wpa_supplicant is a client (supplicant) with support for WPA and WPA2
(IEEE 802.11i / RSN). It is suitable for both desktop/laptop computers and
embedded systems. Supplicant is the IEEE 802.1X/WPA component that is used
in the client stations. It implements key negotiation with a WPA
Authenticator and it controls the roaming and IEEE 802.11 authentication/
association of the wlan driver.
wpa_supplicant is designed to be a "daemon" program that runs in the
background and acts as the backend component controlling the wireless
connection. wpa_supplicant supports separate frontend programs and a
text-based frontend (wpa_cli) and a GUI (wpa_gui) are included with
wpa_supplicant.
===> The following configuration options are available for wpa_supplicant-devel-2026.09.22_4:
DBUS=on: D-Bus IPC system support
DEBUG_FILE=off: Support for writing debug log to a file
DEBUG_SYSLOG=on: Send debug messages to syslog instead of stdout
DELAYED_MIC=off: Mitigate TKIP attack, random delay on MIC errors
DOCS=on: Build and/or install documentation
EAPOL_TEST=off: Development testing
HS20=on: Hotspot 2.0
HT_OVERRIDES=off: Disable HT/HT40, mask MCS rates, etc
IEEE80211AC=off: Very High Throughput, AP mode (IEEE 802.11ac)
IEEE80211N=off: High Throughput, AP mode (IEEE 802.11n)
IEEE80211R=on: Fast BSS Transition (IEEE 802.11r-2008)
IEEE80211W=on: Management Frame Protection (IEEE 802.11w)
IEEE8021X_EAPOL=on: EAP over LAN support
INTERWORKING=on: Improve ext. network interworking (IEEE 802.11u)
IPV6=on: Development testing IPv6 support
LIBWPA=on: libwpa_client Shared Library
MATCH=on: Interface match mode
MBO=on: Multi Band Operation (Enables WNM)
NO_ROAMING=off: Disable roaming
P2P=off: Peer-to-Peer support
PASN=on: Pre-Association Security Negotiation
PKCS12=on: PKCS#12 (PFS) support
PRIVSEP=off: Privilege separation
RSN_PREAUTH=on
SIM_SIMULATOR=off: SIM simulator (Milenage) for EAP-SIM
SMARTCARD=on: Private key on smartcard support
TDLS=off: Tunneled Direct Link Setup
TLSV12=off: Build with TLS v1.2 instead of TLS v1.0
USIM_SIMULATOR=off: SIM simulator (Milenage) for EAP-AKA
VHT_OVERRIDES=off: Disable VHT, mask MCS rates, etc
WEP=on: WEP support
WNM=on: Wireless Network Monitoring
WPS=on: Wi-Fi Protected Setup
WPS_ER=on: Enable WPS External Registrar
WPS_NFC=on: Near Field Communication (NFC) configuration
WPS_NOREG=off: Disable open network credentials when registrar
WPS_UPNP=on: Universal Plug and Play support
====> Driver options: you have to choose at least one of them
BSD=on: BSD net80211 interface
WIRED=on: Wired ethernet interface
NDIS=off: Windows NDIS interface
TEST=off: Development testing interface
NONE=off: The 'no driver' interface, e.g. WPS ER only
====> Extensible Authentication Protocols: you have to choose at least one of them
TLS=on: Transport Layer Security
PEAP=on: Protected Extensible Authentication Protocol
TTLS=on: Tunneled Transport Layer Security
MD5=on: MD5 hash (deprecated, no key generation)
MSCHAPV2=on: Microsoft CHAP version 2 (RFC 2759)
GTC=on: Generic Token Card
LEAP=on: Lightweight Extensible Authentication Protocol
OTP=on: One-Time Password
PSK=on: Pre-Shared key
FAST=on: Flexible Authentication via Secure Tunneling
SIM=off: Subscriber Identity Module
PWD=on: Shared password (RFC 5931)
PAX=on: Password Authenticated Exchange
AKA=off: Autentication and Key Agreement (UMTS)
AKA_PRIME=off: AKA Prime variant (RFC 5448)
SAKE=on: Shared-Secret Authentication & Key Establishment
GPSK=on: Generalized Pre-Shared Key
TNC=on: Trusted Network Connect
IKEV2=on: Internet Key Exchange version 2
EKE=on: Encrypted Key Exchange
===> Use 'make config' to modify these settings
security/wpa_supplicant*: Fix EAPOL_TEST build for non-standard SSL_DEFAULT
The post-build target does not have the same environment variables setup
as the do-build target. This results in the eapol_test binary getting
compiled against the headers of the TLS library specified in
SSL_DEFAULT, but getting linked against the TLS library from the base
system regardless of SSL_DEFAULT, causing build failures when
SSL_DEFAULT is set to a different TLS library/version than the on from
the base system.
Fix this by not using the post-build target to build the eapol_test
binary, but instead conditionally add the eapol_test target to
TARGET_ALL if the EAPOL_TEST option is enabled for the port.
Signed-off-by: Pascal Ernster <git@hardfalcon.net>
net/hostapd* security/wpa-supplicant*: Fix 13 and 14 builds
The updates imported from 15-CURRENT included features not implemented
in FreeBSD 13 and 14. #ifdef them out.
Fixes: 995f5b9b0e4d
PR: 285371
net/nhostapd*, security/wpa_supplicant*: Sync drivers_bsd.c from src
src/ commits to drviers_bsd.c in src have fixed a number of problems
with wpa_supplicant/hostapd and FreeBSD. Bring those changes into the
ports.
PR: 285371
Tested by: Matthias Apitz <guru@unixarea.de>
MFH 2025Q1
security/wpa_supplicant-devel: Sync driver_bsd.c with base system
Replace driver_bsd.c with the one from src. It utilizes facilities
and features already in FreeBSD.
security/wpa_supplicant-devel: Fix 15-CURRENT 108de784513d build
On FreeBSD systems without 108de784513d the old definition will be used
while on 108de784513d and newer the duplicate case will be removed.
Obtained from: src 676041c41ba5
Discussed with: imp
security/wpa_supplicant*: ctrl_iface set sendbuf size
In order to avoid running into the default net.local.dgram.maxdgram
of 2K currently when calling sendto(2) try to set the sndbuf size to
the maximum ctrl message size.
The problem occured, e.g., when the scan_list result had enough BSSIDs
so the text output would exceed 2048 bytes.
Written by: bz
PR: 274990
Obtained from: https://reviews.freebsd.org/D42558
security/wpa_supplicant-devel: wpa: Enable receiving priority tagged (VID 0)
frames
Certain internet service providers transmit vlan 0 priority tagged
EAPOL frames from the ONT towards the residential gateway. VID 0
should be ignored, and the frame processed according to the priority
set in the 802.1P bits and the encapsulated EtherType (i.e. EAPOL).
The pcap filter utilized by l2_packet is inadquate for this use case.
Here we modify the pcap filter to accept both unencapsulated and
encapsulated (with VLAN 0) EAPOL EtherTypes. This preserves the
original filter behavior while also matching on encapsulated EAPOL.
Sponsored by: Rubicon Communications, LLC ("Netgate")
Reviewed by: cy
Obtained from: src bb5d6d14d81b
PR: 273696
MFH: 2023Q3
security/wpa_supplicant-devel: Fix uninitialized packet pointer on error
The packet pointer (called packet) will remain uninitialized when
pcap_next_ex() returns an error. This occurs when the wlan
interface is shut down using ifconfig destroy. Adding a NULL
assignment to packet duplicates what pcap_next() does.
The reason we use pcap_next_ex() in this instance is because with
pacp_next() when we receive a null pointer if there was an error
or if no packets were read. With pcap_next_ex() we can differentiate
between an error and legitimately no packets were received.
PR: 270649, 273696
Obtained from: src 953efa5b200f
Reported by: Robert Morris <rtm@lcs.mit.edu>
MFH: 2023Q3
security/wpa_supplicant-devel: Reapply c586ac04eb66
Reapply "Fix 100% CPU when USB wlan NIC removed."
hostapd calls pcap_next(3) to read the next packet off the wlan interface.
pcap_next() returns a pointer to the packet header but does not indicate
success or failure. Unfortunately this results in an infinite loop (100%
CPU) when the wlan device disappears, i.e. when a USB wlan device is
manually removed or a USB error results in the device removal. However
pcap_next_ex(3) does return success or failure. To resolve this we use
pcap_next_ex(), forcing hostapd to exit when the error is encountered.
An error message is printed to syslog or stderr when debugging (-d flag)
is enabled. Unfortunately wpa_printf() only works when debugging is enabled.
PR: 253608, 273696
Obtained from: src 6e5d01124fd4
Reported by: Damjan Jovanovic <damjan.jov@gmail.com>,
bz (privately)
MFH: 2023Q3
security/wpa_supplicant-devel: driver_bsd.c: backout upstream IFF_ change and
add logging
This reverts the state to our old supplicant logic setting or clearing
IFF_UP if needed. In addition this adds logging for the cases in which
we do (not) change the interface state.
Depending on testing this seems to help bringing WiFi up or not log
any needed changes (which would be the expected wpa_supplicant logic
now). People should look out for ``(changed)`` log entries (at least
if debugging the issue; this way we will at least have data points).
There is a hypothesis still pondered that the entire IFF_UP toggling
only exploits a race in net80211 (see further discssussions for more
debugging and alternative solutions see D38508 and D38753).
That may also explain why the changes to the rc startup script [1]
(Only the first 15 lines of the commit message are shown above )
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/wpa_supplicant-devel: Enable WEP by default
As of hostap 2.10, WEP is disabled by default. This of course is not a
bad thing but requires some planning and an announcment to remove WEP
support by default. At some point this option will default to off, to
coincide with the removal of WEP support from FreeBSD base.
MFH: 2022Q3
wpa_supplicant* hostapd*: Resolve secondary VAP association issue
Association will fail on a secondary open unprotected VAP when the
primary VAP is configured for WPA. Examples of secondary VAPs are,
hotels, universities, and commodity routers' guest networks.
A broadly similar bug was discussed on Red Hat's bugzilla affecting
association to a D-Link DIR-842.
This suggests that as IEs were added to the 802.11 protocol the old code
was increasingly inadaquate to handle the additional IEs, not only a
secondary VAP.
This duplcates src commit 775611ea11db here in ports.
PR: 264238
Reported by: Jaskie <jiangjun12321@gmail.com>
"J.R. Oldroyd" <fbsd@opal.com>
Submitted by: "J.R. Oldroyd" <fbsd@opal.com>
MFH: 2022Q3
*/*: Restore a missing wpa BSD driver patch
These patches were removed to sync with base where in fact base was
missing these patches and base should have been synced with the ports.
PR: 264238
Fixes: b8477825c2dc42f6c595697a36f593c71f39fbad
c86f32d652eb9dd023049122d8ca37cb13ed07b6
MFH: 2022Q2
*/*: Restore non-IBSS part of wpa patches
b8477825c2dc42f6c595697a36f593c71f39fbad removed some non-IBSS patches.
Restore them. We only want to remove the patches that make IBSS use
ADHOC mode.
Fixes: b8477825c2dc42f6c595697a36f593c71f39fbad
*/{wpa_supplicant*,hostapd*}: Fix wpa 100% CPU when USB wlan NIC removed
hostapd calls pcap_next(3) to read the next packet off the wlan interface.
pcap_next() returns a pointer to the packet header but does not indicate
success or failure. Unfortunately this results in an infinite loop (100%
CPU) when the wlan device disappears, i.e. when a USB wlan device is
manually removed or a USB error results in the device removal. However
pcap_next_ex(3) does return success or failure. To resolve this we use
pcap_next_ex(), forcing hostapd to exit when the error is encountered.
An error message is printed to syslog or stderr when debugging (-d flag)
is enabled. Unfortunately wpa_printf() only works when debugging is enabled.
PR: 253608
Reported by: Damjan Jovanovic <damjan.jov@gmail.com>,
bz (privately)
MFH: 2022Q2
*/*: Fix wpa_supplicant* and hostapd* EAPOL_TEST build
Fix EAPOL_TEST build. Local funcion os_fdatasync() is valid under
FreeBSD as fdatasync(2) is supported.
PR: 261636
Reported by: David Siebörger <drs-freebsd@sieborger.nom.za>
MFH: 2022Q1
