webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-22 17:02:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

hostapd: Update to version 2_11

Browse Source 
- Update from version 2_10 to 2_11
- Update of rootfile not required
- Update of patches to latest source tarball
- Changelog
    2_11
	* Wi-Fi Easy Connect
	  - add support for DPP release 3
	  - allow Configurator parameters to be provided during config exchange
	* HE/IEEE 802.11ax/Wi-Fi 6
	  - various fixes
	* EHT/IEEE 802.11be/Wi-Fi 7
	  - add preliminary support
	* SAE: add support for fetching the password from a RADIUS server
	* support OpenSSL 3.0 API changes
	* support background radar detection and CAC with some additional
	  drivers
	* support RADIUS ACL/PSK check during 4-way handshake (wpa_psk_radius=3)
	* EAP-SIM/AKA: support IMSI privacy
	* improve 4-way handshake operations
	  - use Secure=1 in message 3 during PTK rekeying
	* OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases
	  to avoid interoperability issues
	* support new SAE AKM suites with variable length keys
	* support new AKM for 802.1X/EAP with SHA384
	* extend PASN support for secure ranging
	* FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
	  - this is based on additional details being added in the IEEE 802.11
	    standard
	  - the new implementation is not backwards compatible
	* improved ACS to cover additional channel types/bandwidths
	* extended Multiple BSSID support
	* fix beacon protection with FT protocol (incorrect BIGTK was provided)
	* support unsynchronized service discovery (USD)
	* add preliminary support for RADIUS/TLS
	* add support for explicit SSID protection in 4-way handshake
	  (a mitigation for CVE-2023-52424; disabled by default for now, can be
	  enabled with ssid_protection=1)
	* fix SAE H2E rejected groups validation to avoid downgrade attacks
	* use stricter validation for some RADIUS messages
	* a large number of other fixes, cleanup, and extensions

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Adolf Belka
2024-08-07 10:22:56 +02:00
committed by Michael Tremer
parent f5160566b2
commit 6c6959694a
3 changed files with 28 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
lfs/hostapd
View File

@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2007-2023 IPFire Team <info@ipfire.org> #
# Copyright (C) 2007-2024 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -25,7 +25,7 @@
include Config
SUMMARY = Daemon for running a WPA capable Access Point
VER = 2_10
VER = 2_11
THISAPP = hostap_$(VER)
DL_FILE = $(THISAPP).tar.bz2
@@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = hostapd
PAK_VER = 63
PAK_VER = 64
DEPS =
@@ -47,7 +47,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
$(DL_FILE)_BLAKE2 = de474630835a1208ce456d3151759cd3411dc63b2470de7144117634d4985aba1c878fd2cc2388cf6226bc0674eb2bf48cc4b4491f85f3461966b0278f75ea1e
$(DL_FILE)_BLAKE2 = de98a3634ff937b0068329219e4fa5dece34c9eeb27fa81a9e7de689d5dd2936ceb0ea43923a0e994e0a7bfcd71709b5f739df2f3efdd7c6ec5c765171711a19
install : $(TARGET)
@@ -81,8 +81,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/hostapd/hostapd-2.9-increase_EAPOL-timeouts.patch
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/hostapd/hostapd-2.9-noscan.patch
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/hostapd/hostapd-2.11-increase_EAPOL-timeouts.patch
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/hostapd/hostapd-2.11-noscan.patch
cd $(DIR_APP)/hostapd && cp $(DIR_SRC)/config/hostapd/config ./.config
cd $(DIR_APP)/hostapd && sed -e "s@/usr/local@/usr@g" -i Makefile

11
src/patches/hostapd/hostapd-2.9-increase_EAPOL-timeouts.patch → src/patches/hostapd/hostapd-2.11-increase_EAPOL-timeouts.patch
View File

@@ -1,9 +1,8 @@
diff U3 src/ap/wpa_auth.c src/ap/wpa_auth.c
--- a/src/ap/wpa_auth.c Wed Aug 7 15:25:25 2019
+++ b/src/ap/wpa_auth.c Fri Sep 20 17:35:23 2019
@@ -68,9 +68,9 @@
static int ieee80211w_kde_len(struct wpa_state_machine *sm);
static u8 * ieee80211w_kde_add(struct wpa_state_machine *sm, u8 *pos);
--- hostap_2_11/src/ap/wpa_auth.c.orig 2024-07-20 20:04:37.000000000 +0200
+++ hostap_2_11/src/ap/wpa_auth.c 2024-08-06 12:51:22.849029559 +0200
@@ -75,9 +75,9 @@
struct wpa_group *group);
-static const u32 eapol_key_timeout_first = 100; /* ms */
-static const u32 eapol_key_timeout_subseq = 1000; /* ms */

30
src/patches/hostapd/hostapd-2.9-noscan.patch → src/patches/hostapd/hostapd-2.11-noscan.patch
View File

@@ -1,6 +1,7 @@
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -3474,6 +3474,10 @@ static int hostapd_config_fill(struct ho
diff -Naur hostap_2_11.orig/hostapd/config_file.c hostap_2_11/hostapd/config_file.c
--- hostap_2_11.orig/hostapd/config_file.c 2024-07-20 20:04:37.000000000 +0200
+++ hostap_2_11/hostapd/config_file.c 2024-08-06 12:55:53.750009117 +0200
@@ -3678,6 +3678,10 @@
if (bss->ocv && !bss->ieee80211w)
bss->ieee80211w = 1;
#endif /* CONFIG_OCV */
@@ -11,9 +12,10 @@
} else if (os_strcmp(buf, "ieee80211n") == 0) {
conf->ieee80211n = atoi(pos);
} else if (os_strcmp(buf, "ht_capab") == 0) {
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -1014,6 +1014,8 @@ struct hostapd_config {
diff -Naur hostap_2_11.orig/src/ap/ap_config.h hostap_2_11/src/ap/ap_config.h
--- hostap_2_11.orig/src/ap/ap_config.h 2024-07-20 20:04:37.000000000 +0200
+++ hostap_2_11/src/ap/ap_config.h 2024-08-06 12:57:06.779631503 +0200
@@ -1108,6 +1108,8 @@
int ht_op_mode_fixed;
u16 ht_capab;
@@ -22,9 +24,10 @@
int ieee80211n;
int secondary_channel;
int no_pri_sec_switch;
--- a/src/ap/hw_features.c
+++ b/src/ap/hw_features.c
@@ -517,7 +517,8 @@ static int ieee80211n_check_40mhz(struct
diff -Naur hostap_2_11.orig/src/ap/hw_features.c hostap_2_11/src/ap/hw_features.c
--- hostap_2_11.orig/src/ap/hw_features.c 2024-07-20 20:04:37.000000000 +0200
+++ hostap_2_11/src/ap/hw_features.c 2024-08-06 12:58:29.122962573 +0200
@@ -551,7 +551,8 @@
int ret;
/* Check that HT40 is used and PRI / SEC switch is allowed */
@@ -34,9 +37,10 @@
return 0;
hostapd_set_state(iface, HAPD_IFACE_HT_SCAN);
--- a/src/ap/ieee802_11_ht.c
+++ b/src/ap/ieee802_11_ht.c
@@ -230,6 +230,9 @@ void hostapd_2040_coex_action(struct hos
diff -Naur hostap_2_11.orig/src/ap/ieee802_11_ht.c hostap_2_11/src/ap/ieee802_11_ht.c
--- hostap_2_11.orig/src/ap/ieee802_11_ht.c 2024-07-20 20:04:37.000000000 +0200
+++ hostap_2_11/src/ap/ieee802_11_ht.c 2024-08-06 13:00:31.237899938 +0200
@@ -230,6 +230,9 @@
return;
}
@@ -46,7 +50,7 @@
if (len < IEEE80211_HDRLEN + 2 + sizeof(*bc_ie)) {
wpa_printf(MSG_DEBUG,
"Ignore too short 20/40 BSS Coexistence Management frame");
@@ -390,6 +393,9 @@ void ht40_intolerant_add(struct hostapd_
@@ -390,6 +393,9 @@
if (iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G)
return;