2.11

README.md

@@ -0,0 +1,3 @@
+# hostapd
+
+A software access point, also called virtual router or virtual Wi-Fi, enables a computer to turn its wireless interface into a Wi-Fi access point. It saves the trouble of getting a separate wireless router.

files/config

@@ -0,0 +1,432 @@
+# Example hostapd build time configuration
+#
+# This file lists the configuration options that are used when building the
+# hostapd binary. All lines starting with # are ignored. Configuration option
+# lines must be commented out complete, if they are not to be included, i.e.,
+# just setting VARIABLE=n is not disabling that variable.
+#
+# This file is included in Makefile, so variables like CFLAGS and LIBS can also
+# be modified from here. In most cass, these lines should use += in order not
+# to override previous values of the variables.
+
+# Driver interface for Host AP driver
+CONFIG_DRIVER_HOSTAP=y
+
+# Driver interface for wired authenticator
+CONFIG_DRIVER_WIRED=y
+
+# Driver interface for drivers using the nl80211 kernel interface
+CONFIG_DRIVER_NL80211=y
+
+# QCA vendor extensions to nl80211
+#CONFIG_DRIVER_NL80211_QCA=y
+
+# driver_nl80211.c requires libnl. If you are compiling it yourself
+# you may need to point hostapd to your version of libnl.
+#
+#CFLAGS += -I$<path to libnl include files>
+#LIBS += -L$<path to libnl library files>
+
+# Use libnl v2.0 (or 3.0) libraries.
+#CONFIG_LIBNL20=y
+
+# Use libnl 3.2 libraries (if this is selected, CONFIG_LIBNL20 is ignored)
+CONFIG_LIBNL32=y
+
+
+# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
+#CONFIG_DRIVER_BSD=y
+#CFLAGS += -I/usr/local/include
+#LIBS += -L/usr/local/lib
+#LIBS_p += -L/usr/local/lib
+#LIBS_c += -L/usr/local/lib
+
+# Driver interface for no driver (e.g., RADIUS server only)
+#CONFIG_DRIVER_NONE=y
+
+# WPA2/IEEE 802.11i RSN pre-authentication
+CONFIG_RSN_PREAUTH=y
+
+# Support Operating Channel Validation
+#CONFIG_OCV=y
+
+# Integrated EAP server
+CONFIG_EAP=y
+
+# EAP Re-authentication Protocol (ERP) in integrated EAP server
+CONFIG_ERP=y
+
+# EAP-MD5 for the integrated EAP server
+CONFIG_EAP_MD5=y
+
+# EAP-TLS for the integrated EAP server
+CONFIG_EAP_TLS=y
+
+# EAP-MSCHAPv2 for the integrated EAP server
+CONFIG_EAP_MSCHAPV2=y
+
+# EAP-PEAP for the integrated EAP server
+CONFIG_EAP_PEAP=y
+
+# EAP-GTC for the integrated EAP server
+CONFIG_EAP_GTC=y
+
+# EAP-TTLS for the integrated EAP server
+CONFIG_EAP_TTLS=y
+
+# EAP-SIM for the integrated EAP server
+CONFIG_EAP_SIM=y
+
+# EAP-AKA for the integrated EAP server
+CONFIG_EAP_AKA=y
+
+# EAP-AKA' for the integrated EAP server
+# This requires CONFIG_EAP_AKA to be enabled, too.
+#CONFIG_EAP_AKA_PRIME=y
+
+# EAP-PAX for the integrated EAP server
+CONFIG_EAP_PAX=y
+
+# EAP-PSK for the integrated EAP server (this is _not_ needed for WPA-PSK)
+CONFIG_EAP_PSK=y
+
+# EAP-pwd for the integrated EAP server (secure authentication with a password)
+#CONFIG_EAP_PWD=y
+
+# EAP-SAKE for the integrated EAP server
+CONFIG_EAP_SAKE=y
+
+# EAP-GPSK for the integrated EAP server
+CONFIG_EAP_GPSK=y
+# Include support for optional SHA256 cipher suite in EAP-GPSK
+CONFIG_EAP_GPSK_SHA256=y
+
+# EAP-FAST for the integrated EAP server
+#CONFIG_EAP_FAST=y
+
+# EAP-TEAP for the integrated EAP server
+# Note: The current EAP-TEAP implementation is experimental and should not be
+# enabled for production use. The IETF RFC 7170 that defines EAP-TEAP has number
+# of conflicting statements and missing details and the implementation has
+# vendor specific workarounds for those and as such, may not interoperate with
+# any other implementation. This should not be used for anything else than
+# experimentation and interoperability testing until those issues has been
+# resolved.
+#CONFIG_EAP_TEAP=y
+
+# Wi-Fi Protected Setup (WPS)
+CONFIG_WPS=y
+# Enable UPnP support for external WPS Registrars
+CONFIG_WPS_UPNP=y
+# Enable WPS support with NFC config method
+CONFIG_WPS_NFC=y
+
+# EAP-IKEv2
+#CONFIG_EAP_IKEV2=y
+
+# Trusted Network Connect (EAP-TNC)
+#CONFIG_EAP_TNC=y
+
+# EAP-EKE for the integrated EAP server
+#CONFIG_EAP_EKE=y
+
+# PKCS#12 (PFX) support (used to read private key and certificate file from
+# a file that usually has extension .p12 or .pfx)
+CONFIG_PKCS12=y
+
+# RADIUS authentication server. This provides access to the integrated EAP
+# server from external hosts using RADIUS.
+CONFIG_RADIUS_SERVER=y
+
+# Build IPv6 support for RADIUS operations
+CONFIG_IPV6=y
+
+# Include support fo RADIUS/TLS into the RADIUS client
+CONFIG_RADIUS_TLS=y
+
+# IEEE Std 802.11r-2008 (Fast BSS Transition)
+CONFIG_IEEE80211R=y
+
+# Use the hostapd's IEEE 802.11 authentication (ACL), but without
+# the IEEE 802.11 Management capability (e.g., FreeBSD/net80211)
+#CONFIG_DRIVER_RADIUS_ACL=y
+
+# Wireless Network Management (IEEE Std 802.11v-2011)
+# Note: This is experimental and not complete implementation.
+#CONFIG_WNM=y
+
+# IEEE 802.11ac (Very High Throughput) support
+CONFIG_IEEE80211AC=y
+
+# IEEE 802.11ax HE support
+CONFIG_IEEE80211AX=y
+
+# IEEE 802.11be EHT support
+# CONFIG_IEEE80211AX is mandatory for setting CONFIG_IEEE80211BE.
+# Note: This is experimental and work in progress. The definitions are still
+# subject to change and this should not be expected to interoperate with the
+# final IEEE 802.11be version.
+CONFIG_IEEE80211BE=y
+
+# Simultaneous Authentication of Equals (SAE), WPA3-Personal
+CONFIG_SAE=y
+
+# SAE Public Key, WPA3-Personal
+CONFIG_SAE_PK=y
+
+# Remove debugging code that is printing out debug messages to stdout.
+# This can be used to reduce the size of the hostapd considerably if debugging
+# code is not needed.
+#CONFIG_NO_STDOUT_DEBUG=y
+
+# Add support for writing debug log to a file: -f /tmp/hostapd.log
+# Disabled by default.
+#CONFIG_DEBUG_FILE=y
+
+# Send debug messages to syslog instead of stdout
+#CONFIG_DEBUG_SYSLOG=y
+
+# Add support for sending all debug messages (regardless of debug verbosity)
+# to the Linux kernel tracing facility. This helps debug the entire stack by
+# making it easy to record everything happening from the driver up into the
+# same file, e.g., using trace-cmd.
+#CONFIG_DEBUG_LINUX_TRACING=y
+
+# Remove support for RADIUS accounting
+#CONFIG_NO_ACCOUNTING=y
+
+# Remove support for RADIUS
+#CONFIG_NO_RADIUS=y
+
+# Remove support for VLANs
+#CONFIG_NO_VLAN=y
+
+# Enable support for fully dynamic VLANs. This enables hostapd to
+# automatically create bridge and VLAN interfaces if necessary.
+#CONFIG_FULL_DYNAMIC_VLAN=y
+
+# Use netlink-based kernel API for VLAN operations instead of ioctl()
+# Note: This requires libnl 3.1 or newer.
+#CONFIG_VLAN_NETLINK=y
+
+# Remove support for dumping internal state through control interface commands
+# This can be used to reduce binary size at the cost of disabling a debugging
+# option.
+#CONFIG_NO_DUMP_STATE=y
+
+# Enable tracing code for developer debugging
+# This tracks use of memory allocations and other registrations and reports
+# incorrect use with a backtrace of call (or allocation) location.
+#CONFIG_WPA_TRACE=y
+# For BSD, comment out these.
+#LIBS += -lexecinfo
+#LIBS_p += -lexecinfo
+#LIBS_c += -lexecinfo
+
+# Use libbfd to get more details for developer debugging
+# This enables use of libbfd to get more detailed symbols for the backtraces
+# generated by CONFIG_WPA_TRACE=y.
+#CONFIG_WPA_TRACE_BFD=y
+# For BSD, comment out these.
+#LIBS += -lbfd -liberty -lz
+#LIBS_p += -lbfd -liberty -lz
+#LIBS_c += -lbfd -liberty -lz
+
+# hostapd depends on strong random number generation being available from the
+# operating system. os_get_random() function is used to fetch random data when
+# needed, e.g., for key generation. On Linux and BSD systems, this works by
+# reading /dev/urandom. It should be noted that the OS entropy pool needs to be
+# properly initialized before hostapd is started. This is important especially
+# on embedded devices that do not have a hardware random number generator and
+# may by default start up with minimal entropy available for random number
+# generation.
+#
+# As a safety net, hostapd is by default trying to internally collect
+# additional entropy for generating random data to mix in with the data
+# fetched from the OS. This by itself is not considered to be very strong, but
+# it may help in cases where the system pool is not initialized properly.
+# However, it is very strongly recommended that the system pool is initialized
+# with enough entropy either by using hardware assisted random number
+# generator or by storing state over device reboots.
+#
+# hostapd can be configured to maintain its own entropy store over restarts to
+# enhance random number generation. This is not perfect, but it is much more
+# secure than using the same sequence of random numbers after every reboot.
+# This can be enabled with -e<entropy file> command line option. The specified
+# file needs to be readable and writable by hostapd.
+#
+# If the os_get_random() is known to provide strong random data (e.g., on
+# Linux/BSD, the board in question is known to have reliable source of random
+# data from /dev/urandom), the internal hostapd random pool can be disabled.
+# This will save some in binary size and CPU use. However, this should only be
+# considered for builds that are known to be used on devices that meet the
+# requirements described above.
+#CONFIG_NO_RANDOM_POOL=y
+
+# Should we attempt to use the getrandom(2) call that provides more reliable
+# yet secure randomness source than /dev/random on Linux 3.17 and newer.
+# Requires glibc 2.25 to build, falls back to /dev/random if unavailable.
+CONFIG_GETRANDOM=y
+
+# Should we use poll instead of select? Select is used by default.
+#CONFIG_ELOOP_POLL=y
+
+# Should we use epoll instead of select? Select is used by default.
+#CONFIG_ELOOP_EPOLL=y
+
+# Should we use kqueue instead of select? Select is used by default.
+#CONFIG_ELOOP_KQUEUE=y
+
+# Select TLS implementation
+# openssl = OpenSSL (default)
+# gnutls = GnuTLS
+# internal = Internal TLSv1 implementation (experimental)
+# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
+# none = Empty template
+#CONFIG_TLS=openssl
+
+# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.1)
+# can be enabled to get a stronger construction of messages when block ciphers
+# are used.
+#CONFIG_TLSV11=y
+
+# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.2)
+# can be enabled to enable use of stronger crypto algorithms.
+#CONFIG_TLSV12=y
+
+# Select which ciphers to use by default with OpenSSL if the user does not
+# specify them.
+#CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW"
+
+# If CONFIG_TLS=internal is used, additional library and include paths are
+# needed for LibTomMath. Alternatively, an integrated, minimal version of
+# LibTomMath can be used. See beginning of libtommath.c for details on benefits
+# and drawbacks of this option.
+#CONFIG_INTERNAL_LIBTOMMATH=y
+#ifndef CONFIG_INTERNAL_LIBTOMMATH
+#LTM_PATH=/usr/src/libtommath-0.39
+#CFLAGS += -I$(LTM_PATH)
+#LIBS += -L$(LTM_PATH)
+#LIBS_p += -L$(LTM_PATH)
+#endif
+# At the cost of about 4 kB of additional binary size, the internal LibTomMath
+# can be configured to include faster routines for exptmod, sqr, and div to
+# speed up DH and RSA calculation considerably
+#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
+
+# Interworking (IEEE 802.11u)
+# This can be used to enable functionality to improve interworking with
+# external networks.
+#CONFIG_INTERWORKING=y
+
+# Hotspot 2.0
+#CONFIG_HS20=y
+
+# Enable SQLite database support in hlr_auc_gw, EAP-SIM DB, and eap_user_file
+CONFIG_SQLITE=y
+
+# Enable Fast Session Transfer (FST)
+#CONFIG_FST=y
+
+# Enable CLI commands for FST testing
+#CONFIG_FST_TEST=y
+
+# Testing options
+# This can be used to enable some testing options (see also the example
+# configuration file) that are really useful only for testing clients that
+# connect to this hostapd. These options allow, for example, to drop a
+# certain percentage of probe requests or auth/(re)assoc frames.
+#
+#CONFIG_TESTING_OPTIONS=y
+
+# Automatic Channel Selection
+# This will allow hostapd to pick the channel automatically when channel is set
+# to "acs_survey" or "0". Eventually, other ACS algorithms can be added in
+# similar way.
+#
+# Automatic selection is currently only done through initialization, later on
+# we hope to do background checks to keep us moving to more ideal channels as
+# time goes by. ACS is currently only supported through the nl80211 driver and
+# your driver must have survey dump capability that is filled by the driver
+# during scanning.
+#
+# You can customize the ACS survey algorithm with the hostapd.conf variable
+# acs_num_scans.
+#
+# Supported ACS drivers:
+# * ath9k
+# * ath5k
+# * ath10k
+#
+# For more details refer to:
+# https://wireless.wiki.kernel.org/en/users/documentation/acs
+#
+CONFIG_ACS=y
+
+# Multiband Operation support
+# These extensions facilitate efficient use of multiple frequency bands
+# available to the AP and the devices that may associate with it.
+#CONFIG_MBO=y
+
+# Client Taxonomy
+# Has the AP retain the Probe Request and (Re)Association Request frames from
+# a client, from which a signature can be produced which can identify the model
+# of client device like "Nexus 6P" or "iPhone 5s".
+#CONFIG_TAXONOMY=y
+
+# Fast Initial Link Setup (FILS) (IEEE 802.11ai)
+#CONFIG_FILS=y
+# FILS shared key authentication with PFS
+#CONFIG_FILS_SK_PFS=y
+
+# Include internal line edit mode in hostapd_cli. This can be used to provide
+# limited command line editing and history support.
+#CONFIG_WPA_CLI_EDIT=y
+
+# Opportunistic Wireless Encryption (OWE)
+# Experimental implementation of draft-harkins-owe-07.txt
+#CONFIG_OWE=y
+
+# Airtime policy support
+#CONFIG_AIRTIME_POLICY=y
+
+# Override default value for the wpa_disable_eapol_key_retries configuration
+# parameter. See that parameter in hostapd.conf for more details.
+#CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1
+
+# Wired equivalent privacy (WEP)
+# WEP is an obsolete cryptographic data confidentiality algorithm that is not
+# considered secure. It should not be used for anything anymore. The
+# functionality needed to use WEP is available in the current hostapd
+# release under this optional build parameter. This functionality is subject to
+# be completely removed in a future release.
+#CONFIG_WEP=y
+
+# Remove all TKIP functionality
+# TKIP is an old cryptographic data confidentiality algorithm that is not
+# considered secure. It should not be used anymore. For now, the default hostapd
+# build includes this to allow mixed mode WPA+WPA2 networks to be enabled, but
+# that functionality is subject to be removed in the future.
+#CONFIG_NO_TKIP=y
+
+# Pre-Association Security Negotiation (PASN)
+# Experimental implementation based on IEEE P802.11z/D2.6 and the protocol
+# design is still subject to change. As such, this should not yet be enabled in
+# production use.
+#CONFIG_PASN=y
+
+# Device Provisioning Protocol (DPP) (also known as Wi-Fi Easy Connect)
+CONFIG_DPP=y
+# DPP version 2 support
+CONFIG_DPP2=y
+# DPP version 3 support (experimental and still changing; do not enable for
+# production use)
+#CONFIG_DPP3=y
+
+# Wi-Fi Aware unsynchronized service discovery (NAN USD)
+CONFIG_NAN_USD=y
+
+# custom configuration options
+
+CONFIG_MESH=y
+CONFIG_WPS2=y

files/hostapd-2.11-fhs-config.patch

@@ -0,0 +1,168 @@
+diff --git i/hostapd/hostapd.conf w/hostapd/hostapd.conf
+index d875d5fc6..6873898f8 100644
+--- i/hostapd/hostapd.conf
++++ w/hostapd/hostapd.conf
+@@ -61,9 +61,9 @@ logger_stdout_level=2
+ # configuration. The socket file will be named based on the interface name, so
+ # multiple hostapd processes/interfaces can be run at the same time if more
+ # than one interface is used.
+-# /var/run/hostapd is the recommended directory for sockets and by default,
++# /run/hostapd is the recommended directory for sockets and by default,
+ # hostapd_cli will use it when trying to connect with hostapd.
+-ctrl_interface=/var/run/hostapd
++ctrl_interface=/run/hostapd
+ 
+ # Access control for the control interface can be configured by setting the
+ # directory to allow only members of a group to use sockets. This way, it is
+@@ -322,8 +322,8 @@ macaddr_acl=0
+ # Accept/deny lists are read from separate files (containing list of
+ # MAC addresses, one per line). Use absolute path name to make sure that the
+ # files can be read on SIGHUP configuration reloads.
+-#accept_mac_file=/etc/hostapd.accept
+-#deny_mac_file=/etc/hostapd.deny
++#accept_mac_file=/etc/hostapd/hostapd.accept
++#deny_mac_file=/etc/hostapd/hostapd.deny
+ 
+ # IEEE 802.11 specifies two authentication algorithms. hostapd can be
+ # configured to allow both of these or only one. Open system authentication
+@@ -1235,20 +1235,20 @@ eap_server=0
+ # Path for EAP server user database
+ # If SQLite support is included, this can be set to "sqlite:/path/to/sqlite.db"
+ # to use SQLite database instead of a text file.
+-#eap_user_file=/etc/hostapd.eap_user
++#eap_user_file=/etc/hostapd/hostapd.eap_user
+ 
+ # CA certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS
+-#ca_cert=/etc/hostapd.ca.pem
++#ca_cert=/etc/hostapd/hostapd.ca.pem
+ 
+ # Server certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS
+-#server_cert=/etc/hostapd.server.pem
++#server_cert=/etc/hostapd/hostapd.server.pem
+ 
+ # Private key matching with the server certificate for EAP-TLS/PEAP/TTLS
+ # This may point to the same file as server_cert if both certificate and key
+ # are included in a single file. PKCS#12 (PFX) file (.p12/.pfx) can also be
+ # used by commenting out server_cert and specifying the PFX file as the
+ # private_key.
+-#private_key=/etc/hostapd.server.prv
++#private_key=/etc/hostapd/hostapd.server.prv
+ 
+ # Passphrase for private key
+ #private_key_passwd=secret passphrase
+@@ -1265,8 +1265,8 @@ eap_server=0
+ # do not filter out the cipher suite list based on their local configuration and
+ # as such, configuration of alternative types of certificates on the server may
+ # result in interoperability issues.
+-#server_cert2=/etc/hostapd.server-ecc.pem
+-#private_key2=/etc/hostapd.server-ecc.prv
++#server_cert2=/etc/hostapd/hostapd.server-ecc.pem
++#private_key2=/etc/hostapd/hostapd.server-ecc.prv
+ #private_key_passwd2=secret passphrase
+ 
+ 
+@@ -1370,9 +1370,9 @@ eap_server=0
+ # periodically to get an update from the OCSP responder:
+ # openssl ocsp \
+ #	-no_nonce \
+-#	-CAfile /etc/hostapd.ca.pem \
+-#	-issuer /etc/hostapd.ca.pem \
+-#	-cert /etc/hostapd.server.pem \
++#	-CAfile /etc/hostapd/hostapd.ca.pem \
++#	-issuer /etc/hostapd/hostapd.ca.pem \
++#	-cert /etc/hostapd/hostapd.server.pem \
+ #	-url http://ocsp.example.com:8888/ \
+ #	-respout /tmp/ocsp-cache.der
+ #ocsp_stapling_response=/tmp/ocsp-cache.der
+@@ -1390,8 +1390,8 @@ eap_server=0
+ # parameter is not set. DH parameters are required if anonymous EAP-FAST is
+ # used.
+ # You can generate DH parameters file with OpenSSL, e.g.,
+-# "openssl dhparam -out /etc/hostapd.dh.pem 2048"
+-#dh_file=/etc/hostapd.dh.pem
++# "openssl dhparam -out /etc/hostapd/hostapd.dh.pem 2048"
++#dh_file=/etc/hostapd/hostapd.dh.pem
+ 
+ # OpenSSL cipher string
+ #
+@@ -1681,7 +1681,7 @@ own_ip_addr=127.0.0.1
+ # If no entries are provided by this file, the station is statically mapped
+ # to <bss-iface>.<vlan-id> interfaces.
+ # Each line can optionally also contain the name of a bridge to add the VLAN to
+-#vlan_file=/etc/hostapd.vlan
++#vlan_file=/etc/hostapd/hostapd.vlan
+ 
+ # Interface where 802.1q tagged packets should appear when a RADIUS server is
+ # used to determine which VLAN a station is on.  hostapd creates a bridge for
+@@ -1742,7 +1742,7 @@ own_ip_addr=127.0.0.1
+ # sta  = station MAC address in `11:22:33:44:55:66` format.
+ # type = `auth` | `acct` | NULL (match any)
+ # attr = existing config file format, e.g. `126:s:Test Operator`
+-#radius_req_attr_sqlite=radius_attr.sqlite
++#radius_req_attr_sqlite=/var/lib/hostapd/radius_attr.sqlite
+ 
+ # Dynamic Authorization Extensions (RFC 5176)
+ # This mechanism can be used to allow dynamic changes to user session based on
+@@ -1776,7 +1776,7 @@ own_ip_addr=127.0.0.1
+ 
+ # File name of the RADIUS clients configuration for the RADIUS server. If this
+ # commented out, RADIUS server is disabled.
+-#radius_server_clients=/etc/hostapd.radius_clients
++#radius_server_clients=/etc/hostapd/hostapd.radius_clients
+ 
+ # The UDP port number for the RADIUS authentication server
+ #radius_server_auth_port=1812
+@@ -1832,7 +1832,7 @@ own_ip_addr=127.0.0.1
+ # of (PSK,MAC address) pairs. This allows more than one PSK to be configured.
+ # Use absolute path name to make sure that the files can be read on SIGHUP
+ # configuration reloads.
+-#wpa_psk_file=/etc/hostapd.wpa_psk
++#wpa_psk_file=/etc/hostapd/hostapd.wpa_psk
+ 
+ # Optionally, WPA passphrase can be received from RADIUS authentication server
+ # This requires macaddr_acl to be set to 2 (RADIUS) for wpa_psk_radius values
+@@ -2496,7 +2496,7 @@ own_ip_addr=127.0.0.1
+ # text file that could be used, e.g., to populate the AP administration UI with
+ # pending PIN requests. If the following variable is set, the PIN requests will
+ # be written to the configured file.
+-#wps_pin_requests=/var/run/hostapd_wps_pin_requests
++#wps_pin_requests=/run/hostapd/hostapd_wps_pin_requests
+ 
+ # Device Name
+ # User-friendly description of device; up to 32 octets encoded in UTF-8
+@@ -2575,7 +2575,7 @@ own_ip_addr=127.0.0.1
+ # automatically generated based on network configuration. This configuration
+ # option points to an external file that much contain the WPS Credential
+ # attribute(s) as binary data.
+-#extra_cred=hostapd.cred
++#extra_cred=/var/lib/hostapd/hostapd.cred
+ 
+ # Credential processing
+ #   0 = process received credentials internally (default)
+@@ -2606,7 +2606,7 @@ own_ip_addr=127.0.0.1
+ # with pre-configured attributes. This is similar to extra_cred file format,
+ # but the AP Settings attributes are not encapsulated in a Credential
+ # attribute.
+-#ap_settings=hostapd.ap_settings
++#ap_settings=/var/lib/hostapd/hostapd.ap_settings
+ 
+ # Multi-AP backhaul BSS config
+ # Used in WPS when multi_ap=2 or 3. Defines "backhaul BSS" credentials.
+@@ -3357,7 +3357,7 @@ own_ip_addr=127.0.0.1
+ # Example:
+ #mbssid=2
+ #interface=wlan2
+-#ctrl_interface=/var/run/hostapd
++#ctrl_interface=/run/hostapd
+ #wpa_passphrase=0123456789
+ #ieee80211w=2
+ #sae_pwe=1
+@@ -3370,7 +3370,7 @@ own_ip_addr=127.0.0.1
+ #bssid=00:03:7f:12:84:84
+ #
+ #bss=wlan2-1
+-#ctrl_interface=/var/run/hostapd
++#ctrl_interface=/run/hostapd
+ #wpa_passphrase=0123456789
+ #ieee80211w=2
+ #sae_pwe=1

files/hostapd.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Hostapd IEEE 802.11 AP, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
+After=network.target
+
+[Service]
+ExecStart=/usr/bin/hostapd /etc/hostapd/hostapd.conf
+ExecReload=/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target

files/hostapd.tmpfiles

@@ -0,0 +1,5 @@
+# create configuration files and directories from factory defaults if they do not exist
+C /etc/hostapd - - - - /usr/share/defaults/etc/hostapd
+
+# create state dir
+d /var/lib/hostapd 750 root root - -

files/hostapd@.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Hostapd IEEE 802.11 AP, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
+After=network.target
+
+[Service]
+ExecStart=/usr/bin/hostapd /etc/hostapd/%i.conf
+ExecReload=/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target

files/series

@@ -0,0 +1 @@
+hostapd-2.11-fhs-config.patch

package.yml

@@ -0,0 +1,28 @@
+name       : hostapd
+version    : 2.11
+release    : 1
+source     :
+    - https://w1.fi/releases/hostapd-2.11.tar.gz : 2b3facb632fd4f65e32f4bf82a76b4b72c501f995a4f62e330219fe7aed1747a
+homepage   : https://w1.fi/hostapd/
+license    : BSD-3-Clause
+component  : network.util
+summary    : IEEE 802.11 AP, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
+description: |
+    A software access point, also called virtual router or virtual Wi-Fi, enables a computer to turn its wireless interface into a Wi-Fi access point. It saves the trouble of getting a separate wireless router.
+builddeps  :
+    - pkgconfig(libnl-3.0)
+    - pkgconfig(sqlite3)
+setup      : |
+    %apply_patches
+    cp $pkgfiles/config hostapd/.config
+build      : |
+    %make -C hostapd
+install    : |
+    %make -C hostapd install DESTDIR="$installdir" BINDIR=/usr/bin
+
+    install -vDm 644 $pkgfiles/hostapd.service -t "$installdir/usr/lib/systemd/system/"
+    install -vDm 644 $pkgfiles/hostapd@.service -t "$installdir/usr/lib/systemd/system/"
+    install -vDm 644 $pkgfiles/hostapd.tmpfiles "$installdir/usr/lib/tmpfiles.d/hostapd.conf"
+
+    install -vDm 640 hostapd/hostapd.{accept,conf,deny,eap_user,radius_clients,vlan,wpa_psk} -t "$installdir/etc/hostapd/"
+    install -vDm 640 hostapd/hostapd.{accept,conf,deny,eap_user,radius_clients,vlan,wpa_psk} -t "$installdir/usr/share/defaults/etc/hostapd/"