Home | History | Annotate | Download | only in wpa_supplicant
      1 ChangeLog for wpa_supplicant
      2 
      3 2015-03-15 - v2.4
      4 	* allow OpenSSL cipher configuration to be set for internal EAP server
      5 	  (openssl_ciphers parameter)
      6 	* fixed number of small issues based on hwsim test case failures and
      7 	  static analyzer reports
      8 	* P2P:
      9 	  - add new=<0/1> flag to P2P-DEVICE-FOUND events
     10 	  - add passive channels in invitation response from P2P Client
     11 	  - enable nl80211 P2P_DEVICE support by default
     12 	  - fix regresssion in disallow_freq preventing search on social
     13 	    channels
     14 	  - fix regressions in P2P SD query processing
     15 	  - try to re-invite with social operating channel if no common channels
     16 	    in invitation
     17 	  - allow cross connection on parent interface (this fixes number of
     18 	    use cases with nl80211)
     19 	  - add support for P2P services (P2PS)
     20 	  - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to
     21 	    be configured
     22 	* increase postponing of EAPOL-Start by one second with AP/GO that
     23 	  supports WPS 2.0 (this makes it less likely to trigger extra roundtrip
     24 	  of identity frames)
     25 	* add support for PMKSA caching with SAE
     26 	* add support for control mesh BSS (IEEE 802.11s) operations
     27 	* fixed number of issues with D-Bus P2P commands
     28 	* fixed regression in ap_scan=2 special case for WPS
     29 	* fixed macsec_validate configuration
     30 	* add a workaround for incorrectly behaving APs that try to use
     31 	  EAPOL-Key descriptor version 3 when the station supports PMF even if
     32 	  PMF is not enabled on the AP
     33 	* allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior
     34 	  of disabling these can be configured to work around issues with broken
     35 	  servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1"
     36 	* add support for Suite B (128-bit and 192-bit level) key management and
     37 	  cipher suites
     38 	* add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS)
     39 	* improved BSS Transition Management processing
     40 	* add support for neighbor report
     41 	* add support for link measurement
     42 	* fixed expiration of BSS entry with all-zeros BSSID
     43 	* add optional LAST_ID=x argument to LIST_NETWORK to allow all
     44 	  configured networks to be listed even with huge number of network
     45 	  profiles
     46 	* add support for EAP Re-Authentication Protocol (ERP)
     47 	* fixed EAP-IKEv2 fragmentation reassembly
     48 	* improved PKCS#11 configuration for OpenSSL
     49 	* set stdout to be line-buffered
     50 	* add TDLS channel switch configuration
     51 	* add support for MAC address randomization in scans with nl80211
     52 	* enable HT for IBSS if supported by the driver
     53 	* add BSSID black and white lists (bssid_blacklist, bssid_whitelist)
     54 	* add support for domain_suffix_match with GnuTLS
     55 	* add OCSP stapling client support with GnuTLS
     56 	* include peer certificate in EAP events even without a separate probe
     57 	  operation; old behavior can be restored with cert_in_cb=0
     58 	* add peer ceritficate alt subject name to EAP events
     59 	  (CTRL-EVENT-EAP-PEER-ALT)
     60 	* add domain_match network profile parameter (similar to
     61 	  domain_suffix_match, but full match is required)
     62 	* enable AP/GO mode HT Tx STBC automatically based on driver support
     63 	* add ANQP-QUERY-DONE event to provide information on ANQP parsing
     64 	  status
     65 	* allow passive scanning to be forced with passive_scan=1
     66 	* add a workaround for Linux packet socket behavior when interface is in
     67 	  bridge
     68 	* increase 5 GHz band preference in BSS selection (estimate SNR, if info
     69 	  not available from driver; estimate maximum throughput based on common
     70 	  HT/VHT/specific TX rate support)
     71 	* add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to
     72 	  implement Interworking network selection behavior in upper layers
     73 	  software components
     74 	* add optional reassoc_same_bss_optim=1 (disabled by default)
     75 	  optimization to avoid unnecessary Authentication frame exchange
     76 	* extend TDLS frame padding workaround to cover all packets
     77 	* allow wpa_supplicant to recover nl80211 functionality if the cfg80211
     78 	  module gets removed and reloaded without restarting wpa_supplicant
     79 	* allow hostapd DFS implementation to be used in wpa_supplicant AP mode
     80 
     81 2014-10-09 - v2.3
     82 	* fixed number of minor issues identified in static analyzer warnings
     83 	* fixed wfd_dev_info to be more careful and not read beyond the buffer
     84 	  when parsing invalid information for P2P-DEVICE-FOUND
     85 	* extended P2P and GAS query operations to support drivers that have
     86 	  maximum remain-on-channel time below 1000 ms (500 ms is the current
     87 	  minimum supported value)
     88 	* added p2p_search_delay parameter to make the default p2p_find delay
     89 	  configurable
     90 	* improved P2P operating channel selection for various multi-channel
     91 	  concurrency cases
     92 	* fixed some TDLS failure cases to clean up driver state
     93 	* fixed dynamic interface addition cases with nl80211 to avoid adding
     94 	  ifindex values to incorrect interface to skip foreign interface events
     95 	  properly
     96 	* added TDLS workaround for some APs that may add extra data to the
     97 	  end of a short frame
     98 	* fixed EAP-AKA' message parser with multiple AT_KDF attributes
     99 	* added configuration option (p2p_passphrase_len) to allow longer
    100 	  passphrases to be generated for P2P groups
    101 	* fixed IBSS channel configuration in some corner cases
    102 	* improved HT/VHT/QoS parameter setup for TDLS
    103 	* modified D-Bus interface for P2P peers/groups
    104 	* started to use constant time comparison for various password and hash
    105 	  values to reduce possibility of any externally measurable timing
    106 	  differences
    107 	* extended explicit clearing of freed memory and expired keys to avoid
    108 	  keeping private data in memory longer than necessary
    109 	* added optional scan_id parameter to the SCAN command to allow manual
    110 	  scan requests for active scans for specific configured SSIDs
    111 	* fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value
    112 	* added option to set Hotspot 2.0 Rel 2 update_identifier in network
    113 	  configuration to support external configuration
    114 	* modified Android PNO functionality to send Probe Request frames only
    115 	  for hidden SSIDs (based on scan_ssid=1)
    116 	* added generic mechanism for adding vendor elements into frames at
    117 	  runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE)
    118 	* added fields to show unrecognized vendor elements in P2P_PEER
    119 	* removed EAP-TTLS/MSCHAPv2 interoperability workaround so that
    120 	  MS-CHAP2-Success is required to be present regardless of
    121 	  eap_workaround configuration
    122 	* modified EAP fast session resumption to allow results to be used only
    123 	  with the same network block that generated them
    124 	* extended freq_list configuration to apply for sched_scan as well as
    125 	  normal scan
    126 	* modified WPS to merge mixed-WPA/WPA2 credentials from a single session
    127 	* fixed nl80211/RTM_DELLINK processing when a P2P GO interface is
    128 	  removed from a bridge
    129 	* fixed number of small P2P issues to make negotiations more robust in
    130 	  corner cases
    131 	* added experimental support for using temporary, random local MAC
    132 	  address (mac_addr and preassoc_mac_addr parameters); this is disabled
    133 	  by default (i.e., previous behavior of using permanent address is
    134 	  maintained if configuration is not changed)
    135 	* added D-Bus interface for setting/clearing WFD IEs
    136 	* fixed TDLS AID configuration for VHT
    137 	* modified -m<conf> configuration file to be used only for the P2P
    138 	  non-netdev management device and do not load this for the default
    139 	  station interface or load the station interface configuration for
    140 	  the P2P management interface
    141 	* fixed external MAC address changes while wpa_supplicant is running
    142 	* started to enable HT (if supported by the driver) for IBSS
    143 	* fixed wpa_cli action script execution to use more robust mechanism
    144 	  (CVE-2014-3686)
    145 
    146 2014-06-04 - v2.2
    147 	* added DFS indicator to get_capability freq
    148 	* added/fixed nl80211 functionality
    149 	  - BSSID/frequency hint for driver-based BSS selection
    150 	  - fix tearing down WDS STA interfaces
    151 	  - support vendor specific driver command
    152 	    (VENDOR <vendor id> <sub command id> [<hex formatted data>])
    153 	  - GO interface teardown optimization
    154 	  - allow beacon interval to be configured for IBSS
    155 	  - add SHA256-based AKM suites to CONNECT/ASSOCIATE commands
    156 	* removed unused NFC_RX_HANDOVER_REQ and NFC_RX_HANDOVER_SEL control
    157 	  interface commands (the more generic NFC_REPORT_HANDOVER is now used)
    158 	* fixed MSCHAP UTF-8 to UCS-2 conversion for three-byte encoding;
    159 	  this fixes password with include UTF-8 characters that use
    160 	  three-byte encoding EAP methods that use NtPasswordHash
    161 	* fixed couple of sequencies where radio work items could get stuck,
    162 	  e.g., when rfkill blocking happens during scanning or when
    163 	  scan-for-auth workaround is used
    164 	* P2P enhancements/fixes
    165 	  - enable enable U-APSD on GO automatically if the driver indicates
    166 	    support for this
    167 	  - fixed some service discovery cases with broadcast queries not being
    168 	    sent to all stations
    169 	  - fixed Probe Request frame triggering invitation to trigger only a
    170 	    single invitation instance even if multiple Probe Request frames are
    171 	    received
    172 	  - fixed a potential NULL pointer dereference crash when processing an
    173 	    invalid Invitation Request frame
    174 	  - add optional configuration file for the P2P_DEVICE parameters
    175 	  - optimize scan for GO during persistent group invocation
    176 	  - fix possible segmentation fault when PBC overlap is detected while
    177 	    using a separate P2P group interface
    178 	  - improve GO Negotiation robustness by allowing GO Negotiation
    179 	    Confirmation to be retransmitted
    180 	  - do use freed memory on device found event when P2P NFC
    181 	* added phase1 network parameter options for disabling TLS v1.1 and v1.2
    182 	  to allow workarounds with misbehaving AAA servers
    183 	  (tls_disable_tlsv1_1=1 and tls_disable_tlsv1_2=1)
    184 	* added support for OCSP stapling to validate AAA server certificate
    185 	  during TLS exchange
    186 	* Interworking/Hotspot 2.0 enhancements
    187 	  - prefer the last added network in Interworking connection to make the
    188 	    behavior more consistent with likely user expectation
    189 	  - roaming partner configuration (roaming_partner within a cred block)
    190 	  - support Hotspot 2.0 Release 2
    191 	    * "hs20_anqp_get <BSSID> 8" to request OSU Providers list
    192 	    * "hs20_icon_request <BSSID> <icon filename>" to request icon files
    193 	    * "fetch_osu" and "cancel_osu_fetch" to start/stop full OSU provider
    194 	      search (all suitable APs in scan results)
    195 	    * OSEN network for online signup connection
    196 	    * min_{dl,ul}_bandwidth_{home,roaming} cred parameters
    197 	    * max_bss_load cred parameter
    198 	    * req_conn_capab cred parameter
    199 	    * sp_priority cred parameter
    200 	    * ocsp cred parameter
    201 	    * slow down automatic connection attempts on EAP failure to meet
    202 	      required behavior (no more than 10 retries within a 10-minute
    203 	      interval)
    204 	    * sample implementation of online signup client (both SPP and
    205 	      OMA-DM protocols) (hs20/client/*)
    206 	  - fixed GAS indication for additional comeback delay with status
    207 	    code 95
    208 	  - extend ANQP_GET to accept Hotspot 2.0 subtypes
    209 	    ANQP_GET <addr> <info id>[,<info id>]...
    210 	    [,hs20:<subtype>][...,hs20:<subtype>]
    211 	  - add control interface events CRED-ADDED <id>,
    212 	    CRED-MODIFIED <id> <field>, CRED-REMOVED <id>
    213 	  - add "GET_CRED <id> <field>" command
    214 	  - enable FT for the connection automatically if the AP advertises
    215 	    support for this
    216 	  - fix a case where auto_interworking=1 could end up stopping scanning
    217 	* fixed TDLS interoperability issues with supported operating class in
    218 	  some deployed stations
    219 	* internal TLS implementation enhancements/fixes
    220 	  - add SHA256-based cipher suites
    221 	  - add DHE-RSA cipher suites
    222 	  - fix X.509 validation of PKCS#1 signature to check for extra data
    223 	* fixed PTK derivation for CCMP-256 and GCMP-256
    224 	* added "reattach" command for fast reassociate-back-to-same-BSS
    225 	* allow PMF to be enabled for AP mode operation with the ieee80211w
    226 	  parameter
    227 	* added "get_capability tdls" command
    228 	* added option to set config blobs through control interface with
    229 	  "SET blob <name> <hexdump>"
    230 	* D-Bus interface extensions/fixes
    231 	  - make p2p_no_group_iface configurable
    232 	  - declare ServiceDiscoveryRequest method properly
    233 	  - export peer's device address as a property
    234 	  - make reassociate command behave like the control interface one,
    235 	    i.e., to allow connection from disconnected state
    236 	* added optional "freq=<channel ranges>" parameter to SET pno
    237 	* added optional "freq=<channel ranges>" parameter to SELECT_NETWORK
    238 	* fixed OBSS scan result processing for 20/40 MHz co-ex report
    239 	* remove WPS 1.0 only support, i.e., WSC 2.0 support is now enabled
    240 	  whenever CONFIG_WPS=y is set
    241 	* fixed regression in parsing of WNM Sleep Mode exit key data
    242 	* fixed potential segmentation fault and memory leaks in WNM neighbor
    243 	  report processing
    244 	* EAP-pwd fixes
    245 	  - fragmentation of PWD-Confirm-Resp
    246 	  - fix memory leak when fragmentation is used
    247 	  - fix possible segmentation fault on EAP method deinit if an invalid
    248 	    group is negotiated
    249 	* added MACsec/IEEE Std 802.1X-2010 PAE implementation (currently
    250 	  available only with the macsec_qca driver wrapper)
    251 	* fixed EAP-SIM counter-too-small message
    252 	* added 'dup_network <id_s> <id_d> <name>' command; this can be used to
    253 	  clone the psk field without having toextract it from wpa_supplicant
    254 	* fixed GSM authentication on USIM
    255 	* added support for usin epoll in eloop (CONFIG_ELOOP_EPOLL=y)
    256 	* fixed some concurrent virtual interface cases with dedicated P2P
    257 	  management interface to not catch events from removed interface (this
    258 	  could result in the management interface getting disabled)
    259 	* fixed a memory leak in SAE random number generation
    260 	* fixed off-by-one bounds checking in printf_encode()
    261 	  - this could result in some control interface ATTACH command cases
    262 	    terminating wpa_supplicant
    263 	* fixed EAPOL-Key exchange when GCMP is used with SHA256-based AKM
    264 	* various bug fixes
    265 
    266 2014-02-04 - v2.1
    267 	* added support for simultaneous authentication of equals (SAE) for
    268 	  stronger password-based authentication with WPA2-Personal
    269 	* improved P2P negotiation and group formation robustness
    270 	  - avoid unnecessary Dialog Token value changes during retries
    271 	  - avoid more concurrent scanning cases during full group formation
    272 	    sequence
    273 	  - do not use potentially obsolete scan result data from driver
    274 	    cache for peer discovery/updates
    275 	  - avoid undesired re-starting of GO negotiation based on Probe
    276 	    Request frames
    277 	  - increase GO Negotiation and Invitation timeouts to address busy
    278 	    environments and peers that take long time to react to messages,
    279 	    e.g., due to power saving
    280 	  - P2P Device interface type
    281 	* improved P2P channel selection (use more peer information and allow
    282 	  more local options)
    283 	* added support for optional per-device PSK assignment by P2P GO
    284 	  (wpa_cli p2p_set per_sta_psk <0/1>)
    285 	* added P2P_REMOVE_CLIENT for removing a client from P2P groups
    286 	  (including persistent groups); this can be used to securely remove
    287 	  a client from a group if per-device PSKs are used
    288 	* added more configuration flexibility for allowed P2P GO/client
    289 	  channels (p2p_no_go_freq list and p2p_add_cli_chan=0/1)
    290 	* added nl80211 functionality
    291 	  - VHT configuration for nl80211
    292 	  - MFP (IEEE 802.11w) information for nl80211 command API
    293 	  - support split wiphy dump
    294 	  - FT (IEEE 802.11r) with driver-based SME
    295 	  - use advertised number of supported concurrent channels
    296 	  - QoS Mapping configuration
    297 	* improved TDLS negotiation robustness
    298 	* added more TDLS peer parameters to be configured to the driver
    299 	* optimized connection time by allowing recently received scan results
    300 	  to be used instead of having to run through a new scan
    301 	* fixed ctrl_iface BSS command iteration with RANGE argument and no
    302 	  exact matches; also fixed argument parsing for some cases with
    303 	  multiple arguments
    304 	* added 'SCAN TYPE=ONLY' ctrl_iface command to request manual scan
    305 	  without executing roaming/network re-selection on scan results
    306 	* added Session-Id derivation for EAP peer methods
    307 	* added fully automated regression testing with mac80211_hwsim
    308 	* changed configuration parser to reject invalid integer values
    309 	* allow AP/Enrollee to be specified with BSSID instead of UUID for
    310 	  WPS ER operations
    311 	* disable network block temporarily on repeated connection failures
    312 	* changed the default driver interface from wext to nl80211 if both are
    313 	  included in the build
    314 	* remove duplicate networks if WPS provisioning is run multiple times
    315 	* remove duplicate networks when Interworking network selection uses the
    316 	  same network
    317 	* added global freq_list configuration to allow scan frequencies to be
    318 	  limited for all cases instead of just for a specific network block
    319 	* added support for BSS Transition Management
    320 	* added option to use "IFNAME=<ifname> " prefix to use the global
    321 	  control interface connection to perform per-interface commands;
    322 	  similarly, allow global control interface to be used as a monitor
    323 	  interface to receive events from all interfaces
    324 	* fixed OKC-based PMKSA cache entry clearing
    325 	* fixed TKIP group key configuration with FT
    326 	* added support for using OCSP stapling to validate server certificate
    327 	  (ocsp=1 as optional and ocsp=2 as mandatory)
    328 	* added EAP-EKE peer
    329 	* added peer restart detection for IBSS RSN
    330 	* added domain_suffix_match (and domain_suffix_match2 for Phase 2
    331 	  EAP-TLS) to specify additional constraint for the server certificate
    332 	  domain name
    333 	* added support for external SIM/USIM processing in EAP-SIM, EAP-AKA,
    334 	  and EAP-AKA' (CTRL-REQ-SIM and CTRL-RSP-SIM commands over control
    335 	  interface)
    336 	* added global bgscan configuration option as a default for all network
    337 	  blocks that do not specify their own bgscan parameters
    338 	* added D-Bus methods for TDLS
    339 	* added more control to scan requests
    340 	  - "SCAN freq=<freq list>" can be used to specify which channels are
    341 	    scanned (comma-separated frequency ranges in MHz)
    342 	  - "SCAN passive=1" can be used to request a passive scan (no Probe
    343 	    Request frames are sent)
    344 	  - "SCAN use_id" can be used to request a scan id to be returned and
    345 	    included in event messages related to this specific scan operation
    346 	  - "SCAN only_new=1" can be used to request the driver/cfg80211 to
    347 	    report only BSS entries that have been updated during this scan
    348 	    round
    349 	  - these optional arguments to the SCAN command can be combined with
    350 	    each other
    351 	* modified behavior on externally triggered scans
    352 	  - avoid concurrent operations requiring full control of the radio when
    353 	    an externally triggered scan is detected
    354 	  - do not use results for internal roaming decision
    355 	* added a new cred block parameter 'temporary' to allow credential
    356 	  blocks to be stored separately even if wpa_supplicant configuration
    357 	  file is used to maintain other network information
    358 	* added "radio work" framework to schedule exclusive radio operations
    359 	  for off-channel functionality
    360 	  - reduce issues with concurrent operations that try to control which
    361 	    channel is used
    362 	  - allow external programs to request exclusive radio control in a way
    363 	    that avoids conflicts with wpa_supplicant
    364 	* added support for using Protected Dual of Public Action frames for
    365 	  GAS/ANQP exchanges when associated with PMF
    366 	* added support for WPS+NFC updates and P2P+NFC
    367 	  - improved protocol for WPS
    368 	  - P2P group formation/join based on NFC connection handover
    369 	  - new IPv4 address assignment for P2P groups (ip_addr_* configuration
    370 	    parameters on the GO) to replace DHCP
    371 	  - option to fetch and report alternative carrier records for external
    372 	    NFC operations
    373 	* various bug fixes
    374 
    375 2013-01-12 - v2.0
    376 	* removed Qt3-based wpa_gui (obsoleted by wpa_qui-qt4)
    377 	* removed unmaintained driver wrappers broadcom, iphone, osx, ralink,
    378 	  hostap, madwifi (hostap and madwifi remain available for hostapd;
    379 	  their wpa_supplicant functionality is obsoleted by wext)
    380 	* improved debug logging (human readable event names, interface name
    381 	  included in more entries)
    382 	* changed AP mode behavior to enable WPS only for open and
    383 	  WPA/WPA2-Personal configuration
    384 	* improved P2P concurrency operations
    385 	  - better coordination of concurrent scan and P2P search operations
    386 	  - avoid concurrent remain-on-channel operation requests by canceling
    387 	    previous operations prior to starting a new one
    388 	  - reject operations that would require multi-channel concurrency if
    389 	    the driver does not support it
    390 	  - add parameter to select whether STA or P2P connection is preferred
    391 	    if the driver cannot support both at the same time
    392 	  - allow driver to indicate channel changes
    393 	  - added optional delay=<search delay in milliseconds> parameter for
    394 	    p2p_find to avoid taking all radio resources
    395 	  - use 500 ms p2p_find search delay by default during concurrent
    396 	    operations
    397 	  - allow all channels in GO Negotiation if the driver supports
    398 	    multi-channel concurrency
    399 	* added number of small changes to make it easier for static analyzers
    400 	  to understand the implementation
    401 	* fixed number of small bugs (see git logs for more details)
    402 	* nl80211: number of updates to use new cfg80211/nl80211 functionality
    403 	  - replace monitor interface with nl80211 commands for AP mode
    404 	  - additional information for driver-based AP SME
    405 	  - STA entry authorization in RSN IBSS
    406 	* EAP-pwd:
    407 	  - fixed KDF for group 21 and zero-padding
    408 	  - added support for fragmentation
    409 	  - increased maximum number of hunting-and-pecking iterations
    410 	* avoid excessive Probe Response retries for broadcast Probe Request
    411 	  frames (only with drivers using wpa_supplicant AP mode SME/MLME)
    412 	* added "GET country" ctrl_iface command
    413 	* do not save an invalid network block in wpa_supplicant.conf to avoid
    414 	  problems reading the file on next start
    415 	* send STA connected/disconnected ctrl_iface events to both the P2P
    416 	  group and parent interfaces
    417 	* added preliminary support for using TLS v1.2 (CONFIG_TLSV12=y)
    418 	* added "SET pno <1/0>" ctrl_iface command to start/stop preferred
    419 	  network offload with sched_scan driver command
    420 	* merged in number of changes from Android repository for P2P, nl80211,
    421 	  and build parameters
    422 	* changed P2P GO mode configuration to use driver capabilities to
    423 	  automatically enable HT operations when supported
    424 	* added "wpa_cli status wps" command to fetch WPA2-Personal passhrase
    425 	  for WPS use cases in AP mode
    426 	* EAP-AKA: keep pseudonym identity across EAP exchanges to match EAP-SIM
    427 	  behavior
    428 	* improved reassociation behavior in cases where association is rejected
    429 	  or when an AP disconnects us to handle common load balancing
    430 	  mechanisms
    431 	  - try to avoid extra scans when the needed information is available
    432 	* added optional "join" argument for p2p_prov_disc ctrl_iface command
    433 	* added group ifname to P2P-PROV-DISC-* events
    434 	* added P2P Device Address to AP-STA-DISCONNECTED event and use
    435 	  p2p_dev_addr parameter name with AP-STA-CONNECTED
    436 	* added workarounds for WPS PBC overlap detection for some P2P use cases
    437 	  where deployed stations work incorrectly
    438 	* optimize WPS connection speed by disconnecting prior to WPS scan and
    439 	  by using single channel scans when AP channel is known
    440 	* PCSC and SIM/USIM improvements:
    441 	  - accept 0x67 (Wrong length) as a response to READ RECORD to fix
    442 	    issues with some USIM cards
    443 	  - try to read MNC length from SIM/USIM
    444 	  - build realm according to 3GPP TS 23.003 with identity from the SIM
    445 	  - allow T1 protocol to be enabled
    446 	* added more WPS and P2P information available through D-Bus
    447 	* improve P2P negotiation robustness
    448 	  - extra waits to get ACK frames through
    449 	  - longer timeouts for cases where deployed devices have been
    450 	    identified have issues meeting the specification requirements
    451 	  - more retries for some P2P frames
    452 	  - handle race conditions in GO Negotiation start by both devices
    453 	  - ignore unexpected GO Negotiation Response frame
    454 	* added support for libnl 3.2 and newer
    455 	* added P2P persistent group info to P2P_PEER data
    456 	* maintain a list of P2P Clients for persistent group on GO
    457 	* AP: increased initial group key handshake retransmit timeout to 500 ms
    458 	* added optional dev_id parameter for p2p_find
    459 	* added P2P-FIND-STOPPED ctrl_iface event
    460 	* fixed issues in WPA/RSN element validation when roaming with ap_scan=1
    461 	  and driver-based BSS selection
    462 	* do not expire P2P peer entries while connected with the peer in a
    463 	  group
    464 	* fixed WSC element inclusion in cases where P2P is disabled
    465 	* AP: added a WPS workaround for mixed mode AP Settings with Windows 7
    466 	* EAP-SIM: fixed AT_COUNTER_TOO_SMALL use
    467 	* EAP-SIM/AKA: append realm to pseudonym identity
    468 	* EAP-SIM/AKA: store pseudonym identity in network configuration to
    469 	  allow it to persist over multiple EAP sessions and wpa_supplicant
    470 	  restarts
    471 	* EAP-AKA': updated to RFC 5448 (username prefixes changed); note: this
    472 	  breaks interoperability with older versions
    473 	* added support for WFA Hotspot 2.0
    474 	  - GAS/ANQP to fetch network information
    475 	  - credential configuration and automatic network selections based on
    476 	    credential match with ANQP information
    477 	* limited PMKSA cache entries to be used only with the network context
    478 	  that was used to create them
    479 	* improved PMKSA cache expiration to avoid unnecessary disconnections
    480 	* adjusted bgscan_simple fast-scan backoff to avoid too frequent
    481 	  background scans
    482 	* removed ctrl_iface event on P2P PD Response in join-group case
    483 	* added option to fetch BSS table entry based on P2P Device Address
    484 	  ("BSS p2p_dev_addr=<P2P Device Address>")
    485 	* added BSS entry age to ctrl_iface BSS command output
    486 	* added optional MASK=0xH option for ctrl_iface BSS command to select
    487 	  which fields are included in the response
    488 	* added optional RANGE=ALL|N1-N2 option for ctrl_iface BSS command to
    489 	  fetch information about several BSSes in one call
    490 	* simplified licensing terms by selecting the BSD license as the only
    491 	  alternative
    492 	* added "P2P_SET disallow_freq <freq list>" ctrl_iface command to
    493 	  disable channels from P2P use
    494 	* added p2p_pref_chan configuration parameter to allow preferred P2P
    495 	  channels to be specified
    496 	* added support for advertising immediate availability of a WPS
    497 	  credential for P2P use cases
    498 	* optimized scan operations for P2P use cases (use single channel scan
    499 	  for a specific SSID when possible)
    500 	* EAP-TTLS: fixed peer challenge generation for MSCHAPv2
    501 	* SME: do not use reassociation after explicit disconnection request
    502 	  (local or a notification from an AP)
    503 	* added support for sending debug info to Linux tracing (-T on command
    504 	  line)
    505 	* added support for using Deauthentication reason code 3 as an
    506 	  indication of P2P group termination
    507 	* added wps_vendor_ext_m1 configuration parameter to allow vendor
    508 	  specific attributes to be added to WPS M1
    509 	* started using separate TLS library context for tunneled TLS
    510 	  (EAP-PEAP/TLS, EAP-TTLS/TLS, EAP-FAST/TLS) to support different CA
    511 	  certificate configuration between Phase 1 and Phase 2
    512 	* added optional "auto" parameter for p2p_connect to request automatic
    513 	  GO Negotiation vs. join-a-group selection
    514 	* added disabled_scan_offload parameter to disable automatic scan
    515 	  offloading (sched_scan)
    516 	* added optional persistent=<network id> parameter for p2p_connect to
    517 	  allow forcing of a specific SSID/passphrase for GO Negotiation
    518 	* added support for OBSS scan requests and 20/40 BSS coexistence reports
    519 	* reject PD Request for unknown group
    520 	* removed scripts and notes related to Windows binary releases (which
    521 	  have not been used starting from 1.x)
    522 	* added initial support for WNM operations
    523 	  - Keep-alive based on BSS max idle period
    524 	  - WNM-Sleep Mode
    525 	  - minimal BSS Transition Management processing
    526 	* added autoscan module to control scanning behavior while not connected
    527 	  - autoscan_periodic and autoscan_exponential modules
    528 	* added new WPS NFC ctrl_iface mechanism
    529 	  - added initial support NFC connection handover
    530 	  - removed obsoleted WPS_OOB command (including support for deprecated
    531 	    UFD config_method)
    532 	* added optional framework for external password storage ("ext:<name>")
    533 	* wpa_cli: added optional support for controlling wpa_supplicant
    534 	  remotely over UDP (CONFIG_CTRL_IFACE=udp-remote) for testing purposes
    535 	* wpa_cli: extended tab completion to more commands
    536 	* changed SSID output to use printf-escaped strings instead of masking
    537 	  of non-ASCII characters
    538 	  - SSID can now be configured in the same format: ssid=P"abc\x00test"
    539 	* removed default ACM=1 from AC_VO and AC_VI
    540 	* added optional "ht40" argument for P2P ctrl_iface commands to allow
    541 	  40 MHz channels to be requested on the 5 GHz band
    542 	* added optional parameters for p2p_invite command to specify channel
    543 	  when reinvoking a persistent group as the GO
    544 	* improved FIPS mode builds with OpenSSL
    545 	  - "make fips" with CONFIG_FIPS=y to build wpa_supplicant with the
    546 	    OpenSSL FIPS object module
    547 	  - replace low level OpenSSL AES API calls to use EVP
    548 	  - use OpenSSL keying material exporter when possible
    549 	  - do not export TLS keys in FIPS mode
    550 	  - remove MD5 from CONFIG_FIPS=y builds
    551 	  - use OpenSSL function for PKBDF2 passphrase-to-PSK
    552 	  - use OpenSSL HMAC implementation
    553 	  - mix RAND_bytes() output into random_get_bytes() to force OpenSSL
    554 	    DRBG to be used in FIPS mode
    555 	  - use OpenSSL CMAC implementation
    556 	* added mechanism to disable TLS Session Ticket extension
    557 	  - a workaround for servers that do not support TLS extensions that
    558 	    was enabled by default in recent OpenSSL versions
    559 	  - tls_disable_session_ticket=1
    560 	  - automatically disable TLS Session Ticket extension by default when
    561 	    using EAP-TLS/PEAP/TTLS (i.e., only use it with EAP-FAST)
    562 	* changed VENDOR-TEST EAP method to use proper private enterprise number
    563 	  (this will not interoperate with older versions)
    564 	* disable network block temporarily on authentication failures
    565 	* improved WPS AP selection during WPS PIN iteration
    566 	* added support for configuring GCMP cipher for IEEE 802.11ad
    567 	* added support for Wi-Fi Display extensions
    568 	  - WFD_SUBELEMENT_SET ctrl_iface command to configure WFD subelements
    569 	  - SET wifi_display <0/1> to disable/enable WFD support
    570 	  - WFD service discovery
    571 	  - an external program is needed to manage the audio/video streaming
    572 	    and codecs
    573 	* optimized scan result use for network selection
    574 	  - use the internal BSS table instead of raw scan results
    575 	  - allow unnecessary scans to be skipped if fresh information is
    576 	    available (e.g., after GAS/ANQP round for Interworking)
    577 	* added support for 256-bit AES with internal TLS implementation
    578 	* allow peer to propose channel in P2P invitation process for a
    579 	  persistent group
    580 	* added disallow_aps parameter to allow BSSIDs/SSIDs to be disallowed
    581 	  from network selection
    582 	* re-enable the networks disabled during WPS operations
    583 	* allow P2P functionality to be disabled per interface (p2p_disabled=1)
    584 	* added secondary device types into P2P_PEER output
    585 	* added an option to disable use of a separate P2P group interface
    586 	  (p2p_no_group_iface=1)
    587 	* fixed P2P Bonjour SD to match entries with both compressed and not
    588 	  compressed domain name format and support multiple Bonjour PTR matches
    589 	  for the same key
    590 	* use deauthentication instead of disassociation for all disconnection
    591 	  operations; this removes the now unused disassociate() wpa_driver_ops
    592 	  callback
    593 	* optimized PSK generation on P2P GO by caching results to avoid
    594 	  multiple PBKDF2 operations
    595 	* added okc=1 global configuration parameter to allow OKC to be enabled
    596 	  by default for all network blocks
    597 	* added a workaround for WPS PBC session overlap detection to avoid
    598 	  interop issues with deployed station implementations that do not
    599 	  remove active PBC indication from Probe Request frames properly
    600 	* added basic support for 60 GHz band
    601 	* extend EAPOL frames processing workaround for roaming cases
    602 	  (postpone processing of unexpected EAPOL frame until association
    603 	  event to handle reordered events)
    604 
    605 2012-05-10 - v1.0
    606 	* bsd: Add support for setting HT values in IFM_MMASK.
    607 	* Delay STA entry removal until Deauth/Disassoc TX status in AP mode.
    608 	  This allows the driver to use PS buffering of Deauthentication and
    609 	  Disassociation frames when the STA is in power save sleep. Only
    610 	  available with drivers that provide TX status events for Deauth/
    611 	  Disassoc frames (nl80211).
    612 	* Drop oldest unknown BSS table entries first. This makes it less
    613 	  likely to hit connection issues in environments with huge number
    614 	  of visible APs.
    615 	* Add systemd support.
    616 	* Add support for setting the syslog facility from the config file
    617 	  at build time.
    618 	* atheros: Add support for IEEE 802.11w configuration.
    619 	* AP mode: Allow enable HT20 if driver supports it, by setting the
    620 	  config parameter ieee80211n.
    621 	* Allow AP mode to disconnect STAs based on low ACK condition (when
    622 	  the data connection is not working properly, e.g., due to the STA
    623 	  going outside the range of the AP). Disabled by default, enable by
    624 	  config option disassoc_low_ack.
    625 	* nl80211:
    626 	  - Support GTK rekey offload.
    627 	  - Support PMKSA candidate events. This adds support for RSN
    628 	    pre-authentication with nl80211 interface and drivers that handle
    629 	    roaming internally.
    630 	* dbus:
    631 	  - Add a DBus signal for EAP SM requests, emitted on the Interface
    632 	    object.
    633 	  - Export max scan ssids supported by the driver as MaxScanSSID.
    634 	  - Add signal Certification for information about server certification.
    635 	  - Add BSSExpireAge and BSSExpireCount interface properties and
    636 	    support set/get, which allows for setting BSS cache expiration age
    637 	    and expiration scan count.
    638 	  - Add ConfigFile to AddInterface properties.
    639 	  - Add Interface.Country property and support to get/set the value.
    640 	  - Add DBus property CurrentAuthMode.
    641 	  - P2P DBus API added.
    642 	  - Emit property changed events (for property BSSs) when adding/
    643 	    removing BSSs.
    644 	  - Treat '' in SSIDs of Interface.Scan as a request for broadcast
    645 	    scan, instead of ignoring it.
    646 	  - Add DBus getter/setter for FastReauth.
    647 	  - Raise PropertiesChanged on org.freedesktop.DBus.Properties.
    648 	* wpa_cli:
    649 	  - Send AP-STA-DISCONNECTED event when an AP disconnects a station
    650 	    due to inactivity.
    651 	  - Make second argument to set command optional. This can be used to
    652 	    indicate a zero length value.
    653 	  - Add signal_poll command.
    654 	  - Add bss_expire_age and bss_expire_count commands to set/get BSS
    655 	    cache expiration age and expiration scan count.
    656 	  - Add ability to set scan interval (the time in seconds wpa_s waits
    657 	    before requesting a new scan after failing to find a suitable
    658 	    network in scan results) using scan_interval command.
    659 	  - Add event CTRL-EVENT-ASSOC-REJECT for association rejected.
    660 	  - Add command get version, that returns wpa_supplicant version string.
    661 	  - Add command sta_autoconnect for disabling automatic reconnection
    662 	    on receiving disconnection event.
    663 	  - Setting bssid parameter to an empty string "" or any can now be
    664 	    used to clear the bssid_set flag in a network block, i.e., to remove
    665 	    bssid filtering.
    666 	  - Add tdls_testing command to add a special testing feature for
    667 	    changing TDLS behavior. Build param CONFIG_TDLS_TESTING must be
    668 	    enabled as well.
    669 	  - For interworking, add wpa_cli commands interworking_select,
    670 	    interworking_connect, anqp_get, fetch_anqp, and stop_fetch_anqp.
    671 	  - Many P2P commands were added. See README-P2P.
    672 	  - Many WPS/WPS ER commands - see WPS/WPS ER sections for details.
    673 	  - Allow set command to change global config parameters.
    674 	  - Add log_level command, which can be used to display the current
    675 	    debugging level and to change the log level during run time.
    676 	  - Add note command, which can be used to insert notes to the debug
    677 	    log.
    678 	  - Add internal line edit implementation. CONFIG_WPA_CLI_EDIT=y
    679 	    can now be used to build wpa_cli with internal implementation of
    680 	    line editing and history support. This can be used as a replacement
    681 	    for CONFIG_READLINE=y.
    682 	* AP mode: Add max_num_sta config option, which can be used to limit
    683 	  the number of stations allowed to connect to the AP.
    684 	* Add WPA_IGNORE_CONFIG_ERRORS build option to continue in case of bad
    685 	  config file.
    686 	* wext: Increase scan timeout from 5 to 10 seconds.
    687 	* Add blacklist command, allowing an external program to
    688 	  manage the BSS blacklist and display its current contents.
    689 	* WPS:
    690 	  - Add wpa_cli wps_pin get command for generating random PINs. This can
    691 	    be used in a UI to generate a PIN without starting WPS (or P2P)
    692 	    operation.
    693 	  - Set RF bands based on driver capabilities, instead of hardcoding
    694 	    them.
    695 	  - Add mechanism for indicating non-standard WPS errors.
    696 	  - Add CONFIG_WPS_REG_DISABLE_OPEN=y option to disable open networks
    697 	    by default.
    698 	  - Add wps_ap_pin cli command for wpa_supplicant AP mode.
    699 	  - Add wps_check_pin cli command for processing PIN from user input.
    700 	    UIs can use this command to process a PIN entered by a user and to
    701 	    validate the checksum digit (if present).
    702 	  - Cancel WPS operation on PBC session overlap detection.
    703 	  - New wps_cancel command in wpa_cli will cancel a pending WPS
    704 	    operation.
    705 	  - wpa_cli action: Add WPS_EVENT_SUCCESS and WPS_EVENT_FAIL handlers.
    706 	  - Trigger WPS config update on Manufacturer, Model Name, Model
    707 	    Number, and Serial Number changes.
    708 	  - Fragment size is now configurable for EAP-WSC peer. Use
    709 	    wpa_cli set wps_fragment_size <val>.
    710 	  - Disable AP PIN after 10 consecutive failures. Slow down attacks on
    711 	    failures up to 10.
    712 	  - Allow AP to start in Enrollee mode without AP PIN for probing, to
    713 	    be compatible with Windows 7.
    714 	  - Add Config Error into WPS-FAIL events to provide more info to the
    715 	    user on how to resolve the issue.
    716 	  - Label and Display config methods are not allowed to be enabled
    717 	    at the same time, since it is unclear which PIN to use if both
    718 	    methods are advertised.
    719 	  - When controlling multiple interfaces:
    720 	     - apply WPS commands to all interfaces configured to use WPS
    721 	     - apply WPS config changes to all interfaces that use WPS
    722 	     - when an attack is detected on any interface, disable AP PIN on
    723 	       all interfaces
    724 	* WPS ER:
    725 	  - Add special AP Setup Locked mode to allow read only ER.
    726 	    ap_setup_locked=2 can now be used to enable a special mode where
    727 	    WPS ER can learn the current AP settings, but cannot change them.
    728 	  - Show SetSelectedRegistrar events as ctrl_iface events
    729 	  - Add wps_er_set_config to enroll a network based on a local
    730 	    network configuration block instead of having to (re-)learn the
    731 	    current AP settings with wps_er_learn.
    732 	  - Allow AP filtering based on IP address, add ctrl_iface event for
    733 	    learned AP settings, add wps_er_config command to configure an AP.
    734 	* WPS 2.0: Add support for WPS 2.0 (CONFIG_WPS2)
    735 	  - Add build option CONFIG_WPS_EXTENSIBILITY_TESTING to enable tool
    736 	    for testing protocol extensibility.
    737 	  - Add build option CONFIG_WPS_STRICT to allow disabling of WPS
    738 	    workarounds.
    739 	  - Add support for AuthorizedMACs attribute.
    740 	* TDLS:
    741 	  - Propogate TDLS related nl80211 capability flags from kernel and
    742 	    add them as driver capability flags. If the driver doesn't support
    743 	    capabilities, assume TDLS is supported internally. When TDLS is
    744 	    explicitly not supported, disable all user facing TDLS operations.
    745 	  - Allow TDLS to be disabled at runtime (mostly for testing).
    746 	    Use set tdls_disabled.
    747 	  - Honor AP TDLS settings that prohibit/allow TDLS.
    748 	  - Add a special testing feature for changing TDLS behavior. Use
    749 	    CONFIG_TDLS_TESTING build param to enable. Configure at runtime
    750 	    with tdls_testing cli command.
    751 	  - Add support for TDLS 802.11z.
    752 	* wlantest: Add a tool wlantest for IEEE802.11 protocol testing.
    753 	  wlantest can be used to capture frames from a monitor interface
    754 	  for realtime capturing or from pcap files for offline analysis.
    755 	* Interworking: Support added for 802.11u. Enable in .config with
    756 	  CONFIG_INTERWORKING. See wpa_supplicant.conf for config parameters
    757 	  for interworking. wpa_cli commands added to support this are
    758 	  interworking_select, interworking_connect, anqp_get, fetch_anqp,
    759 	  and stop_fetch_anqp.
    760 	* Android: Add build and runtime support for Android wpa_supplicant.
    761 	* bgscan learn: Add new bgscan that learns BSS information based on
    762 	  previous scans, and uses that information to dynamically generate
    763 	  the list of channels for background scans.
    764 	* Add a new debug message level for excessive information. Use
    765 	  -ddd to enable.
    766 	* TLS: Add support for tls_disable_time_checks=1 in client mode.
    767 	* Internal TLS:
    768 	  - Add support for TLS v1.1 (RFC 4346). Enable with build parameter
    769 	    CONFIG_TLSV11.
    770 	  - Add domainComponent parser for X.509 names.
    771 	* Linux: Add RFKill support by adding an interface state "disabled".
    772 	* Reorder some IEs to get closer to IEEE 802.11 standard. Move
    773 	  WMM into end of Beacon, Probe Resp and (Re)Assoc Resp frames.
    774 	  Move HT IEs to be later in (Re)Assoc Resp.
    775 	* Solaris: Add support for wired 802.1X client.
    776 	* Wi-Fi Direct support. See README-P2P for more information.
    777 	* Many bugfixes.
    778 
    779 2010-04-18 - v0.7.2
    780 	* nl80211: fixed number of issues with roaming
    781 	* avoid unnecessary roaming if multiple APs with similar signal
    782 	  strength are present in scan results
    783 	* add TLS client events and server probing to ease design of
    784 	  automatic detection of EAP parameters
    785 	* add option for server certificate matching (SHA256 hash of the
    786 	  certificate) instead of trusted CA certificate configuration
    787 	* bsd: Cleaned up driver wrapper and added various low-level
    788 	  configuration options
    789 	* wpa_gui-qt4: do not show too frequent WPS AP available events as
    790 	  tray messages
    791 	* TNC: fixed issues with fragmentation
    792 	* EAP-TNC: add Flags field into fragment acknowledgement (needed to
    793 	  interoperate with other implementations; may potentially breaks
    794 	  compatibility with older wpa_supplicant/hostapd versions)
    795 	* wpa_cli: added option for using a separate process to receive event
    796 	  messages to reduce latency in showing these
    797 	  (CFLAGS += -DCONFIG_WPA_CLI_FORK=y in .config to enable this)
    798 	* maximum BSS table size can now be configured (bss_max_count)
    799 	* BSSes to be included in the BSS table can be filtered based on
    800 	  configured SSIDs to save memory (filter_ssids)
    801 	* fix number of issues with IEEE 802.11r/FT; this version is not
    802 	  backwards compatible with old versions
    803 	* nl80211: add support for IEEE 802.11r/FT protocol (both over-the-air
    804 	  and over-the-DS)
    805 	* add freq_list network configuration parameter to allow the AP
    806 	  selection to filter out entries based on the operating channel
    807 	* add signal strength change events for bgscan; this allows more
    808 	  dynamic changes to background scanning interval based on changes in
    809 	  the signal strength with the current AP; this improves roaming within
    810 	  ESS quite a bit, e.g., with bgscan="simple:30:-45:300" in the network
    811 	  configuration block to request background scans less frequently when
    812 	  signal strength remains good and to automatically trigger background
    813 	  scans whenever signal strength drops noticeably
    814 	  (this is currently only available with nl80211)
    815 	* add BSSID and reason code (if available) to disconnect event messages
    816 	* wpa_gui-qt4: more complete support for translating the GUI with
    817 	  linguist and add German translation
    818 	* fix DH padding with internal crypto code (mainly, for WPS)
    819 	* do not trigger initial scan automatically anymore if there are no
    820 	  enabled networks
    821 
    822 2010-01-16 - v0.7.1
    823 	* cleaned up driver wrapper API (struct wpa_driver_ops); the new API
    824 	  is not fully backwards compatible, so out-of-tree driver wrappers
    825 	  will need modifications
    826 	* cleaned up various module interfaces
    827 	* merge hostapd and wpa_supplicant developers' documentation into a
    828 	  single document
    829 	* nl80211: use explicit deauthentication to clear cfg80211 state to
    830 	  avoid issues when roaming between APs
    831 	* dbus: major design changes in the new D-Bus API
    832 	  (fi.w1.wpa_supplicant1)
    833 	* nl80211: added support for IBSS networks
    834 	* added internal debugging mechanism with backtrace support and memory
    835 	  allocation/freeing validation, etc. tests (CONFIG_WPA_TRACE=y)
    836 	* added WPS ER unsubscription command to more cleanly unregister from
    837 	  receiving UPnP events when ER is terminated
    838 	* cleaned up AP mode operations to avoid need for virtual driver_ops
    839 	  wrapper
    840 	* added BSS table to maintain more complete scan result information
    841 	  over multiple scans (that may include only partial results)
    842 	* wpa_gui-qt4: update Peers dialog information more dynamically while
    843 	  the dialog is kept open
    844 	* fixed PKCS#12 use with OpenSSL 1.0.0
    845 	* driver_wext: Added cfg80211-specific optimization to avoid some
    846 	  unnecessary scans and to speed up association
    847 
    848 2009-11-21 - v0.7.0
    849 	* increased wpa_cli ping interval to 5 seconds and made this
    850 	  configurable with a new command line options (-G<seconds>)
    851 	* fixed scan buffer processing with WEXT to handle up to 65535
    852 	  byte result buffer (previously, limited to 32768 bytes)
    853 	* allow multiple driver wrappers to be specified on command line
    854 	  (e.g., -Dnl80211,wext); the first one that is able to initialize the
    855 	  interface will be used
    856 	* added support for multiple SSIDs per scan request to optimize
    857 	  scan_ssid=1 operations in ap_scan=1 mode (i.e., search for hidden
    858 	  SSIDs); this requires driver support and can currently be used only
    859 	  with nl80211
    860 	* added support for WPS USBA out-of-band mechanism with USB Flash
    861 	  Drives (UFD) (CONFIG_WPS_UFD=y)
    862 	* driver_ndis: add PAE group address to the multicast address list to
    863 	  fix wired IEEE 802.1X authentication
    864 	* fixed IEEE 802.11r key derivation function to match with the standard
    865 	  (note: this breaks interoperability with previous version) [Bug 303]
    866 	* added better support for drivers that allow separate authentication
    867 	  and association commands (e.g., mac80211-based Linux drivers with
    868 	  nl80211; SME in wpa_supplicant); this allows over-the-air FT protocol
    869 	  to be used (IEEE 802.11r)
    870 	* fixed SHA-256 based key derivation function to match with the
    871 	  standard when using CCMP (for IEEE 802.11r and IEEE 802.11w)
    872 	  (note: this breaks interoperability with previous version) [Bug 307]
    873 	* use shared driver wrapper files with hostapd
    874 	* added AP mode functionality (CONFIG_AP=y) with mode=2 in the network
    875 	  block; this can be used for open and WPA2-Personal networks
    876 	  (optionally, with WPS); this links in parts of hostapd functionality
    877 	  into wpa_supplicant
    878 	* wpa_gui-qt4: added new Peers dialog to show information about peers
    879 	  (other devices, including APs and stations, etc. in the neighborhood)
    880 	* added support for WPS External Registrar functionality (configure APs
    881 	  and enroll new devices); can be used with wpa_gui-qt4 Peers dialog
    882 	  and wpa_cli commands wps_er_start, wps_er_stop, wps_er_pin,
    883 	  wps_er_pbc, wps_er_learn
    884 	  (this can also be used with a new 'none' driver wrapper if no
    885 	  wireless device or IEEE 802.1X on wired is needed)
    886 	* driver_nl80211: multiple updates to provide support for new Linux
    887 	  nl80211/mac80211 functionality
    888 	* updated management frame protection to use IEEE Std 802.11w-2009
    889 	* fixed number of small WPS issues and added workarounds to
    890 	  interoperate with common deployed broken implementations
    891 	* added support for NFC out-of-band mechanism with WPS
    892 	* driver_ndis: fixed wired IEEE 802.1X authentication with PAE group
    893 	  address frames
    894 	* added preliminary support for IEEE 802.11r RIC processing
    895 	* added support for specifying subset of enabled frequencies to scan
    896 	  (scan_freq option in the network configuration block); this can speed
    897 	  up scanning process considerably if it is known that only a small
    898 	  subset of channels is actually used in the network (this is currently
    899 	  supported only with -Dnl80211)
    900 	* added a workaround for race condition between receiving the
    901 	  association event and the following EAPOL-Key
    902 	* added background scan and roaming infrastructure to allow
    903 	  network-specific optimizations to be used to improve roaming within
    904 	  an ESS (same SSID)
    905 	* added new DBus interface (fi.w1.wpa_supplicant1)
    906 
    907 2009-01-06 - v0.6.7
    908 	* added support for Wi-Fi Protected Setup (WPS)
    909 	  (wpa_supplicant can now be configured to act as a WPS Enrollee to
    910 	  enroll credentials for a network using PIN and PBC methods; in
    911 	  addition, wpa_supplicant can act as a wireless WPS Registrar to
    912 	  configure an AP); WPS support can be enabled by adding CONFIG_WPS=y
    913 	  into .config and setting the runtime configuration variables in
    914 	  wpa_supplicant.conf (see WPS section in the example configuration
    915 	  file); new wpa_cli commands wps_pin, wps_pbc, and wps_reg are used to
    916 	  manage WPS negotiation; see README-WPS for more details
    917 	* added support for EAP-AKA' (draft-arkko-eap-aka-kdf)
    918 	* added support for using driver_test over UDP socket
    919 	* fixed PEAPv0 Cryptobinding interoperability issue with Windows Server
    920 	  2008 NPS; optional cryptobinding is now enabled (again) by default
    921 	* fixed PSK editing in wpa_gui
    922 	* changed EAP-GPSK to use the IANA assigned EAP method type 51
    923 	* added a Windows installer that includes WinPcap and all the needed
    924 	  DLLs; in addition, it set up the registry automatically so that user
    925 	  will only need start wpa_gui to get prompted to start the wpasvc
    926 	  servide and add a new interface if needed through wpa_gui dialog
    927 	* updated management frame protection to use IEEE 802.11w/D7.0
    928 
    929 2008-11-23 - v0.6.6
    930 	* added Milenage SIM/USIM emulator for EAP-SIM/EAP-AKA
    931 	  (can be used to simulate test SIM/USIM card with a known private key;
    932 	  enable with CONFIG_SIM_SIMULATOR=y/CONFIG_USIM_SIMULATOR=y in .config
    933 	  and password="Ki:OPc"/password="Ki:OPc:SQN" in network configuration)
    934 	* added a new network configuration option, wpa_ptk_rekey, that can be
    935 	  used to enforce frequent PTK rekeying, e.g., to mitigate some attacks
    936 	  against TKIP deficiencies
    937 	* added an optional mitigation mechanism for certain attacks against
    938 	  TKIP by delaying Michael MIC error reports by a random amount of time
    939 	  between 0 and 60 seconds; this can be enabled with a build option
    940 	  CONFIG_DELAYED_MIC_ERROR_REPORT=y in .config
    941 	* fixed EAP-AKA to use RES Length field in AT_RES as length in bits,
    942 	  not bytes
    943 	* updated OpenSSL code for EAP-FAST to use an updated version of the
    944 	  session ticket overriding API that was included into the upstream
    945 	  OpenSSL 0.9.9 tree on 2008-11-15 (no additional OpenSSL patch is
    946 	  needed with that version anymore)
    947 	* updated userspace MLME instructions to match with the current Linux
    948 	  mac80211 implementation; please also note that this can only be used
    949 	  with driver_nl80211.c (the old code from driver_wext.c was removed)
    950 	* added support (Linux only) for RoboSwitch chipsets (often found in
    951 	  consumer grade routers); driver interface 'roboswitch'
    952 	* fixed canceling of PMKSA caching when using drivers that generate
    953 	  RSN IE and refuse to drop PMKIDs that wpa_supplicant does not know
    954 	  about
    955 
    956 2008-11-01 - v0.6.5
    957 	* added support for SHA-256 as X.509 certificate digest when using the
    958 	  internal X.509/TLSv1 implementation
    959 	* updated management frame protection to use IEEE 802.11w/D6.0
    960 	* added support for using SHA256-based stronger key derivation for WPA2
    961 	  (IEEE 802.11w)
    962 	* fixed FT (IEEE 802.11r) authentication after a failed association to
    963 	  use correct FTIE
    964 	* added support for configuring Phase 2 (inner/tunneled) authentication
    965 	  method with wpa_gui-qt4
    966 
    967 2008-08-10 - v0.6.4
    968 	* added support for EAP Sequences in EAP-FAST Phase 2
    969 	* added support for using TNC with EAP-FAST
    970 	* added driver_ps3 for the PS3 Linux wireless driver
    971 	* added support for optional cryptobinding with PEAPv0
    972 	* fixed the OpenSSL patches (0.9.8g and 0.9.9) for EAP-FAST to
    973 	  allow fallback to full handshake if server rejects PAC-Opaque
    974 	* added fragmentation support for EAP-TNC
    975 	* added support for parsing PKCS #8 formatted private keys into the
    976 	  internal TLS implementation (both PKCS #1 RSA key and PKCS #8
    977 	  encapsulated RSA key can now be used)
    978 	* added option of using faster, but larger, routines in the internal
    979 	  LibTomMath (for internal TLS implementation) to speed up DH and RSA
    980 	  calculations (CONFIG_INTERNAL_LIBTOMMATH_FAST=y)
    981 	* fixed race condition between disassociation event and group key
    982 	  handshake to avoid getting stuck in incorrect state [Bug 261]
    983 	* fixed opportunistic key caching (proactive_key_caching)
    984 
    985 2008-02-22 - v0.6.3
    986 	* removed 'nai' and 'eappsk' network configuration variables that were
    987 	  previously used for configuring user identity and key for EAP-PSK,
    988 	  EAP-PAX, EAP-SAKE, and EAP-GPSK. 'identity' field is now used as the
    989 	  replacement for 'nai' (if old configuration used a separate
    990 	  'identity' value, that would now be configured as
    991 	  'anonymous_identity'). 'password' field is now used as the
    992 	  replacement for 'eappsk' (it can also be set using hexstring to
    993 	  present random binary data)
    994 	* removed '-w' command line parameter (wait for interface to be added,
    995 	  if needed); cleaner way of handling this functionality is to use an
    996 	  external mechanism (e.g., hotplug scripts) that start wpa_supplicant
    997 	  when an interface is added
    998 	* updated FT support to use the latest draft, IEEE 802.11r/D9.0
    999 	* added ctrl_iface monitor event (CTRL-EVENT-SCAN-RESULTS) for
   1000 	  indicating when new scan results become available
   1001 	* added new ctrl_iface command, BSS, to allow scan results to be
   1002 	  fetched without hitting the message size limits (this command
   1003 	  can be used to iterate through the scan results one BSS at the time)
   1004 	* fixed EAP-SIM not to include AT_NONCE_MT and AT_SELECTED_VERSION
   1005 	  attributes in EAP-SIM Start/Response when using fast reauthentication
   1006 	* fixed EAPOL not to end up in infinite loop when processing dynamic
   1007 	  WEP keys with IEEE 802.1X
   1008 	* fixed problems in getting NDIS events from WMI on Windows 2000
   1009 
   1010 2008-01-01 - v0.6.2
   1011 	* added support for Makefile builds to include debug-log-to-a-file
   1012 	  functionality (CONFIG_DEBUG_FILE=y and -f<path> on command line)
   1013 	* fixed EAP-SIM and EAP-AKA message parser to validate attribute
   1014 	  lengths properly to avoid potential crash caused by invalid messages
   1015 	* added data structure for storing allocated buffers (struct wpabuf);
   1016 	  this does not affect wpa_supplicant usage, but many of the APIs
   1017 	  changed and various interfaces (e.g., EAP) is not compatible with old
   1018 	  versions
   1019 	* added support for protecting EAP-AKA/Identity messages with
   1020 	  AT_CHECKCODE (optional feature in RFC 4187)
   1021 	* added support for protected result indication with AT_RESULT_IND for
   1022 	  EAP-SIM and EAP-AKA (phase1="result_ind=1")
   1023 	* added driver_wext workaround for race condition between scanning and
   1024 	  association with drivers that take very long time to scan all
   1025 	  channels (e.g., madwifi with dual-band cards); wpa_supplicant is now
   1026 	  using a longer hardcoded timeout for the scan if the driver supports
   1027 	  notifications for scan completion (SIOCGIWSCAN event); this helps,
   1028 	  e.g., in cases where wpa_supplicant and madwifi driver ended up in
   1029 	  loop where the driver did not even try to associate
   1030 	* stop EAPOL timer tick when no timers are in use in order to reduce
   1031 	  power consumption (no need to wake up the process once per second)
   1032 	  [Bug 237]
   1033 	* added support for privilege separation (run only minimal part of
   1034 	  wpa_supplicant functionality as root and rest as unprivileged,
   1035 	  non-root process); see 'Privilege separation' in README for details;
   1036 	  this is disabled by default and can be enabled with CONFIG_PRIVSEP=y
   1037 	  in .config
   1038 	* changed scan results data structure to include all information
   1039 	  elements to make it easier to support new IEs; old get_scan_result()
   1040 	  driver_ops is still supported for backwards compatibility (results
   1041 	  are converted internally to the new format), but all drivers should
   1042 	  start using the new get_scan_results2() to make them more likely to
   1043 	  work with new features
   1044 	* Qt4 version of wpa_gui (wpa_gui-qt4 subdirectory) is now native Qt4
   1045 	  application, i.e., it does not require Qt3Support anymore; Windows
   1046 	  binary of wpa_gui.exe is now from this directory and only requires
   1047 	  QtCore4.dll and QtGui4.dll libraries
   1048 	* updated Windows binary build to use Qt 4.3.3 and made Qt DLLs
   1049 	  available as a separate package to make wpa_gui installation easier:
   1050 	  http://w1.fi/wpa_supplicant/qt4/wpa_gui-qt433-windows-dll.zip
   1051 	* added support for EAP-IKEv2 (draft-tschofenig-eap-ikev2-15.txt);
   1052 	  only shared key/password authentication is supported in this version
   1053 
   1054 2007-11-24 - v0.6.1
   1055 	* added support for configuring password as NtPasswordHash
   1056 	  (16-byte MD4 hash of password) in hash:<32 hex digits> format
   1057 	* added support for fallback from abbreviated TLS handshake to
   1058 	  full handshake when using EAP-FAST (e.g., due to an expired
   1059 	  PAC-Opaque)
   1060 	* updated EAP Generalized Pre-Shared Key (EAP-GPSK) to use the latest
   1061 	  draft (draft-ietf-emu-eap-gpsk-07.txt)
   1062 	* added support for drivers that take care of RSN 4-way handshake
   1063 	  internally (WPA_DRIVER_FLAGS_4WAY_HANDSHAKE in get_capa flags and
   1064 	  WPA_ALG_PMK in set_key)
   1065 	* added an experimental port for Mac OS X (CONFIG_DRIVER_OSX=y in
   1066 	  .config); this version supports only ap_scan=2 mode and allow the
   1067 	  driver to take care of the 4-way handshake
   1068 	* fixed a buffer overflow in parsing TSF from scan results when using
   1069 	  driver_wext.c with a driver that includes the TSF (e.g., iwl4965)
   1070 	  [Bug 232]
   1071 	* updated FT support to use the latest draft, IEEE 802.11r/D8.0
   1072 	* fixed an integer overflow issue in the ASN.1 parser used by the
   1073 	  (experimental) internal TLS implementation to avoid a potential
   1074 	  buffer read overflow
   1075 	* fixed a race condition with -W option (wait for a control interface
   1076 	  monitor before starting) that could have caused the first messages to
   1077 	  be lost
   1078 	* added support for processing TNCC-TNCS-Messages to report
   1079 	  recommendation (allow/none/isolate) when using TNC [Bug 243]
   1080 
   1081 2007-05-28 - v0.6.0
   1082 	* added network configuration parameter 'frequency' for setting
   1083 	  initial channel for IBSS (adhoc) networks
   1084 	* added experimental IEEE 802.11r/D6.0 support
   1085 	* updated EAP-SAKE to RFC 4763 and the IANA-allocated EAP type 48
   1086 	* updated EAP-PSK to use the IANA-allocated EAP type 47
   1087 	* fixed EAP-PAX key derivation
   1088 	* fixed EAP-PSK bit ordering of the Flags field
   1089 	* fixed EAP-PEAP/TTLS/FAST to use the correct EAP identifier in
   1090 	  tunnelled identity request (previously, the identifier from the outer
   1091 	  method was used, not the tunnelled identifier which could be
   1092 	  different)
   1093 	* added support for fragmentation of outer TLS packets during Phase 2
   1094 	  of EAP-PEAP/TTLS/FAST
   1095 	* fixed EAP-TTLS AVP parser processing for too short AVP lengths
   1096 	* added support for EAP-FAST authentication with inner methods that
   1097 	  generate MSK (e.g., EAP-MSCHAPv2 that was previously only supported
   1098 	  for PAC provisioning)
   1099 	* added support for authenticated EAP-FAST provisioning
   1100 	* added support for configuring maximum number of EAP-FAST PACs to
   1101 	  store in a PAC list (fast_max_pac_list_len=<max> in phase1 string)
   1102 	* added support for storing EAP-FAST PACs in binary format
   1103 	  (fast_pac_format=binary in phase1 string)
   1104 	* fixed dbus ctrl_iface to validate message interface before
   1105 	  dispatching to avoid a possible segfault [Bug 190]
   1106 	* fixed PeerKey key derivation to use the correct PRF label
   1107 	* updated Windows binary build to link against OpenSSL 0.9.8d and
   1108 	  added support for EAP-FAST
   1109 	* updated EAP Generalized Pre-Shared Key (EAP-GPSK) to use the latest
   1110 	  draft (draft-ietf-emu-eap-gpsk-04.txt)
   1111 	* fixed EAP-AKA Notification processing to allow Notification to be
   1112 	  processed after AKA Challenge response has been sent
   1113 	* updated to use IEEE 802.11w/D2.0 for management frame protection
   1114 	  (still experimental)
   1115 	* fixed EAP-TTLS implementation not to crash on use of freed memory
   1116 	  if TLS library initialization fails
   1117 	* added support for EAP-TNC (Trusted Network Connect)
   1118 	  (this version implements the EAP-TNC method and EAP-TTLS changes
   1119 	  needed to run two methods in sequence (IF-T) and the IF-IMC and
   1120 	  IF-TNCCS interfaces from TNCC)
   1121 
   1122 2006-11-24 - v0.5.6
   1123 	* added experimental, integrated TLSv1 client implementation with the
   1124 	  needed X.509/ASN.1/RSA/bignum processing (this can be enabled by
   1125 	  setting CONFIG_TLS=internal and CONFIG_INTERNAL_LIBTOMMATH=y in
   1126 	  .config); this can be useful, e.g., if the target system does not
   1127 	  have a suitable TLS library and a minimal code size is required
   1128 	  (total size of this internal TLS/crypto code is bit under 50 kB on
   1129 	  x86 and the crypto code is shared by rest of the supplicant so some
   1130 	  of it was already required; TLSv1/X.509/ASN.1/RSA added about 25 kB)
   1131 	* removed STAKey handshake since PeerKey handshake has replaced it in
   1132 	  IEEE 802.11ma and there are no known deployments of STAKey
   1133 	* updated EAP Generalized Pre-Shared Key (EAP-GPSK) to use the latest
   1134 	  draft (draft-ietf-emu-eap-gpsk-01.txt)
   1135 	* added preliminary implementation of IEEE 802.11w/D1.0 (management
   1136 	  frame protection)
   1137 	  (Note: this requires driver support to work properly.)
   1138 	  (Note2: IEEE 802.11w is an unapproved draft and subject to change.)
   1139 	* fixed Windows named pipes ctrl_iface to not stop listening for
   1140 	  commands if client program opens a named pipe and closes it
   1141 	  immediately without sending a command
   1142 	* fixed USIM PIN status determination for the case that PIN is not
   1143 	  needed (this allows EAP-AKA to be used with USIM cards that do not
   1144 	  use PIN)
   1145 	* added support for reading 3G USIM AID from EF_DIR to allow EAP-AKA to
   1146 	  be used with cards that do not support file selection based on
   1147 	  partial AID
   1148 	* added support for matching the subjectAltName of the authentication
   1149 	  server certificate against multiple name components (e.g.,
   1150 	  altsubject_match="DNS:server.example.com;DNS:server2.example.com")
   1151 	* fixed EAP-SIM/AKA key derivation for re-authentication case (only
   1152 	  affects IEEE 802.1X with dynamic WEP keys)
   1153 	* changed ctrl_iface network configuration 'get' operations to not
   1154 	  return password/key material; if these fields are requested, "*"
   1155 	  will be returned if the password/key is set, but the value of the
   1156 	  parameter is not exposed
   1157 
   1158 2006-08-27 - v0.5.5
   1159 	* added support for building Windows version with UNICODE defined
   1160 	  (wide-char functions)
   1161 	* driver_ndis: fixed static WEP configuration to avoid race condition
   1162 	  issues with some NDIS drivers between association and setting WEP
   1163 	  keys
   1164 	* driver_ndis: added validation for IELength value in scan results to
   1165 	  avoid crashes when using buggy NDIS drivers [Bug 165]
   1166 	* fixed Release|Win32 target in the Visual Studio project files
   1167 	  (previously, only Debug|Win32 target was set properly)
   1168 	* changed control interface API call wpa_ctrl_pending() to allow it to
   1169 	  return -1 on error (e.g., connection lost); control interface clients
   1170 	  will need to make sure that they verify that the value is indeed >0
   1171 	  when determining whether there are pending messages
   1172 	* added an alternative control interface backend for Windows targets:
   1173 	  Named Pipe (CONFIG_CTRL_IFACE=named_pipe); this is now the default
   1174 	  control interface mechanism for Windows builds (previously, UDP to
   1175 	  localhost was used)
   1176 	* changed ctrl_interface configuration for UNIX domain sockets:
   1177 	  - deprecated ctrl_interface_group variable (it may be removed in
   1178 	    future versions)
   1179 	  - allow both directory and group be configured with ctrl_interface
   1180 	    in following format: DIR=/var/run/wpa_supplicant GROUP=wheel
   1181 	  - ctrl_interface=/var/run/wpa_supplicant is still supported for the
   1182 	    case when group is not changed
   1183 	* added support for controlling more than one interface per process in
   1184 	  Windows version
   1185 	* added a workaround for a case where the AP is using unknown address
   1186 	  (e.g., MAC address of the wired interface) as the source address for
   1187 	  EAPOL-Key frames; previously, that source address was used as the
   1188 	  destination for EAPOL-Key frames and in key derivation; now, BSSID is
   1189 	  used even if the source address does not match with it
   1190 	  (this resolves an interoperability issue with Thomson SpeedTouch 580)
   1191 	* added a workaround for UDP-based control interface (which was used in
   1192 	  Windows builds before this release) to prevent packets with forged
   1193 	  addresses from being accepted as local control requests
   1194 	* removed ndis_events.cpp and possibility of using external
   1195 	  ndis_events.exe; C version (ndis_events.c) is fully functional and
   1196 	  there is no desire to maintain two separate versions of this
   1197 	  implementation
   1198 	* ndis_events: Changed NDIS event notification design to use WMI to
   1199 	  learn the adapter description through Win32_PnPEntity class; this
   1200 	  should fix some cases where the adapter name was not recognized
   1201 	  correctly (e.g., with some USB WLAN adapters, e.g., Ralink RT2500
   1202 	  USB) [Bug 113]
   1203 	* fixed selection of the first network in ap_scan=2 mode; previously,
   1204 	  wpa_supplicant could get stuck in SCANNING state when only the first
   1205 	  network for enabled (e.g., after 'wpa_cli select_network 0')
   1206 	* winsvc: added support for configuring ctrl_interface parameters in
   1207 	  registry (ctrl_interface string value in
   1208 	  HKLM\SOFTWARE\wpa_supplicant\interfaces\0000 key); this new value is
   1209 	  required to enable control interface (previously, this was hardcoded
   1210 	  to be enabled)
   1211 	* allow wpa_gui subdirectory to be built with both Qt3 and Qt4
   1212 	* converted wpa_gui-qt4 subdirectory to use Qt4 specific project format
   1213 
   1214 2006-06-20 - v0.5.4
   1215 	* fixed build with CONFIG_STAKEY=y [Bug 143]
   1216 	* added support for doing MLME (IEEE 802.11 management frame
   1217 	  processing) in wpa_supplicant when using Devicescape IEEE 802.11
   1218 	  stack (wireless-dev.git tree)
   1219 	* added a new network block configuration option, fragment_size, to
   1220 	  configure the maximum EAP fragment size
   1221 	* driver_ndis: Disable WZC automatically for the selected interface to
   1222 	  avoid conflicts with two programs trying to control the radio; WZC
   1223 	  will be re-enabled (if it was enabled originally) when wpa_supplicant
   1224 	  is terminated
   1225 	* added an experimental TLSv1 client implementation
   1226 	  (CONFIG_TLS=internal) that can be used instead of an external TLS
   1227 	  library, e.g., to reduce total size requirement on systems that do
   1228 	  not include any TLS library by default (this is not yet complete;
   1229 	  basic functionality is there, but certificate validation is not yet
   1230 	  included)
   1231 	* added PeerKey handshake implementation for IEEE 802.11e
   1232 	  direct link setup (DLS) to replace STAKey handshake
   1233 	* fixed WPA PSK update through ctrl_iface for the case where the old
   1234 	  PSK was derived from an ASCII passphrase and the new PSK is set as
   1235 	  a raw PSK (hex string)
   1236 	* added new configuration option for identifying which network block
   1237 	  was used (id_str in wpa_supplicant.conf; included on
   1238 	  WPA_EVENT_CONNECT monitor event and as WPA_ID_STR environmental
   1239 	  variable in wpa_cli action scripts; in addition WPA_ID variable is
   1240 	  set to the current unique identifier that wpa_supplicant assigned
   1241 	  automatically for the network and that can be used with
   1242 	  GET_NETWORK/SET_NETWORK ctrl_iface commands)
   1243 	* wpa_cli action script is now called only when the connect/disconnect
   1244 	  status changes or when associating with a different network
   1245 	* fixed configuration parser not to remove CCMP from group cipher list
   1246 	  if WPA-None (adhoc) is used (pairwise=NONE in that case)
   1247 	* fixed integrated NDIS events processing not to hang the process due
   1248 	  to a missed change in eloop_win.c API in v0.5.3 [Bug 155]
   1249 	* added support for EAP Generalized Pre-Shared Key (EAP-GPSK,
   1250 	  draft-clancy-emu-eap-shared-secret-00.txt)
   1251 	* added Microsoft Visual Studio 2005 solution and project files for
   1252 	  build wpa_supplicant for Windows (see vs2005 subdirectory)
   1253 	* eloop_win: fixed unregistration of Windows events
   1254 	* l2_packet_winpcap: fixed a deadlock in deinitializing l2_packet
   1255 	  at the end of RSN pre-authentication and added unregistration of
   1256 	  a Windows event to avoid getting eloop_win stuck with an invalid
   1257 	  handle
   1258 	* driver_ndis: added support for selecting AP based on BSSID
   1259 	* added new environmental variable for wpa_cli action scripts:
   1260 	  WPA_CTRL_DIR is the current control interface directory
   1261 	* driver_ndis: added support for using NDISUIO instead of WinPcap for
   1262 	  OID set/query operations (CONFIG_USE_NDISUIO=y in .config); with new
   1263 	  l2_packet_ndis (CONFIG_L2_PACKET=ndis), this can be used to build
   1264 	  wpa_supplicant without requiring WinPcap; note that using NDISUIO
   1265 	  requires that WZC is disabled (net stop wzcsvc) since NDISUIO allows
   1266 	  only one application to open the device
   1267 	* changed NDIS driver naming to only include device GUID, e.g.,
   1268 	  {7EE3EFE5-C165-472F-986D-F6FBEDFE8C8D}, instead of including WinPcap
   1269 	  specific \Device\NPF_ prefix before the GUID; the prefix is still
   1270 	  allowed for backwards compatibility, but it is not required anymore
   1271 	  when specifying the interface
   1272 	* driver_ndis: re-initialize driver interface is the adapter is removed
   1273 	  and re-inserted [Bug 159]
   1274 	* driver_madwifi: fixed TKIP and CCMP sequence number configuration on
   1275 	  big endian hosts [Bug 146]
   1276 
   1277 2006-04-27 - v0.5.3
   1278 	* fixed EAP-GTC response to include correct user identity when run as
   1279 	  phase 2 method of EAP-FAST (i.e., EAP-FAST did not work in v0.5.2)
   1280 	* driver_ndis: Fixed encryption mode configuration for unencrypted
   1281 	  networks (some NDIS drivers ignored this, but others, e.g., Broadcom,
   1282 	  refused to associate with open networks) [Bug 106]
   1283 	* driver_ndis: use BSSID OID polling to detect when IBSS network is
   1284 	  formed even when ndis_events code is included since some NDIS drivers
   1285 	  do not generate media connect events in IBSS mode
   1286 	* config_winreg: allow global ctrl_interface parameter to be configured
   1287 	  in Windows registry
   1288 	* config_winreg: added support for saving configuration data into
   1289 	  Windows registry
   1290 	* added support for controlling network device operational state
   1291 	  (dormant/up) for Linux 2.6.17 to improve DHCP processing (see
   1292 	  http://www.flamewarmaster.de/software/dhcpclient/ for a DHCP client
   1293 	  that can use this information)
   1294 	* driver_wext: added support for WE-21 change to SSID configuration
   1295 	* driver_wext: fixed privacy configuration for static WEP keys mode
   1296 	  [Bug 140]
   1297 	* added an optional driver_ops callback for MLME-SETPROTECTION.request
   1298 	  primitive
   1299 	* added support for EAP-SAKE (no EAP method number allocated yet, so
   1300 	  this is using the same experimental type 255 as EAP-PSK)
   1301 	* added support for dynamically loading EAP methods (.so files) instead
   1302 	  of requiring them to be statically linked in; this is disabled by
   1303 	  default (see CONFIG_DYNAMIC_EAP_METHODS in defconfig for information
   1304 	  on how to use this)
   1305 
   1306 2006-03-19 - v0.5.2
   1307 	* do not try to use USIM APDUs when initializing PC/SC for SIM card
   1308 	  access for a network that has not enabled EAP-AKA
   1309 	* fixed EAP phase 2 Nak for EAP-{PEAP,TTLS,FAST} (this was broken in
   1310 	  v0.5.1 due to the new support for expanded EAP types)
   1311 	* added support for generating EAP Expanded Nak
   1312 	* try to fetch scan results once before requesting new scan when
   1313 	  starting up in ap_scan=1 mode (this can speed up initial association
   1314 	  a lot with, e.g., madwifi-ng driver)
   1315 	* added support for receiving EAPOL frames from a Linux bridge
   1316 	  interface (-bbr0 on command line)
   1317 	* fixed EAPOL re-authentication for sessions that used PMKSA caching
   1318 	* changed EAP method registration to use a dynamic list of methods
   1319 	  instead of a static list generated at build time
   1320 	* fixed PMKSA cache deinitialization not to use freed memory when
   1321 	  removing PMKSA entries
   1322 	* fixed a memory leak in EAP-TTLS re-authentication
   1323 	* reject WPA/WPA2 message 3/4 if it does not include any valid
   1324 	  WPA/RSN IE
   1325 	* driver_wext: added fallback to use SIOCSIWENCODE for setting auth_alg
   1326 	  if the driver does not support SIOCSIWAUTH
   1327 
   1328 2006-01-29 - v0.5.1
   1329 	* driver_test: added better support for multiple APs and STAs by using
   1330 	  a directory with sockets that include MAC address for each device in
   1331 	  the name (driver_param=test_dir=/tmp/test)
   1332 	* added support for EAP expanded type (vendor specific EAP methods)
   1333 	* added AP_SCAN command into ctrl_iface so that ap_scan configuration
   1334 	  option can be changed if needed
   1335 	* wpa_cli/wpa_gui: skip non-socket files in control directory when
   1336 	  using UNIX domain sockets; this avoids selecting an incorrect
   1337 	  interface (e.g., a PID file could be in this directory, even though
   1338 	  use of this directory for something else than socket files is not
   1339 	  recommended)
   1340 	* fixed TLS library deinitialization after RSN pre-authentication not
   1341 	  to disable TLS library for normal authentication
   1342 	* driver_wext: Remove null-termination from SSID length if the driver
   1343 	  used it; some Linux drivers do this and they were causing problems in
   1344 	  wpa_supplicant not finding matching configuration block. This change
   1345 	  would break a case where the SSID actually ends in '\0', but that is
   1346 	  not likely to happen in real use.
   1347 	* fixed PMKSA cache processing not to trigger deauthentication if the
   1348 	  current PMKSA cache entry is replaced with a valid new entry
   1349 	* fixed PC/SC initialization for ap_scan != 1 modes (this fixes
   1350 	  EAP-SIM and EAP-AKA with real SIM/USIM card when using ap_scan=0 or
   1351 	  ap_scan=2)
   1352 
   1353 2005-12-18 - v0.5.0 (beginning of 0.5.x development releases)
   1354 	* added experimental STAKey handshake implementation for IEEE 802.11e
   1355 	  direct link setup (DLS); note: this is disabled by default in both
   1356 	  build and runtime configuration (can be enabled with CONFIG_STAKEY=y
   1357 	  and stakey=1)
   1358 	* fixed EAP-SIM and EAP-AKA pseudonym and fast re-authentication to
   1359 	  decrypt AT_ENCR_DATA attributes correctly
   1360 	* fixed EAP-AKA to allow resynchronization within the same session
   1361 	* made code closer to ANSI C89 standard to make it easier to port to
   1362 	  other C libraries and compilers
   1363 	* started moving operating system or C library specific functions into
   1364 	  wrapper functions defined in os.h and implemented in os_*.c to make
   1365 	  code more portable
   1366 	* wpa_supplicant can now be built with Microsoft Visual C++
   1367 	  (e.g., with the freely available Toolkit 2003 version or Visual
   1368 	  C++ 2005 Express Edition and Platform SDK); see nmake.mak for an
   1369 	  example makefile for nmake
   1370 	* added support for using Windows registry for command line parameters
   1371 	  (CONFIG_MAIN=main_winsvc) and configuration data
   1372 	  (CONFIG_BACKEND=winreg); see win_example.reg for an example registry
   1373 	  contents; this version can be run both as a Windows service and as a
   1374 	  normal application; 'wpasvc.exe app' to start as applicant,
   1375 	  'wpasvc.exe reg <full path to wpasvc.exe>' to register a service,
   1376 	  'net start wpasvc' to start the service, 'wpasvc.exe unreg' to
   1377 	  unregister a service
   1378 	* made it possible to link ndis_events.exe functionality into
   1379 	  wpa_supplicant.exe by defining CONFIG_NDIS_EVENTS_INTEGRATED
   1380 	* added better support for multiple control interface backends
   1381 	  (CONFIG_CTRL_IFACE option); currently, 'unix' and 'udp' are supported
   1382 	* fixed PC/SC code to use correct length for GSM AUTH command buffer
   1383 	  and to not use pioRecvPci with SCardTransmit() calls; these were not
   1384 	  causing visible problems with pcsc-lite, but Windows Winscard.dll
   1385 	  refused the previously used parameters; this fixes EAP-SIM and
   1386 	  EAP-AKA authentication using SIM/USIM card under Windows
   1387 	* added new event loop implementation for Windows using
   1388 	  WaitForMultipleObject() instead of select() in order to allow waiting
   1389 	  for non-socket objects; this can be selected with
   1390 	  CONFIG_ELOOP=eloop_win in .config
   1391 	* added support for selecting l2_packet implementation in .config
   1392 	  (CONFIG_L2_PACKET; following options are available now: linux, pcap,
   1393 	  winpcap, freebsd, none)
   1394 	* added new l2_packet implementation for WinPcap
   1395 	  (CONFIG_L2_PACKET=winpcap) that uses a separate receive thread to
   1396 	  reduce latency in EAPOL receive processing from about 100 ms to about
   1397 	  3 ms
   1398 	* added support for EAP-FAST key derivation using other ciphers than
   1399 	  RC4-128-SHA for authentication and AES128-SHA for provisioning
   1400 	* added support for configuring CA certificate as DER file and as a
   1401 	  configuration blob
   1402 	* fixed private key configuration as configuration blob and added
   1403 	  support for using PKCS#12 as a blob
   1404 	* tls_gnutls: added support for using PKCS#12 files; added support for
   1405 	  session resumption
   1406 	* added support for loading trusted CA certificates from Windows
   1407 	  certificate store: ca_cert="cert_store://<name>", where <name> is
   1408 	  likely CA (Intermediate CA certificates) or ROOT (root certificates)
   1409 	* added C version of ndis_events.cpp and made it possible to build this
   1410 	  with MinGW so that CONFIG_NDIS_EVENTS_INTEGRATED can be used more
   1411 	  easily on cross-compilation builds
   1412 	* added wpasvc.exe into Windows binary release; this is an alternative
   1413 	  version of wpa_supplicant.exe with configuration backend using
   1414 	  Windows registry and with the entry point designed to run as a
   1415 	  Windows service
   1416 	* integrated ndis_events.exe functionality into wpa_supplicant.exe and
   1417 	  wpasvc.exe and removed this additional tool from the Windows binary
   1418 	  release since it is not needed anymore
   1419 	* load winscard.dll functions dynamically when building with MinGW
   1420 	  since MinGW does not yet include winscard library
   1421 
   1422 2005-11-20 - v0.4.7 (beginning of 0.4.x stable releases)
   1423 	* l2_packet_pcap: fixed wired IEEE 802.1X authentication with libpcap
   1424 	  and WinPcap to receive frames sent to PAE group address
   1425 	* disable EAP state machine when IEEE 802.1X authentication is not used
   1426 	  in order to get rid of bogus "EAP failed" messages
   1427 	* fixed OpenSSL error reporting to go through all pending errors to
   1428 	  avoid confusing reports of old errors being reported at later point
   1429 	  during handshake
   1430 	* fixed configuration file updating to not write empty variables
   1431 	  (e.g., proto or key_mgmt) that the file parser would not accept
   1432 	* fixed ADD_NETWORK ctrl_iface command to use the same default values
   1433 	  for variables as empty network definitions read from config file
   1434 	  would get
   1435 	* fixed EAP state machine to not discard EAP-Failure messages in many
   1436 	  cases (e.g., during TLS handshake)
   1437 	* fixed a infinite loop in private key reading if the configured file
   1438 	  cannot be parsed successfully
   1439 	* driver_madwifi: added support for madwifi-ng
   1440 	* wpa_gui: do not display password/PSK field contents
   1441 	* wpa_gui: added CA certificate configuration
   1442 	* driver_ndis: fixed scan request in ap_scan=2 mode not to change SSID
   1443 	* driver_ndis: include Beacon IEs in AssocInfo in order to notice if
   1444 	  the new AP is using different WPA/RSN IE
   1445 	* use longer timeout for IEEE 802.11 association to avoid problems with
   1446 	  drivers that may take more than five second to associate
   1447 
   1448 2005-10-27 - v0.4.6
   1449 	* allow fallback to WPA, if mixed WPA+WPA2 networks have mismatch in
   1450 	  RSN IE, but WPA IE would match with wpa_supplicant configuration
   1451 	* added support for named configuration blobs in order to avoid having
   1452 	  to use file system for external files (e.g., certificates);
   1453 	  variables can be set to "blob://<blob name>" instead of file path to
   1454 	  use a named blob; supported fields: pac_file, client_cert,
   1455 	  private_key
   1456 	* fixed RSN pre-authentication (it was broken in the clean up of WPA
   1457 	  state machine interface in v0.4.5)
   1458 	* driver_madwifi: set IEEE80211_KEY_GROUP flag for group keys to make
   1459 	  sure the driver configures broadcast decryption correctly
   1460 	* added ca_path (and ca_path2) configuration variables that can be used
   1461 	  to configure OpenSSL CA path, e.g., /etc/ssl/certs, for using the
   1462 	  system-wide trusted CA list
   1463 	* added support for starting wpa_supplicant without a configuration
   1464 	  file (-C argument must be used to set ctrl_interface parameter for
   1465 	  this case; in addition, -p argument can be used to provide
   1466 	  driver_param; these new arguments can also be used with a
   1467 	  configuration to override the values from the configuration)
   1468 	* added global control interface that can be optionally used for adding
   1469 	  and removing network interfaces dynamically (-g command line argument
   1470 	  for both wpa_supplicant and wpa_cli) without having to restart
   1471 	  wpa_supplicant process
   1472 	* wpa_gui:
   1473 	  - try to save configuration whenever something is modified
   1474 	  - added WEP key configuration
   1475 	  - added possibility to edit the current network configuration
   1476 	* driver_ndis: fixed driver polling not to increase frequency on each
   1477 	  received EAPOL frame due to incorrectly cancelled timeout
   1478 	* added simple configuration file examples (in examples subdirectory)
   1479 	* fixed driver_wext.c to filter wireless events based on ifindex to
   1480 	  avoid interfaces receiving events from other interfaces
   1481 	* delay sending initial EAPOL-Start couple of seconds to speed up
   1482 	  authentication for the most common case of Authenticator starting
   1483 	  EAP authentication immediately after association
   1484 
   1485 2005-09-25 - v0.4.5
   1486 	* added a workaround for clearing keys with ndiswrapper to allow
   1487 	  roaming from WPA enabled AP to plaintext one
   1488 	* added docbook documentation (doc/docbook) that can be used to
   1489 	  generate, e.g., man pages
   1490 	* l2_packet_linux: use socket type SOCK_DGRAM instead of SOCK_RAW for
   1491 	  PF_PACKET in order to prepare for network devices that do not use
   1492 	  Ethernet headers (e.g., network stack with native IEEE 802.11 frames)
   1493 	* use receipt of EAPOL-Key frame as a lower layer success indication
   1494 	  for EAP state machine to allow recovery from dropped EAP-Success
   1495 	  frame
   1496 	* cleaned up internal EAPOL frame processing by not including link
   1497 	  layer (Ethernet) header during WPA and EAPOL/EAP processing; this
   1498 	  header is added only when transmitted the frame; this makes it easier
   1499 	  to use wpa_supplicant on link layers that use different header than
   1500 	  Ethernet
   1501 	* updated EAP-PSK to use draft 9 by default since this can now be
   1502 	  tested with hostapd; removed support for draft 3, including
   1503 	  server_nai configuration option from network blocks
   1504 	* driver_wired: add PAE address to the multicast address list in order
   1505 	  to be able to receive EAPOL frames with drivers that do not include
   1506 	  these multicast addresses by default
   1507 	* driver_wext: add support for WE-19
   1508 	* added support for multiple configuration backends (CONFIG_BACKEND
   1509 	  option); currently, only 'file' is supported (i.e., the format used
   1510 	  in wpa_supplicant.conf)
   1511 	* added support for updating configuration ('wpa_cli save_config');
   1512 	  this is disabled by default and can be enabled with global
   1513 	  update_config=1 variable in wpa_supplicant.conf; this allows wpa_cli
   1514 	  and wpa_gui to store the configuration changes in a permanent store
   1515 	* added GET_NETWORK ctrl_iface command
   1516 	  (e.g., 'wpa_cli get_network 0 ssid')
   1517 
   1518 2005-08-21 - v0.4.4
   1519 	* replaced OpenSSL patch for EAP-FAST support
   1520 	  (openssl-tls-extensions.patch) with a more generic and correct
   1521 	  patch (the new patch is not compatible with the previous one, so the
   1522 	  OpenSSL library will need to be patched with the new patch in order
   1523 	  to be able to build wpa_supplicant with EAP-FAST support)
   1524 	* added support for using Windows certificate store (through CryptoAPI)
   1525 	  for client certificate and private key operations (EAP-TLS)
   1526 	  (see wpa_supplicant.conf for more information on how to configure
   1527 	  this with private_key)
   1528 	* ported wpa_gui to Windows
   1529 	* added Qt4 version of wpa_gui (wpa_gui-qt4 directory); this can be
   1530 	  built with the open source version of the Qt4 for Windows
   1531 	* allow non-WPA modes (e.g., IEEE 802.1X with dynamic WEP) to be used
   1532 	  with drivers that do not support WPA
   1533 	* ndis_events: fixed Windows 2000 support
   1534 	* added support for enabling/disabling networks from the list of all
   1535 	  configured networks ('wpa_cli enable_network <network id>' and
   1536 	  'wpa_cli disable_network <network id>')
   1537 	* added support for adding and removing network from the current
   1538 	  configuration ('wpa_cli add_network' and 'wpa_cli remove_network
   1539 	  <network id>'); added networks are disabled by default and they can
   1540 	  be enabled with enable_network command once the configuration is done
   1541 	  for the new network; note: configuration file is not yet updated, so
   1542 	  these new networks are lost when wpa_supplicant is restarted
   1543 	* added support for setting network configuration parameters through
   1544 	  the control interface, for example:
   1545 	  wpa_cli set_network 0 ssid "\"my network\""
   1546 	* fixed parsing of strings that include both " and # within double
   1547 	  quoted area (e.g., "start"#end")
   1548 	* added EAP workaround for PEAP session resumption: allow outer,
   1549 	  i.e., not tunneled, EAP-Success to terminate session since; this can
   1550 	  be disabled with eap_workaround=0
   1551 	  (this was allowed for PEAPv1 before, but now it is also allowed for
   1552 	  PEAPv0 since at least one RADIUS authentication server seems to be
   1553 	  doing this for PEAPv0, too)
   1554 	* wpa_gui: added preliminary support for adding new networks to the
   1555 	  wpa_supplicant configuration (double click on the scan results to
   1556 	  open network configuration)
   1557 
   1558 2005-06-26 - v0.4.3
   1559 	* removed interface for external EAPOL/EAP supplicant (e.g.,
   1560 	  Xsupplicant), (CONFIG_XSUPPLICANT_IFACE) since it is not required
   1561 	  anymore and is unlikely to be used by anyone
   1562 	* driver_ndis: fixed WinPcap 3.0 support
   1563 	* fixed build with CONFIG_DNET_PCAP=y on Linux
   1564 	* l2_packet: moved different implementations into separate files
   1565 	  (l2_packet_*.c)
   1566 
   1567 2005-06-12 - v0.4.2
   1568 	* driver_ipw: updated driver structures to match with ipw2200-1.0.4
   1569 	  (note: ipw2100-1.1.0 is likely to require an update to work with
   1570 	  this)
   1571 	* added support for using ap_scan=2 mode with multiple network blocks;
   1572 	  wpa_supplicant will go through the networks one by one until the
   1573 	  driver reports a successful association; this uses the same order for
   1574 	  networks as scan_ssid=1 scans, i.e., the priority field is ignored
   1575 	  and the network block order in the file is used instead
   1576 	* fixed a potential issue in RSN pre-authentication ending up using
   1577 	  freed memory if pre-authentication times out
   1578 	* added support for matching alternative subject name extensions of the
   1579 	  authentication server certificate; new configuration variables
   1580 	  altsubject_match and altsubject_match2
   1581 	* driver_ndis: added support for IEEE 802.1X authentication with wired
   1582 	  NDIS drivers
   1583 	* added support for querying private key password (EAP-TLS) through the
   1584 	  control interface (wpa_cli/wpa_gui) if one is not included in the
   1585 	  configuration file
   1586 	* driver_broadcom: fixed couple of memory leaks in scan result
   1587 	  processing
   1588 	* EAP-PAX is now registered as EAP type 46
   1589 	* fixed EAP-PAX MAC calculation
   1590 	* fixed EAP-PAX CK and ICK key derivation
   1591 	* added support for using password with EAP-PAX (as an alternative to
   1592 	  entering key with eappsk); SHA-1 hash of the password will be used as
   1593 	  the key in this case
   1594 	* added support for arbitrary driver interface parameters through the
   1595 	  configuration file with a new driver_param field; this adds a new
   1596 	  driver_ops function set_param()
   1597 	* added possibility to override l2_packet module with driver interface
   1598 	  API (new send_eapol handler); this can be used to implement driver
   1599 	  specific TX/RX functions for EAPOL frames
   1600 	* fixed ctrl_interface_group processing for the case where gid is
   1601 	  entered as a number, not group name
   1602 	* driver_test: added support for testing hostapd with wpa_supplicant
   1603 	  by using test driver interface without any kernel drivers or network
   1604 	  cards
   1605 
   1606 2005-05-22 - v0.4.1
   1607 	* driver_madwifi: fixed WPA/WPA2 mode configuration to allow EAPOL
   1608 	  packets to be encrypted; this was apparently broken by the changed
   1609 	  ioctl order in v0.4.0
   1610 	* driver_madwifi: added preliminary support for compiling against 'BSD'
   1611 	  branch of madwifi CVS tree
   1612 	* added support for EAP-MSCHAPv2 password retries within the same EAP
   1613 	  authentication session
   1614 	* added support for password changes with EAP-MSCHAPv2 (used when the
   1615 	  password has expired)
   1616 	* added support for reading additional certificates from PKCS#12 files
   1617 	  and adding them to the certificate chain
   1618 	* fixed association with IEEE 802.1X (no WPA) when dynamic WEP keys
   1619 	  were used
   1620 	* fixed a possible double free in EAP-TTLS fast-reauthentication when
   1621 	  identity or password is entered through control interface
   1622 	* display EAP Notification messages to user through control interface
   1623 	  with "CTRL-EVENT-EAP-NOTIFICATION" prefix
   1624 	* added GUI version of wpa_cli, wpa_gui; this is not build
   1625 	  automatically with 'make'; use 'make wpa_gui' to build (this requires
   1626 	  Qt development tools)
   1627 	* added 'disconnect' command to control interface for setting
   1628 	  wpa_supplicant in state where it will not associate before
   1629 	  'reassociate' command has been used
   1630 	* added support for selecting a network from the list of all configured
   1631 	  networks ('wpa_cli select_network <network id>'; this disabled all
   1632 	  other networks; to re-enable, 'wpa_cli select_network any')
   1633 	* added support for getting scan results through control interface
   1634 	* added EAP workaround for PEAPv1 session resumption: allow outer,
   1635 	  i.e., not tunneled, EAP-Success to terminate session since; this can
   1636 	  be disabled with eap_workaround=0
   1637 
   1638 2005-04-25 - v0.4.0 (beginning of 0.4.x development releases)
   1639 	* added a new build time option, CONFIG_NO_STDOUT_DEBUG, that can be
   1640 	  used to reduce the size of the wpa_supplicant considerably if
   1641 	  debugging code is not needed
   1642 	* fixed EAPOL-Key validation to drop packets with invalid Key Data
   1643 	  Length; such frames could have crashed wpa_supplicant due to buffer
   1644 	  overflow
   1645 	* added support for wired authentication (IEEE 802.1X on wired
   1646 	  Ethernet); driver interface 'wired'
   1647 	* obsoleted set_wpa() handler in the driver interface API (it can be
   1648 	  replaced by moving enable/disable functionality into init()/deinit())
   1649 	  (calls to set_wpa() are still present for backwards compatibility,
   1650 	  but they may be removed in the future)
   1651 	* driver_madwifi: fixed association in plaintext mode
   1652 	* modified the EAP workaround that accepts EAP-Success with incorrect
   1653 	  Identifier to be even less strict about verification in order to
   1654 	  interoperate with some authentication servers
   1655 	* added support for sending TLS alerts
   1656 	* added support for 'any' SSID wildcard; if ssid is not configured or
   1657 	  is set to an empty string, any SSID will be accepted for non-WPA AP
   1658 	* added support for asking PIN (for SIM) from frontends (e.g.,
   1659 	  wpa_cli); if a PIN is needed, but not included in the configuration
   1660 	  file, a control interface request is sent and EAP processing is
   1661 	  delayed until the PIN is available
   1662 	* added support for using external devices (e.g., a smartcard) for
   1663 	  private key operations in EAP-TLS (CONFIG_SMARTCARD=y in .config);
   1664 	  new wpa_supplicant.conf variables:
   1665 	  - global: opensc_engine_path, pkcs11_engine_path, pkcs11_module_path
   1666 	  - network: engine, engine_id, key_id
   1667 	* added experimental support for EAP-PAX
   1668 	* added monitor mode for wpa_cli (-a<path to a program to run>) that
   1669 	  allows external commands (e.g., shell scripts) to be run based on
   1670 	  wpa_supplicant events, e.g., when authentication has been completed
   1671 	  and data connection is ready; other related wpa_cli arguments:
   1672 	  -B (run in background), -P (write PID file); wpa_supplicant has a new
   1673 	  command line argument (-W) that can be used to make it wait until a
   1674 	  control interface command is received in order to avoid missing
   1675 	  events
   1676 	* added support for opportunistic WPA2 PMKSA key caching (disabled by
   1677 	  default, can be enabled with proactive_key_caching=1)
   1678 	* fixed RSN IE in 4-Way Handshake message 2/4 for the case where
   1679 	  Authenticator rejects PMKSA caching attempt and the driver is not
   1680 	  using assoc_info events
   1681 	* added -P<pid file> argument for wpa_supplicant to write the current
   1682 	  process id into a file
   1683 
   1684 2005-02-12 - v0.3.7 (beginning of 0.3.x stable releases)
   1685 	* added new phase1 option parameter, include_tls_length=1, to force
   1686 	  wpa_supplicant to add TLS Message Length field to all TLS messages
   1687 	  even if the packet is not fragmented; this may be needed with some
   1688 	  authentication servers
   1689 	* fixed WPA/RSN IE verification in message 3 of 4-Way Handshake when
   1690 	  using drivers that take care of AP selection (e.g., when using
   1691 	  ap_scan=2)
   1692 	* fixed reprocessing of pending request after ctrl_iface requests for
   1693 	  identity/password/otp
   1694 	* fixed ctrl_iface requests for identity/password/otp in Phase 2 of
   1695 	  EAP-PEAP and EAP-TTLS
   1696 	* all drivers using driver_wext: set interface up and select Managed
   1697 	  mode when starting wpa_supplicant; set interface down when exiting
   1698 	* renamed driver_ipw2100.c to driver_ipw.c since it now supports both
   1699 	  ipw2100 and ipw2200; please note that this also changed the
   1700 	  configuration variable in .config to CONFIG_DRIVER_IPW
   1701 
   1702 2005-01-24 - v0.3.6
   1703 	* fixed a busy loop introduced in v0.3.5 for scan result processing
   1704 	  when no matching AP is found
   1705 
   1706 2005-01-23 - v0.3.5
   1707 	* added a workaround for an interoperability issue with a Cisco AP
   1708 	  when using WPA2-PSK
   1709 	* fixed non-WPA IEEE 802.1X to use the same authentication timeout as
   1710 	  WPA with IEEE 802.1X (i.e., timeout 10 -> 70 sec to allow
   1711 	  retransmission of dropped frames)
   1712 	* fixed issues with 64-bit CPUs and SHA1 cleanup in previous version
   1713 	  (e.g., segfault when processing EAPOL-Key frames)
   1714 	* fixed EAP workaround and fast reauthentication configuration for
   1715 	  RSN pre-authentication; previously these were disabled and
   1716 	  pre-authentication would fail if the used authentication server
   1717 	  requires EAP workarounds
   1718 	* added support for blacklisting APs that fail or timeout
   1719 	  authentication in ap_scan=1 mode so that all APs are tried in cases
   1720 	  where the ones with strongest signal level are failing authentication
   1721 	* fixed CA certificate loading after a failed EAP-TLS/PEAP/TTLS
   1722 	  authentication attempt
   1723 	* allow EAP-PEAP/TTLS fast reauthentication only if Phase 2 succeeded
   1724 	  in the previous authentication (previously, only Phase 1 success was
   1725 	  verified)
   1726 
   1727 2005-01-09 - v0.3.4
   1728 	* added preliminary support for IBSS (ad-hoc) mode configuration
   1729 	  (mode=1 in network block); this included a new key_mgmt mode
   1730 	  WPA-NONE, i.e., TKIP or CCMP with a fixed key (based on psk) and no
   1731 	  key management; see wpa_supplicant.conf for more details and an
   1732 	  example on how to configure this (note: this is currently implemented
   1733 	  only for driver_hostapd.c, but the changes should be trivial to add
   1734 	  in associate() handler for other drivers, too (assuming the driver
   1735 	  supports WPA-None)
   1736 	* added preliminary port for native Windows (i.e., no cygwin) using
   1737 	  mingw
   1738 
   1739 2005-01-02 - v0.3.3
   1740 	* added optional support for GNU Readline and History Libraries for
   1741 	  wpa_cli (CONFIG_READLINE)
   1742 	* cleaned up EAP state machine <-> method interface and number of
   1743 	  small problems with error case processing not terminating on
   1744 	  EAP-Failure but waiting for timeout
   1745 	* added couple of workarounds for interoperability issues with a
   1746 	  Cisco AP when using WPA2
   1747 	* added support for EAP-FAST (draft-cam-winget-eap-fast-00.txt);
   1748 	  Note: This requires a patch for openssl to add support for TLS
   1749 	  extensions and number of workarounds for operations without
   1750 	  certificates. Proof of concept type of experimental patch is
   1751 	  included in openssl-tls-extensions.patch.
   1752 
   1753 2004-12-19 - v0.3.2
   1754 	* fixed private key loading for cases where passphrase is not set
   1755 	* fixed Windows/cygwin L2 packet handler freeing; previous version
   1756 	  could cause a segfault when RSN pre-authentication was completed
   1757 	* added support for PMKSA caching with drivers that generate RSN IEs
   1758 	  (e.g., NDIS); currently, this is only implemented in driver_ndis.c,
   1759 	  but similar code can be easily added to driver_ndiswrapper.c once
   1760 	  ndiswrapper gets full support for RSN PMKSA caching
   1761 	* improved recovery from PMKID mismatches by requesting full EAP
   1762 	  authentication in case of failed PMKSA caching attempt
   1763 	* driver_ndis: added support for NDIS NdisMIncidateStatus() events
   1764 	  (this requires that ndis_events is ran while wpa_supplicant is
   1765 	  running)
   1766 	* driver_ndis: use ADD_WEP/REMOVE_WEP when configuring WEP keys
   1767 	* added support for driver interfaces to replace the interface name
   1768 	  based on driver/OS specific mapping, e.g., in case of driver_ndis,
   1769 	  this allows the beginning of the adapter description to be used as
   1770 	  the interface name
   1771 	* added support for CR+LF (Windows-style) line ends in configuration
   1772 	  file
   1773 	* driver_ndis: enable radio before starting scanning, disable radio
   1774 	  when exiting
   1775 	* modified association event handler to set portEnabled = FALSE before
   1776 	  clearing port Valid in order to reset EAP state machine and avoid
   1777 	  problems with new authentication getting ignored because of state
   1778 	  machines ending up in AUTHENTICATED/SUCCESS state based on old
   1779 	  information
   1780 	* added support for driver events to add PMKID candidates in order to
   1781 	  allow drivers to give priority to most likely roaming candidates
   1782 	* driver_hostap: moved PrivacyInvoked configuration to associate()
   1783 	  function so that this will not be set for plaintext connections
   1784 	* added KEY_MGMT_802_1X_NO_WPA as a new key_mgmt type so that driver
   1785 	  interface can distinguish plaintext and IEEE 802.1X (no WPA)
   1786 	  authentication
   1787 	* fixed static WEP key configuration to use broadcast/default type for
   1788 	  all keys (previously, the default TX key was configured as pairwise/
   1789 	  unicast key)
   1790 	* driver_ndis: added legacy WPA capability detection for non-WPA2
   1791 	  drivers
   1792 	* added support for setting static WEP keys for IEEE 802.1X without
   1793 	  dynamic WEP keying (eapol_flags=0)
   1794 
   1795 2004-12-12 - v0.3.1
   1796 	* added support for reading PKCS#12 (PFX) files (as a replacement for
   1797 	  PEM/DER) to get certificate and private key (CONFIG_PKCS12)
   1798 	* fixed compilation with CONFIG_PCSC=y
   1799 	* added new ap_scan mode, ap_scan=2, for drivers that take care of
   1800 	  association, but need to be configured with security policy and SSID,
   1801 	  e.g., ndiswrapper and NDIS driver; this mode should allow such
   1802 	  drivers to work with hidden SSIDs and optimized roaming; when
   1803 	  ap_scan=2 is used, only the first network block in the configuration
   1804 	  file is used and this configuration should have explicit security
   1805 	  policy (i.e., only one option in the lists) for key_mgmt, pairwise,
   1806 	  group, proto variables
   1807 	* added experimental port of wpa_supplicant for Windows
   1808 	  - driver_ndis.c driver interface (NDIS OIDs)
   1809 	  - currently, this requires cygwin and WinPcap
   1810 	  - small utility, win_if_list, can be used to get interface name
   1811 	* control interface can now be removed at build time; add
   1812 	  CONFIG_CTRL_IFACE=y to .config to maintain old functionality
   1813 	* optional Xsupplicant interface can now be removed at build time;
   1814 	  (CONFIG_XSUPPLICANT_IFACE=y in .config to bring it back)
   1815 	* added auth_alg to driver interface associate() parameters to make it
   1816 	  easier for drivers to configure authentication algorithm as part of
   1817 	  the association
   1818 
   1819 2004-12-05 - v0.3.0 (beginning of 0.3.x development releases)
   1820 	* driver_broadcom: added new driver interface for Broadcom wl.o driver
   1821 	  (a generic driver for Broadcom IEEE 802.11a/g cards)
   1822 	* wpa_cli: fixed parsing of -p <path> command line argument
   1823 	* PEAPv1: fixed tunneled EAP-Success reply handling to reply with TLS
   1824 	  ACK, not tunneled EAP-Success (of which only the first byte was
   1825 	  actually send due to a bug in previous code); this seems to
   1826 	  interoperate with most RADIUS servers that implements PEAPv1
   1827 	* PEAPv1: added support for terminating PEAP authentication on tunneled
   1828 	  EAP-Success message; this can be configured by adding
   1829 	  peap_outer_success=0 on phase1 parameters in wpa_supplicant.conf
   1830 	  (some RADIUS servers require this whereas others require a tunneled
   1831 	  reply
   1832 	* PEAPv1: changed phase1 option peaplabel to use default to 0, i.e., to
   1833 	  the old label for key derivation; previously, the default was 1,
   1834 	  but it looks like most existing PEAPv1 implementations use the old
   1835 	  label which is thus more suitable default option
   1836 	* added support for EAP-PSK (draft-bersani-eap-psk-03.txt)
   1837 	* fixed parsing of wep_tx_keyidx
   1838 	* added support for configuring list of allowed Phase 2 EAP types
   1839 	  (for both EAP-PEAP and EAP-TTLS) instead of only one type
   1840 	* added support for configuring IEEE 802.11 authentication algorithm
   1841 	  (auth_alg; mainly for using Shared Key authentication with static
   1842 	  WEP keys)
   1843 	* added support for EAP-AKA (with UMTS SIM)
   1844 	* fixed couple of errors in PCSC handling that could have caused
   1845 	  random-looking errors for EAP-SIM
   1846 	* added support for EAP-SIM pseudonyms and fast re-authentication
   1847 	* added support for EAP-TLS/PEAP/TTLS fast re-authentication (TLS
   1848 	  session resumption)
   1849 	* added support for EAP-SIM with two challanges
   1850 	  (phase1="sim_min_num_chal=3" can be used to require three challenges)
   1851 	* added support for configuring DH/DSA parameters for an ephemeral DH
   1852 	  key exchange (EAP-TLS/PEAP/TTLS) using new configuration parameters
   1853 	  dh_file and dh_file2 (phase 2); this adds support for using DSA keys
   1854 	  and optional DH key exchange to achieve forward secracy with RSA keys
   1855 	* added support for matching subject of the authentication server
   1856 	  certificate with a substring when using EAP-TLS/PEAP/TTLS; new
   1857 	  configuration variables subject_match and subject_match2
   1858 	* changed SSID configuration in driver_wext.c (used by many driver
   1859 	  interfaces) to use ssid_len+1 as the length for SSID since some Linux
   1860 	  drivers expect this
   1861 	* fixed couple of unaligned reads in scan result parsing to fix WPA
   1862 	  connection on some platforms (e.g., ARM)
   1863 	* added driver interface for Intel ipw2100 driver
   1864 	* added support for LEAP with WPA
   1865 	* added support for larger scan results report (old limit was 4 kB of
   1866 	  data, i.e., about 35 or so APs) when using Linux wireless extensions
   1867 	  v17 or newer
   1868 	* fixed a bug in PMKSA cache processing: skip sending of EAPOL-Start
   1869 	  only if there is a PMKSA cache entry for the current AP
   1870 	* fixed error handling for case where reading of scan results fails:
   1871 	  must schedule a new scan or wpa_supplicant will remain waiting
   1872 	  forever
   1873 	* changed debug output to remove shared password/key material by
   1874 	  default; all key information can be included with -K command line
   1875 	  argument to match the previous behavior
   1876 	* added support for timestamping debug log messages (disabled by
   1877 	  default, can be enabled with -t command line argument)
   1878 	* set pairwise/group cipher suite for non-WPA IEEE 802.1X to WEP-104
   1879 	  if keys are not configured to be used; this fixes IEEE 802.1X mode
   1880 	  with drivers that use this information to configure whether Privacy
   1881 	  bit can be in Beacon frames (e.g., ndiswrapper)
   1882 	* avoid clearing driver keys if no keys have been configured since last
   1883 	  key clear request; this seems to improve reliability of group key
   1884 	  handshake for ndiswrapper & NDIS driver which seems to be suffering
   1885 	  of some kind of timing issue when the keys are cleared again after
   1886 	  association
   1887 	* changed driver interface API:
   1888 	  - WPA_SUPPLICANT_DRIVER_VERSION define can be used to determine which
   1889 	    version is being used (now, this is set to 2; previously, it was
   1890 	    not defined)
   1891 	  - pass pointer to private data structure to all calls
   1892 	  - the new API is not backwards compatible; all in-tree driver
   1893 	    interfaces has been converted to the new API
   1894 	* added support for controlling multiple interfaces (radios) per
   1895 	  wpa_supplicant process; each interface needs to be listed on the
   1896 	  command line (-c, -i, -D arguments) with -N as a separator
   1897 	  (-cwpa1.conf -iwlan0 -Dhostap -N -cwpa2.conf -iath0 -Dmadwifi)
   1898 	* added a workaround for EAP servers that incorrectly use same Id for
   1899 	  sequential EAP packets
   1900 	* changed libpcap/libdnet configuration to use .config variable,
   1901 	  CONFIG_DNET_PCAP, instead of requiring Makefile modification
   1902 	* improved downgrade attack detection in IE verification of msg 3/4:
   1903 	  verify both WPA and RSN IEs, if present, not only the selected one;
   1904 	  reject the AP if an RSN IE is found in msg 3/4, but not in Beacon or
   1905 	  Probe Response frame, and RSN is enabled in wpa_supplicant
   1906 	  configuration
   1907 	* fixed WPA msg 3/4 processing to allow Key Data field contain other
   1908 	  IEs than just one WPA IE
   1909 	* added support for FreeBSD and driver interface for the BSD net80211
   1910 	  layer (CONFIG_DRIVER_BSD=y in .config); please note that some of the
   1911 	  required kernel mods have not yet been committed
   1912 	* made EAP workarounds configurable; enabled by default, can be
   1913 	  disabled with network block option eap_workaround=0
   1914 
   1915 2004-07-17 - v0.2.4 (beginning of 0.2.x stable releases)
   1916 	* resolved couple of interoperability issues with EAP-PEAPv1 and
   1917 	  Phase 2 (inner EAP) fragment reassembly
   1918 	* driver_madwifi: fixed WEP key configuration for IEEE 802.1X when the
   1919 	  AP is using non-zero key index for the unicast key and key index zero
   1920 	  for the broadcast key
   1921 	* driver_hostap: fixed IEEE 802.1X WEP key updates and
   1922 	  re-authentication by allowing unencrypted EAPOL frames when not using
   1923 	  WPA
   1924 	* added a new driver interface, 'wext', which uses only standard,
   1925 	  driver independent functionality in Linux wireless extensions;
   1926 	  currently, this can be used only for non-WPA IEEE 802.1X mode, but
   1927 	  eventually, this is to be extended to support full WPA/WPA2 once
   1928 	  Linux wireless extensions get support for this
   1929 	* added support for mode in which the driver is responsible for AP
   1930 	  scanning and selection; this is disabled by default and can be
   1931 	  enabled with global ap_scan=0 variable in wpa_supplicant.conf;
   1932 	  this mode can be used, e.g., with generic 'wext' driver interface to
   1933 	  use wpa_supplicant as IEEE 802.1X Supplicant with any Linux driver
   1934 	  supporting wireless extensions.
   1935 	* driver_madwifi: fixed WPA2 configuration and scan_ssid=1 (e.g.,
   1936 	  operation with an AP that does not include SSID in the Beacon frames)
   1937 	* added support for new EAP authentication methods:
   1938 	  EAP-TTLS/EAP-OTP, EAP-PEAPv0/OTP, EAP-PEAPv1/OTP, EAP-OTP
   1939 	* added support for asking one-time-passwords from frontends (e.g.,
   1940 	  wpa_cli); this 'otp' command works otherwise like 'password' command,
   1941 	  but the password is used only once and the frontend will be asked for
   1942 	  a new password whenever a request from authenticator requires a
   1943 	  password; this can be used with both EAP-OTP and EAP-GTC
   1944 	* changed wpa_cli to automatically re-establish connection so that it
   1945 	  does not need to be re-started when wpa_supplicant is terminated and
   1946 	  started again
   1947 	* improved user data (identity/password/otp) requests through
   1948 	  frontends: process pending EAPOL packets after getting new
   1949 	  information so that full authentication does not need to be
   1950 	  restarted; in addition, send pending requests again whenever a new
   1951 	  frontend is attached
   1952 	* changed control frontends to use a new directory for socket files to
   1953 	  make it easier for wpa_cli to automatically select between interfaces
   1954 	  and to provide access control for the control interface;
   1955 	  wpa_supplicant.conf: ctrl_interface is now a path
   1956 	  (/var/run/wpa_supplicant is the recommended path) and
   1957 	  ctrl_interface_group can be used to select which group gets access to
   1958 	  the control interface;
   1959 	  wpa_cli: by default, try to connect to the first interface available
   1960 	  in /var/run/wpa_supplicant; this path can be overriden with -p option
   1961 	  and an interface can be selected with -i option (i.e., in most common
   1962 	  cases, wpa_cli does not need to get any arguments)
   1963 	* added support for LEAP
   1964 	* added driver interface for Linux ndiswrapper
   1965 	* added priority option for network blocks in the configuration file;
   1966 	  this allows networks to be grouped based on priority (the scan
   1967 	  results are searched for matches with network blocks in this order)
   1968 
   1969 2004-06-20 - v0.2.3
   1970 	* sort scan results to improve AP selection
   1971 	* fixed control interface socket removal for some error cases
   1972 	* improved scan requesting and authentication timeout
   1973 	* small improvements/bug fixes for EAP-MSCHAPv2, EAP-PEAP, and
   1974 	  TLS processing
   1975 	* PEAP version can now be forced with phase1="peapver=<ver>"
   1976 	  (mostly for testing; by default, the highest version supported by
   1977 	  both the Supplicant and Authentication Server is selected
   1978 	  automatically)
   1979 	* added support for madwifi driver (Atheros ar521x)
   1980 	* added a workaround for cases where AP sets Install Tx/Rx bit for
   1981 	  WPA Group Key messages when pairwise keys are used (without this,
   1982 	  the Group Key would be used for Tx and the AP would drop frames
   1983 	  from the station)
   1984 	* added GSM SIM/USIM interface for GSM authentication algorithm for
   1985 	  EAP-SIM; this requires pcsc-lite
   1986 	* added support for ATMEL AT76C5XXx driver
   1987 	* fixed IEEE 802.1X WEP key derivation in the case where Authenticator
   1988 	  does not include key data in the EAPOL-Key frame (i.e., part of
   1989 	  EAP keying material is used as data encryption key)
   1990 	* added support for using plaintext and static WEP networks
   1991 	  (key_mgmt=NONE)
   1992 
   1993 2004-05-31 - v0.2.2
   1994 	* added support for new EAP authentication methods:
   1995 	  EAP-TTLS/EAP-MD5-Challenge
   1996 	  EAP-TTLS/EAP-GTC
   1997 	  EAP-TTLS/EAP-MSCHAPv2
   1998 	  EAP-TTLS/EAP-TLS
   1999 	  EAP-TTLS/MSCHAPv2
   2000 	  EAP-TTLS/MSCHAP
   2001 	  EAP-TTLS/PAP
   2002 	  EAP-TTLS/CHAP
   2003 	  EAP-PEAP/TLS
   2004 	  EAP-PEAP/GTC
   2005 	  EAP-PEAP/MD5-Challenge
   2006 	  EAP-GTC
   2007 	  EAP-SIM (not yet complete; needs GSM/SIM authentication interface)
   2008 	* added support for anonymous identity (to be used when identity is
   2009 	  sent in plaintext; real identity will be used within TLS protected
   2010 	  tunnel (e.g., with EAP-TTLS)
   2011 	* added event messages from wpa_supplicant to frontends, e.g., wpa_cli
   2012 	* added support for requesting identity and password information using
   2013 	  control interface; in other words, the password for EAP-PEAP or
   2014 	  EAP-TTLS does not need to be included in the configuration file since
   2015 	  a frontand (e.g., wpa_cli) can ask it from the user
   2016 	* improved RSN pre-authentication to use a candidate list and process
   2017 	  all candidates from each scan; not only one per scan
   2018 	* fixed RSN IE and WPA IE capabilities field parsing
   2019 	* ignore Tx bit in GTK IE when Pairwise keys are used
   2020 	* avoid making new scan requests during IEEE 802.1X negotiation
   2021 	* use openssl/libcrypto for MD5 and SHA-1 when compiling wpa_supplicant
   2022 	  with TLS support (this replaces the included implementation with
   2023 	  library code to save about 8 kB since the library code is needed
   2024 	  anyway for TLS)
   2025 	* fixed WPA-PSK only mode when compiled without IEEE 802.1X support
   2026 	  (i.e., without CONFIG_IEEE8021X_EAPOL=y in .config)
   2027 
   2028 2004-05-06 - v0.2.1
   2029 	* added support for internal IEEE 802.1X (actually, IEEE 802.1aa/D6.1)
   2030 	  Supplicant
   2031 	  - EAPOL state machines for Supplicant [IEEE 802.1aa/D6.1]
   2032 	  - EAP peer state machine [draft-ietf-eap-statemachine-02.pdf]
   2033 	  - EAP-MD5 (cannot be used with WPA-RADIUS)
   2034 	    [draft-ietf-eap-rfc2284bis-09.txt]
   2035 	  - EAP-TLS [RFC 2716]
   2036 	  - EAP-MSCHAPv2 (currently used only with EAP-PEAP)
   2037 	  - EAP-PEAP/MSCHAPv2 [draft-josefsson-pppext-eap-tls-eap-07.txt]
   2038 	    [draft-kamath-pppext-eap-mschapv2-00.txt]
   2039 	    (PEAP version 0, 1, and parts of 2; only 0 and 1 are enabled by
   2040 	    default; tested with FreeRADIUS, Microsoft IAS, and Funk Odyssey)
   2041 	  - new configuration file options: eap, identity, password, ca_cert,
   2042 	    client_cert, privatekey, private_key_passwd
   2043 	  - Xsupplicant is not required anymore, but it can be used by
   2044 	    disabling the internal IEEE 802.1X Supplicant with -e command line
   2045 	    option
   2046 	  - this code is not included in the default build; Makefile need to
   2047 	    be edited for this (uncomment lines for selected functionality)
   2048 	  - EAP-TLS and EAP-PEAP require openssl libraries
   2049 	* use module prefix in debug messages (WPA, EAP, EAP-TLS, ..)
   2050 	* added support for non-WPA IEEE 802.1X mode with dynamic WEP keys
   2051 	  (i.e., complete IEEE 802.1X/EAP authentication and use IEEE 802.1X
   2052 	   EAPOL-Key frames instead of WPA key handshakes)
   2053 	* added support for IEEE 802.11i/RSN (WPA2)
   2054 	  - improved PTK Key Handshake
   2055 	  - PMKSA caching, pre-authentication
   2056 	* fixed wpa_supplicant to ignore possible extra data after WPA
   2057 	  EAPOL-Key packets (this fixes 'Invalid EAPOL-Key MIC when using
   2058 	  TPTK' error from message 3 of 4-Way Handshake in case the AP
   2059 	  includes extra data after the EAPOL-Key)
   2060 	* added interface for external programs (frontends) to control
   2061 	  wpa_supplicant
   2062 	  - CLI example (wpa_cli) with interactive mode and command line
   2063 	    mode
   2064 	  - replaced SIGUSR1 status/statistics with the new control interface
   2065 	* made some feature compile time configurable
   2066 	  - .config file for make
   2067 	  - driver interfaces (hostap, hermes, ..)
   2068 	  - EAPOL/EAP functions
   2069 
   2070 2004-02-15 - v0.2.0
   2071 	* Initial version of wpa_supplicant
   2072