aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services/hostapd
Commit message (Collapse)AuthorAgeFilesLines
* hostapd: increase PKG_RELEASE to fix buildsNick Hainke2023-09-291-1/+1
| | | | | | | | Recent hostapd changes just edited the ucode files. It is required to bump the PKG_RELEASE to include the newest changes in the latest builds. Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit 91d2ead3c3bf75b279f861ad5d11b64bf31478f0)
* hostapd: fix wpa_supplicant mac address allocation on ap+staFelix Fietkau2023-09-281-9/+10
| | | | | | | | | | | | If the full interface is restarted while bringing up an AP, it can trigger a wpa_supplicant interface start before wpa_supplicant is notified of the allocated mac addresses. Fix this by moving the iface_update_supplicant_macaddr call to just after the point where mac addresses are allocated. Reported-by: Michael-cy Lee (李峻宇) <Michael-cy.Lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit abceef120d57bf066941882630a76788eb4985a9)
* hostapd: fix mac address of interfaces created via wdev.ucFelix Fietkau2023-09-271-1/+1
| | | | | | | Use the wdev config with the generated MAC address Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 0c43a48735959245f18d79a6e908d3b45cff0a94)
* hostapd: fix rare crash with AP+STA and ACS enabledFelix Fietkau2023-09-271-13/+14
| | | | | | | | Ensure that the iface disable in uc_hostapd_iface_start also clears the ACS state. Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit f1bb528ae7631c60b95499b7e8a1948c3e6a42f0)
* hostapd: fix patch rebase after a crash fixFelix Fietkau2023-09-221-5/+5
| | | | | | | | | The patch refresh accidentally moved the hostapd_ucode_free_iface call to the wrong function Fixes: e9722aef9e84 ("hostapd: fix a crash when disabling an interface during channel list update") Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 3a5ad6e3d74da713c0fc7d63b8026a56d16e198b)
* hostapd: fix wpa_supplicant bringup with non-nl80211 driversFelix Fietkau2023-09-221-0/+17
| | | | | | | Needed for wired 802.1x Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit fd6d7aafb2c3d335a3d192c308ffdace8d292e9f)
* hostapd: add missing NULL pointer check in uc_hostapd_iface_stopFelix Fietkau2023-09-201-0/+3
| | | | | | | Avoid crashing if the interface has already been removed Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 4145ff4d8a29c1c7a1569bb06fa4d1fe9808c94f)
* hostapd: fix a crash when disabling an interface during channel list updateFelix Fietkau2023-09-202-4/+32
| | | | | Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit e9722aef9e84110331706f74f7de0942c8d657ed)
* hostapd: use phy name for hostapd interfaces instead of first-bss ifnameFelix Fietkau2023-09-193-9/+21
| | | | | | | Improves reliability in error handling Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit a511480368a03f754aa6ce7887633247a07ea166)
* hostapd: select libopenssl-legacy for openssl variantsFelix Fietkau2023-09-181-7/+8
| | | | | | | Without it, a lot of authentication modes fail without obvious error messages Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 560965d5826626e3be8c1f1db194db43cc7002cf)
* hostapd: remove eap-eap192 auth type valueFelix Fietkau2023-09-181-12/+4
| | | | | | | It is no longer used Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit b0501d380f65ae9f82173b35b820c9c6adb92493)
* hostapd: support eap-eap2 and eap2 auth_type valuesFelix Fietkau2023-09-181-7/+15
| | | | | | | | WPA3 Enterprise-transitional requires optional MFP support and SHA1+SHA256 WPA3 Enterprise-only requires SHA1 support disabled and mandatory MFP. Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit b63df6ce5d0639e6106967fd445c96518da52afb)
* hostapd: fix FILS key mgmt type for WPA3 Enterprise 192 bitFelix Fietkau2023-09-181-0/+4
| | | | | | | Use the SHA384 variant to account for longer keys with more security Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit f0d1349b52983400e7526f3ab57dc6a0f2cc771a)
* hostapd: backport from master, including ucode based reload supportFelix Fietkau2023-09-1865-1474/+5265
| | | | | | | This significantly improves config reload behavior and also fixes some corner cases related to running AP + mesh interfaces at the same time. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: revert upstream commit to fix #13156Stijn Tintel2023-08-191-0/+63
| | | | | | | | | | | | | Commit e978072baaca ("Do prune_association only after the STA is authorized") causes issues when an STA roams from one interface to another interface on the same PHY. The mt7915 driver is not able to handle this properly. While the commits fixes a DoS, there are other devices and drivers with the same limitation, so revert to the orginal behavior for now, until we have a better solution in place. Fixes: #13156 Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit 324673914d42f5fb9b70cc73e955117828b99f3b)
* hostapd: add fix for dealing with VHT 160 MHz via ext nss bwFelix Fietkau2023-08-1511-15/+156
| | | | | Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit adfeda849198b33ffa7a7ef233ae8a4df22bbc2d)
* hostapd: update to 2023-06-22Andre Heider2023-07-2032-202/+162
| | | | | | | | | | | | | | | Removed, merged upstream: - 170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch Manually refreshed: - 040-mesh-allow-processing-authentication-frames-in-block.patch - 600-ubus_support.patch - 761-shared_das_port.patch Fixes: #12661 Fixes: 304423a4 ("hostapd: update to 2023-03-29") Signed-off-by: Andre Heider <a.heider@gmail.com> (cherry picked from commit cd804c1ebb34c9740f8ad9fe393a81f3efb7b009)
* treewide: replace AUTORELEASE with real PKG_RELEASETianling Shen2023-05-181-1/+1
| | | | | | | | | | | | | | | | | | Based on Paul Fertser <fercerpav@gmail.com>'s guidance: Change AUTORELEASE in rules.mk to: ``` AUTORELEASE = $(if $(DUMP),0,$(shell sed -i "s/\$$(AUTORELEASE)/$(call commitcount,1)/" $(CURDIR)/Makefile)) ``` then update all affected packages by: ``` for i in $(git grep -l PKG_RELEASE:=.*AUTORELEASE | sed 's^.*/\([^/]*\)/Makefile^\1^';); do make package/$i/clean done ``` Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* hostapd: update to 2023-03-29Nick Hainke2023-04-2254-587/+504
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add patches: - 170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch Remove upstreamed: - 170-DPP-fix-memleak-of-intro.peer_key.patch - 461-driver_nl80211-use-new-parameters-during-ibss-join.patch - 800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch - 992-openssl-include-rsa.patch Automatically refreshed: - 011-mesh-use-deterministic-channel-on-channel-switch.patch - 021-fix-sta-add-after-previous-connection.patch - 022-hostapd-fix-use-of-uninitialized-stack-variables.patch - 030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch - 040-mesh-allow-processing-authentication-frames-in-block.patch - 050-build_fix.patch - 110-mbedtls-TLS-crypto-option-initial-port.patch - 120-mbedtls-fips186_2_prf.patch - 140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch - 150-add-NULL-checks-encountered-during-tests-hwsim.patch - 160-dpp_pkex-EC-point-mul-w-value-prime.patch - 200-multicall.patch - 300-noscan.patch - 310-rescan_immediately.patch - 330-nl80211_fix_set_freq.patch - 341-mesh-ctrl-iface-channel-switch.patch - 360-ctrl_iface_reload.patch - 381-hostapd_cli_UNKNOWN-COMMAND.patch - 390-wpa_ie_cap_workaround.patch - 410-limit_debug_messages.patch - 420-indicate-features.patch - 430-hostapd_cli_ifdef.patch - 450-scan_wait.patch - 460-wpa_supplicant-add-new-config-params-to-be-used-with.patch - 463-add-mcast_rate-to-11s.patch - 465-hostapd-config-support-random-BSS-color.patch - 500-lto-jobserver-support.patch - 590-rrm-wnm-statistics.patch - 710-vlan_no_bridge.patch - 720-iface_max_num_sta.patch - 730-ft_iface.patch - 750-qos_map_set_without_interworking.patch - 751-qos_map_ignore_when_unsupported.patch - 760-dynamic_own_ip.patch - 761-shared_das_port.patch - 990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch Manually refresh: - 010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch - 301-mesh-noscan.patch - 340-reload_freq_change.patch - 350-nl80211_del_beacon_bss.patch - 370-ap_sta_support.patch - 380-disable_ctrl_iface_mib.patch - 464-fix-mesh-obss-check.patch - 470-survey_data_fallback.patch - 600-ubus_support.patch - 700-wifi-reload.patch - 711-wds_bridge_force.patch - 740-snoop_iface.patch Tested-by: Packet Please <pktpls@systemli.org> [Fritzbox 4040 (ipq40xx), EAP225-Outdoor (ath79); 802.11s, WPA3 OWE, and WPA3 PSK] Tested-by: Andrew Sim <andrewsimz@gmail.com> [mediatek/filogic] Signed-off-by: Nick Hainke <vincent@systemli.org>
* treewide: add support for "lto" in PKG_BUILD_FLAGSAndre Heider2023-03-211-3/+2
| | | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-lto". Some packages used LTO, but not the linker plugin. This unifies 'em all to attempt to produce better code. Quoting man gcc(1): "This improves the quality of optimization by exposing more code to the link-time optimizer." Also use -flto=auto instead of -flto=jobserver, as it's not guaranteed that every buildsystem uses +$(MAKE) correctly. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: add support for "gc-sections" in PKG_BUILD_FLAGSAndre Heider2023-03-211-2/+4
| | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-gc-sections". Note: libnl, mbedtls and opkg only used the CFLAGS part without the LDFLAGS counterpart. That doesn't help at all if the goal is to produce smaller binaries. I consider that an accident, and this fixes it. Note: there are also packages using only the LDFLAGS part. I didn't touch those, as gc might have been disabled via CFLAGS intentionally. Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: enable radius server supportFelix Fietkau2023-03-071-1/+1
| | | | | | This is useful in combination with the built-in eap server support Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add missing return code for the bss_mgmt_enable ubus methodFelix Fietkau2023-03-071-0/+2
| | | | | | Fixes bogus errors on ubus calls Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add support for defining multiple acct/auth serversFelix Fietkau2023-03-071-25/+25
| | | | | | | This allows adding backup servers, in case the primary ones fail. Assume that port and shared secret are going to be the same. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: always use sae_password for mesh/SAE authLeon M. Busch-George2023-02-191-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a corner case when using passwords that are exactly 64 characters in length with mesh mode or passwords longer than 63 characters with SAE because 'psk' is used instead of 'sae_password'. SAE is obligatory for 802.11s (mesh point). The 'psk' option for hostapd is suited for WPA2 and enforces length restrictions on passwords. Values of 64 characters are treated as PMKs. With SAE, PMKs are always generated during the handshake and there are no length restrictions. The 'sae_password' option is more suited for SAE and should be used instead. Before this patch, the 'sae_password' option is only used with mesh mode passwords that are not 64 characters long. As a consequence: - mesh passwords can't be 64 characters in length - SAE only works with passwords with lengths >8 and <=63 (due to psk limitation). Fix this by always using 'sae_password' with SAE/mesh and applying the PMK differentiation only when PSK is used. Fixes: #11324 Signed-off-by: Leon M. Busch-George <leon@georgemail.eu> [ improve commit description ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* hostapd: add quotes in assignmentsLeon M. Busch-George2023-02-191-6/+6
| | | | | | It's generally advised to use quotes for variable assignments in bash. Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
* treewide: Trigger reinstall of all wolfssl dependenciesHauke Mehrtens2023-01-011-1/+1
| | | | | | | | The ABI of the wolfssl library changed a bit between version 5.5.3 and 5.5.4. This release update will trigger a rebuild of all packages which are using wolfssl to make sure they are adapted to the new ABI. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* tree-wide: Do not use package librt and libpthreadHauke Mehrtens2022-12-291-5/+0
| | | | | | | | | | | The libraries libpthread, libdl, libutil, libanl have been integrated into the libc library in version 2.34. it is not needed to explicitly link them any more. Most of the functions have been moved from the librt.so into libc.so some time ago already. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* hostapd: allow sharing the incoming DAS port across multiple interfacesFelix Fietkau2022-12-271-0/+298
| | | | | | Use the NAS identifier to find the right receiver context on incoming messages Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add mbedtls variantRosen Penev2022-12-1911-12/+10188
| | | | | | | This adds the current WIP mbedtls patches for hostapd. The motivation here is to reduce size. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* hostapd: enable coredumpsFelix Fietkau2022-12-161-0/+2
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: always set a default for the nas identifierFelix Fietkau2022-12-161-2/+3
| | | | | | | It is used for both 802.11r and WPA enterprise. Setting it when not needed is harmless Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add support for automatically setting RADIUS own-ip dynamicallyFelix Fietkau2022-12-162-2/+118
| | | | | | Some servers use the NAS-IP-Address attribute as a destination address Signed-off-by: Felix Fietkau <nbd@nbd.name>
* treewide: remove DRIVER_11N_SUPPORTAndre Heider2022-12-133-15/+0
| | | | | | | | | | | | hostapd's compile time option CONFIG_IEEE80211N was removed almost 3 years ago, 80.211n/HT is always included since then. Noticed because `hostapd -v11n` confusingly returned an error. See hostapd's commit: f3bcd69603 "Remove CONFIG_IEEE80211N build option" Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: fix 350-nl80211_del_beacon_bss.patchAndre Heider2022-12-131-1/+1
| | | | | | | | | | | | | | | | | Pass the expected struct: ../src/drivers/driver_nl80211.c: In function 'wpa_driver_nl80211_del_beacon': ../src/drivers/driver_nl80211.c:2945:31: warning: passing argument 1 of 'nl80211_bss_msg' from incompatible pointer type [-Wincompatible-pointer-types] 2945 | msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON); | ^~~ | | | struct wpa_driver_nl80211_data * ../src/drivers/driver_nl80211.c:695:50: note: expected 'struct i802_bss *' but argument is of type 'struct wpa_driver_nl80211_data *' 695 | struct nl_msg * nl80211_bss_msg(struct i802_bss *bss, int flags, uint8_t cmd) | ~~~~~~~~~~~~~~~~~^~~ Fixes: 35ff1affe8 "hostapd: update to 2022-05-08" Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: remove an unused function from ubus.cAndre Heider2022-12-131-26/+0
| | | | | | | eee80211_frequency_to_channel() isn't used anymore, which is a leftover from: 2a31e9ca97 "hostapd: add op-class to get_status output" Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: use wpa_supplicant for unencrypted mesh connectionsFelix Fietkau2022-12-102-2/+6
| | | | | | It's more reliable than using iw Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: remove invalid dtim_period option processingFelix Fietkau2022-11-101-2/+1
| | | | | | | | dtim_period is a bss property, not a device one. It is already handled properly in mac80211.sh Fixes: 30c64825c7ed ("hostapd: add dtim_period, local_pwr_constraint, spectrum_mgmt_required") Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add measurement report value for beacon reportsNick Hainke2022-10-131-0/+1
| | | | | | | | | | | | | | | | | Add the measurement report value to the beacon reports send via ubus. It is possible to derive from the measurement report if a station refused to do a beacon report and why. It is important to know why a station refuses to do a beacon-report. In particular, we should not request a beacon report from a station again that refused a beacon-report before. The rejection reasons can be found by looking at the bits defined by: - MEASUREMENT_REPORT_MODE_ACCEPT - MEASUREMENT_REPORT_MODE_REJECT_LATE - MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE - MEASUREMENT_REPORT_MODE_REJECT_REFUSED Suggested-by: Ian Clowes <clowes_ian@hotmail.com> Signed-off-by: Nick Hainke <vincent@systemli.org>
* treewide: fix security issues by bumping all packages using libwolfsslPetr Štetiar2022-10-031-1/+1
| | | | | | | | | | | | | | | | | As wolfSSL is having hard time maintaining ABI compatibility between releases, we need to manually force rebuild of packages depending on libwolfssl and thus force their upgrade. Otherwise due to the ABI handling we would endup with possibly two libwolfssl libraries in the system, including the patched libwolfssl-5.5.1, but still have vulnerable services running using the vulnerable libwolfssl-5.4.0. So in order to propagate update of libwolfssl to latest stable release done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely exploitable vulnerabilities, we need to bump PKG_RELEASE of all packages using wolfSSL library. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* hostapd: add ubus notification on sta authorizedFelix Fietkau2022-09-223-2/+79
| | | | | | | Also include the station auth_type in the ubus and log message in order to detect, if clients used FT or FILS to associate Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: disable wireless extensions only when neededFelix Fietkau2022-09-221-0/+1
| | | | | | They are only needed by a few very old drivers Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: update to 2022-07-29David Bauer2022-09-2042-266/+242
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b704dc72e tests: sigma_dut and updated ConfResult value for Configurator failures 89de431f2 DPP: Add config response status value to DPP-CONF-SENT 10104915a tests: sigma_dut and DPP PB session overlap 80d5e264c Enhance QCA vendor roam event to indicate MLO links after reassociation 662249306 Update copyright notices for the QCA vendor definitions 8adcdd659 tests: Temporary workaround for dpp_chirp_ap_5g ddcd15c2d tests: Fix fuzzing/sae build 7fa67861a tests: Fix p2p_channel_avoid3 ee3567d65 tests: Add more time for scan/connection 1d08b238c nl80211: Allow more time for the initial scan with 6 GHz ac9e6a2ab tests: Allow 6 GHz opclasses in MBO checks faf9c04cb Remove a host of unnecessary OPENSSL_IS_BORINGSSL ifdefs b9cd5a82f Always process pending QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_ROAM_AUTH data ef4cd8e33 QoS: Use common classifier_mask for ipv4/ipv6 93be02592 Add fixed FDD mode to qca_btc_chain_mode QCA vendor attribute e7cbfa1c1 tests: sigma_dut and DPP Enrollee unsupported curves 5565fbee2 DPP: Check Enrollee supported curves when building Config Response ceae05cec tests: sigma_dut and DPP MUDURL setting for hostapd 4cfb484e9 DPP: Allow dpp_controller_start without arguments in CLIs c97000933 Fix ifdef condition for imsi_privacy_cert 2a9a61d6c tests: SAE with extended key AKM e35f6ed1d tests: More detailed report on SAE PMKSA caching error case f70db167a SAE: Derive a variable length PMK with the new AKM suites 91010e6f6 SAE: Indicate AKM suite selector in commit for new AKM suites e81ec0962 SAE: Use H2E unconditionally with the new AKM suites f8eed2e8b SAE: Store PMK length and AKM in SAE data 9dc4e9d13 SAE: EAPOL-Key and key/MIC length information for the new AKM suites a32ef3cfb SAE: Driver capability flags for the new SAE AKM suites 91df8c9c6 SAE: Internal WPA_KEY_MGMT_* defines for extended key AKMs 5c8a714b1 SAE: Use wpa_key_mgmt_sae() helper 5456b0f26 Define new RSN AKM suite selector values def33101c DPP: Clear push button announcement state on wpa_supplicant FLUSH 35587fa8f tests: DPP Controller/Relay with need to discover Controller d22dfe918 DPP: Event message for indicating when Relay would need a Controller ca7892e98 tests: DPP Relay and adding/removing connection to a Controller bfe3cfc38 DPP: Allow Relay connections to Controllers to be added and removed 808834b18 Add a comparison function for hostapd_ip_addr f7763880b DPP: Advertise Configurator connectivity on Relay automatically ff7cc1d49 tests: DPP Relay and dynamic Controller addition ca682f80a DPP: Dynamic Controller initiated connection on Relay d2388bcca DPP: Strict validation of PKEX peer bootstrapping key during auth a7b8cef8b DPP3: Fix push button boostrapping key passing through PKEX 69d7c8e6b DPP: Add peer=id entry for PKEX-over-TCP case b607d2723 tests: sigma_dut and DPP PB Configurator in wpa_supplicant 1ff9251a8 DPP3: Push button Configurator in wpa_supplicant b94e46bc7 tests: PB Configurator in wpa_supplicant ca4e82cbf tests: sigma_dut DPP/PKEX initiator as Configurator over TCP and Wi-Fi e9137950f DPP: Recognize own PKEX Exchange Request if it ends up being received 692956446 DPP: Note PKEX code/identifier deletion in debug log dfa9183b1 tests: DPP reconfig after Controller-initiated operation through Relay ae4a3a6f6 DPP: Add DPP-CONF-REQ-RX event for Controller 17216b524 tests: sigma_dut DPP/PKEX initiator as Configurator (TCP) through Relay fb2937b85 DPP: Allow Controller to initiate PKEX through Relay 15af83cf1 DPP: Delete PKEX code and identifier on success completion of PKEX d86ed5b72 tests: Allow DPP_PKEX_REMOVE success in dpp_pkex_hostapd_errors 0a4f391b1 tests: sigma_dut and DPP Connector Privacy 479e412a6 DPP3: Default value for dpp_connector_privacy 7d12871ba test: DPP Private Peer Introduction protocol 148de3e0d DPP3: Private Peer Introduction protocol 786ea402b HPKE base mode with single-shot API f0273bc81 OpenSSL: Remove a forgotten debug print f2bb0839f test: DPP 3rd party config information 68209ddbe DPP: Allow 3rd party information to be added into config object 0e2217c95 DPP: Allow 3rd party information to be added into config request obj 3d82fbe05 Add QCA vendor subcommand and attributes for SCS rule configuration 16b62ddfa QCA vendor attribute for DBAM configuration 004b1ff47 tests: DPP Controller initiating through Relay 451ede2c3 DPP: Allow AP/Relay to be configured to listed for new TCP connections 248654d36 tests: sigma_dut DPP PB test cases 697b7d7ec tests: DPP push button 7bbe85987 DPP3: Allow external configuration to be specified on AP for PB 8db786a43 DPP3: Testing functionality for push button announcements 37bccfcab DPP3: Push button bootstrap mechanism a0054fe7c Add AP and STA specific P802.11az security capabilities (vendor command) 159e63613 QCA vendor command for CoAP offload processing 3b7bb17f6 Add QCA vendor attribute for TIM beacon statistics 09a281e52 Add QCA vendor interface for PASN offload to userspace 809fb96fa Add a vendor attribute to configure concurrency policy for AP interface a5754f531 Rename QCA_NL80211_VENDOR_SUBCMD_CONCURRENT_MULTI_STA_POLICY 085a3fc76 EHT: Add 320 channel width support bafe35df0 Move CHANWIDTH_* definitions from ieee80211_defs.h to defs.h 92f549901 tests: Remove the 80+80 vs. 160 part from wpa2_ocv_ap_vht160_mismatch c580c2aec tests: Make OCV negative test error cases more robust 3c2ba98ad Add QCA vendor event to indicate driver recovery after internal failures 6b461f68c Set current_ssid before changing state to ASSOCIATING 8dd826741 QCA vendor attribute to configure direct data path for audio traffic 504be2f9d QCA vendor command support to get WLAN radio combinations d5905dbc8 OCV: Check the Frequency Segment 1 Channel Number only on 80+80 MHz Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: don't select indoor channel on outdoor operationDavid Bauer2022-09-181-0/+58
| | | | | | | Don't select channels designated for exclusive-indoor use when the country3 element is set on outdoor operation. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: rename hostapd multicast_to_unicast option to multicast_to_unicast_allFelix Fietkau2022-09-061-5/+5
| | | | | | | | | | | | | | | | | | | | There are two feature currently altered by the multicast_to_unicast option. 1. bridge level multicast_to_unicast via IGMP snooping 2. hostapd/mac80211 config multicast_to_unicast setting The hostapd/mac80211 setting has the side effect of converting *all* multicast or broadcast traffic into per-station duplicated unicast traffic, which can in some cases break expectations of various protocols. It also has been observed to cause ARP lookup failure between stations connected to the same interface. The bridge level feature is much more useful, since it only covers actual multicast traffic managed by IGMP, and it implicitly defaults to 1 already. Renaming the hostapd/mac80211 option to multicast_to_unicast_all should avoid unintentionally enabling this feature Signed-off-by: Felix Fietkau <nbd@nbd.name>
* mac80211: disable ft-over-ds by defaultFelix Fietkau2022-08-301-1/+1
| | | | | | | | Testing has shown it to be very unreliable in variety of configurations. It is not mandatory, so let's disable it by default until we have a better solution. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: fix WPA3 enterprise keys and ciphersJoerg Werner2022-08-201-3/+10
| | | | | | | | WPA3 enterprise requires group_mgmt_cipher=BIP-GMAC-256 and if 802.11r is active also wpa_key_mgmt FT-EAP-SHA384. This commit also requires corresponding changes in netifd. Signed-off-by: Joerg Werner <schreibubi@gmail.com>
* hostapd: add mbo flag to get_clients ubus methodStijn Tintel2022-08-151-0/+4
| | | | | | | | | There is no WLAN_STA_MBO flag, but according to the hostapd source code, when an STA does not support MBO, cell_capa will be 0. Use this to indicate MBO support in the get_clients ubus method. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Reviewed-by: David Bauer <mail@david-bauer.net>
* hostapd: prevent unused crypto lib dependencies from being compiledBoris Krasnovskiy2022-07-311-16/+16
| | | | | | Prevented unused crypto lib dependencies from being compiled Signed-off-by: Boris Krasnovskiy <borkra@gmail.com>
* hostapd: add ppsk option (private psk)Manuel Giganto2022-07-151-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR allows a user to enable a private psk, where each station may have it's own psk or use a common psk if it is not defined. The private psk is defined using the sta's mac and a radius server is required. ppsk option should be enabled in the wireless configuration along with radius server details. When using PPSK, the key is ignored, it will be retrieved from radius server. SAE is not yet supported (private sae) in hostapd. Wireless example configuration: option encryption 'psk2+ccmp' option ppsk '1' option auth_server '127.0.0.1' option auth_secret 'radiusServerPassword' If you want to use dynamic VLAN on PPSK also include: option dynamic_vlan '2' option vlan_tagged_interface 'eth0' option vlan_bridge 'br-vlan' option vlan_naming '0' It works enabling mac address verification on radius server and requiring the tunnel-password (the private psk) from radius server. In the radius server we need to configure the users. In case of freeradius: /etc/freeradius3/mods-config/files/authorize The user and Cleartext-Password should be the mac lower case using the format "aabbccddeeff" <sta mac> Cleartext-Password := "<sta mac>" Tunnel-Password = <Private Password> Example of a user configured in radius and using dynamic VLAN5: 8cb84a000000 Cleartext-Password := "8cb84a000000" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 5, Tunnel-Password = MyPrivPw If we want to have a default or shared psk, used when the mac is not found in the list, we need to add the following at the end of the radius authorize file: DEFAULT Auth-Type := Accept Tunnel-Password = SharedPw And if using VLANs, for example VLAN6 for default users: DEFAULT Auth-Type := Accept Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 6, Tunnel-Password = SharedPw Signed-off-by: Manuel Giganto <mgigantoregistros@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-05 13:30:32 +0000