import clean BK tree at cset 1.3670

11 files changed, 1663 insertions, 0 deletions

diff --git a/packages/wpa-supplicant/files/.mtn2git_empty b/packages/wpa-supplicant/files/.mtn2git_empty
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/packages/wpa-supplicant/files/.mtn2git_empty
diff --git a/packages/wpa-supplicant/files/driver-hermes.patch b/packages/wpa-supplicant/files/driver-hermes.patch
index e69de29bb2..ad96db32c1 100644
--- a/packages/wpa-supplicant/files/driver-hermes.patch
+++ b/packages/wpa-supplicant/files/driver-hermes.patch
@@ -0,0 +1,889 @@
+
+#
+# Patch managed by http://www.holgerschurig.de/patcher.html
+#
+
+--- /dev/null
++++ wpa_supplicant/driver_hermes.c
+@@ -0,0 +1,705 @@
++/*
++ * WPA Supplicant - testing driver interface
++ * Copyright (c) 2004-2005, Jouni Malinen <jkmaline@cc.hut.fi>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * Alternatively, this software may be distributed under the terms of BSD
++ * license.
++ *
++ * See README and COPYING for more details.
++ */
++
++#include <stdlib.h>
++#include <stdio.h>
++#include <unistd.h>
++#include <string.h>
++#include <sys/ioctl.h>
++#include <errno.h>
++#include <net/if_arp.h>
++
++#include "wireless_copy.h"
++#include "common.h"
++#include "driver.h"
++
++#include "eloop.h"
++#include "wpa_supplicant.h"
++#include "priv_netlink.h"
++
++#include "hostap_common.h"
++#include "driver_wext.h"
++#include "driver_hermes.h"
++
++
++
++/* Enumeration for supported Hermes Types */
++enum
++{
++    WL_HERMES_UNKNOWN = 0,
++    WL_HERMES_1       = 1,
++    WL_HERMES_2       = 2,
++    WL_HERMES_25      = 3
++};
++
++
++
++
++struct wpa_driver_hermes_data {
++	void *wext; /* private data for driver_wext */
++	void *ctx;
++	char ifname[IFNAMSIZ + 1];
++	int sock;
++	int type;
++};
++
++
++
++/****************************************************************************/
++/*                                                                          */
++/* Routines for basic device access to Agere Hermes-I/Hermes-II via the UIL */
++/*                                                                          */
++/****************************************************************************/
++
++IFBP _connect(void *priv)
++{
++        struct wpa_driver_hermes_data *drv = priv;
++	int		result = 0;
++	IFBP		ifbp = NULL;
++	struct uilreq	urq;
++
++	//wpa_printf(MSG_DEBUG, "%s: %s %d", __FUNCTION__, drv->ifname, drv->sock);
++
++	memset(&urq, 0, sizeof(urq));
++
++	strcpy(urq.ifr_name, drv->ifname);
++	urq.command = UIL_FUN_CONNECT;
++	
++	result = ioctl(drv->sock, WVLAN2_IOCTL_UIL, &urq);
++	if (result == 0 && urq.result == UIL_SUCCESS) {
++		ifbp = urq.hcfCtx;
++	} else {
++		wpa_printf(MSG_DEBUG, "%s: could not set IFBP, result %d", __FUNCTION__, result);
++	}
++	
++	return ifbp;
++}
++
++
++void _disconnect(void *priv, IFBP ifbp)
++{
++        struct wpa_driver_hermes_data *drv = priv;
++	int result = 0;
++	struct uilreq urq;
++
++	//wpa_printf(MSG_DEBUG, "%s: %s", __FUNCTION__, drv->ifname);
++
++	if (ifbp != NULL) {
++		memset(&urq, 0, sizeof(struct uilreq));
++
++		strcpy(urq.ifr_name, drv->ifname);
++		urq.command = UIL_FUN_DISCONNECT;
++		urq.hcfCtx = ifbp;
++
++		result = ioctl(drv->sock, WVLAN2_IOCTL_UIL, &urq);
++	
++		if (result != 0 || urq.result != UIL_SUCCESS) {
++			wpa_printf( MSG_WARNING, "wl_disconnect(): ioctl() failed, errno: %d", errno );
++			wpa_printf( MSG_WARNING, "wl_disconnect(): urq.result: %d", urq.result );
++		}
++	} else {
++		wpa_printf(MSG_WARNING, "wl_disconnect(): called with NULL ifbp");
++	}
++
++	return;
++}
++
++int _get_info(void *priv, ltv_t *ltv)
++{
++        struct wpa_driver_hermes_data *drv = priv;
++	int result = 0;
++	IFBP ifbp = NULL;
++	struct uilreq urq;
++
++	//wpa_printf(MSG_DEBUG, "%s: %s", __FUNCTION__, drv->ifname);
++
++	/* First, connect to the device */
++	ifbp = _connect(priv);
++	if (ifbp != NULL && ltv != NULL) {
++		memset(&urq, 0, sizeof(struct uilreq));
++
++		strcpy(urq.ifr_name, drv->ifname);
++		urq.hcfCtx = ifbp;
++		urq.command = UIL_FUN_GET_INFO;
++		urq.len = sizeof(ltv_t);
++		urq.data = ltv;
++		
++		result = ioctl(drv->sock, WVLAN2_IOCTL_UIL, &urq);
++
++		if (result != 0 || urq.result != UIL_SUCCESS) {
++			wpa_printf(MSG_WARNING, "wl_disconnect(): ioctl() failed, errno: %d", errno);
++			wpa_printf(MSG_WARNING, "wl_disconnect(): urq.result: %d", urq.result);
++		}
++		_disconnect(priv, ifbp);
++	} else {
++		wpa_printf( MSG_WARNING, "Could not connect to the device, or LTV NULL");
++		result = -1;
++	}
++	
++	return result;
++}
++
++int _put_info(void *priv, ltv_t *ltv)
++{
++	struct wpa_driver_hermes_data *drv = priv;
++	int result = 0;
++	IFBP ifbp = NULL;
++	struct uilreq  urq;
++
++	//wpa_printf(MSG_DEBUG, "%s: %s", __FUNCTION__, drv->ifname);
++
++	/* First, connect to the device */
++	ifbp = _connect(priv);
++	if (ifbp != NULL && ltv != NULL) {
++		memset(&urq, 0, sizeof(struct uilreq));
++
++		strcpy(urq.ifr_name, drv->ifname);
++		urq.hcfCtx = ifbp;
++		urq.command = UIL_FUN_PUT_INFO;
++		urq.len = sizeof( ltv_t );
++		urq.data = ltv;
++		
++		result = ioctl(drv->sock, WVLAN2_IOCTL_UIL, &urq);
++		
++		if (result != 0 || urq.result != UIL_SUCCESS) {
++			wpa_printf(MSG_WARNING, "_put_info(): ioctl() failed, errno: %d", errno);
++			wpa_printf(MSG_WARNING, "_put_info(): urq.result: %d", urq.result);
++		}
++
++		_disconnect(priv, ifbp);
++	} else {
++		wpa_printf(MSG_WARNING, "%s: could not connect to the device, or LTV NULL", __FUNCTION__ );
++		result = -1;
++	}
++	
++	return result;
++}
++
++
++static void _detect_hermes_type(void *priv)
++{
++        struct wpa_driver_hermes_data *drv = priv;
++	CFG_FW_IDENTITY_STRCT *fw_id;
++	ltv_t ltv;
++	int result;
++
++	//wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
++
++	drv->type = WL_HERMES_UNKNOWN;
++
++	if (drv->sock >= 0) {
++		fw_id = (CFG_FW_IDENTITY_STRCT *)&ltv;
++		fw_id->len = ( sizeof(CFG_FW_IDENTITY_STRCT) / sizeof( hcf_16 )) - 1;
++		fw_id->typ = CFG_FW_IDENTITY;
++
++		result = _get_info(priv, (ltv_t *)fw_id);
++		if (result == HCF_SUCCESS) {
++			//wpa_printf(MSG_DEBUG, "PRI CompID  : %d", fw_id->comp_id);
++			//wpa_printf(MSG_DEBUG, "PRI Variant : %d", fw_id->variant);
++			//wpa_printf(MSG_DEBUG, "PRI Version : %d.%02d", fw_id->version_major, fw_id->version_minor);
++
++			switch(fw_id->comp_id) {
++			case COMP_ID_FW_STA:
++				switch (fw_id->variant) {
++				case 1:
++				case 2:
++					wpa_printf(MSG_DEBUG, "found Hermes 1 STA");
++					drv->type = WL_HERMES_1;
++					break;
++
++				case 3:
++					wpa_printf(MSG_DEBUG, "found Hermes 2 STA");
++					drv->type = WL_HERMES_2;
++					break;
++				case 4:
++					wpa_printf(MSG_DEBUG, "found Hermes 2.5 STA");
++					drv->type = WL_HERMES_25;
++					break;
++				}
++				break;
++
++			case COMP_ID_FW_AP:
++				switch (fw_id->variant) {
++				case 1:
++					wpa_printf(MSG_DEBUG, "found Hermes 1 AP");
++					drv->type = WL_HERMES_1;
++					break;
++
++				case 2:
++					wpa_printf(MSG_DEBUG, "found Hermes 2 AP" );
++					drv->type = WL_HERMES_2;
++					break;
++				}
++				break;
++
++			default:
++				wpa_printf(MSG_WARNING, "could not detect Hermes type!");
++				break;
++			}
++		}
++	}
++}
++
++
++
++/****************************************************************************/
++
++
++static int wpa_driver_hermes_set_wpa_ie(void *priv, const char *wpa_ie,
++                                        size_t wpa_ie_len)
++{
++        struct wpa_driver_hermes_data *drv = priv;
++	ltv_t   ltv;
++
++	wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
++
++	ltv.len = 2;
++	ltv.typ = CFG_SET_WPA_AUTH_KEY_MGMT_SUITE;
++
++	switch(drv->type) {
++	case WL_HERMES_1:
++		ltv.u.u16[0] = 2;
++		break;
++
++	case WL_HERMES_2:
++	case WL_HERMES_25:
++		ltv.u.u16[0] = 4;
++		break;
++
++	default:
++		ltv.u.u16[0] = 0;
++		break;
++	}
++
++	return _put_info(priv, &ltv);
++}
++
++
++static int wpa_driver_hermes_set_wpa(void *priv, int enabled)
++{
++	ltv_t ltv;
++
++	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
++
++        ltv.len = 2;
++        ltv.typ = CFG_CNF_ENCRYPTION;
++        ltv.u.u16[0] = enabled ? 2 : 0;		/* Setting CFG_CNF_ENCRYPTION to 2 sets WPA: TKIP or better */
++
++        return _put_info(priv, &ltv);
++}
++
++
++static int wpa_driver_hermes_set_key(void *priv, wpa_alg alg,
++                                     const u8 *addr, int key_idx,
++                                     int set_tx, const u8 *seq, size_t seq_len,
++                                     const u8 *key, size_t key_len)
++{
++        struct wpa_driver_hermes_data *drv = priv;
++	int ret = 0;
++	char *alg_name;
++	ltv_t ltv;
++	int count = 0;
++	int buf_idx = 0;
++	hcf_8 tsc[] = { 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00 };
++	hcf_8 rsc[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
++
++
++	switch (alg) {
++	case WPA_ALG_NONE:
++		alg_name = "none";
++		break;
++	case WPA_ALG_WEP:
++		alg_name = "WEP";
++		break;
++	case WPA_ALG_TKIP:
++		alg_name = "TKIP";
++		break;
++	case WPA_ALG_CCMP:
++		alg_name = "CCMP";
++		break;
++	default:
++		return -1;
++	}
++
++	wpa_printf(MSG_DEBUG, "%s: alg=%s key_idx=%d set_tx=%d seq_len=%d "
++		   "key_len=%d", __FUNCTION__, alg_name, key_idx, set_tx,
++		   seq_len, key_len);
++
++        if (seq_len > IW_ENCODE_SEQ_MAX_SIZE) {
++                wpa_printf(MSG_DEBUG, "%s: Invalid seq_len %lu", __FUNCTION__, (unsigned long) seq_len);
++                return -2;
++        }
++
++	/* Check the key index here; if 0, load as Pairwise Key, otherwise, load as
++	   a group key. Note that for the Hermes, the RIDs for group/pairwise keys
++	   are different from each other and different than the default WEP keys as
++	   well. */
++        switch (alg) {
++        case WPA_ALG_TKIP:
++                /* Make sure that there is no data queued up in the firmware before
++                   setting the TKIP keys. If this check is not performed, some data
++                   may be sent out with incorrect MIC and cause synchronizarion
++                   errors with the AP */
++                /* Check every 1ms for 100ms */
++                for (count = 0; count < 100; count++) {
++                        usleep(1000);
++
++                        ltv.len = 2;
++                        ltv.typ = 0xFD91;  // This RID not defined in HCF yet!!!
++                        ltv.u.u16[0] = 0;
++
++                        _get_info( priv, &ltv);
++                        
++                        if (ltv.u.u16[0] == 0) 
++                                break;
++                }
++
++                if (count == 100)
++                        wpa_printf(MSG_DEBUG, "%s: Timed out waiting for TxQ!", __FUNCTION__);
++                
++
++                switch (key_idx) {
++                case 0:
++                        /* Only load key as pairwise key for Hermes-II and II.5. For Hermes-I,
++                           fall through to the next case and load the pairwise key as
++                           a Group Key at index 0. */
++                        if (drv->type == WL_HERMES_2 || drv->type == WL_HERMES_25) {
++                                ltv.len = 28;
++                                ltv.typ = CFG_ADD_TKIP_MAPPED_KEY;
++
++                                /* Load the BSSID */
++                                memcpy(&ltv.u.u8[buf_idx], addr, ETH_ALEN);
++                                buf_idx += ETH_ALEN;
++
++                                /* Load the TKIP key */
++                                memcpy(&ltv.u.u8[buf_idx], &key[0], 16);
++                                buf_idx += 16;
++
++                                /* Load the TSC */
++                                memcpy(&ltv.u.u8[buf_idx], tsc, 8);
++                                buf_idx += 8;
++
++                                /* Load the RSC */
++                                /* Copy the RSC from the supplicant to a local buffer, because
++                                the RSC doesn't always contain the padding needed */
++                                memcpy(rsc, seq, seq_len);
++                                memcpy(&ltv.u.u8[buf_idx], rsc, 8);
++                                buf_idx += 8;
++
++                                /* Load the TxMIC key */
++                                memcpy(&ltv.u.u8[buf_idx], &key[16], 8);
++                                buf_idx += 8;
++
++                                /* Load the RxMIC key */
++                                memcpy(&ltv.u.u8[buf_idx], &key[24], 8);
++
++                                /* Send the request to the Hermes */
++                                _put_info(priv, &ltv);
++                                break;
++                        }
++
++                case 1:
++                case 2:
++                case 3:
++                        ltv.len = 26;
++                        ltv.typ = CFG_ADD_TKIP_DEFAULT_KEY;
++
++                        /* Load the key Index */
++                        ltv.u.u16[buf_idx] = key_idx;
++
++                        /* If this is a Tx Key, set bit 8000 */
++                        if (set_tx)
++                                ltv.u.u16[buf_idx] |= 0x8000;
++
++                        buf_idx += 2;
++
++                        /* Load the RSC */
++                        /* Copy the RSC from the supplicant to a local buffer, because
++                           the RSC doesn't always contain the padding needed */
++                        memcpy(rsc, seq, seq_len);
++                        memcpy(&ltv.u.u8[buf_idx], rsc, 8);
++                        buf_idx += 8;
++
++                        /* Load the TKIP, TxMIC, and RxMIC keys in one shot, because in
++                           CFG_ADD_TKIP_DEFAULT_KEY they are back-to-back */
++                        memcpy(&ltv.u.u8[buf_idx], key, key_len);
++                        buf_idx += key_len;
++
++                        /* Load the TSC */
++                        memcpy(&ltv.u.u8[buf_idx], tsc, 8);
++
++                        /* Send the request to the Hermes */
++                        _put_info(priv, &ltv);
++                        break;
++
++                default:
++                        break;
++                }
++
++                break;
++
++        case WPA_ALG_WEP:
++        case WPA_ALG_CCMP:
++                break;
++
++        case WPA_ALG_NONE:
++                switch (key_idx) {
++                case 0:
++                        if (drv->type == WL_HERMES_2 || drv->type == WL_HERMES_25) {
++                                /* Only clear a pairwise key for Hermes-II. For Hermes-I,
++                                   fall through to the next case and clear the key as a
++                                   Group Key at index 0. */
++                                if (addr) {
++                                        ltv.len = 7;
++                                        ltv.typ = CFG_REMOVE_TKIP_MAPPED_KEY;
++
++                                        memcpy(&ltv.u.u8[0], addr, ETH_ALEN);
++                                        
++                                        _put_info(priv, &ltv);
++                                }
++                                break;
++                        }
++
++                case 1:
++                case 2:
++                case 3:
++                        /* Clear the Group TKIP keys by index */
++                        ltv.len = 2;
++                        ltv.typ = CFG_REMOVE_TKIP_DEFAULT_KEY;
++
++                        ltv.u.u16[0] = key_idx;
++                        
++                        _put_info(priv, &ltv);
++                        break;
++
++                default:
++                        break;
++                }
++                break;
++
++        default:
++                break;
++        }
++
++	return ret;
++}
++
++
++static int wpa_driver_hermes_set_countermeasures(void *priv, int enabled)
++{
++	ltv_t ltv;
++
++	/* The supplicant handles all the timers related to MIC failure and
++	   countermeasures. When countermeasures are enabled, shut down the card;
++	   when disable, re-enable the card. Make sure that the EAPOL message
++	   is getting out before card disable */
++
++	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __FUNCTION__, enabled);
++
++        ltv.len      = 2;
++        ltv.typ      = CFG_DRIVER_ENABLE;
++        ltv.u.u16[0] = enabled ? 0 : 1;
++
++        return _put_info(priv, &ltv);
++}
++
++
++static int wpa_driver_hermes_set_drop_unencrypted(void *priv, int enabled)
++{
++	ltv_t   ltv;
++
++	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __FUNCTION__, enabled);
++
++	ltv.len = 2;
++	ltv.typ = CFG_CNF_EXCL_UNENCRYPTED;
++	ltv.u.u16[0] = enabled;
++
++	return _put_info(priv, &ltv);
++}
++
++
++static int wpa_driver_hermes_deauthenticate(void *priv, const u8 *addr,
++					  int reason_code)
++{
++	wpa_printf(MSG_DEBUG, "%s: *DUMMY* %d", __FUNCTION__, reason_code);
++
++	return 0;
++}
++
++
++static int wpa_driver_hermes_disassociate(void *priv, const u8 *addr, int reason_code)
++{
++	ltv_t   ltv;
++
++	wpa_printf(MSG_DEBUG, "%s: reason=%d", __FUNCTION__, reason_code);
++
++	ltv.len = 2;
++	ltv.typ = 0xFCC8;   // This RID not defined in HCF yet!!!
++	memcpy( &ltv.u.u8[0], addr, ETH_ALEN );
++	ltv.u.u16[ETH_ALEN / 2] = reason_code;
++
++	return _put_info( priv, &ltv);
++}
++
++
++static int wpa_driver_hermes_associate(
++	void *priv, struct wpa_driver_associate_params *params)
++{
++        struct wpa_driver_hermes_data *drv = priv;
++
++#if 0
++	wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
++#else
++	wpa_printf(MSG_DEBUG, "%s: priv=%p freq=%d pairwise_suite=%d "
++		   "group_suite=%d key_mgmt_suite=%d auth_alg=%d mode=%d",
++		   __func__, priv, params->freq, params->pairwise_suite,
++		   params->group_suite, params->key_mgmt_suite,
++		   params->auth_alg, params->mode);
++	if (params->bssid) {
++		wpa_printf(MSG_DEBUG, "   bssid=" MACSTR,
++			   MAC2STR(params->bssid));
++	}
++	if (params->ssid) {
++		wpa_hexdump_ascii(MSG_DEBUG, "   ssid",
++				  params->ssid, params->ssid_len);
++	}
++	if (params->wpa_ie) {
++		wpa_hexdump(MSG_DEBUG, "   wpa_ie",
++			    params->wpa_ie, params->wpa_ie_len);
++	}
++#endif
++
++        if (wpa_driver_hermes_set_wpa_ie(priv, params->wpa_ie, params->wpa_ie_len) < 0)
++                return -1;
++        if (wpa_driver_wext_set_freq(drv->wext, params->freq) < 0)
++                return -1;
++        if (wpa_driver_wext_set_ssid(drv->wext, params->ssid, params->ssid_len) < 0)
++                return -1;
++#ifdef UNSUPPORTED_IN_HERMES_DRIVER
++        if (wpa_driver_wext_hermes_bssid(drv->wext, params->bssid) < 0)
++                return -1;
++#endif
++
++	return 0;
++}
++
++
++static int wpa_driver_hermes_get_bssid(void *priv, u8 *bssid)
++{
++        struct wpa_driver_hermes_data *drv = priv;
++        return wpa_driver_wext_get_bssid(drv->wext, bssid);
++}
++
++
++static int wpa_driver_hermes_get_ssid(void *priv, u8 *ssid)
++{
++        struct wpa_driver_hermes_data *drv = priv;
++        return wpa_driver_wext_get_ssid(drv->wext, ssid);
++}
++
++
++static int wpa_driver_hermes_scan(void *priv, const u8 *ssid, size_t ssid_len)
++{
++        struct wpa_driver_hermes_data *drv = priv;
++	return wpa_driver_wext_scan(drv->wext, ssid, ssid_len);
++}
++
++
++static int wpa_driver_hermes_get_scan_results(void *priv,
++                                            struct wpa_scan_result *results,
++                                            size_t max_size)
++{
++        struct wpa_driver_hermes_data *drv = priv;
++        return wpa_driver_wext_get_scan_results(drv->wext, results, max_size);
++}
++
++
++static void * wpa_driver_hermes_init(void *ctx, const char *ifname)
++{
++	struct wpa_driver_hermes_data *drv;
++
++	wpa_printf(MSG_DEBUG, "%s: %s", __FUNCTION__, ifname);
++
++	drv = malloc(sizeof(*drv));
++	if (drv == NULL)
++		return NULL;
++	memset(drv, 0, sizeof(*drv));
++
++	/* Initialize wireless context */
++	drv->wext = wpa_driver_wext_init(ctx, ifname);
++	if (drv->wext == NULL) {
++		perror("no wext context");
++		goto no_wext;
++	}
++
++	drv->ctx = ctx;
++	strncpy(drv->ifname, ifname, sizeof(drv->ifname));
++
++	drv->sock = socket(PF_INET, SOCK_DGRAM, 0);
++	if (drv->sock < 0) {
++		perror("socket(PF_INET,SOCK_DGRAM)");
++		goto no_sock;
++	}
++
++	_detect_hermes_type(drv);
++
++	return drv;
++
++no_sock:
++	wpa_driver_wext_deinit(drv->wext);
++no_wext:
++	free(drv);
++	return NULL;	
++}
++
++
++static void wpa_driver_hermes_deinit(void *priv)
++{
++	struct wpa_driver_hermes_data *drv = priv;
++	wpa_driver_wext_deinit(drv->wext);
++	close(drv->sock);
++	free(drv);
++}
++
++
++
++
++struct wpa_driver_ops wpa_driver_hermes_ops = {
++	.name = "hermes",
++	.desc = "wpa_supplicant hermes driver",
++
++	.init = wpa_driver_hermes_init,
++	.deinit = wpa_driver_hermes_deinit,
++
++	// from old driver_hermes.c:
++	.get_bssid = wpa_driver_hermes_get_bssid,
++	.get_ssid = wpa_driver_hermes_get_ssid,
++	.set_wpa = wpa_driver_hermes_set_wpa,
++	.set_key = wpa_driver_hermes_set_key,
++	//.events_init = wpa_driver_wext_events_init,
++	//.events_deinit = wpa_driver_wext_events_deinit,
++        .set_countermeasures = wpa_driver_hermes_set_countermeasures,
++	.set_drop_unencrypted = wpa_driver_hermes_set_drop_unencrypted,
++	.scan = wpa_driver_hermes_scan,
++	.get_scan_results = wpa_driver_hermes_get_scan_results,
++	.deauthenticate = wpa_driver_hermes_deauthenticate,
++	.disassociate = wpa_driver_hermes_disassociate,
++	.associate = wpa_driver_hermes_associate,
++
++
++#if 0
++	/* Not possible with current Hermes driver:
++	.set_auth_alg = wpa_driver_hermes_set_auth_alg, */
++#endif
++};
+--- /dev/null
++++ wpa_supplicant/driver_hermes.h
+@@ -0,0 +1,173 @@
++#ifndef HERMES_DRIVER_H
++#define HERMES_DRIVER_H
++
++typedef unsigned char hcf_8;
++typedef unsigned short hcf_16;
++typedef unsigned long hcf_32;
++typedef hcf_16 hcf_io;
++typedef hcf_8 *wci_bufp;
++
++typedef struct {
++  hcf_16 len;
++  hcf_16 typ;
++  unsigned short * bufp;
++} RID_LOG_STRCT;
++typedef RID_LOG_STRCT *RID_LOGP;
++
++typedef struct {
++  hcf_16 len;
++  hcf_16 typ;
++  hcf_16 comp_id;
++  hcf_16 variant;
++  hcf_16 version_major;
++  hcf_16 version_minor;
++} CFG_FW_IDENTITY_STRCT;
++
++typedef struct {
++  hcf_32 TxUnicastFrames;
++  hcf_32 TxMulticastFrames;
++  hcf_32 TxFragments;
++  hcf_32 TxUnicastOctets;
++  hcf_32 TxMulticastOctets;
++  hcf_32 TxDeferredTransmissions;
++  hcf_32 TxSingleRetryFrames;
++  hcf_32 TxMultipleRetryFrames;
++  hcf_32 TxRetryLimitExceeded;
++  hcf_32 TxDiscards;
++  hcf_32 RxUnicastFrames;
++  hcf_32 RxMulticastFrames;
++  hcf_32 RxFragments;
++  hcf_32 RxUnicastOctets;
++  hcf_32 RxMulticastOctets;
++  hcf_32 RxFCSErrors;
++  hcf_32 RxDiscardsNoBuffer;
++  hcf_32 TxDiscardsWrongSA;
++  hcf_32 RxWEPUndecryptable;
++  hcf_32 RxMsgInMsgFragments;
++  hcf_32 RxMsgInBadMsgFragments;
++  hcf_32 RxDiscardsWEPICVError;
++  hcf_32 RxDiscardsWEPExcluded;
++} CFG_HERMES_TALLIES_STRCT;
++
++typedef struct {
++  hcf_32 not_used_NoBufInq;
++  hcf_32 NoBufInfo;
++  hcf_32 NoBufMB;
++  hcf_32 MiscErr;
++  hcf_32 EngCnt;
++} CFG_HCF_TALLIES_STRCT;
++
++typedef struct {
++  hcf_io IFB_IOBase;
++  hcf_16 IFB_IORange;
++
++  hcf_32 IFB_TickIni;
++
++  hcf_16 IFB_Version;
++  hcf_16 IFB_CardStat;
++  hcf_16 IFB_TraceLvl;
++  hcf_16 *IFB_MBp;
++  hcf_16 IFB_MBSize;
++  hcf_16 IFB_MBWp;
++  hcf_16 IFB_MBRp;
++  hcf_16 IFB_MBInfoLen;
++
++  hcf_16 IFB_DLMode;
++  hcf_16 IFB_Magic;
++  hcf_16 IFB_Cmd;
++  hcf_16 IFB_RxFID;
++  RID_LOGP IFB_RIDLogp;
++  hcf_16 IFB_Monitor;
++  hcf_16 IFB_TxFid;
++  hcf_16 IFB_RxLen;
++  hcf_16 IFB_DefunctStat;
++
++  hcf_16 IFB_ErrCmd;
++  hcf_16 IFB_ErrQualifier;
++  hcf_16 IFB_lal;
++  wci_bufp IFB_lap;
++  hcf_16 IFB_LinkStat;
++
++  void (*IFB_MICRxRtn)( hcf_32*, hcf_32 );
++  void (*IFB_MICTxRtn)( hcf_32*, hcf_32 );
++  hcf_16 IFB_rx_tlen;
++  hcf_16 IFB_tx_tlen;
++  hcf_8 IFB_rx_32[4];
++  hcf_8 IFB_tx_32[4];
++  hcf_16 IFB_RscInd;
++  hcf_16 IFB_MB_FID;
++  hcf_16 IFB_DLTarget[2];
++
++  hcf_16 IFB_DLPage;
++  hcf_16 IFB_DLOffset;
++  hcf_16 IFB_DLLen;
++
++  hcf_16 volatile IFB_IntOffCnt;
++  hcf_16 IFB_IntEnMask;
++
++  CFG_FW_IDENTITY_STRCT IFB_FWIdentity;
++  hcf_16 IFB_Tally;
++  hcf_16 IFB_TallyTyp;
++
++  CFG_HERMES_TALLIES_STRCT IFB_NIC_Tallies;
++  CFG_HCF_TALLIES_STRCT IFB_HCF_Tallies;
++
++  void *IFB_MSFSup;
++} IFB_STRCT;
++
++typedef IFB_STRCT* IFBP;
++
++struct uilreq
++{
++    union
++    {
++        char ifrn_name[16];
++    } ifr_ifrn;
++
++    IFBP hcfCtx;
++    __u8 command;
++    __u8 result;
++    __u16 len;
++    void *data;
++};
++
++typedef struct
++{
++    hcf_16 len;
++    hcf_16 typ;
++    union
++    {
++        hcf_8 u8[(512 - (sizeof(hcf_16) * 2)) / sizeof(hcf_8)];
++        hcf_16 u16[(512 - (sizeof(hcf_16) * 2)) / sizeof(hcf_16)];
++        hcf_32 u32[(512 - (sizeof(hcf_16) * 2)) / sizeof(hcf_32)];
++    } u;
++} ltv_t;
++
++
++#define UIL_FUN_CONNECT                 0x00
++#define UIL_FUN_DISCONNECT              0x01
++#define UIL_FUN_GET_INFO                0x04
++#define UIL_FUN_PUT_INFO                0x05
++
++#define GENERIC_INFO_ELEM                   0xdd
++#define RSN_INFO_ELEM 0x30
++
++#define CFG_DRIVER_ENABLE               0x0902 
++#define CFG_CNF_ENCRYPTION              0xFC20
++#define CFG_ADD_TKIP_DEFAULT_KEY        0xFCB4
++#define CFG_SET_WPA_AUTH_KEY_MGMT_SUITE 0xFCB5
++#define CFG_REMOVE_TKIP_DEFAULT_KEY     0xFCB6
++#define CFG_ADD_TKIP_MAPPED_KEY         0xFCB7 
++#define CFG_REMOVE_TKIP_MAPPED_KEY      0xFCB8
++#define CFG_FW_IDENTITY                 0xFD20
++#define CFG_CNF_EXCL_UNENCRYPTED        0xFC22
++
++#define HCF_SUCCESS			0x00
++#define UIL_SUCCESS                     0x00
++
++#define COMP_ID_FW_STA			31
++#define COMP_ID_FW_AP			32
++
++#define WVLAN2_IOCTL_UIL		SIOCDEVPRIVATE
++
++#endif
diff --git a/packages/wpa-supplicant/files/init.sh b/packages/wpa-supplicant/files/init.sh
index e69de29bb2..bc7ee9184e 100644..100755
--- a/packages/wpa-supplicant/files/init.sh
+++ b/packages/wpa-supplicant/files/init.sh
@@ -0,0 +1,50 @@
+#!/bin/sh
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+
+DAEMON=/usr/sbin/wpa_supplicant
+CONFIG="/etc/wpa_supplicant.conf"
+PNAME="wpa_supplicant"
+
+# insane defaults
+OPTIONS=""
+
+test -f /etc/default/wpa && . /etc/default/wpa
+
+if [ ! -f $CONFIG ]; then
+	echo "No configuration file found, not starting."
+	exit 1
+fi
+
+test -f $DAEMON || exit 0
+
+case "$1" in
+	start)
+		echo -n "Starting wpa_supplicant: "
+		start-stop-daemon -S -b -x $DAEMON -- -Bw -c $CONFIG $OPTIONS >/dev/null
+		echo "done."
+		;;
+	stop)
+		echo -n "Stopping wpa_supplicant: "
+		start-stop-daemon -K -n $PNAME >/dev/null
+		echo "done."
+		;;
+	reload|force-reload)
+		echo -n "Reloading wpa_supplicant: "
+		killall -HUP $PNAME
+		echo "done."
+		;;
+	restart)
+		echo -n "Restarting wpa_supplicant: "
+		start-stop-daemon -K -n $PNAME >/dev/null
+		sleep 1
+		start-stop-daemon -S -b -x $DAEMON -- -Bw -c $CONFIG $OPTIONS >/dev/null
+		echo "done."
+		;;
+	*)
+		echo "Usage: $0 {start|stop|restart|reload|force-reload}" >&2
+		exit 1
+		;;
+esac
+
+exit 0
diff --git a/packages/wpa-supplicant/files/madwifi-bsd-fix.diff b/packages/wpa-supplicant/files/madwifi-bsd-fix.diff
index e69de29bb2..974eb39627 100644
--- a/packages/wpa-supplicant/files/madwifi-bsd-fix.diff
+++ b/packages/wpa-supplicant/files/madwifi-bsd-fix.diff
@@ -0,0 +1,12 @@
+--- driver_madwifi.c.orig	2005-03-18 15:12:53.392793216 +0100
++++ driver_madwifi.c	2005-03-18 15:13:09.246383104 +0100
+@@ -25,7 +25,8 @@
+ #include "eloop.h"
+ #include "wpa_supplicant.h"
+ 
+-#include <include/compat.h>
++#include <net80211/compat.h>
++#include <net80211/_ieee80211.h>
+ #include <net80211/ieee80211.h>
+ #include <net80211/ieee80211_crypto.h>
+ #include <net80211/ieee80211_ioctl.h>
diff --git a/packages/wpa-supplicant/files/mtx-1/.mtn2git_empty b/packages/wpa-supplicant/files/mtx-1/.mtn2git_empty
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/packages/wpa-supplicant/files/mtx-1/.mtn2git_empty
diff --git a/packages/wpa-supplicant/files/mtx-1/defconfig b/packages/wpa-supplicant/files/mtx-1/defconfig
index e69de29bb2..a0d9b73d3f 100644
--- a/packages/wpa-supplicant/files/mtx-1/defconfig
+++ b/packages/wpa-supplicant/files/mtx-1/defconfig
@@ -0,0 +1,157 @@
+# This file lists the configuration options that are used when building the
+# hostapd binary. All lines starting with # are ignored. Configuration option
+# lines must be commented out complete, if they are not to be included, i.e.,
+# just setting VARIABLE=n is not disabling that variable.
+#
+# This file is included in Makefile, so variables like CFLAGS and LIBS can also
+# be modified from here. In most cass, these lines should use += in order not
+# to override previous values of the variables.
+
+CFLAGS = $(TARGET_CFLAGS) -I../hostapd -I../utils -I../driver/modules -Wall -MMD
+
+# for wpa_supplicant, wpa_cli
+LIBS = $(TARGET_LDFLAGS)
+
+# for wpa_passphrase:
+LIBS_p = $(TARGET_LDFLAGS)
+
+
+# Uncomment following two lines and fix the paths if you have installed openssl
+# in non-default location
+#CFLAGS += -I/usr/local/openssl/include
+#LIBS += -L/usr/local/openssl/lib
+
+# Example configuration for various cross-compilation platforms
+
+#### sveasoft (e.g., for Linksys WRT54G) ######################################
+#CC=mipsel-uclibc-gcc
+#CC=/opt/brcm/hndtools-mipsel-uclibc/bin/mipsel-uclibc-gcc
+#CFLAGS += -Os
+#CPPFLAGS += -I../src/include -I../../src/router/openssl/include
+#LIBS += -L/opt/brcm/hndtools-mipsel-uclibc-0.9.19/lib -lssl
+###############################################################################
+
+#### openwrt (e.g., for Linksys WRT54G) #######################################
+#CC=mipsel-uclibc-gcc
+#CC=/opt/brcm/hndtools-mipsel-uclibc/bin/mipsel-uclibc-gcc
+#CFLAGS += -Os
+#CPPFLAGS=-I../src/include -I../openssl-0.9.7d/include \
+#	-I../WRT54GS/release/src/include
+#LIBS = -lssl
+###############################################################################
+
+
+# Driver interface for Host AP driver
+CONFIG_DRIVER_HOSTAP=y
+
+# Driver interface for Agere driver
+#CONFIG_DRIVER_HERMES=y
+
+# Driver interface for madwifi driver
+CONFIG_DRIVER_MADWIFI=y
+# Change include directories to match with the local setup
+#CFLAGS += -I../madwifi/wpa
+
+# Driver interface for Prism54 driver
+CONFIG_DRIVER_PRISM54=y
+
+# Driver interface for ndiswrapper
+#CONFIG_DRIVER_NDISWRAPPER=y
+
+# Driver interface for Atmel driver
+#CONFIG_DRIVER_ATMEL=y
+
+# Driver interface for Broadcom driver
+#CONFIG_DRIVER_BROADCOM=y
+# Example path for wlioctl.h; change to match your configuration
+#CFLAGS += -I/opt/WRT54GS/release/src/include
+
+# Driver interface for Intel ipw2100 driver
+#CONFIG_DRIVER_IPW2100=y
+
+# Driver interface for generic Linux wireless extensions
+CONFIG_DRIVER_WEXT=y
+
+# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
+#CONFIG_DRIVER_BSD=y
+#CFLAGS += -I/usr/local/include
+#LIBS += -L/usr/local/lib
+
+# Driver interface for Windows NDIS
+#CONFIG_DRIVER_NDIS=y
+#CFLAGS += -I/usr/include/w32api/ddk
+#LIBS += -L/usr/local/lib
+# For native build using mingw
+#CONFIG_NATIVE_WINDOWS=y
+# Additional directories for cross-compilation on Linux host for mingw target
+#CFLAGS += -I/opt/mingw/mingw32/include/ddk
+#LIBS += -L/opt/mingw/mingw32/lib
+#CC=mingw32-gcc
+
+# Driver interface for development testing
+#CONFIG_DRIVER_TEST=y
+
+# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is
+# included)
+CONFIG_IEEE8021X_EAPOL=y
+
+# EAP-MD5 (automatically included if EAP-TTLS is enabled)
+CONFIG_EAP_MD5=y
+
+# EAP-MSCHAPv2 (automatically included if EAP-PEAP is enabled)
+CONFIG_EAP_MSCHAPV2=y
+
+# EAP-TLS
+CONFIG_EAP_TLS=y
+
+# EAL-PEAP
+CONFIG_EAP_PEAP=y
+
+# EAP-TTLS
+CONFIG_EAP_TTLS=y
+
+# EAP-GTC
+CONFIG_EAP_GTC=y
+
+# EAP-OTP
+CONFIG_EAP_OTP=y
+
+# EAP-SIM (enable CONFIG_PCSC, if EAP-SIM is used)
+#CONFIG_EAP_SIM=y
+
+# EAP-PSK (experimental; this is _not_ needed for WPA-PSK)
+#CONFIG_EAP_PSK=y
+
+# LEAP
+CONFIG_EAP_LEAP=y
+
+# EAP-AKA (enable CONFIG_PCSC, if EAP-AKA is used)
+#CONFIG_EAP_AKA=y
+
+# PKCS#12 (PFX) support (used to read private key and certificate file from
+# a file that usually has extension .p12 or .pfx)
+CONFIG_PKCS12=y
+
+# PC/SC interface for smartcards (USIM, GSM SIM)
+# Enable this if EAP-SIM or EAP-AKA is included
+#CONFIG_PCSC=y
+
+# Development testing
+#CONFIG_EAPOL_TEST=y
+
+# Replace native Linux implementation of packet sockets with libdnet/libpcap.
+# This will be automatically set for non-Linux OS.
+#CONFIG_DNET_PCAP=y
+
+# Include control interface for external programs, e.g, wpa_cli
+CONFIG_CTRL_IFACE=y
+
+# Include interface for using external supplicant (Xsupplicant) for EAP
+# authentication
+#CONFIG_XSUPPLICANT_IFACE=y
+
+# Include support for GNU Readline and History Libraries in wpa_cli.
+# When building a wpa_cli binary for distribution, please note that these
+# libraries are licensed under GPL and as such, BSD license may not apply for
+# the resulting binary.
+#CONFIG_READLINE=y
diff --git a/packages/wpa-supplicant/files/openmn/.mtn2git_empty b/packages/wpa-supplicant/files/openmn/.mtn2git_empty
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/packages/wpa-supplicant/files/openmn/.mtn2git_empty
diff --git a/packages/wpa-supplicant/files/openmn/defaults b/packages/wpa-supplicant/files/openmn/defaults
index e69de29bb2..1da73d30c0 100644
--- a/packages/wpa-supplicant/files/openmn/defaults
+++ b/packages/wpa-supplicant/files/openmn/defaults
@@ -0,0 +1,8 @@
+# Useful flags:
+#  -i <ifname>          Interface (required, unless specified in config)
+#  -D <driver>          Wireless Driver
+#  -d                   Debugging (-dd for more)
+#  -q                   Quiet (-qq for more)
+
+CONFIG="/etc/wpa_supplicant.conf"
+OPTIONS="-i eth1 -D hermes"
diff --git a/packages/wpa-supplicant/files/use-channel.patch b/packages/wpa-supplicant/files/use-channel.patch
index e69de29bb2..337c0422cd 100644
--- a/packages/wpa-supplicant/files/use-channel.patch
+++ b/packages/wpa-supplicant/files/use-channel.patch
@@ -0,0 +1,32 @@
+
+#
+# Patch managed by http://www.holgerschurig.de/patcher.html
+#
+
+--- wpa_supplicant/driver_wext.c~use-channel
++++ wpa_supplicant/driver_wext.c
+@@ -655,6 +655,12 @@
+ }
+ 
+ 
++static const long frequency_list[] =
++{
++    2412, 2417, 2422, 2427, 2432, 2437, 2442,
++    2447, 2452, 2457, 2462, 2467, 2472, 2484
++};
++
+ int wpa_driver_wext_get_scan_results(void *priv,
+ 				     struct wpa_scan_result *results,
+ 				     size_t max_size)
+@@ -739,6 +745,11 @@
+ 		case SIOCGIWFREQ:
+ 			if (ap_num < max_size) {
+ 				int div = 1000000, i;
++				/* driver sent a channel, not a frequency */
++				if (iwe->u.freq.e == 0 && iwe->u.freq.m >= 1 && iwe->u.freq.m <= sizeof(frequency_list)) {
++					results[ap_num].freq = frequency_list[iwe->u.freq.m-1];
++					break;
++				} else
+ 				if (iwe->u.freq.e > 6) {
+ 					wpa_printf(
+ 						MSG_DEBUG, "Invalid freq "
diff --git a/packages/wpa-supplicant/files/wpa_supplicant.conf b/packages/wpa-supplicant/files/wpa_supplicant.conf
index e69de29bb2..da407b5ef3 100644
--- a/packages/wpa-supplicant/files/wpa_supplicant.conf
+++ b/packages/wpa-supplicant/files/wpa_supplicant.conf
@@ -0,0 +1,502 @@
+##### Example wpa_supplicant configuration file ###############################
+# Empty lines and lines starting with # are ignored
+
+# NOTE! This file may contain password information and should probably be made
+# readable only by root user on multiuser systems.
+
+# global configuration (shared by all network blocks)
+#
+# Interface for separate control program. If this is specified, wpa_supplicant
+# will create this directory and a UNIX domain socket for listening to requests
+# from external programs (CLI/GUI, etc.) for status information and
+# configuration. The socket file will be named based on the interface name, so
+# multiple wpa_supplicant processes can be run at the same time if more than
+# one interface is used.
+# /var/run/wpa_supplicant is the recommended directory for sockets and by
+# default, wpa_cli will use it when trying to connect with wpa_supplicant.
+ctrl_interface=/var/run/wpa_supplicant
+
+# Access control for the control interface can be configured by setting the
+# directory to allow only members of a group to use sockets. This way, it is
+# possible to run wpa_supplicant as root (since it needs to change network
+# configuration and open raw sockets) and still allow GUI/CLI components to be
+# run as non-root users. However, since the control interface can be used to
+# change the network configuration, this access needs to be protected in many
+# cases. By default, wpa_supplicant is configured to use gid 0 (root). If you
+# want to allow non-root users to use the control interface, add a new group
+# and change this value to match with that group. Add users that should have
+# control interface access to this group. If this variable is commented out or
+# not included in the configuration file, group will not be changed from the
+# value it got by default when the directory or socket was created.
+#
+# This variable can be a group name or gid.
+#ctrl_interface_group=wheel
+ctrl_interface_group=0
+
+# IEEE 802.1X/EAPOL version
+# wpa_supplicant was implemented based on IEEE 802-1X-REV-d8 which defines
+# EAPOL version 2. However, there are many APs that do not handle the new
+# version number correctly (they seem to drop the frames completely). In order
+# to make wpa_supplicant interoperate with these APs, the version number is set
+# to 1 by default. This configuration value can be used to set it to the new
+# version (2).
+eapol_version=1
+
+# AP scanning/selection
+# By default, wpa_supplicant requests driver to perform AP scanning and then
+# uses the scan results to select a suitable AP. Another alternative is to
+# allow the driver to take care of AP scanning and selection and use
+# wpa_supplicant just to process EAPOL frames based on IEEE 802.11 association
+# information from the driver.
+# 1: wpa_supplicant initiates scanning and AP selection
+# 0: driver takes care of scanning, AP selection, and IEEE 802.11 association
+#    parameters (e.g., WPA IE generation); this mode can also be used with
+#    non-WPA drivers when using IEEE 802.1X mode; do not try to associate with
+#    APs (i.e., external program needs to control association)
+# 2: like 0, but associate with APs using security policy and SSID (but not
+#    BSSID); this can be used, e.g., with ndiswrapper and NDIS driver to
+#    enable operation with hidden SSIDs and optimized roaming; in this mode,
+#    only the first network block in the configuration file is used and this
+#    configuration should have explicit security policy (i.e., only one option
+#    in the lists) for key_mgmt, pairwise, group, proto variables
+ap_scan=1
+
+# EAP fast re-authentication
+# By default, fast re-authentication is enabled for all EAP methods that
+# support it. This variable can be used to disable fast re-authentication.
+# Normally, there is no need to disable this.
+fast_reauth=1
+
+# network block
+#
+# Each network (usually AP's sharing the same SSID) is configured as a separate
+# block in this configuration file. The network blocks are in preference order
+# (the first match is used).
+#
+# network block fields:
+#
+# ssid: SSID (mandatory); either as an ASCII string with double quotation or
+#	as hex string; network name
+#
+# scan_ssid:
+#	0 = do not scan this SSID with specific Probe Request frames (default)
+#	1 = scan with SSID-specific Probe Request frames (this can be used to
+#	    find APs that do not accept broadcast SSID or use multiple SSIDs;
+#	    this will add latency to scanning, so enable this only when needed)
+#
+# bssid: BSSID (optional); if set, this network block is used only when
+#	associating with the AP using the configured BSSID
+#
+# priority: priority group (integer)
+# By default, all networks will get same priority group (0). If some of the
+# networks are more desirable, this field can be used to change the order in
+# which wpa_supplicant goes through the networks when selecting a BSS. The
+# priority groups will be iterated in decreasing priority (i.e., the larger the
+# priority value, the sooner the network is matched against the scan results).
+# Within each priority group, networks will be selected based on security
+# policy, signal strength, etc.
+# Please note that AP scanning with scan_ssid=1 is not using this priority to
+# select the order for scanning. Instead, it uses the order the networks are in
+# the configuration file.
+#
+# mode: IEEE 802.11 operation mode
+# 0 = infrastructure (Managed) mode, i.e., associate with an AP (default)
+# 1 = IBSS (ad-hoc, peer-to-peer)
+# Note: IBSS can only be used with key_mgmt NONE (plaintext and static WEP)
+# and key_mgmt=WPA-NONE (fixed group key TKIP/CCMP). In addition, ap_scan has
+# to be set to 2 for IBSS. WPA-None requires following network block options:
+# proto=WPA, key_mgmt=WPA-NONE, pairwise=NONE, group=TKIP (or CCMP, but not
+# both), and psk must also be set.
+#
+# proto: list of accepted protocols
+# WPA = WPA/IEEE 802.11i/D3.0
+# RSN = WPA2/IEEE 802.11i (also WPA2 can be used as an alias for RSN)
+# If not set, this defaults to: WPA RSN
+#
+# key_mgmt: list of accepted authenticated key management protocols
+# WPA-PSK = WPA pre-shared key (this requires 'psk' field)
+# WPA-EAP = WPA using EAP authentication (this can use an external
+#	program, e.g., Xsupplicant, for IEEE 802.1X EAP Authentication
+# IEEE8021X = IEEE 802.1X using EAP authentication and (optionally) dynamically
+#	generated WEP keys
+# NONE = WPA is not used; plaintext or static WEP could be used
+# If not set, this defaults to: WPA-PSK WPA-EAP
+#
+# auth_alg: list of allowed IEEE 802.11 authentication algorithms
+# OPEN = Open System authentication (required for WPA/WPA2)
+# SHARED = Shared Key authentication (requires static WEP keys)
+# LEAP = LEAP/Network EAP (only used with LEAP)
+# If not set, automatic selection is used (Open System with LEAP enabled if
+# LEAP is allowed as one of the EAP methods).
+#
+# pairwise: list of accepted pairwise (unicast) ciphers for WPA
+# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
+# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
+# NONE = Use only Group Keys (deprecated, should not be included if APs support
+#	pairwise keys)
+# If not set, this defaults to: CCMP TKIP
+#
+# group: list of accepted group (broadcast/multicast) ciphers for WPA
+# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
+# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
+# WEP104 = WEP (Wired Equivalent Privacy) with 104-bit key
+# WEP40 = WEP (Wired Equivalent Privacy) with 40-bit key [IEEE 802.11]
+# If not set, this defaults to: CCMP TKIP WEP104 WEP40
+#
+# psk: WPA preshared key; 256-bit pre-shared key
+# The key used in WPA-PSK mode can be entered either as 64 hex-digits, i.e.,
+# 32 bytes or as an ASCII passphrase (in which case, the real PSK will be
+# generated using the passphrase and SSID). ASCII passphrase must be between
+# 8 and 63 characters (inclusive).
+# This field is not needed, if WPA-EAP is used.
+# Note: Separate tool, wpa_passphrase, can be used to generate 256-bit keys
+# from ASCII passphrase. This process uses lot of CPU and wpa_supplicant
+# startup and reconfiguration time can be optimized by generating the PSK only
+# only when the passphrase or SSID has actually changed.
+#
+# eapol_flags: IEEE 802.1X/EAPOL options (bit field)
+# Dynamic WEP key require for non-WPA mode
+# bit0 (1): require dynamically generated unicast WEP key
+# bit1 (2): require dynamically generated broadcast WEP key
+# 	(3 = require both keys; default)
+#
+# Following fields are only used with internal EAP implementation.
+# eap: space-separated list of accepted EAP methods
+#	MD5 = EAP-MD5 (unsecure and does not generate keying material ->
+#			cannot be used with WPA; to be used as a Phase 2 method
+#			with EAP-PEAP or EAP-TTLS)
+#       MSCHAPV2 = EAP-MSCHAPv2 (cannot be used separately with WPA; to be used
+#		as a Phase 2 method with EAP-PEAP or EAP-TTLS)
+#       OTP = EAP-OTP (cannot be used separately with WPA; to be used
+#		as a Phase 2 method with EAP-PEAP or EAP-TTLS)
+#       GTC = EAP-GTC (cannot be used separately with WPA; to be used
+#		as a Phase 2 method with EAP-PEAP or EAP-TTLS)
+#	TLS = EAP-TLS (client and server certificate)
+#	PEAP = EAP-PEAP (with tunnelled EAP authentication)
+#	TTLS = EAP-TTLS (with tunnelled EAP or PAP/CHAP/MSCHAP/MSCHAPV2
+#			 authentication)
+#	If not set, all compiled in methods are allowed.
+#
+# identity: Identity string for EAP
+# anonymous_identity: Anonymous identity string for EAP (to be used as the
+#	unencrypted identity with EAP types that support different tunnelled
+#	identity, e.g., EAP-TTLS)
+# password: Password string for EAP
+# ca_cert: File path to CA certificate file. This file can have one or more
+#	trusted CA certificates. If ca_cert is not included, server certificate
+#	will not be verified. This is insecure and the CA file should always be
+#	configured.
+# client_cert: File path to client certificate file (PEM/DER)
+# private_key: File path to client private key file (PEM/DER/PFX)
+#	When PKCS#12/PFX file (.p12/.pfx) is used, client_cert should be
+#	commented out. Both the private key and certificate will be read from
+#	the PKCS#12 file in this case.
+# private_key_passwd: Password for private key file
+# dh_file: File path to DH/DSA parameters file (in PEM format)
+#	This is an optional configuration file for setting parameters for an
+#	ephemeral DH key exchange. In most cases, the default RSA
+#	authentication does not use this configuration. However, it is possible
+#	setup RSA to use ephemeral DH key exchange. In addition, ciphers with
+#	DSA keys always use ephemeral DH keys. This can be used to achieve
+#	forward secrecy. If the file is in DSA parameters format, it will be
+#	automatically converted into DH params.
+# subject_match: Substring to be matched against the subject of the
+#	authentication server certificate. If this string is set, the server
+#	sertificate is only accepted if it contains this string in the subject.
+#	The subject string is in following format:
+#	/C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as@example.com
+# phase1: Phase1 (outer authentication, i.e., TLS tunnel) parameters
+#	(string with field-value pairs, e.g., "peapver=0" or
+#	"peapver=1 peaplabel=1")
+#	'peapver' can be used to force which PEAP version (0 or 1) is used.
+#	'peaplabel=1' can be used to force new label, "client PEAP encryption",
+#	to be used during key derivation when PEAPv1 or newer. Most existing
+#	PEAPv1 implementation seem to be using the old label, "client EAP
+#	encryption", and wpa_supplicant is now using that as the default value.
+#	Some servers, e.g., Radiator, may require peaplabel=1 configuration to
+#	interoperate with PEAPv1; see eap_testing.txt for more details.
+#	'peap_outer_success=0' can be used to terminate PEAP authentication on
+#	tunneled EAP-Success. This is required with some RADIUS servers that
+#	implement draft-josefsson-pppext-eap-tls-eap-05.txt (e.g.,
+#	Lucent NavisRadius v4.4.0 with PEAP in "IETF Draft 5" mode)
+#	sim_min_num_chal=3 can be used to configure EAP-SIM to require three
+#	challenges (by default, it accepts 2 or 3)
+# phase2: Phase2 (inner authentication with TLS tunnel) parameters
+#	(string with field-value pairs, e.g., "auth=MSCHAPV2" for EAP-PEAP or
+#	"autheap=MSCHAPV2 autheap=MD5" for EAP-TTLS)
+# Following certificate/private key fields are used in inner Phase2
+# authentication when using EAP-TTLS or EAP-PEAP.
+# ca_cert2: File path to CA certificate file. This file can have one or more
+#	trusted CA certificates. If ca_cert2 is not included, server
+#	certificate will not be verified. This is insecure and the CA file
+#	should always be configured.
+# client_cert2: File path to client certificate file
+# private_key2: File path to client private key file
+# private_key2_passwd: Password for private key file
+# dh_file2: File path to DH/DSA parameters file (in PEM format)
+# subject_match2: Substring to be matched against the subject of the
+#	authentication server certificate.
+#
+# EAP-PSK variables:
+# eappsk: 16-byte (128-bit, 32 hex digits) pre-shared key in hex format
+# nai: user NAI
+# server_nai: authentication server NAI
+#
+# EAP-FAST variables:
+# pac_file: File path for the PAC entries. wpa_supplicant will need to be able
+#	to create this file and write updates to it when PAC is being
+#	provisioned or refreshed.
+# phase1: fast_provisioning=1 option enables in-line provisioning of EAP-FAST
+#	credentials (PAC)
+#
+# wpa_supplicant supports number of "EAP workarounds" to work around
+# interoperability issues with incorrectly behaving authentication servers.
+# These are enabled by default because some of the issues are present in large
+# number of authentication servers. Strict EAP conformance mode can be
+# configured by disabling workarounds with eap_workaround=0.
+
+# Example blocks:
+
+# Simple case: WPA-PSK, PSK as an ASCII passphrase, allow all valid ciphers
+network={
+	ssid="simple"
+	psk="very secret passphrase"
+	priority=5
+}
+
+# Same as previous, but request SSID-specific scanning (for APs that reject
+# broadcast SSID)
+network={
+	ssid="second ssid"
+	scan_ssid=1
+	psk="very secret passphrase"
+	priority=2
+}
+
+# Only WPA-PSK is used. Any valid cipher combination is accepted.
+network={
+	ssid="example"
+	proto=WPA
+	key_mgmt=WPA-PSK
+	pairwise=CCMP TKIP
+	group=CCMP TKIP WEP104 WEP40
+	psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb
+	priority=2
+}
+
+# Only WPA-EAP is used. Both CCMP and TKIP is accepted. An AP that used WEP104
+# or WEP40 as the group cipher will not be accepted.
+network={
+	ssid="example"
+	proto=RSN
+	key_mgmt=WPA-EAP
+	pairwise=CCMP TKIP
+	group=CCMP TKIP
+	eap=TLS
+	identity="user@example.com"
+	ca_cert="/etc/cert/ca.pem"
+	client_cert="/etc/cert/user.pem"
+	private_key="/etc/cert/user.prv"
+	private_key_passwd="password"
+	priority=1
+}
+
+# EAP-PEAP/MSCHAPv2 configuration for RADIUS servers that use the new peaplabel
+# (e.g., Radiator)
+network={
+	ssid="example"
+	key_mgmt=WPA-EAP
+	eap=PEAP
+	identity="user@example.com"
+	password="foobar"
+	ca_cert="/etc/cert/ca.pem"
+	phase1="peaplabel=1"
+	phase2="auth=MSCHAPV2"
+	priority=10
+}
+
+# EAP-TTLS/EAP-MD5-Challenge configuration with anonymous identity for the
+# unencrypted use. Real identity is sent only within an encrypted TLS tunnel.
+network={
+	ssid="example"
+	key_mgmt=WPA-EAP
+	eap=TTLS
+	identity="user@example.com"
+	anonymous_identity="anonymous@example.com"
+	password="foobar"
+	ca_cert="/etc/cert/ca.pem"
+	priority=2
+}
+
+# EAP-TTLS/MSCHAPv2 configuration with anonymous identity for the unencrypted
+# use. Real identity is sent only within an encrypted TLS tunnel.
+network={
+	ssid="example"
+	key_mgmt=WPA-EAP
+	eap=TTLS
+	identity="user@example.com"
+	anonymous_identity="anonymous@example.com"
+	password="foobar"
+	ca_cert="/etc/cert/ca.pem"
+	phase2="auth=MSCHAPV2"
+}
+
+# WPA-EAP, EAP-TTLS with different CA certificate used for outer and inner
+# authentication.
+network={
+	ssid="example"
+	key_mgmt=WPA-EAP
+	eap=TTLS
+	# Phase1 / outer authentication
+	anonymous_identity="anonymous@example.com"
+	ca_cert="/etc/cert/ca.pem"
+	# Phase 2 / inner authentication
+	phase2="autheap=TLS"
+	ca_cert2="/etc/cert/ca2.pem"
+	client_cert2="/etc/cer/user.pem"
+	private_key2="/etc/cer/user.prv"
+	private_key2_passwd="password"
+	priority=2
+}
+
+# Both WPA-PSK and WPA-EAP is accepted. Only CCMP is accepted as pairwise and
+# group cipher.
+network={
+	ssid="example"
+	bssid=00:11:22:33:44:55
+	proto=WPA RSN
+	key_mgmt=WPA-PSK WPA-EAP
+	pairwise=CCMP
+	group=CCMP
+	psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb
+}
+
+# Special characters in SSID, so use hex string. Default to WPA-PSK, WPA-EAP
+# and all valid ciphers.
+network={
+	ssid=00010203
+	psk=000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
+}
+
+
+# EAP-SIM with a GSM SIM or USIM
+network={
+	ssid="eap-sim-test"
+	key_mgmt=WPA-EAP
+	eap=SIM
+	pin="1234"
+	pcsc=""
+}
+
+
+# EAP-PSK
+network={
+	ssid="eap-psk-test"
+	key_mgmt=WPA-EAP
+	eap=PSK
+	identity="eap_psk_user"
+	eappsk=06b4be19da289f475aa46a33cb793029
+	nai="eap_psk_user@example.com"
+	server_nai="as@example.com"
+}
+
+
+# IEEE 802.1X/EAPOL with dynamically generated WEP keys (i.e., no WPA) using
+# EAP-TLS for authentication and key generation; require both unicast and
+# broadcast WEP keys.
+network={
+	ssid="1x-test"
+	key_mgmt=IEEE8021X
+	eap=TLS
+	identity="user@example.com"
+	ca_cert="/etc/cert/ca.pem"
+	client_cert="/etc/cert/user.pem"
+	private_key="/etc/cert/user.prv"
+	private_key_passwd="password"
+	eapol_flags=3
+}
+
+
+# LEAP with dynamic WEP keys
+network={
+	ssid="leap-example"
+	key_mgmt=IEEE8021X
+	eap=LEAP
+	identity="user"
+	password="foobar"
+}
+
+# EAP-FAST with WPA (WPA or WPA2)
+network={
+	ssid="eap-fast-test"
+	key_mgmt=WPA-EAP
+	eap=FAST
+	anonymous_identity="FAST-000102030405"
+	identity="username"
+	password="password"
+	phase1="fast_provisioning=1"
+	pac_file="/etc/wpa_supplicant.eap-fast-pac"
+}
+
+# Plaintext connection (no WPA, no IEEE 802.1X)
+network={
+	ssid="plaintext-test"
+	key_mgmt=NONE
+}
+
+
+# Shared WEP key connection (no WPA, no IEEE 802.1X)
+network={
+	ssid="static-wep-test"
+	key_mgmt=NONE
+	wep_key0="abcde"
+	wep_key1=0102030405
+	wep_key2="1234567890123"
+	wep_tx_keyidx=0
+	priority=5
+}
+
+
+# Shared WEP key connection (no WPA, no IEEE 802.1X) using Shared Key
+# IEEE 802.11 authentication
+network={
+	ssid="static-wep-test2"
+	key_mgmt=NONE
+	wep_key0="abcde"
+	wep_key1=0102030405
+	wep_key2="1234567890123"
+	wep_tx_keyidx=0
+	priority=5
+	auth_alg=SHARED
+}
+
+
+# IBSS/ad-hoc network with WPA-None/TKIP.
+network={
+	ssid="test adhoc"
+	mode=1
+	proto=WPA
+	key_mgmt=WPA-NONE
+	pairwise=NONE
+	group=TKIP
+	psk="secret passphrase"
+}
+
+
+# Catch all example that allows more or less all configuration modes
+network={
+	ssid="example"
+	scan_ssid=1
+	key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE
+	pairwise=CCMP TKIP
+	group=CCMP TKIP WEP104 WEP40
+	psk="very secret passphrase"
+	eap=TTLS PEAP TLS
+	identity="user@example.com"
+	password="foobar"
+	ca_cert="/etc/cert/ca.pem"
+	client_cert="/etc/cert/user.pem"
+	private_key="/etc/cert/user.prv"
+	private_key_passwd="password"
+	phase1="peaplabel=0"
+}
diff --git a/packages/wpa-supplicant/files/wpa_supplicant_default.conf b/packages/wpa-supplicant/files/wpa_supplicant_default.conf
index e69de29bb2..8eebdeb5cb 100644
--- a/packages/wpa-supplicant/files/wpa_supplicant_default.conf
+++ b/packages/wpa-supplicant/files/wpa_supplicant_default.conf
@@ -0,0 +1,13 @@
+# This is a basic configuration for WPA with pre-shared keys (WPA-PSK)
+
+ctrl_interface=/var/run/wpa_supplicant
+ctrl_interface_group=0
+eapol_version=1
+ap_scan=1
+network={
+	ssid="YOUR_SSID"
+	psk="YOUR WPA PASSWORD IN HEX OR ASCII"
+	key_mgmt=WPA-PSK
+	pairwise=CCMP
+	priority=5
+}