aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2016-01-18 11:40:44 +0000
committerFelix Fietkau <nbd@openwrt.org>2016-01-18 11:40:44 +0000
commite4cf25cfab7dc52bae02d44308e56e7437cb6433 (patch)
tree8cc46bd90f43c06e3183a1c807b6404c11be8c9d
parentfc8a7051cd997d4445f9c37c332d5141b5396d17 (diff)
downloadupstream-e4cf25cfab7dc52bae02d44308e56e7437cb6433.tar.gz
upstream-e4cf25cfab7dc52bae02d44308e56e7437cb6433.tar.bz2
upstream-e4cf25cfab7dc52bae02d44308e56e7437cb6433.zip
wpa_supplicant: improve generating phase2 config line for WPA-EAP
WPA-EAP supports several phase2 (=inner) authentication methods when using EAP-TTLS, EAP-PEAP or EAP-FAST (the latter is added as a first step towards the UCI model supporting EAP-FAST by this commit) The value of the auth config variable was previously expected to be directly parseable as the content of the 'phase2' option of wpa_supplicant. This exposed wpa_supplicant's internals, leaving it to view-level to set the value properly. Unfortunately, this is currently not the case, as LuCI currently allows values like 'PAP', 'CHAP', 'MSCHAPV2'. Users thus probably diverged and set auth to values like 'auth=MSCHAPV2' as a work-around. This behaviour isn't explicitely documented anywhere and is not quite intuitive... The phase2-string is now generated according to $eap_type and $auth, following the scheme also found in hostap's test-cases: http://w1.fi/cgit/hostap/tree/tests/hwsim/test_ap_eap.py The old behaviour is also still supported for the sake of not breaking existing, working configurations. Examples: eap_type auth 'ttls' 'EAP-MSCHAPV2' -> phase2="autheap=MSCHAPV2" 'ttls' 'MSCHAPV2' -> phase2="auth=MSCHAPV2" 'peap' 'EAP-GTC' -> phase2="auth=GTC" Deprecated syntax supported for compatibility: 'ttls' 'autheap=MSCHAPV2' -> phase2="autheap=MSCHAPV2" I will suggest a patch to LuCI adding EAP-MSCHAPV2, EAP-GTC, ... to the list of Authentication methods available. Signed-off-by: Daniel Golle <daniel@makrotopia.org> SVN-Revision: 48309
-rw-r--r--package/network/services/hostapd/files/netifd.sh15
1 files changed, 13 insertions, 2 deletions
diff --git a/package/network/services/hostapd/files/netifd.sh b/package/network/services/hostapd/files/netifd.sh
index 80560802d2..cedf5d5589 100644
--- a/package/network/services/hostapd/files/netifd.sh
+++ b/package/network/services/hostapd/files/netifd.sh
@@ -633,10 +633,21 @@ wpa_supplicant_add_network() {
append network_data "private_key=\"$priv_key\"" "$N$T"
append network_data "private_key_passwd=\"$priv_key_pwd\"" "$N$T"
;;
- peap|ttls)
+ fast|peap|ttls)
json_get_vars auth password
set_default auth MSCHAPV2
- append network_data "phase2=\"$auth\"" "$N$T"
+ phase2proto="auth="
+ case "$auth" in
+ "auth"*)
+ phase2proto=""
+ ;;
+ "EAP-"*)
+ auth="$(echo $auth | cut -b 5- )"
+ [ "$eap_type" = "ttls" ] &&
+ phase2proto="autheap="
+ ;;
+ esac
+ append network_data "phase2=\"$phase2proto$auth\"" "$N$T"
append network_data "password=\"$password\"" "$N$T"
;;
esac