hostapd: fix multiple security problems

package/network/services/hostapd/Config.in

@@ -6,13 +6,11 @@ config WPA_SUPPLICANT_NO_TIMESTAMP_CHECK
 		   PACKAGE_wpa-supplicant-wolfssl || \
 		   PACKAGE_wpa-supplicant-mesh-openssl || \
 		   PACKAGE_wpa-supplicant-mesh-wolfssl || \
-		   PACKAGE_wpa-supplicant-basic || \
 		   PACKAGE_wpa-supplicant-mini || \
 		   PACKAGE_wpa-supplicant-p2p || \
 		   PACKAGE_wpad || \
 		   PACKAGE_wpad-openssl || \
 		   PACKAGE_wpad-wolfssl || \
-		   PACKAGE_wpad-basic || \
 		   PACKAGE_wpad-mini || \
 		   PACKAGE_wpad-mesh-openssl || \
 		   PACKAGE_wpad-mesh-wolfssl
@@ -28,13 +26,11 @@ config WPA_RFKILL_SUPPORT
 		   PACKAGE_wpa-supplicant-wolfssl || \
 		   PACKAGE_wpa-supplicant-mesh-openssl || \
 		   PACKAGE_wpa-supplicant-mesh-wolfssl || \
-		   PACKAGE_wpa-supplicant-basic || \
 		   PACKAGE_wpa-supplicant-mini || \
 		   PACKAGE_wpa-supplicant-p2p || \
 		   PACKAGE_wpad || \
 		   PACKAGE_wpad-openssl || \
 		   PACKAGE_wpad-wolfssl || \
-		   PACKAGE_wpad-basic || \
 		   PACKAGE_wpad-mini || \
 		   PACKAGE_wpad-mesh-openssl || \
 		   PACKAGE_wpad-mesh-wolfssl
@@ -47,13 +43,11 @@ config WPA_MSG_MIN_PRIORITY
 		   PACKAGE_wpa-supplicant-wolfssl || \
 		   PACKAGE_wpa-supplicant-mesh-openssl || \
 		   PACKAGE_wpa-supplicant-mesh-wolfssl || \
-		   PACKAGE_wpa-supplicant-basic || \
 		   PACKAGE_wpa-supplicant-mini || \
 		   PACKAGE_wpa-supplicant-p2p || \
 		   PACKAGE_wpad || \
 		   PACKAGE_wpad-openssl || \
 		   PACKAGE_wpad-wolfssl || \
-		   PACKAGE_wpad-basic || \
 		   PACKAGE_wpad-mini || \
 		   PACKAGE_wpad-mesh-openssl || \
 		   PACKAGE_wpad-mesh-wolfssl

package/network/services/hostapd/Makefile

@@ -7,13 +7,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_RELEASE:=2
+PKG_RELEASE:=6
 
 PKG_SOURCE_URL:=http://w1.fi/hostap.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2018-12-02
-PKG_SOURCE_VERSION:=c2c6c01bb8b6fafc2074b46a53c4eab2c145ac6f
-PKG_MIRROR_HASH:=d381123fe42059b553d96122a03c35e7d1709153c3aaf10fa4e74fe59be243dd
+PKG_SOURCE_DATE:=2018-05-21
+PKG_SOURCE_VERSION:=62566bc23d041e88f8e35933d5fd8c2fd0f7cf2a
+PKG_MIRROR_HASH:=f234b24f9471ae9cb34460feec6d6614641691544101535673595272c91448eb
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=BSD-3-Clause
@@ -26,7 +26,6 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_kmod-ath9k \
 	CONFIG_PACKAGE_kmod-cfg80211 \
 	CONFIG_PACKAGE_hostapd \
-	CONFIG_PACKAGE_hostapd-basic \
 	CONFIG_PACKAGE_hostapd-mini \
 	CONFIG_WPA_RFKILL_SUPPORT \
 	CONFIG_DRIVER_WEXT_SUPPORT \
@@ -96,17 +95,13 @@ ifeq ($(LOCAL_VARIANT),full)
   DRIVER_MAKEOPTS += CONFIG_IEEE80211W=$(CONFIG_DRIVER_11W_SUPPORT)
 endif
 
-ifeq ($(LOCAL_VARIANT),basic)
-  DRIVER_MAKEOPTS += CONFIG_IEEE80211W=$(CONFIG_DRIVER_11W_SUPPORT)
-endif
-
 ifeq ($(LOCAL_VARIANT),full)
   ifeq ($(SSL_VARIANT),openssl)
-    DRIVER_MAKEOPTS += CONFIG_TLS=openssl CONFIG_SAE=y CONFIG_OWE=y CONFIG_SUITEB192=y
+    DRIVER_MAKEOPTS += CONFIG_TLS=openssl
     TARGET_LDFLAGS += -lcrypto -lssl
   endif
   ifeq ($(SSL_VARIANT),wolfssl)
-    DRIVER_MAKEOPTS += CONFIG_TLS=wolfssl CONFIG_WPS_NFC=1 CONFIG_SAE=y CONFIG_OWE=y CONFIG_SUITEB192=y
+    DRIVER_MAKEOPTS += CONFIG_TLS=wolfssl CONFIG_WPS_NFC=1
     TARGET_LDFLAGS += -lwolfssl
   endif
 endif
@@ -181,16 +176,6 @@ endef
 
 Package/hostapd-wolfssl/description = $(Package/hostapd/description)
 
-define Package/hostapd-basic
-$(call Package/hostapd/Default,$(1))
-  TITLE+= (WPA-PSK, 11r and 11w)
-  VARIANT:=basic
-endef
-
-define Package/hostapd-basic/description
- This package contains a basic IEEE 802.1x/WPA Authenticator with WPA-PSK, 802.11r and 802.11w support.
-endef
-
 define Package/hostapd-mini
 $(call Package/hostapd/Default,$(1))
   TITLE+= (WPA-PSK only)
@@ -243,16 +228,6 @@ endef
 
 Package/wpad-wolfssl/description = $(Package/wpad/description)
 
-define Package/wpad-basic
-$(call Package/wpad/Default,$(1))
-  TITLE+= (WPA-PSK, 11r and 11w)
-  VARIANT:=wpad-basic
-endef
-
-define Package/wpad-basic/description
- This package contains a basic IEEE 802.1x/WPA Authenticator and Supplicant with WPA-PSK, 802.11r and 802.11w support.
-endef
-
 define Package/wpad-mini
 $(call Package/wpad/Default,$(1))
   TITLE+= (WPA-PSK only)
@@ -296,7 +271,7 @@ define Package/wpa-supplicant/Default
   CATEGORY:=Network
   TITLE:=WPA Supplicant
   URL:=http://hostap.epitest.fi/wpa_supplicant/
-  DEPENDS:=$(DRV_DEPENDS) +hostapd-common +libubus
+  DEPENDS:=$(DRV_DEPENDS)
   PROVIDES:=wpa-supplicant
   CONFLICTS:=$(SUPPLICANT_PROVIDERS)
   SUPPLICANT_PROVIDERS+=$(1)
@@ -349,12 +324,6 @@ $(call Package/wpa-supplicant-mesh/Default,$(1))
   DEPENDS+=+libwolfssl
 endef
 
-define Package/wpa-supplicant-basic
-$(call Package/wpa-supplicant/Default,$(1))
-  TITLE+= (with 11r and 11w)
-  VARIANT:=supplicant-basic
-endef
-
 define Package/wpa-supplicant-mini
 $(call Package/wpa-supplicant/Default,$(1))
   TITLE+= (minimal version)
@@ -393,7 +362,7 @@ define Package/eapol-test
   SECTION:=net
   CATEGORY:=Network
   VARIANT:=supplicant-full-internal
-  DEPENDS:=$(DRV_DEPENDS) +libubus
+  DEPENDS:=$(DRV_DEPENDS)
 endef
 
 define Package/eapol-test-openssl
@@ -402,7 +371,7 @@ define Package/eapol-test-openssl
   CATEGORY:=Network
   VARIANT:=supplicant-full-openssl
   CONFLICTS:=$(filter-out eapol-test-openssl ,$(EAPOL_TEST_PROVIDERS))
-  DEPENDS:=$(DRV_DEPENDS) +libubus +libopenssl
+  DEPENDS:=$(DRV_DEPENDS) +libopenssl
   PROVIDES:=eapol-test
 endef
 
@@ -412,7 +381,7 @@ define Package/eapol-test-wolfssl
   CATEGORY:=Network
   VARIANT:=supplicant-full-wolfssl
   CONFLICTS:=$(filter-out eapol-test-openssl ,$(filter-out eapol-test-wolfssl ,$(EAPOL_TEST_PROVIDERS)))
-  DEPENDS:=$(DRV_DEPENDS) +libubus +libwolfssl
+  DEPENDS:=$(DRV_DEPENDS) +libwolfssl
   PROVIDES:=eapol-test
 endef
 
@@ -443,8 +412,11 @@ TARGET_CPPFLAGS := \
 	-D_GNU_SOURCE \
 	$(if $(CONFIG_WPA_MSG_MIN_PRIORITY),-DCONFIG_MSG_MIN_PRIORITY=$(CONFIG_WPA_MSG_MIN_PRIORITY))
 
-TARGET_CFLAGS += -ffunction-sections -fdata-sections -flto
-TARGET_LDFLAGS += -Wl,--gc-sections -flto=jobserver -fuse-linker-plugin -lubox -lubus
+TARGET_CFLAGS += -ffunction-sections -fdata-sections
+TARGET_LDFLAGS += -Wl,--gc-sections
+ifeq ($(findstring supplicant,$(BUILD_VARIANT)),)
+  TARGET_LDFLAGS += -lubox -lubus
+endif
 
 ifdef CONFIG_PACKAGE_kmod-cfg80211
   TARGET_LDFLAGS += -lm -lnl-tiny
@@ -457,7 +429,6 @@ define Build/RunMake
 		$(DRIVER_MAKEOPTS) \
 		LIBS="$(TARGET_LDFLAGS)" \
 		LIBS_c="$(TARGET_LDFLAGS_C)" \
-		AR="$(TARGET_CROSS)gcc-ar" \
 		BCHECK= \
 		$(2)
 endef
@@ -479,7 +450,7 @@ define Build/Compile/wpad
 		MULTICALL=1 \
 		wpa_cli wpa_supplicant_multi.a \
 	)
-	+export MAKEFLAGS="$(MAKE_JOBSERVER)"; $(TARGET_CC) -o $(PKG_BUILD_DIR)/wpad \
+	$(TARGET_CC) -o $(PKG_BUILD_DIR)/wpad \
 		$(TARGET_CFLAGS) \
 		./files/multicall.c \
 		$(PKG_BUILD_DIR)/hostapd/hostapd_multi.a \
@@ -531,24 +502,23 @@ define Install/supplicant
 endef
 
 define Package/hostapd-common/install
-	$(INSTALL_DIR) $(1)/lib/netifd $(1)/etc/rc.button
+	$(INSTALL_DIR) $(1)/lib/netifd
 	$(INSTALL_DATA) ./files/hostapd.sh $(1)/lib/netifd/hostapd.sh
-	$(INSTALL_BIN) ./files/wps-hotplug.sh $(1)/etc/rc.button/wps
 endef
 
 define Package/hostapd/install
 	$(call Install/hostapd,$(1))
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/hostapd/hostapd $(1)/usr/sbin/
 endef
-Package/hostapd-basic/install = $(Package/hostapd/install)
 Package/hostapd-mini/install = $(Package/hostapd/install)
 Package/hostapd-openssl/install = $(Package/hostapd/install)
 Package/hostapd-wolfssl/install = $(Package/hostapd/install)
 
 ifneq ($(LOCAL_TYPE),supplicant)
   define Package/hostapd-utils/install
-	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/rc.button
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/hostapd/hostapd_cli $(1)/usr/sbin/
+	$(INSTALL_BIN) ./files/wps-hotplug.sh $(1)/etc/rc.button/wps
   endef
 endif
 
@@ -559,7 +529,6 @@ define Package/wpad/install
 	$(LN) wpad $(1)/usr/sbin/hostapd
 	$(LN) wpad $(1)/usr/sbin/wpa_supplicant
 endef
-Package/wpad-basic/install = $(Package/wpad/install)
 Package/wpad-mini/install = $(Package/wpad/install)
 Package/wpad-openssl/install = $(Package/wpad/install)
 Package/wpad-wolfssl/install = $(Package/wpad/install)
@@ -570,7 +539,6 @@ define Package/wpa-supplicant/install
 	$(call Install/supplicant,$(1))
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/wpa_supplicant/wpa_supplicant $(1)/usr/sbin/
 endef
-Package/wpa-supplicant-basic/install = $(Package/wpa-supplicant/install)
 Package/wpa-supplicant-mini/install = $(Package/wpa-supplicant/install)
 Package/wpa-supplicant-p2p/install = $(Package/wpa-supplicant/install)
 Package/wpa-supplicant-openssl/install = $(Package/wpa-supplicant/install)
@@ -607,21 +575,18 @@ ifeq ($(BUILD_VARIANT),supplicant-full-wolfssl)
 endif
 
 $(eval $(call BuildPackage,hostapd))
-$(eval $(call BuildPackage,hostapd-basic))
 $(eval $(call BuildPackage,hostapd-mini))
 $(eval $(call BuildPackage,hostapd-openssl))
 $(eval $(call BuildPackage,hostapd-wolfssl))
 $(eval $(call BuildPackage,wpad))
 $(eval $(call BuildPackage,wpad-mesh-openssl))
 $(eval $(call BuildPackage,wpad-mesh-wolfssl))
-$(eval $(call BuildPackage,wpad-basic))
 $(eval $(call BuildPackage,wpad-mini))
 $(eval $(call BuildPackage,wpad-openssl))
 $(eval $(call BuildPackage,wpad-wolfssl))
 $(eval $(call BuildPackage,wpa-supplicant))
 $(eval $(call BuildPackage,wpa-supplicant-mesh-openssl))
 $(eval $(call BuildPackage,wpa-supplicant-mesh-wolfssl))
-$(eval $(call BuildPackage,wpa-supplicant-basic))
 $(eval $(call BuildPackage,wpa-supplicant-mini))
 $(eval $(call BuildPackage,wpa-supplicant-p2p))
 $(eval $(call BuildPackage,wpa-supplicant-openssl))

package/network/services/hostapd/files/hostapd-basic.config

@@ -1,380 +0,0 @@
-# Example hostapd build time configuration
-#
-# This file lists the configuration options that are used when building the
-# hostapd binary. All lines starting with # are ignored. Configuration option
-# lines must be commented out complete, if they are not to be included, i.e.,
-# just setting VARIABLE=n is not disabling that variable.
-#
-# This file is included in Makefile, so variables like CFLAGS and LIBS can also
-# be modified from here. In most cass, these lines should use += in order not
-# to override previous values of the variables.
-
-# Driver interface for Host AP driver
-#CONFIG_DRIVER_HOSTAP=y
-
-# Driver interface for wired authenticator
-CONFIG_DRIVER_WIRED=y
-
-# Driver interface for drivers using the nl80211 kernel interface
-CONFIG_DRIVER_NL80211=y
-
-# QCA vendor extensions to nl80211
-#CONFIG_DRIVER_NL80211_QCA=y
-
-# driver_nl80211.c requires libnl. If you are compiling it yourself
-# you may need to point hostapd to your version of libnl.
-#
-#CFLAGS += -I$<path to libnl include files>
-#LIBS += -L$<path to libnl library files>
-
-# Use libnl v2.0 (or 3.0) libraries.
-#CONFIG_LIBNL20=y
-
-# Use libnl 3.2 libraries (if this is selected, CONFIG_LIBNL20 is ignored)
-#CONFIG_LIBNL32=y
-
-
-# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
-#CONFIG_DRIVER_BSD=y
-#CFLAGS += -I/usr/local/include
-#LIBS += -L/usr/local/lib
-#LIBS_p += -L/usr/local/lib
-#LIBS_c += -L/usr/local/lib
-
-# Driver interface for no driver (e.g., RADIUS server only)
-#CONFIG_DRIVER_NONE=y
-
-# IEEE 802.11F/IAPP
-#CONFIG_IAPP=y
-
-# WPA2/IEEE 802.11i RSN pre-authentication
-CONFIG_RSN_PREAUTH=y
-
-# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS)
-CONFIG_PEERKEY=y
-
-# IEEE 802.11w (management frame protection)
-# Driver support is also needed for IEEE 802.11w.
-#CONFIG_IEEE80211W=y
-
-# Integrated EAP server
-#CONFIG_EAP=y
-
-# EAP Re-authentication Protocol (ERP) in integrated EAP server
-#CONFIG_ERP=y
-
-# EAP-MD5 for the integrated EAP server
-#CONFIG_EAP_MD5=y
-
-# EAP-TLS for the integrated EAP server
-#CONFIG_EAP_TLS=y
-
-# EAP-MSCHAPv2 for the integrated EAP server
-#CONFIG_EAP_MSCHAPV2=y
-
-# EAP-PEAP for the integrated EAP server
-#CONFIG_EAP_PEAP=y
-
-# EAP-GTC for the integrated EAP server
-#CONFIG_EAP_GTC=y
-
-# EAP-TTLS for the integrated EAP server
-#CONFIG_EAP_TTLS=y
-
-# EAP-SIM for the integrated EAP server
-#CONFIG_EAP_SIM=y
-
-# EAP-AKA for the integrated EAP server
-#CONFIG_EAP_AKA=y
-
-# EAP-AKA' for the integrated EAP server
-# This requires CONFIG_EAP_AKA to be enabled, too.
-#CONFIG_EAP_AKA_PRIME=y
-
-# EAP-PAX for the integrated EAP server
-#CONFIG_EAP_PAX=y
-
-# EAP-PSK for the integrated EAP server (this is _not_ needed for WPA-PSK)
-#CONFIG_EAP_PSK=y
-
-# EAP-pwd for the integrated EAP server (secure authentication with a password)
-#CONFIG_EAP_PWD=y
-
-# EAP-SAKE for the integrated EAP server
-#CONFIG_EAP_SAKE=y
-
-# EAP-GPSK for the integrated EAP server
-#CONFIG_EAP_GPSK=y
-# Include support for optional SHA256 cipher suite in EAP-GPSK
-#CONFIG_EAP_GPSK_SHA256=y
-
-# EAP-FAST for the integrated EAP server
-# Note: If OpenSSL is used as the TLS library, OpenSSL 1.0 or newer is needed
-# for EAP-FAST support. Older OpenSSL releases would need to be patched, e.g.,
-# with openssl-0.9.8x-tls-extensions.patch, to add the needed functions.
-#CONFIG_EAP_FAST=y
-
-# Wi-Fi Protected Setup (WPS)
-#CONFIG_WPS=y
-# Enable UPnP support for external WPS Registrars
-#CONFIG_WPS_UPNP=y
-# Enable WPS support with NFC config method
-#CONFIG_WPS_NFC=y
-
-# EAP-IKEv2
-#CONFIG_EAP_IKEV2=y
-
-# Trusted Network Connect (EAP-TNC)
-#CONFIG_EAP_TNC=y
-
-# EAP-EKE for the integrated EAP server
-#CONFIG_EAP_EKE=y
-
-# PKCS#12 (PFX) support (used to read private key and certificate file from
-# a file that usually has extension .p12 or .pfx)
-#CONFIG_PKCS12=y
-
-# RADIUS authentication server. This provides access to the integrated EAP
-# server from external hosts using RADIUS.
-#CONFIG_RADIUS_SERVER=y
-
-# Build IPv6 support for RADIUS operations
-#CONFIG_IPV6=y
-
-# IEEE Std 802.11r-2008 (Fast BSS Transition)
-CONFIG_IEEE80211R=y
-
-# Use the hostapd's IEEE 802.11 authentication (ACL), but without
-# the IEEE 802.11 Management capability (e.g., FreeBSD/net80211)
-#CONFIG_DRIVER_RADIUS_ACL=y
-
-# IEEE 802.11n (High Throughput) support
-CONFIG_IEEE80211N=y
-
-# Wireless Network Management (IEEE Std 802.11v-2011)
-# Note: This is experimental and not complete implementation.
-#CONFIG_WNM=y
-
-# IEEE 802.11ac (Very High Throughput) support
-CONFIG_IEEE80211AC=y
-
-# IEEE 802.11ax HE support
-# Note: This is experimental and work in progress. The definitions are still
-# subject to change and this should not be expected to interoperate with the
-# final IEEE 802.11ax version.
-#CONFIG_IEEE80211AX=y
-
-# Remove debugging code that is printing out debug messages to stdout.
-# This can be used to reduce the size of the hostapd considerably if debugging
-# code is not needed.
-#CONFIG_NO_STDOUT_DEBUG=y
-
-# Add support for writing debug log to a file: -f /tmp/hostapd.log
-# Disabled by default.
-#CONFIG_DEBUG_FILE=y
-
-# Send debug messages to syslog instead of stdout
-CONFIG_DEBUG_SYSLOG=y
-
-# Add support for sending all debug messages (regardless of debug verbosity)
-# to the Linux kernel tracing facility. This helps debug the entire stack by
-# making it easy to record everything happening from the driver up into the
-# same file, e.g., using trace-cmd.
-#CONFIG_DEBUG_LINUX_TRACING=y
-
-# Remove support for RADIUS accounting
-CONFIG_NO_ACCOUNTING=y
-
-# Remove support for RADIUS
-CONFIG_NO_RADIUS=y
-
-# Remove support for VLANs
-#CONFIG_NO_VLAN=y
-
-# Enable support for fully dynamic VLANs. This enables hostapd to
-# automatically create bridge and VLAN interfaces if necessary.
-#CONFIG_FULL_DYNAMIC_VLAN=y
-
-# Use netlink-based kernel API for VLAN operations instead of ioctl()
-# Note: This requires libnl 3.1 or newer.
-#CONFIG_VLAN_NETLINK=y
-
-# Remove support for dumping internal state through control interface commands
-# This can be used to reduce binary size at the cost of disabling a debugging
-# option.
-CONFIG_NO_DUMP_STATE=y
-
-# Enable tracing code for developer debugging
-# This tracks use of memory allocations and other registrations and reports
-# incorrect use with a backtrace of call (or allocation) location.
-#CONFIG_WPA_TRACE=y
-# For BSD, comment out these.
-#LIBS += -lexecinfo
-#LIBS_p += -lexecinfo
-#LIBS_c += -lexecinfo
-
-# Use libbfd to get more details for developer debugging
-# This enables use of libbfd to get more detailed symbols for the backtraces
-# generated by CONFIG_WPA_TRACE=y.
-#CONFIG_WPA_TRACE_BFD=y
-# For BSD, comment out these.
-#LIBS += -lbfd -liberty -lz
-#LIBS_p += -lbfd -liberty -lz
-#LIBS_c += -lbfd -liberty -lz
-
-# hostapd depends on strong random number generation being available from the
-# operating system. os_get_random() function is used to fetch random data when
-# needed, e.g., for key generation. On Linux and BSD systems, this works by
-# reading /dev/urandom. It should be noted that the OS entropy pool needs to be
-# properly initialized before hostapd is started. This is important especially
-# on embedded devices that do not have a hardware random number generator and
-# may by default start up with minimal entropy available for random number
-# generation.
-#
-# As a safety net, hostapd is by default trying to internally collect
-# additional entropy for generating random data to mix in with the data
-# fetched from the OS. This by itself is not considered to be very strong, but
-# it may help in cases where the system pool is not initialized properly.
-# However, it is very strongly recommended that the system pool is initialized
-# with enough entropy either by using hardware assisted random number
-# generator or by storing state over device reboots.
-#
-# hostapd can be configured to maintain its own entropy store over restarts to
-# enhance random number generation. This is not perfect, but it is much more
-# secure than using the same sequence of random numbers after every reboot.
-# This can be enabled with -e<entropy file> command line option. The specified
-# file needs to be readable and writable by hostapd.
-#
-# If the os_get_random() is known to provide strong random data (e.g., on
-# Linux/BSD, the board in question is known to have reliable source of random
-# data from /dev/urandom), the internal hostapd random pool can be disabled.
-# This will save some in binary size and CPU use. However, this should only be
-# considered for builds that are known to be used on devices that meet the
-# requirements described above.
-CONFIG_NO_RANDOM_POOL=y
-
-# Should we use poll instead of select? Select is used by default.
-#CONFIG_ELOOP_POLL=y
-
-# Should we use epoll instead of select? Select is used by default.
-#CONFIG_ELOOP_EPOLL=y
-
-# Should we use kqueue instead of select? Select is used by default.
-#CONFIG_ELOOP_KQUEUE=y
-
-# Select TLS implementation
-# openssl = OpenSSL (default)
-# gnutls = GnuTLS
-# internal = Internal TLSv1 implementation (experimental)
-# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
-# none = Empty template
-CONFIG_TLS=internal
-
-# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.1)
-# can be enabled to get a stronger construction of messages when block ciphers
-# are used.
-#CONFIG_TLSV11=y
-
-# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.2)
-# can be enabled to enable use of stronger crypto algorithms.
-#CONFIG_TLSV12=y
-
-# Select which ciphers to use by default with OpenSSL if the user does not
-# specify them.
-#CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW"
-
-# If CONFIG_TLS=internal is used, additional library and include paths are
-# needed for LibTomMath. Alternatively, an integrated, minimal version of
-# LibTomMath can be used. See beginning of libtommath.c for details on benefits
-# and drawbacks of this option.
-#CONFIG_INTERNAL_LIBTOMMATH=y
-#ifndef CONFIG_INTERNAL_LIBTOMMATH
-#LTM_PATH=/usr/src/libtommath-0.39
-#CFLAGS += -I$(LTM_PATH)
-#LIBS += -L$(LTM_PATH)
-#LIBS_p += -L$(LTM_PATH)
-#endif
-# At the cost of about 4 kB of additional binary size, the internal LibTomMath
-# can be configured to include faster routines for exptmod, sqr, and div to
-# speed up DH and RSA calculation considerably
-#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
-
-# Interworking (IEEE 802.11u)
-# This can be used to enable functionality to improve interworking with
-# external networks.
-#CONFIG_INTERWORKING=y
-
-# Hotspot 2.0
-#CONFIG_HS20=y
-
-# Enable SQLite database support in hlr_auc_gw, EAP-SIM DB, and eap_user_file
-#CONFIG_SQLITE=y
-
-# Enable Fast Session Transfer (FST)
-#CONFIG_FST=y
-
-# Enable CLI commands for FST testing
-#CONFIG_FST_TEST=y
-
-# Testing options
-# This can be used to enable some testing options (see also the example
-# configuration file) that are really useful only for testing clients that
-# connect to this hostapd. These options allow, for example, to drop a
-# certain percentage of probe requests or auth/(re)assoc frames.
-#
-#CONFIG_TESTING_OPTIONS=y
-
-# Automatic Channel Selection
-# This will allow hostapd to pick the channel automatically when channel is set
-# to "acs_survey" or "0". Eventually, other ACS algorithms can be added in
-# similar way.
-#
-# Automatic selection is currently only done through initialization, later on
-# we hope to do background checks to keep us moving to more ideal channels as
-# time goes by. ACS is currently only supported through the nl80211 driver and
-# your driver must have survey dump capability that is filled by the driver
-# during scanning.
-#
-# You can customize the ACS survey algorithm with the hostapd.conf variable
-# acs_num_scans.
-#
-# Supported ACS drivers:
-# * ath9k
-# * ath5k
-# * ath10k
-#
-# For more details refer to:
-# http://wireless.kernel.org/en/users/Documentation/acs
-#
-#CONFIG_ACS=y
-
-# Multiband Operation support
-# These extentions facilitate efficient use of multiple frequency bands
-# available to the AP and the devices that may associate with it.
-#CONFIG_MBO=y
-
-# Client Taxonomy
-# Has the AP retain the Probe Request and (Re)Association Request frames from
-# a client, from which a signature can be produced which can identify the model
-# of client device like "Nexus 6P" or "iPhone 5s".
-#CONFIG_TAXONOMY=y
-
-# Fast Initial Link Setup (FILS) (IEEE 802.11ai)
-# Note: This is an experimental and not yet complete implementation. This
-# should not be enabled for production use.
-#CONFIG_FILS=y
-# FILS shared key authentication with PFS
-#CONFIG_FILS_SK_PFS=y
-
-# Include internal line edit mode in hostapd_cli. This can be used to provide
-# limited command line editing and history support.
-#CONFIG_WPA_CLI_EDIT=y
-
-# Opportunistic Wireless Encryption (OWE)
-# Experimental implementation of draft-harkins-owe-07.txt
-#CONFIG_OWE=y
-
-# uBus IPC/RPC System
-# Services can connect to the bus and provide methods
-# that can be called by other services or clients.
-CONFIG_UBUS=y

package/network/services/hostapd/files/hostapd-full.config

@@ -50,7 +50,11 @@ CONFIG_IAPP=y
 # WPA2/IEEE 802.11i RSN pre-authentication
 CONFIG_RSN_PREAUTH=y
 
+# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS)
+CONFIG_PEERKEY=y
+
 # IEEE 802.11w (management frame protection)
+# Driver support is also needed for IEEE 802.11w.
 #CONFIG_IEEE80211W=y
 
 # Integrated EAP server
@@ -370,10 +374,6 @@ CONFIG_TAXONOMY=y
 # Experimental implementation of draft-harkins-owe-07.txt
 #CONFIG_OWE=y
 
-# Override default value for the wpa_disable_eapol_key_retries configuration
-# parameter. See that parameter in hostapd.conf for more details.
-#CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1
-
 # uBus IPC/RPC System
 # Services can connect to the bus and provide methods
 # that can be called by other services or clients.

package/network/services/hostapd/files/hostapd-mini.config

@@ -50,7 +50,11 @@ CONFIG_DRIVER_NL80211=y
 # WPA2/IEEE 802.11i RSN pre-authentication
 CONFIG_RSN_PREAUTH=y
 
+# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS)
+CONFIG_PEERKEY=y
+
 # IEEE 802.11w (management frame protection)
+# Driver support is also needed for IEEE 802.11w.
 #CONFIG_IEEE80211W=y
 
 # Integrated EAP server
@@ -370,10 +374,6 @@ CONFIG_TLS=internal
 # Experimental implementation of draft-harkins-owe-07.txt
 #CONFIG_OWE=y
 
-# Override default value for the wpa_disable_eapol_key_retries configuration
-# parameter. See that parameter in hostapd.conf for more details.
-#CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1
-
 # uBus IPC/RPC System
 # Services can connect to the bus and provide methods
 # that can be called by other services or clients.

package/network/services/hostapd/files/hostapd.sh

@@ -37,38 +37,11 @@ hostapd_append_wep_key() {
 }
 
 hostapd_append_wpa_key_mgmt() {
-	local auth_type_l="$(echo $auth_type | tr 'a-z' 'A-Z')"
+	local auth_type="$(echo $auth_type | tr 'a-z' 'A-Z')"
 
-	case "$auth_type" in
-		psk|eap)
-			append wpa_key_mgmt "WPA-$auth_type_l"
-			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type_l}"
-			[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-${auth_type_l}-SHA256"
-		;;
-		eap192)
-			append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
-		;;
-		eap-eap192)
-			append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
-			append wpa_key_mgmt "WPA-EAP"
-			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
-			[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-EAP-SHA256"
-		;;
-		sae)
-			append wpa_key_mgmt "SAE"
-			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE"
-		;;
-		psk-sae)
-			append wpa_key_mgmt "WPA-PSK"
-			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-PSK"
-			[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-PSK-SHA256"
-			append wpa_key_mgmt "SAE"
-			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE"
-		;;
-		owe)
-			append wpa_key_mgmt "OWE"
-		;;
-	esac
+	append wpa_key_mgmt "WPA-$auth_type"
+	[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type}"
+	[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-${auth_type}-SHA256"
 }
 
 hostapd_add_log_config() {
@@ -168,7 +141,7 @@ EOF
 
 hostapd_common_add_bss_config() {
 	config_add_string 'bssid:macaddr' 'ssid:string'
-	config_add_boolean wds wmm uapsd hidden utf8_ssid
+	config_add_boolean wds wmm uapsd hidden
 
 	config_add_int maxassoc max_inactivity
 	config_add_boolean disassoc_low_ack isolate short_preamble
@@ -212,12 +185,9 @@ hostapd_common_add_bss_config() {
 
 	config_add_string wpa_psk_file
 
-	config_add_int multi_ap
-
 	config_add_boolean wps_pushbutton wps_label ext_registrar wps_pbc_in_m1
 	config_add_int wps_ap_setup_locked wps_independent
 	config_add_string wps_device_type wps_device_name wps_manufacturer wps_pin
-	config_add_string multi_ap_backhaul_ssid multi_ap_backhaul_key
 
 	config_add_boolean ieee80211v wnm_sleep_mode bss_transition
 	config_add_int time_advertisement
@@ -239,10 +209,6 @@ hostapd_common_add_bss_config() {
 	config_add_int mcast_rate
 	config_add_array basic_rate
 	config_add_array supported_rates
-	
-	config_add_boolean sae_require_mfp
-	
-	config_add_string 'owe_transition_bssid:macaddr' 'owe_transition_ssid:string'
 }
 
 hostapd_set_bss_options() {
@@ -261,11 +227,10 @@ hostapd_set_bss_options() {
 		maxassoc max_inactivity disassoc_low_ack isolate auth_cache \
 		wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 wps_ap_setup_locked \
 		wps_independent wps_device_type wps_device_name wps_manufacturer wps_pin \
-		macfilter ssid utf8_ssid wmm uapsd hidden short_preamble rsn_preauth \
+		macfilter ssid wmm uapsd hidden short_preamble rsn_preauth \
 		iapp_interface eapol_version dynamic_vlan ieee80211w nasid \
 		acct_server acct_secret acct_port acct_interval \
-		bss_load_update_period chan_util_avg_period sae_require_mfp \
-		multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key
+		bss_load_update_period chan_util_avg_period
 
 	set_default isolate 0
 	set_default maxassoc 0
@@ -281,9 +246,7 @@ hostapd_set_bss_options() {
 	set_default acct_port 1813
 	set_default bss_load_update_period 60
 	set_default chan_util_avg_period 600
-	set_default utf8_ssid 1
-	set_default multi_ap 0
-
+	
 	append bss_conf "ctrl_interface=/var/run/hostapd"
 	if [ "$isolate" -gt 0 ]; then
 		append bss_conf "ap_isolate=$isolate" "$N"
@@ -302,8 +265,6 @@ hostapd_set_bss_options() {
 	append bss_conf "wmm_enabled=$wmm" "$N"
 	append bss_conf "ignore_broadcast_ssid=$hidden" "$N"
 	append bss_conf "uapsd_advertisement_enabled=$uapsd" "$N"
-	append bss_conf "utf8_ssid=$utf8_ssid" "$N"
-	append bss_conf "multi_ap=$multi_ap" "$N"
 
 	[ "$tdls_prohibit" -gt 0 ] && append bss_conf "tdls_prohibit=$tdls_prohibit" "$N"
 
@@ -323,33 +284,16 @@ hostapd_set_bss_options() {
 			append bss_conf "radius_acct_interim_interval=$acct_interval" "$N"
 	}
 
-	case "$auth_type" in
-		sae|owe|eap192|eap-eap192)
-			set_default ieee80211w 2
-			set_default sae_require_mfp 1
-		;;
-		psk-sae)
-			set_default ieee80211w 1
-			set_default sae_require_mfp 1
-		;;
-	esac
-	[ -n "$sae_require_mfp" ] && append bss_conf "sae_require_mfp=$sae_require_mfp" "$N"
-
 	local vlan_possible=""
 
 	case "$auth_type" in
-		none|owe)
-			json_get_vars owe_transition_bssid owe_transition_ssid
-
-			[ -n "$owe_transition_ssid" ] && append bss_conf "owe_transition_ssid=\"$owe_transition_ssid\"" "$N"
-			[ -n "$owe_transition_bssid" ] && append bss_conf "owe_transition_bssid=$owe_transition_bssid" "$N"
-
+		none)
 			wps_possible=1
 			# Here we make the assumption that if we're in open mode
 			# with WPS enabled, we got to be in unconfigured state.
 			wps_not_configured=1
 		;;
-		psk|sae|psk-sae)
+		psk)
 			json_get_vars key wpa_psk_file
 			if [ ${#key} -lt 8 ]; then
 				wireless_setup_vif_failed INVALID_WPA_PSK
@@ -367,7 +311,7 @@ hostapd_set_bss_options() {
 
 			wps_possible=1
 		;;
-		eap|eap192|eap-eap192)
+		eap)
 			json_get_vars \
 				auth_server auth_secret auth_port \
 				dae_client dae_secret dae_port \
@@ -426,9 +370,6 @@ hostapd_set_bss_options() {
 	[ "$wps_pushbutton" -gt 0 ] && append config_methods push_button
 	[ "$wps_label" -gt 0 ] && append config_methods label
 
-	# WPS not possible on Multi-AP backhaul-only SSID
-	[ "$multi_ap" = 1 ] && wps_possible=
-
 	[ -n "$wps_possible" -a -n "$config_methods" ] && {
 		set_default ext_registrar 0
 		set_default wps_device_type "6-0050F204-1"
@@ -451,19 +392,6 @@ hostapd_set_bss_options() {
 		append bss_conf "wps_independent=$wps_independent" "$N"
 		[ -n "$wps_ap_setup_locked" ] && append bss_conf "ap_setup_locked=$wps_ap_setup_locked" "$N"
 		[ "$wps_pbc_in_m1" -gt 0 ] && append bss_conf "pbc_in_m1=$wps_pbc_in_m1" "$N"
-		[ "$multi_ap" -gt 0 ] && [ -n "$multi_ap_backhaul_ssid" ] && {
-			append bss_conf "multi_ap_backhaul_ssid=\"$multi_ap_backhaul_ssid\"" "$N"
-			if [ -z "$multi_ap_backhaul_key" ]; then
-				:
-			elif [ ${#multi_ap_backhaul_key} -lt 8 ]; then
-				wireless_setup_vif_failed INVALID_WPA_PSK
-				return 1
-			elif [ ${#multi_ap_backhaul_key} -eq 64 ]; then
-				append bss_conf "multi_ap_backhaul_wpa_psk=$multi_ap_backhaul_key" "$N"
-			else
-				append bss_conf "multi_ap_backhaul_wpa_passphrase=$multi_ap_backhaul_key" "$N"
-			fi
-		}
 	}
 
 	append bss_conf "ssid=$ssid" "$N"
@@ -662,7 +590,7 @@ wpa_supplicant_prepare_interface() {
 
 	_wpa_supplicant_common "$1"
 
-	json_get_vars mode wds multi_ap
+	json_get_vars mode wds
 
 	[ -n "$network_bridge" ] && {
 		fail=
@@ -671,7 +599,7 @@ wpa_supplicant_prepare_interface() {
 				fail=1
 			;;
 			sta)
-				[ "$wds" = 1 -o "$multi_ap" = 1 ] || fail=1
+				[ "$wds" = 1 ] || fail=1
 			;;
 		esac
 
@@ -697,12 +625,6 @@ wpa_supplicant_prepare_interface() {
 		country_str="country=$country"
 	}
 
-	multiap_flag_file="${_config}.is_multiap"
-	if [ "$multi_ap" = "1" ]; then
-		touch "$multiap_flag_file"
-	else
-		[ -e "$multiap_flag_file" ] && rm "$multiap_flag_file"
-	fi
 	wpa_supplicant_teardown_interface "$ifname"
 	cat > "$_config" <<EOF
 $ap_scan
@@ -744,11 +666,9 @@ wpa_supplicant_add_network() {
 	json_get_vars \
 		ssid bssid key \
 		basic_rate mcast_rate \
-		ieee80211w ieee80211r \
-		multi_ap
+		ieee80211w ieee80211r
 
 	set_default ieee80211r 0
-	set_default multi_ap 0
 
 	local key_mgmt='NONE'
 	local enc_str=
@@ -782,22 +702,14 @@ wpa_supplicant_add_network() {
 
 	[ "$_w_mode" = "adhoc" -o "$_w_mode" = "mesh" ] && append network_data "$_w_modestr" "$N$T"
 
-	[ "$multi_ap" = 1 -a "$_w_mode" = "sta" ] && append network_data "multi_ap_backhaul_sta=1" "$N$T"
-
 	case "$auth_type" in
 		none) ;;
-		owe)
-			hostapd_append_wpa_key_mgmt
-		;;
 		wep)
 			local wep_keyidx=0
 			hostapd_append_wep_key network_data
 			append network_data "wep_tx_keyidx=$wep_keyidx" "$N$T"
 		;;
-		wps)
-			key_mgmt='WPS'
-		;;
-		psk|sae|psk-sae)
+		psk)
 			local passphrase
 
 			if [ "$_w_mode" != "mesh" ]; then
@@ -817,7 +729,7 @@ wpa_supplicant_add_network() {
 			fi
 			append network_data "$passphrase" "$N$T"
 		;;
-		eap|eap192|eap-eap192)
+		eap)
 			hostapd_append_wpa_key_mgmt
 			key_mgmt="$wpa_key_mgmt"
 
@@ -904,10 +816,7 @@ wpa_supplicant_add_network() {
 		append network_data "mcast_rate=$mc_rate" "$N$T"
 	}
 
-	if [ "$key_mgnt" = "WPS" ]; then
-		echo "wps_cred_processing=1" >> "$_config"
-	else
-		cat >> "$_config" <<EOF
+	cat >> "$_config" <<EOF
 network={
 	$scan_ssid
 	ssid="$ssid"
@@ -915,7 +824,6 @@ network={
 	$network_data
 }
 EOF
-	fi
 	return 0
 }
 
@@ -924,7 +832,7 @@ wpa_supplicant_run() {
 
 	_wpa_supplicant_common "$ifname"
 
-	/usr/sbin/wpa_supplicant -B -s \
+	/usr/sbin/wpa_supplicant -B \
 		${network_bridge:+-b $network_bridge} \
 		-P "/var/run/wpa_supplicant-${ifname}.pid" \
 		-D ${_w_driver:-wext} \

package/network/services/hostapd/files/wpa_supplicant-basic.config

@@ -1,598 +0,0 @@
-# Example wpa_supplicant build time configuration
-#
-# This file lists the configuration options that are used when building the
-# wpa_supplicant binary. All lines starting with # are ignored. Configuration
-# option lines must be commented out complete, if they are not to be included,
-# i.e., just setting VARIABLE=n is not disabling that variable.
-#
-# This file is included in Makefile, so variables like CFLAGS and LIBS can also
-# be modified from here. In most cases, these lines should use += in order not
-# to override previous values of the variables.
-
-
-# Uncomment following two lines and fix the paths if you have installed OpenSSL
-# or GnuTLS in non-default location
-#CFLAGS += -I/usr/local/openssl/include
-#LIBS += -L/usr/local/openssl/lib
-
-# Some Red Hat versions seem to include kerberos header files from OpenSSL, but
-# the kerberos files are not in the default include path. Following line can be
-# used to fix build issues on such systems (krb5.h not found).
-#CFLAGS += -I/usr/include/kerberos
-
-# Driver interface for generic Linux wireless extensions
-# Note: WEXT is deprecated in the current Linux kernel version and no new
-# functionality is added to it. nl80211-based interface is the new
-# replacement for WEXT and its use allows wpa_supplicant to properly control
-# the driver to improve existing functionality like roaming and to support new
-# functionality.
-CONFIG_DRIVER_WEXT=y
-
-# Driver interface for Linux drivers using the nl80211 kernel interface
-CONFIG_DRIVER_NL80211=y
-
-# QCA vendor extensions to nl80211
-#CONFIG_DRIVER_NL80211_QCA=y
-
-# driver_nl80211.c requires libnl. If you are compiling it yourself
-# you may need to point hostapd to your version of libnl.
-#
-#CFLAGS += -I$<path to libnl include files>
-#LIBS += -L$<path to libnl library files>
-
-# Use libnl v2.0 (or 3.0) libraries.
-#CONFIG_LIBNL20=y
-
-# Use libnl 3.2 libraries (if this is selected, CONFIG_LIBNL20 is ignored)
-#CONFIG_LIBNL32=y
-
-
-# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
-#CONFIG_DRIVER_BSD=y
-#CFLAGS += -I/usr/local/include
-#LIBS += -L/usr/local/lib
-#LIBS_p += -L/usr/local/lib
-#LIBS_c += -L/usr/local/lib
-
-# Driver interface for Windows NDIS
-#CONFIG_DRIVER_NDIS=y
-#CFLAGS += -I/usr/include/w32api/ddk
-#LIBS += -L/usr/local/lib
-# For native build using mingw
-#CONFIG_NATIVE_WINDOWS=y
-# Additional directories for cross-compilation on Linux host for mingw target
-#CFLAGS += -I/opt/mingw/mingw32/include/ddk
-#LIBS += -L/opt/mingw/mingw32/lib
-#CC=mingw32-gcc
-# By default, driver_ndis uses WinPcap for low-level operations. This can be
-# replaced with the following option which replaces WinPcap calls with NDISUIO.
-# However, this requires that WZC is disabled (net stop wzcsvc) before starting
-# wpa_supplicant.
-# CONFIG_USE_NDISUIO=y
-
-# Driver interface for wired Ethernet drivers
-CONFIG_DRIVER_WIRED=y
-
-# Driver interface for the Broadcom RoboSwitch family
-#CONFIG_DRIVER_ROBOSWITCH=y
-
-# Driver interface for no driver (e.g., WPS ER only)
-#CONFIG_DRIVER_NONE=y
-
-# Solaris libraries
-#LIBS += -lsocket -ldlpi -lnsl
-#LIBS_c += -lsocket
-
-# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is
-# included)
-#CONFIG_IEEE8021X_EAPOL=y
-
-# EAP-MD5
-#CONFIG_EAP_MD5=y
-
-# EAP-MSCHAPv2
-#CONFIG_EAP_MSCHAPV2=y
-
-# EAP-TLS
-#CONFIG_EAP_TLS=y
-
-# EAL-PEAP
-#CONFIG_EAP_PEAP=y
-
-# EAP-TTLS
-#CONFIG_EAP_TTLS=y
-
-# EAP-FAST
-# Note: If OpenSSL is used as the TLS library, OpenSSL 1.0 or newer is needed
-# for EAP-FAST support. Older OpenSSL releases would need to be patched, e.g.,
-# with openssl-0.9.8x-tls-extensions.patch, to add the needed functions.
-#CONFIG_EAP_FAST=y
-
-# EAP-GTC
-#CONFIG_EAP_GTC=y
-
-# EAP-OTP
-#CONFIG_EAP_OTP=y
-
-# EAP-SIM (enable CONFIG_PCSC, if EAP-SIM is used)
-#CONFIG_EAP_SIM=y
-
-# EAP-PSK (experimental; this is _not_ needed for WPA-PSK)
-#CONFIG_EAP_PSK=y
-
-# EAP-pwd (secure authentication using only a password)
-#CONFIG_EAP_PWD=y
-
-# EAP-PAX
-#CONFIG_EAP_PAX=y
-
-# LEAP
-#CONFIG_EAP_LEAP=y
-
-# EAP-AKA (enable CONFIG_PCSC, if EAP-AKA is used)
-#CONFIG_EAP_AKA=y
-
-# EAP-AKA' (enable CONFIG_PCSC, if EAP-AKA' is used).
-# This requires CONFIG_EAP_AKA to be enabled, too.
-#CONFIG_EAP_AKA_PRIME=y
-
-# Enable USIM simulator (Milenage) for EAP-AKA
-#CONFIG_USIM_SIMULATOR=y
-
-# EAP-SAKE
-#CONFIG_EAP_SAKE=y
-
-# EAP-GPSK
-#CONFIG_EAP_GPSK=y
-# Include support for optional SHA256 cipher suite in EAP-GPSK
-#CONFIG_EAP_GPSK_SHA256=y
-
-# EAP-TNC and related Trusted Network Connect support (experimental)
-#CONFIG_EAP_TNC=y
-
-# Wi-Fi Protected Setup (WPS)
-#CONFIG_WPS=y
-# Enable WPS external registrar functionality
-#CONFIG_WPS_ER=y
-# Disable credentials for an open network by default when acting as a WPS
-# registrar.
-#CONFIG_WPS_REG_DISABLE_OPEN=y
-# Enable WPS support with NFC config method
-#CONFIG_WPS_NFC=y
-
-# EAP-IKEv2
-#CONFIG_EAP_IKEV2=y
-
-# EAP-EKE
-#CONFIG_EAP_EKE=y
-
-# PKCS#12 (PFX) support (used to read private key and certificate file from
-# a file that usually has extension .p12 or .pfx)
-#CONFIG_PKCS12=y
-
-# Smartcard support (i.e., private key on a smartcard), e.g., with openssl
-# engine.
-#CONFIG_SMARTCARD=y
-
-# PC/SC interface for smartcards (USIM, GSM SIM)
-# Enable this if EAP-SIM or EAP-AKA is included
-#CONFIG_PCSC=y
-
-# Support HT overrides (disable HT/HT40, mask MCS rates, etc.)
-CONFIG_HT_OVERRIDES=y
-
-# Support VHT overrides (disable VHT, mask MCS rates, etc.)
-CONFIG_VHT_OVERRIDES=y
-
-# Development testing
-#CONFIG_EAPOL_TEST=y
-
-# Select control interface backend for external programs, e.g, wpa_cli:
-# unix = UNIX domain sockets (default for Linux/*BSD)
-# udp = UDP sockets using localhost (127.0.0.1)
-# udp6 = UDP IPv6 sockets using localhost (::1)
-# named_pipe = Windows Named Pipe (default for Windows)
-# udp-remote = UDP sockets with remote access (only for tests systems/purpose)
-# udp6-remote = UDP IPv6 sockets with remote access (only for tests purpose)
-# y = use default (backwards compatibility)
-# If this option is commented out, control interface is not included in the
-# build.
-CONFIG_CTRL_IFACE=y
-
-# Include support for GNU Readline and History Libraries in wpa_cli.
-# When building a wpa_cli binary for distribution, please note that these
-# libraries are licensed under GPL and as such, BSD license may not apply for
-# the resulting binary.
-#CONFIG_READLINE=y
-
-# Include internal line edit mode in wpa_cli. This can be used as a replacement
-# for GNU Readline to provide limited command line editing and history support.
-#CONFIG_WPA_CLI_EDIT=y
-
-# Remove debugging code that is printing out debug message to stdout.
-# This can be used to reduce the size of the wpa_supplicant considerably
-# if debugging code is not needed. The size reduction can be around 35%
-# (e.g., 90 kB).
-#CONFIG_NO_STDOUT_DEBUG=y
-
-# Remove WPA support, e.g., for wired-only IEEE 802.1X supplicant, to save
-# 35-50 kB in code size.
-#CONFIG_NO_WPA=y
-
-# Remove IEEE 802.11i/WPA-Personal ASCII passphrase support
-# This option can be used to reduce code size by removing support for
-# converting ASCII passphrases into PSK. If this functionality is removed, the
-# PSK can only be configured as the 64-octet hexstring (e.g., from
-# wpa_passphrase). This saves about 0.5 kB in code size.
-#CONFIG_NO_WPA_PASSPHRASE=y
-
-# Disable scan result processing (ap_mode=1) to save code size by about 1 kB.
-# This can be used if ap_scan=1 mode is never enabled.
-#CONFIG_NO_SCAN_PROCESSING=y
-
-# Select configuration backend:
-# file = text file (e.g., wpa_supplicant.conf; note: the configuration file
-#	path is given on command line, not here; this option is just used to
-#	select the backend that allows configuration files to be used)
-# winreg = Windows registry (see win_example.reg for an example)
-CONFIG_BACKEND=file
-
-# Remove configuration write functionality (i.e., to allow the configuration
-# file to be updated based on runtime configuration changes). The runtime
-# configuration can still be changed, the changes are just not going to be
-# persistent over restarts. This option can be used to reduce code size by
-# about 3.5 kB.
-#CONFIG_NO_CONFIG_WRITE=y
-
-# Remove support for configuration blobs to reduce code size by about 1.5 kB.
-#CONFIG_NO_CONFIG_BLOBS=y
-
-# Select program entry point implementation:
-# main = UNIX/POSIX like main() function (default)
-# main_winsvc = Windows service (read parameters from registry)
-# main_none = Very basic example (development use only)
-#CONFIG_MAIN=main
-
-# Select wrapper for operating system and C library specific functions
-# unix = UNIX/POSIX like systems (default)
-# win32 = Windows systems
-# none = Empty template
-#CONFIG_OS=unix
-
-# Select event loop implementation
-# eloop = select() loop (default)
-# eloop_win = Windows events and WaitForMultipleObject() loop
-#CONFIG_ELOOP=eloop
-
-# Should we use poll instead of select? Select is used by default.
-#CONFIG_ELOOP_POLL=y
-
-# Should we use epoll instead of select? Select is used by default.
-#CONFIG_ELOOP_EPOLL=y
-
-# Should we use kqueue instead of select? Select is used by default.
-#CONFIG_ELOOP_KQUEUE=y
-
-# Select layer 2 packet implementation
-# linux = Linux packet socket (default)
-# pcap = libpcap/libdnet/WinPcap
-# freebsd = FreeBSD libpcap
-# winpcap = WinPcap with receive thread
-# ndis = Windows NDISUIO (note: requires CONFIG_USE_NDISUIO=y)
-# none = Empty template
-#CONFIG_L2_PACKET=linux
-
-# Disable Linux packet socket workaround applicable for station interface
-# in a bridge for EAPOL frames. This should be uncommented only if the kernel
-# is known to not have the regression issue in packet socket behavior with
-# bridge interfaces (commit 'bridge: respect RFC2863 operational state')').
-#CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y
-
-# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS)
-#CONFIG_PEERKEY=y
-
-# IEEE 802.11w (management frame protection), also known as PMF
-# Driver support is also needed for IEEE 802.11w.
-#CONFIG_IEEE80211W=y
-
-# Select TLS implementation
-# openssl = OpenSSL (default)
-# gnutls = GnuTLS
-# internal = Internal TLSv1 implementation (experimental)
-# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
-# none = Empty template
-CONFIG_TLS=internal
-
-# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.1)
-# can be enabled to get a stronger construction of messages when block ciphers
-# are used. It should be noted that some existing TLS v1.0 -based
-# implementation may not be compatible with TLS v1.1 message (ClientHello is
-# sent prior to negotiating which version will be used)
-#CONFIG_TLSV11=y
-
-# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.2)
-# can be enabled to enable use of stronger crypto algorithms. It should be
-# noted that some existing TLS v1.0 -based implementation may not be compatible
-# with TLS v1.2 message (ClientHello is sent prior to negotiating which version
-# will be used)
-#CONFIG_TLSV12=y
-
-# Select which ciphers to use by default with OpenSSL if the user does not
-# specify them.
-#CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW"
-
-# If CONFIG_TLS=internal is used, additional library and include paths are
-# needed for LibTomMath. Alternatively, an integrated, minimal version of
-# LibTomMath can be used. See beginning of libtommath.c for details on benefits
-# and drawbacks of this option.
-#CONFIG_INTERNAL_LIBTOMMATH=y
-#ifndef CONFIG_INTERNAL_LIBTOMMATH
-#LTM_PATH=/usr/src/libtommath-0.39
-#CFLAGS += -I$(LTM_PATH)
-#LIBS += -L$(LTM_PATH)
-#LIBS_p += -L$(LTM_PATH)
-#endif
-# At the cost of about 4 kB of additional binary size, the internal LibTomMath
-# can be configured to include faster routines for exptmod, sqr, and div to
-# speed up DH and RSA calculation considerably
-#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
-
-# Include NDIS event processing through WMI into wpa_supplicant/wpasvc.
-# This is only for Windows builds and requires WMI-related header files and
-# WbemUuid.Lib from Platform SDK even when building with MinGW.
-#CONFIG_NDIS_EVENTS_INTEGRATED=y
-#PLATFORMSDKLIB="/opt/Program Files/Microsoft Platform SDK/Lib"
-
-# Add support for old DBus control interface
-# (fi.epitest.hostap.WPASupplicant)
-#CONFIG_CTRL_IFACE_DBUS=y
-
-# Add support for new DBus control interface
-# (fi.w1.hostap.wpa_supplicant1)
-#CONFIG_CTRL_IFACE_DBUS_NEW=y
-
-# Add introspection support for new DBus control interface
-#CONFIG_CTRL_IFACE_DBUS_INTRO=y
-
-# Add support for loading EAP methods dynamically as shared libraries.
-# When this option is enabled, each EAP method can be either included
-# statically (CONFIG_EAP_<method>=y) or dynamically (CONFIG_EAP_<method>=dyn).
-# Dynamic EAP methods are build as shared objects (eap_*.so) and they need to
-# be loaded in the beginning of the wpa_supplicant configuration file
-# (see load_dynamic_eap parameter in the example file) before being used in
-# the network blocks.
-#
-# Note that some shared parts of EAP methods are included in the main program
-# and in order to be able to use dynamic EAP methods using these parts, the
-# main program must have been build with the EAP method enabled (=y or =dyn).
-# This means that EAP-TLS/PEAP/TTLS/FAST cannot be added as dynamic libraries
-# unless at least one of them was included in the main build to force inclusion
-# of the shared code. Similarly, at least one of EAP-SIM/AKA must be included
-# in the main build to be able to load these methods dynamically.
-#
-# Please also note that using dynamic libraries will increase the total binary
-# size. Thus, it may not be the best option for targets that have limited
-# amount of memory/flash.
-#CONFIG_DYNAMIC_EAP_METHODS=y
-
-# IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode
-CONFIG_IEEE80211R=y
-
-# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies
-# CONFIG_IEEE80211R).
-#CONFIG_IEEE80211R_AP=y
-
-# Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt)
-#CONFIG_DEBUG_FILE=y
-
-# Send debug messages to syslog instead of stdout
-CONFIG_DEBUG_SYSLOG=y
-# Set syslog facility for debug messages
-CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON
-
-# Add support for sending all debug messages (regardless of debug verbosity)
-# to the Linux kernel tracing facility. This helps debug the entire stack by
-# making it easy to record everything happening from the driver up into the
-# same file, e.g., using trace-cmd.
-#CONFIG_DEBUG_LINUX_TRACING=y
-
-# Add support for writing debug log to Android logcat instead of standard
-# output
-#CONFIG_ANDROID_LOG=y
-
-# Enable privilege separation (see README 'Privilege separation' for details)
-#CONFIG_PRIVSEP=y
-
-# Enable mitigation against certain attacks against TKIP by delaying Michael
-# MIC error reports by a random amount of time between 0 and 60 seconds
-#CONFIG_DELAYED_MIC_ERROR_REPORT=y
-
-# Enable tracing code for developer debugging
-# This tracks use of memory allocations and other registrations and reports
-# incorrect use with a backtrace of call (or allocation) location.
-#CONFIG_WPA_TRACE=y
-# For BSD, uncomment these.
-#LIBS += -lexecinfo
-#LIBS_p += -lexecinfo
-#LIBS_c += -lexecinfo
-
-# Use libbfd to get more details for developer debugging
-# This enables use of libbfd to get more detailed symbols for the backtraces
-# generated by CONFIG_WPA_TRACE=y.
-#CONFIG_WPA_TRACE_BFD=y
-# For BSD, uncomment these.
-#LIBS += -lbfd -liberty -lz
-#LIBS_p += -lbfd -liberty -lz
-#LIBS_c += -lbfd -liberty -lz
-
-# wpa_supplicant depends on strong random number generation being available
-# from the operating system. os_get_random() function is used to fetch random
-# data when needed, e.g., for key generation. On Linux and BSD systems, this
-# works by reading /dev/urandom. It should be noted that the OS entropy pool
-# needs to be properly initialized before wpa_supplicant is started. This is
-# important especially on embedded devices that do not have a hardware random
-# number generator and may by default start up with minimal entropy available
-# for random number generation.
-#
-# As a safety net, wpa_supplicant is by default trying to internally collect
-# additional entropy for generating random data to mix in with the data fetched
-# from the OS. This by itself is not considered to be very strong, but it may
-# help in cases where the system pool is not initialized properly. However, it
-# is very strongly recommended that the system pool is initialized with enough
-# entropy either by using hardware assisted random number generator or by
-# storing state over device reboots.
-#
-# wpa_supplicant can be configured to maintain its own entropy store over
-# restarts to enhance random number generation. This is not perfect, but it is
-# much more secure than using the same sequence of random numbers after every
-# reboot. This can be enabled with -e<entropy file> command line option. The
-# specified file needs to be readable and writable by wpa_supplicant.
-#
-# If the os_get_random() is known to provide strong random data (e.g., on
-# Linux/BSD, the board in question is known to have reliable source of random
-# data from /dev/urandom), the internal wpa_supplicant random pool can be
-# disabled. This will save some in binary size and CPU use. However, this
-# should only be considered for builds that are known to be used on devices
-# that meet the requirements described above.
-CONFIG_NO_RANDOM_POOL=y
-
-# IEEE 802.11n (High Throughput) support (mainly for AP mode)
-#CONFIG_IEEE80211N=y
-
-# IEEE 802.11ac (Very High Throughput) support (mainly for AP mode)
-# (depends on CONFIG_IEEE80211N)
-#CONFIG_IEEE80211AC=y
-
-# Wireless Network Management (IEEE Std 802.11v-2011)
-# Note: This is experimental and not complete implementation.
-#CONFIG_WNM=y
-
-# Interworking (IEEE 802.11u)
-# This can be used to enable functionality to improve interworking with
-# external networks (GAS/ANQP to learn more about the networks and network
-# selection based on available credentials).
-#CONFIG_INTERWORKING=y
-
-# Hotspot 2.0
-#CONFIG_HS20=y
-
-# Enable interface matching in wpa_supplicant
-#CONFIG_MATCH_IFACE=y
-
-# Disable roaming in wpa_supplicant
-#CONFIG_NO_ROAMING=y
-
-# AP mode operations with wpa_supplicant
-# This can be used for controlling AP mode operations with wpa_supplicant. It
-# should be noted that this is mainly aimed at simple cases like
-# WPA2-Personal while more complex configurations like WPA2-Enterprise with an
-# external RADIUS server can be supported with hostapd.
-#CONFIG_AP=y
-
-# P2P (Wi-Fi Direct)
-# This can be used to enable P2P support in wpa_supplicant. See README-P2P for
-# more information on P2P operations.
-#CONFIG_P2P=y
-
-# Enable TDLS support
-#CONFIG_TDLS=y
-
-# Wi-Fi Direct
-# This can be used to enable Wi-Fi Direct extensions for P2P using an external
-# program to control the additional information exchanges in the messages.
-#CONFIG_WIFI_DISPLAY=y
-
-# Autoscan
-# This can be used to enable automatic scan support in wpa_supplicant.
-# See wpa_supplicant.conf for more information on autoscan usage.
-#
-# Enabling directly a module will enable autoscan support.
-# For exponential module:
-#CONFIG_AUTOSCAN_EXPONENTIAL=y
-# For periodic module:
-#CONFIG_AUTOSCAN_PERIODIC=y
-
-# Password (and passphrase, etc.) backend for external storage
-# These optional mechanisms can be used to add support for storing passwords
-# and other secrets in external (to wpa_supplicant) location. This allows, for
-# example, operating system specific key storage to be used
-#
-# External password backend for testing purposes (developer use)
-#CONFIG_EXT_PASSWORD_TEST=y
-
-# Enable Fast Session Transfer (FST)
-#CONFIG_FST=y
-
-# Enable CLI commands for FST testing
-#CONFIG_FST_TEST=y
-
-# OS X builds. This is only for building eapol_test.
-#CONFIG_OSX=y
-
-# Automatic Channel Selection
-# This will allow wpa_supplicant to pick the channel automatically when channel
-# is set to "0".
-#
-# TODO: Extend parser to be able to parse "channel=acs_survey" as an alternative
-# to "channel=0". This would enable us to eventually add other ACS algorithms in
-# similar way.
-#
-# Automatic selection is currently only done through initialization, later on
-# we hope to do background checks to keep us moving to more ideal channels as
-# time goes by. ACS is currently only supported through the nl80211 driver and
-# your driver must have survey dump capability that is filled by the driver
-# during scanning.
-#
-# TODO: In analogy to hostapd be able to customize the ACS survey algorithm with
-# a newly to create wpa_supplicant.conf variable acs_num_scans.
-#
-# Supported ACS drivers:
-# * ath9k
-# * ath5k
-# * ath10k
-#
-# For more details refer to:
-# http://wireless.kernel.org/en/users/Documentation/acs
-#CONFIG_ACS=y
-
-# Support Multi Band Operation
-#CONFIG_MBO=y
-
-# Fast Initial Link Setup (FILS) (IEEE 802.11ai)
-# Note: This is an experimental and not yet complete implementation. This
-# should not be enabled for production use.
-#CONFIG_FILS=y
-# FILS shared key authentication with PFS
-#CONFIG_FILS_SK_PFS=y
-
-# Support RSN on IBSS networks
-# This is needed to be able to use mode=1 network profile with proto=RSN and
-# key_mgmt=WPA-PSK (i.e., full key management instead of WPA-None).
-#CONFIG_IBSS_RSN=y
-
-# External PMKSA cache control
-# This can be used to enable control interface commands that allow the current
-# PMKSA cache entries to be fetched and new entries to be added.
-#CONFIG_PMKSA_CACHE_EXTERNAL=y
-
-# Mesh Networking (IEEE 802.11s)
-#CONFIG_MESH=y
-
-# Background scanning modules
-# These can be used to request wpa_supplicant to perform background scanning
-# operations for roaming within an ESS (same SSID). See the bgscan parameter in
-# the wpa_supplicant.conf file for more details.
-# Periodic background scans based on signal strength
-#CONFIG_BGSCAN_SIMPLE=y
-# Learn channels used by the network and try to avoid bgscans on other
-# channels (experimental)
-#CONFIG_BGSCAN_LEARN=y
-
-# Opportunistic Wireless Encryption (OWE)
-# Experimental implementation of draft-harkins-owe-07.txt
-#CONFIG_OWE=y
-
-# uBus IPC/RPC System
-# Services can connect to the bus and provide methods
-# that can be called by other services or clients.
-CONFIG_UBUS=y

package/network/services/hostapd/files/wpa_supplicant-full.config

@@ -73,12 +73,6 @@ CONFIG_DRIVER_NL80211=y
 # Driver interface for wired Ethernet drivers
 CONFIG_DRIVER_WIRED=y
 
-# Driver interface for MACsec capable Qualcomm Atheros drivers
-#CONFIG_DRIVER_MACSEC_QCA=y
-
-# Driver interface for Linux MACsec drivers
-#CONFIG_DRIVER_MACSEC_LINUX=y
-
 # Driver interface for the Broadcom RoboSwitch family
 #CONFIG_DRIVER_ROBOSWITCH=y
 
@@ -89,8 +83,8 @@ CONFIG_DRIVER_WIRED=y
 #LIBS += -lsocket -ldlpi -lnsl
 #LIBS_c += -lsocket
 
-# Enable IEEE 802.1X Supplicant (automatically included if any EAP method or
-# MACsec is included)
+# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is
+# included)
 CONFIG_IEEE8021X_EAPOL=y
 
 # EAP-MD5
@@ -172,9 +166,6 @@ CONFIG_WPS=y
 # EAP-EKE
 #CONFIG_EAP_EKE=y
 
-# MACsec
-#CONFIG_MACSEC=y
-
 # PKCS#12 (PFX) support (used to read private key and certificate file from
 # a file that usually has extension .p12 or .pfx)
 CONFIG_PKCS12=y
@@ -297,6 +288,9 @@ CONFIG_BACKEND=file
 # bridge interfaces (commit 'bridge: respect RFC2863 operational state')').
 #CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y
 
+# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS)
+CONFIG_PEERKEY=y
+
 # IEEE 802.11w (management frame protection), also known as PMF
 # Driver support is also needed for IEEE 802.11w.
 #CONFIG_IEEE80211W=y
@@ -384,13 +378,17 @@ CONFIG_INTERNAL_LIBTOMMATH_FAST=y
 # IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode
 CONFIG_IEEE80211R=y
 
+# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies
+# CONFIG_IEEE80211R).
+#CONFIG_IEEE80211R_AP=y
+
 # Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt)
 #CONFIG_DEBUG_FILE=y
 
 # Send debug messages to syslog instead of stdout
-CONFIG_DEBUG_SYSLOG=y
+#CONFIG_DEBUG_SYSLOG=y
 # Set syslog facility for debug messages
-CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON
+#CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON
 
 # Add support for sending all debug messages (regardless of debug verbosity)
 # to the Linux kernel tracing facility. This helps debug the entire stack by
@@ -593,8 +591,3 @@ CONFIG_IBSS_RSN=y
 # Opportunistic Wireless Encryption (OWE)
 # Experimental implementation of draft-harkins-owe-07.txt
 #CONFIG_OWE=y
-
-# uBus IPC/RPC System
-# Services can connect to the bus and provide methods
-# that can be called by other services or clients.
-CONFIG_UBUS=y

package/network/services/hostapd/files/wpa_supplicant-mini.config

@@ -73,12 +73,6 @@ CONFIG_DRIVER_NL80211=y
 # Driver interface for wired Ethernet drivers
 CONFIG_DRIVER_WIRED=y
 
-# Driver interface for MACsec capable Qualcomm Atheros drivers
-#CONFIG_DRIVER_MACSEC_QCA=y
-
-# Driver interface for Linux MACsec drivers
-#CONFIG_DRIVER_MACSEC_LINUX=y
-
 # Driver interface for the Broadcom RoboSwitch family
 #CONFIG_DRIVER_ROBOSWITCH=y
 
@@ -89,8 +83,8 @@ CONFIG_DRIVER_WIRED=y
 #LIBS += -lsocket -ldlpi -lnsl
 #LIBS_c += -lsocket
 
-# Enable IEEE 802.1X Supplicant (automatically included if any EAP method or
-# MACsec is included)
+# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is
+# included)
 #CONFIG_IEEE8021X_EAPOL=y
 
 # EAP-MD5
@@ -172,9 +166,6 @@ CONFIG_DRIVER_WIRED=y
 # EAP-EKE
 #CONFIG_EAP_EKE=y
 
-# MACsec
-#CONFIG_MACSEC=y
-
 # PKCS#12 (PFX) support (used to read private key and certificate file from
 # a file that usually has extension .p12 or .pfx)
 #CONFIG_PKCS12=y
@@ -297,6 +288,9 @@ CONFIG_BACKEND=file
 # bridge interfaces (commit 'bridge: respect RFC2863 operational state')').
 #CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y
 
+# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS)
+#CONFIG_PEERKEY=y
+
 # IEEE 802.11w (management frame protection), also known as PMF
 # Driver support is also needed for IEEE 802.11w.
 #CONFIG_IEEE80211W=y
@@ -384,13 +378,17 @@ CONFIG_TLS=internal
 # IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode
 #CONFIG_IEEE80211R=y
 
+# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies
+# CONFIG_IEEE80211R).
+#CONFIG_IEEE80211R_AP=y
+
 # Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt)
 #CONFIG_DEBUG_FILE=y
 
 # Send debug messages to syslog instead of stdout
-CONFIG_DEBUG_SYSLOG=y
+#CONFIG_DEBUG_SYSLOG=y
 # Set syslog facility for debug messages
-CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON
+#CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON
 
 # Add support for sending all debug messages (regardless of debug verbosity)
 # to the Linux kernel tracing facility. This helps debug the entire stack by
@@ -593,8 +591,3 @@ CONFIG_NO_RANDOM_POOL=y
 # Opportunistic Wireless Encryption (OWE)
 # Experimental implementation of draft-harkins-owe-07.txt
 #CONFIG_OWE=y
-
-# uBus IPC/RPC System
-# Services can connect to the bus and provide methods
-# that can be called by other services or clients.
-CONFIG_UBUS=y

package/network/services/hostapd/files/wpa_supplicant-p2p.config

@@ -73,12 +73,6 @@ CONFIG_DRIVER_NL80211=y
 # Driver interface for wired Ethernet drivers
 CONFIG_DRIVER_WIRED=y
 
-# Driver interface for MACsec capable Qualcomm Atheros drivers
-#CONFIG_DRIVER_MACSEC_QCA=y
-
-# Driver interface for Linux MACsec drivers
-#CONFIG_DRIVER_MACSEC_LINUX=y
-
 # Driver interface for the Broadcom RoboSwitch family
 #CONFIG_DRIVER_ROBOSWITCH=y
 
@@ -89,8 +83,8 @@ CONFIG_DRIVER_WIRED=y
 #LIBS += -lsocket -ldlpi -lnsl
 #LIBS_c += -lsocket
 
-# Enable IEEE 802.1X Supplicant (automatically included if any EAP method or
-# MACsec is included)
+# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is
+# included)
 CONFIG_IEEE8021X_EAPOL=y
 
 # EAP-MD5
@@ -172,9 +166,6 @@ CONFIG_WPS=y
 # EAP-EKE
 #CONFIG_EAP_EKE=y
 
-# MACsec
-#CONFIG_MACSEC=y
-
 # PKCS#12 (PFX) support (used to read private key and certificate file from
 # a file that usually has extension .p12 or .pfx)
 CONFIG_PKCS12=y
@@ -297,6 +288,9 @@ CONFIG_BACKEND=file
 # bridge interfaces (commit 'bridge: respect RFC2863 operational state')').
 #CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y
 
+# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS)
+CONFIG_PEERKEY=y
+
 # IEEE 802.11w (management frame protection), also known as PMF
 # Driver support is also needed for IEEE 802.11w.
 CONFIG_IEEE80211W=y
@@ -384,13 +378,17 @@ CONFIG_INTERNAL_LIBTOMMATH_FAST=y
 # IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode
 #CONFIG_IEEE80211R=y
 
+# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies
+# CONFIG_IEEE80211R).
+#CONFIG_IEEE80211R_AP=y
+
 # Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt)
 #CONFIG_DEBUG_FILE=y
 
 # Send debug messages to syslog instead of stdout
-CONFIG_DEBUG_SYSLOG=y
+#CONFIG_DEBUG_SYSLOG=y
 # Set syslog facility for debug messages
-CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON
+#CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON
 
 # Add support for sending all debug messages (regardless of debug verbosity)
 # to the Linux kernel tracing facility. This helps debug the entire stack by
@@ -593,8 +591,3 @@ CONFIG_IBSS_RSN=y
 # Opportunistic Wireless Encryption (OWE)
 # Experimental implementation of draft-harkins-owe-07.txt
 #CONFIG_OWE=y
-
-# uBus IPC/RPC System
-# Services can connect to the bus and provide methods
-# that can be called by other services or clients.
-CONFIG_UBUS=y

package/network/services/hostapd/files/wps-hotplug.sh

@@ -1,62 +1,11 @@
 #!/bin/sh
 
-wps_catch_credentials() {
-	local iface ifaces ifc ifname ssid encryption key radio radios
-	local found=0
-
-	. /usr/share/libubox/jshn.sh
-	ubus -S -t 30 listen wps_credentials | while read creds; do
-		json_init
-		json_load "$creds"
-		json_select wps_credentials || continue
-		json_get_vars ifname ssid key encryption
-		local ifcname="$ifname"
-		json_init
-		json_load "$(ubus -S call network.wireless status)"
-		json_get_keys radios
-		for radio in $radios; do
-			json_select $radio
-			json_select interfaces
-			json_get_keys ifaces
-			for ifc in $ifaces; do
-				json_select $ifc
-				json_get_vars ifname
-				[ "$ifname" = "$ifcname" ] && {
-					ubus -S call uci set "{\"config\":\"wireless\", \"type\":\"wifi-iface\",		\
-								\"match\": { \"device\": \"$radio\", \"encryption\": \"wps\" },	\
-								\"values\": { \"encryption\": \"$encryption\", 			\
-										\"ssid\": \"$ssid\", 				\
-										\"key\": \"$key\" } }"
-					ubus -S call uci commit '{"config": "wireless"}'
-					ubus -S call uci apply
-				}
-				json_select ..
-			done
-			json_select ..
-			json_select ..
-		done
-	done
-}
-
 if [ "$ACTION" = "pressed" -a "$BUTTON" = "wps" ]; then
-	wps_done=0
-	ubusobjs="$( ubus -S list hostapd.* )"
-	for ubusobj in $ubusobjs; do
-		ubus -S call $ubusobj wps_start && wps_done=1
+	cd /var/run/hostapd
+	for socket in *; do
+		[ -S "$socket" ] || continue
+		hostapd_cli -i "$socket" wps_pbc
 	done
-	[ $wps_done = 0 ] || return 0
-	wps_done=0
-	ubusobjs="$( ubus -S list wpa_supplicant.* )"
-	for ubusobj in $ubusobjs; do
-		ifname="$(echo $ubusobj | cut -d'.' -f2 )"
-		multi_ap=""
-		if [ -e "/var/run/wpa_supplicant-${ifname}.conf.is_multiap" ]; then
-			ubus -S call $ubusobj wps_start '{ "multi_ap": true }' && wps_done=1
-		else
-			ubus -S call $ubusobj wps_start && wps_done=1
-		fi
-	done
-	[ $wps_done = 0 ] || wps_catch_credentials &
 fi
 
 return 0

package/network/services/hostapd/patches/000-0001-Reduce-undesired-logging-of-ACL-rejection.patch

@@ -0,0 +1,39 @@
+From 6588f712220797c69dbd019daa19b82a50d92782 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 14 Oct 2018 19:57:22 +0300
+Subject: Reduce undesired logging of ACL rejection events from AP mode
+
+When Probe Request frame handling was extended to use MAC ACL through
+ieee802_11_allowed_address(), the MSG_INFO level log print ("Station
+<addr> not allowed to authenticate") from that function ended up getting
+printed even for Probe Request frames. That was not by design and it can
+result in excessive logging and MSG_INFO level if MAC ACL is used.
+
+Fix this by printing this log entry only for authentication and
+association frames. In addition, drop the priority of that log entry to
+MSG_DEBUG since this is not really an unexpected behavior in most MAC
+ACL use cases.
+
+Fixes: 92eb00aec2a0 ("Extend ACL check for Probe Request frames")
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/ap/ieee802_11.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -1636,9 +1636,11 @@ ieee802_11_allowed_address(struct hostap
+ 				      is_probe_req);
+ 
+ 	if (res == HOSTAPD_ACL_REJECT) {
+-		wpa_printf(MSG_INFO,
+-			   "Station " MACSTR " not allowed to authenticate",
+-			   MAC2STR(addr));
++		if (!is_probe_req)
++			wpa_printf(MSG_DEBUG,
++				   "Station " MACSTR
++				   " not allowed to authenticate",
++				   MAC2STR(addr));
+ 		return HOSTAPD_ACL_REJECT;
+ 	}
+ 

package/network/services/hostapd/patches/000-0002-Drop-logging-priority-for-handle_auth_cb.patch

@@ -0,0 +1,28 @@
+From dc1b1c8db7905639be6f4de8173e2d97bf6df90d Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 14 Oct 2018 20:03:55 +0300
+Subject: Drop logging priority for handle_auth_cb no-STA-match messages
+
+This message was printed and MSG_INFO level which would be more
+reasonable for error cases where hostapd has accepted authentication.
+However, this is not really an error case for the cases where
+authentication was rejected (e.g., due to MAC ACL). Drop this to use
+MSG_DEBUG level.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/ap/ieee802_11.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -4018,7 +4018,8 @@ static void handle_auth_cb(struct hostap
+ 
+ 	sta = ap_get_sta(hapd, mgmt->da);
+ 	if (!sta) {
+-		wpa_printf(MSG_INFO, "handle_auth_cb: STA " MACSTR " not found",
++		wpa_printf(MSG_DEBUG, "handle_auth_cb: STA " MACSTR
++			   " not found",
+ 			   MAC2STR(mgmt->da));
+ 		return;
+ 	}

package/network/services/hostapd/patches/0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch

@@ -0,0 +1,43 @@
+From 3e34cfdff6b192fe337c6fb3f487f73e96582961 Mon Sep 17 00:00:00 2001
+From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
+Date: Sun, 15 Jul 2018 01:25:53 +0200
+Subject: [PATCH] WPA: Ignore unauthenticated encrypted EAPOL-Key data
+
+Ignore unauthenticated encrypted EAPOL-Key data in supplicant
+processing. When using WPA2, these are frames that have the Encrypted
+flag set, but not the MIC flag.
+
+When using WPA2, EAPOL-Key frames that had the Encrypted flag set but
+not the MIC flag, had their data field decrypted without first verifying
+the MIC. In case the data field was encrypted using RC4 (i.e., when
+negotiating TKIP as the pairwise cipher), this meant that
+unauthenticated but decrypted data would then be processed. An adversary
+could abuse this as a decryption oracle to recover sensitive information
+in the data field of EAPOL-Key messages (e.g., the group key).
+(CVE-2018-14526)
+
+Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
+---
+ src/rsn_supp/wpa.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -2208,6 +2208,17 @@ int wpa_sm_rx_eapol(struct wpa_sm *sm, c
+ 
+ 	if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) &&
+ 	    (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) && mic_len) {
++		/*
++		 * Only decrypt the Key Data field if the frame's authenticity
++		 * was verified. When using AES-SIV (FILS), the MIC flag is not
++		 * set, so this check should only be performed if mic_len != 0
++		 * which is the case in this code branch.
++		 */
++		if (!(key_info & WPA_KEY_INFO_MIC)) {
++			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
++				"WPA: Ignore EAPOL-Key with encrypted but unauthenticated data");
++			goto out;
++		}
+ 		if (wpa_supplicant_decrypt_key_data(sm, key, mic_len,
+ 						    ver, key_data,
+ 						    &key_data_len))

package/network/services/hostapd/patches/001-mesh-factor-out-mesh-join-function.patch

@@ -201,7 +201,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  
 --- a/wpa_supplicant/wpa_supplicant_i.h
 +++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -814,6 +814,7 @@ struct wpa_supplicant {
+@@ -810,6 +810,7 @@ struct wpa_supplicant {
  	unsigned int mesh_if_created:1;
  	unsigned int mesh_ht_enabled:1;
  	unsigned int mesh_vht_enabled:1;

package/network/services/hostapd/patches/006-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch

@@ -16,7 +16,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
 
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -1402,6 +1402,7 @@ struct wpa_driver_mesh_join_params {
+@@ -1390,6 +1390,7 @@ struct wpa_driver_mesh_join_params {
  #define WPA_DRIVER_MESH_FLAG_SAE_AUTH	0x00000004
  #define WPA_DRIVER_MESH_FLAG_AMPE	0x00000008
  	unsigned int flags;
@@ -26,7 +26,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  /**
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -9375,6 +9375,9 @@ static int nl80211_join_mesh(struct i802
+@@ -9270,6 +9270,9 @@ static int nl80211_join_mesh(struct i802
  
  	wpa_printf(MSG_DEBUG, "  * flags=%08X", params->flags);
  

package/network/services/hostapd/patches/010-mesh-consider-mesh-interface-on-dfs-event-handler.patch

@@ -15,7 +15,7 @@ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
 
 --- a/wpa_supplicant/ap.c
 +++ b/wpa_supplicant/ap.c
-@@ -1379,13 +1379,18 @@ int ap_ctrl_iface_chanswitch(struct wpa_
+@@ -1337,13 +1337,18 @@ int ap_ctrl_iface_chanswitch(struct wpa_
  void wpas_ap_ch_switch(struct wpa_supplicant *wpa_s, int freq, int ht,
  		       int offset, int width, int cf1, int cf2)
  {
@@ -37,7 +37,7 @@ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
  				offset, width, cf1, cf2);
  }
  
-@@ -1582,10 +1587,16 @@ int wpas_ap_pmksa_cache_add_external(str
+@@ -1540,10 +1545,16 @@ int wpas_ap_pmksa_cache_add_external(str
  void wpas_ap_event_dfs_radar_detected(struct wpa_supplicant *wpa_s,
  				      struct dfs_event *radar)
  {
@@ -57,7 +57,7 @@ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
  				   radar->ht_enabled, radar->chan_offset,
  				   radar->chan_width,
  				   radar->cf1, radar->cf2);
-@@ -1595,10 +1606,16 @@ void wpas_ap_event_dfs_radar_detected(st
+@@ -1553,10 +1564,16 @@ void wpas_ap_event_dfs_radar_detected(st
  void wpas_ap_event_dfs_cac_started(struct wpa_supplicant *wpa_s,
  				   struct dfs_event *radar)
  {
@@ -77,7 +77,7 @@ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
  			      radar->ht_enabled, radar->chan_offset,
  			      radar->chan_width, radar->cf1, radar->cf2);
  }
-@@ -1607,10 +1624,16 @@ void wpas_ap_event_dfs_cac_started(struc
+@@ -1565,10 +1582,16 @@ void wpas_ap_event_dfs_cac_started(struc
  void wpas_ap_event_dfs_cac_finished(struct wpa_supplicant *wpa_s,
  				    struct dfs_event *radar)
  {
@@ -97,7 +97,7 @@ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
  				 radar->ht_enabled, radar->chan_offset,
  				 radar->chan_width, radar->cf1, radar->cf2);
  }
-@@ -1619,10 +1642,16 @@ void wpas_ap_event_dfs_cac_finished(stru
+@@ -1577,10 +1600,16 @@ void wpas_ap_event_dfs_cac_finished(stru
  void wpas_ap_event_dfs_cac_aborted(struct wpa_supplicant *wpa_s,
  				   struct dfs_event *radar)
  {
@@ -117,7 +117,7 @@ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
  				 radar->ht_enabled, radar->chan_offset,
  				 radar->chan_width, radar->cf1, radar->cf2);
  }
-@@ -1631,10 +1660,16 @@ void wpas_ap_event_dfs_cac_aborted(struc
+@@ -1589,10 +1618,16 @@ void wpas_ap_event_dfs_cac_aborted(struc
  void wpas_ap_event_dfs_cac_nop_finished(struct wpa_supplicant *wpa_s,
  					struct dfs_event *radar)
  {
@@ -139,7 +139,7 @@ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
  }
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -3840,7 +3840,7 @@ static void wpas_event_dfs_cac_started(s
+@@ -3802,7 +3802,7 @@ static void wpas_event_dfs_cac_started(s
  				       struct dfs_event *radar)
  {
  #if defined(NEED_AP_MLME) && defined(CONFIG_AP)
@@ -148,7 +148,7 @@ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
  		wpas_ap_event_dfs_cac_started(wpa_s, radar);
  	} else
  #endif /* NEED_AP_MLME && CONFIG_AP */
-@@ -3861,7 +3861,7 @@ static void wpas_event_dfs_cac_finished(
+@@ -3823,7 +3823,7 @@ static void wpas_event_dfs_cac_finished(
  					struct dfs_event *radar)
  {
  #if defined(NEED_AP_MLME) && defined(CONFIG_AP)
@@ -157,7 +157,7 @@ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
  		wpas_ap_event_dfs_cac_finished(wpa_s, radar);
  	} else
  #endif /* NEED_AP_MLME && CONFIG_AP */
-@@ -3877,7 +3877,7 @@ static void wpas_event_dfs_cac_aborted(s
+@@ -3839,7 +3839,7 @@ static void wpas_event_dfs_cac_aborted(s
  				       struct dfs_event *radar)
  {
  #if defined(NEED_AP_MLME) && defined(CONFIG_AP)
@@ -166,7 +166,7 @@ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
  		wpas_ap_event_dfs_cac_aborted(wpa_s, radar);
  	} else
  #endif /* NEED_AP_MLME && CONFIG_AP */
-@@ -4328,6 +4328,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -4278,6 +4278,7 @@ void wpa_supplicant_event(void *ctx, enu
  #ifdef CONFIG_AP
  		if (wpa_s->current_ssid->mode == WPAS_MODE_AP ||
  		    wpa_s->current_ssid->mode == WPAS_MODE_P2P_GO ||

package/network/services/hostapd/patches/011-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch

@@ -1,7 +1,7 @@
-From bbaa6142eadf229334436fdbf51aa65bb819f771 Mon Sep 17 00:00:00 2001
+From ce3e491e445ebea9705e76ac7ee3d4841ace1cad Mon Sep 17 00:00:00 2001
 From: Peter Oh <peter.oh@bowerswilkins.com>
-Date: Tue, 29 May 2018 14:39:15 -0700
-Subject: [PATCH 11/18] mesh: Allow DFS channels to be selected if dfs is
+Date: Tue, 17 Apr 2018 21:55:08 -0700
+Subject: [PATCH 11/16] mesh: Allow DFS channels to be selected if dfs is
  enabled
 
 Note: DFS is assumed to be usable if a country code has been set
@@ -14,7 +14,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
 
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2090,6 +2090,8 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2060,6 +2060,8 @@ void ibss_mesh_setup_freq(struct wpa_sup
  	struct hostapd_freq_params vht_freq;
  	int chwidth, seg0, seg1;
  	u32 vht_caps = 0;
@@ -23,7 +23,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  
  	freq->freq = ssid->frequency;
  
-@@ -2166,8 +2168,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2136,8 +2138,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
  		return;
  
  	/* Check primary channel flags */
@@ -36,7 +36,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  
  #ifdef CONFIG_HT_OVERRIDES
  	if (ssid->disable_ht40)
-@@ -2193,8 +2198,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2163,8 +2168,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
  		return;
  
  	/* Check secondary channel flags */
@@ -49,7 +49,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  
  	freq->channel = pri_chan->chan;
  
-@@ -2284,8 +2292,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2254,8 +2262,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
  			return;
  
  		/* Back to HT configuration if channel not usable */
@@ -62,7 +62,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  	}
  
  	chwidth = VHT_CHANWIDTH_80MHZ;
-@@ -2305,10 +2316,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2275,10 +2286,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
  				if (!chan)
  					continue;
  

package/network/services/hostapd/patches/012-mesh-allow-mesh-to-send-channel-switch-request.patch

@@ -0,0 +1,25 @@
+From 4a8245ec2e9d48e464488477a3e7ed234009c216 Mon Sep 17 00:00:00 2001
+From: Peter Oh <peter.oh@bowerswilkins.com>
+Date: Tue, 29 May 2018 14:39:16 -0700
+Subject: [PATCH 12/18] mesh: allow mesh to send channel switch request
+
+add mesh type to nl80211 channel switch request,
+so mesh is able to send the request to kernel drivers.
+
+Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
+---
+ src/drivers/driver_nl80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -8685,7 +8685,8 @@ static int nl80211_switch_channel(void *
+ 	}
+ 
+ 	if ((drv->nlmode != NL80211_IFTYPE_AP) &&
+-	    (drv->nlmode != NL80211_IFTYPE_P2P_GO))
++	    (drv->nlmode != NL80211_IFTYPE_P2P_GO) &&
++	    (drv->nlmode != NL80211_IFTYPE_MESH_POINT) )
+ 		return -EOPNOTSUPP;
+ 
+ 	/*

package/network/services/hostapd/patches/014-mesh-do-not-allow-scan-result-to-swap-pri-sec.patch

@@ -1,7 +1,7 @@
-From f95897cef614fff710c31d9e478eacc85d6312d5 Mon Sep 17 00:00:00 2001
+From cf2ba81fb307f3e87e13896f9dbf93c0c2a9eb92 Mon Sep 17 00:00:00 2001
 From: Peter Oh <peter.oh@bowerswilkins.com>
-Date: Tue, 29 May 2018 14:39:18 -0700
-Subject: [PATCH 14/18] mesh: do not allow scan result to swap pri/sec
+Date: Tue, 17 Apr 2018 21:55:11 -0700
+Subject: [PATCH 14/16] mesh: do not allow scan result to swap pri/sec
 
 Swapping between primary and secondary channel will break
 mesh from joining, hence don't allow it.
@@ -13,7 +13,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
 
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2215,7 +2215,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2185,7 +2185,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
  	}
  	freq->sec_channel_offset = ht40;
  

package/network/services/hostapd/patches/015-mesh-do-not-use-offchan-mgmt-tx-on-DFS.patch

@@ -14,7 +14,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -7268,6 +7268,10 @@ static int wpa_driver_nl80211_send_actio
+@@ -7165,6 +7165,10 @@ static int wpa_driver_nl80211_send_actio
  	struct wpa_driver_nl80211_data *drv = bss->drv;
  	int ret = -1;
  	u8 *buf;
@@ -25,7 +25,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	struct ieee80211_hdr *hdr;
  
  	wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
-@@ -7292,7 +7296,11 @@ static int wpa_driver_nl80211_send_actio
+@@ -7189,7 +7193,11 @@ static int wpa_driver_nl80211_send_actio
  	} else {
  		os_memset(bss->rand_addr, 0, ETH_ALEN);
  	}
@@ -38,7 +38,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	if (is_ap_interface(drv->nlmode) &&
  	    (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
  	     (int) freq == bss->freq || drv->device_ap_sme ||
-@@ -7304,7 +7312,7 @@ static int wpa_driver_nl80211_send_actio
+@@ -7201,7 +7209,7 @@ static int wpa_driver_nl80211_send_actio
  		ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
  					     24 + data_len,
  					     &drv->send_action_cookie,

package/network/services/hostapd/patches/018-mesh-make-forwarding-configurable.patch

@@ -1,7 +1,7 @@
-From 90fe6429624fc48bc0e5d2d7eeecb7498708b5e3 Mon Sep 17 00:00:00 2001
+From 9a01d7f21bd33725dc33325a437c3cc4185ee8bd Mon Sep 17 00:00:00 2001
 From: Daniel Golle <daniel@makrotopia.org>
 Date: Wed, 18 Apr 2018 19:24:31 +0200
-Subject: [PATCH 18/18] mesh: make forwarding configurable
+Subject: [PATCH 16/16] mesh: make forwarding configurable
 
 Allow mesh_fwding to be specified in a mesh bss config, pass that
 to the driver (only nl80211 implemented for now) and announce
@@ -31,7 +31,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  };
  
  #define MAX_STA_COUNT 2007
-@@ -628,6 +629,7 @@ struct hostapd_bss_config {
+@@ -624,6 +625,7 @@ struct hostapd_bss_config {
  
  #define MESH_ENABLED BIT(0)
  	int mesh;
@@ -41,7 +41,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -1375,6 +1375,7 @@ struct wpa_driver_mesh_bss_params {
+@@ -1363,6 +1363,7 @@ struct wpa_driver_mesh_bss_params {
  #define WPA_DRIVER_MESH_CONF_FLAG_MAX_PEER_LINKS	0x00000004
  #define WPA_DRIVER_MESH_CONF_FLAG_HT_OP_MODE		0x00000008
  #define WPA_DRIVER_MESH_CONF_FLAG_RSSI_THRESHOLD	0x00000010
@@ -49,7 +49,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	/*
  	 * TODO: Other mesh configuration parameters would go here.
  	 * See NL80211_MESHCONF_* for all the mesh config parameters.
-@@ -1384,6 +1385,7 @@ struct wpa_driver_mesh_bss_params {
+@@ -1372,6 +1373,7 @@ struct wpa_driver_mesh_bss_params {
  	int peer_link_timeout;
  	int max_peer_links;
  	int rssi_threshold;
@@ -59,7 +59,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -9332,6 +9332,9 @@ static int nl80211_put_mesh_config(struc
+@@ -9228,6 +9228,9 @@ static int nl80211_put_mesh_config(struc
  	if (((params->flags & WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS) &&
  	     nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
  			params->auto_plinks)) ||
@@ -71,7 +71,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  			 params->max_peer_links)) ||
 --- a/wpa_supplicant/config.c
 +++ b/wpa_supplicant/config.c
-@@ -2228,6 +2228,7 @@ static const struct parse_data ssid_fiel
+@@ -2212,6 +2212,7 @@ static const struct parse_data ssid_fiel
  #ifdef CONFIG_MESH
  	{ INT_RANGE(mode, 0, 5) },
  	{ INT_RANGE(no_auto_peer, 0, 1) },
@@ -79,7 +79,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	{ INT_RANGE(mesh_rssi_threshold, -255, 1) },
  #else /* CONFIG_MESH */
  	{ INT_RANGE(mode, 0, 4) },
-@@ -2779,6 +2780,7 @@ void wpa_config_set_network_defaults(str
+@@ -2763,6 +2764,7 @@ void wpa_config_set_network_defaults(str
  	ssid->dot11MeshRetryTimeout = DEFAULT_MESH_RETRY_TIMEOUT;
  	ssid->dot11MeshConfirmTimeout = DEFAULT_MESH_CONFIRM_TIMEOUT;
  	ssid->dot11MeshHoldingTimeout = DEFAULT_MESH_HOLDING_TIMEOUT;
@@ -87,7 +87,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	ssid->mesh_rssi_threshold = DEFAULT_MESH_RSSI_THRESHOLD;
  #endif /* CONFIG_MESH */
  #ifdef CONFIG_HT_OVERRIDES
-@@ -3996,6 +3998,7 @@ struct wpa_config * wpa_config_alloc_emp
+@@ -3978,6 +3980,7 @@ struct wpa_config * wpa_config_alloc_emp
  	config->user_mpm = DEFAULT_USER_MPM;
  	config->max_peer_links = DEFAULT_MAX_PEER_LINKS;
  	config->mesh_max_inactivity = DEFAULT_MESH_MAX_INACTIVITY;
@@ -95,7 +95,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	config->dot11RSNASAERetransPeriod =
  		DEFAULT_DOT11_RSNA_SAE_RETRANS_PERIOD;
  	config->fast_reauth = DEFAULT_FAST_REAUTH;
-@@ -4618,6 +4621,7 @@ static const struct global_parse_data gl
+@@ -4600,6 +4603,7 @@ static const struct global_parse_data gl
  	{ INT(user_mpm), 0 },
  	{ INT_RANGE(max_peer_links, 0, 255), 0 },
  	{ INT(mesh_max_inactivity), 0 },
@@ -193,7 +193,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		wpa_msg(wpa_s, MSG_ERROR, "Failed to init mesh");
 --- a/wpa_supplicant/mesh_mpm.c
 +++ b/wpa_supplicant/mesh_mpm.c
-@@ -289,9 +289,9 @@ static void mesh_mpm_send_plink_action(s
+@@ -288,9 +288,9 @@ static void mesh_mpm_send_plink_action(s
  		info = (bss->num_plinks > 63 ? 63 : bss->num_plinks) << 1;
  		/* TODO: Add Connected to Mesh Gate/AS subfields */
  		wpabuf_put_u8(buf, info);

package/network/services/hostapd/patches/022-mesh-fix-crash-with-CONFIG_TAXONOMY-enabled.patch

@@ -0,0 +1,23 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 3 May 2018 12:34:31 +0200
+Subject: [PATCH] mesh: fix crash with CONFIG_TAXONOMY enabled
+
+wpa_s->ifmsh needs to be allocated using hostapd_alloc_iface() instead
+of a direct call to os_zalloc, otherwise the linked list for station
+taxonomy items remains uninitialized, leading to a crash on the first
+attempt to traverse that list
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/wpa_supplicant/mesh.c
++++ b/wpa_supplicant/mesh.c
+@@ -215,7 +215,7 @@ static int wpa_supplicant_mesh_init(stru
+ 		return 0;
+ 	}
+ 
+-	wpa_s->ifmsh = ifmsh = os_zalloc(sizeof(*wpa_s->ifmsh));
++	wpa_s->ifmsh = ifmsh = hostapd_alloc_iface();
+ 	if (!ifmsh)
+ 		return -ENOMEM;
+ 

package/network/services/hostapd/patches/031-mesh-add-VHT_CHANWIDTH_USE_HT-to-max_oper_chwidth.patch

@@ -17,7 +17,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
 
 --- a/wpa_supplicant/config.c
 +++ b/wpa_supplicant/config.c
-@@ -2818,6 +2818,7 @@ void wpa_config_set_network_defaults(str
+@@ -2802,6 +2802,7 @@ void wpa_config_set_network_defaults(str
  	ssid->mka_priority = DEFAULT_PRIO_NOT_KEY_SERVER;
  #endif /* CONFIG_MACSEC */
  	ssid->mac_addr = -1;
@@ -37,7 +37,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  	struct dl_list list;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2342,6 +2342,9 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2312,6 +2312,9 @@ void ibss_mesh_setup_freq(struct wpa_sup
  			vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
  			seg0 = 114;
  		}

package/network/services/hostapd/patches/032-mesh-implement-use-of-VHT20-config-in-mesh-mode.patch

@@ -33,7 +33,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
 
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2174,9 +2174,15 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2144,9 +2144,15 @@ void ibss_mesh_setup_freq(struct wpa_sup
  		if (!dfs_enabled)
  			return;
  
@@ -51,7 +51,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  #endif /* CONFIG_HT_OVERRIDES */
  
  	/* Check/setup HT40+/HT40- */
-@@ -2204,8 +2210,6 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2174,8 +2180,6 @@ void ibss_mesh_setup_freq(struct wpa_sup
  		if (!dfs_enabled)
  			return;
  
@@ -60,7 +60,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  	if (ht40 == -1) {
  		if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
  			return;
-@@ -2249,6 +2253,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2219,6 +2223,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
  		wpa_scan_results_free(scan_res);
  	}
  
@@ -68,7 +68,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  	wpa_printf(MSG_DEBUG,
  		   "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
  		   freq->channel, freq->sec_channel_offset);
-@@ -2344,7 +2349,10 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2314,7 +2319,10 @@ void ibss_mesh_setup_freq(struct wpa_sup
  		}
  	} else if (ssid->max_oper_chwidth == VHT_CHANWIDTH_USE_HT) {
  		chwidth = VHT_CHANWIDTH_USE_HT;

package/network/services/hostapd/patches/033-mesh-fix-parsing-of-max_oper_chwidth.patch

@@ -0,0 +1,45 @@
+From 444adf78eeb129e415d53fcb2fa2f05b6a69abdc Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Mon,  7 May 2018 15:24:29 +0200
+Subject: wpa_supplicant: Fix parsing of max_oper_chwidth
+
+The max_oper_chwidth is parsed in wpa_config_set as INT_RANGE (see
+ssid_fields). The actual parsing for INT_RANGE is done by
+wpa_config_parse_int which can only store the result as full integer.
+
+max_oper_chwidth is stored as u8 (a single byte) in wpa_ssid. This means
+that on little endian systems, the least significant byte of the parsed
+value are really stored in the max_oper_chwidth. But on big endian system,
+the only most significant byte is stored as max_oper_chwidth. This means
+that 0 is always stored because the provided range doesn't allow any other
+value for systems with multi-byte-wide integers.
+
+This also means that for common systems with 4-byte-wide integers, the
+remaining 3 bytes were written after the actual member of the struct. This
+should not have influenced the behavior of succeeding members because these
+bytes would have been part of the padding between the members on most
+systems.
+
+Increasing its size to a full int fixes the write operations outside of the
+member and allows to use the max_oper_chwidth setting on big endian
+systems.
+
+Fixes: 0f29bc68d18e ("IBSS/mesh: Add support for VHT80P80 configuration")
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+Forwarded: https://patchwork.ozlabs.org/patch/909751/
+---
+ wpa_supplicant/config_ssid.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/wpa_supplicant/config_ssid.h
++++ b/wpa_supplicant/config_ssid.h
+@@ -511,7 +511,7 @@ struct wpa_ssid {
+ 
+ 	int vht;
+ 
+-	u8 max_oper_chwidth;
++	int max_oper_chwidth;
+ 
+ 	unsigned int vht_center_freq1;
+ 	unsigned int vht_center_freq2;

package/network/services/hostapd/patches/040-FT-Fix-CONFIG_IEEE80211X-y-build-without-CONFIG_FILS.patch

@@ -1,33 +0,0 @@
-From f2973fa39d6109f0f34969e91551a98dc340d537 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Mon, 3 Dec 2018 12:00:26 +0200
-Subject: FT: Fix CONFIG_IEEE80211X=y build without CONFIG_FILS=y
-
-remove_ie() was defined within an ifdef CONFIG_FILS block while it is
-now needed even without CONFIG_FILS=y. Remove the CONFIG_FILS condition
-there.
-
-Fixes 8c41734e5de1 ("FT: Fix Reassociation Request IEs during FT protocol")
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- wpa_supplicant/sme.c | 2 --
- 1 file changed, 2 deletions(-)
-
---- a/wpa_supplicant/sme.c
-+++ b/wpa_supplicant/sme.c
-@@ -1386,7 +1386,6 @@ void sme_event_auth(struct wpa_supplican
- }
- 
- 
--#ifdef CONFIG_FILS
- #ifdef CONFIG_IEEE80211R
- static void remove_ie(u8 *buf, size_t *len, u8 eid)
- {
-@@ -1401,7 +1400,6 @@ static void remove_ie(u8 *buf, size_t *l
- 	}
- }
- #endif /* CONFIG_IEEE80211R */
--#endif /* CONFIG_FILS */
- 
- 
- void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,

package/network/services/hostapd/patches/051-wpa_supplicant-fix-race-condition-in-mesh-mpm-new-pe.patch

@@ -1,34 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 12 Feb 2019 14:22:43 +0100
-Subject: [PATCH v2] wpa_supplicant: fix race condition in mesh mpm new peer
- handling
-
-When wpa_supplicant receives another new peer event before the first one
-has been processed, it tries to add a station to the driver a second time
-(which fails) and then tears down the station entry until another event
-comes in.
-Fix this by only adding a station to the driver if it didn't exist already.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/wpa_supplicant/mesh_mpm.c
-+++ b/wpa_supplicant/mesh_mpm.c
-@@ -663,11 +663,12 @@ static struct sta_info * mesh_mpm_add_pe
- 	}
- 
- 	sta = ap_get_sta(data, addr);
--	if (!sta) {
--		sta = ap_sta_add(data, addr);
--		if (!sta)
--			return NULL;
--	}
-+	if (sta)
-+		return NULL;
-+
-+	sta = ap_sta_add(data, addr);
-+	if (!sta)
-+		return NULL;
- 
- 	/* Set WMM by default since Mesh STAs are QoS STAs */
- 	sta->flags |= WLAN_STA_WMM;

package/network/services/hostapd/patches/060-0001-EAP-pwd-Move-EC-group-initialization-to-earlier-step.patch

@@ -0,0 +1,104 @@
+From 2a5c291881fa819325d0287d0763776edfcb1943 Mon Sep 17 00:00:00 2001
+From: Dan Harkins <dharkins@lounge.org>
+Date: Fri, 25 May 2018 21:40:04 +0300
+Subject: [PATCH] EAP-pwd: Move EC group initialization to earlier step
+
+This is needed for adding support for salted passwords.
+
+Signed-off-by: Dan Harkins <dharkins@lounge.org>
+---
+ src/eap_common/eap_pwd_common.c | 32 +++++++++++++++++++++++---------
+ src/eap_common/eap_pwd_common.h |  1 +
+ src/eap_peer/eap_pwd.c          |  2 +-
+ src/eap_server/eap_server_pwd.c |  2 +-
+ 4 files changed, 26 insertions(+), 11 deletions(-)
+
+--- a/src/eap_common/eap_pwd_common.c
++++ b/src/eap_common/eap_pwd_common.c
+@@ -81,6 +81,27 @@ static int eap_pwd_kdf(const u8 *key, si
+ }
+ 
+ 
++EAP_PWD_group * get_eap_pwd_group(u16 num)
++{
++	EAP_PWD_group *grp;
++
++	grp = os_zalloc(sizeof(EAP_PWD_group));
++	if (!grp)
++		return NULL;
++	grp->group = crypto_ec_init(num);
++	if (!grp->group) {
++		wpa_printf(MSG_INFO, "EAP-pwd: unable to create EC group");
++		os_free(grp);
++		return NULL;
++	}
++
++	grp->group_num = num;
++	wpa_printf(MSG_INFO, "EAP-pwd: provisioned group %d", num);
++
++	return grp;
++}
++
++
+ /*
+  * compute a "random" secret point on an elliptic curve based
+  * on the password and identities.
+@@ -97,12 +118,8 @@ int compute_password_element(EAP_PWD_gro
+ 	size_t primebytelen, primebitlen;
+ 	struct crypto_bignum *x_candidate = NULL, *rnd = NULL, *cofactor = NULL;
+ 
+-	grp->pwe = NULL;
+-	grp->group = crypto_ec_init(num);
+-	if (!grp->group) {
+-		wpa_printf(MSG_INFO, "EAP-pwd: unable to create EC group");
+-		goto fail;
+-	}
++	if (grp->pwe)
++		return -1;
+ 
+ 	cofactor = crypto_bignum_init();
+ 	grp->pwe = crypto_ec_point_init(grp->group);
+@@ -234,11 +251,8 @@ int compute_password_element(EAP_PWD_gro
+ 		break;
+ 	}
+ 	wpa_printf(MSG_DEBUG, "EAP-pwd: found a PWE in %d tries", ctr);
+-	grp->group_num = num;
+ 	if (0) {
+  fail:
+-		crypto_ec_deinit(grp->group);
+-		grp->group = NULL;
+ 		crypto_ec_point_deinit(grp->pwe, 1);
+ 		grp->pwe = NULL;
+ 		ret = 1;
+--- a/src/eap_common/eap_pwd_common.h
++++ b/src/eap_common/eap_pwd_common.h
+@@ -50,6 +50,7 @@ struct eap_pwd_id {
+ } STRUCT_PACKED;
+ 
+ /* common routines */
++EAP_PWD_group * get_eap_pwd_group(u16 num);
+ int compute_password_element(EAP_PWD_group *grp, u16 num,
+ 			     const u8 *password, size_t password_len,
+ 			     const u8 *id_server, size_t id_server_len,
+--- a/src/eap_peer/eap_pwd.c
++++ b/src/eap_peer/eap_pwd.c
+@@ -265,7 +265,7 @@ eap_pwd_perform_id_exchange(struct eap_s
+ 	wpa_hexdump_ascii(MSG_INFO, "EAP-PWD (peer): server sent id of",
+ 			  data->id_server, data->id_server_len);
+ 
+-	data->grp = os_zalloc(sizeof(EAP_PWD_group));
++	data->grp = get_eap_pwd_group(data->group_num);
+ 	if (data->grp == NULL) {
+ 		wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for "
+ 			   "group");
+--- a/src/eap_server/eap_server_pwd.c
++++ b/src/eap_server/eap_server_pwd.c
+@@ -562,7 +562,7 @@ static void eap_pwd_process_id_resp(stru
+ 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-PWD (server): peer sent id of",
+ 			  data->id_peer, data->id_peer_len);
+ 
+-	data->grp = os_zalloc(sizeof(EAP_PWD_group));
++	data->grp = get_eap_pwd_group(data->group_num);
+ 	if (data->grp == NULL) {
+ 		wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for "
+ 			   "group");

package/network/services/hostapd/patches/060-0002-EAP-pwd-Mask-timing-of-PWE-derivation.patch

@@ -0,0 +1,247 @@
+From 22ac3dfebf7b25a3aae02f9b4f69025bb4173137 Mon Sep 17 00:00:00 2001
+From: Dan Harkins <dharkins@lounge.org>
+Date: Fri, 25 May 2018 21:40:04 +0300
+Subject: [PATCH] EAP-pwd: Mask timing of PWE derivation
+
+Run through the hunting-and-pecking loop 40 times to mask the time
+necessary to find PWE. The odds of PWE not being found in 40 loops is
+roughly 1 in 1 trillion.
+
+Signed-off-by: Dan Harkins <dharkins@lounge.org>
+---
+ src/eap_common/eap_pwd_common.c | 171 ++++++++++++++++++++++++--------
+ 1 file changed, 130 insertions(+), 41 deletions(-)
+
+--- a/src/eap_common/eap_pwd_common.c
++++ b/src/eap_common/eap_pwd_common.c
+@@ -112,18 +112,25 @@ int compute_password_element(EAP_PWD_gro
+ 			     const u8 *id_peer, size_t id_peer_len,
+ 			     const u8 *token)
+ {
++	struct crypto_bignum *qr = NULL, *qnr = NULL, *one = NULL;
++	struct crypto_bignum *tmp1 = NULL, *tmp2 = NULL, *pm1 = NULL;
+ 	struct crypto_hash *hash;
+ 	unsigned char pwe_digest[SHA256_MAC_LEN], *prfbuf = NULL, ctr;
+-	int is_odd, ret = 0;
++	int is_odd, ret = 0, check, found = 0;
+ 	size_t primebytelen, primebitlen;
+ 	struct crypto_bignum *x_candidate = NULL, *rnd = NULL, *cofactor = NULL;
++	const struct crypto_bignum *prime;
+ 
+ 	if (grp->pwe)
+ 		return -1;
+ 
++	prime = crypto_ec_get_prime(grp->group);
+ 	cofactor = crypto_bignum_init();
+ 	grp->pwe = crypto_ec_point_init(grp->group);
+-	if (!cofactor || !grp->pwe) {
++	tmp1 = crypto_bignum_init();
++	pm1 = crypto_bignum_init();
++	one = crypto_bignum_init_set((const u8 *) "\x01", 1);
++	if (!cofactor || !grp->pwe || !tmp1 || !pm1 || !one) {
+ 		wpa_printf(MSG_INFO, "EAP-pwd: unable to create bignums");
+ 		goto fail;
+ 	}
+@@ -140,15 +147,36 @@ int compute_password_element(EAP_PWD_gro
+ 			   "buffer");
+ 		goto fail;
+ 	}
++	if (crypto_bignum_sub(prime, one, pm1) < 0)
++		goto fail;
++
++	/* get a random quadratic residue and nonresidue */
++	while (!qr || !qnr) {
++		int res;
++
++		if (crypto_bignum_rand(tmp1, prime) < 0)
++			goto fail;
++		res = crypto_bignum_legendre(tmp1, prime);
++		if (!qr && res == 1) {
++			qr = tmp1;
++			tmp1 = crypto_bignum_init();
++		} else if (!qnr && res == -1) {
++			qnr = tmp1;
++			tmp1 = crypto_bignum_init();
++		}
++		if (!tmp1)
++			goto fail;
++	}
++
+ 	os_memset(prfbuf, 0, primebytelen);
+ 	ctr = 0;
+-	while (1) {
+-		if (ctr > 30) {
+-			wpa_printf(MSG_INFO, "EAP-pwd: unable to find random "
+-				   "point on curve for group %d, something's "
+-				   "fishy", num);
+-			goto fail;
+-		}
++
++	/*
++	 * Run through the hunting-and-pecking loop 40 times to mask the time
++	 * necessary to find PWE. The odds of PWE not being found in 40 loops is
++	 * roughly 1 in 1 trillion.
++	 */
++	while (ctr < 40) {
+ 		ctr++;
+ 
+ 		/*
+@@ -199,58 +227,113 @@ int compute_password_element(EAP_PWD_gro
+ 					 x_candidate) < 0)
+ 			goto fail;
+ 
+-		if (crypto_bignum_cmp(x_candidate,
+-				      crypto_ec_get_prime(grp->group)) >= 0)
++		if (crypto_bignum_cmp(x_candidate, prime) >= 0)
+ 			continue;
+ 
+ 		wpa_hexdump(MSG_DEBUG, "EAP-pwd: x_candidate",
+ 			    prfbuf, primebytelen);
+ 
+ 		/*
+-		 * need to unambiguously identify the solution, if there is
+-		 * one...
++		 * compute y^2 using the equation of the curve
++		 *
++		 *      y^2 = x^3 + ax + b
+ 		 */
+-		is_odd = crypto_bignum_is_odd(rnd);
++		tmp2 = crypto_ec_point_compute_y_sqr(grp->group, x_candidate);
++		if (!tmp2)
++			goto fail;
+ 
+ 		/*
+-		 * solve the quadratic equation, if it's not solvable then we
+-		 * don't have a point
++		 * mask tmp2 so doing legendre won't leak timing info
++		 *
++		 * tmp1 is a random number between 1 and p-1
+ 		 */
+-		if (crypto_ec_point_solve_y_coord(grp->group, grp->pwe,
+-						  x_candidate, is_odd) != 0) {
+-			wpa_printf(MSG_INFO, "EAP-pwd: Could not solve for y");
+-			continue;
+-		}
++		if (crypto_bignum_rand(tmp1, pm1) < 0 ||
++		    crypto_bignum_mulmod(tmp2, tmp1, prime, tmp2) < 0 ||
++		    crypto_bignum_mulmod(tmp2, tmp1, prime, tmp2) < 0)
++			goto fail;
++
+ 		/*
+-		 * If there's a solution to the equation then the point must be
+-		 * on the curve so why check again explicitly? OpenSSL code
+-		 * says this is required by X9.62. We're not X9.62 but it can't
+-		 * hurt just to be sure.
++		 * Now tmp2 (y^2) is masked, all values between 1 and p-1
++		 * are equally probable. Multiplying by r^2 does not change
++		 * whether or not tmp2 is a quadratic residue, just masks it.
++		 *
++		 * Flip a coin, multiply by the random quadratic residue or the
++		 * random quadratic nonresidue and record heads or tails.
+ 		 */
+-		if (!crypto_ec_point_is_on_curve(grp->group, grp->pwe)) {
+-			wpa_printf(MSG_INFO, "EAP-pwd: point is not on curve");
+-			continue;
++		if (crypto_bignum_is_odd(tmp1)) {
++			crypto_bignum_mulmod(tmp2, qr, prime, tmp2);
++			check = 1;
++		} else {
++			crypto_bignum_mulmod(tmp2, qnr, prime, tmp2);
++			check = -1;
+ 		}
+ 
+-		if (!crypto_bignum_is_one(cofactor)) {
+-			/* make sure the point is not in a small sub-group */
+-			if (crypto_ec_point_mul(grp->group, grp->pwe,
+-						cofactor, grp->pwe) != 0) {
+-				wpa_printf(MSG_INFO, "EAP-pwd: cannot "
+-					   "multiply generator by order");
++		/*
++		 * Now it's safe to do legendre, if check is 1 then it's
++		 * a straightforward test (multiplying by qr does not
++		 * change result), if check is -1 then it's the opposite test
++		 * (multiplying a qr by qnr would make a qnr).
++		 */
++		if (crypto_bignum_legendre(tmp2, prime) == check) {
++			if (found == 1)
++				continue;
++
++			/* need to unambiguously identify the solution */
++			is_odd = crypto_bignum_is_odd(rnd);
++
++			/*
++			 * We know x_candidate is a quadratic residue so set
++			 * it here.
++			 */
++			if (crypto_ec_point_solve_y_coord(grp->group, grp->pwe,
++							  x_candidate,
++							  is_odd) != 0) {
++				wpa_printf(MSG_INFO,
++					   "EAP-pwd: Could not solve for y");
+ 				continue;
+ 			}
+-			if (crypto_ec_point_is_at_infinity(grp->group,
+-							   grp->pwe)) {
+-				wpa_printf(MSG_INFO, "EAP-pwd: point is at "
+-					   "infinity");
++
++			/*
++			 * If there's a solution to the equation then the point
++			 * must be on the curve so why check again explicitly?
++			 * OpenSSL code says this is required by X9.62. We're
++			 * not X9.62 but it can't hurt just to be sure.
++			 */
++			if (!crypto_ec_point_is_on_curve(grp->group,
++							 grp->pwe)) {
++				wpa_printf(MSG_INFO,
++					   "EAP-pwd: point is not on curve");
+ 				continue;
+ 			}
++
++			if (!crypto_bignum_is_one(cofactor)) {
++				/* make sure the point is not in a small
++				 * sub-group */
++				if (crypto_ec_point_mul(grp->group, grp->pwe,
++							cofactor,
++							grp->pwe) != 0) {
++					wpa_printf(MSG_INFO,
++						   "EAP-pwd: cannot multiply generator by order");
++					continue;
++				}
++				if (crypto_ec_point_is_at_infinity(grp->group,
++								   grp->pwe)) {
++					wpa_printf(MSG_INFO,
++						   "EAP-pwd: point is at infinity");
++					continue;
++				}
++			}
++			wpa_printf(MSG_DEBUG,
++				   "EAP-pwd: found a PWE in %d tries", ctr);
++			found = 1;
+ 		}
+-		/* if we got here then we have a new generator. */
+-		break;
+ 	}
+-	wpa_printf(MSG_DEBUG, "EAP-pwd: found a PWE in %d tries", ctr);
++	if (found == 0) {
++		wpa_printf(MSG_INFO,
++			   "EAP-pwd: unable to find random point on curve for group %d, something's fishy",
++			   num);
++		goto fail;
++	}
+ 	if (0) {
+  fail:
+ 		crypto_ec_point_deinit(grp->pwe, 1);
+@@ -261,6 +344,12 @@ int compute_password_element(EAP_PWD_gro
+ 	crypto_bignum_deinit(cofactor, 1);
+ 	crypto_bignum_deinit(x_candidate, 1);
+ 	crypto_bignum_deinit(rnd, 1);
++	crypto_bignum_deinit(pm1, 0);
++	crypto_bignum_deinit(tmp1, 1);
++	crypto_bignum_deinit(tmp2, 1);
++	crypto_bignum_deinit(qr, 1);
++	crypto_bignum_deinit(qnr, 1);
++	crypto_bignum_deinit(one, 0);
+ 	os_free(prfbuf);
+ 
+ 	return ret;

package/network/services/hostapd/patches/061-0001-OpenSSL-Use-constant-time-operations-for-private-big.patch

@@ -0,0 +1,88 @@
+From d42c477cc794163a3757956bbffca5cea000923c Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Tue, 26 Feb 2019 11:43:03 +0200
+Subject: [PATCH 01/14] OpenSSL: Use constant time operations for private
+ bignums
+
+This helps in reducing measurable timing differences in operations
+involving private information. BoringSSL has removed BN_FLG_CONSTTIME
+and expects specific constant time functions to be called instead, so a
+bit different approach is needed depending on which library is used.
+
+The main operation that needs protection against side channel attacks is
+BN_mod_exp() that depends on private keys (the public key validation
+step in crypto_dh_derive_secret() is an exception that can use the
+faster version since it does not depend on private keys).
+
+crypto_bignum_div() is currently used only in SAE FFC case with not
+safe-prime groups and only with values that do not depend on private
+keys, so it is not critical to protect it.
+
+crypto_bignum_inverse() is currently used only in SAE FFC PWE
+derivation. The additional protection here is targeting only OpenSSL.
+BoringSSL may need conversion to using BN_mod_inverse_blinded().
+
+This is related to CVE-2019-9494 and CVE-2019-9495.
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/crypto/crypto_openssl.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/src/crypto/crypto_openssl.c
++++ b/src/crypto/crypto_openssl.c
+@@ -548,7 +548,8 @@ int crypto_mod_exp(const u8 *base, size_
+ 	    bn_result == NULL)
+ 		goto error;
+ 
+-	if (BN_mod_exp(bn_result, bn_base, bn_exp, bn_modulus, ctx) != 1)
++	if (BN_mod_exp_mont_consttime(bn_result, bn_base, bn_exp, bn_modulus,
++				      ctx, NULL) != 1)
+ 		goto error;
+ 
+ 	*result_len = BN_bn2bin(bn_result, result);
+@@ -1294,8 +1295,9 @@ int crypto_bignum_exptmod(const struct c
+ 	bnctx = BN_CTX_new();
+ 	if (bnctx == NULL)
+ 		return -1;
+-	res = BN_mod_exp((BIGNUM *) d, (const BIGNUM *) a, (const BIGNUM *) b,
+-			 (const BIGNUM *) c, bnctx);
++	res = BN_mod_exp_mont_consttime((BIGNUM *) d, (const BIGNUM *) a,
++					(const BIGNUM *) b, (const BIGNUM *) c,
++					bnctx, NULL);
+ 	BN_CTX_free(bnctx);
+ 
+ 	return res ? 0 : -1;
+@@ -1314,6 +1316,11 @@ int crypto_bignum_inverse(const struct c
+ 	bnctx = BN_CTX_new();
+ 	if (bnctx == NULL)
+ 		return -1;
++#ifdef OPENSSL_IS_BORINGSSL
++	/* TODO: use BN_mod_inverse_blinded() ? */
++#else /* OPENSSL_IS_BORINGSSL */
++	BN_set_flags((BIGNUM *) a, BN_FLG_CONSTTIME);
++#endif /* OPENSSL_IS_BORINGSSL */
+ 	res = BN_mod_inverse((BIGNUM *) c, (const BIGNUM *) a,
+ 			     (const BIGNUM *) b, bnctx);
+ 	BN_CTX_free(bnctx);
+@@ -1347,6 +1354,9 @@ int crypto_bignum_div(const struct crypt
+ 	bnctx = BN_CTX_new();
+ 	if (bnctx == NULL)
+ 		return -1;
++#ifndef OPENSSL_IS_BORINGSSL
++	BN_set_flags((BIGNUM *) a, BN_FLG_CONSTTIME);
++#endif /* OPENSSL_IS_BORINGSSL */
+ 	res = BN_div((BIGNUM *) c, NULL, (const BIGNUM *) a,
+ 		     (const BIGNUM *) b, bnctx);
+ 	BN_CTX_free(bnctx);
+@@ -1438,8 +1448,8 @@ int crypto_bignum_legendre(const struct
+ 	    /* exp = (p-1) / 2 */
+ 	    !BN_sub(exp, (const BIGNUM *) p, BN_value_one()) ||
+ 	    !BN_rshift1(exp, exp) ||
+-	    !BN_mod_exp(tmp, (const BIGNUM *) a, exp, (const BIGNUM *) p,
+-			bnctx))
++	    !BN_mod_exp_mont_consttime(tmp, (const BIGNUM *) a, exp,
++				       (const BIGNUM *) p, bnctx, NULL))
+ 		goto fail;
+ 
+ 	if (BN_is_word(tmp, 1))

package/network/services/hostapd/patches/061-0002-Add-helper-functions-for-constant-time-operations.patch

@@ -0,0 +1,212 @@
+From 6e34f618d37ddbb5854c42e2ad4fca83492fa7b7 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Wed, 27 Feb 2019 18:38:30 +0200
+Subject: [PATCH 02/14] Add helper functions for constant time operations
+
+These functions can be used to help implement constant time operations
+for various cryptographic operations that must minimize externally
+observable differences in processing (both in timing and also in
+internal cache use, etc.).
+
+This is related to CVE-2019-9494 and CVE-2019-9495.
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/utils/const_time.h | 191 +++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 191 insertions(+)
+ create mode 100644 src/utils/const_time.h
+
+--- /dev/null
++++ b/src/utils/const_time.h
+@@ -0,0 +1,191 @@
++/*
++ * Helper functions for constant time operations
++ * Copyright (c) 2019, The Linux Foundation
++ *
++ * This software may be distributed under the terms of the BSD license.
++ * See README for more details.
++ *
++ * These helper functions can be used to implement logic that needs to minimize
++ * externally visible differences in execution path by avoiding use of branches,
++ * avoiding early termination or other time differences, and forcing same memory
++ * access pattern regardless of values.
++ */
++
++#ifndef CONST_TIME_H
++#define CONST_TIME_H
++
++
++#if defined(__clang__)
++#define NO_UBSAN_UINT_OVERFLOW \
++	__attribute__((no_sanitize("unsigned-integer-overflow")))
++#else
++#define NO_UBSAN_UINT_OVERFLOW
++#endif
++
++
++/**
++ * const_time_fill_msb - Fill all bits with MSB value
++ * @val: Input value
++ * Returns: Value with all the bits set to the MSB of the input val
++ */
++static inline unsigned int const_time_fill_msb(unsigned int val)
++{
++	/* Move the MSB to LSB and multiple by -1 to fill in all bits. */
++	return (val >> (sizeof(val) * 8 - 1)) * ~0U;
++}
++
++
++/* Returns: -1 if val is zero; 0 if val is not zero */
++static inline unsigned int const_time_is_zero(unsigned int val)
++	NO_UBSAN_UINT_OVERFLOW
++{
++	/* Set MSB to 1 for 0 and fill rest of bits with the MSB value */
++	return const_time_fill_msb(~val & (val - 1));
++}
++
++
++/* Returns: -1 if a == b; 0 if a != b */
++static inline unsigned int const_time_eq(unsigned int a, unsigned int b)
++{
++	return const_time_is_zero(a ^ b);
++}
++
++
++/* Returns: -1 if a == b; 0 if a != b */
++static inline u8 const_time_eq_u8(unsigned int a, unsigned int b)
++{
++	return (u8) const_time_eq(a, b);
++}
++
++
++/**
++ * const_time_eq_bin - Constant time memory comparison
++ * @a: First buffer to compare
++ * @b: Second buffer to compare
++ * @len: Number of octets to compare
++ * Returns: -1 if buffers are equal, 0 if not
++ *
++ * This function is meant for comparing passwords or hash values where
++ * difference in execution time or memory access pattern could provide external
++ * observer information about the location of the difference in the memory
++ * buffers. The return value does not behave like memcmp(), i.e.,
++ * const_time_eq_bin() cannot be used to sort items into a defined order. Unlike
++ * memcmp(), the execution time of const_time_eq_bin() does not depend on the
++ * contents of the compared memory buffers, but only on the total compared
++ * length.
++ */
++static inline unsigned int const_time_eq_bin(const void *a, const void *b,
++					     size_t len)
++{
++	const u8 *aa = a;
++	const u8 *bb = b;
++	size_t i;
++	u8 res = 0;
++
++	for (i = 0; i < len; i++)
++		res |= aa[i] ^ bb[i];
++
++	return const_time_is_zero(res);
++}
++
++
++/**
++ * const_time_select - Constant time unsigned int selection
++ * @mask: 0 (false) or -1 (true) to identify which value to select
++ * @true_val: Value to select for the true case
++ * @false_val: Value to select for the false case
++ * Returns: true_val if mask == -1, false_val if mask == 0
++ */
++static inline unsigned int const_time_select(unsigned int mask,
++					     unsigned int true_val,
++					     unsigned int false_val)
++{
++	return (mask & true_val) | (~mask & false_val);
++}
++
++
++/**
++ * const_time_select_int - Constant time int selection
++ * @mask: 0 (false) or -1 (true) to identify which value to select
++ * @true_val: Value to select for the true case
++ * @false_val: Value to select for the false case
++ * Returns: true_val if mask == -1, false_val if mask == 0
++ */
++static inline int const_time_select_int(unsigned int mask, int true_val,
++					int false_val)
++{
++	return (int) const_time_select(mask, (unsigned int) true_val,
++				       (unsigned int) false_val);
++}
++
++
++/**
++ * const_time_select_u8 - Constant time u8 selection
++ * @mask: 0 (false) or -1 (true) to identify which value to select
++ * @true_val: Value to select for the true case
++ * @false_val: Value to select for the false case
++ * Returns: true_val if mask == -1, false_val if mask == 0
++ */
++static inline u8 const_time_select_u8(u8 mask, u8 true_val, u8 false_val)
++{
++	return (u8) const_time_select(mask, true_val, false_val);
++}
++
++
++/**
++ * const_time_select_s8 - Constant time s8 selection
++ * @mask: 0 (false) or -1 (true) to identify which value to select
++ * @true_val: Value to select for the true case
++ * @false_val: Value to select for the false case
++ * Returns: true_val if mask == -1, false_val if mask == 0
++ */
++static inline s8 const_time_select_s8(u8 mask, s8 true_val, s8 false_val)
++{
++	return (s8) const_time_select(mask, (unsigned int) true_val,
++				      (unsigned int) false_val);
++}
++
++
++/**
++ * const_time_select_bin - Constant time binary buffer selection copy
++ * @mask: 0 (false) or -1 (true) to identify which value to copy
++ * @true_val: Buffer to copy for the true case
++ * @false_val: Buffer to copy for the false case
++ * @len: Number of octets to copy
++ * @dst: Destination buffer for the copy
++ *
++ * This function copies the specified buffer into the destination buffer using
++ * operations with identical memory access pattern regardless of which buffer
++ * is being copied.
++ */
++static inline void const_time_select_bin(u8 mask, const u8 *true_val,
++					 const u8 *false_val, size_t len,
++					 u8 *dst)
++{
++	size_t i;
++
++	for (i = 0; i < len; i++)
++		dst[i] = const_time_select_u8(mask, true_val[i], false_val[i]);
++}
++
++
++static inline int const_time_memcmp(const void *a, const void *b, size_t len)
++{
++	const u8 *aa = a;
++	const u8 *bb = b;
++	int diff, res = 0;
++	unsigned int mask;
++
++	if (len == 0)
++		return 0;
++	do {
++		len--;
++		diff = (int) aa[len] - (int) bb[len];
++		mask = const_time_is_zero((unsigned int) diff);
++		res = const_time_select_int(mask, res, diff);
++	} while (len);
++
++	return res;
++}
++
++#endif /* CONST_TIME_H */

package/network/services/hostapd/patches/061-0003-OpenSSL-Use-constant-time-selection-for-crypto_bignu.patch

@@ -0,0 +1,55 @@
+From c93461c1d98f52681717a088776ab32fd97872b0 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Fri, 8 Mar 2019 00:24:12 +0200
+Subject: [PATCH 03/14] OpenSSL: Use constant time selection for
+ crypto_bignum_legendre()
+
+Get rid of the branches that depend on the result of the Legendre
+operation. This is needed to avoid leaking information about different
+temporary results in blinding mechanisms.
+
+This is related to CVE-2019-9494 and CVE-2019-9495.
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/crypto/crypto_openssl.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/src/crypto/crypto_openssl.c
++++ b/src/crypto/crypto_openssl.c
+@@ -24,6 +24,7 @@
+ #endif /* CONFIG_ECC */
+ 
+ #include "common.h"
++#include "utils/const_time.h"
+ #include "wpabuf.h"
+ #include "dh_group5.h"
+ #include "sha1.h"
+@@ -1434,6 +1435,7 @@ int crypto_bignum_legendre(const struct
+ 	BN_CTX *bnctx;
+ 	BIGNUM *exp = NULL, *tmp = NULL;
+ 	int res = -2;
++	unsigned int mask;
+ 
+ 	if (TEST_FAIL())
+ 		return -2;
+@@ -1452,12 +1454,13 @@ int crypto_bignum_legendre(const struct
+ 				       (const BIGNUM *) p, bnctx, NULL))
+ 		goto fail;
+ 
+-	if (BN_is_word(tmp, 1))
+-		res = 1;
+-	else if (BN_is_zero(tmp))
+-		res = 0;
+-	else
+-		res = -1;
++	/* Return 1 if tmp == 1, 0 if tmp == 0, or -1 otherwise. Need to use
++	 * constant time selection to avoid branches here. */
++	res = -1;
++	mask = const_time_eq(BN_is_word(tmp, 1), 1);
++	res = const_time_select_int(mask, 1, res);
++	mask = const_time_eq(BN_is_zero(tmp), 1);
++	res = const_time_select_int(mask, 0, res);
+ 
+ fail:
+ 	BN_clear_free(tmp);

package/network/services/hostapd/patches/061-0005-SAE-Minimize-timing-differences-in-PWE-derivation.patch

@@ -0,0 +1,242 @@
+From 6513db3e96c43c2e36805cf5ead349765d18eaf7 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Tue, 26 Feb 2019 13:05:09 +0200
+Subject: [PATCH 05/14] SAE: Minimize timing differences in PWE derivation
+
+The QR test result can provide information about the password to an
+attacker, so try to minimize differences in how the
+sae_test_pwd_seed_ecc() result is used. (CVE-2019-9494)
+
+Use heap memory for the dummy password to allow the same password length
+to be used even with long passwords.
+
+Use constant time selection functions to track the real vs. dummy
+variables so that the exact same operations can be performed for both QR
+test results.
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/common/sae.c | 106 ++++++++++++++++++++++++++++++-------------------------
+ 1 file changed, 57 insertions(+), 49 deletions(-)
+
+--- a/src/common/sae.c
++++ b/src/common/sae.c
+@@ -9,6 +9,7 @@
+ #include "includes.h"
+ 
+ #include "common.h"
++#include "utils/const_time.h"
+ #include "crypto/crypto.h"
+ #include "crypto/sha256.h"
+ #include "crypto/random.h"
+@@ -269,15 +270,12 @@ static int sae_test_pwd_seed_ecc(struct
+ 				 const u8 *prime,
+ 				 const struct crypto_bignum *qr,
+ 				 const struct crypto_bignum *qnr,
+-				 struct crypto_bignum **ret_x_cand)
++				 u8 *pwd_value)
+ {
+-	u8 pwd_value[SAE_MAX_ECC_PRIME_LEN];
+ 	struct crypto_bignum *y_sqr, *x_cand;
+ 	int res;
+ 	size_t bits;
+ 
+-	*ret_x_cand = NULL;
+-
+ 	wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN);
+ 
+ 	/* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */
+@@ -286,7 +284,7 @@ static int sae_test_pwd_seed_ecc(struct
+ 			    prime, sae->tmp->prime_len, pwd_value, bits) < 0)
+ 		return -1;
+ 	if (bits % 8)
+-		buf_shift_right(pwd_value, sizeof(pwd_value), 8 - bits % 8);
++		buf_shift_right(pwd_value, sae->tmp->prime_len, 8 - bits % 8);
+ 	wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value",
+ 			pwd_value, sae->tmp->prime_len);
+ 
+@@ -297,20 +295,13 @@ static int sae_test_pwd_seed_ecc(struct
+ 	if (!x_cand)
+ 		return -1;
+ 	y_sqr = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x_cand);
+-	if (!y_sqr) {
+-		crypto_bignum_deinit(x_cand, 1);
++	crypto_bignum_deinit(x_cand, 1);
++	if (!y_sqr)
+ 		return -1;
+-	}
+ 
+ 	res = is_quadratic_residue_blind(sae, prime, bits, qr, qnr, y_sqr);
+ 	crypto_bignum_deinit(y_sqr, 1);
+-	if (res <= 0) {
+-		crypto_bignum_deinit(x_cand, 1);
+-		return res;
+-	}
+-
+-	*ret_x_cand = x_cand;
+-	return 1;
++	return res;
+ }
+ 
+ 
+@@ -431,25 +422,30 @@ static int sae_derive_pwe_ecc(struct sae
+ 	const u8 *addr[3];
+ 	size_t len[3];
+ 	size_t num_elem;
+-	u8 dummy_password[32];
+-	size_t dummy_password_len;
++	u8 *dummy_password, *tmp_password;
+ 	int pwd_seed_odd = 0;
+ 	u8 prime[SAE_MAX_ECC_PRIME_LEN];
+ 	size_t prime_len;
+-	struct crypto_bignum *x = NULL, *qr, *qnr;
++	struct crypto_bignum *x = NULL, *qr = NULL, *qnr = NULL;
++	u8 x_bin[SAE_MAX_ECC_PRIME_LEN];
++	u8 x_cand_bin[SAE_MAX_ECC_PRIME_LEN];
+ 	size_t bits;
+-	int res;
+-
+-	dummy_password_len = password_len;
+-	if (dummy_password_len > sizeof(dummy_password))
+-		dummy_password_len = sizeof(dummy_password);
+-	if (random_get_bytes(dummy_password, dummy_password_len) < 0)
+-		return -1;
++	int res = -1;
++	u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_*
++		       * mask */
++
++	os_memset(x_bin, 0, sizeof(x_bin));
++
++	dummy_password = os_malloc(password_len);
++	tmp_password = os_malloc(password_len);
++	if (!dummy_password || !tmp_password ||
++	    random_get_bytes(dummy_password, password_len) < 0)
++		goto fail;
+ 
+ 	prime_len = sae->tmp->prime_len;
+ 	if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime),
+ 				 prime_len) < 0)
+-		return -1;
++		goto fail;
+ 	bits = crypto_ec_prime_len_bits(sae->tmp->ec);
+ 
+ 	/*
+@@ -458,7 +454,7 @@ static int sae_derive_pwe_ecc(struct sae
+ 	 */
+ 	if (get_random_qr_qnr(prime, prime_len, sae->tmp->prime, bits,
+ 			      &qr, &qnr) < 0)
+-		return -1;
++		goto fail;
+ 
+ 	wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
+ 			      password, password_len);
+@@ -474,7 +470,7 @@ static int sae_derive_pwe_ecc(struct sae
+ 	 */
+ 	sae_pwd_seed_key(addr1, addr2, addrs);
+ 
+-	addr[0] = password;
++	addr[0] = tmp_password;
+ 	len[0] = password_len;
+ 	num_elem = 1;
+ 	if (identifier) {
+@@ -491,9 +487,8 @@ static int sae_derive_pwe_ecc(struct sae
+ 	 * attacks that attempt to determine the number of iterations required
+ 	 * in the loop.
+ 	 */
+-	for (counter = 1; counter <= k || !x; counter++) {
++	for (counter = 1; counter <= k || !found; counter++) {
+ 		u8 pwd_seed[SHA256_MAC_LEN];
+-		struct crypto_bignum *x_cand;
+ 
+ 		if (counter > 200) {
+ 			/* This should not happen in practice */
+@@ -501,40 +496,49 @@ static int sae_derive_pwe_ecc(struct sae
+ 			break;
+ 		}
+ 
+-		wpa_printf(MSG_DEBUG, "SAE: counter = %u", counter);
++		wpa_printf(MSG_DEBUG, "SAE: counter = %03u", counter);
++		const_time_select_bin(found, dummy_password, password,
++				      password_len, tmp_password);
+ 		if (hmac_sha256_vector(addrs, sizeof(addrs), num_elem,
+ 				       addr, len, pwd_seed) < 0)
+ 			break;
+ 
+ 		res = sae_test_pwd_seed_ecc(sae, pwd_seed,
+-					    prime, qr, qnr, &x_cand);
++					    prime, qr, qnr, x_cand_bin);
++		const_time_select_bin(found, x_bin, x_cand_bin, prime_len,
++				      x_bin);
++		pwd_seed_odd = const_time_select_u8(
++			found, pwd_seed_odd,
++			pwd_seed[SHA256_MAC_LEN - 1] & 0x01);
++		os_memset(pwd_seed, 0, sizeof(pwd_seed));
+ 		if (res < 0)
+ 			goto fail;
+-		if (res > 0 && !x) {
+-			wpa_printf(MSG_DEBUG,
+-				   "SAE: Selected pwd-seed with counter %u",
+-				   counter);
+-			x = x_cand;
+-			pwd_seed_odd = pwd_seed[SHA256_MAC_LEN - 1] & 0x01;
+-			os_memset(pwd_seed, 0, sizeof(pwd_seed));
+-
+-			/*
+-			 * Use a dummy password for the following rounds, if
+-			 * any.
+-			 */
+-			addr[0] = dummy_password;
+-			len[0] = dummy_password_len;
+-		} else if (res > 0) {
+-			crypto_bignum_deinit(x_cand, 1);
+-		}
++		/* Need to minimize differences in handling res == 0 and 1 here
++		 * to avoid differences in timing and instruction cache access,
++		 * so use const_time_select_*() to make local copies of the
++		 * values based on whether this loop iteration was the one that
++		 * found the pwd-seed/x. */
++
++		/* found is 0 or 0xff here and res is 0 or 1. Bitwise OR of them
++		 * (with res converted to 0/0xff) handles this in constant time.
++		 */
++		found |= res * 0xff;
++		wpa_printf(MSG_DEBUG, "SAE: pwd-seed result %d found=0x%02x",
++			   res, found);
+ 	}
+ 
+-	if (!x) {
++	if (!found) {
+ 		wpa_printf(MSG_DEBUG, "SAE: Could not generate PWE");
+ 		res = -1;
+ 		goto fail;
+ 	}
+ 
++	x = crypto_bignum_init_set(x_bin, prime_len);
++	if (!x) {
++		res = -1;
++		goto fail;
++	}
++
+ 	if (!sae->tmp->pwe_ecc)
+ 		sae->tmp->pwe_ecc = crypto_ec_point_init(sae->tmp->ec);
+ 	if (!sae->tmp->pwe_ecc)
+@@ -543,7 +547,6 @@ static int sae_derive_pwe_ecc(struct sae
+ 		res = crypto_ec_point_solve_y_coord(sae->tmp->ec,
+ 						    sae->tmp->pwe_ecc, x,
+ 						    pwd_seed_odd);
+-	crypto_bignum_deinit(x, 1);
+ 	if (res < 0) {
+ 		/*
+ 		 * This should not happen since we already checked that there
+@@ -555,6 +558,11 @@ static int sae_derive_pwe_ecc(struct sae
+ fail:
+ 	crypto_bignum_deinit(qr, 0);
+ 	crypto_bignum_deinit(qnr, 0);
++	os_free(dummy_password);
++	bin_clear_free(tmp_password, password_len);
++	crypto_bignum_deinit(x, 1);
++	os_memset(x_bin, 0, sizeof(x_bin));
++	os_memset(x_cand_bin, 0, sizeof(x_cand_bin));
+ 
+ 	return res;
+ }

package/network/services/hostapd/patches/061-0006-SAE-Avoid-branches-in-is_quadratic_residue_blind.patch

@@ -0,0 +1,139 @@
+From 362704dda04507e7ebb8035122e83d9f0ae7c320 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Tue, 26 Feb 2019 19:34:38 +0200
+Subject: [PATCH 06/14] SAE: Avoid branches in is_quadratic_residue_blind()
+
+Make the non-failure path in the function proceed without branches based
+on r_odd and in constant time to minimize risk of observable differences
+in timing or cache use. (CVE-2019-9494)
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/common/sae.c | 64 ++++++++++++++++++++++++++++++++------------------------
+ 1 file changed, 37 insertions(+), 27 deletions(-)
+
+--- a/src/common/sae.c
++++ b/src/common/sae.c
+@@ -209,12 +209,14 @@ get_rand_1_to_p_1(const u8 *prime, size_
+ 
+ static int is_quadratic_residue_blind(struct sae_data *sae,
+ 				      const u8 *prime, size_t bits,
+-				      const struct crypto_bignum *qr,
+-				      const struct crypto_bignum *qnr,
++				      const u8 *qr, const u8 *qnr,
+ 				      const struct crypto_bignum *y_sqr)
+ {
+-	struct crypto_bignum *r, *num;
++	struct crypto_bignum *r, *num, *qr_or_qnr = NULL;
+ 	int r_odd, check, res = -1;
++	u8 qr_or_qnr_bin[SAE_MAX_ECC_PRIME_LEN];
++	size_t prime_len = sae->tmp->prime_len;
++	unsigned int mask;
+ 
+ 	/*
+ 	 * Use the blinding technique to mask y_sqr while determining
+@@ -225,7 +227,7 @@ static int is_quadratic_residue_blind(st
+ 	 * r = a random number between 1 and p-1, inclusive
+ 	 * num = (v * r * r) modulo p
+ 	 */
+-	r = get_rand_1_to_p_1(prime, sae->tmp->prime_len, bits, &r_odd);
++	r = get_rand_1_to_p_1(prime, prime_len, bits, &r_odd);
+ 	if (!r)
+ 		return -1;
+ 
+@@ -235,41 +237,45 @@ static int is_quadratic_residue_blind(st
+ 	    crypto_bignum_mulmod(num, r, sae->tmp->prime, num) < 0)
+ 		goto fail;
+ 
+-	if (r_odd) {
+-		/*
+-		 * num = (num * qr) module p
+-		 * LGR(num, p) = 1 ==> quadratic residue
+-		 */
+-		if (crypto_bignum_mulmod(num, qr, sae->tmp->prime, num) < 0)
+-			goto fail;
+-		check = 1;
+-	} else {
+-		/*
+-		 * num = (num * qnr) module p
+-		 * LGR(num, p) = -1 ==> quadratic residue
+-		 */
+-		if (crypto_bignum_mulmod(num, qnr, sae->tmp->prime, num) < 0)
+-			goto fail;
+-		check = -1;
+-	}
++	/*
++	 * Need to minimize differences in handling different cases, so try to
++	 * avoid branches and timing differences.
++	 *
++	 * If r_odd:
++	 * num = (num * qr) module p
++	 * LGR(num, p) = 1 ==> quadratic residue
++	 * else:
++	 * num = (num * qnr) module p
++	 * LGR(num, p) = -1 ==> quadratic residue
++	 */
++	mask = const_time_is_zero(r_odd);
++	const_time_select_bin(mask, qnr, qr, prime_len, qr_or_qnr_bin);
++	qr_or_qnr = crypto_bignum_init_set(qr_or_qnr_bin, prime_len);
++	if (!qr_or_qnr ||
++	    crypto_bignum_mulmod(num, qr_or_qnr, sae->tmp->prime, num) < 0)
++		goto fail;
++	/* r_odd is 0 or 1; branchless version of check = r_odd ? 1 : -1, */
++	check = const_time_select_int(mask, -1, 1);
+ 
+ 	res = crypto_bignum_legendre(num, sae->tmp->prime);
+ 	if (res == -2) {
+ 		res = -1;
+ 		goto fail;
+ 	}
+-	res = res == check;
++	/* branchless version of res = res == check
++	 * (res is -1, 0, or 1; check is -1 or 1) */
++	mask = const_time_eq(res, check);
++	res = const_time_select_int(mask, 1, 0);
+ fail:
+ 	crypto_bignum_deinit(num, 1);
+ 	crypto_bignum_deinit(r, 1);
++	crypto_bignum_deinit(qr_or_qnr, 1);
+ 	return res;
+ }
+ 
+ 
+ static int sae_test_pwd_seed_ecc(struct sae_data *sae, const u8 *pwd_seed,
+-				 const u8 *prime,
+-				 const struct crypto_bignum *qr,
+-				 const struct crypto_bignum *qnr,
++				 const u8 *prime, const u8 *qr, const u8 *qnr,
+ 				 u8 *pwd_value)
+ {
+ 	struct crypto_bignum *y_sqr, *x_cand;
+@@ -429,6 +435,8 @@ static int sae_derive_pwe_ecc(struct sae
+ 	struct crypto_bignum *x = NULL, *qr = NULL, *qnr = NULL;
+ 	u8 x_bin[SAE_MAX_ECC_PRIME_LEN];
+ 	u8 x_cand_bin[SAE_MAX_ECC_PRIME_LEN];
++	u8 qr_bin[SAE_MAX_ECC_PRIME_LEN];
++	u8 qnr_bin[SAE_MAX_ECC_PRIME_LEN];
+ 	size_t bits;
+ 	int res = -1;
+ 	u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_*
+@@ -453,7 +461,9 @@ static int sae_derive_pwe_ecc(struct sae
+ 	 * (qnr) modulo p for blinding purposes during the loop.
+ 	 */
+ 	if (get_random_qr_qnr(prime, prime_len, sae->tmp->prime, bits,
+-			      &qr, &qnr) < 0)
++			      &qr, &qnr) < 0 ||
++	    crypto_bignum_to_bin(qr, qr_bin, sizeof(qr_bin), prime_len) < 0 ||
++	    crypto_bignum_to_bin(qnr, qnr_bin, sizeof(qnr_bin), prime_len) < 0)
+ 		goto fail;
+ 
+ 	wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
+@@ -504,7 +514,7 @@ static int sae_derive_pwe_ecc(struct sae
+ 			break;
+ 
+ 		res = sae_test_pwd_seed_ecc(sae, pwd_seed,
+-					    prime, qr, qnr, x_cand_bin);
++					    prime, qr_bin, qnr_bin, x_cand_bin);
+ 		const_time_select_bin(found, x_bin, x_cand_bin, prime_len,
+ 				      x_bin);
+ 		pwd_seed_odd = const_time_select_u8(

package/network/services/hostapd/patches/061-0007-SAE-Mask-timing-of-MODP-groups-22-23-24.patch

@@ -0,0 +1,113 @@
+From 90839597cc4016b33f00055b12d59174c62770a3 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Sat, 2 Mar 2019 12:24:09 +0200
+Subject: [PATCH 07/14] SAE: Mask timing of MODP groups 22, 23, 24
+
+These groups have significant probability of coming up with pwd-value
+that is equal or greater than the prime and as such, need for going
+through the PWE derivation loop multiple times. This can result in
+sufficient timing different to allow an external observer to determine
+how many rounds are needed and that can leak information about the used
+password.
+
+Force at least 40 loop rounds for these MODP groups similarly to the ECC
+group design to mask timing. This behavior is not described in IEEE Std
+802.11-2016 for SAE, but it does not result in different values (i.e.,
+only different timing), so such implementation specific countermeasures
+can be done without breaking interoperability with other implementation.
+
+Note: These MODP groups 22, 23, and 24 are not considered sufficiently
+strong to be used with SAE (or more or less anything else). As such,
+they should never be enabled in runtime configuration for any production
+use cases. These changes to introduce additional protection to mask
+timing is only for completeness of implementation and not an indication
+that these groups should be used.
+
+This is related to CVE-2019-9494.
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/common/sae.c | 38 ++++++++++++++++++++++++++++----------
+ 1 file changed, 28 insertions(+), 10 deletions(-)
+
+--- a/src/common/sae.c
++++ b/src/common/sae.c
+@@ -578,22 +578,27 @@ fail:
+ }
+ 
+ 
++static int sae_modp_group_require_masking(int group)
++{
++	/* Groups for which pwd-value is likely to be >= p frequently */
++	return group == 22 || group == 23 || group == 24;
++}
++
++
+ static int sae_derive_pwe_ffc(struct sae_data *sae, const u8 *addr1,
+ 			      const u8 *addr2, const u8 *password,
+ 			      size_t password_len, const char *identifier)
+ {
+-	u8 counter;
++	u8 counter, k;
+ 	u8 addrs[2 * ETH_ALEN];
+ 	const u8 *addr[3];
+ 	size_t len[3];
+ 	size_t num_elem;
+ 	int found = 0;
++	struct crypto_bignum *pwe = NULL;
+ 
+-	if (sae->tmp->pwe_ffc == NULL) {
+-		sae->tmp->pwe_ffc = crypto_bignum_init();
+-		if (sae->tmp->pwe_ffc == NULL)
+-			return -1;
+-	}
++	crypto_bignum_deinit(sae->tmp->pwe_ffc, 1);
++	sae->tmp->pwe_ffc = NULL;
+ 
+ 	wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
+ 			      password, password_len);
+@@ -617,7 +622,9 @@ static int sae_derive_pwe_ffc(struct sae
+ 	len[num_elem] = sizeof(counter);
+ 	num_elem++;
+ 
+-	for (counter = 1; !found; counter++) {
++	k = sae_modp_group_require_masking(sae->group) ? 40 : 1;
++
++	for (counter = 1; counter <= k || !found; counter++) {
+ 		u8 pwd_seed[SHA256_MAC_LEN];
+ 		int res;
+ 
+@@ -627,19 +634,30 @@ static int sae_derive_pwe_ffc(struct sae
+ 			break;
+ 		}
+ 
+-		wpa_printf(MSG_DEBUG, "SAE: counter = %u", counter);
++		wpa_printf(MSG_DEBUG, "SAE: counter = %02u", counter);
+ 		if (hmac_sha256_vector(addrs, sizeof(addrs), num_elem,
+ 				       addr, len, pwd_seed) < 0)
+ 			break;
+-		res = sae_test_pwd_seed_ffc(sae, pwd_seed, sae->tmp->pwe_ffc);
++		if (!pwe) {
++			pwe = crypto_bignum_init();
++			if (!pwe)
++				break;
++		}
++		res = sae_test_pwd_seed_ffc(sae, pwd_seed, pwe);
+ 		if (res < 0)
+ 			break;
+ 		if (res > 0) {
+-			wpa_printf(MSG_DEBUG, "SAE: Use this PWE");
+ 			found = 1;
++			if (!sae->tmp->pwe_ffc) {
++				wpa_printf(MSG_DEBUG, "SAE: Use this PWE");
++				sae->tmp->pwe_ffc = pwe;
++				pwe = NULL;
++			}
+ 		}
+ 	}
+ 
++	crypto_bignum_deinit(pwe, 1);
++
+ 	return found ? 0 : -1;
+ }
+ 

package/network/services/hostapd/patches/061-0008-SAE-Use-const_time-selection-for-PWE-in-FFC.patch

@@ -0,0 +1,100 @@
+From f8f20717f87eff1f025f48ed585c7684debacf72 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Sat, 2 Mar 2019 12:45:33 +0200
+Subject: [PATCH 08/14] SAE: Use const_time selection for PWE in FFC
+
+This is an initial step towards making the FFC case use strictly
+constant time operations similarly to the ECC case.
+sae_test_pwd_seed_ffc() does not yet have constant time behavior,
+though.
+
+This is related to CVE-2019-9494.
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/common/sae.c | 53 +++++++++++++++++++++++++++++++++++------------------
+ 1 file changed, 35 insertions(+), 18 deletions(-)
+
+--- a/src/common/sae.c
++++ b/src/common/sae.c
+@@ -589,17 +589,28 @@ static int sae_derive_pwe_ffc(struct sae
+ 			      const u8 *addr2, const u8 *password,
+ 			      size_t password_len, const char *identifier)
+ {
+-	u8 counter, k;
++	u8 counter, k, sel_counter = 0;
+ 	u8 addrs[2 * ETH_ALEN];
+ 	const u8 *addr[3];
+ 	size_t len[3];
+ 	size_t num_elem;
+-	int found = 0;
+-	struct crypto_bignum *pwe = NULL;
++	u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_*
++		       * mask */
++	u8 mask;
++	struct crypto_bignum *pwe;
++	size_t prime_len = sae->tmp->prime_len * 8;
++	u8 *pwe_buf;
+ 
+ 	crypto_bignum_deinit(sae->tmp->pwe_ffc, 1);
+ 	sae->tmp->pwe_ffc = NULL;
+ 
++	/* Allocate a buffer to maintain selected and candidate PWE for constant
++	 * time selection. */
++	pwe_buf = os_zalloc(prime_len * 2);
++	pwe = crypto_bignum_init();
++	if (!pwe_buf || !pwe)
++		goto fail;
++
+ 	wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
+ 			      password, password_len);
+ 
+@@ -638,27 +649,33 @@ static int sae_derive_pwe_ffc(struct sae
+ 		if (hmac_sha256_vector(addrs, sizeof(addrs), num_elem,
+ 				       addr, len, pwd_seed) < 0)
+ 			break;
+-		if (!pwe) {
+-			pwe = crypto_bignum_init();
+-			if (!pwe)
+-				break;
+-		}
+ 		res = sae_test_pwd_seed_ffc(sae, pwd_seed, pwe);
++		/* res is -1 for fatal failure, 0 if a valid PWE was not found,
++		 * or 1 if a valid PWE was found. */
+ 		if (res < 0)
+ 			break;
+-		if (res > 0) {
+-			found = 1;
+-			if (!sae->tmp->pwe_ffc) {
+-				wpa_printf(MSG_DEBUG, "SAE: Use this PWE");
+-				sae->tmp->pwe_ffc = pwe;
+-				pwe = NULL;
+-			}
+-		}
++		/* Store the candidate PWE into the second half of pwe_buf and
++		 * the selected PWE in the beginning of pwe_buf using constant
++		 * time selection. */
++		if (crypto_bignum_to_bin(pwe, pwe_buf + prime_len, prime_len,
++					 prime_len) < 0)
++			break;
++		const_time_select_bin(found, pwe_buf, pwe_buf + prime_len,
++				      prime_len, pwe_buf);
++		sel_counter = const_time_select_u8(found, sel_counter, counter);
++		mask = const_time_eq_u8(res, 1);
++		found = const_time_select_u8(found, found, mask);
+ 	}
+ 
+-	crypto_bignum_deinit(pwe, 1);
++	if (!found)
++		goto fail;
+ 
+-	return found ? 0 : -1;
++	wpa_printf(MSG_DEBUG, "SAE: Use PWE from counter = %02u", sel_counter);
++	sae->tmp->pwe_ffc = crypto_bignum_init_set(pwe_buf, prime_len);
++fail:
++	crypto_bignum_deinit(pwe, 1);
++	bin_clear_free(pwe_buf, prime_len * 2);
++	return sae->tmp->pwe_ffc ? 0 : -1;
+ }
+ 
+ 

package/network/services/hostapd/patches/061-0009-SAE-Use-constant-time-operations-in-sae_test_pwd_see.patch

@@ -0,0 +1,133 @@
+From cff138b0747fa39765cbc641b66cfa5d7f1735d1 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Sat, 2 Mar 2019 16:05:56 +0200
+Subject: [PATCH 09/14] SAE: Use constant time operations in
+ sae_test_pwd_seed_ffc()
+
+Try to avoid showing externally visible timing or memory access
+differences regardless of whether the derived pwd-value is smaller than
+the group prime.
+
+This is related to CVE-2019-9494.
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/common/sae.c | 75 ++++++++++++++++++++++++++++++++++----------------------
+ 1 file changed, 46 insertions(+), 29 deletions(-)
+
+--- a/src/common/sae.c
++++ b/src/common/sae.c
+@@ -311,14 +311,17 @@ static int sae_test_pwd_seed_ecc(struct
+ }
+ 
+ 
++/* Returns -1 on fatal failure, 0 if PWE cannot be derived from the provided
++ * pwd-seed, or 1 if a valid PWE was derived from pwd-seed. */
+ static int sae_test_pwd_seed_ffc(struct sae_data *sae, const u8 *pwd_seed,
+ 				 struct crypto_bignum *pwe)
+ {
+ 	u8 pwd_value[SAE_MAX_PRIME_LEN];
+ 	size_t bits = sae->tmp->prime_len * 8;
+ 	u8 exp[1];
+-	struct crypto_bignum *a, *b;
+-	int res;
++	struct crypto_bignum *a, *b = NULL;
++	int res, is_val;
++	u8 pwd_value_valid;
+ 
+ 	wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN);
+ 
+@@ -330,16 +333,29 @@ static int sae_test_pwd_seed_ffc(struct
+ 	wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", pwd_value,
+ 			sae->tmp->prime_len);
+ 
+-	if (os_memcmp(pwd_value, sae->tmp->dh->prime, sae->tmp->prime_len) >= 0)
+-	{
+-		wpa_printf(MSG_DEBUG, "SAE: pwd-value >= p");
+-		return 0;
+-	}
++	/* Check whether pwd-value < p */
++	res = const_time_memcmp(pwd_value, sae->tmp->dh->prime,
++				sae->tmp->prime_len);
++	/* pwd-value >= p is invalid, so res is < 0 for the valid cases and
++	 * the negative sign can be used to fill the mask for constant time
++	 * selection */
++	pwd_value_valid = const_time_fill_msb(res);
++
++	/* If pwd-value >= p, force pwd-value to be < p and perform the
++	 * calculations anyway to hide timing difference. The derived PWE will
++	 * be ignored in that case. */
++	pwd_value[0] = const_time_select_u8(pwd_value_valid, pwd_value[0], 0);
+ 
+ 	/* PWE = pwd-value^((p-1)/r) modulo p */
+ 
++	res = -1;
+ 	a = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len);
++	if (!a)
++		goto fail;
+ 
++	/* This is an optimization based on the used group that does not depend
++	 * on the password in any way, so it is fine to use separate branches
++	 * for this step without constant time operations. */
+ 	if (sae->tmp->dh->safe_prime) {
+ 		/*
+ 		 * r = (p-1)/2 for the group used here, so this becomes:
+@@ -353,33 +369,34 @@ static int sae_test_pwd_seed_ffc(struct
+ 		b = crypto_bignum_init_set(exp, sizeof(exp));
+ 		if (b == NULL ||
+ 		    crypto_bignum_sub(sae->tmp->prime, b, b) < 0 ||
+-		    crypto_bignum_div(b, sae->tmp->order, b) < 0) {
+-			crypto_bignum_deinit(b, 0);
+-			b = NULL;
+-		}
++		    crypto_bignum_div(b, sae->tmp->order, b) < 0)
++			goto fail;
+ 	}
+ 
+-	if (a == NULL || b == NULL)
+-		res = -1;
+-	else
+-		res = crypto_bignum_exptmod(a, b, sae->tmp->prime, pwe);
+-
+-	crypto_bignum_deinit(a, 0);
+-	crypto_bignum_deinit(b, 0);
+-
+-	if (res < 0) {
+-		wpa_printf(MSG_DEBUG, "SAE: Failed to calculate PWE");
+-		return -1;
+-	}
+-
+-	/* if (PWE > 1) --> found */
+-	if (crypto_bignum_is_zero(pwe) || crypto_bignum_is_one(pwe)) {
+-		wpa_printf(MSG_DEBUG, "SAE: PWE <= 1");
+-		return 0;
+-	}
++	if (!b)
++		goto fail;
+ 
+-	wpa_printf(MSG_DEBUG, "SAE: PWE found");
+-	return 1;
++	res = crypto_bignum_exptmod(a, b, sae->tmp->prime, pwe);
++	if (res < 0)
++		goto fail;
++
++	/* There were no fatal errors in calculations, so determine the return
++	 * value using constant time operations. We get here for number of
++	 * invalid cases which are cleared here after having performed all the
++	 * computation. PWE is valid if pwd-value was less than prime and
++	 * PWE > 1. Start with pwd-value check first and then use constant time
++	 * operations to clear res to 0 if PWE is 0 or 1.
++	 */
++	res = const_time_select_u8(pwd_value_valid, 1, 0);
++	is_val = crypto_bignum_is_zero(pwe);
++	res = const_time_select_u8(const_time_is_zero(is_val), res, 0);
++	is_val = crypto_bignum_is_one(pwe);
++	res = const_time_select_u8(const_time_is_zero(is_val), res, 0);
++
++fail:
++	crypto_bignum_deinit(a, 1);
++	crypto_bignum_deinit(b, 1);
++	return res;
+ }
+ 
+ 

package/network/services/hostapd/patches/062-0004-EAP-pwd-Use-constant-time-and-memory-access-for-find.patch

@@ -0,0 +1,319 @@
+From aaf65feac67c3993935634eefe5bc76b9fce03aa Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Tue, 26 Feb 2019 11:59:45 +0200
+Subject: [PATCH 04/14] EAP-pwd: Use constant time and memory access for
+ finding the PWE
+
+This algorithm could leak information to external observers in form of
+timing differences or memory access patterns (cache use). While the
+previous implementation had protection against the most visible timing
+differences (looping 40 rounds and masking the legendre operation), it
+did not protect against memory access patterns between the two possible
+code paths in the masking operations. That might be sufficient to allow
+an unprivileged process running on the same device to be able to
+determine which path is being executed through a cache attack and based
+on that, determine information about the used password.
+
+Convert the PWE finding loop to use constant time functions and
+identical memory access path without different branches for the QR/QNR
+cases to minimize possible side-channel information similarly to the
+changes done for SAE authentication. (CVE-2019-9495)
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/eap_common/eap_pwd_common.c | 187 +++++++++++++++++++++-------------------
+ 1 file changed, 99 insertions(+), 88 deletions(-)
+
+--- a/src/eap_common/eap_pwd_common.c
++++ b/src/eap_common/eap_pwd_common.c
+@@ -8,11 +8,15 @@
+ 
+ #include "includes.h"
+ #include "common.h"
++#include "utils/const_time.h"
+ #include "crypto/sha256.h"
+ #include "crypto/crypto.h"
+ #include "eap_defs.h"
+ #include "eap_pwd_common.h"
+ 
++#define MAX_ECC_PRIME_LEN 66
++
++
+ /* The random function H(x) = HMAC-SHA256(0^32, x) */
+ struct crypto_hash * eap_pwd_h_init(void)
+ {
+@@ -102,6 +106,15 @@ EAP_PWD_group * get_eap_pwd_group(u16 nu
+ }
+ 
+ 
++static void buf_shift_right(u8 *buf, size_t len, size_t bits)
++{
++	size_t i;
++	for (i = len - 1; i > 0; i--)
++		buf[i] = (buf[i - 1] << (8 - bits)) | (buf[i] >> bits);
++	buf[0] >>= bits;
++}
++
++
+ /*
+  * compute a "random" secret point on an elliptic curve based
+  * on the password and identities.
+@@ -113,17 +126,27 @@ int compute_password_element(EAP_PWD_gro
+ 			     const u8 *token)
+ {
+ 	struct crypto_bignum *qr = NULL, *qnr = NULL, *one = NULL;
++	struct crypto_bignum *qr_or_qnr = NULL;
++	u8 qr_bin[MAX_ECC_PRIME_LEN];
++	u8 qnr_bin[MAX_ECC_PRIME_LEN];
++	u8 qr_or_qnr_bin[MAX_ECC_PRIME_LEN];
++	u8 x_bin[MAX_ECC_PRIME_LEN];
+ 	struct crypto_bignum *tmp1 = NULL, *tmp2 = NULL, *pm1 = NULL;
+ 	struct crypto_hash *hash;
+ 	unsigned char pwe_digest[SHA256_MAC_LEN], *prfbuf = NULL, ctr;
+-	int is_odd, ret = 0, check, found = 0;
+-	size_t primebytelen, primebitlen;
+-	struct crypto_bignum *x_candidate = NULL, *rnd = NULL, *cofactor = NULL;
++	int ret = 0, check, res;
++	u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_*
++		       * mask */
++	size_t primebytelen = 0, primebitlen;
++	struct crypto_bignum *x_candidate = NULL, *cofactor = NULL;
+ 	const struct crypto_bignum *prime;
++	u8 mask, found_ctr = 0, is_odd = 0;
+ 
+ 	if (grp->pwe)
+ 		return -1;
+ 
++	os_memset(x_bin, 0, sizeof(x_bin));
++
+ 	prime = crypto_ec_get_prime(grp->group);
+ 	cofactor = crypto_bignum_init();
+ 	grp->pwe = crypto_ec_point_init(grp->group);
+@@ -152,8 +175,6 @@ int compute_password_element(EAP_PWD_gro
+ 
+ 	/* get a random quadratic residue and nonresidue */
+ 	while (!qr || !qnr) {
+-		int res;
+-
+ 		if (crypto_bignum_rand(tmp1, prime) < 0)
+ 			goto fail;
+ 		res = crypto_bignum_legendre(tmp1, prime);
+@@ -167,6 +188,11 @@ int compute_password_element(EAP_PWD_gro
+ 		if (!tmp1)
+ 			goto fail;
+ 	}
++	if (crypto_bignum_to_bin(qr, qr_bin, sizeof(qr_bin),
++				 primebytelen) < 0 ||
++	    crypto_bignum_to_bin(qnr, qnr_bin, sizeof(qnr_bin),
++				 primebytelen) < 0)
++		goto fail;
+ 
+ 	os_memset(prfbuf, 0, primebytelen);
+ 	ctr = 0;
+@@ -194,17 +220,16 @@ int compute_password_element(EAP_PWD_gro
+ 		eap_pwd_h_update(hash, &ctr, sizeof(ctr));
+ 		eap_pwd_h_final(hash, pwe_digest);
+ 
+-		crypto_bignum_deinit(rnd, 1);
+-		rnd = crypto_bignum_init_set(pwe_digest, SHA256_MAC_LEN);
+-		if (!rnd) {
+-			wpa_printf(MSG_INFO, "EAP-pwd: unable to create rnd");
+-			goto fail;
+-		}
++		is_odd = const_time_select_u8(
++			found, is_odd, pwe_digest[SHA256_MAC_LEN - 1] & 0x01);
+ 		if (eap_pwd_kdf(pwe_digest, SHA256_MAC_LEN,
+ 				(u8 *) "EAP-pwd Hunting And Pecking",
+ 				os_strlen("EAP-pwd Hunting And Pecking"),
+ 				prfbuf, primebitlen) < 0)
+ 			goto fail;
++		if (primebitlen % 8)
++			buf_shift_right(prfbuf, primebytelen,
++					8 - primebitlen % 8);
+ 
+ 		crypto_bignum_deinit(x_candidate, 1);
+ 		x_candidate = crypto_bignum_init_set(prfbuf, primebytelen);
+@@ -214,24 +239,13 @@ int compute_password_element(EAP_PWD_gro
+ 			goto fail;
+ 		}
+ 
+-		/*
+-		 * eap_pwd_kdf() returns a string of bits 0..primebitlen but
+-		 * BN_bin2bn will treat that string of bits as a big endian
+-		 * number. If the primebitlen is not an even multiple of 8
+-		 * then excessive bits-- those _after_ primebitlen-- so now
+-		 * we have to shift right the amount we masked off.
+-		 */
+-		if ((primebitlen % 8) &&
+-		    crypto_bignum_rshift(x_candidate,
+-					 (8 - (primebitlen % 8)),
+-					 x_candidate) < 0)
+-			goto fail;
+-
+ 		if (crypto_bignum_cmp(x_candidate, prime) >= 0)
+ 			continue;
+ 
+-		wpa_hexdump(MSG_DEBUG, "EAP-pwd: x_candidate",
+-			    prfbuf, primebytelen);
++		wpa_hexdump_key(MSG_DEBUG, "EAP-pwd: x_candidate",
++				prfbuf, primebytelen);
++		const_time_select_bin(found, x_bin, prfbuf, primebytelen,
++				      x_bin);
+ 
+ 		/*
+ 		 * compute y^2 using the equation of the curve
+@@ -260,13 +274,15 @@ int compute_password_element(EAP_PWD_gro
+ 		 * Flip a coin, multiply by the random quadratic residue or the
+ 		 * random quadratic nonresidue and record heads or tails.
+ 		 */
+-		if (crypto_bignum_is_odd(tmp1)) {
+-			crypto_bignum_mulmod(tmp2, qr, prime, tmp2);
+-			check = 1;
+-		} else {
+-			crypto_bignum_mulmod(tmp2, qnr, prime, tmp2);
+-			check = -1;
+-		}
++		mask = const_time_eq_u8(crypto_bignum_is_odd(tmp1), 1);
++		check = const_time_select_s8(mask, 1, -1);
++		const_time_select_bin(mask, qr_bin, qnr_bin, primebytelen,
++				      qr_or_qnr_bin);
++		crypto_bignum_deinit(qr_or_qnr, 1);
++		qr_or_qnr = crypto_bignum_init_set(qr_or_qnr_bin, primebytelen);
++		if (!qr_or_qnr ||
++		    crypto_bignum_mulmod(tmp2, qr_or_qnr, prime, tmp2) < 0)
++			goto fail;
+ 
+ 		/*
+ 		 * Now it's safe to do legendre, if check is 1 then it's
+@@ -274,59 +290,12 @@ int compute_password_element(EAP_PWD_gro
+ 		 * change result), if check is -1 then it's the opposite test
+ 		 * (multiplying a qr by qnr would make a qnr).
+ 		 */
+-		if (crypto_bignum_legendre(tmp2, prime) == check) {
+-			if (found == 1)
+-				continue;
+-
+-			/* need to unambiguously identify the solution */
+-			is_odd = crypto_bignum_is_odd(rnd);
+-
+-			/*
+-			 * We know x_candidate is a quadratic residue so set
+-			 * it here.
+-			 */
+-			if (crypto_ec_point_solve_y_coord(grp->group, grp->pwe,
+-							  x_candidate,
+-							  is_odd) != 0) {
+-				wpa_printf(MSG_INFO,
+-					   "EAP-pwd: Could not solve for y");
+-				continue;
+-			}
+-
+-			/*
+-			 * If there's a solution to the equation then the point
+-			 * must be on the curve so why check again explicitly?
+-			 * OpenSSL code says this is required by X9.62. We're
+-			 * not X9.62 but it can't hurt just to be sure.
+-			 */
+-			if (!crypto_ec_point_is_on_curve(grp->group,
+-							 grp->pwe)) {
+-				wpa_printf(MSG_INFO,
+-					   "EAP-pwd: point is not on curve");
+-				continue;
+-			}
+-
+-			if (!crypto_bignum_is_one(cofactor)) {
+-				/* make sure the point is not in a small
+-				 * sub-group */
+-				if (crypto_ec_point_mul(grp->group, grp->pwe,
+-							cofactor,
+-							grp->pwe) != 0) {
+-					wpa_printf(MSG_INFO,
+-						   "EAP-pwd: cannot multiply generator by order");
+-					continue;
+-				}
+-				if (crypto_ec_point_is_at_infinity(grp->group,
+-								   grp->pwe)) {
+-					wpa_printf(MSG_INFO,
+-						   "EAP-pwd: point is at infinity");
+-					continue;
+-				}
+-			}
+-			wpa_printf(MSG_DEBUG,
+-				   "EAP-pwd: found a PWE in %d tries", ctr);
+-			found = 1;
+-		}
++		res = crypto_bignum_legendre(tmp2, prime);
++		if (res == -2)
++			goto fail;
++		mask = const_time_eq(res, check);
++		found_ctr = const_time_select_u8(found, found_ctr, ctr);
++		found |= mask;
+ 	}
+ 	if (found == 0) {
+ 		wpa_printf(MSG_INFO,
+@@ -334,6 +303,44 @@ int compute_password_element(EAP_PWD_gro
+ 			   num);
+ 		goto fail;
+ 	}
++
++	/*
++	 * We know x_candidate is a quadratic residue so set it here.
++	 */
++	crypto_bignum_deinit(x_candidate, 1);
++	x_candidate = crypto_bignum_init_set(x_bin, primebytelen);
++	if (!x_candidate ||
++	    crypto_ec_point_solve_y_coord(grp->group, grp->pwe, x_candidate,
++					  is_odd) != 0) {
++		wpa_printf(MSG_INFO, "EAP-pwd: Could not solve for y");
++		goto fail;
++	}
++
++	/*
++	 * If there's a solution to the equation then the point must be on the
++	 * curve so why check again explicitly? OpenSSL code says this is
++	 * required by X9.62. We're not X9.62 but it can't hurt just to be sure.
++	 */
++	if (!crypto_ec_point_is_on_curve(grp->group, grp->pwe)) {
++		wpa_printf(MSG_INFO, "EAP-pwd: point is not on curve");
++		goto fail;
++	}
++
++	if (!crypto_bignum_is_one(cofactor)) {
++		/* make sure the point is not in a small sub-group */
++		if (crypto_ec_point_mul(grp->group, grp->pwe, cofactor,
++					grp->pwe) != 0) {
++			wpa_printf(MSG_INFO,
++				   "EAP-pwd: cannot multiply generator by order");
++			goto fail;
++		}
++		if (crypto_ec_point_is_at_infinity(grp->group, grp->pwe)) {
++			wpa_printf(MSG_INFO, "EAP-pwd: point is at infinity");
++			goto fail;
++		}
++	}
++	wpa_printf(MSG_DEBUG, "EAP-pwd: found a PWE in %02d tries", found_ctr);
++
+ 	if (0) {
+  fail:
+ 		crypto_ec_point_deinit(grp->pwe, 1);
+@@ -343,14 +350,18 @@ int compute_password_element(EAP_PWD_gro
+ 	/* cleanliness and order.... */
+ 	crypto_bignum_deinit(cofactor, 1);
+ 	crypto_bignum_deinit(x_candidate, 1);
+-	crypto_bignum_deinit(rnd, 1);
+ 	crypto_bignum_deinit(pm1, 0);
+ 	crypto_bignum_deinit(tmp1, 1);
+ 	crypto_bignum_deinit(tmp2, 1);
+ 	crypto_bignum_deinit(qr, 1);
+ 	crypto_bignum_deinit(qnr, 1);
++	crypto_bignum_deinit(qr_or_qnr, 1);
+ 	crypto_bignum_deinit(one, 0);
+-	os_free(prfbuf);
++	bin_clear_free(prfbuf, primebytelen);
++	os_memset(qr_bin, 0, sizeof(qr_bin));
++	os_memset(qnr_bin, 0, sizeof(qnr_bin));
++	os_memset(qr_or_qnr_bin, 0, sizeof(qr_or_qnr_bin));
++	os_memset(pwe_digest, 0, sizeof(pwe_digest));
+ 
+ 	return ret;
+ }

package/network/services/hostapd/patches/063-0010-SAE-Fix-confirm-message-validation-in-error-cases.patch

@@ -0,0 +1,52 @@
+From ac8fa9ef198640086cf2ce7c94673be2b6a018a0 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Tue, 5 Mar 2019 23:43:25 +0200
+Subject: [PATCH 10/14] SAE: Fix confirm message validation in error cases
+
+Explicitly verify that own and peer commit scalar/element are available
+when trying to check SAE confirm message. It could have been possible to
+hit a NULL pointer dereference if the peer element could not have been
+parsed. (CVE-2019-9496)
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/common/sae.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/src/common/sae.c
++++ b/src/common/sae.c
+@@ -1464,23 +1464,31 @@ int sae_check_confirm(struct sae_data *s
+ 
+ 	wpa_printf(MSG_DEBUG, "SAE: peer-send-confirm %u", WPA_GET_LE16(data));
+ 
+-	if (sae->tmp == NULL) {
++	if (!sae->tmp || !sae->peer_commit_scalar ||
++	    !sae->tmp->own_commit_scalar) {
+ 		wpa_printf(MSG_DEBUG, "SAE: Temporary data not yet available");
+ 		return -1;
+ 	}
+ 
+-	if (sae->tmp->ec)
++	if (sae->tmp->ec) {
++		if (!sae->tmp->peer_commit_element_ecc ||
++		    !sae->tmp->own_commit_element_ecc)
++			return -1;
+ 		sae_cn_confirm_ecc(sae, data, sae->peer_commit_scalar,
+ 				   sae->tmp->peer_commit_element_ecc,
+ 				   sae->tmp->own_commit_scalar,
+ 				   sae->tmp->own_commit_element_ecc,
+ 				   verifier);
+-	else
++	} else {
++		if (!sae->tmp->peer_commit_element_ffc ||
++		    !sae->tmp->own_commit_element_ffc)
++			return -1;
+ 		sae_cn_confirm_ffc(sae, data, sae->peer_commit_scalar,
+ 				   sae->tmp->peer_commit_element_ffc,
+ 				   sae->tmp->own_commit_scalar,
+ 				   sae->tmp->own_commit_element_ffc,
+ 				   verifier);
++	}
+ 
+ 	if (os_memcmp_const(verifier, data + 2, SHA256_MAC_LEN) != 0) {
+ 		wpa_printf(MSG_DEBUG, "SAE: Confirm mismatch");

package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch

@@ -0,0 +1,53 @@
+From 70ff850e89fbc8bc7da515321b4d15b5eef70581 Mon Sep 17 00:00:00 2001
+From: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
+Date: Sun, 31 Mar 2019 17:13:06 +0200
+Subject: [PATCH 11/14] EAP-pwd server: Verify received scalar and element
+
+When processing an EAP-pwd Commit frame, the peer's scalar and element
+(elliptic curve point) were not validated. This allowed an adversary to
+bypass authentication, and impersonate any user if the crypto
+implementation did not verify the validity of the EC point.
+
+Fix this vulnerability by assuring the received scalar lies within the
+valid range, and by checking that the received element is not the point
+at infinity and lies on the elliptic curve being used. (CVE-2019-9498)
+
+The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower
+is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL
+(and also BoringSSL) implicitly validate the elliptic curve point in
+EC_POINT_set_affine_coordinates_GFp(), preventing the attack.
+
+Signed-off-by: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
+---
+ src/eap_server/eap_server_pwd.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/src/eap_server/eap_server_pwd.c
++++ b/src/eap_server/eap_server_pwd.c
+@@ -653,6 +653,26 @@ eap_pwd_process_commit_resp(struct eap_s
+ 		goto fin;
+ 	}
+ 
++	/* verify received scalar */
++	if (crypto_bignum_is_zero(data->peer_scalar) ||
++	    crypto_bignum_is_one(data->peer_scalar) ||
++	    crypto_bignum_cmp(data->peer_scalar,
++			      crypto_ec_get_order(data->grp->group)) >= 0) {
++		wpa_printf(MSG_INFO,
++			   "EAP-PWD (server): received scalar is invalid");
++		goto fin;
++	}
++
++	/* verify received element */
++	if (!crypto_ec_point_is_on_curve(data->grp->group,
++					 data->peer_element) ||
++	    crypto_ec_point_is_at_infinity(data->grp->group,
++					   data->peer_element)) {
++		wpa_printf(MSG_INFO,
++			   "EAP-PWD (server): received element is invalid");
++		goto fin;
++	}
++
+ 	/* check to ensure peer's element is not in a small sub-group */
+ 	if (!crypto_bignum_is_one(cofactor)) {
+ 		if (crypto_ec_point_mul(data->grp->group, data->peer_element,

package/network/services/hostapd/patches/064-0012-EAP-pwd-server-Detect-reflection-attacks.patch

@@ -0,0 +1,40 @@
+From d63edfa90243e9a7de6ae5c275032f2cc79fef95 Mon Sep 17 00:00:00 2001
+From: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
+Date: Sun, 31 Mar 2019 17:26:01 +0200
+Subject: [PATCH 12/14] EAP-pwd server: Detect reflection attacks
+
+When processing an EAP-pwd Commit frame, verify that the peer's scalar
+and elliptic curve element differ from the one sent by the server. This
+prevents reflection attacks where the adversary reflects the scalar and
+element sent by the server. (CVE-2019-9497)
+
+The vulnerability allows an adversary to complete the EAP-pwd handshake
+as any user. However, the adversary does not learn the negotiated
+session key, meaning the subsequent 4-way handshake would fail. As a
+result, this cannot be abused to bypass authentication unless EAP-pwd is
+used in non-WLAN cases without any following key exchange that would
+require the attacker to learn the MSK.
+
+Signed-off-by: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
+---
+ src/eap_server/eap_server_pwd.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/src/eap_server/eap_server_pwd.c
++++ b/src/eap_server/eap_server_pwd.c
+@@ -688,6 +688,15 @@ eap_pwd_process_commit_resp(struct eap_s
+ 		}
+ 	}
+ 
++	/* detect reflection attacks */
++	if (crypto_bignum_cmp(data->my_scalar, data->peer_scalar) == 0 ||
++	    crypto_ec_point_cmp(data->grp->group, data->my_element,
++				data->peer_element) == 0) {
++		wpa_printf(MSG_INFO,
++			   "EAP-PWD (server): detected reflection attack!");
++		goto fin;
++	}
++
+ 	/* compute the shared key, k */
+ 	if ((crypto_ec_point_mul(data->grp->group, data->grp->pwe,
+ 				 data->peer_scalar, K) < 0) ||

package/network/services/hostapd/patches/064-0013-EAP-pwd-client-Verify-received-scalar-and-element.patch

@@ -0,0 +1,53 @@
+From 8ad8585f91823ddcc3728155e288e0f9f872e31a Mon Sep 17 00:00:00 2001
+From: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
+Date: Sun, 31 Mar 2019 17:43:44 +0200
+Subject: [PATCH 13/14] EAP-pwd client: Verify received scalar and element
+
+When processing an EAP-pwd Commit frame, the server's scalar and element
+(elliptic curve point) were not validated. This allowed an adversary to
+bypass authentication, and act as a rogue Access Point (AP) if the
+crypto implementation did not verify the validity of the EC point.
+
+Fix this vulnerability by assuring the received scalar lies within the
+valid range, and by checking that the received element is not the point
+at infinity and lies on the elliptic curve being used. (CVE-2019-9499)
+
+The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower
+is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL
+(and also BoringSSL) implicitly validate the elliptic curve point in
+EC_POINT_set_affine_coordinates_GFp(), preventing the attack.
+
+Signed-off-by: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
+---
+ src/eap_peer/eap_pwd.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/src/eap_peer/eap_pwd.c
++++ b/src/eap_peer/eap_pwd.c
+@@ -436,6 +436,26 @@ eap_pwd_perform_commit_exchange(struct e
+ 		goto fin;
+ 	}
+ 
++	/* verify received scalar */
++	if (crypto_bignum_is_zero(data->server_scalar) ||
++	    crypto_bignum_is_one(data->server_scalar) ||
++	    crypto_bignum_cmp(data->server_scalar,
++			      crypto_ec_get_order(data->grp->group)) >= 0) {
++		wpa_printf(MSG_INFO,
++			   "EAP-PWD (peer): received scalar is invalid");
++		goto fin;
++	}
++
++	/* verify received element */
++	if (!crypto_ec_point_is_on_curve(data->grp->group,
++					 data->server_element) ||
++	    crypto_ec_point_is_at_infinity(data->grp->group,
++					   data->server_element)) {
++		wpa_printf(MSG_INFO,
++			   "EAP-PWD (peer): received element is invalid");
++		goto fin;
++	}
++
+ 	/* check to ensure server's element is not in a small sub-group */
+ 	if (!crypto_bignum_is_one(cofactor)) {
+ 		if (crypto_ec_point_mul(data->grp->group, data->server_element,

package/network/services/hostapd/patches/064-0014-EAP-pwd-Check-element-x-y-coordinates-explicitly.patch

@@ -0,0 +1,321 @@
+From 16d4f1069118aa19bfce013493e1ac5783f92f1d Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Fri, 5 Apr 2019 02:12:50 +0300
+Subject: [PATCH 14/14] EAP-pwd: Check element x,y coordinates explicitly
+
+This adds an explicit check for 0 < x,y < prime based on RFC 5931,
+2.8.5.2.2 requirement. The earlier checks might have covered this
+implicitly, but it is safer to avoid any dependency on implicit checks
+and specific crypto library behavior. (CVE-2019-9498 and CVE-2019-9499)
+
+Furthermore, this moves the EAP-pwd element and scalar parsing and
+validation steps into shared helper functions so that there is no need
+to maintain two separate copies of this common functionality between the
+server and peer implementations.
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/eap_common/eap_pwd_common.c | 106 ++++++++++++++++++++++++++++++++++++++++
+ src/eap_common/eap_pwd_common.h |   3 ++
+ src/eap_peer/eap_pwd.c          |  45 ++---------------
+ src/eap_server/eap_server_pwd.c |  45 ++---------------
+ 4 files changed, 117 insertions(+), 82 deletions(-)
+
+--- a/src/eap_common/eap_pwd_common.c
++++ b/src/eap_common/eap_pwd_common.c
+@@ -427,3 +427,109 @@ int compute_keys(EAP_PWD_group *grp, con
+ 
+ 	return 1;
+ }
++
++
++static int eap_pwd_element_coord_ok(const struct crypto_bignum *prime,
++				    const u8 *buf, size_t len)
++{
++	struct crypto_bignum *val;
++	int ok = 1;
++
++	val = crypto_bignum_init_set(buf, len);
++	if (!val || crypto_bignum_is_zero(val) ||
++	    crypto_bignum_cmp(val, prime) >= 0)
++		ok = 0;
++	crypto_bignum_deinit(val, 0);
++	return ok;
++}
++
++
++struct crypto_ec_point * eap_pwd_get_element(EAP_PWD_group *group,
++					     const u8 *buf)
++{
++	struct crypto_ec_point *element;
++	const struct crypto_bignum *prime;
++	size_t prime_len;
++	struct crypto_bignum *cofactor = NULL;
++
++	prime = crypto_ec_get_prime(group->group);
++	prime_len = crypto_ec_prime_len(group->group);
++
++	/* RFC 5931, 2.8.5.2.2: 0 < x,y < p */
++	if (!eap_pwd_element_coord_ok(prime, buf, prime_len) ||
++	    !eap_pwd_element_coord_ok(prime, buf + prime_len, prime_len)) {
++		wpa_printf(MSG_INFO, "EAP-pwd: Invalid coordinate in element");
++		return NULL;
++	}
++
++	element = crypto_ec_point_from_bin(group->group, buf);
++	if (!element) {
++		wpa_printf(MSG_INFO, "EAP-pwd: EC point from element failed");
++		return NULL;
++	}
++
++	/* RFC 5931, 2.8.5.2.2: on curve and not the point at infinity */
++	if (!crypto_ec_point_is_on_curve(group->group, element) ||
++	    crypto_ec_point_is_at_infinity(group->group, element)) {
++		wpa_printf(MSG_INFO, "EAP-pwd: Invalid element");
++		goto fail;
++	}
++
++	cofactor = crypto_bignum_init();
++	if (!cofactor || crypto_ec_cofactor(group->group, cofactor) < 0) {
++		wpa_printf(MSG_INFO,
++			   "EAP-pwd: Unable to get cofactor for curve");
++		goto fail;
++	}
++
++	if (!crypto_bignum_is_one(cofactor)) {
++		struct crypto_ec_point *point;
++		int ok = 1;
++
++		/* check to ensure peer's element is not in a small sub-group */
++		point = crypto_ec_point_init(group->group);
++		if (!point ||
++		    crypto_ec_point_mul(group->group, element,
++					cofactor, point) != 0 ||
++		    crypto_ec_point_is_at_infinity(group->group, point))
++			ok = 0;
++		crypto_ec_point_deinit(point, 0);
++
++		if (!ok) {
++			wpa_printf(MSG_INFO,
++				   "EAP-pwd: Small sub-group check on peer element failed");
++			goto fail;
++		}
++	}
++
++out:
++	crypto_bignum_deinit(cofactor, 0);
++	return element;
++fail:
++	crypto_ec_point_deinit(element, 0);
++	element = NULL;
++	goto out;
++}
++
++
++struct crypto_bignum * eap_pwd_get_scalar(EAP_PWD_group *group, const u8 *buf)
++{
++	struct crypto_bignum *scalar;
++	const struct crypto_bignum *order;
++	size_t order_len;
++
++	order = crypto_ec_get_order(group->group);
++	order_len = crypto_ec_order_len(group->group);
++
++	/* RFC 5931, 2.8.5.2: 1 < scalar < r */
++	scalar = crypto_bignum_init_set(buf, order_len);
++	if (!scalar || crypto_bignum_is_zero(scalar) ||
++	    crypto_bignum_is_one(scalar) ||
++	    crypto_bignum_cmp(scalar, order) >= 0) {
++		wpa_printf(MSG_INFO, "EAP-pwd: received scalar is invalid");
++		crypto_bignum_deinit(scalar, 0);
++		scalar = NULL;
++	}
++
++	return scalar;
++}
+--- a/src/eap_common/eap_pwd_common.h
++++ b/src/eap_common/eap_pwd_common.h
+@@ -64,5 +64,8 @@ int compute_keys(EAP_PWD_group *grp, con
+ struct crypto_hash * eap_pwd_h_init(void);
+ void eap_pwd_h_update(struct crypto_hash *hash, const u8 *data, size_t len);
+ void eap_pwd_h_final(struct crypto_hash *hash, u8 *digest);
++struct crypto_ec_point * eap_pwd_get_element(EAP_PWD_group *group,
++					     const u8 *buf);
++struct crypto_bignum * eap_pwd_get_scalar(EAP_PWD_group *group, const u8 *buf);
+ 
+ #endif  /* EAP_PWD_COMMON_H */
+--- a/src/eap_peer/eap_pwd.c
++++ b/src/eap_peer/eap_pwd.c
+@@ -344,7 +344,7 @@ eap_pwd_perform_commit_exchange(struct e
+ 				const struct wpabuf *reqData,
+ 				const u8 *payload, size_t payload_len)
+ {
+-	struct crypto_ec_point *K = NULL, *point = NULL;
++	struct crypto_ec_point *K = NULL;
+ 	struct crypto_bignum *mask = NULL, *cofactor = NULL;
+ 	const u8 *ptr;
+ 	u8 *scalar = NULL, *element = NULL;
+@@ -413,8 +413,7 @@ eap_pwd_perform_commit_exchange(struct e
+ 	/* process the request */
+ 	data->k = crypto_bignum_init();
+ 	K = crypto_ec_point_init(data->grp->group);
+-	point = crypto_ec_point_init(data->grp->group);
+-	if (!data->k || !K || !point) {
++	if (!data->k || !K) {
+ 		wpa_printf(MSG_INFO, "EAP-PWD (peer): peer data allocation "
+ 			   "fail");
+ 		goto fin;
+@@ -422,55 +421,20 @@ eap_pwd_perform_commit_exchange(struct e
+ 
+ 	/* element, x then y, followed by scalar */
+ 	ptr = payload;
+-	data->server_element = crypto_ec_point_from_bin(data->grp->group, ptr);
++	data->server_element = eap_pwd_get_element(data->grp, ptr);
+ 	if (!data->server_element) {
+ 		wpa_printf(MSG_INFO, "EAP-PWD (peer): setting peer element "
+ 			   "fail");
+ 		goto fin;
+ 	}
+ 	ptr += prime_len * 2;
+-	data->server_scalar = crypto_bignum_init_set(ptr, order_len);
++	data->server_scalar = eap_pwd_get_scalar(data->grp, ptr);
+ 	if (!data->server_scalar) {
+ 		wpa_printf(MSG_INFO,
+ 			   "EAP-PWD (peer): setting peer scalar fail");
+ 		goto fin;
+ 	}
+ 
+-	/* verify received scalar */
+-	if (crypto_bignum_is_zero(data->server_scalar) ||
+-	    crypto_bignum_is_one(data->server_scalar) ||
+-	    crypto_bignum_cmp(data->server_scalar,
+-			      crypto_ec_get_order(data->grp->group)) >= 0) {
+-		wpa_printf(MSG_INFO,
+-			   "EAP-PWD (peer): received scalar is invalid");
+-		goto fin;
+-	}
+-
+-	/* verify received element */
+-	if (!crypto_ec_point_is_on_curve(data->grp->group,
+-					 data->server_element) ||
+-	    crypto_ec_point_is_at_infinity(data->grp->group,
+-					   data->server_element)) {
+-		wpa_printf(MSG_INFO,
+-			   "EAP-PWD (peer): received element is invalid");
+-		goto fin;
+-	}
+-
+-	/* check to ensure server's element is not in a small sub-group */
+-	if (!crypto_bignum_is_one(cofactor)) {
+-		if (crypto_ec_point_mul(data->grp->group, data->server_element,
+-					cofactor, point) < 0) {
+-			wpa_printf(MSG_INFO, "EAP-PWD (peer): cannot multiply "
+-				   "server element by order!\n");
+-			goto fin;
+-		}
+-		if (crypto_ec_point_is_at_infinity(data->grp->group, point)) {
+-			wpa_printf(MSG_INFO, "EAP-PWD (peer): server element "
+-				   "is at infinity!\n");
+-			goto fin;
+-		}
+-	}
+-
+ 	/* compute the shared key, k */
+ 	if (crypto_ec_point_mul(data->grp->group, data->grp->pwe,
+ 				data->server_scalar, K) < 0 ||
+@@ -544,7 +508,6 @@ fin:
+ 	crypto_bignum_deinit(mask, 1);
+ 	crypto_bignum_deinit(cofactor, 1);
+ 	crypto_ec_point_deinit(K, 1);
+-	crypto_ec_point_deinit(point, 1);
+ 	if (data->outbuf == NULL)
+ 		eap_pwd_state(data, FAILURE);
+ 	else
+--- a/src/eap_server/eap_server_pwd.c
++++ b/src/eap_server/eap_server_pwd.c
+@@ -604,7 +604,7 @@ eap_pwd_process_commit_resp(struct eap_s
+ {
+ 	const u8 *ptr;
+ 	struct crypto_bignum *cofactor = NULL;
+-	struct crypto_ec_point *K = NULL, *point = NULL;
++	struct crypto_ec_point *K = NULL;
+ 	int res = 0;
+ 	size_t prime_len, order_len;
+ 
+@@ -623,9 +623,8 @@ eap_pwd_process_commit_resp(struct eap_s
+ 
+ 	data->k = crypto_bignum_init();
+ 	cofactor = crypto_bignum_init();
+-	point = crypto_ec_point_init(data->grp->group);
+ 	K = crypto_ec_point_init(data->grp->group);
+-	if (!data->k || !cofactor || !point || !K) {
++	if (!data->k || !cofactor || !K) {
+ 		wpa_printf(MSG_INFO, "EAP-PWD (server): peer data allocation "
+ 			   "fail");
+ 		goto fin;
+@@ -639,55 +638,20 @@ eap_pwd_process_commit_resp(struct eap_s
+ 
+ 	/* element, x then y, followed by scalar */
+ 	ptr = payload;
+-	data->peer_element = crypto_ec_point_from_bin(data->grp->group, ptr);
++	data->peer_element = eap_pwd_get_element(data->grp, ptr);
+ 	if (!data->peer_element) {
+ 		wpa_printf(MSG_INFO, "EAP-PWD (server): setting peer element "
+ 			   "fail");
+ 		goto fin;
+ 	}
+ 	ptr += prime_len * 2;
+-	data->peer_scalar = crypto_bignum_init_set(ptr, order_len);
++	data->peer_scalar = eap_pwd_get_scalar(data->grp, ptr);
+ 	if (!data->peer_scalar) {
+ 		wpa_printf(MSG_INFO, "EAP-PWD (server): peer data allocation "
+ 			   "fail");
+ 		goto fin;
+ 	}
+ 
+-	/* verify received scalar */
+-	if (crypto_bignum_is_zero(data->peer_scalar) ||
+-	    crypto_bignum_is_one(data->peer_scalar) ||
+-	    crypto_bignum_cmp(data->peer_scalar,
+-			      crypto_ec_get_order(data->grp->group)) >= 0) {
+-		wpa_printf(MSG_INFO,
+-			   "EAP-PWD (server): received scalar is invalid");
+-		goto fin;
+-	}
+-
+-	/* verify received element */
+-	if (!crypto_ec_point_is_on_curve(data->grp->group,
+-					 data->peer_element) ||
+-	    crypto_ec_point_is_at_infinity(data->grp->group,
+-					   data->peer_element)) {
+-		wpa_printf(MSG_INFO,
+-			   "EAP-PWD (server): received element is invalid");
+-		goto fin;
+-	}
+-
+-	/* check to ensure peer's element is not in a small sub-group */
+-	if (!crypto_bignum_is_one(cofactor)) {
+-		if (crypto_ec_point_mul(data->grp->group, data->peer_element,
+-					cofactor, point) != 0) {
+-			wpa_printf(MSG_INFO, "EAP-PWD (server): cannot "
+-				   "multiply peer element by order");
+-			goto fin;
+-		}
+-		if (crypto_ec_point_is_at_infinity(data->grp->group, point)) {
+-			wpa_printf(MSG_INFO, "EAP-PWD (server): peer element "
+-				   "is at infinity!\n");
+-			goto fin;
+-		}
+-	}
+-
+ 	/* detect reflection attacks */
+ 	if (crypto_bignum_cmp(data->my_scalar, data->peer_scalar) == 0 ||
+ 	    crypto_ec_point_cmp(data->grp->group, data->my_element,
+@@ -739,7 +703,6 @@ eap_pwd_process_commit_resp(struct eap_s
+ 
+ fin:
+ 	crypto_ec_point_deinit(K, 1);
+-	crypto_ec_point_deinit(point, 1);
+ 	crypto_bignum_deinit(cofactor, 1);
+ 
+ 	if (res)

package/network/services/hostapd/patches/065-0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch

@@ -0,0 +1,40 @@
+From fe76f487e28bdc61940f304f153a954cf36935ea Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Wed, 17 Apr 2019 01:55:32 +0300
+Subject: [PATCH 1/3] EAP-pwd server: Fix reassembly buffer handling
+
+data->inbuf allocation might fail and if that were to happen, the next
+fragment in the exchange could have resulted in NULL pointer
+dereference. Unexpected fragment with more bit might also be able to
+trigger this. Fix that by explicitly checking for data->inbuf to be
+available before using it.
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/eap_server/eap_server_pwd.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/src/eap_server/eap_server_pwd.c
++++ b/src/eap_server/eap_server_pwd.c
+@@ -882,6 +882,12 @@ static void eap_pwd_process(struct eap_s
+ 	 * the first and all intermediate fragments have the M bit set
+ 	 */
+ 	if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) {
++		if (!data->inbuf) {
++			wpa_printf(MSG_DEBUG,
++				   "EAP-pwd: No buffer for reassembly");
++			eap_pwd_state(data, FAILURE);
++			return;
++		}
+ 		if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) {
+ 			wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow "
+ 				   "attack detected! (%d+%d > %d)",
+@@ -902,7 +908,7 @@ static void eap_pwd_process(struct eap_s
+ 	 * last fragment won't have the M bit set (but we're obviously
+ 	 * buffering fragments so that's how we know it's the last)
+ 	 */
+-	if (data->in_frag_pos) {
++	if (data->in_frag_pos && data->inbuf) {
+ 		pos = wpabuf_head_u8(data->inbuf);
+ 		len = data->in_frag_pos;
+ 		wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes",

package/network/services/hostapd/patches/065-0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch

@@ -0,0 +1,40 @@
+From d2d1a324ce937628e4d9d9999fe113819b7d4478 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Wed, 17 Apr 2019 02:21:20 +0300
+Subject: [PATCH 3/3] EAP-pwd peer: Fix reassembly buffer handling
+
+Unexpected fragment might result in data->inbuf not being allocated
+before processing and that could have resulted in NULL pointer
+dereference. Fix that by explicitly checking for data->inbuf to be
+available before using it.
+
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/eap_peer/eap_pwd.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/src/eap_peer/eap_pwd.c
++++ b/src/eap_peer/eap_pwd.c
+@@ -805,6 +805,13 @@ eap_pwd_process(struct eap_sm *sm, void
+ 	 * buffer and ACK the fragment
+ 	 */
+ 	if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) {
++		if (!data->inbuf) {
++			wpa_printf(MSG_DEBUG,
++				   "EAP-pwd: No buffer for reassembly");
++			ret->methodState = METHOD_DONE;
++			ret->decision = DECISION_FAIL;
++			return NULL;
++		}
+ 		data->in_frag_pos += len;
+ 		if (data->in_frag_pos > wpabuf_size(data->inbuf)) {
+ 			wpa_printf(MSG_INFO, "EAP-pwd: Buffer overflow attack "
+@@ -831,7 +838,7 @@ eap_pwd_process(struct eap_sm *sm, void
+ 	/*
+ 	 * we're buffering and this is the last fragment
+ 	 */
+-	if (data->in_frag_pos) {
++	if (data->in_frag_pos && data->inbuf) {
+ 		wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes",
+ 			   (int) len);
+ 		pos = wpabuf_head_u8(data->inbuf);

package/network/services/hostapd/patches/110-no_eapol_fix.patch

@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -295,9 +295,10 @@ void wpa_supplicant_cancel_auth_timeout(
+@@ -292,9 +292,10 @@ void wpa_supplicant_cancel_auth_timeout(
   */
  void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
  {

package/network/services/hostapd/patches/200-multicall.patch

@@ -156,7 +156,7 @@
  wpa_cli.exe: wpa_cli
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -5476,8 +5476,8 @@ union wpa_event_data {
+@@ -5449,8 +5449,8 @@ union wpa_event_data {
   * Driver wrapper code should call this function whenever an event is received
   * from the driver.
   */
@@ -167,7 +167,7 @@
  
  /**
   * wpa_supplicant_event_global - Report a driver event for wpa_supplicant
-@@ -5489,7 +5489,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -5462,7 +5462,7 @@ void wpa_supplicant_event(void *ctx, enu
   * Same as wpa_supplicant_event(), but we search for the interface in
   * wpa_global.
   */
@@ -178,7 +178,7 @@
  /*
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -1527,8 +1527,8 @@ static void hostapd_event_wds_sta_interf
+@@ -1515,8 +1515,8 @@ static void hostapd_event_wds_sta_interf
  }
  
  
@@ -189,7 +189,7 @@
  {
  	struct hostapd_data *hapd = ctx;
  #ifndef CONFIG_NO_STDOUT_DEBUG
-@@ -1757,7 +1757,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -1742,7 +1742,7 @@ void wpa_supplicant_event(void *ctx, enu
  }
  
  
@@ -231,7 +231,7 @@
  	os_memset(&global, 0, sizeof(global));
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -4026,8 +4026,8 @@ static void wpas_event_assoc_reject(stru
+@@ -3976,8 +3976,8 @@ static void wpas_event_assoc_reject(stru
  }
  
  
@@ -242,7 +242,7 @@
  {
  	struct wpa_supplicant *wpa_s = ctx;
  	int resched;
-@@ -4796,7 +4796,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -4745,7 +4745,7 @@ void wpa_supplicant_event(void *ctx, enu
  }
  
  
@@ -253,7 +253,7 @@
  	struct wpa_supplicant *wpa_s;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -5861,7 +5861,6 @@ struct wpa_interface * wpa_supplicant_ma
+@@ -5797,7 +5797,6 @@ struct wpa_interface * wpa_supplicant_ma
  	return NULL;
  }
  
@@ -261,7 +261,7 @@
  /**
   * wpa_supplicant_match_existing - Match existing interfaces
   * @global: Pointer to global data from wpa_supplicant_init()
-@@ -5898,6 +5897,11 @@ static int wpa_supplicant_match_existing
+@@ -5834,6 +5833,11 @@ static int wpa_supplicant_match_existing
  
  #endif /* CONFIG_MATCH_IFACE */
  
@@ -273,7 +273,7 @@
  
  /**
   * wpa_supplicant_add_iface - Add a new network interface
-@@ -6154,6 +6158,8 @@ struct wpa_global * wpa_supplicant_init(
+@@ -6090,6 +6094,8 @@ struct wpa_global * wpa_supplicant_init(
  #ifndef CONFIG_NO_WPA_MSG
  	wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
  #endif /* CONFIG_NO_WPA_MSG */

package/network/services/hostapd/patches/300-noscan.patch

@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3317,6 +3317,10 @@ static int hostapd_config_fill(struct ho
+@@ -3214,6 +3214,10 @@ static int hostapd_config_fill(struct ho
  		}
  #endif /* CONFIG_IEEE80211W */
  #ifdef CONFIG_IEEE80211N
@@ -13,7 +13,7 @@
  	} else if (os_strcmp(buf, "ht_capab") == 0) {
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -781,6 +781,8 @@ struct hostapd_config {
+@@ -775,6 +775,8 @@ struct hostapd_config {
  
  	int ht_op_mode_fixed;
  	u16 ht_capab;

package/network/services/hostapd/patches/301-mesh-noscan.patch

@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/config.c
 +++ b/wpa_supplicant/config.c
-@@ -2233,6 +2233,7 @@ static const struct parse_data ssid_fiel
+@@ -2217,6 +2217,7 @@ static const struct parse_data ssid_fiel
  #else /* CONFIG_MESH */
  	{ INT_RANGE(mode, 0, 4) },
  #endif /* CONFIG_MESH */
@@ -31,7 +31,7 @@
  	if (conf->hw_mode == HOSTAPD_MODE_IEEE80211A && ssid->vht) {
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2081,12 +2081,12 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2051,12 +2051,12 @@ void ibss_mesh_setup_freq(struct wpa_sup
  {
  	enum hostapd_hw_mode hw_mode;
  	struct hostapd_hw_modes *mode = NULL;
@@ -46,7 +46,7 @@
  	unsigned int j, k;
  	struct hostapd_freq_params vht_freq;
  	int chwidth, seg0, seg1;
-@@ -2156,7 +2156,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2126,7 +2126,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
  		return;
  
  	/* Setup higher BW only for 5 GHz */

package/network/services/hostapd/patches/310-rescan_immediately.patch

@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -4312,7 +4312,7 @@ wpa_supplicant_alloc(struct wpa_supplica
+@@ -4248,7 +4248,7 @@ wpa_supplicant_alloc(struct wpa_supplica
  	if (wpa_s == NULL)
  		return NULL;
  	wpa_s->scan_req = INITIAL_SCAN_REQ;

package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch

@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -4318,7 +4318,7 @@ static int nl80211_set_channel(struct i8
+@@ -4234,7 +4234,7 @@ static int nl80211_set_channel(struct i8
  		   freq->freq, freq->ht_enabled, freq->vht_enabled,
  		   freq->bandwidth, freq->center_freq1, freq->center_freq2);
  

package/network/services/hostapd/patches/340-reload_freq_change.patch

@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -103,6 +103,25 @@ static void hostapd_reload_bss(struct ho
+@@ -93,6 +93,25 @@ static void hostapd_reload_bss(struct ho
  #endif /* CONFIG_NO_RADIUS */
  
  	ssid = &hapd->conf->ssid;
@@ -26,7 +26,7 @@
  	if (!ssid->wpa_psk_set && ssid->wpa_psk && !ssid->wpa_psk->next &&
  	    ssid->wpa_passphrase_set && ssid->wpa_passphrase) {
  		/*
-@@ -200,6 +219,7 @@ int hostapd_reload_config(struct hostapd
+@@ -171,6 +190,7 @@ int hostapd_reload_config(struct hostapd
  	struct hostapd_data *hapd = iface->bss[0];
  	struct hostapd_config *newconf, *oldconf;
  	size_t j;
@@ -34,8 +34,8 @@
  
  	if (iface->config_fname == NULL) {
  		/* Only in-memory config in use - assume it has been updated */
-@@ -250,21 +270,20 @@ int hostapd_reload_config(struct hostapd
- 	}
+@@ -192,21 +212,20 @@ int hostapd_reload_config(struct hostapd
+ 	oldconf = hapd->iconf;
  	iface->conf = newconf;
  
 +	for (i = 0; i < iface->num_hw_features; i++) {

package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch

@@ -1,39 +0,0 @@
---- a/wpa_supplicant/ap.c
-+++ b/wpa_supplicant/ap.c
-@@ -1363,15 +1363,35 @@ int ap_switch_channel(struct wpa_supplic
- 
- 
- #ifdef CONFIG_CTRL_IFACE
-+
-+static int __ap_ctrl_iface_chanswitch(struct hostapd_iface *iface,
-+				      struct csa_settings *settings)
-+{
-+#ifdef NEED_AP_MLME
-+	if (!iface || !iface->bss[0])
-+		return 0;
-+
-+	return hostapd_switch_channel(iface->bss[0], settings);
-+#else
-+	return -1;
-+#endif
-+}
-+
-+
- int ap_ctrl_iface_chanswitch(struct wpa_supplicant *wpa_s, const char *pos)
- {
- 	struct csa_settings settings;
- 	int ret = hostapd_parse_csa_settings(pos, &settings);
- 
-+	if (!(wpa_s->ap_iface && wpa_s->ap_iface->bss[0]) &&
-+	    !(wpa_s->ifmsh && wpa_s->ifmsh->bss[0]))
-+		return -1;
-+
-+	ret = __ap_ctrl_iface_chanswitch(wpa_s->ap_iface, &settings);
- 	if (ret)
- 		return ret;
- 
--	return ap_switch_channel(wpa_s, &settings);
-+	return __ap_ctrl_iface_chanswitch(wpa_s->ifmsh, &settings);
- }
- #endif /* CONFIG_CTRL_IFACE */
- 

package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch

@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -2634,10 +2634,15 @@ static int wpa_driver_nl80211_del_beacon
+@@ -2566,10 +2566,15 @@ static int wpa_driver_nl80211_del_beacon
  	struct nl_msg *msg;
  	struct wpa_driver_nl80211_data *drv = bss->drv;
  
@@ -18,7 +18,7 @@
  	return send_and_recv_msgs(drv, msg, NULL, NULL);
  }
  
-@@ -4919,7 +4924,7 @@ static void nl80211_teardown_ap(struct i
+@@ -4835,7 +4840,7 @@ static void nl80211_teardown_ap(struct i
  		nl80211_mgmt_unsubscribe(bss, "AP teardown");
  
  	nl80211_put_wiphy_data_ap(bss);
@@ -27,7 +27,7 @@
  }
  
  
-@@ -7160,8 +7165,6 @@ static int wpa_driver_nl80211_if_remove(
+@@ -7057,8 +7062,6 @@ static int wpa_driver_nl80211_if_remove(
  	} else {
  		wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
  		nl80211_teardown_ap(bss);
@@ -36,7 +36,7 @@
  		nl80211_destroy_bss(bss);
  		if (!bss->added_if)
  			i802_set_iface_flags(bss, 0);
-@@ -7540,7 +7543,6 @@ static int wpa_driver_nl80211_deinit_ap(
+@@ -7437,7 +7440,6 @@ static int wpa_driver_nl80211_deinit_ap(
  	if (!is_ap_interface(drv->nlmode))
  		return -1;
  	wpa_driver_nl80211_del_beacon(bss);
@@ -44,7 +44,7 @@
  
  	/*
  	 * If the P2P GO interface was dynamically added, then it is
-@@ -7560,7 +7562,6 @@ static int wpa_driver_nl80211_stop_ap(vo
+@@ -7457,7 +7459,6 @@ static int wpa_driver_nl80211_stop_ap(vo
  	if (!is_ap_interface(drv->nlmode))
  		return -1;
  	wpa_driver_nl80211_del_beacon(bss);

package/network/services/hostapd/patches/360-ctrl_iface_reload.patch

@@ -78,7 +78,7 @@
  
  #ifdef CONFIG_IEEE80211W
  #ifdef NEED_AP_MLME
-@@ -3084,6 +3141,8 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -3031,6 +3088,8 @@ static int hostapd_ctrl_iface_receive_pr
  	} else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
  		reply_len = hostapd_ctrl_iface_vendor(hapd, buf + 7, reply,
  						      reply_size);

package/network/services/hostapd/patches/370-ap_sta_support.patch

@@ -30,7 +30,7 @@
  #include "drivers/driver.h"
  #include "eap_peer/eap.h"
  #include "wpa_supplicant_i.h"
-@@ -294,6 +295,10 @@ void calculate_update_time(const struct
+@@ -292,6 +293,10 @@ void calculate_update_time(const struct
  static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src,
  			     struct os_reltime *fetch_time)
  {
@@ -41,7 +41,7 @@
  	dst->flags = src->flags;
  	os_memcpy(dst->bssid, src->bssid, ETH_ALEN);
  	dst->freq = src->freq;
-@@ -306,6 +311,15 @@ static void wpa_bss_copy_res(struct wpa_
+@@ -304,6 +309,15 @@ static void wpa_bss_copy_res(struct wpa_
  	dst->est_throughput = src->est_throughput;
  	dst->snr = src->snr;
  
@@ -59,7 +59,7 @@
  
 --- a/wpa_supplicant/bss.h
 +++ b/wpa_supplicant/bss.h
-@@ -82,6 +82,10 @@ struct wpa_bss {
+@@ -81,6 +81,10 @@ struct wpa_bss {
  	u8 ssid[SSID_MAX_LEN];
  	/** Length of SSID */
  	size_t ssid_len;
@@ -166,7 +166,7 @@
  /* Configure default/group WEP keys for static WEP */
  int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
  {
-@@ -920,12 +969,16 @@ void wpa_supplicant_set_state(struct wpa
+@@ -913,12 +962,16 @@ void wpa_supplicant_set_state(struct wpa
  
  		sme_sched_obss_scan(wpa_s, 1);
  
@@ -183,7 +183,7 @@
  		wpa_s->new_connection = 1;
  		wpa_drv_set_operstate(wpa_s, 0);
  #ifndef IEEE8021X_EAPOL
-@@ -1977,6 +2030,8 @@ void wpa_supplicant_associate(struct wpa
+@@ -1947,6 +2000,8 @@ void wpa_supplicant_associate(struct wpa
  			wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
  			ssid->id);
  		wpas_notify_mesh_group_started(wpa_s, ssid);
@@ -192,7 +192,7 @@
  #else /* CONFIG_MESH */
  		wpa_msg(wpa_s, MSG_ERROR,
  			"mesh mode support not included in the build");
-@@ -5487,6 +5542,16 @@ static int wpa_supplicant_init_iface(str
+@@ -5423,6 +5478,16 @@ static int wpa_supplicant_init_iface(str
  			   sizeof(wpa_s->bridge_ifname));
  	}
  
@@ -209,7 +209,7 @@
  	/* RSNA Supplicant Key Management - INITIALIZE */
  	eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
  	eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
-@@ -5808,6 +5873,11 @@ static void wpa_supplicant_deinit_iface(
+@@ -5744,6 +5809,11 @@ static void wpa_supplicant_deinit_iface(
  	if (terminate)
  		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
  
@@ -244,184 +244,3 @@
  	char *confname;
  	char *confanother;
  
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -2328,6 +2328,11 @@ static int hostapd_ctrl_iface_chan_switc
- 	if (ret)
- 		return ret;
- 
-+	if (os_strstr(pos, " auto-ht")) {
-+		settings.freq_params.ht_enabled = iface->conf->ieee80211n;
-+		settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
-+	}
-+
- 	for (i = 0; i < iface->num_bss; i++) {
- 
- 		/* Save CHAN_SWITCH VHT config */
---- a/src/ap/beacon.c
-+++ b/src/ap/beacon.c
-@@ -1381,11 +1381,6 @@ int ieee802_11_set_beacon(struct hostapd
- 	struct wpabuf *beacon, *proberesp, *assocresp;
- 	int res, ret = -1;
- 
--	if (hapd->csa_in_progress) {
--		wpa_printf(MSG_ERROR, "Cannot set beacons during CSA period");
--		return -1;
--	}
--
- 	hapd->beacon_set_done = 1;
- 
- 	if (ieee802_11_build_ap_params(hapd, &params) < 0)
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4469,6 +4469,13 @@ enum wpa_event_type {
- 	EVENT_CH_SWITCH,
- 
- 	/**
-+	 * EVENT_CH_SWITCH - AP or GO will switch channels soon
-+	 *
-+	 * Described in wpa_event_data.ch_switch
-+	 * */
-+	EVENT_CH_SWITCH_STARTED,
-+
-+	/**
- 	 * EVENT_WNM - Request WNM operation
- 	 *
- 	 * This event can be used to request a WNM operation to be performed.
-@@ -5306,6 +5313,7 @@ union wpa_event_data {
- 
- 	/**
- 	 * struct ch_switch
-+	 * @count: countdown until channel switch
- 	 * @freq: Frequency of new channel in MHz
- 	 * @ht_enabled: Whether this is an HT channel
- 	 * @ch_offset: Secondary channel offset
-@@ -5314,6 +5322,7 @@ union wpa_event_data {
- 	 * @cf2: Center frequency 2
- 	 */
- 	struct ch_switch {
-+		int count;
- 		int freq;
- 		int ht_enabled;
- 		int ch_offset;
---- a/src/drivers/driver_nl80211_event.c
-+++ b/src/drivers/driver_nl80211_event.c
-@@ -526,7 +526,8 @@ static int calculate_chan_offset(int wid
- static void mlme_event_ch_switch(struct wpa_driver_nl80211_data *drv,
- 				 struct nlattr *ifindex, struct nlattr *freq,
- 				 struct nlattr *type, struct nlattr *bw,
--				 struct nlattr *cf1, struct nlattr *cf2)
-+				 struct nlattr *cf1, struct nlattr *cf2,
-+				 struct nlattr *count)
- {
- 	struct i802_bss *bss;
- 	union wpa_event_data data;
-@@ -584,11 +585,15 @@ static void mlme_event_ch_switch(struct
- 		data.ch_switch.cf1 = nla_get_u32(cf1);
- 	if (cf2)
- 		data.ch_switch.cf2 = nla_get_u32(cf2);
-+	if (count)
-+		data.ch_switch.count = nla_get_u32(count);
- 
- 	bss->freq = data.ch_switch.freq;
- 	drv->assoc_freq = data.ch_switch.freq;
- 
--	wpa_supplicant_event(bss->ctx, EVENT_CH_SWITCH, &data);
-+	wpa_supplicant_event(bss->ctx,
-+			     count ? EVENT_CH_SWITCH_STARTED : EVENT_CH_SWITCH,
-+			     &data);
- }
- 
- 
-@@ -2446,6 +2451,7 @@ static void do_process_drv_event(struct
- 				   tb[NL80211_ATTR_PMK],
- 				   tb[NL80211_ATTR_PMKID]);
- 		break;
-+	case NL80211_CMD_CH_SWITCH_STARTED_NOTIFY:
- 	case NL80211_CMD_CH_SWITCH_NOTIFY:
- 		mlme_event_ch_switch(drv,
- 				     tb[NL80211_ATTR_IFINDEX],
-@@ -2453,7 +2459,8 @@ static void do_process_drv_event(struct
- 				     tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
- 				     tb[NL80211_ATTR_CHANNEL_WIDTH],
- 				     tb[NL80211_ATTR_CENTER_FREQ1],
--				     tb[NL80211_ATTR_CENTER_FREQ2]);
-+				     tb[NL80211_ATTR_CENTER_FREQ2],
-+				     tb[NL80211_ATTR_CH_SWITCH_COUNT]);
- 		break;
- 	case NL80211_CMD_DISCONNECT:
- 		mlme_event_disconnect(drv, tb[NL80211_ATTR_REASON_CODE],
---- a/wpa_supplicant/events.c
-+++ b/wpa_supplicant/events.c
-@@ -4026,6 +4026,60 @@ static void wpas_event_assoc_reject(stru
- }
- 
- 
-+static void
-+supplicant_ch_switch_started(struct wpa_supplicant *wpa_s,
-+			    union wpa_event_data *data)
-+{
-+	char buf[256];
-+	size_t len = sizeof(buf);
-+	char *cmd = NULL;
-+	int width = 20;
-+	int ret;
-+
-+	if (!wpa_s->hostapd)
-+		return;
-+
-+	wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CHANNEL_SWITCH
-+		"count=%d freq=%d ht_enabled=%d ch_offset=%d ch_width=%s cf1=%d cf2=%d",
-+		data->ch_switch.count,
-+		data->ch_switch.freq,
-+		data->ch_switch.ht_enabled,
-+		data->ch_switch.ch_offset,
-+		channel_width_to_string(data->ch_switch.ch_width),
-+		data->ch_switch.cf1,
-+		data->ch_switch.cf2);
-+
-+	switch (data->ch_switch.ch_width) {
-+	case CHAN_WIDTH_20_NOHT:
-+	case CHAN_WIDTH_20:
-+		width = 20;
-+		break;
-+	case CHAN_WIDTH_40:
-+		width = 40;
-+		break;
-+	case CHAN_WIDTH_80:
-+		width = 80;
-+		break;
-+	case CHAN_WIDTH_160:
-+	case CHAN_WIDTH_80P80:
-+		width = 160;
-+		break;
-+	}
-+
-+	asprintf(&cmd, "CHAN_SWITCH %d %d sec_channel_offset=%d center_freq1=%d center_freq2=%d, bandwidth=%d auto-ht\n",
-+		data->ch_switch.count - 1,
-+		data->ch_switch.freq,
-+		data->ch_switch.ch_offset,
-+		data->ch_switch.cf1,
-+		data->ch_switch.cf2,
-+		width);
-+	ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
-+	free(cmd);
-+
-+	if (ret < 0)
-+		wpa_printf(MSG_ERROR, "\nFailed to reload hostapd AP interfaces\n");
-+}
-+
- void supplicant_event(void *ctx, enum wpa_event_type event,
- 		      union wpa_event_data *data)
- {
-@@ -4309,6 +4363,10 @@ void supplicant_event(void *ctx, enum wp
- 				       data->rx_from_unknown.wds);
- 		break;
- #endif /* CONFIG_AP */
-+	case EVENT_CH_SWITCH_STARTED:
-+		supplicant_ch_switch_started(wpa_s, data);
-+		break;
-+
- 	case EVENT_CH_SWITCH:
- 		if (!data || !wpa_s->current_ssid)
- 			break;

package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch

@@ -12,7 +12,7 @@
  else
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -2912,6 +2912,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -2857,6 +2857,7 @@ static int hostapd_ctrl_iface_receive_pr
  						      reply_size);
  	} else if (os_strcmp(buf, "STATUS-DRIVER") == 0) {
  		reply_len = hostapd_drv_status(hapd, reply, reply_size);
@@ -20,7 +20,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -2953,6 +2954,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -2898,6 +2899,7 @@ static int hostapd_ctrl_iface_receive_pr
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
  							reply_size);
@@ -42,7 +42,7 @@
  
 --- a/wpa_supplicant/ctrl_iface.c
 +++ b/wpa_supplicant/ctrl_iface.c
-@@ -2117,7 +2117,7 @@ static int wpa_supplicant_ctrl_iface_sta
+@@ -2108,7 +2108,7 @@ static int wpa_supplicant_ctrl_iface_sta
  			pos += ret;
  		}
  
@@ -51,7 +51,7 @@
  		if (wpa_s->ap_iface) {
  			pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
  							    end - pos,
-@@ -9852,6 +9852,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -9825,6 +9825,7 @@ char * wpa_supplicant_ctrl_iface_process
  			reply_len = -1;
  	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
  		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
@@ -59,7 +59,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -9859,6 +9860,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -9832,6 +9833,7 @@ char * wpa_supplicant_ctrl_iface_process
  						      reply + reply_len,
  						      reply_size - reply_len);
  		}
@@ -67,7 +67,7 @@
  	} else if (os_strncmp(buf, "STATUS", 6) == 0) {
  		reply_len = wpa_supplicant_ctrl_iface_status(
  			wpa_s, buf + 6, reply, reply_size);
-@@ -10340,6 +10342,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -10313,6 +10315,7 @@ char * wpa_supplicant_ctrl_iface_process
  		reply_len = wpa_supplicant_ctrl_iface_bss(
  			wpa_s, buf + 4, reply, reply_size);
  #ifdef CONFIG_AP
@@ -75,7 +75,7 @@
  	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
  		reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
  	} else if (os_strncmp(buf, "STA ", 4) == 0) {
-@@ -10348,12 +10351,15 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -10321,12 +10324,15 @@ char * wpa_supplicant_ctrl_iface_process
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
  						   reply_size);
@@ -126,7 +126,7 @@
  		if (os_snprintf_error(buflen - len, ret))
 --- a/src/ap/ieee802_1x.c
 +++ b/src/ap/ieee802_1x.c
-@@ -2581,6 +2581,7 @@ static const char * bool_txt(Boolean val
+@@ -2555,6 +2555,7 @@ static const char * bool_txt(Boolean val
  	return val ? "TRUE" : "FALSE";
  }
  
@@ -134,7 +134,7 @@
  
  int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
  {
-@@ -2756,6 +2757,7 @@ int ieee802_1x_get_mib_sta(struct hostap
+@@ -2730,6 +2731,7 @@ int ieee802_1x_get_mib_sta(struct hostap
  	return len;
  }
  
@@ -144,7 +144,7 @@
  static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx)
 --- a/src/ap/wpa_auth.c
 +++ b/src/ap/wpa_auth.c
-@@ -3798,6 +3798,7 @@ static const char * wpa_bool_txt(int val
+@@ -3772,6 +3772,7 @@ static const char * wpa_bool_txt(int val
  	return val ? "TRUE" : "FALSE";
  }
  
@@ -152,7 +152,7 @@
  
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
-@@ -3942,7 +3943,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
+@@ -3916,7 +3917,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
  
  	return len;
  }
@@ -163,7 +163,7 @@
  {
 --- a/src/rsn_supp/wpa.c
 +++ b/src/rsn_supp/wpa.c
-@@ -2319,6 +2319,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
+@@ -2306,6 +2306,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
  }
  
  
@@ -172,7 +172,7 @@
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
  ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
-@@ -2402,6 +2404,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
+@@ -2389,6 +2391,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
  
  	return (int) len;
  }
@@ -182,7 +182,7 @@
  
 --- a/wpa_supplicant/ap.c
 +++ b/wpa_supplicant/ap.c
-@@ -1221,7 +1221,7 @@ int wpas_ap_wps_nfc_report_handover(stru
+@@ -1179,7 +1179,7 @@ int wpas_ap_wps_nfc_report_handover(stru
  #endif /* CONFIG_WPS */
  
  

package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch

@@ -1,6 +1,6 @@
 --- a/src/common/wpa_common.c
 +++ b/src/common/wpa_common.c
-@@ -2042,6 +2042,31 @@ u32 wpa_akm_to_suite(int akm)
+@@ -1849,6 +1849,31 @@ u32 wpa_akm_to_suite(int akm)
  }
  
  
@@ -32,7 +32,7 @@
  int wpa_compare_rsn_ie(int ft_initial_assoc,
  		       const u8 *ie1, size_t ie1len,
  		       const u8 *ie2, size_t ie2len)
-@@ -2049,8 +2074,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
+@@ -1856,8 +1881,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
  	if (ie1 == NULL || ie2 == NULL)
  		return -1;
  

package/network/services/hostapd/patches/410-limit_debug_messages.patch

@@ -1,6 +1,6 @@
 --- a/src/utils/wpa_debug.c
 +++ b/src/utils/wpa_debug.c
-@@ -205,7 +205,7 @@ void wpa_debug_close_linux_tracing(void)
+@@ -201,7 +201,7 @@ void wpa_debug_close_linux_tracing(void)
   *
   * Note: New line '\n' is added to the end of the text when printing to stdout.
   */
@@ -9,7 +9,7 @@
  {
  	va_list ap;
  
-@@ -252,8 +252,8 @@ void wpa_printf(int level, const char *f
+@@ -248,8 +248,8 @@ void wpa_printf(int level, const char *f
  }
  
  
@@ -20,7 +20,7 @@
  {
  	size_t i;
  
-@@ -379,20 +379,8 @@ static void _wpa_hexdump(int level, cons
+@@ -375,20 +375,8 @@ static void _wpa_hexdump(int level, cons
  #endif /* CONFIG_ANDROID_LOG */
  }
  
@@ -43,7 +43,7 @@
  {
  	size_t i, llen;
  	const u8 *pos = buf;
-@@ -499,20 +487,6 @@ static void _wpa_hexdump_ascii(int level
+@@ -495,20 +483,6 @@ static void _wpa_hexdump_ascii(int level
  }
  
  
@@ -64,7 +64,7 @@
  #ifdef CONFIG_DEBUG_FILE
  static char *last_path = NULL;
  #endif /* CONFIG_DEBUG_FILE */
-@@ -628,7 +602,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_
+@@ -604,7 +578,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_
  }
  
  
@@ -73,7 +73,7 @@
  {
  	va_list ap;
  	char *buf;
-@@ -666,7 +640,7 @@ void wpa_msg(void *ctx, int level, const
+@@ -642,7 +616,7 @@ void wpa_msg(void *ctx, int level, const
  }
  
  

package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch

@@ -22,7 +22,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  #include "common/defs.h"
  #include "common/ieee802_11_defs.h"
  #include "common/wpa_common.h"
-@@ -774,6 +775,9 @@ struct wpa_driver_associate_params {
+@@ -762,6 +763,9 @@ struct wpa_driver_associate_params {
  	 * responsible for selecting with which BSS to associate. */
  	const u8 *bssid;
  
@@ -42,7 +42,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  #include "config.h"
  
  
-@@ -2053,6 +2054,97 @@ static char * wpa_config_write_peerkey(c
+@@ -2037,6 +2038,97 @@ static char * wpa_config_write_peerkey(c
  #endif /* NO_CONFIG_WRITE */
  
  
@@ -140,7 +140,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  /* Helper macros for network block parser */
  
  #ifdef OFFSET
-@@ -2298,6 +2390,8 @@ static const struct parse_data ssid_fiel
+@@ -2282,6 +2374,8 @@ static const struct parse_data ssid_fiel
  	{ INT(ap_max_inactivity) },
  	{ INT(dtim_period) },
  	{ INT(beacon_int) },
@@ -174,7 +174,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  	 * macsec_policy - Determines the policy for MACsec secure session
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -3117,6 +3117,12 @@ static void wpas_start_assoc_cb(struct w
+@@ -3061,6 +3061,12 @@ static void wpas_start_assoc_cb(struct w
  			params.beacon_int = ssid->beacon_int;
  		else
  			params.beacon_int = wpa_s->conf->beacon_int;

package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch

@@ -10,7 +10,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
 
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -5178,7 +5178,7 @@ static int wpa_driver_nl80211_ibss(struc
+@@ -5094,7 +5094,7 @@ static int wpa_driver_nl80211_ibss(struc
  				   struct wpa_driver_associate_params *params)
  {
  	struct nl_msg *msg;
@@ -19,7 +19,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  	int count = 0;
  
  	wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
-@@ -5205,6 +5205,37 @@ retry:
+@@ -5121,6 +5121,37 @@ retry:
  	    nl80211_put_beacon_int(msg, params->beacon_int))
  		goto fail;
  

package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch

@@ -19,7 +19,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
 
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -1409,6 +1409,7 @@ struct wpa_driver_mesh_join_params {
+@@ -1397,6 +1397,7 @@ struct wpa_driver_mesh_join_params {
  #define WPA_DRIVER_MESH_FLAG_AMPE	0x00000008
  	unsigned int flags;
  	u8 handle_dfs;
@@ -29,7 +29,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
  /**
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -9352,6 +9352,18 @@ static int nl80211_put_mesh_id(struct nl
+@@ -9248,6 +9248,18 @@ static int nl80211_put_mesh_id(struct nl
  }
  
  
@@ -48,7 +48,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
  static int nl80211_put_mesh_config(struct nl_msg *msg,
  				   struct wpa_driver_mesh_bss_params *params)
  {
-@@ -9413,6 +9425,7 @@ static int nl80211_join_mesh(struct i802
+@@ -9309,6 +9321,7 @@ static int nl80211_join_mesh(struct i802
  	    nl80211_put_basic_rates(msg, params->basic_rates) ||
  	    nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) ||
  	    nl80211_put_beacon_int(msg, params->beacon_int) ||

package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch

@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2154,11 +2154,13 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2124,11 +2124,13 @@ void ibss_mesh_setup_freq(struct wpa_sup
  	for (j = 0; j < wpa_s->last_scan_res_used; j++) {
  		struct wpa_bss *bss = wpa_s->last_scan_res[j];
  

package/network/services/hostapd/patches/500-lto-jobserver-support.patch

@@ -1,50 +0,0 @@
---- a/hostapd/Makefile
-+++ b/hostapd/Makefile
-@@ -1290,14 +1290,14 @@ hostapd_multi.a: $(BCHECK) $(OBJS)
- 	@$(AR) cr $@ hostapd_multi.o $(OBJS)
- 
- hostapd: $(BCHECK) $(OBJS)
--	$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
-+	+$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
- 	@$(E) "  LD " $@
- 
- ifdef CONFIG_WPA_TRACE
- OBJS_c += ../src/utils/trace.o
- endif
- hostapd_cli: $(OBJS_c)
--	$(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c)
-+	+$(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c)
- 	@$(E) "  LD " $@
- 
- NOBJS = nt_password_hash.o ../src/crypto/ms_funcs.o $(SHA1OBJS)
---- a/wpa_supplicant/Makefile
-+++ b/wpa_supplicant/Makefile
-@@ -1921,23 +1921,23 @@ wpa_supplicant_multi.a: .config $(BCHECK
- 	@$(AR) cr $@ wpa_supplicant_multi.o $(OBJS)
- 
- wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
--	$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
-+	+$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
- 	@$(E) "  LD " $@
- 
- eapol_test: $(OBJS_t)
--	$(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS)
-+	+$(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS)
- 	@$(E) "  LD " $@
- 
- preauth_test: $(OBJS_t2)
--	$(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS)
-+	+$(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS)
- 	@$(E) "  LD " $@
- 
- wpa_passphrase: $(OBJS_p)
--	$(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS)
-+	+$(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS)
- 	@$(E) "  LD " $@
- 
- wpa_cli: $(OBJS_c)
--	$(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c)
-+	+$(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c)
- 	@$(E) "  LD " $@
- 
- LIBCTRL += ../src/common/wpa_ctrl.o

package/network/services/hostapd/patches/550-hostapd-Add-Multi-AP-protocol-support.patch

@@ -1,306 +0,0 @@
-From 9c06f0f6aed26c1628acaa74df0232dd7b345e9a Mon Sep 17 00:00:00 2001
-From: Venkateswara Naralasetty <vnaralas@codeaurora.org>
-Date: Wed, 5 Dec 2018 11:23:51 +0100
-Subject: [PATCH] hostapd: Add Multi-AP protocol support
-
-The purpose of Multi-AP specification is to enable inter-operability
-across Wi-Fi access points (APs) from different vendors.
-
-This patch introduces one new configuration parameter 'multi_ap' to
-enable Multi-AP functionality and to configure the BSS as a backhaul
-and/or fronthaul BSS.
-
-Advertise vendor specific Multi-AP capabilities in (Re)Association
-Response frame, if Multi-AP functionality is enabled through the
-configuration parameter.
-
-A backhaul AP must support receiving both 3addr and 4addr frames from a
-backhaul STA, so create a VLAN for it just like is done for WDS, i.e.,
-by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never
-WEP), we can safely call hostapd_set_wds_encryption() as well and we can
-reuse the entire WDS condition.
-
-To parse the Multi-AP Extension subelement, we use get_ie(): even though
-that function is meant for parsing IEs, it works for subelements.
-
-Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org>
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
----
- hostapd/config_file.c          | 10 +++++
- hostapd/hostapd.conf           |  7 ++++
- src/ap/ap_config.h             |  4 ++
- src/ap/ieee802_11.c            | 77 +++++++++++++++++++++++++++++++++-
- src/ap/sta_info.c              |  2 +-
- src/ap/sta_info.h              |  1 +
- src/common/ieee802_11_common.c | 24 +++++++++++
- src/common/ieee802_11_common.h |  4 ++
- src/common/ieee802_11_defs.h   |  7 ++++
- 9 files changed, 134 insertions(+), 2 deletions(-)
-
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4115,6 +4115,16 @@ static int hostapd_config_fill(struct ho
- 	} else if (os_strcmp(buf, "coloc_intf_reporting") == 0) {
- 		bss->coloc_intf_reporting = atoi(pos);
- #endif /* CONFIG_OWE */
-+	} else if (os_strcmp(buf, "multi_ap") == 0) {
-+		int val = atoi(pos);
-+
-+		if (val < 0 || val > 3) {
-+			wpa_printf(MSG_ERROR, "Line %d: Invalid multi_ap '%s'",
-+				   line, buf);
-+			return -1;
-+		}
-+
-+		bss->multi_ap = val;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
---- a/hostapd/hostapd.conf
-+++ b/hostapd/hostapd.conf
-@@ -438,6 +438,13 @@ wmm_ac_vo_txop_limit=47
- wmm_ac_vo_acm=0
- # Note: for IEEE 802.11b mode: cWmin=3 cWmax=4 burst=102
- 
-+# Enable Multi-AP functionality
-+# 0 = disabled (default)
-+# 1 = AP support backhaul BSS
-+# 2 = AP support fronthaul BSS
-+# 3 = AP supports both backhaul BSS and fronthaul BSS
-+#multi_ap=0
-+
- # Static WEP key configuration
- #
- # The key number to use when transmitting.
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -688,6 +688,10 @@ struct hostapd_bss_config {
- #endif /* CONFIG_OWE */
- 
- 	int coloc_intf_reporting;
-+
-+#define BACKHAUL_BSS 1
-+#define FRONTHAUL_BSS 2
-+	int multi_ap; /* bitmap of BACKHAUL_BSS, FRONTHAUL_BSS */
- };
- 
- /**
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -62,6 +62,22 @@ prepare_auth_resp_fils(struct hostapd_da
- 		       int *is_pub);
- #endif /* CONFIG_FILS */
- 
-+
-+u8 * hostapd_eid_multi_ap(struct hostapd_data *hapd, u8 *eid)
-+{
-+	u8 multi_ap_val = 0;
-+
-+	if (!hapd->conf->multi_ap)
-+		return eid;
-+	if (hapd->conf->multi_ap & BACKHAUL_BSS)
-+		multi_ap_val |= MULTI_AP_BACKHAUL_BSS;
-+	if (hapd->conf->multi_ap & FRONTHAUL_BSS)
-+		multi_ap_val |= MULTI_AP_FRONTHAUL_BSS;
-+
-+	return eid + add_multi_ap_ie(eid, 9, multi_ap_val);
-+}
-+
-+
- u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
- {
- 	u8 *pos = eid;
-@@ -2210,6 +2226,57 @@ static u16 check_wmm(struct hostapd_data
- 	return WLAN_STATUS_SUCCESS;
- }
- 
-+static u16 check_multi_ap(struct hostapd_data *hapd, struct sta_info *sta,
-+			  const u8 *multi_ap_ie, size_t multi_ap_len)
-+{
-+	u8 multi_ap_value = 0;
-+
-+	sta->flags &= ~WLAN_STA_MULTI_AP;
-+
-+	if (!hapd->conf->multi_ap)
-+		return WLAN_STATUS_SUCCESS;
-+
-+	if (multi_ap_ie) {
-+		const u8 *multi_ap_subelem;
-+
-+		multi_ap_subelem = get_ie(multi_ap_ie + 4,
-+					  multi_ap_len - 4,
-+					  MULTI_AP_SUB_ELEM_TYPE);
-+		if (multi_ap_subelem && multi_ap_subelem[1] == 1) {
-+			multi_ap_value = multi_ap_subelem[2];
-+		} else {
-+			hostapd_logger(hapd, sta->addr,
-+				       HOSTAPD_MODULE_IEEE80211,
-+				       HOSTAPD_LEVEL_INFO,
-+				       "Multi-AP IE has missing or invalid Multi-AP subelement");
-+			return WLAN_STATUS_INVALID_IE;
-+		}
-+	}
-+
-+	if (multi_ap_value == MULTI_AP_BACKHAUL_STA)
-+		sta->flags |= WLAN_STA_MULTI_AP;
-+
-+	if ((hapd->conf->multi_ap & BACKHAUL_BSS) &&
-+	    multi_ap_value == MULTI_AP_BACKHAUL_STA)
-+		return WLAN_STATUS_SUCCESS;
-+
-+	if (hapd->conf->multi_ap & FRONTHAUL_BSS) {
-+		if (multi_ap_value == MULTI_AP_BACKHAUL_STA) {
-+			hostapd_logger(hapd, sta->addr,
-+				       HOSTAPD_MODULE_IEEE80211,
-+				       HOSTAPD_LEVEL_INFO,
-+				       "Backhaul STA tries to associate with fronthaul-only BSS");
-+			return WLAN_STATUS_ASSOC_DENIED_UNSPEC;
-+		}
-+		return WLAN_STATUS_SUCCESS;
-+	}
-+
-+	hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
-+		       HOSTAPD_LEVEL_INFO,
-+		       "Non-Multi-AP STA tries to associate with backhaul-only BSS");
-+	return WLAN_STATUS_ASSOC_DENIED_UNSPEC;
-+}
-+
- 
- static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
- 			   struct ieee802_11_elems *elems)
-@@ -2466,6 +2533,11 @@ static u16 check_assoc_ies(struct hostap
- 	resp = copy_supp_rates(hapd, sta, &elems);
- 	if (resp != WLAN_STATUS_SUCCESS)
- 		return resp;
-+
-+	resp = check_multi_ap(hapd, sta, elems.multi_ap, elems.multi_ap_len);
-+	if (resp != WLAN_STATUS_SUCCESS)
-+		return resp;
-+
- #ifdef CONFIG_IEEE80211N
- 	resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities);
- 	if (resp != WLAN_STATUS_SUCCESS)
-@@ -2996,6 +3068,9 @@ static u16 send_assoc_resp(struct hostap
- 	}
- #endif /* CONFIG_WPS */
- 
-+	if (sta && (sta->flags & WLAN_STA_MULTI_AP))
-+		p = hostapd_eid_multi_ap(hapd, p);
-+
- #ifdef CONFIG_P2P
- 	if (sta && sta->p2p_ie && hapd->p2p_group) {
- 		struct wpabuf *p2p_resp_ie;
-@@ -4236,7 +4311,7 @@ static void handle_assoc_cb(struct hosta
- 		sta->flags |= WLAN_STA_WDS;
- 	}
- 
--	if (sta->flags & WLAN_STA_WDS) {
-+	if (sta->flags & (WLAN_STA_WDS | WLAN_STA_MULTI_AP)) {
- 		int ret;
- 		char ifname_wds[IFNAMSIZ + 1];
- 
---- a/src/ap/sta_info.c
-+++ b/src/ap/sta_info.c
-@@ -166,7 +166,7 @@ void ap_free_sta(struct hostapd_data *ha
- 	/* just in case */
- 	ap_sta_set_authorized(hapd, sta, 0);
- 
--	if (sta->flags & WLAN_STA_WDS)
-+	if (sta->flags & (WLAN_STA_WDS | WLAN_STA_MULTI_AP))
- 		hostapd_set_wds_sta(hapd, NULL, sta->addr, sta->aid, 0);
- 
- 	if (sta->ipaddr)
---- a/src/ap/sta_info.h
-+++ b/src/ap/sta_info.h
-@@ -36,6 +36,7 @@
- #define WLAN_STA_VHT_OPMODE_ENABLED BIT(20)
- #define WLAN_STA_VENDOR_VHT BIT(21)
- #define WLAN_STA_PENDING_FILS_ERP BIT(22)
-+#define WLAN_STA_MULTI_AP BIT(23)
- #define WLAN_STA_PENDING_DISASSOC_CB BIT(29)
- #define WLAN_STA_PENDING_DEAUTH_CB BIT(30)
- #define WLAN_STA_NONERP BIT(31)
---- a/src/common/ieee802_11_common.c
-+++ b/src/common/ieee802_11_common.c
-@@ -126,6 +126,10 @@ static int ieee802_11_parse_vendor_speci
- 			elems->roaming_cons_sel = pos;
- 			elems->roaming_cons_sel_len = elen;
- 			break;
-+		case MULTI_AP_OUI_TYPE:
-+			elems->multi_ap = pos;
-+			elems->multi_ap_len = elen;
-+			break;
- 		default:
- 			wpa_printf(MSG_MSGDUMP, "Unknown WFA "
- 				   "information element ignored "
-@@ -1519,6 +1523,26 @@ size_t mbo_add_ie(u8 *buf, size_t len, c
- }
- 
- 
-+size_t add_multi_ap_ie(u8 *buf, size_t len, u8 value)
-+{
-+	u8 *pos = buf;
-+
-+	if (len < 9)
-+		return 0;
-+
-+	*pos++ = WLAN_EID_VENDOR_SPECIFIC;
-+	*pos++ = 7; /* len */
-+	WPA_PUT_BE24(pos, OUI_WFA);
-+	pos += 3;
-+	*pos++ = MULTI_AP_OUI_TYPE;
-+	*pos++ = MULTI_AP_SUB_ELEM_TYPE;
-+	*pos++ = 1; /* len */
-+	*pos++ = value;
-+
-+	return pos - buf;
-+}
-+
-+
- static const struct country_op_class us_op_class[] = {
- 	{ 1, 115 },
- 	{ 2, 118 },
---- a/src/common/ieee802_11_common.h
-+++ b/src/common/ieee802_11_common.h
-@@ -84,6 +84,7 @@ struct ieee802_11_elems {
- 	const u8 *power_capab;
- 	const u8 *roaming_cons_sel;
- 	const u8 *password_id;
-+	const u8 *multi_ap;
- 
- 	u8 ssid_len;
- 	u8 supp_rates_len;
-@@ -130,6 +131,7 @@ struct ieee802_11_elems {
- 	u8 power_capab_len;
- 	u8 roaming_cons_sel_len;
- 	u8 password_id_len;
-+	u8 multi_ap_len;
- 
- 	struct mb_ies_info mb_ies;
- };
-@@ -189,6 +191,8 @@ const u8 * get_ie_ext(const u8 *ies, siz
- 
- size_t mbo_add_ie(u8 *buf, size_t len, const u8 *attr, size_t attr_len);
- 
-+size_t add_multi_ap_ie(u8 *buf, size_t len, u8 value);
-+
- struct country_op_class {
- 	u8 country_op_class;
- 	u8 global_op_class;
---- a/src/common/ieee802_11_defs.h
-+++ b/src/common/ieee802_11_defs.h
-@@ -1210,6 +1210,13 @@ struct ieee80211_ampe_ie {
- #define MBO_OUI_TYPE 22
- #define OWE_IE_VENDOR_TYPE 0x506f9a1c
- #define OWE_OUI_TYPE 28
-+#define MULTI_AP_OUI_TYPE 0x1B
-+
-+#define MULTI_AP_SUB_ELEM_TYPE 0x06
-+#define MULTI_AP_TEAR_DOWN BIT(4)
-+#define MULTI_AP_FRONTHAUL_BSS BIT(5)
-+#define MULTI_AP_BACKHAUL_BSS BIT(6)
-+#define MULTI_AP_BACKHAUL_STA BIT(7)
- 
- #define WMM_OUI_TYPE 2
- #define WMM_OUI_SUBTYPE_INFORMATION_ELEMENT 0

package/network/services/hostapd/patches/551-wpa_supplicant-Add-Multi-AP-protocol-support-to-supp.patch

@@ -1,311 +0,0 @@
-From 5abc7823bd01f69b8afbe1fd19f65fff86137c44 Mon Sep 17 00:00:00 2001
-From: Venkateswara Naralasetty <vnaralas@codeaurora.org>
-Date: Wed, 5 Dec 2018 11:23:53 +0100
-Subject: [PATCH] wpa_supplicant: Add Multi-AP backhaul STA support
-
-Advertise vendor specific Multi-AP IE in (Re)Association Request frames
-and process Multi-AP IE from (Re)Association Response frames if the user
-enables Multi-AP fuctionality. If the (Re)Association Response frame
-does not contain the Multi-AP IE, disassociate.
-
-This adds a new configuration parameter 'multi_ap_backhaul_sta' to
-enable/disable Multi-AP functionality.
-
-Enable 4-address mode after association (if the Association Response
-frame contains the Multi-AP IE). Also enable the bridge in that case.
-This is necessary because wpa_supplicant only enables the bridge in
-wpa_drv_if_add(), which only gets called when an interface is added
-through the control interface, not when it is configured from the
-command line.
-
-Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org>
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
----
- src/drivers/driver.h               |  9 ++++++
- src/drivers/driver_nl80211.c       | 44 ++++++++++++++++++++++++++
- wpa_supplicant/config.c            |  1 +
- wpa_supplicant/config_ssid.h       |  7 +++++
- wpa_supplicant/driver_i.h          |  8 +++++
- wpa_supplicant/events.c            | 50 ++++++++++++++++++++++++++++++
- wpa_supplicant/sme.c               | 16 ++++++++++
- wpa_supplicant/wpa_supplicant.c    | 18 +++++++++++
- wpa_supplicant/wpa_supplicant.conf |  7 +++++
- wpa_supplicant/wpa_supplicant_i.h  |  1 +
- 10 files changed, 161 insertions(+)
-
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4100,6 +4100,15 @@ struct wpa_driver_ops {
- 	 */
- 	int (*send_external_auth_status)(void *priv,
- 					 struct external_auth *params);
-+
-+	/**
-+	 * set_4addr_mode - Set 4-address mode
-+	 * @priv: Private driver interface data
-+	 * @bridge_ifname: Bridge interface name
-+	 * @val: 0 - disable 4addr mode, 1 - enable 4addr mode
-+	 * Returns: 0 on success, < 0 on failure
-+	 */
-+	int (*set_4addr_mode)(void *priv, const char *bridge_ifname, int val);
- };
- 
- /**
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -10728,6 +10728,49 @@ fail:
- }
- 
- 
-+static int nl80211_set_4addr_mode(void *priv, const char *bridge_ifname,
-+				  int val)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	int ret = -ENOBUFS;
-+
-+	wpa_printf(MSG_DEBUG, "nl80211: %s 4addr mode (bridge_ifname: %s)",
-+		   val ? "Enable" : "Disable", bridge_ifname);
-+
-+	msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_SET_INTERFACE);
-+	if (!msg || nla_put_u8(msg, NL80211_ATTR_4ADDR, val))
-+		goto fail;
-+
-+	if (bridge_ifname[0] && bss->added_if_into_bridge && !val) {
-+		if (linux_br_del_if(drv->global->ioctl_sock,
-+				    bridge_ifname, bss->ifname)) {
-+			wpa_printf(MSG_ERROR,
-+				   "nl80211: Failed to remove interface %s from bridge %s",
-+				   bss->ifname, bridge_ifname);
-+			return -1;
-+		}
-+		bss->added_if_into_bridge = 0;
-+	}
-+
-+	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
-+	msg = NULL;
-+	if (!ret) {
-+		if (bridge_ifname[0] && val &&
-+		    i802_check_bridge(drv, bss, bridge_ifname, bss->ifname) < 0)
-+			return -1;
-+		return 0;
-+	}
-+
-+fail:
-+	nlmsg_free(msg);
-+	wpa_printf(MSG_ERROR, "nl80211: Failed to enable/disable 4addr");
-+
-+	return ret;
-+}
-+
-+
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
- 	.desc = "Linux nl80211/cfg80211",
-@@ -10856,4 +10899,5 @@ const struct wpa_driver_ops wpa_driver_n
- 	.get_ext_capab = nl80211_get_ext_capab,
- 	.update_connect_params = nl80211_update_connection_params,
- 	.send_external_auth_status = nl80211_send_external_auth_status,
-+	.set_4addr_mode = nl80211_set_4addr_mode,
- };
---- a/wpa_supplicant/config.c
-+++ b/wpa_supplicant/config.c
-@@ -2416,6 +2416,7 @@ static const struct parse_data ssid_fiel
- #endif /* CONFIG_DPP */
- 	{ INT_RANGE(owe_group, 0, 65535) },
- 	{ INT_RANGE(owe_only, 0, 1) },
-+	{ INT_RANGE(multi_ap_backhaul_sta, 0, 1) },
- };
- 
- #undef OFFSET
---- a/wpa_supplicant/config_ssid.h
-+++ b/wpa_supplicant/config_ssid.h
-@@ -950,6 +950,13 @@ struct wpa_ssid {
- 	 * the selection attempts for OWE BSS exceed the configured threshold.
- 	 */
- 	int owe_transition_bss_select_count;
-+
-+	/**
-+	 * multi_ap_backhaul_sta - Multi-AP backhaul STA
-+	 * 0 = normal (non-Multi-AP) station
-+	 * 1 = Multi-AP backhaul station
-+	 */
-+	int multi_ap_backhaul_sta;
- };
- 
- #endif /* CONFIG_SSID_H */
---- a/wpa_supplicant/driver_i.h
-+++ b/wpa_supplicant/driver_i.h
-@@ -1046,4 +1046,12 @@ wpa_drv_send_external_auth_status(struct
- 							params);
- }
- 
-+static inline int wpa_drv_set_4addr_mode(struct wpa_supplicant *wpa_s, int val)
-+{
-+	if (!wpa_s->driver->set_4addr_mode)
-+		return -1;
-+	return wpa_s->driver->set_4addr_mode(wpa_s->drv_priv,
-+					     wpa_s->bridge_ifname, val);
-+}
-+
- #endif /* DRIVER_I_H */
---- a/wpa_supplicant/events.c
-+++ b/wpa_supplicant/events.c
-@@ -324,6 +324,9 @@ void wpa_supplicant_mark_disassoc(struct
- 	os_memset(wpa_s->last_tk, 0, sizeof(wpa_s->last_tk));
- #endif /* CONFIG_TESTING_OPTIONS */
- 	wpa_s->ieee80211ac = 0;
-+
-+	if (wpa_s->enabled_4addr_mode && wpa_drv_set_4addr_mode(wpa_s, 0) == 0)
-+		wpa_s->enabled_4addr_mode = 0;
- }
- 
- 
-@@ -2267,6 +2270,50 @@ static void interworking_process_assoc_r
- #endif /* CONFIG_INTERWORKING */
- 
- 
-+static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s,
-+					const u8 *ies, size_t ies_len)
-+{
-+	struct ieee802_11_elems elems;
-+	const u8 *map_sub_elem, *pos;
-+	size_t len;
-+
-+	if (!wpa_s->current_ssid ||
-+	    !wpa_s->current_ssid->multi_ap_backhaul_sta ||
-+	    !ies ||
-+	    ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed)
-+		return;
-+
-+	if (!elems.multi_ap || elems.multi_ap_len < 7) {
-+		wpa_printf(MSG_INFO, "AP doesn't support Multi-AP protocol");
-+		goto fail;
-+	}
-+
-+	pos = elems.multi_ap + 4;
-+	len = elems.multi_ap_len - 4;
-+
-+	map_sub_elem = get_ie(pos, len, MULTI_AP_SUB_ELEM_TYPE);
-+	if (!map_sub_elem || map_sub_elem[1] < 1) {
-+		wpa_printf(MSG_INFO, "invalid Multi-AP sub elem type");
-+		goto fail;
-+	}
-+
-+	if (!(map_sub_elem[2] & MULTI_AP_BACKHAUL_BSS)) {
-+		wpa_printf(MSG_INFO, "AP doesn't support backhaul BSS");
-+		goto fail;
-+	}
-+
-+	if (wpa_drv_set_4addr_mode(wpa_s, 1) < 0) {
-+		wpa_printf(MSG_ERROR, "Failed to set 4addr mode");
-+		goto fail;
-+	}
-+	wpa_s->enabled_4addr_mode = 1;
-+	return;
-+
-+fail:
-+	wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
-+}
-+
-+
- #ifdef CONFIG_FST
- static int wpas_fst_update_mbie(struct wpa_supplicant *wpa_s,
- 				const u8 *ie, size_t ie_len)
-@@ -2343,6 +2390,9 @@ static int wpa_supplicant_event_associnf
- 		    get_ie(data->assoc_info.resp_ies,
- 			   data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP))
- 			wpa_s->ieee80211ac = 1;
-+
-+		multi_ap_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
-+					    data->assoc_info.resp_ies_len);
- 	}
- 	if (data->assoc_info.beacon_ies)
- 		wpa_hexdump(MSG_DEBUG, "beacon_ies",
---- a/wpa_supplicant/sme.c
-+++ b/wpa_supplicant/sme.c
-@@ -1552,6 +1552,22 @@ void sme_associate(struct wpa_supplicant
- 	}
- #endif /* CONFIG_OWE */
- 
-+	if (wpa_s->current_ssid && wpa_s->current_ssid->multi_ap_backhaul_sta) {
-+		size_t multi_ap_ie_len;
-+
-+		multi_ap_ie_len = add_multi_ap_ie(
-+			wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
-+			sizeof(wpa_s->sme.assoc_req_ie) -
-+			wpa_s->sme.assoc_req_ie_len,
-+			MULTI_AP_BACKHAUL_STA);
-+		if (multi_ap_ie_len == 0) {
-+			wpa_printf(MSG_ERROR,
-+				   "Multi-AP: Failed to build Multi-AP IE");
-+			return;
-+		}
-+		wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len;
-+	}
-+
- 	params.bssid = bssid;
- 	params.ssid = wpa_s->sme.ssid;
- 	params.ssid_len = wpa_s->sme.ssid_len;
---- a/wpa_supplicant/wpa_supplicant.c
-+++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2893,6 +2893,21 @@ static u8 * wpas_populate_assoc_ies(
- 	}
- #endif /* CONFIG_IEEE80211R */
- 
-+	if (ssid->multi_ap_backhaul_sta) {
-+		size_t multi_ap_ie_len;
-+
-+		multi_ap_ie_len = add_multi_ap_ie(wpa_ie + wpa_ie_len,
-+						  max_wpa_ie_len - wpa_ie_len,
-+						  MULTI_AP_BACKHAUL_STA);
-+		if (multi_ap_ie_len == 0) {
-+			wpa_printf(MSG_ERROR,
-+				   "Multi-AP: Failed to build Multi-AP IE");
-+			os_free(wpa_ie);
-+			return NULL;
-+		}
-+		wpa_ie_len += multi_ap_ie_len;
-+	}
-+
- 	params->wpa_ie = wpa_ie;
- 	params->wpa_ie_len = wpa_ie_len;
- 	params->auth_alg = algs;
-@@ -3377,6 +3392,9 @@ void wpa_supplicant_deauthenticate(struc
- 		zero_addr = 1;
- 	}
- 
-+	if (wpa_s->enabled_4addr_mode && wpa_drv_set_4addr_mode(wpa_s, 0) == 0)
-+		wpa_s->enabled_4addr_mode = 0;
-+
- #ifdef CONFIG_TDLS
- 	wpa_tdls_teardown_peers(wpa_s->wpa);
- #endif /* CONFIG_TDLS */
---- a/wpa_supplicant/wpa_supplicant.conf
-+++ b/wpa_supplicant/wpa_supplicant.conf
-@@ -1399,6 +1399,13 @@ fast_reauth=1
- #  2: MCS 0-9
- #  3: not supported
- 
-+# multi_ap_backhaul_sta: Multi-AP backhaul STA functionality
-+# 0 = normal STA (default)
-+# 1 = backhaul STA
-+# A backhaul STA sends the Multi-AP IE, fails to associate if the AP does not
-+# support Multi-AP, and sets 4-address mode if it does. Thus, the netdev can be
-+# added to a bridge to allow forwarding frames over this backhaul link.
-+
- ##### Fast Session Transfer (FST) support #####################################
- #
- # The options in this section are only available when the build configuration
---- a/wpa_supplicant/wpa_supplicant_i.h
-+++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -1242,6 +1242,7 @@ struct wpa_supplicant {
- 	unsigned int disable_fils:1;
- #endif /* CONFIG_FILS */
- 	unsigned int ieee80211ac:1;
-+	unsigned int enabled_4addr_mode:1;
- };
- 
- 

package/network/services/hostapd/patches/552-tests-Multi-AP-association.patch

@@ -1,100 +0,0 @@
-From 7488e0ade6dffb6df4c1fb6526a9f3ede0eb18ef Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jouni@codeaurora.org>
-Date: Thu, 20 Dec 2018 12:41:00 +0200
-Subject: [PATCH] tests: Multi-AP association
-
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
----
- tests/hwsim/test_multi_ap.py | 73 ++++++++++++++++++++++++++++++++++++
- tests/hwsim/wpasupplicant.py |  3 +-
- 2 files changed, 75 insertions(+), 1 deletion(-)
- create mode 100644 tests/hwsim/test_multi_ap.py
-
---- /dev/null
-+++ b/tests/hwsim/test_multi_ap.py
-@@ -0,0 +1,73 @@
-+# Test cases for Multi-AP
-+# Copyright (c) 2018, The Linux Foundation
-+#
-+# This software may be distributed under the terms of the BSD license.
-+# See README for more details.
-+
-+import hostapd
-+
-+def test_multi_ap_association(dev, apdev):
-+    """Multi-AP association in backhaul BSS"""
-+    run_multi_ap_association(dev, apdev, 1)
-+    dev[1].connect("multi-ap", psk="12345678", scan_freq="2412",
-+                   wait_connect=False)
-+    ev = dev[1].wait_event([ "CTRL-EVENT-DISCONNECTED",
-+                             "CTRL-EVENT-CONNECTED",
-+                             "CTRL-EVENT-ASSOC-REJECT" ],
-+                           timeout=5)
-+    dev[1].request("DISCONNECT")
-+    if ev is None:
-+        raise Exception("Connection result not reported")
-+    if "CTRL-EVENT-ASSOC-REJECT" not in ev:
-+        raise Exception("Association rejection not reported")
-+    if "status_code=12" not in ev:
-+        raise Exception("Unexpected association status code: " + ev)
-+
-+def test_multi_ap_association_shared_bss(dev, apdev):
-+    """Multi-AP association in backhaul BSS (with fronthaul BSS enabled)"""
-+    run_multi_ap_association(dev, apdev, 3)
-+    dev[1].connect("multi-ap", psk="12345678", scan_freq="2412")
-+
-+def run_multi_ap_association(dev, apdev, multi_ap):
-+    params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678")
-+    params["multi_ap"] = str(multi_ap)
-+    hapd = hostapd.add_ap(apdev[0], params)
-+
-+    dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1",
-+                   scan_freq="2412")
-+
-+def test_multi_ap_disabled_on_ap(dev, apdev):
-+    """Multi-AP association attempt when disabled on AP"""
-+    params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678")
-+    hapd = hostapd.add_ap(apdev[0], params)
-+
-+    dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1",
-+                   scan_freq="2412", wait_connect=False)
-+    ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED",
-+                             "CTRL-EVENT-CONNECTED" ],
-+                           timeout=5)
-+    dev[0].request("DISCONNECT")
-+    if ev is None:
-+        raise Exception("Connection result not reported")
-+    if "CTRL-EVENT-DISCONNECTED" not in ev:
-+        raise Exception("Unexpected connection result")
-+
-+def test_multi_ap_fronthaul_on_ap(dev, apdev):
-+    """Multi-AP association attempt when only fronthaul BSS on AP"""
-+    params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678")
-+    params["multi_ap"] = "2"
-+    hapd = hostapd.add_ap(apdev[0], params)
-+
-+    dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1",
-+                   scan_freq="2412", wait_connect=False)
-+    ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED",
-+                             "CTRL-EVENT-CONNECTED",
-+                             "CTRL-EVENT-ASSOC-REJECT" ],
-+                           timeout=5)
-+    dev[0].request("DISCONNECT")
-+    if ev is None:
-+        raise Exception("Connection result not reported")
-+    if "CTRL-EVENT-ASSOC-REJECT" not in ev:
-+        raise Exception("Association rejection not reported")
-+    if "status_code=12" not in ev:
-+        raise Exception("Unexpected association status code: " + ev)
---- a/tests/hwsim/wpasupplicant.py
-+++ b/tests/hwsim/wpasupplicant.py
-@@ -1031,7 +1031,8 @@ class WpaSupplicant:
-                        "dpp_csign", "dpp_csign_expiry",
-                        "dpp_netaccesskey", "dpp_netaccesskey_expiry",
-                        "group_mgmt", "owe_group",
--                       "roaming_consortium_selection" ]
-+                       "roaming_consortium_selection", "multi_ap_backhaul_sta" ]
-+
-         for field in not_quoted:
-             if field in kwargs and kwargs[field]:
-                 self.set_network(id, field, kwargs[field])

package/network/services/hostapd/patches/553-tests-refactor-test_multi_ap.patch

@@ -1,72 +0,0 @@
-From 0f5029ff41ef286aa7b3e4a3efd3f1a16be925e8 Mon Sep 17 00:00:00 2001
-From: "Arnout Vandecappelle (Essensium/Mind)" <arnout@mind.be>
-Date: Wed, 9 Jan 2019 18:41:08 +0100
-Subject: [PATCH] tests: refactor test_multi_ap
-
-With just one additional argument, the run_multi_ap_association function
-can be used for all tests.
-
-While we're at it, also move it to the top of the file.
-
-Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
----
-v4: new patch
----
- tests/hwsim/test_multi_ap.py | 30 +++++++++++-------------------
- 1 file changed, 11 insertions(+), 19 deletions(-)
-
---- a/tests/hwsim/test_multi_ap.py
-+++ b/tests/hwsim/test_multi_ap.py
-@@ -6,6 +6,15 @@
- 
- import hostapd
- 
-+def run_multi_ap_association(dev, apdev, multi_ap, wait_connect=True):
-+    params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678")
-+    if multi_ap:
-+        params["multi_ap"] = str(multi_ap)
-+    hapd = hostapd.add_ap(apdev[0], params)
-+
-+    dev[0].connect("multi-ap", psk="12345678", scan_freq="2412",
-+                   multi_ap_backhaul_sta="1", wait_connect=wait_connect)
-+
- def test_multi_ap_association(dev, apdev):
-     """Multi-AP association in backhaul BSS"""
-     run_multi_ap_association(dev, apdev, 1)
-@@ -28,21 +37,9 @@ def test_multi_ap_association_shared_bss
-     run_multi_ap_association(dev, apdev, 3)
-     dev[1].connect("multi-ap", psk="12345678", scan_freq="2412")
- 
--def run_multi_ap_association(dev, apdev, multi_ap):
--    params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678")
--    params["multi_ap"] = str(multi_ap)
--    hapd = hostapd.add_ap(apdev[0], params)
--
--    dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1",
--                   scan_freq="2412")
--
- def test_multi_ap_disabled_on_ap(dev, apdev):
-     """Multi-AP association attempt when disabled on AP"""
--    params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678")
--    hapd = hostapd.add_ap(apdev[0], params)
--
--    dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1",
--                   scan_freq="2412", wait_connect=False)
-+    run_multi_ap_association(dev, apdev, 0, wait_connect=False)
-     ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED",
-                              "CTRL-EVENT-CONNECTED" ],
-                            timeout=5)
-@@ -54,12 +51,7 @@ def test_multi_ap_disabled_on_ap(dev, ap
- 
- def test_multi_ap_fronthaul_on_ap(dev, apdev):
-     """Multi-AP association attempt when only fronthaul BSS on AP"""
--    params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678")
--    params["multi_ap"] = "2"
--    hapd = hostapd.add_ap(apdev[0], params)
--
--    dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1",
--                   scan_freq="2412", wait_connect=False)
-+    run_multi_ap_association(dev, apdev, 2, wait_connect=False)
-     ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED",
-                              "CTRL-EVENT-CONNECTED",
-                              "CTRL-EVENT-ASSOC-REJECT" ],

package/network/services/hostapd/patches/554-multi_ap-don-t-reject-backhaul-STA-on-fronhaul-BSS.patch

@@ -1,106 +0,0 @@
-From 71b061b8a13791a1ed858d924e401541c8584030 Mon Sep 17 00:00:00 2001
-From: "Arnout Vandecappelle (Essensium/Mind)" <arnout@mind.be>
-Date: Wed, 9 Jan 2019 19:08:00 +0100
-Subject: [PATCH] multi_ap: don't reject backhaul STA on fronhaul BSS
-
-The Multi-AP specification only specifies that information elements have
-to be added to the association requests and responses; it doesn't
-specify anything about what should be done in case they are missing.
-Currently, we reject non-backhaul associations on a backhaul-only BSS,
-and non-fronthaul associations on a fronthaul-only BSS.
-
-However, this makes WPS fail when fronthaul and backhaul are separate
-SSIDs. Indeed, WPS for the backhaul link is performed on the *fronthaul*
-SSID. Thus, the association request used for WPS *will* contain the
-Multi-AP IE indicating a backhaul STA. Rejecting that association makes
-WPS fail.
-
-Therefore, accept a multi-AP backhaul STA association request on a
-fronthaul-only BSS. Still issue a warning about it, but only at level
-DEBUG intead of INFO. Also change the condition checking to make it
-clearer.
-
-While we're at it, also fix the handling of unexpected bits in the
-Multi-AP IE. 4 bits are reserved in the specification, so these
-certainly have to be ignored. The specification also doesn't say that
-setting one of the other bits is not allowed. Therefore, only report
-unexpected values in the Multi-AP IE, don't reject because of it.
-Note that a malformed IE (containing more than one byte) still triggers
-a rejection.
-
-Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
----
-v4: new patch
-
-Cfr. discussion on http://lists.infradead.org/pipermail/hostap/2019-January/039232.html
-and follow-ups.
----
- src/ap/ieee802_11.c          | 38 +++++++++++++++++++-----------------
- tests/hwsim/test_multi_ap.py |  6 ++----
- 2 files changed, 22 insertions(+), 22 deletions(-)
-
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -2253,28 +2253,30 @@ static u16 check_multi_ap(struct hostapd
- 		}
- 	}
- 
--	if (multi_ap_value == MULTI_AP_BACKHAUL_STA)
--		sta->flags |= WLAN_STA_MULTI_AP;
--
--	if ((hapd->conf->multi_ap & BACKHAUL_BSS) &&
--	    multi_ap_value == MULTI_AP_BACKHAUL_STA)
--		return WLAN_STATUS_SUCCESS;
--
--	if (hapd->conf->multi_ap & FRONTHAUL_BSS) {
--		if (multi_ap_value == MULTI_AP_BACKHAUL_STA) {
--			hostapd_logger(hapd, sta->addr,
--				       HOSTAPD_MODULE_IEEE80211,
--				       HOSTAPD_LEVEL_INFO,
--				       "Backhaul STA tries to associate with fronthaul-only BSS");
--			return WLAN_STATUS_ASSOC_DENIED_UNSPEC;
--		}
--		return WLAN_STATUS_SUCCESS;
-+	if (multi_ap_value && multi_ap_value != MULTI_AP_BACKHAUL_STA)
-+		hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
-+			       HOSTAPD_LEVEL_INFO,
-+			       "Multi-AP IE with unexpected value 0x%02x",
-+			       multi_ap_value);
-+
-+	if (!(multi_ap_value & MULTI_AP_BACKHAUL_STA)) {
-+		if (hapd->conf->multi_ap & FRONTHAUL_BSS)
-+			return WLAN_STATUS_SUCCESS;
-+
-+		hostapd_logger(hapd, sta->addr,
-+			       HOSTAPD_MODULE_IEEE80211,
-+			       HOSTAPD_LEVEL_INFO,
-+			       "Non-Multi-AP STA tries to associate with backhaul-only BSS");
-+		return WLAN_STATUS_ASSOC_DENIED_UNSPEC;
- 	}
- 
--	hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
--		       HOSTAPD_LEVEL_INFO,
--		       "Non-Multi-AP STA tries to associate with backhaul-only BSS");
--	return WLAN_STATUS_ASSOC_DENIED_UNSPEC;
-+	if (!(hapd->conf->multi_ap & BACKHAUL_BSS))
-+		hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
-+			       HOSTAPD_LEVEL_DEBUG,
-+			       "Backhaul STA tries to associate with fronthaul-only BSS");
-+
-+	sta->flags |= WLAN_STA_MULTI_AP;
-+	return WLAN_STATUS_SUCCESS;
- }
- 
- 
---- a/tests/hwsim/test_multi_ap.py
-+++ b/tests/hwsim/test_multi_ap.py
-@@ -59,7 +59,5 @@ def test_multi_ap_fronthaul_on_ap(dev, a
-     dev[0].request("DISCONNECT")
-     if ev is None:
-         raise Exception("Connection result not reported")
--    if "CTRL-EVENT-ASSOC-REJECT" not in ev:
--        raise Exception("Association rejection not reported")
--    if "status_code=12" not in ev:
--        raise Exception("Unexpected association status code: " + ev)
-+    if "CTRL-EVENT-DISCONNECTED" not in ev:
-+        raise Exception("Unexpected connection result")

package/network/services/hostapd/patches/555-WPS-wps_build_wfa_ext-add-multi_ap_subelem-parameter.patch

@@ -1,342 +0,0 @@
-From ad3c6faca118c23cdafef418dc27b3cee7d0e06e Mon Sep 17 00:00:00 2001
-From: "Arnout Vandecappelle (Essensium/Mind)" <arnout@mind.be>
-Date: Wed, 9 Jan 2019 19:19:26 +0100
-Subject: [PATCH] WPS: wps_build_wfa_ext(): add multi_ap_subelem parameter
-
-The Multi-AP specification adds a new subelement to the WFA extension
-element in the WPS exchange. Add an additional parameter to
-wps_build_wfa_ext() to add this subelement. The subelement is only added
-if the parameter is non-0. Note that we don't reuse the existing
-MULTI_AP_SUB_ELEM_TYPE definition here, but rather define a new
-WFA_ELEM_MULTI_AP, to make sure the enum of WFA subelement types remains
-complete.
-
-For now, all callers set the multi_ap_subelem parameter to 0.
-
-Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
----
-v4: Split off from supplicant WPS patch
-
-Since the original patch from Davina Lyu didn't have this extra
-argument, I kept myself as the author of this patch.
----
- src/p2p/p2p_build.c      |  2 +-
- src/wps/wps.c            |  6 +++---
- src/wps/wps_attr_build.c | 11 ++++++++++-
- src/wps/wps_common.c     | 16 ++++++++--------
- src/wps/wps_defs.h       |  3 ++-
- src/wps/wps_enrollee.c   | 10 +++++-----
- src/wps/wps_er.c         |  4 ++--
- src/wps/wps_i.h          |  3 ++-
- src/wps/wps_registrar.c  | 14 +++++++-------
- src/wps/wps_upnp.c       |  2 +-
- 10 files changed, 41 insertions(+), 30 deletions(-)
-
---- a/src/p2p/p2p_build.c
-+++ b/src/p2p/p2p_build.c
-@@ -802,7 +802,7 @@ int p2p_build_wps_ie(struct p2p_data *p2
- 		wpabuf_put_be16(buf, p2p->cfg->config_methods);
- 	}
- 
--	if (wps_build_wfa_ext(buf, 0, NULL, 0) < 0)
-+	if (wps_build_wfa_ext(buf, 0, NULL, 0, 0) < 0)
- 		return -1;
- 
- 	if (all_attr && p2p->cfg->num_sec_dev_types) {
---- a/src/wps/wps.c
-+++ b/src/wps/wps.c
-@@ -430,7 +430,7 @@ struct wpabuf * wps_build_assoc_req_ie(e
- 
- 	if (wps_build_version(ie) ||
- 	    wps_build_req_type(ie, req_type) ||
--	    wps_build_wfa_ext(ie, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(ie, 0, NULL, 0, 0)) {
- 		wpabuf_free(ie);
- 		return NULL;
- 	}
-@@ -464,7 +464,7 @@ struct wpabuf * wps_build_assoc_resp_ie(
- 
- 	if (wps_build_version(ie) ||
- 	    wps_build_resp_type(ie, WPS_RESP_AP) ||
--	    wps_build_wfa_ext(ie, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(ie, 0, NULL, 0, 0)) {
- 		wpabuf_free(ie);
- 		return NULL;
- 	}
-@@ -516,7 +516,7 @@ struct wpabuf * wps_build_probe_req_ie(u
- 	    wps_build_model_name(dev, ie) ||
- 	    wps_build_model_number(dev, ie) ||
- 	    wps_build_dev_name(dev, ie) ||
--	    wps_build_wfa_ext(ie, req_type == WPS_REQ_ENROLLEE, NULL, 0) ||
-+	    wps_build_wfa_ext(ie, req_type == WPS_REQ_ENROLLEE, NULL, 0, 0) ||
- 	    wps_build_req_dev_type(dev, ie, num_req_dev_types, req_dev_types)
- 	    ||
- 	    wps_build_secondary_dev_type(dev, ie)
---- a/src/wps/wps_attr_build.c
-+++ b/src/wps/wps_attr_build.c
-@@ -203,7 +203,8 @@ int wps_build_version(struct wpabuf *msg
- 
- 
- int wps_build_wfa_ext(struct wpabuf *msg, int req_to_enroll,
--		      const u8 *auth_macs, size_t auth_macs_count)
-+		      const u8 *auth_macs, size_t auth_macs_count,
-+		      u8 multi_ap_subelem)
- {
- 	u8 *len;
- 
-@@ -244,6 +245,14 @@ int wps_build_wfa_ext(struct wpabuf *msg
- 				   MAC2STR(&auth_macs[i * ETH_ALEN]));
- 	}
- 
-+	if (multi_ap_subelem) {
-+		wpa_printf(MSG_DEBUG, "WPS:  * Multi-AP (0x%x)",
-+			   multi_ap_subelem);
-+		wpabuf_put_u8(msg, WFA_ELEM_MULTI_AP);
-+		wpabuf_put_u8(msg, 1); /* length */
-+		wpabuf_put_u8(msg, multi_ap_subelem);
-+	}
-+
- 	WPA_PUT_BE16(len, (u8 *) wpabuf_put(msg, 0) - len - 2);
- 
- #ifdef CONFIG_WPS_TESTING
---- a/src/wps/wps_common.c
-+++ b/src/wps/wps_common.c
-@@ -374,7 +374,7 @@ struct wpabuf * wps_get_oob_cred(struct
- 	    (rf_band && wps_build_rf_bands_attr(plain, rf_band)) ||
- 	    (channel && wps_build_ap_channel(plain, channel)) ||
- 	    wps_build_mac_addr(plain, wps->dev.mac_addr) ||
--	    wps_build_wfa_ext(plain, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(plain, 0, NULL, 0, 0)) {
- 		os_free(data.new_psk);
- 		wpabuf_clear_free(plain);
- 		return NULL;
-@@ -421,7 +421,7 @@ struct wpabuf * wps_build_nfc_pw_token(u
- 
- 	if (wps_build_oob_dev_pw(data, dev_pw_id, pubkey,
- 				 wpabuf_head(dev_pw), wpabuf_len(dev_pw)) ||
--	    wps_build_wfa_ext(data, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(data, 0, NULL, 0, 0)) {
- 		wpa_printf(MSG_ERROR, "WPS: Failed to build NFC password "
- 			   "token");
- 		wpabuf_clear_free(data);
-@@ -586,7 +586,7 @@ struct wpabuf * wps_build_wsc_ack(struct
- 	    wps_build_msg_type(msg, WPS_WSC_ACK) ||
- 	    wps_build_enrollee_nonce(wps, msg) ||
- 	    wps_build_registrar_nonce(wps, msg) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0)) {
- 		wpabuf_free(msg);
- 		return NULL;
- 	}
-@@ -610,7 +610,7 @@ struct wpabuf * wps_build_wsc_nack(struc
- 	    wps_build_enrollee_nonce(wps, msg) ||
- 	    wps_build_registrar_nonce(wps, msg) ||
- 	    wps_build_config_error(msg, wps->config_error) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0)) {
- 		wpabuf_free(msg);
- 		return NULL;
- 	}
-@@ -726,7 +726,7 @@ struct wpabuf * wps_build_nfc_handover_r
- 	if (wps_build_oob_dev_pw(msg, DEV_PW_NFC_CONNECTION_HANDOVER,
- 				 nfc_dh_pubkey, NULL, 0) ||
- 	    wps_build_uuid_e(msg, ctx->uuid) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0)) {
- 		wpabuf_free(msg);
- 		return NULL;
- 	}
-@@ -809,7 +809,7 @@ struct wpabuf * wps_build_nfc_handover_s
- 	    wps_build_ssid(msg, ctx) ||
- 	    wps_build_ap_freq(msg, freq) ||
- 	    (bssid && wps_build_mac_addr(msg, bssid)) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0)) {
- 		wpabuf_free(msg);
- 		return NULL;
- 	}
-@@ -848,7 +848,7 @@ struct wpabuf * wps_build_nfc_handover_r
- 	    wps_build_rf_bands(&ctx->dev, msg, 0) ||
- 	    wps_build_serial_number(&ctx->dev, msg) ||
- 	    wps_build_uuid_e(msg, ctx->uuid) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0)) {
- 		wpabuf_free(msg);
- 		return NULL;
- 	}
-@@ -900,7 +900,7 @@ struct wpabuf * wps_build_nfc_handover_s
- 	    wps_build_rf_bands(&ctx->dev, msg, 0) ||
- 	    wps_build_serial_number(&ctx->dev, msg) ||
- 	    wps_build_uuid_e(msg, ctx->uuid) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0)) {
- 		wpabuf_free(msg);
- 		return NULL;
- 	}
---- a/src/wps/wps_defs.h
-+++ b/src/wps/wps_defs.h
-@@ -152,7 +152,8 @@ enum {
- 	WFA_ELEM_NETWORK_KEY_SHAREABLE = 0x02,
- 	WFA_ELEM_REQUEST_TO_ENROLL = 0x03,
- 	WFA_ELEM_SETTINGS_DELAY_TIME = 0x04,
--	WFA_ELEM_REGISTRAR_CONFIGURATION_METHODS = 0x05
-+	WFA_ELEM_REGISTRAR_CONFIGURATION_METHODS = 0x05,
-+	WFA_ELEM_MULTI_AP = 0x06
- };
- 
- /* Device Password ID */
---- a/src/wps/wps_enrollee.c
-+++ b/src/wps/wps_enrollee.c
-@@ -152,7 +152,7 @@ static struct wpabuf * wps_build_m1(stru
- 	    wps_build_dev_password_id(msg, wps->dev_pw_id) ||
- 	    wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
- 	    wps_build_os_version(&wps->wps->dev, msg) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0) ||
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0) ||
- 	    wps_build_vendor_ext_m1(&wps->wps->dev, msg)) {
- 		wpabuf_free(msg);
- 		return NULL;
-@@ -190,7 +190,7 @@ static struct wpabuf * wps_build_m3(stru
- 	    wps_build_msg_type(msg, WPS_M3) ||
- 	    wps_build_registrar_nonce(wps, msg) ||
- 	    wps_build_e_hash(wps, msg) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0) ||
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0) ||
- 	    wps_build_authenticator(wps, msg)) {
- 		wpabuf_free(msg);
- 		return NULL;
-@@ -223,7 +223,7 @@ static struct wpabuf * wps_build_m5(stru
- 	    wps_build_e_snonce1(wps, plain) ||
- 	    wps_build_key_wrap_auth(wps, plain) ||
- 	    wps_build_encr_settings(wps, msg, plain) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0) ||
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0) ||
- 	    wps_build_authenticator(wps, msg)) {
- 		wpabuf_clear_free(plain);
- 		wpabuf_free(msg);
-@@ -393,7 +393,7 @@ static struct wpabuf * wps_build_m7(stru
- 	    (wps->wps->ap && wps_build_ap_settings(wps, plain)) ||
- 	    wps_build_key_wrap_auth(wps, plain) ||
- 	    wps_build_encr_settings(wps, msg, plain) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0) ||
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0) ||
- 	    wps_build_authenticator(wps, msg)) {
- 		wpabuf_clear_free(plain);
- 		wpabuf_free(msg);
-@@ -430,7 +430,7 @@ static struct wpabuf * wps_build_wsc_don
- 	    wps_build_msg_type(msg, WPS_WSC_DONE) ||
- 	    wps_build_enrollee_nonce(wps, msg) ||
- 	    wps_build_registrar_nonce(wps, msg) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0)) {
- 		wpabuf_free(msg);
- 		return NULL;
- 	}
---- a/src/wps/wps_er.c
-+++ b/src/wps/wps_er.c
-@@ -1530,7 +1530,7 @@ void wps_er_set_sel_reg(struct wps_er *e
- 	    wps_er_build_selected_registrar(msg, sel_reg) ||
- 	    wps_er_build_dev_password_id(msg, dev_passwd_id) ||
- 	    wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods) ||
--	    wps_build_wfa_ext(msg, 0, auth_macs, count) ||
-+	    wps_build_wfa_ext(msg, 0, auth_macs, count, 0) ||
- 	    wps_er_build_uuid_r(msg, er->wps->uuid)) {
- 		wpabuf_free(msg);
- 		return;
-@@ -2048,7 +2048,7 @@ struct wpabuf * wps_er_config_token_from
- 	data.wps = wps;
- 	data.use_cred = cred;
- 	if (wps_build_cred(&data, ret) ||
--	    wps_build_wfa_ext(ret, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(ret, 0, NULL, 0, 0)) {
- 		wpabuf_free(ret);
- 		return NULL;
- 	}
---- a/src/wps/wps_i.h
-+++ b/src/wps/wps_i.h
-@@ -163,7 +163,8 @@ int wps_build_encr_settings(struct wps_d
- 			    struct wpabuf *plain);
- int wps_build_version(struct wpabuf *msg);
- int wps_build_wfa_ext(struct wpabuf *msg, int req_to_enroll,
--		      const u8 *auth_macs, size_t auth_macs_count);
-+		      const u8 *auth_macs, size_t auth_macs_count,
-+		      u8 multi_ap_subelem);
- int wps_build_msg_type(struct wpabuf *msg, enum wps_msg_type msg_type);
- int wps_build_enrollee_nonce(struct wps_data *wps, struct wpabuf *msg);
- int wps_build_registrar_nonce(struct wps_data *wps, struct wpabuf *msg);
---- a/src/wps/wps_registrar.c
-+++ b/src/wps/wps_registrar.c
-@@ -1281,7 +1281,7 @@ static int wps_set_ie(struct wps_registr
- 	    wps_build_sel_reg_config_methods(reg, beacon) ||
- 	    wps_build_sel_pbc_reg_uuid_e(reg, beacon) ||
- 	    (reg->dualband && wps_build_rf_bands(&reg->wps->dev, beacon, 0)) ||
--	    wps_build_wfa_ext(beacon, 0, auth_macs, count) ||
-+	    wps_build_wfa_ext(beacon, 0, auth_macs, count, 0) ||
- 	    wps_build_vendor_ext(&reg->wps->dev, beacon)) {
- 		wpabuf_free(beacon);
- 		wpabuf_free(probe);
-@@ -1311,7 +1311,7 @@ static int wps_set_ie(struct wps_registr
- 	    wps_build_device_attrs(&reg->wps->dev, probe) ||
- 	    wps_build_probe_config_methods(reg, probe) ||
- 	    (reg->dualband && wps_build_rf_bands(&reg->wps->dev, probe, 0)) ||
--	    wps_build_wfa_ext(probe, 0, auth_macs, count) ||
-+	    wps_build_wfa_ext(probe, 0, auth_macs, count, 0) ||
- 	    wps_build_vendor_ext(&reg->wps->dev, probe)) {
- 		wpabuf_free(beacon);
- 		wpabuf_free(probe);
-@@ -1845,7 +1845,7 @@ static struct wpabuf * wps_build_m2(stru
- 	    wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
- 	    wps_build_dev_password_id(msg, wps->dev_pw_id) ||
- 	    wps_build_os_version(&wps->wps->dev, msg) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0)) {
- 		wpabuf_free(msg);
- 		return NULL;
- 	}
-@@ -1913,7 +1913,7 @@ static struct wpabuf * wps_build_m2d(str
- 	    wps_build_assoc_state(wps, msg) ||
- 	    wps_build_config_error(msg, err) ||
- 	    wps_build_os_version(&wps->wps->dev, msg) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0)) {
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0)) {
- 		wpabuf_free(msg);
- 		return NULL;
- 	}
-@@ -1949,7 +1949,7 @@ static struct wpabuf * wps_build_m4(stru
- 	    wps_build_r_snonce1(wps, plain) ||
- 	    wps_build_key_wrap_auth(wps, plain) ||
- 	    wps_build_encr_settings(wps, msg, plain) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0) ||
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0) ||
- 	    wps_build_authenticator(wps, msg)) {
- 		wpabuf_clear_free(plain);
- 		wpabuf_free(msg);
-@@ -1984,7 +1984,7 @@ static struct wpabuf * wps_build_m6(stru
- 	    wps_build_r_snonce2(wps, plain) ||
- 	    wps_build_key_wrap_auth(wps, plain) ||
- 	    wps_build_encr_settings(wps, msg, plain) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0) ||
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0) ||
- 	    wps_build_authenticator(wps, msg)) {
- 		wpabuf_clear_free(plain);
- 		wpabuf_free(msg);
-@@ -2021,7 +2021,7 @@ static struct wpabuf * wps_build_m8(stru
- 	    (!wps->wps->ap && !wps->er && wps_build_ap_settings(wps, plain)) ||
- 	    wps_build_key_wrap_auth(wps, plain) ||
- 	    wps_build_encr_settings(wps, msg, plain) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0) ||
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, 0) ||
- 	    wps_build_authenticator(wps, msg)) {
- 		wpabuf_clear_free(plain);
- 		wpabuf_clear_free(msg);
---- a/src/wps/wps_upnp.c
-+++ b/src/wps/wps_upnp.c
-@@ -599,7 +599,7 @@ static struct wpabuf * build_fake_wsc_ac
- 	wpabuf_put_be16(msg, ATTR_REGISTRAR_NONCE);
- 	wpabuf_put_be16(msg, WPS_NONCE_LEN);
- 	wpabuf_put(msg, WPS_NONCE_LEN);
--	if (wps_build_wfa_ext(msg, 0, NULL, 0)) {
-+	if (wps_build_wfa_ext(msg, 0, NULL, 0, 0)) {
- 		wpabuf_free(msg);
- 		return NULL;
- 	}

package/network/services/hostapd/patches/556-wpa_supplicant-support-Multi-AP-backhaul-STA-onboard.patch

@@ -1,217 +0,0 @@
-From 6c4c98db9420a3321bbf091cfc254de5eba4b404 Mon Sep 17 00:00:00 2001
-From: Davina Lu <ylu@quantenna.com>
-Date: Tue, 15 Jan 2019 19:17:51 +0100
-Subject: [PATCH] wpa_supplicant: support Multi-AP backhaul STA onboarding
-
-The Wi-Fi Alliance Multi-AP Specification v1.0 allows onboarding of a
-backhaul STA through WPS. To enable this, the backhaul STA needs to add
-a Multi-AP IE to the WFA vendor extension element in the WSC M1 message
-that indicates it supports the Multi-AP backhaul STA role. The registrar
-(if it support Multi-AP onboarding) will respond to that with a WSC M8
-message that also contains the Multi-AP IE, and that contains the
-credentials for the backhaul SSID (which may be different from the SSID
-on which WPS is performed).
-
-Introduce a new parameter to wpas_wps_start_pbc() and allow it to be
-set via control interface's new multi_ap=1 parameter of WPS_PBC call.
-multi_ap_backhaul_sta is set to 1 in the automatically created SSID.
-Thus, if the AP does not support Multi-AP, association will fail and
-WPS will be terminated.
-
-Only wps_pbc is supported.
-
-The multi_ap argument is only added to the socket interface, not to the
-dbus interface.
-
-Signed-off-by: Davina Lu <ylu@quantenna.com>
-Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com>
-Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
-Signed-off-by: Daniel Golle <daniel@makrotopia.org>
----
-v4: use argument to wps_pbc instead of a global configuration option
- (requested by Jouni)
----
- src/eap_peer/eap_wsc.c                      | 3 +++
- src/wps/wps.h                               | 6 ++++++
- src/wps/wps_enrollee.c                      | 6 +++++-
- wpa_supplicant/ctrl_iface.c                 | 5 ++++-
- wpa_supplicant/dbus/dbus_new_handlers_wps.c | 2 +-
- wpa_supplicant/dbus/dbus_old_handlers_wps.c | 4 ++--
- wpa_supplicant/events.c                     | 2 +-
- wpa_supplicant/p2p_supplicant.c             | 2 +-
- wpa_supplicant/wps_supplicant.c             | 9 +++++++--
- wpa_supplicant/wps_supplicant.h             | 2 +-
- 10 files changed, 31 insertions(+), 10 deletions(-)
-
---- a/src/eap_peer/eap_wsc.c
-+++ b/src/eap_peer/eap_wsc.c
-@@ -274,6 +274,9 @@ static void * eap_wsc_init(struct eap_sm
- 				      cfg.pin, cfg.pin_len, 0);
- 	}
- 
-+	if (os_strstr(phase1, "multi_ap=1"))
-+		wps->multi_ap_backhaul_sta = 1;
-+
- 	/* Use reduced client timeout for WPS to avoid long wait */
- 	if (sm->ClientTimeout > 30)
- 		sm->ClientTimeout = 30;
---- a/src/wps/wps.h
-+++ b/src/wps/wps.h
-@@ -613,6 +613,12 @@ struct wps_context {
- 	int ap_setup_locked;
- 
- 	/**
-+	 * multi_ap_backhaul_sta - Whether this is a Multi-AP backhaul STA
-+	 * enrollee
-+	 */
-+	int multi_ap_backhaul_sta;
-+
-+	/**
- 	 * uuid - Own UUID
- 	 */
- 	u8 uuid[16];
---- a/src/wps/wps_enrollee.c
-+++ b/src/wps/wps_enrollee.c
-@@ -105,6 +105,7 @@ static struct wpabuf * wps_build_m1(stru
- {
- 	struct wpabuf *msg;
- 	u16 config_methods;
-+	u8 multi_ap_backhaul_sta = 0;
- 
- 	if (random_get_bytes(wps->nonce_e, WPS_NONCE_LEN) < 0)
- 		return NULL;
-@@ -134,6 +135,9 @@ static struct wpabuf * wps_build_m1(stru
- 				    WPS_CONFIG_PHY_PUSHBUTTON);
- 	}
- 
-+	if (wps->wps->multi_ap_backhaul_sta)
-+		multi_ap_backhaul_sta = MULTI_AP_BACKHAUL_STA;
-+
- 	if (wps_build_version(msg) ||
- 	    wps_build_msg_type(msg, WPS_M1) ||
- 	    wps_build_uuid_e(msg, wps->uuid_e) ||
-@@ -152,7 +156,7 @@ static struct wpabuf * wps_build_m1(stru
- 	    wps_build_dev_password_id(msg, wps->dev_pw_id) ||
- 	    wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
- 	    wps_build_os_version(&wps->wps->dev, msg) ||
--	    wps_build_wfa_ext(msg, 0, NULL, 0, 0) ||
-+	    wps_build_wfa_ext(msg, 0, NULL, 0, multi_ap_backhaul_sta) ||
- 	    wps_build_vendor_ext_m1(&wps->wps->dev, msg)) {
- 		wpabuf_free(msg);
- 		return NULL;
---- a/wpa_supplicant/ctrl_iface.c
-+++ b/wpa_supplicant/ctrl_iface.c
-@@ -1167,6 +1167,7 @@ static int wpa_supplicant_ctrl_iface_wps
- #ifdef CONFIG_AP
- 	u8 *_p2p_dev_addr = NULL;
- #endif /* CONFIG_AP */
-+	int multi_ap = 0;
- 
- 	if (cmd == NULL || os_strcmp(cmd, "any") == 0) {
- 		_bssid = NULL;
-@@ -1184,6 +1185,8 @@ static int wpa_supplicant_ctrl_iface_wps
- 		wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid BSSID '%s'",
- 			   cmd);
- 		return -1;
-+	} else if (os_strncmp(cmd, "multi_ap=", 9) == 0) {
-+		multi_ap = atoi(cmd + 9);
- 	}
- 
- #ifdef CONFIG_AP
-@@ -1191,7 +1194,7 @@ static int wpa_supplicant_ctrl_iface_wps
- 		return wpa_supplicant_ap_wps_pbc(wpa_s, _bssid, _p2p_dev_addr);
- #endif /* CONFIG_AP */
- 
--	return wpas_wps_start_pbc(wpa_s, _bssid, 0);
-+	return wpas_wps_start_pbc(wpa_s, _bssid, 0, multi_ap);
- }
- 
- 
---- a/wpa_supplicant/dbus/dbus_new_handlers_wps.c
-+++ b/wpa_supplicant/dbus/dbus_new_handlers_wps.c
-@@ -289,7 +289,7 @@ DBusMessage * wpas_dbus_handler_wps_star
- 		if (ret > 0)
- 			os_snprintf(npin, sizeof(npin), "%08d", ret);
- 	} else {
--		ret = wpas_wps_start_pbc(wpa_s, params.bssid, 0);
-+		ret = wpas_wps_start_pbc(wpa_s, params.bssid, 0, 0);
- 	}
- 
- 	if (ret < 0) {
---- a/wpa_supplicant/dbus/dbus_old_handlers_wps.c
-+++ b/wpa_supplicant/dbus/dbus_old_handlers_wps.c
-@@ -37,9 +37,9 @@ DBusMessage * wpas_dbus_iface_wps_pbc(DB
- 		return wpas_dbus_new_invalid_opts_error(message, NULL);
- 
- 	if (os_strcmp(arg_bssid, "any") == 0)
--		ret = wpas_wps_start_pbc(wpa_s, NULL, 0);
-+		ret = wpas_wps_start_pbc(wpa_s, NULL, 0, 0);
- 	else if (!hwaddr_aton(arg_bssid, bssid))
--		ret = wpas_wps_start_pbc(wpa_s, bssid, 0);
-+		ret = wpas_wps_start_pbc(wpa_s, bssid, 0, 0);
- 	else {
- 		return wpas_dbus_new_invalid_opts_error(message,
- 							"Invalid BSSID");
---- a/wpa_supplicant/events.c
-+++ b/wpa_supplicant/events.c
-@@ -4816,7 +4816,7 @@ void supplicant_event(void *ctx, enum wp
- 		break;
- 	case EVENT_WPS_BUTTON_PUSHED:
- #ifdef CONFIG_WPS
--		wpas_wps_start_pbc(wpa_s, NULL, 0);
-+		wpas_wps_start_pbc(wpa_s, NULL, 0, 0);
- #endif /* CONFIG_WPS */
- 		break;
- 	case EVENT_AVOID_FREQUENCIES:
---- a/wpa_supplicant/p2p_supplicant.c
-+++ b/wpa_supplicant/p2p_supplicant.c
-@@ -1649,7 +1649,7 @@ static void wpas_start_wps_enrollee(stru
- 	wpa_supplicant_ap_deinit(wpa_s);
- 	wpas_copy_go_neg_results(wpa_s, res);
- 	if (res->wps_method == WPS_PBC) {
--		wpas_wps_start_pbc(wpa_s, res->peer_interface_addr, 1);
-+		wpas_wps_start_pbc(wpa_s, res->peer_interface_addr, 1, 0);
- #ifdef CONFIG_WPS_NFC
- 	} else if (res->wps_method == WPS_NFC) {
- 		wpas_wps_start_nfc(wpa_s, res->peer_device_addr,
---- a/wpa_supplicant/wps_supplicant.c
-+++ b/wpa_supplicant/wps_supplicant.c
-@@ -1137,9 +1137,10 @@ static void wpas_wps_reassoc(struct wpa_
- 
- 
- int wpas_wps_start_pbc(struct wpa_supplicant *wpa_s, const u8 *bssid,
--		       int p2p_group)
-+		       int p2p_group, int multi_ap_backhaul_sta)
- {
- 	struct wpa_ssid *ssid;
-+	char phase1[32];
- 
- #ifdef CONFIG_AP
- 	if (wpa_s->ap_iface) {
-@@ -1177,10 +1178,14 @@ int wpas_wps_start_pbc(struct wpa_suppli
- 		}
- 	}
- #endif /* CONFIG_P2P */
--	if (wpa_config_set(ssid, "phase1", "\"pbc=1\"", 0) < 0)
-+	if (os_snprintf(phase1, sizeof(phase1), "pbc=1%s",
-+			multi_ap_backhaul_sta ? " multi_ap=1" : "") ||
-+	    wpa_config_set_quoted(ssid, "phase1", phase1) < 0)
- 		return -1;
- 	if (wpa_s->wps_fragment_size)
- 		ssid->eap.fragment_size = wpa_s->wps_fragment_size;
-+	if (multi_ap_backhaul_sta)
-+		ssid->multi_ap_backhaul_sta = 1;
- 	wpa_supplicant_wps_event(wpa_s, WPS_EV_PBC_ACTIVE, NULL);
- 	eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout,
- 			       wpa_s, NULL);
---- a/wpa_supplicant/wps_supplicant.h
-+++ b/wpa_supplicant/wps_supplicant.h
-@@ -30,7 +30,7 @@ void wpas_wps_deinit(struct wpa_supplica
- int wpas_wps_eapol_cb(struct wpa_supplicant *wpa_s);
- enum wps_request_type wpas_wps_get_req_type(struct wpa_ssid *ssid);
- int wpas_wps_start_pbc(struct wpa_supplicant *wpa_s, const u8 *bssid,
--		       int p2p_group);
-+		       int p2p_group, int multi_ap_backhaul_sta);
- int wpas_wps_start_pin(struct wpa_supplicant *wpa_s, const u8 *bssid,
- 		       const char *pin, int p2p_group, u16 dev_pw_id);
- void wpas_wps_pbc_overlap(struct wpa_supplicant *wpa_s);

package/network/services/hostapd/patches/557-hostapd-support-Multi-AP-backhaul-STA-onboarding.patch

@@ -1,339 +0,0 @@
-From 8b04a4cddbd6dbadb24279713af7ac677e80d342 Mon Sep 17 00:00:00 2001
-From: Davina Lu <ylu@quantenna.com>
-Date: Tue, 2 Oct 2018 18:34:14 -0700
-Subject: [PATCH] hostapd: support Multi-AP backhaul STA onboarding
-
-The Wi-Fi Alliance Multi-AP Specification v1.0 allows onboarding of a
-backhaul STA through WPS. To enable this, the WPS registrar offers a
-different set of credentials (backhaul credentials instead of fronthaul
-credentials) when the Multi-AP subelement is present in the WFA vendor
-extension element of the WSC M1 message.
-
-Add 3 new configuration options to specify the backhaul credentials for
-the hostapd internal registrar: multi_ap_backhaul_ssid,
-multi_ap_backhaul_wpa_psk, multi_ap_backhaul_wpa_passphrase. These are
-only relevant for a fronthaul SSID, i.e. where multi_ap is set to 2 or
-3. When these options are set, pass the backhaul credentials instead of
-the normal credentials when the Multi-AP subelement is present.
-
-Ignore the Multi-AP subelement if the backhaul config options are not
-set. Note that for an SSID which is fronthaul and backhaul at the same
-time (i.e., multi_ap == 3), this results in the correct credentials
-being sent anyway.
-
-The security to be used for the backaul BSS is fixed to WPA2PSK. The
-Multi-AP Specification only allows Open and WPA2PSK networks to be
-configured. Although not stated explicitly, the backhaul link is
-intended to be always encrypted, hence WPA2PSK.
-
-To build the credentials, the credential-building code is essentially
-copied and simplified. Indeed, the backhaul credentials are always
-WPA2PSK and never use per-device PSK. All the options set for the
-fronthaul BSS WPS are simply ignored.
-
-Signed-off-by: Davina Lu <ylu@quantenna.com>
-Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com>
-Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
----
-v4: no change
----
- hostapd/config_file.c    | 47 ++++++++++++++++++++++++++++++++++++++++
- hostapd/hostapd.conf     |  9 ++++++++
- src/ap/ap_config.c       |  2 ++
- src/ap/ap_config.h       |  1 +
- src/ap/wps_hostapd.c     | 26 ++++++++++++++++++++++
- src/wps/wps.h            | 32 +++++++++++++++++++++++++++
- src/wps/wps_attr_parse.c | 11 ++++++++++
- src/wps/wps_attr_parse.h |  1 +
- src/wps/wps_dev_attr.c   |  5 +++++
- src/wps/wps_dev_attr.h   |  1 +
- src/wps/wps_registrar.c  | 25 ++++++++++++++++++++-
- 11 files changed, 159 insertions(+), 1 deletion(-)
-
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -3479,6 +3479,53 @@ static int hostapd_config_fill(struct ho
- 				   line, pos);
- 			return 1;
- 		}
-+	} else if (os_strcmp(buf, "multi_ap_backhaul_ssid") == 0) {
-+		size_t slen;
-+		char *str = wpa_config_parse_string(pos, &slen);
-+
-+		if (str == NULL || slen < 1 || slen > SSID_MAX_LEN) {
-+			wpa_printf(MSG_ERROR, "Line %d: invalid SSID '%s'",
-+				   line, pos);
-+			os_free(str);
-+			return 1;
-+		}
-+		os_memcpy(bss->multi_ap_backhaul_ssid.ssid, str, slen);
-+		bss->multi_ap_backhaul_ssid.ssid_len = slen;
-+		bss->multi_ap_backhaul_ssid.ssid_set = 1;
-+		os_free(str);
-+	} else if (os_strcmp(buf, "multi_ap_backhaul_wpa_passphrase") == 0) {
-+		int len = os_strlen(pos);
-+
-+		if (len < 8 || len > 63) {
-+			wpa_printf(MSG_ERROR,
-+				   "Line %d: invalid WPA passphrase length %d (expected 8..63)",
-+				   line, len);
-+			return 1;
-+		}
-+		os_free(bss->multi_ap_backhaul_ssid.wpa_passphrase);
-+		bss->multi_ap_backhaul_ssid.wpa_passphrase = os_strdup(pos);
-+		if (bss->multi_ap_backhaul_ssid.wpa_passphrase) {
-+			hostapd_config_clear_wpa_psk(&bss->multi_ap_backhaul_ssid.wpa_psk);
-+			bss->multi_ap_backhaul_ssid.wpa_passphrase_set = 1;
-+		}
-+	} else if (os_strcmp(buf, "multi_ap_backhaul_wpa_psk") == 0) {
-+		hostapd_config_clear_wpa_psk(&bss->multi_ap_backhaul_ssid.wpa_psk);
-+		bss->multi_ap_backhaul_ssid.wpa_psk =
-+			os_zalloc(sizeof(struct hostapd_wpa_psk));
-+		if (bss->multi_ap_backhaul_ssid.wpa_psk == NULL)
-+			return 1;
-+		if (hexstr2bin(pos, bss->multi_ap_backhaul_ssid.wpa_psk->psk,
-+			       PMK_LEN) ||
-+		    pos[PMK_LEN * 2] != '\0') {
-+			wpa_printf(MSG_ERROR, "Line %d: Invalid PSK '%s'.",
-+				   line, pos);
-+			hostapd_config_clear_wpa_psk(&bss->multi_ap_backhaul_ssid.wpa_psk);
-+			return 1;
-+		}
-+		bss->multi_ap_backhaul_ssid.wpa_psk->group = 1;
-+		os_free(bss->multi_ap_backhaul_ssid.wpa_passphrase);
-+		bss->multi_ap_backhaul_ssid.wpa_passphrase = NULL;
-+		bss->multi_ap_backhaul_ssid.wpa_psk_set = 1;
- 	} else if (os_strcmp(buf, "upnp_iface") == 0) {
- 		os_free(bss->upnp_iface);
- 		bss->upnp_iface = os_strdup(pos);
---- a/hostapd/hostapd.conf
-+++ b/hostapd/hostapd.conf
-@@ -1852,6 +1852,15 @@ own_ip_addr=127.0.0.1
- # attribute.
- #ap_settings=hostapd.ap_settings
- 
-+# Multi-AP backhaul BSS config
-+# Used in WPS when multi_ap=2 or 3. Defines "backhaul BSS" credentials.
-+# These are passed in WPS M8 instead of the normal (fronthaul) credentials
-+# if the enrollee has the Multi-AP subelement set. Backhaul SSID is formatted
-+# like ssid2. The key is set like wpa_psk or wpa_passphrase.
-+#multi_ap_backhaul_ssid="backhaul"
-+#multi_ap_backhaul_wpa_psk=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
-+#multi_ap_backhaul_wpa_passphrase=secret passphrase
-+
- # WPS UPnP interface
- # If set, support for external Registrars is enabled.
- #upnp_iface=br0
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -582,6 +582,8 @@ void hostapd_config_free_bss(struct host
- 	os_free(conf->ap_pin);
- 	os_free(conf->extra_cred);
- 	os_free(conf->ap_settings);
-+	hostapd_config_clear_wpa_psk(&conf->multi_ap_backhaul_ssid.wpa_psk);
-+	str_clear_free(conf->multi_ap_backhaul_ssid.wpa_passphrase);
- 	os_free(conf->upnp_iface);
- 	os_free(conf->friendly_name);
- 	os_free(conf->manufacturer_url);
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -456,6 +456,7 @@ struct hostapd_bss_config {
- 	int force_per_enrollee_psk;
- 	u8 *ap_settings;
- 	size_t ap_settings_len;
-+	struct hostapd_ssid multi_ap_backhaul_ssid;
- 	char *upnp_iface;
- 	char *friendly_name;
- 	char *manufacturer_url;
---- a/src/ap/wps_hostapd.c
-+++ b/src/ap/wps_hostapd.c
-@@ -962,6 +962,7 @@ static void hostapd_free_wps(struct wps_
- 		wpabuf_free(wps->dev.vendor_ext[i]);
- 	wps_device_data_free(&wps->dev);
- 	os_free(wps->network_key);
-+	os_free(wps->multi_ap_backhaul_network_key);
- 	hostapd_wps_nfc_clear(wps);
- 	wpabuf_free(wps->dh_pubkey);
- 	wpabuf_free(wps->dh_privkey);
-@@ -1131,6 +1132,31 @@ int hostapd_init_wps(struct hostapd_data
- 		wps->encr_types_wpa = WPS_ENCR_AES | WPS_ENCR_TKIP;
- 	}
- 
-+	if (hapd->conf->multi_ap & FRONTHAUL_BSS &&
-+	    hapd->conf->multi_ap_backhaul_ssid.ssid_len) {
-+		wps->multi_ap_backhaul_ssid_len =
-+			hapd->conf->multi_ap_backhaul_ssid.ssid_len;
-+		os_memcpy(wps->multi_ap_backhaul_ssid,
-+			  hapd->conf->multi_ap_backhaul_ssid.ssid,
-+			  wps->multi_ap_backhaul_ssid_len);
-+		if (conf->multi_ap_backhaul_ssid.wpa_passphrase) {
-+			wps->multi_ap_backhaul_network_key =
-+				(u8 *) os_strdup(conf->multi_ap_backhaul_ssid.wpa_passphrase);
-+			wps->multi_ap_backhaul_network_key_len =
-+				os_strlen(conf->multi_ap_backhaul_ssid.wpa_passphrase);
-+		} else if (conf->multi_ap_backhaul_ssid.wpa_psk) {
-+			wps->multi_ap_backhaul_network_key =
-+				os_malloc(2 * PMK_LEN + 1);
-+			if (wps->multi_ap_backhaul_network_key == NULL)
-+				goto fail;
-+			wpa_snprintf_hex((char *) wps->multi_ap_backhaul_network_key,
-+					 2 * PMK_LEN + 1,
-+					 conf->multi_ap_backhaul_ssid.wpa_psk->psk,
-+					 PMK_LEN);
-+			wps->multi_ap_backhaul_network_key_len = 2 * PMK_LEN;
-+		}
-+	}
-+
- 	wps->ap_settings = conf->ap_settings;
- 	wps->ap_settings_len = conf->ap_settings_len;
- 
---- a/src/wps/wps.h
-+++ b/src/wps/wps.h
-@@ -100,6 +100,7 @@ struct wps_device_data {
- 	struct wpabuf *vendor_ext[MAX_WPS_VENDOR_EXTENSIONS];
- 
- 	int p2p;
-+	u8 multi_ap_ext;
- };
- 
- /**
-@@ -730,6 +731,37 @@ struct wps_context {
- 	int psk_set;
- 
- 	/**
-+	 * multi_ap_backhaul_ssid - SSID to supply to a Multi-AP backhaul
-+	 * enrollee
-+	 *
-+	 * This SSID is used by the Registrar to fill in information for
-+	 * Credentials when the enrollee advertises it is a Multi-AP backhaul
-+	 * STA.
-+	 */
-+	u8 multi_ap_backhaul_ssid[SSID_MAX_LEN];
-+
-+	/**
-+	 * multi_ap_backhaul_ssid_len - Length of multi_ap_backhaul_ssid in
-+	 * octets
-+	 */
-+	size_t multi_ap_backhaul_ssid_len;
-+
-+	/**
-+	 * multi_ap_backhaul_network_key - The Network Key (PSK) for the
-+	 * Multi-AP backhaul enrollee.
-+	 *
-+	 * This key can be either the ASCII passphrase (8..63 characters) or the
-+	 * 32-octet PSK (64 hex characters).
-+	 */
-+	u8 *multi_ap_backhaul_network_key;
-+
-+	/**
-+	 * multi_ap_backhaul_network_key_len - Length of
-+	 * multi_ap_backhaul_network_key in octets
-+	 */
-+	size_t multi_ap_backhaul_network_key_len;
-+
-+	/**
- 	 * ap_settings - AP Settings override for M7 (only used at AP)
- 	 *
- 	 * If %NULL, AP Settings attributes will be generated based on the
---- a/src/wps/wps_attr_parse.c
-+++ b/src/wps/wps_attr_parse.c
-@@ -67,6 +67,17 @@ static int wps_set_vendor_ext_wfa_subele
- 		}
- 		attr->registrar_configuration_methods = pos;
- 		break;
-+	case WFA_ELEM_MULTI_AP:
-+		if (len != 1) {
-+			wpa_printf(MSG_DEBUG,
-+				   "WPS: Invalid Multi-AP Extension length %u",
-+				   len);
-+			return -1;
-+		}
-+		attr->multi_ap_ext = *pos;
-+		wpa_printf(MSG_DEBUG, "WPS: Multi-AP Extension 0x%02x",
-+			   attr->multi_ap_ext);
-+		break;
- 	default:
- 		wpa_printf(MSG_MSGDUMP, "WPS: Skipped unknown WFA Vendor "
- 			   "Extension subelement %u", id);
---- a/src/wps/wps_attr_parse.h
-+++ b/src/wps/wps_attr_parse.h
-@@ -97,6 +97,7 @@ struct wps_parse_attr {
- 	const u8 *cred[MAX_CRED_COUNT];
- 	const u8 *req_dev_type[MAX_REQ_DEV_TYPE_COUNT];
- 	const u8 *vendor_ext[MAX_WPS_PARSE_VENDOR_EXT];
-+	u8 multi_ap_ext;
- };
- 
- int wps_parse_msg(const struct wpabuf *msg, struct wps_parse_attr *attr);
---- a/src/wps/wps_dev_attr.c
-+++ b/src/wps/wps_dev_attr.c
-@@ -389,6 +389,11 @@ int wps_process_os_version(struct wps_de
- 	return 0;
- }
- 
-+void wps_process_vendor_ext_m1(struct wps_device_data *dev, const u8 ext)
-+{
-+	dev->multi_ap_ext = ext;
-+	wpa_printf(MSG_DEBUG, "WPS: Multi-AP extension value %02x", dev->multi_ap_ext);
-+}
- 
- int wps_process_rf_bands(struct wps_device_data *dev, const u8 *bands)
- {
---- a/src/wps/wps_dev_attr.h
-+++ b/src/wps/wps_dev_attr.h
-@@ -29,6 +29,7 @@ int wps_build_dev_name(struct wps_device
- int wps_process_device_attrs(struct wps_device_data *dev,
- 			     struct wps_parse_attr *attr);
- int wps_process_os_version(struct wps_device_data *dev, const u8 *ver);
-+void wps_process_vendor_ext_m1(struct wps_device_data *dev, const u8 ext);
- int wps_process_rf_bands(struct wps_device_data *dev, const u8 *bands);
- void wps_device_data_free(struct wps_device_data *dev);
- int wps_build_vendor_ext(struct wps_device_data *dev, struct wpabuf *msg);
---- a/src/wps/wps_registrar.c
-+++ b/src/wps/wps_registrar.c
-@@ -1588,7 +1588,6 @@ int wps_build_credential_wrap(struct wpa
- 	return 0;
- }
- 
--
- int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
- {
- 	struct wpabuf *cred;
-@@ -1603,6 +1602,29 @@ int wps_build_cred(struct wps_data *wps,
- 	}
- 	os_memset(&wps->cred, 0, sizeof(wps->cred));
- 
-+	if (wps->peer_dev.multi_ap_ext == MULTI_AP_BACKHAUL_STA &&
-+	    wps->wps->multi_ap_backhaul_ssid_len) {
-+		wpa_printf(MSG_DEBUG, "WPS: Use backhaul STA credentials");
-+		os_memcpy(wps->cred.ssid, wps->wps->multi_ap_backhaul_ssid,
-+			  wps->wps->multi_ap_backhaul_ssid_len);
-+		wps->cred.ssid_len = wps->wps->multi_ap_backhaul_ssid_len;
-+		/* Backhaul is always WPA2PSK */
-+		wps->cred.auth_type = WPS_AUTH_WPA2PSK;
-+		wps->cred.encr_type = WPS_ENCR_AES;
-+		/* Set MAC address in the Credential to be the Enrollee's MAC
-+		 * address
-+		 */
-+		os_memcpy(wps->cred.mac_addr, wps->mac_addr_e, ETH_ALEN);
-+		if (wps->wps->multi_ap_backhaul_network_key) {
-+			os_memcpy(wps->cred.key,
-+				  wps->wps->multi_ap_backhaul_network_key,
-+				  wps->wps->multi_ap_backhaul_network_key_len);
-+			wps->cred.key_len =
-+				wps->wps->multi_ap_backhaul_network_key_len;
-+		}
-+		goto use_provided;
-+	}
-+
- 	os_memcpy(wps->cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
- 	wps->cred.ssid_len = wps->wps->ssid_len;
- 
-@@ -2705,6 +2727,7 @@ static enum wps_process_res wps_process_
- 		wps->use_psk_key = 1;
- 	}
- #endif /* WPS_WORKAROUNDS */
-+	wps_process_vendor_ext_m1(&wps->peer_dev, attr->multi_ap_ext);
- 
- 	wps->state = SEND_M2;
- 	return WPS_CONTINUE;

package/network/services/hostapd/patches/558-hostapd-add-README-MULTI-AP.patch

@@ -1,181 +0,0 @@
-From bd733055a22c8ca3bcd7648bf716da2713b3d9f1 Mon Sep 17 00:00:00 2001
-From: "Arnout Vandecappelle (Essensium/Mind)" <arnout@mind.be>
-Date: Mon, 21 Jan 2019 16:44:06 +0100
-Subject: [PATCH] hostapd: add README-MULTI-AP
-
-Document what hostapd and wpa_supplicant do for Multi-AP.
-
-This is only included in hostapd, since a Multi-AP device is always an
-access point so it should have hostapd.
-
-Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
----
-v4: wps_pbc has multi_ap as a parameter instead of config option.
----
- hostapd/README-MULTI-AP | 160 ++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 160 insertions(+)
- create mode 100644 hostapd/README-MULTI-AP
-
---- /dev/null
-+++ b/hostapd/README-MULTI-AP
-@@ -0,0 +1,160 @@
-+hostapd, wpa_supplicant and the Multi-AP Specification
-+======================================================
-+
-+This document describes how hostapd and wpa_supplicant can be configured to
-+support the Multi-AP Specification.
-+
-+Introduction to Multi-AP
-+------------------------
-+
-+The Wi-Fi Alliance Multi-AP Specification is the technical specification for
-+Wi-Fi CERTIFIED EasyMesh(TM) [1], the Wi-Fi Alliance® certification program for
-+Multi-AP. It defines control protocols between Wi-Fi® access points (APs) to
-+join them into a network with centralized control and operation. It is targeted
-+only at routers (repeaters, gateways, ...), not at clients. Clients are not
-+involved at all in the protocols.
-+
-+Most of the Multi-AP specification falls outside of the scope of
-+hostapd/wpa_supplicant. hostapd/wpa_supplicant is only involved for the items
-+summarized below. The rest of the protocol must be implemented by a separate
-+daemon, e.g. prplMesh [2]. That daemon also needs to communicate with hostapd,
-+e.g. to get a list of associated clients, but this can be done using the normal
-+hostapd interfaces.
-+
-+hostapd/wpa_supplicant needs to be configured specifically to support:
-+- the WPS onboarding process;
-+- configuring backhaul links.
-+
-+The text below refers to "Multi-AP Specification v1.0" [3].
-+
-+
-+Fronthaul and backhaul links
-+----------------------------
-+
-+In a Multi-AP network, the central controller can configure the SSIDs on the
-+devices that are joined into the network. These are called fronthaul SSIDs.
-+From the point of view of hostapd, there is nothing special about these
-+fronthaul SSIDs.
-+
-+In addition to fronthaul SSIDs, the controller can also configure backhaul
-+links. A backhaul link is a link between two access point devices, giving
-+internet access to access point devices that don't have a wired link. The
-+Multi-AP specification doesn't dictate this, but typically the backhaul link
-+will be bridged into a LAN together with (one of) the fronthaul SSID(s) and the
-+wired Ethernet ports.
-+
-+A backhaul link must be treated specially by hostapd and wpa_supplicant. One
-+side of the backhaul link is configured through the Multi-AP protocol as the
-+"backhaul STA", i.e. the client side of the link. A backhaul STA is like any
-+station and is handled appropriately by wpa_supplicant, but two additional
-+features are required. It must send an additional information element in each
-+(Re-)Association Request ([3], section 5.2, paragraph 4). In addition, it must
-+use 4-address mode for all frames sent over this link ([3], section 14).
-+Therefore, wpa_supplicant must be configured explicitly as the backhaul STA
-+role, by setting 'multi_ap_backhaul_sta=1' in the network configuration block
-+or when configuring the SSID through the client socket. When
-+'multi_ap_backhaul_sta=1', wpa_supplicant includes the Multi-AP IE in
-+(Re-)Association Request messages and verifies that it is included in the
-+(Re-)Association Response. If it is not, association fails. If it is,
-+wpa_supplicant sets 4-address mode for this interface through a driver
-+callback.
-+
-+The AP side of the backhaul link is called a "backhaul SSID". Such an SSID must
-+be handled specially by hostapd, because it must add an additional information
-+element in each (Re-)Association Response, but only to stations that have
-+identified themselves as backhaul stations ([3], section 5.2, paragraph 5-6).
-+This is important because it is possible to use the same BSS and SSID for
-+fronthaul and backhaul at the same time. The additional information element must
-+only be used for frames sent to a backhaul STA, not to a normal STA. Also,
-+frames sent to a backhaul STA must use 4-address mode, while frames sent to a
-+normal STA (fronthaul, when it's a fronthaul and backhaul SSID) must use
-+3-address mode.
-+
-+An SSID is configured in Multi-AP mode in hostapd by setting the 'multi_ap'
-+configuration option to 1 (backhaul SSID), 2 (fronthaul SSID) or 3
-+(simultaneous backhaul and fronthaul SSID). If this option is set, hostapd
-+parses the Multi-AP information element in the Association Request. If the
-+station is a backhaul STA and the SSID is configured as a backhaul SSID,
-+hostapd sets up 4-address mode. Since there may be multiple stations connected
-+simultaneously, and each of them has a different RA (receiver address), a VLAN
-+is created for each backhaul STA and it is automatically added to a bridge.
-+This is the same behavior as for WDS, and the relevant option ('bridge' or
-+'wds_bridge') applies here as well.
-+
-+If 'multi_ap' is 1 (backhaul SSID only), any station that tries to associate
-+without the Multi-AP information element will be denied.
-+
-+If 'multi_ap' is 2 (fronthaul SSID only), any station that tries to associate
-+with the Multi-AP information element will be denied. That is also the only
-+difference with 'multi_ap' set to 0: in the latter case, the Multi-AP
-+information element is simply ignored.
-+
-+In summary, this is the end-to-end behaviour for a backhaul BSS (i.e.,
-+multi_ap_backhaul_sta=1 in wpa_supplicant on STA, and multi_ap=1 or 3 in
-+hostapd on AP). Note that point 1 means that hostapd must not be configured
-+with WPS support on the backhaul BSS (multi_ap=1). hostapd does not check for
-+that.
-+
-+1. Backhaul BSS beacons do not advertise WPS support (other than that, nothing
-+   multi-ap specific).
-+2. STA sends authentication req (nothing multi-ap specific).
-+3. AP sends authentication resp (nothing multi-ap specific).
-+4. STA sends association req with Multi-AP IE.
-+5. AP send association resp with Multi-AP IE.
-+6. STA and AP both use 4-address mode for data.
-+
-+
-+WPS support
-+-----------
-+
-+WPS requires more special handling. WPS must only be advertised on fronthaul
-+SSIDs, not on backhaul SSIDs, so WPS should not be enabled on a backhaul-only
-+SSID in hostapd.conf. The WPS configuration purely works on the fronthaul SSID.
-+When a WPS M1 message has an additional subelement that indicates a request for
-+a multi-AP backhaul link, hostapd must not respond with the normal fronthaul
-+SSID credentials; instead, it should respond with the (potentially different)
-+backhaul SSID credentials.
-+
-+To support this, hostapd has the 'multi_ap_backhaul_ssid',
-+'multi_ap_backhaul_wpa_psk' and 'multi_ap_backhaul_wpa_passphrase' options.
-+When these are set on an SSID with WPS, they are used instead of the normal
-+credentials when hostapd receives a WPS M1 message with the Multi-AP IE. Only
-+WPA2 Personal is supported in the Multi-AP specification, so there is no need
-+to specify authentication or encryption options. For the backhaul credentials,
-+per-device PSK is not supported.
-+
-+If the SSID is a simultaneous backhaul and fronthaul SSID, there is no need to
-+specify the backhaul credentials, since the backhaul and fronthaul credentials
-+are identical.
-+
-+To enable the Multi-AP backhaul STA feature when it performs WPS, a new
-+parameter has been introduced to the WPS_PBC control interface call.
-+When this option is set, it adds the multi-AP backhaul subelement to
-+the association and M1 messages. It then configures the new SSID with
-+'multi_ap_backhaul_sta=1'. Note that this means that if the AP does not
-+follow the Multi-AP specification, wpa_supplicant will fail to
-+associate.
-+
-+In summary, this is the end-to-end behaviour for WPS of a backhaul link (i.e.,
-+multi_ap=1 option is given in the wps_pbc call on the STA side, and multi_ap=2
-+and multi_ap_backhaul_ssid and either multi_ap_backhaul_wpa_psk or
-+multi_ap_backhaul_wpa_passphrase are set to the credentials of a backhaul SSID
-+in hostapd on registrar AP).
-+
-+1. Fronthaul BSS beacons advertise WPS support (nothing multi-ap specific).
-+2. Enrollee sends authentication req (nothing multi-ap specific).
-+3. AP sends authentication resp (nothing multi-ap specific).
-+4. Enrollee sends association req with Multi-AP IE.
-+5. AP send association resp with Multi-AP IE.
-+6. Enrollee sends M1 with additional Multi-AP subelement
-+7. AP sends M8 with backhaul instead of fronthaul credentials.
-+8. Enrollee sends Deauth.
-+
-+
-+References
-+----------
-+
-+[1] https://www.wi-fi.org/discover-wi-fi/wi-fi-easymesh
-+[2] https://github.com/prplfoundation/prplMesh
-+[3] https://www.wi-fi.org/file/multi-ap-specification-v10
-+    (requires registration)

package/network/services/hostapd/patches/559-tests-add-WPS-tests-to-multi_ap-hwsim-tests.patch

@@ -1,182 +0,0 @@
-From 0729e01f5830ebf4701f0b1b7ff1bd2a2eedae40 Mon Sep 17 00:00:00 2001
-From: "Arnout Vandecappelle (Essensium/Mind)" <arnout@mind.be>
-Date: Tue, 12 Feb 2019 11:02:42 +0100
-Subject: [PATCH] tests: add WPS tests to multi_ap hwsim tests
-
-Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
----
-v4: new patch
----
- tests/hwsim/test_multi_ap.py | 164 +++++++++++++++++++++++++++++++++++
- 1 file changed, 164 insertions(+)
-
---- a/tests/hwsim/test_multi_ap.py
-+++ b/tests/hwsim/test_multi_ap.py
-@@ -61,3 +61,167 @@ def test_multi_ap_fronthaul_on_ap(dev, a
-         raise Exception("Connection result not reported")
-     if "CTRL-EVENT-DISCONNECTED" not in ev:
-         raise Exception("Unexpected connection result")
-+
-+def run_multi_ap_wps(dev, apdev, params, multi_ap_bssid = None):
-+    """Helper for running Multi-AP WPS tests
-+
-+    dev[0] does multi_ap WPS, dev[1] does normal WPS. apdev[0] is the fronthaul
-+    BSS. If there is a separate backhaul BSS, it must have been set up by the
-+    caller. params are the normal SSID parameters, they will be extended with
-+    the WPS parameters. multi_ap_bssid must be given if it is not equal to the
-+    fronthaul BSSID."""
-+
-+    if multi_ap_bssid is None:
-+        multi_ap_bssid = apdev[0]['bssid']
-+    params.update({"wps_state": "2", "eap_server": "1"})
-+
-+    # WPS with multi-ap station dev[0]
-+    hapd = hostapd.add_ap(apdev[0], params)
-+    hapd.request("WPS_PBC")
-+    if "PBC Status: Active" not in hapd.request("WPS_GET_STATUS"):
-+        raise Exception("PBC status not shown correctly")
-+
-+    dev[0].request("WPS_PBC multi_ap=1")
-+    dev[0].wait_connected(timeout=20)
-+    status = dev[0].get_status()
-+    if status['wpa_state'] != 'COMPLETED' or status['bssid'] != multi_ap_bssid:
-+        raise Exception("Not fully connected")
-+    if status['ssid'] != params['multi_ap_backhaul_ssid'].strip('"'):
-+        raise Exception("Unexpected SSID %s != %s" % (status['ssid'], params["multi_ap_backhaul_ssid"]))
-+    if status['pairwise_cipher'] != 'CCMP':
-+        raise Exception("Unexpected encryption configuration %s" % status['pairwise_cipher'])
-+    if status['key_mgmt'] != 'WPA2-PSK':
-+        raise Exception("Unexpected key_mgmt")
-+
-+    status = hapd.request("WPS_GET_STATUS")
-+    if "PBC Status: Disabled" not in status:
-+        raise Exception("PBC status not shown correctly")
-+    if "Last WPS result: Success" not in status:
-+        raise Exception("Last WPS result not shown correctly")
-+    if "Peer Address: " + dev[0].p2p_interface_addr() not in status:
-+        raise Exception("Peer address not shown correctly")
-+
-+    if len(dev[0].list_networks()) != 1:
-+        raise Exception("Unexpected number of network blocks")
-+
-+    # WPS with non-multi-ap station dev[1]
-+    hapd.request("WPS_PBC")
-+    if "PBC Status: Active" not in hapd.request("WPS_GET_STATUS"):
-+        raise Exception("PBC status not shown correctly")
-+
-+    dev[1].request("WPS_PBC")
-+    dev[1].wait_connected(timeout=20)
-+    status = dev[1].get_status()
-+    if status['wpa_state'] != 'COMPLETED' or status['bssid'] != apdev[0]['bssid']:
-+        raise Exception("Not fully connected")
-+    if status['ssid'] != params["ssid"]:
-+        raise Exception("Unexpected SSID")
-+    # Fronthaul may be something else than WPA2-PSK so don't test it.
-+
-+    status = hapd.request("WPS_GET_STATUS")
-+    if "PBC Status: Disabled" not in status:
-+        raise Exception("PBC status not shown correctly")
-+    if "Last WPS result: Success" not in status:
-+        raise Exception("Last WPS result not shown correctly")
-+    if "Peer Address: " + dev[1].p2p_interface_addr() not in status:
-+        raise Exception("Peer address not shown correctly")
-+
-+    if len(dev[1].list_networks()) != 1:
-+        raise Exception("Unexpected number of network blocks")
-+
-+
-+def test_multi_ap_wps_shared(dev, apdev):
-+    """WPS on shared fronthaul/backhaul AP"""
-+    ssid = "multi-ap-wps"
-+    passphrase = "12345678"
-+    params = hostapd.wpa2_params(ssid=ssid, passphrase=passphrase)
-+    params.update({"multi_ap": "3",
-+                   "multi_ap_backhaul_ssid": '"%s"' % ssid,
-+                   "multi_ap_backhaul_wpa_passphrase": passphrase})
-+    run_multi_ap_wps(dev, apdev, params)
-+
-+def test_multi_ap_wps_shared_psk(dev, apdev):
-+    """WPS on shared fronthaul/backhaul AP using PSK"""
-+    ssid = "multi-ap-wps"
-+    psk = "1234567890abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
-+    params = hostapd.wpa2_params(ssid=ssid)
-+    params.update({"wpa_psk": psk, "multi_ap": "3",
-+                   "multi_ap_backhaul_ssid": '"%s"' % ssid,
-+                   "multi_ap_backhaul_wpa_psk": psk})
-+    run_multi_ap_wps(dev, apdev, params)
-+
-+def test_multi_ap_wps_split(dev, apdev):
-+    """WPS on split fronthaul and backhaul AP"""
-+    backhaul_ssid = "multi-ap-backhaul-wps"
-+    backhaul_passphrase = "87654321"
-+    params = hostapd.wpa2_params(ssid="multi-ap-fronthaul-wps", passphrase="12345678")
-+    params.update({"multi_ap": "2",
-+                   "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid,
-+                   "multi_ap_backhaul_wpa_passphrase": backhaul_passphrase})
-+    params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid, passphrase=backhaul_passphrase)
-+    params_backhaul.update({"multi_ap": "1"})
-+    hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul)
-+
-+    run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr())
-+
-+def test_multi_ap_wps_split_psk(dev, apdev):
-+    """WPS on split fronthaul and backhaul AP"""
-+    backhaul_ssid = "multi-ap-backhaul-wps"
-+    backhaul_psk = "1234567890abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
-+    params = hostapd.wpa2_params(ssid="multi-ap-fronthaul-wps", passphrase="12345678")
-+    params.update({"multi_ap": "2",
-+                   "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid,
-+                   "multi_ap_backhaul_wpa_psk": backhaul_psk})
-+    params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid)
-+    params_backhaul.update({"multi_ap": "1", "wpa_psk": backhaul_psk})
-+    hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul)
-+
-+    run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr())
-+
-+def test_multi_ap_wps_split_mixed(dev, apdev):
-+    """WPS on split fronthaul and backhaul AP with mixed-mode fronthaul"""
-+    backhaul_ssid = "multi-ap-backhaul-wps"
-+    backhaul_passphrase = "87654321"
-+    params = hostapd.wpa_mixed_params(ssid="multi-ap-fronthaul-wps", passphrase="12345678")
-+    params.update({"multi_ap": "2",
-+                   "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid,
-+                   "multi_ap_backhaul_wpa_passphrase": backhaul_passphrase})
-+    params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid, passphrase=backhaul_passphrase)
-+    params_backhaul.update({"multi_ap": "1"})
-+    hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul)
-+
-+    run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr())
-+
-+def test_multi_ap_wps_split_open(dev, apdev):
-+    """WPS on split fronthaul and backhaul AP with open fronthaul"""
-+    backhaul_ssid = "multi-ap-backhaul-wps"
-+    backhaul_passphrase = "87654321"
-+    params = {"ssid": "multi-ap-wps-fronthaul", "multi_ap": "2",
-+              "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid,
-+              "multi_ap_backhaul_wpa_passphrase": backhaul_passphrase}
-+    params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid, passphrase=backhaul_passphrase)
-+    params_backhaul.update({"multi_ap": "1"})
-+    hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul)
-+
-+    run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr())
-+
-+def test_multi_ap_wps_fail_non_multi_ap(dev, apdev):
-+    """Multi-AP WPS on non-WPS AP fails"""
-+
-+    params = hostapd.wpa2_params(ssid="non-multi-ap-wps", passphrase="12345678")
-+    params.update({"wps_state": "2", "eap_server": "1"})
-+
-+    hapd = hostapd.add_ap(apdev[0], params)
-+    hapd.request("WPS_PBC")
-+    if "PBC Status: Active" not in hapd.request("WPS_GET_STATUS"):
-+        raise Exception("PBC status not shown correctly")
-+
-+    dev[0].request("WPS_PBC multi_ap=1")
-+    # Since we will fail to associate and WPS doesn't even get started, there
-+    # isn't much we can do except wait for timeout. For PBC, it is not possible
-+    # to change the timeout from 2 minutes. Instead of waiting for the timeout,
-+    # just check that WPS doesn't finish within reasonable time.
-+    ev = dev[0].wait_event(["WPS-SUCCESS", "WPS-FAIL"], timeout=20)
-+    if ev:
-+        raise Exception("WPS operation completed: " + ev)
-+    dev[0].request("WPS_CANCEL")

package/network/services/hostapd/patches/600-ubus_support.patch

@@ -20,9 +20,9 @@
  #include "drivers/driver.h"
 +#include "ubus.h"
  
- #define OCE_STA_CFON_ENABLED(hapd) \
- 	((hapd->conf->oce & OCE_STA_CFON) && \
-@@ -136,6 +137,7 @@ struct hostapd_data {
+ struct wpa_ctrl_dst;
+ struct radius_server_data;
+@@ -129,6 +130,7 @@ struct hostapd_data {
  	struct hostapd_iface *iface;
  	struct hostapd_config *iconf;
  	struct hostapd_bss_config *conf;
@@ -30,7 +30,7 @@
  	int interface_added; /* virtual interface added for this BSS */
  	unsigned int started:1;
  	unsigned int disabled:1;
-@@ -547,6 +549,7 @@ hostapd_alloc_bss_data(struct hostapd_if
+@@ -544,6 +546,7 @@ hostapd_alloc_bss_data(struct hostapd_if
  		       struct hostapd_bss_config *bss);
  int hostapd_setup_interface(struct hostapd_iface *iface);
  int hostapd_setup_interface_complete(struct hostapd_iface *iface, int err);
@@ -40,7 +40,7 @@
  struct hostapd_iface * hostapd_alloc_iface(void);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -373,6 +373,7 @@ static void hostapd_free_hapd_data(struc
+@@ -315,6 +315,7 @@ static void hostapd_free_hapd_data(struc
  	hapd->started = 0;
  
  	wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface);
@@ -48,7 +48,7 @@
  	iapp_deinit(hapd->iapp);
  	hapd->iapp = NULL;
  	accounting_deinit(hapd);
-@@ -1295,6 +1296,8 @@ static int hostapd_setup_bss(struct host
+@@ -1237,6 +1238,8 @@ static int hostapd_setup_bss(struct host
  	if (hapd->driver && hapd->driver->set_operstate)
  		hapd->driver->set_operstate(hapd->drv_priv, 1);
  
@@ -57,7 +57,7 @@
  	return 0;
  }
  
-@@ -1709,7 +1712,7 @@ static enum nr_chan_width hostapd_get_nr
+@@ -1651,7 +1654,7 @@ static enum nr_chan_width hostapd_get_nr
  #endif /* NEED_AP_MLME */
  
  
@@ -66,7 +66,7 @@
  {
  #ifdef NEED_AP_MLME
  	u16 capab = hostapd_own_capab_info(hapd);
-@@ -1930,6 +1933,7 @@ static int hostapd_setup_interface_compl
+@@ -1872,6 +1875,7 @@ static int hostapd_setup_interface_compl
  	if (err)
  		goto fail;
  
@@ -74,7 +74,7 @@
  	wpa_printf(MSG_DEBUG, "Completing interface initialization");
  	if (iface->conf->channel) {
  #ifdef NEED_AP_MLME
-@@ -2110,6 +2114,7 @@ dfs_offload:
+@@ -2052,6 +2056,7 @@ dfs_offload:
  
  fail:
  	wpa_printf(MSG_ERROR, "Interface initialization failed");
@@ -82,7 +82,7 @@
  	hostapd_set_state(iface, HAPD_IFACE_DISABLED);
  	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED);
  #ifdef CONFIG_FST
-@@ -2576,6 +2581,7 @@ void hostapd_interface_deinit_free(struc
+@@ -2517,6 +2522,7 @@ void hostapd_interface_deinit_free(struc
  		   (unsigned int) iface->conf->num_bss);
  	driver = iface->bss[0]->driver;
  	drv_priv = iface->bss[0]->drv_priv;
@@ -92,7 +92,7 @@
  		   __func__, driver, drv_priv);
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -1759,12 +1759,13 @@ ieee802_11_set_radius_info(struct hostap
+@@ -1714,12 +1714,13 @@ ieee802_11_set_radius_info(struct hostap
  
  
  static void handle_auth(struct hostapd_data *hapd,
@@ -108,7 +108,7 @@
  	u16 fc;
  	const u8 *challenge = NULL;
  	u32 session_timeout, acct_interim_interval;
-@@ -1775,6 +1776,11 @@ static void handle_auth(struct hostapd_d
+@@ -1730,6 +1731,11 @@ static void handle_auth(struct hostapd_d
  	char *identity = NULL;
  	char *radius_cui = NULL;
  	u16 seq_ctrl;
@@ -120,7 +120,7 @@
  
  	if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
  		wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
-@@ -1935,6 +1941,13 @@ static void handle_auth(struct hostapd_d
+@@ -1890,6 +1896,13 @@ static void handle_auth(struct hostapd_d
  		resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
  		goto fail;
  	}
@@ -134,7 +134,7 @@
  	if (res == HOSTAPD_ACL_PENDING)
  		return;
  
-@@ -3287,12 +3300,12 @@ void fils_hlp_timeout(void *eloop_ctx, v
+@@ -3169,12 +3182,12 @@ void fils_hlp_timeout(void *eloop_ctx, v
  
  static void handle_assoc(struct hostapd_data *hapd,
  			 const struct ieee80211_mgmt *mgmt, size_t len,
@@ -149,7 +149,7 @@
  	struct sta_info *sta;
  	u8 *tmp = NULL;
  	struct hostapd_sta_wpa_psk_short *psk = NULL;
-@@ -3301,6 +3314,11 @@ static void handle_assoc(struct hostapd_
+@@ -3183,6 +3196,11 @@ static void handle_assoc(struct hostapd_
  #ifdef CONFIG_FILS
  	int delay_assoc = 0;
  #endif /* CONFIG_FILS */
@@ -161,7 +161,7 @@
  
  	if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
  				      sizeof(mgmt->u.assoc_req))) {
-@@ -3472,6 +3490,14 @@ static void handle_assoc(struct hostapd_
+@@ -3354,6 +3372,14 @@ static void handle_assoc(struct hostapd_
  	}
  #endif /* CONFIG_MBO */
  
@@ -176,7 +176,7 @@
  	/*
  	 * sta->capability is used in check_assoc_ies() for RRM enabled
  	 * capability element.
-@@ -3685,6 +3711,7 @@ static void handle_disassoc(struct hosta
+@@ -3567,6 +3593,7 @@ static void handle_disassoc(struct hosta
  	wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
  		   MAC2STR(mgmt->sa),
  		   le_to_host16(mgmt->u.disassoc.reason_code));
@@ -184,7 +184,7 @@
  
  	sta = ap_get_sta(hapd, mgmt->sa);
  	if (sta == NULL) {
-@@ -3750,6 +3777,8 @@ static void handle_deauth(struct hostapd
+@@ -3632,6 +3659,8 @@ static void handle_deauth(struct hostapd
  		" reason_code=%d",
  		MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code));
  
@@ -193,7 +193,7 @@
  	sta = ap_get_sta(hapd, mgmt->sa);
  	if (sta == NULL) {
  		wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
-@@ -4077,7 +4106,7 @@ int ieee802_11_mgmt(struct hostapd_data
+@@ -3951,7 +3980,7 @@ int ieee802_11_mgmt(struct hostapd_data
  
  
  	if (stype == WLAN_FC_STYPE_PROBE_REQ) {
@@ -202,7 +202,7 @@
  		return 1;
  	}
  
-@@ -4097,17 +4126,17 @@ int ieee802_11_mgmt(struct hostapd_data
+@@ -3971,17 +4000,17 @@ int ieee802_11_mgmt(struct hostapd_data
  	switch (stype) {
  	case WLAN_FC_STYPE_AUTH:
  		wpa_printf(MSG_DEBUG, "mgmt::auth");
@@ -225,7 +225,7 @@
  	case WLAN_FC_STYPE_DISASSOC:
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -725,7 +725,7 @@ void sta_track_claim_taxonomy_info(struc
+@@ -720,7 +720,7 @@ void sta_track_claim_taxonomy_info(struc
  
  void handle_probe_req(struct hostapd_data *hapd,
  		      const struct ieee80211_mgmt *mgmt, size_t len,
@@ -234,7 +234,7 @@
  {
  	u8 *resp;
  	struct ieee802_11_elems elems;
-@@ -734,6 +734,7 @@ void handle_probe_req(struct hostapd_dat
+@@ -729,6 +729,7 @@ void handle_probe_req(struct hostapd_dat
  	size_t i, resp_len;
  	int noack;
  	enum ssid_match_result res;
@@ -242,7 +242,7 @@
  	int ret;
  	u16 csa_offs[2];
  	size_t csa_offs_len;
-@@ -742,6 +743,12 @@ void handle_probe_req(struct hostapd_dat
+@@ -737,6 +738,11 @@ void handle_probe_req(struct hostapd_dat
  	struct hostapd_sta_wpa_psk_short *psk = NULL;
  	char *identity = NULL;
  	char *radius_cui = NULL;
@@ -250,12 +250,11 @@
 +		.type = HOSTAPD_UBUS_PROBE_REQ,
 +		.mgmt_frame = mgmt,
 +		.frame_info = fi,
-+		.elems = &elems,
 +	};
  
  	if (len < IEEE80211_HDRLEN)
  		return;
-@@ -919,6 +926,12 @@ void handle_probe_req(struct hostapd_dat
+@@ -914,6 +920,12 @@ void handle_probe_req(struct hostapd_dat
  	}
  #endif /* CONFIG_P2P */
  
@@ -307,7 +306,7 @@
  		wpabuf_free(sta->p2p_ie);
 --- a/src/ap/sta_info.c
 +++ b/src/ap/sta_info.c
-@@ -416,6 +416,7 @@ void ap_handle_timer(void *eloop_ctx, vo
+@@ -415,6 +415,7 @@ void ap_handle_timer(void *eloop_ctx, vo
  			       HOSTAPD_LEVEL_INFO, "deauthenticated due to "
  			       "local deauth request");
  		ap_free_sta(hapd, sta);
@@ -315,7 +314,7 @@
  		return;
  	}
  
-@@ -563,6 +564,7 @@ skip_poll:
+@@ -562,6 +563,7 @@ skip_poll:
  			hapd, sta,
  			WLAN_REASON_PREV_AUTH_NOT_VALID);
  		ap_free_sta(hapd, sta);
@@ -323,7 +322,7 @@
  		break;
  	}
  }
-@@ -1224,6 +1226,7 @@ void ap_sta_set_authorized(struct hostap
+@@ -1223,6 +1225,7 @@ void ap_sta_set_authorized(struct hostap
  					  buf, ip_addr);
  	} else {
  		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf);
@@ -341,85 +340,3 @@
  }
  
  
---- a/wpa_supplicant/Makefile
-+++ b/wpa_supplicant/Makefile
-@@ -189,6 +189,12 @@ ifdef CONFIG_EAPOL_TEST
- CFLAGS += -Werror -DEAPOL_TEST
- endif
- 
-+ifdef CONFIG_UBUS
-+CFLAGS += -DUBUS_SUPPORT
-+OBJS += ubus.o
-+LIBS += -lubox -lubus
-+endif
-+
- ifdef CONFIG_CODE_COVERAGE
- CFLAGS += -O0 -fprofile-arcs -ftest-coverage
- LIBS += -lgcov
-@@ -915,6 +921,9 @@ endif
- ifdef CONFIG_IEEE80211AX
- OBJS += ../src/ap/ieee802_11_he.o
- endif
-+ifdef CONFIG_UBUS
-+OBJS += ../src/ap/ubus.o
-+endif
- endif
- ifdef CONFIG_WNM_AP
- CFLAGS += -DCONFIG_WNM_AP
---- a/wpa_supplicant/wpa_supplicant.c
-+++ b/wpa_supplicant/wpa_supplicant.c
-@@ -6080,6 +6080,8 @@ struct wpa_supplicant * wpa_supplicant_a
- 	}
- #endif /* CONFIG_P2P */
- 
-+	wpas_ubus_add_bss(wpa_s);
-+
- 	return wpa_s;
- }
- 
-@@ -6106,6 +6108,8 @@ int wpa_supplicant_remove_iface(struct w
- 	struct wpa_supplicant *parent = wpa_s->parent;
- #endif /* CONFIG_MESH */
- 
-+	wpas_ubus_free_bss(wpa_s);
-+
- 	/* Remove interface from the global list of interfaces */
- 	prev = global->ifaces;
- 	if (prev == wpa_s) {
---- a/wpa_supplicant/wpa_supplicant_i.h
-+++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -17,6 +17,7 @@
- #include "wps/wps_defs.h"
- #include "config_ssid.h"
- #include "wmm_ac.h"
-+#include "ubus.h"
- 
- extern const char *const wpa_supplicant_version;
- extern const char *const wpa_supplicant_license;
-@@ -500,6 +501,7 @@ struct wpa_supplicant {
- 	unsigned char own_addr[ETH_ALEN];
- 	unsigned char perm_addr[ETH_ALEN];
- 	char ifname[100];
-+	struct wpas_ubus_bss ubus;
- #ifdef CONFIG_MATCH_IFACE
- 	int matched;
- #endif /* CONFIG_MATCH_IFACE */
---- a/wpa_supplicant/wps_supplicant.c
-+++ b/wpa_supplicant/wps_supplicant.c
-@@ -33,6 +33,7 @@
- #include "p2p/p2p.h"
- #include "p2p_supplicant.h"
- #include "wps_supplicant.h"
-+#include "ubus.h"
- 
- 
- #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG
-@@ -388,6 +389,8 @@ static int wpa_supplicant_wps_cred(void
- 	wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
- 			cred->cred_attr, cred->cred_attr_len);
- 
-+	wpas_ubus_notify(wpa_s, cred);
-+
- 	if (wpa_s->conf->wps_cred_processing == 1)
- 		return 0;
- 

package/network/services/hostapd/patches/700-fix-openssl11.patch

@@ -0,0 +1,35 @@
+From 672540d4ddbd24782b5c65b35d636bdfe8a90d0f Mon Sep 17 00:00:00 2001
+From: Rosen Penev <rosenp@gmail.com>
+Date: Fri, 15 Jun 2018 18:35:30 -0700
+Subject: [PATCH] Fix compile with OpenSSL 1.1.0 and deprecated APIs
+
+SSL_session_reused is the same as SSL_cache_hit. The engine load stuff is
+now handled by OPENSSL_init.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+---
+ src/crypto/tls_openssl.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/src/crypto/tls_openssl.c
++++ b/src/crypto/tls_openssl.c
+@@ -1024,8 +1024,10 @@ void * tls_init(const struct tls_config
+ 
+ #ifndef OPENSSL_NO_ENGINE
+ 	wpa_printf(MSG_DEBUG, "ENGINE: Loading dynamic engine");
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	ERR_load_ENGINE_strings();
+ 	ENGINE_load_dynamic();
++#endif /* OPENSSL_VERSION_NUMBER */
+ 
+ 	if (conf &&
+ 	    (conf->opensc_engine_path || conf->pkcs11_engine_path ||
+@@ -3874,7 +3876,7 @@ struct wpabuf * tls_connection_decrypt(v
+ 
+ int tls_connection_resumed(void *ssl_ctx, struct tls_connection *conn)
+ {
+-	return conn ? SSL_cache_hit(conn->ssl) : 0;
++	return conn ? SSL_session_reused(conn->ssl) : 0;
+ }
+ 
+ 

package/network/services/hostapd/src/src/ap/ubus.c

@@ -198,21 +198,6 @@ hostapd_bss_get_clients(struct ubus_context *ctx, struct ubus_object *obj,
 	return 0;
 }
 
-static int
-hostapd_bss_get_features(struct ubus_context *ctx, struct ubus_object *obj,
-			struct ubus_request_data *req, const char *method,
-			struct blob_attr *msg)
-{
-	struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
-
-	blob_buf_init(&b, 0);
-	blobmsg_add_u8(&b, "ht_supported", ht_supported(hapd->iface->hw_features));
-	blobmsg_add_u8(&b, "vht_supported", vht_supported(hapd->iface->hw_features));
-	ubus_send_reply(ctx, req, b.head);
-
-	return 0;
-}
-
 enum {
 	NOTIFY_RESPONSE,
 	__NOTIFY_MAX
@@ -382,26 +367,16 @@ hostapd_bss_update_beacon(struct ubus_context *ctx, struct ubus_object *obj,
 enum {
 	CSA_FREQ,
 	CSA_BCN_COUNT,
-	CSA_CENTER_FREQ1,
-	CSA_CENTER_FREQ2,
-	CSA_BANDWIDTH,
-	CSA_SEC_CHANNEL_OFFSET,
-	CSA_HT,
-	CSA_VHT,
-	CSA_BLOCK_TX,
 	__CSA_MAX
 };
 
 static const struct blobmsg_policy csa_policy[__CSA_MAX] = {
+	/*
+	 * for now, frequency and beacon count are enough, add more
+	 * parameters on demand
+	 */
 	[CSA_FREQ] = { "freq", BLOBMSG_TYPE_INT32 },
 	[CSA_BCN_COUNT] = { "bcn_count", BLOBMSG_TYPE_INT32 },
-	[CSA_CENTER_FREQ1] = { "center_freq1", BLOBMSG_TYPE_INT32 },
-	[CSA_CENTER_FREQ2] = { "center_freq2", BLOBMSG_TYPE_INT32 },
-	[CSA_BANDWIDTH] = { "bandwidth", BLOBMSG_TYPE_INT32 },
-	[CSA_SEC_CHANNEL_OFFSET] = { "sec_channel_offset", BLOBMSG_TYPE_INT32 },
-	[CSA_HT] = { "ht", BLOBMSG_TYPE_BOOL },
-	[CSA_VHT] = { "vht", BLOBMSG_TYPE_BOOL },
-	[CSA_BLOCK_TX] = { "block_tx", BLOBMSG_TYPE_BOOL },
 };
 
 #ifdef NEED_AP_MLME
@@ -421,27 +396,12 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
 
 	memset(&css, 0, sizeof(css));
 	css.freq_params.freq = blobmsg_get_u32(tb[CSA_FREQ]);
-
-#define SET_CSA_SETTING(name, field, type) \
-	do { \
-		if (tb[name]) \
-			css.field = blobmsg_get_ ## type(tb[name]); \
-	} while(0)
-
-	SET_CSA_SETTING(CSA_BCN_COUNT, cs_count, u32);
-	SET_CSA_SETTING(CSA_CENTER_FREQ1, freq_params.center_freq1, u32);
-	SET_CSA_SETTING(CSA_CENTER_FREQ2, freq_params.center_freq2, u32);
-	SET_CSA_SETTING(CSA_BANDWIDTH, freq_params.bandwidth, u32);
-	SET_CSA_SETTING(CSA_SEC_CHANNEL_OFFSET, freq_params.sec_channel_offset, u32);
-	SET_CSA_SETTING(CSA_HT, freq_params.ht_enabled, bool);
-	SET_CSA_SETTING(CSA_VHT, freq_params.vht_enabled, bool);
-	SET_CSA_SETTING(CSA_BLOCK_TX, block_tx, bool);
-
+	if (tb[CSA_BCN_COUNT])
+		css.cs_count = blobmsg_get_u32(tb[CSA_BCN_COUNT]);
 
 	if (hostapd_switch_channel(hapd, &css) != 0)
 		return UBUS_STATUS_NOT_SUPPORTED;
 	return UBUS_STATUS_OK;
-#undef SET_CSA_SETTING
 }
 #endif
 
@@ -955,7 +915,6 @@ static const struct ubus_method bss_methods[] = {
 	UBUS_METHOD_NOARG("wps_start", hostapd_bss_wps_start),
 	UBUS_METHOD_NOARG("wps_cancel", hostapd_bss_wps_cancel),
 	UBUS_METHOD_NOARG("update_beacon", hostapd_bss_update_beacon),
-	UBUS_METHOD_NOARG("get_features", hostapd_bss_get_features),
 #ifdef NEED_AP_MLME
 	UBUS_METHOD("switch_chan", hostapd_switch_chan, csa_policy),
 #endif
@@ -1069,47 +1028,6 @@ int hostapd_ubus_handle_event(struct hostapd_data *hapd, struct hostapd_ubus_req
 		blobmsg_add_u32(&b, "signal", req->frame_info->ssi_signal);
 	blobmsg_add_u32(&b, "freq", hapd->iface->freq);
 
-	if (req->elems) {
-		if(req->elems->ht_capabilities)
-		{
-			struct ieee80211_ht_capabilities *ht_capabilities;
-			void *ht_cap, *ht_cap_mcs_set, *mcs_set;
-
-
-			ht_capabilities = (struct ieee80211_ht_capabilities*) req->elems->ht_capabilities;
-			ht_cap = blobmsg_open_table(&b, "ht_capabilities");
-			blobmsg_add_u16(&b, "ht_capabilities_info", ht_capabilities->ht_capabilities_info);
-			ht_cap_mcs_set = blobmsg_open_table(&b, "supported_mcs_set");		
-			blobmsg_add_u16(&b, "a_mpdu_params", ht_capabilities->a_mpdu_params);
-			blobmsg_add_u16(&b, "ht_extended_capabilities", ht_capabilities->ht_extended_capabilities);
-			blobmsg_add_u32(&b, "tx_bf_capability_info", ht_capabilities->tx_bf_capability_info);
-			blobmsg_add_u16(&b, "asel_capabilities", ht_capabilities->asel_capabilities);
-			mcs_set = blobmsg_open_array(&b, "supported_mcs_set");
-			for (int i = 0; i < 16; i++) {
-				blobmsg_add_u16(&b, NULL, (u16) ht_capabilities->supported_mcs_set[i]);
-			}
-			blobmsg_close_array(&b, mcs_set);
-			blobmsg_close_table(&b, ht_cap_mcs_set);
-			blobmsg_close_table(&b, ht_cap);		
-		}
-		if(req->elems->vht_capabilities)
-		{
-			struct ieee80211_vht_capabilities *vht_capabilities;
-			void *vht_cap, *vht_cap_mcs_set;
-
-			vht_capabilities = (struct ieee80211_vht_capabilities*) req->elems->vht_capabilities;
-			vht_cap = blobmsg_open_table(&b, "vht_capabilities");
-			blobmsg_add_u32(&b, "vht_capabilities_info", vht_capabilities->vht_capabilities_info);
-			vht_cap_mcs_set = blobmsg_open_table(&b, "vht_supported_mcs_set");
-			blobmsg_add_u16(&b, "rx_map", vht_capabilities->vht_supported_mcs_set.rx_map);
-			blobmsg_add_u16(&b, "rx_highest", vht_capabilities->vht_supported_mcs_set.rx_highest);
-			blobmsg_add_u16(&b, "tx_map", vht_capabilities->vht_supported_mcs_set.tx_map);
-			blobmsg_add_u16(&b, "tx_highest", vht_capabilities->vht_supported_mcs_set.tx_highest);
-			blobmsg_close_table(&b, vht_cap_mcs_set);
-			blobmsg_close_table(&b, vht_cap);
-		}
-	}
-
 	if (!hapd->ubus.notify_response) {
 		ubus_notify(ctx, &hapd->ubus.obj, type, b.head, -1);
 		return WLAN_STATUS_SUCCESS;