Motivation for this change

https://w1.fi/security/2020-1/upnp-subscribe-misbehavior-wps-ap.txt

Fixes: CVE-2020-12695

Vulnerable versions/configurations

All hostapd versions with WPS AP support with UPnP enabled in the build
parameters (CONFIG_WPS_UPNP=y) and in the runtime configuration
(upnp_iface).

We don't enable CONFIG_WPS_UPNP and it's not enabled in hostapds defconfig, so an enduser would need to overwrite extraConfig to enable it for exposure first.

Possible mitigation steps

• Disable WPS UPnP support in the hostapd runtime configuration by
  removing the upnp_iface parameter.

• Merge the following commits to hostapd and rebuild:

  For CVE-2020-12695:
  WPS UPnP: Do not allow event subscriptions with URLs to other networks
  For the other issues:
  WPS UPnP: Fix event message generation using a long URL path
  WPS UPnP: Handle HTTP initiation failures for events more properly

  These patches are available from https://w1.fi/security/2020-1/

• Update to hostapd v2.10 or newer, once available

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

@Phreedom @ninjatrappeur