wpa_supplicant/hostapd: 2.10 -> 2.11

[thillux]

Description of changes

Please find the changelog per daemon below.

I kept privsep and epoll disabled, as they still do not work upstream.
Privsep does not support sending EAPOL frames over nl80211 control port, which would slow down network connection time significantly.

Changes for nixpkgs:

• I dropped patches, that are upstream now.
• I enabled 802.11be/Wi-Fi 7 in the configs. This is still not really settled, but we should try this, as the next release will probably take another 2-3 years.

Questions for discussion

• Is Cannot connect with updated wpa_supplicant #8332 still a thing or can we enable TLS 1.2 by default?
• Should a release notes entry be added?

wpa_supplicant

• Wi-Fi Easy Connect
  • add support for DPP release 3
  • allow Configurator parameters to be provided during config exchange
• MACsec
  • add support for GCM-AES-256 cipher suite
  • remove incorrect EAP Session-Id length constraint
  • add hardware offload support for additional drivers
• HE/IEEE 802.11ax/Wi-Fi 6
  • support BSS color updates
  • various fixes
• EHT/IEEE 802.11be/Wi-Fi 7
  • add preliminary support
• support OpenSSL 3.0 API changes
• improve EAP-TLS support for TLSv1.3
• EAP-SIM/AKA: support IMSI privacy
• improve mitigation against DoS attacks when PMF is used
• improve 4-way handshake operations
  • discard unencrypted EAPOL frames in additional cases
  • use Secure=1 in message 2 during PTK rekeying
• OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases
  to avoid interoperability issues
• support new SAE AKM suites with variable length keys
• support new AKM for 802.1X/EAP with SHA384
• improve cross-AKM roaming with driver-based SME/BSS selection
• PASN
  • extend support for secure ranging
  • allow PASN implementation to be used with external programs for
    Wi-Fi Aware
• FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
  • this is based on additional details being added in the IEEE 802.11
    standard
  • the new implementation is not backwards compatible, but PMKSA
    caching with FT-EAP was, and still is, disabled by default
• support a pregenerated MAC (mac_addr=3) as an alternative mechanism
  for using per-network random MAC addresses
• EAP-PEAP: require Phase 2 authentication by default (phase2_auth=1)
  to improve security for still unfortunately common invalid
  configurations that do not set ca_cert
• extend SCS support for QoS Characteristics
• extend MSCS support
• support unsynchronized service discovery (USD)
• add support for explicit SSID protection in 4-way handshake
  (a mitigation for CVE-2023-52424; disabled by default for now, can be
  enabled with ssid_protection=1)
  • in addition, verify SSID after key setup when beacon protection is
    used
• fix SAE H2E rejected groups validation to avoid downgrade attacks
• a large number of other fixes, cleanup, and extensions

http://w1.fi/cgit/hostap/tree/wpa_supplicant/ChangeLog?id=d945ddd368085f255e68328f2d3b020ceea359af

hostapd

• Wi-Fi Easy Connect
  • add support for DPP release 3
  • allow Configurator parameters to be provided during config exchange
• HE/IEEE 802.11ax/Wi-Fi 6
  • various fixes
• EHT/IEEE 802.11be/Wi-Fi 7
  • add preliminary support
• SAE: add support for fetching the password from a RADIUS server
• support OpenSSL 3.0 API changes
• support background radar detection and CAC with some additional
  drivers
• support RADIUS ACL/PSK check during 4-way handshake (wpa_psk_radius=3)
• EAP-SIM/AKA: support IMSI privacy
• improve 4-way handshake operations
  • use Secure=1 in message 3 during PTK rekeying
• OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases
  to avoid interoperability issues
• support new SAE AKM suites with variable length keys
• support new AKM for 802.1X/EAP with SHA384
• extend PASN support for secure ranging
• FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
  • this is based on additional details being added in the IEEE 802.11
    standard
  • the new implementation is not backwards compatible
• improved ACS to cover additional channel types/bandwidths
• extended Multiple BSSID support
• fix beacon protection with FT protocol (incorrect BIGTK was provided)
• support unsynchronized service discovery (USD)
• add preliminary support for RADIUS/TLS
• add support for explicit SSID protection in 4-way handshake
  (a mitigation for CVE-2023-52424; disabled by default for now, can be
  enabled with ssid_protection=1)
• fix SAE H2E rejected groups validation to avoid downgrade attacks
• use stricter validation for some RADIUS messages
• a large number of other fixes, cleanup, and extensions

http://w1.fi/cgit/hostap/tree/hostapd/ChangeLog?id=d945ddd368085f255e68328f2d3b020ceea359af

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[thillux]

Result of nixpkgs-review pr 330386 run on x86_64-linux 1

7 packages built:

• hostapd
• hostapd.man
• linux-router
• linux-wifi-hotspot
• wifish
• wpa_supplicant
• wpa_supplicant_gui

[oddlama]

Just one minor thing, the fetchpatch argument seems to be unused now.

[oddlama]

LGTM

[LeSuisse]

It seems this come with an upstream regression on some chips: https://bugzilla.redhat.com/show_bug.cgi?id=2302577

We might want to revert upstream commit https://w1.fi/cgit/hostap/commit/?id=41638606054a09867fe3f9a2b5523aa4678cbfa5 until a proper fix land

[Krutonium]

Can confirm What @LeSuisse Said - It seems to effect most if not all Broadcom chips so basically any Mac and lots of other computers besides.

[dotlambda]

We might want to revert upstream commit https://w1.fi/cgit/hostap/commit/?id=41638606054a09867fe3f9a2b5523aa4678cbfa5 until a proper fix land

That's what #333475 does.

[adminy]

This PR breaks wifi for Broadcom BCM43a0 802.11 Hybrid Wireless Controller 6.30.223.271 (r587334)

dbus: fill_dict_with_properties dbus_interface=fi.w1.wpa_supplicant1.Interface.P2PDevice dbus_property=P2PDeviceConfig getter failed
wlp6s0: CTRL-EVENT-SCAN-FAILED ret=-22
... (last message repeats forever)

please revert.