]> git.ipfire.org Git - ipfire-2.x.git/commit
hostapd: Update to 2.10
authorMatthias Fischer <matthias.fischer@ipfire.org>
Fri, 18 Feb 2022 17:13:34 +0000 (18:13 +0100)
committerPeter Müller <peter.mueller@ipfire.org>
Fri, 18 Feb 2022 21:57:02 +0000 (21:57 +0000)
commit6491a92335a15fa0e3a4df1fed24b40490eaf3cb
tree42ea2d5ceaea7a1dadf613301d6c57c498a15f41
parent1bd6e152c40018054c9cad81000fcb7580153d90
hostapd: Update to 2.10

For details see:
https://w1.fi/cgit/hostap/plain/hostapd/ChangeLog

"2022-01-16 - v2.10
* SAE changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  - added option send SAE Confirm immediately (sae_config_immediate=1)
    after SAE Commit
  - added support for the hash-to-element mechanism (sae_pwe=1 or
    sae_pwe=2)
  - fixed PMKSA caching with OKC
  - added support for SAE-PK
* EAP-pwd changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
* fixed WPS UPnP SUBSCRIBE handling of invalid operations
  [https://w1.fi/security/2020-1/]
* fixed PMF disconnection protection bypass
  [https://w1.fi/security/2019-7/]
* added support for using OpenSSL 3.0
* fixed various issues in experimental support for EAP-TEAP server
* added configuration (max_auth_rounds, max_auth_rounds_short) to
  increase the maximum number of EAP message exchanges (mainly to
  support cases with very large certificates) for the EAP server
* added support for DPP release 2 (Wi-Fi Device Provisioning Protocol)
* extended HE (IEEE 802.11ax) support, including 6 GHz support
* removed obsolete IAPP functionality
* fixed EAP-FAST server with TLS GCM/CCM ciphers
* dropped support for libnl 1.1
* added support for nl80211 control port for EAPOL frame TX/RX
* fixed OWE key derivation with groups 20 and 21; this breaks backwards
  compatibility for these groups while the default group 19 remains
  backwards compatible; owe_ptk_workaround=1 can be used to enabled a
  a workaround for the group 20/21 backwards compatibility
* added support for Beacon protection
* added support for Extended Key ID for pairwise keys
* removed WEP support from the default build (CONFIG_WEP=y can be used
  to enable it, if really needed)
* added a build option to remove TKIP support (CONFIG_NO_TKIP=y)
* added support for Transition Disable mechanism to allow the AP to
  automatically disable transition mode to improve security
* added support for PASN
* added EAP-TLS server support for TLS 1.3 (disabled by default for now)
* a large number of other fixes, cleanup, and extensions"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
lfs/hostapd
src/patches/hostapd/hostapd-2.9-increase_EAPOL-timeouts.patch
src/patches/hostapd/hostapd-2.9-noscan.patch