gentoo resync : 20.03.2022

16 files changed, 46 insertions, 2531 deletions

diff --git a/net-wireless/wpa_supplicant/Manifest b/net-wireless/wpa_supplicant/Manifest
index 3e5aeb0a9fe5..b5751ec95996 100644
--- a/net-wireless/wpa_supplicant/Manifest
+++ b/net-wireless/wpa_supplicant/Manifest
@@ -1,23 +1,9 @@
-AUX 2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch 6218 BLAKE2B ac06781d0e7ac083d625c75bd1b89ad338e95ad368a5bf29257ce07b5d368ace96818e6e062ff5a3712a38e0bddf35eda866959c125c9e0b49dfe59dff333928 SHA512 f855fa792425f175ccc800eb49df42067b1c1f4b52ba2d24160af4dfbb74dcf8e81661b7e6c8d92fa408938b8a559fc74557d1677913e4a751bfd43706c14bb6
-AUX 2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch 7883 BLAKE2B 131296b8b6e94663506354c73afb3f6778d856bc282acc6d81793184a6d97519b71fa2c7a373d7912e7a4db969effdf8650f2ad9d37d372f29ac82d70aa19486 SHA512 b4e413aa815572ea0002d33d24b69cd499aebb5efebed8fcaade8b29324bb5853a5db64e8b1dfdf24478e02c66196238b81a6ec777a7a28610435dce4d2c344e
-AUX 2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch 6861 BLAKE2B 1660da3f1172722af762adf1339ea3a3e4c60691d6fc795fae627d7650c96156ec4890788ce9d0294bb013d2298184ab3818796d5c9f6533e9006834190ffdef SHA512 a6382d8e84b4829be33c46bf2f4c6f3232c9d924a4547a21dfe023bf5be8ee1c635920295f52be285359efaae95bcc1f12b512659cfd1653b871dd0bea7e5ace
-AUX 2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch 2566 BLAKE2B a1853a5326f177fc82ab1f0527ceccfe818dddcc87c46ca62308f76139db5dcd03b664f0e2418660297c2e8c60d7a4dd714b78236fcd1494dbd82f36a58d141d SHA512 51ed806f0d5b3f588e26d4db4dcfc6be2cfb12002e26893a6cedd62c7cad0d0de75aed4a666223c4877fc1854b08dce6ddf6f6c4cfd752a5d8d58ad4a968b553
-AUX 2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch 1949 BLAKE2B b78b50bf0cba2a5de4d1ac217ce898d4c59cba7693d5c26087012931c2578ede4b3046357fd78e0f03bcb90fdeff322de42c511efadb41209243b308dcdb8372 SHA512 8707a123cd78149dfee9f5bd791761ee1eca605ef96580167044c2339c896920cf0e030b184a5afa9e310f5755afb30bef8ebd4522fc52753f3fbd6acead2cdf
-AUX 2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch 4309 BLAKE2B 6164e0343d7e4bedcaf2be9c3800eeb146a564fffeb339d032706797c04f268ade0674e67c962653c2a124af5a8ff8d28004bbeba0f3e73b166dbed03cd9a355 SHA512 37d050b2e4a3598484912667d8b2705fbe84c5c562267f900d42b0c7b606fb1fed09ddca8b80e2131768baa8f3690aab6ba7a232dee6ff1e66150fdb8816c927
-AUX 2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch 1649 BLAKE2B a8a486e782b7095c3eeb13706d815cd2f72ddf94c50e5bc8c3a9f36fc68580b1a10150ce405a161f2af2f2e5f2e5ba63d6c54807fcd9c71337956d69cd57b90e SHA512 111e655cfbb3a86e3792040e0ea375490d31c42c9d43cbe911290d54df5f4db437e4c8ad0e937c51729dcefeb0db0989b8ab55b9523398683abd08ebfec18076
-AUX 2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch 2750 BLAKE2B 059da1df148c8db68c9fa6aa656e46da301ebe7de3e41ecd4675ca579ebf6f1a66395e852cd8b562743ba83a345d4860618ea11bd01304a3386867115867fb9f SHA512 fc84edd8b30305cc42053c872554098f3f077292ec980ed6a442f37884087ff2f055738fd55977ed792bef1887dcc8c4626586465d78dd0258edb83dcd50a65a
 AUX wpa_cli.sh 1284 BLAKE2B 50757aa432bf714923d0ff5e2e8357bf3126c82dcfebbc2c342325ad97e3ca95a15ea138f9a55e5a7b9ac86cb2518c173e7d5186d5feb3e57ac762a71b11ef85 SHA512 250372231eda6f7228fcf76b13fc1b95637d0d9dec96b7bef820bfa1af1496f218909f521daf2ddb2ca81d0ebb3162500f833575b64d8d2b4820c247499e1c56
 AUX wpa_supplicant-2.6-do-not-call-dbus-functions-with-NULL-path.patch 486 BLAKE2B 877e15a45851331a1499cf8bc96fd514d88b6b270f54d52760e46cc7edbcc4b74a48a0271f0c93b546bb659203c56fdfba63b231757c21ca8ee6ade98406ac2e SHA512 dac56bc505a51167042ebe548f0e81a20a5578f753af9bb7ec3335a542d799c6e8739681ef7c8f7747a9bc954f8aa6f1a147250eacba17fd7fff80c4e53638ed
-AUX wpa_supplicant-2.9-AP-Silently-ignore-management-frame-from-unexpected.patch 2775 BLAKE2B fa9fb5db77955095e083a98a067072fccde02bf55f27af226c8aec515b047f28ab37d9f7c9a1bcc18e584ad3e582bc4dd59beabfcf15b5305394b05e687980a6 SHA512 63710cfb0992f2c346a9807d8c97cbeaed032fa376a0e93a2e56f7742ce515e9c4dfadbdb1af03ba272281f639aab832f0178f67634c222a5d99e1d462aa9e38
 AUX wpa_supplicant-conf.d 291 BLAKE2B 348e7d21fe01d2fdd2117adf22444557fa3d401f649489afd1636105cdddc29d58d45659c5368cc177f919ce94a7e2b5a9ed3fe8ddccd1fba3d059d270bae1a8 SHA512 6bbb9d4f6132b3d4e20cd65f27245ccadd60712ef5794261499f882057a930a393297e491d8147e04e30c0a53645af0eb3514332587118c19b5594f23f1d62ad
 AUX wpa_supplicant-init.d 1250 BLAKE2B 159ebbd5a3552cbd8fdd6d48984c3a511e77cf1e140f56fc1d3e6b16454351a270e566dd7fc4717b92251193bdf59a77f57fc3fdd1d53b067f2e5253796c041b SHA512 f7439937a11d7a91eee98ab9e16a4853ce8e27395970007ae60ca9a8b1852fadc4a37ee0bf81d7e4806c545f70b139f26942ed1630db070abe8fe8e5ce752403
 AUX wpa_supplicant.conf 183 BLAKE2B ea25d56f366783548b8d4bc14615d89d1c9cff1e6535992d14fa2f87a095b6c7226fbdf6b2d2ecd5fdcc13fb413fc56d5294f906c840ab3f9386c99ea69139fc SHA512 425a5c955d462ea0d0d3f79c3e1bbf68e15b495df04ad03ed7aee12408b52616af05650dfc147ca5940d69e97360c33995d33733820fef8eb8769b31e58434e8
 DIST wpa_supplicant-2.10.tar.gz 3511622 BLAKE2B 7f6045e5dcf24f7ccf1ea75c99541f9d68fadaea858a6ca11a95c997de14e33b3aa89138e748664579b5a4ea493d247cf6613da3c5fae49a4dbb5cd58dace752 SHA512 021c2a48f45d39c1dc6557730be5debaee071bc0ff82a271638beee6e32314e353e49d39e2f0dc8dff6e094dcc7008cfe1c32d0c7a34a1a345a12a3f1c1e11a1
-DIST wpa_supplicant-2.9-r3-patches.tar.bz2 5266 BLAKE2B 284fdeaf6328c35b1f5e88075c62c3b008ec2c400b0cc163a59d9cf8d7c356c3e58f8798e5bade102259d2e5be2ed298b63a0001d0a4ab71d90604a8ee8bf274 SHA512 80e4950ddc99d1134a29a3e5a39767c756f7c9f9f283749e688db3435184631f0384b78954f926724ceff86c96d05b4fb042160265e9d00f976a96e864b7ecc5
-DIST wpa_supplicant-2.9.tar.gz 3231785 BLAKE2B f1e2a5cb37b02d5c74116b5bc7f67c47d85f916c972cbd6b881d63a317161294a37c8517aabe6c74f9617c762aaa76d869f318af311473160e87bac8ac2a1807 SHA512 37a33f22cab9d27084fbef29856eaea0f692ff339c5b38bd32402dccf293cb849afd4a870cd3b5ca78179f0102f4011ce2f3444a53dc41dc75a5863b0a2226c8
-EBUILD wpa_supplicant-2.10.ebuild 12365 BLAKE2B cd5d297dd5a4a87dca1085b75a81f768a568ba47d7f05f4c742d09ade2a1fc0588ad7eb7f686c13f4c36bff5aac82a21463a13d61cda98e4179a9f4e5cef29c0 SHA512 93458aa31639a7306b16916ef0abf9dd48dbb1c98c6d0009792be81352e4a943df8a01c9164409859d203e2ea362c2591589c270dde96f047378b0a5860dbf32
-EBUILD wpa_supplicant-2.9-r4.ebuild 11937 BLAKE2B d9dd4c233bd0d700563f849271d09e75dd9e5c754739e51d8dc6889199d4d8003adf25ab51ece8df9e10200ee86a203d8792726ff129e78091ebf591e58f7bf9 SHA512 8e063b1a3236bf80f551a1d5c4d211a72cca442c52b62c676375fd8281d3da5081e0481a6793390e1c570a16f59203c96d55d6b1f133d0d505b6a7caf42ae5b5
-EBUILD wpa_supplicant-2.9-r5.ebuild 12311 BLAKE2B 9ef4ccaed095a0adb90dc039c8cc2ff97f6e10c2cc0b26919aa247204370de658da548651eb854dde7c0dbeae35cff7c32f7c7d9564f96ec217f6b8208e19f5e SHA512 0b887ef1f384bf194be26872aee8ba798722bc7598bdde09cd94b7f656dffd0f67899fdef66bfb81105fe4bffb1fb1a032d6b17af3bcd0e12da721708d175c28
-EBUILD wpa_supplicant-2.9-r8.ebuild 12925 BLAKE2B 58808d6d60e53dd3aa4dffdb503f05d5afadd671b0390585cae241a4777778a0f1a97a5ebba65704339f813d9c057b7a4da4aa346b7fa8ff5084c7868a1b0b59 SHA512 8b40834efc140c1ddc8189232e84043ac2cd8bf447a9fb2f4cb938779b4d5cb0ee150b3af376af41b9fa74db94a695298d8103191d90c02674da7f0db2749a82
-EBUILD wpa_supplicant-9999.ebuild 12365 BLAKE2B cd5d297dd5a4a87dca1085b75a81f768a568ba47d7f05f4c742d09ade2a1fc0588ad7eb7f686c13f4c36bff5aac82a21463a13d61cda98e4179a9f4e5cef29c0 SHA512 93458aa31639a7306b16916ef0abf9dd48dbb1c98c6d0009792be81352e4a943df8a01c9164409859d203e2ea362c2591589c270dde96f047378b0a5860dbf32
-MISC metadata.xml 1804 BLAKE2B d8e5383b6ff9511bc0541725d2c6e8b114f4619d27d6d96b09e868925ebf20fa1e63476218c3b42e1c01af695492879c4e428cf2ae34ea139bca21ef46bd4b4f SHA512 1fc0ccf65262195d6f8896fc0414cb5a4203b3b659bff68bac3ad449eec77d3ce071b7453c636eb16d666199770fd2c65d4b45aca20d14f32b9e0874ec676e70
+EBUILD wpa_supplicant-2.10-r1.ebuild 12638 BLAKE2B 06f09ea1018674c498e7c34a083e1aa5c59ebf5334434f1baa1024a19b924208a054cb96b3260a0fc9c2a6cf6bd07f24615d2259e44f34ffe2f27b304e8b0313 SHA512 cbe2f62ba221757f704d0d38f46e6ccc27f637bb8e14a64c6ca341df315012f6ef34fef302f5941ba88a6532f229b184864e0a2f3f8af037b70be2e08381610d
+EBUILD wpa_supplicant-9999.ebuild 12644 BLAKE2B 9d1f49d1944419ab19c7c25744b9d53c281c47955d0541e11fc087349214ed8a111775a692761bed50854eabbf16023a22470d8e754f8d9f38257a9a43533552 SHA512 1b19f8d84799a894bdd5c5943b7b6271545e78d12d63d36b22c4aa6ee8e2b96a10aec286709900797422080d56accd292da7c290f72c12af456286048fedce43
+MISC metadata.xml 1959 BLAKE2B 0f5445382157d69d59ecd66b601ba8c1bc5049a6b0c63cc2de84ac25752d3cfc3bd84d52f5ed3a21f2256e1360af21f58fc750f2df6853e1c8df6b0a35f74ae0 SHA512 9adb7d9d19beaec1662ad44450c84f850598726c05739f5b76f55387739466be26d9f983317580b9543b85b2614c1e0d138c5beabc0b8d7ddda4c60a4f9d3884
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
deleted file mode 100644
index 727684865dbd..000000000000
--- a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
+++ /dev/null
@@ -1,174 +0,0 @@
-From cf4cab804c7afd5c45505528a8d16e46163243a2 Mon Sep 17 00:00:00 2001
-From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
-Date: Fri, 14 Jul 2017 15:15:35 +0200
-Subject: [PATCH 1/8] hostapd: Avoid key reinstallation in FT handshake
-
-Do not reinstall TK to the driver during Reassociation Response frame
-processing if the first attempt of setting the TK succeeded. This avoids
-issues related to clearing the TX/RX PN that could result in reusing
-same PN values for transmitted frames (e.g., due to CCM nonce reuse and
-also hitting replay protection on the receiver) and accepting replayed
-frames on RX side.
-
-This issue was introduced by the commit
-0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in
-authenticator') which allowed wpa_ft_install_ptk() to be called multiple
-times with the same PTK. While the second configuration attempt is
-needed with some drivers, it must be done only if the first attempt
-failed.
-
-Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
----
- src/ap/ieee802_11.c  | 16 +++++++++++++---
- src/ap/wpa_auth.c    | 11 +++++++++++
- src/ap/wpa_auth.h    |  3 ++-
- src/ap/wpa_auth_ft.c | 10 ++++++++++
- src/ap/wpa_auth_i.h  |  1 +
- 5 files changed, 37 insertions(+), 4 deletions(-)
-
-diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
-index 4e04169..333035f 100644
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -1841,6 +1841,7 @@ static int add_associated_sta(struct hostapd_data *hapd,
- {
- 	struct ieee80211_ht_capabilities ht_cap;
- 	struct ieee80211_vht_capabilities vht_cap;
-+	int set = 1;
- 
- 	/*
- 	 * Remove the STA entry to ensure the STA PS state gets cleared and
-@@ -1848,9 +1849,18 @@ static int add_associated_sta(struct hostapd_data *hapd,
- 	 * FT-over-the-DS, where a station re-associates back to the same AP but
- 	 * skips the authentication flow, or if working with a driver that
- 	 * does not support full AP client state.
-+	 *
-+	 * Skip this if the STA has already completed FT reassociation and the
-+	 * TK has been configured since the TX/RX PN must not be reset to 0 for
-+	 * the same key.
- 	 */
--	if (!sta->added_unassoc)
-+	if (!sta->added_unassoc &&
-+	    (!(sta->flags & WLAN_STA_AUTHORIZED) ||
-+	     !wpa_auth_sta_ft_tk_already_set(sta->wpa_sm))) {
- 		hostapd_drv_sta_remove(hapd, sta->addr);
-+		wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
-+		set = 0;
-+	}
- 
- #ifdef CONFIG_IEEE80211N
- 	if (sta->flags & WLAN_STA_HT)
-@@ -1873,11 +1883,11 @@ static int add_associated_sta(struct hostapd_data *hapd,
- 			    sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
- 			    sta->flags | WLAN_STA_ASSOC, sta->qosinfo,
- 			    sta->vht_opmode, sta->p2p_ie ? 1 : 0,
--			    sta->added_unassoc)) {
-+			    set)) {
- 		hostapd_logger(hapd, sta->addr,
- 			       HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE,
- 			       "Could not %s STA to kernel driver",
--			       sta->added_unassoc ? "set" : "add");
-+			       set ? "set" : "add");
- 
- 		if (sta->added_unassoc) {
- 			hostapd_drv_sta_remove(hapd, sta->addr);
-diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
-index 3587086..707971d 100644
---- a/src/ap/wpa_auth.c
-+++ b/src/ap/wpa_auth.c
-@@ -1745,6 +1745,9 @@ int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event)
- #else /* CONFIG_IEEE80211R */
- 		break;
- #endif /* CONFIG_IEEE80211R */
-+	case WPA_DRV_STA_REMOVED:
-+		sm->tk_already_set = FALSE;
-+		return 0;
- 	}
- 
- #ifdef CONFIG_IEEE80211R
-@@ -3250,6 +3253,14 @@ int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm)
- }
- 
- 
-+int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm)
-+{
-+	if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt))
-+		return 0;
-+	return sm->tk_already_set;
-+}
-+
-+
- int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
- 			     struct rsn_pmksa_cache_entry *entry)
- {
-diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h
-index 0de8d97..97461b0 100644
---- a/src/ap/wpa_auth.h
-+++ b/src/ap/wpa_auth.h
-@@ -267,7 +267,7 @@ void wpa_receive(struct wpa_authenticator *wpa_auth,
- 		 u8 *data, size_t data_len);
- enum wpa_event {
- 	WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH,
--	WPA_REAUTH_EAPOL, WPA_ASSOC_FT
-+	WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_DRV_STA_REMOVED
- };
- void wpa_remove_ptk(struct wpa_state_machine *sm);
- int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event);
-@@ -280,6 +280,7 @@ int wpa_auth_pairwise_set(struct wpa_state_machine *sm);
- int wpa_auth_get_pairwise(struct wpa_state_machine *sm);
- int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm);
- int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm);
-+int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm);
- int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
- 			     struct rsn_pmksa_cache_entry *entry);
- struct rsn_pmksa_cache_entry *
-diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c
-index 42242a5..e63b99a 100644
---- a/src/ap/wpa_auth_ft.c
-+++ b/src/ap/wpa_auth_ft.c
-@@ -780,6 +780,14 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm)
- 		return;
- 	}
- 
-+	if (sm->tk_already_set) {
-+		/* Must avoid TK reconfiguration to prevent clearing of TX/RX
-+		 * PN in the driver */
-+		wpa_printf(MSG_DEBUG,
-+			   "FT: Do not re-install same PTK to the driver");
-+		return;
-+	}
-+
- 	/* FIX: add STA entry to kernel/driver here? The set_key will fail
- 	 * most likely without this.. At the moment, STA entry is added only
- 	 * after association has been completed. This function will be called
-@@ -792,6 +800,7 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm)
- 
- 	/* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */
- 	sm->pairwise_set = TRUE;
-+	sm->tk_already_set = TRUE;
- }
- 
- 
-@@ -898,6 +907,7 @@ static int wpa_ft_process_auth_req(struct wpa_state_machine *sm,
- 
- 	sm->pairwise = pairwise;
- 	sm->PTK_valid = TRUE;
-+	sm->tk_already_set = FALSE;
- 	wpa_ft_install_ptk(sm);
- 
- 	buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) +
-diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h
-index 72b7eb3..7fd8f05 100644
---- a/src/ap/wpa_auth_i.h
-+++ b/src/ap/wpa_auth_i.h
-@@ -65,6 +65,7 @@ struct wpa_state_machine {
- 	struct wpa_ptk PTK;
- 	Boolean PTK_valid;
- 	Boolean pairwise_set;
-+	Boolean tk_already_set;
- 	int keycount;
- 	Boolean Pair;
- 	struct wpa_key_replay_counter {
--- 
-2.7.4
-
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
deleted file mode 100644
index 1802d664add6..000000000000
--- a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
+++ /dev/null
@@ -1,250 +0,0 @@
-From 927f891007c402fefd1ff384645b3f07597c3ede Mon Sep 17 00:00:00 2001
-From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
-Date: Wed, 12 Jul 2017 16:03:24 +0200
-Subject: [PATCH 2/8] Prevent reinstallation of an already in-use group key
-
-Track the current GTK and IGTK that is in use and when receiving a
-(possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do
-not install the given key if it is already in use. This prevents an
-attacker from trying to trick the client into resetting or lowering the
-sequence counter associated to the group key.
-
-Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
----
- src/common/wpa_common.h |  11 +++++
- src/rsn_supp/wpa.c      | 116 ++++++++++++++++++++++++++++++------------------
- src/rsn_supp/wpa_i.h    |   4 ++
- 3 files changed, 87 insertions(+), 44 deletions(-)
-
-diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h
-index af1d0f0..d200285 100644
---- a/src/common/wpa_common.h
-+++ b/src/common/wpa_common.h
-@@ -217,6 +217,17 @@ struct wpa_ptk {
- 	size_t tk_len;
- };
- 
-+struct wpa_gtk {
-+	u8 gtk[WPA_GTK_MAX_LEN];
-+	size_t gtk_len;
-+};
-+
-+#ifdef CONFIG_IEEE80211W
-+struct wpa_igtk {
-+	u8 igtk[WPA_IGTK_MAX_LEN];
-+	size_t igtk_len;
-+};
-+#endif /* CONFIG_IEEE80211W */
- 
- /* WPA IE version 1
-  * 00-50-f2:1 (OUI:OUI type)
-diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
-index 3c47879..95bd7be 100644
---- a/src/rsn_supp/wpa.c
-+++ b/src/rsn_supp/wpa.c
-@@ -714,6 +714,15 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
- 	const u8 *_gtk = gd->gtk;
- 	u8 gtk_buf[32];
- 
-+	/* Detect possible key reinstallation */
-+	if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
-+	    os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
-+		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
-+			"WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
-+			gd->keyidx, gd->tx, gd->gtk_len);
-+		return 0;
-+	}
-+
- 	wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
- 	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- 		"WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
-@@ -748,6 +757,9 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
- 	}
- 	os_memset(gtk_buf, 0, sizeof(gtk_buf));
- 
-+	sm->gtk.gtk_len = gd->gtk_len;
-+	os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
-+
- 	return 0;
- }
- 
-@@ -854,6 +866,48 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
- }
- 
- 
-+#ifdef CONFIG_IEEE80211W
-+static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
-+				       const struct wpa_igtk_kde *igtk)
-+{
-+	size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
-+	u16 keyidx = WPA_GET_LE16(igtk->keyid);
-+
-+	/* Detect possible key reinstallation */
-+	if (sm->igtk.igtk_len == len &&
-+	    os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
-+		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
-+			"WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
-+			keyidx);
-+		return  0;
-+	}
-+
-+	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
-+		"WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x",
-+		keyidx, MAC2STR(igtk->pn));
-+	wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
-+	if (keyidx > 4095) {
-+		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
-+			"WPA: Invalid IGTK KeyID %d", keyidx);
-+		return -1;
-+	}
-+	if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
-+			   broadcast_ether_addr,
-+			   keyidx, 0, igtk->pn, sizeof(igtk->pn),
-+			   igtk->igtk, len) < 0) {
-+		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
-+			"WPA: Failed to configure IGTK to the driver");
-+		return -1;
-+	}
-+
-+	sm->igtk.igtk_len = len;
-+	os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
-+
-+	return 0;
-+}
-+#endif /* CONFIG_IEEE80211W */
-+
-+
- static int ieee80211w_set_keys(struct wpa_sm *sm,
- 			       struct wpa_eapol_ie_parse *ie)
- {
-@@ -864,30 +918,14 @@ static int ieee80211w_set_keys(struct wpa_sm *sm,
- 	if (ie->igtk) {
- 		size_t len;
- 		const struct wpa_igtk_kde *igtk;
--		u16 keyidx;
-+
- 		len = wpa_cipher_key_len(sm->mgmt_group_cipher);
- 		if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
- 			return -1;
-+
- 		igtk = (const struct wpa_igtk_kde *) ie->igtk;
--		keyidx = WPA_GET_LE16(igtk->keyid);
--		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d "
--			"pn %02x%02x%02x%02x%02x%02x",
--			keyidx, MAC2STR(igtk->pn));
--		wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK",
--				igtk->igtk, len);
--		if (keyidx > 4095) {
--			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
--				"WPA: Invalid IGTK KeyID %d", keyidx);
--			return -1;
--		}
--		if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
--				   broadcast_ether_addr,
--				   keyidx, 0, igtk->pn, sizeof(igtk->pn),
--				   igtk->igtk, len) < 0) {
--			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
--				"WPA: Failed to configure IGTK to the driver");
-+		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
- 			return -1;
--		}
- 	}
- 
- 	return 0;
-@@ -2307,7 +2345,7 @@ void wpa_sm_deinit(struct wpa_sm *sm)
-  */
- void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
- {
--	int clear_ptk = 1;
-+	int clear_keys = 1;
- 
- 	if (sm == NULL)
- 		return;
-@@ -2333,11 +2371,11 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
- 		/* Prepare for the next transition */
- 		wpa_ft_prepare_auth_request(sm, NULL);
- 
--		clear_ptk = 0;
-+		clear_keys = 0;
- 	}
- #endif /* CONFIG_IEEE80211R */
- 
--	if (clear_ptk) {
-+	if (clear_keys) {
- 		/*
- 		 * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
- 		 * this is not part of a Fast BSS Transition.
-@@ -2347,6 +2385,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
- 		os_memset(&sm->ptk, 0, sizeof(sm->ptk));
- 		sm->tptk_set = 0;
- 		os_memset(&sm->tptk, 0, sizeof(sm->tptk));
-+		os_memset(&sm->gtk, 0, sizeof(sm->gtk));
-+#ifdef CONFIG_IEEE80211W
-+		os_memset(&sm->igtk, 0, sizeof(sm->igtk));
-+#endif /* CONFIG_IEEE80211W */
- 	}
- 
- #ifdef CONFIG_TDLS
-@@ -2877,6 +2919,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
- 	os_memset(sm->pmk, 0, sizeof(sm->pmk));
- 	os_memset(&sm->ptk, 0, sizeof(sm->ptk));
- 	os_memset(&sm->tptk, 0, sizeof(sm->tptk));
-+	os_memset(&sm->gtk, 0, sizeof(sm->gtk));
-+#ifdef CONFIG_IEEE80211W
-+	os_memset(&sm->igtk, 0, sizeof(sm->igtk));
-+#endif /* CONFIG_IEEE80211W */
- #ifdef CONFIG_IEEE80211R
- 	os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
- 	os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
-@@ -2949,29 +2995,11 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
- 		os_memset(&gd, 0, sizeof(gd));
- #ifdef CONFIG_IEEE80211W
- 	} else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
--		struct wpa_igtk_kde igd;
--		u16 keyidx;
--
--		os_memset(&igd, 0, sizeof(igd));
--		keylen = wpa_cipher_key_len(sm->mgmt_group_cipher);
--		os_memcpy(igd.keyid, buf + 2, 2);
--		os_memcpy(igd.pn, buf + 4, 6);
--
--		keyidx = WPA_GET_LE16(igd.keyid);
--		os_memcpy(igd.igtk, buf + 10, keylen);
--
--		wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)",
--				igd.igtk, keylen);
--		if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
--				   broadcast_ether_addr,
--				   keyidx, 0, igd.pn, sizeof(igd.pn),
--				   igd.igtk, keylen) < 0) {
--			wpa_printf(MSG_DEBUG, "Failed to install the IGTK in "
--				   "WNM mode");
--			os_memset(&igd, 0, sizeof(igd));
-+		const struct wpa_igtk_kde *igtk;
-+
-+		igtk = (const struct wpa_igtk_kde *) (buf + 2);
-+		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
- 			return -1;
--		}
--		os_memset(&igd, 0, sizeof(igd));
- #endif /* CONFIG_IEEE80211W */
- 	} else {
- 		wpa_printf(MSG_DEBUG, "Unknown element id");
-diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
-index f653ba6..afc9e37 100644
---- a/src/rsn_supp/wpa_i.h
-+++ b/src/rsn_supp/wpa_i.h
-@@ -31,6 +31,10 @@ struct wpa_sm {
- 	u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN];
- 	int rx_replay_counter_set;
- 	u8 request_counter[WPA_REPLAY_COUNTER_LEN];
-+	struct wpa_gtk gtk;
-+#ifdef CONFIG_IEEE80211W
-+	struct wpa_igtk igtk;
-+#endif /* CONFIG_IEEE80211W */
- 
- 	struct eapol_sm *eapol; /* EAPOL state machine from upper level code */
- 
--- 
-2.7.4
-
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
deleted file mode 100644
index e2937b851ad5..000000000000
--- a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
+++ /dev/null
@@ -1,184 +0,0 @@
-From 8280294e74846ea342389a0cd17215050fa5afe8 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Sun, 1 Oct 2017 12:12:24 +0300
-Subject: [PATCH 3/8] Extend protection of GTK/IGTK reinstallation of WNM-Sleep
- Mode cases
-
-This extends the protection to track last configured GTK/IGTK value
-separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a
-corner case where these two different mechanisms may get used when the
-GTK/IGTK has changed and tracking a single value is not sufficient to
-detect a possible key reconfiguration.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/rsn_supp/wpa.c   | 53 +++++++++++++++++++++++++++++++++++++---------------
- src/rsn_supp/wpa_i.h |  2 ++
- 2 files changed, 40 insertions(+), 15 deletions(-)
-
-diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
-index 95bd7be..7a2c68d 100644
---- a/src/rsn_supp/wpa.c
-+++ b/src/rsn_supp/wpa.c
-@@ -709,14 +709,17 @@ struct wpa_gtk_data {
- 
- static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
- 				      const struct wpa_gtk_data *gd,
--				      const u8 *key_rsc)
-+				      const u8 *key_rsc, int wnm_sleep)
- {
- 	const u8 *_gtk = gd->gtk;
- 	u8 gtk_buf[32];
- 
- 	/* Detect possible key reinstallation */
--	if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
--	    os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
-+	if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
-+	     os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
-+	    (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
-+	     os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
-+		       sm->gtk_wnm_sleep.gtk_len) == 0)) {
- 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- 			"WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
- 			gd->keyidx, gd->tx, gd->gtk_len);
-@@ -757,8 +760,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
- 	}
- 	os_memset(gtk_buf, 0, sizeof(gtk_buf));
- 
--	sm->gtk.gtk_len = gd->gtk_len;
--	os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
-+	if (wnm_sleep) {
-+		sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
-+		os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
-+			  sm->gtk_wnm_sleep.gtk_len);
-+	} else {
-+		sm->gtk.gtk_len = gd->gtk_len;
-+		os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
-+	}
- 
- 	return 0;
- }
-@@ -852,7 +861,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
- 	    (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
- 					       gtk_len, gtk_len,
- 					       &gd.key_rsc_len, &gd.alg) ||
--	     wpa_supplicant_install_gtk(sm, &gd, key_rsc))) {
-+	     wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
- 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- 			"RSN: Failed to install GTK");
- 		os_memset(&gd, 0, sizeof(gd));
-@@ -868,14 +877,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
- 
- #ifdef CONFIG_IEEE80211W
- static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
--				       const struct wpa_igtk_kde *igtk)
-+				       const struct wpa_igtk_kde *igtk,
-+				       int wnm_sleep)
- {
- 	size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
- 	u16 keyidx = WPA_GET_LE16(igtk->keyid);
- 
- 	/* Detect possible key reinstallation */
--	if (sm->igtk.igtk_len == len &&
--	    os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
-+	if ((sm->igtk.igtk_len == len &&
-+	     os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
-+	    (sm->igtk_wnm_sleep.igtk_len == len &&
-+	     os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
-+		       sm->igtk_wnm_sleep.igtk_len) == 0)) {
- 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- 			"WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
- 			keyidx);
-@@ -900,8 +913,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
- 		return -1;
- 	}
- 
--	sm->igtk.igtk_len = len;
--	os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
-+	if (wnm_sleep) {
-+		sm->igtk_wnm_sleep.igtk_len = len;
-+		os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
-+			  sm->igtk_wnm_sleep.igtk_len);
-+	} else {
-+		sm->igtk.igtk_len = len;
-+		os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
-+	}
- 
- 	return 0;
- }
-@@ -924,7 +943,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm,
- 			return -1;
- 
- 		igtk = (const struct wpa_igtk_kde *) ie->igtk;
--		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
-+		if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
- 			return -1;
- 	}
- 
-@@ -1574,7 +1593,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
- 	if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
- 		key_rsc = null_rsc;
- 
--	if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) ||
-+	if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
- 	    wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
- 		goto failed;
- 	os_memset(&gd, 0, sizeof(gd));
-@@ -2386,8 +2405,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
- 		sm->tptk_set = 0;
- 		os_memset(&sm->tptk, 0, sizeof(sm->tptk));
- 		os_memset(&sm->gtk, 0, sizeof(sm->gtk));
-+		os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
- #ifdef CONFIG_IEEE80211W
- 		os_memset(&sm->igtk, 0, sizeof(sm->igtk));
-+		os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
- #endif /* CONFIG_IEEE80211W */
- 	}
- 
-@@ -2920,8 +2941,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
- 	os_memset(&sm->ptk, 0, sizeof(sm->ptk));
- 	os_memset(&sm->tptk, 0, sizeof(sm->tptk));
- 	os_memset(&sm->gtk, 0, sizeof(sm->gtk));
-+	os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
- #ifdef CONFIG_IEEE80211W
- 	os_memset(&sm->igtk, 0, sizeof(sm->igtk));
-+	os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
- #endif /* CONFIG_IEEE80211W */
- #ifdef CONFIG_IEEE80211R
- 	os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
-@@ -2986,7 +3009,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
- 
- 		wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
- 				gd.gtk, gd.gtk_len);
--		if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) {
-+		if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
- 			os_memset(&gd, 0, sizeof(gd));
- 			wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
- 				   "WNM mode");
-@@ -2998,7 +3021,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
- 		const struct wpa_igtk_kde *igtk;
- 
- 		igtk = (const struct wpa_igtk_kde *) (buf + 2);
--		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
-+		if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
- 			return -1;
- #endif /* CONFIG_IEEE80211W */
- 	} else {
-diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
-index afc9e37..9a54631 100644
---- a/src/rsn_supp/wpa_i.h
-+++ b/src/rsn_supp/wpa_i.h
-@@ -32,8 +32,10 @@ struct wpa_sm {
- 	int rx_replay_counter_set;
- 	u8 request_counter[WPA_REPLAY_COUNTER_LEN];
- 	struct wpa_gtk gtk;
-+	struct wpa_gtk gtk_wnm_sleep;
- #ifdef CONFIG_IEEE80211W
- 	struct wpa_igtk igtk;
-+	struct wpa_igtk igtk_wnm_sleep;
- #endif /* CONFIG_IEEE80211W */
- 
- 	struct eapol_sm *eapol; /* EAPOL state machine from upper level code */
--- 
-2.7.4
-
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
deleted file mode 100644
index 22ee217947d6..000000000000
--- a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 8f82bc94e8697a9d47fa8774dfdaaede1084912c Mon Sep 17 00:00:00 2001
-From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
-Date: Fri, 29 Sep 2017 04:22:51 +0200
-Subject: [PATCH 4/8] Prevent installation of an all-zero TK
-
-Properly track whether a PTK has already been installed to the driver
-and the TK part cleared from memory. This prevents an attacker from
-trying to trick the client into installing an all-zero TK.
-
-This fixes the earlier fix in commit
-ad00d64e7d8827b3cebd665a0ceb08adabf15e1e ('Fix TK configuration to the
-driver in EAPOL-Key 3/4 retry case') which did not take into account
-possibility of an extra message 1/4 showing up between retries of
-message 3/4.
-
-Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
----
- src/common/wpa_common.h | 1 +
- src/rsn_supp/wpa.c      | 5 ++---
- src/rsn_supp/wpa_i.h    | 1 -
- 3 files changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h
-index d200285..1021ccb 100644
---- a/src/common/wpa_common.h
-+++ b/src/common/wpa_common.h
-@@ -215,6 +215,7 @@ struct wpa_ptk {
- 	size_t kck_len;
- 	size_t kek_len;
- 	size_t tk_len;
-+	int installed; /* 1 if key has already been installed to driver */
- };
- 
- struct wpa_gtk {
-diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
-index 7a2c68d..0550a41 100644
---- a/src/rsn_supp/wpa.c
-+++ b/src/rsn_supp/wpa.c
-@@ -510,7 +510,6 @@ static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
- 		os_memset(buf, 0, sizeof(buf));
- 	}
- 	sm->tptk_set = 1;
--	sm->tk_to_set = 1;
- 
- 	kde = sm->assoc_wpa_ie;
- 	kde_len = sm->assoc_wpa_ie_len;
-@@ -615,7 +614,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
- 	enum wpa_alg alg;
- 	const u8 *key_rsc;
- 
--	if (!sm->tk_to_set) {
-+	if (sm->ptk.installed) {
- 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
- 			"WPA: Do not re-install same PTK to the driver");
- 		return 0;
-@@ -659,7 +658,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
- 
- 	/* TK is not needed anymore in supplicant */
- 	os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
--	sm->tk_to_set = 0;
-+	sm->ptk.installed = 1;
- 
- 	if (sm->wpa_ptk_rekey) {
- 		eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
-diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
-index 9a54631..41f371f 100644
---- a/src/rsn_supp/wpa_i.h
-+++ b/src/rsn_supp/wpa_i.h
-@@ -24,7 +24,6 @@ struct wpa_sm {
- 	struct wpa_ptk ptk, tptk;
- 	int ptk_set, tptk_set;
- 	unsigned int msg_3_of_4_ok:1;
--	unsigned int tk_to_set:1;
- 	u8 snonce[WPA_NONCE_LEN];
- 	u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */
- 	int renew_snonce;
--- 
-2.7.4
-
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
deleted file mode 100644
index c19c4c710235..000000000000
--- a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 12fac09b437a1dc8a0f253e265934a8aaf4d2f8b Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Sun, 1 Oct 2017 12:32:57 +0300
-Subject: [PATCH 5/8] Fix PTK rekeying to generate a new ANonce
-
-The Authenticator state machine path for PTK rekeying ended up bypassing
-the AUTHENTICATION2 state where a new ANonce is generated when going
-directly to the PTKSTART state since there is no need to try to
-determine the PMK again in such a case. This is far from ideal since the
-new PTK would depend on a new nonce only from the supplicant.
-
-Fix this by generating a new ANonce when moving to the PTKSTART state
-for the purpose of starting new 4-way handshake to rekey PTK.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/ap/wpa_auth.c | 24 +++++++++++++++++++++---
- 1 file changed, 21 insertions(+), 3 deletions(-)
-
-diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
-index 707971d..bf10cc1 100644
---- a/src/ap/wpa_auth.c
-+++ b/src/ap/wpa_auth.c
-@@ -1901,6 +1901,21 @@ SM_STATE(WPA_PTK, AUTHENTICATION2)
- }
- 
- 
-+static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm)
-+{
-+	if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) {
-+		wpa_printf(MSG_ERROR,
-+			   "WPA: Failed to get random data for ANonce");
-+		sm->Disconnect = TRUE;
-+		return -1;
-+	}
-+	wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce,
-+		    WPA_NONCE_LEN);
-+	sm->TimeoutCtr = 0;
-+	return 0;
-+}
-+
-+
- SM_STATE(WPA_PTK, INITPMK)
- {
- 	u8 msk[2 * PMK_LEN];
-@@ -2458,9 +2473,12 @@ SM_STEP(WPA_PTK)
- 		SM_ENTER(WPA_PTK, AUTHENTICATION);
- 	else if (sm->ReAuthenticationRequest)
- 		SM_ENTER(WPA_PTK, AUTHENTICATION2);
--	else if (sm->PTKRequest)
--		SM_ENTER(WPA_PTK, PTKSTART);
--	else switch (sm->wpa_ptk_state) {
-+	else if (sm->PTKRequest) {
-+		if (wpa_auth_sm_ptk_update(sm) < 0)
-+			SM_ENTER(WPA_PTK, DISCONNECTED);
-+		else
-+			SM_ENTER(WPA_PTK, PTKSTART);
-+	} else switch (sm->wpa_ptk_state) {
- 	case WPA_PTK_INITIALIZE:
- 		break;
- 	case WPA_PTK_DISCONNECT:
--- 
-2.7.4
-
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
deleted file mode 100644
index e1bd5a572625..000000000000
--- a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From 6c4bed4f47d1960ec04981a9d50e5076aea5223d Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Fri, 22 Sep 2017 11:03:15 +0300
-Subject: [PATCH 6/8] TDLS: Reject TPK-TK reconfiguration
-
-Do not try to reconfigure the same TPK-TK to the driver after it has
-been successfully configured. This is an explicit check to avoid issues
-related to resetting the TX/RX packet number. There was already a check
-for this for TPK M2 (retries of that message are ignored completely), so
-that behavior does not get modified.
-
-For TPK M3, the TPK-TK could have been reconfigured, but that was
-followed by immediate teardown of the link due to an issue in updating
-the STA entry. Furthermore, for TDLS with any real security (i.e.,
-ignoring open/WEP), the TPK message exchange is protected on the AP path
-and simple replay attacks are not feasible.
-
-As an additional corner case, make sure the local nonce gets updated if
-the peer uses a very unlikely "random nonce" of all zeros.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/rsn_supp/tdls.c | 38 ++++++++++++++++++++++++++++++++++++--
- 1 file changed, 36 insertions(+), 2 deletions(-)
-
-diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c
-index e424168..9eb9738 100644
---- a/src/rsn_supp/tdls.c
-+++ b/src/rsn_supp/tdls.c
-@@ -112,6 +112,7 @@ struct wpa_tdls_peer {
- 		u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
- 	} tpk;
- 	int tpk_set;
-+	int tk_set; /* TPK-TK configured to the driver */
- 	int tpk_success;
- 	int tpk_in_progress;
- 
-@@ -192,6 +193,20 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
- 	u8 rsc[6];
- 	enum wpa_alg alg;
- 
-+	if (peer->tk_set) {
-+		/*
-+		 * This same TPK-TK has already been configured to the driver
-+		 * and this new configuration attempt (likely due to an
-+		 * unexpected retransmitted frame) would result in clearing
-+		 * the TX/RX sequence number which can break security, so must
-+		 * not allow that to happen.
-+		 */
-+		wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR
-+			   " has already been configured to the driver - do not reconfigure",
-+			   MAC2STR(peer->addr));
-+		return -1;
-+	}
-+
- 	os_memset(rsc, 0, 6);
- 
- 	switch (peer->cipher) {
-@@ -209,12 +224,15 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
- 		return -1;
- 	}
- 
-+	wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR,
-+		   MAC2STR(peer->addr));
- 	if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1,
- 			   rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) {
- 		wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
- 			   "driver");
- 		return -1;
- 	}
-+	peer->tk_set = 1;
- 	return 0;
- }
- 
-@@ -696,7 +714,7 @@ static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
- 	peer->cipher = 0;
- 	peer->qos_info = 0;
- 	peer->wmm_capable = 0;
--	peer->tpk_set = peer->tpk_success = 0;
-+	peer->tk_set = peer->tpk_set = peer->tpk_success = 0;
- 	peer->chan_switch_enabled = 0;
- 	os_memset(&peer->tpk, 0, sizeof(peer->tpk));
- 	os_memset(peer->inonce, 0, WPA_NONCE_LEN);
-@@ -1159,6 +1177,7 @@ skip_rsnie:
- 		wpa_tdls_peer_free(sm, peer);
- 		return -1;
- 	}
-+	peer->tk_set = 0; /* A new nonce results in a new TK */
- 	wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
- 		    peer->inonce, WPA_NONCE_LEN);
- 	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
-@@ -1751,6 +1770,19 @@ static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
- }
- 
- 
-+static int tdls_nonce_set(const u8 *nonce)
-+{
-+	int i;
-+
-+	for (i = 0; i < WPA_NONCE_LEN; i++) {
-+		if (nonce[i])
-+			return 1;
-+	}
-+
-+	return 0;
-+}
-+
-+
- static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
- 				   const u8 *buf, size_t len)
- {
-@@ -2004,7 +2036,8 @@ skip_rsn:
- 	peer->rsnie_i_len = kde.rsn_ie_len;
- 	peer->cipher = cipher;
- 
--	if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
-+	if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 ||
-+	    !tdls_nonce_set(peer->inonce)) {
- 		/*
- 		 * There is no point in updating the RNonce for every obtained
- 		 * TPK M1 frame (e.g., retransmission due to timeout) with the
-@@ -2020,6 +2053,7 @@ skip_rsn:
- 				"TDLS: Failed to get random data for responder nonce");
- 			goto error;
- 		}
-+		peer->tk_set = 0; /* A new nonce results in a new TK */
- 	}
- 
- #if 0
--- 
-2.7.4
-
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
deleted file mode 100644
index 85ea1d62bcf5..000000000000
--- a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 53c5eb58e95004f86e65ee9fbfccbc291b139057 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Fri, 22 Sep 2017 11:25:02 +0300
-Subject: [PATCH 7/8] WNM: Ignore WNM-Sleep Mode Response without pending
- request
-
-Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep
-Mode Response if WNM-Sleep Mode has not been used') started ignoring the
-response when no WNM-Sleep Mode Request had been used during the
-association. This can be made tighter by clearing the used flag when
-successfully processing a response. This adds an additional layer of
-protection against unexpected retransmissions of the response frame.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- wpa_supplicant/wnm_sta.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
-index 1b3409c..67a07ff 100644
---- a/wpa_supplicant/wnm_sta.c
-+++ b/wpa_supplicant/wnm_sta.c
-@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
- 
- 	if (!wpa_s->wnmsleep_used) {
- 		wpa_printf(MSG_DEBUG,
--			   "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association");
-+			   "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested");
- 		return;
- 	}
- 
-@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
- 		return;
- 	}
- 
-+	wpa_s->wnmsleep_used = 0;
-+
- 	if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
- 	    wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
- 		wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
--- 
-2.7.4
-
diff --git a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch b/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
deleted file mode 100644
index b9678f6815a8..000000000000
--- a/net-wireless/wpa_supplicant/files/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From b372ab0b7daea719749194dc554b26e6367603f2 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Fri, 22 Sep 2017 12:06:37 +0300
-Subject: [PATCH 8/8] FT: Do not allow multiple Reassociation Response frames
-
-The driver is expected to not report a second association event without
-the station having explicitly request a new association. As such, this
-case should not be reachable. However, since reconfiguring the same
-pairwise or group keys to the driver could result in nonce reuse issues,
-be extra careful here and do an additional state check to avoid this
-even if the local driver ends up somehow accepting an unexpected
-Reassociation Response frame.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/rsn_supp/wpa.c    | 3 +++
- src/rsn_supp/wpa_ft.c | 8 ++++++++
- src/rsn_supp/wpa_i.h  | 1 +
- 3 files changed, 12 insertions(+)
-
-diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
-index 0550a41..2a53c6f 100644
---- a/src/rsn_supp/wpa.c
-+++ b/src/rsn_supp/wpa.c
-@@ -2440,6 +2440,9 @@ void wpa_sm_notify_disassoc(struct wpa_sm *sm)
- #ifdef CONFIG_TDLS
- 	wpa_tdls_disassoc(sm);
- #endif /* CONFIG_TDLS */
-+#ifdef CONFIG_IEEE80211R
-+	sm->ft_reassoc_completed = 0;
-+#endif /* CONFIG_IEEE80211R */
- 
- 	/* Keys are not needed in the WPA state machine anymore */
- 	wpa_sm_drop_sa(sm);
-diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c
-index 205793e..d45bb45 100644
---- a/src/rsn_supp/wpa_ft.c
-+++ b/src/rsn_supp/wpa_ft.c
-@@ -153,6 +153,7 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len,
- 	u16 capab;
- 
- 	sm->ft_completed = 0;
-+	sm->ft_reassoc_completed = 0;
- 
- 	buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) +
- 		2 + sm->r0kh_id_len + ric_ies_len + 100;
-@@ -681,6 +682,11 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies,
- 		return -1;
- 	}
- 
-+	if (sm->ft_reassoc_completed) {
-+		wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission");
-+		return 0;
-+	}
-+
- 	if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) {
- 		wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs");
- 		return -1;
-@@ -781,6 +787,8 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies,
- 		return -1;
- 	}
- 
-+	sm->ft_reassoc_completed = 1;
-+
- 	if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0)
- 		return -1;
- 
-diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
-index 41f371f..56f88dc 100644
---- a/src/rsn_supp/wpa_i.h
-+++ b/src/rsn_supp/wpa_i.h
-@@ -128,6 +128,7 @@ struct wpa_sm {
- 	size_t r0kh_id_len;
- 	u8 r1kh_id[FT_R1KH_ID_LEN];
- 	int ft_completed;
-+	int ft_reassoc_completed;
- 	int over_the_ds_in_progress;
- 	u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */
- 	int set_ptk_after_assoc;
--- 
-2.7.4
-
diff --git a/net-wireless/wpa_supplicant/files/wpa_supplicant-2.9-AP-Silently-ignore-management-frame-from-unexpected.patch b/net-wireless/wpa_supplicant/files/wpa_supplicant-2.9-AP-Silently-ignore-management-frame-from-unexpected.patch
deleted file mode 100644
index d764a9db016c..000000000000
--- a/net-wireless/wpa_supplicant/files/wpa_supplicant-2.9-AP-Silently-ignore-management-frame-from-unexpected.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 8c07fa9eda13e835f3f968b2e1c9a8be3a851ff9 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Thu, 29 Aug 2019 11:52:04 +0300
-Subject: [PATCH] AP: Silently ignore management frame from unexpected source
- address
-
-Do not process any received Management frames with unexpected/invalid SA
-so that we do not add any state for unexpected STA addresses or end up
-sending out frames to unexpected destination. This prevents unexpected
-sequences where an unprotected frame might end up causing the AP to send
-out a response to another device and that other device processing the
-unexpected response.
-
-In particular, this prevents some potential denial of service cases
-where the unexpected response frame from the AP might result in a
-connected station dropping its association.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/ap/drv_callbacks.c | 13 +++++++++++++
- src/ap/ieee802_11.c    | 12 ++++++++++++
- 2 files changed, 25 insertions(+)
-
-diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c
-index 31587685fe3b..34ca379edc3d 100644
---- a/src/ap/drv_callbacks.c
-+++ b/src/ap/drv_callbacks.c
-@@ -131,6 +131,19 @@ int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,
- 			   "hostapd_notif_assoc: Skip event with no address");
- 		return -1;
- 	}
-+
-+	if (is_multicast_ether_addr(addr) ||
-+	    is_zero_ether_addr(addr) ||
-+	    os_memcmp(addr, hapd->own_addr, ETH_ALEN) == 0) {
-+		/* Do not process any frames with unexpected/invalid SA so that
-+		 * we do not add any state for unexpected STA addresses or end
-+		 * up sending out frames to unexpected destination. */
-+		wpa_printf(MSG_DEBUG, "%s: Invalid SA=" MACSTR
-+			   " in received indication - ignore this indication silently",
-+			   __func__, MAC2STR(addr));
-+		return 0;
-+	}
-+
- 	random_add_randomness(addr, ETH_ALEN);
- 
- 	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
-diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
-index c85a28db44b7..e7065372e158 100644
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -4626,6 +4626,18 @@ int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
- 	fc = le_to_host16(mgmt->frame_control);
- 	stype = WLAN_FC_GET_STYPE(fc);
- 
-+	if (is_multicast_ether_addr(mgmt->sa) ||
-+	    is_zero_ether_addr(mgmt->sa) ||
-+	    os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
-+		/* Do not process any frames with unexpected/invalid SA so that
-+		 * we do not add any state for unexpected STA addresses or end
-+		 * up sending out frames to unexpected destination. */
-+		wpa_printf(MSG_DEBUG, "MGMT: Invalid SA=" MACSTR
-+			   " in received frame - ignore this frame silently",
-+			   MAC2STR(mgmt->sa));
-+		return 0;
-+	}
-+
- 	if (stype == WLAN_FC_STYPE_BEACON) {
- 		handle_beacon(hapd, mgmt, len, fi);
- 		return 1;
--- 
-2.20.1
-
diff --git a/net-wireless/wpa_supplicant/metadata.xml b/net-wireless/wpa_supplicant/metadata.xml
index 749b235bf0e5..e6c399334732 100644
--- a/net-wireless/wpa_supplicant/metadata.xml
+++ b/net-wireless/wpa_supplicant/metadata.xml
@@ -21,7 +21,9 @@
 		<flag name="ps3">Add support for ps3 hypervisor driven gelic wifi</flag>
 		<flag name="privsep">Enable wpa_priv privledge separation binary</flag>
 		<flag name="tdls">Add support for Tunneled Direct Link Setup (802.11z)</flag>
+		<flag name="tkip">Add support for WPA TKIP (deprecated 2009)</flag>
 		<flag name="uncommon-eap-types">Add support for GPSK, SAKE, GPSK_SHA256, IKEV2 and EKE</flag>
+		<flag name="wep">Add support for Wired Equivalent Privacy (deprecated 2004)</flag>
 		<flag name="wps">Add support for Wi-Fi Protected Setup</flag>
 		<flag name="wimax">Add support for Wimax EAP-PEER authentication algorithm</flag>
 		<flag name="smartcard">Add support for smartcards</flag>
diff --git a/net-wireless/wpa_supplicant/wpa_supplicant-2.10.ebuild b/net-wireless/wpa_supplicant/wpa_supplicant-2.10-r1.ebuild
index 3066970717f3..0430cf11a777 100644
--- a/net-wireless/wpa_supplicant/wpa_supplicant-2.10.ebuild
+++ b/net-wireless/wpa_supplicant/wpa_supplicant-2.10-r1.ebuild
@@ -13,17 +13,16 @@ if [ "${PV}" = "9999" ]; then
 	inherit git-r3
 	EGIT_REPO_URI="https://w1.fi/hostap.git"
 else
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~mips ppc ppc64 ~riscv ~sparc x86"
 	SRC_URI="https://w1.fi/releases/${P}.tar.gz"
-	SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-2.9-r3-patches.tar.bz2"
 fi
 
 SLOT="0"
-IUSE="ap +crda broadcom-sta dbus eap-sim eapol-test fasteap +fils +hs2-0 macsec +mbo +mesh p2p privsep ps3 qt5 readline selinux smartcard tdls uncommon-eap-types wimax wps"
+IUSE="ap +crda broadcom-sta dbus eap-sim eapol-test fasteap +fils +hs2-0 macsec +mbo +mesh p2p privsep ps3 qt5 readline selinux smartcard tdls tkip uncommon-eap-types wep wimax wps"
 
 # CONFIG_PRIVSEP=y does not have sufficient support for the new driver
 # interface functions used for MACsec, so this combination cannot be used
-# at least for now.
+# at least for now. bug #684442
 REQUIRED_USE="
 	macsec? ( !privsep )
 	privsep? ( !macsec )
@@ -271,9 +270,23 @@ src_configure() {
 	Kconfig_style_config OWE
 	Kconfig_style_config SAE
 	Kconfig_style_config DPP
+	Kconfig_style_config DPP2
 	Kconfig_style_config SUITEB192
 	Kconfig_style_config SUITEB
 
+	if use wep ; then
+		Kconfig_style_config WEP
+	else
+		Kconfig_style_config WEP n
+	fi
+
+	# Watch out, reversed logic
+	if use tkip ; then
+		Kconfig_style_config NO_TKIP n
+	else
+		Kconfig_style_config NO_TKIP
+	fi
+
 	if use smartcard ; then
 		Kconfig_style_config SMARTCARD
 	else
@@ -299,6 +312,10 @@ src_configure() {
 			#Kconfig_style_config DRIVER_MACSEC_QCA
 			Kconfig_style_config DRIVER_MACSEC_LINUX
 			Kconfig_style_config MACSEC
+		else
+			# bug #831369 and bug #684442
+			Kconfig_style_config DRIVER_MACSEC_LINUX n
+			Kconfig_style_config MACSEC n
 		fi
 
 		if use ps3 ; then
diff --git a/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r4.ebuild b/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r4.ebuild
deleted file mode 100644
index 1f17da11e7e4..000000000000
--- a/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r4.ebuild
+++ /dev/null
@@ -1,465 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit desktop qmake-utils readme.gentoo-r1 systemd toolchain-funcs
-
-DESCRIPTION="IEEE 802.1X/WPA supplicant for secure wireless transfers"
-HOMEPAGE="https://w1.fi/wpa_supplicant/"
-LICENSE="|| ( GPL-2 BSD )"
-
-if [ "${PV}" = "9999" ]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://w1.fi/hostap.git"
-else
-	KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~mips ppc ppc64 ~sparc x86"
-	SRC_URI="https://w1.fi/releases/${P}.tar.gz"
-fi
-
-SLOT="0"
-IUSE="ap bindist broadcom-sta dbus eap-sim eapol-test fasteap +fils +hs2-0 macsec +mbo +mesh p2p privsep ps3 qt5 readline selinux smartcard tdls uncommon-eap-types wimax wps"
-
-# CONFIG_PRIVSEP=y does not have sufficient support for the new driver
-# interface functions used for MACsec, so this combination cannot be used
-# at least for now.
-REQUIRED_USE="
-	macsec? ( !privsep )
-	privsep? ( !macsec )
-	broadcom-sta? ( !fils !mesh !mbo )
-"
-
-DEPEND="
-	>=dev-libs/openssl-1.0.2k:0=[bindist(-)=]
-	dbus? ( sys-apps/dbus )
-	kernel_linux? (
-		dev-libs/libnl:3
-		net-wireless/crda
-		eap-sim? ( sys-apps/pcsc-lite )
-	)
-	!kernel_linux? ( net-libs/libpcap )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtsvg:5
-		dev-qt/qtwidgets:5
-	)
-	readline? (
-		sys-libs/ncurses:0=
-		sys-libs/readline:0=
-	)
-"
-RDEPEND="${DEPEND}
-	selinux? ( sec-policy/selinux-networkmanager )
-"
-BDEPEND="virtual/pkgconfig"
-
-DOC_CONTENTS="
-	If this is a clean installation of wpa_supplicant, you
-	have to create a configuration file named
-	${EROOT}/etc/wpa_supplicant/wpa_supplicant.conf
-	An example configuration file is available for reference in
-	${EROOT}/usr/share/doc/${PF}/
-"
-
-S="${WORKDIR}/${P}/${PN}"
-
-Kconfig_style_config() {
-		#param 1 is CONFIG_* item
-		#param 2 is what to set it = to, defaulting in y
-		CONFIG_PARAM="${CONFIG_HEADER:-CONFIG_}$1"
-		setting="${2:-y}"
-
-		if [ ! $setting = n ]; then
-			#first remove any leading "# " if $2 is not n
-			sed -i "/^# *$CONFIG_PARAM=/s/^# *//" .config || echo "Kconfig_style_config error uncommenting $CONFIG_PARAM"
-			#set item = $setting (defaulting to y)
-			sed -i "/^$CONFIG_PARAM/s/=.*/=$setting/" .config || echo "Kconfig_style_config error setting $CONFIG_PARAM=$setting"
-			if [ -z "$( grep ^$CONFIG_PARAM= .config )" ] ; then
-				echo "$CONFIG_PARAM=$setting" >>.config
-			fi
-		else
-			#ensure item commented out
-			sed -i "/^$CONFIG_PARAM/s/$CONFIG_PARAM/# $CONFIG_PARAM/" .config || echo "Kconfig_style_config error commenting $CONFIG_PARAM"
-		fi
-}
-
-src_prepare() {
-	default
-
-	# net/bpf.h needed for net-libs/libpcap on Gentoo/FreeBSD
-	sed -i \
-		-e "s:\(#include <pcap\.h>\):#include <net/bpf.h>\n\1:" \
-		../src/l2_packet/l2_packet_freebsd.c || die
-
-	# People seem to take the example configuration file too literally (bug #102361)
-	sed -i \
-		-e "s:^\(opensc_engine_path\):#\1:" \
-		-e "s:^\(pkcs11_engine_path\):#\1:" \
-		-e "s:^\(pkcs11_module_path\):#\1:" \
-		wpa_supplicant.conf || die
-
-	# Change configuration to match Gentoo locations (bug #143750)
-	sed -i \
-		-e "s:/usr/lib/opensc:/usr/$(get_libdir):" \
-		-e "s:/usr/lib/pkcs11:/usr/$(get_libdir):" \
-		wpa_supplicant.conf || die
-
-	# systemd entries to D-Bus service files (bug #372877)
-	echo 'SystemdService=wpa_supplicant.service' \
-		| tee -a dbus/*.service >/dev/null || die
-
-	cd "${WORKDIR}/${P}" || die
-
-	if use wimax; then
-		# generate-libeap-peer.patch comes before
-		# fix-undefined-reference-to-random_get_bytes.patch
-		eapply "${FILESDIR}/${P}-generate-libeap-peer.patch"
-
-		# multilib-strict fix (bug #373685)
-		sed -e "s/\/usr\/lib/\/usr\/$(get_libdir)/" -i src/eap_peer/Makefile || die
-	fi
-
-	# bug (320097)
-	eapply "${FILESDIR}/${PN}-2.6-do-not-call-dbus-functions-with-NULL-path.patch"
-
-	# bug (640492)
-	sed -i 's#-Werror ##' wpa_supplicant/Makefile || die
-
-	#CVE-2019-16275 bug #696030
-	eapply "${FILESDIR}/wpa_supplicant-2.9-AP-Silently-ignore-management-frame-from-unexpected.patch"
-}
-
-src_configure() {
-	# Toolchain setup
-	tc-export CC PKG_CONFIG
-
-	cp defconfig .config || die
-
-	# Basic setup
-	Kconfig_style_config CTRL_IFACE
-	Kconfig_style_config MATCH_IFACE
-	Kconfig_style_config BACKEND file
-	Kconfig_style_config IBSS_RSN
-	Kconfig_style_config IEEE80211W
-	Kconfig_style_config IEEE80211R
-	Kconfig_style_config HT_OVERRIDES
-	Kconfig_style_config VHT_OVERRIDES
-	Kconfig_style_config OCV
-	Kconfig_style_config TLSV11
-	Kconfig_style_config TLSV12
-	Kconfig_style_config GETRANDOM
-
-	# Basic authentication methods
-	# NOTE: we don't set GPSK or SAKE as they conflict
-	# with the below options
-	Kconfig_style_config EAP_GTC
-	Kconfig_style_config EAP_MD5
-	Kconfig_style_config EAP_OTP
-	Kconfig_style_config EAP_PAX
-	Kconfig_style_config EAP_PSK
-	Kconfig_style_config EAP_TLV
-	Kconfig_style_config EAP_EXE
-	Kconfig_style_config IEEE8021X_EAPOL
-	Kconfig_style_config PKCS12
-	Kconfig_style_config PEERKEY
-	Kconfig_style_config EAP_LEAP
-	Kconfig_style_config EAP_MSCHAPV2
-	Kconfig_style_config EAP_PEAP
-	Kconfig_style_config EAP_TEAP
-	Kconfig_style_config EAP_TLS
-	Kconfig_style_config EAP_TTLS
-
-	# Enabling background scanning.
-	Kconfig_style_config BGSCAN_SIMPLE
-	Kconfig_style_config BGSCAN_LEARN
-
-	if use dbus ; then
-		Kconfig_style_config CTRL_IFACE_DBUS
-		Kconfig_style_config CTRL_IFACE_DBUS_NEW
-		Kconfig_style_config CTRL_IFACE_DBUS_INTRO
-	else
-		Kconfig_style_config CTRL_IFACE_DBUS n
-		Kconfig_style_config CTRL_IFACE_DBUS_NEW n
-		Kconfig_style_config CTRL_IFACE_DBUS_INTRO n
-	fi
-
-	if use eapol-test ; then
-		Kconfig_style_config EAPOL_TEST
-	fi
-
-	# Enable support for writing debug info to a log file and syslog.
-	Kconfig_style_config DEBUG_FILE
-	Kconfig_style_config DEBUG_SYSLOG
-
-	if use hs2-0 ; then
-		Kconfig_style_config INTERWORKING
-		Kconfig_style_config HS20
-	fi
-
-	if use mbo ; then
-		Kconfig_style_config MBO
-	else
-		Kconfig_style_config MBO n
-	fi
-
-	if use uncommon-eap-types; then
-		Kconfig_style_config EAP_GPSK
-		Kconfig_style_config EAP_SAKE
-		Kconfig_style_config EAP_GPSK_SHA256
-		Kconfig_style_config EAP_IKEV2
-		Kconfig_style_config EAP_EKE
-	fi
-
-	if use eap-sim ; then
-		# Smart card authentication
-		Kconfig_style_config EAP_SIM
-		Kconfig_style_config EAP_AKA
-		Kconfig_style_config EAP_AKA_PRIME
-		Kconfig_style_config PCSC
-	fi
-
-	if use fasteap ; then
-		Kconfig_style_config EAP_FAST
-	fi
-
-	if use readline ; then
-		# readline/history support for wpa_cli
-		Kconfig_style_config READLINE
-	else
-		#internal line edit mode for wpa_cli
-		Kconfig_style_config WPA_CLI_EDIT
-	fi
-
-	Kconfig_style_config TLS openssl
-	Kconfig_style_config FST
-	if ! use bindist ; then
-		Kconfig_style_config EAP_PWD
-		if use fils; then
-			Kconfig_style_config FILS
-			Kconfig_style_config FILS_SK_PFS
-		fi
-		if use mesh; then
-			Kconfig_style_config MESH
-		else
-			Kconfig_style_config MESH n
-		fi
-		#WPA3
-		Kconfig_style_config OWE
-		Kconfig_style_config SAE
-		Kconfig_style_config DPP
-		Kconfig_style_config SUITEB192
-		Kconfig_style_config SUITEB
-	fi
-
-	if use smartcard ; then
-		Kconfig_style_config SMARTCARD
-	else
-		Kconfig_style_config SMARTCARD n
-	fi
-
-	if use tdls ; then
-		Kconfig_style_config TDLS
-	fi
-
-	if use kernel_linux ; then
-		# Linux specific drivers
-		Kconfig_style_config DRIVER_ATMEL
-		Kconfig_style_config DRIVER_HOSTAP
-		Kconfig_style_config DRIVER_IPW
-		Kconfig_style_config DRIVER_NL80211
-		Kconfig_style_config DRIVER_RALINK
-		Kconfig_style_config DRIVER_WEXT
-		Kconfig_style_config DRIVER_WIRED
-
-		if use macsec ; then
-			#requires something, no idea what
-			#Kconfig_style_config DRIVER_MACSEC_QCA
-			Kconfig_style_config DRIVER_MACSEC_LINUX
-			Kconfig_style_config MACSEC
-		fi
-
-		if use ps3 ; then
-			Kconfig_style_config DRIVER_PS3
-		fi
-	fi
-
-	# Wi-Fi Protected Setup (WPS)
-	if use wps ; then
-		Kconfig_style_config WPS
-		Kconfig_style_config WPS2
-		# USB Flash Drive
-		Kconfig_style_config WPS_UFD
-		# External Registrar
-		Kconfig_style_config WPS_ER
-		# Universal Plug'n'Play
-		Kconfig_style_config WPS_UPNP
-		# Near Field Communication
-		Kconfig_style_config WPS_NFC
-	else
-		Kconfig_style_config WPS n
-		Kconfig_style_config WPS2 n
-		Kconfig_style_config WPS_UFD n
-		Kconfig_style_config WPS_ER n
-		Kconfig_style_config WPS_UPNP n
-		Kconfig_style_config WPS_NFC n
-	fi
-
-	# Wi-Fi Direct (WiDi)
-	if use p2p ; then
-		Kconfig_style_config P2P
-		Kconfig_style_config WIFI_DISPLAY
-	else
-		Kconfig_style_config P2P n
-		Kconfig_style_config WIFI_DISPLAY n
-	fi
-
-	# Access Point Mode
-	if use ap ; then
-		Kconfig_style_config AP
-	else
-		Kconfig_style_config AP n
-	fi
-
-	# Enable essentials for AP/P2P
-	if use ap || use p2p ; then
-		# Enabling HT support (802.11n)
-		Kconfig_style_config IEEE80211N
-
-		# Enabling VHT support (802.11ac)
-		Kconfig_style_config IEEE80211AC
-	fi
-
-	# Enable mitigation against certain attacks against TKIP
-	Kconfig_style_config DELAYED_MIC_ERROR_REPORT
-
-	if use privsep ; then
-		Kconfig_style_config PRIVSEP
-	fi
-
-	# If we are using libnl 2.0 and above, enable support for it
-	# Bug 382159
-	# Removed for now, since the 3.2 version is broken, and we don't
-	# support it.
-	if has_version ">=dev-libs/libnl-3.2"; then
-		Kconfig_style_config LIBNL32
-	fi
-
-	if use qt5 ; then
-		pushd "${S}"/wpa_gui-qt4 > /dev/null || die
-		eqmake5 wpa_gui.pro
-		popd > /dev/null || die
-	fi
-}
-
-src_compile() {
-	einfo "Building wpa_supplicant"
-	emake V=1 BINDIR=/usr/sbin
-
-	if use wimax; then
-		emake -C ../src/eap_peer clean
-		emake -C ../src/eap_peer
-	fi
-
-	if use qt5; then
-		einfo "Building wpa_gui"
-		emake -C "${S}"/wpa_gui-qt4
-	fi
-
-	if use eapol-test ; then
-		emake eapol_test
-	fi
-}
-
-src_install() {
-	dosbin wpa_supplicant
-	use privsep && dosbin wpa_priv
-	dobin wpa_cli wpa_passphrase
-
-	# baselayout-1 compat
-	if has_version "<sys-apps/baselayout-2.0.0"; then
-		dodir /sbin
-		dosym ../usr/sbin/wpa_supplicant /sbin/wpa_supplicant
-		dodir /bin
-		dosym ../usr/bin/wpa_cli /bin/wpa_cli
-	fi
-
-	if has_version ">=sys-apps/openrc-0.5.0"; then
-		newinitd "${FILESDIR}/${PN}-init.d" wpa_supplicant
-		newconfd "${FILESDIR}/${PN}-conf.d" wpa_supplicant
-	fi
-
-	exeinto /etc/wpa_supplicant/
-	newexe "${FILESDIR}/wpa_cli.sh" wpa_cli.sh
-
-	readme.gentoo_create_doc
-	dodoc ChangeLog {eap_testing,todo}.txt README{,-WPS} \
-		wpa_supplicant.conf
-
-	newdoc .config build-config
-
-	if [ "${PV}" != "9999" ]; then
-		doman doc/docbook/*.{5,8}
-	fi
-
-	if use qt5 ; then
-		into /usr
-		dobin wpa_gui-qt4/wpa_gui
-		doicon wpa_gui-qt4/icons/wpa_gui.svg
-		domenu wpa_gui-qt4/wpa_gui.desktop
-	else
-		rm "${ED}"/usr/share/man/man8/wpa_gui.8
-	fi
-
-	use wimax && emake DESTDIR="${D}" -C ../src/eap_peer install
-
-	if use dbus ; then
-		pushd "${S}"/dbus > /dev/null || die
-		insinto /etc/dbus-1/system.d
-		newins dbus-wpa_supplicant.conf wpa_supplicant.conf
-		insinto /usr/share/dbus-1/system-services
-		doins fi.w1.wpa_supplicant1.service
-		popd > /dev/null || die
-
-		# This unit relies on dbus support, bug 538600.
-		systemd_dounit systemd/wpa_supplicant.service
-	fi
-
-	if use eapol-test ; then
-		dobin eapol_test
-	fi
-
-	systemd_dounit "systemd/wpa_supplicant@.service"
-	systemd_dounit "systemd/wpa_supplicant-nl80211@.service"
-	systemd_dounit "systemd/wpa_supplicant-wired@.service"
-}
-
-pkg_postinst() {
-	readme.gentoo_print_elog
-
-	if [[ -e "${EROOT}"/etc/wpa_supplicant.conf ]] ; then
-		echo
-		ewarn "WARNING: your old configuration file ${EROOT}/etc/wpa_supplicant.conf"
-		ewarn "needs to be moved to ${EROOT}/etc/wpa_supplicant/wpa_supplicant.conf"
-	fi
-
-	if use bindist; then
-		ewarn "Using bindist use flag presently breaks WPA3 (specifically SAE, OWE, DPP, and FILS)."
-		ewarn "This is incredibly undesirable"
-	fi
-
-	# Mea culpa, feel free to remove that after some time --mgorny.
-	local fn
-	for fn in wpa_supplicant{,@wlan0}.service; do
-		if [[ -e "${EROOT}"/etc/systemd/system/network.target.wants/${fn} ]]
-		then
-			ebegin "Moving ${fn} to multi-user.target"
-			mv "${EROOT}"/etc/systemd/system/network.target.wants/${fn} \
-				"${EROOT}"/etc/systemd/system/multi-user.target.wants/ || die
-			eend ${?} \
-				"Please try to re-enable ${fn}"
-		fi
-	done
-
-	systemd_reenable wpa_supplicant.service
-}
diff --git a/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r5.ebuild b/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r5.ebuild
deleted file mode 100644
index 3be08e10a41d..000000000000
--- a/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r5.ebuild
+++ /dev/null
@@ -1,471 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit desktop qmake-utils readme.gentoo-r1 systemd toolchain-funcs
-
-DESCRIPTION="IEEE 802.1X/WPA supplicant for secure wireless transfers"
-HOMEPAGE="https://w1.fi/wpa_supplicant/"
-LICENSE="|| ( GPL-2 BSD )"
-
-if [ "${PV}" = "9999" ]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://w1.fi/hostap.git"
-else
-	KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~mips ppc ppc64 ~riscv ~sparc x86"
-	SRC_URI="https://w1.fi/releases/${P}.tar.gz"
-	SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-2.9-r3-patches.tar.bz2"
-fi
-
-SLOT="0"
-IUSE="ap bindist broadcom-sta dbus eap-sim eapol-test fasteap +fils +hs2-0 macsec +mbo +mesh p2p privsep ps3 qt5 readline selinux smartcard tdls uncommon-eap-types wimax wps"
-
-# CONFIG_PRIVSEP=y does not have sufficient support for the new driver
-# interface functions used for MACsec, so this combination cannot be used
-# at least for now.
-REQUIRED_USE="
-	macsec? ( !privsep )
-	privsep? ( !macsec )
-	broadcom-sta? ( !fils !mesh !mbo )
-"
-
-DEPEND="
-	>=dev-libs/openssl-1.0.2k:0=[bindist(-)=]
-	dbus? ( sys-apps/dbus )
-	kernel_linux? (
-		dev-libs/libnl:3
-		net-wireless/crda
-		eap-sim? ( sys-apps/pcsc-lite )
-	)
-	!kernel_linux? ( net-libs/libpcap )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtsvg:5
-		dev-qt/qtwidgets:5
-	)
-	readline? (
-		sys-libs/ncurses:0=
-		sys-libs/readline:0=
-	)
-"
-RDEPEND="${DEPEND}
-	selinux? ( sec-policy/selinux-networkmanager )
-"
-BDEPEND="virtual/pkgconfig"
-
-DOC_CONTENTS="
-	If this is a clean installation of wpa_supplicant, you
-	have to create a configuration file named
-	${EROOT}/etc/wpa_supplicant/wpa_supplicant.conf
-	An example configuration file is available for reference in
-	${EROOT}/usr/share/doc/${PF}/
-"
-
-S="${WORKDIR}/${P}/${PN}"
-
-Kconfig_style_config() {
-		#param 1 is CONFIG_* item
-		#param 2 is what to set it = to, defaulting in y
-		CONFIG_PARAM="${CONFIG_HEADER:-CONFIG_}$1"
-		setting="${2:-y}"
-
-		if [ ! $setting = n ]; then
-			#first remove any leading "# " if $2 is not n
-			sed -i "/^# *$CONFIG_PARAM=/s/^# *//" .config || echo "Kconfig_style_config error uncommenting $CONFIG_PARAM"
-			#set item = $setting (defaulting to y)
-			sed -i "/^$CONFIG_PARAM/s/=.*/=$setting/" .config || echo "Kconfig_style_config error setting $CONFIG_PARAM=$setting"
-			if [ -z "$( grep ^$CONFIG_PARAM= .config )" ] ; then
-				echo "$CONFIG_PARAM=$setting" >>.config
-			fi
-		else
-			#ensure item commented out
-			sed -i "/^$CONFIG_PARAM/s/$CONFIG_PARAM/# $CONFIG_PARAM/" .config || echo "Kconfig_style_config error commenting $CONFIG_PARAM"
-		fi
-}
-
-src_prepare() {
-	default
-
-	# net/bpf.h needed for net-libs/libpcap on Gentoo/FreeBSD
-	sed -i \
-		-e "s:\(#include <pcap\.h>\):#include <net/bpf.h>\n\1:" \
-		../src/l2_packet/l2_packet_freebsd.c || die
-
-	# People seem to take the example configuration file too literally (bug #102361)
-	sed -i \
-		-e "s:^\(opensc_engine_path\):#\1:" \
-		-e "s:^\(pkcs11_engine_path\):#\1:" \
-		-e "s:^\(pkcs11_module_path\):#\1:" \
-		wpa_supplicant.conf || die
-
-	# Change configuration to match Gentoo locations (bug #143750)
-	sed -i \
-		-e "s:/usr/lib/opensc:/usr/$(get_libdir):" \
-		-e "s:/usr/lib/pkcs11:/usr/$(get_libdir):" \
-		wpa_supplicant.conf || die
-
-	# systemd entries to D-Bus service files (bug #372877)
-	echo 'SystemdService=wpa_supplicant.service' \
-		| tee -a dbus/*.service >/dev/null || die
-
-	cd "${WORKDIR}/${P}" || die
-
-	if use wimax; then
-		# generate-libeap-peer.patch comes before
-		# fix-undefined-reference-to-random_get_bytes.patch
-		eapply "${FILESDIR}/${P}-generate-libeap-peer.patch"
-
-		# multilib-strict fix (bug #373685)
-		sed -e "s/\/usr\/lib/\/usr\/$(get_libdir)/" -i src/eap_peer/Makefile || die
-	fi
-
-	# bug (320097)
-	eapply "${FILESDIR}/${PN}-2.6-do-not-call-dbus-functions-with-NULL-path.patch"
-
-	# bug (640492)
-	sed -i 's#-Werror ##' wpa_supplicant/Makefile || die
-
-	## Security patches
-	# CVE-2019-16275 (bug #696030)
-	eapply "${FILESDIR}/wpa_supplicant-2.9-AP-Silently-ignore-management-frame-from-unexpected.patch"
-	# 2020-2, 2021-1 security advisories (bug #768759)
-	eapply "${WORKDIR}"/wpa_supplicant-2.9-r3-patches/security-{2020-2,2021-1}/*.patch
-	# CVE-2021-30004 (bug #780138)
-	eapply "${WORKDIR}"/wpa_supplicant-2.9-r3-patches/misc/CVE-2021-30004.patch
-}
-
-src_configure() {
-	# Toolchain setup
-	tc-export CC PKG_CONFIG
-
-	cp defconfig .config || die
-
-	# Basic setup
-	Kconfig_style_config CTRL_IFACE
-	Kconfig_style_config MATCH_IFACE
-	Kconfig_style_config BACKEND file
-	Kconfig_style_config IBSS_RSN
-	Kconfig_style_config IEEE80211W
-	Kconfig_style_config IEEE80211R
-	Kconfig_style_config HT_OVERRIDES
-	Kconfig_style_config VHT_OVERRIDES
-	Kconfig_style_config OCV
-	Kconfig_style_config TLSV11
-	Kconfig_style_config TLSV12
-	Kconfig_style_config GETRANDOM
-
-	# Basic authentication methods
-	# NOTE: we don't set GPSK or SAKE as they conflict
-	# with the below options
-	Kconfig_style_config EAP_GTC
-	Kconfig_style_config EAP_MD5
-	Kconfig_style_config EAP_OTP
-	Kconfig_style_config EAP_PAX
-	Kconfig_style_config EAP_PSK
-	Kconfig_style_config EAP_TLV
-	Kconfig_style_config EAP_EXE
-	Kconfig_style_config IEEE8021X_EAPOL
-	Kconfig_style_config PKCS12
-	Kconfig_style_config PEERKEY
-	Kconfig_style_config EAP_LEAP
-	Kconfig_style_config EAP_MSCHAPV2
-	Kconfig_style_config EAP_PEAP
-	Kconfig_style_config EAP_TEAP
-	Kconfig_style_config EAP_TLS
-	Kconfig_style_config EAP_TTLS
-
-	# Enabling background scanning.
-	Kconfig_style_config BGSCAN_SIMPLE
-	Kconfig_style_config BGSCAN_LEARN
-
-	if use dbus ; then
-		Kconfig_style_config CTRL_IFACE_DBUS
-		Kconfig_style_config CTRL_IFACE_DBUS_NEW
-		Kconfig_style_config CTRL_IFACE_DBUS_INTRO
-	else
-		Kconfig_style_config CTRL_IFACE_DBUS n
-		Kconfig_style_config CTRL_IFACE_DBUS_NEW n
-		Kconfig_style_config CTRL_IFACE_DBUS_INTRO n
-	fi
-
-	if use eapol-test ; then
-		Kconfig_style_config EAPOL_TEST
-	fi
-
-	# Enable support for writing debug info to a log file and syslog.
-	Kconfig_style_config DEBUG_FILE
-	Kconfig_style_config DEBUG_SYSLOG
-
-	if use hs2-0 ; then
-		Kconfig_style_config INTERWORKING
-		Kconfig_style_config HS20
-	fi
-
-	if use mbo ; then
-		Kconfig_style_config MBO
-	else
-		Kconfig_style_config MBO n
-	fi
-
-	if use uncommon-eap-types; then
-		Kconfig_style_config EAP_GPSK
-		Kconfig_style_config EAP_SAKE
-		Kconfig_style_config EAP_GPSK_SHA256
-		Kconfig_style_config EAP_IKEV2
-		Kconfig_style_config EAP_EKE
-	fi
-
-	if use eap-sim ; then
-		# Smart card authentication
-		Kconfig_style_config EAP_SIM
-		Kconfig_style_config EAP_AKA
-		Kconfig_style_config EAP_AKA_PRIME
-		Kconfig_style_config PCSC
-	fi
-
-	if use fasteap ; then
-		Kconfig_style_config EAP_FAST
-	fi
-
-	if use readline ; then
-		# readline/history support for wpa_cli
-		Kconfig_style_config READLINE
-	else
-		#internal line edit mode for wpa_cli
-		Kconfig_style_config WPA_CLI_EDIT
-	fi
-
-	Kconfig_style_config TLS openssl
-	Kconfig_style_config FST
-	if ! use bindist ; then
-		Kconfig_style_config EAP_PWD
-		if use fils; then
-			Kconfig_style_config FILS
-			Kconfig_style_config FILS_SK_PFS
-		fi
-		if use mesh; then
-			Kconfig_style_config MESH
-		else
-			Kconfig_style_config MESH n
-		fi
-		#WPA3
-		Kconfig_style_config OWE
-		Kconfig_style_config SAE
-		Kconfig_style_config DPP
-		Kconfig_style_config SUITEB192
-		Kconfig_style_config SUITEB
-	fi
-
-	if use smartcard ; then
-		Kconfig_style_config SMARTCARD
-	else
-		Kconfig_style_config SMARTCARD n
-	fi
-
-	if use tdls ; then
-		Kconfig_style_config TDLS
-	fi
-
-	if use kernel_linux ; then
-		# Linux specific drivers
-		Kconfig_style_config DRIVER_ATMEL
-		Kconfig_style_config DRIVER_HOSTAP
-		Kconfig_style_config DRIVER_IPW
-		Kconfig_style_config DRIVER_NL80211
-		Kconfig_style_config DRIVER_RALINK
-		Kconfig_style_config DRIVER_WEXT
-		Kconfig_style_config DRIVER_WIRED
-
-		if use macsec ; then
-			#requires something, no idea what
-			#Kconfig_style_config DRIVER_MACSEC_QCA
-			Kconfig_style_config DRIVER_MACSEC_LINUX
-			Kconfig_style_config MACSEC
-		fi
-
-		if use ps3 ; then
-			Kconfig_style_config DRIVER_PS3
-		fi
-	fi
-
-	# Wi-Fi Protected Setup (WPS)
-	if use wps ; then
-		Kconfig_style_config WPS
-		Kconfig_style_config WPS2
-		# USB Flash Drive
-		Kconfig_style_config WPS_UFD
-		# External Registrar
-		Kconfig_style_config WPS_ER
-		# Universal Plug'n'Play
-		Kconfig_style_config WPS_UPNP
-		# Near Field Communication
-		Kconfig_style_config WPS_NFC
-	else
-		Kconfig_style_config WPS n
-		Kconfig_style_config WPS2 n
-		Kconfig_style_config WPS_UFD n
-		Kconfig_style_config WPS_ER n
-		Kconfig_style_config WPS_UPNP n
-		Kconfig_style_config WPS_NFC n
-	fi
-
-	# Wi-Fi Direct (WiDi)
-	if use p2p ; then
-		Kconfig_style_config P2P
-		Kconfig_style_config WIFI_DISPLAY
-	else
-		Kconfig_style_config P2P n
-		Kconfig_style_config WIFI_DISPLAY n
-	fi
-
-	# Access Point Mode
-	if use ap ; then
-		Kconfig_style_config AP
-	else
-		Kconfig_style_config AP n
-	fi
-
-	# Enable essentials for AP/P2P
-	if use ap || use p2p ; then
-		# Enabling HT support (802.11n)
-		Kconfig_style_config IEEE80211N
-
-		# Enabling VHT support (802.11ac)
-		Kconfig_style_config IEEE80211AC
-	fi
-
-	# Enable mitigation against certain attacks against TKIP
-	Kconfig_style_config DELAYED_MIC_ERROR_REPORT
-
-	if use privsep ; then
-		Kconfig_style_config PRIVSEP
-	fi
-
-	# If we are using libnl 2.0 and above, enable support for it
-	# Bug 382159
-	# Removed for now, since the 3.2 version is broken, and we don't
-	# support it.
-	if has_version ">=dev-libs/libnl-3.2"; then
-		Kconfig_style_config LIBNL32
-	fi
-
-	if use qt5 ; then
-		pushd "${S}"/wpa_gui-qt4 > /dev/null || die
-		eqmake5 wpa_gui.pro
-		popd > /dev/null || die
-	fi
-}
-
-src_compile() {
-	einfo "Building wpa_supplicant"
-	emake V=1 BINDIR=/usr/sbin
-
-	if use wimax; then
-		emake -C ../src/eap_peer clean
-		emake -C ../src/eap_peer
-	fi
-
-	if use qt5; then
-		einfo "Building wpa_gui"
-		emake -C "${S}"/wpa_gui-qt4
-	fi
-
-	if use eapol-test ; then
-		emake eapol_test
-	fi
-}
-
-src_install() {
-	dosbin wpa_supplicant
-	use privsep && dosbin wpa_priv
-	dobin wpa_cli wpa_passphrase
-
-	# baselayout-1 compat
-	if has_version "<sys-apps/baselayout-2.0.0"; then
-		dodir /sbin
-		dosym ../usr/sbin/wpa_supplicant /sbin/wpa_supplicant
-		dodir /bin
-		dosym ../usr/bin/wpa_cli /bin/wpa_cli
-	fi
-
-	if has_version ">=sys-apps/openrc-0.5.0"; then
-		newinitd "${FILESDIR}/${PN}-init.d" wpa_supplicant
-		newconfd "${FILESDIR}/${PN}-conf.d" wpa_supplicant
-	fi
-
-	exeinto /etc/wpa_supplicant/
-	newexe "${FILESDIR}/wpa_cli.sh" wpa_cli.sh
-
-	readme.gentoo_create_doc
-	dodoc ChangeLog {eap_testing,todo}.txt README{,-WPS} \
-		wpa_supplicant.conf
-
-	newdoc .config build-config
-
-	if [ "${PV}" != "9999" ]; then
-		doman doc/docbook/*.{5,8}
-	fi
-
-	if use qt5 ; then
-		into /usr
-		dobin wpa_gui-qt4/wpa_gui
-		doicon wpa_gui-qt4/icons/wpa_gui.svg
-		domenu wpa_gui-qt4/wpa_gui.desktop
-	else
-		rm "${ED}"/usr/share/man/man8/wpa_gui.8
-	fi
-
-	use wimax && emake DESTDIR="${D}" -C ../src/eap_peer install
-
-	if use dbus ; then
-		pushd "${S}"/dbus > /dev/null || die
-		insinto /etc/dbus-1/system.d
-		newins dbus-wpa_supplicant.conf wpa_supplicant.conf
-		insinto /usr/share/dbus-1/system-services
-		doins fi.w1.wpa_supplicant1.service
-		popd > /dev/null || die
-
-		# This unit relies on dbus support, bug 538600.
-		systemd_dounit systemd/wpa_supplicant.service
-	fi
-
-	if use eapol-test ; then
-		dobin eapol_test
-	fi
-
-	systemd_dounit "systemd/wpa_supplicant@.service"
-	systemd_dounit "systemd/wpa_supplicant-nl80211@.service"
-	systemd_dounit "systemd/wpa_supplicant-wired@.service"
-}
-
-pkg_postinst() {
-	readme.gentoo_print_elog
-
-	if [[ -e "${EROOT}"/etc/wpa_supplicant.conf ]] ; then
-		echo
-		ewarn "WARNING: your old configuration file ${EROOT}/etc/wpa_supplicant.conf"
-		ewarn "needs to be moved to ${EROOT}/etc/wpa_supplicant/wpa_supplicant.conf"
-	fi
-
-	if use bindist; then
-		ewarn "Using bindist use flag presently breaks WPA3 (specifically SAE, OWE, DPP, and FILS)."
-		ewarn "This is incredibly undesirable"
-	fi
-
-	# Mea culpa, feel free to remove that after some time --mgorny.
-	local fn
-	for fn in wpa_supplicant{,@wlan0}.service; do
-		if [[ -e "${EROOT}"/etc/systemd/system/network.target.wants/${fn} ]]
-		then
-			ebegin "Moving ${fn} to multi-user.target"
-			mv "${EROOT}"/etc/systemd/system/network.target.wants/${fn} \
-				"${EROOT}"/etc/systemd/system/multi-user.target.wants/ || die
-			eend ${?} \
-				"Please try to re-enable ${fn}"
-		fi
-	done
-
-	systemd_reenable wpa_supplicant.service
-}
diff --git a/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r8.ebuild b/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r8.ebuild
deleted file mode 100644
index 1b4727fa9173..000000000000
--- a/net-wireless/wpa_supplicant/wpa_supplicant-2.9-r8.ebuild
+++ /dev/null
@@ -1,490 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit desktop linux-info qmake-utils readme.gentoo-r1 systemd toolchain-funcs
-
-DESCRIPTION="IEEE 802.1X/WPA supplicant for secure wireless transfers"
-HOMEPAGE="https://w1.fi/wpa_supplicant/"
-LICENSE="|| ( GPL-2 BSD )"
-
-if [ "${PV}" = "9999" ]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://w1.fi/hostap.git"
-else
-	KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~mips ppc ppc64 ~riscv ~sparc x86"
-	SRC_URI="https://w1.fi/releases/${P}.tar.gz"
-	SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-2.9-r3-patches.tar.bz2"
-fi
-
-SLOT="0"
-IUSE="ap +crda broadcom-sta dbus eap-sim eapol-test fasteap +fils +hs2-0 macsec +mbo +mesh p2p privsep ps3 qt5 readline selinux smartcard tdls uncommon-eap-types wimax wps"
-
-# CONFIG_PRIVSEP=y does not have sufficient support for the new driver
-# interface functions used for MACsec, so this combination cannot be used
-# at least for now.
-REQUIRED_USE="
-	macsec? ( !privsep )
-	privsep? ( !macsec )
-	broadcom-sta? ( !fils !mesh !mbo )
-"
-
-DEPEND="
-	>=dev-libs/openssl-1.0.2k:=
-	dbus? ( sys-apps/dbus )
-	kernel_linux? (
-		dev-libs/libnl:3
-		eap-sim? ( sys-apps/pcsc-lite )
-	)
-	!kernel_linux? ( net-libs/libpcap )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtsvg:5
-		dev-qt/qtwidgets:5
-	)
-	readline? (
-		sys-libs/ncurses:0=
-		sys-libs/readline:0=
-	)
-"
-RDEPEND="${DEPEND}
-	selinux? ( sec-policy/selinux-networkmanager )
-	kernel_linux? (
-		net-wireless/wireless-regdb
-		crda? ( net-wireless/crda )
-	)
-"
-BDEPEND="virtual/pkgconfig"
-
-DOC_CONTENTS="
-	If this is a clean installation of wpa_supplicant, you
-	have to create a configuration file named
-	${EROOT}/etc/wpa_supplicant/wpa_supplicant.conf
-	An example configuration file is available for reference in
-	${EROOT}/usr/share/doc/${PF}/
-"
-
-S="${WORKDIR}/${P}/${PN}"
-
-Kconfig_style_config() {
-		#param 1 is CONFIG_* item
-		#param 2 is what to set it = to, defaulting in y
-		CONFIG_PARAM="${CONFIG_HEADER:-CONFIG_}$1"
-		setting="${2:-y}"
-
-		if [ ! $setting = n ]; then
-			#first remove any leading "# " if $2 is not n
-			sed -i "/^# *$CONFIG_PARAM=/s/^# *//" .config || echo "Kconfig_style_config error uncommenting $CONFIG_PARAM"
-			#set item = $setting (defaulting to y)
-			sed -i "/^$CONFIG_PARAM/s/=.*/=$setting/" .config || echo "Kconfig_style_config error setting $CONFIG_PARAM=$setting"
-			if [ -z "$( grep ^$CONFIG_PARAM= .config )" ] ; then
-				echo "$CONFIG_PARAM=$setting" >>.config
-			fi
-		else
-			#ensure item commented out
-			sed -i "/^$CONFIG_PARAM/s/$CONFIG_PARAM/# $CONFIG_PARAM/" .config || echo "Kconfig_style_config error commenting $CONFIG_PARAM"
-		fi
-}
-
-pkg_pretend() {
-	CONFIG_CHECK=""
-
-	if use crda ; then
-		CONFIG_CHECK="${CONFIG_CHECK} ~CFG80211_CRDA_SUPPORT"
-		WARNING_CFG80211_CRDA_SUPPORT="REGULATORY DOMAIN PROBLEM: please enable CFG80211_CRDA_SUPPORT for proper regulatory domain support"
-	fi
-
-	check_extra_config
-
-	if ! use crda ; then
-		if linux_config_exists && linux_chkconfig_builtin CFG80211 &&
-			[[ $(linux_chkconfig_string EXTRA_FIRMWARE) != *regulatory.db* ]]
-		then
-			ewarn "REGULATORY DOMAIN PROBLEM:"
-			ewarn "With CONFIG_CFG80211=y (built-in), the driver won't be able to load regulatory.db from"
-			ewarn " /lib/firmware, resulting in broken regulatory domain support.  Please set CONFIG_CFG80211=m"
-			ewarn " or add regulatory.db and regulatory.db.p7s to CONFIG_EXTRA_FIRMWARE."
-		fi
-	fi
-}
-
-src_prepare() {
-	default
-
-	# net/bpf.h needed for net-libs/libpcap on Gentoo/FreeBSD
-	sed -i \
-		-e "s:\(#include <pcap\.h>\):#include <net/bpf.h>\n\1:" \
-		../src/l2_packet/l2_packet_freebsd.c || die
-
-	# People seem to take the example configuration file too literally (bug #102361)
-	sed -i \
-		-e "s:^\(opensc_engine_path\):#\1:" \
-		-e "s:^\(pkcs11_engine_path\):#\1:" \
-		-e "s:^\(pkcs11_module_path\):#\1:" \
-		wpa_supplicant.conf || die
-
-	# Change configuration to match Gentoo locations (bug #143750)
-	sed -i \
-		-e "s:/usr/lib/opensc:/usr/$(get_libdir):" \
-		-e "s:/usr/lib/pkcs11:/usr/$(get_libdir):" \
-		wpa_supplicant.conf || die
-
-	# systemd entries to D-Bus service files (bug #372877)
-	echo 'SystemdService=wpa_supplicant.service' \
-		| tee -a dbus/*.service >/dev/null || die
-
-	cd "${WORKDIR}/${P}" || die
-
-	if use wimax; then
-		# generate-libeap-peer.patch comes before
-		# fix-undefined-reference-to-random_get_bytes.patch
-		eapply "${FILESDIR}/${P}-generate-libeap-peer.patch"
-
-		# multilib-strict fix (bug #373685)
-		sed -e "s/\/usr\/lib/\/usr\/$(get_libdir)/" -i src/eap_peer/Makefile || die
-	fi
-
-	# bug (320097)
-	eapply "${FILESDIR}/${PN}-2.6-do-not-call-dbus-functions-with-NULL-path.patch"
-
-	# bug (640492)
-	sed -i 's#-Werror ##' wpa_supplicant/Makefile || die
-
-	## Security patches
-	# CVE-2019-16275 (bug #696030)
-	eapply "${FILESDIR}/wpa_supplicant-2.9-AP-Silently-ignore-management-frame-from-unexpected.patch"
-	# 2020-2, 2021-1 security advisories (bug #768759)
-	eapply "${WORKDIR}"/wpa_supplicant-2.9-r3-patches/security-{2020-2,2021-1}/*.patch
-	# CVE-2021-30004 (bug #780138)
-	eapply "${WORKDIR}"/wpa_supplicant-2.9-r3-patches/misc/CVE-2021-30004.patch
-}
-
-src_configure() {
-	# Toolchain setup
-	tc-export CC PKG_CONFIG
-
-	cp defconfig .config || die
-
-	# Basic setup
-	Kconfig_style_config CTRL_IFACE
-	Kconfig_style_config MATCH_IFACE
-	Kconfig_style_config BACKEND file
-	Kconfig_style_config IBSS_RSN
-	Kconfig_style_config IEEE80211W
-	Kconfig_style_config IEEE80211R
-	Kconfig_style_config HT_OVERRIDES
-	Kconfig_style_config VHT_OVERRIDES
-	Kconfig_style_config OCV
-	Kconfig_style_config TLSV11
-	Kconfig_style_config TLSV12
-	Kconfig_style_config GETRANDOM
-
-	# Basic authentication methods
-	# NOTE: we don't set GPSK or SAKE as they conflict
-	# with the below options
-	Kconfig_style_config EAP_GTC
-	Kconfig_style_config EAP_MD5
-	Kconfig_style_config EAP_OTP
-	Kconfig_style_config EAP_PAX
-	Kconfig_style_config EAP_PSK
-	Kconfig_style_config EAP_TLV
-	Kconfig_style_config EAP_EXE
-	Kconfig_style_config IEEE8021X_EAPOL
-	Kconfig_style_config PKCS12
-	Kconfig_style_config PEERKEY
-	Kconfig_style_config EAP_LEAP
-	Kconfig_style_config EAP_MSCHAPV2
-	Kconfig_style_config EAP_PEAP
-	Kconfig_style_config EAP_TEAP
-	Kconfig_style_config EAP_TLS
-	Kconfig_style_config EAP_TTLS
-
-	# Enabling background scanning.
-	Kconfig_style_config BGSCAN_SIMPLE
-	Kconfig_style_config BGSCAN_LEARN
-
-	if use dbus ; then
-		Kconfig_style_config CTRL_IFACE_DBUS
-		Kconfig_style_config CTRL_IFACE_DBUS_NEW
-		Kconfig_style_config CTRL_IFACE_DBUS_INTRO
-	else
-		Kconfig_style_config CTRL_IFACE_DBUS n
-		Kconfig_style_config CTRL_IFACE_DBUS_NEW n
-		Kconfig_style_config CTRL_IFACE_DBUS_INTRO n
-	fi
-
-	if use eapol-test ; then
-		Kconfig_style_config EAPOL_TEST
-	fi
-
-	# Enable support for writing debug info to a log file and syslog.
-	Kconfig_style_config DEBUG_FILE
-	Kconfig_style_config DEBUG_SYSLOG
-
-	if use hs2-0 ; then
-		Kconfig_style_config INTERWORKING
-		Kconfig_style_config HS20
-	fi
-
-	if use mbo ; then
-		Kconfig_style_config MBO
-	else
-		Kconfig_style_config MBO n
-	fi
-
-	if use uncommon-eap-types; then
-		Kconfig_style_config EAP_GPSK
-		Kconfig_style_config EAP_SAKE
-		Kconfig_style_config EAP_GPSK_SHA256
-		Kconfig_style_config EAP_IKEV2
-		Kconfig_style_config EAP_EKE
-	fi
-
-	if use eap-sim ; then
-		# Smart card authentication
-		Kconfig_style_config EAP_SIM
-		Kconfig_style_config EAP_AKA
-		Kconfig_style_config EAP_AKA_PRIME
-		Kconfig_style_config PCSC
-	fi
-
-	if use fasteap ; then
-		Kconfig_style_config EAP_FAST
-	fi
-
-	if use readline ; then
-		# readline/history support for wpa_cli
-		Kconfig_style_config READLINE
-	else
-		#internal line edit mode for wpa_cli
-		Kconfig_style_config WPA_CLI_EDIT
-	fi
-
-	Kconfig_style_config TLS openssl
-	Kconfig_style_config FST
-
-	Kconfig_style_config EAP_PWD
-	if use fils; then
-		Kconfig_style_config FILS
-		Kconfig_style_config FILS_SK_PFS
-	fi
-	if use mesh; then
-		Kconfig_style_config MESH
-	else
-		Kconfig_style_config MESH n
-	fi
-	# WPA3
-	Kconfig_style_config OWE
-	Kconfig_style_config SAE
-	Kconfig_style_config DPP
-	Kconfig_style_config SUITEB192
-	Kconfig_style_config SUITEB
-
-	if use smartcard ; then
-		Kconfig_style_config SMARTCARD
-	else
-		Kconfig_style_config SMARTCARD n
-	fi
-
-	if use tdls ; then
-		Kconfig_style_config TDLS
-	fi
-
-	if use kernel_linux ; then
-		# Linux specific drivers
-		Kconfig_style_config DRIVER_ATMEL
-		Kconfig_style_config DRIVER_HOSTAP
-		Kconfig_style_config DRIVER_IPW
-		Kconfig_style_config DRIVER_NL80211
-		Kconfig_style_config DRIVER_RALINK
-		Kconfig_style_config DRIVER_WEXT
-		Kconfig_style_config DRIVER_WIRED
-
-		if use macsec ; then
-			#requires something, no idea what
-			#Kconfig_style_config DRIVER_MACSEC_QCA
-			Kconfig_style_config DRIVER_MACSEC_LINUX
-			Kconfig_style_config MACSEC
-		fi
-
-		if use ps3 ; then
-			Kconfig_style_config DRIVER_PS3
-		fi
-	fi
-
-	# Wi-Fi Protected Setup (WPS)
-	if use wps ; then
-		Kconfig_style_config WPS
-		Kconfig_style_config WPS2
-		# USB Flash Drive
-		Kconfig_style_config WPS_UFD
-		# External Registrar
-		Kconfig_style_config WPS_ER
-		# Universal Plug'n'Play
-		Kconfig_style_config WPS_UPNP
-		# Near Field Communication
-		Kconfig_style_config WPS_NFC
-	else
-		Kconfig_style_config WPS n
-		Kconfig_style_config WPS2 n
-		Kconfig_style_config WPS_UFD n
-		Kconfig_style_config WPS_ER n
-		Kconfig_style_config WPS_UPNP n
-		Kconfig_style_config WPS_NFC n
-	fi
-
-	# Wi-Fi Direct (WiDi)
-	if use p2p ; then
-		Kconfig_style_config P2P
-		Kconfig_style_config WIFI_DISPLAY
-	else
-		Kconfig_style_config P2P n
-		Kconfig_style_config WIFI_DISPLAY n
-	fi
-
-	# Access Point Mode
-	if use ap ; then
-		Kconfig_style_config AP
-	else
-		Kconfig_style_config AP n
-	fi
-
-	# Enable essentials for AP/P2P
-	if use ap || use p2p ; then
-		# Enabling HT support (802.11n)
-		Kconfig_style_config IEEE80211N
-
-		# Enabling VHT support (802.11ac)
-		Kconfig_style_config IEEE80211AC
-	fi
-
-	# Enable mitigation against certain attacks against TKIP
-	Kconfig_style_config DELAYED_MIC_ERROR_REPORT
-
-	if use privsep ; then
-		Kconfig_style_config PRIVSEP
-	fi
-
-	# If we are using libnl 2.0 and above, enable support for it
-	# Bug 382159
-	# Removed for now, since the 3.2 version is broken, and we don't
-	# support it.
-	if has_version ">=dev-libs/libnl-3.2"; then
-		Kconfig_style_config LIBNL32
-	fi
-
-	if use qt5 ; then
-		pushd "${S}"/wpa_gui-qt4 > /dev/null || die
-		eqmake5 wpa_gui.pro
-		popd > /dev/null || die
-	fi
-}
-
-src_compile() {
-	einfo "Building wpa_supplicant"
-	emake V=1 BINDIR=/usr/sbin
-
-	if use wimax; then
-		emake -C ../src/eap_peer clean
-		emake -C ../src/eap_peer
-	fi
-
-	if use qt5; then
-		einfo "Building wpa_gui"
-		emake -C "${S}"/wpa_gui-qt4
-	fi
-
-	if use eapol-test ; then
-		emake eapol_test
-	fi
-}
-
-src_install() {
-	dosbin wpa_supplicant
-	use privsep && dosbin wpa_priv
-	dobin wpa_cli wpa_passphrase
-
-	# baselayout-1 compat
-	if has_version "<sys-apps/baselayout-2.0.0"; then
-		dodir /sbin
-		dosym ../usr/sbin/wpa_supplicant /sbin/wpa_supplicant
-		dodir /bin
-		dosym ../usr/bin/wpa_cli /bin/wpa_cli
-	fi
-
-	if has_version ">=sys-apps/openrc-0.5.0"; then
-		newinitd "${FILESDIR}/${PN}-init.d" wpa_supplicant
-		newconfd "${FILESDIR}/${PN}-conf.d" wpa_supplicant
-	fi
-
-	exeinto /etc/wpa_supplicant/
-	newexe "${FILESDIR}/wpa_cli.sh" wpa_cli.sh
-
-	readme.gentoo_create_doc
-	dodoc ChangeLog {eap_testing,todo}.txt README{,-WPS} \
-		wpa_supplicant.conf
-
-	newdoc .config build-config
-
-	if [ "${PV}" != "9999" ]; then
-		doman doc/docbook/*.{5,8}
-	fi
-
-	if use qt5 ; then
-		into /usr
-		dobin wpa_gui-qt4/wpa_gui
-		doicon wpa_gui-qt4/icons/wpa_gui.svg
-		domenu wpa_gui-qt4/wpa_gui.desktop
-	else
-		rm "${ED}"/usr/share/man/man8/wpa_gui.8
-	fi
-
-	use wimax && emake DESTDIR="${D}" -C ../src/eap_peer install
-
-	if use dbus ; then
-		pushd "${S}"/dbus > /dev/null || die
-		insinto /etc/dbus-1/system.d
-		newins dbus-wpa_supplicant.conf wpa_supplicant.conf
-		insinto /usr/share/dbus-1/system-services
-		doins fi.w1.wpa_supplicant1.service
-		popd > /dev/null || die
-
-		# This unit relies on dbus support, bug 538600.
-		systemd_dounit systemd/wpa_supplicant.service
-	fi
-
-	if use eapol-test ; then
-		dobin eapol_test
-	fi
-
-	systemd_dounit "systemd/wpa_supplicant@.service"
-	systemd_dounit "systemd/wpa_supplicant-nl80211@.service"
-	systemd_dounit "systemd/wpa_supplicant-wired@.service"
-}
-
-pkg_postinst() {
-	readme.gentoo_print_elog
-
-	if [[ -e "${EROOT}"/etc/wpa_supplicant.conf ]] ; then
-		echo
-		ewarn "WARNING: your old configuration file ${EROOT}/etc/wpa_supplicant.conf"
-		ewarn "needs to be moved to ${EROOT}/etc/wpa_supplicant/wpa_supplicant.conf"
-	fi
-
-	# Mea culpa, feel free to remove that after some time --mgorny.
-	local fn
-	for fn in wpa_supplicant{,@wlan0}.service; do
-		if [[ -e "${EROOT}"/etc/systemd/system/network.target.wants/${fn} ]]
-		then
-			ebegin "Moving ${fn} to multi-user.target"
-			mv "${EROOT}"/etc/systemd/system/network.target.wants/${fn} \
-				"${EROOT}"/etc/systemd/system/multi-user.target.wants/ || die
-			eend ${?} \
-				"Please try to re-enable ${fn}"
-		fi
-	done
-
-	systemd_reenable wpa_supplicant.service
-}
diff --git a/net-wireless/wpa_supplicant/wpa_supplicant-9999.ebuild b/net-wireless/wpa_supplicant/wpa_supplicant-9999.ebuild
index 3066970717f3..d0aba4022747 100644
--- a/net-wireless/wpa_supplicant/wpa_supplicant-9999.ebuild
+++ b/net-wireless/wpa_supplicant/wpa_supplicant-9999.ebuild
@@ -15,15 +15,14 @@ if [ "${PV}" = "9999" ]; then
 else
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
 	SRC_URI="https://w1.fi/releases/${P}.tar.gz"
-	SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-2.9-r3-patches.tar.bz2"
 fi
 
 SLOT="0"
-IUSE="ap +crda broadcom-sta dbus eap-sim eapol-test fasteap +fils +hs2-0 macsec +mbo +mesh p2p privsep ps3 qt5 readline selinux smartcard tdls uncommon-eap-types wimax wps"
+IUSE="ap +crda broadcom-sta dbus eap-sim eapol-test fasteap +fils +hs2-0 macsec +mbo +mesh p2p privsep ps3 qt5 readline selinux smartcard tdls tkip uncommon-eap-types wep wimax wps"
 
 # CONFIG_PRIVSEP=y does not have sufficient support for the new driver
 # interface functions used for MACsec, so this combination cannot be used
-# at least for now.
+# at least for now. bug #684442
 REQUIRED_USE="
 	macsec? ( !privsep )
 	privsep? ( !macsec )
@@ -271,9 +270,23 @@ src_configure() {
 	Kconfig_style_config OWE
 	Kconfig_style_config SAE
 	Kconfig_style_config DPP
+	Kconfig_style_config DPP2
 	Kconfig_style_config SUITEB192
 	Kconfig_style_config SUITEB
 
+	if use wep ; then
+		Kconfig_style_config WEP
+	else
+		Kconfig_style_config WEP n
+	fi
+
+	# Watch out, reversed logic
+	if use tkip ; then
+		Kconfig_style_config NO_TKIP n
+	else
+		Kconfig_style_config NO_TKIP
+	fi
+
 	if use smartcard ; then
 		Kconfig_style_config SMARTCARD
 	else
@@ -299,6 +312,10 @@ src_configure() {
 			#Kconfig_style_config DRIVER_MACSEC_QCA
 			Kconfig_style_config DRIVER_MACSEC_LINUX
 			Kconfig_style_config MACSEC
+		else
+			# bug #831369 and bug #684442
+			Kconfig_style_config DRIVER_MACSEC_LINUX n
+			Kconfig_style_config MACSEC n
 		fi
 
 		if use ps3 ; then