hostapd: Update to version 2016-05-05

Fixes CVE-2016-4476 and few possible memory leaks. Signed-off-by: Michal Hrusecky <Michal.Hrusecky@nic.cz>
2016-05-12 14:07:15 +02:00 · 2016-05-12 14:07:15 +02:00 · b67af71181
commit b67af71181
parent a3cde627f8
8 changed files with 180 additions and 103 deletions
--- a/package/network/services/hostapd/Makefile
+++ b/package/network/services/hostapd/Makefile
@ -7,9 +7,9 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=hostapd
-PKG_VERSION:=2016-01-15
-PKG_RELEASE:=2
-PKG_REV:=e15dcf6d1bc2725388555523effca75b1ffab735
+PKG_VERSION:=2016-05-05
+PKG_RELEASE:=1
+PKG_REV:=9524e7e5a4a18539f0fb532544d2de63621b5f8b

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=git://w1.fi/srv/git/hostap.git
--- a/package/network/services/hostapd/patches/200-multicall.patch
+++ b/package/network/services/hostapd/patches/200-multicall.patch
@ -1,15 +1,15 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -32,6 +32,7 @@ export BINDIR ?= /usr/local/bin/
- # CFLAGS += -DUSE_KERNEL_HEADERS -I/usr/src/linux/include
+@@ -28,6 +28,7 @@ CFLAGS += -I$(abspath ../src/utils)
+ export BINDIR ?= /usr/local/bin/
 
 -include .config
 +-include $(if $(MULTICALL), ../wpa_supplicant/.config)
 
 ifndef CONFIG_NO_GITVER
 # Add VERSION_STR postfix for builds from a git repository
-@@ -277,10 +278,14 @@ ifdef CONFIG_IEEE80211AC
- CFLAGS += -DCONFIG_IEEE80211AC
+@@ -315,10 +316,14 @@ CFLAGS += -DCONFIG_MBO
+ OBJS += ../src/ap/mbo_ap.o
 endif
 
 +ifndef MULTICALL
@ -26,7 +26,7 @@
 LIBS += $(DRV_AP_LIBS)
 
 ifdef CONFIG_L2_PACKET
-@@ -1019,6 +1024,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
+@@ -1051,6 +1056,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
 
 BCHECK=../src/drivers/build.hostapd
 
@ -39,7 +39,7 @@
 hostapd: $(BCHECK) $(OBJS)
 	$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
 	@$(E) "  LD " $@
-@@ -1060,6 +1071,12 @@ HOBJS += ../src/crypto/aes-internal.o
+@@ -1092,6 +1103,12 @@ HOBJS += ../src/crypto/aes-internal.o
 HOBJS += ../src/crypto/aes-internal-enc.o
 endif
 
@ -62,7 +62,7 @@
 
 ifndef CONFIG_NO_GITVER
 # Add VERSION_STR postfix for builds from a git repository
-@@ -794,6 +795,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
+@@ -803,6 +804,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
 CFLAGS += -DCONFIG_DYNAMIC_EAP_METHODS
 LIBS += -ldl -rdynamic
 endif
@ -73,7 +73,7 @@
 endif
 
 ifdef CONFIG_MACSEC
-@@ -814,9 +819,11 @@ NEED_EAP_COMMON=y
+@@ -823,9 +828,11 @@ NEED_EAP_COMMON=y
 NEED_RSN_AUTHENTICATOR=y
 CFLAGS += -DCONFIG_AP
 OBJS += ap.o
@ -85,7 +85,7 @@
 OBJS += ../src/ap/hostapd.o
 OBJS += ../src/ap/wpa_auth_glue.o
 OBJS += ../src/ap/utils.o
-@@ -879,10 +886,18 @@ endif
+@@ -898,10 +905,18 @@ endif
 ifdef CONFIG_HS20
 OBJS += ../src/ap/hs20.o
 endif
@ -104,7 +104,7 @@
 NEED_AES_WRAP=y
 OBJS += ../src/ap/wpa_auth.o
 OBJS += ../src/ap/wpa_auth_ie.o
-@@ -1657,6 +1672,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
+@@ -1680,6 +1695,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
 
 $(OBJS_c) $(OBJS_t) $(OBJS_t2) $(OBJS) $(BCHECK) $(EXTRA_progs): .config
 
@ -117,8 +117,8 @@
 wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
 	$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
 	@$(E) "  LD " $@
-@@ -1757,6 +1778,12 @@ endif
- 	$(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' $< >$@
+@@ -1782,6 +1803,12 @@ endif
+ 		-e 's|\@DBUS_INTERFACE\@|$(DBUS_INTERFACE)|g' $< >$@
 	@$(E) "  sed" $<
 
 +dump_cflags:
@ -132,7 +132,7 @@
 wpa_cli.exe: wpa_cli
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -4707,8 +4707,8 @@ union wpa_event_data {
+@@ -4775,8 +4775,8 @@ union wpa_event_data {
  * Driver wrapper code should call this function whenever an event is received
  * from the driver.
  */
@ -141,11 +141,20 @@
 +extern void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
 +				    union wpa_event_data *data);
 
+ /**
+  * wpa_supplicant_event_global - Report a driver event for wpa_supplicant
+@@ -4788,7 +4788,7 @@ void wpa_supplicant_event(void *ctx, enu
+  * Same as wpa_supplicant_event(), but we search for the interface in
+  * wpa_global.
+  */
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
+extern void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
+ 				 union wpa_event_data *data);
 
 /*
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -1122,8 +1122,8 @@ static void hostapd_event_dfs_cac_starte
+@@ -1144,8 +1144,8 @@ static void hostapd_event_dfs_cac_starte
 #endif /* NEED_AP_MLME */
 
 
@ -156,9 +165,18 @@
 {
 	struct hostapd_data *hapd = ctx;
 #ifndef CONFIG_NO_STDOUT_DEBUG
+@@ -1354,7 +1354,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+ 
+ 
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
+void hostapd_wpa_event_global(void *ctx, enum wpa_event_type event,
+ 				 union wpa_event_data *data)
+ {
+ 	struct hapd_interfaces *interfaces = ctx;
 --- a/wpa_supplicant/wpa_priv.c
 +++ b/wpa_supplicant/wpa_priv.c
-@@ -932,8 +932,8 @@ static void wpa_priv_send_ft_response(st
+@@ -940,8 +940,8 @@ static void wpa_priv_send_ft_response(st
 }
 
 
@ -169,17 +187,27 @@
 {
 	struct wpa_priv_interface *iface = ctx;
 
-@@ -1082,6 +1082,7 @@ int main(int argc, char *argv[])
+@@ -1010,7 +1010,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+ 
+ 
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
+void supplicant_event_global(void *ctx, enum wpa_event_type event,
+ 				 union wpa_event_data *data)
+ {
+ 	struct wpa_priv_global *global = ctx;
+@@ -1122,6 +1122,8 @@ int main(int argc, char *argv[])
 	if (os_program_init())
 		return -1;
 
 +	wpa_supplicant_event = supplicant_event;
+	wpa_supplicant_event_global = supplicant_event_global;
 	wpa_priv_fd_workaround();
 
- 	for (;;) {
+ 	os_memset(&global, 0, sizeof(global));
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -3298,8 +3298,8 @@ static void wpa_supplicant_event_assoc_a
+@@ -3375,8 +3375,8 @@ static void wpa_supplicant_event_assoc_a
 }
 
 
@ -190,7 +218,7 @@
 {
 	struct wpa_supplicant *wpa_s = ctx;
 	int resched;
-@@ -3947,7 +3947,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -4037,7 +4037,7 @@ void wpa_supplicant_event(void *ctx, enu
 #endif /* CONFIG_AP */
 		break;
 	case EVENT_ACS_CHANNEL_SELECTED:
@ -199,85 +227,115 @@
 		if (!wpa_s->ap_iface)
 			break;
 		hostapd_acs_channel_selected(wpa_s->ap_iface->bss[0],
+@@ -4051,7 +4051,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+ 
+ 
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
+void supplicant_event_global(void *ctx, enum wpa_event_type event,
+ 				 union wpa_event_data *data)
+ {
+ 	struct wpa_supplicant *wpa_s;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -4845,6 +4845,9 @@ static void wpa_supplicant_deinit_iface(
- 	os_free(wpa_s);
+@@ -4967,7 +4967,6 @@ struct wpa_interface * wpa_supplicant_ma
+ 	return NULL;
 }
 
+-
+ /**
+  * wpa_supplicant_match_existing - Match existing interfaces
+  * @global: Pointer to global data from wpa_supplicant_init()
+@@ -5004,6 +5003,11 @@ static int wpa_supplicant_match_existing
+ 
+ #endif /* CONFIG_MATCH_IFACE */
+ 
 +extern void supplicant_event(void *ctx, enum wpa_event_type event,
 +			     union wpa_event_data *data);
 +
+extern void supplicant_event_global(void *ctx, enum wpa_event_type event,
+ 				 union wpa_event_data *data);
 
 /**
  * wpa_supplicant_add_iface - Add a new network interface
-@@ -5100,6 +5103,7 @@ struct wpa_global * wpa_supplicant_init(
+@@ -5259,6 +5263,8 @@ struct wpa_global * wpa_supplicant_init(
 #ifndef CONFIG_NO_WPA_MSG
 	wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
 #endif /* CONFIG_NO_WPA_MSG */
 +	wpa_supplicant_event = supplicant_event;
+	wpa_supplicant_event_global = supplicant_event_global;
 
 	if (params->wpa_debug_file_path)
 		wpa_debug_open_file(params->wpa_debug_file_path);
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -513,6 +513,9 @@ static int hostapd_get_ctrl_iface_group(
+@@ -526,6 +526,11 @@ static int hostapd_get_ctrl_iface_group(
 	return 0;
 }
 
 +void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
 +                       union wpa_event_data *data);
 +
+void hostapd_wpa_event_global(void *ctx, enum wpa_event_type event,
+ 				 union wpa_event_data *data);
 
 #ifdef CONFIG_WPS
 static int gen_uuid(const char *txt_addr)
-@@ -588,6 +591,7 @@ int main(int argc, char *argv[])
+@@ -601,6 +606,8 @@ int main(int argc, char *argv[])
 	interfaces.global_ctrl_sock = -1;
- 	interfaces.global_ctrl_dst = NULL;
+ 	dl_list_init(&interfaces.global_ctrl_dst);
 
 +	wpa_supplicant_event = hostapd_wpa_event;
+	wpa_supplicant_event_global = hostapd_wpa_event_global;
 	for (;;) {
 		c = getopt(argc, argv, "b:Bde:f:hKP:STtu:vg:G:");
 		if (c < 0)
 --- a/src/drivers/drivers.c
 +++ b/src/drivers/drivers.c
-@@ -10,6 +10,9 @@
+@@ -10,6 +10,11 @@
 #include "utils/common.h"
 #include "driver.h"
 
 +void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
 +			     union wpa_event_data *data);
+void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
+			     union wpa_event_data *data);
 +
 #ifdef CONFIG_DRIVER_WEXT
 extern struct wpa_driver_ops wpa_driver_wext_ops; /* driver_wext.c */
 #endif /* CONFIG_DRIVER_WEXT */
 --- a/wpa_supplicant/eapol_test.c
 +++ b/wpa_supplicant/eapol_test.c
-@@ -29,7 +29,10 @@
+@@ -29,7 +29,12 @@
 #include "ctrl_iface.h"
 #include "pcsc_funcs.h"
 #include "wpas_glue.h"
 +#include "drivers/driver.h"
 
 +void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
+			     union wpa_event_data *data);
+void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
 +			     union wpa_event_data *data);
 
 const struct wpa_driver_ops *const wpa_drivers[] = { NULL };
 
-@@ -1288,6 +1291,8 @@ static void usage(void)
+@@ -1295,6 +1300,10 @@ static void usage(void)
 	       "option several times.\n");
 }
 
 +extern void supplicant_event(void *ctx, enum wpa_event_type event,
+			     union wpa_event_data *data);
+extern void supplicant_event_global(void *ctx, enum wpa_event_type event,
 +			     union wpa_event_data *data);
 
 int main(int argc, char *argv[])
 {
-@@ -1308,6 +1313,7 @@ int main(int argc, char *argv[])
+@@ -1315,6 +1324,8 @@ int main(int argc, char *argv[])
 	if (os_program_init())
 		return -1;
 
 +	wpa_supplicant_event = supplicant_event;
+	wpa_supplicant_event_global = supplicant_event_global;
 	hostapd_logger_register_cb(hostapd_logger_cb);
 
 	os_memset(&eapol_test, 0, sizeof(eapol_test));
--- a/package/network/services/hostapd/patches/370-ap_sta_support.patch
+++ b/package/network/services/hostapd/patches/370-ap_sta_support.patch
@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant_i.h
 +++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -99,6 +99,11 @@ struct wpa_interface {
+@@ -100,6 +100,11 @@ struct wpa_interface {
 	const char *ifname;
 
 	/**
@ -12,8 +12,8 @@
 	 * bridge_ifname - Optional bridge interface name
 	 *
 	 * If the driver interface (ifname) is included in a Linux bridge
-@@ -465,6 +470,8 @@ struct wpa_supplicant {
- #endif /* CONFIG_CTRL_IFACE_DBUS_NEW */
+@@ -484,6 +489,8 @@ struct wpa_supplicant {
+ #endif /* CONFIG_CTRL_IFACE_BINDER */
 	char bridge_ifname[16];
 
 +	struct wpa_ctrl *hostapd;
@ -45,7 +45,7 @@
 CONFIG_OS=win32
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -108,6 +108,55 @@ const char *const wpa_supplicant_full_li
+@@ -112,6 +112,55 @@ const char *const wpa_supplicant_full_li
 "\n";
 #endif /* CONFIG_NO_STDOUT_DEBUG */
 
@ -101,7 +101,7 @@
 /* Configure default/group WEP keys for static WEP */
 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 {
-@@ -783,8 +832,12 @@ void wpa_supplicant_set_state(struct wpa
+@@ -812,8 +861,12 @@ void wpa_supplicant_set_state(struct wpa
 		wpas_p2p_completed(wpa_s);
 
 		sme_sched_obss_scan(wpa_s, 1);
@ -114,7 +114,7 @@
 		wpa_s->new_connection = 1;
 		wpa_drv_set_operstate(wpa_s, 0);
 #ifndef IEEE8021X_EAPOL
-@@ -4537,6 +4590,20 @@ static int wpa_supplicant_init_iface(str
+@@ -4623,6 +4676,20 @@ static int wpa_supplicant_init_iface(str
 			   sizeof(wpa_s->bridge_ifname));
 	}
 
@ -135,7 +135,7 @@
 	/* RSNA Supplicant Key Management - INITIALIZE */
 	eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
 	eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
-@@ -4823,6 +4890,11 @@ static void wpa_supplicant_deinit_iface(
+@@ -4914,6 +4981,11 @@ static void wpa_supplicant_deinit_iface(
 	if (terminate)
 		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
 
@ -203,16 +203,16 @@
 	       "  -i = interface name\n"
 	       "  -I = additional configuration file\n"
 	       "  -K = include keys (passwords, etc.) in debug output\n"
-@@ -176,7 +177,7 @@ int main(int argc, char *argv[])
+@@ -201,7 +202,7 @@ int main(int argc, char *argv[])
 
 	for (;;) {
 		c = getopt(argc, argv,
-			   "b:Bc:C:D:de:f:g:G:hi:I:KLm:No:O:p:P:qsTtuvW");
-+			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLm:No:O:p:P:qsTtuvW");
+-			   "b:Bc:C:D:de:f:g:G:hi:I:KLMm:No:O:p:P:qsTtuvW");
+			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuvW");
 		if (c < 0)
 			break;
 		switch (c) {
-@@ -223,6 +224,9 @@ int main(int argc, char *argv[])
+@@ -248,6 +249,9 @@ int main(int argc, char *argv[])
 			usage();
 			exitcode = 0;
 			goto out;
--- a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
+++ b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
@ -1,18 +1,18 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -202,6 +202,9 @@ endif
+@@ -211,6 +211,9 @@ endif
 ifdef CONFIG_NO_CTRL_IFACE
 CFLAGS += -DCONFIG_NO_CTRL_IFACE
 else
 +ifdef CONFIG_CTRL_IFACE_MIB
 +CFLAGS += -DCONFIG_CTRL_IFACE_MIB
 +endif
- OBJS += ctrl_iface.o
- OBJS += ../src/ap/ctrl_iface_ap.o
- endif
+ ifeq ($(CONFIG_CTRL_IFACE), udp)
+ CFLAGS += -DCONFIG_CTRL_IFACE_UDP
+ else
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -2119,6 +2119,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -2342,6 +2342,7 @@ static int hostapd_ctrl_iface_receive_pr
 						      reply_size);
 	} else if (os_strcmp(buf, "STATUS-DRIVER") == 0) {
 		reply_len = hostapd_drv_status(hapd, reply, reply_size);
@ -20,7 +20,7 @@
 	} else if (os_strcmp(buf, "MIB") == 0) {
 		reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
 		if (reply_len >= 0) {
-@@ -2160,6 +2161,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -2383,6 +2384,7 @@ static int hostapd_ctrl_iface_receive_pr
 	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
 		reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
 							reply_size);
@ -30,8 +30,8 @@
 			reply_len = -1;
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -858,6 +858,9 @@ ifdef CONFIG_WNM
- OBJS += ../src/ap/wnm_ap.o
+@@ -872,6 +872,9 @@ ifdef CONFIG_MBO
+ OBJS += ../src/ap/mbo_ap.o
 endif
 ifdef CONFIG_CTRL_IFACE
 +ifdef CONFIG_CTRL_IFACE_MIB
@ -42,7 +42,7 @@
 
 --- a/wpa_supplicant/ctrl_iface.c
 +++ b/wpa_supplicant/ctrl_iface.c
-@@ -1858,7 +1858,7 @@ static int wpa_supplicant_ctrl_iface_sta
+@@ -1895,7 +1895,7 @@ static int wpa_supplicant_ctrl_iface_sta
 			pos += ret;
 		}
 
@ -51,7 +51,7 @@
 		if (wpa_s->ap_iface) {
 			pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
 							    end - pos,
-@@ -8352,6 +8352,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -8610,6 +8610,7 @@ char * wpa_supplicant_ctrl_iface_process
 			reply_len = -1;
 	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
 		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
@ -59,7 +59,7 @@
 	} else if (os_strcmp(buf, "MIB") == 0) {
 		reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
 		if (reply_len >= 0) {
-@@ -8359,6 +8360,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -8617,6 +8618,7 @@ char * wpa_supplicant_ctrl_iface_process
 						      reply + reply_len,
 						      reply_size - reply_len);
 		}
@ -67,7 +67,7 @@
 	} else if (os_strncmp(buf, "STATUS", 6) == 0) {
 		reply_len = wpa_supplicant_ctrl_iface_status(
 			wpa_s, buf + 6, reply, reply_size);
-@@ -8821,6 +8823,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -9087,6 +9089,7 @@ char * wpa_supplicant_ctrl_iface_process
 		reply_len = wpa_supplicant_ctrl_iface_bss(
 			wpa_s, buf + 4, reply, reply_size);
 #ifdef CONFIG_AP
@ -75,7 +75,7 @@
 	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
 		reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
 	} else if (os_strncmp(buf, "STA ", 4) == 0) {
-@@ -8829,12 +8832,15 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -9095,12 +9098,15 @@ char * wpa_supplicant_ctrl_iface_process
 	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
 		reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
 						   reply_size);
@ -93,15 +93,15 @@
 			reply_len = -1;
 --- a/src/ap/ctrl_iface_ap.c
 +++ b/src/ap/ctrl_iface_ap.c
-@@ -23,6 +23,7 @@
- #include "ctrl_iface_ap.h"
+@@ -24,6 +24,7 @@
 #include "ap_drv_ops.h"
+ #include "mbo_ap.h"
 
 +#ifdef CONFIG_CTRL_IFACE_MIB
 
 static int hostapd_get_sta_tx_rx(struct hostapd_data *hapd,
 				 struct sta_info *sta,
-@@ -235,6 +236,7 @@ int hostapd_ctrl_iface_sta_next(struct h
+@@ -249,6 +250,7 @@ int hostapd_ctrl_iface_sta_next(struct h
 	return hostapd_ctrl_iface_sta_mib(hapd, sta->next, buf, buflen);
 }
 
@ -111,7 +111,7 @@
 static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype,
 --- a/src/ap/ieee802_1x.c
 +++ b/src/ap/ieee802_1x.c
-@@ -2359,6 +2359,7 @@ static const char * bool_txt(Boolean val
+@@ -2441,6 +2441,7 @@ static const char * bool_txt(Boolean val
 	return val ? "TRUE" : "FALSE";
 }
 
@ -119,7 +119,7 @@
 
 int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
 {
-@@ -2534,6 +2535,7 @@ int ieee802_1x_get_mib_sta(struct hostap
+@@ -2616,6 +2617,7 @@ int ieee802_1x_get_mib_sta(struct hostap
 	return len;
 }
 
@ -167,7 +167,7 @@
 
 --- a/wpa_supplicant/ap.c
 +++ b/wpa_supplicant/ap.c
-@@ -1091,7 +1091,7 @@ int wpas_ap_wps_nfc_report_handover(stru
+@@ -1103,7 +1103,7 @@ int wpas_ap_wps_nfc_report_handover(stru
 #endif /* CONFIG_WPS */
 
 
--- a/package/network/services/hostapd/patches/420-indicate-features.patch
+++ b/package/network/services/hostapd/patches/420-indicate-features.patch
@ -8,7 +8,7 @@
 #include "crypto/random.h"
 #include "crypto/tls.h"
 #include "common/version.h"
-@@ -593,7 +594,7 @@ int main(int argc, char *argv[])
+@@ -606,7 +607,7 @@ int main(int argc, char *argv[])
 
 	wpa_supplicant_event = hostapd_wpa_event;
 	for (;;) {
@ -17,7 +17,7 @@
 		if (c < 0)
 			break;
 		switch (c) {
-@@ -630,6 +631,8 @@ int main(int argc, char *argv[])
+@@ -643,6 +644,8 @@ int main(int argc, char *argv[])
 			break;
 #endif /* CONFIG_DEBUG_LINUX_TRACING */
 		case 'v':
@ -36,16 +36,16 @@
 #include "fst/fst.h"
 #include "wpa_supplicant_i.h"
 #include "driver_i.h"
-@@ -177,7 +178,7 @@ int main(int argc, char *argv[])
+@@ -202,7 +203,7 @@ int main(int argc, char *argv[])
 
 	for (;;) {
 		c = getopt(argc, argv,
-			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLm:No:O:p:P:qsTtuvW");
-+			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLm:No:O:p:P:qsTtuv::W");
+-			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuvW");
+			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuv::W");
 		if (c < 0)
 			break;
 		switch (c) {
-@@ -280,8 +281,12 @@ int main(int argc, char *argv[])
+@@ -305,8 +306,12 @@ int main(int argc, char *argv[])
 			break;
 #endif /* CONFIG_DBUS */
 		case 'v':
--- a/package/network/services/hostapd/patches/450-scan_wait.patch
+++ b/package/network/services/hostapd/patches/450-scan_wait.patch
@ -33,7 +33,7 @@
 	/* Initialize the driver interface */
 	if (!(b[0] | b[1] | b[2] | b[3] | b[4] | b[5]))
 		b = NULL;
-@@ -382,8 +394,6 @@ static void hostapd_global_deinit(const
+@@ -383,8 +395,6 @@ static void hostapd_global_deinit(const
 #endif /* CONFIG_NATIVE_WINDOWS */
 
 	eap_server_unregister_methods();
@ -42,19 +42,26 @@
 }
 
 
-@@ -409,11 +419,6 @@ static int hostapd_global_run(struct hap
+@@ -410,18 +420,6 @@ static int hostapd_global_run(struct hap
 	}
 #endif /* EAP_SERVER_TNC */
 
-	if (daemonize && os_daemonize(pid_file)) {
+-	if (daemonize) {
+-		if (os_daemonize(pid_file)) {
 -			wpa_printf(MSG_ERROR, "daemon: %s", strerror(errno));
 -			return -1;
 -		}
+-		if (eloop_sock_requeue()) {
+-			wpa_printf(MSG_ERROR, "eloop_sock_requeue: %s",
+-				   strerror(errno));
+-			return -1;
+-		}
+-	}
 -
 	eloop_run();
 
 	return 0;
-@@ -566,8 +571,7 @@ int main(int argc, char *argv[])
+@@ -579,8 +577,7 @@ int main(int argc, char *argv[])
 	struct hapd_interfaces interfaces;
 	int ret = 1;
 	size_t i, j;
--- a/package/network/services/hostapd/patches/600-ubus_support.patch
+++ b/package/network/services/hostapd/patches/600-ubus_support.patch
@ -1,6 +1,6 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -155,6 +155,11 @@ OBJS += ../src/common/hw_features_common
+@@ -157,6 +157,11 @@ OBJS += ../src/common/hw_features_common
 
 OBJS += ../src/eapol_auth/eapol_auth_sm.o
 
@ -22,7 +22,7 @@
 
 struct wpa_ctrl_dst;
 struct radius_server_data;
-@@ -107,6 +108,7 @@ struct hostapd_data {
+@@ -117,6 +118,7 @@ struct hostapd_data {
 	struct hostapd_iface *iface;
 	struct hostapd_config *iconf;
 	struct hostapd_bss_config *conf;
@ -30,7 +30,7 @@
 	int interface_added; /* virtual interface added for this BSS */
 	unsigned int started:1;
 	unsigned int disabled:1;
-@@ -299,6 +301,8 @@ struct hostapd_iface {
+@@ -322,6 +324,8 @@ struct hostapd_iface {
 	struct hostapd_config *conf;
 	char phy[16]; /* Name of the PHY (radio) */
 
@ -661,7 +661,7 @@
 +#endif
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -280,6 +280,7 @@ static void hostapd_free_hapd_data(struc
+@@ -282,6 +282,7 @@ static void hostapd_free_hapd_data(struc
 	hapd->started = 0;
 
 	wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface);
@ -669,7 +669,7 @@
 	iapp_deinit(hapd->iapp);
 	hapd->iapp = NULL;
 	accounting_deinit(hapd);
-@@ -1118,6 +1119,8 @@ static int hostapd_setup_bss(struct host
+@@ -1137,6 +1138,8 @@ static int hostapd_setup_bss(struct host
 	if (hapd->driver && hapd->driver->set_operstate)
 		hapd->driver->set_operstate(hapd->drv_priv, 1);
 
@ -678,7 +678,7 @@
 	return 0;
 }
 
-@@ -1523,6 +1526,7 @@ static int hostapd_setup_interface_compl
+@@ -1662,6 +1665,7 @@ static int hostapd_setup_interface_compl
 	if (err)
 		goto fail;
 
@ -686,7 +686,7 @@
 	wpa_printf(MSG_DEBUG, "Completing interface initialization");
 	if (iface->conf->channel) {
 #ifdef NEED_AP_MLME
-@@ -1700,6 +1704,7 @@ dfs_offload:
+@@ -1842,6 +1846,7 @@ dfs_offload:
 
 fail:
 	wpa_printf(MSG_ERROR, "Interface initialization failed");
@ -694,7 +694,7 @@
 	hostapd_set_state(iface, HAPD_IFACE_DISABLED);
 	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED);
 #ifdef CONFIG_FST
-@@ -2125,6 +2130,7 @@ void hostapd_interface_deinit_free(struc
+@@ -2268,6 +2273,7 @@ void hostapd_interface_deinit_free(struc
 		   (unsigned int) iface->conf->num_bss);
 	driver = iface->bss[0]->driver;
 	drv_priv = iface->bss[0]->drv_priv;
@ -704,7 +704,7 @@
 		   __func__, driver, drv_priv);
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -877,7 +877,8 @@ int auth_sae_init_committed(struct hosta
+@@ -929,7 +929,8 @@ int auth_sae_init_committed(struct hosta
 
 
 static void handle_auth(struct hostapd_data *hapd,
@ -714,7 +714,7 @@
 {
 	u16 auth_alg, auth_transaction, status_code;
 	u16 resp = WLAN_STATUS_SUCCESS;
-@@ -893,6 +894,11 @@ static void handle_auth(struct hostapd_d
+@@ -945,6 +946,11 @@ static void handle_auth(struct hostapd_d
 	char *identity = NULL;
 	char *radius_cui = NULL;
 	u16 seq_ctrl;
@ -724,9 +724,9 @@
 +		.frame_info = fi,
 +	};
 
- 	if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
- 		wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
-@@ -1044,6 +1050,14 @@ static void handle_auth(struct hostapd_d
+ 	os_memset(&vlan_id, 0, sizeof(vlan_id));
+ 
+@@ -1098,6 +1104,14 @@ static void handle_auth(struct hostapd_d
 		resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 		goto fail;
 	}
@ -741,7 +741,7 @@
 	if (res == HOSTAPD_ACL_PENDING) {
 		wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
 			   " waiting for an external authentication",
-@@ -1776,13 +1790,18 @@ static void send_assoc_resp(struct hosta
+@@ -1982,13 +1996,18 @@ static u16 send_assoc_resp(struct hostap
 
 static void handle_assoc(struct hostapd_data *hapd,
 			 const struct ieee80211_mgmt *mgmt, size_t len,
@ -749,7 +749,7 @@
 +			 int reassoc, struct hostapd_frame_info *fi)
 {
 	u16 capab_info, listen_interval, seq_ctrl, fc;
- 	u16 resp = WLAN_STATUS_SUCCESS;
+ 	u16 resp = WLAN_STATUS_SUCCESS, reply_res;
 	const u8 *pos;
 	int left, i;
 	struct sta_info *sta;
@ -761,9 +761,9 @@
 
 	if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
 				      sizeof(mgmt->u.assoc_req))) {
-@@ -1902,6 +1921,13 @@ static void handle_assoc(struct hostapd_
- 		goto fail;
+@@ -2108,6 +2127,13 @@ static void handle_assoc(struct hostapd_
 	}
+ #endif /* CONFIG_MBO */
 
 +	if (hostapd_ubus_handle_event(hapd, &req)) {
 +		wpa_printf(MSG_DEBUG, "Station " MACSTR " assoc rejected by ubus handler.\n",
@ -772,10 +772,10 @@
 +		goto fail;
 +	}
 +
- 	sta->capability = capab_info;
- 	sta->listen_interval = listen_interval;
- 
-@@ -2328,7 +2354,7 @@ int ieee802_11_mgmt(struct hostapd_data
+ 	/*
+ 	 * sta->capability is used in check_assoc_ies() for RRM enabled
+ 	 * capability element.
+@@ -2588,7 +2614,7 @@ int ieee802_11_mgmt(struct hostapd_data
 
 
 	if (stype == WLAN_FC_STYPE_PROBE_REQ) {
@ -784,7 +784,7 @@
 		return 1;
 	}
 
-@@ -2346,17 +2372,17 @@ int ieee802_11_mgmt(struct hostapd_data
+@@ -2606,17 +2632,17 @@ int ieee802_11_mgmt(struct hostapd_data
 	switch (stype) {
 	case WLAN_FC_STYPE_AUTH:
 		wpa_printf(MSG_DEBUG, "mgmt::auth");
@ -807,7 +807,7 @@
 	case WLAN_FC_STYPE_DISASSOC:
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -667,7 +667,7 @@ sta_track_seen_on(struct hostapd_iface *
+@@ -675,7 +675,7 @@ sta_track_seen_on(struct hostapd_iface *
 
 void handle_probe_req(struct hostapd_data *hapd,
 		      const struct ieee80211_mgmt *mgmt, size_t len,
@ -816,7 +816,7 @@
 {
 	u8 *resp;
 	struct ieee802_11_elems elems;
-@@ -676,9 +676,15 @@ void handle_probe_req(struct hostapd_dat
+@@ -684,9 +684,15 @@ void handle_probe_req(struct hostapd_dat
 	size_t i, resp_len;
 	int noack;
 	enum ssid_match_result res;
@ -830,9 +830,9 @@
 +		.frame_info = fi,
 +	};
 
- 	ie = mgmt->u.probe_req.variable;
- 	if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.probe_req))
-@@ -830,6 +836,12 @@ void handle_probe_req(struct hostapd_dat
+ 	if (len < IEEE80211_HDRLEN)
+ 		return;
+@@ -838,6 +844,12 @@ void handle_probe_req(struct hostapd_dat
 	}
 #endif /* CONFIG_P2P */
 
@ -858,7 +858,7 @@
 int ieee802_11_update_beacons(struct hostapd_iface *iface);
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -51,6 +51,10 @@ int hostapd_notif_assoc(struct hostapd_d
+@@ -52,6 +52,10 @@ int hostapd_notif_assoc(struct hostapd_d
 	u16 reason = WLAN_REASON_UNSPECIFIED;
 	u16 status = WLAN_STATUS_SUCCESS;
 	const u8 *p2p_dev_addr = NULL;
@ -869,7 +869,7 @@
 
 	if (addr == NULL) {
 		/*
-@@ -123,6 +127,12 @@ int hostapd_notif_assoc(struct hostapd_d
+@@ -124,6 +128,12 @@ int hostapd_notif_assoc(struct hostapd_d
 		goto fail;
 	}
 
--- a/package/network/services/hostapd/patches/700-make-make-work.patch
+++ b/package/network/services/hostapd/patches/700-make-make-work.patch
@ -0,0 +1,12 @@
+--- a/hostapd/Makefile
+++ b/hostapd/Makefile
+@@ -196,7 +196,8 @@ endif
+ 
+ ifdef CONFIG_NO_VLAN
+ CFLAGS += -DCONFIG_NO_VLAN
+-else
+endif
+ifneq ($(findstring CONFIG_NO_VLAN,$(CFLAGS)), CONFIG_NO_VLAN)
+ OBJS += ../src/ap/vlan_init.o
+ OBJS += ../src/ap/vlan_ifconfig.o
+ OBJS += ../src/ap/vlan.o