Update to 2.11, fix for CVE-2023-52424

OBS-URL: https://build.opensuse.org/package/show/Base:System/hostapd?expand=0&rev=69
2024-08-31 09:32:18 +00:00 · 2024-08-31 09:32:18 +00:00 · 788dd5615c
commit 788dd5615c
12 changed files with 2055 additions and 0 deletions
--- a/.gitattributes
+++ b/.gitattributes
@ -0,0 +1,23 @@
+## Default LFS
+*.7z filter=lfs diff=lfs merge=lfs -text
+*.bsp filter=lfs diff=lfs merge=lfs -text
+*.bz2 filter=lfs diff=lfs merge=lfs -text
+*.gem filter=lfs diff=lfs merge=lfs -text
+*.gz filter=lfs diff=lfs merge=lfs -text
+*.jar filter=lfs diff=lfs merge=lfs -text
+*.lz filter=lfs diff=lfs merge=lfs -text
+*.lzma filter=lfs diff=lfs merge=lfs -text
+*.obscpio filter=lfs diff=lfs merge=lfs -text
+*.oxt filter=lfs diff=lfs merge=lfs -text
+*.pdf filter=lfs diff=lfs merge=lfs -text
+*.png filter=lfs diff=lfs merge=lfs -text
+*.rpm filter=lfs diff=lfs merge=lfs -text
+*.tbz filter=lfs diff=lfs merge=lfs -text
+*.tbz2 filter=lfs diff=lfs merge=lfs -text
+*.tgz filter=lfs diff=lfs merge=lfs -text
+*.ttf filter=lfs diff=lfs merge=lfs -text
+*.txz filter=lfs diff=lfs merge=lfs -text
+*.whl filter=lfs diff=lfs merge=lfs -text
+*.xz filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
+*.zst filter=lfs diff=lfs merge=lfs -text
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1 @@
+.osc
--- a/apparmor-usr.sbin.hostapd
+++ b/apparmor-usr.sbin.hostapd
@ -0,0 +1,33 @@
+abi <abi/3.0>,
+
+#include <tunables/global>
+
+profile hostapd /usr/sbin/hostapd {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+
+  capability net_admin,
+  capability net_raw,
+  network packet,
+  network raw,
+
+  # for RADIUS
+  network inet dgram,
+  network inet6 dgram,
+
+  # grant read access to config files
+  /etc/hostapd.* r,
+  /etc/ssl/openssl.cnf r,
+  /etc/libnl/classid r,
+
+  @{PROC}/sys/net/ipv*/conf/*/arp_accept w,
+  /sys/devices/platform/**/net/**/proxyarp_wifi w,
+  /sys/devices/platform/**/net/**/hairpin_mode w,
+
+  # grant access to RFKILL control device
+  /dev/rfkill rw,
+
+  /run/hostapd/ rw,
+  /run/hostapd/* rw,
+
+}
--- a/431
+++ b/431
@ -0,0 +1,431 @@
+# Example hostapd build time configuration
+#
+# This file lists the configuration options that are used when building the
+# hostapd binary. All lines starting with # are ignored. Configuration option
+# lines must be commented out complete, if they are not to be included, i.e.,
+# just setting VARIABLE=n is not disabling that variable.
+#
+# This file is included in Makefile, so variables like CFLAGS and LIBS can also
+# be modified from here. In most cass, these lines should use += in order not
+# to override previous values of the variables.
+
+# Driver interface for Host AP driver
+CONFIG_DRIVER_HOSTAP=y
+
+# Driver interface for wired authenticator
+CONFIG_DRIVER_WIRED=y
+
+# Driver interface for drivers using the nl80211 kernel interface
+CONFIG_DRIVER_NL80211=y
+
+# QCA vendor extensions to nl80211
+#CONFIG_DRIVER_NL80211_QCA=y
+
+# driver_nl80211.c requires libnl. If you are compiling it yourself
+# you may need to point hostapd to your version of libnl.
+#
+#CFLAGS += -I$<path to libnl include files>
+#LIBS += -L$<path to libnl library files>
+
+# Use libnl v2.0 (or 3.0) libraries.
+#CONFIG_LIBNL20=y
+
+# Use libnl 3.2 libraries (if this is selected, CONFIG_LIBNL20 is ignored)
+CONFIG_LIBNL32=y
+
+
+# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
+#CONFIG_DRIVER_BSD=y
+#CFLAGS += -I/usr/local/include
+#LIBS += -L/usr/local/lib
+#LIBS_p += -L/usr/local/lib
+#LIBS_c += -L/usr/local/lib
+
+# Driver interface for no driver (e.g., RADIUS server only)
+CONFIG_DRIVER_NONE=y
+
+# IEEE 802.11F/IAPP
+CONFIG_IAPP=y
+
+# WPA2/IEEE 802.11i RSN pre-authentication
+CONFIG_RSN_PREAUTH=y
+
+# IEEE 802.11w (management frame protection)
+CONFIG_IEEE80211W=y
+
+# Support Operating Channel Validation
+#CONFIG_OCV=y
+
+# Integrated EAP server
+CONFIG_EAP=y
+
+# EAP Re-authentication Protocol (ERP) in integrated EAP server
+CONFIG_ERP=y
+
+# EAP-MD5 for the integrated EAP server
+CONFIG_EAP_MD5=y
+
+# EAP-TLS for the integrated EAP server
+CONFIG_EAP_TLS=y
+
+# EAP-MSCHAPv2 for the integrated EAP server
+CONFIG_EAP_MSCHAPV2=y
+
+# EAP-PEAP for the integrated EAP server
+CONFIG_EAP_PEAP=y
+
+# EAP-GTC for the integrated EAP server
+CONFIG_EAP_GTC=y
+
+# EAP-TTLS for the integrated EAP server
+CONFIG_EAP_TTLS=y
+
+# EAP-SIM for the integrated EAP server
+CONFIG_EAP_SIM=y
+
+# EAP-AKA for the integrated EAP server
+CONFIG_EAP_AKA=y
+
+# EAP-AKA' for the integrated EAP server
+# This requires CONFIG_EAP_AKA to be enabled, too.
+CONFIG_EAP_AKA_PRIME=y
+
+# EAP-PAX for the integrated EAP server
+CONFIG_EAP_PAX=y
+
+# EAP-PSK for the integrated EAP server (this is _not_ needed for WPA-PSK)
+CONFIG_EAP_PSK=y
+
+# EAP-pwd for the integrated EAP server (secure authentication with a password)
+CONFIG_EAP_PWD=y
+
+# EAP-SAKE for the integrated EAP server
+CONFIG_EAP_SAKE=y
+
+# EAP-GPSK for the integrated EAP server
+CONFIG_EAP_GPSK=y
+# Include support for optional SHA256 cipher suite in EAP-GPSK
+CONFIG_EAP_GPSK_SHA256=y
+
+# EAP-FAST for the integrated EAP server
+# Note: If OpenSSL is used as the TLS library, OpenSSL 1.0 or newer is needed
+# for EAP-FAST support. Older OpenSSL releases would need to be patched, e.g.,
+# with openssl-0.9.8x-tls-extensions.patch, to add the needed functions.
+#CONFIG_EAP_FAST=y
+
+# EAP-TEAP for the integrated EAP server
+# Note: The current EAP-TEAP implementation is experimental and should not be
+# enabled for production use. The IETF RFC 7170 that defines EAP-TEAP has number
+# of conflicting statements and missing details and the implementation has
+# vendor specific workarounds for those and as such, may not interoperate with
+# any other implementation. This should not be used for anything else than
+# experimentation and interoperability testing until those issues has been
+# resolved.
+#CONFIG_EAP_TEAP=y
+
+# Wi-Fi Protected Setup (WPS)
+CONFIG_WPS=y
+# Enable UPnP support for external WPS Registrars
+CONFIG_WPS_UPNP=y
+# Enable WPS support with NFC config method
+CONFIG_WPS_NFC=y
+
+# EAP-IKEv2
+CONFIG_EAP_IKEV2=y
+
+# Trusted Network Connect (EAP-TNC)
+CONFIG_EAP_TNC=y
+
+# EAP-EKE for the integrated EAP server
+CONFIG_EAP_EKE=y
+
+# PKCS#12 (PFX) support (used to read private key and certificate file from
+# a file that usually has extension .p12 or .pfx)
+CONFIG_PKCS12=y
+
+# RADIUS authentication server. This provides access to the integrated EAP
+# server from external hosts using RADIUS.
+#CONFIG_RADIUS_SERVER=y
+
+# Build IPv6 support for RADIUS operations
+CONFIG_IPV6=y
+
+# IEEE Std 802.11r-2008 (Fast BSS Transition)
+CONFIG_IEEE80211R=y
+
+# Use the hostapd's IEEE 802.11 authentication (ACL), but without
+# the IEEE 802.11 Management capability (e.g., FreeBSD/net80211)
+CONFIG_DRIVER_RADIUS_ACL=y
+
+# IEEE 802.11n (High Throughput) support
+CONFIG_IEEE80211N=y
+
+# Wireless Network Management (IEEE Std 802.11v-2011)
+# Note: This is experimental and not complete implementation.
+CONFIG_WNM=y
+
+# IEEE 802.11ac (Very High Throughput) support
+CONFIG_IEEE80211AC=y
+
+# IEEE 802.11ax HE support
+# Note: This is experimental and work in progress. The definitions are still
+# subject to change and this should not be expected to interoperate with the
+# final IEEE 802.11ax version.
+#CONFIG_IEEE80211AX=y
+
+# Remove debugging code that is printing out debug messages to stdout.
+# This can be used to reduce the size of the hostapd considerably if debugging
+# code is not needed.
+#CONFIG_NO_STDOUT_DEBUG=y
+
+# Add support for writing debug log to a file: -f /tmp/hostapd.log
+# Disabled by default.
+CONFIG_DEBUG_FILE=y
+
+# Send debug messages to syslog instead of stdout
+#CONFIG_DEBUG_SYSLOG=y
+
+# Add support for sending all debug messages (regardless of debug verbosity)
+# to the Linux kernel tracing facility. This helps debug the entire stack by
+# making it easy to record everything happening from the driver up into the
+# same file, e.g., using trace-cmd.
+#CONFIG_DEBUG_LINUX_TRACING=y
+
+# Remove support for RADIUS accounting
+#CONFIG_NO_ACCOUNTING=y
+
+# Remove support for RADIUS
+#CONFIG_NO_RADIUS=y
+
+# Remove support for VLANs
+#CONFIG_NO_VLAN=y
+
+# Enable support for fully dynamic VLANs. This enables hostapd to
+# automatically create bridge and VLAN interfaces if necessary.
+CONFIG_FULL_DYNAMIC_VLAN=y
+
+# Use netlink-based kernel API for VLAN operations instead of ioctl()
+# Note: This requires libnl 3.1 or newer.
+CONFIG_VLAN_NETLINK=y
+
+# Remove support for dumping internal state through control interface commands
+# This can be used to reduce binary size at the cost of disabling a debugging
+# option.
+#CONFIG_NO_DUMP_STATE=y
+
+# Enable tracing code for developer debugging
+# This tracks use of memory allocations and other registrations and reports
+# incorrect use with a backtrace of call (or allocation) location.
+#CONFIG_WPA_TRACE=y
+# For BSD, comment out these.
+#LIBS += -lexecinfo
+#LIBS_p += -lexecinfo
+#LIBS_c += -lexecinfo
+
+# Use libbfd to get more details for developer debugging
+# This enables use of libbfd to get more detailed symbols for the backtraces
+# generated by CONFIG_WPA_TRACE=y.
+#CONFIG_WPA_TRACE_BFD=y
+# For BSD, comment out these.
+#LIBS += -lbfd -liberty -lz
+#LIBS_p += -lbfd -liberty -lz
+#LIBS_c += -lbfd -liberty -lz
+
+# hostapd depends on strong random number generation being available from the
+# operating system. os_get_random() function is used to fetch random data when
+# needed, e.g., for key generation. On Linux and BSD systems, this works by
+# reading /dev/urandom. It should be noted that the OS entropy pool needs to be
+# properly initialized before hostapd is started. This is important especially
+# on embedded devices that do not have a hardware random number generator and
+# may by default start up with minimal entropy available for random number
+# generation.
+#
+# As a safety net, hostapd is by default trying to internally collect
+# additional entropy for generating random data to mix in with the data
+# fetched from the OS. This by itself is not considered to be very strong, but
+# it may help in cases where the system pool is not initialized properly.
+# However, it is very strongly recommended that the system pool is initialized
+# with enough entropy either by using hardware assisted random number
+# generator or by storing state over device reboots.
+#
+# hostapd can be configured to maintain its own entropy store over restarts to
+# enhance random number generation. This is not perfect, but it is much more
+# secure than using the same sequence of random numbers after every reboot.
+# This can be enabled with -e<entropy file> command line option. The specified
+# file needs to be readable and writable by hostapd.
+#
+# If the os_get_random() is known to provide strong random data (e.g., on
+# Linux/BSD, the board in question is known to have reliable source of random
+# data from /dev/urandom), the internal hostapd random pool can be disabled.
+# This will save some in binary size and CPU use. However, this should only be
+# considered for builds that are known to be used on devices that meet the
+# requirements described above.
+#CONFIG_NO_RANDOM_POOL=y
+
+# Should we attempt to use the getrandom(2) call that provides more reliable
+# yet secure randomness source than /dev/random on Linux 3.17 and newer.
+# Requires glibc 2.25 to build, falls back to /dev/random if unavailable.
+CONFIG_GETRANDOM=y
+
+# Should we use poll instead of select? Select is used by default.
+#CONFIG_ELOOP_POLL=y
+
+# Should we use epoll instead of select? Select is used by default.
+#CONFIG_ELOOP_EPOLL=y
+
+# Should we use kqueue instead of select? Select is used by default.
+#CONFIG_ELOOP_KQUEUE=y
+
+# Select TLS implementation
+# openssl = OpenSSL (default)
+# gnutls = GnuTLS
+# internal = Internal TLSv1 implementation (experimental)
+# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
+# none = Empty template
+CONFIG_TLS=openssl
+
+# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.1)
+# can be enabled to get a stronger construction of messages when block ciphers
+# are used.
+CONFIG_TLSV11=y
+
+# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.2)
+# can be enabled to enable use of stronger crypto algorithms.
+CONFIG_TLSV12=y
+
+# Select which ciphers to use by default with OpenSSL if the user does not
+# specify them.
+#CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW"
+
+# If CONFIG_TLS=internal is used, additional library and include paths are
+# needed for LibTomMath. Alternatively, an integrated, minimal version of
+# LibTomMath can be used. See beginning of libtommath.c for details on benefits
+# and drawbacks of this option.
+#CONFIG_INTERNAL_LIBTOMMATH=y
+#ifndef CONFIG_INTERNAL_LIBTOMMATH
+#LTM_PATH=/usr/src/libtommath-0.39
+#CFLAGS += -I$(LTM_PATH)
+#LIBS += -L$(LTM_PATH)
+#LIBS_p += -L$(LTM_PATH)
+#endif
+# At the cost of about 4 kB of additional binary size, the internal LibTomMath
+# can be configured to include faster routines for exptmod, sqr, and div to
+# speed up DH and RSA calculation considerably
+#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
+
+# Interworking (IEEE 802.11u)
+# This can be used to enable functionality to improve interworking with
+# external networks.
+CONFIG_INTERWORKING=y
+
+# Hotspot 2.0
+CONFIG_HS20=y
+
+# Enable SQLite database support in hlr_auc_gw, EAP-SIM DB, and eap_user_file
+CONFIG_SQLITE=y
+
+# Enable Fast Session Transfer (FST)
+CONFIG_FST=y
+
+# Enable CLI commands for FST testing
+CONFIG_FST_TEST=y
+
+# Testing options
+# This can be used to enable some testing options (see also the example
+# configuration file) that are really useful only for testing clients that
+# connect to this hostapd. These options allow, for example, to drop a
+# certain percentage of probe requests or auth/(re)assoc frames.
+#
+#CONFIG_TESTING_OPTIONS=y
+
+# Automatic Channel Selection
+# This will allow hostapd to pick the channel automatically when channel is set
+# to "acs_survey" or "0". Eventually, other ACS algorithms can be added in
+# similar way.
+#
+# Automatic selection is currently only done through initialization, later on
+# we hope to do background checks to keep us moving to more ideal channels as
+# time goes by. ACS is currently only supported through the nl80211 driver and
+# your driver must have survey dump capability that is filled by the driver
+# during scanning.
+#
+# You can customize the ACS survey algorithm with the hostapd.conf variable
+# acs_num_scans.
+#
+# Supported ACS drivers:
+# * ath9k
+# * ath5k
+# * ath10k
+#
+# For more details refer to:
+# http://wireless.kernel.org/en/users/Documentation/acs
+#
+CONFIG_ACS=y
+
+# Multiband Operation support
+# These extensions facilitate efficient use of multiple frequency bands
+# available to the AP and the devices that may associate with it.
+CONFIG_MBO=y
+
+# Client Taxonomy
+# Has the AP retain the Probe Request and (Re)Association Request frames from
+# a client, from which a signature can be produced which can identify the model
+# of client device like "Nexus 6P" or "iPhone 5s".
+#CONFIG_TAXONOMY=y
+
+# Fast Initial Link Setup (FILS) (IEEE 802.11ai)
+CONFIG_FILS=y
+# FILS shared key authentication with PFS
+CONFIG_FILS_SK_PFS=y
+
+# Include internal line edit mode in hostapd_cli. This can be used to provide
+# limited command line editing and history support.
+CONFIG_WPA_CLI_EDIT=y
+
+# Opportunistic Wireless Encryption (OWE)
+# Experimental implementation of draft-harkins-owe-07.txt
+CONFIG_OWE=y
+
+# Airtime policy support
+CONFIG_AIRTIME_POLICY=y
+
+# Override default value for the wpa_disable_eapol_key_retries configuration
+# parameter. See that parameter in hostapd.conf for more details.
+#CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1
+
+# Wired equivalent privacy (WEP)
+# WEP is an obsolete cryptographic data confidentiality algorithm that is not
+# considered secure. It should not be used for anything anymore. The
+# functionality needed to use WEP is available in the current hostapd
+# release under this optional build parameter. This functionality is subject to
+# be completely removed in a future release.
+#CONFIG_WEP=y
+
+# Remove all TKIP functionality
+# TKIP is an old cryptographic data confidentiality algorithm that is not
+# considered secure. It should not be used anymore. For now, the default hostapd
+# build includes this to allow mixed mode WPA+WPA2 networks to be enabled, but
+# that functionality is subject to be removed in the future.
+#CONFIG_NO_TKIP=y
+
+# Pre-Association Security Negotiation (PASN)
+# Experimental implementation based on IEEE P802.11z/D2.6 and the protocol
+# design is still subject to change. As such, this should not yet be enabled in
+# production use.
+# This requires CONFIG_IEEE80211W=y to be enabled, too.
+#CONFIG_PASN=y
+
+# Device Provisioning Protocol (DPP) (also known as Wi-Fi Easy Connect)
+CONFIG_DPP=y
+# DPP version 2 support
+CONFIG_DPP2=y
+# DPP version 3 support (experimental and still changing; do not enable for
+# production use)
+#CONFIG_DPP3=y
+
+# Simultaneous Authentication of Equals (SAE)
+CONFIG_SAE=y
+
+# WPA3-Enterprise (SuiteB-192)
+CONFIG_SUITEB=y
+CONFIG_SUITEB192=y
--- a/hostapd-2.10.tar.gz
+++ b/hostapd-2.10.tar.gz
@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:206e7c799b678572c2e3d12030238784bc4a9f82323b0156b4c9466f1498915d
+size 2440435
--- a/hostapd-2.10.tar.gz.asc
+++ b/hostapd-2.10.tar.gz.asc
@ -0,0 +1,6 @@
+-----BEGIN PGP SIGNATURE-----
+
+iF0EABECAB0WIQTsSqCpkaXyRkWC1S0rbvQy78iV+gUCYeSJ0QAKCRArbvQy78iV
+ryaAJ9Dg6Jolf9k10113AamARgeJObKPgCdGhRdfhroyDzd5qglBkDB0wDsqXc=
+=N0h0
+-----END PGP SIGNATURE-----
--- a/hostapd-2.11.tar.gz
+++ b/hostapd-2.11.tar.gz
@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2b3facb632fd4f65e32f4bf82a76b4b72c501f995a4f62e330219fe7aed1747a
+size 2708343
--- a/hostapd-2.11.tar.gz.asc
+++ b/hostapd-2.11.tar.gz.asc
@ -0,0 +1,6 @@
+-----BEGIN PGP SIGNATURE-----
+
+iF0EABECAB0WIQTsSqCpkaXyRkWC1S0rbvQy78iV+gUCZpwBjgAKCRArbvQy78iV
+kn0AJ425X6Qa2egH+GcGYD/W0Im31POWACfTus+8lK5KJGLsOuXcPGCazUGkl0=
+=2w57
+-----END PGP SIGNATURE-----
--- a/hostapd.changes
+++ b/hostapd.changes
--- a/hostapd.keyring
+++ b/hostapd.keyring
@ -0,0 +1,36 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: SKS 1.1.6
+Comment: Hostname: keyserver.ubuntu.com
+
+mQGiBDoydw4RBAC9vfqCsU+dgrxUSdGf70zrEAIBxcjeqHusovztR65XOWE0ccjmQS2TVgJM
+OzYg9FJG7DuLQZDwhR10BZKJfG97fNyZVBCoO90bEcTufn96oceJlz/MHmy99+i6wYdIKYz
+vmaxcC1QPhENr1scgin9nMiW1MTPJ7sSgjDqd0QPVwCgmaZUpzhKRusR5E/MmgI2kz73Ui0D
+/03lVNypkQTbuBp1q71YqT9qjO8+5kXU5QXJhel0qUgJHcu3rdnIVaiANw1qauMM0DtnRKOt
+caZntn03sFNnaJRx0JlmLa/cMP0nm1kPnR6Q3Cruz7InJnJZDXGsGH/ku4OcYLUJ8UgqzaO0
+J5o66j7pxQQDo1UAs4PQaoYq/ECbA/9B6b3TzuHdqUgS/g2AYTc5MU+i92ydrBv2g9SPuH78
+m/X4YicGR1HF7yNiJ/hiVa/axBUHpXE4vW0Bndj1bN4sctFeGGezGRaLiiggZkBBNnL8nF5e
+ZebLvPrv4kr8Cchz+lGF5UFNVyLWwi/I5CSUqUtSXOD1Q9WcXoqJcrE2brQXSm91bmkgTWFs
+aW5lbiA8akB3MS5maT6IXwQTEQIAHwUCReBvUQIbIwYLCQgHAwIEFQIIAwMWAgECHgECF4AA
+CgkQK270Mu/Ilfq/HgCeMavvxAxc9CYwPkbEyFBWNk+Tx3sAn1G23zGdkLx1pTSmKijWJqyO
+Oh2iiGIEExECACICGyMGCwkIBwMCBBUCCAMDFgIBAh4BAheABQJGWwf0AhkBAAoJECtu9DLv
+yJX6bhgAn3dFmq4Fg3o2tFVvkfU0io0SHztXAJ9QPJ5IrKNW4Pwr1OesEr6VODKRerQZSm91
+bmkgTWFsaW5lbiA8am1Aa2lyLm51PohfBBMRAgAfBQJGWwebAhsjBgsJCAcDAgQVAggDAxYC
+AQIeAQIXgAAKCRArbvQy78iV+gZgAJ0Uniuc9gpS8LleYtQrT/cNr/OU5ACfVy5Gqqzal+Mg
+8aB6mxKR5B2ende0IEpvdW5pIE1hbGluZW4gPGptQGptLmVwaXRlc3QuZmk+iFcEExECABcF
+Ajoydw4FCwcKAwQDFQMCAxYCAQIXgAAKCRArbvQy78iV+o0vAJ4sY07fmnqzR8fMKKju1hhq
+kIdeWACeIiA1F2f70GZ8tRRv3sMxP63VFZq0IkpvdW5pIE1hbGluZW4gPGprbWFsaW5lQGNj
+Lmh1dC5maT6IVwQTEQIAFwUCOjJ9SQULBwoDBAMVAwIDFgIBAheAAAoJECtu9DLvyJX6mZkA
+njfcQtXqkg98YlGv8/kjANhneTb5AJ0bsG6IC8k8gW/B6gtS8SElpE0gb7kCDQQ6MndbEAgA
+vKm7+dJttqvYYbOeBjA/l3poNHR4h7rk7VT2LoCak0pYUkvECQXbpUfIWGAxh2084wf5LIkB
+TnCEmWfs0ESBqi2zZXX+rWhlEyIWZCIdPdEWC1wmKDBQfFywTmi1Ucu0jMLD13WyEZE/b/Qs
+zI2XE1FY8Dm0CkaU4ntCWYXP/wlJmO+rHKUWOYnw10/TTq+bjAN1uRSNQBXN3fOegWIXZ4XL
+iZ/kEEvl7I969r6Vc2B6Evp09J0PYsJqj7UR3qfrdXLnahKLmlk/LaV5EgdGNDIzj8hpzQ5I
+PaJt4I+UCszA3EAsQlUx46lVK5lugbNkZtmFTAbv0yBuBPYRCvDGvwADBQf+KTqLfJRmwCXK
+L4LUhL52ulsjpxbZgvFAlycn9TJ88ywDuhb3/HM9eooNqPu24CokHlscHeyyRInL9pA9932Z
+dzqkmWzXX7DsQfYPo7Vgvrzlxis6+j4u3yAV4JIcRf3lm4RYOyo+K3fowSPRe7iv8D8mPCYr
+x/L8tsOgaIqXN0u6nFJ+RpOfMNBLmawB0hirfUFnf6e6aSH4IJm3O+2BVszP8/X4jFqePmCC
+ZBB+rp89/vdakF1AuCRi+kDJ7CKInqqAJP+qxzAk34RUr0MbocaS1CPj0/bALyAWS2bWuoby
+ImFaUk82cYlZroqFR1IT1UHXKTuTK69VRw8AvmR/JohGBBgRAgAGBQI6MndbAAoJECtu9DLv
+yJX60QgAn1hLZt3rfOZJyXlCtgKXUOeBL8Z+AKCGIt+Y3Lcw/0nycz4hNec00UvDTQ==
+=X3Kw
+-----END PGP PUBLIC KEY BLOCK-----
--- a/hostapd.service
+++ b/hostapd.service
@ -0,0 +1,21 @@
+[Unit]
+Description=Hostapd IEEE 802.11 AP, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
+After=network.target
+
+[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
+ExecStart=/usr/sbin/hostapd /etc/hostapd.conf 
+ExecReload=/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target
--- a/hostapd.spec
+++ b/hostapd.spec
@ -0,0 +1,115 @@
+#
+# spec file for package hostapd
+#
+# Copyright (c) 2024 SUSE LLC
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+#
+
+
+%bcond_without  apparmor
+Name:           hostapd
+Version:        2.11
+Release:        0
+Summary:        Daemon for running a WPA capable Access Point
+License:        BSD-3-Clause OR GPL-2.0-only
+Group:          Hardware/Wifi
+URL:            https://w1.fi/
+Source:         https://w1.fi/releases/hostapd-%{version}.tar.gz
+Source1:        https://w1.fi/releases/hostapd-%{version}.tar.gz.asc
+# https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x2B6EF432EFC895FA#/%%{name}.keyring
+Source2:        %{name}.keyring
+Source3:        config
+Source4:        hostapd.service
+Source5:        apparmor-usr.sbin.hostapd
+BuildRequires:  libnl3-devel
+BuildRequires:  openssl-devel
+BuildRequires:  pkgconfig
+BuildRequires:  sqlite3-devel
+BuildRequires:  pkgconfig(libnl-3.0) >= 3.0
+BuildRequires:  pkgconfig(systemd)
+%{?systemd_requires}
+%if %{with apparmor}
+BuildRequires:  apparmor-abstractions
+BuildRequires:  apparmor-rpm-macros
+Recommends:     apparmor-abstractions
+%endif
+
+%description
+hostapd is a user space daemon for access point and authentication
+servers. It implements IEEE 802.11 access point management, IEEE
+802.1X/WPA/WPA2/EAP Authenticators, RADIUS client, EAP server, and
+RADIUS authentication server. Currently, hostapd supports HostAP,
+madwifi, and prism54 drivers. It also supports wired IEEE 802.1X
+authentication via any ethernet driver.
+
+%prep
+%setup -q
+cp %{SOURCE3} hostapd/.config
+%autopatch -p1
+
+%build
+cd hostapd
+CFLAGS="%{optflags} -D_GNU_SOURCE $(getconf LFS_CFLAGS)" CC="gcc" make  %{?_smp_mflags} V=1
+
+%install
+cd hostapd
+install -d %{buildroot}/%{_sbindir}
+install -d %{buildroot}%{_sysconfdir}
+install -d %{buildroot}/%{_mandir}/man8
+install -m 755 hostapd %{buildroot}/%{_sbindir}
+ln -s %{_sbindir}/service %{buildroot}/%{_sbindir}/rchostapd
+install -m 755 hostapd_cli %{buildroot}/%{_sbindir}
+install -m 600 hostapd.conf %{buildroot}%{_sysconfdir}
+install -m 644 hostapd.accept %{buildroot}%{_sysconfdir}
+install -m 644 hostapd.deny %{buildroot}%{_sysconfdir}
+install -m 600 hostapd.eap_user %{buildroot}%{_sysconfdir}
+install -m 600 hostapd.radius_clients %{buildroot}%{_sysconfdir}
+install -m 644 hostapd.sim_db %{buildroot}%{_sysconfdir}
+install -m 644 hostapd.vlan %{buildroot}%{_sysconfdir}
+install -m 600 hostapd.wpa_psk %{buildroot}%{_sysconfdir}
+install -m 644 hostapd.8 %{buildroot}/%{_mandir}/man8
+install -D -m 0644 %{SOURCE4} %{buildroot}%{_unitdir}/hostapd.service
+%if %{with apparmor}
+# AppArmor profile
+mkdir -p %{buildroot}%{_sysconfdir}/apparmor.d
+install -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/apparmor.d/usr.sbin.hostapd
+%endif
+
+%pre
+%service_add_pre hostapd.service
+
+%post
+%service_add_post hostapd.service
+%if %{with apparmor}
+%apparmor_reload %{_sysconfdir}/apparmor.d/usr.sbin.hostapd
+%endif
+
+%preun
+%service_del_preun hostapd.service
+
+%postun
+%service_del_postun hostapd.service
+
+%files
+%config(noreplace) %{_sysconfdir}/hostapd.*
+%if %{with apparmor}
+%dir %{_sysconfdir}/apparmor.d
+%config %{_sysconfdir}/apparmor.d/usr.sbin.hostapd
+%endif
+%{_sbindir}/*
+%license COPYING
+%doc hostapd/ChangeLog hostapd/README hostapd/wired.conf hostapd/hostapd.conf
+%{_mandir}/man8/*
+%{_unitdir}/hostapd.service
+
+%changelog