wpa (2:2.11-0ubuntu4) questing; urgency=medium

  * Improve PSK mismatch detection and dbus signal (LP: #2125203)

 -- Mitchell Augustin <mitchell.augustin@canonical.com>  Fri, 19 Sep 2025 9:07:00 -0500

wpa (2:2.11-0ubuntu3) questing; urgency=medium

  * d/p/0015-Revert-Mark-authorization-completed-on-driver-indica.patch:
    - Revert commit breaking authentication on brcmfmac (LP: #2124258)

 -- Tobias Heider <tobias.heider@canonical.com>  Mon, 01 Sep 2025 22:48:55 +0200

wpa (2:2.11-0ubuntu2) questing; urgency=medium

  * Bump DEFAULT_BSS_MAX_COUNT to 1000 (LP: #2117180)

 -- Mitchell Augustin <mitchell.augustin@canonical.com>  Mon, 21 Jul 2025 18:13:31 -0500

wpa (2:2.11-0ubuntu1) questing; urgency=medium

  * New upstream release (LP: #2117497)
    - d/p/0019-Send-CTRL-EVENT-SIGNAL-CHANGE-message-to-control-int.patch:
      refreshed
    - d/p/0002-AP-guard-FT-SAE-code-with-CONFIG_IEEE80211R_AP.patch:
      refreshed to fit with WPA_KEY_MGMT_FT_SAE_EXT_KEY too.
    - Dropped patches, merged upstream:
      d/p/upstream-fixes/001*
      d/p/0003-OpenSSL-Drop-security-level-to-0-with-OpenSSL-3.0-wh.patch
      d/p/0017-CVE-2023-52160-PEAP-client-Update-Phase-2-authentica.patch
      d/p/CVE-2022-37660.patch

 -- Antoine Lassagne <antoine.lassagne@canonical.com>  Thu, 24 Jul 2025 10:36:27 +0200

wpa (2:2.10-24) unstable; urgency=medium

  [ Hlib Korzhynskyy ]
  * SECURITY UPDATE: Encrypted element reusage
    - debian/patches/CVE-2022-37660.patch: Add hostapd_dpp_pkex_clear_code()
      and wpas_dpp_pkex_clear_code(), and clear code reusage in
      ./src/ap/dpp_hostapd.c and ./wpa_supplicant/dpp_supplicant.c
    - CVE-2022-37660.

 -- Andrej Shadura <andrewsh@debian.org>  Sat, 22 Mar 2025 07:06:15 +0100

wpa (2:2.10-23) unstable; urgency=medium

  * Apply upstream patch to decrease verbosity of syslog logging.
    Closes: #1101013.

 -- Andrej Shadura <andrewsh@debian.org>  Fri, 21 Mar 2025 19:51:50 +0100

wpa (2:2.10-22) unstable; urgency=medium

  * Only load libraries from trusted path (CVE-2024-5290, LP: #2067613).

 -- Andrej Shadura <andrewsh@debian.org>  Tue, 06 Aug 2024 22:08:38 +0200

wpa (2:2.10-21.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix CVE-2023-52160 (Closes: #1064061):
    The implementation of PEAP in wpa_supplicant allows
    authentication bypass. For a successful attack,
    wpa_supplicant must be configured to not verify
    the network's TLS certificate during Phase 1
    authentication, and an eap_peap_decrypt vulnerability
    can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet
    instead of starting Phase 2. This allows an adversary
    to impersonate Enterprise Wi-Fi networks.

 -- Bastien Roucariès <rouca@debian.org>  Sun, 28 Apr 2024 21:07:32 +0000

wpa (2:2.10-21) unstable; urgency=medium

  [ Jan Van Buggenhout ]
  * Work around missing /dev/stderr and /dev/stdout during early boot.

 -- Andrej Shadura <andrewsh@debian.org>  Mon, 25 Dec 2023 10:47:06 +0100

wpa (2:2.10-20) unstable; urgency=medium

  * Add a trailing newline to the patch series file.

 -- Andrej Shadura <andrewsh@debian.org>  Sun, 10 Dec 2023 17:03:00 +0100

wpa (2:2.10-19) unstable; urgency=medium

  [ Andrey Skvortsov ]
  * Override ieee80211w from pmf for AP mode in wpa_supplicant
    (Closes: #1057494)

 -- Andrej Shadura <andrewsh@debian.org>  Sun, 10 Dec 2023 16:17:49 +0100

wpa (2:2.10-18) unstable; urgency=medium

  * Use "command" when calling actual ifupdown and not its shell wrappers
    (Closes: #1056976)

 -- Andrej Shadura <andrewsh@debian.org>  Thu, 30 Nov 2023 10:01:49 +0100

wpa (2:2.10-17) unstable; urgency=medium

  [ Guillem Jover ]
  * Do not hardcode absolute pathnames to third-party commands.
  * Fully move files from / to canonical /usr locations
    (Closes: #1056976).

 -- Andrej Shadura <andrew.shadura@collabora.co.uk>  Tue, 28 Nov 2023 13:24:46 +0100

wpa (2:2.10-16) unstable; urgency=medium

  * Move binaries to /usr.

 -- Andrej Shadura <andrewsh@debian.org>  Sun, 26 Nov 2023 12:01:06 +0000

wpa (2:2.10-15) unstable; urgency=medium

  * Apply proposed upstream patch:
    - Abort ongoing scan:
      Along with canceling queued scan, abort ongoing scan if any, this
      ensures Wi-Fi interface is in usable state after disconnect is issued,
      else subsequent scan after disconnect might fail with EBUSY.

 -- Andrej Shadura <andrewsh@debian.org>  Wed, 30 Aug 2023 14:28:29 +0200

wpa (2:2.10-14) unstable; urgency=medium

  * Drop a patch with a missing dependency.

 -- Andrej Shadura <andrewsh@debian.org>  Wed, 23 Aug 2023 00:37:01 +0200

wpa (2:2.10-13) unstable; urgency=medium

  [ Gioele Barabucci ]
  * d/rules: Install dbus policy in /usr instead of /etc (Closes: #1035609).

  [ Andrej Shadura ]
  * Update lintian override info format in d/wpasupplicant.lintian-overrides
  * Set upstream metadata fields: Repository.
  * Apply upstream patches:
    - wnm: Choose best available bss, not just first one
    - Fix wpa_supplicant configuration parsing error
    - Fix multiple BSSID STA aid count.

 -- Andrej Shadura <andrewsh@debian.org>  Tue, 22 Aug 2023 21:34:36 +0200

wpa (2:2.10-12) unstable; urgency=medium

  * Prevent hostapd units from being started if there’s
    no config provided (Closes: #1028088).
  * hostapd: Enable 802.11ax support (Closes: #1013732).

 -- Andrej Shadura <andrewsh@debian.org>  Fri, 24 Feb 2023 14:01:35 +0100

wpa (2:2.10-11) unstable; urgency=medium

  * Drop security level to 0 with OpenSSL 3.0 when using TLS 1.0/1.1
    (Closes: #1011121, LP: #1958267)
  * Drop dependency on lsb-base.

 -- Andrej Shadura <andrewsh@debian.org>  Tue, 31 Jan 2023 12:58:02 +0100

wpa (2:2.10-10) unstable; urgency=medium

  * Configure wpa_supplicant.service to create control sockets owned by group netdev
    (Closes: #1012844)

 -- Andrej Shadura <andrewsh@debian.org>  Wed, 21 Dec 2022 10:03:29 +0100

wpa (2:2.10-9) unstable; urgency=medium

  [ Sebastien Bacher ]
  * debian/patches/allow-legacy-renegotiation.patch:
    Allow legacy renegotiation to fix PEAP issues with some servers
    (Closes: #1010603, LP: #1962541)

 -- Andrej Shadura <andrewsh@debian.org>  Thu, 05 May 2022 11:23:33 +0100

wpa (2:2.10-8) unstable; urgency=medium

  * Pull the defconfig updates from the upstream’s Git.
  * Add an upstream patch: AP: guard FT-SAE code with CONFIG_IEEE80211R_AP.
  * Declare Breaks against NM without this patch (Closes: #1003907):
    - supplicant: enable WPA3 transition mode only when interface supports PMF

 -- Andrej Shadura <andrewsh@debian.org>  Sat, 09 Apr 2022 09:28:35 +0200

wpa (2:2.10-7) unstable; urgency=medium

  * Support nodoc build profile.
  * Disable OWE on kFreeBSD.

 -- Andrej Shadura <andrewsh@debian.org>  Mon, 04 Apr 2022 16:56:16 +0200

wpa (2:2.10-6) unstable; urgency=medium

  * Link against dl on kFreeBSD.

 -- Andrej Shadura <andrewsh@debian.org>  Mon, 04 Apr 2022 15:04:12 +0200

wpa (2:2.10-5) unstable; urgency=medium

  * Synchronise build configs with defconfigs.
  * Disable options not compilable on kFreeBSD in kFreeBSD builds.

 -- Andrej Shadura <andrewsh@debian.org>  Mon, 04 Apr 2022 13:59:59 +0200

wpa (2:2.10-4) unstable; urgency=medium

  * Skip GUI build on kFreeBSD, not Hurd.

 -- Andrej Shadura <andrewsh@debian.org>  Sat, 02 Apr 2022 17:25:31 +0200

wpa (2:2.10-3) unstable; urgency=medium

  [ Andrej Shadura ]
  * Bump debhelper from old 12 to 13.
  * Avoid explicitly specifying -Wl,--as-needed linker flag.
  * Drop dh-exec usage, dh 13 supports substitutions natively.
  * Re-enable WEP (Closes: #1006366).
  * Remove constraints unnecessary since buster.
  * Clean up compiler flags.
  * Don’t build the GUI on kFreeBSD since Qt 5 is uninstallable.
  * Add sync-config script to simplify synchronising configuration.
  * Explicitly undefine options we want to disable.

  [ Thomas Glanzmann ]
  * Replace the wheel group with netdev in the manpage
    (Closes: #1005639).

 -- Andrej Shadura <andrewsh@debian.org>  Sat, 02 Apr 2022 15:30:45 +0200

wpa (2:2.10-2) unstable; urgency=medium

  [ Ryutaroh Matsumoto ]
  * Add reload support to the systemd unit files (Closes: #931554).

  [ Michael Yartys ]
  * Enable OCV in compile-time config.

  [ Andrej Shadura ]
  * Apply an upstream patch to fix broadcom-wl (Closes: #1004524).
    Thanks to David Bauer for the patch.

 -- Andrej Shadura <andrewsh@debian.org>  Wed, 02 Feb 2022 01:14:41 +0100

wpa (2:2.10-1) unstable; urgency=medium

  * Upload to unstable.
  * New upstream release.

 -- Andrej Shadura <andrewsh@debian.org>  Mon, 17 Jan 2022 10:30:13 +0100

wpa (2:2.9.0+git20211116+0b853303ae31-1) experimental; urgency=medium

  * New upstream snapshot.
  * Refresh patches, drop patches applied upstream.

 -- Andrej Shadura <andrewsh@debian.org>  Wed, 17 Nov 2021 21:43:03 +0100

wpa (2:2.9.0+git20211018+2e122945fa53-1) experimental; urgency=medium

  * New upstream snapshot.
  * Update the copyright years.
  * Refresh patches, drop patch applied upstream.
  * Drop KNotify patch for wpa-gui.
  * Drop patch modifying the wpa_gui’s desktop file for /usr/sbin.
  * Install wpa_gui into /usr/bin.

 -- Andrej Shadura <andrewsh@debian.org>  Thu, 21 Oct 2021 12:20:49 +0200

wpa (2:2.9.0+git20210909+a75fdcd-1) experimental; urgency=medium

  * New upstream snapshot.
  * Refresh patches.
  * Merge changes from unstable.
  * Enable WNM, MBO, FILS and mesh networking
    (Closes: #886414, #930751).

 -- Andrej Shadura <andrewsh@debian.org>  Wed, 15 Sep 2021 21:41:39 +0100

wpa (2:2.9.0+git20200517+dd2daf0-1) experimental; urgency=medium

  * New upstream snapshot.
  * Refresh patches.

 -- Andrej Shadura <andrewsh@debian.org>  Tue, 19 May 2020 14:45:27 +0200

wpa (2:2.9.0+git20200221+f65da0c-1) experimental; urgency=medium

  * New upstream snapshot.

 -- Andrej Shadura <andrewsh@debian.org>  Sat, 22 Feb 2020 11:31:25 +0300

wpa (2:2.9.0-23) unstable; urgency=medium

  * Implement driver fallback directly in wpa_supplicant.
    Thanks to Kees Cook.
  * Enable airtime policy support (Closes: #996742)

 -- Andrej Shadura <andrewsh@debian.org>  Tue, 19 Oct 2021 10:35:00 +0200

wpa (2:2.9.0-22) unstable; urgency=medium

  * Test systemctl is available before using it.
  * hostapd.service: Do not repeat repeat yourself — remove the second
    -B (Closes: #977703)
  * Enable IPv6 support in eapol_test (Closes: #985912)

 -- Andrej Shadura <andrewsh@debian.org>  Wed, 15 Sep 2021 16:27:12 +0100

wpa (2:2.9.0-21) unstable; urgency=high

  * Fix typos in the package descriptions.
    Thanks to Beatrice Torracca (Closes: #982673).
  * SECURITY ISSUE:
    - P2P: Fix a corner case in peer addition based on PD Request.

 -- Andrej Shadura <andrewsh@debian.org>  Thu, 25 Feb 2021 22:19:14 +0100

wpa (2:2.9.0-20) unstable; urgency=medium

  * Add IgnoreOnIsolate=yes to keep wpa-supplicant running while
    systemctl isolate (LP: #1576024)
  * Disable -Werror for eapol_test.
  * Update descriptions of the packages.
  * Prefer pkgconf to pkg-config.
  * Set Rules-Requires-Root: no.
  * Remove the unused system-sleep hook.
  * Remove get-orig-source/uscan-hook.
  * Use execute_before/execute_after instead of overrides in a few places.
  * Update descriptions in init scripts and service files.
  * Update wpasupplicant.README.Debian.
  * Actually delete an old patch not accepted upstream.

 -- Andrej Shadura <andrewsh@debian.org>  Fri, 12 Feb 2021 16:09:13 +0100

wpa (2:2.9.0-19) unstable; urgency=medium

  * Replace proposed fixes with actual changes accepted upstream:
    - WPS: Reconfigure credentials on hostapd config reload
    - hostapd: Fix error message for radius_accept_attr config option
  * Drop old lintian overrides.
  * Move libwpa-client-dev to section libdevel.
  * Drop old entries from debian/copyright.

 -- Andrej Shadura <andrewsh@debian.org>  Fri, 12 Feb 2021 12:01:09 +0100

wpa (2:2.9.0-18) unstable; urgency=medium

  * Apply upstream patches from Ubuntu (LP: #1879087, #1912609, #1893563):
    - D-Bus: Move roam metrics to the correct interface
    - nl80211: Unbreak mode processing due to presence of S1G band
    - D-Bus: Allow changing an interface bridge via D-Bus
  * Enable support for WPA-EAP-SUITE-B(-192) (Closes: #982548).

 -- Andrej Shadura <andrewsh@debian.org>  Fri, 12 Feb 2021 11:31:57 +0100

wpa (2:2.9.0-17) unstable; urgency=medium

  [ Salvatore Bonaccorso ]
  * P2P: Fix copying of secondary device types for P2P group client
    (CVE-2021-0326) (Closes: #981971).

 -- Andrej Shadura <andrewsh@debian.org>  Sat, 06 Feb 2021 18:04:13 +0100

wpa (2:2.9.0-16) unstable; urgency=high

  * Restrict eapoltest to linux-any kfreebsd-any.
  * Add an upstream patch to fix a crash with a long P2P interface name
    (Closes: #976091).
  * Security fix: CVE-2020-12695.
    A vulnerability in the UPnP SUBSCRIBE command can trigger the AP to
    initiate a HTTP (TCP/IP) connection to an arbitrary URL or to trigger
    misbehavior in hostapd and cause the process to either get terminated
    or to start using more CPU resources.
    The issue can also be mitigated by building hostapd without UPnP support
    (CONFIG_WPS_UPNP=n) or disabling it at runtime by removing the upnp_iface
    parameter.
    (Closes: #976106)
  * Refresh patches.

 -- Andrej Shadura <andrewsh@debian.org>  Mon, 30 Nov 2020 10:02:04 +0100

wpa (2:2.9.0-15) unstable; urgency=medium

  * Don’t fail the build on -Warray-bounds.

 -- Andrej Shadura <andrewsh@debian.org>  Mon, 24 Aug 2020 14:21:02 +0200

wpa (2:2.9.0-14) unstable; urgency=medium

  [ Paul Menzel ]
  * Fix unknown key warnings NetworkManager configuration drop-in.
  * Update NetworkManager configuration drop-in.
  * Remove defaults from NetworkManager configuration drop-in.
    Closes: #951268, #966811.

  [ Andrej Shadura ]
  * Add fixes proposed upstream:
    - Fix error message for radius_accept_attr config option
    - Update WPS credentials on SIGHUP

 -- Andrej Shadura <andrewsh@debian.org>  Mon, 24 Aug 2020 12:53:37 +0200

wpa (2:2.9.0-13) unstable; urgency=medium

  * Apply upstream patches:
    - Avoid sending invalid mgmt frames at startup
    - Increase introspection buffer size for D-Bus

 -- Andrej Shadura <andrewsh@debian.org>  Tue, 19 May 2020 14:29:29 +0200

wpa (2:2.9.0-12) unstable; urgency=medium

  * Add an upstream patch to fix the MAC randomisation issue with some cards
    (LP: #1867908).

 -- Andrej Shadura <andrewsh@debian.org>  Tue, 24 Mar 2020 11:13:16 +0100

wpa (2:2.9.0-11) unstable; urgency=medium

  * Actually add autopkgtest for libwpa-client-dev and libwpa_test.c.

 -- Andrej Shadura <andrewsh@debian.org>  Sat, 07 Mar 2020 13:18:19 +0100

wpa (2:2.9.0-10) unstable; urgency=medium

  * Rename the package with the client library to libwpa-client-dev.

 -- Andrej Shadura <andrewsh@debian.org>  Tue, 25 Feb 2020 20:19:52 +0100

wpa (2:2.9.0-9) unstable; urgency=medium

  [ Terry Burton ]
  * Build and install eapol_test in eapoltest package (Closes: #700870)

  [ Didier Raboud ]
  * Backport upstream patch to fix build with Debian's VERSION_STR.

  [ Andrew Lee (李健秋) ]
  * Build libwpa-dev binary package which contains a static
    libwpa_client library and the wpa_ctrl header with an example program.

  [ Andrej Shadura ]
  * Add a patch to provide the BIT() macro locally in wpa_ctrl.h.
  * Patch the example to use stddef.h and wpa_ctrl.h from the global location.
  * Add an autopkgtest for libwpa-dev and libwpa_test.c.

 -- Andrej Shadura <andrewsh@debian.org>  Tue, 25 Feb 2020 18:21:35 +0100

wpa (2:2.9.0-8) unstable; urgency=medium

  * Reupload as 2.9.0 to undo an accidental experimental upload to unstable.

 -- Andrej Shadura <andrewsh@debian.org>  Sat, 22 Feb 2020 11:25:29 +0300

wpa (2:2.9+git20200213+877d9a0-1) unstable; urgency=medium

  * New upstream snapshot.
  * Refresh patches.

 -- Andrej Shadura <andrewsh@debian.org>  Sat, 15 Feb 2020 16:53:28 +0100

wpa (2:2.9-7) unstable; urgency=medium

  * Apply upstream patches:
    - trace: handle binutils bfd.h breakage
    - Check for FT support when selecting FT suites (Closes: #942164)

 -- Andrej Shadura <andrewsh@debian.org>  Sat, 15 Feb 2020 16:42:04 +0100

wpa (2:2.9-6) unstable; urgency=medium

  [ Debian Janitor ]
  * Use secure URI in Homepage field.
  * Move source package lintian overrides to debian/source.
  * Use canonical URL in Vcs-Browser.
  * Rely on pre-initialized dpkg-architecture variables.
  * Update standards version to 4.4.1, no changes needed.

  [ Andrej Shadura ]
  * Disable CONFIG_DRIVER_MACSEC_QCA on kfreebsd.

 -- Andrej Shadura <andrewsh@debian.org>  Mon, 13 Jan 2020 16:28:58 +0100

wpa (2:2.9-5) unstable; urgency=medium

  * Fix erroneously inverted logic in postinst.

 -- Andrej Shadura <andrewsh@debian.org>  Mon, 13 Jan 2020 10:48:26 +0100

wpa (2:2.9-4) unstable; urgency=medium

  [ Helmut Grohne ]
  * Fix FTCBFS: Don’t export CC=cc (Closes: #921998).

  [ Andrej Shadura ]
  * Don’t act in hostapd.postinst if we’re running in a chrootless root.
  * Apply an upstream patch:
    - wpa_supplicant: Do not try to detect PSK mismatch during PTK rekeying.

 -- Andrej Shadura <andrewsh@debian.org>  Mon, 13 Jan 2020 10:37:10 +0100

wpa (2:2.9-3) unstable; urgency=medium

  * Add pkg.wpa.nogui and noudeb build profiles.

 -- Andrej Shadura <andrewsh@debian.org>  Fri, 04 Oct 2019 11:47:15 +0200

wpa (2:2.9-2) unstable; urgency=medium

  * SECURITY UPDATE:
    - AP mode PMF disconnection protection bypass.
      More details:
       + https://w1.fi/security/2019-7/
      Closes: #940080 (CVE-2019-16275)

 -- Andrej Shadura <andrewsh@debian.org>  Fri, 04 Oct 2019 10:11:47 +0200

wpa (2:2.9-1) unstable; urgency=high

  * New upstream release (Closes: #934180):
    - SECURITY UPDATE (CVE-2019-13377):
      Timing-based side-channel attack against WPA3's Dragonfly handshake
      when using Brainpool curves.
      More details:
      + https://w1.fi/security/2019-6/
      + https://wpa3.mathyvanhoef.com/
  * Drop a patch applied upstream.
  * Update debian/watch.

 -- Andrej Shadura <andrewsh@debian.org>  Thu, 08 Aug 2019 15:59:02 +0200

wpa (2:2.8+git20190713+b8491ae-1) experimental; urgency=medium

  * Upload to experimental.
  * New upstream snapshot.
  * Drop patches applied upstream.

 -- Andrej Shadura <andrewsh@debian.org>  Tue, 16 Jul 2019 18:47:25 -0300

wpa (2:2.8-3) unstable; urgency=medium

  * Upload to unstable.
  * Apply upstream patch:
    - Use a separate flag for 4-way handshake offload.
  * Spelling: meny -> menu.
  * Add lintian overrides for known issues.

 -- Andrej Shadura <andrewsh@debian.org>  Thu, 11 Jul 2019 23:19:03 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog wpasupplicant`.
