commit: ff0acc3cbecf9fb572c511744d6b5d3288cb8938 Author: orbea <orbea <AT> riseup <DOT> net> AuthorDate: Thu Jul 7 00:33:42 2022 +0000 Commit: Quentin Retornaz <gentoo <AT> retornaz <DOT> com> CommitDate: Sun Jul 10 22:49:42 2022 +0000 URL: https://gitweb.gentoo.org/repo/proj/libressl.git/commit/?id=ff0acc3c
net-wireless/hostapd: Add 2.9-r6 + 2.10 Signed-off-by: orbea <orbea <AT> riseup.net> Signed-off-by: Quentin Retornaz <gentoo <AT> retornaz.com> net-wireless/hostapd/Manifest | 1 + .../hostapd/files/hostapd-2.10-libressl.patch | 23 ++ ...date-DigestAlgorithmIdentifier-parameters.patch | 115 +++++++++ net-wireless/hostapd/hostapd-2.10.ebuild | 266 ++++++++++++++++++++ net-wireless/hostapd/hostapd-2.9-r6.ebuild | 279 +++++++++++++++++++++ net-wireless/hostapd/metadata.xml | 7 +- 6 files changed, 687 insertions(+), 4 deletions(-) diff --git a/net-wireless/hostapd/Manifest b/net-wireless/hostapd/Manifest index fa52c27..f51e64a 100644 --- a/net-wireless/hostapd/Manifest +++ b/net-wireless/hostapd/Manifest @@ -1,3 +1,4 @@ +DIST hostapd-2.10.tar.gz 2440435 BLAKE2B dbeeae2f62a8ab52df3e2d05ff0467b643cd68349ef3b28814a11dfb67d4b23d14cf2461a3040694706ec614fcd7c2e0fe58f3597e877cf47296cd75e11c792f SHA512 243baa82d621f859d2507d8d5beb0ebda15a75548a62451dc9bca42717dcc8607adac49b354919a41d8257d16d07ac7268203a79750db0cfb34b51f80ff1ce8f DIST hostapd-2.6.tar.gz 1822341 SHA256 01526b90c1d23bec4b0f052039cc4456c2fd19347b4d830d1d58a0a6aea7117d SHA512 e60baaa092786250b8de9935f5417c7626f5d749210cce9f83d776b65c19fc92a8141f41923389f05c16295d482a15ae8d8b744f4667425040c99e3c2f5b1bda WHIRLPOOL fa093c371a66f3aa834d44060330259dc20e3a1937ffacc4450c5c645291c2bd4b31bbe1827f7d27bfca724c5e26f53ea59f2e3aa69a4c87177212bb491b119a DIST hostapd-2.9.tar.gz 2244312 BLAKE2B 07308376dd1576313513fba815b220e4ab2f30ed1a402e24b5c8e62ded79c6d718ff47aad1a2222c9e46ffb7334580b556f19a8aef013eab34a8d61d708d2f01 SHA512 66c729380152db18b64520bda55dfa00af3b0264f97b5de100b81a46e2593571626c4bdcf900f0988ea2131e30bc8788f75d8489dd1f57e37fd56e8098e48a9c DIST net-wireless_hostapd_2.7-r2_extras.tar.xz 1820 BLAKE2B 5c4daf0e4fcf5ae0803cdbe2aabcc75e89b1e92048e8a01894d73639a16b049174b37eca6b6206c337a2874a6e6d5588d50fa5b8a4813e7f6c22bf02efca852f SHA512 65bc4634c8314280ceab44d1f5d6d62092f4bca48253f107b076211020f6f6502388490aee907f9910846a25ba2da7e4122bdb1873eb2b12bf94e867e3295f4c diff --git a/net-wireless/hostapd/files/hostapd-2.10-libressl.patch b/net-wireless/hostapd/files/hostapd-2.10-libressl.patch new file mode 100644 index 0000000..268cc27 --- /dev/null +++ b/net-wireless/hostapd/files/hostapd-2.10-libressl.patch @@ -0,0 +1,23 @@ +From 87deed487d8f27feb7c6f8180535e67d9e1847ca Mon Sep 17 00:00:00 2001 +From: orbea <[email protected]> +Date: Wed, 6 Jul 2022 17:24:11 -0700 +Subject: [PATCH] Fix build with libressl-3.5.x + +Fails with a undefined reference to SSL_set_cert_cb. +--- + src/crypto/tls_openssl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c +index c9e00b3..5f44a73 100644 +--- a/src/crypto/tls_openssl.c ++++ b/src/crypto/tls_openssl.c +@@ -3048,7 +3048,7 @@ static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags, + /* Start with defaults from BoringSSL */ + SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, NULL, 0); + #endif /* OPENSSL_IS_BORINGSSL */ +-#if OPENSSL_VERSION_NUMBER >= 0x10002000L ++#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER) + if (flags & TLS_CONN_SUITEB_NO_ECDH) { + const char *ciphers = "DHE-RSA-AES256-GCM-SHA384"; + diff --git a/net-wireless/hostapd/files/hostapd-2.9-ASN-1-Validate-DigestAlgorithmIdentifier-parameters.patch b/net-wireless/hostapd/files/hostapd-2.9-ASN-1-Validate-DigestAlgorithmIdentifier-parameters.patch new file mode 100644 index 0000000..8c8ba93 --- /dev/null +++ b/net-wireless/hostapd/files/hostapd-2.9-ASN-1-Validate-DigestAlgorithmIdentifier-parameters.patch @@ -0,0 +1,115 @@ +From a0541334a6394f8237a4393b7372693cd7e96f15 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <[email protected]> +Date: Sat, 13 Mar 2021 18:19:31 +0200 +Subject: ASN.1: Validate DigestAlgorithmIdentifier parameters + +The supported hash algorithms do not use AlgorithmIdentifier parameters. +However, there are implementations that include NULL parameters in +addition to ones that omit the parameters. Previous implementation did +not check the parameters value at all which supported both these cases, +but did not reject any other unexpected information. + +Use strict validation of digest algorithm parameters and reject any +unexpected value when validating a signature. This is needed to prevent +potential forging attacks. + +Signed-off-by: Jouni Malinen <[email protected]> +--- + src/tls/pkcs1.c | 21 +++++++++++++++++++++ + src/tls/x509v3.c | 20 ++++++++++++++++++++ + 2 files changed, 41 insertions(+) + +diff --git a/src/tls/pkcs1.c b/src/tls/pkcs1.c +index bbdb0d7..5761dfe 100644 +--- a/src/tls/pkcs1.c ++++ b/src/tls/pkcs1.c +@@ -244,6 +244,8 @@ int pkcs1_v15_sig_ver(struct crypto_public_key *pk, + os_free(decrypted); + return -1; + } ++ wpa_hexdump(MSG_MSGDUMP, "PKCS #1: DigestInfo", ++ hdr.payload, hdr.length); + + pos = hdr.payload; + end = pos + hdr.length; +@@ -265,6 +267,8 @@ int pkcs1_v15_sig_ver(struct crypto_public_key *pk, + os_free(decrypted); + return -1; + } ++ wpa_hexdump(MSG_MSGDUMP, "PKCS #1: DigestAlgorithmIdentifier", ++ hdr.payload, hdr.length); + da_end = hdr.payload + hdr.length; + + if (asn1_get_oid(hdr.payload, hdr.length, &oid, &next)) { +@@ -273,6 +277,23 @@ int pkcs1_v15_sig_ver(struct crypto_public_key *pk, + os_free(decrypted); + return -1; + } ++ wpa_hexdump(MSG_MSGDUMP, "PKCS #1: Digest algorithm parameters", ++ next, da_end - next); ++ ++ /* ++ * RFC 5754: The correct encoding for the SHA2 algorithms would be to ++ * omit the parameters, but there are implementation that encode these ++ * as a NULL element. Allow these two cases and reject anything else. ++ */ ++ if (da_end > next && ++ (asn1_get_next(next, da_end - next, &hdr) < 0 || ++ !asn1_is_null(&hdr) || ++ hdr.payload + hdr.length != da_end)) { ++ wpa_printf(MSG_DEBUG, ++ "PKCS #1: Unexpected digest algorithm parameters"); ++ os_free(decrypted); ++ return -1; ++ } + + if (!asn1_oid_equal(&oid, hash_alg)) { + char txt[100], txt2[100]; +diff --git a/src/tls/x509v3.c b/src/tls/x509v3.c +index a8944dd..df337ec 100644 +--- a/src/tls/x509v3.c ++++ b/src/tls/x509v3.c +@@ -1964,6 +1964,7 @@ int x509_check_signature(struct x509_certificate *issuer, + os_free(data); + return -1; + } ++ wpa_hexdump(MSG_MSGDUMP, "X509: DigestInfo", hdr.payload, hdr.length); + + pos = hdr.payload; + end = pos + hdr.length; +@@ -1985,6 +1986,8 @@ int x509_check_signature(struct x509_certificate *issuer, + os_free(data); + return -1; + } ++ wpa_hexdump(MSG_MSGDUMP, "X509: DigestAlgorithmIdentifier", ++ hdr.payload, hdr.length); + da_end = hdr.payload + hdr.length; + + if (asn1_get_oid(hdr.payload, hdr.length, &oid, &next)) { +@@ -1992,6 +1995,23 @@ int x509_check_signature(struct x509_certificate *issuer, + os_free(data); + return -1; + } ++ wpa_hexdump(MSG_MSGDUMP, "X509: Digest algorithm parameters", ++ next, da_end - next); ++ ++ /* ++ * RFC 5754: The correct encoding for the SHA2 algorithms would be to ++ * omit the parameters, but there are implementation that encode these ++ * as a NULL element. Allow these two cases and reject anything else. ++ */ ++ if (da_end > next && ++ (asn1_get_next(next, da_end - next, &hdr) < 0 || ++ !asn1_is_null(&hdr) || ++ hdr.payload + hdr.length != da_end)) { ++ wpa_printf(MSG_DEBUG, ++ "X509: Unexpected digest algorithm parameters"); ++ os_free(data); ++ return -1; ++ } + + if (x509_sha1_oid(&oid)) { + if (signature->oid.oid[6] != 5 /* sha-1WithRSAEncryption */) { +-- +cgit v0.12 + diff --git a/net-wireless/hostapd/hostapd-2.10.ebuild b/net-wireless/hostapd/hostapd-2.10.ebuild new file mode 100644 index 0000000..86fc6e9 --- /dev/null +++ b/net-wireless/hostapd/hostapd-2.10.ebuild @@ -0,0 +1,266 @@ +# Copyright 1999-2022 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +inherit flag-o-matic systemd savedconfig toolchain-funcs + +EXTRAS_VER="2.7-r2" +EXTRAS_NAME="${CATEGORY}_${PN}_${EXTRAS_VER}_extras" +DESCRIPTION="IEEE 802.11 wireless LAN Host AP daemon" +HOMEPAGE="https://w1.fi/ https://w1.fi/cgit/hostap/"; +SRC_URI="https://dev.gentoo.org/~andrey_utkin/distfiles/${EXTRAS_NAME}.tar.xz"; +S="${S}/${PN}" + +if [[ ${PV} == 9999 ]]; then + inherit git-r3 + EGIT_REPO_URI="https://w1.fi/hostap.git"; +else + if [[ ${PV} =~ ^.*_p[0-9]{8}$ ]]; then + SRC_URI+=" https://dev.gentoo.org/~andrey_utkin/distfiles/${P}.tar.xz"; + else + SRC_URI+=" https://w1.fi/releases/${P}.tar.gz"; + fi + + # Never stabilize snapshot ebuilds please + KEYWORDS="amd64 arm arm64 ~mips ppc x86" +fi + +LICENSE="BSD" +SLOT="0" +IUSE="internal-tls ipv6 netlink sqlite +suiteb +wps +crda" + +DEPEND=" + internal-tls? ( dev-libs/libtommath ) + !internal-tls? ( dev-libs/openssl:0=[-bindist(-)] ) + kernel_linux? ( + >=dev-libs/libnl-3.2:3 + crda? ( net-wireless/crda ) + ) + netlink? ( net-libs/libnfnetlink ) + sqlite? ( >=dev-db/sqlite-3 )" +RDEPEND="${DEPEND}" +BDEPEND="virtual/pkgconfig" + +PATCHES=( + "${FILESDIR}"/${P}-libressl.patch +) + +pkg_pretend() { + if use internal-tls; then + ewarn "internal-tls implementation is experimental and provides fewer features" + fi +} + +src_unpack() { + # Override default one because we need the SRC_URI ones even in case of 9999 ebuilds + default + + if [[ ${PV} == 9999 ]] ; then + git-r3_src_unpack + fi +} + +src_prepare() { + # Allow users to apply patches to src/drivers for example, + # i.e. anything outside ${S}/${PN} + pushd ../ >/dev/null || die + default + popd >/dev/null || die + + sed -i -e "s:/etc/hostapd:/etc/hostapd/hostapd:g" \ + "${S}/hostapd.conf" || die +} + +src_configure() { + local CONFIG="${S}"/.config + + restore_config "${CONFIG}" + if [[ -f "${CONFIG}" ]]; then + default + return 0 + fi + + # toolchain setup + echo "CC = $(tc-getCC)" > ${CONFIG} || die + + # EAP authentication methods + echo "CONFIG_EAP=y" >> ${CONFIG} || die + echo "CONFIG_ERP=y" >> ${CONFIG} || die + echo "CONFIG_EAP_MD5=y" >> ${CONFIG} || die + + if use suiteb; then + echo "CONFIG_SUITEB=y" >> ${CONFIG} || die + echo "CONFIG_SUITEB192=y" >> ${CONFIG} || die + fi + + if use internal-tls ; then + echo "CONFIG_TLS=internal" >> ${CONFIG} || die + else + # SSL authentication methods + echo "CONFIG_DPP=y" >> ${CONFIG} || die + echo "CONFIG_EAP_FAST=y" >> ${CONFIG} || die + echo "CONFIG_EAP_MSCHAPV2=y" >> ${CONFIG} || die + echo "CONFIG_EAP_PEAP=y" >> ${CONFIG} || die + echo "CONFIG_EAP_PWD=y" >> ${CONFIG} || die + echo "CONFIG_EAP_TLS=y" >> ${CONFIG} || die + echo "CONFIG_EAP_TTLS=y" >> ${CONFIG} || die + echo "CONFIG_OWE=y" >> ${CONFIG} || die + echo "CONFIG_SAE=y" >> ${CONFIG} || die + echo "CONFIG_TLSV11=y" >> ${CONFIG} || die + echo "CONFIG_TLSV12=y" >> ${CONFIG} || die + fi + + if use wps; then + # Enable Wi-Fi Protected Setup + echo "CONFIG_WPS=y" >> ${CONFIG} || die + echo "CONFIG_WPS2=y" >> ${CONFIG} || die + echo "CONFIG_WPS_UPNP=y" >> ${CONFIG} || die + echo "CONFIG_WPS_NFC=y" >> ${CONFIG} || die + einfo "Enabling Wi-Fi Protected Setup support" + fi + + echo "CONFIG_EAP_IKEV2=y" >> ${CONFIG} || die + echo "CONFIG_EAP_TNC=y" >> ${CONFIG} || die + echo "CONFIG_EAP_GTC=y" >> ${CONFIG} || die + echo "CONFIG_EAP_SIM=y" >> ${CONFIG} || die + echo "CONFIG_EAP_AKA=y" >> ${CONFIG} || die + echo "CONFIG_EAP_AKA_PRIME=y" >> ${CONFIG} || die + echo "CONFIG_EAP_EKE=y" >> ${CONFIG} || die + echo "CONFIG_EAP_PAX=y" >> ${CONFIG} || die + echo "CONFIG_EAP_PSK=y" >> ${CONFIG} || die + echo "CONFIG_EAP_SAKE=y" >> ${CONFIG} || die + echo "CONFIG_EAP_GPSK=y" >> ${CONFIG} || die + echo "CONFIG_EAP_GPSK_SHA256=y" >> ${CONFIG} || die + + einfo "Enabling drivers: " + + # drivers + echo "CONFIG_DRIVER_HOSTAP=y" >> ${CONFIG} || die + einfo " HostAP driver enabled" + echo "CONFIG_DRIVER_WIRED=y" >> ${CONFIG} || die + einfo " Wired driver enabled" + echo "CONFIG_DRIVER_NONE=y" >> ${CONFIG} || die + einfo " None driver enabled" + + einfo " nl80211 driver enabled" + echo "CONFIG_DRIVER_NL80211=y" >> ${CONFIG} || die + + # epoll + echo "CONFIG_ELOOP_EPOLL=y" >> ${CONFIG} || die + + # misc + echo "CONFIG_DEBUG_FILE=y" >> ${CONFIG} || die + echo "CONFIG_PKCS12=y" >> ${CONFIG} || die + echo "CONFIG_RADIUS_SERVER=y" >> ${CONFIG} || die + echo "CONFIG_IAPP=y" >> ${CONFIG} || die + echo "CONFIG_IEEE80211R=y" >> ${CONFIG} || die + echo "CONFIG_IEEE80211W=y" >> ${CONFIG} || die + echo "CONFIG_IEEE80211N=y" >> ${CONFIG} || die + echo "CONFIG_IEEE80211AC=y" >> ${CONFIG} || die + echo "CONFIG_OCV=y" >> ${CONFIG} || die + echo "CONFIG_PEERKEY=y" >> ${CONFIG} || die + echo "CONFIG_RSN_PREAUTH=y" >> ${CONFIG} || die + echo "CONFIG_INTERWORKING=y" >> ${CONFIG} || die + echo "CONFIG_FULL_DYNAMIC_VLAN=y" >> ${CONFIG} || die + echo "CONFIG_HS20=y" >> ${CONFIG} || die + echo "CONFIG_WNM=y" >> ${CONFIG} || die + echo "CONFIG_FST=y" >> ${CONFIG} || die + echo "CONFIG_FST_TEST=y" >> ${CONFIG} || die + echo "CONFIG_ACS=y" >> ${CONFIG} || die + + if use netlink; then + # Netlink support + echo "CONFIG_VLAN_NETLINK=y" >> ${CONFIG} || die + fi + + if use ipv6; then + # IPv6 support + echo "CONFIG_IPV6=y" >> ${CONFIG} || die + fi + + if use sqlite; then + # Sqlite support + echo "CONFIG_SQLITE=y" >> ${CONFIG} || die + fi + + if use kernel_linux; then + echo "CONFIG_LIBNL32=y" >> ${CONFIG} || die + append-cflags $($(tc-getPKG_CONFIG) --cflags libnl-3.0) + fi + + # TODO: Add support for BSD drivers + + default +} + +src_compile() { + emake V=1 + + if ! use internal-tls; then + emake V=1 nt_password_hash + emake V=1 hlr_auc_gw + fi +} + +src_install() { + insinto /etc/${PN} + doins ${PN}.{conf,accept,deny,eap_user,radius_clients,sim_db,wpa_psk} + + fperms -R 600 /etc/${PN} + + dosbin ${PN} + dobin ${PN}_cli + + if ! use internal-tls; then + dobin nt_password_hash hlr_auc_gw + fi + + newinitd "${WORKDIR}/${EXTRAS_NAME}"/${PN}-init.d ${PN} + newconfd "${WORKDIR}/${EXTRAS_NAME}"/${PN}-conf.d ${PN} + systemd_dounit "${WORKDIR}/${EXTRAS_NAME}"/${PN}.service + + doman ${PN}{.8,_cli.1} + + dodoc ChangeLog README + use wps && dodoc README-WPS + + docinto examples + dodoc wired.conf + + insinto /etc/log.d/conf/services/ + doins logwatch/${PN}.conf + + exeinto /etc/log.d/scripts/services/ + doexe logwatch/${PN} + + save_config .config +} + +pkg_postinst() { + einfo + einfo "If you are running OpenRC you need to follow this instructions:" + einfo "In order to use ${PN} you need to set up your wireless card" + einfo "for master mode in /etc/conf.d/net and then start" + einfo "/etc/init.d/${PN}." + einfo + einfo "Example configuration:" + einfo + einfo "config_wlan0=( \"192.168.1.1/24\" )" + einfo "channel_wlan0=\"6\"" + einfo "essid_wlan0=\"test\"" + einfo "mode_wlan0=\"master\"" + einfo + + #if [[ -e "${KV_DIR}"/net/mac80211 ]]; then + # einfo "This package now compiles against the headers installed by" + # einfo "the kernel source for the mac80211 driver. You should " + # einfo "re-emerge ${PN} after upgrading your kernel source." + #fi + + if use wps; then + einfo "You have enabled Wi-Fi Protected Setup support, please" + einfo "read the README-WPS file in /usr/share/doc/${PF}" + einfo "for info on how to use WPS" + fi +} diff --git a/net-wireless/hostapd/hostapd-2.9-r6.ebuild b/net-wireless/hostapd/hostapd-2.9-r6.ebuild new file mode 100644 index 0000000..242c573 --- /dev/null +++ b/net-wireless/hostapd/hostapd-2.9-r6.ebuild @@ -0,0 +1,279 @@ +# Copyright 1999-2021 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +inherit flag-o-matic systemd savedconfig toolchain-funcs + +DESCRIPTION="IEEE 802.11 wireless LAN Host AP daemon" +HOMEPAGE="https://w1.fi/ https://w1.fi/cgit/hostap/"; +EXTRAS_VER="2.7-r2" +EXTRAS_NAME="${CATEGORY}_${PN}_${EXTRAS_VER}_extras" +SRC_URI="https://dev.gentoo.org/~andrey_utkin/distfiles/${EXTRAS_NAME}.tar.xz"; +S="${S}/${PN}" + +if [[ ${PV} == 9999 ]]; then + inherit git-r3 + EGIT_REPO_URI="https://w1.fi/hostap.git"; +else + if [[ ${PV} =~ ^.*_p[0-9]{8}$ ]]; then + SRC_URI+=" https://dev.gentoo.org/~andrey_utkin/distfiles/${P}.tar.xz"; + else + SRC_URI+=" https://w1.fi/releases/${P}.tar.gz"; + fi + + # Never stabilize snapshot ebuilds please + KEYWORDS="amd64 arm arm64 ~mips ppc x86" +fi + +LICENSE="BSD" +SLOT="0" +IUSE="internal-tls ipv6 netlink sqlite +suiteb +wps +crda" + +DEPEND=" + internal-tls? ( dev-libs/libtommath ) + !internal-tls? ( dev-libs/openssl:0=[-bindist(-)] ) + kernel_linux? ( + dev-libs/libnl:3 + crda? ( net-wireless/crda ) + ) + netlink? ( net-libs/libnfnetlink ) + sqlite? ( >=dev-db/sqlite-3 )" +RDEPEND="${DEPEND}" +BDEPEND="virtual/pkgconfig" + +PATCHES=( + "${FILESDIR}"/${PN}-2.10-libressl.patch +) + +pkg_pretend() { + if use internal-tls; then + ewarn "internal-tls implementation is experimental and provides fewer features" + fi +} + +src_unpack() { + # Override default one because we need the SRC_URI ones even in case of 9999 ebuilds + default + + if [[ ${PV} == 9999 ]] ; then + git-r3_src_unpack + fi +} + +src_prepare() { + # Allow users to apply patches to src/drivers for example, + # i.e. anything outside ${S}/${PN} + pushd ../ >/dev/null || die + default + + # CVE-2019-16275 (bug #696032) + eapply "${FILESDIR}"/${P}-AP-Silently-ignore-management-frame-from-unexpected.patch + # CVE-2020-12695 (bug #727542) + eapply "${FILESDIR}"/${P}-0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch + eapply "${FILESDIR}"/${P}-0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch + eapply "${FILESDIR}"/${P}-0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch + # CVE-2021-30004 (bug #780135) + eapply "${FILESDIR}"/${P}-ASN-1-Validate-DigestAlgorithmIdentifier-parameters.patch + + popd >/dev/null || die + + sed -i -e "s:/etc/hostapd:/etc/hostapd/hostapd:g" \ + "${S}/hostapd.conf" || die +} + +src_configure() { + local CONFIG="${S}"/.config + + restore_config "${CONFIG}" + if [[ -f "${CONFIG}" ]]; then + default + return 0 + fi + + # toolchain setup + echo "CC = $(tc-getCC)" > ${CONFIG} || die + + # EAP authentication methods + echo "CONFIG_EAP=y" >> ${CONFIG} || die + echo "CONFIG_ERP=y" >> ${CONFIG} || die + echo "CONFIG_EAP_MD5=y" >> ${CONFIG} || die + + if use suiteb; then + echo "CONFIG_SUITEB=y" >> ${CONFIG} || die + echo "CONFIG_SUITEB192=y" >> ${CONFIG} || die + fi + + if use internal-tls ; then + echo "CONFIG_TLS=internal" >> ${CONFIG} || die + else + # SSL authentication methods + echo "CONFIG_DPP=y" >> ${CONFIG} || die + echo "CONFIG_EAP_FAST=y" >> ${CONFIG} || die + echo "CONFIG_EAP_MSCHAPV2=y" >> ${CONFIG} || die + echo "CONFIG_EAP_PEAP=y" >> ${CONFIG} || die + echo "CONFIG_EAP_PWD=y" >> ${CONFIG} || die + echo "CONFIG_EAP_TLS=y" >> ${CONFIG} || die + echo "CONFIG_EAP_TTLS=y" >> ${CONFIG} || die + echo "CONFIG_OWE=y" >> ${CONFIG} || die + echo "CONFIG_SAE=y" >> ${CONFIG} || die + echo "CONFIG_TLSV11=y" >> ${CONFIG} || die + echo "CONFIG_TLSV12=y" >> ${CONFIG} || die + fi + + if use wps; then + # Enable Wi-Fi Protected Setup + echo "CONFIG_WPS=y" >> ${CONFIG} || die + echo "CONFIG_WPS2=y" >> ${CONFIG} || die + echo "CONFIG_WPS_UPNP=y" >> ${CONFIG} || die + echo "CONFIG_WPS_NFC=y" >> ${CONFIG} || die + einfo "Enabling Wi-Fi Protected Setup support" + fi + + echo "CONFIG_EAP_IKEV2=y" >> ${CONFIG} || die + echo "CONFIG_EAP_TNC=y" >> ${CONFIG} || die + echo "CONFIG_EAP_GTC=y" >> ${CONFIG} || die + echo "CONFIG_EAP_SIM=y" >> ${CONFIG} || die + echo "CONFIG_EAP_AKA=y" >> ${CONFIG} || die + echo "CONFIG_EAP_AKA_PRIME=y" >> ${CONFIG} || die + echo "CONFIG_EAP_EKE=y" >> ${CONFIG} || die + echo "CONFIG_EAP_PAX=y" >> ${CONFIG} || die + echo "CONFIG_EAP_PSK=y" >> ${CONFIG} || die + echo "CONFIG_EAP_SAKE=y" >> ${CONFIG} || die + echo "CONFIG_EAP_GPSK=y" >> ${CONFIG} || die + echo "CONFIG_EAP_GPSK_SHA256=y" >> ${CONFIG} || die + + einfo "Enabling drivers: " + + # drivers + echo "CONFIG_DRIVER_HOSTAP=y" >> ${CONFIG} || die + einfo " HostAP driver enabled" + echo "CONFIG_DRIVER_WIRED=y" >> ${CONFIG} || die + einfo " Wired driver enabled" + echo "CONFIG_DRIVER_NONE=y" >> ${CONFIG} || die + einfo " None driver enabled" + + einfo " nl80211 driver enabled" + echo "CONFIG_DRIVER_NL80211=y" >> ${CONFIG} || die + + # epoll + echo "CONFIG_ELOOP_EPOLL=y" >> ${CONFIG} || die + + # misc + echo "CONFIG_DEBUG_FILE=y" >> ${CONFIG} || die + echo "CONFIG_PKCS12=y" >> ${CONFIG} || die + echo "CONFIG_RADIUS_SERVER=y" >> ${CONFIG} || die + echo "CONFIG_IAPP=y" >> ${CONFIG} || die + echo "CONFIG_IEEE80211R=y" >> ${CONFIG} || die + echo "CONFIG_IEEE80211W=y" >> ${CONFIG} || die + echo "CONFIG_IEEE80211N=y" >> ${CONFIG} || die + echo "CONFIG_IEEE80211AC=y" >> ${CONFIG} || die + echo "CONFIG_OCV=y" >> ${CONFIG} || die + echo "CONFIG_PEERKEY=y" >> ${CONFIG} || die + echo "CONFIG_RSN_PREAUTH=y" >> ${CONFIG} || die + echo "CONFIG_INTERWORKING=y" >> ${CONFIG} || die + echo "CONFIG_FULL_DYNAMIC_VLAN=y" >> ${CONFIG} || die + echo "CONFIG_HS20=y" >> ${CONFIG} || die + echo "CONFIG_WNM=y" >> ${CONFIG} || die + echo "CONFIG_FST=y" >> ${CONFIG} || die + echo "CONFIG_FST_TEST=y" >> ${CONFIG} || die + echo "CONFIG_ACS=y" >> ${CONFIG} || die + + if use netlink; then + # Netlink support + echo "CONFIG_VLAN_NETLINK=y" >> ${CONFIG} || die + fi + + if use ipv6; then + # IPv6 support + echo "CONFIG_IPV6=y" >> ${CONFIG} || die + fi + + if use sqlite; then + # Sqlite support + echo "CONFIG_SQLITE=y" >> ${CONFIG} || die + fi + + # If we are using libnl 2.0 and above, enable support for it + # Removed for now, since the 3.2 version is broken, and we don't + # support it. + if has_version ">=dev-libs/libnl-3.2"; then + echo "CONFIG_LIBNL32=y" >> ${CONFIG} || die + append-cflags $($(tc-getPKG_CONFIG) --cflags libnl-3.0) + fi + + # TODO: Add support for BSD drivers + + default +} + +src_compile() { + emake V=1 + + if ! use internal-tls; then + emake V=1 nt_password_hash + emake V=1 hlr_auc_gw + fi +} + +src_install() { + insinto /etc/${PN} + doins ${PN}.{conf,accept,deny,eap_user,radius_clients,sim_db,wpa_psk} + + fperms -R 600 /etc/${PN} + + dosbin ${PN} + dobin ${PN}_cli + + if ! use internal-tls; then + dobin nt_password_hash hlr_auc_gw + fi + + newinitd "${WORKDIR}/${EXTRAS_NAME}"/${PN}-init.d ${PN} + newconfd "${WORKDIR}/${EXTRAS_NAME}"/${PN}-conf.d ${PN} + systemd_dounit "${WORKDIR}/${EXTRAS_NAME}"/${PN}.service + + doman ${PN}{.8,_cli.1} + + dodoc ChangeLog README + use wps && dodoc README-WPS + + docinto examples + dodoc wired.conf + + insinto /etc/log.d/conf/services/ + doins logwatch/${PN}.conf + + exeinto /etc/log.d/scripts/services/ + doexe logwatch/${PN} + + save_config .config +} + +pkg_postinst() { + einfo + einfo "If you are running OpenRC you need to follow this instructions:" + einfo "In order to use ${PN} you need to set up your wireless card" + einfo "for master mode in /etc/conf.d/net and then start" + einfo "/etc/init.d/${PN}." + einfo + einfo "Example configuration:" + einfo + einfo "config_wlan0=( \"192.168.1.1/24\" )" + einfo "channel_wlan0=\"6\"" + einfo "essid_wlan0=\"test\"" + einfo "mode_wlan0=\"master\"" + einfo + + #if [[ -e "${KV_DIR}"/net/mac80211 ]]; then + # einfo "This package now compiles against the headers installed by" + # einfo "the kernel source for the mac80211 driver. You should " + # einfo "re-emerge ${PN} after upgrading your kernel source." + #fi + + if use wps; then + einfo "You have enabled Wi-Fi Protected Setup support, please" + einfo "read the README-WPS file in /usr/share/doc/${PF}" + einfo "for info on how to use WPS" + fi +} diff --git a/net-wireless/hostapd/metadata.xml b/net-wireless/hostapd/metadata.xml index 9de6b97..c002212 100644 --- a/net-wireless/hostapd/metadata.xml +++ b/net-wireless/hostapd/metadata.xml @@ -1,5 +1,5 @@ <?xml version="1.0" encoding="UTF-8"?> -<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd";> +<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd";> <pkgmetadata> <longdescription> User space daemon for the hostap-driver. @@ -8,10 +8,9 @@ </longdescription> <use> <flag name="crda">Add CRDA support</flag> - <flag name="logwatch">Install support files for - <pkg>sys-apps/logwatch</pkg></flag> + <flag name="internal-tls">Use internal TLSv1 implementation instead of depending on OpenSSL or GnuTLS</flag> <flag name="netlink">Adding support for using netlink to create VLANs</flag> - <flag name="sqlite">Adding sqlite support</flag> + <flag name="suiteb">Adding support for NSA Suite B Cryptography</flag> <flag name="wps">Add support for Wi-Fi Protected Setup</flag> </use> <maintainer type="person">
