Commit Graph

55 Commits (98009790c66ec83cedf21af9fadf63049c5f23fd)

Author SHA1 Message Date
Jo-Philipp Wich 18dd101903 hostapd: properly parse wmm and hidden uci options (#14589)
SVN-Revision: 39005
2013-12-08 20:51:21 +00:00
Felix Fietkau 603c532eed hostapd: fix maclist processing with netifd
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38991
2013-12-03 09:02:58 +00:00
Felix Fietkau 498d84fc4e netifd: add wireless configuration support and port mac80211 to the new framework
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38988
2013-12-02 16:41:03 +00:00
Felix Fietkau a26242cb63 hostapd: change the wildcard for the hostapd control socket directory
prepare for using /var/run/hostapd instead of /var/run/hostapd-phy*

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38986
2013-12-02 13:08:14 +00:00
Felix Fietkau 9381eaccb3 wpa_supplicant: clean up hostapd control socket on exit to fix socket leak in ap+sta mode on wifi restarts
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38985
2013-12-02 13:08:11 +00:00
Felix Fietkau 6960ae4e65 hostapd: fix os_daemonize vs starting process race by creating the pid file in the parent
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38984
2013-12-02 13:08:08 +00:00
Felix Fietkau 5022b3949a hostapd: always include p2p options in wpa_cli
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38981
2013-12-02 13:07:46 +00:00
Felix Fietkau 15b4975925 hostapd: add support for auto-channel selection
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38915
2013-11-25 15:43:30 +00:00
Felix Fietkau 1d75f7506d hostapd: update to version 2013-11-20
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38914
2013-11-25 15:43:15 +00:00
Felix Fietkau cd1c8d463f hostapd: remove random pool support - the entropy it gathers is questionable and we have better entropy sources on common platforms now
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38852
2013-11-18 13:54:26 +00:00
Felix Fietkau 37756a97a0 hostapd: remove #ifdef MULTICALL around ap+sta support code (to support separately installed supplicant+hostapd)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38782
2013-11-12 22:11:14 +00:00
Jo-Philipp Wich 4f1e282238 wpa_supplicant: fix beacon_int configuration option
wpa_supplicant expects beacon_int instead of beacon_interval in its config
file.

Signed-off-by: Bruno Randolf <br1@einfach.org>

SVN-Revision: 38451
2013-10-18 11:47:47 +00:00
Felix Fietkau ff40bc2db9 hostapd: recognize 8021x as an authentication mode
Currently, in order to configure the authentication daemon in
8021x mode, we need to set wireless.@wifi-iface[0].encryption="wpa"
Though it works it confuses folks as 8021x is using WEP
encryption and not WPA. Therefore the terminology itself is
confusing. This change adds 8021x as a recognized string for 8021x
authentication.

Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38339
2013-10-08 11:09:52 +00:00
Felix Fietkau 9beaea6fc2 hostapd: add external registrar support
Setting wireless.@wifi-iface[N].ext_registrar=1 will enable UPNP
advertising and add an external registrar to the interface this vif
belongs to (br-lan if the vif is included in the LAN bridge). By
enabling this we append upnp_iface=xxx to the hostapd config file.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38338
2013-10-08 11:09:48 +00:00
Felix Fietkau 246e9b449b hostapd: enable WPS2 support on hostapd-full.config
Enable CONFIG_WPS2 for hostapd. This is required to support
options like Virtual Push Button in WPS.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38337
2013-10-08 11:09:44 +00:00
Felix Fietkau bcbc9b1e89 hostapd: fix hostapd RSN preauthentication PMKSA caching
In 2009 OpenWrt's hostapd config added an "auth_cache" boolean
to be used to address a reported issue #12129 [0] on a forum [1].
The reported issue on the ticket is different that the one
described on the forum. The commit was r33359. This change broke
proper RSN preauthentication [2] [3] [4] expectations on hostapd's
configuration for WPA2 and this in turn disabled PMKSA caching and
Opportunistic Key Caching. This change:

  * Leaves the "auth_cache" to be used only for WPA networks for those
    looking to use this as a workaround to a reported issue but annotates
    a warning over its usage.

  * Separate "auth_cache" from WPA2 RSN preauthentication, leaving
    WPA2 RSN preauthentication to enabled only with "rsn_preauth" with
    the expected and recommended settings.

  * Adds a new WPA2 RSN preauthentication "rsn_preauth_testing" to
    be used when evaluating funcionality for WPA2 RSN preauthentication
    with the expected and recommended settings with the only difference
    so far with what should be enabled by default to disable Opportunistic
    Key Caching.

Disabling the PMKSA cache should mean the STA could not roam off and back
onto the AP that had PMKSA caching disabled and would require a full
authentication cycle. This fixes this for WPA2 networks with
RSN preauthentication enabled.

This change should be applied to AA as well as trunk.

  TL DR;

The issue described on the forum has to do with failure of a STA
being able to try to authenticate again with the AP if it failed
its first try. This may have been an issue with hostapd in 2009
but as per some tests I cannot reproduce this today on a WPA2
network.

The issue described on the ticket alludes to a security issue with the
design of using a Radius server to authenticate to an AP. The issue
vaguely alludes to the circumstances of zapping a user, deleting their
authentication credentials to log in to the network, and that if
RSN preauthentication is enabled with PMKSA caching that the user
that was zapped would still be able to authenticate.

Lets treat these as separate issues.

I cannot reproduce the first issue reported on the forums of not
being able to authenticate anymore on a WPA2 network.

The issue reported on the ticket modified WPA2 RSN preauthentication
by adding two fields to the hostapd configuration if auth_cache
was enabled:

  * disable_pmksa_caching=1
  * okc=0

The first one disables PMKSA authentication cache.
The second one disables Opportunistic Key Caching.

The issue reported on the ticket was fixed by implementing a workaround
in hostapd's configuration. Disabling PMKSA caching breaks proper use
of WPA2 RSN pre authentication. The usage of disable_pmksa_caching=1
prevents hostapd from adding PMKSA entries into its cache when a successful
802.1x authentication occurs. In practice RSN preauthentication would
trigger a STA to perform authentication with other APs on the same SSID,
it would then have its own supplicant PMKSA cache held. If a STA roams
between one AP to another no new authenitcation would need to be performed
as the new AP would already have authenticated the STA. The purpose of the
PMKSA cache on the AP side would be for the AP to use the same PMKID for
a STA when the STA roams off onto another BSSID and later comes back to it.

Disabling Opportunistic Key Caching could help the reported issue
as well but its not the correct place to address this. Opportunistic
Key Caching enables an AP with different interfaces to share the
PMKSA cache. Its a technical enhancement and disabling it would
be useful to let a testing suite properly test for RSN preauthentication
given that otherwise Opportunistic Key Caching would enable an
interface being tested to derive its own derive the PMKSA entry.
In production though okc=1 should be enabled to help with RSN
preauthentication.

The real fix for this particular issue outside of the scope of hostapd's
configuration and it should not be dealt with as a workaround to
its configuration and breaking expected RSN preauthentication and
technical optimizations. Revert this change and enable users to pick
and choose to enable or disable disable_pmksa_caching and okc expecting them
to instead have read clearly more what these do.

As for the core issure ported, the correct place to fix this is to
enable a sort of messaging between the RADIUS server and its peers
so that if caching for authentication is enabled that cache can be
cleared upon user credential updates. Updating a user password
(not just zapping a user) is another possible issue that would need
to be resolved here. Another part of the solution might be to reduce
the cache timing to account for any systematic limitations (RADIUS
server not able to ask peers to clear cache might be
one).

[0] https://dev.openwrt.org/changeset/33359
[1] https://forum.openwrt.org/viewtopic.php?id=19596
[2] http://wireless.kernel.org/en/users/Documentation/hostapd#IEEE_802.11i.2FRSN.2FWPA2_pre-authentication
[3] http://wireless.kernel.org/en/users/Documentation/wpa_supplicant#RSN_preauthentication
[4] http://wiki.openwrt.org/doc/recipes/rsn_preauthentication

Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>

SVN-Revision: 38336
2013-10-08 11:09:40 +00:00
Felix Fietkau 40aec9ed46 hostapd: Add WPS unconfigured & WPS pin method support
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38335
2013-10-08 11:09:36 +00:00
Felix Fietkau 4689bc8517 hostapd: Add eap_reauth_period config option
This adds the eap_reauth_period to be used for modifying
the RADIUS server reauthentication authentication period,
a parameter that gets passed directly to the hostapd
configuration file.

Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38334
2013-10-08 11:09:27 +00:00
Felix Fietkau b2447d1fca hostapd: adjust the md5sum for the uploaded source tarball (fixes #14155)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37990
2013-09-14 20:07:35 +00:00
Felix Fietkau 4cda88a879 hostapd: fix typo in version number
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37742
2013-08-08 20:45:15 +00:00
Felix Fietkau 9df75e7f34 hostapd: fix ubus reconnect handling
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37741
2013-08-08 20:45:12 +00:00
Felix Fietkau 750197b3af hostapd: add a build variant for wpa_supplicant with p2p (aka Wi-Fi Direct) support
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37739
2013-08-08 16:24:50 +00:00
Felix Fietkau f53b96813e hostapd: update to latest version (20130707)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37738
2013-08-08 16:04:19 +00:00
Felix Fietkau 9a22315ca4 hostapd: Settings for DAE/CoA server
hostapd supports "Dynamic Authorization Extensions", making it possible
to forcibly disconnect a user by sending it a RADIUS "Disconnect-Request"
packet.

I've added three new variables to enable setting of the
"radius_das_client" and "radius_das_port" variables in the hostapd
configuration, which enable these extensions.

* dae_client - IP of the client that can send disconnect requests
* dae_secret - shared secret for DAE packets

These are combined into the "radius_das_client" option in hostapd.conf
To enable the server, both dae_client and dae_secret must be set.

* dae_port - optional, default value is 3799 as specified in RFC 5176

Signed-off-by: Martijn van de Streek <martijn@vandestreek.net>

SVN-Revision: 37734
2013-08-06 18:55:30 +00:00
Felix Fietkau 91f0b411f4 hostapd: Fix WDS/WEP usage
WEP in WDS is currently broken in hostapd. Add a patch
to fix the issue.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>

SVN-Revision: 37733
2013-08-06 17:59:12 +00:00
Felix Fietkau 76ca564e79 hostapd: Refresh patches
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>

SVN-Revision: 37731
2013-08-06 17:59:05 +00:00
Felix Fietkau 22e012bad8 hostapd: Add an option to disable beaconing
Add a patch for hostapd that introduces a config option
"start_disabled" which can be used to bring up an AP
interface with beaconing disabled. This is useful in
a Repeater-AP setup where the Repeater AP has to start
beaconing only after the WDS link has been established.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>

SVN-Revision: 37730
2013-08-06 17:59:02 +00:00
Jo-Philipp Wich 7c197d9f0e hostapd: truncate default mac file before adding entries to it (#13797)
SVN-Revision: 37114
2013-07-01 10:52:35 +00:00
Felix Fietkau ee68734929 hostapd: fix multi-ssid and AP+STA, clean up code
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37111
2013-06-30 21:01:13 +00:00
Felix Fietkau 60b040bbaf hostapd: update to latest git version
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37110
2013-06-30 20:27:38 +00:00
John Crispin e7dbdad43b hostapd: fix superflous coma
this cause the wps trigegr to be copied to the wrong place

https://dev.openwrt.org/ticket/13753

Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 37031
2013-06-24 16:44:18 +00:00
John Crispin 4999ae4236 hostapd: remove old button hotplug script
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 36991
2013-06-21 16:53:07 +00:00
Jo-Philipp Wich 541fbfbb9e hostapd: correctly handle macfile uci option
Make hostapd.sh correctly handle the macfile uci option.

Such option specifies the macfile name to pass into the
hostapd configuration file. Moreover, if a maclist option
has been specified, copy the macfile before appending new
entries.

Signed-off-by: Antonio Quartulli <antonio@open-mesh.com>

SVN-Revision: 36944
2013-06-17 11:59:29 +00:00
Felix Fietkau b85c442e81 hostapd: enable 802.11r for the -full variant (#13250)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 36533
2013-05-03 10:39:57 +00:00
Felix Fietkau d7908e02b5 hostapd: return the frequency to some ubus calls to make integration easier
SVN-Revision: 36410
2013-04-23 18:35:50 +00:00
Felix Fietkau 62244d73ae hostapd: update to 2013-04-05
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 36376
2013-04-22 13:24:48 +00:00
Felix Fietkau 96bb7c123b build: consistently use 'depends on' instead of 'depends'
make the syntax more compatible with kernel menuconfig

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 36351
2013-04-17 15:36:41 +00:00
Felix Fietkau 31876c193a hostapd: fix build errors on supplicant-only builds
SVN-Revision: 36085
2013-03-18 16:11:32 +00:00
Felix Fietkau 2167101c90 hostapd: initial prototype of an ubus binding
Supports listing, removing and banning clients, and hooking into
probe/assoc/auth requests via object subscribe.

SVN-Revision: 36081
2013-03-17 20:47:18 +00:00
John Crispin fce3deddff use new button scheme
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 36004
2013-03-13 18:11:25 +00:00
Felix Fietkau 9ddc45bc3f hostapd: fix client reassociation after too many ACK failures
SVN-Revision: 35973
2013-03-12 00:19:25 +00:00
Felix Fietkau c3faa6be75 hostapd: include the madwifi headers in the package directory to avoid compile breakage if the madwifi build fails
SVN-Revision: 35893
2013-03-05 22:06:30 +00:00
Felix Fietkau fa1749e668 hostapd: update to git version 2013-03-02
SVN-Revision: 35887
2013-03-04 17:16:38 +00:00
Felix Fietkau 1d6574b9c3 hostapd: fix the scan wait patch for multiple interfaces
SVN-Revision: 35630
2013-02-16 19:00:34 +00:00
Felix Fietkau 99782943d2 hostapd: add back the patch that waits for interface bringup in ht40, it got lost with the update
SVN-Revision: 35619
2013-02-16 14:26:03 +00:00
Felix Fietkau 1810b80ec0 mac80211/hostapd: short_preamble is a per-vif option and should be enabled by default
SVN-Revision: 35565
2013-02-11 18:59:10 +00:00
Jo-Philipp Wich e804a663e3 hostapd: don't configure wpa_supplicant with empty password="" if no password is specified (#12912)
SVN-Revision: 35358
2013-01-28 18:05:33 +00:00
John Crispin a730e96569 Remove remaining etrax references
SVN-Revision: 34968
2013-01-02 11:28:11 +00:00
Felix Fietkau 056d75049d wpa_supplicant.sh: always use parameters from the current section
Using variables from the outer scope unnecessarily complicates the code and
leads to issues.

This patch fixes the bug when having an "adhoc" wifi-iface section before a
"sta" section prevents wpa_supplicant from using the key specified in the
corresponding section as it tries to use the "adhoc" key instead (1 by
default).

Signed-off-by: Paul Fertser <fercerpav@gmail.com>

SVN-Revision: 34716
2012-12-16 13:23:37 +00:00
Felix Fietkau 8516ddb133 mac80211, hostapd: Fix macfilter for multi bssid setups
Previously only the first macfilter configuration would have been used
on all interfaces. However, the configuration was always done per vif
already. Hence, move the macfilter setup into hostapd.sh where and
create one mac list file per vif.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>

SVN-Revision: 34470
2012-12-04 12:06:40 +00:00