ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2024-12-19 21:58:04 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

hostapd: add support for enabling FILS on AP and client interfaces

Browse Source 
This is only supported with WPA-enterprise

Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau 2021-12-07 14:47:40 +01:00
parent 5b66dfaf6c
commit b7d9bced30
1 changed files with 37 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
package/network/services/hostapd/files/hostapd.sh
View File

@ -72,6 +72,15 @@ hostapd_append_wpa_key_mgmt() {
;;
esac
[ "$fils" -gt 0 ] && {
case "$auth_type" in
eap*)
append wpa_key_mgmt FILS-SHA256
[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA256
;;
esac
}
[ "$auth_osen" = "1" ] && append wpa_key_mgmt "OSEN"
}
@ -359,6 +368,8 @@ hostapd_common_add_bss_config() {
config_add_int eap_server
config_add_string eap_user_file ca_cert server_cert private_key private_key_passwd server_id
config_add_boolean fils
}
hostapd_set_vlan_file() {
@ -531,8 +542,9 @@ hostapd_set_bss_options() {
airtime_bss_weight airtime_bss_limit airtime_sta_weight \
multicast_to_unicast proxy_arp per_sta_vif \
eap_server eap_user_file ca_cert server_cert private_key private_key_passwd server_id \
vendor_elements
vendor_elements fils
set_default fils 0
set_default isolate 0
set_default maxassoc 0
set_default max_inactivity 0
@ -554,6 +566,8 @@ hostapd_set_bss_options() {
set_default airtime_bss_limit 0
set_default eap_server 0
/usr/sbin/hostapd -vfils || fils=0
append bss_conf "ctrl_interface=/var/run/hostapd"
if [ "$isolate" -gt 0 ]; then
append bss_conf "ap_isolate=$isolate" "$N"
@ -654,7 +668,9 @@ hostapd_set_bss_options() {
auth_server auth_secret auth_port \
dae_client dae_secret dae_port \
ownip radius_client_addr \
eap_reauth_period request_cui
eap_reauth_period request_cui \
erp_domain mobility_domain \
fils_realm
# radius can provide VLAN ID for clients
vlan_possible=1
@ -664,6 +680,17 @@ hostapd_set_bss_options() {
[ -n "$auth_port" ] || json_get_var auth_port port
[ -n "$auth_secret" ] || json_get_var auth_secret key
[ "$fils" -gt 0 ] && {
set_default erp_domain "$mobility_domain"
set_default erp_domain "$(echo "$ssid" | md5sum | head -c 8)"
set_default fils_realm "$erp_domain"
append bss_conf "erp_send_reauth_start=1" "$N"
append bss_conf "erp_domain=$erp_domain" "$N"
append bss_conf "fils_realm=$fils_realm" "$N"
append bss_conf "fils_cache_id=$(echo "$fils_realm" | md5sum | head -c 4)" "$N"
}
set_default auth_port 1812
set_default dae_port 3799
set_default request_cui 0
@ -853,6 +880,10 @@ hostapd_set_bss_options() {
done
fi
fi
if [ "$fils" -gt 0 ]; then
json_get_vars fils_realm
set_default fils_realm "$(echo "$ssid" | md5sum | head -c 8)"
fi
append bss_conf "wpa_disable_eapol_key_retries=$wpa_disable_eapol_key_retries" "$N"
@ -877,7 +908,7 @@ hostapd_set_bss_options() {
fi
append bss_conf "okc=$auth_cache" "$N"
[ "$auth_cache" = 0 ] && append bss_conf "disable_pmksa_caching=1" "$N"
[ "$auth_cache" = 0 -a "$fils" = 0 ] && append bss_conf "disable_pmksa_caching=1" "$N"
# RSN -> allow management frame protection
case "$ieee80211w" in
@ -1031,6 +1062,7 @@ hostapd_set_bss_options() {
if [ "$eap_server" = "1" ]; then
append bss_conf "eap_server=1" "$N"
append bss_conf "eap_server_erp=1" "$N"
[ -n "$eap_user_file" ] && append bss_conf "eap_user_file=$eap_user_file" "$N"
[ -n "$ca_cert" ] && append bss_conf "ca_cert=$ca_cert" "$N"
[ -n "$server_cert" ] && append bss_conf "server_cert=$server_cert" "$N"
@ -1197,7 +1229,7 @@ wpa_supplicant_add_network() {
json_get_vars \
ssid bssid key \
basic_rate mcast_rate \
ieee80211w ieee80211r \
ieee80211w ieee80211r fils \
multi_ap \
default_disabled
@ -1289,6 +1321,7 @@ wpa_supplicant_add_network() {
json_get_vars eap_type identity anonymous_identity ca_cert ca_cert_usesystem
[ "$fils" -gt 0 ] && append network_data "erp=1" "$N$T"
if [ "$ca_cert_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
append network_data "ca_cert=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
else