summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/wpa-supplicant
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-connectivity/wpa-supplicant')
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-Install-wpa_passphrase-when-not-disabled.patch33
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-PEAP-client-Update-Phase-2-authentication-requiremen.patch213
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch73
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-macsec_linux-Hardware-offload-requires-Linux-headers.patch53
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch26
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.11.bb (renamed from meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb)23
6 files changed, 64 insertions, 357 deletions
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-Install-wpa_passphrase-when-not-disabled.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-Install-wpa_passphrase-when-not-disabled.patch
deleted file mode 100644
index c04c608bde..0000000000
--- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-Install-wpa_passphrase-when-not-disabled.patch
+++ /dev/null
@@ -1,33 +0,0 @@
1From 57b12a1e43605f71239a21488cb9b541f0751dda Mon Sep 17 00:00:00 2001
2From: Alex Kiernan <alexk@zuma.ai>
3Date: Thu, 21 Apr 2022 10:15:29 +0100
4Subject: [PATCH] Install wpa_passphrase when not disabled
5
6As part of fixing CONFIG_NO_WPA_PASSPHRASE, whilst wpa_passphrase gets
7built, its not installed during `make install`.
8
9Fixes: cb41c214b78d ("build: Re-enable options for libwpa_client.so and wpa_passphrase")
10Signed-off-by: Alex Kiernan <alexk@zuma.ai>
11Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
12Upstream-Status: Submitted [http://lists.infradead.org/pipermail/hostap/2022-April/040448.html]
13---
14 wpa_supplicant/Makefile | 3 +++
15 1 file changed, 3 insertions(+)
16
17diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
18index 0bab313f2355..12787c0c7d0f 100644
19--- a/wpa_supplicant/Makefile
20+++ b/wpa_supplicant/Makefile
21@@ -73,6 +73,9 @@ $(DESTDIR)$(BINDIR)/%: %
22
23 install: $(addprefix $(DESTDIR)$(BINDIR)/,$(BINALL))
24 $(MAKE) -C ../src install
25+ifndef CONFIG_NO_WPA_PASSPHRASE
26+ install -D wpa_passphrase $(DESTDIR)/$(BINDIR)/wpa_passphrase
27+endif
28 ifdef CONFIG_BUILD_WPA_CLIENT_SO
29 install -m 0644 -D libwpa_client.so $(DESTDIR)/$(LIBDIR)/libwpa_client.so
30 install -m 0644 -D ../src/common/wpa_ctrl.h $(DESTDIR)/$(INCDIR)/wpa_ctrl.h
31--
322.35.1
33
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-PEAP-client-Update-Phase-2-authentication-requiremen.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-PEAP-client-Update-Phase-2-authentication-requiremen.patch
deleted file mode 100644
index 620560d3c7..0000000000
--- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-PEAP-client-Update-Phase-2-authentication-requiremen.patch
+++ /dev/null
@@ -1,213 +0,0 @@
1From f6f7cead3661ceeef54b21f7e799c0afc98537ec Mon Sep 17 00:00:00 2001
2From: Jouni Malinen <j@w1.fi>
3Date: Sat, 8 Jul 2023 19:55:32 +0300
4Subject: [PATCH] PEAP client: Update Phase 2 authentication requirements
5
6The previous PEAP client behavior allowed the server to skip Phase 2
7authentication with the expectation that the server was authenticated
8during Phase 1 through TLS server certificate validation. Various PEAP
9specifications are not exactly clear on what the behavior on this front
10is supposed to be and as such, this ended up being more flexible than
11the TTLS/FAST/TEAP cases. However, this is not really ideal when
12unfortunately common misconfiguration of PEAP is used in deployed
13devices where the server trust root (ca_cert) is not configured or the
14user has an easy option for allowing this validation step to be skipped.
15
16Change the default PEAP client behavior to be to require Phase 2
17authentication to be successfully completed for cases where TLS session
18resumption is not used and the client certificate has not been
19configured. Those two exceptions are the main cases where a deployed
20authentication server might skip Phase 2 and as such, where a more
21strict default behavior could result in undesired interoperability
22issues. Requiring Phase 2 authentication will end up disabling TLS
23session resumption automatically to avoid interoperability issues.
24
25Allow Phase 2 authentication behavior to be configured with a new phase1
26configuration parameter option:
27'phase2_auth' option can be used to control Phase 2 (i.e., within TLS
28tunnel) behavior for PEAP:
29 * 0 = do not require Phase 2 authentication
30 * 1 = require Phase 2 authentication when client certificate
31 (private_key/client_cert) is no used and TLS session resumption was
32 not used (default)
33 * 2 = require Phase 2 authentication in all cases
34
35Signed-off-by: Jouni Malinen <j@w1.fi>
36
37CVE: CVE-2023-52160
38Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baffdea9e55255a81270b768439c]
39
40Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com>
41
42---
43 src/eap_peer/eap_config.h | 8 ++++++
44 src/eap_peer/eap_peap.c | 40 +++++++++++++++++++++++++++---
45 src/eap_peer/eap_tls_common.c | 6 +++++
46 src/eap_peer/eap_tls_common.h | 5 ++++
47 wpa_supplicant/wpa_supplicant.conf | 7 ++++++
48 5 files changed, 63 insertions(+), 3 deletions(-)
49
50diff --git a/src/eap_peer/eap_config.h b/src/eap_peer/eap_config.h
51index 3238f74..047eec2 100644
52--- a/src/eap_peer/eap_config.h
53+++ b/src/eap_peer/eap_config.h
54@@ -469,6 +469,14 @@ struct eap_peer_config {
55 * 1 = use cryptobinding if server supports it
56 * 2 = require cryptobinding
57 *
58+ * phase2_auth option can be used to control Phase 2 (i.e., within TLS
59+ * tunnel) behavior for PEAP:
60+ * 0 = do not require Phase 2 authentication
61+ * 1 = require Phase 2 authentication when client certificate
62+ * (private_key/client_cert) is no used and TLS session resumption was
63+ * not used (default)
64+ * 2 = require Phase 2 authentication in all cases
65+ *
66 * EAP-WSC (WPS) uses following options: pin=Device_Password and
67 * uuid=Device_UUID
68 *
69diff --git a/src/eap_peer/eap_peap.c b/src/eap_peer/eap_peap.c
70index 12e30df..6080697 100644
71--- a/src/eap_peer/eap_peap.c
72+++ b/src/eap_peer/eap_peap.c
73@@ -67,6 +67,7 @@ struct eap_peap_data {
74 u8 cmk[20];
75 int soh; /* Whether IF-TNCCS-SOH (Statement of Health; Microsoft NAP)
76 * is enabled. */
77+ enum { NO_AUTH, FOR_INITIAL, ALWAYS } phase2_auth;
78 };
79
80
81@@ -114,6 +115,19 @@ static void eap_peap_parse_phase1(struct eap_peap_data *data,
82 wpa_printf(MSG_DEBUG, "EAP-PEAP: Require cryptobinding");
83 }
84
85+ if (os_strstr(phase1, "phase2_auth=0")) {
86+ data->phase2_auth = NO_AUTH;
87+ wpa_printf(MSG_DEBUG,
88+ "EAP-PEAP: Do not require Phase 2 authentication");
89+ } else if (os_strstr(phase1, "phase2_auth=1")) {
90+ data->phase2_auth = FOR_INITIAL;
91+ wpa_printf(MSG_DEBUG,
92+ "EAP-PEAP: Require Phase 2 authentication for initial connection");
93+ } else if (os_strstr(phase1, "phase2_auth=2")) {
94+ data->phase2_auth = ALWAYS;
95+ wpa_printf(MSG_DEBUG,
96+ "EAP-PEAP: Require Phase 2 authentication for all cases");
97+ }
98 #ifdef EAP_TNC
99 if (os_strstr(phase1, "tnc=soh2")) {
100 data->soh = 2;
101@@ -142,6 +156,7 @@ static void * eap_peap_init(struct eap_sm *sm)
102 data->force_peap_version = -1;
103 data->peap_outer_success = 2;
104 data->crypto_binding = OPTIONAL_BINDING;
105+ data->phase2_auth = FOR_INITIAL;
106
107 if (config && config->phase1)
108 eap_peap_parse_phase1(data, config->phase1);
109@@ -454,6 +469,20 @@ static int eap_tlv_validate_cryptobinding(struct eap_sm *sm,
110 }
111
112
113+static bool peap_phase2_sufficient(struct eap_sm *sm,
114+ struct eap_peap_data *data)
115+{
116+ if ((data->phase2_auth == ALWAYS ||
117+ (data->phase2_auth == FOR_INITIAL &&
118+ !tls_connection_resumed(sm->ssl_ctx, data->ssl.conn) &&
119+ !data->ssl.client_cert_conf) ||
120+ data->phase2_eap_started) &&
121+ !data->phase2_eap_success)
122+ return false;
123+ return true;
124+}
125+
126+
127 /**
128 * eap_tlv_process - Process a received EAP-TLV message and generate a response
129 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
130@@ -568,6 +597,11 @@ static int eap_tlv_process(struct eap_sm *sm, struct eap_peap_data *data,
131 " - force failed Phase 2");
132 resp_status = EAP_TLV_RESULT_FAILURE;
133 ret->decision = DECISION_FAIL;
134+ } else if (!peap_phase2_sufficient(sm, data)) {
135+ wpa_printf(MSG_INFO,
136+ "EAP-PEAP: Server indicated Phase 2 success, but sufficient Phase 2 authentication has not been completed");
137+ resp_status = EAP_TLV_RESULT_FAILURE;
138+ ret->decision = DECISION_FAIL;
139 } else {
140 resp_status = EAP_TLV_RESULT_SUCCESS;
141 ret->decision = DECISION_UNCOND_SUCC;
142@@ -887,8 +921,7 @@ continue_req:
143 /* EAP-Success within TLS tunnel is used to indicate
144 * shutdown of the TLS channel. The authentication has
145 * been completed. */
146- if (data->phase2_eap_started &&
147- !data->phase2_eap_success) {
148+ if (!peap_phase2_sufficient(sm, data)) {
149 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase 2 "
150 "Success used to indicate success, "
151 "but Phase 2 EAP was not yet "
152@@ -1199,8 +1232,9 @@ static struct wpabuf * eap_peap_process(struct eap_sm *sm, void *priv,
153 static bool eap_peap_has_reauth_data(struct eap_sm *sm, void *priv)
154 {
155 struct eap_peap_data *data = priv;
156+
157 return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
158- data->phase2_success;
159+ data->phase2_success && data->phase2_auth != ALWAYS;
160 }
161
162
163diff --git a/src/eap_peer/eap_tls_common.c b/src/eap_peer/eap_tls_common.c
164index c1837db..a53eeb1 100644
165--- a/src/eap_peer/eap_tls_common.c
166+++ b/src/eap_peer/eap_tls_common.c
167@@ -239,6 +239,12 @@ static int eap_tls_params_from_conf(struct eap_sm *sm,
168
169 sm->ext_cert_check = !!(params->flags & TLS_CONN_EXT_CERT_CHECK);
170
171+ if (!phase2)
172+ data->client_cert_conf = params->client_cert ||
173+ params->client_cert_blob ||
174+ params->private_key ||
175+ params->private_key_blob;
176+
177 return 0;
178 }
179
180diff --git a/src/eap_peer/eap_tls_common.h b/src/eap_peer/eap_tls_common.h
181index 9ac0012..3348634 100644
182--- a/src/eap_peer/eap_tls_common.h
183+++ b/src/eap_peer/eap_tls_common.h
184@@ -79,6 +79,11 @@ struct eap_ssl_data {
185 * tls_v13 - Whether TLS v1.3 or newer is used
186 */
187 int tls_v13;
188+
189+ /**
190+ * client_cert_conf: Whether client certificate has been configured
191+ */
192+ bool client_cert_conf;
193 };
194
195
196diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
197index 6619d6b..d63f73c 100644
198--- a/wpa_supplicant/wpa_supplicant.conf
199+++ b/wpa_supplicant/wpa_supplicant.conf
200@@ -1321,6 +1321,13 @@ fast_reauth=1
201 # * 0 = do not use cryptobinding (default)
202 # * 1 = use cryptobinding if server supports it
203 # * 2 = require cryptobinding
204+# 'phase2_auth' option can be used to control Phase 2 (i.e., within TLS
205+# tunnel) behavior for PEAP:
206+# * 0 = do not require Phase 2 authentication
207+# * 1 = require Phase 2 authentication when client certificate
208+# (private_key/client_cert) is no used and TLS session resumption was
209+# not used (default)
210+# * 2 = require Phase 2 authentication in all cases
211 # EAP-WSC (WPS) uses following options: pin=<Device Password> or
212 # pbc=1.
213 #
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch
deleted file mode 100644
index 6e930fc98d..0000000000
--- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch
+++ /dev/null
@@ -1,73 +0,0 @@
1From cb41c214b78d6df187a31950342e48a403dbd769 Mon Sep 17 00:00:00 2001
2From: Sergey Matyukevich <geomatsi@gmail.com>
3Date: Tue, 22 Feb 2022 11:52:19 +0300
4Subject: [PATCH 1/2] build: Re-enable options for libwpa_client.so and
5 wpa_passphrase
6
7Commit a41a29192e5d ("build: Pull common fragments into a build.rules
8file") introduced a regression into wpa_supplicant build process. The
9build target libwpa_client.so is not built regardless of whether the
10option CONFIG_BUILD_WPA_CLIENT_SO is set or not. This happens because
11this config option is used before it is imported from the configuration
12file. Moving its use after including build.rules does not help: the
13variable ALL is processed by build.rules and further changes are not
14applied. Similarly, option CONFIG_NO_WPA_PASSPHRASE also does not work
15as expected: wpa_passphrase is always built regardless of whether the
16option is set or not.
17
18Re-enable these options by adding both build targets to _all
19dependencies.
20
21Fixes: a41a29192e5d ("build: Pull common fragments into a build.rules file")
22Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
23Upstream-Status: Backport
24Signed-off-by: Alex Kiernan <alexk@zuma.ai>
25Signed-off-by: Alex Kiernan <alexk@gmail.com>
26---
27 wpa_supplicant/Makefile | 19 ++++++++++++-------
28 1 file changed, 12 insertions(+), 7 deletions(-)
29
30diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
31index cb66defac7c8..c456825ae75f 100644
32--- a/wpa_supplicant/Makefile
33+++ b/wpa_supplicant/Makefile
34@@ -1,24 +1,29 @@
35 BINALL=wpa_supplicant wpa_cli
36
37-ifndef CONFIG_NO_WPA_PASSPHRASE
38-BINALL += wpa_passphrase
39-endif
40-
41 ALL = $(BINALL)
42 ALL += systemd/wpa_supplicant.service
43 ALL += systemd/wpa_supplicant@.service
44 ALL += systemd/wpa_supplicant-nl80211@.service
45 ALL += systemd/wpa_supplicant-wired@.service
46 ALL += dbus/fi.w1.wpa_supplicant1.service
47-ifdef CONFIG_BUILD_WPA_CLIENT_SO
48-ALL += libwpa_client.so
49-endif
50
51 EXTRA_TARGETS=dynamic_eap_methods
52
53 CONFIG_FILE=.config
54 include ../src/build.rules
55
56+ifdef CONFIG_BUILD_WPA_CLIENT_SO
57+# add the dependency this way to allow CONFIG_BUILD_WPA_CLIENT_SO
58+# being set in the config which is read by build.rules
59+_all: libwpa_client.so
60+endif
61+
62+ifndef CONFIG_NO_WPA_PASSPHRASE
63+# add the dependency this way to allow CONFIG_NO_WPA_PASSPHRASE
64+# being set in the config which is read by build.rules
65+_all: wpa_passphrase
66+endif
67+
68 ifdef LIBS
69 # If LIBS is set with some global build system defaults, clone those for
70 # LIBS_c and LIBS_p to cover wpa_passphrase and wpa_cli as well.
71--
722.35.1
73
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-macsec_linux-Hardware-offload-requires-Linux-headers.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-macsec_linux-Hardware-offload-requires-Linux-headers.patch
new file mode 100644
index 0000000000..f9634e47c9
--- /dev/null
+++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-macsec_linux-Hardware-offload-requires-Linux-headers.patch
@@ -0,0 +1,53 @@
1From 809d9d8172db8e2a08ff639875f838b5b86d2641 Mon Sep 17 00:00:00 2001
2From: Sergey Matyukevich <geomatsi@gmail.com>
3Date: Thu, 22 Aug 2024 00:03:41 +0300
4Subject: [PATCH] macsec_linux: Hardware offload requires Linux headers >= v5.7
5
6Hardware offload in Linux macsec driver is enabled in compile time if
7libnl version is >= v3.6. This is not sufficient for successful build
8since enum 'macsec_offload' has been added to Linux header if_link.h
9in kernels v5.6 and v5.7, see commits:
10- https://github.com/torvalds/linux/commit/21114b7feec29e4425a3ac48a037569c016a46c8
11- https://github.com/torvalds/linux/commit/76564261a7db80c5f5c624e0122a28787f266bdf
12
13New libnl with older Linux headers is a valid combination. This is how
14hostapd build failure has been detected by Buildroot autobuilder, see:
15- http://autobuild.buildroot.net/results/b59d5bc5bd17683a3a1e3577c40c802e81911f84/
16
17Extend compile time condition for the enablement of the macsec hardware
18offload adding Linux headers version check.
19
20Fixes: 40c139664439 ("macsec_linux: Add support for MACsec hardware offload")
21Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
22
23Upstream-Status: Backport [https://w1.fi/cgit/hostap/patch/?id=809d9d8172db8e2a08ff639875f838b5b86d2641]
24Signed-off-by: Jon Mason <jdmason@kudzu.us>
25---
26 src/drivers/driver_macsec_linux.c | 4 +++-
27 1 file changed, 3 insertions(+), 1 deletion(-)
28
29diff --git a/src/drivers/driver_macsec_linux.c b/src/drivers/driver_macsec_linux.c
30index c867154981e9..fad47a292f9f 100644
31--- a/src/drivers/driver_macsec_linux.c
32+++ b/src/drivers/driver_macsec_linux.c
33@@ -19,6 +19,7 @@
34 #include <netlink/route/link.h>
35 #include <netlink/route/link/macsec.h>
36 #include <linux/if_macsec.h>
37+#include <linux/version.h>
38 #include <inttypes.h>
39
40 #include "utils/common.h"
41@@ -32,7 +33,8 @@
42
43 #define UNUSED_SCI 0xffffffffffffffff
44
45-#if LIBNL_VER_NUM >= LIBNL_VER(3, 6)
46+#if (LIBNL_VER_NUM >= LIBNL_VER(3, 6) && \
47+ LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0))
48 #define LIBNL_HAS_OFFLOAD
49 #endif
50
51--
522.39.2
53
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch
deleted file mode 100644
index 53b0fcdf53..0000000000
--- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch
+++ /dev/null
@@ -1,26 +0,0 @@
1From d001b301ba7987f4b39453a211631b85c48f2ff8 Mon Sep 17 00:00:00 2001
2From: Jouni Malinen <quic_jouni@quicinc.com>
3Date: Thu, 3 Mar 2022 13:26:42 +0200
4Subject: [PATCH 2/2] Fix removal of wpa_passphrase on 'make clean'
5
6Fixes: 0430bc8267b4 ("build: Add a common-clean target")
7Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
8Upstream-Status: Backport
9Signed-off-by: Alex Kiernan <alexk@zuma.ai>
10Signed-off-by: Alex Kiernan <alexk@gmail.com>
11---
12 wpa_supplicant/Makefile | 1 +
13 1 file changed, 1 insertion(+)
14
15diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
16index c456825ae75f..4b4688931b1d 100644
17--- a/wpa_supplicant/Makefile
18+++ b/wpa_supplicant/Makefile
19@@ -2077,3 +2077,4 @@ clean: common-clean
20 rm -f libwpa_client.a
21 rm -f libwpa_client.so
22 rm -f libwpa_test1 libwpa_test2
23+ rm -f wpa_passphrase
24--
252.35.1
26
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.11.bb
index 22028ce957..6dc76494f7 100644
--- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb
+++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.11.bb
@@ -5,8 +5,8 @@ BUGTRACKER = "http://w1.fi/security/"
5SECTION = "network" 5SECTION = "network"
6LICENSE = "BSD-3-Clause" 6LICENSE = "BSD-3-Clause"
7LIC_FILES_CHKSUM = "file://COPYING;md5=5ebcb90236d1ad640558c3d3cd3035df \ 7LIC_FILES_CHKSUM = "file://COPYING;md5=5ebcb90236d1ad640558c3d3cd3035df \
8 file://README;beginline=1;endline=56;md5=e3d2f6c2948991e37c1ca4960de84747 \ 8 file://README;beginline=1;endline=56;md5=6e4b25e7d74bfc44a32ba37bdf5210a6 \
9 file://wpa_supplicant/wpa_supplicant.c;beginline=1;endline=12;md5=76306a95306fee9a976b0ac1be70f705" 9 file://wpa_supplicant/wpa_supplicant.c;beginline=1;endline=12;md5=f5ccd57ea91e04800edb88267bf8eae4"
10 10
11DEPENDS = "dbus libnl" 11DEPENDS = "dbus libnl"
12 12
@@ -15,14 +15,11 @@ SRC_URI = "http://w1.fi/releases/wpa_supplicant-${PV}.tar.gz \
15 file://wpa_supplicant.conf \ 15 file://wpa_supplicant.conf \
16 file://wpa_supplicant.conf-sane \ 16 file://wpa_supplicant.conf-sane \
17 file://99_wpa_supplicant \ 17 file://99_wpa_supplicant \
18 file://0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch \ 18 file://0001-macsec_linux-Hardware-offload-requires-Linux-headers.patch \
19 file://0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch \
20 file://0001-Install-wpa_passphrase-when-not-disabled.patch \
21 file://0001-PEAP-client-Update-Phase-2-authentication-requiremen.patch \
22 " 19 "
23SRC_URI[sha256sum] = "20df7ae5154b3830355f8ab4269123a87affdea59fe74fe9292a91d0d7e17b2f" 20SRC_URI[sha256sum] = "912ea06f74e30a8e36fbb68064d6cdff218d8d591db0fc5d75dee6c81ac7fc0a"
24 21
25S = "${WORKDIR}/wpa_supplicant-${PV}" 22S = "${UNPACKDIR}/wpa_supplicant-${PV}"
26 23
27inherit pkgconfig systemd 24inherit pkgconfig systemd
28 25
@@ -32,6 +29,8 @@ PACKAGECONFIG[openssl] = ",,openssl"
32 29
33CVE_PRODUCT = "wpa_supplicant" 30CVE_PRODUCT = "wpa_supplicant"
34 31
32CVE_STATUS[CVE-2024-5290] = "not-applicable-platform: this only affects Ubuntu and other platforms patching wpa-supplicant"
33
35EXTRA_OEMAKE = "'LIBDIR=${libdir}' 'INCDIR=${includedir}' 'BINDIR=${sbindir}'" 34EXTRA_OEMAKE = "'LIBDIR=${libdir}' 'INCDIR=${includedir}' 'BINDIR=${sbindir}'"
36 35
37do_configure () { 36do_configure () {
@@ -62,15 +61,15 @@ do_install () {
62 oe_runmake -C wpa_supplicant DESTDIR="${D}" install 61 oe_runmake -C wpa_supplicant DESTDIR="${D}" install
63 62
64 install -d ${D}${docdir}/wpa_supplicant 63 install -d ${D}${docdir}/wpa_supplicant
65 install -m 644 wpa_supplicant/README ${WORKDIR}/wpa_supplicant.conf ${D}${docdir}/wpa_supplicant 64 install -m 644 wpa_supplicant/README ${UNPACKDIR}/wpa_supplicant.conf ${D}${docdir}/wpa_supplicant
66 65
67 install -d ${D}${sysconfdir} 66 install -d ${D}${sysconfdir}
68 install -m 600 ${WORKDIR}/wpa_supplicant.conf-sane ${D}${sysconfdir}/wpa_supplicant.conf 67 install -m 600 ${UNPACKDIR}/wpa_supplicant.conf-sane ${D}${sysconfdir}/wpa_supplicant.conf
69 68
70 install -d ${D}${sysconfdir}/network/if-pre-up.d/ 69 install -d ${D}${sysconfdir}/network/if-pre-up.d/
71 install -d ${D}${sysconfdir}/network/if-post-down.d/ 70 install -d ${D}${sysconfdir}/network/if-post-down.d/
72 install -d ${D}${sysconfdir}/network/if-down.d/ 71 install -d ${D}${sysconfdir}/network/if-down.d/
73 install -m 755 ${WORKDIR}/wpa-supplicant.sh ${D}${sysconfdir}/network/if-pre-up.d/wpa-supplicant 72 install -m 755 ${UNPACKDIR}/wpa-supplicant.sh ${D}${sysconfdir}/network/if-pre-up.d/wpa-supplicant
74 ln -sf ../if-pre-up.d/wpa-supplicant ${D}${sysconfdir}/network/if-post-down.d/wpa-supplicant 73 ln -sf ../if-pre-up.d/wpa-supplicant ${D}${sysconfdir}/network/if-post-down.d/wpa-supplicant
75 74
76 install -d ${D}/${sysconfdir}/dbus-1/system.d 75 install -d ${D}/${sysconfdir}/dbus-1/system.d
@@ -84,7 +83,7 @@ do_install () {
84 fi 83 fi
85 84
86 install -d ${D}/etc/default/volatiles 85 install -d ${D}/etc/default/volatiles
87 install -m 0644 ${WORKDIR}/99_wpa_supplicant ${D}/etc/default/volatiles 86 install -m 0644 ${UNPACKDIR}/99_wpa_supplicant ${D}/etc/default/volatiles
88 87
89 install -d ${D}${includedir} 88 install -d ${D}${includedir}
90 install -m 0644 ${S}/src/common/wpa_ctrl.h ${D}${includedir} 89 install -m 0644 ${S}/src/common/wpa_ctrl.h ${D}${includedir}
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-15 20:18:01 +0000