Debian Patches
Status for wpa/2:2.11-7
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 02_dbus_group_policy.patch | Add D-Bus group policy Debian does not use pam_console but uses group membership to control access to D-Bus. Activating both options in the conf file makes it work on Debian and Ubuntu. |
Michael Biebl <biebl@debian.org> | no | debian | 2007-03-08 | |
| 07_dbus_service_syslog.patch | Tweak D-Bus/systemd service activation configuration files: * log wpa_supplicant messages to syslog * activate control socket interface so that wpa_cli can be used by D-Bus activated wpa_supplicant daemon |
Kel Modderman <kel@otaku42.de> | no | 2012-04-21 | ||
| allow-tlsv1.patch | Enable TLSv1.0 by default OpenSSL 1.1.1 disables TLSv1.0 by default and sets the security level to 2. Some older networks may support for TLSv1.0 and less secure cyphers. |
Andrej Shadura <andrewsh@debian.org> | no | 2018-12-15 | ||
| disable-eapol-werror.patch | Disable -Werror for eapol_test This may make sense for the upstream, but we just want to build the tool to be useful to our users; dealing with build errors due to issues normally manifesting themselves as warnings is burdening for Debian and its downstreams. |
Andrej Shadura <andrew.shadura@collabora.co.uk> | no | 2021-02-12 | ||
| wpa_service_ignore-on-isolate.patch | Add IgnoreOnIsolate=yes to keep wpa-supplicant running while systemctl isolate > Add IgnoreOnIsolate=yes so that when switching "runlevels" in > oem-config will not kill off wpa and cause wireless to be > unavailable on first boot. (LP: #1576024) Also happens when running systemctl isolate default.target: > NM should be detecting that wpasupplicant is not running and start > it -- this should already have been working by way of wpasupplicant > being dbus-activated. [...] > It seems to me like IgnoreOnIsolate for wpasupplicant would be the > right thing to do, or to figure out why it isn't being properly > started when NM tries to use it. |
Mathieu Trudel-Lapierre <cyphermox@ubuntu.com> | no | 2017-03-13 | ||
| 0015-Revert-Mark-authorization-completed-on-driver-indica.patch | Revert "Mark authorization completed on driver indication during 4-way HS offload" This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5. |
Janne Grunau <janne-fdr@jannau.net> | yes | upstream | vendor, https://src.fedoraproject.org/fork/jannau/rpms/wpa_supplicant/c/a5b0db1716b7b4e63a297dcb5b10e98317c54205 | 2024-08-04 |
| systemd-add-reload-support.patch | Add reload support to the systemd unit files When wifi password is written in /etc/wpa_supplicant/wpa_supplicant-if.conf, wpa_supplicant@if.service is started by systemd. When one adds a new pair of SSID and its password in the above config file, wpa_supplicant has to reload the changed config file. But "systemctl reload" was not accepted because "ExecReload" was missing from wpa_supplicant@.service. |
Ryutaroh Matsumoto <ryutaroh.matsumoto@nagoya-u.jp> | no | debian | 2019-07-08 | |
| manpage-replace-wheel-with-netdev.patch | Replace the wheel group with netdev wpa_supplicant.conf(5) manpage includes multiple examples with group wheel. Group wheel does not exist on Debian as a result the example fails. |
Thomas Glanzmann <thomas@glanzmann.de> | no | debian | 2022-02-13 | |
| upstream-fixes/0001-nl80211-add-extra-ies-only-if-allowed-by-driver.patch | nl80211: add extra-ies only if allowed by driver Upgrading wpa_supplicant from 2.9 to 2.10 breaks broadcom-wl based adapters. The reason for it is hostapd tries to install additional IEs for scanning while the driver does not support this. The kernel indicates the maximum number of bytes for additional scan IEs using the NL80211_ATTR_MAX_SCAN_IE_LEN attribute. Save this value and only add additional scan IEs in case the driver can accommodate these additional IEs. |
David Bauer <mail@david-bauer.net> | yes | debian upstream | http://lists.infradead.org/pipermail/hostap/2022-January/040185.html | 2022-01-30 |
| allow-legacy-renegotiation.patch | Allow legacy renegotiation to fix PEAP issues with some servers | James Ralston <ralston@pobox.com> | no | 2022-05-01 | ||
| wpa_service_netdev.patch | Configure wpa_supplicant.service to create control sockets owned by group netdev | Andrej Shadura <andrew.shadura@collabora.co.uk> | no | debian | 2022-06-15 | |
| CVE-2024-5290-lib_engine_trusted_path.patch | only load libraries from trusted path | Marc Deslauriers <marc.deslauriers@canonical.com> | no | 2026-02-16 | ||
| Bump-DEFAULT_BSS_MAX_COUNT-to-1000.patch | Bump DEFAULT_BSS_MAX_COUNT to 1000 Many congested areas have more than 200 APs in range of a typical device. When the number of APs exceeds BSS_MAX_COUNT, even nearby APs can be absent from the scanning device's AP list. This patch bumps the default to 1000 to be more in line with a realistic modern max number of APs in a given area. |
Mitchell Augustin <mitchell.augustin@canonical.com> | no | 2026-02-16 | ||
| 0013-Remove-misleading-wpa_cli-usage-comment.patch | Remove misleading wpa_cli usage comment # wpa_cli set Selected interface 'wlan0' Invalid SET command - at least 2 arguments are required. |
Andrej Shadura <andrew.shadura@collabora.co.uk> | no | debian | 2026-02-16 | |
| 0014-sae_pk_gen-needs-random_get_bytes-wpa_key_mgmt_txt-w.patch | sae_pk_gen needs random_get_bytes, wpa_key_mgmt_txt, wpa_akm_to_suite | Andrej Shadura <andrew.shadura@collabora.co.uk> | no | 2026-02-16 | ||
| 0016-dbus-Add-SaePasswordMismatch-signal-on-AP-indication.patch | dbus: Add SaePasswordMismatch signal on AP indication of failed SAE auth Per the IEEE 802.11 standard, status code 15 (WLAN_STATUS_CHALLENGE_FAIL), when returned in an Authentication frame of an SAE exchange, is indicative of a password mismatch. Add a new dbus signal "SaePasswordMismatch" and emit it when a password mismatch is detected as defined by that scenario. (cherry picked from commit 446a274b89e32dac8934f64822e5a3acee190dad) |
Mitchell Augustin <mitchell.augustin@canonical.com> | not-needed | upstream, 446a274b89e32dac8934f64822e5a3acee190dad | 2025-10-03 | |
| 0019-Send-CTRL-EVENT-SIGNAL-CHANGE-message-to-control-int.patch | Send CTRL-EVENT-SIGNAL-CHANGE message to control interfaces only The default logging level for the CTRL-EVENT-SIGNAL-CHANGE message may be repeated many times and fill the log file or journal. For example https://bugzilla.redhat.com/show_bug.cgi?id=2309148 and the first few results from searching CTRL-EVENT-SIGNAL-CHANGE on the web contain various complaints and workarounds. Change the logging method to wpa_msg_ctrl to avoid sending frequent messages to the syslog but still allow the message to be consumed by control interface monitors. |
Kan-Ru Chen <kanru@kanru.info> | no | upstream, https://w1.fi/cgit/hostap/commit/?id=c330b5820eefa8e703dbce7278c2a62d9c69166a | 2024-12-23 | |
| openssl-4.0-asn1-string-accessors.patch | OpenSSL: Use ASN1_STRING_length/get0_data() more consistently Some of the accesses to ASN1_IA5STRING were using direct references to the structure members. Replace those with helper functions to avoid the direct access. This is needed for OpenSSL 4.0. |
Jouni Malinen <j@w1.fi> | no | debian | upstream, https://git.w1.fi/cgit/hostap/commit/?id=141abf49a432c9a0f4f38c47a477ab258ec9e239 | 2026-04-06 |
| wpa_supplicant-OpenSSL-Use-pkcs11-provider-when-OPENSSL_NO_ENGINE-i.patch | OpenSSL: Use pkcs11-provider when OPENSSL_NO_ENGINE is defined Now that ENGINE API starts being deprecated in distros (like Fedora [1]) wpa_supplicant users might need a way to load certificates and keys from PKCS11 URIs even when OPENSSL_NO_ENGINE is defined. We can do that using pkcs11-provider: load it by default in wpa_supplicant, and try to use it when OPENSSL_NO_ENGINE is defined and configuration requests PKCS11 URIs for certificates / keys. Inspired by pkcs11-provider test program 'tlssetkey.c' [2] [1] https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine [2] https://github.com/latchset/pkcs11-provider/blob/main/tests/tlssetkey.c |
Davide Caratti <davide.caratti@gmail.com> | no | 2025-01-15 | ||
| wpa_supplicant-OpenSSL-Support-PEM-encoded-chain-from-ca_cert-blob.patch | OpenSSL: Support PEM encoded chain from ca_cert blob Support configuring a chain of certificates through a ca_cert blob. Since the code to to add the certificate to the store is used in multiple places in tls_connection_ca_cert(), extract it to a separate function. (cherry picked from commit 9bb25b01fe843924113883a93236d43bb77d4cb1) |
Beniamino Galvani <bgalvani@redhat.com> | no | debian | 2025-12-19 | |
| CVE-2026-78807.patch | Require network_ctx and AKMP match for accepting PMKSA entry When wpa_supplicant was processing EAPOL-Key msg 1/4 with a PMKID indicated by the AP/Authenticator, a PMKSA for the same AA was accepted without enforcing matching network_ctx (i.e., same network configuration block) and AKMP. This could allow misbehaving APs to make wpa_supplicant use an unacceptable PMKSA entry that was generated for a different network for AKMP under certain conditions. This could result in showing a connection to an incorrect network when an attacker has credentials to one network in wpa_supplicant configuration, but not to another network. Fix this by accepting the PMKID to set the PMKSA for an association only if the PMKSA with the same PMKID is for the same network and was generated using the same AKMP. |
Jouni Malinen <jouni.malinen@oss.qualcomm.com> | no | 2026-07-06 | ||
| 0022-DPP-Discard-DPP-Action-frame-in-AP-mode-if-no-global.patch | DPP: Discard DPP Action frame in AP mode if no global DPP context For AP mode in wpa_supplicant, e.g., for P2P GO interfaces, the global DPP context does not exist support DPP functionality and this could result in dereferencing a NULL pointer in wpa_supplicant if an unexpected frame is received. Discard the received DPP Action frames in such cases instead of trying to process them. |
Hu Wang <quic_huw@quicinc.com> | no | debian | 2025-01-05 | |
| 0023-dbus-Fix-reporting-of-the-SAE-KeyMgmt.patch | dbus: Fix reporting of the SAE KeyMgmt Not all drivers report SAE in the supported AKMs. Also check flag NL80211_FEATURE_SAE (mapped to WPA_DRIVER_FLAGS_SAE) to detect support for SAE in the D-Bus KeyMgmt capabilities, similarly to what ctrl_iface and dpp_supplicant already do. |
Beniamino Galvani <bgalvani@redhat.com> | no | debian | 2026-07-22 | |
| 0024-scan-Disable-MAC-randomization-during-P2P-provisioni.patch | scan: Disable MAC randomization during P2P provisioning If the P2P GO has already been started and we are just trying to find its Beacon frames, we should not randomize the MAC address. Doing so would conflict with the P2P GO possibly having a MAC filter installed and ignoring the Probe Request frames (wpa_supplicant does this). So, do not enable address randomization if in P2P provisioning. Also move the wpa_state check into wpa_setup_mac_addr_rand_params() so that all the checks are in the same location. Note that other P2P scans bypass the main wpa_supplicant scanning facilities and avoid MAC randomization that way. |
Benjamin Berg <benjamin.berg@intel.com> | no | 2026-05-26 | ||
| bug1148985-01-Honor-permissions-from-the-wpa_supplicant-config.patch | Honor permissions from the wpa_supplicant configuration target file fwrite() creates file with default permission (rw-r--r--) while the file does not exist. However, the wpa config file may be installed as (rw-------), which doesn't want other user to see the password. As a result, we honor these permissions from the original file by using stat and chmod syscalls. |
ShengYi Hung <aokblast@FreeBSD.org> | no | debian | https://git.w1.fi/cgit/hostap/commit/?id=e3d1ebda8117c455547b8a9fb06460fb6a405373 | 2026-04-19 |
| bug1148985-02-Use-umask-to-limit-access-to-temporary-wpa_supplican.patch | Use umask to limit access to temporary wpa_supplicant configuration file There is a race condition in fopen() followed by chmod(), so set umask to limit the initial access to the new temporary file. |
Jouni Malinen <jouni.malinen@oss.qualcomm.com> | no | debian | https://git.w1.fi/cgit/hostap/commit/?id=1037cc3678ef316ec65059897a941ac3bcfb44bb | 2026-08-01 |
| bug1148985-03-Remove-alternative-wpa_config_write-path-on-failed-m.patch | Remove alternative wpa_config_write() path on failed memory allocation The memory allocation here for the temporary file name is not really going to fail in practice and there is no need to maintain two different approaches for saving the configuration. Remove the unneeded fallback option to simplify this. |
Jouni Malinen <jouni.malinen@oss.qualcomm.com> | no | debian | https://git.w1.fi/cgit/hostap/commit/?id=c53b2ce62ee11f0d5d95177feeb031196a5ccd25 | 2026-08-01 |
| bug1148985-04-Remove-the-temporary-wpa_supplicant-config-file-in-e.patch | Remove the temporary wpa_supplicant config file in error case There is no need to leave the temporary wpa_supplicant configuration file in place if it cannot be fully written or if renaming it to the original location fails. |
Jouni Malinen <jouni.malinen@oss.qualcomm.com> | no | debian | https://git.w1.fi/cgit/hostap/commit/?id=b35d7d48bb646eda965fc4aa7cee750eacd87687 | 2026-08-01 |
| bug1148985-05-Use-random-suffix-in-the-temporary-config.patch | Use a random suffix in the temporary wpa_supplicant configuration file Avoid use of a predictable file name for the the temporary file. |
Jouni Malinen <jouni.malinen@oss.qualcomm.com> | no | debian | https://git.w1.fi/cgit/hostap/commit/?id=4540af010df3f4d02240757fb0cbff29339a12c3 | 2026-08-01 |
| bug1148985-06-Ensure-temp-config-file-created-and-not-symlink.patch | Ensure the temporary config file gets created and is not a symlink While the unpredictable file name from commit 4540af010df3 ("Use a random suffix in the temporary wpa_supplicant configuration file") would make it challenging to create a symlink with the matching name, this can be made more robust by using open() with O_EXCL to make sure the temporary file does not exist. |
Jouni Malinen <jouni.malinen@oss.qualcomm.com> | no | debian | https://git.w1.fi/cgit/hostap/commit/?id=e3937427e702f2efd45b2bd3cdc3e8591c3280e4 | 2026-08-23 |
| bug1148985-07-Verify-fclose-succeeds-on-temp-config.patch | Verify that fclose() succeeds on temporary configuration file Writing the final data from buffers could fail at least in theory, so verify that fclose() returns success before proceeding with replacing the actual configuration file. |
Jouni Malinen <jouni.malinen@oss.qualcomm.com> | no | debian | https://git.w1.fi/cgit/hostap/commit/?id=50e7efc698f9211717f484614e04f42e4f4f7878 | 2026-08-23 |
| bug1148985-08-wpa_supplicant-option-restrict-config-prefix.patch | wpa_supplicant option to restrict configuration file location The new -x<required prefix> command line argument can now be used to restrict which configuration file paths are accepted for wpa_supplicant interfaces. The main use for this is in cases where the control interface (text based or D-Bus) is enabled to users that have lesser privileges than the wpa_supplicant process itself since the control interfaces can be used to add new interfaces with otherwise arbitrary configuration file paths. The required prefix should point to a location that is not writable by processed that have access to the control interface in such a case. As an example, "-x/etc/wpa_supplicant/" could be used to require that the configuration files are writing the /etc/wpa_supplicant directory. |
Jouni Malinen <jouni.malinen@oss.qualcomm.com> | no | debian | backport, https://git.w1.fi/cgit/hostap/commit/?id=e7a37b0876dc611195acfaec04fb53880a506666 | 2026-08-23 |
| bug1148985-09-restrict-dbus-config-prefix.patch | Restrict D-Bus activated wpa_supplicant to /etc/wpa_supplicant/ Start the D-Bus activated wpa_supplicant with -x/etc/wpa_supplicant/, so that CreateInterface only accepts configuration files from that directory. Members of the netdev group cannot write to that directory. |
Andrej Shadura <andrewsh@debian.org> | not-needed | debian | 2026-10-31 |
All known versions for source package 'wpa'
- 2:2.11-7 (sid, forky)
- 2:2.10-24 (trixie)
- 2:2.10-12+deb12u3 (bookworm)
- 2:2.10-12+deb12u2 (bookworm-security)