aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services/hostapd/files
Commit message (Collapse)AuthorAgeFilesLines
* hostapd: pass respawn settings when registering the serviceJohn Crispin2020-12-221-2/+2
| | | | | | | | When hostapd gets restarted to often/quickly will cause procd to not restart it anymore. it will think that hapd is in a crash loop. Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> [adjust respawn time]
* hostapd: Use EAPOLv1 (802.1X-2001) if WPA enabledNick Lowe2020-12-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, EAPOLv2 (802.1X-2004) is used by default for legacy clients that are not WPA2 (RSN) capable. These legacy clients are often intolerant to this EAPOL version and fail to connect. hostapd.conf upstream documents for eapol_version the following and that this is a known compatibility issue with version 2: // IEEE 802.1X/EAPOL version // hostapd is implemented based on IEEE Std 802.1X-2004 which defines EAPOL // version 2. However, there are many client implementations that do not handle // the new version number correctly (they seem to drop the frames completely). // In order to make hostapd interoperate with these clients, the version number // can be set to the older version (1) with this configuration value. // Note: When using MACsec, eapol_version shall be set to 3, which is // defined in IEEE Std 802.1X-2010. //eapol_version=2 For the wpa parameter, hostapd.conf upstream documents that this is a bitfield, configured as follows: // Enable WPA. Setting this variable configures the AP to require WPA (either // WPA-PSK or WPA-RADIUS/EAP based on other configuration). For WPA-PSK, either // wpa_psk or wpa_passphrase must be set and wpa_key_mgmt must include WPA-PSK. // Instead of wpa_psk / wpa_passphrase, wpa_psk_radius might suffice. // For WPA-RADIUS/EAP, ieee8021x must be set (but without dynamic WEP keys), // RADIUS authentication server must be configured, and WPA-EAP must be included // in wpa_key_mgmt. // This field is a bit field that can be used to enable WPA (IEEE 802.11i/D3.0) // and/or WPA2 (full IEEE 802.11i/RSN): // bit0 = WPA // bit1 = IEEE 802.11i/RSN (WPA2) (dot11RSNAEnabled) // Note that WPA3 is also configured with bit1 since it uses RSN just like WPA2. // In other words, for WPA3, wpa=2 is used the configuration (and // wpa_key_mgmt=SAE for WPA3-Personal instead of wpa_key_mgmt=WPA-PSK). //wpa=2 For client compatibility therefore: EAPOLv1 (802.1X-2001) should be used by default where WPA is enabled. EAPOLv2 (802.1X-2004) should be used by default where WPA is disabled. To fix this, we can therefore change in the script: set_default eapol_version 0 To the following: set_default eapol_version $((wpa & 1)) This therefore: 1) Sets eapol_version to 1 where WPA has been enabled via wpa bit0 being set. 2) Sets eapol_version to 0 where WPA has been disabled via wpa bit0 being unset. For usual configurations that only have WPA2 enabled, EAPOLv2 is then used. Signed-off-by: Nick Lowe <nick.lowe@gmail.com>
* hostapd: parse skip_inactivity_poll optionNadim Atiya2020-12-221-2/+4
| | | | | | | | | | | | hostapd.sh does not parse skip_inactivity_poll boolean from /etc/config/wireless despite being mentioned in the documentation [1]. This change fixes this, and by default sets its value to 0 [1]. [1] https://openwrt.org/docs/guide-user/network/wifi/basic Signed-off-by: Nadim Atiya <nadim.atiya@gmail.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org> [fix and reformat commit message, make patch apply]
* hostapd: Disable 802.11b data rates by defaultNick Lowe2020-12-061-1/+1
| | | | | | | | | | | | | | | | | Set legacy_rates to 0 by default to disable 802.11b data rates by default. The time has long come where 802.11b DSSS/CCK data rates should be disabled by default in OpenWRT. Users in need of 802.11b client support can reasonably enable these where they are needed. The balance of equities has significantly, and for a long time, tipped such that dropping backwards compatibility by default with 802.11b devices is appropriate, proportionate and justified. By doing so, management and control traffic is moved by default to a 20 MHz wide 6 Mb/s OFDM data rate instead of a 22 MHz wide 1 Mb/s DSSS data rate. This is significantly more airtime efficient. Signed-off-by: Nick Lowe <nick.lowe@gmail.com>
* hostapd: Add cell_density data rates optionNick Lowe2020-11-301-13/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a cell_density option to configure data rates for normal, high and very high cell density wireless deployments. The purpose of using a minimum basic/mandatory data rate that is higher than 6 Mb/s, or 5.5 Mb/s (802.11b compatible), in high cell density environments is to transmit broadcast/multicast data frames using less airtime or to reduce management overheads where significant co-channel interference (CCI) exists and cannot be avoided. Caution: Without careful design and validation, configuration of a too high minimum basic/mandatory data rate can sacrifice connection stability or disrupt the ability to reliably connect and authenticate for little to no capacity benefit. This is because this configuration affects the ability of clients to hear and demodulate management, control and broadcast/multicast data frames. Deployments that have not been specifically designed and validated are usually best suited to use 6, 12 and 24 Mb/s as basic/mandatory data rates. Only usually seek to configure a 12 Mb/s, or 11 Mb/s (802.11b compatible), minimum basic/mandatory rate in high cell density deployments that have been designed and validated for this. For many deployments, the minimum basic/mandatory data rate should not be configured above 12 Mb/s to 18 Mb/s, 24 Mb/s or higher. Such a configuration is only appropriate for use in very high cell density deployment scenarios. A cell_density of Very High (3) should only be used where a deployment has a valid use case and has been designed and validated specifically for this use, nearly always with highly directional antennas - an example would be stadium deployments. For example, with a 24 Mb/s OFDM minimum basic/mandatory data rate, approximately a -73 dBm RSSI is required to decode frames. Many clients will not have roamed elsewhere by the time that they experience -73 dBm and, where they do, they frequently may not hear and be able to demodulate beacon, control or broadcast/multicast data frames causing connectivity issues. There is a myth that disabling lower basic/mandatory data rates will improve roaming and avoid sticky clients. For 802.11n, 802.11ac and 802.11ax clients this is not correct as clients will shift to and use lower MCS rates and not to the 802.11b or 802.11g/802.11a rates that are able to be used as basic/mandatory data rates. There is a myth that disabling lower basic/mandatory data rates will ensure that clients only use higher data rates and that better performance is assured. For 802.11n, 802.11ac and 802.11ax clients this is not correct as clients will shift around and use MCS rates and not the 802.11b or 802.11g/802.11a rates that able to be used as basic/mandatory data rates. Cell Density 0 - Disabled (Default) Setting cell_density to 0 does not configure data rates. This is the default. 1 - Normal Cell Density Setting cell_density to 1 configures the basic/mandatory rates to 6, 12 and 24 Mb/s OFDM rates where legacy_rates is 0. Supported rates lower than the minimum basic/mandatory rate are not offered. Setting cell_density to 1 configures the basic/mandatory rates to the 5.5 and 11 Mb/s DSSS rates where legacy_rates is 1. Supported rates lower than the minimum basic/mandatory rate are not offered. 2 - High Cell Density Setting the cell_density to 2 configures the basic/mandatory rates to the 12 and 24 Mb/s OFDM rates where legacy_rates is 0. Supported rates lower than the minimum basic/mandatory rate are not offered. Setting the cell_density to 2 configures the basic/mandatory rates to the 11 Mb/s DSSS rate where legacy_rates is 1. Supported rates lower than the minimum basic/mandatory rate are not offered. 3 - Very High Cell Density Setting the cell_density to 3 configures the basic/mandatory rates to the 24 Mb/s OFDM rate where legacy_rates is 0. Supported rates lower than the minimum basic/mandatory rate are not offered. Setting the cell_density to 3 only has effect where legacy_rates is 0, else this has the same effect as being configured with a cell_density of 2. Where specified, the basic_rate and supported_rates options continue to override both the cell_density and legacy_rates options. Signed-off-by: Nick Lowe <nick.lowe@gmail.com>
* hostapd: fix "sh: out of range" errorsStijn Tintel2020-11-261-0/+7
| | | | | | | | | | | | | | Several variables in hostapd.sh can be used uninitialized in numerical comparisons, causing errors in logread: netifd: radio24 (1668): sh: out of range Set defaults for those variables to silence those errors. Fixes: b518f07d4b8a ("hostapd: remove ieee80211v option") Fixes: cc80cf53c50d ("hostapd: add FTM responder support") Fixes: e66bd0eb0469 ("hostapd: make rrm report independent of ieee80211k setting") Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* hostapd: enable the epoll-based event loopRui Salvaterra2020-11-237-7/+7
| | | | | | Hostapd supports epoll() since 2014. Let's enable it for better performance. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* hostapd: add support for static airtime policy configurationDobroslaw Kijowski2020-11-171-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add support for passing airtime_sta_weight into hostapd configuration. * Since that commit it is possible to configure station weights. Set higher value for larger airtime share, lower for smaller share. I have tested this functionality by modyfing /etc/config/wireless to: config wifi-device 'radio0' ... option airtime_mode '1' config wifi-iface 'default_radio0' ... list airtime_sta_weight '01:02:03:04:05:06 1024' Now, when the station associates with the access point it has been assigned a higher weight value. root@OpenWrt:~# cat /sys/kernel/debug/ieee80211/phy0/netdev\:wlan0/stations/01\:02\:03\:04\:05\:06/airtime RX: 12656 us TX: 10617 us Weight: 1024 Deficit: VO: -2075 us VI: 256 us BE: -206 us BK: 256 us [MAC address has been changed into a dummy one.] Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>
* hostapd: fix per-BSS airtime configurationDobroslaw Kijowski2020-11-171-0/+2
| | | | | | | | airtime_mode is always parsed as an empty string since it hasn't been added into hostapd_common_add_device_config function. Fixes: e289f183 ("hostapd: add support for per-BSS airtime configuration") Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>
* hostapd: fix variable shadowingDavid Bauer2020-11-171-0/+2
| | | | | | Fixes commit 838b412cb527 ("hostapd: add interworking support") Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: wpas: add missing config symbolsDavid Bauer2020-10-281-2/+2
| | | | | | | | | | | | | | | This adds missing config symbols for interworking as well as Hotspot 2.0 to the wpa_supplicant-full configuration. These symbols were added to the hostapd-full configuration prior to this commit. Without adding them to the wpa_supplicant configuration, building of wpad-full fails. Thanks to Rene for reaching out on IRC. Fixes: commit be9694aaa297 ("hostapd: add UCI support for Hotspot 2.0") Fixes: commit 838b412cb527 ("hostapd: add interworking support") Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add interworking supportDavid Bauer2020-10-282-1/+79
| | | | | | | | | | | | | | | | | | | | | | | | This adds configuration options to enable interworking for hostapd. All options require iw_enabled to be set to 1 for a given VAP. All IEEE802.11u related settings are supported with exception of the venue information which will be added as separate UCI sections at a later point. The options use the same name as the ones from the hostapd.conf file with a "iw_" prefix added. All UCI configuration options are passed without further modifications to hostapd with exceptions of the following options, whose elements can be provided using UCI lis elements: - iw_roaming_consortium - iw_anqp_elem - iw_nai_realm - iw_domain_name - iw_anqp_3gpp_cell_net Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add FTM responder supportDavid Bauer2020-10-281-0/+13
| | | | | | | | | | | | | | | This adds support for enabling the FTM responder flag for the APs extended capabilities. On supported hardware, enabling the ftm_responder config key for a given AP will enable the FTM responder bit. FTM support itself is unconditionally implemented in the devices firmware (ath10k 2nd generation with 3.2.1.1 firmware). There's currently no softmac implementation. Also allow to configure LCI and civic location information which can be transmitted to a FTM initiator. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: remove ieee80211v optionDavid Bauer2020-10-281-14/+6
| | | | | | | | | | | | | Remove the ieee80211v option. It previously was required to be enabled in order to use time_advertisement, time_zone, wnm_sleep_mode and bss_transition, however it didn't enable any of these options by default. Remove it, as configuring these options independently is enough. This change does not influence the behavior of any already configured setting. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: make rrm report independent of ieee80211k settingDavid Bauer2020-10-281-5/+4
| | | | | | | | Allow to configure both RRM beacon as well as neighbor reports independently and only enable them by default in case the ieee80211k config option is set. Signed-off-by: David Bauer <mail@david-bauer.net>
* mac80211: add support for specifying a per-device scan listFelix Fietkau2020-09-291-0/+1
| | | | | | | This is useful to bring up multiple client mode interfaces on a single channel much faster without having to scan through a lot of channels Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add support for per-BSS airtime configurationDavid Bauer2020-09-112-3/+13
| | | | | | | | | | | | Add support for per-BSS airtime weight configuration. This allows to set a airtime weight per BSS as well as a ratio limit based on the weight. Support for this feature is only enabled in the full flavors of hostapd. Consult the hostapd.conf documentation (Airtime policy configuration) for more information on the inner workings of the exposed settings. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add UCI support for Hotspot 2.0Daniel Golle2020-09-081-2/+102
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: recognize option "key" as alias for "auth_secret"Jo-Philipp Wich2020-08-071-1/+1
| | | | | | | | | | | | | | The hostapd configuration logic is supposed to accept "option key" as legacy alias for "option auth_secret". This particular fallback option failed to work though because "key" was not a registered configuration variable. Fix this issue by registering the "key" option as well, similar to the existing "server" nad "port" options. Ref: https://github.com/openwrt/openwrt/pull/3282 Suggested-by: Michael Jones <mike@meshplusplus.com> Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: make "key" option optional if "wpa_psk_file" is providedJo-Philipp Wich2020-08-071-5/+5
| | | | | | | | | | | | | If an existing "wpa_psk_file" is passed to hostapd, the "key" option may be omitted. While we're at it, also improve the passphrase length checking to ensure that it is either exactly 64 bytes or 8 to 63 bytes. Fixes: FS#2689 Ref: https://github.com/openwrt/openwrt/pull/3283 Suggested-by: Michael Jones <mike@meshplusplus.com> Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: fix incorrect service nameDavid Bauer2020-07-311-1/+1
| | | | | | | | | | | | | | When retrieving the PID for hostapd and wpa_supplicant via ubus the wrong service name is currently used. This leads to the following error in the log: netifd: radio0 (1409): WARNING (wireless_add_process): executable path /usr/sbin/wpad does not match process path (/proc/exe) Fixing the service name retrieves the correct PID and therefore the warning won't occur. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: hostapd_set_psk_file: fix defaut value for macJohann Neuhauser2020-06-131-1/+1
| | | | | | | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Bringing up of station vlan fails if the optional mac entry isn't set. The default mac "00:00:00:00:00:00", which should match all stations, is mistakenly set to the non used variable "isolate". This results in a wrong formatted .psk file which has to be "vlan_id mac key". fixes: 5aa2ddd0: hostapd: add support for wifi-station and wifi-vlan sections Signed-off-by: Johann Neuhauser <johann@it-neuhauser.de>
* hostapd: silence rmStijn Tintel2020-06-081-2/+2
| | | | | | | | | | | | When bringing up wifi the first time after boot, these warnings appear: netifd: radio0 (1370): rm: can't remove '/var/run/hostapd-wlan0.psk': No such file or directory netifd: radio0 (1370): rm: can't remove '/var/run/hostapd-wlan0.vlan': No such file or directory Silence them by adding the "-f" option to rm. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: John Crispin <john@phrozen.org>
* hostapd: add support for wifi-station and wifi-vlan sectionsJohn Crispin2020-06-041-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for 2 new uci sections. config wifi-vlan # iface is optional. if it is not defined the vlan will apply # to all interfaces option iface default_radio0 option name guest option vid 100 option network guest config wifi-station # iface is optional. if it is not defined the station will apply # to all interfaces option iface default_radio0 # mac is optional. if it is not defined it will be a catch all # for any sta using this key option mac '00:11:22:33:44:55' # vid is optional. if it is not defined, the sta will be part of # the primary iface. option vid 100 option key testtest With this patch applied it is possible to use multiple PSKs on a single BSS. Signed-off-by: John Crispin <john@phrozen.org>
* hostapd: Add disable_vht when using NOHT/HT* modesEnrique Rodríguez Valencia2020-05-281-1/+2
| | | | | | disable_vht parameter needs to be set when using wpa_supplicant NOHT/HT* modes. Signed-off-by: Enrique Rodríguez Valencia <enrique.rodriguez@galgus.net>
* hostapd: reduce to a single instance per serviceDaniel Golle2020-04-143-49/+28
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* wpa_supplicant: disable CONFIG_WRITE functionalityKirill Lukonin2020-04-132-2/+2
| | | | | | | | | CONFIG_WRITE functionality is not used and could be removed. Looks helpful for devices with small flash because wpad is also affected. Little testing shows that about 6 KB could be saved. Signed-off-by: Kirill Lukonin <klukonin@gmail.com>
* hostapd: Add 802.11r support for WPA3-EnterpriseJesus Fernandez Manzano2020-03-301-0/+1
| | | | Signed-off-by: Jesus Fernandez Manzano <jesus.manzano@galgus.net>
* hostapd: start hostapd/wpa_supplicant for all wiphy devicesPiotr Dymacz2020-02-241-1/+1
| | | | | | | | | | | | | | c888e17e06 ("hostapd: manage instances via procd instead of pidfile") added procd support for managing hostapd and wpa_supplicant daemons but at the same time limited wiphy names to 'phy*'. This brings back initial behaviour (introduced in 60fb4c92b6 ("hostapd: add ubus reload") and makes procd manage daemons for any wiphy device found in '/sys/class/ieee80211'. CC: Felix Fietkau <nbd@nbd.name> CC: Daniel Golle <daniel@makrotopia.org> Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* hostapd: remove some bashismsSven Roederer2020-01-261-3/+3
| | | | | | | | | "[[" is a bash extension for test. As the ash-implementation is not fully compatible we drop its usage. Signed-off-by: Sven Roederer <devel-sven@geroedel.de> [remove shebang, slightly facelift commit title/message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* hostapd: add support for system cert bundle validationDavid Lam2020-01-161-5/+14
| | | | | | | | | | | | | | Currently, it is very cumbersome for a user to connect to a WPA-Enterprise based network securely because the RADIUS server's CA certificate must first be extracted from the EAPOL handshake using tcpdump or other methods before it can be pinned using the ca_cert(2) fields. To make this process easier and more secure (combined with changes in openwrt/openwrt#2654), this commit adds support for validating against the built-in CA bundle when the ca-bundle package is installed. Related LuCI changes in openwrt/luci#3513. Signed-off-by: David Lam <david@thedavid.net> [bump PKG_RELEASE] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: cleanup IBSS-RSNDaniel Golle2020-01-161-5/+1
| | | | | | set noscan also for IBSS and remove redundant/obsolete variable. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: add wpa_strict_rekey supportKyle Copperfield2020-01-151-1/+3
| | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Rekey GTK on STA disassociate Signed-off-by: Kyle Copperfield <kmcopper@danwin1210.me>
* hostapd: add dtim_period, local_pwr_constraint, spectrum_mgmt_requiredKyle Copperfield2020-01-151-2/+11
| | | | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Allows dtim_period to be configurable, the default is from hostapd. Adds additional regulatory tunables for power constraint and spectrum managment. Signed-off-by: Kyle Copperfield <kmcopper@danwin1210.me>
* hostapd: add support for subject validationDavid Lam2020-01-141-0/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The wpa_supplicant supports certificate subject validation via the subject match(2) and altsubject_match(2) fields. domain_match(2) and domain_suffix_match(2) fields are also supported for advanced matches. This validation is especially important when connecting to access points that use PAP as the Phase 2 authentication type. Without proper validation, the user's password can be transmitted to a rogue access point in plaintext without the user's knowledge. Most organizations already require these attributes to be included to ensure that the connection from the STA and the AP is secure. Includes LuCI changes via openwrt/luci#3444. From the documentation: subject_match - Constraint for server certificate subject. This substring is matched against the subject of the authentication server certificate. If this string is set, the server sertificate is only accepted if it contains this string in the subject. The subject string is in following format: /C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as .example.com subject_match2 - Constraint for server certificate subject. This field is like subject_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. altsubject_match - Constraint for server certificate alt. subject. Semicolon separated string of entries to be matched against the alternative subject name of the authentication server certificate. If this string is set, the server sertificate is only accepted if it contains one of the entries in an alternative subject name extension. altSubjectName string is in following format: TYPE:VALUE Example: EMAIL:server@example.com Example: DNS:server.example.com;DNS:server2.example.com Following types are supported: EMAIL, DNS, URI altsubject_match2 - Constraint for server certificate alt. subject. This field is like altsubject_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. domain_match - Constraint for server domain name. If set, this FQDN is used as a full match requirement for the server certificate in SubjectAltName dNSName element(s). If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using same full match comparison. This behavior is similar to domain_suffix_match, but has the requirement of a full match, i.e., no subdomains or wildcard matches are allowed. Case-insensitive comparison is used, so "Example.com" matches "example.com", but would not match "test.Example.com". More than one match string can be provided by using semicolons to separate the strings (e.g., example.org;example.com). When multiple strings are specified, a match with any one of the values is considered a sufficient match for the certificate, i.e., the conditions are ORed together. domain_match2 - Constraint for server domain name. This field is like domain_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. domain_suffix_match - Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for the AAA server certificate in SubjectAltName dNSName element(s). If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison. Suffix match here means that the host/domain name is compared one label at a time starting from the top-level domain and all the labels in domain_suffix_match shall be included in the certificate. The certificate may include additional sub-level labels in addition to the required labels. More than one match string can be provided by using semicolons to separate the strings (e.g., example.org;example.com). When multiple strings are specified, a match with any one of the values is considered a sufficient match for the certificate, i.e., the conditions are ORed together. For example, domain_suffix_match=example.com would match test.example.com but would not match test-example.com. This field is like domain_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. domain_suffix_match2 - Constraint for server domain name. This field is like domain_suffix_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. Signed-off-by: David Lam <david@thedavid.net>
* hostapd: disable ft_psk_generate_local for non-PSK networksDavid Bauer2020-01-091-1/+9
| | | | | | | | | | | | Without this commit, ft_psk_generate_local is enabled for non-PSK networks by default. This breaks 802.11r for EAP networks. Disable ft_psk_generate_local by default for non-PSK networks resolves this misbehavior. Reported-by: Martin Weinelt <martin@darmstadt.freifunk.net> Signed-off-by: David Bauer <mail@david-bauer.net> Tested-by: Martin Weinelt <martin@darmstadt.freifunk.net>
* hostapd: re-introduce process trackingDaniel Golle2019-12-081-0/+4
| | | | | | | | | | | Before commit 60fb4c92b6 ("hostapd: add ubus reload") netifd was tracking hostapd/wpa_supplicant and restarting wifi in case of a process crash. Restore this behaviour by tracking the PIDs of hostapd and wpa_supplicant. Also make sure hostapd and/or wpa_supplicant have been started before emmitting ubus calls to them using ubus wait_for. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: manage instances via procd instead of pidfileFelix Fietkau2019-12-081-9/+41
| | | | | | | | Allows graceful restart of crashing hostapd/wpa_supplicant instances Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Daniel Golle <daniel@makrotopia.org> [daniel@makrotopia.org: attempt to launch only present services]
* hostapd: enable CTRL_IFACE_MIB for hostapd-fullDavid Bauer2019-12-087-0/+35
| | | | | | | | This enables the CTRL_IFACE_MIB symbol for wpad-full and hostapd-full. If it is not enabled, statistic outputs such as "hostapd_cli all_sta" are empty. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add ubus reloadJohn Crispin2019-11-122-12/+27
| | | | | | | | | | | | | | | Add ubus interface to hostapd and wpa_supplicant to allow dynamically reloading wiface configuration without having to restart the hostapd process. As a consequence, both hostapd and wpa_supplicant are now started persistently on boot for each wifi device in the system and then receive ubus calls adding, modifying or removing interface configuration. At a later stage it would be desirable to reduce the services to one single instance managing all radios. Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: enable PMKSA and OK caching for WPA3-PersonalDavid Bauer2019-11-041-1/+8
| | | | | | | | | | | | | This enables PMKSA and opportunistic key caching by default for WPA2/WPA3-Personal, WPA3-Personal and OWE auth types. Otherwise, Apple devices won't connect to the WPA3 network. This should not degrade security, as there's no external authentication provider. Tested with OCEDO Koala and iPhone 7 (iOS 13.1). Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add IEEE 802.11k supportKyle Copperfield2019-11-021-0/+13
| | | | | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Enables radio resource management to be reported by hostapd to clients. Ref: https://github.com/lede-project/source/pull/1430 Co-developed-by: Lorenzo Santina <lorenzo.santina@edu.unito.it> Signed-off-by: Lorenzo Santina <lorenzo.santina@edu.unito.it> Signed-off-by: Kyle Copperfield <kmcopper@danwin1210.me>
* hostapd: use getrandom syscallHauke Mehrtens2019-09-227-7/+7
| | | | | | | | hostapd will not use the getrandom() syscall and as a fallback use /dev/random, the syscall is supported since Linux 3.17 and in the musl, glibc and uclibc version used by OpenWrt. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* hostapd: use config option CONFIG_NO_LINUX_PACKET_SOCKET_WARHauke Mehrtens2019-09-224-4/+4
| | | | | | Instead of patching the workaround away, just use the config option. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* hostapd: Update to version 2.9 (2019-08-08)Hauke Mehrtens2019-09-227-9/+91
| | | | | | | | | | | | | | | | | | The size of the ipkgs increase a bit (between 0.7% and 1.1%): old 2019-04-21 (2.8): 288264 wpad-basic_2019-04-21-63962824-1_mipsel_24kc.ipk 256188 wpad-mini_2019-04-21-63962824-1_mipsel_24kc.ipk 427475 wpad-openssl_2019-04-21-63962824-1_mipsel_24kc.ipk 423071 wpad-wolfssl_2019-04-21-63962824-1_mipsel_24kc.ipk new 2019-08-08 (2.9): 290217 wpad-basic_2019-08-08-ca8c2bd2-1_mipsel_24kc.ipk 258745 wpad-mini_2019-08-08-ca8c2bd2-1_mipsel_24kc.ipk 431732 wpad-openssl_2019-08-08-ca8c2bd2-1_mipsel_24kc.ipk 427641 wpad-wolfssl_2019-08-08-ca8c2bd2-1_mipsel_24kc.ipk Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* hostapd: Update to version 2.8 (2019-04-21)Hauke Mehrtens2019-09-227-63/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This also syncs the configuration files with the default configuration files, but no extra options are activated or deactivated. The mesh patches were partially merged into hostapd 2.8, the remaining patches were extracted from patchwork and are now applied by OpenWrt. The patches still have open questions which are not fixed by the author. They were taken from this page: https://patchwork.ozlabs.org/project/hostap/list/?series=62725&state=* The changes in 007-mesh-apply-channel-attributes-before-running-Mesh.patch where first applied to hostapd, but later reverted in hostapd commit 3e949655ccc5 because they caused memory leaks. The size of the ipkgs increase a bit (between 1.3% and 2.3%): old 2018-12-02 (2.7): 283337 wpad-basic_2018-12-02-c2c6c01b-11_mipsel_24kc.ipk 252857 wpad-mini_2018-12-02-c2c6c01b-11_mipsel_24kc.ipk 417473 wpad-openssl_2018-12-02-c2c6c01b-11_mipsel_24kc.ipk 415105 wpad-wolfssl_2018-12-02-c2c6c01b-11_mipsel_24kc.ipk new 2019-04-21 (2.8): 288264 wpad-basic_2019-04-21-63962824-1_mipsel_24kc.ipk 256188 wpad-mini_2019-04-21-63962824-1_mipsel_24kc.ipk 427475 wpad-openssl_2019-04-21-63962824-1_mipsel_24kc.ipk 423071 wpad-wolfssl_2019-04-21-63962824-1_mipsel_24kc.ipk Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Tested-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
* hostapd: mirror ieee80211w ap mode defaults in station modeJo-Philipp Wich2019-09-201-0/+9
| | | | | | | | | | | For AP mode, OpenWrt automatically sets ieee80211w to either 1 or 2, depending on whether the encryption is set to sae-mixed, or sae/owe/eap suite-b. Mirror the same defaults for client mode connections, in order to allow an OpenWrt station to associate to an OpenWrt ap with SAE, OWE or Suite-B encryption without the need to manually specify "option ieee80211w" on the station. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: fix OWE settings in client modeJo-Philipp Wich2019-09-201-0/+1
| | | | | | | | This changes fixes the generation of the wpa_supplicant client configuration in WPA3 OWE client mode. Instead of incorrectly emitting key_mgmt=NONE, use the proper key_mgmt=OWE setting instead. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: add Multi-AP patches and config optionsArnout Vandecappelle (Essensium/Mind)2019-02-202-6/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick Multi-AP commits from uptream: 9c06f0f6a hostapd: Add Multi-AP protocol support 5abc7823b wpa_supplicant: Add Multi-AP backhaul STA support a1debd338 tests: Refactor test_multi_ap bfcdac1c8 Multi-AP: Don't reject backhaul STA on fronthaul BSS cb3c156e7 tests: Update multi_ap_fronthaul_on_ap to match implementation 56a2d788f WPS: Add multi_ap_subelem to wps_build_wfa_ext() 83ebf5586 wpa_supplicant: Support Multi-AP backhaul STA onboarding with WPS 66819b07b hostapd: Support Multi-AP backhaul STA onboarding with WPS 8682f384c hostapd: Add README-MULTI-AP b1daf498a tests: Multi-AP WPS provisioning Add support for Multi-AP to the UCI configuration. Every wifi-iface gets an option 'multi_ap'. For APs, its value can be 0 (multi-AP support disabled), 1 (backhaul AP), 2 (fronthaul AP), or 3 (fronthaul + backhaul AP). For STAs, it can be 0 (not a backhaul STA) or 1 (backhaul STA, can only associate with backhaul AP). Also add new optional parameter to wps_start ubus call of wpa_supplicant to indicate that a Multi-AP backhaul link is required. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
* hostapd: enable CONFIG_DEBUG_SYSLOG for wpa_supplicantFelix Fietkau2019-02-174-8/+8
| | | | | | | It was already enabled for wpad builds and since commit 6a15077e2d7fa the script relies on it. Size impact is minimal (2 kb on MIPS .ipk). Signed-off-by: Felix Fietkau <nbd@nbd.name>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-04 20:31:43 +0000