Merge ~mitchellaugustin/ubuntu/+source/wpa:resolute-sae-mismatch into ubuntu/+source/wpa:ubuntu/devel

[Mitchell Augustin]

Add SaePasswordMismatch signal handling (LP: #2125203)

Add SaePasswordMismatch signal handling (LP: #2125203)

This MP reverts a prior change to PskMismatch signal emission, which upstream said had the potential to be too aggressive and could introduce regressions [0].

The new patch (SaePasswordMismatch signal handler) implements the upstream approved and merged version of this functionality, which allows failed connections to WPA3 networks to prompt the user to enter their password correctly, without the prior patch's risk for false positives.

[0] https://lists.infradead.org/pipermail/hostap/2025-October/043804.html

[Mitchell Augustin (mitchellaugustin)]

Tested using the wpa in https://launchpad.net/~mitchellaugustin/+archive/ubuntu/quick-publish-dev-ppa-10-10-25/+packages and the NM in https://launchpad.net/~mitchellaugustin/+archive/ubuntu/wpa3-sae-signal-10-3-25, which has been patched to include https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2293 (which we expect will land upstream soon).

[Mitchell Augustin (mitchellaugustin)]

Fixed, thanks!

Unmerged commits

834daf3... by Mitchell Augustin on 2025-12-02

Changelog update for SaePasswordMismatch signal fix

7e89981... by Mitchell Augustin on 2025-12-02

Add SaePasswordMismatch signal handler (LP: #2125203)

1cf2139... by Mitchell Augustin on 2025-12-02

Remove old version of PSKMismatch signal detection enhancement

diff --git a/debian/changelog b/debian/changelog
index 3303a0a..d3d63e5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+wpa (2:2.11-0ubuntu5) resolute; urgency=medium
+
+  * Add SaePasswordMismatch signal handling (LP: #2125203)
+  * Revert "Improve PSK mismatch detection and dbus signal" (LP: #2125203)
+
+ -- Mitchell Augustin <[e-mail]>  Tue, 02 Dec 2025 15:57:00 -0600
+
 wpa (2:2.11-0ubuntu4) questing; urgency=medium
 
   * Improve PSK mismatch detection and dbus signal (LP: #2125203)
diff --git a/debian/patches/0016-dbus-Add-SaePasswordMismatch-signal-on-AP-indication.patch b/debian/patches/0016-dbus-Add-SaePasswordMismatch-signal-on-AP-indication.patch
new file mode 100644
index 0000000..681d092
--- /dev/null
+++ b/debian/patches/0016-dbus-Add-SaePasswordMismatch-signal-on-AP-indication.patch
@@ -0,0 +1,131 @@
+From: Mitchell Augustin <[e-mail]>
+Date: Fri, 3 Oct 2025 12:57:58 -0500
+Subject: dbus: Add SaePasswordMismatch signal on AP indication of failed SAE
+ auth
+
+Per the IEEE 802.11 standard, status code 15
+(WLAN_STATUS_CHALLENGE_FAIL), when returned in an Authentication frame
+of an SAE exchange, is indicative of a password mismatch.
+
+Add a new dbus signal "SaePasswordMismatch" and emit it when a password
+mismatch is detected as defined by that scenario.
+
+Discussion: https://lists.infradead.org/pipermail/hostap/2025-October/043817.html
+
+(cherry picked from commit 446a274b89e32dac8934f64822e5a3acee190dad)
+Signed-off-by: Mitchell Augustin <[e-mail]>
+
+Author: Mitchell Augustin <[e-mail]>
+Bug-Ubuntu: https://launchpad.net/bugs/2125203
+Origin: upstream, 446a274b89e32dac8934f64822e5a3acee190dad
+Forwarded: not-needed
+---
+ wpa_supplicant/dbus/dbus_new.c | 23 +++++++++++++++++++++++
+ wpa_supplicant/dbus/dbus_new.h |  6 ++++++
+ wpa_supplicant/notify.c        |  6 ++++++
+ wpa_supplicant/notify.h        |  1 +
+ wpa_supplicant/sme.c           |  4 ++++
+ 5 files changed, 40 insertions(+)
+
+diff --git a/wpa_supplicant/dbus/dbus_new.c b/wpa_supplicant/dbus/dbus_new.c
+index 76e42ff..0fe009c 100644
+--- a/wpa_supplicant/dbus/dbus_new.c
++++ b/wpa_supplicant/dbus/dbus_new.c
+@@ -1159,6 +1159,29 @@ void wpas_dbus_signal_psk_mismatch(struct wpa_supplicant *wpa_s)
+ }
+ 
+ 
++void wpas_dbus_signal_sae_password_mismatch(struct wpa_supplicant *wpa_s)
++{
++	struct wpas_dbus_priv *iface;
++	DBusMessage *msg;
++
++	iface = wpa_s->global->dbus;
++
++	/* Do nothing if the control interface is not turned on */
++	if (!iface || !wpa_s->dbus_new_path)
++		return;
++
++	msg = dbus_message_new_signal(wpa_s->dbus_new_path,
++				      WPAS_DBUS_NEW_IFACE_INTERFACE,
++				      "SaePasswordMismatch");
++	if (!msg)
++		return;
++
++	dbus_connection_send(iface->con, msg, NULL);
++
++	dbus_message_unref(msg);
++}
++
++
+ /**
+  * wpas_dbus_signal_sta - Send a station related event signal
+  * @wpa_s: %wpa_supplicant network interface data
+diff --git a/wpa_supplicant/dbus/dbus_new.h b/wpa_supplicant/dbus/dbus_new.h
+index 952bb42..bd78b7c 100644
+--- a/wpa_supplicant/dbus/dbus_new.h
++++ b/wpa_supplicant/dbus/dbus_new.h
+@@ -256,6 +256,7 @@ void wpas_dbus_signal_preq(struct wpa_supplicant *wpa_s,
+ void wpas_dbus_signal_eap_status(struct wpa_supplicant *wpa_s,
+ 				 const char *status, const char *parameter);
+ void wpas_dbus_signal_psk_mismatch(struct wpa_supplicant *wpa_s);
++void wpas_dbus_signal_sae_password_mismatch(struct wpa_supplicant *wpa_s);
+ void wpas_dbus_signal_sta_authorized(struct wpa_supplicant *wpa_s,
+ 				     const u8 *sta);
+ void wpas_dbus_signal_sta_deauthorized(struct wpa_supplicant *wpa_s,
+@@ -595,6 +596,11 @@ static inline void wpas_dbus_signal_psk_mismatch(struct wpa_supplicant *wpa_s)
+ {
+ }
+ 
++static inline void
++wpas_dbus_signal_sae_password_mismatch(struct wpa_supplicant *wpa_s)
++{
++}
++
+ static inline
+ void wpas_dbus_signal_sta_authorized(struct wpa_supplicant *wpa_s,
+ 				     const u8 *sta)
+diff --git a/wpa_supplicant/notify.c b/wpa_supplicant/notify.c
+index e967dc8..a890133 100644
+--- a/wpa_supplicant/notify.c
++++ b/wpa_supplicant/notify.c
+@@ -912,6 +912,12 @@ void wpas_notify_psk_mismatch(struct wpa_supplicant *wpa_s)
+ }
+ 
+ 
++void wpas_notify_sae_password_mismatch(struct wpa_supplicant *wpa_s)
++{
++	wpas_dbus_signal_sae_password_mismatch(wpa_s);
++}
++
++
+ void wpas_notify_network_bssid_set_changed(struct wpa_supplicant *wpa_s,
+ 					   struct wpa_ssid *ssid)
+ {
+diff --git a/wpa_supplicant/notify.h b/wpa_supplicant/notify.h
+index f6c7ac4..eaf588b 100644
+--- a/wpa_supplicant/notify.h
++++ b/wpa_supplicant/notify.h
+@@ -146,6 +146,7 @@ void wpas_notify_eap_status(struct wpa_supplicant *wpa_s, const char *status,
+ 			    const char *parameter);
+ void wpas_notify_eap_error(struct wpa_supplicant *wpa_s, int error_code);
+ void wpas_notify_psk_mismatch(struct wpa_supplicant *wpa_s);
++void wpas_notify_sae_password_mismatch(struct wpa_supplicant *wpa_s);
+ void wpas_notify_network_bssid_set_changed(struct wpa_supplicant *wpa_s,
+ 					   struct wpa_ssid *ssid);
+ void wpas_notify_network_type_changed(struct wpa_supplicant *wpa_s,
+diff --git a/wpa_supplicant/sme.c b/wpa_supplicant/sme.c
+index e6538e8..502fda1 100644
+--- a/wpa_supplicant/sme.c
++++ b/wpa_supplicant/sme.c
+@@ -2030,6 +2030,10 @@ void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
+ 				   data->auth.ies_len, 0, data->auth.peer,
+ 				   &ie_offset);
+ 		if (res < 0) {
++			if (data->auth.auth_transaction == 2 &&
++			    data->auth.status_code ==
++			    WLAN_STATUS_CHALLENGE_FAIL)
++				wpas_notify_sae_password_mismatch(wpa_s);
+ 			wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
+ 					       NULL);
+ 			wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
diff --git a/debian/patches/Improve-PSK-mismatch-detection-and-dbus-signal.patch b/debian/patches/Improve-PSK-mismatch-detection-and-dbus-signal.patch
deleted file mode 100644
index 674b0e1..0000000
--- a/debian/patches/Improve-PSK-mismatch-detection-and-dbus-signal.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-Description: Improve PSK mismatch detection and dbus signal
-
-As the comment in wpa_supplicant_event_disassoc_finish() says,
-mac80211-based drivers use the WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY
-reason code in locally generated disconnection events for cases where
-the AP does not reply anymore. The code does not indicate that the PSK
-is wrong. Adjust could_be_psk_mismatch() to reflect that this code is
-not considered a PSK mismatch condition.
-
-Commit a678a510fb20 ("dbus: Add D-Bus signal for PSK mismatch
-heuristics") introduced the "PskMismatch" signal. D-Bus clients can
-use this signal to detect a wrong WPA-PSK password and prompt the user
-for a new one.
-This commit adds the same functionality to SAE authentication,
-emitting the signal when a failure occurs that is likely caused by a
-wrong password.
-
-
-Author: Beniamino Galvani <[e-mail]>
-Bug-Ubuntu: https://bugs.launchpad.net/bugs/2125203
-Origin: other, https://lists.infradead.org/pipermail/hostap/2025-June/043584.html
-Forwarded: not-needed
-
----
---- wpa-2.11.orig/wpa_supplicant/events.c
-+++ wpa-2.11/wpa_supplicant/events.c
-@@ -4506,6 +4506,8 @@ static int could_be_psk_mismatch(struct
- 	if (locally_generated) {
- 		if (reason_code == WLAN_REASON_IE_IN_4WAY_DIFFERS)
- 			return 0;
-+		if (reason_code == WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY)
-+			return 0;
- 	}
- 
- 	return 1;
---- wpa-2.11.orig/wpa_supplicant/sme.c
-+++ wpa-2.11/wpa_supplicant/sme.c
-@@ -2030,6 +2030,9 @@ void sme_event_auth(struct wpa_supplican
- 				   data->auth.ies_len, 0, data->auth.peer,
- 				   &ie_offset);
- 		if (res < 0) {
-+			if (res == -2)
-+				wpas_notify_psk_mismatch(wpa_s);
-+
- 			wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
- 					       NULL);
- 			wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
diff --git a/debian/patches/series b/debian/patches/series
index 8eacdb6..99cca06 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -13,4 +13,4 @@ CVE-2024-5290-lib_engine_trusted_path.patch
 0019-Send-CTRL-EVENT-SIGNAL-CHANGE-message-to-control-int.patch
 Bump-DEFAULT_BSS_MAX_COUNT-to-1000.patch
 0015-Revert-Mark-authorization-completed-on-driver-indica.patch
-Improve-PSK-mismatch-detection-and-dbus-signal.patch
+0016-dbus-Add-SaePasswordMismatch-signal-on-AP-indication.patch