From j at w1.fi Tue Sep 1 11:36:04 2026 From: j at w1.fi (Jouni Malinen) Date: Tue, 1 Sep 2026 21:36:04 +0300 Subject: [PATCH 00/20] Add IEEE 802.11bn Security Profile support In-Reply-To: <20260610131213.36820-1-andrei.otcheretianski@intel.com> References: <20260610131213.36820-1-andrei.otcheretianski@intel.com> Message-ID: On Wed, Jun 10, 2026 at 04:11:53PM +0300, Andrei Otcheretianski wrote: > This series adds support for the IEEE 802.11bn Security Profile element > to both hostapd and wpa_supplicant as defined in section 37.32 of Draft > IEEE802.11bn/D1.4 > Add testing coverage for Security Profile flows across SAE, OWE, EPPKE, > and IEEE 802.1X authentication. As I noted earlier, there was another contribution that adds this same functionality. It took a while to go through all the details, but my conclusion is that the contributions were quite similar, but the other set felt more complete especially on the AP side functionality needed for product purposes. I ended up applying the other patchset for security profile support. I did apply a couple of patches from the set you sent since they were on independent items that were not really directly related to security profiles. The patches 15 and 16 might be in that category as well, but they had some dependencies that ended up with somewhat inconvenient merge conflicts without those changes, so I did not apply them now. If you think they are applicable, a rebased version would be appreciated. I tried to go through the details on the patches that are specific to security profiles and compare them to the functionality that is now in hostap.git. I did not identify any significant missing capabilities, but if you think I've missed something, any new patch on top of the current hostap.git snapshot to extend or fix security profile functionality would be welcome. -- Jouni Malinen PGP id EFC895FA From Doug.Smith at ezurio.com Tue Sep 1 14:09:57 2026 From: Doug.Smith at ezurio.com (Doug Smith) Date: Tue, 1 Sep 2026 21:09:57 +0000 Subject: pmksa_cache_remove() -- endless loop? Message-ID: Jouni, Appears to be an endless loop in pmksa_cache_remove() in : https://git.w1.fi/cgit/hostap/tree/src/rsn_supp/pmksa_cache.c#n66 e = pmksa->pmksa; while (e) { if (e == entry) { pmksa->pmksa = entry->next; break; } if (e->next == entry) { e->next = entry->next; break; } } The loop will exit if there are no entries in the cache, or if entry is the first or second in the cache. If not, then the loop repeats forever as e is never updated. Regards, Doug THE INFORMATION CONTAINED IN THIS DOCUMENT IS OF A PROPRIETARY NATURE AND IS INTENDED TO BE KEPT CONFIDENTIAL BETWEEN THE SENDER AND THE INTENDED RECIPIENT. IT MAY NOT BE REPRODUCED OR USED WITHOUT EXPRESS WRITTEN PERMISSION OF EZURIO From j at w1.fi Tue Sep 1 14:41:35 2026 From: j at w1.fi (Jouni Malinen) Date: Wed, 2 Sep 2026 00:41:35 +0300 Subject: Excessive handle_probe_req: send failed messages In-Reply-To: References: Message-ID: On Thu, Aug 27, 2026 at 11:56:10PM +0200, bugs at jth.net wrote: > For years and still in OpenWrt there has been an issue of hostapd spamming the log with > > hostapd: handle_probe_req: send failed > > messages > e.g. > 2026-08-27T09:12:05+02:00 RKunst hostapd: handle_probe_req: send failed > 2026-08-27T09:12:06+02:00 RKunst hostapd: handle_probe_req: send failed .. It would be good for someone who can reproduce this to try to debug why that send operation is failing. It should not really fail that commonly unless something else is wrong. > see also > > https://github.com/openwrt/openwrt/issues/21494 > > I wonder, if this is an issue which can be handled here e.g at least by a filter > reducing the amount of messages. I'd much rather address the root cause than hide that message indicating that something seems quite wrong.. -- Jouni Malinen PGP id EFC895FA From j at w1.fi Tue Sep 1 14:42:38 2026 From: j at w1.fi (Jouni Malinen) Date: Wed, 2 Sep 2026 00:42:38 +0300 Subject: pmksa_cache_remove() -- endless loop? In-Reply-To: References: Message-ID: On Tue, Sep 01, 2026 at 09:09:57PM +0000, Doug Smith wrote: > Appears to be an endless loop in pmksa_cache_remove() in : > https://git.w1.fi/cgit/hostap/tree/src/rsn_supp/pmksa_cache.c#n66 > > e = pmksa->pmksa; > while (e) { > if (e == entry) { > pmksa->pmksa = entry->next; > break; > } > if (e->next == entry) { > e->next = entry->next; > break; > } > } > > The loop will exit if there are no entries in the cache, or if entry is the first or second in the cache. > If not, then the loop repeats forever as e is never updated. Thanks for reporting this. I have no idea what I was thinking when writing that.. Anyway, fixed now in hostap.git. -- Jouni Malinen PGP id EFC895FA