Mon Oct 13 16:08:42 UTC 2008

Author: dcbw

Update of /cvs/extras/rpms/wpa_supplicant/F-9
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv18388

Modified Files:
	sources wpa_supplicant-0.5.7-use-IW_ENCODE_TEMP.patch 
	wpa_supplicant-assoc-timeout.patch wpa_supplicant.spec 
Added Files:
	wpa_supplicant-0.6.4-handle-invalid-ies.patch 
	wpa_supplicant-0.6.4-scan-fixes-1.patch 
	wpa_supplicant-0.6.4-scan-fixes-2.patch 
	wpa_supplicant-0.6.4-set-mode-handler.patch 
	wpa_supplicant-0.6.4-validate-wext-event.patch 
Removed Files:
	wpa_supplicant-0.6.3-dont-reschedule-specific-scans.patch 
	wpa_supplicant-0.6.3-fix-dbus-use-after-free.patch 
	wpa_supplicant-0.6.3-wext-dont-overwrite-BSS-frequency.patch 
	wpa_supplicant-0.6.3-wext-handle-mac80211-mode-switches.patch 
Log Message:
* Mon Oct 15 2008 Dan Williams <dcbw at redhat.com> - 1:0.6.4-2
- Handle encryption keys correctly when switching 802.11 modes (rh #459399)
- Better scanning behavior on resume from suspend/hibernate
- Better interaction with newer kernels and drivers



wpa_supplicant-0.6.4-handle-invalid-ies.patch:

--- NEW FILE wpa_supplicant-0.6.4-handle-invalid-ies.patch ---
commit fd630bc183fb79d0a14b5f3a346544f3d277bd05
Author: Jouni Malinen <jouni.malinen at atheros.com>
Date:   Wed Aug 27 09:52:16 2008 +0300

    Fixed WEXT scan result parser to not crash on invalid IEs (zero len buffer)
    
    If IWEVGENIE or custom event wpa_ie/rsn_ie is received in scan with empty
    buffer, the previous version ended up calling realloc(NULL, 0) which seems
    to return a non-NULL value in some cases. When this return value is passed
    again into realloc with realloc(ptr, 0), the returned value could be NULL.
    If the ptr is then freed (os_free(data.ie) in SIOCGIWAP handling), glibc
    may crash due to invalid pointer being freed (or double-freed?). The
    non-NULL realloc(NULL, 0) return value from glibc looks a bit odd behavior,
    but anyway, better avoid this case completely and just skip the IE events
    that have an empty buffer.
    
    This issue should not show up with drivers that produce proper scan results
    since the IEs will always include the two-octet header. However, it seems
    to be possible to see this when using 64-bit kernel and 32-bit userspace
    with incorrect compat-ioctl processing.

diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index 45e3e1f..98dddd6 100644
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -1618,6 +1618,9 @@ static void wext_get_scan_iwevgenie(struct iw_event *iwe,
 	char *genie, *gpos, *gend;
 	u8 *tmp;
 
+	if (iwe->u.data.length == 0)
+		return;
+
 	gpos = genie = custom;
 	gend = genie + iwe->u.data.length;
 	if (gend > end) {
@@ -1650,7 +1653,7 @@ static void wext_get_scan_custom(struct iw_event *iwe,
 		int bytes;
 		spos = custom + 7;
 		bytes = custom + clen - spos;
-		if (bytes & 1)
+		if (bytes & 1 || bytes == 0)
 			return;
 		bytes /= 2;
 		tmp = os_realloc(res->ie, res->ie_len + bytes);
@@ -1664,7 +1667,7 @@ static void wext_get_scan_custom(struct iw_event *iwe,
 		int bytes;
 		spos = custom + 7;
 		bytes = custom + clen - spos;
-		if (bytes & 1)
+		if (bytes & 1 || bytes == 0)
 			return;
 		bytes /= 2;
 		tmp = os_realloc(res->ie, res->ie_len + bytes);
diff --git a/src/drivers/driver_wext.c b/src/drivers/driver_wext.c
index 6aac427..a3c4733 100644
--- a/src/drivers/driver_wext.c
+++ b/src/drivers/driver_wext.c
@@ -1447,6 +1447,9 @@ static void wext_get_scan_iwevgenie(struct iw_event *iwe,
 	char *genie, *gpos, *gend;
 	u8 *tmp;
 
+	if (iwe->u.data.length == 0)
+		return;
+
 	gpos = genie = custom;
 	gend = genie + iwe->u.data.length;
 	if (gend > end) {
@@ -1479,7 +1482,7 @@ static void wext_get_scan_custom(struct iw_event *iwe,
 		int bytes;
 		spos = custom + 7;
 		bytes = custom + clen - spos;
-		if (bytes & 1)
+		if (bytes & 1 || bytes == 0)
 			return;
 		bytes /= 2;
 		tmp = os_realloc(res->ie, res->ie_len + bytes);
@@ -1493,7 +1496,7 @@ static void wext_get_scan_custom(struct iw_event *iwe,
 		int bytes;
 		spos = custom + 7;
 		bytes = custom + clen - spos;
-		if (bytes & 1)
+		if (bytes & 1 || bytes == 0)
 			return;
 		bytes /= 2;
 		tmp = os_realloc(res->ie, res->ie_len + bytes);

wpa_supplicant-0.6.4-scan-fixes-1.patch:

--- NEW FILE wpa_supplicant-0.6.4-scan-fixes-1.patch ---
commit 2064c2f98515016c376f3b69bfe161c85639e764
Author: Dan Nicholson <dbn.lists at gmail.com>
Date:   Wed Sep 24 12:48:33 2008 +0300

    Restore scan request settings if initial association failed
    
    The scan path to initiate another scan if the initial association failed
    was broken due to wpa_s->scan_req being zeroed earlier in
    wpa_supplicant_scan(). This caused the second scan to bail out early
    since it thought this was not a requested scan.

diff --git a/wpa_supplicant/scan.c b/wpa_supplicant/scan.c
index c2549e2..8767109 100644
--- a/wpa_supplicant/scan.c
+++ b/wpa_supplicant/scan.c
@@ -137,6 +137,7 @@ static void wpa_supplicant_scan(void *eloop_ctx, void *timeout_ctx)
 	if (wpa_s->scan_res_tried == 0 && wpa_s->conf->ap_scan == 1 &&
 	    !wpa_s->use_client_mlme) {
 		wpa_s->scan_res_tried++;
+		wpa_s->scan_req = scan_req;
 		wpa_printf(MSG_DEBUG, "Trying to get current scan results "
 			   "first without requesting a new scan to speed up "
 			   "initial association");

wpa_supplicant-0.6.4-scan-fixes-2.patch:

--- NEW FILE wpa_supplicant-0.6.4-scan-fixes-2.patch ---
commit 23e072374ea500002b8beec5d0e87f9fc6a7609c
Author: Dan Nicholson <dbn.lists at gmail.com>
Date:   Wed Sep 24 12:51:08 2008 +0300

    Don't post scan results when initial scan is emtpy
    
    When the initial scan is made, just the cached results from the driver
    are used. If this is empty, it's useless to post the results since
    another scan is being scheduled immediately. This just causes extra
    processing from listeners for no gain.

diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 0f9b338..04e3152 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -551,9 +551,18 @@ static void wpa_supplicant_event_scan_results(struct wpa_supplicant *wpa_s)
 		goto req_scan;
 	}
 
-	wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_SCAN_RESULTS);
-
-	wpa_supplicant_dbus_notify_scan_results(wpa_s);
+	/*
+	 * Don't post the results if this was the initial cached
+	 * and there were no results.
+	 */
+	if (wpa_s->scan_res_tried == 1 && wpa_s->conf->ap_scan == 1 &&
+	    wpa_s->scan_res->num == 0) {
+		wpa_msg(wpa_s, MSG_DEBUG, "Cached scan results are "
+			"empty - not posting");
+	} else {
+		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_SCAN_RESULTS);
+		wpa_supplicant_dbus_notify_scan_results(wpa_s);
+	}
 
 	if (wpa_s->conf->ap_scan == 2 || wpa_s->disconnected)
 		return;

wpa_supplicant-0.6.4-set-mode-handler.patch:

--- NEW FILE wpa_supplicant-0.6.4-set-mode-handler.patch ---
commit ec5f180a24cd31ba9d3d7f2abc9dc557fd16602f
Author: Dan Williams <dcbw at redhat.com>
Date:   Mon Sep 29 16:45:49 2008 +0300

    Add an optional set_mode() driver_ops handler for setting mode before keys
    
    A bug just got reported as a result of this for mac80211 drivers.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=459399
    
    The basic problem is that since taking the device down clears the keys
    from the driver on many mac80211-based cards, and since the mode gets
    set _after_ the keys have been set in the driver, the keys get cleared
    on a mode switch and the resulting association is wrong.  The report is
    about ad-hoc mode specifically, but this could happen when switching
    from adhoc back to managed mode.

diff --git a/src/drivers/driver.h b/src/drivers/driver.h
index 70dc075..77a2ceb 100644
--- a/src/drivers/driver.h
+++ b/src/drivers/driver.h
@@ -929,6 +929,20 @@ struct wpa_driver_ops {
 	 * Returns: 0 on success, -1 on failure
 	 */
 	int (*set_probe_req_ie)(void *, const u8 *ies, size_t ies_len);
+
+ 	/**
+	 * set_mode - Request driver to set the operating mode
+	 * @priv: private driver interface data
+	 * @mode: Operation mode (infra/ibss) IEEE80211_MODE_*
+	 *
+	 * This handler will be called before any key configuration and call to
+	 * associate() handler in order to allow the operation mode to be
+	 * configured as early as possible. This information is also available
+	 * in associate() params and as such, some driver wrappers may not need
+	 * to implement set_mode() handler.
+	 * Returns: 0 on success, -1 on failure
+	 */
+	int (*set_mode)(void *priv, int mode);
 };
 
 /**
diff --git a/src/drivers/driver_ndis.c b/src/drivers/driver_ndis.c
index da4f90f..f55bd2e 100644
--- a/src/drivers/driver_ndis.c
+++ b/src/drivers/driver_ndis.c
@@ -2829,5 +2829,7 @@ const struct wpa_driver_ops wpa_driver_ndis_ops = {
 	NULL /* mlme_remove_sta */,
 	NULL /* update_ft_ies */,
 	NULL /* send_ft_action */,
-	wpa_driver_ndis_get_scan_results
+	wpa_driver_ndis_get_scan_results,
+	NULL /* set_probe_req_ie */,
+	NULL /* set_mode */
 };
diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index 98dddd6..a207363 100644
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -2226,8 +2226,6 @@ static int wpa_driver_nl80211_associate(
 	    wpa_driver_nl80211_set_bssid(drv, NULL) < 0)
 		ret = -1;
 
-	if (wpa_driver_nl80211_set_mode(drv, params->mode) < 0)
-		ret = -1;
 	/* TODO: should consider getting wpa version and cipher/key_mgmt suites
 	 * from configuration, not from here, where only the selected suite is
 	 * available */
@@ -2859,6 +2857,7 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
 	.get_scan_results2 = wpa_driver_nl80211_get_scan_results,
 	.deauthenticate = wpa_driver_nl80211_deauthenticate,
 	.disassociate = wpa_driver_nl80211_disassociate,
+	.set_mode = wpa_driver_nl80211_set_mode,
 	.associate = wpa_driver_nl80211_associate,
 	.set_auth_alg = wpa_driver_nl80211_set_auth_alg,
 	.init = wpa_driver_nl80211_init,
diff --git a/src/drivers/driver_test.c b/src/drivers/driver_test.c
index 5c6e6f1..7f7f129 100644
--- a/src/drivers/driver_test.c
+++ b/src/drivers/driver_test.c
@@ -982,5 +982,6 @@ const struct wpa_driver_ops wpa_driver_test_ops = {
 	NULL /* update_ft_ies */,
 	NULL /* send_ft_action */,
 	wpa_driver_test_get_scan_results2,
-	NULL /* set_probe_req_ie */
+	NULL /* set_probe_req_ie */,
+	NULL /* set_mode */
 };
diff --git a/src/drivers/driver_wext.c b/src/drivers/driver_wext.c
index 6b7f1a7..a618a74 100644
--- a/src/drivers/driver_wext.c
+++ b/src/drivers/driver_wext.c
@@ -2206,8 +2206,6 @@ int wpa_driver_wext_associate(void *priv,
 	    wpa_driver_wext_set_bssid(drv, NULL) < 0)
 		ret = -1;
 
-	if (wpa_driver_wext_set_mode(drv, params->mode) < 0)
-		ret = -1;
 	/* TODO: should consider getting wpa version and cipher/key_mgmt suites
 	 * from configuration, not from here, where only the selected suite is
 	 * available */
@@ -2782,6 +2780,7 @@ const struct wpa_driver_ops wpa_driver_wext_ops = {
 	.get_scan_results2 = wpa_driver_wext_get_scan_results,
 	.deauthenticate = wpa_driver_wext_deauthenticate,
 	.disassociate = wpa_driver_wext_disassociate,
+	.set_mode = wpa_driver_wext_set_mode,
 	.associate = wpa_driver_wext_associate,
 	.set_auth_alg = wpa_driver_wext_set_auth_alg,
 	.init = wpa_driver_wext_init,
diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 4c9482f..a36c65b 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -937,6 +937,11 @@ void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
 	 * previous association. */
 	wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 
+	if (wpa_drv_set_mode(wpa_s, ssid->mode)) {
+		wpa_printf(MSG_WARNING, "Failed to set operating mode");
+		assoc_failed = 1;
+	}
+
 #ifdef IEEE8021X_EAPOL
 	if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 		if (ssid->leap) {
diff --git a/wpa_supplicant/wpa_supplicant_i.h b/wpa_supplicant/wpa_supplicant_i.h
index a2e3dd5..9afae2a 100644
--- a/wpa_supplicant/wpa_supplicant_i.h
+++ b/wpa_supplicant/wpa_supplicant_i.h
@@ -448,6 +448,14 @@ static inline int wpa_drv_set_wpa(struct wpa_supplicant *wpa_s, int enabled)
 	return 0;
 }
 
+static inline int wpa_drv_set_mode(struct wpa_supplicant *wpa_s, int mode)
+{
+	if (wpa_s->driver->set_mode) {
+		return wpa_s->driver->set_mode(wpa_s->drv_priv, mode);
+	}
+	return 0;
+}
+
 static inline int wpa_drv_associate(struct wpa_supplicant *wpa_s,
 				    struct wpa_driver_associate_params *params)
 {

wpa_supplicant-0.6.4-validate-wext-event.patch:

--- NEW FILE wpa_supplicant-0.6.4-validate-wext-event.patch ---
commit 36b5e559f1387d4e02059753ecfb04461d62f381
Author: Jouni Malinen <jouni.malinen at atheros.com>
Date:   Sat Sep 27 10:49:56 2008 +0300

    Validate WEXT event iwe->u.data.length before using the event data
    
    This is needed to avoid crashing wpa_supplicant with invalid event messages
    that may be received when using 64-bit kernel with 32-bit userspace.

diff --git a/src/drivers/driver_wext.c b/src/drivers/driver_wext.c
index a3c4733..6b7f1a7 100644
--- a/src/drivers/driver_wext.c
+++ b/src/drivers/driver_wext.c
@@ -652,12 +652,20 @@ static void wpa_driver_wext_event_wireless(struct wpa_driver_wext_data *drv,
 			}
 			break;
 		case IWEVMICHAELMICFAILURE:
+			if (custom + iwe->u.data.length > end) {
+				wpa_printf(MSG_DEBUG, "WEXT: Invalid "
+					   "IWEVMICHAELMICFAILURE length");
+				return;
+			}
 			wpa_driver_wext_event_wireless_michaelmicfailure(
 				ctx, custom, iwe->u.data.length);
 			break;
 		case IWEVCUSTOM:
-			if (custom + iwe->u.data.length > end)
+			if (custom + iwe->u.data.length > end) {
+				wpa_printf(MSG_DEBUG, "WEXT: Invalid "
+					   "IWEVCUSTOM length");
 				return;
+			}
 			buf = os_malloc(iwe->u.data.length + 1);
 			if (buf == NULL)
 				return;
@@ -673,14 +681,29 @@ static void wpa_driver_wext_event_wireless(struct wpa_driver_wext_data *drv,
 			wpa_supplicant_event(ctx, EVENT_SCAN_RESULTS, NULL);
 			break;
 		case IWEVASSOCREQIE:
+			if (custom + iwe->u.data.length > end) {
+				wpa_printf(MSG_DEBUG, "WEXT: Invalid "
+					   "IWEVASSOCREQIE length");
+				return;
+			}
 			wpa_driver_wext_event_wireless_assocreqie(
 				drv, custom, iwe->u.data.length);
 			break;
 		case IWEVASSOCRESPIE:
+			if (custom + iwe->u.data.length > end) {
+				wpa_printf(MSG_DEBUG, "WEXT: Invalid "
+					   "IWEVASSOCRESPIE length");
+				return;
+			}
 			wpa_driver_wext_event_wireless_assocrespie(
 				drv, custom, iwe->u.data.length);
 			break;
 		case IWEVPMKIDCAND:
+			if (custom + iwe->u.data.length > end) {
+				wpa_printf(MSG_DEBUG, "WEXT: Invalid "
+					   "IWEVPMKIDCAND length");
+				return;
+			}
 			wpa_driver_wext_event_wireless_pmkidcand(
 				drv, custom, iwe->u.data.length);
 			break;


Index: sources
===================================================================
RCS file: /cvs/extras/rpms/wpa_supplicant/F-9/sources,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- sources	3 Mar 2008 17:20:11 -0000	1.8
+++ sources	13 Oct 2008 16:08:42 -0000	1.9
@@ -1,2 +1,2 @@
 b82289b140cc1c66db11564bde248d8a  madwifi-headers-r1475.tar.bz2
-b51b2975f21006f85f7297f3fb1acde1  wpa_supplicant-0.6.3.tar.gz
+eb06a9a05d3916addf9451297a558aa2  wpa_supplicant-0.6.4.tar.gz

wpa_supplicant-0.5.7-use-IW_ENCODE_TEMP.patch:

Index: wpa_supplicant-0.5.7-use-IW_ENCODE_TEMP.patch
===================================================================
RCS file: /cvs/extras/rpms/wpa_supplicant/F-9/wpa_supplicant-0.5.7-use-IW_ENCODE_TEMP.patch,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- wpa_supplicant-0.5.7-use-IW_ENCODE_TEMP.patch	3 Mar 2008 17:20:11 -0000	1.2
+++ wpa_supplicant-0.5.7-use-IW_ENCODE_TEMP.patch	13 Oct 2008 16:08:42 -0000	1.3
@@ -1,26 +1,25 @@
-Index: wpa_supplicant-0.6.3/src/drivers/driver_wext.c
-===================================================================
---- wpa_supplicant-0.6.3/src/drivers/driver_wext.c.orig	2006-07-13 11:23:05.000000000 +0200
-+++ wpa_supplicant-0.6.3/src/drivers/driver_wext.c	2006-07-13 11:23:57.000000000 +0200
-@@ -1280,6 +1280,7 @@ static int wpa_driver_wext_set_key_ext(v
- 	memset(&iwr, 0, sizeof(iwr));
- 	strncpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
+diff -up wpa_supplicant-0.6.4/src/drivers/driver_wext.c.use-IW_ENCODE_TEMP wpa_supplicant-0.6.4/src/drivers/driver_wext.c
+--- wpa_supplicant-0.6.4/src/drivers/driver_wext.c.use-IW_ENCODE_TEMP	2008-08-10 13:33:12.000000000 -0400
++++ wpa_supplicant-0.6.4/src/drivers/driver_wext.c	2008-08-27 17:22:06.000000000 -0400
+@@ -1836,6 +1836,7 @@ static int wpa_driver_wext_set_key_ext(v
+ 	os_memset(&iwr, 0, sizeof(iwr));
+ 	os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
  	iwr.u.encoding.flags = key_idx + 1;
 +	iwr.u.encoding.flags |= IW_ENCODE_TEMP;
  	if (alg == WPA_ALG_NONE)
  		iwr.u.encoding.flags |= IW_ENCODE_DISABLED;
  	iwr.u.encoding.pointer = (caddr_t) ext;
-@@ -1401,6 +1402,7 @@ int wpa_driver_wext_set_key(void *priv, 
- 	memset(&iwr, 0, sizeof(iwr));
- 	strncpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
+@@ -1967,6 +1968,7 @@ int wpa_driver_wext_set_key(void *priv, 
+ 	os_memset(&iwr, 0, sizeof(iwr));
+ 	os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
  	iwr.u.encoding.flags = key_idx + 1;
 +	iwr.u.encoding.flags |= IW_ENCODE_TEMP;
  	if (alg == WPA_ALG_NONE)
  		iwr.u.encoding.flags |= IW_ENCODE_DISABLED;
  	iwr.u.encoding.pointer = (caddr_t) key;
-@@ -1415,6 +1417,7 @@ int wpa_driver_wext_set_key(void *priv, 
- 		memset(&iwr, 0, sizeof(iwr));
- 		strncpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
+@@ -1981,6 +1983,7 @@ int wpa_driver_wext_set_key(void *priv, 
+ 		os_memset(&iwr, 0, sizeof(iwr));
+ 		os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
  		iwr.u.encoding.flags = key_idx + 1;
 +		iwr.u.encoding.flags |= IW_ENCODE_TEMP;
  		iwr.u.encoding.pointer = (caddr_t) NULL;

wpa_supplicant-assoc-timeout.patch:

Index: wpa_supplicant-assoc-timeout.patch
===================================================================
RCS file: /cvs/extras/rpms/wpa_supplicant/F-9/wpa_supplicant-assoc-timeout.patch,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- wpa_supplicant-assoc-timeout.patch	11 Jun 2008 11:15:37 -0000	1.3
+++ wpa_supplicant-assoc-timeout.patch	13 Oct 2008 16:08:42 -0000	1.4
@@ -1,14 +1,16 @@
---- wpa_supplicant-0.6.3/wpa_supplicant/wpa_supplicant.c.timeout	2006-03-03 22:26:13.000000000 -0500
-+++ wpa_supplicant-0.6.3/wpa_supplicant/wpa_supplicant.c	2006-03-03 22:26:45.000000000 -0500
-@@ -1252,9 +1252,9 @@
- 		/* Timeout for IEEE 802.11 authentication and association */
- 		int timeout;
- 		if (assoc_failed)
--			timeout = 5;
-+			timeout = 15;
- 		else if (wpa_s->conf->ap_scan == 1)
--			timeout = 10;
-+			timeout = 20;
- 		else
- 			timeout = 60;
+diff -up wpa_supplicant-0.6.4/wpa_supplicant/wpa_supplicant.c.assoc-timeout wpa_supplicant-0.6.4/wpa_supplicant/wpa_supplicant.c
+--- wpa_supplicant-0.6.4/wpa_supplicant/wpa_supplicant.c.assoc-timeout	2008-08-27 17:01:00.000000000 -0400
++++ wpa_supplicant-0.6.4/wpa_supplicant/wpa_supplicant.c	2008-08-27 17:01:22.000000000 -0400
+@@ -1094,10 +1094,10 @@ void wpa_supplicant_associate(struct wpa
+ 
+ 		if (assoc_failed) {
+ 			/* give IBSS a bit more time */
+- 			timeout = ssid->mode ? 10 : 5;
++ 			timeout = ssid->mode ? 20 : 10;
+ 		} else if (wpa_s->conf->ap_scan == 1) {
+ 			/* give IBSS a bit more time */
+- 			timeout = ssid->mode ? 20 : 10;
++ 			timeout = ssid->mode ? 20 : 20;
+ 		}
  		wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
+ 	}


Index: wpa_supplicant.spec
===================================================================
RCS file: /cvs/extras/rpms/wpa_supplicant/F-9/wpa_supplicant.spec,v
retrieving revision 1.47
retrieving revision 1.48
diff -u -r1.47 -r1.48
--- wpa_supplicant.spec	11 Jun 2008 11:15:37 -0000	1.47
+++ wpa_supplicant.spec	13 Oct 2008 16:08:42 -0000	1.48
@@ -1,8 +1,8 @@
 Summary: WPA/WPA2/IEEE 802.1X Supplicant
 Name: wpa_supplicant
 Epoch: 1
-Version: 0.6.3
-Release: 6%{?dist}
+Version: 0.6.4
+Release: 2%{?dist}
 License: BSD
 Group: System Environment/Base
 Source0: http://hostap.epitest.fi/releases/%{name}-%{version}.tar.gz
@@ -14,15 +14,15 @@
 Source6: %{name}.logrotate
 
 Patch0: wpa_supplicant-assoc-timeout.patch
-Patch1: wpa_supplicant-0.6.3-wpa-gui-fixes.patch
-Patch2: wpa_supplicant-0.5.7-qmake-location.patch
-Patch3: wpa_supplicant-0.5.7-flush-debug-output.patch
-Patch4: wpa_supplicant-0.5.7-use-IW_ENCODE_TEMP.patch
-Patch5: wpa_supplicant-0.5.10-dbus-service-file.patch
-Patch6: wpa_supplicant-0.6.3-fix-dbus-use-after-free.patch
-Patch7: wpa_supplicant-0.6.3-wext-dont-overwrite-BSS-frequency.patch
-Patch8: wpa_supplicant-0.6.3-dont-reschedule-specific-scans.patch
-Patch9: wpa_supplicant-0.6.3-wext-handle-mac80211-mode-switches.patch
+Patch1: wpa_supplicant-0.5.7-qmake-location.patch
+Patch2: wpa_supplicant-0.5.7-flush-debug-output.patch
+Patch3: wpa_supplicant-0.5.7-use-IW_ENCODE_TEMP.patch
+Patch4: wpa_supplicant-0.5.10-dbus-service-file.patch
+Patch5: wpa_supplicant-0.6.4-handle-invalid-ies.patch
+Patch6: wpa_supplicant-0.6.4-scan-fixes-1.patch
+Patch7: wpa_supplicant-0.6.4-scan-fixes-2.patch
+Patch8: wpa_supplicant-0.6.4-validate-wext-event.patch
+Patch9: wpa_supplicant-0.6.4-set-mode-handler.patch
 
 URL: http://w1.fi/wpa_supplicant/
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -51,15 +51,15 @@
 %prep
 %setup -q
 %patch0 -p1 -b .assoc-timeout
-%patch1 -p1 -b .wpa-gui-fixes
-%patch2 -p1 -b .qmake-location
-%patch3 -p1 -b .flush-debug-output
-%patch4 -p1 -b .use-IW_ENCODE_TEMP
-%patch5 -p1 -b .dbus-service-file
-%patch6 -p1 -b .use-after-free
-%patch7 -p1 -b .bss-freq
-%patch8 -p1 -b .ssid-scans
-%patch9 -p1 -b .mac80211-mode
+%patch1 -p1 -b .qmake-location
+%patch2 -p1 -b .flush-debug-output
+%patch3 -p1 -b .use-IW_ENCODE_TEMP
+%patch4 -p1 -b .dbus-service-file
+%patch5 -p1 -b .handle-invalid-ies
+%patch6 -p1 -b .scan-fixes-1
+%patch7 -p1 -b .scan-fixes-2
+%patch8 -p1 -b .validate-wext-event
+%patch9 -p1 -b .set-mode-handler
 
 %build
 pushd src
@@ -153,6 +153,15 @@
 %{_bindir}/wpa_gui
 
 %changelog
+* Mon Oct 15 2008 Dan Williams <dcbw at redhat.com> - 1:0.6.4-2
+- Handle encryption keys correctly when switching 802.11 modes (rh #459399)
+- Better scanning behavior on resume from suspend/hibernate
+- Better interaction with newer kernels and drivers
+
+* Wed Aug 27 2008 Dan Williams <dcbw at redhat.com> - 1:0.6.4-1
+- Update to 0.6.4
+- Drop upstreamed patches
+
 * Tue Jun 10 2008 Dan Williams <dcbw at redhat.com> - 1:0.6.3-6
 - Fix 802.11a frequency bug
 - Always schedule specific SSID scans to help find hidden APs


--- wpa_supplicant-0.6.3-dont-reschedule-specific-scans.patch DELETED ---


--- wpa_supplicant-0.6.3-fix-dbus-use-after-free.patch DELETED ---


--- wpa_supplicant-0.6.3-wext-dont-overwrite-BSS-frequency.patch DELETED ---


--- wpa_supplicant-0.6.3-wext-handle-mac80211-mode-switches.patch DELETED ---


