openwrt/package/network/services
Felix Fietkau e4cf25cfab wpa_supplicant: improve generating phase2 config line for WPA-EAP
WPA-EAP supports several phase2 (=inner) authentication methods when
using EAP-TTLS, EAP-PEAP or EAP-FAST (the latter is added as a first
step towards the UCI model supporting EAP-FAST by this commit)
The value of the auth config variable was previously expected to be
directly parseable as the content of the 'phase2' option of
wpa_supplicant.
This exposed wpa_supplicant's internals, leaving it to view-level to
set the value properly. Unfortunately, this is currently not the case,
as LuCI currently allows values like 'PAP', 'CHAP', 'MSCHAPV2'.
Users thus probably diverged and set auth to values like
'auth=MSCHAPV2' as a work-around.
This behaviour isn't explicitely documented anywhere and is not quite
intuitive...

The phase2-string is now generated according to $eap_type and $auth,
following the scheme also found in hostap's test-cases:
http://w1.fi/cgit/hostap/tree/tests/hwsim/test_ap_eap.py
The old behaviour is also still supported for the sake of not breaking
existing, working configurations.

Examples:
  eap_type   auth
  'ttls'     'EAP-MSCHAPV2'     -> phase2="autheap=MSCHAPV2"
  'ttls'     'MSCHAPV2'         -> phase2="auth=MSCHAPV2"
  'peap'     'EAP-GTC'          -> phase2="auth=GTC"

Deprecated syntax supported for compatibility:
  'ttls'     'autheap=MSCHAPV2' -> phase2="autheap=MSCHAPV2"

I will suggest a patch to LuCI adding EAP-MSCHAPV2, EAP-GTC, ... to
the list of Authentication methods available.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

SVN-Revision: 48309
2016-01-18 11:40:44 +00:00
..
authsae authsae: Use kbit/s as mcast_rate unit like wpad 2015-11-24 18:28:35 +00:00
dnsmasq dnsmasq: Add option --min-port 2016-01-15 11:24:15 +00:00
dropbear dropbear: update version to 2015.71 2016-01-15 11:24:09 +00:00
ead cosmetic: remove trailing whitespaces 2015-10-15 22:12:13 +00:00
hostapd wpa_supplicant: improve generating phase2 config line for WPA-EAP 2016-01-18 11:40:44 +00:00
igmpproxy igmpproxy: fix spurious restarts on interface events, pass used netdevs to procd instead 2015-09-26 23:27:23 +00:00
ipset-dns Add a few SPDX tags 2014-11-02 12:20:54 +00:00
lldpd package/lldpd: Remove extraneous select 2015-12-23 14:44:05 +00:00
mdns packages: use OPENWRT_GIT to point at the main openwrt git repo 2016-01-04 15:11:49 +00:00
odhcpd odhcpd: correctly handle netlink congestion case 2015-11-19 11:49:21 +00:00
omcproxy omcproxy: fix PKG_LICENSE string 2015-10-26 09:01:48 +00:00
openvpn openvpn: update to version 2.3.10 2016-01-11 18:37:28 +00:00
openvpn-easy-rsa packages: remove uneeded PKG_BUILD_DIR overrides 2015-02-22 01:31:21 +00:00
ppp ppp: use more reliable way to set script environment 2015-09-15 14:52:47 +00:00
relayd relayd: move to git.openwrt.org 2016-01-04 15:13:17 +00:00
samba36 samba36: add three CVE patches from 2015-12-16 2016-01-05 10:42:52 +00:00
uhttpd uhttpd: move to git.openwrt.org 2016-01-04 15:12:21 +00:00