linux/meta-openembedded.git/meta-oe/recipes-connectivity/hostapd, branch master

hostapd: Fix clearing settings for color switch

2026-05-31T10:08:56+00:00

cca_settings is used without zero initialization, which may introduce random values and result in invalid nl80211 attributes. Without this fix, BSS color switch may fail completely and the feature becomes non-functional. Initialize the structure before use. Signed-off-by: Wei Zhang Signed-off-by: Khem Raj

hostapd: patch CVE-2025-24912

2025-11-01T23:45:17+00:00

Pick patches as listed in NVD CVE report. Note that Debian lists one of the patches as introducing the vulnerability. This is against what the original report [1] says. Also the commit messages provide hints that the first patch fixes this issue and second is fixing problem with the first patch. [1] https://jvn.jp/en/jp/JVN19358384/ Signed-off-by: Peter Marko Signed-off-by: Khem Raj

hostapd: Backport a patch to build SAE-PK correctly

2025-09-24T03:44:20+00:00

SAE-PK needs base64_decode(), but if no other feature is enabled that needs base64 support, then it is missing. Signed-off-by: Peter Kjellerstedt Signed-off-by: Khem Raj

hostapd: enable 802.11be, SAE-PK, OWE, SuiteB, ACS, and MBO support

2025-07-17T15:53:08+00:00

hostapd has supported IEEE 802.11be (Wi-Fi 7) for over three years. Given the growing market demand for Wi-Fi 7, it is now an appropriate time to enable support for IEEE 802.11be Extremely High Throughput (EHT). Note that CONFIG_IEEE80211AX is a mandatory prerequisite for setting CONFIG_IEEE80211BE. This patch also enables the following build-time options in defconfig, all of which have no runtime impact: SAE Public Key (SAE_PK) Opportunistic Wireless Encryption (OWE) Suite B and Suite B 192 Automatic Channel Selection (ACS) Multiband Operation (MBO) Signed-off-by: Miaoqing Pan Signed-off-by: Khem Raj

hostapd: enable SAE support

2025-06-05T15:11:28+00:00

Enable Simultaneous Authentication of Equals (SAE) in defconfig to support WPA3-Personal authentication method. Required for modern wireless security standards. This is build-time only change with no runtime impact - SAE requires explicit configuration to activate. Existing WPA2 setups remain unaffected. Signed-off-by: Vitor Soares Signed-off-by: Khem Raj

hostapd: upgrade 2.10 -> 2.11

2024-08-09T21:25:21+00:00

License-Update: Copyright updated to 2024. Changelog: =========== * Wi-Fi Easy Connect - add support for DPP release 3 - allow Configurator parameters to be provided during config exchange * HE/IEEE 802.11ax/Wi-Fi 6 - various fixes * EHT/IEEE 802.11be/Wi-Fi 7 - add preliminary support * SAE: add support for fetching the password from a RADIUS server * support OpenSSL 3.0 API changes * support background radar detection and CAC with some additional drivers * support RADIUS ACL/PSK check during 4-way handshake (wpa_psk_radius=3) * EAP-SIM/AKA: support IMSI privacy * improve 4-way handshake operations - use Secure=1 in message 3 during PTK rekeying * OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases to avoid interoperability issues * support new SAE AKM suites with variable length keys * support new AKM for 802.1X/EAP with SHA384 * extend PASN support for secure ranging * FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP) - this is based on additional details being added in the IEEE 802.11 standard - the new implementation is not backwards compatible * improved ACS to cover additional channel types/bandwidths * extended Multiple BSSID support * fix beacon protection with FT protocol (incorrect BIGTK was provided) * support unsynchronized service discovery (USD) * add preliminary support for RADIUS/TLS * add support for explicit SSID protection in 4-way handshake (a mitigation for CVE-2023-52424; disabled by default for now, can be enabled with ssid_protection=1) * fix SAE H2E rejected groups validation to avoid downgrade attacks * use stricter validation for some RADIUS messages * a large number of other fixes, cleanup, and extensions Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

hostapd: Only include the relevant parts from README in LIC_FILES_CHKSUM

2024-05-30T15:42:03+00:00

Only include the lines from the README that cover the copyright and the license text. License-Update: Only include the relevant parts of the README Signed-off-by: Peter Kjellerstedt Signed-off-by: Khem Raj

hostapd: Support running "devtool modify hostapd"

2024-05-30T15:42:03+00:00

For "devtool modify" to work correctly, ${B} needs to match ${S}. Signed-off-by: Peter Kjellerstedt Signed-off-by: Khem Raj

recipes: Start WORKDIR -> UNPACKDIR transition

2024-05-23T15:44:44+00:00

Replace references of WORKDIR with UNPACKDIR where it makes sense to do so in preparation for changing the default value of UNPACKDIR. Signed-off-by: Khem Raj

hostapd: upgrade 2.9 -> 2.10

2022-01-25T18:56:04+00:00

0001-Prepare-for-CVE-2021-30004.patch.patch CVE-2019-16275.patch CVE-2019-5061.patch CVE-2021-0326.patch CVE-2021-27803.patch CVE-2021-30004.patch removed since they're included in 2.10 License-Update: year updated to 2022. Changelog: ========= * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added option send SAE Confirm immediately (sae_config_immediate=1) after SAE Commit - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2) - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed WPS UPnP SUBSCRIBE handling of invalid operations [https://w1.fi/security/2020-1/] * fixed PMF disconnection protection bypass [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * fixed various issues in experimental support for EAP-TEAP server * added configuration (max_auth_rounds, max_auth_rounds_short) to increase the maximum number of EAP message exchanges (mainly to support cases with very large certificates) for the EAP server * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * extended HE (IEEE 802.11ax) support, including 6 GHz support * removed obsolete IAPP functionality * fixed EAP-FAST server with TLS GCM/CCM ciphers * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible; owe_ptk_workaround=1 can be used to enabled a a workaround for the group 20/21 backwards compatibility * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * added support for PASN * added EAP-TLS server support for TLS 1.3 (disabled by default for now) * a large number of other fixes, cleanup, and extensions Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj