| ChangeLog for hostapd |
| |
| ????-??-?? - v2.1 |
| * added support for simulataneous authentication of equals (SAE) for |
| stronger password-based authentication with WPA2-Personal |
| |
| 2013-01-12 - v2.0 |
| * added AP-STA-DISCONNECTED ctrl_iface event |
| * improved debug logging (human readable event names, interface name |
| included in more entries) |
| * added number of small changes to make it easier for static analyzers |
| to understand the implementation |
| * added a workaround for Windows 7 Michael MIC failure reporting and |
| use of the Secure bit in EAPOL-Key msg 3/4 |
| * fixed number of small bugs (see git logs for more details) |
| * changed OpenSSL to read full certificate chain from server_cert file |
| * nl80211: number of updates to use new cfg80211/nl80211 functionality |
| - replace monitor interface with nl80211 commands |
| - additional information for driver-based AP SME |
| * EAP-pwd: |
| - fix KDF for group 21 and zero-padding |
| - added support for fragmentation |
| - increased maximum number of hunting-and-pecking iterations |
| * avoid excessive Probe Response retries for broadcast Probe Request |
| frames (only with drivers using hostapd SME/MLME) |
| * added preliminary support for using TLS v1.2 (CONFIG_TLSV12=y) |
| * fixed WPS operation stopping on dual concurrent AP |
| * added wps_rf_bands configuration parameter for overriding RF Bands |
| value for WPS |
| * added support for getting per-device PSK from RADIUS Tunnel-Password |
| * added support for libnl 3.2 and newer |
| * increased initial group key handshake retransmit timeout to 500 ms |
| * added a workaround for 4-way handshake to update SNonce even after |
| having sent EAPOL-Key 3/4 to avoid issues with some supplicant |
| implementations that can change SNonce for each EAP-Key 2/4 |
| * added a workaround for EAPOL-Key 4/4 using incorrect type value in |
| WPA2 mode (some deployed stations use WPA type in that message) |
| * added a WPS workaround for mixed mode AP Settings with Windows 7 |
| * changed WPS AP PIN disabling mechanism to disable the PIN after 10 |
| consecutive failures in addition to using the exponential lockout |
| period |
| * added support for WFA Hotspot 2.0 |
| - GAS/ANQP advertisement of network information |
| - disable_dgaf parameter to disable downstream group-addressed |
| forwarding |
| * simplified licensing terms by selecting the BSD license as the only |
| alternative |
| * EAP-SIM: fixed re-authentication not to update pseudonym |
| * EAP-SIM: use Notification round before EAP-Failure |
| * EAP-AKA: added support for AT_COUNTER_TOO_SMALL |
| * EAP-AKA: skip AKA/Identity exchange if EAP identity is recognized |
| * EAP-AKA': fixed identity for MK derivation |
| * EAP-AKA': updated to RFC 5448 (username prefixes changed); note: this |
| breaks interoperability with older versions |
| * EAP-SIM/AKA: allow pseudonym to be used after unknown reauth id |
| * changed ANonce to be a random number instead of Counter-based |
| * added support for canceling WPS operations with hostapd_cli wps_cancel |
| * fixed EAP/WPS to PSK transition on reassociation in cases where |
| deauthentication is missed |
| * hlr_auc_gw enhancements: |
| - a new command line parameter -u can be used to enable updating of |
| SQN in Milenage file |
| - use 5 bit IND for SQN updates |
| - SQLite database can now be used to store Milenage information |
| * EAP-SIM/AKA DB: added optional use of SQLite database for pseudonyms |
| and reauth data |
| * added support for Chargeable-User-Identity (RFC 4372) |
| * added radius_auth_req_attr and radius_acct_req_attr configuration |
| parameters to allow adding/overriding of RADIUS attributes in |
| Access-Request and Accounting-Request packets |
| * added support for RADIUS dynamic authorization server (RFC 5176) |
| * added initial support for WNM operations |
| - BSS max idle period |
| - WNM-Sleep Mode |
| * added new WPS NFC ctrl_iface mechanism |
| - removed obsoleted WPS_OOB command (including support for deprecated |
| UFD config_method) |
| * added FT support for drivers that implement MLME internally |
| * added SA Query support for drivers that implement MLME internally |
| * removed default ACM=1 from AC_VO and AC_VI |
| * changed VENDOR-TEST EAP method to use proper private enterprise number |
| (this will not interoperate with older versions) |
| * added hostapd.conf parameter vendor_elements to allow arbitrary vendor |
| specific elements to be added to the Beacon and Probe Response frames |
| * added support for configuring GCMP cipher for IEEE 802.11ad |
| * added support for 256-bit AES with internal TLS implementation |
| * changed EAPOL transmission to use AC_VO if WMM is active |
| * fixed EAP-TLS/PEAP/TTLS/FAST server to validate TLS Message Length |
| correctly; invalid messages could have caused the hostapd process to |
| terminate before this fix [CVE-2012-4445] |
| * limit number of active wildcard PINs for WPS Registrar to one to avoid |
| confusing behavior with multiple wildcard PINs |
| * added a workaround for WPS PBC session overlap detection to avoid |
| interop issues with deployed station implementations that do not |
| remove active PBC indication from Probe Request frames properly |
| * added support for using SQLite for the eap_user database |
| * added Acct-Session-Id attribute into Access-Request messages |
| * fixed EAPOL frame transmission to non-QoS STAs with nl80211 |
| (do not send QoS frames if the STA did not negotiate use of QoS for |
| this association) |
| |
| 2012-05-10 - v1.0 |
| * Add channel selection support in hostapd. See hostapd.conf. |
| * Add support for IEEE 802.11v Time Advertisement mechanism with UTC |
| TSF offset. See hostapd.conf for config info. |
| * Delay STA entry removal until Deauth/Disassoc TX status in AP mode. |
| This allows the driver to use PS buffering of Deauthentication and |
| Disassociation frames when the STA is in power save sleep. Only |
| available with drivers that provide TX status events for Deauth/ |
| Disassoc frames (nl80211). |
| * Allow PMKSA caching to be disabled on the Authenticator. See |
| hostap.conf config parameter disable_pmksa_caching. |
| * atheros: Add support for IEEE 802.11w configuration. |
| * bsd: Add support for setting HT values in IFM_MMASK. |
| * Allow client isolation to be configured with ap_isolate. Client |
| isolation can be used to prevent low-level bridging of frames |
| between associated stations in the BSS. By default, this bridging |
| is allowed. |
| * Allow coexistance of HT BSSes with WEP/TKIP BSSes. |
| * Add require_ht config parameter, which can be used to configure |
| hostapd to reject association with any station that does not support |
| HT PHY. |
| * Add support for writing debug log to a file using "-f" option. Also |
| add relog CLI command to re-open the log file. |
| * Add bridge handling for WDS STA interfaces. By default they are |
| added to the configured bridge of the AP interface (if present), |
| but the user can also specify a separate bridge using cli command |
| wds_bridge. |
| * hostapd_cli: |
| - Add wds_bridge command for specifying bridge for WDS STA |
| interfaces. |
| - Add relog command for reopening log file. |
| - Send AP-STA-DISCONNECTED event when an AP disconnects a station |
| due to inactivity. |
| - Add wps_config ctrl_interface command for configuring AP. This |
| command can be used to configure the AP using the internal WPS |
| registrar. It works in the same way as new AP settings received |
| from an ER. |
| - Many WPS/WPS ER commands - see WPS/WPS ER sections for details. |
| - Add command get version, that returns hostapd version string. |
| * WNM: Add BSS Transition Management Request for ESS Disassoc Imminent. |
| Use hostapd_cli ess_disassoc (STA addr) (URL) to send the |
| notification to the STA. |
| * Allow AP mode to disconnect STAs based on low ACK condition (when |
| the data connection is not working properly, e.g., due to the STA |
| going outside the range of the AP). Disabled by default, enable by |
| config option disassoc_low_ack. |
| * Add WPA_IGNORE_CONFIG_ERRORS build option to continue in case of bad |
| config file. |
| * WPS: |
| - Send AP Settings as a wrapped Credential attribute to ctrl_iface |
| in WPS-NEW-AP-SETTINGS. |
| - Dispatch more WPS events through hostapd ctrl_iface. |
| - Add mechanism for indicating non-standard WPS errors. |
| - Change concurrent radio AP to use only one WPS UPnP instance. |
| - Add wps_check_pin command for processing PIN from user input. |
| UIs can use this command to process a PIN entered by a user and to |
| validate the checksum digit (if present). |
| - Add hostap_cli get_config command to display current AP config. |
| - Add new hostapd_cli command, wps_ap_pin, to manage AP PIN at |
| runtime and support dynamic AP PIN management. |
| - Disable AP PIN after 10 consecutive failures. Slow down attacks |
| on failures up to 10. |
| - Allow AP to start in Enrollee mode without AP PIN for probing, |
| to be compatible with Windows 7. |
| - Add Config Error into WPS-FAIL events to provide more info |
| to the user on how to resolve the issue. |
| - When controlling multiple interfaces: |
| - apply WPS commands to all interfaces configured to use WPS |
| - apply WPS config changes to all interfaces that use WPS |
| - when an attack is detected on any interface, disable AP PIN on |
| all interfaces |
| * WPS ER: |
| - Show SetSelectedRegistrar events as ctrl_iface events. |
| - Add special AP Setup Locked mode to allow read only ER. |
| ap_setup_locked=2 can now be used to enable a special mode where |
| WPS ER can learn the current AP settings, but cannot change them. |
| * WPS 2.0: Add support for WPS 2.0 (CONFIG_WPS2) |
| - Add build option CONFIG_WPS_EXTENSIBILITY_TESTING to enable tool |
| for testing protocol extensibility. |
| - Add build option CONFIG_WPS_STRICT to allow disabling of WPS |
| workarounds. |
| - Add support for AuthorizedMACs attribute. |
| * TDLS: |
| - Allow TDLS use or TDLS channel switching in the BSS to be |
| prohibited in the BSS, using config params tdls_prohibit and |
| tdls_prohibit_chan_switch. |
| * EAP server: Add support for configuring fragment size (see |
| fragment_size in hostapd.conf). |
| * wlantest: Add a tool wlantest for IEEE802.11 protocol testing. |
| wlantest can be used to capture frames from a monitor interface |
| for realtime capturing or from pcap files for offline analysis. |
| * Interworking: Support added for 802.11u. Enable in .config with |
| CONFIG_INTERWORKING. See hostapd.conf for config parameters for |
| interworking. |
| * Android: Add build and runtime support for Android hostapd. |
| * Add a new debug message level for excessive information. Use |
| -ddd to enable. |
| * TLS: Add support for tls_disable_time_checks=1 in client mode. |
| * Internal TLS: |
| - Add support for TLS v1.1 (RFC 4346). Enable with build parameter |
| CONFIG_TLSV11. |
| - Add domainComponent parser for X.509 names |
| * Reorder some IEs to get closer to IEEE 802.11 standard. Move |
| WMM into end of Beacon, Probe Resp and (Re)Assoc Resp frames. |
| Move HT IEs to be later in (Re)Assoc Resp. |
| * Many bugfixes. |
| |
| 2010-04-18 - v0.7.2 |
| * fix WPS internal Registrar use when an external Registrar is also |
| active |
| * bsd: Cleaned up driver wrapper and added various low-level |
| configuration options |
| * TNC: fixed issues with fragmentation |
| * EAP-TNC: add Flags field into fragment acknowledgement (needed to |
| interoperate with other implementations; may potentially breaks |
| compatibility with older wpa_supplicant/hostapd versions) |
| * cleaned up driver wrapper API for multi-BSS operations |
| * nl80211: fix multi-BSS and VLAN operations |
| * fix number of issues with IEEE 802.11r/FT; this version is not |
| backwards compatible with old versions |
| * add SA Query Request processing in AP mode (IEEE 802.11w) |
| * fix IGTK PN in group rekeying (IEEE 802.11w) |
| * fix WPS PBC session overlap detection to use correct attribute |
| * hostapd_notif_Assoc() can now be called with all IEs to simplify |
| driver wrappers |
| * work around interoperability issue with some WPS External Registrar |
| implementations |
| * nl80211: fix WPS IE update |
| * hostapd_cli: add support for action script operations (run a script |
| on hostapd events) |
| * fix DH padding with internal crypto code (mainly, for WPS) |
| * fix WPS association with both WPS IE and WPA/RSN IE present with |
| driver wrappers that use hostapd MLME (e.g., nl80211) |
| |
| 2010-01-16 - v0.7.1 |
| * cleaned up driver wrapper API (struct wpa_driver_ops); the new API |
| is not fully backwards compatible, so out-of-tree driver wrappers |
| will need modifications |
| * cleaned up various module interfaces |
| * merge hostapd and wpa_supplicant developers' documentation into a |
| single document |
| * fixed HT Capabilities IE with nl80211 drivers |
| * moved generic AP functionality code into src/ap |
| * WPS: handle Selected Registrar as union of info from all Registrars |
| * remove obsolte Prism54.org driver wrapper |
| * added internal debugging mechanism with backtrace support and memory |
| allocation/freeing validation, etc. tests (CONFIG_WPA_TRACE=y) |
| * EAP-FAST server: piggyback Phase 2 start with the end of Phase 1 |
| * WPS: add support for dynamically selecting whether to provision the |
| PSK as an ASCII passphrase or PSK |
| * added support for WDS (4-address frame) mode with per-station virtual |
| interfaces (wds_sta=1 in config file; only supported with |
| driver=nl80211 for now) |
| * fixed WPS Probe Request processing to handle missing required |
| attribute |
| * fixed PKCS#12 use with OpenSSL 1.0.0 |
| * detect bridge interface automatically so that bridge parameter in |
| hostapd.conf becomes optional (though, it may now be used to |
| automatically add then WLAN interface into a bridge with |
| driver=nl80211) |
| |
| 2009-11-21 - v0.7.0 |
| * increased hostapd_cli ping interval to 5 seconds and made this |
| configurable with a new command line options (-G<seconds>) |
| * driver_nl80211: use Linux socket filter to improve performance |
| * added support for external Registrars with WPS (UPnP transport) |
| * 802.11n: scan for overlapping BSSes before starting 20/40 MHz channel |
| * driver_nl80211: fixed STA accounting data collection (TX/RX bytes |
| reported correctly; TX/RX packets not yet available from kernel) |
| * added support for WPS USBA out-of-band mechanism with USB Flash |
| Drives (UFD) (CONFIG_WPS_UFD=y) |
| * fixed EAPOL/EAP reauthentication when using an external RADIUS |
| authentication server |
| * fixed TNC with EAP-TTLS |
| * fixed IEEE 802.11r key derivation function to match with the standard |
| (note: this breaks interoperability with previous version) [Bug 303] |
| * fixed SHA-256 based key derivation function to match with the |
| standard when using CCMP (for IEEE 802.11r and IEEE 802.11w) |
| (note: this breaks interoperability with previous version) [Bug 307] |
| * added number of code size optimizations to remove unnecessary |
| functionality from the program binary based on build configuration |
| (part of this automatic; part configurable with CONFIG_NO_* build |
| options) |
| * use shared driver wrapper files with wpa_supplicant |
| * driver_nl80211: multiple updates to provide support for new Linux |
| nl80211/mac80211 functionality |
| * updated management frame protection to use IEEE Std 802.11w-2009 |
| * fixed number of small WPS issues and added workarounds to |
| interoperate with common deployed broken implementations |
| * added some IEEE 802.11n co-existence rules to disable 40 MHz channels |
| or modify primary/secondary channels if needed based on neighboring |
| networks |
| * added support for NFC out-of-band mechanism with WPS |
| * added preliminary support for IEEE 802.11r RIC processing |
| |
| 2009-01-06 - v0.6.7 |
| * added support for Wi-Fi Protected Setup (WPS) |
| (hostapd can now be configured to act as an integrated WPS Registrar |
| and provision credentials for WPS Enrollees using PIN and PBC |
| methods; external wireless Registrar can configure the AP, but |
| external WLAN Manager Registrars are not supported); WPS support can |
| be enabled by adding CONFIG_WPS=y into .config and setting the |
| runtime configuration variables in hostapd.conf (see WPS section in |
| the example configuration file); new hostapd_cli commands wps_pin and |
| wps_pbc are used to configure WPS negotiation; see README-WPS for |
| more details |
| * added IEEE 802.11n HT capability configuration (ht_capab) |
| * added support for generating Country IE based on nl80211 regulatory |
| information (added if ieee80211d=1 in configuration) |
| * fixed WEP authentication (both Open System and Shared Key) with |
| mac80211 |
| * added support for EAP-AKA' (draft-arkko-eap-aka-kdf) |
| * added support for using driver_test over UDP socket |
| * changed EAP-GPSK to use the IANA assigned EAP method type 51 |
| * updated management frame protection to use IEEE 802.11w/D7.0 |
| * fixed retransmission of EAP requests if no response is received |
| |
| 2008-11-23 - v0.6.6 |
| * added a new configuration option, wpa_ptk_rekey, that can be used to |
| enforce frequent PTK rekeying, e.g., to mitigate some attacks against |
| TKIP deficiencies |
| * updated OpenSSL code for EAP-FAST to use an updated version of the |
| session ticket overriding API that was included into the upstream |
| OpenSSL 0.9.9 tree on 2008-11-15 (no additional OpenSSL patch is |
| needed with that version anymore) |
| * changed channel flags configuration to read the information from |
| the driver (e.g., via driver_nl80211 when using mac80211) instead of |
| using hostapd as the source of the regulatory information (i.e., |
| information from CRDA is now used with mac80211); this allows 5 GHz |
| channels to be used with hostapd (if allowed in the current |
| regulatory domain) |
| * fixed EAP-TLS message processing for the last TLS message if it is |
| large enough to require fragmentation (e.g., if a large Session |
| Ticket data is included) |
| * fixed listen interval configuration for nl80211 drivers |
| |
| 2008-11-01 - v0.6.5 |
| * added support for SHA-256 as X.509 certificate digest when using the |
| internal X.509/TLSv1 implementation |
| * fixed EAP-FAST PAC-Opaque padding (0.6.4 broke this for some peer |
| identity lengths) |
| * fixed internal TLSv1 implementation for abbreviated handshake (used |
| by EAP-FAST server) |
| * added support for setting VLAN ID for STAs based on local MAC ACL |
| (accept_mac_file) as an alternative for RADIUS server-based |
| configuration |
| * updated management frame protection to use IEEE 802.11w/D6.0 |
| (adds a new association ping to protect against unauthenticated |
| authenticate or (re)associate request frames dropping association) |
| * added support for using SHA256-based stronger key derivation for WPA2 |
| (IEEE 802.11w) |
| * added new "driver wrapper" for RADIUS-only configuration |
| (driver=none in hostapd.conf; CONFIG_DRIVER_NONE=y in .config) |
| * fixed WPA/RSN IE validation to verify that the proto (WPA vs. WPA2) |
| is enabled in configuration |
| * changed EAP-FAST configuration to use separate fields for A-ID and |
| A-ID-Info (eap_fast_a_id_info) to allow A-ID to be set to a fixed |
| 16-octet len binary value for better interoperability with some peer |
| implementations; eap_fast_a_id is now configured as a hex string |
| * driver_nl80211: Updated to match the current Linux mac80211 AP mode |
| configuration (wireless-testing.git and Linux kernel releases |
| starting from 2.6.29) |
| |
| 2008-08-10 - v0.6.4 |
| * added peer identity into EAP-FAST PAC-Opaque and skip Phase 2 |
| Identity Request if identity is already known |
| * added support for EAP Sequences in EAP-FAST Phase 2 |
| * added support for EAP-TNC (Trusted Network Connect) |
| (this version implements the EAP-TNC method and EAP-TTLS/EAP-FAST |
| changes needed to run two methods in sequence (IF-T) and the IF-IMV |
| and IF-TNCCS interfaces from TNCS) |
| * added support for optional cryptobinding with PEAPv0 |
| * added fragmentation support for EAP-TNC |
| * added support for fragmenting EAP-TTLS/PEAP/FAST Phase 2 (tunneled) |
| data |
| * added support for opportunistic key caching (OKC) |
| |
| 2008-02-22 - v0.6.3 |
| * fixed Reassociation Response callback processing when using internal |
| MLME (driver_{hostap,nl80211,test}.c) |
| * updated FT support to use the latest draft, IEEE 802.11r/D9.0 |
| * copy optional Proxy-State attributes into RADIUS response when acting |
| as a RADIUS authentication server |
| * fixed EAPOL state machine to handle a case in which no response is |
| received from the RADIUS authentication server; previous version |
| could have triggered a crash in some cases after a timeout |
| * fixed EAP-SIM/AKA realm processing to allow decorated usernames to |
| be used |
| * added a workaround for EAP-SIM/AKA peers that include incorrect null |
| termination in the username |
| * fixed EAP-SIM/AKA protected result indication to include AT_COUNTER |
| attribute in notification messages only when using fast |
| reauthentication |
| * fixed EAP-SIM Start response processing for fast reauthentication |
| case |
| * added support for pending EAP processing in EAP-{PEAP,TTLS,FAST} |
| phase 2 to allow EAP-SIM and EAP-AKA to be used as the Phase 2 method |
| |
| 2008-01-01 - v0.6.2 |
| * fixed EAP-SIM and EAP-AKA message parser to validate attribute |
| lengths properly to avoid potential crash caused by invalid messages |
| * added data structure for storing allocated buffers (struct wpabuf); |
| this does not affect hostapd usage, but many of the APIs changed |
| and various interfaces (e.g., EAP) is not compatible with old |
| versions |
| * added support for protecting EAP-AKA/Identity messages with |
| AT_CHECKCODE (optional feature in RFC 4187) |
| * added support for protected result indication with AT_RESULT_IND for |
| EAP-SIM and EAP-AKA (eap_sim_aka_result_ind=1) |
| * added support for configuring EAP-TTLS phase 2 non-EAP methods in |
| EAP server configuration; previously all four were enabled for every |
| phase 2 user, now all four are disabled by default and need to be |
| enabled with new method names TTLS-PAP, TTLS-CHAP, TTLS-MSCHAP, |
| TTLS-MSCHAPV2 |
| * removed old debug printing mechanism and the related 'debug' |
| parameter in the configuration file; debug verbosity is now set with |
| -d (or -dd) command line arguments |
| * added support for EAP-IKEv2 (draft-tschofenig-eap-ikev2-15.txt); |
| only shared key/password authentication is supported in this version |
| |
| 2007-11-24 - v0.6.1 |
| * added experimental, integrated TLSv1 server implementation with the |
| needed X.509/ASN.1/RSA/bignum processing (this can be enabled by |
| setting CONFIG_TLS=internal and CONFIG_INTERNAL_LIBTOMMATH=y in |
| .config); this can be useful, e.g., if the target system does not |
| have a suitable TLS library and a minimal code size is required |
| * added support for EAP-FAST server method to the integrated EAP |
| server |
| * updated EAP Generalized Pre-Shared Key (EAP-GPSK) to use the latest |
| draft (draft-ietf-emu-eap-gpsk-07.txt) |
| * added a new configuration parameter, rsn_pairwise, to allow different |
| pairwise cipher suites to be enabled for WPA and RSN/WPA2 |
| (note: if wpa_pairwise differs from rsn_pairwise, the driver will |
| either need to support this or will have to use the WPA/RSN IEs from |
| hostapd; currently, the included madwifi and bsd driver interfaces do |
| not have support for this) |
| * updated FT support to use the latest draft, IEEE 802.11r/D8.0 |
| |
| 2007-05-28 - v0.6.0 |
| * added experimental IEEE 802.11r/D6.0 support |
| * updated EAP-SAKE to RFC 4763 and the IANA-allocated EAP type 48 |
| * updated EAP-PSK to use the IANA-allocated EAP type 47 |
| * fixed EAP-PSK bit ordering of the Flags field |
| * fixed configuration reloading (SIGHUP) to re-initialize WPA PSKs |
| by reading wpa_psk_file [Bug 181] |
| * fixed EAP-TTLS AVP parser processing for too short AVP lengths |
| * fixed IPv6 connection to RADIUS accounting server |
| * updated EAP Generalized Pre-Shared Key (EAP-GPSK) to use the latest |
| draft (draft-ietf-emu-eap-gpsk-04.txt) |
| * hlr_auc_gw: read GSM triplet file into memory and rotate through the |
| entries instead of only using the same three triplets every time |
| (this does not work properly with tests using multiple clients, but |
| provides bit better triplet data for testing a single client; anyway, |
| if a better quality triplets are needed, GSM-Milenage should be used |
| instead of hardcoded triplet file) |
| * fixed EAP-MSCHAPv2 server to use a space between S and M parameters |
| in Success Request [Bug 203] |
| * added support for sending EAP-AKA Notifications in error cases |
| * updated to use IEEE 802.11w/D2.0 for management frame protection |
| (still experimental) |
| * RADIUS server: added support for processing duplicate messages |
| (retransmissions from RADIUS client) by replying with the previous |
| reply |
| |
| 2006-11-24 - v0.5.6 |
| * added support for configuring and controlling multiple BSSes per |
| radio interface (bss=<ifname> in hostapd.conf); this is only |
| available with Devicescape and test driver interfaces |
| * fixed PMKSA cache update in the end of successful RSN |
| pre-authentication |
| * added support for dynamic VLAN configuration (i.e., selecting VLAN-ID |
| for each STA based on RADIUS Access-Accept attributes); this requires |
| VLAN support from the kernel driver/802.11 stack and this is |
| currently only available with Devicescape and test driver interfaces |
| * driver_madwifi: fixed configuration of unencrypted modes (plaintext |
| and IEEE 802.1X without WEP) |
| * removed STAKey handshake since PeerKey handshake has replaced it in |
| IEEE 802.11ma and there are no known deployments of STAKey |
| * updated EAP Generalized Pre-Shared Key (EAP-GPSK) to use the latest |
| draft (draft-ietf-emu-eap-gpsk-01.txt) |
| * added preliminary implementation of IEEE 802.11w/D1.0 (management |
| frame protection) |
| (Note: this requires driver support to work properly.) |
| (Note2: IEEE 802.11w is an unapproved draft and subject to change.) |
| * hlr_auc_gw: added support for GSM-Milenage (for EAP-SIM) |
| * hlr_auc_gw: added support for reading per-IMSI Milenage keys and |
| parameters from a text file to make it possible to implement proper |
| GSM/UMTS authentication server for multiple SIM/USIM cards using |
| EAP-SIM/EAP-AKA |
| * fixed session timeout processing with drivers that do not use |
| ieee802_11.c (e.g., madwifi) |
| |
| 2006-08-27 - v0.5.5 |
| * added 'hostapd_cli new_sta <addr>' command for adding a new STA into |
| hostapd (e.g., to initialize wired network authentication based on an |
| external signal) |
| * fixed hostapd to add PMKID KDE into 4-Way Handshake Message 1 when |
| using WPA2 even if PMKSA caching is not used |
| * added -P<pid file> argument for hostapd to write the current process |
| id into a file |
| * added support for RADIUS Authentication Server MIB (RFC 2619) |
| |
| 2006-06-20 - v0.5.4 |
| * fixed nt_password_hash build [Bug 144] |
| * added PeerKey handshake implementation for IEEE 802.11e |
| direct link setup (DLS) to replace STAKey handshake |
| * added support for EAP Generalized Pre-Shared Key (EAP-GPSK, |
| draft-clancy-emu-eap-shared-secret-00.txt) |
| * fixed a segmentation fault when RSN pre-authentication was completed |
| successfully [Bug 152] |
| |
| 2006-04-27 - v0.5.3 |
| * do not build nt_password_hash and hlr_auc_gw by default to avoid |
| requiring a TLS library for a successful build; these programs can be |
| build with 'make nt_password_hash' and 'make hlr_auc_gw' |
| * added a new configuration option, eapol_version, that can be used to |
| set EAPOL version to 1 (default is 2) to work around broken client |
| implementations that drop EAPOL frames which use version number 2 |
| [Bug 89] |
| * added support for EAP-SAKE (no EAP method number allocated yet, so |
| this is using the same experimental type 255 as EAP-PSK) |
| * fixed EAP-MSCHAPv2 message length validation |
| |
| 2006-03-19 - v0.5.2 |
| * fixed stdarg use in hostapd_logger(): if both stdout and syslog |
| logging was enabled, hostapd could trigger a segmentation fault in |
| vsyslog on some CPU -- C library combinations |
| * moved HLR/AuC gateway implementation for EAP-SIM/AKA into an external |
| program to make it easier to use for implementing real SS7 gateway; |
| eap_sim_db is not anymore used as a file name for GSM authentication |
| triplets; instead, it is path to UNIX domain socket that will be used |
| to communicate with the external gateway program (e.g., hlr_auc_gw) |
| * added example HLR/AuC gateway implementation, hlr_auc_gw, that uses |
| local information (GSM authentication triplets from a text file and |
| hardcoded AKA authentication data); this can be used to test EAP-SIM |
| and EAP-AKA |
| * added Milenage algorithm (example 3GPP AKA algorithm) to hlr_auc_gw |
| to make it possible to test EAP-AKA with real USIM cards (this is |
| disabled by default; define AKA_USE_MILENAGE when building hlr_auc_gw |
| to enable this) |
| * driver_madwifi: added support for getting station RSN IE from |
| madwifi-ng svn r1453 and newer; this fixes RSN that was apparently |
| broken with earlier change (r1357) in the driver |
| * changed EAP method registration to use a dynamic list of methods |
| instead of a static list generated at build time |
| * fixed WPA message 3/4 not to encrypt Key Data field (WPA IE) |
| [Bug 125] |
| * added ap_max_inactivity configuration parameter |
| |
| 2006-01-29 - v0.5.1 |
| * driver_test: added better support for multiple APs and STAs by using |
| a directory with sockets that include MAC address for each device in |
| the name (test_socket=DIR:/tmp/test) |
| * added support for EAP expanded type (vendor specific EAP methods) |
| |
| 2005-12-18 - v0.5.0 (beginning of 0.5.x development releases) |
| * added experimental STAKey handshake implementation for IEEE 802.11e |
| direct link setup (DLS); note: this is disabled by default in both |
| build and runtime configuration (can be enabled with CONFIG_STAKEY=y |
| and stakey=1) |
| * added support for EAP methods to use callbacks to external programs |
| by buffering a pending request and processing it after the EAP method |
| is ready to continue |
| * improved EAP-SIM database interface to allow external request to GSM |
| HLR/AuC without blocking hostapd process |
| * added support for using EAP-SIM pseudonyms and fast re-authentication |
| * added support for EAP-AKA in the integrated EAP authenticator |
| * added support for matching EAP identity prefixes (e.g., "1"*) in EAP |
| user database to allow EAP-SIM/AKA selection without extra roundtrip |
| for EAP-Nak negotiation |
| * added support for storing EAP user password as NtPasswordHash instead |
| of plaintext password when using MSCHAP or MSCHAPv2 for |
| authentication (hash:<16-octet hex value>); added nt_password_hash |
| tool for hashing password to generate NtPasswordHash |
| |
| 2005-11-20 - v0.4.7 (beginning of 0.4.x stable releases) |
| * driver_wired: fixed EAPOL sending to optionally use PAE group address |
| as the destination instead of supplicant MAC address; this is |
| disabled by default, but should be enabled with use_pae_group_addr=1 |
| in configuration file if the wired interface is used by only one |
| device at the time (common switch configuration) |
| * driver_madwifi: configure driver to use TKIP countermeasures in order |
| to get correct behavior (IEEE 802.11 association failing; previously, |
| association succeeded, but hostpad forced disassociation immediately) |
| * driver_madwifi: added support for madwifi-ng |
| |
| 2005-10-27 - v0.4.6 |
| * added support for replacing user identity from EAP with RADIUS |
| User-Name attribute from Access-Accept message, if that is included, |
| for the RADIUS accounting messages (e.g., for EAP-PEAP/TTLS to get |
| tunneled identity into accounting messages when the RADIUS server |
| does not support better way of doing this with Class attribute) |
| * driver_madwifi: fixed EAPOL packet receive for configuration where |
| ath# is part of a bridge interface |
| * added a configuration file and log analyzer script for logwatch |
| * fixed EAPOL state machine step function to process all state |
| transitions before processing new events; this resolves a race |
| condition in which EAPOL-Start message could trigger hostapd to send |
| two EAP-Response/Identity frames to the authentication server |
| |
| 2005-09-25 - v0.4.5 |
| * added client CA list to the TLS certificate request in order to make |
| it easier for the client to select which certificate to use |
| * added experimental support for EAP-PSK |
| * added support for WE-19 (hostap, madwifi) |
| |
| 2005-08-21 - v0.4.4 |
| * fixed build without CONFIG_RSN_PREAUTH |
| * fixed FreeBSD build |
| |
| 2005-06-26 - v0.4.3 |
| * fixed PMKSA caching to copy User-Name and Class attributes so that |
| RADIUS accounting gets correct information |
| * start RADIUS accounting only after successful completion of WPA |
| 4-Way Handshake if WPA-PSK is used |
| * fixed PMKSA caching for the case where STA (re)associates without |
| first disassociating |
| |
| 2005-06-12 - v0.4.2 |
| * EAP-PAX is now registered as EAP type 46 |
| * fixed EAP-PAX MAC calculation |
| * fixed EAP-PAX CK and ICK key derivation |
| * renamed eap_authenticator configuration variable to eap_server to |
| better match with RFC 3748 (EAP) terminology |
| * driver_test: added support for testing hostapd with wpa_supplicant |
| by using test driver interface without any kernel drivers or network |
| cards |
| |
| 2005-05-22 - v0.4.1 |
| * fixed RADIUS server initialization when only auth or acct server |
| is configured and the other one is left empty |
| * driver_madwifi: added support for RADIUS accounting |
| * driver_madwifi: added preliminary support for compiling against 'BSD' |
| branch of madwifi CVS tree |
| * driver_madwifi: fixed pairwise key removal to allow WPA reauth |
| without disassociation |
| * added support for reading additional certificates from PKCS#12 files |
| and adding them to the certificate chain |
| * fixed RADIUS Class attribute processing to only use Access-Accept |
| packets to update Class; previously, other RADIUS authentication |
| packets could have cleared Class attribute |
| * added support for more than one Class attribute in RADIUS packets |
| * added support for verifying certificate revocation list (CRL) when |
| using integrated EAP authenticator for EAP-TLS; new hostapd.conf |
| options 'check_crl'; CRL must be included in the ca_cert file for now |
| |
| 2005-04-25 - v0.4.0 (beginning of 0.4.x development releases) |
| * added support for including network information into |
| EAP-Request/Identity message (ASCII-0 (nul) in eap_message) |
| (e.g., to implement draft-adrange-eap-network-discovery-07.txt) |
| * fixed a bug which caused some RSN pre-authentication cases to use |
| freed memory and potentially crash hostapd |
| * fixed private key loading for cases where passphrase is not set |
| * added support for sending TLS alerts and aborting authentication |
| when receiving a TLS alert |
| * fixed WPA2 to add PMKSA cache entry when using integrated EAP |
| authenticator |
| * fixed PMKSA caching (EAP authentication was not skipped correctly |
| with the new state machine changes from IEEE 802.1X draft) |
| * added support for RADIUS over IPv6; own_ip_addr, auth_server_addr, |
| and acct_server_addr can now be IPv6 addresses (CONFIG_IPV6=y needs |
| to be added to .config to include IPv6 support); for RADIUS server, |
| radius_server_ipv6=1 needs to be set in hostapd.conf and addresses |
| in RADIUS clients file can then use IPv6 format |
| * added experimental support for EAP-PAX |
| * replaced hostapd control interface library (hostapd_ctrl.[ch]) with |
| the same implementation that wpa_supplicant is using (wpa_ctrl.[ch]) |
| |
| 2005-02-12 - v0.3.7 (beginning of 0.3.x stable releases) |
| |
| 2005-01-23 - v0.3.5 |
| * added support for configuring a forced PEAP version based on the |
| Phase 1 identity |
| * fixed PEAPv1 to use tunneled EAP-Success/Failure instead of EAP-TLV |
| to terminate authentication |
| * fixed EAP identifier duplicate processing with the new IEEE 802.1X |
| draft |
| * clear accounting data in the driver when starting a new accounting |
| session |
| * driver_madwifi: filter wireless events based on ifindex to allow more |
| than one network interface to be used |
| * fixed WPA message 2/4 processing not to cancel timeout for TimeoutEvt |
| setting if the packet does not pass MIC verification (e.g., due to |
| incorrect PSK); previously, message 1/4 was not tried again if an |
| invalid message 2/4 was received |
| * fixed reconfiguration of RADIUS client retransmission timer when |
| adding a new message to the pending list; previously, timer was not |
| updated at this point and if there was a pending message with long |
| time for the next retry, the new message needed to wait that long for |
| its first retry, too |
| |
| 2005-01-09 - v0.3.4 |
| * added support for configuring multiple allowed EAP types for Phase 2 |
| authentication (EAP-PEAP, EAP-TTLS) |
| * fixed EAPOL-Start processing to trigger WPA reauthentication |
| (previously, only EAPOL authentication was done) |
| |
| 2005-01-02 - v0.3.3 |
| * added support for EAP-PEAP in the integrated EAP authenticator |
| * added support for EAP-GTC in the integrated EAP authenticator |
| * added support for configuring list of EAP methods for Phase 1 so that |
| the integrated EAP authenticator can, e.g., use the wildcard entry |
| for EAP-TLS and EAP-PEAP |
| * added support for EAP-TTLS in the integrated EAP authenticator |
| * added support for EAP-SIM in the integrated EAP authenticator |
| * added support for using hostapd as a RADIUS authentication server |
| with the integrated EAP authenticator taking care of EAP |
| authentication (new hostapd.conf options: radius_server_clients and |
| radius_server_auth_port); this is not included in default build; use |
| CONFIG_RADIUS_SERVER=y in .config to include |
| |
| 2004-12-19 - v0.3.2 |
| * removed 'daemonize' configuration file option since it has not really |
| been used at all for more than year |
| * driver_madwifi: fixed group key setup and added get_ssid method |
| * added support for EAP-MSCHAPv2 in the integrated EAP authenticator |
| |
| 2004-12-12 - v0.3.1 |
| * added support for integrated EAP-TLS authentication (new hostapd.conf |
| variables: ca_cert, server_cert, private_key, private_key_passwd); |
| this enabled dynamic keying (WPA2/WPA/IEEE 802.1X/WEP) without |
| external RADIUS server |
| * added support for reading PKCS#12 (PFX) files (as a replacement for |
| PEM/DER) to get certificate and private key (CONFIG_PKCS12) |
| |
| 2004-12-05 - v0.3.0 (beginning of 0.3.x development releases) |
| * added support for Acct-{Input,Output}-Gigawords |
| * added support for Event-Timestamp (in RADIUS Accounting-Requests) |
| * added support for RADIUS Authentication Client MIB (RFC2618) |
| * added support for RADIUS Accounting Client MIB (RFC2620) |
| * made EAP re-authentication period configurable (eap_reauth_period) |
| * fixed EAPOL reauthentication to trigger WPA/WPA2 reauthentication |
| * fixed EAPOL state machine to stop if STA is removed during |
| eapol_sm_step(); this fixes at least one segfault triggering bug with |
| IEEE 802.11i pre-authentication |
| * added support for multiple WPA pre-shared keys (e.g., one for each |
| client MAC address or keys shared by a group of clients); |
| new hostapd.conf field wpa_psk_file for setting path to a text file |
| containing PSKs, see hostapd.wpa_psk for an example |
| * added support for multiple driver interfaces to allow hostapd to be |
| used with other drivers |
| * added wired authenticator driver interface (driver=wired in |
| hostapd.conf, see wired.conf for example configuration) |
| * added madwifi driver interface (driver=madwifi in hostapd.conf, see |
| madwifi.conf for example configuration; Note: include files from |
| madwifi project is needed for building and a configuration file, |
| .config, needs to be created in hostapd directory with |
| CONFIG_DRIVER_MADWIFI=y to include this driver interface in hostapd |
| build) |
| * fixed an alignment issue that could cause SHA-1 to fail on some |
| platforms (e.g., Intel ixp425 with a compiler that does not 32-bit |
| align variables) |
| * fixed RADIUS reconnection after an error in sending interim |
| accounting packets |
| * added hostapd control interface for external programs and an example |
| CLI, hostapd_cli (like wpa_cli for wpa_supplicant) |
| * started adding dot11, dot1x, radius MIBs ('hostapd_cli mib', |
| 'hostapd_cli sta <addr>') |
| * finished update from IEEE 802.1X-2001 to IEEE 802.1X-REV (now d11) |
| * added support for strict GTK rekeying (wpa_strict_rekey in |
| hostapd.conf) |
| * updated IAPP to use UDP port 3517 and multicast address 224.0.1.178 |
| (instead of broadcast) for IAPP ADD-notify (moved from draft 3 to |
| IEEE 802.11F-2003) |
| * added Prism54 driver interface (driver=prism54 in hostapd.conf; |
| note: .config needs to be created in hostapd directory with |
| CONFIG_DRIVER_PRISM54=y to include this driver interface in hostapd |
| build) |
| * dual-licensed hostapd (GPLv2 and BSD licenses) |
| * fixed RADIUS accounting to generate a new session id for cases where |
| a station reassociates without first being complete deauthenticated |
| * fixed STA disassociation handler to mark next timeout state to |
| deauthenticate the station, i.e., skip long wait for inactivity poll |
| and extra disassociation, if the STA disassociates without |
| deauthenticating |
| * added integrated EAP authenticator that can be used instead of |
| external RADIUS authentication server; currently, only EAP-MD5 is |
| supported, so this cannot yet be used for key distribution; the EAP |
| method interface is generic, though, so adding new EAP methods should |
| be straightforward; new hostapd.conf variables: 'eap_authenticator' |
| and 'eap_user_file'; this obsoletes "minimal authentication server" |
| ('minimal_eap' in hostapd.conf) which is now removed |
| * added support for FreeBSD and driver interface for the BSD net80211 |
| layer (driver=bsd in hostapd.conf and CONFIG_DRIVER_BSD=y in |
| .config); please note that some of the required kernel mods have not |
| yet been committed |
| |
| 2004-07-17 - v0.2.4 (beginning of 0.2.x stable releases) |
| * fixed some accounting cases where Accounting-Start was sent when |
| IEEE 802.1X port was being deauthorized |
| |
| 2004-06-20 - v0.2.3 |
| * modified RADIUS client to re-connect the socket in case of certain |
| error codes that are generated when a network interface state is |
| changes (e.g., when IP address changes or the interface is set UP) |
| * fixed couple of cases where EAPOL state for a station was freed |
| twice causing a segfault for hostapd |
| * fixed couple of bugs in processing WPA deauthentication (freed data |
| was used) |
| |
| 2004-05-31 - v0.2.2 |
| * fixed WPA/WPA2 group rekeying to use key index correctly (GN/GM) |
| * fixed group rekeying to send zero TSC in EAPOL-Key messages to fix |
| cases where STAs dropped multicast frames as replay attacks |
| * added support for copying RADIUS Attribute 'Class' from |
| authentication messages into accounting messages |
| * send canned EAP failure if RADIUS server sends Access-Reject without |
| EAP message (previously, Supplicant was not notified in this case) |
| * fixed mixed WPA-PSK and WPA-EAP mode to work with WPA-PSK (i.e., do |
| not start EAPOL state machines if the STA selected to use WPA-PSK) |
| |
| 2004-05-06 - v0.2.1 |
| * added WPA and IEEE 802.11i/RSN (WPA2) Authenticator functionality |
| - based on IEEE 802.11i/D10.0 but modified to interoperate with WPA |
| (i.e., IEEE 802.11i/D3.0) |
| - supports WPA-only, RSN-only, and mixed WPA/RSN mode |
| - both WPA-PSK and WPA-RADIUS/EAP are supported |
| - PMKSA caching and pre-authentication |
| - new hostapd.conf variables: wpa, wpa_psk, wpa_passphrase, |
| wpa_key_mgmt, wpa_pairwise, wpa_group_rekey, wpa_gmk_rekey, |
| rsn_preauth, rsn_preauth_interfaces |
| * fixed interim accounting to remove any pending accounting messages |
| to the STA before sending a new one |
| |
| 2004-02-15 - v0.2.0 |
| * added support for Acct-Interim-Interval: |
| - draft-ietf-radius-acct-interim-01.txt |
| - use Acct-Interim-Interval attribute from Access-Accept if local |
| 'radius_acct_interim_interval' is not set |
| - allow different update intervals for each STA |
| * fixed event loop to call signal handlers only after returning from |
| the real signal handler |
| * reset sta->timeout_next after successful association to make sure |
| that the previously registered inactivity timer will not remove the |
| STA immediately (e.g., if STA deauthenticates and re-associates |
| before the timer is triggered). |
| * added new hostapd.conf variable, nas_identifier, that can be used to |
| add an optional RADIUS Attribute, NAS-Identifier, into authentication |
| and accounting messages |
| * added support for Accounting-On and Accounting-Off messages |
| * fixed accounting session handling to send Accounting-Start only once |
| per session and not to send Accounting-Stop if the session was not |
| initialized properly |
| * fixed Accounting-Stop statistics in cases where the message was |
| previously sent after the kernel entry for the STA (and/or IEEE |
| 802.1X data) was removed |
| |
| |
| Note: |
| |
| Older changes up to and including v0.1.0 are included in the ChangeLog |
| of the Host AP driver. |
