aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services/hostapd/files
Commit message (Collapse)AuthorAgeFilesLines
* hostapd: fix civic location optionJohn Crispin2021-05-261-1/+1
| | | | Signed-off-by: John Crispin <john@phrozen.org>
* hostapd: add patch for disabling automatic bridging of vlan interfacesFelix Fietkau2021-05-181-3/+7
| | | | | | | netifd is responsible for handling that, except if the vlan bridge was provided by the config Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: enable airtime policy for the -basic variantsRui Salvaterra2021-04-031-1/+1
| | | | | | | | | | | | | | Airtime policy configuration is extremely useful in multiple BSS scenarios. Since nowadays most people configure both private and guest networks (at least), it makes sense to enable it by default, except for the most limited of the variants. Size of the hostapd-basic-openssl binary (mipsel 24Kc -O2): 543944 bytes (airtime policy disabled) 548040 bytes (airtime policy enabled) Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com> Acked-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: fix setting wps_state to "not configured"Leon M. George2021-01-151-1/+1
| | | | | | | | | | | | | | | With encryption disabled, it was intended to set wpa_state=1 (enabled, not configured) through the 'wps_not_configured' flag. The flag is set appropriately but the condition using it is broken. Instead, 'wps_configured' is checked and wpa_state is always 2 (enabled, configured). Fix it by using the correct variable name. Fixes: 498d84fc4e00 ("netifd: add wireless configuration support and port mac80211 to the new framework") Signed-off-by: Leon M. George <leon@georgemail.eu> [commit title/message improvements] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* hostapd: fix key_mgmt typoLeon M. George2021-01-141-1/+1
| | | | | | | | | | | The key_mgmt variable was mistyped when checking against "WPS", so the if clause was never entered. Fixes: f5753aae233f ("hostapd: add support for WPS pushbutton station") Signed-off-by: Leon M. George <leon@georgemail.eu> [add commit message, bump PKG_RELEASE] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* hostapd: remove trailing whitespacesLeon M. George2021-01-141-2/+2
| | | | Signed-off-by: Leon M. George <leon@georgemail.eu>
* hostapd: remove unused variableLeon M. George2021-01-141-1/+0
| | | | | | | | | 'base' was never used. Fixes: 498d84fc4e00 ("netifd: add wireless configuration support and port mac80211 to the new framework") Signed-off-by: Leon M. George <leon@georgemail.eu>
* hostapd: remove unused variableLeon M. George2021-01-141-1/+0
| | | | | | | | | 'enc_str' was never used. Fixes: 498d84fc4e00 ("netifd: add wireless configuration support and port mac80211 to the new framework") Signed-off-by: Leon M. George <leon@georgemail.eu>
* hostapd: run as user 'network' if procd-ujail is installedDaniel Golle2021-01-143-0/+48
| | | | | | | Granting capabilities CAP_NET_ADMIN and CAP_NET_RAW allows running hostapd and wpa_supplicant without root priviledges. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: improve error handling when adding supplicant configDaniel Golle2021-01-141-4/+4
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: add multicast_to_unicast and per_sta_vifEtan Kissling2021-01-141-1/+14
| | | | | | | | This allows configuration of multicast_to_unicast and per_sta_vif options. - multicast_to_unicast requests multicast-to-unicast conversion. - per_sta_vif assigns each station its own AP_VLAN interface. Signed-off-by: Etan Kissling <etan_kissling@apple.com>
* hostapd: return PID on config_add callDaniel Golle2021-01-101-3/+2
| | | | | | | | | To simplify the way netifd acquires the PIDs of wpa_supplicant and hostapd let the config_add method of both of them return the PID of the called process. Use the returned PID instead of querying procd when adding wpa_supplicant configuration. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: wpa_supplicant: Enable proper GCMP cipher supportRobert Marko2021-01-051-0/+5
| | | | | | | | | This patch enables hostapd.sh to properly configure wpa_supplicant for when GCMP is used as cipher in station mode. Without this wpa_supplicant will be unable to connect to AP. This is needed for wil6210 as it does not support CCMP. Signed-off-by: Robert Marko <robimarko@gmail.com>
* hostapd: add support for custom per-BSS optionsFlorian Beverborg2021-01-031-0/+7
| | | | | | | | | | | | This adds an option "hostapd_bss_options" that does the same as "hostapd_options" but on a per-BSS level, instead of a per-device level. This can be used, for example, to configure different per-devce sae_passwords per BSS or to augment some of the existing per-BSS options. Signed-off-by: Florian Beverborg <flo@beverb.org> [remove whitespace errors, bump release] Signed-off-by: Paul Spooren <mail@aparcar.org>
* hostapd: do not restart hostapd instance on wireless restartsFelix Fietkau2020-12-311-1/+1
| | | | | | Add the flag that prevents netifd from killing hostapd/wpa_supplicant Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: pass respawn settings when registering the serviceJohn Crispin2020-12-221-2/+2
| | | | | | | | When hostapd gets restarted to often/quickly will cause procd to not restart it anymore. it will think that hapd is in a crash loop. Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> [adjust respawn time]
* hostapd: Use EAPOLv1 (802.1X-2001) if WPA enabledNick Lowe2020-12-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, EAPOLv2 (802.1X-2004) is used by default for legacy clients that are not WPA2 (RSN) capable. These legacy clients are often intolerant to this EAPOL version and fail to connect. hostapd.conf upstream documents for eapol_version the following and that this is a known compatibility issue with version 2: // IEEE 802.1X/EAPOL version // hostapd is implemented based on IEEE Std 802.1X-2004 which defines EAPOL // version 2. However, there are many client implementations that do not handle // the new version number correctly (they seem to drop the frames completely). // In order to make hostapd interoperate with these clients, the version number // can be set to the older version (1) with this configuration value. // Note: When using MACsec, eapol_version shall be set to 3, which is // defined in IEEE Std 802.1X-2010. //eapol_version=2 For the wpa parameter, hostapd.conf upstream documents that this is a bitfield, configured as follows: // Enable WPA. Setting this variable configures the AP to require WPA (either // WPA-PSK or WPA-RADIUS/EAP based on other configuration). For WPA-PSK, either // wpa_psk or wpa_passphrase must be set and wpa_key_mgmt must include WPA-PSK. // Instead of wpa_psk / wpa_passphrase, wpa_psk_radius might suffice. // For WPA-RADIUS/EAP, ieee8021x must be set (but without dynamic WEP keys), // RADIUS authentication server must be configured, and WPA-EAP must be included // in wpa_key_mgmt. // This field is a bit field that can be used to enable WPA (IEEE 802.11i/D3.0) // and/or WPA2 (full IEEE 802.11i/RSN): // bit0 = WPA // bit1 = IEEE 802.11i/RSN (WPA2) (dot11RSNAEnabled) // Note that WPA3 is also configured with bit1 since it uses RSN just like WPA2. // In other words, for WPA3, wpa=2 is used the configuration (and // wpa_key_mgmt=SAE for WPA3-Personal instead of wpa_key_mgmt=WPA-PSK). //wpa=2 For client compatibility therefore: EAPOLv1 (802.1X-2001) should be used by default where WPA is enabled. EAPOLv2 (802.1X-2004) should be used by default where WPA is disabled. To fix this, we can therefore change in the script: set_default eapol_version 0 To the following: set_default eapol_version $((wpa & 1)) This therefore: 1) Sets eapol_version to 1 where WPA has been enabled via wpa bit0 being set. 2) Sets eapol_version to 0 where WPA has been disabled via wpa bit0 being unset. For usual configurations that only have WPA2 enabled, EAPOLv2 is then used. Signed-off-by: Nick Lowe <nick.lowe@gmail.com>
* hostapd: parse skip_inactivity_poll optionNadim Atiya2020-12-221-2/+4
| | | | | | | | | | | | hostapd.sh does not parse skip_inactivity_poll boolean from /etc/config/wireless despite being mentioned in the documentation [1]. This change fixes this, and by default sets its value to 0 [1]. [1] https://openwrt.org/docs/guide-user/network/wifi/basic Signed-off-by: Nadim Atiya <nadim.atiya@gmail.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org> [fix and reformat commit message, make patch apply]
* hostapd: Disable 802.11b data rates by defaultNick Lowe2020-12-061-1/+1
| | | | | | | | | | | | | | | | | Set legacy_rates to 0 by default to disable 802.11b data rates by default. The time has long come where 802.11b DSSS/CCK data rates should be disabled by default in OpenWRT. Users in need of 802.11b client support can reasonably enable these where they are needed. The balance of equities has significantly, and for a long time, tipped such that dropping backwards compatibility by default with 802.11b devices is appropriate, proportionate and justified. By doing so, management and control traffic is moved by default to a 20 MHz wide 6 Mb/s OFDM data rate instead of a 22 MHz wide 1 Mb/s DSSS data rate. This is significantly more airtime efficient. Signed-off-by: Nick Lowe <nick.lowe@gmail.com>
* hostapd: Add cell_density data rates optionNick Lowe2020-11-301-13/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a cell_density option to configure data rates for normal, high and very high cell density wireless deployments. The purpose of using a minimum basic/mandatory data rate that is higher than 6 Mb/s, or 5.5 Mb/s (802.11b compatible), in high cell density environments is to transmit broadcast/multicast data frames using less airtime or to reduce management overheads where significant co-channel interference (CCI) exists and cannot be avoided. Caution: Without careful design and validation, configuration of a too high minimum basic/mandatory data rate can sacrifice connection stability or disrupt the ability to reliably connect and authenticate for little to no capacity benefit. This is because this configuration affects the ability of clients to hear and demodulate management, control and broadcast/multicast data frames. Deployments that have not been specifically designed and validated are usually best suited to use 6, 12 and 24 Mb/s as basic/mandatory data rates. Only usually seek to configure a 12 Mb/s, or 11 Mb/s (802.11b compatible), minimum basic/mandatory rate in high cell density deployments that have been designed and validated for this. For many deployments, the minimum basic/mandatory data rate should not be configured above 12 Mb/s to 18 Mb/s, 24 Mb/s or higher. Such a configuration is only appropriate for use in very high cell density deployment scenarios. A cell_density of Very High (3) should only be used where a deployment has a valid use case and has been designed and validated specifically for this use, nearly always with highly directional antennas - an example would be stadium deployments. For example, with a 24 Mb/s OFDM minimum basic/mandatory data rate, approximately a -73 dBm RSSI is required to decode frames. Many clients will not have roamed elsewhere by the time that they experience -73 dBm and, where they do, they frequently may not hear and be able to demodulate beacon, control or broadcast/multicast data frames causing connectivity issues. There is a myth that disabling lower basic/mandatory data rates will improve roaming and avoid sticky clients. For 802.11n, 802.11ac and 802.11ax clients this is not correct as clients will shift to and use lower MCS rates and not to the 802.11b or 802.11g/802.11a rates that are able to be used as basic/mandatory data rates. There is a myth that disabling lower basic/mandatory data rates will ensure that clients only use higher data rates and that better performance is assured. For 802.11n, 802.11ac and 802.11ax clients this is not correct as clients will shift around and use MCS rates and not the 802.11b or 802.11g/802.11a rates that able to be used as basic/mandatory data rates. Cell Density 0 - Disabled (Default) Setting cell_density to 0 does not configure data rates. This is the default. 1 - Normal Cell Density Setting cell_density to 1 configures the basic/mandatory rates to 6, 12 and 24 Mb/s OFDM rates where legacy_rates is 0. Supported rates lower than the minimum basic/mandatory rate are not offered. Setting cell_density to 1 configures the basic/mandatory rates to the 5.5 and 11 Mb/s DSSS rates where legacy_rates is 1. Supported rates lower than the minimum basic/mandatory rate are not offered. 2 - High Cell Density Setting the cell_density to 2 configures the basic/mandatory rates to the 12 and 24 Mb/s OFDM rates where legacy_rates is 0. Supported rates lower than the minimum basic/mandatory rate are not offered. Setting the cell_density to 2 configures the basic/mandatory rates to the 11 Mb/s DSSS rate where legacy_rates is 1. Supported rates lower than the minimum basic/mandatory rate are not offered. 3 - Very High Cell Density Setting the cell_density to 3 configures the basic/mandatory rates to the 24 Mb/s OFDM rate where legacy_rates is 0. Supported rates lower than the minimum basic/mandatory rate are not offered. Setting the cell_density to 3 only has effect where legacy_rates is 0, else this has the same effect as being configured with a cell_density of 2. Where specified, the basic_rate and supported_rates options continue to override both the cell_density and legacy_rates options. Signed-off-by: Nick Lowe <nick.lowe@gmail.com>
* hostapd: fix "sh: out of range" errorsStijn Tintel2020-11-261-0/+7
| | | | | | | | | | | | | | Several variables in hostapd.sh can be used uninitialized in numerical comparisons, causing errors in logread: netifd: radio24 (1668): sh: out of range Set defaults for those variables to silence those errors. Fixes: b518f07d4b8a ("hostapd: remove ieee80211v option") Fixes: cc80cf53c50d ("hostapd: add FTM responder support") Fixes: e66bd0eb0469 ("hostapd: make rrm report independent of ieee80211k setting") Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* hostapd: enable the epoll-based event loopRui Salvaterra2020-11-237-7/+7
| | | | | | Hostapd supports epoll() since 2014. Let's enable it for better performance. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* hostapd: add support for static airtime policy configurationDobroslaw Kijowski2020-11-171-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add support for passing airtime_sta_weight into hostapd configuration. * Since that commit it is possible to configure station weights. Set higher value for larger airtime share, lower for smaller share. I have tested this functionality by modyfing /etc/config/wireless to: config wifi-device 'radio0' ... option airtime_mode '1' config wifi-iface 'default_radio0' ... list airtime_sta_weight '01:02:03:04:05:06 1024' Now, when the station associates with the access point it has been assigned a higher weight value. root@OpenWrt:~# cat /sys/kernel/debug/ieee80211/phy0/netdev\:wlan0/stations/01\:02\:03\:04\:05\:06/airtime RX: 12656 us TX: 10617 us Weight: 1024 Deficit: VO: -2075 us VI: 256 us BE: -206 us BK: 256 us [MAC address has been changed into a dummy one.] Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>
* hostapd: fix per-BSS airtime configurationDobroslaw Kijowski2020-11-171-0/+2
| | | | | | | | airtime_mode is always parsed as an empty string since it hasn't been added into hostapd_common_add_device_config function. Fixes: e289f183 ("hostapd: add support for per-BSS airtime configuration") Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>
* hostapd: fix variable shadowingDavid Bauer2020-11-171-0/+2
| | | | | | Fixes commit 838b412cb527 ("hostapd: add interworking support") Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: wpas: add missing config symbolsDavid Bauer2020-10-281-2/+2
| | | | | | | | | | | | | | | This adds missing config symbols for interworking as well as Hotspot 2.0 to the wpa_supplicant-full configuration. These symbols were added to the hostapd-full configuration prior to this commit. Without adding them to the wpa_supplicant configuration, building of wpad-full fails. Thanks to Rene for reaching out on IRC. Fixes: commit be9694aaa297 ("hostapd: add UCI support for Hotspot 2.0") Fixes: commit 838b412cb527 ("hostapd: add interworking support") Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add interworking supportDavid Bauer2020-10-282-1/+79
| | | | | | | | | | | | | | | | | | | | | | | | This adds configuration options to enable interworking for hostapd. All options require iw_enabled to be set to 1 for a given VAP. All IEEE802.11u related settings are supported with exception of the venue information which will be added as separate UCI sections at a later point. The options use the same name as the ones from the hostapd.conf file with a "iw_" prefix added. All UCI configuration options are passed without further modifications to hostapd with exceptions of the following options, whose elements can be provided using UCI lis elements: - iw_roaming_consortium - iw_anqp_elem - iw_nai_realm - iw_domain_name - iw_anqp_3gpp_cell_net Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add FTM responder supportDavid Bauer2020-10-281-0/+13
| | | | | | | | | | | | | | | This adds support for enabling the FTM responder flag for the APs extended capabilities. On supported hardware, enabling the ftm_responder config key for a given AP will enable the FTM responder bit. FTM support itself is unconditionally implemented in the devices firmware (ath10k 2nd generation with 3.2.1.1 firmware). There's currently no softmac implementation. Also allow to configure LCI and civic location information which can be transmitted to a FTM initiator. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: remove ieee80211v optionDavid Bauer2020-10-281-14/+6
| | | | | | | | | | | | | Remove the ieee80211v option. It previously was required to be enabled in order to use time_advertisement, time_zone, wnm_sleep_mode and bss_transition, however it didn't enable any of these options by default. Remove it, as configuring these options independently is enough. This change does not influence the behavior of any already configured setting. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: make rrm report independent of ieee80211k settingDavid Bauer2020-10-281-5/+4
| | | | | | | | Allow to configure both RRM beacon as well as neighbor reports independently and only enable them by default in case the ieee80211k config option is set. Signed-off-by: David Bauer <mail@david-bauer.net>
* mac80211: add support for specifying a per-device scan listFelix Fietkau2020-09-291-0/+1
| | | | | | | This is useful to bring up multiple client mode interfaces on a single channel much faster without having to scan through a lot of channels Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add support for per-BSS airtime configurationDavid Bauer2020-09-112-3/+13
| | | | | | | | | | | | Add support for per-BSS airtime weight configuration. This allows to set a airtime weight per BSS as well as a ratio limit based on the weight. Support for this feature is only enabled in the full flavors of hostapd. Consult the hostapd.conf documentation (Airtime policy configuration) for more information on the inner workings of the exposed settings. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add UCI support for Hotspot 2.0Daniel Golle2020-09-081-2/+102
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: recognize option "key" as alias for "auth_secret"Jo-Philipp Wich2020-08-071-1/+1
| | | | | | | | | | | | | | The hostapd configuration logic is supposed to accept "option key" as legacy alias for "option auth_secret". This particular fallback option failed to work though because "key" was not a registered configuration variable. Fix this issue by registering the "key" option as well, similar to the existing "server" nad "port" options. Ref: https://github.com/openwrt/openwrt/pull/3282 Suggested-by: Michael Jones <mike@meshplusplus.com> Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: make "key" option optional if "wpa_psk_file" is providedJo-Philipp Wich2020-08-071-5/+5
| | | | | | | | | | | | | If an existing "wpa_psk_file" is passed to hostapd, the "key" option may be omitted. While we're at it, also improve the passphrase length checking to ensure that it is either exactly 64 bytes or 8 to 63 bytes. Fixes: FS#2689 Ref: https://github.com/openwrt/openwrt/pull/3283 Suggested-by: Michael Jones <mike@meshplusplus.com> Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: fix incorrect service nameDavid Bauer2020-07-311-1/+1
| | | | | | | | | | | | | | When retrieving the PID for hostapd and wpa_supplicant via ubus the wrong service name is currently used. This leads to the following error in the log: netifd: radio0 (1409): WARNING (wireless_add_process): executable path /usr/sbin/wpad does not match process path (/proc/exe) Fixing the service name retrieves the correct PID and therefore the warning won't occur. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: hostapd_set_psk_file: fix defaut value for macJohann Neuhauser2020-06-131-1/+1
| | | | | | | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Bringing up of station vlan fails if the optional mac entry isn't set. The default mac "00:00:00:00:00:00", which should match all stations, is mistakenly set to the non used variable "isolate". This results in a wrong formatted .psk file which has to be "vlan_id mac key". fixes: 5aa2ddd0: hostapd: add support for wifi-station and wifi-vlan sections Signed-off-by: Johann Neuhauser <johann@it-neuhauser.de>
* hostapd: silence rmStijn Tintel2020-06-081-2/+2
| | | | | | | | | | | | When bringing up wifi the first time after boot, these warnings appear: netifd: radio0 (1370): rm: can't remove '/var/run/hostapd-wlan0.psk': No such file or directory netifd: radio0 (1370): rm: can't remove '/var/run/hostapd-wlan0.vlan': No such file or directory Silence them by adding the "-f" option to rm. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: John Crispin <john@phrozen.org>
* hostapd: add support for wifi-station and wifi-vlan sectionsJohn Crispin2020-06-041-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for 2 new uci sections. config wifi-vlan # iface is optional. if it is not defined the vlan will apply # to all interfaces option iface default_radio0 option name guest option vid 100 option network guest config wifi-station # iface is optional. if it is not defined the station will apply # to all interfaces option iface default_radio0 # mac is optional. if it is not defined it will be a catch all # for any sta using this key option mac '00:11:22:33:44:55' # vid is optional. if it is not defined, the sta will be part of # the primary iface. option vid 100 option key testtest With this patch applied it is possible to use multiple PSKs on a single BSS. Signed-off-by: John Crispin <john@phrozen.org>
* hostapd: Add disable_vht when using NOHT/HT* modesEnrique Rodríguez Valencia2020-05-281-1/+2
| | | | | | disable_vht parameter needs to be set when using wpa_supplicant NOHT/HT* modes. Signed-off-by: Enrique Rodríguez Valencia <enrique.rodriguez@galgus.net>
* hostapd: reduce to a single instance per serviceDaniel Golle2020-04-143-49/+28
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* wpa_supplicant: disable CONFIG_WRITE functionalityKirill Lukonin2020-04-132-2/+2
| | | | | | | | | CONFIG_WRITE functionality is not used and could be removed. Looks helpful for devices with small flash because wpad is also affected. Little testing shows that about 6 KB could be saved. Signed-off-by: Kirill Lukonin <klukonin@gmail.com>
* hostapd: Add 802.11r support for WPA3-EnterpriseJesus Fernandez Manzano2020-03-301-0/+1
| | | | Signed-off-by: Jesus Fernandez Manzano <jesus.manzano@galgus.net>
* hostapd: start hostapd/wpa_supplicant for all wiphy devicesPiotr Dymacz2020-02-241-1/+1
| | | | | | | | | | | | | | c888e17e06 ("hostapd: manage instances via procd instead of pidfile") added procd support for managing hostapd and wpa_supplicant daemons but at the same time limited wiphy names to 'phy*'. This brings back initial behaviour (introduced in 60fb4c92b6 ("hostapd: add ubus reload") and makes procd manage daemons for any wiphy device found in '/sys/class/ieee80211'. CC: Felix Fietkau <nbd@nbd.name> CC: Daniel Golle <daniel@makrotopia.org> Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* hostapd: remove some bashismsSven Roederer2020-01-261-3/+3
| | | | | | | | | "[[" is a bash extension for test. As the ash-implementation is not fully compatible we drop its usage. Signed-off-by: Sven Roederer <devel-sven@geroedel.de> [remove shebang, slightly facelift commit title/message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* hostapd: add support for system cert bundle validationDavid Lam2020-01-161-5/+14
| | | | | | | | | | | | | | Currently, it is very cumbersome for a user to connect to a WPA-Enterprise based network securely because the RADIUS server's CA certificate must first be extracted from the EAPOL handshake using tcpdump or other methods before it can be pinned using the ca_cert(2) fields. To make this process easier and more secure (combined with changes in openwrt/openwrt#2654), this commit adds support for validating against the built-in CA bundle when the ca-bundle package is installed. Related LuCI changes in openwrt/luci#3513. Signed-off-by: David Lam <david@thedavid.net> [bump PKG_RELEASE] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: cleanup IBSS-RSNDaniel Golle2020-01-161-5/+1
| | | | | | set noscan also for IBSS and remove redundant/obsolete variable. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: add wpa_strict_rekey supportKyle Copperfield2020-01-151-1/+3
| | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Rekey GTK on STA disassociate Signed-off-by: Kyle Copperfield <kmcopper@danwin1210.me>
* hostapd: add dtim_period, local_pwr_constraint, spectrum_mgmt_requiredKyle Copperfield2020-01-151-2/+11
| | | | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Allows dtim_period to be configurable, the default is from hostapd. Adds additional regulatory tunables for power constraint and spectrum managment. Signed-off-by: Kyle Copperfield <kmcopper@danwin1210.me>
* hostapd: add support for subject validationDavid Lam2020-01-141-0/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The wpa_supplicant supports certificate subject validation via the subject match(2) and altsubject_match(2) fields. domain_match(2) and domain_suffix_match(2) fields are also supported for advanced matches. This validation is especially important when connecting to access points that use PAP as the Phase 2 authentication type. Without proper validation, the user's password can be transmitted to a rogue access point in plaintext without the user's knowledge. Most organizations already require these attributes to be included to ensure that the connection from the STA and the AP is secure. Includes LuCI changes via openwrt/luci#3444. From the documentation: subject_match - Constraint for server certificate subject. This substring is matched against the subject of the authentication server certificate. If this string is set, the server sertificate is only accepted if it contains this string in the subject. The subject string is in following format: /C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as .example.com subject_match2 - Constraint for server certificate subject. This field is like subject_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. altsubject_match - Constraint for server certificate alt. subject. Semicolon separated string of entries to be matched against the alternative subject name of the authentication server certificate. If this string is set, the server sertificate is only accepted if it contains one of the entries in an alternative subject name extension. altSubjectName string is in following format: TYPE:VALUE Example: EMAIL:server@example.com Example: DNS:server.example.com;DNS:server2.example.com Following types are supported: EMAIL, DNS, URI altsubject_match2 - Constraint for server certificate alt. subject. This field is like altsubject_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. domain_match - Constraint for server domain name. If set, this FQDN is used as a full match requirement for the server certificate in SubjectAltName dNSName element(s). If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using same full match comparison. This behavior is similar to domain_suffix_match, but has the requirement of a full match, i.e., no subdomains or wildcard matches are allowed. Case-insensitive comparison is used, so "Example.com" matches "example.com", but would not match "test.Example.com". More than one match string can be provided by using semicolons to separate the strings (e.g., example.org;example.com). When multiple strings are specified, a match with any one of the values is considered a sufficient match for the certificate, i.e., the conditions are ORed together. domain_match2 - Constraint for server domain name. This field is like domain_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. domain_suffix_match - Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for the AAA server certificate in SubjectAltName dNSName element(s). If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison. Suffix match here means that the host/domain name is compared one label at a time starting from the top-level domain and all the labels in domain_suffix_match shall be included in the certificate. The certificate may include additional sub-level labels in addition to the required labels. More than one match string can be provided by using semicolons to separate the strings (e.g., example.org;example.com). When multiple strings are specified, a match with any one of the values is considered a sufficient match for the certificate, i.e., the conditions are ORed together. For example, domain_suffix_match=example.com would match test.example.com but would not match test-example.com. This field is like domain_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. domain_suffix_match2 - Constraint for server domain name. This field is like domain_suffix_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. Signed-off-by: David Lam <david@thedavid.net>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-04 04:43:43 +0000