pool/hostapd
SHA256
5
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6813f6d9b7
hostapd/hostapd.changes

1084 lines
49 KiB
Plaintext
Raw Blame History

-------------------------------------------------------------------
Fri Dec 28 12:01:55 UTC 2018 - Jan Engelhardt <jengelh@inai.de>
- Use noun phrase in summary.
-------------------------------------------------------------------
Mon Dec 17 09:07:15 UTC 2018 - Karol Babioch <kbabioch@suse.de>
- Applied spec-cleaner
- Added bug reference
- Use defconfig file as template for configuration instead of patching it
during build. This is easier to maintain in the long run. This removes the
patch hostapd-2.6-defconfig.patch in favor of a simple config file, which is
copied over from the source directory.
- Enabled CLI editing and history support.
-------------------------------------------------------------------
Fri Dec 7 20:46:47 UTC 2018 - mardnh@gmx.de
- Update to version 2.7
* fixed WPA packet number reuse with replayed messages and key
reinstallation
[http://w1.fi/security/2017-1/] (CVE-2017-13082) (bsc#1056061)
* added support for FILS (IEEE 802.11ai) shared key authentication
* added support for OWE (Opportunistic Wireless Encryption, RFC 8110;
and transition mode defined by WFA)
* added support for DPP (Wi-Fi Device Provisioning Protocol)
* FT:
- added local generation of PMK-R0/PMK-R1 for FT-PSK
(ft_psk_generate_local=1)
- replaced inter-AP protocol with a cleaner design that is more
easily extensible; this breaks backward compatibility and requires
all APs in the ESS to be updated at the same time to maintain FT
functionality
- added support for wildcard R0KH/R1KH
- replaced r0_key_lifetime (minutes) parameter with
ft_r0_key_lifetime (seconds)
- fixed wpa_psk_file use for FT-PSK
- fixed FT-SAE PMKID matching
- added expiration to PMK-R0 and PMK-R1 cache
- added IEEE VLAN support (including tagged VLANs)
- added support for SHA384 based AKM
* SAE
- fixed some PMKSA caching cases with SAE
- added support for configuring SAE password separately of the
WPA2 PSK/passphrase
- added option to require MFP for SAE associations
(sae_require_pmf=1)
- fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection
for SAE;
note: this is not backwards compatible, i.e., both the AP and
station side implementations will need to be update at the same
time to maintain interoperability
- added support for Password Identifier
* hostapd_cli: added support for command history and completion
* added support for requesting beacon report
* large number of other fixes, cleanup, and extensions
* added option to configure EAPOL-Key retry limits
(wpa_group_update_count and wpa_pairwise_update_count)
* removed all PeerKey functionality
* fixed nl80211 AP mode configuration regression with Linux 4.15 and
newer
* added support for using wolfSSL cryptographic library
* fixed some 20/40 MHz coexistence cases where the BSS could drop to
20 MHz even when 40 MHz would be allowed
* Hotspot 2.0
- added support for setting Venue URL ANQP-element (venue_url)
- added support for advertising Hotspot 2.0 operator icons
- added support for Roaming Consortium Selection element
- added support for Terms and Conditions
- added support for OSEN connection in a shared RSN BSS
* added support for using OpenSSL 1.1.1
* added EAP-pwd server support for salted passwords
- Remove not longer needed patches (fixed upstream)
* rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
* rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
* rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
* rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
* rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
* rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
* rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
* rebased-v2.6-0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
- Verify source signature
-------------------------------------------------------------------
Fri Oct 19 10:32:25 UTC 2018 - Karol Babioch <kbabioch@suse.com>
- Added rebased-v2.6-0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).
-------------------------------------------------------------------
Wed Oct 18 21:59:01 UTC 2017 - chris@intrbiz.com
- Fix KRACK attacks (bsc#1063479, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088):
* rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
* rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
* rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
* rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
* rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
* rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
* rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
* rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
-------------------------------------------------------------------
Mon Oct 02 14:39:02 BST 2016 - chris@intrbiz.com
- update to upstream release 2.6
* fixed EAP-pwd last fragment validation
[http://w1.fi/security/2015-7/] (CVE-2015-5314)
* fixed WPS configuration update vulnerability with malformed passphrase
[http://w1.fi/security/2016-1/] (CVE-2016-4476)
* extended channel switch support for VHT bandwidth changes
* added support for configuring new ANQP-elements with
anqp_elem=<InfoID>:<hexdump of payload>
* fixed Suite B 192-bit AKM to use proper PMK length
(note: this makes old releases incompatible with the fixed behavior)
* added no_probe_resp_if_max_sta=1 parameter to disable Probe Response
frame sending for not-associated STAs if max_num_sta limit has been
reached
* added option (-S as command line argument) to request all interfaces
to be started at the same time
* modified rts_threshold and fragm_threshold configuration parameters
to allow -1 to be used to disable RTS/fragmentation
* EAP-pwd: added support for Brainpool Elliptic Curves
(with OpenSSL 1.0.2 and newer)
* fixed EAPOL reauthentication after FT protocol run
* fixed FTIE generation for 4-way handshake after FT protocol run
* fixed and improved various FST operations
* TLS server
- support SHA384 and SHA512 hashes
- support TLS v1.2 signature algorithm with SHA384 and SHA512
- support PKCS #5 v2.0 PBES2
- support PKCS #5 with PKCS #12 style key decryption
- minimal support for PKCS #12
- support OCSP stapling (including ocsp_multi)
* added support for OpenSSL 1.1 API changes
- drop support for OpenSSL 0.9.8
- drop support for OpenSSL 1.0.0
* EAP-PEAP: support fast-connect crypto binding
* RADIUS
- fix Called-Station-Id to not escape SSID
- add Event-Timestamp to all Accounting-Request packets
- add Acct-Session-Id to Accounting-On/Off
- add Acct-Multi-Session-Id ton Access-Request packets
- add Service-Type (= Frames)
- allow server to provide PSK instead of passphrase for WPA-PSK
Tunnel_password case
- update full message for interim accounting updates
- add Acct-Delay-Time into Accounting messages
- add require_message_authenticator configuration option to require
CoA/Disconnect-Request packets to be authenticated
* started to postpone WNM-Notification frame sending by 100 ms so that
the STA has some more time to configure the key before this frame is
received after the 4-way handshake
* VHT: added interoperability workaround for 80+80 and 160 MHz channels
* extended VLAN support (per-STA vif, etc.)
* fixed PMKID derivation with SAE
* nl80211
- added support for full station state operations
- fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use
unencrypted EAPOL frames
* added initial MBO support; number of extensions to WNM BSS Transition
Management
* added initial functionality for location related operations
* added assocresp_elements parameter to allow vendor specific elements
to be added into (Re)Association Response frames
* improved Public Action frame addressing
- use Address 3 = wildcard BSSID in GAS response if a query from an
unassociated STA used that address
- fix TX status processing for Address 3 = wildcard BSSID
- add gas_address3 configuration parameter to control Address 3
behavior
* added command line parameter -i to override interface parameter in
hostapd.conf
* added command completion support to hostapd_cli
* added passive client taxonomy determination (CONFIG_TAXONOMY=y
compile option and "SIGNATURE <addr>" control interface command)
* number of small fixes
- renamed hostapd-2.5-defconfig.patch to hostapd-2.6-defconfig.patch
-------------------------------------------------------------------
Sun Oct 18 12:59:02 UTC 2015 - michael@stroeder.com
- update to upstream release 2.5
- removed 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
(CVE-2015-1863) because it's fixed in upstream release 2.5
- rebased hostapd-2.4-defconfig.patch -> hostapd-2.5-defconfig.patch
ChangeLog for hostapd since 2.4:
2015-09-27 - v2.5
* fixed WPS UPnP vulnerability with HTTP chunked transfer encoding
[http://w1.fi/security/2015-2/] (CVE-2015-4141 bsc#930077)
* fixed WMM Action frame parser
[http://w1.fi/security/2015-3/] (CVE-2015-4142 bsc#930078)
* fixed EAP-pwd server missing payload length validation
[http://w1.fi/security/2015-4/]
(CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, bsc#930079)
* fixed validation of WPS and P2P NFC NDEF record payload length
[http://w1.fi/security/2015-5/]
* nl80211:
- fixed vendor command handling to check OUI properly
* fixed hlr_auc_gw build with OpenSSL
* hlr_auc_gw: allow Milenage RES length to be reduced
* disable HT for a station that does not support WMM/QoS
* added support for hashed password (NtHash) in EAP-pwd server
* fixed and extended dynamic VLAN cases
* added EAP-EKE server support for deriving Session-Id
* set Acct-Session-Id to a random value to make it more likely to be
unique even if the device does not have a proper clock
* added more 2.4 GHz channels for 20/40 MHz HT co-ex scan
* modified SAE routines to be more robust and PWE generation to be
stronger against timing attacks
* added support for Brainpool Elliptic Curves with SAE
* increases maximum value accepted for cwmin/cwmax
* added support for CCMP-256 and GCMP-256 as group ciphers with FT
* added Fast Session Transfer (FST) module
* removed optional fields from RSNE when using FT with PMF
(workaround for interoperability issues with iOS 8.4)
* added EAP server support for TLS session resumption
* fixed key derivation for Suite B 192-bit AKM (this breaks
compatibility with the earlier version)
* added mechanism to track unconnected stations and do minimal band
steering
* number of small fixes
-------------------------------------------------------------------
Thu Apr 23 19:45:41 UTC 2015 - michael@stroeder.com
- update version 2.4
- added 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
for CVE-2015-1863
- updated URLs
- require pkg-config and libnl3-devel during build
- replaced hostapd-2.3-defconfig.patch by hostapd-2.4-defconfig.patch
ChangeLog for hostapd since 2.3:
2015-03-15 - v2.4
* allow OpenSSL cipher configuration to be set for internal EAP server
(openssl_ciphers parameter)
* fixed number of small issues based on hwsim test case failures and
static analyzer reports
* fixed Accounting-Request to not include duplicated Acct-Session-Id
* add support for Acct-Multi-Session-Id in RADIUS Accounting messages
* add support for PMKSA caching with SAE
* add support for generating BSS Load element (bss_load_update_period)
* fixed channel switch from VHT to HT
* add INTERFACE-ENABLED and INTERFACE-DISABLED ctrl_iface events
* add support for learning STA IPv4/IPv6 addresses and configuring
ProxyARP support
* dropped support for the madwifi driver interface
* add support for Suite B (128-bit and 192-bit level) key management and
cipher suites
* fixed a regression with driver=wired
* extend EAPOL-Key msg 1/4 retry workaround for changing SNonce
* add BSS_TM_REQ ctrl_iface command to send BSS Transition Management
Request frames and BSS-TM-RESP event to indicate response to such
frame
* add support for EAP Re-Authentication Protocol (ERP)
* fixed AP IE in EAPOL-Key 3/4 when both WPA and FT was enabled
* fixed a regression in HT 20/40 coex Action frame parsing
* set stdout to be line-buffered
* add support for vendor specific VHT extension to enable 256 QAM rates
(VHT-MCS 8 and 9) on 2.4 GHz band
* RADIUS DAS:
- extend Disconnect-Request processing to allow matching of multiple
sessions
- support Acct-Multi-Session-Id as an identifier
- allow PMKSA cache entry to be removed without association
* expire hostapd STA entry if kernel does not have a matching entry
* allow chanlist to be used to specify a subset of channels for ACS
* improve ACS behavior on 2.4 GHz band and allow channel bias to be
configured with acs_chan_bias parameter
* do not reply to a Probe Request frame that includes DSS Parameter Set
element in which the channel does not match the current operating
channel
* add UPDATE_BEACON ctrl_iface command; this can be used to force Beacon
frame contents to be updated and to start beaconing on an interface
that used start_disabled=1
* fixed some RADIUS server failover cases
-------------------------------------------------------------------
Mon Jan 5 19:23:24 UTC 2015 - michael@stroeder.com
- update version 2.3
- removed patch hostapd-2.1-be-host_to_le.patch because it
seems obsolete
- hostapd-2.1-defconfig.patch rediffed and renamed to hostapd-2.3-defconfig.patch
ChangeLog for hostapd since 2.1:
2014-10-09 - v2.3
* fixed number of minor issues identified in static analyzer warnings
* fixed DFS and channel switch operation for multi-BSS cases
* started to use constant time comparison for various password and hash
values to reduce possibility of any externally measurable timing
differences
* extended explicit clearing of freed memory and expired keys to avoid
keeping private data in memory longer than necessary
* added support for number of new RADIUS attributes from RFC 7268
(Mobility-Domain-Id, WLAN-HESSID, WLAN-Pairwise-Cipher,
WLAN-Group-Cipher, WLAN-AKM-Suite, WLAN-Group-Mgmt-Pairwise-Cipher)
* fixed GET_CONFIG wpa_pairwise_cipher value
* added code to clear bridge FDB entry on station disconnection
* fixed PMKSA cache timeout from Session-Timeout for WPA/WPA2 cases
* fixed OKC PMKSA cache entry fetch to avoid a possible infinite loop
in case the first entry does not match
* fixed hostapd_cli action script execution to use more robust mechanism
(CVE-2014-3686)
2014-06-04 - v2.2
* fixed SAE confirm-before-commit validation to avoid a potential
segmentation fault in an unexpected message sequence that could be
triggered remotely
* extended VHT support
- Operating Mode Notification
- Power Constraint element (local_pwr_constraint)
- Spectrum management capability (spectrum_mgmt_required=1)
- fix VHT80 segment picking in ACS
- fix vht_capab 'Maximum A-MPDU Length Exponent' handling
- fix VHT20
* fixed HT40 co-ex scan for some pri/sec channel switches
* extended HT40 co-ex support to allow dynamic channel width changes
during the lifetime of the BSS
* fixed HT40 co-ex support to check for overlapping 20 MHz BSS
* fixed MSCHAP UTF-8 to UCS-2 conversion for three-byte encoding;
this fixes password with include UTF-8 characters that use
three-byte encoding EAP methods that use NtPasswordHash
* reverted TLS certificate validation step change in v2.1 that rejected
any AAA server certificate with id-kp-clientAuth even if
id-kp-serverAuth EKU was included
* fixed STA validation step for WPS ER commands to prevent a potential
crash if an ER sends an unexpected PutWLANResponse to a station that
is disassociated, but not fully removed
* enforce full EAP authentication after RADIUS Disconnect-Request by
removing the PMKSA cache entry
* added support for NAS-IP-Address, NAS-identifier, and NAS-IPv6-Address
in RADIUS Disconnect-Request
* added mechanism for removing addresses for MAC ACLs by prefixing an
entry with "-"
* Interworking/Hotspot 2.0 enhancements
- support Hotspot 2.0 Release 2
* OSEN network for online signup connection
* subscription remediation (based on RADIUS server request or
control interface HS20_WNM_NOTIF for testing purposes)
* Hotspot 2.0 release number indication in WFA RADIUS VSA
* deauthentication request (based on RADIUS server request or
control interface WNM_DEAUTH_REQ for testing purposes)
* Session Info URL RADIUS AVP to trigger ESS Disassociation Imminent
* hs20_icon config parameter to configure icon files for OSU
* osu_* config parameters for OSU Providers list
- do not use Interworking filtering rules on Probe Request if
Interworking is disabled to avoid interop issues
* added/fixed nl80211 functionality
- AP interface teardown optimization
- support vendor specific driver command
(VENDOR <vendor id> <sub command id> [<hex formatted data>])
* fixed PMF protection of Deauthentication frame when this is triggered
by session timeout
* internal TLS implementation enhancements/fixes
- add SHA256-based cipher suites
- add DHE-RSA cipher suites
- fix X.509 validation of PKCS#1 signature to check for extra data
* RADIUS server functionality
- add minimal RADIUS accounting server support (hostapd-as-server);
this is mainly to enable testing coverage with hwsim scripts
- allow authentication log to be written into SQLite databse
- added option for TLS protocol testing of an EAP peer by simulating
various misbehaviors/known attacks
- MAC ACL support for testing purposes
* fixed PTK derivation for CCMP-256 and GCMP-256
* extended WPS per-station PSK to support ER case
* added option to configure the management group cipher
(group_mgmt_cipher=AES-128-CMAC (default), BIP-GMAC-128, BIP-GMAC-256,
BIP-CMAC-256)
* fixed AP mode default TXOP Limit values for AC_VI and AC_VO (these
were rounded incorrectly)
* added support for postponing FT response in case PMK-R1 needs to be
pulled from R0KH
* added option to advertise 40 MHz intolerant HT capability with
ht_capab=[40-INTOLERANT]
* remove WPS 1.0 only support, i.e., WSC 2.0 support is now enabled
whenever CONFIG_WPS=y is set
* EAP-pwd fixes
- fix possible segmentation fault on EAP method deinit if an invalid
group is negotiated
* fixed RADIUS client retransmit/failover behavior
- there was a potential ctash due to freed memory being accessed
- failover to a backup server mechanism did not work properly
* fixed a possible crash on double DISABLE command when multiple BSSes
are enabled
* fixed a memory leak in SAE random number generation
* fixed GTK rekeying when the station uses FT protocol
* fixed off-by-one bounds checking in printf_encode()
- this could result in deinial of service in some EAP server cases
* various bug fixes
-------------------------------------------------------------------
Tue May 27 19:57:16 UTC 2014 - crrodriguez@opensuse.org
- Update hostapd-2.1-defconfig.patch and spec file
to build with libnl3 instead of libnl1
-------------------------------------------------------------------
Wed Apr 16 15:50:48 UTC 2014 - i@marguerite.su
- update version 2.1
* see http://hostap.epitest.fi/cgit/hostap/log/ for details.
- change hostapd.diff to hostapd-2.1-defconfig.patch
- remove patch: hostapd-tmp.diff, no longer needed.
-------------------------------------------------------------------
Wed Oct 2 15:33:43 UTC 2013 - dvaleev@suse.com
- fix host_to_le32 undefined on BigEndian architectures
(hostapd-be-host_to_le.patch)
-------------------------------------------------------------------
Thu Apr 18 08:05:13 UTC 2013 - aj@suse.com
- Do not package /etc/init.d
- Do not install init file since package contains a service file and
is only build for Factory
- Cleanup spec file
- Use /run instead of /var/run
-------------------------------------------------------------------
Wed Apr 17 16:14:02 UTC 2013 - cfarrell@suse.com
- license update: GPL-2.0 or BSD-3-Clause
README makes it clear that this is a dual license - i.e. choice of either
or
-------------------------------------------------------------------
Tue Apr 9 17:49:22 UTC 2013 - avm-xandry@yandex.ru
- update to version 2.0
- fix corrected file name hostapd.dif to hostapd.diff
- in default config includes all features (IEEE 802.11w, Hotspot 2.0, IEEE 802.11ac, WPS, etc.)
-------------------------------------------------------------------
Tue Nov 6 04:41:17 UTC 2012 - crrodriguez@opensuse.org
- Add Native systemd units
-------------------------------------------------------------------
Tue May 15 04:55:22 UTC 2012 - glin@suse.com
- update to version 1.0
- respin hostapd.dif to fit the new defconfig
- change the file permission of the config files with passwords
to 600 (bnc#740964)
-------------------------------------------------------------------
Wed Oct 12 08:46:43 UTC 2011 - lnussel@suse.de
- update to version 0.7.3
- don't use /tmp for dump file in default config
- verbose build
- fix build for older distros
- enable driver 'none' for radius only mode
- add init script
-------------------------------------------------------------------
Fri Sep 30 15:22:48 UTC 2011 - uli@suse.com
- cross-build fix: use %__cc macro
-------------------------------------------------------------------
Fri Sep 16 12:02:37 UTC 2011 - jengelh@medozas.de
- Select libnl-1_1-devel
-------------------------------------------------------------------
Sun Oct 31 12:37:02 UTC 2010 - jengelh@medozas.de
- Use %_smp_mflags
-------------------------------------------------------------------
Wed Jun 9 05:32:08 CEST 2010 - sndirsch@suse.de
- udpated to release 0.6.10
- updated hostapd.dif
- git-commit-eb1f744.diff:
* Move DTIM period configuration into Beacon set operation; fixes
"Could not set DTIM period for kernel driver; wlan0: Unable to
setup interface.rmdir[ctrl_interface]: No such file or
directory" error when using "nl80211" driver
-------------------------------------------------------------------
Wed Sep 24 00:58:59 CEST 2008 - ro@suse.de
- drop buildreq for madwifi (dropped package)
-------------------------------------------------------------------
Tue Sep 23 01:14:12 CEST 2008 - ro@suse.de
- updae to version 0.5.10, changes:
* fixed EAP-SIM and EAP-AKA message parser to validate attribute
lengths properly to avoid potential crash caused by invalid messages
* fixed Reassociation Response callback processing when using internal
MLME (driver_{hostap,devicescape,test}.c)
* fixed EAP-SIM/AKA realm processing to allow decorated usernames to
be used
* added a workaround for EAP-SIM/AKA peers that include incorrect null
termination in the username
* fixed EAP-SIM Start response processing for fast reauthentication
case
* copy optional Proxy-State attributes into RADIUS response when acting
as a RADIUS authentication server
- update to version 0.5.9, changes:
* updated EAP Generalized Pre-Shared Key (EAP-GPSK) to use the latest
draft (draft-ietf-emu-eap-gpsk-07.txt)
* fixed debugging code not to use potentially unaligned read to fetch
IPv4 addresses
-------------------------------------------------------------------
Mon Jan 21 14:54:48 CET 2008 - cstender@suse.de
- fixed madwifi include dir (b.n.c #350982)
-------------------------------------------------------------------
Mon Jul 30 16:57:16 CEST 2007 - jg@suse.de
- update to version 0.5.8, changes:
* updated driver_devicescape.c to build with the current
wireless-dev.git tree and net/d80211 changes
* updated EAP Generalized Pre-Shared Key (EAP-GPSK) to use the latest
draft (draft-ietf-emu-eap-gpsk-03.txt)
* fixed EAP-MSCHAPv2 server to use a space between S and M parameters
in Success Request [Bug 203]
* added support for sending EAP-AKA Notifications in error cases
* RADIUS server: added support for processing duplicate messages
(retransmissions from RADIUS client) by replying with the previous
reply
-------------------------------------------------------------------
Wed Mar 14 17:27:32 CET 2007 - jg@suse.de
- split off hostapd in its own package
- update to version 0.5.7, changes (shortened):
* fixed EAP-PSK bit ordering of the Flags field
* fixed configuration reloading (SIGHUP) to re-initialize WPA PSKs
* fixed IPv6 connection to RADIUS accounting server
* added support for configuring and controlling multiple BSSes per
radio interface (bss=<ifname> in hostapd.conf)
* added support for dynamic VLAN configuration
* driver_madwifi: fixed configuration of unencrypted modes
* added preliminary implementation of IEEE 802.11w/D1.0 (management
frame protection)
* fixed session timeout processing with drivers that do not use
ieee802_11.c (e.g., madwifi)
* added 'hostapd_cli new_sta <addr>' command for adding a new STA
into hostapd
* fixed hostapd to add PMKID KDE into 4-Way Handshake Message 1
when using WPA2 even if PMKSA caching is not used
* added -P<pid file> argument for hostapd to write the current
process id into a file
* added support for RADIUS Authentication Server MIB (RFC 2619)
* added support for EAP Generalized Pre-Shared Key
* fixed a segmentation fault when RSN pre-authentication was
completed successfully
* added support for EAP-SAKE
* driver_madwifi: added support for getting station RSN IE from
madwifi-ng svn r1453 and newer
* fixed WPA message 3/4 not to encrypt Key Data field (WPA IE)
* added ap_max_inactivity configuration parameter
* added support for EAP expanded type (vendor specific EAP methods)
* added support for using EAP-SIM pseudonyms and fast re-authentication
* added support for EAP-AKA in the integrated EAP authenticator
-------------------------------------------------------------------
Mon Sep 18 14:13:31 CEST 2006 - jg@suse.de
- hostap-utils: Fixed usage of uninitialised variable (bug 184410)
- hostapd: Update to version 0.4.9, changes:
* added a new configuration option, eapol_version, that can be
used to set EAPOL version to 1 (default is 2) to work around
broken client implementations that drop EAPOL frames which use
version number 2 [Bug 89]
* fixed EAP-MSCHAPv2 message length validation
* fixed stdarg use in hostapd_logger(): if both stdout and syslog
logging was enabled, hostapd could trigger a segmentation fault
in vsyslog on some CPU -- C library combinations
-------------------------------------------------------------------
Sun Feb 5 19:37:30 CET 2006 - ro@suse.de
- use madwifi-devel in BuildRequires
-------------------------------------------------------------------
Sun Feb 5 17:09:48 CET 2006 - aj@suse.de
- Remove BuildRequires on km_wlan.
-------------------------------------------------------------------
Wed Jan 25 21:36:28 CET 2006 - mls@suse.de
- converted neededforbuild to BuildRequires
-------------------------------------------------------------------
Mon Nov 21 14:00:48 CET 2005 - jg@suse.de
- hostapd: update to 0.4.7, changes:
* driver_wired: fixed EAPOL sending to optionally use PAE group
address as the destination instead of supplicant MAC address
* driver_madwifi: configure driver to use TKIP countermeasures in
order to get correct behavior
* driver_madwifi: added support for madwifi-ng
- hostapd: remove obsolete madwifi patch
- hostapd: updated config file
- hostap-utils: update to 0.4.7 (no changes)
- use %{jobs}
-------------------------------------------------------------------
Tue Nov 8 15:28:33 CET 2005 - jg@suse.de
- do not build as root
-------------------------------------------------------------------
Fri Nov 4 17:51:44 CET 2005 - jg@suse.de
- hostapd, update to 0.4.6, changes:
* added support for replacing user identity from EAP with RADIUS
User-Name attribute from Access-Accept message, if that is included,
for the RADIUS accounting messages (e.g., for EAP-PEAP/TTLS to get
tunneled identity into accounting messages when the RADIUS server
does not support better way of doing this with Class attribute)
* driver_madwifi: fixed EAPOL packet receive for configuration where
ath# is part of a bridge interface
* added a configuration file and log analyzer script for logwatch
* fixed EAPOL state machine step function to process all state
transitions before processing new events; this resolves a race
condition in which EAPOL-Start message could trigger hostapd to send
two EAP-Response/Identity frames to the authentication server
- hostapd: added support for madwifi-ng
- removed hostap-driver, is part of the kernel now
-------------------------------------------------------------------
Thu Oct 13 16:29:17 CEST 2005 - jg@suse.de
- hostapd: update to 0.4.5, changes (shortened):
* added client CA list to the TLS certificate request in order to
make it easier for the client to select which certificate to use
* added experimental support for EAP-PSK
* added support for WE-19 (hostap, madwifi)
* fixed PMKSA caching to copy User-Name and Class attributes so
that RADIUS accounting gets correct information
* start RADIUS accounting only after successful completion of WPA
4-Way Handshake if WPA-PSK is used
* fixed PMKSA caching for the case where
* EAP-PAX is now registered as EAP type 46
* fixed EAP-PAX MAC calculation
* fixed EAP-PAX CK and ICK key derivation
- hostap-driver: update to 0.4.5, changes:
* added support for WE-19
- hostap-utils: update to 0.4.0 (no real changes)
-------------------------------------------------------------------
Thu Sep 8 16:41:41 CEST 2005 - jg@suse.de
- fixed file permissions
-------------------------------------------------------------------
Mon Aug 22 15:21:31 CEST 2005 - jg@suse.de
- hostap-driver: update to 0.4.4, changes:
* added support for pcmcia changes in Linux 2.6.13
* added support for creating sysfs device files (Linux 2.6.x)
* fixed power save processing for PS-Poll frames with PwrMgmt flag
set (this was causing "wifi0: invalid skb->cb magic" errors)
* fixed linking both hostap_cs and hostap_pci to kernel
* filter out sequential disconnect events to make race condition with
received EAPOL frames less likely to happen (this improves
authentication success rate with some APs that send EAPOL frames
very quickly after the (re)association response)
* added support for setting channel mask for scan requests
-------------------------------------------------------------------
Sun Aug 7 22:13:32 CEST 2005 - ro@suse.de
- fix build with current wireless drivers
-------------------------------------------------------------------
Mon Jul 11 16:34:25 CEST 2005 - jg@suse.de
- hostapd: update to 0.3.9, changes:
* fixed a bug which caused some RSN pre-authentication cases to
use freed memory and potentially crash hostapd
* fixed private key loading for cases where passphrase is not set
* fixed WPA2 to add PMKSA cache entry when using integrated EAP
authenticator
* driver_madwifi: fixed pairwise key removal to allow WPA reauth
without disassociation
* fixed RADIUS attribute Class processing to only use
Access-Accept packets to update Class; previously, other RADIUS
authentication packets could have cleared Class attribute
* fixed PMKSA caching (EAP authentication was not skipped correctly
with the new state machine changes from IEEE 802.1X draft)
- hostap-driver: update to 0.3.9, changes:
* fixed background scans (iwlist wlan0 scan) not to break data
connection when in host_roaming 2 mode
* fixed beacon frame when moving from monitor mode to master mode
-------------------------------------------------------------------
Wed Jun 8 08:23:34 CEST 2005 - meissner@suse.de
- adjust hostapd/Makefile to be able to correctly
get passed RPM_OPT_FLAGS.
-------------------------------------------------------------------
Wed Jun 8 00:09:10 CEST 2005 - meissner@suse.de
- Use RPM_OPT_FLAGS.
-------------------------------------------------------------------
Fri Mar 11 14:36:44 CET 2005 - jg@suse.de
- hostap-driver:
* create sysfs links for ethernet device, not IEEE80211 device
* disabled sysfs links for hostap_cs, as it breaks association
-------------------------------------------------------------------
Thu Feb 24 15:28:31 CET 2005 - jg@suse.de
- hostap-driver: fixed sysfs support
-------------------------------------------------------------------
Mon Feb 14 10:11:51 CET 2005 - jg@suse.de
- hostapd, hostap-utils, hostap-driver: update to 0.3.7 final
(no real changes, just version rename)
-------------------------------------------------------------------
Mon Feb 7 21:11:32 CET 2005 - jg@suse.de
- disabled support for madwifi on non x86(-64) platforms
-------------------------------------------------------------------
Mon Feb 7 14:43:27 CET 2005 - jg@suse.de
- hostapd: update to version 0.3.7-pre, changes (shortened):
* added support for configuring a forced PEAP version based on
the Phase 1 identity
* fixed PEAPv1 to use tunneled EAP-Success/Failure instead of
EAP-TLV to terminate authentication
* driver_madwifi: filter wireless events based on ifindex to
allow more than one network interface to be used
* added support for configuring multiple allowed EAP types for
Phase 2 authentication (EAP-PEAP, EAP-TTLS)
* added support for EAP-PEAP in the integrated EAP authenticator
* added support for EAP-GTC in the integrated EAP authenticator
* added support for configuring list of EAP methods for Phase 1
so that the integrated EAP authenticator can, e.g., use the
wildcard entry for EAP-TLS and EAP-PEAP
* added support for EAP-TTLS in the integrated EAP authenticator
* added support for EAP-SIM in the integrated EAP authenticator
* added support for using hostapd as a RADIUS authentication
server with the integrated EAP authenticator taking care of
EAP authentication
* driver_madwifi: fixed group key setup and added get_ssid method
* added support for EAP-MSCHAPv2 in the integrated EAP
authenticator
* added support for integrated EAP-TLS authentication
* added support for reading PKCS#12 (PFX) files (as a replacement
for PEM/DER) to get certificate and private key (CONFIG_PKCS12)
* added support for Acct-{Input,Output}-Gigawords
* added support for Event-Timestamp (in RADIUS Accounting-Requests)
* added support for RADIUS Authentication Client MIB (RFC2618)
* added support for RADIUS Accounting Client MIB (RFC2620)
* made EAP re-authentication period configurable
* fixed EAPOL reauthentication to trigger WPA/WPA2 reauthentication
* added support for multiple WPA pre-shared keys
* added support for multiple driver interfaces to allow hostapd
to be used with other drivers
* added wired authenticator driver interface
* added madwifi driver interface
* fixed RADIUS reconnection after an error in sending interim
accounting packets
* added hostapd control interface for external programs
* finished update from IEEE 802.1X-2001 to IEEE 802.1X-REV
(now d11)
* added support for strict GTK rekeying
* added Prism54 driver interface
* dual-licensed hostapd (GPLv2 and BSD licenses)
* added integrated EAP authenticator that can be used instead of
external RADIUS authentication server
- hostap-driver: update to version 0.3.7-pre, changes:
* improved suspend operation: disable firmware (hostap_cs) and
generate disconnect event to trigger wpa_supplicant to
reassociate immediately after resume
* added new ioctl command for hostapd to clear station specific
accounting data when starting a new accounting session
* added support for the special initialization needed for the
wireless part of multi-function SanDisk ConnectPlus CF cards
(manfid 0xd601, 0x0101)
* fixed card enabling after firmware download in case any of the
netdevs were up when the download was started
* added support for Linux wireless extension v17
- hostap-utils: update to version 0.3.7-pre (no changes)
- added all example configuration files
-------------------------------------------------------------------
Thu Jan 13 12:26:34 CET 2005 - jg@suse.de
- hostapd: update to version 0.2.6, changes:
* fixed RADIUS accounting to generate a new session id for cases
where a station reassociates without first being complete
deauthenticated
* fixed STA disassociation handler to mark next timeout state to
deauthenticate the station, i.e., skip long wait for inactivity
poll and extra disassociation, if the STA disassociates without
deauthenticating
* removed 'daemonize' configuration file option since it has not
really been used at all for more than year
- hostap-utils: update to version 0.2.6, changes:
* split_combined_hex: updated to use head/tail -n argument
- hostap-driver: update to version 0.2.6, changes:
* added support for changed PCI API in Linux 2.6.10-rc1 and newer
-------------------------------------------------------------------
Tue Nov 2 17:53:18 CET 2004 - jg@suse.de
- hostapd: update to version 0.2.5, changes:
* fixed EAPOL reauthentication to trigger WPA/WPA2
reauthentication
* fixed EAPOL state machine to stop if STA is removed during
eapol_sm_step(); this fixes at least one segfault triggering
bug with IEEE 802.11i pre-authentication
* fixed an alignment issue that could cause SHA-1 to fail on some
platforms (e.g., Intel ixp425 with a compiler that does not
32-bit align variables)
* fixed RADIUS reconnection after an error in sending interim
accounting packets
- hostap-driver: update to version 0.2.5, changes:
* fixed card enabling after firmware download in case any of the
netdevs were up when the download was started
* fixed netif_carrier_on/off() calls to leave carrier on for
Master mode; previously this may have been left off in some
cases which could prevent packet bridging with new kernel
versions
- hostap-driver: enabled support for non-volatile firmware download
-------------------------------------------------------------------
Fri Oct 1 18:13:12 CEST 2004 - jg@suse.de
- fixed sysfs device/driver links (bug 46633)
-------------------------------------------------------------------
Mon Aug 9 09:35:05 CEST 2004 - jg@suse.de
- fixed filelist
-------------------------------------------------------------------
Fri Aug 6 15:09:06 CEST 2004 - jg@suse.de
- do not install /etc/pcmcia/hostap_cs.conf.example anymore
-------------------------------------------------------------------
Thu Jul 29 19:51:55 CEST 2004 - jg@suse.de
- update hostapd to 0.2.4:
* fixed some accounting cases where Accounting-Start was sent
when IEEE 802.1X port was being deauthorized
* modified RADIUS client to re-connect the socket in case of
certain error codes that are generated when a network
interface state is changes (e.g., when IP address changes or
the interface is set UP)
* fixed couple of cases where EAPOL state for a station was freed
twice causing a segfault for hostapd
* fixed couple of bugs in processing WPA deauthentication
* fixed WPA/WPA2 group rekeying to use key index correctly (GN/GM)
* fixed group rekeying to send zero TSC in EAPOL-Key messages to
fix cases where STAs dropped multicast frames as replay attacks
* added support for copying RADIUS Attribute 'Class' from
authentication messages into accounting messages
* send canned EAP failure if RADIUS server sends Access-Reject
without EAP message (previously, Supplicant was not notified
in this case)
* fixed mixed WPA-PSK and WPA-EAP mode to work with WPA-PSK
- update hostap-utils to 0.2.4 (no changes)
- update hostap-driver to 0.2.4:
* fixed wlan#/wifi# interface packet counters (both are supposed
to see data packets once; wlan# was counting TX twice and wifi#
did not count TX or RX at all for most cases)
* fixed compilation with PRISM2_NO_STATION_MODES defined
* fixed MAC address changing to update address for wifi# interface
(without this, at least Master mode did not work correctly when
MAC address was changed for wlan#)
* fixed inner-BSS bridge (ap_bridge_packets=1) not to bridge
packets to unauthorized ports when IEEE 802.1X/WPA is used
* merged CryptoAPI versions of WEP/TKIP/CCMP from the wireless-2.6
BitKeeper tree (not used by default, can be enabled by defining
HOSTAP_USE_CRYPTO_API)
* fixed a buffer overflow in TKIP encryption (hostap_crypt_tkip
module) on big endian hosts
-------------------------------------------------------------------
Mon May 17 18:15:57 CEST 2004 - jg@suse.de
- update hostapd to 0.2.1 (shortened):
* added WPA and IEEE 802.11i/RSN (WPA2) Authenticator
functionality
* added support for Acct-Interim-Interval
* added new hostapd.conf variable, nas_identifier, that can be
used to add an optional RADIUS Attribute, NAS-Identifier, into
authentication and accounting messages
* added support for Accounting-On and Accounting-Off messages
- update hostap-utils to 0.2.1:
* hostap_rid: fixed handling of failed RID reads
* fixed prism2_srec not to allow combination of volatile and
non-volatile firmware images (they will corrupt the card flash)
* added support for loading PRI firmware for cards without PRI
* fixed volatile download of combined primary and secondary
firmware to start running the secondary firmware
* added support for dumping PDA in text format and overriding PDA
with text and binary files (prism2_srec options -D, -P, and -O)
- update hostap-driver to 0.2.1 (shortened):
* allow hostapd to send encrypted frames using wlan#ap interface
* added driver support for hostapd WPA Authenticator
* fixed TKIP get sequence number
* clear IFF_RUNNING and generate linkwatch events based on
association status in Managed mode
* added alternative TKIP implementation which uses Michael MIC
implementation in CryptoAPI instead of Host AP specific
implementation
* added support for RSN (IEEE 802.11i/WPA2)
* dropped support for Linux 2.2.x and old Linux 2.4.x kernels
* fixed hostap_cs unregistration when PC Card is removed while
Host AP interfaces are still up
* restructured Linux net device use to be more like IEEE 802.1q
VLAN
* disable wlan hardware when radio netdev (wifi#) is down
* fixed Shared Key authentication when using host_decrypt and
kernel driver based IEEE 802.11 management
* added crypto hooks for full MSDU encrypt/decrypt
* fixed iwspy support with Linux wireless ext v16
* fixed IEEE 802.11 defragmentation when using host-based WEP
decryption and bridging packets between two associated STAs
* added driver support for WPA Authenticator/Supplicant
* added minimal support for ethtool
- fixed bug in hostap-driver Makefile which prevented hostap_cs.ko
from being built
-------------------------------------------------------------------
Sat Apr 3 17:39:13 CEST 2004 - jg@suse.de
- fixed sysfs support in hostap driver (bug #37278)
-------------------------------------------------------------------
Tue Mar 30 11:09:31 CEST 2004 - jg@suse.de
- skipping build for UM kernels (bug #37448)
- skipping build of hostap_cs in case PCMCIA is disabled in the
kernel config (also bug #37448)
-------------------------------------------------------------------
Tue Mar 2 08:20:38 CET 2004 - jg@suse.de
- typo fix in makefile
-------------------------------------------------------------------
Sun Feb 29 12:28:30 CET 2004 - jg@suse.de
- update to hostapd-0.1.3, changes:
* fixed event loop to call signal handlers only after returning from
the real signal handler
* reset sta->timeout_next after successful association to make sure
that the previously registered inactivity timer will not remove the
STA immediately (e.g., if STA deauthenticates and re-associates
before the timer is triggered).
- update to hostap-driver-0.1.3, changes:
* fixed IEEE 802.11 defragmentation when using host-based WEP
decryption and bridging packets between two associated STAs
(this caused a kernel crash in dev_queue_xmit())
* reconfigure fragmentation threshold after Port0 enable to work around
issues with some STA firmware versions forgetting the configured
value
* restore retry limit after card reset
* update STA RX statistics also in Repeater mode
* hostap_cs: fixed CS reset when the netdev is down: need to reset
hardware even in this case to make resume from suspend mode work
correctly
* fixed error reporting from Genesis mode download
* changed README to use 'make' instead of 'make pccard/pci/plx' when
building the driver
* replaced CardServices() calls with calls to matching pcmcia_*()
functions (required for Linux 2.6.2 and newer)
* fixed module reference counting of hostap_crypt_wep module for
Linux 2.6.x (i.e., prevent it from be unloaded if it is still used)
- update to hostap-utils-0.1.3, changes:
* prism2_srec: ignore PDR 0x0413 if it is not used (this allows some
of the newer STA firmware 1.8.x versions to be downloaded)
* prism2_srec: fixed combined RAM download of PRI and STA firmwares
to use correct start address
- added driver race condition fix from hostap CVS
- rewrote driver Makefile
-------------------------------------------------------------------
Mon Jan 26 15:01:49 CET 2004 - jg@suse.de
- removed kernel-source from neededforbuild
-------------------------------------------------------------------
Fri Jan 9 18:44:30 CET 2004 - jg@suse.de
- driver update to version 0.1.2, from ChangeLog
* fixed RTS and Fragmentation thresholds after hw reset
* fixed Managed/Ad-hoc mode authentication with Open System
algorithm when using old (e.g., version 0.6.2) STA firmware
* fixed iwspy support with Linux wireless ext v16
* fixed WDS interface selection to not select non-WDS interface
* fixed wlan#wds#, wlan#ap, and wlan#sta netdevice unregistration
* added PCI ID for Prism3 mini-PCI [hostap_pci]
* fixed yield() backward compatibility code for Linux 2.4.0-18
* added support for 32-bit CommTallies (if STA f/w >= 0.8.2)
* update counters used for /proc/net/hostap/wlan#/stats periodically
* fixed CommTallies handling on big endian platforms
* added support for Primary-only mode
* fixed failure handling in PCI probe not to crash kernel [hostap_pci]
* merged hostap_crypt module into hostap module
* fixed inactivity polling of stations that are in power saving mode
- utils update to version 0.1.2, from ChangeLog
* fixed prism2_srec not to allow combination of volatile and
non-volatile firmware images (they will corrupt the card flash)
* reduced verbosity of prism2_srec
* added support for volatile download of Primary firmware using
Genesis mode (this is available only for hfa3842; hfa3841, i.e., old
Prism2 cards, require hardware changes for similar function)
('-g' command line option in prism2_srec)
* added support for merging two srec file (Primary and Secondary(STA)
firmware) into one non-volatile (flash) download
- hostapd update to version 0.1.0
-------------------------------------------------------------------
Mon Sep 8 18:35:40 CEST 2003 - agruen@suse.de
- km_hostap-HZ.diff: Adapt to dynamic-hz kernel patch.
-------------------------------------------------------------------
Mon Jul 28 16:52:09 CEST 2003 - jg@suse.de
- update to version 0.0.4, from ChangeLog (shortened)
* moved non-hardware specific RX code from hostap_hw.c into a new file,
hostap_80211_rx.c and removed Prism2 RX descriptor dependency from
hostap_ap.c
* fixed number of compilation issues (RH9 kernel, *.mod files to local
directory, 2.4.x compilation with CONFIG_MODVERSIONS, external
pcmcia-cs)
* removed extra tasklet that was used with TX callback handler
* update basic rate set automaticallyt when changing supported rate set
* fixed compilation without Linux Wireless Extensions
* use less aggressive transmit rate decreasing algorithm
* fixed inactivity expiration of stations using power saving mode
* fixed sending of IEEE 802.1X frames to buffer them if STA is in power
saving mode
* removed backward compatibility code for Linux Wireless Extensions
versions older than ver 9
* added module parameter 'dev_template' for setting the device name
template (default: 'wlan%d'); this is for hostap_{cs,pci,plx}.o
* changed monitor mode to use pseudo-IBSS mode instead of Host AP mode
to avoid sending out Beacon and ProbeResp frames
* fixed enh_sec setting (hide SSID) to reset Port0 so that the changes
to the beacon are taken into use immediately
* added support for selection which authentication algorithm to use
in station mode
* added support for manual scan and roaming mode (managed/ad-hoc);
* process beacon frames in kernel driver even when hostapd is used
* removed TX power controlling (iwconfig txpower)
-------------------------------------------------------------------
Tue Jun 17 10:06:30 CEST 2003 - jg@suse.de
- added directory /usr/src/kernel-modules to filelist
-------------------------------------------------------------------
Wed Jun 4 13:25:28 CEST 2003 - jg@suse.de
- Initial package
Reference in New Issue View Git Blame Copy Permalink