[rpms/hostapd] rawhide: Update to version 2.12

[Davide Caratti <dcaratti@redhat.com>]

            A new commit has been pushed.

            Repo   : rpms/hostapd
            Branch : rawhide
            Commit : 704ce408edb8f8d8f4ef302059f46271c7a89c86
            Author : Davide Caratti <dcaratti@redhat.com>
            Date   : 2026-08-14T13:06:55+02:00
            Stats  : +11/-631 in 8 file(s)
            URL    : https://src.fedoraproject.org/rpms/hostapd/c/704ce408edb8f8d8f4ef302059f46271c7a89c86?branch=rawhide

            Log:
            Update to version 2.12

while at it, disable "badfuncs" check in rpminspect. inet_ntoa() and
inet_aton() in WPS code will disappear when WPS will be removed from
the upstream project.

https://bugzilla.redhat.com/show_bug.cgi?id=2512500

---
diff --git a/.gitignore b/.gitignore
index d5d4b5c..203f2f9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /hostapd-2.10.tar.gz
 /hostapd-2.11.tar.gz
+/hostapd-2.12.tar.gz

diff --git a/OpenSSL-Mark-more-ASN1-X509-values-const.patch b/OpenSSL-Mark-more-ASN1-X509-values-const.patch
deleted file mode 100644
index 2b8bcee..0000000
--- a/OpenSSL-Mark-more-ASN1-X509-values-const.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 907c5a99ad126bbef72b4a5d67e363decbd3d1ac Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Mon, 6 Apr 2026 11:59:07 +0300
-Subject: [PATCH 3/3] OpenSSL: Mark more ASN1/X509 values const
-
-OpenSSL 4.0 enforces this. A couple of additional typecasts are needed
-to get rid of the const marking for function calls with OpenSSL 1.1.1,
-but those could be removed for OpenSSL 3.0 and newer.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/crypto/crypto_openssl.c |  4 ++--
- src/crypto/tls_openssl.c    | 18 ++++++++++--------
- 2 files changed, 12 insertions(+), 10 deletions(-)
-
-diff --git a/src/crypto/crypto_openssl.c b/src/crypto/crypto_openssl.c
-index dbe85d5e3..3e88c3d0a 100644
---- a/src/crypto/crypto_openssl.c
-+++ b/src/crypto/crypto_openssl.c
-@@ -4479,8 +4479,8 @@ const u8 * crypto_csr_get_attribute(struct crypto_csr *csr,
- 				    size_t *len, int *type)
- {
- 	X509_ATTRIBUTE *attrib;
--	ASN1_TYPE *attrib_type;
--	ASN1_STRING *data;
-+	const ASN1_TYPE *attrib_type;
-+	const ASN1_STRING *data;
- 	int loc;
- 	int nid;
- 
-diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
-index fc7b4d2f9..292017cc4 100644
---- a/src/crypto/tls_openssl.c
-+++ b/src/crypto/tls_openssl.c
-@@ -2163,7 +2163,7 @@ static int match_dn_field(const X509 *cert, int nid, const char *field,
- 			  const struct tls_dn_field_order_cnt *dn_cnt)
- {
- 	int i, ret = 0, len, config_dn_field_index, match_index = 0;
--	X509_NAME *name;
-+	const X509_NAME *name;
- 
- 	len = os_strlen(value);
- 	name = X509_get_subject_name((X509 *) cert);
-@@ -2175,9 +2175,10 @@ static int match_dn_field(const X509 *cert, int nid, const char *field,
- 		return 0;
- 
- 	/* Fetch value based on NID */
--	for (i = -1; (i = X509_NAME_get_index_by_NID(name, nid, i)) > -1;) {
--		X509_NAME_ENTRY *e;
--		ASN1_STRING *cn;
-+	for (i = -1; (i = X509_NAME_get_index_by_NID((X509_NAME *) name, nid,
-+						     i)) > -1;) {
-+		const X509_NAME_ENTRY *e;
-+		const ASN1_STRING *cn;
- 
- 		e = X509_NAME_get_entry(name, i);
- 		if (!e)
-@@ -2332,7 +2333,7 @@ static int tls_match_suffix_helper(X509 *cert, const char *match,
- 	int i;
- 	stack_index_t j;
- 	int dns_name = 0;
--	X509_NAME *name;
-+	const X509_NAME *name;
- 
- 	wpa_printf(MSG_DEBUG, "TLS: Match domain against %s%s",
- 		   full ? "": "suffix ", match);
-@@ -2366,10 +2367,11 @@ static int tls_match_suffix_helper(X509 *cert, const char *match,
- 	name = X509_get_subject_name(cert);
- 	i = -1;
- 	for (;;) {
--		X509_NAME_ENTRY *e;
--		ASN1_STRING *cn;
-+		const X509_NAME_ENTRY *e;
-+		const ASN1_STRING *cn;
- 
--		i = X509_NAME_get_index_by_NID(name, NID_commonName, i);
-+		i = X509_NAME_get_index_by_NID((X509_NAME *) name,
-+					       NID_commonName, i);
- 		if (i == -1)
- 			break;
- 		e = X509_NAME_get_entry(name, i);
--- 
-2.53.0
-

diff --git a/OpenSSL-Set-X509_REQ-subject-name-using-proper-API-c.patch b/OpenSSL-Set-X509_REQ-subject-name-using-proper-API-c.patch
deleted file mode 100644
index efc9d09..0000000
--- a/OpenSSL-Set-X509_REQ-subject-name-using-proper-API-c.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From ec00192a5a56cadbb250816b2ed1552f6a4fdabe Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Mon, 6 Apr 2026 11:57:19 +0300
-Subject: [PATCH 2/3] OpenSSL: Set X509_REQ subject name using proper API calls
-
-X509_REQ_set_subject_name() should have used for this instead of adding
-entries into whatever X509_REQ_get_subject_name() returned. OpenSSL 4.0
-enforces this by marking the returned value from
-X509_REQ_get_subject_name() const.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/crypto/crypto_openssl.c | 15 +++++++++++----
- 1 file changed, 11 insertions(+), 4 deletions(-)
-
-diff --git a/src/crypto/crypto_openssl.c b/src/crypto/crypto_openssl.c
-index 0514185c9..dbe85d5e3 100644
---- a/src/crypto/crypto_openssl.c
-+++ b/src/crypto/crypto_openssl.c
-@@ -4405,6 +4405,7 @@ int crypto_csr_set_name(struct crypto_csr *csr, enum crypto_csr_name type,
- {
- 	X509_NAME *n;
- 	int nid;
-+	int ret = -1;
- 
- 	switch (type) {
- 	case CSR_NAME_CN:
-@@ -4426,7 +4427,7 @@ int crypto_csr_set_name(struct crypto_csr *csr, enum crypto_csr_name type,
- 		return -1;
- 	}
- 
--	n = X509_REQ_get_subject_name((X509_REQ *) csr);
-+	n = X509_NAME_new();
- 	if (!n)
- 		return -1;
- 
-@@ -4434,15 +4435,21 @@ int crypto_csr_set_name(struct crypto_csr *csr, enum crypto_csr_name type,
- 	if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_UTF8,
- 					(unsigned char *) name,
- 					os_strlen(name), -1, 0))
--		return -1;
-+		goto fail;
- #else
- 	if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_UTF8,
- 					(const unsigned char *) name,
- 					os_strlen(name), -1, 0))
--		return -1;
-+		goto fail;
- #endif
- 
--	return 0;
-+	if (X509_REQ_set_subject_name((X509_REQ *) csr, n) != 1)
-+		goto fail;
-+
-+	ret = 0;
-+fail:
-+	X509_NAME_free(n);
-+	return ret;
- }
- 
- 
--- 
-2.53.0
-

diff --git a/OpenSSL-Use-ASN1_STRING_length-get0_data-more-consis.patch b/OpenSSL-Use-ASN1_STRING_length-get0_data-more-consis.patch
deleted file mode 100644
index cc71cf6..0000000
--- a/OpenSSL-Use-ASN1_STRING_length-get0_data-more-consis.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 141abf49a432c9a0f4f38c47a477ab258ec9e239 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Mon, 6 Apr 2026 11:32:06 +0300
-Subject: [PATCH 1/3] OpenSSL: Use ASN1_STRING_length/get0_data() more
- consistently
-
-Some of the accesses to ASN1_IA5STRING were using direct references to
-the structure members. Replace those with helper functions to avoid the
-direct access. This is needed for OpenSSL 4.0.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/crypto/tls_openssl.c | 26 +++++++++++++++-----------
- 1 file changed, 15 insertions(+), 11 deletions(-)
-
-diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
-index d6f254371..fc7b4d2f9 100644
---- a/src/crypto/tls_openssl.c
-+++ b/src/crypto/tls_openssl.c
-@@ -2020,8 +2020,9 @@ static int tls_match_altsubject_component(X509 *cert, int type,
- 		gen = sk_GENERAL_NAME_value(ext, i);
- 		if (gen->type != type)
- 			continue;
--		if (os_strlen((char *) gen->d.ia5->data) == len &&
--		    os_memcmp(value, gen->d.ia5->data, len) == 0)
-+		if ((size_t) ASN1_STRING_length(gen->d.ia5) == len &&
-+		    os_memcmp(value, ASN1_STRING_get0_data(gen->d.ia5), len) ==
-+		    0)
- 			found++;
- 	}
- 
-@@ -2344,10 +2345,10 @@ static int tls_match_suffix_helper(X509 *cert, const char *match,
- 			continue;
- 		dns_name++;
- 		wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate dNSName",
--				  gen->d.dNSName->data,
--				  gen->d.dNSName->length);
--		if (domain_suffix_match(gen->d.dNSName->data,
--					gen->d.dNSName->length,
-+				  ASN1_STRING_get0_data(gen->d.dNSName),
-+				  ASN1_STRING_length(gen->d.dNSName));
-+		if (domain_suffix_match(ASN1_STRING_get0_data(gen->d.dNSName),
-+					ASN1_STRING_length(gen->d.dNSName),
- 					match, match_len, full) == 1) {
- 			wpa_printf(MSG_DEBUG, "TLS: %s in dNSName found",
- 				   full ? "Match" : "Suffix match");
-@@ -2378,8 +2379,10 @@ static int tls_match_suffix_helper(X509 *cert, const char *match,
- 		if (cn == NULL)
- 			continue;
- 		wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate commonName",
--				  cn->data, cn->length);
--		if (domain_suffix_match(cn->data, cn->length,
-+				  ASN1_STRING_get0_data(cn),
-+				  ASN1_STRING_length(cn));
-+		if (domain_suffix_match(ASN1_STRING_get0_data(cn),
-+					ASN1_STRING_length(cn),
- 					match, match_len, full) == 1) {
- 			wpa_printf(MSG_DEBUG, "TLS: %s in commonName found",
- 				   full ? "Match" : "Suffix match");
-@@ -2588,7 +2591,7 @@ static void openssl_tls_cert_event(struct tls_connection *conn,
- 		    gen->type != GEN_URI)
- 			continue;
- 
--		pos = os_malloc(10 + gen->d.ia5->length + 1);
-+		pos = os_malloc(10 + ASN1_STRING_length(gen->d.ia5) + 1);
- 		if (pos == NULL)
- 			break;
- 		altsubject[num_altsubject++] = pos;
-@@ -2608,8 +2611,9 @@ static void openssl_tls_cert_event(struct tls_connection *conn,
- 			break;
- 		}
- 
--		os_memcpy(pos, gen->d.ia5->data, gen->d.ia5->length);
--		pos += gen->d.ia5->length;
-+		os_memcpy(pos, ASN1_STRING_get0_data(gen->d.ia5),
-+			  ASN1_STRING_length(gen->d.ia5));
-+		pos += ASN1_STRING_length(gen->d.ia5);
- 		*pos = '\0';
- 	}
- 	sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
--- 
-2.53.0
-

diff --git a/OpenSSL-Use-pkcs11-provider-when-OPENSSL_NO_ENGINE-i.patch b/OpenSSL-Use-pkcs11-provider-when-OPENSSL_NO_ENGINE-i.patch
deleted file mode 100644
index 012fc03..0000000
--- a/OpenSSL-Use-pkcs11-provider-when-OPENSSL_NO_ENGINE-i.patch
+++ /dev/null
@@ -1,386 +0,0 @@
-From 400b89162294f0344d82334218e8950fd01bb12f Mon Sep 17 00:00:00 2001
-Message-ID: <400b89162294f0344d82334218e8950fd01bb12f.1744107874.git.davide.caratti@gmail.com>
-From: Davide Caratti <davide.caratti@gmail.com>
-Date: Wed, 15 Jan 2025 18:04:54 +0100
-Subject: [PATCH] OpenSSL: Use pkcs11-provider when OPENSSL_NO_ENGINE is
- defined
-
-Now that ENGINE API starts being deprecated in distros (like Fedora [1])
-wpa_supplicant users might need a way to load certificates and keys from
-PKCS11 URIs even when OPENSSL_NO_ENGINE is defined. We can do that using
-pkcs11-provider: load it by default in wpa_supplicant, and try to use it
-when OPENSSL_NO_ENGINE is defined and configuration requests PKCS11 URIs
-for certificates / keys.
-
-Inspired by pkcs11-provider test program 'tlssetkey.c' [2]
-
-[1] https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
-[2] https://github.com/latchset/pkcs11-provider/blob/main/tests/tlssetkey.c
-
-Signed-off-by: Davide Caratti <davide.caratti@gmail.com>
----
- src/crypto/tls_openssl.c | 215 ++++++++++++++++++++++++++++++++++-----
- 1 file changed, 190 insertions(+), 25 deletions(-)
-
-diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
-index 17283f998..e225817fe 100644
---- a/src/crypto/tls_openssl.c
-+++ b/src/crypto/tls_openssl.c
-@@ -33,6 +33,8 @@
- #include <openssl/core_names.h>
- #include <openssl/decoder.h>
- #include <openssl/param_build.h>
-+#include <openssl/store.h>
-+#include <openssl/provider.h>
- #else /* OpenSSL version >= 3.0 */
- #ifndef OPENSSL_NO_DSA
- #include <openssl/dsa.h>
-@@ -244,8 +246,8 @@ struct tls_connection {
- 	BIO *ssl_in, *ssl_out;
- #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
- 	ENGINE *engine;        /* functional reference to the engine */
--	EVP_PKEY *private_key; /* the private key if using engine */
- #endif /* OPENSSL_NO_ENGINE */
-+	EVP_PKEY *private_key; /* the private key if using engine/provider */
- 	char *subject_match, *altsubject_match, *suffix_match, *domain_match;
- 	char *check_cert_subject;
- 	int read_alerts, write_alerts, failed;
-@@ -357,6 +359,149 @@ static X509_STORE * tls_crl_cert_reload(const char *ca_cert, int check_crl)
- }
- 
- 
-+#ifdef OPENSSL_NO_ENGINE
-+
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+static OSSL_PROVIDER *openssl_pkcs11_provider = NULL;
-+#endif /* OpenSSL version >= 3.0 */
-+
-+static void openssl_load_pkcs11_provider(void)
-+{
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+	if (openssl_pkcs11_provider)
-+		return;
-+
-+	openssl_pkcs11_provider = OSSL_PROVIDER_try_load(NULL, "pkcs11", 1);
-+	if (!openssl_pkcs11_provider)
-+		wpa_printf(MSG_WARNING, "PKCS11 provider not present");
-+#endif /* OpenSSL version >= 3.0 */
-+}
-+
-+
-+static void openssl_unload_pkcs11_provider(void)
-+{
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+	if (openssl_pkcs11_provider) {
-+		OSSL_PROVIDER_unload(openssl_pkcs11_provider);
-+		openssl_pkcs11_provider = NULL;
-+	}
-+#endif /* OpenSSL version >= 3.0 */
-+}
-+
-+
-+static bool openssl_can_use_provider(const char *engine_id, const char *req)
-+{
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+	if (!os_strcmp(engine_id, "pkcs11") && openssl_pkcs11_provider)
-+		return true;
-+
-+	wpa_printf(MSG_ERROR,
-+		   "Cannot find OpenSSL provider for '%s' (missing '%s')",
-+		   req, engine_id);
-+#endif /* OpenSSL version >= 3.0 */
-+	return false;
-+}
-+
-+
-+static EVP_PKEY * provider_load_key(const char *uri)
-+{
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+	OSSL_STORE_CTX *store;
-+	OSSL_STORE_INFO *info;
-+	EVP_PKEY *key = NULL;
-+
-+	if (!uri) {
-+		tls_show_errors(MSG_ERROR, __func__,
-+				"Invalid NULL uri for key");
-+		goto err_key;
-+	}
-+
-+	store = OSSL_STORE_open(uri, NULL, NULL, NULL, NULL);
-+	if (!store) {
-+		wpa_printf(MSG_DEBUG, "Bad uri for private key:%s", uri);
-+
-+		tls_show_errors(MSG_ERROR, __func__,
-+				"Failed to open key store");
-+		goto err_key;
-+	}
-+
-+	if (os_strncmp(uri, "pkcs11:", 7) &&
-+	    os_strstr(uri, "type=private") == NULL) {
-+		/* This is a workaround for OpenSSL < 3.2.0 where the code fails
-+		 * to correctly source public keys unless explicitly requested
-+		 * via an expect hint. */
-+		if (OSSL_STORE_expect(store, OSSL_STORE_INFO_PUBKEY) != 1) {
-+			tls_show_errors(MSG_ERROR, __func__,
-+					"Failed to expect Public Key File");
-+			goto err_store;
-+		}
-+	}
-+
-+	while (!OSSL_STORE_eof(store)) {
-+		info = OSSL_STORE_load(store);
-+		if ((OSSL_STORE_INFO_get_type(info)) == OSSL_STORE_INFO_PKEY)
-+			key = OSSL_STORE_INFO_get1_PKEY(info);
-+
-+		OSSL_STORE_INFO_free(info);
-+		if (key)
-+			break;
-+	}
-+
-+err_store:
-+	OSSL_STORE_close(store);
-+err_key:
-+	if (!key)
-+		wpa_printf(MSG_ERROR, "OpenSSL: Failed to load key from URI");
-+
-+	return key;
-+#else /* OpenSSL version >= 3.0 */
-+	return NULL;
-+#endif /* OpenSSL version >= 3.0 */
-+}
-+
-+
-+static X509 * provider_load_cert(const char *cert_id)
-+{
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+	OSSL_STORE_CTX *store;
-+	OSSL_STORE_INFO *info;
-+	X509 *cert = NULL;
-+
-+	if (!cert_id) {
-+		tls_show_errors(MSG_ERROR, __func__, "Invalid NULL uri");
-+		goto err_cert;
-+	}
-+
-+	store = OSSL_STORE_open(cert_id, NULL, NULL, NULL, NULL);
-+	if (!store) {
-+		tls_show_errors(MSG_ERROR, __func__, "Failed to open store");
-+		goto err_cert;
-+	}
-+
-+	while (!OSSL_STORE_eof(store)) {
-+		info = OSSL_STORE_load(store);
-+		if ((OSSL_STORE_INFO_get_type(info)) == OSSL_STORE_INFO_CERT)
-+			cert = OSSL_STORE_INFO_get1_CERT(info);
-+
-+		OSSL_STORE_INFO_free(info);
-+		if (cert)
-+			break;
-+	}
-+	OSSL_STORE_close(store);
-+
-+err_cert:
-+	if (!cert)
-+		tls_show_errors(MSG_ERROR, __func__,
-+				"Failed to load cert from URI");
-+	return cert;
-+#else /* OpenSSL version >= 3.0 */
-+	return NULL;
-+#endif /* OpenSSL version >= 3.0 */
-+}
-+
-+#endif /* OPENSSL_NO_ENGINE */
-+
-+
- #ifdef CONFIG_NATIVE_WINDOWS
- 
- /* Windows CryptoAPI and access to certificate stores */
-@@ -1020,6 +1165,9 @@ void * tls_init(const struct tls_config *conf)
- 		void openssl_load_legacy_provider(void);
- 
- 		openssl_load_legacy_provider();
-+#ifdef OPENSSL_NO_ENGINE
-+		openssl_load_pkcs11_provider();
-+#endif /* OPENSSL_NO_ENGINE */
- 
- 		tls_global = context = tls_context_new(conf);
- 		if (context == NULL)
-@@ -1211,6 +1359,9 @@ void tls_deinit(void *ssl_ctx)
- 
- 	tls_openssl_ref_count--;
- 	if (tls_openssl_ref_count == 0) {
-+#ifdef OPENSSL_NO_ENGINE
-+		openssl_unload_pkcs11_provider();
-+#endif /* OPENSSL_NO_ENGINE */
- #if OPENSSL_VERSION_NUMBER < 0x10100000L
- #ifndef OPENSSL_NO_ENGINE
- 		ENGINE_cleanup();
-@@ -1369,6 +1520,10 @@ err:
- 
- 	return ret;
- #else /* OPENSSL_NO_ENGINE */
-+	conn->private_key = provider_load_key(key_id);
-+	if (!conn->private_key)
-+		return -1;
-+
- 	return 0;
- #endif /* OPENSSL_NO_ENGINE */
- }
-@@ -1376,12 +1531,12 @@ err:
- 
- static void tls_engine_deinit(struct tls_connection *conn)
- {
--#if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
--	wpa_printf(MSG_DEBUG, "ENGINE: engine deinit");
- 	if (conn->private_key) {
- 		EVP_PKEY_free(conn->private_key);
- 		conn->private_key = NULL;
- 	}
-+#if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
-+	wpa_printf(MSG_DEBUG, "ENGINE: engine deinit");
- 	if (conn->engine) {
- #if !defined(OPENSSL_IS_BORINGSSL)
- 		ENGINE_finish(conn->engine);
-@@ -3799,11 +3954,16 @@ static int tls_engine_get_cert(struct tls_connection *conn,
- static int tls_connection_engine_client_cert(struct tls_connection *conn,
- 					     const char *cert_id)
- {
--#ifndef OPENSSL_NO_ENGINE
- 	X509 *cert;
- 
-+#ifndef OPENSSL_NO_ENGINE
- 	if (tls_engine_get_cert(conn, cert_id, &cert))
- 		return -1;
-+#else /* OPENSSL_NO_ENGINE */
-+	cert = provider_load_cert(cert_id);
-+	if (!cert)
-+		return -1;
-+#endif /* OPENSSL_NO_ENGINE */
- 
- 	if (!SSL_use_certificate(conn->ssl, cert)) {
- 		tls_show_errors(MSG_ERROR, __func__,
-@@ -3812,13 +3972,9 @@ static int tls_connection_engine_client_cert(struct tls_connection *conn,
- 		return -1;
- 	}
- 	X509_free(cert);
--	wpa_printf(MSG_DEBUG, "ENGINE: SSL_use_certificate --> "
-+	wpa_printf(MSG_DEBUG, "ENGINE/provider: SSL_use_certificate --> "
- 		   "OK");
- 	return 0;
--
--#else /* OPENSSL_NO_ENGINE */
--	return -1;
--#endif /* OPENSSL_NO_ENGINE */
- }
- 
- 
-@@ -3826,13 +3982,18 @@ static int tls_connection_engine_ca_cert(struct tls_data *data,
- 					 struct tls_connection *conn,
- 					 const char *ca_cert_id)
- {
--#ifndef OPENSSL_NO_ENGINE
- 	X509 *cert;
- 	SSL_CTX *ssl_ctx = data->ssl;
- 	X509_STORE *store;
- 
-+#ifndef OPENSSL_NO_ENGINE
- 	if (tls_engine_get_cert(conn, ca_cert_id, &cert))
- 		return -1;
-+#else /* OPENSSL_NO_ENGINE */
-+	cert = provider_load_cert(ca_cert_id);
-+	if (!cert)
-+		return -1;
-+#endif /* OPENSSL_NO_ENGINE */
- 
- 	/* start off the same as tls_connection_ca_cert */
- 	store = X509_STORE_new();
-@@ -3846,7 +4007,7 @@ static int tls_connection_engine_ca_cert(struct tls_data *data,
- 	if (!X509_STORE_add_cert(store, cert)) {
- 		unsigned long err = ERR_peek_error();
- 		tls_show_errors(MSG_WARNING, __func__,
--				"Failed to add CA certificate from engine "
-+				"Failed to add CA certificate from engine/provider "
- 				"to certificate store");
- 		if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
- 		    ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
-@@ -3859,25 +4020,21 @@ static int tls_connection_engine_ca_cert(struct tls_data *data,
- 		}
- 	}
- 	X509_free(cert);
--	wpa_printf(MSG_DEBUG, "OpenSSL: %s - added CA certificate from engine "
--		   "to certificate store", __func__);
-+	wpa_printf(MSG_DEBUG,
-+		   "OpenSSL: %s - added CA certificate from engine/provider to certificate store",
-+		   __func__);
- 	SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
- 	conn->ca_cert_verify = 1;
- 
- 	return 0;
--
--#else /* OPENSSL_NO_ENGINE */
--	return -1;
--#endif /* OPENSSL_NO_ENGINE */
- }
- 
- 
- static int tls_connection_engine_private_key(struct tls_connection *conn)
- {
--#if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
- 	if (SSL_use_PrivateKey(conn->ssl, conn->private_key) != 1) {
- 		tls_show_errors(MSG_ERROR, __func__,
--				"ENGINE: cannot use private key for TLS");
-+				"ENGINE/provider: cannot use private key for TLS");
- 		return -1;
- 	}
- 	if (!SSL_check_private_key(conn->ssl)) {
-@@ -3886,11 +4043,6 @@ static int tls_connection_engine_private_key(struct tls_connection *conn)
- 		return -1;
- 	}
- 	return 0;
--#else /* OPENSSL_NO_ENGINE */
--	wpa_printf(MSG_ERROR, "SSL: Configuration uses engine, but "
--		   "engine support was not compiled in");
--	return -1;
--#endif /* OPENSSL_NO_ENGINE */
- }
- 
- 
-@@ -5437,6 +5589,10 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
- 		return -1;
- 
- 	if (engine_id && ca_cert_id) {
-+#ifdef OPENSSL_NO_ENGINE
-+		if (!openssl_can_use_provider(engine_id, ca_cert_id))
-+			return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
-+#endif /* OPENSSL_NO_ENGINE */
- 		if (tls_connection_engine_ca_cert(data, conn, ca_cert_id))
- 			return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
- 	} else if (tls_connection_ca_cert(data, conn, params->ca_cert,
-@@ -5446,6 +5602,10 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
- 		return -1;
- 
- 	if (engine_id && cert_id) {
-+#ifdef OPENSSL_NO_ENGINE
-+		if (!openssl_can_use_provider(engine_id, cert_id))
-+			return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
-+#endif /* OPENSSL_NO_ENGINE */
- 		if (tls_connection_engine_client_cert(conn, cert_id))
- 			return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
- 	} else if (tls_connection_client_cert(conn, params->client_cert,
-@@ -5454,7 +5614,12 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
- 		return -1;
- 
- 	if (engine_id && key_id) {
--		wpa_printf(MSG_DEBUG, "TLS: Using private key from engine");
-+#ifdef OPENSSL_NO_ENGINE
-+		if (!openssl_can_use_provider(engine_id, key_id))
-+			return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
-+#endif /* OPENSSL_NO_ENGINE */
-+		wpa_printf(MSG_DEBUG,
-+			   "TLS: Using private key from engine/provider");
- 		if (tls_connection_engine_private_key(conn))
- 			return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
- 	} else if (tls_connection_private_key(data, conn,
--- 
-2.47.0
-

diff --git a/hostapd.spec b/hostapd.spec
index d0d6a3e..56a55eb 100644
--- a/hostapd.spec
+++ b/hostapd.spec
@@ -1,8 +1,8 @@
 %global _hardened_build 1
 
 Name:           hostapd
-Version:        2.11
-Release:        7%{?dist}
+Version:        2.12
+Release:        1%{?dist}
 Summary:        IEEE 802.11 AP, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
 License:        BSD-3-Clause
 URL:            http://w1.fi/hostapd
@@ -14,16 +14,6 @@ Source3:        %{name}.conf.5
 Source4:        %{name}.sysconfig
 Source5:        %{name}.init
 
-# use pkcs11-provider instead of OpenSSL engine
-Patch1: OpenSSL-Use-pkcs11-provider-when-OPENSSL_NO_ENGINE-i.patch
-# OpenSSL 4.0 compatibility patches
-# https://git.w1.fi/cgit/hostap/commit/?id=141abf49a432c9a0f4f38c47a477ab258ec9e239
-Patch2: OpenSSL-Use-ASN1_STRING_length-get0_data-more-consis.patch
-# https://git.w1.fi/cgit/hostap/commit/?id=ec00192a5a56cadbb250816b2ed1552f6a4fdabe
-Patch3: OpenSSL-Set-X509_REQ-subject-name-using-proper-API-c.patch
-# https://git.w1.fi/cgit/hostap/commit/?id=907c5a99ad126bbef72b4a5d67e363decbd3d1ac
-Patch4: OpenSSL-Mark-more-ASN1-X509-values-const.patch
-
 BuildRequires:  libnl3-devel
 BuildRequires:  openssl-devel
 BuildRequires:  perl-generators
@@ -204,6 +194,9 @@ fi
 %{_sysconfdir}/logwatch/scripts/services/%{name}
 
 %changelog
+* Thu Aug 13 2026 Davide Caratti <dcaratti@redhat.com> - 2.12-1
+- Update to version 2.12 (#2512509)
+
 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.11-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
 
@@ -224,7 +217,7 @@ fi
 * Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.11-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 
-* Mon Jul 29 2024 Davide Caratti <dcaratti@redhat.com> - 1:2.11-1
+* Mon Jul 29 2024 Davide Caratti <dcaratti@redhat.com> - 2.11-1
 - Update to version 2.11 (#2299039)
 - Disable OpenSSL ENGINE API
 

diff --git a/rpminspect.yaml b/rpminspect.yaml
new file mode 100644
index 0000000..0c3bdf7
--- /dev/null
+++ b/rpminspect.yaml
@@ -0,0 +1,3 @@
+---
+inspections:
+    badfuncs: off

diff --git a/sources b/sources
index 34f04ad..7c0e0ca 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (hostapd-2.11.tar.gz) = 1382af2a243e3a555507b55942f41d1233cc942826d26bc4f4dbe5e75560b3fe22e426948762fe162453e934685a69ef0c05723b7fecef71811fc1987e32b048
+SHA512 (hostapd-2.12.tar.gz) = 3d952125dc2b6868532b39264e16eae4d0bdf601b82229e6f5e7caedbd7ce3c1c2b842932b0afe33d9c3077dc4d536e04f8b47fb5d35f5e253d97ab8465eda81