| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
Signed-off-by: David Bauer <mail@david-bauer.net>
|
|
|
|
|
|
|
| |
Notify external ubus subscribers of received link-measurement reports.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit f6445cfa1acb32676723c49da3e3158b64a4b3d2)
|
|
|
|
|
|
|
|
|
|
|
| |
Add a ubus method to request link-measurements from connected STAs.
In addition to the STAs address, the used and maximum transmit power can
be provided by the external process for the link-measurement. If they
are not provided, 0 is used as the default value.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 965aa33a18c76bb2d5a1eeb0cfa01501b08e784a)
|
|
|
|
|
|
|
|
| |
Allow external processes to enable advertisement of link-measurement RRM
capability.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 2ca5c3da04c3f05a7477ae484768e03d4ca30711)
|
|
|
|
|
|
|
|
|
|
|
| |
Add the STAs extended capabilities to the ubus STA information. This
way, external daemons can be made aware of a STAs capabilities.
This field is of an array type and contains 0 or more bytes of a STAs
advertised extended capabilities.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 6f787239771044ed7eeaf22301c543b699f25cb4)
|
|
|
|
|
|
|
| |
Include the current operation class to hostapd get_status interface.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 2a31e9ca975d99b6216b2979a825f07253c8947e)
|
|
|
|
|
|
|
|
|
|
|
| |
Add the beacon interval to hostapd status output. This allows external
services to discover the beacon interval for a specific VAP.
This way, external wireless management daemons can correctly calculate
fields containing TBTT value from absolute time-values.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 3ba98468424db1f081818982dfa2a07ab85ae136)
|
|
|
|
|
| |
Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de>
(cherry picked from commit cde154c8712255d13658317b116d4fc341ed89f2)
|
|
|
|
|
|
|
|
|
|
| |
Imports a function from iw to convert frequencies to channel numbers.
Co-authored-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de>
[fix potential out of bounds read]
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 398df6275674b637bc950e4f946f84c2bc5e09ff)
|
|
|
|
|
|
|
|
|
|
| |
To allow steering daemons to be aware of the STA-decided transition
target, publish WNM transition responses to ubus. This way, steerings
daemons can learn about STA-chosen targets and send a better selection
of transition candidates.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit a3de42e72ce349c14263737c5d6ec7b00397cf14)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The existing wnm_disassoc_imminent ubus method only supports issuing a
bss transition request with the disassoc imminent flag set.
For use-cases, where the client is requested to roam to another BSS
without a pending disassoc, this existing method is not suitable.
Add a new bss_transition_request ubus method, which provides a more
universal way to dispatch a transition request. It takes the following
arguments:
Required:
addr: String - MAC-address of the STA to send the request to (colon-seperated)
Optional:
abridged - Bool - Indicates if the abridged flag is set
disassociation_imminent: Bool - Whether or not the disassoc_imminent
flag is set
disassociation_timer: I32 - number of TBTTs after which the client will
be disassociated
validity_period: I32 - number of TBTTs after which the beacon
candidate list (if included) will be invalid
neighbors: blob-array - Array of strings containing neighbor reports as
hex-string
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 0eed96ca5d86bdc4158c8ef6814893bc2a3dc467)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The offending commit caused the configuration file to contain:
radius_auth_req_attr=
radius_acct_req_attr=
which cause hostapd to add an ATTR of type 0 into the messages.
hostapd: RADIUS message: code=4 (Accounting-Request) identifier=0 length=93
hostapd: Attribute 40 (Acct-Status-Type) length=6
hostapd: Value: 7
hostapd: Attribute 30 (Called-Station-Id) length=28
hostapd: Value: 'C4-41-1E-F5-2D-55:OpenWifi'
hostapd: Attribute 61 (NAS-Port-Type) length=6
hostapd: Value: 19
hostapd: Attribute 0 (?Unknown?) length=3 <----------------
hostapd: Attribute 55 (Event-Timestamp) length=6
hostapd: Value: 1622726457
hostapd: Attribute 41 (Acct-Delay-Time) length=6
hostapd: Value: 0
hostapd: Attribute 44 (Acct-Session-Id) length=18
hostapd: Value: '9B5961E7235AAEC6'
Closes: #9315
Fixes: ce7a17041486 ("hostapd: add additional radius options")
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [pkg version bump]
(cherry picked from commit 96e9c81aabe9e14d6ec75c3f238c4ca7389b92a8)
|
|
|
|
|
|
|
|
|
| |
This fixes some recent security problems in hostapd.
See here for details: https://w1.fi/security/2022-1
* CVE-2022-23303
* CVE-2022-23304
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
|
|
|
|
|
|
|
| |
Fixes issues with brcmfmac
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 5e67cd63c4ff5d8f36c341dfa3355e3a4ac2be81)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
blocked state
If authentication fails repeatedly e.g. because of a weak signal, the link
can end up in blocked state. If one of the nodes tries to establish a link
again before it is unblocked on the other side, it will block the link to
that other side. The same happens on the other side when it unblocks the
link. In that scenario, the link never recovers on its own.
To fix this, allow restarting authentication even if the link is in blocked
state, but don't initiate the attempt until the blocked period is over.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit f84053af5c0b0a159ea4d3e90b0c06574b4fde8d)
|
|
|
|
| |
Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
|
|
|
|
|
|
|
|
|
| |
When a ubus event handler denies a association with a non-zero return
value, the code jumps to preceeding code, creating an endless loop until
the event handler accepts the assc request.
Move the ubus handler further up the code to avoid creating such a loop.
Signed-off-by: David Bauer <mail@david-bauer.net>
|
|
|
|
|
| |
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit c26d741d07632451337810aaecd500a0b3cbf44f)
|
|
|
|
|
|
|
| |
They can be added as hex digit strings via the 'vendor_elements' option
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 1818b038d7275273adbd525b5ee76bc60b7d628c)
|
|
|
|
|
|
|
|
| |
This makes it possible to avoid using a RADIUS server for WPA enterprise authentication
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from 98621c97822eb20a80ab2248a253972051ea6f08)
|
|
|
|
|
|
|
|
| |
This allows WPA enterprise roaming in the same mobility domain without any
manual key configuration (aside from radius credentials)
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 704ab6a002172e76d41612f6d07ff179ef035d10)
|
|
|
|
|
| |
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 46509a51dd63aa49648ad0f130461817f43532d0)
|
|
|
|
|
| |
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 26da5c235983d215a42983467149e0e5597e8de2)
|
|
|
|
|
|
|
|
| |
Using a pointer one lifter after it freed is not the best idea.
Let's not do that.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry-picked from commit 63c01ad025981eaa841353dc0fc27e5017febe21)
|
|
|
|
|
|
|
|
|
|
|
| |
This implements the mapping recommendations from RFC8325, with an
update from RFC8622. This ensures that DSCP marked packets are properly
sorted into WMM classes.
The map can be disabled by setting iw_qos_map_set to something invalid
like 'none'
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit a5e3def1822431ef6436cb493df77006dbacafd6)
|
|
|
|
|
|
|
| |
This feature is useful on its own even without full interworking support
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit efff3520f4d8fe131c4bd54bb2e098139a7efa4d)
|
|
|
|
| |
Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
|
|
|
|
|
|
|
|
|
|
|
| |
Both hostapd and netifd attempt to add a VLAN device to a bridge.
Depending on which one wins the race, bridge vlan settings might be incomplete,
or hostapd might run into an error and refuse to service the client.
Fix this by preventing hostapd from adding interfaces to the bridge and
instead rely entirely on netifd handling this properly
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit da4be02fcd5d642954b1c9d9855d9e8d1e6205f4)
(cherry-picked from commit 63c01ad025981eaa841353dc0fc27e5017febe21)
|
|
|
|
|
| |
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 2319cf4ec048e50a7d3885d19dc27663b45e258d)
|
|
|
|
|
|
|
| |
Avoids race conditions on bridge member add/remove
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 17d19a7d4398789ae8da3daf8e0db167d58b0782)
|
|
|
|
|
|
|
|
|
| |
When using htmode 'HE20' with a radio mode that uses wpa-supplicant
(like mesh or sta), it will default to 40 MHz bw if disable_ht40 is not
set. This commit fixes this behaviour.
Signed-off-by: Jesus Fernandez Manzano <jesus.manzano@galgus.net>
(cherry-picked from commit af83e3ce0ff40dcecbe913676343bf86846294f7)
|
|
|
|
|
|
|
| |
Remove a dependency on libnl3-route
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit ae1c5d0d6af60d0467899f5730a2f01aa72137f7)
|
|
|
|
|
| |
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 5dd1bd5b80feb2dbaad8bdf93779acad74ed199a)
|
|
|
|
|
|
|
|
|
| |
Use the VLAN interface instead of the bridge, to ensure that hostapd receives
untagged DHCP packets
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 7b46377a0cd9d809a3c340358121de77f005d4cc)
(cherry-picked from commit f1b98fa4fa8a86a9daf2a7177235f28cbd7c53ef)
|
|
|
|
|
|
|
|
| |
In setups using VLAN bridge filtering, hostapd may need to communicate using
a VLAN interface on top of the bridge, instead of using the bridge directly
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 305c1b8d746b363f655c2f8d5a6497cca10a5d4e)
|
|
|
|
|
|
|
|
|
|
| |
- add functionality to configure RADIUS NAS-Id and Operator-Name
- add functionality to configure RADIUS accounting interval
- enable RADIUS "Chargeable User Identity"
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 3bd6c8c728e72444bdf23b8904ef9c52ebb46bb7)
|
|
|
|
|
|
| |
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit c76f1d8330c679774eb568a423feb57d956b3ca4)
|
|
|
|
|
| |
Signed-off-by: John Crispin <john@phrozen.org>
(cherry-picked from commit 937dd79e2a4457a316d67b3091f6da7d14a99168)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Airtime policy configuration is extremely useful in multiple BSS scenarios.
Since nowadays most people configure both private and guest networks (at
least), it makes sense to enable it by default, except for the most limited
of the variants.
Size of the hostapd-basic-openssl binary (mipsel 24Kc -O2):
543944 bytes (airtime policy disabled)
548040 bytes (airtime policy enabled)
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
Acked-by: Daniel Golle <daniel@makrotopia.org>
(cherry-picked from commit d38f4565828264731f2a9cfe646491fba80315d3)
|
|
|
|
|
|
|
|
| |
netifd is responsible for handling that, except if the vlan bridge
was provided by the config
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit cf45caeff16256f9db777e0e652ec3a38cd476a4)
|
|
|
|
|
|
|
|
|
|
|
|
| |
In hostapd_ubus_add_bss(), ubus objects are not registered for mesh
interfaces. This provokes a segfault when accessing the ubus object in
mesh deinit.
This commit adds the same condition to hostapd_ubus_free_bss() for
discarding those mesh interfaces.
Signed-off-by: Jesus Fernandez Manzano <jesus.manzano@galgus.net>
(cherry picked from commit 5269c47e8db549695ceaf6a19afdd0cb90074622)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In the aftermath of the KRACK attacks, hostapd gained an AP-side workaround
against WNM-Sleep Mode GTK/IGTK reinstallation attacks. WNM Sleep Mode is not
enabled by default on OpenWrt, but it is configurable through the option
wnm_sleep_mode. Thus, make the AP-side workaround configurable as well by
exposing the option wnm_sleep_mode_no_keys. If you use the option
wpa_disable_eapol_key_retries and have wnm_sleep_mode enabled, you might
consider using this workaround.
Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
[bump PKG_RELEASE]
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit bf98faaac8ed24cf7d3d93dd4fcd7304d109363b)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The country3 option in hostapd.conf allows the third octet of the country
string to be set. It can be used e.g. to indicate indoor or outdoor use (see
hostapd.conf for further details). Make this option configurable but optional
in OpenWrt.
Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
[bump PKG_RELEASE, rebase]
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 9f09c1936a4a13b67fcba632f7ca02331f685359)
Signed-off-by: Paul Spooren <mail@aparcar.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Commit 0a7657c ("hostapd: add channel utilization as config option") added the
two new uci options bss_load_update_period and chan_util_avg_period. However,
the corresponding "config_add_int" calls for these options weren't added, so
attempting to actually use these options and change their values is bound to
fail - they always stay at their defaults. Add the missing code to actually
make these options work.
Fixes: 0a7657c ("hostapd: add channel utilization as config option")
Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
(cherry picked from commit 85ce590705072be78c3ef7dc6b64e3b1facc892b)
|
|
|
|
|
|
|
|
|
|
|
| |
Since upstream commit 6467de5a8840 ("Randomize z ordinates in
scalar mult when timing resistant") WolfSSL requires a RNG for
the EC key when built hardened which is the default.
Set the RNG for the EC key to fix connections for OWE clients.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit ddcb970274c011d3db611ec39350ee4704ff0e02)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
p2p_add_device() may remove the oldest entry if there is no room in the
peer table for a new peer. This would result in any pointer to that
removed entry becoming stale. A corner case with an invalid PD Request
frame could result in such a case ending up using (read+write) freed
memory. This could only by triggered when the peer table has reached its
maximum size and the PD Request frame is received from the P2P Device
Address of the oldest remaining entry and the frame has incorrect P2P
Device Address in the payload.
Fix this by fetching the dev pointer again after having called
p2p_add_device() so that the stale pointer cannot be used.
This fixes the following security vulnerabilities/bugs:
- CVE-2021-27803 - A vulnerability was discovered in how p2p/p2p_pd.c
in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision
discovery requests. It could result in denial of service or other
impact (potentially execution of arbitrary code), for an attacker
within radio range.
Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
(cherry picked from commit 1ca5de13a153061feae260864d73d96f7c463785)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This is a backport of the upstream commit 58bbbb598144 ("nl80211: Ignore
4addr mode enabling error if it was already enabled") which fixes same
issue as in the current fix contained in '130-wpa_supplicant-multi_ap_roam.patch',
but in a different way:
nl80211_set_4addr_mode() could fail when trying to enable 4addr mode on
an interface that is in a bridge and has 4addr mode already enabled.
This operation would not have been necessary in the first place and this
failure results in disconnecting, e.g., when roaming from one backhaul
BSS to another BSS with Multi AP.
Avoid this issue by ignoring the nl80211 command failure in the case
where 4addr mode is being enabled while it has already been enabled.
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
[bump PKG_RELEASE, more verbose commit description]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit fb860b4e418c28a0f388f215e5acce103dcee1bf)
|
|
|
|
|
|
|
|
|
| |
This patch is required to be able to roam from one backhaul AP to
another one in the same ESS.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(daniel@makrotopia.org: PKG_REVISION bump and refreshed patches)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
|
|
|
|
|
|
|
|
|
|
| |
This patch fixes a bug that prevents updating Multi-AP credentials
after hostapd has started.
It was sent to upstream hostapd here:
https://patchwork.ozlabs.org/bundle/rmelotte/hostapd:%20update%20WPS%20credentials%20on%20SIGHUP/
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch allows other applications to get events management
frames (for example: association requests).
This is useful in Multi-AP context to be able to save association
requests from stations.
It has been sent to upstream hostapd in this series:
https://patchwork.ozlabs.org/project/hostap/list/?series=217500
'700-wifi-reload.patch' is updated due to the introduction of
'110-notify-mgmt-frames.patch'.
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
|