.c | 1400 ++++-
contrib/wpa/src/drivers/driver_nl80211_monitor.c | 387 +-
contrib/wpa/src/drivers/driver_nl80211_scan.c | 83 +-
contrib/wpa/src/drivers/driver_openbsd.c | 3 +
contrib/wpa/src/drivers/driver_privsep.c | 3 +
contrib/wpa/src/drivers/driver_wext.c | 124 +-
contrib/wpa/src/drivers/driver_wext.h | 2 +
contrib/wpa/src/drivers/drivers.c | 6 -
contrib/wpa/src/drivers/drivers.mak | 22 +-
contrib/wpa/src/drivers/drivers.mk | 18 +-
contrib/wpa/src/drivers/nl80211_copy.h | 1624 +++++-
contrib/wpa/src/eap_common/eap_pwd_common.c | 2 +-
contrib/wpa/src/eap_common/eap_teap_common.c | 73 +-
contrib/wpa/src/eap_common/eap_teap_common.h | 7 +-
contrib/wpa/src/eap_common/ikev2_common.c | 29 +-
contrib/wpa/src/eap_peer/eap.c | 26 +-
contrib/wpa/src/eap_peer/eap_config.h | 2 -
contrib/wpa/src/eap_peer/eap_leap.c | 5 +-
contrib/wpa/src/eap_peer/eap_teap.c | 691 +--
contrib/wpa/src/eap_peer/eap_teap_pac.c | 931 ---
contrib/wpa/src/eap_peer/eap_teap_pac.h | 50 -
contrib/wpa/src/eap_peer/eap_tls.c | 55 -
contrib/wpa/src/eap_peer/eap_tls_common.c | 13 +-
contrib/wpa/src/eap_peer/eap_tls_common.h | 1 -
contrib/wpa/src/eap_server/eap.h | 2 -
contrib/wpa/src/eap_server/eap_server_teap.c | 522 +-
contrib/wpa/src/eap_server/eap_server_tls.c | 54 -
contrib/wpa/src/eap_server/eap_server_tls_common.c | 8 -
contrib/wpa/src/eap_server/eap_server_ttls.c | 5 +
contrib/wpa/src/eap_server/eap_tls_common.h | 1 -
contrib/wpa/src/eapol_auth/eapol_auth_sm.c | 17 +-
contrib/wpa/src/eapol_auth/eapol_auth_sm.h | 2 +-
contrib/wpa/src/eapol_auth/eapol_auth_sm_i.h | 2 -
contrib/wpa/src/eapol_supp/eapol_supp_sm.c | 135 +-
contrib/wpa/src/eapol_supp/eapol_supp_sm.h | 5 +
contrib/wpa/src/fst/fst.c | 8 +
contrib/wpa/src/fst/fst_session.c | 8 +-
contrib/wpa/src/nan/Makefile | 9 +
contrib/wpa/src/nan/nan.c | 3677 ++++++++++++
contrib/wpa/src/nan/nan.h | 946 +++
contrib/wpa/src/nan/nan_bootstrap.c | 741 +++
contrib/wpa/src/nan/nan_crypto.c | 773 +++
contrib/wpa/src/nan/nan_i.h | 867 +++
contrib/wpa/src/nan/nan_module_test_cases.c | 817 +++
contrib/wpa/src/nan/nan_module_tests.c | 1530 +++++
contrib/wpa/src/nan/nan_module_tests.h | 137 +
contrib/wpa/src/nan/nan_ndl.c | 1724 ++++++
contrib/wpa/src/nan/nan_ndp.c | 1214 ++++
contrib/wpa/src/nan/nan_pairing.c | 1625 ++++++
contrib/wpa/src/nan/nan_sec.c | 1653 ++++++
contrib/wpa/src/nan/nan_util.c | 2043 +++++++
contrib/wpa/src/p2p/p2p.c | 1774 +++++-
contrib/wpa/src/p2p/p2p.h | 416 +-
contrib/wpa/src/p2p/p2p_build.c | 170 +-
contrib/wpa/src/p2p/p2p_go_neg.c | 284 +-
contrib/wpa/src/p2p/p2p_group.c | 52 +-
contrib/wpa/src/p2p/p2p_i.h | 236 +-
contrib/wpa/src/p2p/p2p_invitation.c | 284 +-
contrib/wpa/src/p2p/p2p_parse.c | 68 +
contrib/wpa/src/p2p/p2p_pd.c | 864 ++-
contrib/wpa/src/p2p/p2p_utils.c | 71 +-
contrib/wpa/src/pae/ieee802_1x_kay.c | 33 +-
contrib/wpa/src/pae/ieee802_1x_kay.h | 4 +-
contrib/wpa/src/pasn/pasn_common.c | 168 +-
contrib/wpa/src/pasn/pasn_common.h | 164 +-
contrib/wpa/src/pasn/pasn_initiator.c | 606 +-
contrib/wpa/src/pasn/pasn_responder.c | 491 +-
contrib/wpa/src/radius/radius.c | 112 +-
contrib/wpa/src/radius/radius.h | 10 +-
contrib/wpa/src/radius/radius_client.c | 60 +-
contrib/wpa/src/radius/radius_server.c | 306 +-
contrib/wpa/src/radius/radius_server.h | 29 +-
contrib/wpa/src/rsn_supp/pmksa_cache.c | 94 +-
contrib/wpa/src/rsn_supp/pmksa_cache.h | 6 +-
contrib/wpa/src/rsn_supp/preauth.c | 2 +-
contrib/wpa/src/rsn_supp/tdls.c | 28 +-
contrib/wpa/src/rsn_supp/wpa.c | 1342 ++++-
contrib/wpa/src/rsn_supp/wpa.h | 104 +-
contrib/wpa/src/rsn_supp/wpa_ft.c | 8 +-
contrib/wpa/src/rsn_supp/wpa_i.h | 35 +-
contrib/wpa/src/rsn_supp/wpa_ie.c | 199 +-
contrib/wpa/src/rsn_supp/wpa_ie.h | 8 +
contrib/wpa/src/tls/tlsv1_client.c | 2 +-
contrib/wpa/src/tls/tlsv1_common.c | 8 -
contrib/wpa/src/tls/tlsv1_common.h | 4 -
contrib/wpa/src/tls/x509v3.c | 2 +-
contrib/wpa/src/utils/bitfield.c | 160 +-
contrib/wpa/src/utils/bitfield.h | 12 +-
contrib/wpa/src/utils/common.c | 32 +-
contrib/wpa/src/utils/common.h | 29 +-
contrib/wpa/src/utils/eloop.c | 9 +
contrib/wpa/src/utils/ext_password_file.c | 21 +-
contrib/wpa/src/utils/http-utils.h | 36 -
contrib/wpa/src/utils/http_curl.c | 962 ---
contrib/wpa/src/utils/json.c | 138 +-
contrib/wpa/src/utils/json.h | 3 +
contrib/wpa/src/utils/module_tests.h | 1 +
contrib/wpa/src/utils/os.h | 11 +-
contrib/wpa/src/utils/os_unix.c | 75 +-
contrib/wpa/src/utils/trace.c | 47 +-
contrib/wpa/src/utils/trace.h | 25 +-
contrib/wpa/src/utils/utils_module_tests.c | 97 +-
contrib/wpa/src/utils/wpa_debug.c | 38 +-
contrib/wpa/src/utils/wpa_debug.h | 49 +-
contrib/wpa/src/utils/wpabuf.c | 57 +-
contrib/wpa/src/utils/wpabuf.h | 11 +
contrib/wpa/src/utils/xml-utils.c | 31 -
contrib/wpa/src/utils/xml-utils.h | 19 -
contrib/wpa/src/utils/xml_libxml2.c | 212 +-
contrib/wpa/src/wps/http_server.c | 9 +-
contrib/wpa/src/wps/wps_er.c | 5 +-
contrib/wpa/src/wps/wps_upnp_ap.c | 2 +-
contrib/wpa/wpa_supplicant/Android.mk | 60 +-
contrib/wpa/wpa_supplicant/ChangeLog | 32 +
contrib/wpa/wpa_supplicant/Makefile | 81 +-
contrib/wpa/wpa_supplicant/README | 4 +-
contrib/wpa/wpa_supplicant/README-HS20 | 22 -
contrib/wpa/wpa_supplicant/README-NAN-USD | 16 +
contrib/wpa/wpa_supplicant/ap.c | 68 +-
contrib/wpa/wpa_supplicant/bgscan_learn.c | 5 +
contrib/wpa/wpa_supplicant/bgscan_simple.c | 4 +
contrib/wpa/wpa_supplicant/bss.c | 968 ++-
contrib/wpa/wpa_supplicant/bss.h | 36 +-
contrib/wpa/wpa_supplicant/config.c | 663 ++-
contrib/wpa/wpa_supplicant/config.h | 174 +-
contrib/wpa/wpa_supplicant/config_file.c | 302 +-
contrib/wpa/wpa_supplicant/config_none.c | 2 +-
contrib/wpa/wpa_supplicant/config_ssid.h | 115 +
contrib/wpa/wpa_supplicant/config_winreg.c | 2 +-
contrib/wpa/wpa_supplicant/ctrl_iface.c | 1694 +++++-
.../wpa/wpa_supplicant/dbus/dbus_dict_helpers.c | 35 +
.../wpa/wpa_supplicant/dbus/dbus_dict_helpers.h | 3 +
contrib/wpa/wpa_supplicant/dbus/dbus_new.c | 552 +-
contrib/wpa/wpa_supplicant/dbus/dbus_new.h | 87 +
.../wpa/wpa_supplicant/dbus/dbus_new_handlers.c | 645 +-
.../wpa/wpa_supplicant/dbus/dbus_new_handlers.h | 20 +
.../wpa_supplicant/dbus/dbus_new_handlers_p2p.c | 47 +-
.../wpa_supplicant/dbus/dbus_new_handlers_p2p.h | 2 +
.../wpa/wpa_supplicant/dbus/dbus_new_introspect.c | 2 +-
contrib/wpa/wpa_supplicant/defconfig | 44 +-
contrib/wpa/wpa_supplicant/dpp_supplicant.c | 84 +-
contrib/wpa/wpa_supplicant/dpp_supplicant.h | 2 +-
contrib/wpa/wpa_supplicant/driver_i.h | 223 +-
contrib/wpa/wpa_supplicant/eap_register.c | 7 -
contrib/wpa/wpa_supplicant/eapol_test.c | 5 +-
contrib/wpa/wpa_supplicant/events.c | 1449 ++++-
contrib/wpa/wpa_supplicant/gas_query.c | 95 +-
contrib/wpa/wpa_supplicant/hs20_supplicant.c | 997 +---
contrib/wpa/wpa_supplicant/hs20_supplicant.h | 20 +-
contrib/wpa/wpa_supplicant/ibss_rsn.c | 14 +-
contrib/wpa/wpa_supplicant/interworking.c | 64 +-
contrib/wpa/wpa_supplicant/main.c | 52 +-
contrib/wpa/wpa_supplicant/mbo.c | 6 +-
contrib/wpa/wpa_supplicant/mesh.c | 98 +-
contrib/wpa/wpa_supplicant/mesh_mpm.c | 4 +-
contrib/wpa/wpa_supplicant/mesh_rsn.c | 31 +-
contrib/wpa/wpa_supplicant/nan_supplicant.c | 5003 ++++++++++++++++
contrib/wpa/wpa_supplicant/nan_supplicant.h | 252 +
contrib/wpa/wpa_supplicant/nan_usd.c | 513 --
contrib/wpa/wpa_supplicant/nan_usd.h | 46 -
contrib/wpa/wpa_supplicant/notify.c | 591 +-
contrib/wpa/wpa_supplicant/notify.h | 98 +
contrib/wpa/wpa_supplicant/offchannel.c | 4 +-
contrib/wpa/wpa_supplicant/op_classes.c | 9 +-
contrib/wpa/wpa_supplicant/p2p_supplicant.c | 1914 +++++-
contrib/wpa/wpa_supplicant/p2p_supplicant.h | 52 +-
contrib/wpa/wpa_supplicant/pasn_supplicant.c | 811 ++-
contrib/wpa/wpa_supplicant/pr_supplicant.c | 1807 ++++++
contrib/wpa/wpa_supplicant/pr_supplicant.h | 148 +
contrib/wpa/wpa_supplicant/preauth_test.c | 2 +-
contrib/wpa/wpa_supplicant/robust_av.c | 278 +-
contrib/wpa/wpa_supplicant/rrm.c | 125 +-
contrib/wpa/wpa_supplicant/scan.c | 611 +-
contrib/wpa/wpa_supplicant/scan.h | 3 +
contrib/wpa/wpa_supplicant/sme.c | 2841 +++++++--
contrib/wpa/wpa_supplicant/sme.h | 22 +-
contrib/wpa/wpa_supplicant/wnm_sta.c | 976 ++--
contrib/wpa/wpa_supplicant/wnm_sta.h | 5 +-
contrib/wpa/wpa_supplicant/wpa_cli.c | 338 +-
contrib/wpa/wpa_supplicant/wpa_passphrase.c | 10 +-
contrib/wpa/wpa_supplicant/wpa_supplicant.c | 1520 ++++-
contrib/wpa/wpa_supplicant/wpa_supplicant.conf | 96 +
contrib/wpa/wpa_supplicant/wpa_supplicant_i.h | 314 +-
contrib/wpa/wpa_supplicant/wpas_glue.c | 69 +-
contrib/wpa/wpa_supplicant/wpas_kay.c | 1 +
contrib/wpa/wpa_supplicant/wpas_module_tests.c | 5 +
contrib/wpa/wpa_supplicant/wps_supplicant.c | 7 +-
usr.sbin/wpa/Makefile.inc | 11 +
usr.sbin/wpa/hostapd/Makefile | 9 +-
usr.sbin/wpa/src/ap/Makefile | 7 +
usr.sbin/wpa/src/common/Makefile | 1 +
usr.sbin/wpa/src/crypto/Makefile | 5 +-
usr.sbin/wpa/src/pasn/Makefile | 3 +-
336 files changed, 90636 insertions(+), 25473 deletions(-)
diff --git a/contrib/wpa/Makefile b/contrib/wpa/Makefile
new file mode 100644
index 000000000000..c4b1498cff9f
--- /dev/null
+++ b/contrib/wpa/Makefile
@@ -0,0 +1,10 @@
+SUBDIRS=$(wildcard hostapd) $(wildcard wpa_supplicant)
+
+all:
+ for dir in $(SUBDIRS); do $(MAKE) -C $$dir; done
+
+clean distclean:
+ for dir in $(SUBDIRS); do $(MAKE) -C $$dir clean; done
+
+install:
+ for dir in $(SUBDIRS); do $(MAKE) -C $$dir install; done
diff --git a/contrib/wpa/README b/contrib/wpa/README
index 8392bb354fac..0addde360ee5 100644
--- a/contrib/wpa/README
+++ b/contrib/wpa/README
@@ -1,7 +1,7 @@
wpa_supplicant and hostapd
--------------------------
-Copyright (c) 2002-2024, Jouni Malinen <j@w1.fi> and contributors
+Copyright (c) 2002-2026, Jouni Malinen <j@w1.fi> and contributors
All Rights Reserved.
These programs are licensed under the BSD license (the one with
diff --git a/contrib/wpa/hostapd/Android.mk b/contrib/wpa/hostapd/Android.mk
index 573564d5b0de..bff81cac4a31 100644
--- a/contrib/wpa/hostapd/Android.mk
+++ b/contrib/wpa/hostapd/Android.mk
@@ -127,7 +127,7 @@ HOBJS += src/utils/trace.c
LDFLAGS += -rdynamic
L_CFLAGS += -funwind-tables
ifdef CONFIG_WPA_TRACE_BFD
-L_CFLAGS += -DWPA_TRACE_BFD
+L_CFLAGS += -DWPA_TRACE_BFD -fno-inline -fno-optimize-sibling-calls
LIBS += -lbfd
LIBS_c += -lbfd
LIBS_h += -lbfd
@@ -259,9 +259,10 @@ L_CFLAGS += -DCONFIG_SAE
OBJS += src/common/sae.c
ifdef CONFIG_SAE_PK
L_CFLAGS += -DCONFIG_SAE_PK
-NEED_AES_SIV=y
+NEED_BASE64=y
OBJS += src/common/sae_pk.c
endif
+NEED_AES_SIV=y
NEED_ECC=y
NEED_DH_GROUPS=y
NEED_HMAC_SHA256_KDF=y
@@ -588,6 +589,21 @@ OBJS += src/ap/nan_usd_ap.c
L_CFLAGS += -DCONFIG_NAN_USD
endif
+ifdef CONFIG_PMKSA_PRIVACY
+CONFIG_ENC_ASSOC=y
+L_CFLAGS += -DCONFIG_PMKSA_PRIVACY
+endif
+
+ifdef CONFIG_IEEE8021X_AUTH
+CONFIG_ENC_ASSOC=y
+L_CFLAGS += -DCONFIG_IEEE8021X_AUTH
+endif
+
+ifdef CONFIG_ENC_ASSOC
+CONFIG_PASN=y
+L_CFLAGS += -DCONFIG_ENC_ASSOC
+endif
+
ifdef CONFIG_PASN
L_CFLAGS += -DCONFIG_PASN
L_CFLAGS += -DCONFIG_PTKSA_CACHE
@@ -936,6 +952,20 @@ endif
endif
endif
+ifdef CONFIG_SAE
+ifdef CONFIG_IEEE80211BE
+NEED_SHA384=y
+endif
+ifdef NEED_SHA384
+# Need to add HMAC-SHA384 KDF as well, if SHA384 was enabled.
+NEED_HMAC_SHA384_KDF=y
+endif
+ifdef NEED_SHA512
+# Need to add HMAC-SHA512 KDF as well, if SHA512 was enabled.
+NEED_HMAC_SHA512_KDF=y
+endif
+endif
+
L_CFLAGS += -DCONFIG_SHA256
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), gnutls)
@@ -1055,6 +1085,7 @@ OBJS += src/pasn/pasn_common.c
OBJS += src/ap/ieee802_11.c
OBJS += src/ap/hw_features.c
OBJS += src/ap/dfs.c
+OBJS += src/ap/interference.c
L_CFLAGS += -DNEED_AP_MLME
endif
OBJS += src/ap/ieee802_11_ht.c
@@ -1125,6 +1156,11 @@ ifdef CONFIG_ANDROID_LOG
L_CFLAGS += -DCONFIG_ANDROID_LOG
endif
+ifdef CONFIG_PROCESS_COORDINATION
+L_CFLAGS += -DCONFIG_PROCESS_COORDINATION
+OBJS += src/common/proc_coord.c
+endif
+
OBJS_c = hostapd_cli.c
OBJS_c += src/common/wpa_ctrl.c
OBJS_c += src/utils/os_$(CONFIG_OS).c
diff --git a/contrib/wpa/hostapd/ChangeLog b/contrib/wpa/hostapd/ChangeLog
index 1c8240d333c4..ec26207d8d9d 100644
--- a/contrib/wpa/hostapd/ChangeLog
+++ b/contrib/wpa/hostapd/ChangeLog
@@ -1,5 +1,35 @@
ChangeLog for hostapd
+2026-08-07 - v2.12
+ * support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
+ * EHT/IEEE 802.11be/Wi-Fi 7
+ - more complete support
+ - fix message validation issues that could enable DoS attacks
+ - fix group key rekeying
+ * enable SAE group 20 by default if SAE-EXT-KEY is enabled
+ * reject unexpected SAE password identifier to avoid DoS attack against
+ a specific STA
+ * mandate use of SAE H2E when using password identifiers
+ * assign VLAN when using SAE with PMKSA caching
+ * support SPP A-MSDU negotiation
+ * support IEEE 802.11bi functionality
+ - changing SAE password identifiers
+ - EPPKE
+ - IEEE 802.1X/EAP in Authentication frames
+ - Association frame encryption
+ - PMKID privacy
+ * remove the driver interface for now obsolete Host AP driver
+ * remove the driver interface for now obsolete Atheros WEXT interface
+ * move supported, basic, and Beacon TX rate configuration to be at BSS
+ level instead of per-radio for all BSSs
+ * fix various issues in Multiple-BSSID functionality
+ * support OpenSSL 3.0 API changes
+ * EAP-TEAP: protocol changes based on RFC 9930; this is not compatible
+ with previous versions
+ * support Automated Frequency Coordination (AFC) on the 6 GHz band
+ * improve GAS/ANQP processing to support larger ANQP responses
+ * a large number of other fixes, cleanup, and extensions
+
2024-07-20 - v2.11
* Wi-Fi Easy Connect
- add support for DPP release 3
diff --git a/contrib/wpa/hostapd/Makefile b/contrib/wpa/hostapd/Makefile
index ca4439234a11..f6fee0b46a33 100644
--- a/contrib/wpa/hostapd/Makefile
+++ b/contrib/wpa/hostapd/Makefile
@@ -116,7 +116,7 @@ HOBJS += ../src/utils/trace.o
LDFLAGS += -rdynamic
CFLAGS += -funwind-tables
ifdef CONFIG_WPA_TRACE_BFD
-CFLAGS += -DPACKAGE="hostapd" -DWPA_TRACE_BFD
+CFLAGS += -DPACKAGE="hostapd" -DWPA_TRACE_BFD -fno-inline -fno-optimize-sibling-calls
LIBS += -lbfd -ldl -liberty -lz
LIBS_c += -lbfd -ldl -liberty -lz
LIBS_h += -lbfd -ldl -liberty -lz
@@ -298,9 +298,10 @@ CFLAGS += -DCONFIG_SAE
OBJS += ../src/common/sae.o
ifdef CONFIG_SAE_PK
CFLAGS += -DCONFIG_SAE_PK
-NEED_AES_SIV=y
+NEED_BASE64=y
OBJS += ../src/common/sae_pk.o
endif
+NEED_AES_SIV=y
NEED_ECC=y
NEED_DH_GROUPS=y
NEED_HMAC_SHA256_KDF=y
@@ -354,6 +355,14 @@ CFLAGS += -DCONFIG_IEEE80211AX
OBJS += ../src/ap/ieee802_11_he.o
endif
+ifdef CONFIG_IEEE80211AX
+ifdef CONFIG_AFC
+CFLAGS += -DCONFIG_AFC
+OBJS += ../src/ap/afc.o
+NEED_JSON=y
+endif
+endif
+
ifdef CONFIG_MBO
CFLAGS += -DCONFIG_MBO
OBJS += ../src/ap/mbo_ap.o
@@ -614,6 +623,21 @@ OBJS += ../src/ap/nan_usd_ap.o
CFLAGS += -DCONFIG_NAN_USD
endif
+ifdef CONFIG_PMKSA_PRIVACY
+CONFIG_ENC_ASSOC=y
+CFLAGS += -DCONFIG_PMKSA_PRIVACY
+endif
+
+ifdef CONFIG_IEEE8021X_AUTH
+CONFIG_ENC_ASSOC=y
+CFLAGS += -DCONFIG_IEEE8021X_AUTH
+endif
+
+ifdef CONFIG_ENC_ASSOC
+CONFIG_PASN=y
+CFLAGS += -DCONFIG_ENC_ASSOC
+endif
+
ifdef CONFIG_PASN
CFLAGS += -DCONFIG_PASN
CFLAGS += -DCONFIG_PTKSA_CACHE
@@ -708,6 +732,7 @@ CFLAGS += -DCONFIG_TLSV12
endif
ifeq ($(CONFIG_TLS), wolfssl)
+CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
CONFIG_CRYPTO=wolfssl
ifdef TLS_FUNCS
OBJS += ../src/crypto/tls_wolfssl.o
@@ -1065,6 +1090,20 @@ endif
endif
endif
+ifdef CONFIG_SAE
+ifdef CONFIG_IEEE80211BE
+NEED_SHA384=y
+endif
+ifdef NEED_SHA384
+# Need to add HMAC-SHA384 KDF as well, if SHA384 was enabled.
+NEED_HMAC_SHA384_KDF=y
+endif
+ifdef NEED_SHA512
+# Need to add HMAC-SHA512 KDF as well, if SHA512 was enabled.
+NEED_HMAC_SHA512_KDF=y
+endif
+endif
+
CFLAGS += -DCONFIG_SHA256
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
@@ -1201,6 +1240,7 @@ OBJS += ../src/pasn/pasn_common.o
OBJS += ../src/ap/ieee802_11.o
OBJS += ../src/ap/hw_features.o
OBJS += ../src/ap/dfs.o
+OBJS += ../src/ap/interference.o
CFLAGS += -DNEED_AP_MLME
endif
OBJS += ../src/ap/ieee802_11_ht.o
@@ -1298,6 +1338,11 @@ ifdef CONFIG_NO_TKIP
CFLAGS += -DCONFIG_NO_TKIP
endif
+ifdef CONFIG_PROCESS_COORDINATION
+CFLAGS += -DCONFIG_PROCESS_COORDINATION
+OBJS += ../src/common/proc_coord.o
+endif
+
$(DESTDIR)$(BINDIR)/%: %
install -D $(<) $(@)
@@ -1365,6 +1410,16 @@ SOBJS += ../src/common/sae.o
SOBJS += ../src/common/sae_pk.o
SOBJS += ../src/common/dragonfly.o
SOBJS += $(AESOBJS)
+ifneq ($(CONFIG_TLS), openssl)
+ifneq ($(CONFIG_TLS), linux)
+ifneq ($(CONFIG_TLS), gnutls)
+ifneq ($(CONFIG_TLS), wolfssl)
+SOBJS += ../src/crypto/sha384.o
+SOBJS += ../src/crypto/sha512.o
+endif
+endif
+endif
+endif
SOBJS += ../src/crypto/sha256-prf.o
SOBJS += ../src/crypto/sha384-prf.o
SOBJS += ../src/crypto/sha512-prf.o
@@ -1372,6 +1427,14 @@ SOBJS += ../src/crypto/dh_groups.o
SOBJS += ../src/crypto/sha256-kdf.o
SOBJS += ../src/crypto/sha384-kdf.o
SOBJS += ../src/crypto/sha512-kdf.o
+SOBJS += ../src/common/wpa_common.o
+ifdef CONFIG_NO_RANDOM_POOL
+CFLAGS += -DCONFIG_NO_RANDOM_POOL
+else
+SOBJS += ../src/crypto/random.o
+endif
+SOBJS += ../src/crypto/sha1-prf.o
+SOBJS += ../src/utils/eloop.o
_OBJS_VAR := NOBJS
include ../src/objs.mk
diff --git a/contrib/wpa/hostapd/README b/contrib/wpa/hostapd/README
index 1a0248fce422..89f65d58eae6 100644
--- a/contrib/wpa/hostapd/README
+++ b/contrib/wpa/hostapd/README
@@ -2,7 +2,7 @@ hostapd - user space IEEE 802.11 AP and IEEE 802.1X/WPA/WPA2/EAP
Authenticator and RADIUS authentication server
================================================================
-Copyright (c) 2002-2024, Jouni Malinen <j@w1.fi> and contributors
+Copyright (c) 2002-2026, Jouni Malinen <j@w1.fi> and contributors
All Rights Reserved.
This program is licensed under the BSD license (the one with
@@ -69,11 +69,6 @@ Requirements
Current hardware/software requirements:
- drivers:
- Host AP driver for Prism2/2.5/3.
- (http://w1.fi/hostap-driver.html)
- Please note that station firmware version needs to be 1.7.0 or newer
- to work in WPA mode.
-
mac80211-based drivers that support AP mode (with driver=nl80211).
This includes drivers for Atheros (ath9k) and Broadcom (b43)
chipsets.
@@ -125,7 +120,7 @@ use an external Authentication Server and encapsulate EAP frame in the
frames used by that server. RADIUS is suitable for this, but IEEE
802.1X would also allow other mechanisms.
-Host AP driver includes PAE functionality in the kernel driver. It
+Drivers include PAE functionality in the kernel driver. It
is a relatively simple mechanism for denying normal frames going to
or coming from an unauthorized port. PAE allows IEEE 802.1X related
frames to be passed between the Supplicant and the Authenticator even
@@ -156,7 +151,7 @@ with the Authentication Server. After this is completed successfully,
the virtual port is set to Authorized state and frames from and to the
station are accepted.
-Host AP configuration for IEEE 802.1X
+hostapd configuration for IEEE 802.1X
-------------------------------------
The user space daemon has its own configuration file that can be used to
diff --git a/contrib/wpa/hostapd/README-MULTI-AP b/contrib/wpa/hostapd/README-MULTI-AP
index ccee69e13c08..6190cace4aa1 100644
--- a/contrib/wpa/hostapd/README-MULTI-AP
+++ b/contrib/wpa/hostapd/README-MULTI-AP
@@ -155,6 +155,6 @@ References
----------
[1] https://www.wi-fi.org/discover-wi-fi/wi-fi-easymesh
-[2] https://github.com/prplfoundation/prplMesh
+[2] https://gitlab.com/prpl-foundation/prplmesh/prplMesh
[3] https://www.wi-fi.org/file/multi-ap-specification-v10
(requires registration)
diff --git a/contrib/wpa/hostapd/android.config b/contrib/wpa/hostapd/android.config
index 522de87266d5..133a8111286d 100644
--- a/contrib/wpa/hostapd/android.config
+++ b/contrib/wpa/hostapd/android.config
@@ -9,9 +9,6 @@
# be modified from here. In most cass, these lines should use += in order not
# to override previous values of the variables.
-# Driver interface for Host AP driver
-#CONFIG_DRIVER_HOSTAP=y
-
# Driver interface for wired authenticator
#CONFIG_DRIVER_WIRED=y
diff --git a/contrib/wpa/hostapd/config_file.c b/contrib/wpa/hostapd/config_file.c
index 3fb059770d49..59684808c794 100644
--- a/contrib/wpa/hostapd/config_file.c
+++ b/contrib/wpa/hostapd/config_file.c
@@ -713,14 +713,14 @@ static int hostapd_config_parse_key_mgmt(int line, const char *value)
else if (os_strcmp(start, "DPP") == 0)
val |= WPA_KEY_MGMT_DPP;
#endif /* CONFIG_DPP */
-#ifdef CONFIG_HS20
- else if (os_strcmp(start, "OSEN") == 0)
- val |= WPA_KEY_MGMT_OSEN;
-#endif /* CONFIG_HS20 */
#ifdef CONFIG_PASN
else if (os_strcmp(start, "PASN") == 0)
val |= WPA_KEY_MGMT_PASN;
#endif /* CONFIG_PASN */
+#ifdef CONFIG_ENC_ASSOC
+ else if (os_strcmp(start, "EPPKE") == 0)
+ val |= WPA_KEY_MGMT_EPPKE;
+#endif /* CONFIG_ENC_ASSOC */
else {
wpa_printf(MSG_ERROR, "Line %d: invalid key_mgmt '%s'",
line, start);
@@ -865,7 +865,7 @@ static int hostapd_parse_intlist(int **int_list, char *val)
break;
pos = end + 1;
}
- list[count] = -1;
+ list[count] = 0;
*int_list = list;
return 0;
@@ -1269,7 +1269,7 @@ static int hostapd_parse_he_srg_bitmap(u8 *bitmap, char *val)
*end = '\0';
bitpos = atoi(pos);
- if (bitpos < 0 || bitpos > 64)
+ if (bitpos < 0 || bitpos > 63)
return -1;
bitmap[bitpos / 8] |= BIT(bitpos % 8);
@@ -1281,6 +1281,140 @@ static int hostapd_parse_he_srg_bitmap(u8 *bitmap, char *val)
return 0;
}
+
+#ifdef CONFIG_AFC
+
+static int hostapd_afc_parse_cert_ids(struct hostapd_config *conf, char *pos)
+{
+ struct afc_cert_id *c = NULL, *tmp;
+ unsigned int i, count = 0;
+
+ while (pos && pos[0]) {
+ char *p;
+
+ tmp = os_realloc_array(c, count + 1, sizeof(*c));
+ if (!tmp)
+ goto error;
+ c = tmp;
+
+ i = count;
+ count++;
+ os_memset(&c[i], 0, sizeof(struct afc_cert_id));
+
+ p = os_strchr(pos, ':');
+ if (!p)
+ goto error;
+
+ *p++ = '\0';
+ if (!p || !p[0])
+ goto error;
+
+ c[i].ruleset = os_strdup(pos);
+ if (!c[i].ruleset)
+ goto error;
+
+ pos = p;
+ p = os_strchr(pos, ',');
+ if (p)
+ *p++ = '\0';
+
+ c[i].id = os_strdup(pos);
+ if (!c[i].id)
+ goto error;
+
+ pos = p;
+ }
+
+ hostapd_config_free_afc_cert_ids(conf);
+
+ conf->afc.n_cert_ids = count;
+ conf->afc.cert_ids = c;
+
+ return 0;
+
+error:
+ for (i = 0; i < count; i++) {
+ os_free(c[i].ruleset);
+ os_free(c[i].id);
+ }
+ os_free(c);
+
+ return -ENOMEM;
+}
+
+
+static int hostapd_afc_parse_position_data(struct afc_linear_polygon **data,
+ unsigned int *n_linear_polygon_data,
+ char *pos)
+{
+ struct afc_linear_polygon *d = NULL, *tmp;
+ unsigned int count = 0;
+
+ while (pos && pos[0]) {
+ char *p, *end;
+
+ tmp = os_realloc_array(d, count + 1, sizeof(*d));
+ if (!tmp)
+ goto error;
+ d = tmp;
+
+ p = os_strchr(pos, ':');
+ if (!p)
+ goto error;
+
+ *p++ = '\0';
+ if (!p || !p[0])
+ goto error;
+
+ d[count].longitude = strtod(pos, &end);
+ if (*end)
+ goto error;
+
+ pos = p;
+ p = os_strchr(pos, ',');
+ if (p)
+ *p++ = '\0';
+
+ d[count].latitude = strtod(pos, &end);
+ if (*end)
+ goto error;
+
+ pos = p;
+ count++;
+ }
+
+ os_free(*data);
+ *n_linear_polygon_data = count;
+ *data = d;
+
+ return 0;
+
+error:
+ os_free(d);
+ return -ENOMEM;
+}
+
+
+static int hostapd_afc_parse_op_class(struct hostapd_config *conf, char *pos)
+{
+ os_free(conf->afc.op_class);
+ conf->afc.op_class = NULL;
+
+ while (pos && pos[0]) {
+ char *p;
+
+ p = os_strchr(pos, ',');
+ if (p)
+ *p++ = '\0';
+
+ int_array_add_unique(&conf->afc.op_class, atoi(pos));
+ pos = p;
+ }
+
+ return 0;
+}
+
+#endif /* CONFIG_AFC */
#endif /* CONFIG_IEEE80211AX */
@@ -1834,233 +1968,6 @@ static int hs20_parse_oper_friendly_name(struct hostapd_bss_config *bss,
return 0;
}
-
-static int hs20_parse_icon(struct hostapd_bss_config *bss, char *pos)
-{
- struct hs20_icon *icon;
- char *end;
-
- icon = os_realloc_array(bss->hs20_icons, bss->hs20_icons_count + 1,
- sizeof(struct hs20_icon));
- if (icon == NULL)
- return -1;
- bss->hs20_icons = icon;
- icon = &bss->hs20_icons[bss->hs20_icons_count];
- os_memset(icon, 0, sizeof(*icon));
-
*** 153666 LINES SKIPPED ***