deleted file mode 100644
@@ -1,53 +0,0 @@
-From 809d9d8172db8e2a08ff639875f838b5b86d2641 Mon Sep 17 00:00:00 2001
-From: Sergey Matyukevich <geomatsi@gmail.com>
-Date: Thu, 22 Aug 2024 00:03:41 +0300
-Subject: [PATCH] macsec_linux: Hardware offload requires Linux headers >= v5.7
-
-Hardware offload in Linux macsec driver is enabled in compile time if
-libnl version is >= v3.6. This is not sufficient for successful build
-since enum 'macsec_offload' has been added to Linux header if_link.h
-in kernels v5.6 and v5.7, see commits:
-- https://github.com/torvalds/linux/commit/21114b7feec29e4425a3ac48a037569c016a46c8
-- https://github.com/torvalds/linux/commit/76564261a7db80c5f5c624e0122a28787f266bdf
-
-New libnl with older Linux headers is a valid combination. This is how
-hostapd build failure has been detected by Buildroot autobuilder, see:
-- http://autobuild.buildroot.net/results/b59d5bc5bd17683a3a1e3577c40c802e81911f84/
-
-Extend compile time condition for the enablement of the macsec hardware
-offload adding Linux headers version check.
-
-Fixes: 40c139664439 ("macsec_linux: Add support for MACsec hardware offload")
-Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
-
-Upstream-Status: Backport [https://w1.fi/cgit/hostap/patch/?id=809d9d8172db8e2a08ff639875f838b5b86d2641]
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
----
- src/drivers/driver_macsec_linux.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/src/drivers/driver_macsec_linux.c b/src/drivers/driver_macsec_linux.c
-index c867154981e9..fad47a292f9f 100644
---- a/src/drivers/driver_macsec_linux.c
-+++ b/src/drivers/driver_macsec_linux.c
-@@ -19,6 +19,7 @@
- #include <netlink/route/link.h>
- #include <netlink/route/link/macsec.h>
- #include <linux/if_macsec.h>
-+#include <linux/version.h>
- #include <inttypes.h>
-
- #include "utils/common.h"
-@@ -32,7 +33,8 @@
-
- #define UNUSED_SCI 0xffffffffffffffff
-
--#if LIBNL_VER_NUM >= LIBNL_VER(3, 6)
-+#if (LIBNL_VER_NUM >= LIBNL_VER(3, 6) && \
-+ LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0))
- #define LIBNL_HAS_OFFLOAD
- #endif
-
-2.39.2
-
deleted file mode 100644
@@ -1,39 +0,0 @@
-From fb043a27324ba81502b8986a31222f38aa414bbf Mon Sep 17 00:00:00 2001
-From: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
-Date: Thu, 18 Dec 2025 09:46:03 +0800
-Subject: [PATCH 1/3] defconfig: Update Opportunistic Wireless Encryption (OWE)
- state
-
-OWE enhances privacy in public and enterprise environments where open
-networks are prevalent. Enabling OWE aligns with modern security best
-practices and supports the testing and development of OWE-capable
-devices.
-
-OWE is now standardized in IEEE Std 802.11-2024 while it was originally
-specified in IETF RFC 8110 (updated by RFC 9672). It is not experimental
-anymore, i.e., there has been significant interoperability testing and
-there are deployed cases.
-
-Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
-Upstream-Status: Backport [https://git.w1.fi/cgit/hostap/commit/?id=39db92dcf301793ce45a8ebf85c425f67c670058]
----
- wpa_supplicant/defconfig | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/wpa_supplicant/defconfig b/wpa_supplicant/defconfig
-index 52befd8..044604a 100644
---- a/wpa_supplicant/defconfig
-+++ b/wpa_supplicant/defconfig
-@@ -638,8 +638,7 @@ CONFIG_BGSCAN_SIMPLE=y
- #CONFIG_BGSCAN_LEARN=y
-
- # Opportunistic Wireless Encryption (OWE)
--# Experimental implementation of draft-harkins-owe-07.txt
--#CONFIG_OWE=y
-+CONFIG_OWE=y
-
- # Device Provisioning Protocol (DPP) (also known as Wi-Fi Easy Connect)
- CONFIG_DPP=y
-2.34.1
-
deleted file mode 100644
@@ -1,34 +0,0 @@
-From aebbf87ca7311f543bd849020b97402c49f3cf24 Mon Sep 17 00:00:00 2001
-From: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
-Date: Thu, 18 Dec 2025 09:39:39 +0800
-Subject: [PATCH 2/3] defconfig: Document IEEE 802.11be as a published
- amendment
-
-The comment about the IEEE 802.11be functionality being experimental
-and based on a not yet finalized standard is not accurate anymore
-since IEEE Std 802.11be-2024 has already been published. Remove this
-outdated comment.
-
-Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
-Upstream-Status: Backport [https://git.w1.fi/cgit/hostap/commit/?id=2887a975b12de9256ed6fdbd0da1dbb78c7a25c4]
----
- wpa_supplicant/defconfig | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/wpa_supplicant/defconfig b/wpa_supplicant/defconfig
-index 044604a..7efb9e6 100644
---- a/wpa_supplicant/defconfig
-+++ b/wpa_supplicant/defconfig
-@@ -507,9 +507,6 @@ CONFIG_IEEE80211AX=y
-
- # IEEE 802.11be EHT support (mainly for AP mode)
- # CONFIG_IEEE80211AX is mandatory for setting CONFIG_IEEE80211BE.
--# Note: This is experimental and work in progress. The definitions are still
--# subject to change and this should not be expected to interoperate with the
--# final IEEE 802.11be version.
- #CONFIG_IEEE80211BE=y
-
- # Wireless Network Management (IEEE Std 802.11v-2011)
-2.34.1
-
deleted file mode 100644
@@ -1,32 +0,0 @@
-From be5ffd2084b8690f5b974c5b6ff7409fbfaacfb7 Mon Sep 17 00:00:00 2001
-From: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
-Date: Thu, 11 Dec 2025 15:07:31 +0800
-Subject: [PATCH 3/3] defconfig: Uncomment CONFIG_IEEE80211BE=y
-
-wpa_supplicant has supported IEEE 802.11be (Wi-Fi 7) for over three
-years. With growing market demand for Wi-Fi 7, it is now an appropriate
-time to enable IEEE 802.11be support. This is needed mainly to enable AP
-mode functionality in wpa_supplicant.
-
-Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
-Upstream-Status: Backport [https://git.w1.fi/cgit/hostap/commit/?id=e623edd9b73a521b8a4438c600c9a8fb0ac5febe]
----
- wpa_supplicant/defconfig | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/wpa_supplicant/defconfig b/wpa_supplicant/defconfig
-index 7efb9e6..84ac8ba 100644
---- a/wpa_supplicant/defconfig
-+++ b/wpa_supplicant/defconfig
-@@ -507,7 +507,7 @@ CONFIG_IEEE80211AX=y
-
- # IEEE 802.11be EHT support (mainly for AP mode)
- # CONFIG_IEEE80211AX is mandatory for setting CONFIG_IEEE80211BE.
--#CONFIG_IEEE80211BE=y
-+CONFIG_IEEE80211BE=y
-
- # Wireless Network Management (IEEE Std 802.11v-2011)
- # Note: This is experimental and not complete implementation.
-2.34.1
-
deleted file mode 100644
@@ -1,39 +0,0 @@
-From 72ac0ee026d9f6f9cd031d7859ea0b343b34e61d Mon Sep 17 00:00:00 2001
-From: "Yu Zhang(Yuriy)" <quic_yuzha@quicinc.com>
-Date: Thu, 1 Aug 2024 18:37:25 +0800
-Subject: [PATCH] WNM: Extend workaround for broken AP operating class behavior
-
-Some APs do not advertise operating classes correctly for BSS Transition
-Management. Try to determine the most likely operating frequency based
-on the channel number (1..14 --> 2.4 GHz; 36..177 --> 5 GHz) if invalid
-op_class == 255 is received in a BSS Transition Management Request. This
-speeds up the following operating by avoiding a full scan due to an
-unknown channel.
-
-This extends the workaround that was added in commit 80ce804e8824 ("WNM:
-Workaround for broken AP operating class behavior") for invalid
-operating class 0 to cover another observed case with invalid operating
-class 255.
-
-Signed-off-by: Yu Zhang(Yuriy) <quic_yuzha@quicinc.com>
-Upstream-Status: Backport [https://w1.fi/cgit/hostap.git/commit/?id=72ac0ee026d9f6f9cd031d7859ea0b343b34e61d]
----
- wpa_supplicant/wnm_sta.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
-index 58a124c00..662f6089e 100644
---- a/wpa_supplicant/wnm_sta.c
-+++ b/wpa_supplicant/wnm_sta.c
-@@ -555,7 +555,7 @@ static int wnm_nei_get_chan(struct wpa_supplicant *wpa_s, u8 op_class, u8 chan)
- }
-
- freq = ieee80211_chan_to_freq(country, op_class, chan);
-- if (freq <= 0 && op_class == 0) {
-+ if (freq <= 0 && (op_class == 0 || op_class == 255)) {
- /*
- * Some APs do not advertise correct operating class
- * information. Try to determine the most likely operating
-2.34.1
-
deleted file mode 100644
@@ -1,79 +0,0 @@
-From 726432d7622cc0088ac353d073b59628b590ea44 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Sat, 25 Jan 2025 11:21:16 +0200
-Subject: [PATCH] RADIUS: Drop pending request only when accepting the response
-
-The case of an invalid authenticator in a RADIUS response could imply
-that the response is not from the correct RADIUS server and as such,
-such a response should be discarded without changing internal state for
-the pending request. The case of an unknown response (RADIUS_RX_UNKNOWN)
-is somewhat more complex since it could have been indicated before
-validating the authenticator. In any case, it seems better to change the
-state for the pending request only when we have fully accepted the
-response.
-
-Allowing the internal state of pending RADIUS request to change based on
-responses that are not fully validation could have allow at least a
-theoretical DoS attack if an attacker were to have means for injecting
-RADIUS messages to the network using the IP address of the real RADIUS
-server and being able to do so more quickly than the real server and
-with the matching identifier from the request header (i.e., either by
-flooding 256 responses quickly or by having means to capture the RADIUS
-request). These should not really be realistic options in a properly
-protected deployment, but nevertheless it is good to be more careful in
-processing RADIUS responses.
-
-Remove a pending RADIUS request from the internal list only when having
-fully accepted a matching RADIUS response, i.e., after one of the
-registered handlers has confirmed that the authenticator is valid and
-processing of the response has succeeded.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
-
-CVE: CVE-2025-24912
-Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44]
-Signed-off-by: Peter Marko <peter.marko@siemens.com>
----
- src/radius/radius_client.c | 15 +++++++--------
- 1 file changed, 7 insertions(+), 8 deletions(-)
-
-diff --git a/src/radius/radius_client.c b/src/radius/radius_client.c
-index 2a7f36170..7909b29a7 100644
---- a/src/radius/radius_client.c
-+++ b/src/radius/radius_client.c
-@@ -1259,13 +1259,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- roundtrip / 100, roundtrip % 100);
- rconf->round_trip_time = roundtrip;
-
-- /* Remove ACKed RADIUS packet from retransmit list */
-- if (prev_req)
-- prev_req->next = req->next;
-- else
-- radius->msgs = req->next;
-- radius->num_msgs--;
--
- for (i = 0; i < num_handlers; i++) {
- RadiusRxResult res;
- res = handlers[i].handler(msg, req->msg, req->shared_secret,
-@@ -1276,6 +1269,13 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- radius_msg_free(msg);
- /* fall through */
- case RADIUS_RX_QUEUED:
-+ /* Remove ACKed RADIUS packet from retransmit list */
-+ if (prev_req)
-+ prev_req->next = req->next;
-+ else
-+ radius->msgs = req->next;
-+ radius->num_msgs--;
-+
- radius_client_msg_free(req);
- return;
- case RADIUS_RX_INVALID_AUTHENTICATOR:
-@@ -1297,7 +1297,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- msg_type, hdr->code, hdr->identifier,
- invalid_authenticator ? " [INVALID AUTHENTICATOR]" :
- "");
-- radius_client_msg_free(req);
-
- fail:
- radius_msg_free(msg);
deleted file mode 100644
@@ -1,70 +0,0 @@
-From 339a334551ca911187cc870f4f97ef08e11db109 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <quic_jouni@quicinc.com>
-Date: Wed, 5 Feb 2025 19:23:39 +0200
-Subject: [PATCH] RADIUS: Fix pending request dropping
-
-A recent change to this moved the place where the processed RADIUS
-request was removed from the pending list to happen after the message
-handler had been called. This did not take into account possibility of
-the handler adding a new pending request in the list and the prev_req
-pointer not necessarily pointing to the correct entry anymore. As such,
-some of the pending requests could have been lost and that would result
-in not being able to process responses to those requests and also, to a
-memory leak.
-
-Fix this by determining prev_req at the point when the pending request
-is being removed, i.e., after the handler function has already added a
-new entry.
-
-Fixes: 726432d7622c ("RADIUS: Drop pending request only when accepting the response")
-Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
-
-CVE: CVE-2025-24912
-Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109]
-Signed-off-by: Peter Marko <peter.marko@siemens.com>
----
- src/radius/radius_client.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/src/radius/radius_client.c b/src/radius/radius_client.c
-index 7909b29a7..d4faa7936 100644
---- a/src/radius/radius_client.c
-+++ b/src/radius/radius_client.c
-@@ -1099,7 +1099,7 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- struct radius_hdr *hdr;
- struct radius_rx_handler *handlers;
- size_t num_handlers, i;
-- struct radius_msg_list *req, *prev_req;
-+ struct radius_msg_list *req, *prev_req, *r;
- struct os_reltime now;
- struct hostapd_radius_server *rconf;
- int invalid_authenticator = 0;
-@@ -1224,7 +1224,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- break;
- }
-
-- prev_req = NULL;
- req = radius->msgs;
- while (req) {
- /* TODO: also match by src addr:port of the packet when using
-@@ -1236,7 +1235,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- hdr->identifier)
- break;
-
-- prev_req = req;
- req = req->next;
- }
-
-@@ -1270,6 +1268,12 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- /* fall through */
- case RADIUS_RX_QUEUED:
- /* Remove ACKed RADIUS packet from retransmit list */
-+ prev_req = NULL;
-+ for (r = radius->msgs; r; r = r->next) {
-+ if (r == req)
-+ break;
-+ prev_req = r;
-+ }
- if (prev_req)
- prev_req->next = req->next;
- else
similarity index 88%
rename from meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.11.bb
rename to meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.12.bb
@@ -5,7 +5,7 @@ BUGTRACKER = "http://w1.fi/security/"
SECTION = "network"
LICENSE = "BSD-3-Clause"
LIC_FILES_CHKSUM = "file://COPYING;md5=5ebcb90236d1ad640558c3d3cd3035df \
- file://README;beginline=1;endline=56;md5=6e4b25e7d74bfc44a32ba37bdf5210a6 \
+ file://README;beginline=1;endline=56;md5=155e35cb3d6ab0d6a17524f48f4e761c \
file://wpa_supplicant/wpa_supplicant.c;beginline=1;endline=12;md5=f5ccd57ea91e04800edb88267bf8eae4"
DEPENDS = "dbus libnl"
@@ -15,15 +15,8 @@ SRC_URI = "http://w1.fi/releases/wpa_supplicant-${PV}.tar.gz \
file://wpa_supplicant.conf \
file://wpa_supplicant.conf-sane \
file://99_wpa_supplicant \
- file://0001-macsec_linux-Hardware-offload-requires-Linux-headers.patch \
- file://0002-defconfig-Update-Opportunistic-Wireless-Encryption-O.patch \
- file://0003-defconfig-Document-IEEE-802.11be-as-a-published-amen.patch \
- file://0004-defconfig-Uncomment-CONFIG_IEEE80211BE-y.patch \
- file://0005-WNM-Extend-workaround-for-broken-AP-operating-class-behavior.patch \
- file://CVE-2025-24912-01.patch \
- file://CVE-2025-24912-02.patch \
"
-SRC_URI[sha256sum] = "912ea06f74e30a8e36fbb68064d6cdff218d8d591db0fc5d75dee6c81ac7fc0a"
+SRC_URI[sha256sum] = "08e23937e16d0155e55cab2b51f51fbe10d80a1aa91c4e15442645059b737ef6"
S = "${UNPACKDIR}/wpa_supplicant-${PV}"