diff options
| author | Joerg Werner <schreibubi@gmail.com> | 2022-06-26 17:18:39 +0200 |
|---|---|---|
| committer | Hauke Mehrtens <hauke@hauke-m.de> | 2022-08-20 22:56:12 +0200 |
| commit | 9fbb76c0470fd54f1f34909b1098d0f76078878f (patch) | |
| tree | 82e9d2bc3dd50c75b88324046393599de9f57cd8 | |
| parent | 8008816a2ceeb7e66d27d9882685933bb9df4c76 (diff) | |
| download | upstream-9fbb76c0470fd54f1f34909b1098d0f76078878f.tar.gz upstream-9fbb76c0470fd54f1f34909b1098d0f76078878f.tar.bz2 upstream-9fbb76c0470fd54f1f34909b1098d0f76078878f.zip | |
hostapd: fix WPA3 enterprise keys and ciphers
WPA3 enterprise requires group_mgmt_cipher=BIP-GMAC-256 and if 802.11r is
active also wpa_key_mgmt FT-EAP-SHA384. This commit also requires
corresponding changes in netifd.
Signed-off-by: Joerg Werner <schreibubi@gmail.com>
| -rw-r--r-- | package/network/services/hostapd/files/hostapd.sh | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh index 72ff65b4f1..00de1e07ec 100644 --- a/package/network/services/hostapd/files/hostapd.sh +++ b/package/network/services/hostapd/files/hostapd.sh @@ -48,12 +48,15 @@ hostapd_append_wpa_key_mgmt() { ;; eap192) append wpa_key_mgmt "WPA-EAP-SUITE-B-192" - [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP" + [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP-SHA384" ;; eap-eap192) append wpa_key_mgmt "WPA-EAP-SUITE-B-192" append wpa_key_mgmt "WPA-EAP" - [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP" + [ "${ieee80211r:-0}" -gt 0 ] && { + append wpa_key_mgmt "FT-EAP-SHA384" + append wpa_key_mgmt "FT-EAP" + } [ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-EAP-SHA256" ;; sae) @@ -968,7 +971,11 @@ hostapd_set_bss_options() { json_get_vars ieee80211w_mgmt_cipher ieee80211w_max_timeout ieee80211w_retry_timeout append bss_conf "ieee80211w=$ieee80211w" "$N" [ "$ieee80211w" -gt "0" ] && { - append bss_conf "group_mgmt_cipher=${ieee80211w_mgmt_cipher:-AES-128-CMAC}" "$N" + if [ "$auth_type" = "eap192" ]; then + append bss_conf "group_mgmt_cipher=BIP-GMAC-256" "$N" + else + append bss_conf "group_mgmt_cipher=${ieee80211w_mgmt_cipher:-AES-128-CMAC}" "$N" + fi [ -n "$ieee80211w_max_timeout" ] && \ append bss_conf "assoc_sa_query_max_timeout=$ieee80211w_max_timeout" "$N" [ -n "$ieee80211w_retry_timeout" ] && \ |