From 3f1981045b830676d0bdb33f11243e7c13f91c1c Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Tue, 20 Aug 2019 15:09:02 +0800 Subject: [PATCH] hostapd: update --- package/network/services/hostapd/Config.in | 28 +- package/network/services/hostapd/Makefile | 75 ++- .../hostapd/files/hostapd-basic.config | 380 +++++++++++ .../hostapd/files/hostapd-full.config | 8 +- .../hostapd/files/hostapd-mini.config | 8 +- .../network/services/hostapd/files/hostapd.sh | 128 +++- .../hostapd/files/wpa_supplicant-basic.config | 598 ++++++++++++++++++ .../hostapd/files/wpa_supplicant-full.config | 29 +- .../hostapd/files/wpa_supplicant-mini.config | 29 +- .../hostapd/files/wpa_supplicant-p2p.config | 29 +- .../services/hostapd/files/wps-hotplug.sh | 61 +- ...e-undesired-logging-of-ACL-rejection.patch | 39 -- ...-logging-priority-for-handle_auth_cb.patch | 28 - ...thenticated-encrypted-EAPOL-Key-data.patch | 43 -- ...1-mesh-factor-out-mesh-join-function.patch | 2 +- ...rnel-driver-DFS-handler-in-userspace.patch | 4 +- ...-mesh-interface-on-dfs-event-handler.patch | 20 +- ...hannels-to-be-selected-if-dfs-is-ena.patch | 16 +- ...-mesh-to-send-channel-switch-request.patch | 25 - ...ot-allow-scan-result-to-swap-pri-sec.patch | 8 +- ...sh-do-not-use-offchan-mgmt-tx-on-DFS.patch | 6 +- ...18-mesh-make-forwarding-configurable.patch | 22 +- ...x-crash-with-CONFIG_TAXONOMY-enabled.patch | 23 - ...CHANWIDTH_USE_HT-to-max_oper_chwidth.patch | 4 +- ...ent-use-of-VHT20-config-in-mesh-mode.patch | 8 +- ...mesh-fix-parsing-of-max_oper_chwidth.patch | 45 -- ...EE80211X-y-build-without-CONFIG_FILS.patch | 33 + ...ix-race-condition-in-mesh-mpm-new-pe.patch | 34 + ...group-initialization-to-earlier-step.patch | 104 --- ...AP-pwd-Mask-timing-of-PWE-derivation.patch | 247 -------- ...tant-time-operations-for-private-big.patch | 10 +- ...tant-time-selection-for-crypto_bignu.patch | 4 +- ...r-Verify-received-scalar-and-element.patch | 2 +- ...pwd-server-Detect-reflection-attacks.patch | 2 +- ...t-Verify-received-scalar-and-element.patch | 2 +- ...k-element-x-y-coordinates-explicitly.patch | 21 +- ...erver-Fix-reassembly-buffer-handling.patch | 40 -- ...-peer-Fix-reassembly-buffer-handling.patch | 40 -- .../hostapd/patches/110-no_eapol_fix.patch | 2 +- .../hostapd/patches/200-multicall.patch | 18 +- .../services/hostapd/patches/300-noscan.patch | 4 +- .../hostapd/patches/301-mesh-noscan.patch | 6 +- .../patches/310-rescan_immediately.patch | 2 +- .../patches/330-nl80211_fix_set_freq.patch | 2 +- .../patches/340-reload_freq_change.patch | 8 +- .../341-mesh-ctrl-iface-channel-switch.patch | 39 ++ .../patches/350-nl80211_del_beacon_bss.patch | 10 +- .../patches/360-ctrl_iface_reload.patch | 2 +- .../hostapd/patches/370-ap_sta_support.patch | 195 +++++- .../patches/380-disable_ctrl_iface_mib.patch | 28 +- .../patches/390-wpa_ie_cap_workaround.patch | 4 +- .../patches/410-limit_debug_messages.patch | 12 +- ...dd-new-config-params-to-be-used-with.patch | 8 +- ...-use-new-parameters-during-ibss-join.patch | 4 +- .../patches/463-add-mcast_rate-to-11s.patch | 6 +- .../patches/464-fix-mesh-obss-check.patch | 2 +- .../patches/500-lto-jobserver-support.patch | 50 ++ ...ostapd-Add-Multi-AP-protocol-support.patch | 306 +++++++++ ...dd-Multi-AP-protocol-support-to-supp.patch | 311 +++++++++ .../552-tests-Multi-AP-association.patch | 100 +++ .../553-tests-refactor-test_multi_ap.patch | 72 +++ ...-reject-backhaul-STA-on-fronhaul-BSS.patch | 106 ++++ ...a_ext-add-multi_ap_subelem-parameter.patch | 342 ++++++++++ ...upport-Multi-AP-backhaul-STA-onboard.patch | 217 +++++++ ...ort-Multi-AP-backhaul-STA-onboarding.patch | 339 ++++++++++ .../558-hostapd-add-README-MULTI-AP.patch | 181 ++++++ ...dd-WPS-tests-to-multi_ap-hwsim-tests.patch | 182 ++++++ .../hostapd/patches/600-ubus_support.patch | 137 +++- .../hostapd/patches/700-fix-openssl11.patch | 35 - .../services/hostapd/src/src/ap/ubus.c | 94 ++- .../services/hostapd/src/src/ap/ubus.h | 1 + .../hostapd/src/src/utils/build_features.h | 16 + .../hostapd/src/wpa_supplicant/ubus.c | 265 ++++++++ .../hostapd/src/wpa_supplicant/ubus.h | 53 ++ 74 files changed, 4420 insertions(+), 944 deletions(-) create mode 100644 package/network/services/hostapd/files/hostapd-basic.config mode change 100644 => 100755 package/network/services/hostapd/files/hostapd.sh create mode 100644 package/network/services/hostapd/files/wpa_supplicant-basic.config mode change 100644 => 100755 package/network/services/hostapd/files/wps-hotplug.sh delete mode 100644 package/network/services/hostapd/patches/000-0001-Reduce-undesired-logging-of-ACL-rejection.patch delete mode 100644 package/network/services/hostapd/patches/000-0002-Drop-logging-priority-for-handle_auth_cb.patch delete mode 100644 package/network/services/hostapd/patches/0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch delete mode 100644 package/network/services/hostapd/patches/012-mesh-allow-mesh-to-send-channel-switch-request.patch delete mode 100644 package/network/services/hostapd/patches/022-mesh-fix-crash-with-CONFIG_TAXONOMY-enabled.patch delete mode 100644 package/network/services/hostapd/patches/033-mesh-fix-parsing-of-max_oper_chwidth.patch create mode 100644 package/network/services/hostapd/patches/040-FT-Fix-CONFIG_IEEE80211X-y-build-without-CONFIG_FILS.patch create mode 100644 package/network/services/hostapd/patches/051-wpa_supplicant-fix-race-condition-in-mesh-mpm-new-pe.patch delete mode 100644 package/network/services/hostapd/patches/060-0001-EAP-pwd-Move-EC-group-initialization-to-earlier-step.patch delete mode 100644 package/network/services/hostapd/patches/060-0002-EAP-pwd-Mask-timing-of-PWE-derivation.patch delete mode 100644 package/network/services/hostapd/patches/065-0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch delete mode 100644 package/network/services/hostapd/patches/065-0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch create mode 100644 package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch create mode 100644 package/network/services/hostapd/patches/500-lto-jobserver-support.patch create mode 100644 package/network/services/hostapd/patches/550-hostapd-Add-Multi-AP-protocol-support.patch create mode 100644 package/network/services/hostapd/patches/551-wpa_supplicant-Add-Multi-AP-protocol-support-to-supp.patch create mode 100644 package/network/services/hostapd/patches/552-tests-Multi-AP-association.patch create mode 100644 package/network/services/hostapd/patches/553-tests-refactor-test_multi_ap.patch create mode 100644 package/network/services/hostapd/patches/554-multi_ap-don-t-reject-backhaul-STA-on-fronhaul-BSS.patch create mode 100644 package/network/services/hostapd/patches/555-WPS-wps_build_wfa_ext-add-multi_ap_subelem-parameter.patch create mode 100644 package/network/services/hostapd/patches/556-wpa_supplicant-support-Multi-AP-backhaul-STA-onboard.patch create mode 100644 package/network/services/hostapd/patches/557-hostapd-support-Multi-AP-backhaul-STA-onboarding.patch create mode 100644 package/network/services/hostapd/patches/558-hostapd-add-README-MULTI-AP.patch create mode 100644 package/network/services/hostapd/patches/559-tests-add-WPS-tests-to-multi_ap-hwsim-tests.patch delete mode 100644 package/network/services/hostapd/patches/700-fix-openssl11.patch create mode 100644 package/network/services/hostapd/src/wpa_supplicant/ubus.c create mode 100644 package/network/services/hostapd/src/wpa_supplicant/ubus.h diff --git a/package/network/services/hostapd/Config.in b/package/network/services/hostapd/Config.in index 222cfb7f13..9ce4b243cc 100644 --- a/package/network/services/hostapd/Config.in +++ b/package/network/services/hostapd/Config.in @@ -1,24 +1,4 @@ # wpa_supplicant config -config WPA_SUPPLICANT_NO_TIMESTAMP_CHECK - bool "Disable timestamp check" - depends on PACKAGE_wpa-supplicant || \ - PACKAGE_wpa-supplicant-openssl || \ - PACKAGE_wpa-supplicant-wolfssl || \ - PACKAGE_wpa-supplicant-mesh-openssl || \ - PACKAGE_wpa-supplicant-mesh-wolfssl || \ - PACKAGE_wpa-supplicant-mini || \ - PACKAGE_wpa-supplicant-p2p || \ - PACKAGE_wpad || \ - PACKAGE_wpad-openssl || \ - PACKAGE_wpad-wolfssl || \ - PACKAGE_wpad-mini || \ - PACKAGE_wpad-mesh-openssl || \ - PACKAGE_wpad-mesh-wolfssl - default n - help - This disables the timestamp check for certificates in wpa_supplicant - Useful for devices without RTC that cannot reliably get the real date/time - config WPA_RFKILL_SUPPORT bool "Add rfkill support" depends on PACKAGE_wpa-supplicant || \ @@ -26,11 +6,13 @@ config WPA_RFKILL_SUPPORT PACKAGE_wpa-supplicant-wolfssl || \ PACKAGE_wpa-supplicant-mesh-openssl || \ PACKAGE_wpa-supplicant-mesh-wolfssl || \ + PACKAGE_wpa-supplicant-basic || \ PACKAGE_wpa-supplicant-mini || \ PACKAGE_wpa-supplicant-p2p || \ PACKAGE_wpad || \ PACKAGE_wpad-openssl || \ PACKAGE_wpad-wolfssl || \ + PACKAGE_wpad-basic || \ PACKAGE_wpad-mini || \ PACKAGE_wpad-mesh-openssl || \ PACKAGE_wpad-mesh-wolfssl @@ -43,11 +25,13 @@ config WPA_MSG_MIN_PRIORITY PACKAGE_wpa-supplicant-wolfssl || \ PACKAGE_wpa-supplicant-mesh-openssl || \ PACKAGE_wpa-supplicant-mesh-wolfssl || \ + PACKAGE_wpa-supplicant-basic || \ PACKAGE_wpa-supplicant-mini || \ PACKAGE_wpa-supplicant-p2p || \ PACKAGE_wpad || \ PACKAGE_wpad-openssl || \ PACKAGE_wpad-wolfssl || \ + PACKAGE_wpad-basic || \ PACKAGE_wpad-mini || \ PACKAGE_wpad-mesh-openssl || \ PACKAGE_wpad-mesh-wolfssl @@ -67,15 +51,11 @@ config WPA_WOLFSSL PACKAGE_wpad-wolfssl ||\ PACKAGE_wpad-mesh-wolfssl ||\ PACKAGE_eapol-test-wolfssl - select PACKAGE_libwolfssl select WOLFSSL_HAS_AES_CCM select WOLFSSL_HAS_AES_GCM select WOLFSSL_HAS_ARC4 - select WOLFSSL_HAS_DES3 select WOLFSSL_HAS_DH - select WOLFSSL_HAS_ECC select WOLFSSL_HAS_OCSP - select WOLFSSL_HAS_PSK select WOLFSSL_HAS_SESSION_TICKET select WOLFSSL_HAS_WPAS diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile index b548ecdf1b..e389efccb2 100644 --- a/package/network/services/hostapd/Makefile +++ b/package/network/services/hostapd/Makefile @@ -11,9 +11,9 @@ PKG_RELEASE:=6 PKG_SOURCE_URL:=http://w1.fi/hostap.git PKG_SOURCE_PROTO:=git -PKG_SOURCE_DATE:=2018-05-21 -PKG_SOURCE_VERSION:=62566bc23d041e88f8e35933d5fd8c2fd0f7cf2a -PKG_MIRROR_HASH:=f234b24f9471ae9cb34460feec6d6614641691544101535673595272c91448eb +PKG_SOURCE_DATE:=2018-12-02 +PKG_SOURCE_VERSION:=c2c6c01bb8b6fafc2074b46a53c4eab2c145ac6f +PKG_MIRROR_HASH:=d381123fe42059b553d96122a03c35e7d1709153c3aaf10fa4e74fe59be243dd PKG_MAINTAINER:=Felix Fietkau PKG_LICENSE:=BSD-3-Clause @@ -22,10 +22,10 @@ PKG_CPE_ID:=cpe:/a:w1.fi:hostapd PKG_BUILD_PARALLEL:=1 PKG_CONFIG_DEPENDS:= \ - CONFIG_WPA_SUPPLICANT_NO_TIMESTAMP_CHECK \ CONFIG_PACKAGE_kmod-ath9k \ CONFIG_PACKAGE_kmod-cfg80211 \ CONFIG_PACKAGE_hostapd \ + CONFIG_PACKAGE_hostapd-basic \ CONFIG_PACKAGE_hostapd-mini \ CONFIG_WPA_RFKILL_SUPPORT \ CONFIG_DRIVER_WEXT_SUPPORT \ @@ -95,13 +95,17 @@ ifeq ($(LOCAL_VARIANT),full) DRIVER_MAKEOPTS += CONFIG_IEEE80211W=$(CONFIG_DRIVER_11W_SUPPORT) endif +ifeq ($(LOCAL_VARIANT),basic) + DRIVER_MAKEOPTS += CONFIG_IEEE80211W=$(CONFIG_DRIVER_11W_SUPPORT) +endif + ifeq ($(LOCAL_VARIANT),full) ifeq ($(SSL_VARIANT),openssl) - DRIVER_MAKEOPTS += CONFIG_TLS=openssl + DRIVER_MAKEOPTS += CONFIG_TLS=openssl CONFIG_SAE=y CONFIG_OWE=y CONFIG_SUITEB192=y TARGET_LDFLAGS += -lcrypto -lssl endif ifeq ($(SSL_VARIANT),wolfssl) - DRIVER_MAKEOPTS += CONFIG_TLS=wolfssl CONFIG_WPS_NFC=1 + DRIVER_MAKEOPTS += CONFIG_TLS=wolfssl CONFIG_WPS_NFC=1 CONFIG_SAE=y CONFIG_OWE=y CONFIG_SUITEB192=y TARGET_LDFLAGS += -lwolfssl endif endif @@ -118,9 +122,6 @@ ifneq ($(LOCAL_TYPE),hostapd) endif endif - ifdef CONFIG_WPA_SUPPLICANT_NO_TIMESTAMP_CHECK - TARGET_CFLAGS += -DNO_TIMESTAMP_CHECK - endif ifdef CONFIG_WPA_RFKILL_SUPPORT DRIVER_MAKEOPTS += NEED_RFKILL=y endif @@ -176,6 +177,16 @@ endef Package/hostapd-wolfssl/description = $(Package/hostapd/description) +define Package/hostapd-basic +$(call Package/hostapd/Default,$(1)) + TITLE+= (WPA-PSK, 11r and 11w) + VARIANT:=basic +endef + +define Package/hostapd-basic/description + This package contains a basic IEEE 802.1x/WPA Authenticator with WPA-PSK, 802.11r and 802.11w support. +endef + define Package/hostapd-mini $(call Package/hostapd/Default,$(1)) TITLE+= (WPA-PSK only) @@ -228,6 +239,16 @@ endef Package/wpad-wolfssl/description = $(Package/wpad/description) +define Package/wpad-basic +$(call Package/wpad/Default,$(1)) + TITLE+= (WPA-PSK, 11r and 11w) + VARIANT:=wpad-basic +endef + +define Package/wpad-basic/description + This package contains a basic IEEE 802.1x/WPA Authenticator and Supplicant with WPA-PSK, 802.11r and 802.11w support. +endef + define Package/wpad-mini $(call Package/wpad/Default,$(1)) TITLE+= (WPA-PSK only) @@ -271,7 +292,7 @@ define Package/wpa-supplicant/Default CATEGORY:=Network TITLE:=WPA Supplicant URL:=http://hostap.epitest.fi/wpa_supplicant/ - DEPENDS:=$(DRV_DEPENDS) + DEPENDS:=$(DRV_DEPENDS) +hostapd-common +libubus PROVIDES:=wpa-supplicant CONFLICTS:=$(SUPPLICANT_PROVIDERS) SUPPLICANT_PROVIDERS+=$(1) @@ -324,6 +345,12 @@ $(call Package/wpa-supplicant-mesh/Default,$(1)) DEPENDS+=+libwolfssl endef +define Package/wpa-supplicant-basic +$(call Package/wpa-supplicant/Default,$(1)) + TITLE+= (with 11r and 11w) + VARIANT:=supplicant-basic +endef + define Package/wpa-supplicant-mini $(call Package/wpa-supplicant/Default,$(1)) TITLE+= (minimal version) @@ -362,7 +389,7 @@ define Package/eapol-test SECTION:=net CATEGORY:=Network VARIANT:=supplicant-full-internal - DEPENDS:=$(DRV_DEPENDS) + DEPENDS:=$(DRV_DEPENDS) +libubus endef define Package/eapol-test-openssl @@ -371,7 +398,7 @@ define Package/eapol-test-openssl CATEGORY:=Network VARIANT:=supplicant-full-openssl CONFLICTS:=$(filter-out eapol-test-openssl ,$(EAPOL_TEST_PROVIDERS)) - DEPENDS:=$(DRV_DEPENDS) +libopenssl + DEPENDS:=$(DRV_DEPENDS) +libubus +libopenssl PROVIDES:=eapol-test endef @@ -381,7 +408,7 @@ define Package/eapol-test-wolfssl CATEGORY:=Network VARIANT:=supplicant-full-wolfssl CONFLICTS:=$(filter-out eapol-test-openssl ,$(filter-out eapol-test-wolfssl ,$(EAPOL_TEST_PROVIDERS))) - DEPENDS:=$(DRV_DEPENDS) +libwolfssl + DEPENDS:=$(DRV_DEPENDS) +libubus +libwolfssl PROVIDES:=eapol-test endef @@ -412,11 +439,8 @@ TARGET_CPPFLAGS := \ -D_GNU_SOURCE \ $(if $(CONFIG_WPA_MSG_MIN_PRIORITY),-DCONFIG_MSG_MIN_PRIORITY=$(CONFIG_WPA_MSG_MIN_PRIORITY)) -TARGET_CFLAGS += -ffunction-sections -fdata-sections -TARGET_LDFLAGS += -Wl,--gc-sections -ifeq ($(findstring supplicant,$(BUILD_VARIANT)),) - TARGET_LDFLAGS += -lubox -lubus -endif +TARGET_CFLAGS += -ffunction-sections -fdata-sections -flto +TARGET_LDFLAGS += -Wl,--gc-sections -flto=jobserver -fuse-linker-plugin -lubox -lubus ifdef CONFIG_PACKAGE_kmod-cfg80211 TARGET_LDFLAGS += -lm -lnl-tiny @@ -429,6 +453,7 @@ define Build/RunMake $(DRIVER_MAKEOPTS) \ LIBS="$(TARGET_LDFLAGS)" \ LIBS_c="$(TARGET_LDFLAGS_C)" \ + AR="$(TARGET_CROSS)gcc-ar" \ BCHECK= \ $(2) endef @@ -450,7 +475,7 @@ define Build/Compile/wpad MULTICALL=1 \ wpa_cli wpa_supplicant_multi.a \ ) - $(TARGET_CC) -o $(PKG_BUILD_DIR)/wpad \ + +export MAKEFLAGS="$(MAKE_JOBSERVER)"; $(TARGET_CC) -o $(PKG_BUILD_DIR)/wpad \ $(TARGET_CFLAGS) \ ./files/multicall.c \ $(PKG_BUILD_DIR)/hostapd/hostapd_multi.a \ @@ -502,23 +527,24 @@ define Install/supplicant endef define Package/hostapd-common/install - $(INSTALL_DIR) $(1)/lib/netifd + $(INSTALL_DIR) $(1)/lib/netifd $(1)/etc/rc.button $(INSTALL_DATA) ./files/hostapd.sh $(1)/lib/netifd/hostapd.sh + $(INSTALL_BIN) ./files/wps-hotplug.sh $(1)/etc/rc.button/wps endef define Package/hostapd/install $(call Install/hostapd,$(1)) $(INSTALL_BIN) $(PKG_BUILD_DIR)/hostapd/hostapd $(1)/usr/sbin/ endef +Package/hostapd-basic/install = $(Package/hostapd/install) Package/hostapd-mini/install = $(Package/hostapd/install) Package/hostapd-openssl/install = $(Package/hostapd/install) Package/hostapd-wolfssl/install = $(Package/hostapd/install) ifneq ($(LOCAL_TYPE),supplicant) define Package/hostapd-utils/install - $(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/rc.button + $(INSTALL_DIR) $(1)/usr/sbin $(INSTALL_BIN) $(PKG_BUILD_DIR)/hostapd/hostapd_cli $(1)/usr/sbin/ - $(INSTALL_BIN) ./files/wps-hotplug.sh $(1)/etc/rc.button/wps endef endif @@ -529,6 +555,7 @@ define Package/wpad/install $(LN) wpad $(1)/usr/sbin/hostapd $(LN) wpad $(1)/usr/sbin/wpa_supplicant endef +Package/wpad-basic/install = $(Package/wpad/install) Package/wpad-mini/install = $(Package/wpad/install) Package/wpad-openssl/install = $(Package/wpad/install) Package/wpad-wolfssl/install = $(Package/wpad/install) @@ -539,6 +566,7 @@ define Package/wpa-supplicant/install $(call Install/supplicant,$(1)) $(INSTALL_BIN) $(PKG_BUILD_DIR)/wpa_supplicant/wpa_supplicant $(1)/usr/sbin/ endef +Package/wpa-supplicant-basic/install = $(Package/wpa-supplicant/install) Package/wpa-supplicant-mini/install = $(Package/wpa-supplicant/install) Package/wpa-supplicant-p2p/install = $(Package/wpa-supplicant/install) Package/wpa-supplicant-openssl/install = $(Package/wpa-supplicant/install) @@ -575,18 +603,21 @@ ifeq ($(BUILD_VARIANT),supplicant-full-wolfssl) endif $(eval $(call BuildPackage,hostapd)) +$(eval $(call BuildPackage,hostapd-basic)) $(eval $(call BuildPackage,hostapd-mini)) $(eval $(call BuildPackage,hostapd-openssl)) $(eval $(call BuildPackage,hostapd-wolfssl)) $(eval $(call BuildPackage,wpad)) $(eval $(call BuildPackage,wpad-mesh-openssl)) $(eval $(call BuildPackage,wpad-mesh-wolfssl)) +$(eval $(call BuildPackage,wpad-basic)) $(eval $(call BuildPackage,wpad-mini)) $(eval $(call BuildPackage,wpad-openssl)) $(eval $(call BuildPackage,wpad-wolfssl)) $(eval $(call BuildPackage,wpa-supplicant)) $(eval $(call BuildPackage,wpa-supplicant-mesh-openssl)) $(eval $(call BuildPackage,wpa-supplicant-mesh-wolfssl)) +$(eval $(call BuildPackage,wpa-supplicant-basic)) $(eval $(call BuildPackage,wpa-supplicant-mini)) $(eval $(call BuildPackage,wpa-supplicant-p2p)) $(eval $(call BuildPackage,wpa-supplicant-openssl)) diff --git a/package/network/services/hostapd/files/hostapd-basic.config b/package/network/services/hostapd/files/hostapd-basic.config new file mode 100644 index 0000000000..b15116fbbe --- /dev/null +++ b/package/network/services/hostapd/files/hostapd-basic.config @@ -0,0 +1,380 @@ +# Example hostapd build time configuration +# +# This file lists the configuration options that are used when building the +# hostapd binary. All lines starting with # are ignored. Configuration option +# lines must be commented out complete, if they are not to be included, i.e., +# just setting VARIABLE=n is not disabling that variable. +# +# This file is included in Makefile, so variables like CFLAGS and LIBS can also +# be modified from here. In most cass, these lines should use += in order not +# to override previous values of the variables. + +# Driver interface for Host AP driver +#CONFIG_DRIVER_HOSTAP=y + +# Driver interface for wired authenticator +CONFIG_DRIVER_WIRED=y + +# Driver interface for drivers using the nl80211 kernel interface +CONFIG_DRIVER_NL80211=y + +# QCA vendor extensions to nl80211 +#CONFIG_DRIVER_NL80211_QCA=y + +# driver_nl80211.c requires libnl. If you are compiling it yourself +# you may need to point hostapd to your version of libnl. +# +#CFLAGS += -I$ +#LIBS += -L$ + +# Use libnl v2.0 (or 3.0) libraries. +#CONFIG_LIBNL20=y + +# Use libnl 3.2 libraries (if this is selected, CONFIG_LIBNL20 is ignored) +#CONFIG_LIBNL32=y + + +# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver) +#CONFIG_DRIVER_BSD=y +#CFLAGS += -I/usr/local/include +#LIBS += -L/usr/local/lib +#LIBS_p += -L/usr/local/lib +#LIBS_c += -L/usr/local/lib + +# Driver interface for no driver (e.g., RADIUS server only) +#CONFIG_DRIVER_NONE=y + +# IEEE 802.11F/IAPP +#CONFIG_IAPP=y + +# WPA2/IEEE 802.11i RSN pre-authentication +CONFIG_RSN_PREAUTH=y + +# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) +CONFIG_PEERKEY=y + +# IEEE 802.11w (management frame protection) +# Driver support is also needed for IEEE 802.11w. +#CONFIG_IEEE80211W=y + +# Integrated EAP server +#CONFIG_EAP=y + +# EAP Re-authentication Protocol (ERP) in integrated EAP server +#CONFIG_ERP=y + +# EAP-MD5 for the integrated EAP server +#CONFIG_EAP_MD5=y + +# EAP-TLS for the integrated EAP server +#CONFIG_EAP_TLS=y + +# EAP-MSCHAPv2 for the integrated EAP server +#CONFIG_EAP_MSCHAPV2=y + +# EAP-PEAP for the integrated EAP server +#CONFIG_EAP_PEAP=y + +# EAP-GTC for the integrated EAP server +#CONFIG_EAP_GTC=y + +# EAP-TTLS for the integrated EAP server +#CONFIG_EAP_TTLS=y + +# EAP-SIM for the integrated EAP server +#CONFIG_EAP_SIM=y + +# EAP-AKA for the integrated EAP server +#CONFIG_EAP_AKA=y + +# EAP-AKA' for the integrated EAP server +# This requires CONFIG_EAP_AKA to be enabled, too. +#CONFIG_EAP_AKA_PRIME=y + +# EAP-PAX for the integrated EAP server +#CONFIG_EAP_PAX=y + +# EAP-PSK for the integrated EAP server (this is _not_ needed for WPA-PSK) +#CONFIG_EAP_PSK=y + +# EAP-pwd for the integrated EAP server (secure authentication with a password) +#CONFIG_EAP_PWD=y + +# EAP-SAKE for the integrated EAP server +#CONFIG_EAP_SAKE=y + +# EAP-GPSK for the integrated EAP server +#CONFIG_EAP_GPSK=y +# Include support for optional SHA256 cipher suite in EAP-GPSK +#CONFIG_EAP_GPSK_SHA256=y + +# EAP-FAST for the integrated EAP server +# Note: If OpenSSL is used as the TLS library, OpenSSL 1.0 or newer is needed +# for EAP-FAST support. Older OpenSSL releases would need to be patched, e.g., +# with openssl-0.9.8x-tls-extensions.patch, to add the needed functions. +#CONFIG_EAP_FAST=y + +# Wi-Fi Protected Setup (WPS) +#CONFIG_WPS=y +# Enable UPnP support for external WPS Registrars +#CONFIG_WPS_UPNP=y +# Enable WPS support with NFC config method +#CONFIG_WPS_NFC=y + +# EAP-IKEv2 +#CONFIG_EAP_IKEV2=y + +# Trusted Network Connect (EAP-TNC) +#CONFIG_EAP_TNC=y + +# EAP-EKE for the integrated EAP server +#CONFIG_EAP_EKE=y + +# PKCS#12 (PFX) support (used to read private key and certificate file from +# a file that usually has extension .p12 or .pfx) +#CONFIG_PKCS12=y + +# RADIUS authentication server. This provides access to the integrated EAP +# server from external hosts using RADIUS. +#CONFIG_RADIUS_SERVER=y + +# Build IPv6 support for RADIUS operations +#CONFIG_IPV6=y + +# IEEE Std 802.11r-2008 (Fast BSS Transition) +CONFIG_IEEE80211R=y + +# Use the hostapd's IEEE 802.11 authentication (ACL), but without +# the IEEE 802.11 Management capability (e.g., FreeBSD/net80211) +#CONFIG_DRIVER_RADIUS_ACL=y + +# IEEE 802.11n (High Throughput) support +CONFIG_IEEE80211N=y + +# Wireless Network Management (IEEE Std 802.11v-2011) +# Note: This is experimental and not complete implementation. +#CONFIG_WNM=y + +# IEEE 802.11ac (Very High Throughput) support +CONFIG_IEEE80211AC=y + +# IEEE 802.11ax HE support +# Note: This is experimental and work in progress. The definitions are still +# subject to change and this should not be expected to interoperate with the +# final IEEE 802.11ax version. +#CONFIG_IEEE80211AX=y + +# Remove debugging code that is printing out debug messages to stdout. +# This can be used to reduce the size of the hostapd considerably if debugging +# code is not needed. +#CONFIG_NO_STDOUT_DEBUG=y + +# Add support for writing debug log to a file: -f /tmp/hostapd.log +# Disabled by default. +#CONFIG_DEBUG_FILE=y + +# Send debug messages to syslog instead of stdout +CONFIG_DEBUG_SYSLOG=y + +# Add support for sending all debug messages (regardless of debug verbosity) +# to the Linux kernel tracing facility. This helps debug the entire stack by +# making it easy to record everything happening from the driver up into the +# same file, e.g., using trace-cmd. +#CONFIG_DEBUG_LINUX_TRACING=y + +# Remove support for RADIUS accounting +CONFIG_NO_ACCOUNTING=y + +# Remove support for RADIUS +CONFIG_NO_RADIUS=y + +# Remove support for VLANs +#CONFIG_NO_VLAN=y + +# Enable support for fully dynamic VLANs. This enables hostapd to +# automatically create bridge and VLAN interfaces if necessary. +#CONFIG_FULL_DYNAMIC_VLAN=y + +# Use netlink-based kernel API for VLAN operations instead of ioctl() +# Note: This requires libnl 3.1 or newer. +#CONFIG_VLAN_NETLINK=y + +# Remove support for dumping internal state through control interface commands +# This can be used to reduce binary size at the cost of disabling a debugging +# option. +CONFIG_NO_DUMP_STATE=y + +# Enable tracing code for developer debugging +# This tracks use of memory allocations and other registrations and reports +# incorrect use with a backtrace of call (or allocation) location. +#CONFIG_WPA_TRACE=y +# For BSD, comment out these. +#LIBS += -lexecinfo +#LIBS_p += -lexecinfo +#LIBS_c += -lexecinfo + +# Use libbfd to get more details for developer debugging +# This enables use of libbfd to get more detailed symbols for the backtraces +# generated by CONFIG_WPA_TRACE=y. +#CONFIG_WPA_TRACE_BFD=y +# For BSD, comment out these. +#LIBS += -lbfd -liberty -lz +#LIBS_p += -lbfd -liberty -lz +#LIBS_c += -lbfd -liberty -lz + +# hostapd depends on strong random number generation being available from the +# operating system. os_get_random() function is used to fetch random data when +# needed, e.g., for key generation. On Linux and BSD systems, this works by +# reading /dev/urandom. It should be noted that the OS entropy pool needs to be +# properly initialized before hostapd is started. This is important especially +# on embedded devices that do not have a hardware random number generator and +# may by default start up with minimal entropy available for random number +# generation. +# +# As a safety net, hostapd is by default trying to internally collect +# additional entropy for generating random data to mix in with the data +# fetched from the OS. This by itself is not considered to be very strong, but +# it may help in cases where the system pool is not initialized properly. +# However, it is very strongly recommended that the system pool is initialized +# with enough entropy either by using hardware assisted random number +# generator or by storing state over device reboots. +# +# hostapd can be configured to maintain its own entropy store over restarts to +# enhance random number generation. This is not perfect, but it is much more +# secure than using the same sequence of random numbers after every reboot. +# This can be enabled with -e command line option. The specified +# file needs to be readable and writable by hostapd. +# +# If the os_get_random() is known to provide strong random data (e.g., on +# Linux/BSD, the board in question is known to have reliable source of random +# data from /dev/urandom), the internal hostapd random pool can be disabled. +# This will save some in binary size and CPU use. However, this should only be +# considered for builds that are known to be used on devices that meet the +# requirements described above. +CONFIG_NO_RANDOM_POOL=y + +# Should we use poll instead of select? Select is used by default. +#CONFIG_ELOOP_POLL=y + +# Should we use epoll instead of select? Select is used by default. +#CONFIG_ELOOP_EPOLL=y + +# Should we use kqueue instead of select? Select is used by default. +#CONFIG_ELOOP_KQUEUE=y + +# Select TLS implementation +# openssl = OpenSSL (default) +# gnutls = GnuTLS +# internal = Internal TLSv1 implementation (experimental) +# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental) +# none = Empty template +CONFIG_TLS=internal + +# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.1) +# can be enabled to get a stronger construction of messages when block ciphers +# are used. +#CONFIG_TLSV11=y + +# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.2) +# can be enabled to enable use of stronger crypto algorithms. +#CONFIG_TLSV12=y + +# Select which ciphers to use by default with OpenSSL if the user does not +# specify them. +#CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW" + +# If CONFIG_TLS=internal is used, additional library and include paths are +# needed for LibTomMath. Alternatively, an integrated, minimal version of +# LibTomMath can be used. See beginning of libtommath.c for details on benefits +# and drawbacks of this option. +#CONFIG_INTERNAL_LIBTOMMATH=y +#ifndef CONFIG_INTERNAL_LIBTOMMATH +#LTM_PATH=/usr/src/libtommath-0.39 +#CFLAGS += -I$(LTM_PATH) +#LIBS += -L$(LTM_PATH) +#LIBS_p += -L$(LTM_PATH) +#endif +# At the cost of about 4 kB of additional binary size, the internal LibTomMath +# can be configured to include faster routines for exptmod, sqr, and div to +# speed up DH and RSA calculation considerably +#CONFIG_INTERNAL_LIBTOMMATH_FAST=y + +# Interworking (IEEE 802.11u) +# This can be used to enable functionality to improve interworking with +# external networks. +#CONFIG_INTERWORKING=y + +# Hotspot 2.0 +#CONFIG_HS20=y + +# Enable SQLite database support in hlr_auc_gw, EAP-SIM DB, and eap_user_file +#CONFIG_SQLITE=y + +# Enable Fast Session Transfer (FST) +#CONFIG_FST=y + +# Enable CLI commands for FST testing +#CONFIG_FST_TEST=y + +# Testing options +# This can be used to enable some testing options (see also the example +# configuration file) that are really useful only for testing clients that +# connect to this hostapd. These options allow, for example, to drop a +# certain percentage of probe requests or auth/(re)assoc frames. +# +#CONFIG_TESTING_OPTIONS=y + +# Automatic Channel Selection +# This will allow hostapd to pick the channel automatically when channel is set +# to "acs_survey" or "0". Eventually, other ACS algorithms can be added in +# similar way. +# +# Automatic selection is currently only done through initialization, later on +# we hope to do background checks to keep us moving to more ideal channels as +# time goes by. ACS is currently only supported through the nl80211 driver and +# your driver must have survey dump capability that is filled by the driver +# during scanning. +# +# You can customize the ACS survey algorithm with the hostapd.conf variable +# acs_num_scans. +# +# Supported ACS drivers: +# * ath9k +# * ath5k +# * ath10k +# +# For more details refer to: +# http://wireless.kernel.org/en/users/Documentation/acs +# +#CONFIG_ACS=y + +# Multiband Operation support +# These extentions facilitate efficient use of multiple frequency bands +# available to the AP and the devices that may associate with it. +#CONFIG_MBO=y + +# Client Taxonomy +# Has the AP retain the Probe Request and (Re)Association Request frames from +# a client, from which a signature can be produced which can identify the model +# of client device like "Nexus 6P" or "iPhone 5s". +#CONFIG_TAXONOMY=y + +# Fast Initial Link Setup (FILS) (IEEE 802.11ai) +# Note: This is an experimental and not yet complete implementation. This +# should not be enabled for production use. +#CONFIG_FILS=y +# FILS shared key authentication with PFS +#CONFIG_FILS_SK_PFS=y + +# Include internal line edit mode in hostapd_cli. This can be used to provide +# limited command line editing and history support. +#CONFIG_WPA_CLI_EDIT=y + +# Opportunistic Wireless Encryption (OWE) +# Experimental implementation of draft-harkins-owe-07.txt +#CONFIG_OWE=y + +# uBus IPC/RPC System +# Services can connect to the bus and provide methods +# that can be called by other services or clients. +CONFIG_UBUS=y diff --git a/package/network/services/hostapd/files/hostapd-full.config b/package/network/services/hostapd/files/hostapd-full.config index 355a70b9e1..b4159c2d28 100644 --- a/package/network/services/hostapd/files/hostapd-full.config +++ b/package/network/services/hostapd/files/hostapd-full.config @@ -50,11 +50,7 @@ CONFIG_IAPP=y # WPA2/IEEE 802.11i RSN pre-authentication CONFIG_RSN_PREAUTH=y -# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) -CONFIG_PEERKEY=y - # IEEE 802.11w (management frame protection) -# Driver support is also needed for IEEE 802.11w. #CONFIG_IEEE80211W=y # Integrated EAP server @@ -374,6 +370,10 @@ CONFIG_TAXONOMY=y # Experimental implementation of draft-harkins-owe-07.txt #CONFIG_OWE=y +# Override default value for the wpa_disable_eapol_key_retries configuration +# parameter. See that parameter in hostapd.conf for more details. +#CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1 + # uBus IPC/RPC System # Services can connect to the bus and provide methods # that can be called by other services or clients. diff --git a/package/network/services/hostapd/files/hostapd-mini.config b/package/network/services/hostapd/files/hostapd-mini.config index 661983a94b..9057658c16 100644 --- a/package/network/services/hostapd/files/hostapd-mini.config +++ b/package/network/services/hostapd/files/hostapd-mini.config @@ -50,11 +50,7 @@ CONFIG_DRIVER_NL80211=y # WPA2/IEEE 802.11i RSN pre-authentication CONFIG_RSN_PREAUTH=y -# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) -CONFIG_PEERKEY=y - # IEEE 802.11w (management frame protection) -# Driver support is also needed for IEEE 802.11w. #CONFIG_IEEE80211W=y # Integrated EAP server @@ -374,6 +370,10 @@ CONFIG_TLS=internal # Experimental implementation of draft-harkins-owe-07.txt #CONFIG_OWE=y +# Override default value for the wpa_disable_eapol_key_retries configuration +# parameter. See that parameter in hostapd.conf for more details. +#CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1 + # uBus IPC/RPC System # Services can connect to the bus and provide methods # that can be called by other services or clients. diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh old mode 100644 new mode 100755 index 7ffff4e7e1..46acbefeee --- a/package/network/services/hostapd/files/hostapd.sh +++ b/package/network/services/hostapd/files/hostapd.sh @@ -37,11 +37,38 @@ hostapd_append_wep_key() { } hostapd_append_wpa_key_mgmt() { - local auth_type="$(echo $auth_type | tr 'a-z' 'A-Z')" + local auth_type_l="$(echo $auth_type | tr 'a-z' 'A-Z')" - append wpa_key_mgmt "WPA-$auth_type" - [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type}" - [ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-${auth_type}-SHA256" + case "$auth_type" in + psk|eap) + append wpa_key_mgmt "WPA-$auth_type_l" + [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type_l}" + [ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-${auth_type_l}-SHA256" + ;; + eap192) + append wpa_key_mgmt "WPA-EAP-SUITE-B-192" + ;; + eap-eap192) + append wpa_key_mgmt "WPA-EAP-SUITE-B-192" + append wpa_key_mgmt "WPA-EAP" + [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP" + [ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-EAP-SHA256" + ;; + sae) + append wpa_key_mgmt "SAE" + [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE" + ;; + psk-sae) + append wpa_key_mgmt "WPA-PSK" + [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-PSK" + [ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-PSK-SHA256" + append wpa_key_mgmt "SAE" + [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE" + ;; + owe) + append wpa_key_mgmt "OWE" + ;; + esac } hostapd_add_log_config() { @@ -141,7 +168,7 @@ EOF hostapd_common_add_bss_config() { config_add_string 'bssid:macaddr' 'ssid:string' - config_add_boolean wds wmm uapsd hidden + config_add_boolean wds wmm uapsd hidden utf8_ssid config_add_int maxassoc max_inactivity config_add_boolean disassoc_low_ack isolate short_preamble @@ -185,9 +212,12 @@ hostapd_common_add_bss_config() { config_add_string wpa_psk_file + config_add_int multi_ap + config_add_boolean wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 config_add_int wps_ap_setup_locked wps_independent config_add_string wps_device_type wps_device_name wps_manufacturer wps_pin + config_add_string multi_ap_backhaul_ssid multi_ap_backhaul_key config_add_boolean ieee80211v wnm_sleep_mode bss_transition config_add_int time_advertisement @@ -209,6 +239,10 @@ hostapd_common_add_bss_config() { config_add_int mcast_rate config_add_array basic_rate config_add_array supported_rates + + config_add_boolean sae_require_mfp + + config_add_string 'owe_transition_bssid:macaddr' 'owe_transition_ssid:string' } hostapd_set_bss_options() { @@ -227,10 +261,11 @@ hostapd_set_bss_options() { maxassoc max_inactivity disassoc_low_ack isolate auth_cache \ wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 wps_ap_setup_locked \ wps_independent wps_device_type wps_device_name wps_manufacturer wps_pin \ - macfilter ssid wmm uapsd hidden short_preamble rsn_preauth \ + macfilter ssid utf8_ssid wmm uapsd hidden short_preamble rsn_preauth \ iapp_interface eapol_version dynamic_vlan ieee80211w nasid \ acct_server acct_secret acct_port acct_interval \ - bss_load_update_period chan_util_avg_period + bss_load_update_period chan_util_avg_period sae_require_mfp \ + multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key set_default isolate 0 set_default maxassoc 0 @@ -246,7 +281,9 @@ hostapd_set_bss_options() { set_default acct_port 1813 set_default bss_load_update_period 60 set_default chan_util_avg_period 600 - + set_default utf8_ssid 1 + set_default multi_ap 0 + append bss_conf "ctrl_interface=/var/run/hostapd" if [ "$isolate" -gt 0 ]; then append bss_conf "ap_isolate=$isolate" "$N" @@ -265,6 +302,8 @@ hostapd_set_bss_options() { append bss_conf "wmm_enabled=$wmm" "$N" append bss_conf "ignore_broadcast_ssid=$hidden" "$N" append bss_conf "uapsd_advertisement_enabled=$uapsd" "$N" + append bss_conf "utf8_ssid=$utf8_ssid" "$N" + append bss_conf "multi_ap=$multi_ap" "$N" [ "$tdls_prohibit" -gt 0 ] && append bss_conf "tdls_prohibit=$tdls_prohibit" "$N" @@ -284,16 +323,33 @@ hostapd_set_bss_options() { append bss_conf "radius_acct_interim_interval=$acct_interval" "$N" } + case "$auth_type" in + sae|owe|eap192|eap-eap192) + set_default ieee80211w 2 + set_default sae_require_mfp 1 + ;; + psk-sae) + set_default ieee80211w 1 + set_default sae_require_mfp 1 + ;; + esac + [ -n "$sae_require_mfp" ] && append bss_conf "sae_require_mfp=$sae_require_mfp" "$N" + local vlan_possible="" case "$auth_type" in - none) + none|owe) + json_get_vars owe_transition_bssid owe_transition_ssid + + [ -n "$owe_transition_ssid" ] && append bss_conf "owe_transition_ssid=\"$owe_transition_ssid\"" "$N" + [ -n "$owe_transition_bssid" ] && append bss_conf "owe_transition_bssid=$owe_transition_bssid" "$N" + wps_possible=1 # Here we make the assumption that if we're in open mode # with WPS enabled, we got to be in unconfigured state. wps_not_configured=1 ;; - psk) + psk|sae|psk-sae) json_get_vars key wpa_psk_file if [ ${#key} -lt 8 ]; then wireless_setup_vif_failed INVALID_WPA_PSK @@ -311,7 +367,7 @@ hostapd_set_bss_options() { wps_possible=1 ;; - eap) + eap|eap192|eap-eap192) json_get_vars \ auth_server auth_secret auth_port \ dae_client dae_secret dae_port \ @@ -370,6 +426,9 @@ hostapd_set_bss_options() { [ "$wps_pushbutton" -gt 0 ] && append config_methods push_button [ "$wps_label" -gt 0 ] && append config_methods label + # WPS not possible on Multi-AP backhaul-only SSID + [ "$multi_ap" = 1 ] && wps_possible= + [ -n "$wps_possible" -a -n "$config_methods" ] && { set_default ext_registrar 0 set_default wps_device_type "6-0050F204-1" @@ -392,6 +451,19 @@ hostapd_set_bss_options() { append bss_conf "wps_independent=$wps_independent" "$N" [ -n "$wps_ap_setup_locked" ] && append bss_conf "ap_setup_locked=$wps_ap_setup_locked" "$N" [ "$wps_pbc_in_m1" -gt 0 ] && append bss_conf "pbc_in_m1=$wps_pbc_in_m1" "$N" + [ "$multi_ap" -gt 0 ] && [ -n "$multi_ap_backhaul_ssid" ] && { + append bss_conf "multi_ap_backhaul_ssid=\"$multi_ap_backhaul_ssid\"" "$N" + if [ -z "$multi_ap_backhaul_key" ]; then + : + elif [ ${#multi_ap_backhaul_key} -lt 8 ]; then + wireless_setup_vif_failed INVALID_WPA_PSK + return 1 + elif [ ${#multi_ap_backhaul_key} -eq 64 ]; then + append bss_conf "multi_ap_backhaul_wpa_psk=$multi_ap_backhaul_key" "$N" + else + append bss_conf "multi_ap_backhaul_wpa_passphrase=$multi_ap_backhaul_key" "$N" + fi + } } append bss_conf "ssid=$ssid" "$N" @@ -590,7 +662,7 @@ wpa_supplicant_prepare_interface() { _wpa_supplicant_common "$1" - json_get_vars mode wds + json_get_vars mode wds multi_ap [ -n "$network_bridge" ] && { fail= @@ -599,7 +671,7 @@ wpa_supplicant_prepare_interface() { fail=1 ;; sta) - [ "$wds" = 1 ] || fail=1 + [ "$wds" = 1 -o "$multi_ap" = 1 ] || fail=1 ;; esac @@ -625,6 +697,12 @@ wpa_supplicant_prepare_interface() { country_str="country=$country" } + multiap_flag_file="${_config}.is_multiap" + if [ "$multi_ap" = "1" ]; then + touch "$multiap_flag_file" + else + [ -e "$multiap_flag_file" ] && rm "$multiap_flag_file" + fi wpa_supplicant_teardown_interface "$ifname" cat > "$_config" <> "$_config" <> "$_config" + else + cat >> "$_config" < +#LIBS += -L$ + +# Use libnl v2.0 (or 3.0) libraries. +#CONFIG_LIBNL20=y + +# Use libnl 3.2 libraries (if this is selected, CONFIG_LIBNL20 is ignored) +#CONFIG_LIBNL32=y + + +# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver) +#CONFIG_DRIVER_BSD=y +#CFLAGS += -I/usr/local/include +#LIBS += -L/usr/local/lib +#LIBS_p += -L/usr/local/lib +#LIBS_c += -L/usr/local/lib + +# Driver interface for Windows NDIS +#CONFIG_DRIVER_NDIS=y +#CFLAGS += -I/usr/include/w32api/ddk +#LIBS += -L/usr/local/lib +# For native build using mingw +#CONFIG_NATIVE_WINDOWS=y +# Additional directories for cross-compilation on Linux host for mingw target +#CFLAGS += -I/opt/mingw/mingw32/include/ddk +#LIBS += -L/opt/mingw/mingw32/lib +#CC=mingw32-gcc +# By default, driver_ndis uses WinPcap for low-level operations. This can be +# replaced with the following option which replaces WinPcap calls with NDISUIO. +# However, this requires that WZC is disabled (net stop wzcsvc) before starting +# wpa_supplicant. +# CONFIG_USE_NDISUIO=y + +# Driver interface for wired Ethernet drivers +CONFIG_DRIVER_WIRED=y + +# Driver interface for the Broadcom RoboSwitch family +#CONFIG_DRIVER_ROBOSWITCH=y + +# Driver interface for no driver (e.g., WPS ER only) +#CONFIG_DRIVER_NONE=y + +# Solaris libraries +#LIBS += -lsocket -ldlpi -lnsl +#LIBS_c += -lsocket + +# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is +# included) +#CONFIG_IEEE8021X_EAPOL=y + +# EAP-MD5 +#CONFIG_EAP_MD5=y + +# EAP-MSCHAPv2 +#CONFIG_EAP_MSCHAPV2=y + +# EAP-TLS +#CONFIG_EAP_TLS=y + +# EAL-PEAP +#CONFIG_EAP_PEAP=y + +# EAP-TTLS +#CONFIG_EAP_TTLS=y + +# EAP-FAST +# Note: If OpenSSL is used as the TLS library, OpenSSL 1.0 or newer is needed +# for EAP-FAST support. Older OpenSSL releases would need to be patched, e.g., +# with openssl-0.9.8x-tls-extensions.patch, to add the needed functions. +#CONFIG_EAP_FAST=y + +# EAP-GTC +#CONFIG_EAP_GTC=y + +# EAP-OTP +#CONFIG_EAP_OTP=y + +# EAP-SIM (enable CONFIG_PCSC, if EAP-SIM is used) +#CONFIG_EAP_SIM=y + +# EAP-PSK (experimental; this is _not_ needed for WPA-PSK) +#CONFIG_EAP_PSK=y + +# EAP-pwd (secure authentication using only a password) +#CONFIG_EAP_PWD=y + +# EAP-PAX +#CONFIG_EAP_PAX=y + +# LEAP +#CONFIG_EAP_LEAP=y + +# EAP-AKA (enable CONFIG_PCSC, if EAP-AKA is used) +#CONFIG_EAP_AKA=y + +# EAP-AKA' (enable CONFIG_PCSC, if EAP-AKA' is used). +# This requires CONFIG_EAP_AKA to be enabled, too. +#CONFIG_EAP_AKA_PRIME=y + +# Enable USIM simulator (Milenage) for EAP-AKA +#CONFIG_USIM_SIMULATOR=y + +# EAP-SAKE +#CONFIG_EAP_SAKE=y + +# EAP-GPSK +#CONFIG_EAP_GPSK=y +# Include support for optional SHA256 cipher suite in EAP-GPSK +#CONFIG_EAP_GPSK_SHA256=y + +# EAP-TNC and related Trusted Network Connect support (experimental) +#CONFIG_EAP_TNC=y + +# Wi-Fi Protected Setup (WPS) +#CONFIG_WPS=y +# Enable WPS external registrar functionality +#CONFIG_WPS_ER=y +# Disable credentials for an open network by default when acting as a WPS +# registrar. +#CONFIG_WPS_REG_DISABLE_OPEN=y +# Enable WPS support with NFC config method +#CONFIG_WPS_NFC=y + +# EAP-IKEv2 +#CONFIG_EAP_IKEV2=y + +# EAP-EKE +#CONFIG_EAP_EKE=y + +# PKCS#12 (PFX) support (used to read private key and certificate file from +# a file that usually has extension .p12 or .pfx) +#CONFIG_PKCS12=y + +# Smartcard support (i.e., private key on a smartcard), e.g., with openssl +# engine. +#CONFIG_SMARTCARD=y + +# PC/SC interface for smartcards (USIM, GSM SIM) +# Enable this if EAP-SIM or EAP-AKA is included +#CONFIG_PCSC=y + +# Support HT overrides (disable HT/HT40, mask MCS rates, etc.) +CONFIG_HT_OVERRIDES=y + +# Support VHT overrides (disable VHT, mask MCS rates, etc.) +CONFIG_VHT_OVERRIDES=y + +# Development testing +#CONFIG_EAPOL_TEST=y + +# Select control interface backend for external programs, e.g, wpa_cli: +# unix = UNIX domain sockets (default for Linux/*BSD) +# udp = UDP sockets using localhost (127.0.0.1) +# udp6 = UDP IPv6 sockets using localhost (::1) +# named_pipe = Windows Named Pipe (default for Windows) +# udp-remote = UDP sockets with remote access (only for tests systems/purpose) +# udp6-remote = UDP IPv6 sockets with remote access (only for tests purpose) +# y = use default (backwards compatibility) +# If this option is commented out, control interface is not included in the +# build. +CONFIG_CTRL_IFACE=y + +# Include support for GNU Readline and History Libraries in wpa_cli. +# When building a wpa_cli binary for distribution, please note that these +# libraries are licensed under GPL and as such, BSD license may not apply for +# the resulting binary. +#CONFIG_READLINE=y + +# Include internal line edit mode in wpa_cli. This can be used as a replacement +# for GNU Readline to provide limited command line editing and history support. +#CONFIG_WPA_CLI_EDIT=y + +# Remove debugging code that is printing out debug message to stdout. +# This can be used to reduce the size of the wpa_supplicant considerably +# if debugging code is not needed. The size reduction can be around 35% +# (e.g., 90 kB). +#CONFIG_NO_STDOUT_DEBUG=y + +# Remove WPA support, e.g., for wired-only IEEE 802.1X supplicant, to save +# 35-50 kB in code size. +#CONFIG_NO_WPA=y + +# Remove IEEE 802.11i/WPA-Personal ASCII passphrase support +# This option can be used to reduce code size by removing support for +# converting ASCII passphrases into PSK. If this functionality is removed, the +# PSK can only be configured as the 64-octet hexstring (e.g., from +# wpa_passphrase). This saves about 0.5 kB in code size. +#CONFIG_NO_WPA_PASSPHRASE=y + +# Disable scan result processing (ap_mode=1) to save code size by about 1 kB. +# This can be used if ap_scan=1 mode is never enabled. +#CONFIG_NO_SCAN_PROCESSING=y + +# Select configuration backend: +# file = text file (e.g., wpa_supplicant.conf; note: the configuration file +# path is given on command line, not here; this option is just used to +# select the backend that allows configuration files to be used) +# winreg = Windows registry (see win_example.reg for an example) +CONFIG_BACKEND=file + +# Remove configuration write functionality (i.e., to allow the configuration +# file to be updated based on runtime configuration changes). The runtime +# configuration can still be changed, the changes are just not going to be +# persistent over restarts. This option can be used to reduce code size by +# about 3.5 kB. +#CONFIG_NO_CONFIG_WRITE=y + +# Remove support for configuration blobs to reduce code size by about 1.5 kB. +#CONFIG_NO_CONFIG_BLOBS=y + +# Select program entry point implementation: +# main = UNIX/POSIX like main() function (default) +# main_winsvc = Windows service (read parameters from registry) +# main_none = Very basic example (development use only) +#CONFIG_MAIN=main + +# Select wrapper for operating system and C library specific functions +# unix = UNIX/POSIX like systems (default) +# win32 = Windows systems +# none = Empty template +#CONFIG_OS=unix + +# Select event loop implementation +# eloop = select() loop (default) +# eloop_win = Windows events and WaitForMultipleObject() loop +#CONFIG_ELOOP=eloop + +# Should we use poll instead of select? Select is used by default. +#CONFIG_ELOOP_POLL=y + +# Should we use epoll instead of select? Select is used by default. +#CONFIG_ELOOP_EPOLL=y + +# Should we use kqueue instead of select? Select is used by default. +#CONFIG_ELOOP_KQUEUE=y + +# Select layer 2 packet implementation +# linux = Linux packet socket (default) +# pcap = libpcap/libdnet/WinPcap +# freebsd = FreeBSD libpcap +# winpcap = WinPcap with receive thread +# ndis = Windows NDISUIO (note: requires CONFIG_USE_NDISUIO=y) +# none = Empty template +#CONFIG_L2_PACKET=linux + +# Disable Linux packet socket workaround applicable for station interface +# in a bridge for EAPOL frames. This should be uncommented only if the kernel +# is known to not have the regression issue in packet socket behavior with +# bridge interfaces (commit 'bridge: respect RFC2863 operational state')'). +#CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y + +# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) +#CONFIG_PEERKEY=y + +# IEEE 802.11w (management frame protection), also known as PMF +# Driver support is also needed for IEEE 802.11w. +#CONFIG_IEEE80211W=y + +# Select TLS implementation +# openssl = OpenSSL (default) +# gnutls = GnuTLS +# internal = Internal TLSv1 implementation (experimental) +# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental) +# none = Empty template +CONFIG_TLS=internal + +# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.1) +# can be enabled to get a stronger construction of messages when block ciphers +# are used. It should be noted that some existing TLS v1.0 -based +# implementation may not be compatible with TLS v1.1 message (ClientHello is +# sent prior to negotiating which version will be used) +#CONFIG_TLSV11=y + +# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.2) +# can be enabled to enable use of stronger crypto algorithms. It should be +# noted that some existing TLS v1.0 -based implementation may not be compatible +# with TLS v1.2 message (ClientHello is sent prior to negotiating which version +# will be used) +#CONFIG_TLSV12=y + +# Select which ciphers to use by default with OpenSSL if the user does not +# specify them. +#CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW" + +# If CONFIG_TLS=internal is used, additional library and include paths are +# needed for LibTomMath. Alternatively, an integrated, minimal version of +# LibTomMath can be used. See beginning of libtommath.c for details on benefits +# and drawbacks of this option. +#CONFIG_INTERNAL_LIBTOMMATH=y +#ifndef CONFIG_INTERNAL_LIBTOMMATH +#LTM_PATH=/usr/src/libtommath-0.39 +#CFLAGS += -I$(LTM_PATH) +#LIBS += -L$(LTM_PATH) +#LIBS_p += -L$(LTM_PATH) +#endif +# At the cost of about 4 kB of additional binary size, the internal LibTomMath +# can be configured to include faster routines for exptmod, sqr, and div to +# speed up DH and RSA calculation considerably +#CONFIG_INTERNAL_LIBTOMMATH_FAST=y + +# Include NDIS event processing through WMI into wpa_supplicant/wpasvc. +# This is only for Windows builds and requires WMI-related header files and +# WbemUuid.Lib from Platform SDK even when building with MinGW. +#CONFIG_NDIS_EVENTS_INTEGRATED=y +#PLATFORMSDKLIB="/opt/Program Files/Microsoft Platform SDK/Lib" + +# Add support for old DBus control interface +# (fi.epitest.hostap.WPASupplicant) +#CONFIG_CTRL_IFACE_DBUS=y + +# Add support for new DBus control interface +# (fi.w1.hostap.wpa_supplicant1) +#CONFIG_CTRL_IFACE_DBUS_NEW=y + +# Add introspection support for new DBus control interface +#CONFIG_CTRL_IFACE_DBUS_INTRO=y + +# Add support for loading EAP methods dynamically as shared libraries. +# When this option is enabled, each EAP method can be either included +# statically (CONFIG_EAP_=y) or dynamically (CONFIG_EAP_=dyn). +# Dynamic EAP methods are build as shared objects (eap_*.so) and they need to +# be loaded in the beginning of the wpa_supplicant configuration file +# (see load_dynamic_eap parameter in the example file) before being used in +# the network blocks. +# +# Note that some shared parts of EAP methods are included in the main program +# and in order to be able to use dynamic EAP methods using these parts, the +# main program must have been build with the EAP method enabled (=y or =dyn). +# This means that EAP-TLS/PEAP/TTLS/FAST cannot be added as dynamic libraries +# unless at least one of them was included in the main build to force inclusion +# of the shared code. Similarly, at least one of EAP-SIM/AKA must be included +# in the main build to be able to load these methods dynamically. +# +# Please also note that using dynamic libraries will increase the total binary +# size. Thus, it may not be the best option for targets that have limited +# amount of memory/flash. +#CONFIG_DYNAMIC_EAP_METHODS=y + +# IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode +CONFIG_IEEE80211R=y + +# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies +# CONFIG_IEEE80211R). +#CONFIG_IEEE80211R_AP=y + +# Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt) +#CONFIG_DEBUG_FILE=y + +# Send debug messages to syslog instead of stdout +CONFIG_DEBUG_SYSLOG=y +# Set syslog facility for debug messages +CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON + +# Add support for sending all debug messages (regardless of debug verbosity) +# to the Linux kernel tracing facility. This helps debug the entire stack by +# making it easy to record everything happening from the driver up into the +# same file, e.g., using trace-cmd. +#CONFIG_DEBUG_LINUX_TRACING=y + +# Add support for writing debug log to Android logcat instead of standard +# output +#CONFIG_ANDROID_LOG=y + +# Enable privilege separation (see README 'Privilege separation' for details) +#CONFIG_PRIVSEP=y + +# Enable mitigation against certain attacks against TKIP by delaying Michael +# MIC error reports by a random amount of time between 0 and 60 seconds +#CONFIG_DELAYED_MIC_ERROR_REPORT=y + +# Enable tracing code for developer debugging +# This tracks use of memory allocations and other registrations and reports +# incorrect use with a backtrace of call (or allocation) location. +#CONFIG_WPA_TRACE=y +# For BSD, uncomment these. +#LIBS += -lexecinfo +#LIBS_p += -lexecinfo +#LIBS_c += -lexecinfo + +# Use libbfd to get more details for developer debugging +# This enables use of libbfd to get more detailed symbols for the backtraces +# generated by CONFIG_WPA_TRACE=y. +#CONFIG_WPA_TRACE_BFD=y +# For BSD, uncomment these. +#LIBS += -lbfd -liberty -lz +#LIBS_p += -lbfd -liberty -lz +#LIBS_c += -lbfd -liberty -lz + +# wpa_supplicant depends on strong random number generation being available +# from the operating system. os_get_random() function is used to fetch random +# data when needed, e.g., for key generation. On Linux and BSD systems, this +# works by reading /dev/urandom. It should be noted that the OS entropy pool +# needs to be properly initialized before wpa_supplicant is started. This is +# important especially on embedded devices that do not have a hardware random +# number generator and may by default start up with minimal entropy available +# for random number generation. +# +# As a safety net, wpa_supplicant is by default trying to internally collect +# additional entropy for generating random data to mix in with the data fetched +# from the OS. This by itself is not considered to be very strong, but it may +# help in cases where the system pool is not initialized properly. However, it +# is very strongly recommended that the system pool is initialized with enough +# entropy either by using hardware assisted random number generator or by +# storing state over device reboots. +# +# wpa_supplicant can be configured to maintain its own entropy store over +# restarts to enhance random number generation. This is not perfect, but it is +# much more secure than using the same sequence of random numbers after every +# reboot. This can be enabled with -e command line option. The +# specified file needs to be readable and writable by wpa_supplicant. +# +# If the os_get_random() is known to provide strong random data (e.g., on +# Linux/BSD, the board in question is known to have reliable source of random +# data from /dev/urandom), the internal wpa_supplicant random pool can be +# disabled. This will save some in binary size and CPU use. However, this +# should only be considered for builds that are known to be used on devices +# that meet the requirements described above. +CONFIG_NO_RANDOM_POOL=y + +# IEEE 802.11n (High Throughput) support (mainly for AP mode) +#CONFIG_IEEE80211N=y + +# IEEE 802.11ac (Very High Throughput) support (mainly for AP mode) +# (depends on CONFIG_IEEE80211N) +#CONFIG_IEEE80211AC=y + +# Wireless Network Management (IEEE Std 802.11v-2011) +# Note: This is experimental and not complete implementation. +#CONFIG_WNM=y + +# Interworking (IEEE 802.11u) +# This can be used to enable functionality to improve interworking with +# external networks (GAS/ANQP to learn more about the networks and network +# selection based on available credentials). +#CONFIG_INTERWORKING=y + +# Hotspot 2.0 +#CONFIG_HS20=y + +# Enable interface matching in wpa_supplicant +#CONFIG_MATCH_IFACE=y + +# Disable roaming in wpa_supplicant +#CONFIG_NO_ROAMING=y + +# AP mode operations with wpa_supplicant +# This can be used for controlling AP mode operations with wpa_supplicant. It +# should be noted that this is mainly aimed at simple cases like +# WPA2-Personal while more complex configurations like WPA2-Enterprise with an +# external RADIUS server can be supported with hostapd. +#CONFIG_AP=y + +# P2P (Wi-Fi Direct) +# This can be used to enable P2P support in wpa_supplicant. See README-P2P for +# more information on P2P operations. +#CONFIG_P2P=y + +# Enable TDLS support +#CONFIG_TDLS=y + +# Wi-Fi Direct +# This can be used to enable Wi-Fi Direct extensions for P2P using an external +# program to control the additional information exchanges in the messages. +#CONFIG_WIFI_DISPLAY=y + +# Autoscan +# This can be used to enable automatic scan support in wpa_supplicant. +# See wpa_supplicant.conf for more information on autoscan usage. +# +# Enabling directly a module will enable autoscan support. +# For exponential module: +#CONFIG_AUTOSCAN_EXPONENTIAL=y +# For periodic module: +#CONFIG_AUTOSCAN_PERIODIC=y + +# Password (and passphrase, etc.) backend for external storage +# These optional mechanisms can be used to add support for storing passwords +# and other secrets in external (to wpa_supplicant) location. This allows, for +# example, operating system specific key storage to be used +# +# External password backend for testing purposes (developer use) +#CONFIG_EXT_PASSWORD_TEST=y + +# Enable Fast Session Transfer (FST) +#CONFIG_FST=y + +# Enable CLI commands for FST testing +#CONFIG_FST_TEST=y + +# OS X builds. This is only for building eapol_test. +#CONFIG_OSX=y + +# Automatic Channel Selection +# This will allow wpa_supplicant to pick the channel automatically when channel +# is set to "0". +# +# TODO: Extend parser to be able to parse "channel=acs_survey" as an alternative +# to "channel=0". This would enable us to eventually add other ACS algorithms in +# similar way. +# +# Automatic selection is currently only done through initialization, later on +# we hope to do background checks to keep us moving to more ideal channels as +# time goes by. ACS is currently only supported through the nl80211 driver and +# your driver must have survey dump capability that is filled by the driver +# during scanning. +# +# TODO: In analogy to hostapd be able to customize the ACS survey algorithm with +# a newly to create wpa_supplicant.conf variable acs_num_scans. +# +# Supported ACS drivers: +# * ath9k +# * ath5k +# * ath10k +# +# For more details refer to: +# http://wireless.kernel.org/en/users/Documentation/acs +#CONFIG_ACS=y + +# Support Multi Band Operation +#CONFIG_MBO=y + +# Fast Initial Link Setup (FILS) (IEEE 802.11ai) +# Note: This is an experimental and not yet complete implementation. This +# should not be enabled for production use. +#CONFIG_FILS=y +# FILS shared key authentication with PFS +#CONFIG_FILS_SK_PFS=y + +# Support RSN on IBSS networks +# This is needed to be able to use mode=1 network profile with proto=RSN and +# key_mgmt=WPA-PSK (i.e., full key management instead of WPA-None). +#CONFIG_IBSS_RSN=y + +# External PMKSA cache control +# This can be used to enable control interface commands that allow the current +# PMKSA cache entries to be fetched and new entries to be added. +#CONFIG_PMKSA_CACHE_EXTERNAL=y + +# Mesh Networking (IEEE 802.11s) +#CONFIG_MESH=y + +# Background scanning modules +# These can be used to request wpa_supplicant to perform background scanning +# operations for roaming within an ESS (same SSID). See the bgscan parameter in +# the wpa_supplicant.conf file for more details. +# Periodic background scans based on signal strength +#CONFIG_BGSCAN_SIMPLE=y +# Learn channels used by the network and try to avoid bgscans on other +# channels (experimental) +#CONFIG_BGSCAN_LEARN=y + +# Opportunistic Wireless Encryption (OWE) +# Experimental implementation of draft-harkins-owe-07.txt +#CONFIG_OWE=y + +# uBus IPC/RPC System +# Services can connect to the bus and provide methods +# that can be called by other services or clients. +CONFIG_UBUS=y diff --git a/package/network/services/hostapd/files/wpa_supplicant-full.config b/package/network/services/hostapd/files/wpa_supplicant-full.config index c22e1cca5d..5f6e82f7b6 100644 --- a/package/network/services/hostapd/files/wpa_supplicant-full.config +++ b/package/network/services/hostapd/files/wpa_supplicant-full.config @@ -73,6 +73,12 @@ CONFIG_DRIVER_NL80211=y # Driver interface for wired Ethernet drivers CONFIG_DRIVER_WIRED=y +# Driver interface for MACsec capable Qualcomm Atheros drivers +#CONFIG_DRIVER_MACSEC_QCA=y + +# Driver interface for Linux MACsec drivers +#CONFIG_DRIVER_MACSEC_LINUX=y + # Driver interface for the Broadcom RoboSwitch family #CONFIG_DRIVER_ROBOSWITCH=y @@ -83,8 +89,8 @@ CONFIG_DRIVER_WIRED=y #LIBS += -lsocket -ldlpi -lnsl #LIBS_c += -lsocket -# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is -# included) +# Enable IEEE 802.1X Supplicant (automatically included if any EAP method or +# MACsec is included) CONFIG_IEEE8021X_EAPOL=y # EAP-MD5 @@ -166,6 +172,9 @@ CONFIG_WPS=y # EAP-EKE #CONFIG_EAP_EKE=y +# MACsec +#CONFIG_MACSEC=y + # PKCS#12 (PFX) support (used to read private key and certificate file from # a file that usually has extension .p12 or .pfx) CONFIG_PKCS12=y @@ -288,9 +297,6 @@ CONFIG_BACKEND=file # bridge interfaces (commit 'bridge: respect RFC2863 operational state')'). #CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y -# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) -CONFIG_PEERKEY=y - # IEEE 802.11w (management frame protection), also known as PMF # Driver support is also needed for IEEE 802.11w. #CONFIG_IEEE80211W=y @@ -378,17 +384,13 @@ CONFIG_INTERNAL_LIBTOMMATH_FAST=y # IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode CONFIG_IEEE80211R=y -# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies -# CONFIG_IEEE80211R). -#CONFIG_IEEE80211R_AP=y - # Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt) #CONFIG_DEBUG_FILE=y # Send debug messages to syslog instead of stdout -#CONFIG_DEBUG_SYSLOG=y +CONFIG_DEBUG_SYSLOG=y # Set syslog facility for debug messages -#CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON +CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON # Add support for sending all debug messages (regardless of debug verbosity) # to the Linux kernel tracing facility. This helps debug the entire stack by @@ -591,3 +593,8 @@ CONFIG_IBSS_RSN=y # Opportunistic Wireless Encryption (OWE) # Experimental implementation of draft-harkins-owe-07.txt #CONFIG_OWE=y + +# uBus IPC/RPC System +# Services can connect to the bus and provide methods +# that can be called by other services or clients. +CONFIG_UBUS=y diff --git a/package/network/services/hostapd/files/wpa_supplicant-mini.config b/package/network/services/hostapd/files/wpa_supplicant-mini.config index 3e088715c8..5e6f154105 100644 --- a/package/network/services/hostapd/files/wpa_supplicant-mini.config +++ b/package/network/services/hostapd/files/wpa_supplicant-mini.config @@ -73,6 +73,12 @@ CONFIG_DRIVER_NL80211=y # Driver interface for wired Ethernet drivers CONFIG_DRIVER_WIRED=y +# Driver interface for MACsec capable Qualcomm Atheros drivers +#CONFIG_DRIVER_MACSEC_QCA=y + +# Driver interface for Linux MACsec drivers +#CONFIG_DRIVER_MACSEC_LINUX=y + # Driver interface for the Broadcom RoboSwitch family #CONFIG_DRIVER_ROBOSWITCH=y @@ -83,8 +89,8 @@ CONFIG_DRIVER_WIRED=y #LIBS += -lsocket -ldlpi -lnsl #LIBS_c += -lsocket -# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is -# included) +# Enable IEEE 802.1X Supplicant (automatically included if any EAP method or +# MACsec is included) #CONFIG_IEEE8021X_EAPOL=y # EAP-MD5 @@ -166,6 +172,9 @@ CONFIG_DRIVER_WIRED=y # EAP-EKE #CONFIG_EAP_EKE=y +# MACsec +#CONFIG_MACSEC=y + # PKCS#12 (PFX) support (used to read private key and certificate file from # a file that usually has extension .p12 or .pfx) #CONFIG_PKCS12=y @@ -288,9 +297,6 @@ CONFIG_BACKEND=file # bridge interfaces (commit 'bridge: respect RFC2863 operational state')'). #CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y -# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) -#CONFIG_PEERKEY=y - # IEEE 802.11w (management frame protection), also known as PMF # Driver support is also needed for IEEE 802.11w. #CONFIG_IEEE80211W=y @@ -378,17 +384,13 @@ CONFIG_TLS=internal # IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode #CONFIG_IEEE80211R=y -# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies -# CONFIG_IEEE80211R). -#CONFIG_IEEE80211R_AP=y - # Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt) #CONFIG_DEBUG_FILE=y # Send debug messages to syslog instead of stdout -#CONFIG_DEBUG_SYSLOG=y +CONFIG_DEBUG_SYSLOG=y # Set syslog facility for debug messages -#CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON +CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON # Add support for sending all debug messages (regardless of debug verbosity) # to the Linux kernel tracing facility. This helps debug the entire stack by @@ -591,3 +593,8 @@ CONFIG_NO_RANDOM_POOL=y # Opportunistic Wireless Encryption (OWE) # Experimental implementation of draft-harkins-owe-07.txt #CONFIG_OWE=y + +# uBus IPC/RPC System +# Services can connect to the bus and provide methods +# that can be called by other services or clients. +CONFIG_UBUS=y diff --git a/package/network/services/hostapd/files/wpa_supplicant-p2p.config b/package/network/services/hostapd/files/wpa_supplicant-p2p.config index 420aebcf98..bbbb8e6e30 100644 --- a/package/network/services/hostapd/files/wpa_supplicant-p2p.config +++ b/package/network/services/hostapd/files/wpa_supplicant-p2p.config @@ -73,6 +73,12 @@ CONFIG_DRIVER_NL80211=y # Driver interface for wired Ethernet drivers CONFIG_DRIVER_WIRED=y +# Driver interface for MACsec capable Qualcomm Atheros drivers +#CONFIG_DRIVER_MACSEC_QCA=y + +# Driver interface for Linux MACsec drivers +#CONFIG_DRIVER_MACSEC_LINUX=y + # Driver interface for the Broadcom RoboSwitch family #CONFIG_DRIVER_ROBOSWITCH=y @@ -83,8 +89,8 @@ CONFIG_DRIVER_WIRED=y #LIBS += -lsocket -ldlpi -lnsl #LIBS_c += -lsocket -# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is -# included) +# Enable IEEE 802.1X Supplicant (automatically included if any EAP method or +# MACsec is included) CONFIG_IEEE8021X_EAPOL=y # EAP-MD5 @@ -166,6 +172,9 @@ CONFIG_WPS=y # EAP-EKE #CONFIG_EAP_EKE=y +# MACsec +#CONFIG_MACSEC=y + # PKCS#12 (PFX) support (used to read private key and certificate file from # a file that usually has extension .p12 or .pfx) CONFIG_PKCS12=y @@ -288,9 +297,6 @@ CONFIG_BACKEND=file # bridge interfaces (commit 'bridge: respect RFC2863 operational state')'). #CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y -# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) -CONFIG_PEERKEY=y - # IEEE 802.11w (management frame protection), also known as PMF # Driver support is also needed for IEEE 802.11w. CONFIG_IEEE80211W=y @@ -378,17 +384,13 @@ CONFIG_INTERNAL_LIBTOMMATH_FAST=y # IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode #CONFIG_IEEE80211R=y -# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies -# CONFIG_IEEE80211R). -#CONFIG_IEEE80211R_AP=y - # Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt) #CONFIG_DEBUG_FILE=y # Send debug messages to syslog instead of stdout -#CONFIG_DEBUG_SYSLOG=y +CONFIG_DEBUG_SYSLOG=y # Set syslog facility for debug messages -#CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON +CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON # Add support for sending all debug messages (regardless of debug verbosity) # to the Linux kernel tracing facility. This helps debug the entire stack by @@ -591,3 +593,8 @@ CONFIG_IBSS_RSN=y # Opportunistic Wireless Encryption (OWE) # Experimental implementation of draft-harkins-owe-07.txt #CONFIG_OWE=y + +# uBus IPC/RPC System +# Services can connect to the bus and provide methods +# that can be called by other services or clients. +CONFIG_UBUS=y diff --git a/package/network/services/hostapd/files/wps-hotplug.sh b/package/network/services/hostapd/files/wps-hotplug.sh old mode 100644 new mode 100755 index 24af80e55b..d00939d769 --- a/package/network/services/hostapd/files/wps-hotplug.sh +++ b/package/network/services/hostapd/files/wps-hotplug.sh @@ -1,11 +1,62 @@ #!/bin/sh -if [ "$ACTION" = "pressed" -a "$BUTTON" = "wps" ]; then - cd /var/run/hostapd - for socket in *; do - [ -S "$socket" ] || continue - hostapd_cli -i "$socket" wps_pbc +wps_catch_credentials() { + local iface ifaces ifc ifname ssid encryption key radio radios + local found=0 + + . /usr/share/libubox/jshn.sh + ubus -S -t 30 listen wps_credentials | while read creds; do + json_init + json_load "$creds" + json_select wps_credentials || continue + json_get_vars ifname ssid key encryption + local ifcname="$ifname" + json_init + json_load "$(ubus -S call network.wireless status)" + json_get_keys radios + for radio in $radios; do + json_select $radio + json_select interfaces + json_get_keys ifaces + for ifc in $ifaces; do + json_select $ifc + json_get_vars ifname + [ "$ifname" = "$ifcname" ] && { + ubus -S call uci set "{\"config\":\"wireless\", \"type\":\"wifi-iface\", \ + \"match\": { \"device\": \"$radio\", \"encryption\": \"wps\" }, \ + \"values\": { \"encryption\": \"$encryption\", \ + \"ssid\": \"$ssid\", \ + \"key\": \"$key\" } }" + ubus -S call uci commit '{"config": "wireless"}' + ubus -S call uci apply + } + json_select .. + done + json_select .. + json_select .. + done done +} + +if [ "$ACTION" = "pressed" -a "$BUTTON" = "wps" ]; then + wps_done=0 + ubusobjs="$( ubus -S list hostapd.* )" + for ubusobj in $ubusobjs; do + ubus -S call $ubusobj wps_start && wps_done=1 + done + [ $wps_done = 0 ] || return 0 + wps_done=0 + ubusobjs="$( ubus -S list wpa_supplicant.* )" + for ubusobj in $ubusobjs; do + ifname="$(echo $ubusobj | cut -d'.' -f2 )" + multi_ap="" + if [ -e "/var/run/wpa_supplicant-${ifname}.conf.is_multiap" ]; then + ubus -S call $ubusobj wps_start '{ "multi_ap": true }' && wps_done=1 + else + ubus -S call $ubusobj wps_start && wps_done=1 + fi + done + [ $wps_done = 0 ] || wps_catch_credentials & fi return 0 diff --git a/package/network/services/hostapd/patches/000-0001-Reduce-undesired-logging-of-ACL-rejection.patch b/package/network/services/hostapd/patches/000-0001-Reduce-undesired-logging-of-ACL-rejection.patch deleted file mode 100644 index 3fc80a01d7..0000000000 --- a/package/network/services/hostapd/patches/000-0001-Reduce-undesired-logging-of-ACL-rejection.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 6588f712220797c69dbd019daa19b82a50d92782 Mon Sep 17 00:00:00 2001 -From: Jouni Malinen -Date: Sun, 14 Oct 2018 19:57:22 +0300 -Subject: Reduce undesired logging of ACL rejection events from AP mode - -When Probe Request frame handling was extended to use MAC ACL through -ieee802_11_allowed_address(), the MSG_INFO level log print ("Station - not allowed to authenticate") from that function ended up getting -printed even for Probe Request frames. That was not by design and it can -result in excessive logging and MSG_INFO level if MAC ACL is used. - -Fix this by printing this log entry only for authentication and -association frames. In addition, drop the priority of that log entry to -MSG_DEBUG since this is not really an unexpected behavior in most MAC -ACL use cases. - -Fixes: 92eb00aec2a0 ("Extend ACL check for Probe Request frames") -Signed-off-by: Jouni Malinen ---- - src/ap/ieee802_11.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - ---- a/src/ap/ieee802_11.c -+++ b/src/ap/ieee802_11.c -@@ -1636,9 +1636,11 @@ ieee802_11_allowed_address(struct hostap - is_probe_req); - - if (res == HOSTAPD_ACL_REJECT) { -- wpa_printf(MSG_INFO, -- "Station " MACSTR " not allowed to authenticate", -- MAC2STR(addr)); -+ if (!is_probe_req) -+ wpa_printf(MSG_DEBUG, -+ "Station " MACSTR -+ " not allowed to authenticate", -+ MAC2STR(addr)); - return HOSTAPD_ACL_REJECT; - } - diff --git a/package/network/services/hostapd/patches/000-0002-Drop-logging-priority-for-handle_auth_cb.patch b/package/network/services/hostapd/patches/000-0002-Drop-logging-priority-for-handle_auth_cb.patch deleted file mode 100644 index 82165a94f9..0000000000 --- a/package/network/services/hostapd/patches/000-0002-Drop-logging-priority-for-handle_auth_cb.patch +++ /dev/null @@ -1,28 +0,0 @@ -From dc1b1c8db7905639be6f4de8173e2d97bf6df90d Mon Sep 17 00:00:00 2001 -From: Jouni Malinen -Date: Sun, 14 Oct 2018 20:03:55 +0300 -Subject: Drop logging priority for handle_auth_cb no-STA-match messages - -This message was printed and MSG_INFO level which would be more -reasonable for error cases where hostapd has accepted authentication. -However, this is not really an error case for the cases where -authentication was rejected (e.g., due to MAC ACL). Drop this to use -MSG_DEBUG level. - -Signed-off-by: Jouni Malinen ---- - src/ap/ieee802_11.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/src/ap/ieee802_11.c -+++ b/src/ap/ieee802_11.c -@@ -4018,7 +4018,8 @@ static void handle_auth_cb(struct hostap - - sta = ap_get_sta(hapd, mgmt->da); - if (!sta) { -- wpa_printf(MSG_INFO, "handle_auth_cb: STA " MACSTR " not found", -+ wpa_printf(MSG_DEBUG, "handle_auth_cb: STA " MACSTR -+ " not found", - MAC2STR(mgmt->da)); - return; - } diff --git a/package/network/services/hostapd/patches/0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch b/package/network/services/hostapd/patches/0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch deleted file mode 100644 index 633ab58623..0000000000 --- a/package/network/services/hostapd/patches/0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 3e34cfdff6b192fe337c6fb3f487f73e96582961 Mon Sep 17 00:00:00 2001 -From: Mathy Vanhoef -Date: Sun, 15 Jul 2018 01:25:53 +0200 -Subject: [PATCH] WPA: Ignore unauthenticated encrypted EAPOL-Key data - -Ignore unauthenticated encrypted EAPOL-Key data in supplicant -processing. When using WPA2, these are frames that have the Encrypted -flag set, but not the MIC flag. - -When using WPA2, EAPOL-Key frames that had the Encrypted flag set but -not the MIC flag, had their data field decrypted without first verifying -the MIC. In case the data field was encrypted using RC4 (i.e., when -negotiating TKIP as the pairwise cipher), this meant that -unauthenticated but decrypted data would then be processed. An adversary -could abuse this as a decryption oracle to recover sensitive information -in the data field of EAPOL-Key messages (e.g., the group key). -(CVE-2018-14526) - -Signed-off-by: Mathy Vanhoef ---- - src/rsn_supp/wpa.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - ---- a/src/rsn_supp/wpa.c -+++ b/src/rsn_supp/wpa.c -@@ -2208,6 +2208,17 @@ int wpa_sm_rx_eapol(struct wpa_sm *sm, c - - if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) && - (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) && mic_len) { -+ /* -+ * Only decrypt the Key Data field if the frame's authenticity -+ * was verified. When using AES-SIV (FILS), the MIC flag is not -+ * set, so this check should only be performed if mic_len != 0 -+ * which is the case in this code branch. -+ */ -+ if (!(key_info & WPA_KEY_INFO_MIC)) { -+ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, -+ "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data"); -+ goto out; -+ } - if (wpa_supplicant_decrypt_key_data(sm, key, mic_len, - ver, key_data, - &key_data_len)) diff --git a/package/network/services/hostapd/patches/001-mesh-factor-out-mesh-join-function.patch b/package/network/services/hostapd/patches/001-mesh-factor-out-mesh-join-function.patch index a1d668b283..de8d65b982 100644 --- a/package/network/services/hostapd/patches/001-mesh-factor-out-mesh-join-function.patch +++ b/package/network/services/hostapd/patches/001-mesh-factor-out-mesh-join-function.patch @@ -201,7 +201,7 @@ Signed-off-by: Peter Oh --- a/wpa_supplicant/wpa_supplicant_i.h +++ b/wpa_supplicant/wpa_supplicant_i.h -@@ -810,6 +810,7 @@ struct wpa_supplicant { +@@ -814,6 +814,7 @@ struct wpa_supplicant { unsigned int mesh_if_created:1; unsigned int mesh_ht_enabled:1; unsigned int mesh_vht_enabled:1; diff --git a/package/network/services/hostapd/patches/006-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch b/package/network/services/hostapd/patches/006-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch index fe2353cd81..5ec7aa0837 100644 --- a/package/network/services/hostapd/patches/006-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch +++ b/package/network/services/hostapd/patches/006-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch @@ -16,7 +16,7 @@ Signed-off-by: Peter Oh --- a/src/drivers/driver.h +++ b/src/drivers/driver.h -@@ -1390,6 +1390,7 @@ struct wpa_driver_mesh_join_params { +@@ -1402,6 +1402,7 @@ struct wpa_driver_mesh_join_params { #define WPA_DRIVER_MESH_FLAG_SAE_AUTH 0x00000004 #define WPA_DRIVER_MESH_FLAG_AMPE 0x00000008 unsigned int flags; @@ -26,7 +26,7 @@ Signed-off-by: Peter Oh /** --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -9270,6 +9270,9 @@ static int nl80211_join_mesh(struct i802 +@@ -9375,6 +9375,9 @@ static int nl80211_join_mesh(struct i802 wpa_printf(MSG_DEBUG, " * flags=%08X", params->flags); diff --git a/package/network/services/hostapd/patches/010-mesh-consider-mesh-interface-on-dfs-event-handler.patch b/package/network/services/hostapd/patches/010-mesh-consider-mesh-interface-on-dfs-event-handler.patch index 3f5178a74b..0c82d84d6b 100644 --- a/package/network/services/hostapd/patches/010-mesh-consider-mesh-interface-on-dfs-event-handler.patch +++ b/package/network/services/hostapd/patches/010-mesh-consider-mesh-interface-on-dfs-event-handler.patch @@ -15,7 +15,7 @@ Signed-off-by: Masashi Honma --- a/wpa_supplicant/ap.c +++ b/wpa_supplicant/ap.c -@@ -1337,13 +1337,18 @@ int ap_ctrl_iface_chanswitch(struct wpa_ +@@ -1379,13 +1379,18 @@ int ap_ctrl_iface_chanswitch(struct wpa_ void wpas_ap_ch_switch(struct wpa_supplicant *wpa_s, int freq, int ht, int offset, int width, int cf1, int cf2) { @@ -37,7 +37,7 @@ Signed-off-by: Masashi Honma offset, width, cf1, cf2); } -@@ -1540,10 +1545,16 @@ int wpas_ap_pmksa_cache_add_external(str +@@ -1582,10 +1587,16 @@ int wpas_ap_pmksa_cache_add_external(str void wpas_ap_event_dfs_radar_detected(struct wpa_supplicant *wpa_s, struct dfs_event *radar) { @@ -57,7 +57,7 @@ Signed-off-by: Masashi Honma radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); -@@ -1553,10 +1564,16 @@ void wpas_ap_event_dfs_radar_detected(st +@@ -1595,10 +1606,16 @@ void wpas_ap_event_dfs_radar_detected(st void wpas_ap_event_dfs_cac_started(struct wpa_supplicant *wpa_s, struct dfs_event *radar) { @@ -77,7 +77,7 @@ Signed-off-by: Masashi Honma radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } -@@ -1565,10 +1582,16 @@ void wpas_ap_event_dfs_cac_started(struc +@@ -1607,10 +1624,16 @@ void wpas_ap_event_dfs_cac_started(struc void wpas_ap_event_dfs_cac_finished(struct wpa_supplicant *wpa_s, struct dfs_event *radar) { @@ -97,7 +97,7 @@ Signed-off-by: Masashi Honma radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } -@@ -1577,10 +1600,16 @@ void wpas_ap_event_dfs_cac_finished(stru +@@ -1619,10 +1642,16 @@ void wpas_ap_event_dfs_cac_finished(stru void wpas_ap_event_dfs_cac_aborted(struct wpa_supplicant *wpa_s, struct dfs_event *radar) { @@ -117,7 +117,7 @@ Signed-off-by: Masashi Honma radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } -@@ -1589,10 +1618,16 @@ void wpas_ap_event_dfs_cac_aborted(struc +@@ -1631,10 +1660,16 @@ void wpas_ap_event_dfs_cac_aborted(struc void wpas_ap_event_dfs_cac_nop_finished(struct wpa_supplicant *wpa_s, struct dfs_event *radar) { @@ -139,7 +139,7 @@ Signed-off-by: Masashi Honma } --- a/wpa_supplicant/events.c +++ b/wpa_supplicant/events.c -@@ -3802,7 +3802,7 @@ static void wpas_event_dfs_cac_started(s +@@ -3840,7 +3840,7 @@ static void wpas_event_dfs_cac_started(s struct dfs_event *radar) { #if defined(NEED_AP_MLME) && defined(CONFIG_AP) @@ -148,7 +148,7 @@ Signed-off-by: Masashi Honma wpas_ap_event_dfs_cac_started(wpa_s, radar); } else #endif /* NEED_AP_MLME && CONFIG_AP */ -@@ -3823,7 +3823,7 @@ static void wpas_event_dfs_cac_finished( +@@ -3861,7 +3861,7 @@ static void wpas_event_dfs_cac_finished( struct dfs_event *radar) { #if defined(NEED_AP_MLME) && defined(CONFIG_AP) @@ -157,7 +157,7 @@ Signed-off-by: Masashi Honma wpas_ap_event_dfs_cac_finished(wpa_s, radar); } else #endif /* NEED_AP_MLME && CONFIG_AP */ -@@ -3839,7 +3839,7 @@ static void wpas_event_dfs_cac_aborted(s +@@ -3877,7 +3877,7 @@ static void wpas_event_dfs_cac_aborted(s struct dfs_event *radar) { #if defined(NEED_AP_MLME) && defined(CONFIG_AP) @@ -166,7 +166,7 @@ Signed-off-by: Masashi Honma wpas_ap_event_dfs_cac_aborted(wpa_s, radar); } else #endif /* NEED_AP_MLME && CONFIG_AP */ -@@ -4278,6 +4278,7 @@ void wpa_supplicant_event(void *ctx, enu +@@ -4328,6 +4328,7 @@ void wpa_supplicant_event(void *ctx, enu #ifdef CONFIG_AP if (wpa_s->current_ssid->mode == WPAS_MODE_AP || wpa_s->current_ssid->mode == WPAS_MODE_P2P_GO || diff --git a/package/network/services/hostapd/patches/011-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch b/package/network/services/hostapd/patches/011-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch index 2022bbbdd2..184b6e9e9d 100644 --- a/package/network/services/hostapd/patches/011-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch +++ b/package/network/services/hostapd/patches/011-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch @@ -1,7 +1,7 @@ -From ce3e491e445ebea9705e76ac7ee3d4841ace1cad Mon Sep 17 00:00:00 2001 +From bbaa6142eadf229334436fdbf51aa65bb819f771 Mon Sep 17 00:00:00 2001 From: Peter Oh -Date: Tue, 17 Apr 2018 21:55:08 -0700 -Subject: [PATCH 11/16] mesh: Allow DFS channels to be selected if dfs is +Date: Tue, 29 May 2018 14:39:15 -0700 +Subject: [PATCH 11/18] mesh: Allow DFS channels to be selected if dfs is enabled Note: DFS is assumed to be usable if a country code has been set @@ -14,7 +14,7 @@ Signed-off-by: Peter Oh --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2060,6 +2060,8 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2090,6 +2090,8 @@ void ibss_mesh_setup_freq(struct wpa_sup struct hostapd_freq_params vht_freq; int chwidth, seg0, seg1; u32 vht_caps = 0; @@ -23,7 +23,7 @@ Signed-off-by: Peter Oh freq->freq = ssid->frequency; -@@ -2136,8 +2138,11 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2166,8 +2168,11 @@ void ibss_mesh_setup_freq(struct wpa_sup return; /* Check primary channel flags */ @@ -36,7 +36,7 @@ Signed-off-by: Peter Oh #ifdef CONFIG_HT_OVERRIDES if (ssid->disable_ht40) -@@ -2163,8 +2168,11 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2193,8 +2198,11 @@ void ibss_mesh_setup_freq(struct wpa_sup return; /* Check secondary channel flags */ @@ -49,7 +49,7 @@ Signed-off-by: Peter Oh freq->channel = pri_chan->chan; -@@ -2254,8 +2262,11 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2284,8 +2292,11 @@ void ibss_mesh_setup_freq(struct wpa_sup return; /* Back to HT configuration if channel not usable */ @@ -62,7 +62,7 @@ Signed-off-by: Peter Oh } chwidth = VHT_CHANWIDTH_80MHZ; -@@ -2275,10 +2286,11 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2305,10 +2316,11 @@ void ibss_mesh_setup_freq(struct wpa_sup if (!chan) continue; diff --git a/package/network/services/hostapd/patches/012-mesh-allow-mesh-to-send-channel-switch-request.patch b/package/network/services/hostapd/patches/012-mesh-allow-mesh-to-send-channel-switch-request.patch deleted file mode 100644 index 793f4f5db1..0000000000 --- a/package/network/services/hostapd/patches/012-mesh-allow-mesh-to-send-channel-switch-request.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 4a8245ec2e9d48e464488477a3e7ed234009c216 Mon Sep 17 00:00:00 2001 -From: Peter Oh -Date: Tue, 29 May 2018 14:39:16 -0700 -Subject: [PATCH 12/18] mesh: allow mesh to send channel switch request - -add mesh type to nl80211 channel switch request, -so mesh is able to send the request to kernel drivers. - -Signed-off-by: Peter Oh ---- - src/drivers/driver_nl80211.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/src/drivers/driver_nl80211.c -+++ b/src/drivers/driver_nl80211.c -@@ -8685,7 +8685,8 @@ static int nl80211_switch_channel(void * - } - - if ((drv->nlmode != NL80211_IFTYPE_AP) && -- (drv->nlmode != NL80211_IFTYPE_P2P_GO)) -+ (drv->nlmode != NL80211_IFTYPE_P2P_GO) && -+ (drv->nlmode != NL80211_IFTYPE_MESH_POINT) ) - return -EOPNOTSUPP; - - /* diff --git a/package/network/services/hostapd/patches/014-mesh-do-not-allow-scan-result-to-swap-pri-sec.patch b/package/network/services/hostapd/patches/014-mesh-do-not-allow-scan-result-to-swap-pri-sec.patch index a6cb1b469c..afcbcbb0ad 100644 --- a/package/network/services/hostapd/patches/014-mesh-do-not-allow-scan-result-to-swap-pri-sec.patch +++ b/package/network/services/hostapd/patches/014-mesh-do-not-allow-scan-result-to-swap-pri-sec.patch @@ -1,7 +1,7 @@ -From cf2ba81fb307f3e87e13896f9dbf93c0c2a9eb92 Mon Sep 17 00:00:00 2001 +From f95897cef614fff710c31d9e478eacc85d6312d5 Mon Sep 17 00:00:00 2001 From: Peter Oh -Date: Tue, 17 Apr 2018 21:55:11 -0700 -Subject: [PATCH 14/16] mesh: do not allow scan result to swap pri/sec +Date: Tue, 29 May 2018 14:39:18 -0700 +Subject: [PATCH 14/18] mesh: do not allow scan result to swap pri/sec Swapping between primary and secondary channel will break mesh from joining, hence don't allow it. @@ -13,7 +13,7 @@ Signed-off-by: Peter Oh --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2185,7 +2185,7 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2215,7 +2215,7 @@ void ibss_mesh_setup_freq(struct wpa_sup } freq->sec_channel_offset = ht40; diff --git a/package/network/services/hostapd/patches/015-mesh-do-not-use-offchan-mgmt-tx-on-DFS.patch b/package/network/services/hostapd/patches/015-mesh-do-not-use-offchan-mgmt-tx-on-DFS.patch index 148e90d859..c921436925 100644 --- a/package/network/services/hostapd/patches/015-mesh-do-not-use-offchan-mgmt-tx-on-DFS.patch +++ b/package/network/services/hostapd/patches/015-mesh-do-not-use-offchan-mgmt-tx-on-DFS.patch @@ -14,7 +14,7 @@ Signed-off-by: Daniel Golle --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -7165,6 +7165,10 @@ static int wpa_driver_nl80211_send_actio +@@ -7268,6 +7268,10 @@ static int wpa_driver_nl80211_send_actio struct wpa_driver_nl80211_data *drv = bss->drv; int ret = -1; u8 *buf; @@ -25,7 +25,7 @@ Signed-off-by: Daniel Golle struct ieee80211_hdr *hdr; wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, " -@@ -7189,7 +7193,11 @@ static int wpa_driver_nl80211_send_actio +@@ -7292,7 +7296,11 @@ static int wpa_driver_nl80211_send_actio } else { os_memset(bss->rand_addr, 0, ETH_ALEN); } @@ -38,7 +38,7 @@ Signed-off-by: Daniel Golle if (is_ap_interface(drv->nlmode) && (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) || (int) freq == bss->freq || drv->device_ap_sme || -@@ -7201,7 +7209,7 @@ static int wpa_driver_nl80211_send_actio +@@ -7304,7 +7312,7 @@ static int wpa_driver_nl80211_send_actio ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf, 24 + data_len, &drv->send_action_cookie, diff --git a/package/network/services/hostapd/patches/018-mesh-make-forwarding-configurable.patch b/package/network/services/hostapd/patches/018-mesh-make-forwarding-configurable.patch index 682eb46503..2eb2d7de07 100644 --- a/package/network/services/hostapd/patches/018-mesh-make-forwarding-configurable.patch +++ b/package/network/services/hostapd/patches/018-mesh-make-forwarding-configurable.patch @@ -1,7 +1,7 @@ -From 9a01d7f21bd33725dc33325a437c3cc4185ee8bd Mon Sep 17 00:00:00 2001 +From 90fe6429624fc48bc0e5d2d7eeecb7498708b5e3 Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Wed, 18 Apr 2018 19:24:31 +0200 -Subject: [PATCH 16/16] mesh: make forwarding configurable +Subject: [PATCH 18/18] mesh: make forwarding configurable Allow mesh_fwding to be specified in a mesh bss config, pass that to the driver (only nl80211 implemented for now) and announce @@ -31,7 +31,7 @@ Signed-off-by: Daniel Golle }; #define MAX_STA_COUNT 2007 -@@ -624,6 +625,7 @@ struct hostapd_bss_config { +@@ -628,6 +629,7 @@ struct hostapd_bss_config { #define MESH_ENABLED BIT(0) int mesh; @@ -41,7 +41,7 @@ Signed-off-by: Daniel Golle --- a/src/drivers/driver.h +++ b/src/drivers/driver.h -@@ -1363,6 +1363,7 @@ struct wpa_driver_mesh_bss_params { +@@ -1375,6 +1375,7 @@ struct wpa_driver_mesh_bss_params { #define WPA_DRIVER_MESH_CONF_FLAG_MAX_PEER_LINKS 0x00000004 #define WPA_DRIVER_MESH_CONF_FLAG_HT_OP_MODE 0x00000008 #define WPA_DRIVER_MESH_CONF_FLAG_RSSI_THRESHOLD 0x00000010 @@ -49,7 +49,7 @@ Signed-off-by: Daniel Golle /* * TODO: Other mesh configuration parameters would go here. * See NL80211_MESHCONF_* for all the mesh config parameters. -@@ -1372,6 +1373,7 @@ struct wpa_driver_mesh_bss_params { +@@ -1384,6 +1385,7 @@ struct wpa_driver_mesh_bss_params { int peer_link_timeout; int max_peer_links; int rssi_threshold; @@ -59,7 +59,7 @@ Signed-off-by: Daniel Golle --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -9228,6 +9228,9 @@ static int nl80211_put_mesh_config(struc +@@ -9332,6 +9332,9 @@ static int nl80211_put_mesh_config(struc if (((params->flags & WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS) && nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, params->auto_plinks)) || @@ -71,7 +71,7 @@ Signed-off-by: Daniel Golle params->max_peer_links)) || --- a/wpa_supplicant/config.c +++ b/wpa_supplicant/config.c -@@ -2212,6 +2212,7 @@ static const struct parse_data ssid_fiel +@@ -2228,6 +2228,7 @@ static const struct parse_data ssid_fiel #ifdef CONFIG_MESH { INT_RANGE(mode, 0, 5) }, { INT_RANGE(no_auto_peer, 0, 1) }, @@ -79,7 +79,7 @@ Signed-off-by: Daniel Golle { INT_RANGE(mesh_rssi_threshold, -255, 1) }, #else /* CONFIG_MESH */ { INT_RANGE(mode, 0, 4) }, -@@ -2763,6 +2764,7 @@ void wpa_config_set_network_defaults(str +@@ -2779,6 +2780,7 @@ void wpa_config_set_network_defaults(str ssid->dot11MeshRetryTimeout = DEFAULT_MESH_RETRY_TIMEOUT; ssid->dot11MeshConfirmTimeout = DEFAULT_MESH_CONFIRM_TIMEOUT; ssid->dot11MeshHoldingTimeout = DEFAULT_MESH_HOLDING_TIMEOUT; @@ -87,7 +87,7 @@ Signed-off-by: Daniel Golle ssid->mesh_rssi_threshold = DEFAULT_MESH_RSSI_THRESHOLD; #endif /* CONFIG_MESH */ #ifdef CONFIG_HT_OVERRIDES -@@ -3978,6 +3980,7 @@ struct wpa_config * wpa_config_alloc_emp +@@ -3996,6 +3998,7 @@ struct wpa_config * wpa_config_alloc_emp config->user_mpm = DEFAULT_USER_MPM; config->max_peer_links = DEFAULT_MAX_PEER_LINKS; config->mesh_max_inactivity = DEFAULT_MESH_MAX_INACTIVITY; @@ -95,7 +95,7 @@ Signed-off-by: Daniel Golle config->dot11RSNASAERetransPeriod = DEFAULT_DOT11_RSNA_SAE_RETRANS_PERIOD; config->fast_reauth = DEFAULT_FAST_REAUTH; -@@ -4600,6 +4603,7 @@ static const struct global_parse_data gl +@@ -4618,6 +4621,7 @@ static const struct global_parse_data gl { INT(user_mpm), 0 }, { INT_RANGE(max_peer_links, 0, 255), 0 }, { INT(mesh_max_inactivity), 0 }, @@ -193,7 +193,7 @@ Signed-off-by: Daniel Golle wpa_msg(wpa_s, MSG_ERROR, "Failed to init mesh"); --- a/wpa_supplicant/mesh_mpm.c +++ b/wpa_supplicant/mesh_mpm.c -@@ -288,9 +288,9 @@ static void mesh_mpm_send_plink_action(s +@@ -289,9 +289,9 @@ static void mesh_mpm_send_plink_action(s info = (bss->num_plinks > 63 ? 63 : bss->num_plinks) << 1; /* TODO: Add Connected to Mesh Gate/AS subfields */ wpabuf_put_u8(buf, info); diff --git a/package/network/services/hostapd/patches/022-mesh-fix-crash-with-CONFIG_TAXONOMY-enabled.patch b/package/network/services/hostapd/patches/022-mesh-fix-crash-with-CONFIG_TAXONOMY-enabled.patch deleted file mode 100644 index 56554ef02f..0000000000 --- a/package/network/services/hostapd/patches/022-mesh-fix-crash-with-CONFIG_TAXONOMY-enabled.patch +++ /dev/null @@ -1,23 +0,0 @@ -From: Felix Fietkau -Date: Thu, 3 May 2018 12:34:31 +0200 -Subject: [PATCH] mesh: fix crash with CONFIG_TAXONOMY enabled - -wpa_s->ifmsh needs to be allocated using hostapd_alloc_iface() instead -of a direct call to os_zalloc, otherwise the linked list for station -taxonomy items remains uninitialized, leading to a crash on the first -attempt to traverse that list - -Signed-off-by: Felix Fietkau ---- - ---- a/wpa_supplicant/mesh.c -+++ b/wpa_supplicant/mesh.c -@@ -215,7 +215,7 @@ static int wpa_supplicant_mesh_init(stru - return 0; - } - -- wpa_s->ifmsh = ifmsh = os_zalloc(sizeof(*wpa_s->ifmsh)); -+ wpa_s->ifmsh = ifmsh = hostapd_alloc_iface(); - if (!ifmsh) - return -ENOMEM; - diff --git a/package/network/services/hostapd/patches/031-mesh-add-VHT_CHANWIDTH_USE_HT-to-max_oper_chwidth.patch b/package/network/services/hostapd/patches/031-mesh-add-VHT_CHANWIDTH_USE_HT-to-max_oper_chwidth.patch index 925a53818d..de64a59372 100644 --- a/package/network/services/hostapd/patches/031-mesh-add-VHT_CHANWIDTH_USE_HT-to-max_oper_chwidth.patch +++ b/package/network/services/hostapd/patches/031-mesh-add-VHT_CHANWIDTH_USE_HT-to-max_oper_chwidth.patch @@ -17,7 +17,7 @@ Signed-off-by: Peter Oh --- a/wpa_supplicant/config.c +++ b/wpa_supplicant/config.c -@@ -2802,6 +2802,7 @@ void wpa_config_set_network_defaults(str +@@ -2818,6 +2818,7 @@ void wpa_config_set_network_defaults(str ssid->mka_priority = DEFAULT_PRIO_NOT_KEY_SERVER; #endif /* CONFIG_MACSEC */ ssid->mac_addr = -1; @@ -37,7 +37,7 @@ Signed-off-by: Peter Oh struct dl_list list; --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2312,6 +2312,9 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2342,6 +2342,9 @@ void ibss_mesh_setup_freq(struct wpa_sup vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ; seg0 = 114; } diff --git a/package/network/services/hostapd/patches/032-mesh-implement-use-of-VHT20-config-in-mesh-mode.patch b/package/network/services/hostapd/patches/032-mesh-implement-use-of-VHT20-config-in-mesh-mode.patch index 083bdfe1d1..4691a79404 100644 --- a/package/network/services/hostapd/patches/032-mesh-implement-use-of-VHT20-config-in-mesh-mode.patch +++ b/package/network/services/hostapd/patches/032-mesh-implement-use-of-VHT20-config-in-mesh-mode.patch @@ -33,7 +33,7 @@ Signed-off-by: Peter Oh --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2144,9 +2144,15 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2174,9 +2174,15 @@ void ibss_mesh_setup_freq(struct wpa_sup if (!dfs_enabled) return; @@ -51,7 +51,7 @@ Signed-off-by: Peter Oh #endif /* CONFIG_HT_OVERRIDES */ /* Check/setup HT40+/HT40- */ -@@ -2174,8 +2180,6 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2204,8 +2210,6 @@ void ibss_mesh_setup_freq(struct wpa_sup if (!dfs_enabled) return; @@ -60,7 +60,7 @@ Signed-off-by: Peter Oh if (ht40 == -1) { if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS)) return; -@@ -2219,6 +2223,7 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2249,6 +2253,7 @@ void ibss_mesh_setup_freq(struct wpa_sup wpa_scan_results_free(scan_res); } @@ -68,7 +68,7 @@ Signed-off-by: Peter Oh wpa_printf(MSG_DEBUG, "IBSS/mesh: setup freq channel %d, sec_channel_offset %d", freq->channel, freq->sec_channel_offset); -@@ -2314,7 +2319,10 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2344,7 +2349,10 @@ void ibss_mesh_setup_freq(struct wpa_sup } } else if (ssid->max_oper_chwidth == VHT_CHANWIDTH_USE_HT) { chwidth = VHT_CHANWIDTH_USE_HT; diff --git a/package/network/services/hostapd/patches/033-mesh-fix-parsing-of-max_oper_chwidth.patch b/package/network/services/hostapd/patches/033-mesh-fix-parsing-of-max_oper_chwidth.patch deleted file mode 100644 index cb922ba1e2..0000000000 --- a/package/network/services/hostapd/patches/033-mesh-fix-parsing-of-max_oper_chwidth.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 444adf78eeb129e415d53fcb2fa2f05b6a69abdc Mon Sep 17 00:00:00 2001 -From: Sven Eckelmann -Date: Mon, 7 May 2018 15:24:29 +0200 -Subject: wpa_supplicant: Fix parsing of max_oper_chwidth - -The max_oper_chwidth is parsed in wpa_config_set as INT_RANGE (see -ssid_fields). The actual parsing for INT_RANGE is done by -wpa_config_parse_int which can only store the result as full integer. - -max_oper_chwidth is stored as u8 (a single byte) in wpa_ssid. This means -that on little endian systems, the least significant byte of the parsed -value are really stored in the max_oper_chwidth. But on big endian system, -the only most significant byte is stored as max_oper_chwidth. This means -that 0 is always stored because the provided range doesn't allow any other -value for systems with multi-byte-wide integers. - -This also means that for common systems with 4-byte-wide integers, the -remaining 3 bytes were written after the actual member of the struct. This -should not have influenced the behavior of succeeding members because these -bytes would have been part of the padding between the members on most -systems. - -Increasing its size to a full int fixes the write operations outside of the -member and allows to use the max_oper_chwidth setting on big endian -systems. - -Fixes: 0f29bc68d18e ("IBSS/mesh: Add support for VHT80P80 configuration") -Signed-off-by: Sven Eckelmann - -Forwarded: https://patchwork.ozlabs.org/patch/909751/ ---- - wpa_supplicant/config_ssid.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/wpa_supplicant/config_ssid.h -+++ b/wpa_supplicant/config_ssid.h -@@ -511,7 +511,7 @@ struct wpa_ssid { - - int vht; - -- u8 max_oper_chwidth; -+ int max_oper_chwidth; - - unsigned int vht_center_freq1; - unsigned int vht_center_freq2; diff --git a/package/network/services/hostapd/patches/040-FT-Fix-CONFIG_IEEE80211X-y-build-without-CONFIG_FILS.patch b/package/network/services/hostapd/patches/040-FT-Fix-CONFIG_IEEE80211X-y-build-without-CONFIG_FILS.patch new file mode 100644 index 0000000000..66ffd9e48b --- /dev/null +++ b/package/network/services/hostapd/patches/040-FT-Fix-CONFIG_IEEE80211X-y-build-without-CONFIG_FILS.patch @@ -0,0 +1,33 @@ +From f2973fa39d6109f0f34969e91551a98dc340d537 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Mon, 3 Dec 2018 12:00:26 +0200 +Subject: FT: Fix CONFIG_IEEE80211X=y build without CONFIG_FILS=y + +remove_ie() was defined within an ifdef CONFIG_FILS block while it is +now needed even without CONFIG_FILS=y. Remove the CONFIG_FILS condition +there. + +Fixes 8c41734e5de1 ("FT: Fix Reassociation Request IEs during FT protocol") +Signed-off-by: Jouni Malinen +--- + wpa_supplicant/sme.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/wpa_supplicant/sme.c ++++ b/wpa_supplicant/sme.c +@@ -1386,7 +1386,6 @@ void sme_event_auth(struct wpa_supplican + } + + +-#ifdef CONFIG_FILS + #ifdef CONFIG_IEEE80211R + static void remove_ie(u8 *buf, size_t *len, u8 eid) + { +@@ -1401,7 +1400,6 @@ static void remove_ie(u8 *buf, size_t *l + } + } + #endif /* CONFIG_IEEE80211R */ +-#endif /* CONFIG_FILS */ + + + void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode, diff --git a/package/network/services/hostapd/patches/051-wpa_supplicant-fix-race-condition-in-mesh-mpm-new-pe.patch b/package/network/services/hostapd/patches/051-wpa_supplicant-fix-race-condition-in-mesh-mpm-new-pe.patch new file mode 100644 index 0000000000..26842c97d5 --- /dev/null +++ b/package/network/services/hostapd/patches/051-wpa_supplicant-fix-race-condition-in-mesh-mpm-new-pe.patch @@ -0,0 +1,34 @@ +From: Felix Fietkau +Date: Tue, 12 Feb 2019 14:22:43 +0100 +Subject: [PATCH v2] wpa_supplicant: fix race condition in mesh mpm new peer + handling + +When wpa_supplicant receives another new peer event before the first one +has been processed, it tries to add a station to the driver a second time +(which fails) and then tears down the station entry until another event +comes in. +Fix this by only adding a station to the driver if it didn't exist already. + +Signed-off-by: Felix Fietkau +--- + +--- a/wpa_supplicant/mesh_mpm.c ++++ b/wpa_supplicant/mesh_mpm.c +@@ -663,11 +663,12 @@ static struct sta_info * mesh_mpm_add_pe + } + + sta = ap_get_sta(data, addr); +- if (!sta) { +- sta = ap_sta_add(data, addr); +- if (!sta) +- return NULL; +- } ++ if (sta) ++ return NULL; ++ ++ sta = ap_sta_add(data, addr); ++ if (!sta) ++ return NULL; + + /* Set WMM by default since Mesh STAs are QoS STAs */ + sta->flags |= WLAN_STA_WMM; diff --git a/package/network/services/hostapd/patches/060-0001-EAP-pwd-Move-EC-group-initialization-to-earlier-step.patch b/package/network/services/hostapd/patches/060-0001-EAP-pwd-Move-EC-group-initialization-to-earlier-step.patch deleted file mode 100644 index 6d35769e30..0000000000 --- a/package/network/services/hostapd/patches/060-0001-EAP-pwd-Move-EC-group-initialization-to-earlier-step.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 2a5c291881fa819325d0287d0763776edfcb1943 Mon Sep 17 00:00:00 2001 -From: Dan Harkins -Date: Fri, 25 May 2018 21:40:04 +0300 -Subject: [PATCH] EAP-pwd: Move EC group initialization to earlier step - -This is needed for adding support for salted passwords. - -Signed-off-by: Dan Harkins ---- - src/eap_common/eap_pwd_common.c | 32 +++++++++++++++++++++++--------- - src/eap_common/eap_pwd_common.h | 1 + - src/eap_peer/eap_pwd.c | 2 +- - src/eap_server/eap_server_pwd.c | 2 +- - 4 files changed, 26 insertions(+), 11 deletions(-) - ---- a/src/eap_common/eap_pwd_common.c -+++ b/src/eap_common/eap_pwd_common.c -@@ -81,6 +81,27 @@ static int eap_pwd_kdf(const u8 *key, si - } - - -+EAP_PWD_group * get_eap_pwd_group(u16 num) -+{ -+ EAP_PWD_group *grp; -+ -+ grp = os_zalloc(sizeof(EAP_PWD_group)); -+ if (!grp) -+ return NULL; -+ grp->group = crypto_ec_init(num); -+ if (!grp->group) { -+ wpa_printf(MSG_INFO, "EAP-pwd: unable to create EC group"); -+ os_free(grp); -+ return NULL; -+ } -+ -+ grp->group_num = num; -+ wpa_printf(MSG_INFO, "EAP-pwd: provisioned group %d", num); -+ -+ return grp; -+} -+ -+ - /* - * compute a "random" secret point on an elliptic curve based - * on the password and identities. -@@ -97,12 +118,8 @@ int compute_password_element(EAP_PWD_gro - size_t primebytelen, primebitlen; - struct crypto_bignum *x_candidate = NULL, *rnd = NULL, *cofactor = NULL; - -- grp->pwe = NULL; -- grp->group = crypto_ec_init(num); -- if (!grp->group) { -- wpa_printf(MSG_INFO, "EAP-pwd: unable to create EC group"); -- goto fail; -- } -+ if (grp->pwe) -+ return -1; - - cofactor = crypto_bignum_init(); - grp->pwe = crypto_ec_point_init(grp->group); -@@ -234,11 +251,8 @@ int compute_password_element(EAP_PWD_gro - break; - } - wpa_printf(MSG_DEBUG, "EAP-pwd: found a PWE in %d tries", ctr); -- grp->group_num = num; - if (0) { - fail: -- crypto_ec_deinit(grp->group); -- grp->group = NULL; - crypto_ec_point_deinit(grp->pwe, 1); - grp->pwe = NULL; - ret = 1; ---- a/src/eap_common/eap_pwd_common.h -+++ b/src/eap_common/eap_pwd_common.h -@@ -50,6 +50,7 @@ struct eap_pwd_id { - } STRUCT_PACKED; - - /* common routines */ -+EAP_PWD_group * get_eap_pwd_group(u16 num); - int compute_password_element(EAP_PWD_group *grp, u16 num, - const u8 *password, size_t password_len, - const u8 *id_server, size_t id_server_len, ---- a/src/eap_peer/eap_pwd.c -+++ b/src/eap_peer/eap_pwd.c -@@ -265,7 +265,7 @@ eap_pwd_perform_id_exchange(struct eap_s - wpa_hexdump_ascii(MSG_INFO, "EAP-PWD (peer): server sent id of", - data->id_server, data->id_server_len); - -- data->grp = os_zalloc(sizeof(EAP_PWD_group)); -+ data->grp = get_eap_pwd_group(data->group_num); - if (data->grp == NULL) { - wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for " - "group"); ---- a/src/eap_server/eap_server_pwd.c -+++ b/src/eap_server/eap_server_pwd.c -@@ -562,7 +562,7 @@ static void eap_pwd_process_id_resp(stru - wpa_hexdump_ascii(MSG_DEBUG, "EAP-PWD (server): peer sent id of", - data->id_peer, data->id_peer_len); - -- data->grp = os_zalloc(sizeof(EAP_PWD_group)); -+ data->grp = get_eap_pwd_group(data->group_num); - if (data->grp == NULL) { - wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for " - "group"); diff --git a/package/network/services/hostapd/patches/060-0002-EAP-pwd-Mask-timing-of-PWE-derivation.patch b/package/network/services/hostapd/patches/060-0002-EAP-pwd-Mask-timing-of-PWE-derivation.patch deleted file mode 100644 index 0a27abb9e9..0000000000 --- a/package/network/services/hostapd/patches/060-0002-EAP-pwd-Mask-timing-of-PWE-derivation.patch +++ /dev/null @@ -1,247 +0,0 @@ -From 22ac3dfebf7b25a3aae02f9b4f69025bb4173137 Mon Sep 17 00:00:00 2001 -From: Dan Harkins -Date: Fri, 25 May 2018 21:40:04 +0300 -Subject: [PATCH] EAP-pwd: Mask timing of PWE derivation - -Run through the hunting-and-pecking loop 40 times to mask the time -necessary to find PWE. The odds of PWE not being found in 40 loops is -roughly 1 in 1 trillion. - -Signed-off-by: Dan Harkins ---- - src/eap_common/eap_pwd_common.c | 171 ++++++++++++++++++++++++-------- - 1 file changed, 130 insertions(+), 41 deletions(-) - ---- a/src/eap_common/eap_pwd_common.c -+++ b/src/eap_common/eap_pwd_common.c -@@ -112,18 +112,25 @@ int compute_password_element(EAP_PWD_gro - const u8 *id_peer, size_t id_peer_len, - const u8 *token) - { -+ struct crypto_bignum *qr = NULL, *qnr = NULL, *one = NULL; -+ struct crypto_bignum *tmp1 = NULL, *tmp2 = NULL, *pm1 = NULL; - struct crypto_hash *hash; - unsigned char pwe_digest[SHA256_MAC_LEN], *prfbuf = NULL, ctr; -- int is_odd, ret = 0; -+ int is_odd, ret = 0, check, found = 0; - size_t primebytelen, primebitlen; - struct crypto_bignum *x_candidate = NULL, *rnd = NULL, *cofactor = NULL; -+ const struct crypto_bignum *prime; - - if (grp->pwe) - return -1; - -+ prime = crypto_ec_get_prime(grp->group); - cofactor = crypto_bignum_init(); - grp->pwe = crypto_ec_point_init(grp->group); -- if (!cofactor || !grp->pwe) { -+ tmp1 = crypto_bignum_init(); -+ pm1 = crypto_bignum_init(); -+ one = crypto_bignum_init_set((const u8 *) "\x01", 1); -+ if (!cofactor || !grp->pwe || !tmp1 || !pm1 || !one) { - wpa_printf(MSG_INFO, "EAP-pwd: unable to create bignums"); - goto fail; - } -@@ -140,15 +147,36 @@ int compute_password_element(EAP_PWD_gro - "buffer"); - goto fail; - } -+ if (crypto_bignum_sub(prime, one, pm1) < 0) -+ goto fail; -+ -+ /* get a random quadratic residue and nonresidue */ -+ while (!qr || !qnr) { -+ int res; -+ -+ if (crypto_bignum_rand(tmp1, prime) < 0) -+ goto fail; -+ res = crypto_bignum_legendre(tmp1, prime); -+ if (!qr && res == 1) { -+ qr = tmp1; -+ tmp1 = crypto_bignum_init(); -+ } else if (!qnr && res == -1) { -+ qnr = tmp1; -+ tmp1 = crypto_bignum_init(); -+ } -+ if (!tmp1) -+ goto fail; -+ } -+ - os_memset(prfbuf, 0, primebytelen); - ctr = 0; -- while (1) { -- if (ctr > 30) { -- wpa_printf(MSG_INFO, "EAP-pwd: unable to find random " -- "point on curve for group %d, something's " -- "fishy", num); -- goto fail; -- } -+ -+ /* -+ * Run through the hunting-and-pecking loop 40 times to mask the time -+ * necessary to find PWE. The odds of PWE not being found in 40 loops is -+ * roughly 1 in 1 trillion. -+ */ -+ while (ctr < 40) { - ctr++; - - /* -@@ -199,58 +227,113 @@ int compute_password_element(EAP_PWD_gro - x_candidate) < 0) - goto fail; - -- if (crypto_bignum_cmp(x_candidate, -- crypto_ec_get_prime(grp->group)) >= 0) -+ if (crypto_bignum_cmp(x_candidate, prime) >= 0) - continue; - - wpa_hexdump(MSG_DEBUG, "EAP-pwd: x_candidate", - prfbuf, primebytelen); - - /* -- * need to unambiguously identify the solution, if there is -- * one... -+ * compute y^2 using the equation of the curve -+ * -+ * y^2 = x^3 + ax + b - */ -- is_odd = crypto_bignum_is_odd(rnd); -+ tmp2 = crypto_ec_point_compute_y_sqr(grp->group, x_candidate); -+ if (!tmp2) -+ goto fail; - - /* -- * solve the quadratic equation, if it's not solvable then we -- * don't have a point -+ * mask tmp2 so doing legendre won't leak timing info -+ * -+ * tmp1 is a random number between 1 and p-1 - */ -- if (crypto_ec_point_solve_y_coord(grp->group, grp->pwe, -- x_candidate, is_odd) != 0) { -- wpa_printf(MSG_INFO, "EAP-pwd: Could not solve for y"); -- continue; -- } -+ if (crypto_bignum_rand(tmp1, pm1) < 0 || -+ crypto_bignum_mulmod(tmp2, tmp1, prime, tmp2) < 0 || -+ crypto_bignum_mulmod(tmp2, tmp1, prime, tmp2) < 0) -+ goto fail; -+ - /* -- * If there's a solution to the equation then the point must be -- * on the curve so why check again explicitly? OpenSSL code -- * says this is required by X9.62. We're not X9.62 but it can't -- * hurt just to be sure. -+ * Now tmp2 (y^2) is masked, all values between 1 and p-1 -+ * are equally probable. Multiplying by r^2 does not change -+ * whether or not tmp2 is a quadratic residue, just masks it. -+ * -+ * Flip a coin, multiply by the random quadratic residue or the -+ * random quadratic nonresidue and record heads or tails. - */ -- if (!crypto_ec_point_is_on_curve(grp->group, grp->pwe)) { -- wpa_printf(MSG_INFO, "EAP-pwd: point is not on curve"); -- continue; -+ if (crypto_bignum_is_odd(tmp1)) { -+ crypto_bignum_mulmod(tmp2, qr, prime, tmp2); -+ check = 1; -+ } else { -+ crypto_bignum_mulmod(tmp2, qnr, prime, tmp2); -+ check = -1; - } - -- if (!crypto_bignum_is_one(cofactor)) { -- /* make sure the point is not in a small sub-group */ -- if (crypto_ec_point_mul(grp->group, grp->pwe, -- cofactor, grp->pwe) != 0) { -- wpa_printf(MSG_INFO, "EAP-pwd: cannot " -- "multiply generator by order"); -+ /* -+ * Now it's safe to do legendre, if check is 1 then it's -+ * a straightforward test (multiplying by qr does not -+ * change result), if check is -1 then it's the opposite test -+ * (multiplying a qr by qnr would make a qnr). -+ */ -+ if (crypto_bignum_legendre(tmp2, prime) == check) { -+ if (found == 1) -+ continue; -+ -+ /* need to unambiguously identify the solution */ -+ is_odd = crypto_bignum_is_odd(rnd); -+ -+ /* -+ * We know x_candidate is a quadratic residue so set -+ * it here. -+ */ -+ if (crypto_ec_point_solve_y_coord(grp->group, grp->pwe, -+ x_candidate, -+ is_odd) != 0) { -+ wpa_printf(MSG_INFO, -+ "EAP-pwd: Could not solve for y"); - continue; - } -- if (crypto_ec_point_is_at_infinity(grp->group, -- grp->pwe)) { -- wpa_printf(MSG_INFO, "EAP-pwd: point is at " -- "infinity"); -+ -+ /* -+ * If there's a solution to the equation then the point -+ * must be on the curve so why check again explicitly? -+ * OpenSSL code says this is required by X9.62. We're -+ * not X9.62 but it can't hurt just to be sure. -+ */ -+ if (!crypto_ec_point_is_on_curve(grp->group, -+ grp->pwe)) { -+ wpa_printf(MSG_INFO, -+ "EAP-pwd: point is not on curve"); - continue; - } -+ -+ if (!crypto_bignum_is_one(cofactor)) { -+ /* make sure the point is not in a small -+ * sub-group */ -+ if (crypto_ec_point_mul(grp->group, grp->pwe, -+ cofactor, -+ grp->pwe) != 0) { -+ wpa_printf(MSG_INFO, -+ "EAP-pwd: cannot multiply generator by order"); -+ continue; -+ } -+ if (crypto_ec_point_is_at_infinity(grp->group, -+ grp->pwe)) { -+ wpa_printf(MSG_INFO, -+ "EAP-pwd: point is at infinity"); -+ continue; -+ } -+ } -+ wpa_printf(MSG_DEBUG, -+ "EAP-pwd: found a PWE in %d tries", ctr); -+ found = 1; - } -- /* if we got here then we have a new generator. */ -- break; - } -- wpa_printf(MSG_DEBUG, "EAP-pwd: found a PWE in %d tries", ctr); -+ if (found == 0) { -+ wpa_printf(MSG_INFO, -+ "EAP-pwd: unable to find random point on curve for group %d, something's fishy", -+ num); -+ goto fail; -+ } - if (0) { - fail: - crypto_ec_point_deinit(grp->pwe, 1); -@@ -261,6 +344,12 @@ int compute_password_element(EAP_PWD_gro - crypto_bignum_deinit(cofactor, 1); - crypto_bignum_deinit(x_candidate, 1); - crypto_bignum_deinit(rnd, 1); -+ crypto_bignum_deinit(pm1, 0); -+ crypto_bignum_deinit(tmp1, 1); -+ crypto_bignum_deinit(tmp2, 1); -+ crypto_bignum_deinit(qr, 1); -+ crypto_bignum_deinit(qnr, 1); -+ crypto_bignum_deinit(one, 0); - os_free(prfbuf); - - return ret; diff --git a/package/network/services/hostapd/patches/061-0001-OpenSSL-Use-constant-time-operations-for-private-big.patch b/package/network/services/hostapd/patches/061-0001-OpenSSL-Use-constant-time-operations-for-private-big.patch index 8e6a8cfec3..7a73b09ff9 100644 --- a/package/network/services/hostapd/patches/061-0001-OpenSSL-Use-constant-time-operations-for-private-big.patch +++ b/package/network/services/hostapd/patches/061-0001-OpenSSL-Use-constant-time-operations-for-private-big.patch @@ -31,7 +31,7 @@ Signed-off-by: Jouni Malinen --- a/src/crypto/crypto_openssl.c +++ b/src/crypto/crypto_openssl.c -@@ -548,7 +548,8 @@ int crypto_mod_exp(const u8 *base, size_ +@@ -549,7 +549,8 @@ int crypto_mod_exp(const u8 *base, size_ bn_result == NULL) goto error; @@ -41,7 +41,7 @@ Signed-off-by: Jouni Malinen goto error; *result_len = BN_bn2bin(bn_result, result); -@@ -1294,8 +1295,9 @@ int crypto_bignum_exptmod(const struct c +@@ -1295,8 +1296,9 @@ int crypto_bignum_exptmod(const struct c bnctx = BN_CTX_new(); if (bnctx == NULL) return -1; @@ -53,7 +53,7 @@ Signed-off-by: Jouni Malinen BN_CTX_free(bnctx); return res ? 0 : -1; -@@ -1314,6 +1316,11 @@ int crypto_bignum_inverse(const struct c +@@ -1315,6 +1317,11 @@ int crypto_bignum_inverse(const struct c bnctx = BN_CTX_new(); if (bnctx == NULL) return -1; @@ -65,7 +65,7 @@ Signed-off-by: Jouni Malinen res = BN_mod_inverse((BIGNUM *) c, (const BIGNUM *) a, (const BIGNUM *) b, bnctx); BN_CTX_free(bnctx); -@@ -1347,6 +1354,9 @@ int crypto_bignum_div(const struct crypt +@@ -1348,6 +1355,9 @@ int crypto_bignum_div(const struct crypt bnctx = BN_CTX_new(); if (bnctx == NULL) return -1; @@ -75,7 +75,7 @@ Signed-off-by: Jouni Malinen res = BN_div((BIGNUM *) c, NULL, (const BIGNUM *) a, (const BIGNUM *) b, bnctx); BN_CTX_free(bnctx); -@@ -1438,8 +1448,8 @@ int crypto_bignum_legendre(const struct +@@ -1439,8 +1449,8 @@ int crypto_bignum_legendre(const struct /* exp = (p-1) / 2 */ !BN_sub(exp, (const BIGNUM *) p, BN_value_one()) || !BN_rshift1(exp, exp) || diff --git a/package/network/services/hostapd/patches/061-0003-OpenSSL-Use-constant-time-selection-for-crypto_bignu.patch b/package/network/services/hostapd/patches/061-0003-OpenSSL-Use-constant-time-selection-for-crypto_bignu.patch index 003985bdd2..0d89b46cb3 100644 --- a/package/network/services/hostapd/patches/061-0003-OpenSSL-Use-constant-time-selection-for-crypto_bignu.patch +++ b/package/network/services/hostapd/patches/061-0003-OpenSSL-Use-constant-time-selection-for-crypto_bignu.patch @@ -25,7 +25,7 @@ Signed-off-by: Jouni Malinen #include "wpabuf.h" #include "dh_group5.h" #include "sha1.h" -@@ -1434,6 +1435,7 @@ int crypto_bignum_legendre(const struct +@@ -1435,6 +1436,7 @@ int crypto_bignum_legendre(const struct BN_CTX *bnctx; BIGNUM *exp = NULL, *tmp = NULL; int res = -2; @@ -33,7 +33,7 @@ Signed-off-by: Jouni Malinen if (TEST_FAIL()) return -2; -@@ -1452,12 +1454,13 @@ int crypto_bignum_legendre(const struct +@@ -1453,12 +1455,13 @@ int crypto_bignum_legendre(const struct (const BIGNUM *) p, bnctx, NULL)) goto fail; diff --git a/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch b/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch index 5e0d0d2078..8ecb5fd502 100644 --- a/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch +++ b/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch @@ -24,7 +24,7 @@ Signed-off-by: Mathy Vanhoef --- a/src/eap_server/eap_server_pwd.c +++ b/src/eap_server/eap_server_pwd.c -@@ -653,6 +653,26 @@ eap_pwd_process_commit_resp(struct eap_s +@@ -718,6 +718,26 @@ eap_pwd_process_commit_resp(struct eap_s goto fin; } diff --git a/package/network/services/hostapd/patches/064-0012-EAP-pwd-server-Detect-reflection-attacks.patch b/package/network/services/hostapd/patches/064-0012-EAP-pwd-server-Detect-reflection-attacks.patch index 340b23395f..44949cb24d 100644 --- a/package/network/services/hostapd/patches/064-0012-EAP-pwd-server-Detect-reflection-attacks.patch +++ b/package/network/services/hostapd/patches/064-0012-EAP-pwd-server-Detect-reflection-attacks.patch @@ -22,7 +22,7 @@ Signed-off-by: Mathy Vanhoef --- a/src/eap_server/eap_server_pwd.c +++ b/src/eap_server/eap_server_pwd.c -@@ -688,6 +688,15 @@ eap_pwd_process_commit_resp(struct eap_s +@@ -753,6 +753,15 @@ eap_pwd_process_commit_resp(struct eap_s } } diff --git a/package/network/services/hostapd/patches/064-0013-EAP-pwd-client-Verify-received-scalar-and-element.patch b/package/network/services/hostapd/patches/064-0013-EAP-pwd-client-Verify-received-scalar-and-element.patch index f20b491306..9c7707ae3f 100644 --- a/package/network/services/hostapd/patches/064-0013-EAP-pwd-client-Verify-received-scalar-and-element.patch +++ b/package/network/services/hostapd/patches/064-0013-EAP-pwd-client-Verify-received-scalar-and-element.patch @@ -24,7 +24,7 @@ Signed-off-by: Mathy Vanhoef --- a/src/eap_peer/eap_pwd.c +++ b/src/eap_peer/eap_pwd.c -@@ -436,6 +436,26 @@ eap_pwd_perform_commit_exchange(struct e +@@ -594,6 +594,26 @@ eap_pwd_perform_commit_exchange(struct e goto fin; } diff --git a/package/network/services/hostapd/patches/064-0014-EAP-pwd-Check-element-x-y-coordinates-explicitly.patch b/package/network/services/hostapd/patches/064-0014-EAP-pwd-Check-element-x-y-coordinates-explicitly.patch index 17984312ff..ab1edfaffc 100644 --- a/package/network/services/hostapd/patches/064-0014-EAP-pwd-Check-element-x-y-coordinates-explicitly.patch +++ b/package/network/services/hostapd/patches/064-0014-EAP-pwd-Check-element-x-y-coordinates-explicitly.patch @@ -135,7 +135,7 @@ Signed-off-by: Jouni Malinen +} --- a/src/eap_common/eap_pwd_common.h +++ b/src/eap_common/eap_pwd_common.h -@@ -64,5 +64,8 @@ int compute_keys(EAP_PWD_group *grp, con +@@ -67,5 +67,8 @@ int compute_keys(EAP_PWD_group *grp, con struct crypto_hash * eap_pwd_h_init(void); void eap_pwd_h_update(struct crypto_hash *hash, const u8 *data, size_t len); void eap_pwd_h_final(struct crypto_hash *hash, u8 *digest); @@ -146,16 +146,16 @@ Signed-off-by: Jouni Malinen #endif /* EAP_PWD_COMMON_H */ --- a/src/eap_peer/eap_pwd.c +++ b/src/eap_peer/eap_pwd.c -@@ -344,7 +344,7 @@ eap_pwd_perform_commit_exchange(struct e +@@ -308,7 +308,7 @@ eap_pwd_perform_commit_exchange(struct e const struct wpabuf *reqData, const u8 *payload, size_t payload_len) { - struct crypto_ec_point *K = NULL, *point = NULL; + struct crypto_ec_point *K = NULL; struct crypto_bignum *mask = NULL, *cofactor = NULL; - const u8 *ptr; + const u8 *ptr = payload; u8 *scalar = NULL, *element = NULL; -@@ -413,8 +413,7 @@ eap_pwd_perform_commit_exchange(struct e +@@ -572,63 +572,27 @@ eap_pwd_perform_commit_exchange(struct e /* process the request */ data->k = crypto_bignum_init(); K = crypto_ec_point_init(data->grp->group); @@ -165,10 +165,9 @@ Signed-off-by: Jouni Malinen wpa_printf(MSG_INFO, "EAP-PWD (peer): peer data allocation " "fail"); goto fin; -@@ -422,55 +421,20 @@ eap_pwd_perform_commit_exchange(struct e + } /* element, x then y, followed by scalar */ - ptr = payload; - data->server_element = crypto_ec_point_from_bin(data->grp->group, ptr); + data->server_element = eap_pwd_get_element(data->grp, ptr); if (!data->server_element) { @@ -223,7 +222,7 @@ Signed-off-by: Jouni Malinen /* compute the shared key, k */ if (crypto_ec_point_mul(data->grp->group, data->grp->pwe, data->server_scalar, K) < 0 || -@@ -544,7 +508,6 @@ fin: +@@ -702,7 +666,6 @@ fin: crypto_bignum_deinit(mask, 1); crypto_bignum_deinit(cofactor, 1); crypto_ec_point_deinit(K, 1); @@ -233,7 +232,7 @@ Signed-off-by: Jouni Malinen else --- a/src/eap_server/eap_server_pwd.c +++ b/src/eap_server/eap_server_pwd.c -@@ -604,7 +604,7 @@ eap_pwd_process_commit_resp(struct eap_s +@@ -669,7 +669,7 @@ eap_pwd_process_commit_resp(struct eap_s { const u8 *ptr; struct crypto_bignum *cofactor = NULL; @@ -242,7 +241,7 @@ Signed-off-by: Jouni Malinen int res = 0; size_t prime_len, order_len; -@@ -623,9 +623,8 @@ eap_pwd_process_commit_resp(struct eap_s +@@ -688,9 +688,8 @@ eap_pwd_process_commit_resp(struct eap_s data->k = crypto_bignum_init(); cofactor = crypto_bignum_init(); @@ -253,7 +252,7 @@ Signed-off-by: Jouni Malinen wpa_printf(MSG_INFO, "EAP-PWD (server): peer data allocation " "fail"); goto fin; -@@ -639,55 +638,20 @@ eap_pwd_process_commit_resp(struct eap_s +@@ -704,55 +703,20 @@ eap_pwd_process_commit_resp(struct eap_s /* element, x then y, followed by scalar */ ptr = payload; @@ -311,7 +310,7 @@ Signed-off-by: Jouni Malinen /* detect reflection attacks */ if (crypto_bignum_cmp(data->my_scalar, data->peer_scalar) == 0 || crypto_ec_point_cmp(data->grp->group, data->my_element, -@@ -739,7 +703,6 @@ eap_pwd_process_commit_resp(struct eap_s +@@ -804,7 +768,6 @@ eap_pwd_process_commit_resp(struct eap_s fin: crypto_ec_point_deinit(K, 1); diff --git a/package/network/services/hostapd/patches/065-0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch b/package/network/services/hostapd/patches/065-0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch deleted file mode 100644 index 9ceb8d7098..0000000000 --- a/package/network/services/hostapd/patches/065-0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch +++ /dev/null @@ -1,40 +0,0 @@ -From fe76f487e28bdc61940f304f153a954cf36935ea Mon Sep 17 00:00:00 2001 -From: Jouni Malinen -Date: Wed, 17 Apr 2019 01:55:32 +0300 -Subject: [PATCH 1/3] EAP-pwd server: Fix reassembly buffer handling - -data->inbuf allocation might fail and if that were to happen, the next -fragment in the exchange could have resulted in NULL pointer -dereference. Unexpected fragment with more bit might also be able to -trigger this. Fix that by explicitly checking for data->inbuf to be -available before using it. - -Signed-off-by: Jouni Malinen ---- - src/eap_server/eap_server_pwd.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - ---- a/src/eap_server/eap_server_pwd.c -+++ b/src/eap_server/eap_server_pwd.c -@@ -882,6 +882,12 @@ static void eap_pwd_process(struct eap_s - * the first and all intermediate fragments have the M bit set - */ - if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { -+ if (!data->inbuf) { -+ wpa_printf(MSG_DEBUG, -+ "EAP-pwd: No buffer for reassembly"); -+ eap_pwd_state(data, FAILURE); -+ return; -+ } - if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) { - wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow " - "attack detected! (%d+%d > %d)", -@@ -902,7 +908,7 @@ static void eap_pwd_process(struct eap_s - * last fragment won't have the M bit set (but we're obviously - * buffering fragments so that's how we know it's the last) - */ -- if (data->in_frag_pos) { -+ if (data->in_frag_pos && data->inbuf) { - pos = wpabuf_head_u8(data->inbuf); - len = data->in_frag_pos; - wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", diff --git a/package/network/services/hostapd/patches/065-0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch b/package/network/services/hostapd/patches/065-0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch deleted file mode 100644 index b62420da37..0000000000 --- a/package/network/services/hostapd/patches/065-0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch +++ /dev/null @@ -1,40 +0,0 @@ -From d2d1a324ce937628e4d9d9999fe113819b7d4478 Mon Sep 17 00:00:00 2001 -From: Jouni Malinen -Date: Wed, 17 Apr 2019 02:21:20 +0300 -Subject: [PATCH 3/3] EAP-pwd peer: Fix reassembly buffer handling - -Unexpected fragment might result in data->inbuf not being allocated -before processing and that could have resulted in NULL pointer -dereference. Fix that by explicitly checking for data->inbuf to be -available before using it. - -Signed-off-by: Jouni Malinen ---- - src/eap_peer/eap_pwd.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - ---- a/src/eap_peer/eap_pwd.c -+++ b/src/eap_peer/eap_pwd.c -@@ -805,6 +805,13 @@ eap_pwd_process(struct eap_sm *sm, void - * buffer and ACK the fragment - */ - if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { -+ if (!data->inbuf) { -+ wpa_printf(MSG_DEBUG, -+ "EAP-pwd: No buffer for reassembly"); -+ ret->methodState = METHOD_DONE; -+ ret->decision = DECISION_FAIL; -+ return NULL; -+ } - data->in_frag_pos += len; - if (data->in_frag_pos > wpabuf_size(data->inbuf)) { - wpa_printf(MSG_INFO, "EAP-pwd: Buffer overflow attack " -@@ -831,7 +838,7 @@ eap_pwd_process(struct eap_sm *sm, void - /* - * we're buffering and this is the last fragment - */ -- if (data->in_frag_pos) { -+ if (data->in_frag_pos && data->inbuf) { - wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", - (int) len); - pos = wpabuf_head_u8(data->inbuf); diff --git a/package/network/services/hostapd/patches/110-no_eapol_fix.patch b/package/network/services/hostapd/patches/110-no_eapol_fix.patch index ac53cbc92d..2a9c5ec807 100644 --- a/package/network/services/hostapd/patches/110-no_eapol_fix.patch +++ b/package/network/services/hostapd/patches/110-no_eapol_fix.patch @@ -1,6 +1,6 @@ --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -292,9 +292,10 @@ void wpa_supplicant_cancel_auth_timeout( +@@ -295,9 +295,10 @@ void wpa_supplicant_cancel_auth_timeout( */ void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s) { diff --git a/package/network/services/hostapd/patches/200-multicall.patch b/package/network/services/hostapd/patches/200-multicall.patch index 273af644c6..9c7936695a 100644 --- a/package/network/services/hostapd/patches/200-multicall.patch +++ b/package/network/services/hostapd/patches/200-multicall.patch @@ -156,7 +156,7 @@ wpa_cli.exe: wpa_cli --- a/src/drivers/driver.h +++ b/src/drivers/driver.h -@@ -5449,8 +5449,8 @@ union wpa_event_data { +@@ -5476,8 +5476,8 @@ union wpa_event_data { * Driver wrapper code should call this function whenever an event is received * from the driver. */ @@ -167,7 +167,7 @@ /** * wpa_supplicant_event_global - Report a driver event for wpa_supplicant -@@ -5462,7 +5462,7 @@ void wpa_supplicant_event(void *ctx, enu +@@ -5489,7 +5489,7 @@ void wpa_supplicant_event(void *ctx, enu * Same as wpa_supplicant_event(), but we search for the interface in * wpa_global. */ @@ -178,7 +178,7 @@ /* --- a/src/ap/drv_callbacks.c +++ b/src/ap/drv_callbacks.c -@@ -1515,8 +1515,8 @@ static void hostapd_event_wds_sta_interf +@@ -1527,8 +1527,8 @@ static void hostapd_event_wds_sta_interf } @@ -189,7 +189,7 @@ { struct hostapd_data *hapd = ctx; #ifndef CONFIG_NO_STDOUT_DEBUG -@@ -1742,7 +1742,7 @@ void wpa_supplicant_event(void *ctx, enu +@@ -1757,7 +1757,7 @@ void wpa_supplicant_event(void *ctx, enu } @@ -231,7 +231,7 @@ os_memset(&global, 0, sizeof(global)); --- a/wpa_supplicant/events.c +++ b/wpa_supplicant/events.c -@@ -3976,8 +3976,8 @@ static void wpas_event_assoc_reject(stru +@@ -4026,8 +4026,8 @@ static void wpas_event_assoc_reject(stru } @@ -242,7 +242,7 @@ { struct wpa_supplicant *wpa_s = ctx; int resched; -@@ -4745,7 +4745,7 @@ void wpa_supplicant_event(void *ctx, enu +@@ -4796,7 +4796,7 @@ void wpa_supplicant_event(void *ctx, enu } @@ -253,7 +253,7 @@ struct wpa_supplicant *wpa_s; --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -5797,7 +5797,6 @@ struct wpa_interface * wpa_supplicant_ma +@@ -5861,7 +5861,6 @@ struct wpa_interface * wpa_supplicant_ma return NULL; } @@ -261,7 +261,7 @@ /** * wpa_supplicant_match_existing - Match existing interfaces * @global: Pointer to global data from wpa_supplicant_init() -@@ -5834,6 +5833,11 @@ static int wpa_supplicant_match_existing +@@ -5898,6 +5897,11 @@ static int wpa_supplicant_match_existing #endif /* CONFIG_MATCH_IFACE */ @@ -273,7 +273,7 @@ /** * wpa_supplicant_add_iface - Add a new network interface -@@ -6090,6 +6094,8 @@ struct wpa_global * wpa_supplicant_init( +@@ -6154,6 +6158,8 @@ struct wpa_global * wpa_supplicant_init( #ifndef CONFIG_NO_WPA_MSG wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb); #endif /* CONFIG_NO_WPA_MSG */ diff --git a/package/network/services/hostapd/patches/300-noscan.patch b/package/network/services/hostapd/patches/300-noscan.patch index 4463c75c91..d055422969 100644 --- a/package/network/services/hostapd/patches/300-noscan.patch +++ b/package/network/services/hostapd/patches/300-noscan.patch @@ -1,6 +1,6 @@ --- a/hostapd/config_file.c +++ b/hostapd/config_file.c -@@ -3214,6 +3214,10 @@ static int hostapd_config_fill(struct ho +@@ -3317,6 +3317,10 @@ static int hostapd_config_fill(struct ho } #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_IEEE80211N @@ -13,7 +13,7 @@ } else if (os_strcmp(buf, "ht_capab") == 0) { --- a/src/ap/ap_config.h +++ b/src/ap/ap_config.h -@@ -775,6 +775,8 @@ struct hostapd_config { +@@ -781,6 +781,8 @@ struct hostapd_config { int ht_op_mode_fixed; u16 ht_capab; diff --git a/package/network/services/hostapd/patches/301-mesh-noscan.patch b/package/network/services/hostapd/patches/301-mesh-noscan.patch index 0c42d2b110..ed4e91cae9 100644 --- a/package/network/services/hostapd/patches/301-mesh-noscan.patch +++ b/package/network/services/hostapd/patches/301-mesh-noscan.patch @@ -1,6 +1,6 @@ --- a/wpa_supplicant/config.c +++ b/wpa_supplicant/config.c -@@ -2217,6 +2217,7 @@ static const struct parse_data ssid_fiel +@@ -2233,6 +2233,7 @@ static const struct parse_data ssid_fiel #else /* CONFIG_MESH */ { INT_RANGE(mode, 0, 4) }, #endif /* CONFIG_MESH */ @@ -31,7 +31,7 @@ if (conf->hw_mode == HOSTAPD_MODE_IEEE80211A && ssid->vht) { --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2051,12 +2051,12 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2081,12 +2081,12 @@ void ibss_mesh_setup_freq(struct wpa_sup { enum hostapd_hw_mode hw_mode; struct hostapd_hw_modes *mode = NULL; @@ -46,7 +46,7 @@ unsigned int j, k; struct hostapd_freq_params vht_freq; int chwidth, seg0, seg1; -@@ -2126,7 +2126,7 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2156,7 +2156,7 @@ void ibss_mesh_setup_freq(struct wpa_sup return; /* Setup higher BW only for 5 GHz */ diff --git a/package/network/services/hostapd/patches/310-rescan_immediately.patch b/package/network/services/hostapd/patches/310-rescan_immediately.patch index 1fb05401f8..84eb252319 100644 --- a/package/network/services/hostapd/patches/310-rescan_immediately.patch +++ b/package/network/services/hostapd/patches/310-rescan_immediately.patch @@ -1,6 +1,6 @@ --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -4248,7 +4248,7 @@ wpa_supplicant_alloc(struct wpa_supplica +@@ -4312,7 +4312,7 @@ wpa_supplicant_alloc(struct wpa_supplica if (wpa_s == NULL) return NULL; wpa_s->scan_req = INITIAL_SCAN_REQ; diff --git a/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch b/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch index 6aa8d1a3a7..e175bbc103 100644 --- a/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch +++ b/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch @@ -1,6 +1,6 @@ --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -4234,7 +4234,7 @@ static int nl80211_set_channel(struct i8 +@@ -4318,7 +4318,7 @@ static int nl80211_set_channel(struct i8 freq->freq, freq->ht_enabled, freq->vht_enabled, freq->bandwidth, freq->center_freq1, freq->center_freq2); diff --git a/package/network/services/hostapd/patches/340-reload_freq_change.patch b/package/network/services/hostapd/patches/340-reload_freq_change.patch index d46f5144d0..81c20970e7 100644 --- a/package/network/services/hostapd/patches/340-reload_freq_change.patch +++ b/package/network/services/hostapd/patches/340-reload_freq_change.patch @@ -1,6 +1,6 @@ --- a/src/ap/hostapd.c +++ b/src/ap/hostapd.c -@@ -93,6 +93,25 @@ static void hostapd_reload_bss(struct ho +@@ -103,6 +103,25 @@ static void hostapd_reload_bss(struct ho #endif /* CONFIG_NO_RADIUS */ ssid = &hapd->conf->ssid; @@ -26,7 +26,7 @@ if (!ssid->wpa_psk_set && ssid->wpa_psk && !ssid->wpa_psk->next && ssid->wpa_passphrase_set && ssid->wpa_passphrase) { /* -@@ -171,6 +190,7 @@ int hostapd_reload_config(struct hostapd +@@ -200,6 +219,7 @@ int hostapd_reload_config(struct hostapd struct hostapd_data *hapd = iface->bss[0]; struct hostapd_config *newconf, *oldconf; size_t j; @@ -34,8 +34,8 @@ if (iface->config_fname == NULL) { /* Only in-memory config in use - assume it has been updated */ -@@ -192,21 +212,20 @@ int hostapd_reload_config(struct hostapd - oldconf = hapd->iconf; +@@ -250,21 +270,20 @@ int hostapd_reload_config(struct hostapd + } iface->conf = newconf; + for (i = 0; i < iface->num_hw_features; i++) { diff --git a/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch b/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch new file mode 100644 index 0000000000..b9a0b23a7b --- /dev/null +++ b/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch @@ -0,0 +1,39 @@ +--- a/wpa_supplicant/ap.c ++++ b/wpa_supplicant/ap.c +@@ -1363,15 +1363,35 @@ int ap_switch_channel(struct wpa_supplic + + + #ifdef CONFIG_CTRL_IFACE ++ ++static int __ap_ctrl_iface_chanswitch(struct hostapd_iface *iface, ++ struct csa_settings *settings) ++{ ++#ifdef NEED_AP_MLME ++ if (!iface || !iface->bss[0]) ++ return 0; ++ ++ return hostapd_switch_channel(iface->bss[0], settings); ++#else ++ return -1; ++#endif ++} ++ ++ + int ap_ctrl_iface_chanswitch(struct wpa_supplicant *wpa_s, const char *pos) + { + struct csa_settings settings; + int ret = hostapd_parse_csa_settings(pos, &settings); + ++ if (!(wpa_s->ap_iface && wpa_s->ap_iface->bss[0]) && ++ !(wpa_s->ifmsh && wpa_s->ifmsh->bss[0])) ++ return -1; ++ ++ ret = __ap_ctrl_iface_chanswitch(wpa_s->ap_iface, &settings); + if (ret) + return ret; + +- return ap_switch_channel(wpa_s, &settings); ++ return __ap_ctrl_iface_chanswitch(wpa_s->ifmsh, &settings); + } + #endif /* CONFIG_CTRL_IFACE */ + diff --git a/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch b/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch index 9d7a2a4431..836339f2e2 100644 --- a/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch +++ b/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch @@ -1,6 +1,6 @@ --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -2566,10 +2566,15 @@ static int wpa_driver_nl80211_del_beacon +@@ -2634,10 +2634,15 @@ static int wpa_driver_nl80211_del_beacon struct nl_msg *msg; struct wpa_driver_nl80211_data *drv = bss->drv; @@ -18,7 +18,7 @@ return send_and_recv_msgs(drv, msg, NULL, NULL); } -@@ -4835,7 +4840,7 @@ static void nl80211_teardown_ap(struct i +@@ -4919,7 +4924,7 @@ static void nl80211_teardown_ap(struct i nl80211_mgmt_unsubscribe(bss, "AP teardown"); nl80211_put_wiphy_data_ap(bss); @@ -27,7 +27,7 @@ } -@@ -7057,8 +7062,6 @@ static int wpa_driver_nl80211_if_remove( +@@ -7160,8 +7165,6 @@ static int wpa_driver_nl80211_if_remove( } else { wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context"); nl80211_teardown_ap(bss); @@ -36,7 +36,7 @@ nl80211_destroy_bss(bss); if (!bss->added_if) i802_set_iface_flags(bss, 0); -@@ -7437,7 +7440,6 @@ static int wpa_driver_nl80211_deinit_ap( +@@ -7540,7 +7543,6 @@ static int wpa_driver_nl80211_deinit_ap( if (!is_ap_interface(drv->nlmode)) return -1; wpa_driver_nl80211_del_beacon(bss); @@ -44,7 +44,7 @@ /* * If the P2P GO interface was dynamically added, then it is -@@ -7457,7 +7459,6 @@ static int wpa_driver_nl80211_stop_ap(vo +@@ -7560,7 +7562,6 @@ static int wpa_driver_nl80211_stop_ap(vo if (!is_ap_interface(drv->nlmode)) return -1; wpa_driver_nl80211_del_beacon(bss); diff --git a/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch b/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch index 07faead2c5..537c0881c4 100644 --- a/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch +++ b/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch @@ -78,7 +78,7 @@ #ifdef CONFIG_IEEE80211W #ifdef NEED_AP_MLME -@@ -3031,6 +3088,8 @@ static int hostapd_ctrl_iface_receive_pr +@@ -3084,6 +3141,8 @@ static int hostapd_ctrl_iface_receive_pr } else if (os_strncmp(buf, "VENDOR ", 7) == 0) { reply_len = hostapd_ctrl_iface_vendor(hapd, buf + 7, reply, reply_size); diff --git a/package/network/services/hostapd/patches/370-ap_sta_support.patch b/package/network/services/hostapd/patches/370-ap_sta_support.patch index 58a0044849..d93984a172 100644 --- a/package/network/services/hostapd/patches/370-ap_sta_support.patch +++ b/package/network/services/hostapd/patches/370-ap_sta_support.patch @@ -30,7 +30,7 @@ #include "drivers/driver.h" #include "eap_peer/eap.h" #include "wpa_supplicant_i.h" -@@ -292,6 +293,10 @@ void calculate_update_time(const struct +@@ -294,6 +295,10 @@ void calculate_update_time(const struct static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src, struct os_reltime *fetch_time) { @@ -41,7 +41,7 @@ dst->flags = src->flags; os_memcpy(dst->bssid, src->bssid, ETH_ALEN); dst->freq = src->freq; -@@ -304,6 +309,15 @@ static void wpa_bss_copy_res(struct wpa_ +@@ -306,6 +311,15 @@ static void wpa_bss_copy_res(struct wpa_ dst->est_throughput = src->est_throughput; dst->snr = src->snr; @@ -59,7 +59,7 @@ --- a/wpa_supplicant/bss.h +++ b/wpa_supplicant/bss.h -@@ -81,6 +81,10 @@ struct wpa_bss { +@@ -82,6 +82,10 @@ struct wpa_bss { u8 ssid[SSID_MAX_LEN]; /** Length of SSID */ size_t ssid_len; @@ -166,7 +166,7 @@ /* Configure default/group WEP keys for static WEP */ int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid) { -@@ -913,12 +962,16 @@ void wpa_supplicant_set_state(struct wpa +@@ -920,12 +969,16 @@ void wpa_supplicant_set_state(struct wpa sme_sched_obss_scan(wpa_s, 1); @@ -183,7 +183,7 @@ wpa_s->new_connection = 1; wpa_drv_set_operstate(wpa_s, 0); #ifndef IEEE8021X_EAPOL -@@ -1947,6 +2000,8 @@ void wpa_supplicant_associate(struct wpa +@@ -1977,6 +2030,8 @@ void wpa_supplicant_associate(struct wpa wpa_ssid_txt(ssid->ssid, ssid->ssid_len), ssid->id); wpas_notify_mesh_group_started(wpa_s, ssid); @@ -192,7 +192,7 @@ #else /* CONFIG_MESH */ wpa_msg(wpa_s, MSG_ERROR, "mesh mode support not included in the build"); -@@ -5423,6 +5478,16 @@ static int wpa_supplicant_init_iface(str +@@ -5487,6 +5542,16 @@ static int wpa_supplicant_init_iface(str sizeof(wpa_s->bridge_ifname)); } @@ -209,7 +209,7 @@ /* RSNA Supplicant Key Management - INITIALIZE */ eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE); eapol_sm_notify_portValid(wpa_s->eapol, FALSE); -@@ -5744,6 +5809,11 @@ static void wpa_supplicant_deinit_iface( +@@ -5808,6 +5873,11 @@ static void wpa_supplicant_deinit_iface( if (terminate) wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING); @@ -244,3 +244,184 @@ char *confname; char *confanother; +--- a/hostapd/ctrl_iface.c ++++ b/hostapd/ctrl_iface.c +@@ -2328,6 +2328,11 @@ static int hostapd_ctrl_iface_chan_switc + if (ret) + return ret; + ++ if (os_strstr(pos, " auto-ht")) { ++ settings.freq_params.ht_enabled = iface->conf->ieee80211n; ++ settings.freq_params.vht_enabled = iface->conf->ieee80211ac; ++ } ++ + for (i = 0; i < iface->num_bss; i++) { + + /* Save CHAN_SWITCH VHT config */ +--- a/src/ap/beacon.c ++++ b/src/ap/beacon.c +@@ -1381,11 +1381,6 @@ int ieee802_11_set_beacon(struct hostapd + struct wpabuf *beacon, *proberesp, *assocresp; + int res, ret = -1; + +- if (hapd->csa_in_progress) { +- wpa_printf(MSG_ERROR, "Cannot set beacons during CSA period"); +- return -1; +- } +- + hapd->beacon_set_done = 1; + + if (ieee802_11_build_ap_params(hapd, ¶ms) < 0) +--- a/src/drivers/driver.h ++++ b/src/drivers/driver.h +@@ -4469,6 +4469,13 @@ enum wpa_event_type { + EVENT_CH_SWITCH, + + /** ++ * EVENT_CH_SWITCH - AP or GO will switch channels soon ++ * ++ * Described in wpa_event_data.ch_switch ++ * */ ++ EVENT_CH_SWITCH_STARTED, ++ ++ /** + * EVENT_WNM - Request WNM operation + * + * This event can be used to request a WNM operation to be performed. +@@ -5306,6 +5313,7 @@ union wpa_event_data { + + /** + * struct ch_switch ++ * @count: countdown until channel switch + * @freq: Frequency of new channel in MHz + * @ht_enabled: Whether this is an HT channel + * @ch_offset: Secondary channel offset +@@ -5314,6 +5322,7 @@ union wpa_event_data { + * @cf2: Center frequency 2 + */ + struct ch_switch { ++ int count; + int freq; + int ht_enabled; + int ch_offset; +--- a/src/drivers/driver_nl80211_event.c ++++ b/src/drivers/driver_nl80211_event.c +@@ -526,7 +526,8 @@ static int calculate_chan_offset(int wid + static void mlme_event_ch_switch(struct wpa_driver_nl80211_data *drv, + struct nlattr *ifindex, struct nlattr *freq, + struct nlattr *type, struct nlattr *bw, +- struct nlattr *cf1, struct nlattr *cf2) ++ struct nlattr *cf1, struct nlattr *cf2, ++ struct nlattr *count) + { + struct i802_bss *bss; + union wpa_event_data data; +@@ -584,11 +585,15 @@ static void mlme_event_ch_switch(struct + data.ch_switch.cf1 = nla_get_u32(cf1); + if (cf2) + data.ch_switch.cf2 = nla_get_u32(cf2); ++ if (count) ++ data.ch_switch.count = nla_get_u32(count); + + bss->freq = data.ch_switch.freq; + drv->assoc_freq = data.ch_switch.freq; + +- wpa_supplicant_event(bss->ctx, EVENT_CH_SWITCH, &data); ++ wpa_supplicant_event(bss->ctx, ++ count ? EVENT_CH_SWITCH_STARTED : EVENT_CH_SWITCH, ++ &data); + } + + +@@ -2446,6 +2451,7 @@ static void do_process_drv_event(struct + tb[NL80211_ATTR_PMK], + tb[NL80211_ATTR_PMKID]); + break; ++ case NL80211_CMD_CH_SWITCH_STARTED_NOTIFY: + case NL80211_CMD_CH_SWITCH_NOTIFY: + mlme_event_ch_switch(drv, + tb[NL80211_ATTR_IFINDEX], +@@ -2453,7 +2459,8 @@ static void do_process_drv_event(struct + tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE], + tb[NL80211_ATTR_CHANNEL_WIDTH], + tb[NL80211_ATTR_CENTER_FREQ1], +- tb[NL80211_ATTR_CENTER_FREQ2]); ++ tb[NL80211_ATTR_CENTER_FREQ2], ++ tb[NL80211_ATTR_CH_SWITCH_COUNT]); + break; + case NL80211_CMD_DISCONNECT: + mlme_event_disconnect(drv, tb[NL80211_ATTR_REASON_CODE], +--- a/wpa_supplicant/events.c ++++ b/wpa_supplicant/events.c +@@ -4026,6 +4026,60 @@ static void wpas_event_assoc_reject(stru + } + + ++static void ++supplicant_ch_switch_started(struct wpa_supplicant *wpa_s, ++ union wpa_event_data *data) ++{ ++ char buf[256]; ++ size_t len = sizeof(buf); ++ char *cmd = NULL; ++ int width = 20; ++ int ret; ++ ++ if (!wpa_s->hostapd) ++ return; ++ ++ wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CHANNEL_SWITCH ++ "count=%d freq=%d ht_enabled=%d ch_offset=%d ch_width=%s cf1=%d cf2=%d", ++ data->ch_switch.count, ++ data->ch_switch.freq, ++ data->ch_switch.ht_enabled, ++ data->ch_switch.ch_offset, ++ channel_width_to_string(data->ch_switch.ch_width), ++ data->ch_switch.cf1, ++ data->ch_switch.cf2); ++ ++ switch (data->ch_switch.ch_width) { ++ case CHAN_WIDTH_20_NOHT: ++ case CHAN_WIDTH_20: ++ width = 20; ++ break; ++ case CHAN_WIDTH_40: ++ width = 40; ++ break; ++ case CHAN_WIDTH_80: ++ width = 80; ++ break; ++ case CHAN_WIDTH_160: ++ case CHAN_WIDTH_80P80: ++ width = 160; ++ break; ++ } ++ ++ asprintf(&cmd, "CHAN_SWITCH %d %d sec_channel_offset=%d center_freq1=%d center_freq2=%d, bandwidth=%d auto-ht\n", ++ data->ch_switch.count - 1, ++ data->ch_switch.freq, ++ data->ch_switch.ch_offset, ++ data->ch_switch.cf1, ++ data->ch_switch.cf2, ++ width); ++ ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL); ++ free(cmd); ++ ++ if (ret < 0) ++ wpa_printf(MSG_ERROR, "\nFailed to reload hostapd AP interfaces\n"); ++} ++ + void supplicant_event(void *ctx, enum wpa_event_type event, + union wpa_event_data *data) + { +@@ -4309,6 +4363,10 @@ void supplicant_event(void *ctx, enum wp + data->rx_from_unknown.wds); + break; + #endif /* CONFIG_AP */ ++ case EVENT_CH_SWITCH_STARTED: ++ supplicant_ch_switch_started(wpa_s, data); ++ break; ++ + case EVENT_CH_SWITCH: + if (!data || !wpa_s->current_ssid) + break; diff --git a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch index cd050fc0c9..2fe03340a8 100644 --- a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch +++ b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch @@ -12,7 +12,7 @@ else --- a/hostapd/ctrl_iface.c +++ b/hostapd/ctrl_iface.c -@@ -2857,6 +2857,7 @@ static int hostapd_ctrl_iface_receive_pr +@@ -2912,6 +2912,7 @@ static int hostapd_ctrl_iface_receive_pr reply_size); } else if (os_strcmp(buf, "STATUS-DRIVER") == 0) { reply_len = hostapd_drv_status(hapd, reply, reply_size); @@ -20,7 +20,7 @@ } else if (os_strcmp(buf, "MIB") == 0) { reply_len = ieee802_11_get_mib(hapd, reply, reply_size); if (reply_len >= 0) { -@@ -2898,6 +2899,7 @@ static int hostapd_ctrl_iface_receive_pr +@@ -2953,6 +2954,7 @@ static int hostapd_ctrl_iface_receive_pr } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) { reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply, reply_size); @@ -42,7 +42,7 @@ --- a/wpa_supplicant/ctrl_iface.c +++ b/wpa_supplicant/ctrl_iface.c -@@ -2108,7 +2108,7 @@ static int wpa_supplicant_ctrl_iface_sta +@@ -2117,7 +2117,7 @@ static int wpa_supplicant_ctrl_iface_sta pos += ret; } @@ -51,7 +51,7 @@ if (wpa_s->ap_iface) { pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos, end - pos, -@@ -9825,6 +9825,7 @@ char * wpa_supplicant_ctrl_iface_process +@@ -9852,6 +9852,7 @@ char * wpa_supplicant_ctrl_iface_process reply_len = -1; } else if (os_strncmp(buf, "NOTE ", 5) == 0) { wpa_printf(MSG_INFO, "NOTE: %s", buf + 5); @@ -59,7 +59,7 @@ } else if (os_strcmp(buf, "MIB") == 0) { reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size); if (reply_len >= 0) { -@@ -9832,6 +9833,7 @@ char * wpa_supplicant_ctrl_iface_process +@@ -9859,6 +9860,7 @@ char * wpa_supplicant_ctrl_iface_process reply + reply_len, reply_size - reply_len); } @@ -67,7 +67,7 @@ } else if (os_strncmp(buf, "STATUS", 6) == 0) { reply_len = wpa_supplicant_ctrl_iface_status( wpa_s, buf + 6, reply, reply_size); -@@ -10313,6 +10315,7 @@ char * wpa_supplicant_ctrl_iface_process +@@ -10340,6 +10342,7 @@ char * wpa_supplicant_ctrl_iface_process reply_len = wpa_supplicant_ctrl_iface_bss( wpa_s, buf + 4, reply, reply_size); #ifdef CONFIG_AP @@ -75,7 +75,7 @@ } else if (os_strcmp(buf, "STA-FIRST") == 0) { reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size); } else if (os_strncmp(buf, "STA ", 4) == 0) { -@@ -10321,12 +10324,15 @@ char * wpa_supplicant_ctrl_iface_process +@@ -10348,12 +10351,15 @@ char * wpa_supplicant_ctrl_iface_process } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) { reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply, reply_size); @@ -126,7 +126,7 @@ if (os_snprintf_error(buflen - len, ret)) --- a/src/ap/ieee802_1x.c +++ b/src/ap/ieee802_1x.c -@@ -2555,6 +2555,7 @@ static const char * bool_txt(Boolean val +@@ -2581,6 +2581,7 @@ static const char * bool_txt(Boolean val return val ? "TRUE" : "FALSE"; } @@ -134,7 +134,7 @@ int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen) { -@@ -2730,6 +2731,7 @@ int ieee802_1x_get_mib_sta(struct hostap +@@ -2756,6 +2757,7 @@ int ieee802_1x_get_mib_sta(struct hostap return len; } @@ -144,7 +144,7 @@ static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx) --- a/src/ap/wpa_auth.c +++ b/src/ap/wpa_auth.c -@@ -3772,6 +3772,7 @@ static const char * wpa_bool_txt(int val +@@ -3798,6 +3798,7 @@ static const char * wpa_bool_txt(int val return val ? "TRUE" : "FALSE"; } @@ -152,7 +152,7 @@ #define RSN_SUITE "%02x-%02x-%02x-%d" #define RSN_SUITE_ARG(s) \ -@@ -3916,7 +3917,7 @@ int wpa_get_mib_sta(struct wpa_state_mac +@@ -3942,7 +3943,7 @@ int wpa_get_mib_sta(struct wpa_state_mac return len; } @@ -163,7 +163,7 @@ { --- a/src/rsn_supp/wpa.c +++ b/src/rsn_supp/wpa.c -@@ -2306,6 +2306,8 @@ static u32 wpa_key_mgmt_suite(struct wpa +@@ -2319,6 +2319,8 @@ static u32 wpa_key_mgmt_suite(struct wpa } @@ -172,7 +172,7 @@ #define RSN_SUITE "%02x-%02x-%02x-%d" #define RSN_SUITE_ARG(s) \ ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff -@@ -2389,6 +2391,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch +@@ -2402,6 +2404,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch return (int) len; } @@ -182,7 +182,7 @@ --- a/wpa_supplicant/ap.c +++ b/wpa_supplicant/ap.c -@@ -1179,7 +1179,7 @@ int wpas_ap_wps_nfc_report_handover(stru +@@ -1221,7 +1221,7 @@ int wpas_ap_wps_nfc_report_handover(stru #endif /* CONFIG_WPS */ diff --git a/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch b/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch index 1646627191..855fc808e9 100644 --- a/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch +++ b/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch @@ -1,6 +1,6 @@ --- a/src/common/wpa_common.c +++ b/src/common/wpa_common.c -@@ -1849,6 +1849,31 @@ u32 wpa_akm_to_suite(int akm) +@@ -2042,6 +2042,31 @@ u32 wpa_akm_to_suite(int akm) } @@ -32,7 +32,7 @@ int wpa_compare_rsn_ie(int ft_initial_assoc, const u8 *ie1, size_t ie1len, const u8 *ie2, size_t ie2len) -@@ -1856,8 +1881,19 @@ int wpa_compare_rsn_ie(int ft_initial_as +@@ -2049,8 +2074,19 @@ int wpa_compare_rsn_ie(int ft_initial_as if (ie1 == NULL || ie2 == NULL) return -1; diff --git a/package/network/services/hostapd/patches/410-limit_debug_messages.patch b/package/network/services/hostapd/patches/410-limit_debug_messages.patch index b7dbbd0dc7..d182e8d986 100644 --- a/package/network/services/hostapd/patches/410-limit_debug_messages.patch +++ b/package/network/services/hostapd/patches/410-limit_debug_messages.patch @@ -1,6 +1,6 @@ --- a/src/utils/wpa_debug.c +++ b/src/utils/wpa_debug.c -@@ -201,7 +201,7 @@ void wpa_debug_close_linux_tracing(void) +@@ -205,7 +205,7 @@ void wpa_debug_close_linux_tracing(void) * * Note: New line '\n' is added to the end of the text when printing to stdout. */ @@ -9,7 +9,7 @@ { va_list ap; -@@ -248,8 +248,8 @@ void wpa_printf(int level, const char *f +@@ -252,8 +252,8 @@ void wpa_printf(int level, const char *f } @@ -20,7 +20,7 @@ { size_t i; -@@ -375,20 +375,8 @@ static void _wpa_hexdump(int level, cons +@@ -379,20 +379,8 @@ static void _wpa_hexdump(int level, cons #endif /* CONFIG_ANDROID_LOG */ } @@ -43,7 +43,7 @@ { size_t i, llen; const u8 *pos = buf; -@@ -495,20 +483,6 @@ static void _wpa_hexdump_ascii(int level +@@ -499,20 +487,6 @@ static void _wpa_hexdump_ascii(int level } @@ -64,7 +64,7 @@ #ifdef CONFIG_DEBUG_FILE static char *last_path = NULL; #endif /* CONFIG_DEBUG_FILE */ -@@ -604,7 +578,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_ +@@ -628,7 +602,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_ } @@ -73,7 +73,7 @@ { va_list ap; char *buf; -@@ -642,7 +616,7 @@ void wpa_msg(void *ctx, int level, const +@@ -666,7 +640,7 @@ void wpa_msg(void *ctx, int level, const } diff --git a/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch b/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch index 81ad81c39a..1bb5d6e620 100644 --- a/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch +++ b/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch @@ -22,7 +22,7 @@ Signed-hostap: Antonio Quartulli #include "common/defs.h" #include "common/ieee802_11_defs.h" #include "common/wpa_common.h" -@@ -762,6 +763,9 @@ struct wpa_driver_associate_params { +@@ -774,6 +775,9 @@ struct wpa_driver_associate_params { * responsible for selecting with which BSS to associate. */ const u8 *bssid; @@ -42,7 +42,7 @@ Signed-hostap: Antonio Quartulli #include "config.h" -@@ -2037,6 +2038,97 @@ static char * wpa_config_write_peerkey(c +@@ -2053,6 +2054,97 @@ static char * wpa_config_write_peerkey(c #endif /* NO_CONFIG_WRITE */ @@ -140,7 +140,7 @@ Signed-hostap: Antonio Quartulli /* Helper macros for network block parser */ #ifdef OFFSET -@@ -2282,6 +2374,8 @@ static const struct parse_data ssid_fiel +@@ -2298,6 +2390,8 @@ static const struct parse_data ssid_fiel { INT(ap_max_inactivity) }, { INT(dtim_period) }, { INT(beacon_int) }, @@ -174,7 +174,7 @@ Signed-hostap: Antonio Quartulli * macsec_policy - Determines the policy for MACsec secure session --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -3061,6 +3061,12 @@ static void wpas_start_assoc_cb(struct w +@@ -3117,6 +3117,12 @@ static void wpas_start_assoc_cb(struct w params.beacon_int = ssid->beacon_int; else params.beacon_int = wpa_s->conf->beacon_int; diff --git a/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch b/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch index b56fa3d38e..287cd1dd2e 100644 --- a/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch +++ b/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch @@ -10,7 +10,7 @@ Signed-hostap: Antonio Quartulli --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -5094,7 +5094,7 @@ static int wpa_driver_nl80211_ibss(struc +@@ -5178,7 +5178,7 @@ static int wpa_driver_nl80211_ibss(struc struct wpa_driver_associate_params *params) { struct nl_msg *msg; @@ -19,7 +19,7 @@ Signed-hostap: Antonio Quartulli int count = 0; wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex); -@@ -5121,6 +5121,37 @@ retry: +@@ -5205,6 +5205,37 @@ retry: nl80211_put_beacon_int(msg, params->beacon_int)) goto fail; diff --git a/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch b/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch index 12cbd993a5..55a48b9733 100644 --- a/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch +++ b/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch @@ -19,7 +19,7 @@ Tested-by: Simon Wunderlich --- a/src/drivers/driver.h +++ b/src/drivers/driver.h -@@ -1397,6 +1397,7 @@ struct wpa_driver_mesh_join_params { +@@ -1409,6 +1409,7 @@ struct wpa_driver_mesh_join_params { #define WPA_DRIVER_MESH_FLAG_AMPE 0x00000008 unsigned int flags; u8 handle_dfs; @@ -29,7 +29,7 @@ Tested-by: Simon Wunderlich /** --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -9248,6 +9248,18 @@ static int nl80211_put_mesh_id(struct nl +@@ -9352,6 +9352,18 @@ static int nl80211_put_mesh_id(struct nl } @@ -48,7 +48,7 @@ Tested-by: Simon Wunderlich static int nl80211_put_mesh_config(struct nl_msg *msg, struct wpa_driver_mesh_bss_params *params) { -@@ -9309,6 +9321,7 @@ static int nl80211_join_mesh(struct i802 +@@ -9413,6 +9425,7 @@ static int nl80211_join_mesh(struct i802 nl80211_put_basic_rates(msg, params->basic_rates) || nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) || nl80211_put_beacon_int(msg, params->beacon_int) || diff --git a/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch b/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch index f630894c92..3d4946e0b0 100644 --- a/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch +++ b/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch @@ -1,6 +1,6 @@ --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2124,11 +2124,13 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2154,11 +2154,13 @@ void ibss_mesh_setup_freq(struct wpa_sup for (j = 0; j < wpa_s->last_scan_res_used; j++) { struct wpa_bss *bss = wpa_s->last_scan_res[j]; diff --git a/package/network/services/hostapd/patches/500-lto-jobserver-support.patch b/package/network/services/hostapd/patches/500-lto-jobserver-support.patch new file mode 100644 index 0000000000..a65ad9c7f6 --- /dev/null +++ b/package/network/services/hostapd/patches/500-lto-jobserver-support.patch @@ -0,0 +1,50 @@ +--- a/hostapd/Makefile ++++ b/hostapd/Makefile +@@ -1290,14 +1290,14 @@ hostapd_multi.a: $(BCHECK) $(OBJS) + @$(AR) cr $@ hostapd_multi.o $(OBJS) + + hostapd: $(BCHECK) $(OBJS) +- $(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS) ++ +$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS) + @$(E) " LD " $@ + + ifdef CONFIG_WPA_TRACE + OBJS_c += ../src/utils/trace.o + endif + hostapd_cli: $(OBJS_c) +- $(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c) ++ +$(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c) + @$(E) " LD " $@ + + NOBJS = nt_password_hash.o ../src/crypto/ms_funcs.o $(SHA1OBJS) +--- a/wpa_supplicant/Makefile ++++ b/wpa_supplicant/Makefile +@@ -1921,23 +1921,23 @@ wpa_supplicant_multi.a: .config $(BCHECK + @$(AR) cr $@ wpa_supplicant_multi.o $(OBJS) + + wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs) +- $(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS) ++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS) + @$(E) " LD " $@ + + eapol_test: $(OBJS_t) +- $(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS) ++ +$(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS) + @$(E) " LD " $@ + + preauth_test: $(OBJS_t2) +- $(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS) ++ +$(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS) + @$(E) " LD " $@ + + wpa_passphrase: $(OBJS_p) +- $(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS) ++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS) + @$(E) " LD " $@ + + wpa_cli: $(OBJS_c) +- $(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c) ++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c) + @$(E) " LD " $@ + + LIBCTRL += ../src/common/wpa_ctrl.o diff --git a/package/network/services/hostapd/patches/550-hostapd-Add-Multi-AP-protocol-support.patch b/package/network/services/hostapd/patches/550-hostapd-Add-Multi-AP-protocol-support.patch new file mode 100644 index 0000000000..812f794eda --- /dev/null +++ b/package/network/services/hostapd/patches/550-hostapd-Add-Multi-AP-protocol-support.patch @@ -0,0 +1,306 @@ +From 9c06f0f6aed26c1628acaa74df0232dd7b345e9a Mon Sep 17 00:00:00 2001 +From: Venkateswara Naralasetty +Date: Wed, 5 Dec 2018 11:23:51 +0100 +Subject: [PATCH] hostapd: Add Multi-AP protocol support + +The purpose of Multi-AP specification is to enable inter-operability +across Wi-Fi access points (APs) from different vendors. + +This patch introduces one new configuration parameter 'multi_ap' to +enable Multi-AP functionality and to configure the BSS as a backhaul +and/or fronthaul BSS. + +Advertise vendor specific Multi-AP capabilities in (Re)Association +Response frame, if Multi-AP functionality is enabled through the +configuration parameter. + +A backhaul AP must support receiving both 3addr and 4addr frames from a +backhaul STA, so create a VLAN for it just like is done for WDS, i.e., +by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never +WEP), we can safely call hostapd_set_wds_encryption() as well and we can +reuse the entire WDS condition. + +To parse the Multi-AP Extension subelement, we use get_ie(): even though +that function is meant for parsing IEs, it works for subelements. + +Signed-off-by: Venkateswara Naralasetty +Signed-off-by: Jouni Malinen +Signed-off-by: Arnout Vandecappelle (Essensium/Mind) +--- + hostapd/config_file.c | 10 +++++ + hostapd/hostapd.conf | 7 ++++ + src/ap/ap_config.h | 4 ++ + src/ap/ieee802_11.c | 77 +++++++++++++++++++++++++++++++++- + src/ap/sta_info.c | 2 +- + src/ap/sta_info.h | 1 + + src/common/ieee802_11_common.c | 24 +++++++++++ + src/common/ieee802_11_common.h | 4 ++ + src/common/ieee802_11_defs.h | 7 ++++ + 9 files changed, 134 insertions(+), 2 deletions(-) + +--- a/hostapd/config_file.c ++++ b/hostapd/config_file.c +@@ -4115,6 +4115,16 @@ static int hostapd_config_fill(struct ho + } else if (os_strcmp(buf, "coloc_intf_reporting") == 0) { + bss->coloc_intf_reporting = atoi(pos); + #endif /* CONFIG_OWE */ ++ } else if (os_strcmp(buf, "multi_ap") == 0) { ++ int val = atoi(pos); ++ ++ if (val < 0 || val > 3) { ++ wpa_printf(MSG_ERROR, "Line %d: Invalid multi_ap '%s'", ++ line, buf); ++ return -1; ++ } ++ ++ bss->multi_ap = val; + } else { + wpa_printf(MSG_ERROR, + "Line %d: unknown configuration item '%s'", +--- a/hostapd/hostapd.conf ++++ b/hostapd/hostapd.conf +@@ -438,6 +438,13 @@ wmm_ac_vo_txop_limit=47 + wmm_ac_vo_acm=0 + # Note: for IEEE 802.11b mode: cWmin=3 cWmax=4 burst=102 + ++# Enable Multi-AP functionality ++# 0 = disabled (default) ++# 1 = AP support backhaul BSS ++# 2 = AP support fronthaul BSS ++# 3 = AP supports both backhaul BSS and fronthaul BSS ++#multi_ap=0 ++ + # Static WEP key configuration + # + # The key number to use when transmitting. +--- a/src/ap/ap_config.h ++++ b/src/ap/ap_config.h +@@ -688,6 +688,10 @@ struct hostapd_bss_config { + #endif /* CONFIG_OWE */ + + int coloc_intf_reporting; ++ ++#define BACKHAUL_BSS 1 ++#define FRONTHAUL_BSS 2 ++ int multi_ap; /* bitmap of BACKHAUL_BSS, FRONTHAUL_BSS */ + }; + + /** +--- a/src/ap/ieee802_11.c ++++ b/src/ap/ieee802_11.c +@@ -62,6 +62,22 @@ prepare_auth_resp_fils(struct hostapd_da + int *is_pub); + #endif /* CONFIG_FILS */ + ++ ++u8 * hostapd_eid_multi_ap(struct hostapd_data *hapd, u8 *eid) ++{ ++ u8 multi_ap_val = 0; ++ ++ if (!hapd->conf->multi_ap) ++ return eid; ++ if (hapd->conf->multi_ap & BACKHAUL_BSS) ++ multi_ap_val |= MULTI_AP_BACKHAUL_BSS; ++ if (hapd->conf->multi_ap & FRONTHAUL_BSS) ++ multi_ap_val |= MULTI_AP_FRONTHAUL_BSS; ++ ++ return eid + add_multi_ap_ie(eid, 9, multi_ap_val); ++} ++ ++ + u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid) + { + u8 *pos = eid; +@@ -2210,6 +2226,57 @@ static u16 check_wmm(struct hostapd_data + return WLAN_STATUS_SUCCESS; + } + ++static u16 check_multi_ap(struct hostapd_data *hapd, struct sta_info *sta, ++ const u8 *multi_ap_ie, size_t multi_ap_len) ++{ ++ u8 multi_ap_value = 0; ++ ++ sta->flags &= ~WLAN_STA_MULTI_AP; ++ ++ if (!hapd->conf->multi_ap) ++ return WLAN_STATUS_SUCCESS; ++ ++ if (multi_ap_ie) { ++ const u8 *multi_ap_subelem; ++ ++ multi_ap_subelem = get_ie(multi_ap_ie + 4, ++ multi_ap_len - 4, ++ MULTI_AP_SUB_ELEM_TYPE); ++ if (multi_ap_subelem && multi_ap_subelem[1] == 1) { ++ multi_ap_value = multi_ap_subelem[2]; ++ } else { ++ hostapd_logger(hapd, sta->addr, ++ HOSTAPD_MODULE_IEEE80211, ++ HOSTAPD_LEVEL_INFO, ++ "Multi-AP IE has missing or invalid Multi-AP subelement"); ++ return WLAN_STATUS_INVALID_IE; ++ } ++ } ++ ++ if (multi_ap_value == MULTI_AP_BACKHAUL_STA) ++ sta->flags |= WLAN_STA_MULTI_AP; ++ ++ if ((hapd->conf->multi_ap & BACKHAUL_BSS) && ++ multi_ap_value == MULTI_AP_BACKHAUL_STA) ++ return WLAN_STATUS_SUCCESS; ++ ++ if (hapd->conf->multi_ap & FRONTHAUL_BSS) { ++ if (multi_ap_value == MULTI_AP_BACKHAUL_STA) { ++ hostapd_logger(hapd, sta->addr, ++ HOSTAPD_MODULE_IEEE80211, ++ HOSTAPD_LEVEL_INFO, ++ "Backhaul STA tries to associate with fronthaul-only BSS"); ++ return WLAN_STATUS_ASSOC_DENIED_UNSPEC; ++ } ++ return WLAN_STATUS_SUCCESS; ++ } ++ ++ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, ++ HOSTAPD_LEVEL_INFO, ++ "Non-Multi-AP STA tries to associate with backhaul-only BSS"); ++ return WLAN_STATUS_ASSOC_DENIED_UNSPEC; ++} ++ + + static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta, + struct ieee802_11_elems *elems) +@@ -2466,6 +2533,11 @@ static u16 check_assoc_ies(struct hostap + resp = copy_supp_rates(hapd, sta, &elems); + if (resp != WLAN_STATUS_SUCCESS) + return resp; ++ ++ resp = check_multi_ap(hapd, sta, elems.multi_ap, elems.multi_ap_len); ++ if (resp != WLAN_STATUS_SUCCESS) ++ return resp; ++ + #ifdef CONFIG_IEEE80211N + resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities); + if (resp != WLAN_STATUS_SUCCESS) +@@ -2996,6 +3068,9 @@ static u16 send_assoc_resp(struct hostap + } + #endif /* CONFIG_WPS */ + ++ if (sta && (sta->flags & WLAN_STA_MULTI_AP)) ++ p = hostapd_eid_multi_ap(hapd, p); ++ + #ifdef CONFIG_P2P + if (sta && sta->p2p_ie && hapd->p2p_group) { + struct wpabuf *p2p_resp_ie; +@@ -4236,7 +4311,7 @@ static void handle_assoc_cb(struct hosta + sta->flags |= WLAN_STA_WDS; + } + +- if (sta->flags & WLAN_STA_WDS) { ++ if (sta->flags & (WLAN_STA_WDS | WLAN_STA_MULTI_AP)) { + int ret; + char ifname_wds[IFNAMSIZ + 1]; + +--- a/src/ap/sta_info.c ++++ b/src/ap/sta_info.c +@@ -166,7 +166,7 @@ void ap_free_sta(struct hostapd_data *ha + /* just in case */ + ap_sta_set_authorized(hapd, sta, 0); + +- if (sta->flags & WLAN_STA_WDS) ++ if (sta->flags & (WLAN_STA_WDS | WLAN_STA_MULTI_AP)) + hostapd_set_wds_sta(hapd, NULL, sta->addr, sta->aid, 0); + + if (sta->ipaddr) +--- a/src/ap/sta_info.h ++++ b/src/ap/sta_info.h +@@ -36,6 +36,7 @@ + #define WLAN_STA_VHT_OPMODE_ENABLED BIT(20) + #define WLAN_STA_VENDOR_VHT BIT(21) + #define WLAN_STA_PENDING_FILS_ERP BIT(22) ++#define WLAN_STA_MULTI_AP BIT(23) + #define WLAN_STA_PENDING_DISASSOC_CB BIT(29) + #define WLAN_STA_PENDING_DEAUTH_CB BIT(30) + #define WLAN_STA_NONERP BIT(31) +--- a/src/common/ieee802_11_common.c ++++ b/src/common/ieee802_11_common.c +@@ -126,6 +126,10 @@ static int ieee802_11_parse_vendor_speci + elems->roaming_cons_sel = pos; + elems->roaming_cons_sel_len = elen; + break; ++ case MULTI_AP_OUI_TYPE: ++ elems->multi_ap = pos; ++ elems->multi_ap_len = elen; ++ break; + default: + wpa_printf(MSG_MSGDUMP, "Unknown WFA " + "information element ignored " +@@ -1519,6 +1523,26 @@ size_t mbo_add_ie(u8 *buf, size_t len, c + } + + ++size_t add_multi_ap_ie(u8 *buf, size_t len, u8 value) ++{ ++ u8 *pos = buf; ++ ++ if (len < 9) ++ return 0; ++ ++ *pos++ = WLAN_EID_VENDOR_SPECIFIC; ++ *pos++ = 7; /* len */ ++ WPA_PUT_BE24(pos, OUI_WFA); ++ pos += 3; ++ *pos++ = MULTI_AP_OUI_TYPE; ++ *pos++ = MULTI_AP_SUB_ELEM_TYPE; ++ *pos++ = 1; /* len */ ++ *pos++ = value; ++ ++ return pos - buf; ++} ++ ++ + static const struct country_op_class us_op_class[] = { + { 1, 115 }, + { 2, 118 }, +--- a/src/common/ieee802_11_common.h ++++ b/src/common/ieee802_11_common.h +@@ -84,6 +84,7 @@ struct ieee802_11_elems { + const u8 *power_capab; + const u8 *roaming_cons_sel; + const u8 *password_id; ++ const u8 *multi_ap; + + u8 ssid_len; + u8 supp_rates_len; +@@ -130,6 +131,7 @@ struct ieee802_11_elems { + u8 power_capab_len; + u8 roaming_cons_sel_len; + u8 password_id_len; ++ u8 multi_ap_len; + + struct mb_ies_info mb_ies; + }; +@@ -189,6 +191,8 @@ const u8 * get_ie_ext(const u8 *ies, siz + + size_t mbo_add_ie(u8 *buf, size_t len, const u8 *attr, size_t attr_len); + ++size_t add_multi_ap_ie(u8 *buf, size_t len, u8 value); ++ + struct country_op_class { + u8 country_op_class; + u8 global_op_class; +--- a/src/common/ieee802_11_defs.h ++++ b/src/common/ieee802_11_defs.h +@@ -1210,6 +1210,13 @@ struct ieee80211_ampe_ie { + #define MBO_OUI_TYPE 22 + #define OWE_IE_VENDOR_TYPE 0x506f9a1c + #define OWE_OUI_TYPE 28 ++#define MULTI_AP_OUI_TYPE 0x1B ++ ++#define MULTI_AP_SUB_ELEM_TYPE 0x06 ++#define MULTI_AP_TEAR_DOWN BIT(4) ++#define MULTI_AP_FRONTHAUL_BSS BIT(5) ++#define MULTI_AP_BACKHAUL_BSS BIT(6) ++#define MULTI_AP_BACKHAUL_STA BIT(7) + + #define WMM_OUI_TYPE 2 + #define WMM_OUI_SUBTYPE_INFORMATION_ELEMENT 0 diff --git a/package/network/services/hostapd/patches/551-wpa_supplicant-Add-Multi-AP-protocol-support-to-supp.patch b/package/network/services/hostapd/patches/551-wpa_supplicant-Add-Multi-AP-protocol-support-to-supp.patch new file mode 100644 index 0000000000..5fc41c20e6 --- /dev/null +++ b/package/network/services/hostapd/patches/551-wpa_supplicant-Add-Multi-AP-protocol-support-to-supp.patch @@ -0,0 +1,311 @@ +From 5abc7823bd01f69b8afbe1fd19f65fff86137c44 Mon Sep 17 00:00:00 2001 +From: Venkateswara Naralasetty +Date: Wed, 5 Dec 2018 11:23:53 +0100 +Subject: [PATCH] wpa_supplicant: Add Multi-AP backhaul STA support + +Advertise vendor specific Multi-AP IE in (Re)Association Request frames +and process Multi-AP IE from (Re)Association Response frames if the user +enables Multi-AP fuctionality. If the (Re)Association Response frame +does not contain the Multi-AP IE, disassociate. + +This adds a new configuration parameter 'multi_ap_backhaul_sta' to +enable/disable Multi-AP functionality. + +Enable 4-address mode after association (if the Association Response +frame contains the Multi-AP IE). Also enable the bridge in that case. +This is necessary because wpa_supplicant only enables the bridge in +wpa_drv_if_add(), which only gets called when an interface is added +through the control interface, not when it is configured from the +command line. + +Signed-off-by: Venkateswara Naralasetty +Signed-off-by: Jouni Malinen +Signed-off-by: Arnout Vandecappelle (Essensium/Mind) +--- + src/drivers/driver.h | 9 ++++++ + src/drivers/driver_nl80211.c | 44 ++++++++++++++++++++++++++ + wpa_supplicant/config.c | 1 + + wpa_supplicant/config_ssid.h | 7 +++++ + wpa_supplicant/driver_i.h | 8 +++++ + wpa_supplicant/events.c | 50 ++++++++++++++++++++++++++++++ + wpa_supplicant/sme.c | 16 ++++++++++ + wpa_supplicant/wpa_supplicant.c | 18 +++++++++++ + wpa_supplicant/wpa_supplicant.conf | 7 +++++ + wpa_supplicant/wpa_supplicant_i.h | 1 + + 10 files changed, 161 insertions(+) + +--- a/src/drivers/driver.h ++++ b/src/drivers/driver.h +@@ -4100,6 +4100,15 @@ struct wpa_driver_ops { + */ + int (*send_external_auth_status)(void *priv, + struct external_auth *params); ++ ++ /** ++ * set_4addr_mode - Set 4-address mode ++ * @priv: Private driver interface data ++ * @bridge_ifname: Bridge interface name ++ * @val: 0 - disable 4addr mode, 1 - enable 4addr mode ++ * Returns: 0 on success, < 0 on failure ++ */ ++ int (*set_4addr_mode)(void *priv, const char *bridge_ifname, int val); + }; + + /** +--- a/src/drivers/driver_nl80211.c ++++ b/src/drivers/driver_nl80211.c +@@ -10728,6 +10728,49 @@ fail: + } + + ++static int nl80211_set_4addr_mode(void *priv, const char *bridge_ifname, ++ int val) ++{ ++ struct i802_bss *bss = priv; ++ struct wpa_driver_nl80211_data *drv = bss->drv; ++ struct nl_msg *msg; ++ int ret = -ENOBUFS; ++ ++ wpa_printf(MSG_DEBUG, "nl80211: %s 4addr mode (bridge_ifname: %s)", ++ val ? "Enable" : "Disable", bridge_ifname); ++ ++ msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_SET_INTERFACE); ++ if (!msg || nla_put_u8(msg, NL80211_ATTR_4ADDR, val)) ++ goto fail; ++ ++ if (bridge_ifname[0] && bss->added_if_into_bridge && !val) { ++ if (linux_br_del_if(drv->global->ioctl_sock, ++ bridge_ifname, bss->ifname)) { ++ wpa_printf(MSG_ERROR, ++ "nl80211: Failed to remove interface %s from bridge %s", ++ bss->ifname, bridge_ifname); ++ return -1; ++ } ++ bss->added_if_into_bridge = 0; ++ } ++ ++ ret = send_and_recv_msgs(drv, msg, NULL, NULL); ++ msg = NULL; ++ if (!ret) { ++ if (bridge_ifname[0] && val && ++ i802_check_bridge(drv, bss, bridge_ifname, bss->ifname) < 0) ++ return -1; ++ return 0; ++ } ++ ++fail: ++ nlmsg_free(msg); ++ wpa_printf(MSG_ERROR, "nl80211: Failed to enable/disable 4addr"); ++ ++ return ret; ++} ++ ++ + const struct wpa_driver_ops wpa_driver_nl80211_ops = { + .name = "nl80211", + .desc = "Linux nl80211/cfg80211", +@@ -10856,4 +10899,5 @@ const struct wpa_driver_ops wpa_driver_n + .get_ext_capab = nl80211_get_ext_capab, + .update_connect_params = nl80211_update_connection_params, + .send_external_auth_status = nl80211_send_external_auth_status, ++ .set_4addr_mode = nl80211_set_4addr_mode, + }; +--- a/wpa_supplicant/config.c ++++ b/wpa_supplicant/config.c +@@ -2416,6 +2416,7 @@ static const struct parse_data ssid_fiel + #endif /* CONFIG_DPP */ + { INT_RANGE(owe_group, 0, 65535) }, + { INT_RANGE(owe_only, 0, 1) }, ++ { INT_RANGE(multi_ap_backhaul_sta, 0, 1) }, + }; + + #undef OFFSET +--- a/wpa_supplicant/config_ssid.h ++++ b/wpa_supplicant/config_ssid.h +@@ -950,6 +950,13 @@ struct wpa_ssid { + * the selection attempts for OWE BSS exceed the configured threshold. + */ + int owe_transition_bss_select_count; ++ ++ /** ++ * multi_ap_backhaul_sta - Multi-AP backhaul STA ++ * 0 = normal (non-Multi-AP) station ++ * 1 = Multi-AP backhaul station ++ */ ++ int multi_ap_backhaul_sta; + }; + + #endif /* CONFIG_SSID_H */ +--- a/wpa_supplicant/driver_i.h ++++ b/wpa_supplicant/driver_i.h +@@ -1046,4 +1046,12 @@ wpa_drv_send_external_auth_status(struct + params); + } + ++static inline int wpa_drv_set_4addr_mode(struct wpa_supplicant *wpa_s, int val) ++{ ++ if (!wpa_s->driver->set_4addr_mode) ++ return -1; ++ return wpa_s->driver->set_4addr_mode(wpa_s->drv_priv, ++ wpa_s->bridge_ifname, val); ++} ++ + #endif /* DRIVER_I_H */ +--- a/wpa_supplicant/events.c ++++ b/wpa_supplicant/events.c +@@ -324,6 +324,9 @@ void wpa_supplicant_mark_disassoc(struct + os_memset(wpa_s->last_tk, 0, sizeof(wpa_s->last_tk)); + #endif /* CONFIG_TESTING_OPTIONS */ + wpa_s->ieee80211ac = 0; ++ ++ if (wpa_s->enabled_4addr_mode && wpa_drv_set_4addr_mode(wpa_s, 0) == 0) ++ wpa_s->enabled_4addr_mode = 0; + } + + +@@ -2267,6 +2270,50 @@ static void interworking_process_assoc_r + #endif /* CONFIG_INTERWORKING */ + + ++static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s, ++ const u8 *ies, size_t ies_len) ++{ ++ struct ieee802_11_elems elems; ++ const u8 *map_sub_elem, *pos; ++ size_t len; ++ ++ if (!wpa_s->current_ssid || ++ !wpa_s->current_ssid->multi_ap_backhaul_sta || ++ !ies || ++ ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) ++ return; ++ ++ if (!elems.multi_ap || elems.multi_ap_len < 7) { ++ wpa_printf(MSG_INFO, "AP doesn't support Multi-AP protocol"); ++ goto fail; ++ } ++ ++ pos = elems.multi_ap + 4; ++ len = elems.multi_ap_len - 4; ++ ++ map_sub_elem = get_ie(pos, len, MULTI_AP_SUB_ELEM_TYPE); ++ if (!map_sub_elem || map_sub_elem[1] < 1) { ++ wpa_printf(MSG_INFO, "invalid Multi-AP sub elem type"); ++ goto fail; ++ } ++ ++ if (!(map_sub_elem[2] & MULTI_AP_BACKHAUL_BSS)) { ++ wpa_printf(MSG_INFO, "AP doesn't support backhaul BSS"); ++ goto fail; ++ } ++ ++ if (wpa_drv_set_4addr_mode(wpa_s, 1) < 0) { ++ wpa_printf(MSG_ERROR, "Failed to set 4addr mode"); ++ goto fail; ++ } ++ wpa_s->enabled_4addr_mode = 1; ++ return; ++ ++fail: ++ wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING); ++} ++ ++ + #ifdef CONFIG_FST + static int wpas_fst_update_mbie(struct wpa_supplicant *wpa_s, + const u8 *ie, size_t ie_len) +@@ -2343,6 +2390,9 @@ static int wpa_supplicant_event_associnf + get_ie(data->assoc_info.resp_ies, + data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP)) + wpa_s->ieee80211ac = 1; ++ ++ multi_ap_process_assoc_resp(wpa_s, data->assoc_info.resp_ies, ++ data->assoc_info.resp_ies_len); + } + if (data->assoc_info.beacon_ies) + wpa_hexdump(MSG_DEBUG, "beacon_ies", +--- a/wpa_supplicant/sme.c ++++ b/wpa_supplicant/sme.c +@@ -1552,6 +1552,22 @@ void sme_associate(struct wpa_supplicant + } + #endif /* CONFIG_OWE */ + ++ if (wpa_s->current_ssid && wpa_s->current_ssid->multi_ap_backhaul_sta) { ++ size_t multi_ap_ie_len; ++ ++ multi_ap_ie_len = add_multi_ap_ie( ++ wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len, ++ sizeof(wpa_s->sme.assoc_req_ie) - ++ wpa_s->sme.assoc_req_ie_len, ++ MULTI_AP_BACKHAUL_STA); ++ if (multi_ap_ie_len == 0) { ++ wpa_printf(MSG_ERROR, ++ "Multi-AP: Failed to build Multi-AP IE"); ++ return; ++ } ++ wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len; ++ } ++ + params.bssid = bssid; + params.ssid = wpa_s->sme.ssid; + params.ssid_len = wpa_s->sme.ssid_len; +--- a/wpa_supplicant/wpa_supplicant.c ++++ b/wpa_supplicant/wpa_supplicant.c +@@ -2893,6 +2893,21 @@ static u8 * wpas_populate_assoc_ies( + } + #endif /* CONFIG_IEEE80211R */ + ++ if (ssid->multi_ap_backhaul_sta) { ++ size_t multi_ap_ie_len; ++ ++ multi_ap_ie_len = add_multi_ap_ie(wpa_ie + wpa_ie_len, ++ max_wpa_ie_len - wpa_ie_len, ++ MULTI_AP_BACKHAUL_STA); ++ if (multi_ap_ie_len == 0) { ++ wpa_printf(MSG_ERROR, ++ "Multi-AP: Failed to build Multi-AP IE"); ++ os_free(wpa_ie); ++ return NULL; ++ } ++ wpa_ie_len += multi_ap_ie_len; ++ } ++ + params->wpa_ie = wpa_ie; + params->wpa_ie_len = wpa_ie_len; + params->auth_alg = algs; +@@ -3377,6 +3392,9 @@ void wpa_supplicant_deauthenticate(struc + zero_addr = 1; + } + ++ if (wpa_s->enabled_4addr_mode && wpa_drv_set_4addr_mode(wpa_s, 0) == 0) ++ wpa_s->enabled_4addr_mode = 0; ++ + #ifdef CONFIG_TDLS + wpa_tdls_teardown_peers(wpa_s->wpa); + #endif /* CONFIG_TDLS */ +--- a/wpa_supplicant/wpa_supplicant.conf ++++ b/wpa_supplicant/wpa_supplicant.conf +@@ -1399,6 +1399,13 @@ fast_reauth=1 + # 2: MCS 0-9 + # 3: not supported + ++# multi_ap_backhaul_sta: Multi-AP backhaul STA functionality ++# 0 = normal STA (default) ++# 1 = backhaul STA ++# A backhaul STA sends the Multi-AP IE, fails to associate if the AP does not ++# support Multi-AP, and sets 4-address mode if it does. Thus, the netdev can be ++# added to a bridge to allow forwarding frames over this backhaul link. ++ + ##### Fast Session Transfer (FST) support ##################################### + # + # The options in this section are only available when the build configuration +--- a/wpa_supplicant/wpa_supplicant_i.h ++++ b/wpa_supplicant/wpa_supplicant_i.h +@@ -1242,6 +1242,7 @@ struct wpa_supplicant { + unsigned int disable_fils:1; + #endif /* CONFIG_FILS */ + unsigned int ieee80211ac:1; ++ unsigned int enabled_4addr_mode:1; + }; + + diff --git a/package/network/services/hostapd/patches/552-tests-Multi-AP-association.patch b/package/network/services/hostapd/patches/552-tests-Multi-AP-association.patch new file mode 100644 index 0000000000..1f3aed92bd --- /dev/null +++ b/package/network/services/hostapd/patches/552-tests-Multi-AP-association.patch @@ -0,0 +1,100 @@ +From 7488e0ade6dffb6df4c1fb6526a9f3ede0eb18ef Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Thu, 20 Dec 2018 12:41:00 +0200 +Subject: [PATCH] tests: Multi-AP association + +Signed-off-by: Jouni Malinen +--- + tests/hwsim/test_multi_ap.py | 73 ++++++++++++++++++++++++++++++++++++ + tests/hwsim/wpasupplicant.py | 3 +- + 2 files changed, 75 insertions(+), 1 deletion(-) + create mode 100644 tests/hwsim/test_multi_ap.py + +--- /dev/null ++++ b/tests/hwsim/test_multi_ap.py +@@ -0,0 +1,73 @@ ++# Test cases for Multi-AP ++# Copyright (c) 2018, The Linux Foundation ++# ++# This software may be distributed under the terms of the BSD license. ++# See README for more details. ++ ++import hostapd ++ ++def test_multi_ap_association(dev, apdev): ++ """Multi-AP association in backhaul BSS""" ++ run_multi_ap_association(dev, apdev, 1) ++ dev[1].connect("multi-ap", psk="12345678", scan_freq="2412", ++ wait_connect=False) ++ ev = dev[1].wait_event([ "CTRL-EVENT-DISCONNECTED", ++ "CTRL-EVENT-CONNECTED", ++ "CTRL-EVENT-ASSOC-REJECT" ], ++ timeout=5) ++ dev[1].request("DISCONNECT") ++ if ev is None: ++ raise Exception("Connection result not reported") ++ if "CTRL-EVENT-ASSOC-REJECT" not in ev: ++ raise Exception("Association rejection not reported") ++ if "status_code=12" not in ev: ++ raise Exception("Unexpected association status code: " + ev) ++ ++def test_multi_ap_association_shared_bss(dev, apdev): ++ """Multi-AP association in backhaul BSS (with fronthaul BSS enabled)""" ++ run_multi_ap_association(dev, apdev, 3) ++ dev[1].connect("multi-ap", psk="12345678", scan_freq="2412") ++ ++def run_multi_ap_association(dev, apdev, multi_ap): ++ params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") ++ params["multi_ap"] = str(multi_ap) ++ hapd = hostapd.add_ap(apdev[0], params) ++ ++ dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", ++ scan_freq="2412") ++ ++def test_multi_ap_disabled_on_ap(dev, apdev): ++ """Multi-AP association attempt when disabled on AP""" ++ params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") ++ hapd = hostapd.add_ap(apdev[0], params) ++ ++ dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", ++ scan_freq="2412", wait_connect=False) ++ ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED", ++ "CTRL-EVENT-CONNECTED" ], ++ timeout=5) ++ dev[0].request("DISCONNECT") ++ if ev is None: ++ raise Exception("Connection result not reported") ++ if "CTRL-EVENT-DISCONNECTED" not in ev: ++ raise Exception("Unexpected connection result") ++ ++def test_multi_ap_fronthaul_on_ap(dev, apdev): ++ """Multi-AP association attempt when only fronthaul BSS on AP""" ++ params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") ++ params["multi_ap"] = "2" ++ hapd = hostapd.add_ap(apdev[0], params) ++ ++ dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", ++ scan_freq="2412", wait_connect=False) ++ ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED", ++ "CTRL-EVENT-CONNECTED", ++ "CTRL-EVENT-ASSOC-REJECT" ], ++ timeout=5) ++ dev[0].request("DISCONNECT") ++ if ev is None: ++ raise Exception("Connection result not reported") ++ if "CTRL-EVENT-ASSOC-REJECT" not in ev: ++ raise Exception("Association rejection not reported") ++ if "status_code=12" not in ev: ++ raise Exception("Unexpected association status code: " + ev) +--- a/tests/hwsim/wpasupplicant.py ++++ b/tests/hwsim/wpasupplicant.py +@@ -1031,7 +1031,8 @@ class WpaSupplicant: + "dpp_csign", "dpp_csign_expiry", + "dpp_netaccesskey", "dpp_netaccesskey_expiry", + "group_mgmt", "owe_group", +- "roaming_consortium_selection" ] ++ "roaming_consortium_selection", "multi_ap_backhaul_sta" ] ++ + for field in not_quoted: + if field in kwargs and kwargs[field]: + self.set_network(id, field, kwargs[field]) diff --git a/package/network/services/hostapd/patches/553-tests-refactor-test_multi_ap.patch b/package/network/services/hostapd/patches/553-tests-refactor-test_multi_ap.patch new file mode 100644 index 0000000000..240407fd1c --- /dev/null +++ b/package/network/services/hostapd/patches/553-tests-refactor-test_multi_ap.patch @@ -0,0 +1,72 @@ +From 0f5029ff41ef286aa7b3e4a3efd3f1a16be925e8 Mon Sep 17 00:00:00 2001 +From: "Arnout Vandecappelle (Essensium/Mind)" +Date: Wed, 9 Jan 2019 18:41:08 +0100 +Subject: [PATCH] tests: refactor test_multi_ap + +With just one additional argument, the run_multi_ap_association function +can be used for all tests. + +While we're at it, also move it to the top of the file. + +Signed-off-by: Arnout Vandecappelle (Essensium/Mind) +--- +v4: new patch +--- + tests/hwsim/test_multi_ap.py | 30 +++++++++++------------------- + 1 file changed, 11 insertions(+), 19 deletions(-) + +--- a/tests/hwsim/test_multi_ap.py ++++ b/tests/hwsim/test_multi_ap.py +@@ -6,6 +6,15 @@ + + import hostapd + ++def run_multi_ap_association(dev, apdev, multi_ap, wait_connect=True): ++ params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") ++ if multi_ap: ++ params["multi_ap"] = str(multi_ap) ++ hapd = hostapd.add_ap(apdev[0], params) ++ ++ dev[0].connect("multi-ap", psk="12345678", scan_freq="2412", ++ multi_ap_backhaul_sta="1", wait_connect=wait_connect) ++ + def test_multi_ap_association(dev, apdev): + """Multi-AP association in backhaul BSS""" + run_multi_ap_association(dev, apdev, 1) +@@ -28,21 +37,9 @@ def test_multi_ap_association_shared_bss + run_multi_ap_association(dev, apdev, 3) + dev[1].connect("multi-ap", psk="12345678", scan_freq="2412") + +-def run_multi_ap_association(dev, apdev, multi_ap): +- params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") +- params["multi_ap"] = str(multi_ap) +- hapd = hostapd.add_ap(apdev[0], params) +- +- dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", +- scan_freq="2412") +- + def test_multi_ap_disabled_on_ap(dev, apdev): + """Multi-AP association attempt when disabled on AP""" +- params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") +- hapd = hostapd.add_ap(apdev[0], params) +- +- dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", +- scan_freq="2412", wait_connect=False) ++ run_multi_ap_association(dev, apdev, 0, wait_connect=False) + ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED", + "CTRL-EVENT-CONNECTED" ], + timeout=5) +@@ -54,12 +51,7 @@ def test_multi_ap_disabled_on_ap(dev, ap + + def test_multi_ap_fronthaul_on_ap(dev, apdev): + """Multi-AP association attempt when only fronthaul BSS on AP""" +- params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") +- params["multi_ap"] = "2" +- hapd = hostapd.add_ap(apdev[0], params) +- +- dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", +- scan_freq="2412", wait_connect=False) ++ run_multi_ap_association(dev, apdev, 2, wait_connect=False) + ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED", + "CTRL-EVENT-CONNECTED", + "CTRL-EVENT-ASSOC-REJECT" ], diff --git a/package/network/services/hostapd/patches/554-multi_ap-don-t-reject-backhaul-STA-on-fronhaul-BSS.patch b/package/network/services/hostapd/patches/554-multi_ap-don-t-reject-backhaul-STA-on-fronhaul-BSS.patch new file mode 100644 index 0000000000..6c30a1793e --- /dev/null +++ b/package/network/services/hostapd/patches/554-multi_ap-don-t-reject-backhaul-STA-on-fronhaul-BSS.patch @@ -0,0 +1,106 @@ +From 71b061b8a13791a1ed858d924e401541c8584030 Mon Sep 17 00:00:00 2001 +From: "Arnout Vandecappelle (Essensium/Mind)" +Date: Wed, 9 Jan 2019 19:08:00 +0100 +Subject: [PATCH] multi_ap: don't reject backhaul STA on fronhaul BSS + +The Multi-AP specification only specifies that information elements have +to be added to the association requests and responses; it doesn't +specify anything about what should be done in case they are missing. +Currently, we reject non-backhaul associations on a backhaul-only BSS, +and non-fronthaul associations on a fronthaul-only BSS. + +However, this makes WPS fail when fronthaul and backhaul are separate +SSIDs. Indeed, WPS for the backhaul link is performed on the *fronthaul* +SSID. Thus, the association request used for WPS *will* contain the +Multi-AP IE indicating a backhaul STA. Rejecting that association makes +WPS fail. + +Therefore, accept a multi-AP backhaul STA association request on a +fronthaul-only BSS. Still issue a warning about it, but only at level +DEBUG intead of INFO. Also change the condition checking to make it +clearer. + +While we're at it, also fix the handling of unexpected bits in the +Multi-AP IE. 4 bits are reserved in the specification, so these +certainly have to be ignored. The specification also doesn't say that +setting one of the other bits is not allowed. Therefore, only report +unexpected values in the Multi-AP IE, don't reject because of it. +Note that a malformed IE (containing more than one byte) still triggers +a rejection. + +Signed-off-by: Arnout Vandecappelle (Essensium/Mind) +--- +v4: new patch + +Cfr. discussion on http://lists.infradead.org/pipermail/hostap/2019-January/039232.html +and follow-ups. +--- + src/ap/ieee802_11.c | 38 +++++++++++++++++++----------------- + tests/hwsim/test_multi_ap.py | 6 ++---- + 2 files changed, 22 insertions(+), 22 deletions(-) + +--- a/src/ap/ieee802_11.c ++++ b/src/ap/ieee802_11.c +@@ -2253,28 +2253,30 @@ static u16 check_multi_ap(struct hostapd + } + } + +- if (multi_ap_value == MULTI_AP_BACKHAUL_STA) +- sta->flags |= WLAN_STA_MULTI_AP; +- +- if ((hapd->conf->multi_ap & BACKHAUL_BSS) && +- multi_ap_value == MULTI_AP_BACKHAUL_STA) +- return WLAN_STATUS_SUCCESS; +- +- if (hapd->conf->multi_ap & FRONTHAUL_BSS) { +- if (multi_ap_value == MULTI_AP_BACKHAUL_STA) { +- hostapd_logger(hapd, sta->addr, +- HOSTAPD_MODULE_IEEE80211, +- HOSTAPD_LEVEL_INFO, +- "Backhaul STA tries to associate with fronthaul-only BSS"); +- return WLAN_STATUS_ASSOC_DENIED_UNSPEC; +- } +- return WLAN_STATUS_SUCCESS; ++ if (multi_ap_value && multi_ap_value != MULTI_AP_BACKHAUL_STA) ++ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, ++ HOSTAPD_LEVEL_INFO, ++ "Multi-AP IE with unexpected value 0x%02x", ++ multi_ap_value); ++ ++ if (!(multi_ap_value & MULTI_AP_BACKHAUL_STA)) { ++ if (hapd->conf->multi_ap & FRONTHAUL_BSS) ++ return WLAN_STATUS_SUCCESS; ++ ++ hostapd_logger(hapd, sta->addr, ++ HOSTAPD_MODULE_IEEE80211, ++ HOSTAPD_LEVEL_INFO, ++ "Non-Multi-AP STA tries to associate with backhaul-only BSS"); ++ return WLAN_STATUS_ASSOC_DENIED_UNSPEC; + } + +- hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, +- HOSTAPD_LEVEL_INFO, +- "Non-Multi-AP STA tries to associate with backhaul-only BSS"); +- return WLAN_STATUS_ASSOC_DENIED_UNSPEC; ++ if (!(hapd->conf->multi_ap & BACKHAUL_BSS)) ++ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, ++ HOSTAPD_LEVEL_DEBUG, ++ "Backhaul STA tries to associate with fronthaul-only BSS"); ++ ++ sta->flags |= WLAN_STA_MULTI_AP; ++ return WLAN_STATUS_SUCCESS; + } + + +--- a/tests/hwsim/test_multi_ap.py ++++ b/tests/hwsim/test_multi_ap.py +@@ -59,7 +59,5 @@ def test_multi_ap_fronthaul_on_ap(dev, a + dev[0].request("DISCONNECT") + if ev is None: + raise Exception("Connection result not reported") +- if "CTRL-EVENT-ASSOC-REJECT" not in ev: +- raise Exception("Association rejection not reported") +- if "status_code=12" not in ev: +- raise Exception("Unexpected association status code: " + ev) ++ if "CTRL-EVENT-DISCONNECTED" not in ev: ++ raise Exception("Unexpected connection result") diff --git a/package/network/services/hostapd/patches/555-WPS-wps_build_wfa_ext-add-multi_ap_subelem-parameter.patch b/package/network/services/hostapd/patches/555-WPS-wps_build_wfa_ext-add-multi_ap_subelem-parameter.patch new file mode 100644 index 0000000000..2a1dc76ac1 --- /dev/null +++ b/package/network/services/hostapd/patches/555-WPS-wps_build_wfa_ext-add-multi_ap_subelem-parameter.patch @@ -0,0 +1,342 @@ +From ad3c6faca118c23cdafef418dc27b3cee7d0e06e Mon Sep 17 00:00:00 2001 +From: "Arnout Vandecappelle (Essensium/Mind)" +Date: Wed, 9 Jan 2019 19:19:26 +0100 +Subject: [PATCH] WPS: wps_build_wfa_ext(): add multi_ap_subelem parameter + +The Multi-AP specification adds a new subelement to the WFA extension +element in the WPS exchange. Add an additional parameter to +wps_build_wfa_ext() to add this subelement. The subelement is only added +if the parameter is non-0. Note that we don't reuse the existing +MULTI_AP_SUB_ELEM_TYPE definition here, but rather define a new +WFA_ELEM_MULTI_AP, to make sure the enum of WFA subelement types remains +complete. + +For now, all callers set the multi_ap_subelem parameter to 0. + +Signed-off-by: Arnout Vandecappelle (Essensium/Mind) +--- +v4: Split off from supplicant WPS patch + +Since the original patch from Davina Lyu didn't have this extra +argument, I kept myself as the author of this patch. +--- + src/p2p/p2p_build.c | 2 +- + src/wps/wps.c | 6 +++--- + src/wps/wps_attr_build.c | 11 ++++++++++- + src/wps/wps_common.c | 16 ++++++++-------- + src/wps/wps_defs.h | 3 ++- + src/wps/wps_enrollee.c | 10 +++++----- + src/wps/wps_er.c | 4 ++-- + src/wps/wps_i.h | 3 ++- + src/wps/wps_registrar.c | 14 +++++++------- + src/wps/wps_upnp.c | 2 +- + 10 files changed, 41 insertions(+), 30 deletions(-) + +--- a/src/p2p/p2p_build.c ++++ b/src/p2p/p2p_build.c +@@ -802,7 +802,7 @@ int p2p_build_wps_ie(struct p2p_data *p2 + wpabuf_put_be16(buf, p2p->cfg->config_methods); + } + +- if (wps_build_wfa_ext(buf, 0, NULL, 0) < 0) ++ if (wps_build_wfa_ext(buf, 0, NULL, 0, 0) < 0) + return -1; + + if (all_attr && p2p->cfg->num_sec_dev_types) { +--- a/src/wps/wps.c ++++ b/src/wps/wps.c +@@ -430,7 +430,7 @@ struct wpabuf * wps_build_assoc_req_ie(e + + if (wps_build_version(ie) || + wps_build_req_type(ie, req_type) || +- wps_build_wfa_ext(ie, 0, NULL, 0)) { ++ wps_build_wfa_ext(ie, 0, NULL, 0, 0)) { + wpabuf_free(ie); + return NULL; + } +@@ -464,7 +464,7 @@ struct wpabuf * wps_build_assoc_resp_ie( + + if (wps_build_version(ie) || + wps_build_resp_type(ie, WPS_RESP_AP) || +- wps_build_wfa_ext(ie, 0, NULL, 0)) { ++ wps_build_wfa_ext(ie, 0, NULL, 0, 0)) { + wpabuf_free(ie); + return NULL; + } +@@ -516,7 +516,7 @@ struct wpabuf * wps_build_probe_req_ie(u + wps_build_model_name(dev, ie) || + wps_build_model_number(dev, ie) || + wps_build_dev_name(dev, ie) || +- wps_build_wfa_ext(ie, req_type == WPS_REQ_ENROLLEE, NULL, 0) || ++ wps_build_wfa_ext(ie, req_type == WPS_REQ_ENROLLEE, NULL, 0, 0) || + wps_build_req_dev_type(dev, ie, num_req_dev_types, req_dev_types) + || + wps_build_secondary_dev_type(dev, ie) +--- a/src/wps/wps_attr_build.c ++++ b/src/wps/wps_attr_build.c +@@ -203,7 +203,8 @@ int wps_build_version(struct wpabuf *msg + + + int wps_build_wfa_ext(struct wpabuf *msg, int req_to_enroll, +- const u8 *auth_macs, size_t auth_macs_count) ++ const u8 *auth_macs, size_t auth_macs_count, ++ u8 multi_ap_subelem) + { + u8 *len; + +@@ -244,6 +245,14 @@ int wps_build_wfa_ext(struct wpabuf *msg + MAC2STR(&auth_macs[i * ETH_ALEN])); + } + ++ if (multi_ap_subelem) { ++ wpa_printf(MSG_DEBUG, "WPS: * Multi-AP (0x%x)", ++ multi_ap_subelem); ++ wpabuf_put_u8(msg, WFA_ELEM_MULTI_AP); ++ wpabuf_put_u8(msg, 1); /* length */ ++ wpabuf_put_u8(msg, multi_ap_subelem); ++ } ++ + WPA_PUT_BE16(len, (u8 *) wpabuf_put(msg, 0) - len - 2); + + #ifdef CONFIG_WPS_TESTING +--- a/src/wps/wps_common.c ++++ b/src/wps/wps_common.c +@@ -374,7 +374,7 @@ struct wpabuf * wps_get_oob_cred(struct + (rf_band && wps_build_rf_bands_attr(plain, rf_band)) || + (channel && wps_build_ap_channel(plain, channel)) || + wps_build_mac_addr(plain, wps->dev.mac_addr) || +- wps_build_wfa_ext(plain, 0, NULL, 0)) { ++ wps_build_wfa_ext(plain, 0, NULL, 0, 0)) { + os_free(data.new_psk); + wpabuf_clear_free(plain); + return NULL; +@@ -421,7 +421,7 @@ struct wpabuf * wps_build_nfc_pw_token(u + + if (wps_build_oob_dev_pw(data, dev_pw_id, pubkey, + wpabuf_head(dev_pw), wpabuf_len(dev_pw)) || +- wps_build_wfa_ext(data, 0, NULL, 0)) { ++ wps_build_wfa_ext(data, 0, NULL, 0, 0)) { + wpa_printf(MSG_ERROR, "WPS: Failed to build NFC password " + "token"); + wpabuf_clear_free(data); +@@ -586,7 +586,7 @@ struct wpabuf * wps_build_wsc_ack(struct + wps_build_msg_type(msg, WPS_WSC_ACK) || + wps_build_enrollee_nonce(wps, msg) || + wps_build_registrar_nonce(wps, msg) || +- wps_build_wfa_ext(msg, 0, NULL, 0)) { ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { + wpabuf_free(msg); + return NULL; + } +@@ -610,7 +610,7 @@ struct wpabuf * wps_build_wsc_nack(struc + wps_build_enrollee_nonce(wps, msg) || + wps_build_registrar_nonce(wps, msg) || + wps_build_config_error(msg, wps->config_error) || +- wps_build_wfa_ext(msg, 0, NULL, 0)) { ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { + wpabuf_free(msg); + return NULL; + } +@@ -726,7 +726,7 @@ struct wpabuf * wps_build_nfc_handover_r + if (wps_build_oob_dev_pw(msg, DEV_PW_NFC_CONNECTION_HANDOVER, + nfc_dh_pubkey, NULL, 0) || + wps_build_uuid_e(msg, ctx->uuid) || +- wps_build_wfa_ext(msg, 0, NULL, 0)) { ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { + wpabuf_free(msg); + return NULL; + } +@@ -809,7 +809,7 @@ struct wpabuf * wps_build_nfc_handover_s + wps_build_ssid(msg, ctx) || + wps_build_ap_freq(msg, freq) || + (bssid && wps_build_mac_addr(msg, bssid)) || +- wps_build_wfa_ext(msg, 0, NULL, 0)) { ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { + wpabuf_free(msg); + return NULL; + } +@@ -848,7 +848,7 @@ struct wpabuf * wps_build_nfc_handover_r + wps_build_rf_bands(&ctx->dev, msg, 0) || + wps_build_serial_number(&ctx->dev, msg) || + wps_build_uuid_e(msg, ctx->uuid) || +- wps_build_wfa_ext(msg, 0, NULL, 0)) { ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { + wpabuf_free(msg); + return NULL; + } +@@ -900,7 +900,7 @@ struct wpabuf * wps_build_nfc_handover_s + wps_build_rf_bands(&ctx->dev, msg, 0) || + wps_build_serial_number(&ctx->dev, msg) || + wps_build_uuid_e(msg, ctx->uuid) || +- wps_build_wfa_ext(msg, 0, NULL, 0)) { ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { + wpabuf_free(msg); + return NULL; + } +--- a/src/wps/wps_defs.h ++++ b/src/wps/wps_defs.h +@@ -152,7 +152,8 @@ enum { + WFA_ELEM_NETWORK_KEY_SHAREABLE = 0x02, + WFA_ELEM_REQUEST_TO_ENROLL = 0x03, + WFA_ELEM_SETTINGS_DELAY_TIME = 0x04, +- WFA_ELEM_REGISTRAR_CONFIGURATION_METHODS = 0x05 ++ WFA_ELEM_REGISTRAR_CONFIGURATION_METHODS = 0x05, ++ WFA_ELEM_MULTI_AP = 0x06 + }; + + /* Device Password ID */ +--- a/src/wps/wps_enrollee.c ++++ b/src/wps/wps_enrollee.c +@@ -152,7 +152,7 @@ static struct wpabuf * wps_build_m1(stru + wps_build_dev_password_id(msg, wps->dev_pw_id) || + wps_build_config_error(msg, WPS_CFG_NO_ERROR) || + wps_build_os_version(&wps->wps->dev, msg) || +- wps_build_wfa_ext(msg, 0, NULL, 0) || ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || + wps_build_vendor_ext_m1(&wps->wps->dev, msg)) { + wpabuf_free(msg); + return NULL; +@@ -190,7 +190,7 @@ static struct wpabuf * wps_build_m3(stru + wps_build_msg_type(msg, WPS_M3) || + wps_build_registrar_nonce(wps, msg) || + wps_build_e_hash(wps, msg) || +- wps_build_wfa_ext(msg, 0, NULL, 0) || ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || + wps_build_authenticator(wps, msg)) { + wpabuf_free(msg); + return NULL; +@@ -223,7 +223,7 @@ static struct wpabuf * wps_build_m5(stru + wps_build_e_snonce1(wps, plain) || + wps_build_key_wrap_auth(wps, plain) || + wps_build_encr_settings(wps, msg, plain) || +- wps_build_wfa_ext(msg, 0, NULL, 0) || ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || + wps_build_authenticator(wps, msg)) { + wpabuf_clear_free(plain); + wpabuf_free(msg); +@@ -393,7 +393,7 @@ static struct wpabuf * wps_build_m7(stru + (wps->wps->ap && wps_build_ap_settings(wps, plain)) || + wps_build_key_wrap_auth(wps, plain) || + wps_build_encr_settings(wps, msg, plain) || +- wps_build_wfa_ext(msg, 0, NULL, 0) || ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || + wps_build_authenticator(wps, msg)) { + wpabuf_clear_free(plain); + wpabuf_free(msg); +@@ -430,7 +430,7 @@ static struct wpabuf * wps_build_wsc_don + wps_build_msg_type(msg, WPS_WSC_DONE) || + wps_build_enrollee_nonce(wps, msg) || + wps_build_registrar_nonce(wps, msg) || +- wps_build_wfa_ext(msg, 0, NULL, 0)) { ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { + wpabuf_free(msg); + return NULL; + } +--- a/src/wps/wps_er.c ++++ b/src/wps/wps_er.c +@@ -1530,7 +1530,7 @@ void wps_er_set_sel_reg(struct wps_er *e + wps_er_build_selected_registrar(msg, sel_reg) || + wps_er_build_dev_password_id(msg, dev_passwd_id) || + wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods) || +- wps_build_wfa_ext(msg, 0, auth_macs, count) || ++ wps_build_wfa_ext(msg, 0, auth_macs, count, 0) || + wps_er_build_uuid_r(msg, er->wps->uuid)) { + wpabuf_free(msg); + return; +@@ -2048,7 +2048,7 @@ struct wpabuf * wps_er_config_token_from + data.wps = wps; + data.use_cred = cred; + if (wps_build_cred(&data, ret) || +- wps_build_wfa_ext(ret, 0, NULL, 0)) { ++ wps_build_wfa_ext(ret, 0, NULL, 0, 0)) { + wpabuf_free(ret); + return NULL; + } +--- a/src/wps/wps_i.h ++++ b/src/wps/wps_i.h +@@ -163,7 +163,8 @@ int wps_build_encr_settings(struct wps_d + struct wpabuf *plain); + int wps_build_version(struct wpabuf *msg); + int wps_build_wfa_ext(struct wpabuf *msg, int req_to_enroll, +- const u8 *auth_macs, size_t auth_macs_count); ++ const u8 *auth_macs, size_t auth_macs_count, ++ u8 multi_ap_subelem); + int wps_build_msg_type(struct wpabuf *msg, enum wps_msg_type msg_type); + int wps_build_enrollee_nonce(struct wps_data *wps, struct wpabuf *msg); + int wps_build_registrar_nonce(struct wps_data *wps, struct wpabuf *msg); +--- a/src/wps/wps_registrar.c ++++ b/src/wps/wps_registrar.c +@@ -1281,7 +1281,7 @@ static int wps_set_ie(struct wps_registr + wps_build_sel_reg_config_methods(reg, beacon) || + wps_build_sel_pbc_reg_uuid_e(reg, beacon) || + (reg->dualband && wps_build_rf_bands(®->wps->dev, beacon, 0)) || +- wps_build_wfa_ext(beacon, 0, auth_macs, count) || ++ wps_build_wfa_ext(beacon, 0, auth_macs, count, 0) || + wps_build_vendor_ext(®->wps->dev, beacon)) { + wpabuf_free(beacon); + wpabuf_free(probe); +@@ -1311,7 +1311,7 @@ static int wps_set_ie(struct wps_registr + wps_build_device_attrs(®->wps->dev, probe) || + wps_build_probe_config_methods(reg, probe) || + (reg->dualband && wps_build_rf_bands(®->wps->dev, probe, 0)) || +- wps_build_wfa_ext(probe, 0, auth_macs, count) || ++ wps_build_wfa_ext(probe, 0, auth_macs, count, 0) || + wps_build_vendor_ext(®->wps->dev, probe)) { + wpabuf_free(beacon); + wpabuf_free(probe); +@@ -1845,7 +1845,7 @@ static struct wpabuf * wps_build_m2(stru + wps_build_config_error(msg, WPS_CFG_NO_ERROR) || + wps_build_dev_password_id(msg, wps->dev_pw_id) || + wps_build_os_version(&wps->wps->dev, msg) || +- wps_build_wfa_ext(msg, 0, NULL, 0)) { ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { + wpabuf_free(msg); + return NULL; + } +@@ -1913,7 +1913,7 @@ static struct wpabuf * wps_build_m2d(str + wps_build_assoc_state(wps, msg) || + wps_build_config_error(msg, err) || + wps_build_os_version(&wps->wps->dev, msg) || +- wps_build_wfa_ext(msg, 0, NULL, 0)) { ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { + wpabuf_free(msg); + return NULL; + } +@@ -1949,7 +1949,7 @@ static struct wpabuf * wps_build_m4(stru + wps_build_r_snonce1(wps, plain) || + wps_build_key_wrap_auth(wps, plain) || + wps_build_encr_settings(wps, msg, plain) || +- wps_build_wfa_ext(msg, 0, NULL, 0) || ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || + wps_build_authenticator(wps, msg)) { + wpabuf_clear_free(plain); + wpabuf_free(msg); +@@ -1984,7 +1984,7 @@ static struct wpabuf * wps_build_m6(stru + wps_build_r_snonce2(wps, plain) || + wps_build_key_wrap_auth(wps, plain) || + wps_build_encr_settings(wps, msg, plain) || +- wps_build_wfa_ext(msg, 0, NULL, 0) || ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || + wps_build_authenticator(wps, msg)) { + wpabuf_clear_free(plain); + wpabuf_free(msg); +@@ -2021,7 +2021,7 @@ static struct wpabuf * wps_build_m8(stru + (!wps->wps->ap && !wps->er && wps_build_ap_settings(wps, plain)) || + wps_build_key_wrap_auth(wps, plain) || + wps_build_encr_settings(wps, msg, plain) || +- wps_build_wfa_ext(msg, 0, NULL, 0) || ++ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || + wps_build_authenticator(wps, msg)) { + wpabuf_clear_free(plain); + wpabuf_clear_free(msg); +--- a/src/wps/wps_upnp.c ++++ b/src/wps/wps_upnp.c +@@ -599,7 +599,7 @@ static struct wpabuf * build_fake_wsc_ac + wpabuf_put_be16(msg, ATTR_REGISTRAR_NONCE); + wpabuf_put_be16(msg, WPS_NONCE_LEN); + wpabuf_put(msg, WPS_NONCE_LEN); +- if (wps_build_wfa_ext(msg, 0, NULL, 0)) { ++ if (wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { + wpabuf_free(msg); + return NULL; + } diff --git a/package/network/services/hostapd/patches/556-wpa_supplicant-support-Multi-AP-backhaul-STA-onboard.patch b/package/network/services/hostapd/patches/556-wpa_supplicant-support-Multi-AP-backhaul-STA-onboard.patch new file mode 100644 index 0000000000..11c65c71a0 --- /dev/null +++ b/package/network/services/hostapd/patches/556-wpa_supplicant-support-Multi-AP-backhaul-STA-onboard.patch @@ -0,0 +1,217 @@ +From 6c4c98db9420a3321bbf091cfc254de5eba4b404 Mon Sep 17 00:00:00 2001 +From: Davina Lu +Date: Tue, 15 Jan 2019 19:17:51 +0100 +Subject: [PATCH] wpa_supplicant: support Multi-AP backhaul STA onboarding + +The Wi-Fi Alliance Multi-AP Specification v1.0 allows onboarding of a +backhaul STA through WPS. To enable this, the backhaul STA needs to add +a Multi-AP IE to the WFA vendor extension element in the WSC M1 message +that indicates it supports the Multi-AP backhaul STA role. The registrar +(if it support Multi-AP onboarding) will respond to that with a WSC M8 +message that also contains the Multi-AP IE, and that contains the +credentials for the backhaul SSID (which may be different from the SSID +on which WPS is performed). + +Introduce a new parameter to wpas_wps_start_pbc() and allow it to be +set via control interface's new multi_ap=1 parameter of WPS_PBC call. +multi_ap_backhaul_sta is set to 1 in the automatically created SSID. +Thus, if the AP does not support Multi-AP, association will fail and +WPS will be terminated. + +Only wps_pbc is supported. + +The multi_ap argument is only added to the socket interface, not to the +dbus interface. + +Signed-off-by: Davina Lu +Signed-off-by: Igor Mitsyanko +Signed-off-by: Arnout Vandecappelle (Essensium/Mind) +Signed-off-by: Daniel Golle +--- +v4: use argument to wps_pbc instead of a global configuration option + (requested by Jouni) +--- + src/eap_peer/eap_wsc.c | 3 +++ + src/wps/wps.h | 6 ++++++ + src/wps/wps_enrollee.c | 6 +++++- + wpa_supplicant/ctrl_iface.c | 5 ++++- + wpa_supplicant/dbus/dbus_new_handlers_wps.c | 2 +- + wpa_supplicant/dbus/dbus_old_handlers_wps.c | 4 ++-- + wpa_supplicant/events.c | 2 +- + wpa_supplicant/p2p_supplicant.c | 2 +- + wpa_supplicant/wps_supplicant.c | 9 +++++++-- + wpa_supplicant/wps_supplicant.h | 2 +- + 10 files changed, 31 insertions(+), 10 deletions(-) + +--- a/src/eap_peer/eap_wsc.c ++++ b/src/eap_peer/eap_wsc.c +@@ -274,6 +274,9 @@ static void * eap_wsc_init(struct eap_sm + cfg.pin, cfg.pin_len, 0); + } + ++ if (os_strstr(phase1, "multi_ap=1")) ++ wps->multi_ap_backhaul_sta = 1; ++ + /* Use reduced client timeout for WPS to avoid long wait */ + if (sm->ClientTimeout > 30) + sm->ClientTimeout = 30; +--- a/src/wps/wps.h ++++ b/src/wps/wps.h +@@ -613,6 +613,12 @@ struct wps_context { + int ap_setup_locked; + + /** ++ * multi_ap_backhaul_sta - Whether this is a Multi-AP backhaul STA ++ * enrollee ++ */ ++ int multi_ap_backhaul_sta; ++ ++ /** + * uuid - Own UUID + */ + u8 uuid[16]; +--- a/src/wps/wps_enrollee.c ++++ b/src/wps/wps_enrollee.c +@@ -105,6 +105,7 @@ static struct wpabuf * wps_build_m1(stru + { + struct wpabuf *msg; + u16 config_methods; ++ u8 multi_ap_backhaul_sta = 0; + + if (random_get_bytes(wps->nonce_e, WPS_NONCE_LEN) < 0) + return NULL; +@@ -134,6 +135,9 @@ static struct wpabuf * wps_build_m1(stru + WPS_CONFIG_PHY_PUSHBUTTON); + } + ++ if (wps->wps->multi_ap_backhaul_sta) ++ multi_ap_backhaul_sta = MULTI_AP_BACKHAUL_STA; ++ + if (wps_build_version(msg) || + wps_build_msg_type(msg, WPS_M1) || + wps_build_uuid_e(msg, wps->uuid_e) || +@@ -152,7 +156,7 @@ static struct wpabuf * wps_build_m1(stru + wps_build_dev_password_id(msg, wps->dev_pw_id) || + wps_build_config_error(msg, WPS_CFG_NO_ERROR) || + wps_build_os_version(&wps->wps->dev, msg) || +- wps_build_wfa_ext(msg, 0, NULL, 0, 0) || ++ wps_build_wfa_ext(msg, 0, NULL, 0, multi_ap_backhaul_sta) || + wps_build_vendor_ext_m1(&wps->wps->dev, msg)) { + wpabuf_free(msg); + return NULL; +--- a/wpa_supplicant/ctrl_iface.c ++++ b/wpa_supplicant/ctrl_iface.c +@@ -1167,6 +1167,7 @@ static int wpa_supplicant_ctrl_iface_wps + #ifdef CONFIG_AP + u8 *_p2p_dev_addr = NULL; + #endif /* CONFIG_AP */ ++ int multi_ap = 0; + + if (cmd == NULL || os_strcmp(cmd, "any") == 0) { + _bssid = NULL; +@@ -1184,6 +1185,8 @@ static int wpa_supplicant_ctrl_iface_wps + wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid BSSID '%s'", + cmd); + return -1; ++ } else if (os_strncmp(cmd, "multi_ap=", 9) == 0) { ++ multi_ap = atoi(cmd + 9); + } + + #ifdef CONFIG_AP +@@ -1191,7 +1194,7 @@ static int wpa_supplicant_ctrl_iface_wps + return wpa_supplicant_ap_wps_pbc(wpa_s, _bssid, _p2p_dev_addr); + #endif /* CONFIG_AP */ + +- return wpas_wps_start_pbc(wpa_s, _bssid, 0); ++ return wpas_wps_start_pbc(wpa_s, _bssid, 0, multi_ap); + } + + +--- a/wpa_supplicant/dbus/dbus_new_handlers_wps.c ++++ b/wpa_supplicant/dbus/dbus_new_handlers_wps.c +@@ -289,7 +289,7 @@ DBusMessage * wpas_dbus_handler_wps_star + if (ret > 0) + os_snprintf(npin, sizeof(npin), "%08d", ret); + } else { +- ret = wpas_wps_start_pbc(wpa_s, params.bssid, 0); ++ ret = wpas_wps_start_pbc(wpa_s, params.bssid, 0, 0); + } + + if (ret < 0) { +--- a/wpa_supplicant/dbus/dbus_old_handlers_wps.c ++++ b/wpa_supplicant/dbus/dbus_old_handlers_wps.c +@@ -37,9 +37,9 @@ DBusMessage * wpas_dbus_iface_wps_pbc(DB + return wpas_dbus_new_invalid_opts_error(message, NULL); + + if (os_strcmp(arg_bssid, "any") == 0) +- ret = wpas_wps_start_pbc(wpa_s, NULL, 0); ++ ret = wpas_wps_start_pbc(wpa_s, NULL, 0, 0); + else if (!hwaddr_aton(arg_bssid, bssid)) +- ret = wpas_wps_start_pbc(wpa_s, bssid, 0); ++ ret = wpas_wps_start_pbc(wpa_s, bssid, 0, 0); + else { + return wpas_dbus_new_invalid_opts_error(message, + "Invalid BSSID"); +--- a/wpa_supplicant/events.c ++++ b/wpa_supplicant/events.c +@@ -4816,7 +4816,7 @@ void supplicant_event(void *ctx, enum wp + break; + case EVENT_WPS_BUTTON_PUSHED: + #ifdef CONFIG_WPS +- wpas_wps_start_pbc(wpa_s, NULL, 0); ++ wpas_wps_start_pbc(wpa_s, NULL, 0, 0); + #endif /* CONFIG_WPS */ + break; + case EVENT_AVOID_FREQUENCIES: +--- a/wpa_supplicant/p2p_supplicant.c ++++ b/wpa_supplicant/p2p_supplicant.c +@@ -1649,7 +1649,7 @@ static void wpas_start_wps_enrollee(stru + wpa_supplicant_ap_deinit(wpa_s); + wpas_copy_go_neg_results(wpa_s, res); + if (res->wps_method == WPS_PBC) { +- wpas_wps_start_pbc(wpa_s, res->peer_interface_addr, 1); ++ wpas_wps_start_pbc(wpa_s, res->peer_interface_addr, 1, 0); + #ifdef CONFIG_WPS_NFC + } else if (res->wps_method == WPS_NFC) { + wpas_wps_start_nfc(wpa_s, res->peer_device_addr, +--- a/wpa_supplicant/wps_supplicant.c ++++ b/wpa_supplicant/wps_supplicant.c +@@ -1137,9 +1137,10 @@ static void wpas_wps_reassoc(struct wpa_ + + + int wpas_wps_start_pbc(struct wpa_supplicant *wpa_s, const u8 *bssid, +- int p2p_group) ++ int p2p_group, int multi_ap_backhaul_sta) + { + struct wpa_ssid *ssid; ++ char phase1[32]; + + #ifdef CONFIG_AP + if (wpa_s->ap_iface) { +@@ -1177,10 +1178,14 @@ int wpas_wps_start_pbc(struct wpa_suppli + } + } + #endif /* CONFIG_P2P */ +- if (wpa_config_set(ssid, "phase1", "\"pbc=1\"", 0) < 0) ++ if (os_snprintf(phase1, sizeof(phase1), "pbc=1%s", ++ multi_ap_backhaul_sta ? " multi_ap=1" : "") || ++ wpa_config_set_quoted(ssid, "phase1", phase1) < 0) + return -1; + if (wpa_s->wps_fragment_size) + ssid->eap.fragment_size = wpa_s->wps_fragment_size; ++ if (multi_ap_backhaul_sta) ++ ssid->multi_ap_backhaul_sta = 1; + wpa_supplicant_wps_event(wpa_s, WPS_EV_PBC_ACTIVE, NULL); + eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout, + wpa_s, NULL); +--- a/wpa_supplicant/wps_supplicant.h ++++ b/wpa_supplicant/wps_supplicant.h +@@ -30,7 +30,7 @@ void wpas_wps_deinit(struct wpa_supplica + int wpas_wps_eapol_cb(struct wpa_supplicant *wpa_s); + enum wps_request_type wpas_wps_get_req_type(struct wpa_ssid *ssid); + int wpas_wps_start_pbc(struct wpa_supplicant *wpa_s, const u8 *bssid, +- int p2p_group); ++ int p2p_group, int multi_ap_backhaul_sta); + int wpas_wps_start_pin(struct wpa_supplicant *wpa_s, const u8 *bssid, + const char *pin, int p2p_group, u16 dev_pw_id); + void wpas_wps_pbc_overlap(struct wpa_supplicant *wpa_s); diff --git a/package/network/services/hostapd/patches/557-hostapd-support-Multi-AP-backhaul-STA-onboarding.patch b/package/network/services/hostapd/patches/557-hostapd-support-Multi-AP-backhaul-STA-onboarding.patch new file mode 100644 index 0000000000..c5785e50c3 --- /dev/null +++ b/package/network/services/hostapd/patches/557-hostapd-support-Multi-AP-backhaul-STA-onboarding.patch @@ -0,0 +1,339 @@ +From 8b04a4cddbd6dbadb24279713af7ac677e80d342 Mon Sep 17 00:00:00 2001 +From: Davina Lu +Date: Tue, 2 Oct 2018 18:34:14 -0700 +Subject: [PATCH] hostapd: support Multi-AP backhaul STA onboarding + +The Wi-Fi Alliance Multi-AP Specification v1.0 allows onboarding of a +backhaul STA through WPS. To enable this, the WPS registrar offers a +different set of credentials (backhaul credentials instead of fronthaul +credentials) when the Multi-AP subelement is present in the WFA vendor +extension element of the WSC M1 message. + +Add 3 new configuration options to specify the backhaul credentials for +the hostapd internal registrar: multi_ap_backhaul_ssid, +multi_ap_backhaul_wpa_psk, multi_ap_backhaul_wpa_passphrase. These are +only relevant for a fronthaul SSID, i.e. where multi_ap is set to 2 or +3. When these options are set, pass the backhaul credentials instead of +the normal credentials when the Multi-AP subelement is present. + +Ignore the Multi-AP subelement if the backhaul config options are not +set. Note that for an SSID which is fronthaul and backhaul at the same +time (i.e., multi_ap == 3), this results in the correct credentials +being sent anyway. + +The security to be used for the backaul BSS is fixed to WPA2PSK. The +Multi-AP Specification only allows Open and WPA2PSK networks to be +configured. Although not stated explicitly, the backhaul link is +intended to be always encrypted, hence WPA2PSK. + +To build the credentials, the credential-building code is essentially +copied and simplified. Indeed, the backhaul credentials are always +WPA2PSK and never use per-device PSK. All the options set for the +fronthaul BSS WPS are simply ignored. + +Signed-off-by: Davina Lu +Signed-off-by: Igor Mitsyanko +Signed-off-by: Arnout Vandecappelle (Essensium/Mind) +--- +v4: no change +--- + hostapd/config_file.c | 47 ++++++++++++++++++++++++++++++++++++++++ + hostapd/hostapd.conf | 9 ++++++++ + src/ap/ap_config.c | 2 ++ + src/ap/ap_config.h | 1 + + src/ap/wps_hostapd.c | 26 ++++++++++++++++++++++ + src/wps/wps.h | 32 +++++++++++++++++++++++++++ + src/wps/wps_attr_parse.c | 11 ++++++++++ + src/wps/wps_attr_parse.h | 1 + + src/wps/wps_dev_attr.c | 5 +++++ + src/wps/wps_dev_attr.h | 1 + + src/wps/wps_registrar.c | 25 ++++++++++++++++++++- + 11 files changed, 159 insertions(+), 1 deletion(-) + +--- a/hostapd/config_file.c ++++ b/hostapd/config_file.c +@@ -3479,6 +3479,53 @@ static int hostapd_config_fill(struct ho + line, pos); + return 1; + } ++ } else if (os_strcmp(buf, "multi_ap_backhaul_ssid") == 0) { ++ size_t slen; ++ char *str = wpa_config_parse_string(pos, &slen); ++ ++ if (str == NULL || slen < 1 || slen > SSID_MAX_LEN) { ++ wpa_printf(MSG_ERROR, "Line %d: invalid SSID '%s'", ++ line, pos); ++ os_free(str); ++ return 1; ++ } ++ os_memcpy(bss->multi_ap_backhaul_ssid.ssid, str, slen); ++ bss->multi_ap_backhaul_ssid.ssid_len = slen; ++ bss->multi_ap_backhaul_ssid.ssid_set = 1; ++ os_free(str); ++ } else if (os_strcmp(buf, "multi_ap_backhaul_wpa_passphrase") == 0) { ++ int len = os_strlen(pos); ++ ++ if (len < 8 || len > 63) { ++ wpa_printf(MSG_ERROR, ++ "Line %d: invalid WPA passphrase length %d (expected 8..63)", ++ line, len); ++ return 1; ++ } ++ os_free(bss->multi_ap_backhaul_ssid.wpa_passphrase); ++ bss->multi_ap_backhaul_ssid.wpa_passphrase = os_strdup(pos); ++ if (bss->multi_ap_backhaul_ssid.wpa_passphrase) { ++ hostapd_config_clear_wpa_psk(&bss->multi_ap_backhaul_ssid.wpa_psk); ++ bss->multi_ap_backhaul_ssid.wpa_passphrase_set = 1; ++ } ++ } else if (os_strcmp(buf, "multi_ap_backhaul_wpa_psk") == 0) { ++ hostapd_config_clear_wpa_psk(&bss->multi_ap_backhaul_ssid.wpa_psk); ++ bss->multi_ap_backhaul_ssid.wpa_psk = ++ os_zalloc(sizeof(struct hostapd_wpa_psk)); ++ if (bss->multi_ap_backhaul_ssid.wpa_psk == NULL) ++ return 1; ++ if (hexstr2bin(pos, bss->multi_ap_backhaul_ssid.wpa_psk->psk, ++ PMK_LEN) || ++ pos[PMK_LEN * 2] != '\0') { ++ wpa_printf(MSG_ERROR, "Line %d: Invalid PSK '%s'.", ++ line, pos); ++ hostapd_config_clear_wpa_psk(&bss->multi_ap_backhaul_ssid.wpa_psk); ++ return 1; ++ } ++ bss->multi_ap_backhaul_ssid.wpa_psk->group = 1; ++ os_free(bss->multi_ap_backhaul_ssid.wpa_passphrase); ++ bss->multi_ap_backhaul_ssid.wpa_passphrase = NULL; ++ bss->multi_ap_backhaul_ssid.wpa_psk_set = 1; + } else if (os_strcmp(buf, "upnp_iface") == 0) { + os_free(bss->upnp_iface); + bss->upnp_iface = os_strdup(pos); +--- a/hostapd/hostapd.conf ++++ b/hostapd/hostapd.conf +@@ -1852,6 +1852,15 @@ own_ip_addr=127.0.0.1 + # attribute. + #ap_settings=hostapd.ap_settings + ++# Multi-AP backhaul BSS config ++# Used in WPS when multi_ap=2 or 3. Defines "backhaul BSS" credentials. ++# These are passed in WPS M8 instead of the normal (fronthaul) credentials ++# if the enrollee has the Multi-AP subelement set. Backhaul SSID is formatted ++# like ssid2. The key is set like wpa_psk or wpa_passphrase. ++#multi_ap_backhaul_ssid="backhaul" ++#multi_ap_backhaul_wpa_psk=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef ++#multi_ap_backhaul_wpa_passphrase=secret passphrase ++ + # WPS UPnP interface + # If set, support for external Registrars is enabled. + #upnp_iface=br0 +--- a/src/ap/ap_config.c ++++ b/src/ap/ap_config.c +@@ -582,6 +582,8 @@ void hostapd_config_free_bss(struct host + os_free(conf->ap_pin); + os_free(conf->extra_cred); + os_free(conf->ap_settings); ++ hostapd_config_clear_wpa_psk(&conf->multi_ap_backhaul_ssid.wpa_psk); ++ str_clear_free(conf->multi_ap_backhaul_ssid.wpa_passphrase); + os_free(conf->upnp_iface); + os_free(conf->friendly_name); + os_free(conf->manufacturer_url); +--- a/src/ap/ap_config.h ++++ b/src/ap/ap_config.h +@@ -456,6 +456,7 @@ struct hostapd_bss_config { + int force_per_enrollee_psk; + u8 *ap_settings; + size_t ap_settings_len; ++ struct hostapd_ssid multi_ap_backhaul_ssid; + char *upnp_iface; + char *friendly_name; + char *manufacturer_url; +--- a/src/ap/wps_hostapd.c ++++ b/src/ap/wps_hostapd.c +@@ -962,6 +962,7 @@ static void hostapd_free_wps(struct wps_ + wpabuf_free(wps->dev.vendor_ext[i]); + wps_device_data_free(&wps->dev); + os_free(wps->network_key); ++ os_free(wps->multi_ap_backhaul_network_key); + hostapd_wps_nfc_clear(wps); + wpabuf_free(wps->dh_pubkey); + wpabuf_free(wps->dh_privkey); +@@ -1131,6 +1132,31 @@ int hostapd_init_wps(struct hostapd_data + wps->encr_types_wpa = WPS_ENCR_AES | WPS_ENCR_TKIP; + } + ++ if (hapd->conf->multi_ap & FRONTHAUL_BSS && ++ hapd->conf->multi_ap_backhaul_ssid.ssid_len) { ++ wps->multi_ap_backhaul_ssid_len = ++ hapd->conf->multi_ap_backhaul_ssid.ssid_len; ++ os_memcpy(wps->multi_ap_backhaul_ssid, ++ hapd->conf->multi_ap_backhaul_ssid.ssid, ++ wps->multi_ap_backhaul_ssid_len); ++ if (conf->multi_ap_backhaul_ssid.wpa_passphrase) { ++ wps->multi_ap_backhaul_network_key = ++ (u8 *) os_strdup(conf->multi_ap_backhaul_ssid.wpa_passphrase); ++ wps->multi_ap_backhaul_network_key_len = ++ os_strlen(conf->multi_ap_backhaul_ssid.wpa_passphrase); ++ } else if (conf->multi_ap_backhaul_ssid.wpa_psk) { ++ wps->multi_ap_backhaul_network_key = ++ os_malloc(2 * PMK_LEN + 1); ++ if (wps->multi_ap_backhaul_network_key == NULL) ++ goto fail; ++ wpa_snprintf_hex((char *) wps->multi_ap_backhaul_network_key, ++ 2 * PMK_LEN + 1, ++ conf->multi_ap_backhaul_ssid.wpa_psk->psk, ++ PMK_LEN); ++ wps->multi_ap_backhaul_network_key_len = 2 * PMK_LEN; ++ } ++ } ++ + wps->ap_settings = conf->ap_settings; + wps->ap_settings_len = conf->ap_settings_len; + +--- a/src/wps/wps.h ++++ b/src/wps/wps.h +@@ -100,6 +100,7 @@ struct wps_device_data { + struct wpabuf *vendor_ext[MAX_WPS_VENDOR_EXTENSIONS]; + + int p2p; ++ u8 multi_ap_ext; + }; + + /** +@@ -730,6 +731,37 @@ struct wps_context { + int psk_set; + + /** ++ * multi_ap_backhaul_ssid - SSID to supply to a Multi-AP backhaul ++ * enrollee ++ * ++ * This SSID is used by the Registrar to fill in information for ++ * Credentials when the enrollee advertises it is a Multi-AP backhaul ++ * STA. ++ */ ++ u8 multi_ap_backhaul_ssid[SSID_MAX_LEN]; ++ ++ /** ++ * multi_ap_backhaul_ssid_len - Length of multi_ap_backhaul_ssid in ++ * octets ++ */ ++ size_t multi_ap_backhaul_ssid_len; ++ ++ /** ++ * multi_ap_backhaul_network_key - The Network Key (PSK) for the ++ * Multi-AP backhaul enrollee. ++ * ++ * This key can be either the ASCII passphrase (8..63 characters) or the ++ * 32-octet PSK (64 hex characters). ++ */ ++ u8 *multi_ap_backhaul_network_key; ++ ++ /** ++ * multi_ap_backhaul_network_key_len - Length of ++ * multi_ap_backhaul_network_key in octets ++ */ ++ size_t multi_ap_backhaul_network_key_len; ++ ++ /** + * ap_settings - AP Settings override for M7 (only used at AP) + * + * If %NULL, AP Settings attributes will be generated based on the +--- a/src/wps/wps_attr_parse.c ++++ b/src/wps/wps_attr_parse.c +@@ -67,6 +67,17 @@ static int wps_set_vendor_ext_wfa_subele + } + attr->registrar_configuration_methods = pos; + break; ++ case WFA_ELEM_MULTI_AP: ++ if (len != 1) { ++ wpa_printf(MSG_DEBUG, ++ "WPS: Invalid Multi-AP Extension length %u", ++ len); ++ return -1; ++ } ++ attr->multi_ap_ext = *pos; ++ wpa_printf(MSG_DEBUG, "WPS: Multi-AP Extension 0x%02x", ++ attr->multi_ap_ext); ++ break; + default: + wpa_printf(MSG_MSGDUMP, "WPS: Skipped unknown WFA Vendor " + "Extension subelement %u", id); +--- a/src/wps/wps_attr_parse.h ++++ b/src/wps/wps_attr_parse.h +@@ -97,6 +97,7 @@ struct wps_parse_attr { + const u8 *cred[MAX_CRED_COUNT]; + const u8 *req_dev_type[MAX_REQ_DEV_TYPE_COUNT]; + const u8 *vendor_ext[MAX_WPS_PARSE_VENDOR_EXT]; ++ u8 multi_ap_ext; + }; + + int wps_parse_msg(const struct wpabuf *msg, struct wps_parse_attr *attr); +--- a/src/wps/wps_dev_attr.c ++++ b/src/wps/wps_dev_attr.c +@@ -389,6 +389,11 @@ int wps_process_os_version(struct wps_de + return 0; + } + ++void wps_process_vendor_ext_m1(struct wps_device_data *dev, const u8 ext) ++{ ++ dev->multi_ap_ext = ext; ++ wpa_printf(MSG_DEBUG, "WPS: Multi-AP extension value %02x", dev->multi_ap_ext); ++} + + int wps_process_rf_bands(struct wps_device_data *dev, const u8 *bands) + { +--- a/src/wps/wps_dev_attr.h ++++ b/src/wps/wps_dev_attr.h +@@ -29,6 +29,7 @@ int wps_build_dev_name(struct wps_device + int wps_process_device_attrs(struct wps_device_data *dev, + struct wps_parse_attr *attr); + int wps_process_os_version(struct wps_device_data *dev, const u8 *ver); ++void wps_process_vendor_ext_m1(struct wps_device_data *dev, const u8 ext); + int wps_process_rf_bands(struct wps_device_data *dev, const u8 *bands); + void wps_device_data_free(struct wps_device_data *dev); + int wps_build_vendor_ext(struct wps_device_data *dev, struct wpabuf *msg); +--- a/src/wps/wps_registrar.c ++++ b/src/wps/wps_registrar.c +@@ -1588,7 +1588,6 @@ int wps_build_credential_wrap(struct wpa + return 0; + } + +- + int wps_build_cred(struct wps_data *wps, struct wpabuf *msg) + { + struct wpabuf *cred; +@@ -1603,6 +1602,29 @@ int wps_build_cred(struct wps_data *wps, + } + os_memset(&wps->cred, 0, sizeof(wps->cred)); + ++ if (wps->peer_dev.multi_ap_ext == MULTI_AP_BACKHAUL_STA && ++ wps->wps->multi_ap_backhaul_ssid_len) { ++ wpa_printf(MSG_DEBUG, "WPS: Use backhaul STA credentials"); ++ os_memcpy(wps->cred.ssid, wps->wps->multi_ap_backhaul_ssid, ++ wps->wps->multi_ap_backhaul_ssid_len); ++ wps->cred.ssid_len = wps->wps->multi_ap_backhaul_ssid_len; ++ /* Backhaul is always WPA2PSK */ ++ wps->cred.auth_type = WPS_AUTH_WPA2PSK; ++ wps->cred.encr_type = WPS_ENCR_AES; ++ /* Set MAC address in the Credential to be the Enrollee's MAC ++ * address ++ */ ++ os_memcpy(wps->cred.mac_addr, wps->mac_addr_e, ETH_ALEN); ++ if (wps->wps->multi_ap_backhaul_network_key) { ++ os_memcpy(wps->cred.key, ++ wps->wps->multi_ap_backhaul_network_key, ++ wps->wps->multi_ap_backhaul_network_key_len); ++ wps->cred.key_len = ++ wps->wps->multi_ap_backhaul_network_key_len; ++ } ++ goto use_provided; ++ } ++ + os_memcpy(wps->cred.ssid, wps->wps->ssid, wps->wps->ssid_len); + wps->cred.ssid_len = wps->wps->ssid_len; + +@@ -2705,6 +2727,7 @@ static enum wps_process_res wps_process_ + wps->use_psk_key = 1; + } + #endif /* WPS_WORKAROUNDS */ ++ wps_process_vendor_ext_m1(&wps->peer_dev, attr->multi_ap_ext); + + wps->state = SEND_M2; + return WPS_CONTINUE; diff --git a/package/network/services/hostapd/patches/558-hostapd-add-README-MULTI-AP.patch b/package/network/services/hostapd/patches/558-hostapd-add-README-MULTI-AP.patch new file mode 100644 index 0000000000..b8526b8b71 --- /dev/null +++ b/package/network/services/hostapd/patches/558-hostapd-add-README-MULTI-AP.patch @@ -0,0 +1,181 @@ +From bd733055a22c8ca3bcd7648bf716da2713b3d9f1 Mon Sep 17 00:00:00 2001 +From: "Arnout Vandecappelle (Essensium/Mind)" +Date: Mon, 21 Jan 2019 16:44:06 +0100 +Subject: [PATCH] hostapd: add README-MULTI-AP + +Document what hostapd and wpa_supplicant do for Multi-AP. + +This is only included in hostapd, since a Multi-AP device is always an +access point so it should have hostapd. + +Signed-off-by: Arnout Vandecappelle (Essensium/Mind) +--- +v4: wps_pbc has multi_ap as a parameter instead of config option. +--- + hostapd/README-MULTI-AP | 160 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 160 insertions(+) + create mode 100644 hostapd/README-MULTI-AP + +--- /dev/null ++++ b/hostapd/README-MULTI-AP +@@ -0,0 +1,160 @@ ++hostapd, wpa_supplicant and the Multi-AP Specification ++====================================================== ++ ++This document describes how hostapd and wpa_supplicant can be configured to ++support the Multi-AP Specification. ++ ++Introduction to Multi-AP ++------------------------ ++ ++The Wi-Fi Alliance Multi-AP Specification is the technical specification for ++Wi-Fi CERTIFIED EasyMesh(TM) [1], the Wi-Fi Alliance® certification program for ++Multi-AP. It defines control protocols between Wi-Fi® access points (APs) to ++join them into a network with centralized control and operation. It is targeted ++only at routers (repeaters, gateways, ...), not at clients. Clients are not ++involved at all in the protocols. ++ ++Most of the Multi-AP specification falls outside of the scope of ++hostapd/wpa_supplicant. hostapd/wpa_supplicant is only involved for the items ++summarized below. The rest of the protocol must be implemented by a separate ++daemon, e.g. prplMesh [2]. That daemon also needs to communicate with hostapd, ++e.g. to get a list of associated clients, but this can be done using the normal ++hostapd interfaces. ++ ++hostapd/wpa_supplicant needs to be configured specifically to support: ++- the WPS onboarding process; ++- configuring backhaul links. ++ ++The text below refers to "Multi-AP Specification v1.0" [3]. ++ ++ ++Fronthaul and backhaul links ++---------------------------- ++ ++In a Multi-AP network, the central controller can configure the SSIDs on the ++devices that are joined into the network. These are called fronthaul SSIDs. ++From the point of view of hostapd, there is nothing special about these ++fronthaul SSIDs. ++ ++In addition to fronthaul SSIDs, the controller can also configure backhaul ++links. A backhaul link is a link between two access point devices, giving ++internet access to access point devices that don't have a wired link. The ++Multi-AP specification doesn't dictate this, but typically the backhaul link ++will be bridged into a LAN together with (one of) the fronthaul SSID(s) and the ++wired Ethernet ports. ++ ++A backhaul link must be treated specially by hostapd and wpa_supplicant. One ++side of the backhaul link is configured through the Multi-AP protocol as the ++"backhaul STA", i.e. the client side of the link. A backhaul STA is like any ++station and is handled appropriately by wpa_supplicant, but two additional ++features are required. It must send an additional information element in each ++(Re-)Association Request ([3], section 5.2, paragraph 4). In addition, it must ++use 4-address mode for all frames sent over this link ([3], section 14). ++Therefore, wpa_supplicant must be configured explicitly as the backhaul STA ++role, by setting 'multi_ap_backhaul_sta=1' in the network configuration block ++or when configuring the SSID through the client socket. When ++'multi_ap_backhaul_sta=1', wpa_supplicant includes the Multi-AP IE in ++(Re-)Association Request messages and verifies that it is included in the ++(Re-)Association Response. If it is not, association fails. If it is, ++wpa_supplicant sets 4-address mode for this interface through a driver ++callback. ++ ++The AP side of the backhaul link is called a "backhaul SSID". Such an SSID must ++be handled specially by hostapd, because it must add an additional information ++element in each (Re-)Association Response, but only to stations that have ++identified themselves as backhaul stations ([3], section 5.2, paragraph 5-6). ++This is important because it is possible to use the same BSS and SSID for ++fronthaul and backhaul at the same time. The additional information element must ++only be used for frames sent to a backhaul STA, not to a normal STA. Also, ++frames sent to a backhaul STA must use 4-address mode, while frames sent to a ++normal STA (fronthaul, when it's a fronthaul and backhaul SSID) must use ++3-address mode. ++ ++An SSID is configured in Multi-AP mode in hostapd by setting the 'multi_ap' ++configuration option to 1 (backhaul SSID), 2 (fronthaul SSID) or 3 ++(simultaneous backhaul and fronthaul SSID). If this option is set, hostapd ++parses the Multi-AP information element in the Association Request. If the ++station is a backhaul STA and the SSID is configured as a backhaul SSID, ++hostapd sets up 4-address mode. Since there may be multiple stations connected ++simultaneously, and each of them has a different RA (receiver address), a VLAN ++is created for each backhaul STA and it is automatically added to a bridge. ++This is the same behavior as for WDS, and the relevant option ('bridge' or ++'wds_bridge') applies here as well. ++ ++If 'multi_ap' is 1 (backhaul SSID only), any station that tries to associate ++without the Multi-AP information element will be denied. ++ ++If 'multi_ap' is 2 (fronthaul SSID only), any station that tries to associate ++with the Multi-AP information element will be denied. That is also the only ++difference with 'multi_ap' set to 0: in the latter case, the Multi-AP ++information element is simply ignored. ++ ++In summary, this is the end-to-end behaviour for a backhaul BSS (i.e., ++multi_ap_backhaul_sta=1 in wpa_supplicant on STA, and multi_ap=1 or 3 in ++hostapd on AP). Note that point 1 means that hostapd must not be configured ++with WPS support on the backhaul BSS (multi_ap=1). hostapd does not check for ++that. ++ ++1. Backhaul BSS beacons do not advertise WPS support (other than that, nothing ++ multi-ap specific). ++2. STA sends authentication req (nothing multi-ap specific). ++3. AP sends authentication resp (nothing multi-ap specific). ++4. STA sends association req with Multi-AP IE. ++5. AP send association resp with Multi-AP IE. ++6. STA and AP both use 4-address mode for data. ++ ++ ++WPS support ++----------- ++ ++WPS requires more special handling. WPS must only be advertised on fronthaul ++SSIDs, not on backhaul SSIDs, so WPS should not be enabled on a backhaul-only ++SSID in hostapd.conf. The WPS configuration purely works on the fronthaul SSID. ++When a WPS M1 message has an additional subelement that indicates a request for ++a multi-AP backhaul link, hostapd must not respond with the normal fronthaul ++SSID credentials; instead, it should respond with the (potentially different) ++backhaul SSID credentials. ++ ++To support this, hostapd has the 'multi_ap_backhaul_ssid', ++'multi_ap_backhaul_wpa_psk' and 'multi_ap_backhaul_wpa_passphrase' options. ++When these are set on an SSID with WPS, they are used instead of the normal ++credentials when hostapd receives a WPS M1 message with the Multi-AP IE. Only ++WPA2 Personal is supported in the Multi-AP specification, so there is no need ++to specify authentication or encryption options. For the backhaul credentials, ++per-device PSK is not supported. ++ ++If the SSID is a simultaneous backhaul and fronthaul SSID, there is no need to ++specify the backhaul credentials, since the backhaul and fronthaul credentials ++are identical. ++ ++To enable the Multi-AP backhaul STA feature when it performs WPS, a new ++parameter has been introduced to the WPS_PBC control interface call. ++When this option is set, it adds the multi-AP backhaul subelement to ++the association and M1 messages. It then configures the new SSID with ++'multi_ap_backhaul_sta=1'. Note that this means that if the AP does not ++follow the Multi-AP specification, wpa_supplicant will fail to ++associate. ++ ++In summary, this is the end-to-end behaviour for WPS of a backhaul link (i.e., ++multi_ap=1 option is given in the wps_pbc call on the STA side, and multi_ap=2 ++and multi_ap_backhaul_ssid and either multi_ap_backhaul_wpa_psk or ++multi_ap_backhaul_wpa_passphrase are set to the credentials of a backhaul SSID ++in hostapd on registrar AP). ++ ++1. Fronthaul BSS beacons advertise WPS support (nothing multi-ap specific). ++2. Enrollee sends authentication req (nothing multi-ap specific). ++3. AP sends authentication resp (nothing multi-ap specific). ++4. Enrollee sends association req with Multi-AP IE. ++5. AP send association resp with Multi-AP IE. ++6. Enrollee sends M1 with additional Multi-AP subelement ++7. AP sends M8 with backhaul instead of fronthaul credentials. ++8. Enrollee sends Deauth. ++ ++ ++References ++---------- ++ ++[1] https://www.wi-fi.org/discover-wi-fi/wi-fi-easymesh ++[2] https://github.com/prplfoundation/prplMesh ++[3] https://www.wi-fi.org/file/multi-ap-specification-v10 ++ (requires registration) diff --git a/package/network/services/hostapd/patches/559-tests-add-WPS-tests-to-multi_ap-hwsim-tests.patch b/package/network/services/hostapd/patches/559-tests-add-WPS-tests-to-multi_ap-hwsim-tests.patch new file mode 100644 index 0000000000..3a121ba911 --- /dev/null +++ b/package/network/services/hostapd/patches/559-tests-add-WPS-tests-to-multi_ap-hwsim-tests.patch @@ -0,0 +1,182 @@ +From 0729e01f5830ebf4701f0b1b7ff1bd2a2eedae40 Mon Sep 17 00:00:00 2001 +From: "Arnout Vandecappelle (Essensium/Mind)" +Date: Tue, 12 Feb 2019 11:02:42 +0100 +Subject: [PATCH] tests: add WPS tests to multi_ap hwsim tests + +Signed-off-by: Arnout Vandecappelle (Essensium/Mind) +--- +v4: new patch +--- + tests/hwsim/test_multi_ap.py | 164 +++++++++++++++++++++++++++++++++++ + 1 file changed, 164 insertions(+) + +--- a/tests/hwsim/test_multi_ap.py ++++ b/tests/hwsim/test_multi_ap.py +@@ -61,3 +61,167 @@ def test_multi_ap_fronthaul_on_ap(dev, a + raise Exception("Connection result not reported") + if "CTRL-EVENT-DISCONNECTED" not in ev: + raise Exception("Unexpected connection result") ++ ++def run_multi_ap_wps(dev, apdev, params, multi_ap_bssid = None): ++ """Helper for running Multi-AP WPS tests ++ ++ dev[0] does multi_ap WPS, dev[1] does normal WPS. apdev[0] is the fronthaul ++ BSS. If there is a separate backhaul BSS, it must have been set up by the ++ caller. params are the normal SSID parameters, they will be extended with ++ the WPS parameters. multi_ap_bssid must be given if it is not equal to the ++ fronthaul BSSID.""" ++ ++ if multi_ap_bssid is None: ++ multi_ap_bssid = apdev[0]['bssid'] ++ params.update({"wps_state": "2", "eap_server": "1"}) ++ ++ # WPS with multi-ap station dev[0] ++ hapd = hostapd.add_ap(apdev[0], params) ++ hapd.request("WPS_PBC") ++ if "PBC Status: Active" not in hapd.request("WPS_GET_STATUS"): ++ raise Exception("PBC status not shown correctly") ++ ++ dev[0].request("WPS_PBC multi_ap=1") ++ dev[0].wait_connected(timeout=20) ++ status = dev[0].get_status() ++ if status['wpa_state'] != 'COMPLETED' or status['bssid'] != multi_ap_bssid: ++ raise Exception("Not fully connected") ++ if status['ssid'] != params['multi_ap_backhaul_ssid'].strip('"'): ++ raise Exception("Unexpected SSID %s != %s" % (status['ssid'], params["multi_ap_backhaul_ssid"])) ++ if status['pairwise_cipher'] != 'CCMP': ++ raise Exception("Unexpected encryption configuration %s" % status['pairwise_cipher']) ++ if status['key_mgmt'] != 'WPA2-PSK': ++ raise Exception("Unexpected key_mgmt") ++ ++ status = hapd.request("WPS_GET_STATUS") ++ if "PBC Status: Disabled" not in status: ++ raise Exception("PBC status not shown correctly") ++ if "Last WPS result: Success" not in status: ++ raise Exception("Last WPS result not shown correctly") ++ if "Peer Address: " + dev[0].p2p_interface_addr() not in status: ++ raise Exception("Peer address not shown correctly") ++ ++ if len(dev[0].list_networks()) != 1: ++ raise Exception("Unexpected number of network blocks") ++ ++ # WPS with non-multi-ap station dev[1] ++ hapd.request("WPS_PBC") ++ if "PBC Status: Active" not in hapd.request("WPS_GET_STATUS"): ++ raise Exception("PBC status not shown correctly") ++ ++ dev[1].request("WPS_PBC") ++ dev[1].wait_connected(timeout=20) ++ status = dev[1].get_status() ++ if status['wpa_state'] != 'COMPLETED' or status['bssid'] != apdev[0]['bssid']: ++ raise Exception("Not fully connected") ++ if status['ssid'] != params["ssid"]: ++ raise Exception("Unexpected SSID") ++ # Fronthaul may be something else than WPA2-PSK so don't test it. ++ ++ status = hapd.request("WPS_GET_STATUS") ++ if "PBC Status: Disabled" not in status: ++ raise Exception("PBC status not shown correctly") ++ if "Last WPS result: Success" not in status: ++ raise Exception("Last WPS result not shown correctly") ++ if "Peer Address: " + dev[1].p2p_interface_addr() not in status: ++ raise Exception("Peer address not shown correctly") ++ ++ if len(dev[1].list_networks()) != 1: ++ raise Exception("Unexpected number of network blocks") ++ ++ ++def test_multi_ap_wps_shared(dev, apdev): ++ """WPS on shared fronthaul/backhaul AP""" ++ ssid = "multi-ap-wps" ++ passphrase = "12345678" ++ params = hostapd.wpa2_params(ssid=ssid, passphrase=passphrase) ++ params.update({"multi_ap": "3", ++ "multi_ap_backhaul_ssid": '"%s"' % ssid, ++ "multi_ap_backhaul_wpa_passphrase": passphrase}) ++ run_multi_ap_wps(dev, apdev, params) ++ ++def test_multi_ap_wps_shared_psk(dev, apdev): ++ """WPS on shared fronthaul/backhaul AP using PSK""" ++ ssid = "multi-ap-wps" ++ psk = "1234567890abcdef0123456789abcdef0123456789abcdef0123456789abcdef" ++ params = hostapd.wpa2_params(ssid=ssid) ++ params.update({"wpa_psk": psk, "multi_ap": "3", ++ "multi_ap_backhaul_ssid": '"%s"' % ssid, ++ "multi_ap_backhaul_wpa_psk": psk}) ++ run_multi_ap_wps(dev, apdev, params) ++ ++def test_multi_ap_wps_split(dev, apdev): ++ """WPS on split fronthaul and backhaul AP""" ++ backhaul_ssid = "multi-ap-backhaul-wps" ++ backhaul_passphrase = "87654321" ++ params = hostapd.wpa2_params(ssid="multi-ap-fronthaul-wps", passphrase="12345678") ++ params.update({"multi_ap": "2", ++ "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid, ++ "multi_ap_backhaul_wpa_passphrase": backhaul_passphrase}) ++ params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid, passphrase=backhaul_passphrase) ++ params_backhaul.update({"multi_ap": "1"}) ++ hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul) ++ ++ run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr()) ++ ++def test_multi_ap_wps_split_psk(dev, apdev): ++ """WPS on split fronthaul and backhaul AP""" ++ backhaul_ssid = "multi-ap-backhaul-wps" ++ backhaul_psk = "1234567890abcdef0123456789abcdef0123456789abcdef0123456789abcdef" ++ params = hostapd.wpa2_params(ssid="multi-ap-fronthaul-wps", passphrase="12345678") ++ params.update({"multi_ap": "2", ++ "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid, ++ "multi_ap_backhaul_wpa_psk": backhaul_psk}) ++ params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid) ++ params_backhaul.update({"multi_ap": "1", "wpa_psk": backhaul_psk}) ++ hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul) ++ ++ run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr()) ++ ++def test_multi_ap_wps_split_mixed(dev, apdev): ++ """WPS on split fronthaul and backhaul AP with mixed-mode fronthaul""" ++ backhaul_ssid = "multi-ap-backhaul-wps" ++ backhaul_passphrase = "87654321" ++ params = hostapd.wpa_mixed_params(ssid="multi-ap-fronthaul-wps", passphrase="12345678") ++ params.update({"multi_ap": "2", ++ "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid, ++ "multi_ap_backhaul_wpa_passphrase": backhaul_passphrase}) ++ params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid, passphrase=backhaul_passphrase) ++ params_backhaul.update({"multi_ap": "1"}) ++ hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul) ++ ++ run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr()) ++ ++def test_multi_ap_wps_split_open(dev, apdev): ++ """WPS on split fronthaul and backhaul AP with open fronthaul""" ++ backhaul_ssid = "multi-ap-backhaul-wps" ++ backhaul_passphrase = "87654321" ++ params = {"ssid": "multi-ap-wps-fronthaul", "multi_ap": "2", ++ "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid, ++ "multi_ap_backhaul_wpa_passphrase": backhaul_passphrase} ++ params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid, passphrase=backhaul_passphrase) ++ params_backhaul.update({"multi_ap": "1"}) ++ hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul) ++ ++ run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr()) ++ ++def test_multi_ap_wps_fail_non_multi_ap(dev, apdev): ++ """Multi-AP WPS on non-WPS AP fails""" ++ ++ params = hostapd.wpa2_params(ssid="non-multi-ap-wps", passphrase="12345678") ++ params.update({"wps_state": "2", "eap_server": "1"}) ++ ++ hapd = hostapd.add_ap(apdev[0], params) ++ hapd.request("WPS_PBC") ++ if "PBC Status: Active" not in hapd.request("WPS_GET_STATUS"): ++ raise Exception("PBC status not shown correctly") ++ ++ dev[0].request("WPS_PBC multi_ap=1") ++ # Since we will fail to associate and WPS doesn't even get started, there ++ # isn't much we can do except wait for timeout. For PBC, it is not possible ++ # to change the timeout from 2 minutes. Instead of waiting for the timeout, ++ # just check that WPS doesn't finish within reasonable time. ++ ev = dev[0].wait_event(["WPS-SUCCESS", "WPS-FAIL"], timeout=20) ++ if ev: ++ raise Exception("WPS operation completed: " + ev) ++ dev[0].request("WPS_CANCEL") diff --git a/package/network/services/hostapd/patches/600-ubus_support.patch b/package/network/services/hostapd/patches/600-ubus_support.patch index 7ac16e62b3..db037c6491 100644 --- a/package/network/services/hostapd/patches/600-ubus_support.patch +++ b/package/network/services/hostapd/patches/600-ubus_support.patch @@ -20,9 +20,9 @@ #include "drivers/driver.h" +#include "ubus.h" - struct wpa_ctrl_dst; - struct radius_server_data; -@@ -129,6 +130,7 @@ struct hostapd_data { + #define OCE_STA_CFON_ENABLED(hapd) \ + ((hapd->conf->oce & OCE_STA_CFON) && \ +@@ -136,6 +137,7 @@ struct hostapd_data { struct hostapd_iface *iface; struct hostapd_config *iconf; struct hostapd_bss_config *conf; @@ -30,7 +30,7 @@ int interface_added; /* virtual interface added for this BSS */ unsigned int started:1; unsigned int disabled:1; -@@ -544,6 +546,7 @@ hostapd_alloc_bss_data(struct hostapd_if +@@ -547,6 +549,7 @@ hostapd_alloc_bss_data(struct hostapd_if struct hostapd_bss_config *bss); int hostapd_setup_interface(struct hostapd_iface *iface); int hostapd_setup_interface_complete(struct hostapd_iface *iface, int err); @@ -40,7 +40,7 @@ struct hostapd_iface * hostapd_alloc_iface(void); --- a/src/ap/hostapd.c +++ b/src/ap/hostapd.c -@@ -315,6 +315,7 @@ static void hostapd_free_hapd_data(struc +@@ -373,6 +373,7 @@ static void hostapd_free_hapd_data(struc hapd->started = 0; wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface); @@ -48,7 +48,7 @@ iapp_deinit(hapd->iapp); hapd->iapp = NULL; accounting_deinit(hapd); -@@ -1237,6 +1238,8 @@ static int hostapd_setup_bss(struct host +@@ -1295,6 +1296,8 @@ static int hostapd_setup_bss(struct host if (hapd->driver && hapd->driver->set_operstate) hapd->driver->set_operstate(hapd->drv_priv, 1); @@ -57,7 +57,7 @@ return 0; } -@@ -1651,7 +1654,7 @@ static enum nr_chan_width hostapd_get_nr +@@ -1709,7 +1712,7 @@ static enum nr_chan_width hostapd_get_nr #endif /* NEED_AP_MLME */ @@ -66,7 +66,7 @@ { #ifdef NEED_AP_MLME u16 capab = hostapd_own_capab_info(hapd); -@@ -1872,6 +1875,7 @@ static int hostapd_setup_interface_compl +@@ -1930,6 +1933,7 @@ static int hostapd_setup_interface_compl if (err) goto fail; @@ -74,7 +74,7 @@ wpa_printf(MSG_DEBUG, "Completing interface initialization"); if (iface->conf->channel) { #ifdef NEED_AP_MLME -@@ -2052,6 +2056,7 @@ dfs_offload: +@@ -2110,6 +2114,7 @@ dfs_offload: fail: wpa_printf(MSG_ERROR, "Interface initialization failed"); @@ -82,7 +82,7 @@ hostapd_set_state(iface, HAPD_IFACE_DISABLED); wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED); #ifdef CONFIG_FST -@@ -2517,6 +2522,7 @@ void hostapd_interface_deinit_free(struc +@@ -2576,6 +2581,7 @@ void hostapd_interface_deinit_free(struc (unsigned int) iface->conf->num_bss); driver = iface->bss[0]->driver; drv_priv = iface->bss[0]->drv_priv; @@ -92,7 +92,7 @@ __func__, driver, drv_priv); --- a/src/ap/ieee802_11.c +++ b/src/ap/ieee802_11.c -@@ -1714,12 +1714,13 @@ ieee802_11_set_radius_info(struct hostap +@@ -1759,12 +1759,13 @@ ieee802_11_set_radius_info(struct hostap static void handle_auth(struct hostapd_data *hapd, @@ -108,7 +108,7 @@ u16 fc; const u8 *challenge = NULL; u32 session_timeout, acct_interim_interval; -@@ -1730,6 +1731,11 @@ static void handle_auth(struct hostapd_d +@@ -1775,6 +1776,11 @@ static void handle_auth(struct hostapd_d char *identity = NULL; char *radius_cui = NULL; u16 seq_ctrl; @@ -120,7 +120,7 @@ if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) { wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)", -@@ -1890,6 +1896,13 @@ static void handle_auth(struct hostapd_d +@@ -1935,6 +1941,13 @@ static void handle_auth(struct hostapd_d resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } @@ -134,7 +134,7 @@ if (res == HOSTAPD_ACL_PENDING) return; -@@ -3169,12 +3182,12 @@ void fils_hlp_timeout(void *eloop_ctx, v +@@ -3287,12 +3300,12 @@ void fils_hlp_timeout(void *eloop_ctx, v static void handle_assoc(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, @@ -149,7 +149,7 @@ struct sta_info *sta; u8 *tmp = NULL; struct hostapd_sta_wpa_psk_short *psk = NULL; -@@ -3183,6 +3196,11 @@ static void handle_assoc(struct hostapd_ +@@ -3301,6 +3314,11 @@ static void handle_assoc(struct hostapd_ #ifdef CONFIG_FILS int delay_assoc = 0; #endif /* CONFIG_FILS */ @@ -161,7 +161,7 @@ if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) : sizeof(mgmt->u.assoc_req))) { -@@ -3354,6 +3372,14 @@ static void handle_assoc(struct hostapd_ +@@ -3472,6 +3490,14 @@ static void handle_assoc(struct hostapd_ } #endif /* CONFIG_MBO */ @@ -176,7 +176,7 @@ /* * sta->capability is used in check_assoc_ies() for RRM enabled * capability element. -@@ -3567,6 +3593,7 @@ static void handle_disassoc(struct hosta +@@ -3685,6 +3711,7 @@ static void handle_disassoc(struct hosta wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d", MAC2STR(mgmt->sa), le_to_host16(mgmt->u.disassoc.reason_code)); @@ -184,7 +184,7 @@ sta = ap_get_sta(hapd, mgmt->sa); if (sta == NULL) { -@@ -3632,6 +3659,8 @@ static void handle_deauth(struct hostapd +@@ -3750,6 +3777,8 @@ static void handle_deauth(struct hostapd " reason_code=%d", MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code)); @@ -193,7 +193,7 @@ sta = ap_get_sta(hapd, mgmt->sa); if (sta == NULL) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying " -@@ -3951,7 +3980,7 @@ int ieee802_11_mgmt(struct hostapd_data +@@ -4077,7 +4106,7 @@ int ieee802_11_mgmt(struct hostapd_data if (stype == WLAN_FC_STYPE_PROBE_REQ) { @@ -202,7 +202,7 @@ return 1; } -@@ -3971,17 +4000,17 @@ int ieee802_11_mgmt(struct hostapd_data +@@ -4097,17 +4126,17 @@ int ieee802_11_mgmt(struct hostapd_data switch (stype) { case WLAN_FC_STYPE_AUTH: wpa_printf(MSG_DEBUG, "mgmt::auth"); @@ -225,7 +225,7 @@ case WLAN_FC_STYPE_DISASSOC: --- a/src/ap/beacon.c +++ b/src/ap/beacon.c -@@ -720,7 +720,7 @@ void sta_track_claim_taxonomy_info(struc +@@ -725,7 +725,7 @@ void sta_track_claim_taxonomy_info(struc void handle_probe_req(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, @@ -234,7 +234,7 @@ { u8 *resp; struct ieee802_11_elems elems; -@@ -729,6 +729,7 @@ void handle_probe_req(struct hostapd_dat +@@ -734,6 +734,7 @@ void handle_probe_req(struct hostapd_dat size_t i, resp_len; int noack; enum ssid_match_result res; @@ -242,7 +242,7 @@ int ret; u16 csa_offs[2]; size_t csa_offs_len; -@@ -737,6 +738,11 @@ void handle_probe_req(struct hostapd_dat +@@ -742,6 +743,12 @@ void handle_probe_req(struct hostapd_dat struct hostapd_sta_wpa_psk_short *psk = NULL; char *identity = NULL; char *radius_cui = NULL; @@ -250,11 +250,12 @@ + .type = HOSTAPD_UBUS_PROBE_REQ, + .mgmt_frame = mgmt, + .frame_info = fi, ++ .elems = &elems, + }; if (len < IEEE80211_HDRLEN) return; -@@ -914,6 +920,12 @@ void handle_probe_req(struct hostapd_dat +@@ -919,6 +926,12 @@ void handle_probe_req(struct hostapd_dat } #endif /* CONFIG_P2P */ @@ -306,7 +307,7 @@ wpabuf_free(sta->p2p_ie); --- a/src/ap/sta_info.c +++ b/src/ap/sta_info.c -@@ -415,6 +415,7 @@ void ap_handle_timer(void *eloop_ctx, vo +@@ -416,6 +416,7 @@ void ap_handle_timer(void *eloop_ctx, vo HOSTAPD_LEVEL_INFO, "deauthenticated due to " "local deauth request"); ap_free_sta(hapd, sta); @@ -314,7 +315,7 @@ return; } -@@ -562,6 +563,7 @@ skip_poll: +@@ -563,6 +564,7 @@ skip_poll: hapd, sta, WLAN_REASON_PREV_AUTH_NOT_VALID); ap_free_sta(hapd, sta); @@ -322,7 +323,7 @@ break; } } -@@ -1223,6 +1225,7 @@ void ap_sta_set_authorized(struct hostap +@@ -1224,6 +1226,7 @@ void ap_sta_set_authorized(struct hostap buf, ip_addr); } else { wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf); @@ -340,3 +341,85 @@ } +--- a/wpa_supplicant/Makefile ++++ b/wpa_supplicant/Makefile +@@ -189,6 +189,12 @@ ifdef CONFIG_EAPOL_TEST + CFLAGS += -Werror -DEAPOL_TEST + endif + ++ifdef CONFIG_UBUS ++CFLAGS += -DUBUS_SUPPORT ++OBJS += ubus.o ++LIBS += -lubox -lubus ++endif ++ + ifdef CONFIG_CODE_COVERAGE + CFLAGS += -O0 -fprofile-arcs -ftest-coverage + LIBS += -lgcov +@@ -915,6 +921,9 @@ endif + ifdef CONFIG_IEEE80211AX + OBJS += ../src/ap/ieee802_11_he.o + endif ++ifdef CONFIG_UBUS ++OBJS += ../src/ap/ubus.o ++endif + endif + ifdef CONFIG_WNM_AP + CFLAGS += -DCONFIG_WNM_AP +--- a/wpa_supplicant/wpa_supplicant.c ++++ b/wpa_supplicant/wpa_supplicant.c +@@ -6080,6 +6080,8 @@ struct wpa_supplicant * wpa_supplicant_a + } + #endif /* CONFIG_P2P */ + ++ wpas_ubus_add_bss(wpa_s); ++ + return wpa_s; + } + +@@ -6106,6 +6108,8 @@ int wpa_supplicant_remove_iface(struct w + struct wpa_supplicant *parent = wpa_s->parent; + #endif /* CONFIG_MESH */ + ++ wpas_ubus_free_bss(wpa_s); ++ + /* Remove interface from the global list of interfaces */ + prev = global->ifaces; + if (prev == wpa_s) { +--- a/wpa_supplicant/wpa_supplicant_i.h ++++ b/wpa_supplicant/wpa_supplicant_i.h +@@ -17,6 +17,7 @@ + #include "wps/wps_defs.h" + #include "config_ssid.h" + #include "wmm_ac.h" ++#include "ubus.h" + + extern const char *const wpa_supplicant_version; + extern const char *const wpa_supplicant_license; +@@ -500,6 +501,7 @@ struct wpa_supplicant { + unsigned char own_addr[ETH_ALEN]; + unsigned char perm_addr[ETH_ALEN]; + char ifname[100]; ++ struct wpas_ubus_bss ubus; + #ifdef CONFIG_MATCH_IFACE + int matched; + #endif /* CONFIG_MATCH_IFACE */ +--- a/wpa_supplicant/wps_supplicant.c ++++ b/wpa_supplicant/wps_supplicant.c +@@ -33,6 +33,7 @@ + #include "p2p/p2p.h" + #include "p2p_supplicant.h" + #include "wps_supplicant.h" ++#include "ubus.h" + + + #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG +@@ -388,6 +389,8 @@ static int wpa_supplicant_wps_cred(void + wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute", + cred->cred_attr, cred->cred_attr_len); + ++ wpas_ubus_notify(wpa_s, cred); ++ + if (wpa_s->conf->wps_cred_processing == 1) + return 0; + diff --git a/package/network/services/hostapd/patches/700-fix-openssl11.patch b/package/network/services/hostapd/patches/700-fix-openssl11.patch deleted file mode 100644 index 86343c150b..0000000000 --- a/package/network/services/hostapd/patches/700-fix-openssl11.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 672540d4ddbd24782b5c65b35d636bdfe8a90d0f Mon Sep 17 00:00:00 2001 -From: Rosen Penev -Date: Fri, 15 Jun 2018 18:35:30 -0700 -Subject: [PATCH] Fix compile with OpenSSL 1.1.0 and deprecated APIs - -SSL_session_reused is the same as SSL_cache_hit. The engine load stuff is -now handled by OPENSSL_init. - -Signed-off-by: Rosen Penev ---- - src/crypto/tls_openssl.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/src/crypto/tls_openssl.c -+++ b/src/crypto/tls_openssl.c -@@ -1024,8 +1024,10 @@ void * tls_init(const struct tls_config - - #ifndef OPENSSL_NO_ENGINE - wpa_printf(MSG_DEBUG, "ENGINE: Loading dynamic engine"); -+#if OPENSSL_VERSION_NUMBER < 0x10100000L - ERR_load_ENGINE_strings(); - ENGINE_load_dynamic(); -+#endif /* OPENSSL_VERSION_NUMBER */ - - if (conf && - (conf->opensc_engine_path || conf->pkcs11_engine_path || -@@ -3874,7 +3876,7 @@ struct wpabuf * tls_connection_decrypt(v - - int tls_connection_resumed(void *ssl_ctx, struct tls_connection *conn) - { -- return conn ? SSL_cache_hit(conn->ssl) : 0; -+ return conn ? SSL_session_reused(conn->ssl) : 0; - } - - diff --git a/package/network/services/hostapd/src/src/ap/ubus.c b/package/network/services/hostapd/src/src/ap/ubus.c index 37a20ed774..3375ac49f7 100644 --- a/package/network/services/hostapd/src/src/ap/ubus.c +++ b/package/network/services/hostapd/src/src/ap/ubus.c @@ -198,6 +198,21 @@ hostapd_bss_get_clients(struct ubus_context *ctx, struct ubus_object *obj, return 0; } +static int +hostapd_bss_get_features(struct ubus_context *ctx, struct ubus_object *obj, + struct ubus_request_data *req, const char *method, + struct blob_attr *msg) +{ + struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj); + + blob_buf_init(&b, 0); + blobmsg_add_u8(&b, "ht_supported", ht_supported(hapd->iface->hw_features)); + blobmsg_add_u8(&b, "vht_supported", vht_supported(hapd->iface->hw_features)); + ubus_send_reply(ctx, req, b.head); + + return 0; +} + enum { NOTIFY_RESPONSE, __NOTIFY_MAX @@ -367,16 +382,26 @@ hostapd_bss_update_beacon(struct ubus_context *ctx, struct ubus_object *obj, enum { CSA_FREQ, CSA_BCN_COUNT, + CSA_CENTER_FREQ1, + CSA_CENTER_FREQ2, + CSA_BANDWIDTH, + CSA_SEC_CHANNEL_OFFSET, + CSA_HT, + CSA_VHT, + CSA_BLOCK_TX, __CSA_MAX }; static const struct blobmsg_policy csa_policy[__CSA_MAX] = { - /* - * for now, frequency and beacon count are enough, add more - * parameters on demand - */ [CSA_FREQ] = { "freq", BLOBMSG_TYPE_INT32 }, [CSA_BCN_COUNT] = { "bcn_count", BLOBMSG_TYPE_INT32 }, + [CSA_CENTER_FREQ1] = { "center_freq1", BLOBMSG_TYPE_INT32 }, + [CSA_CENTER_FREQ2] = { "center_freq2", BLOBMSG_TYPE_INT32 }, + [CSA_BANDWIDTH] = { "bandwidth", BLOBMSG_TYPE_INT32 }, + [CSA_SEC_CHANNEL_OFFSET] = { "sec_channel_offset", BLOBMSG_TYPE_INT32 }, + [CSA_HT] = { "ht", BLOBMSG_TYPE_BOOL }, + [CSA_VHT] = { "vht", BLOBMSG_TYPE_BOOL }, + [CSA_BLOCK_TX] = { "block_tx", BLOBMSG_TYPE_BOOL }, }; #ifdef NEED_AP_MLME @@ -396,12 +421,27 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj, memset(&css, 0, sizeof(css)); css.freq_params.freq = blobmsg_get_u32(tb[CSA_FREQ]); - if (tb[CSA_BCN_COUNT]) - css.cs_count = blobmsg_get_u32(tb[CSA_BCN_COUNT]); + +#define SET_CSA_SETTING(name, field, type) \ + do { \ + if (tb[name]) \ + css.field = blobmsg_get_ ## type(tb[name]); \ + } while(0) + + SET_CSA_SETTING(CSA_BCN_COUNT, cs_count, u32); + SET_CSA_SETTING(CSA_CENTER_FREQ1, freq_params.center_freq1, u32); + SET_CSA_SETTING(CSA_CENTER_FREQ2, freq_params.center_freq2, u32); + SET_CSA_SETTING(CSA_BANDWIDTH, freq_params.bandwidth, u32); + SET_CSA_SETTING(CSA_SEC_CHANNEL_OFFSET, freq_params.sec_channel_offset, u32); + SET_CSA_SETTING(CSA_HT, freq_params.ht_enabled, bool); + SET_CSA_SETTING(CSA_VHT, freq_params.vht_enabled, bool); + SET_CSA_SETTING(CSA_BLOCK_TX, block_tx, bool); + if (hostapd_switch_channel(hapd, &css) != 0) return UBUS_STATUS_NOT_SUPPORTED; return UBUS_STATUS_OK; +#undef SET_CSA_SETTING } #endif @@ -915,6 +955,7 @@ static const struct ubus_method bss_methods[] = { UBUS_METHOD_NOARG("wps_start", hostapd_bss_wps_start), UBUS_METHOD_NOARG("wps_cancel", hostapd_bss_wps_cancel), UBUS_METHOD_NOARG("update_beacon", hostapd_bss_update_beacon), + UBUS_METHOD_NOARG("get_features", hostapd_bss_get_features), #ifdef NEED_AP_MLME UBUS_METHOD("switch_chan", hostapd_switch_chan, csa_policy), #endif @@ -1028,6 +1069,47 @@ int hostapd_ubus_handle_event(struct hostapd_data *hapd, struct hostapd_ubus_req blobmsg_add_u32(&b, "signal", req->frame_info->ssi_signal); blobmsg_add_u32(&b, "freq", hapd->iface->freq); + if (req->elems) { + if(req->elems->ht_capabilities) + { + struct ieee80211_ht_capabilities *ht_capabilities; + void *ht_cap, *ht_cap_mcs_set, *mcs_set; + + + ht_capabilities = (struct ieee80211_ht_capabilities*) req->elems->ht_capabilities; + ht_cap = blobmsg_open_table(&b, "ht_capabilities"); + blobmsg_add_u16(&b, "ht_capabilities_info", ht_capabilities->ht_capabilities_info); + ht_cap_mcs_set = blobmsg_open_table(&b, "supported_mcs_set"); + blobmsg_add_u16(&b, "a_mpdu_params", ht_capabilities->a_mpdu_params); + blobmsg_add_u16(&b, "ht_extended_capabilities", ht_capabilities->ht_extended_capabilities); + blobmsg_add_u32(&b, "tx_bf_capability_info", ht_capabilities->tx_bf_capability_info); + blobmsg_add_u16(&b, "asel_capabilities", ht_capabilities->asel_capabilities); + mcs_set = blobmsg_open_array(&b, "supported_mcs_set"); + for (int i = 0; i < 16; i++) { + blobmsg_add_u16(&b, NULL, (u16) ht_capabilities->supported_mcs_set[i]); + } + blobmsg_close_array(&b, mcs_set); + blobmsg_close_table(&b, ht_cap_mcs_set); + blobmsg_close_table(&b, ht_cap); + } + if(req->elems->vht_capabilities) + { + struct ieee80211_vht_capabilities *vht_capabilities; + void *vht_cap, *vht_cap_mcs_set; + + vht_capabilities = (struct ieee80211_vht_capabilities*) req->elems->vht_capabilities; + vht_cap = blobmsg_open_table(&b, "vht_capabilities"); + blobmsg_add_u32(&b, "vht_capabilities_info", vht_capabilities->vht_capabilities_info); + vht_cap_mcs_set = blobmsg_open_table(&b, "vht_supported_mcs_set"); + blobmsg_add_u16(&b, "rx_map", vht_capabilities->vht_supported_mcs_set.rx_map); + blobmsg_add_u16(&b, "rx_highest", vht_capabilities->vht_supported_mcs_set.rx_highest); + blobmsg_add_u16(&b, "tx_map", vht_capabilities->vht_supported_mcs_set.tx_map); + blobmsg_add_u16(&b, "tx_highest", vht_capabilities->vht_supported_mcs_set.tx_highest); + blobmsg_close_table(&b, vht_cap_mcs_set); + blobmsg_close_table(&b, vht_cap); + } + } + if (!hapd->ubus.notify_response) { ubus_notify(ctx, &hapd->ubus.obj, type, b.head, -1); return WLAN_STATUS_SUCCESS; diff --git a/package/network/services/hostapd/src/src/ap/ubus.h b/package/network/services/hostapd/src/src/ap/ubus.h index ca63b34cb7..185af5a7f4 100644 --- a/package/network/services/hostapd/src/src/ap/ubus.h +++ b/package/network/services/hostapd/src/src/ap/ubus.h @@ -18,6 +18,7 @@ enum hostapd_ubus_event_type { struct hostapd_ubus_request { enum hostapd_ubus_event_type type; const struct ieee80211_mgmt *mgmt_frame; + const struct ieee802_11_elems *elems; const struct hostapd_frame_info *frame_info; const u8 *addr; }; diff --git a/package/network/services/hostapd/src/src/utils/build_features.h b/package/network/services/hostapd/src/src/utils/build_features.h index 315804361c..abebecb570 100644 --- a/package/network/services/hostapd/src/src/utils/build_features.h +++ b/package/network/services/hostapd/src/src/utils/build_features.h @@ -22,6 +22,22 @@ static inline int has_feature(const char *feat) #ifdef CONFIG_IEEE80211W if (!strcmp(feat, "11w")) return 1; +#endif +#ifdef CONFIG_ACS + if (!strcmp(feat, "acs")) + return 1; +#endif +#ifdef CONFIG_SAE + if (!strcmp(feat, "sae")) + return 1; +#endif +#ifdef CONFIG_OWE + if (!strcmp(feat, "owe")) + return 1; +#endif +#ifdef CONFIG_SUITEB192 + if (!strcmp(feat, "suiteb192")) + return 1; #endif return 0; } diff --git a/package/network/services/hostapd/src/wpa_supplicant/ubus.c b/package/network/services/hostapd/src/wpa_supplicant/ubus.c new file mode 100644 index 0000000000..5fdb57be7a --- /dev/null +++ b/package/network/services/hostapd/src/wpa_supplicant/ubus.c @@ -0,0 +1,265 @@ +/* + * wpa_supplicant / ubus support + * Copyright (c) 2018, Daniel Golle + * Copyright (c) 2013, Felix Fietkau + * + * This software may be distributed under the terms of the BSD license. + * See README for more details. + */ + +#include "utils/includes.h" +#include "utils/common.h" +#include "utils/eloop.h" +#include "utils/wpabuf.h" +#include "common/ieee802_11_defs.h" +#include "wpa_supplicant_i.h" +#include "wps_supplicant.h" +#include "ubus.h" + +static struct ubus_context *ctx; +static struct blob_buf b; +static int ctx_ref; + +static inline struct wpa_supplicant *get_wpas_from_object(struct ubus_object *obj) +{ + return container_of(obj, struct wpa_supplicant, ubus.obj); +} + +static void ubus_receive(int sock, void *eloop_ctx, void *sock_ctx) +{ + struct ubus_context *ctx = eloop_ctx; + ubus_handle_event(ctx); +} + +static void ubus_reconnect_timeout(void *eloop_data, void *user_ctx) +{ + if (ubus_reconnect(ctx, NULL)) { + eloop_register_timeout(1, 0, ubus_reconnect_timeout, ctx, NULL); + return; + } + + eloop_register_read_sock(ctx->sock.fd, ubus_receive, ctx, NULL); +} + +static void wpas_ubus_connection_lost(struct ubus_context *ctx) +{ + eloop_unregister_read_sock(ctx->sock.fd); + eloop_register_timeout(1, 0, ubus_reconnect_timeout, ctx, NULL); +} + +static bool wpas_ubus_init(void) +{ + if (ctx) + return true; + + ctx = ubus_connect(NULL); + if (!ctx) + return false; + + ctx->connection_lost = wpas_ubus_connection_lost; + eloop_register_read_sock(ctx->sock.fd, ubus_receive, ctx, NULL); + return true; +} + +static void wpas_ubus_ref_inc(void) +{ + ctx_ref++; +} + +static void wpas_ubus_ref_dec(void) +{ + ctx_ref--; + if (!ctx) + return; + + if (ctx_ref) + return; + + eloop_unregister_read_sock(ctx->sock.fd); + ubus_free(ctx); + ctx = NULL; +} + +static int +wpas_bss_get_features(struct ubus_context *ctx, struct ubus_object *obj, + struct ubus_request_data *req, const char *method, + struct blob_attr *msg) +{ + struct wpa_supplicant *wpa_s = get_wpas_from_object(obj); + + blob_buf_init(&b, 0); + blobmsg_add_u8(&b, "ht_supported", ht_supported(wpa_s->hw.modes)); + blobmsg_add_u8(&b, "vht_supported", vht_supported(wpa_s->hw.modes)); + ubus_send_reply(ctx, req, b.head); + + return 0; +} + +#ifdef CONFIG_WPS +enum { + WPS_START_MULTI_AP, + __WPS_START_MAX +}; + +static const struct blobmsg_policy wps_start_policy[] = { + [WPS_START_MULTI_AP] = { "multi_ap", BLOBMSG_TYPE_BOOL }, +}; + +static int +wpas_bss_wps_start(struct ubus_context *ctx, struct ubus_object *obj, + struct ubus_request_data *req, const char *method, + struct blob_attr *msg) +{ + int rc; + struct wpa_supplicant *wpa_s = get_wpas_from_object(obj); + struct blob_attr *tb[__WPS_START_MAX], *cur; + int multi_ap = 0; + + blobmsg_parse(wps_start_policy, __WPS_START_MAX, tb, blobmsg_data(msg), blobmsg_data_len(msg)); + + if (tb[WPS_START_MULTI_AP]) + multi_ap = blobmsg_get_bool(tb[WPS_START_MULTI_AP]); + + rc = wpas_wps_start_pbc(wpa_s, NULL, 0, multi_ap); + + if (rc != 0) + return UBUS_STATUS_NOT_SUPPORTED; + + return 0; +} + +static int +wpas_bss_wps_cancel(struct ubus_context *ctx, struct ubus_object *obj, + struct ubus_request_data *req, const char *method, + struct blob_attr *msg) +{ + int rc; + struct wpa_supplicant *wpa_s = get_wpas_from_object(obj); + + rc = wpas_wps_cancel(wpa_s); + + if (rc != 0) + return UBUS_STATUS_NOT_SUPPORTED; + + return 0; +} +#endif + +static const struct ubus_method bss_methods[] = { +#ifdef CONFIG_WPS + UBUS_METHOD_NOARG("wps_start", wpas_bss_wps_start), + UBUS_METHOD_NOARG("wps_cancel", wpas_bss_wps_cancel), +#endif + UBUS_METHOD_NOARG("get_features", wpas_bss_get_features), +}; + +static struct ubus_object_type bss_object_type = + UBUS_OBJECT_TYPE("wpas_bss", bss_methods); + +void wpas_ubus_add_bss(struct wpa_supplicant *wpa_s) +{ + struct ubus_object *obj = &wpa_s->ubus.obj; + char *name; + int ret; + + if (!wpas_ubus_init()) + return; + + if (asprintf(&name, "wpa_supplicant.%s", wpa_s->ifname) < 0) + return; + + obj->name = name; + obj->type = &bss_object_type; + obj->methods = bss_object_type.methods; + obj->n_methods = bss_object_type.n_methods; + ret = ubus_add_object(ctx, obj); + wpas_ubus_ref_inc(); +} + +void wpas_ubus_free_bss(struct wpa_supplicant *wpa_s) +{ + struct ubus_object *obj = &wpa_s->ubus.obj; + char *name = (char *) obj->name; + + if (!ctx) + return; + + if (obj->id) { + ubus_remove_object(ctx, obj); + wpas_ubus_ref_dec(); + } + + free(name); +} + +#ifdef CONFIG_WPS +void wpas_ubus_notify(struct wpa_supplicant *wpa_s, const struct wps_credential *cred) +{ + u16 auth_type; + char *ifname, *encryption, *ssid, *key; + size_t ifname_len; + + if (!cred) + return; + + auth_type = cred->auth_type; + + if (auth_type == (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) + auth_type = WPS_AUTH_WPA2PSK; + + if (auth_type != WPS_AUTH_OPEN && + auth_type != WPS_AUTH_WPAPSK && + auth_type != WPS_AUTH_WPA2PSK) { + wpa_printf(MSG_DEBUG, "WPS: Ignored credentials for " + "unsupported authentication type 0x%x", + auth_type); + return; + } + + if (auth_type == WPS_AUTH_WPAPSK || auth_type == WPS_AUTH_WPA2PSK) { + if (cred->key_len < 8 || cred->key_len > 2 * PMK_LEN) { + wpa_printf(MSG_ERROR, "WPS: Reject PSK credential with " + "invalid Network Key length %lu", + (unsigned long) cred->key_len); + return; + } + } + + blob_buf_init(&b, 0); + + ifname_len = strlen(wpa_s->ifname); + ifname = blobmsg_alloc_string_buffer(&b, "ifname", ifname_len + 1); + memcpy(ifname, wpa_s->ifname, ifname_len + 1); + ifname[ifname_len] = '\0'; + blobmsg_add_string_buffer(&b); + + switch (auth_type) { + case WPS_AUTH_WPA2PSK: + encryption = "psk2"; + break; + case WPS_AUTH_WPAPSK: + encryption = "psk"; + break; + default: + encryption = "none"; + break; + } + + blobmsg_add_string(&b, "encryption", encryption); + + ssid = blobmsg_alloc_string_buffer(&b, "ssid", cred->ssid_len + 1); + memcpy(ssid, cred->ssid, cred->ssid_len); + ssid[cred->ssid_len] = '\0'; + blobmsg_add_string_buffer(&b); + + if (cred->key_len > 0) { + key = blobmsg_alloc_string_buffer(&b, "key", cred->key_len + 1); + memcpy(key, cred->key, cred->key_len); + key[cred->key_len] = '\0'; + blobmsg_add_string_buffer(&b); + } + +// ubus_notify(ctx, &wpa_s->ubus.obj, "wps_credentials", b.head, -1); + ubus_send_event(ctx, "wps_credentials", b.head); +} +#endif /* CONFIG_WPS */ diff --git a/package/network/services/hostapd/src/wpa_supplicant/ubus.h b/package/network/services/hostapd/src/wpa_supplicant/ubus.h new file mode 100644 index 0000000000..c37e743e73 --- /dev/null +++ b/package/network/services/hostapd/src/wpa_supplicant/ubus.h @@ -0,0 +1,53 @@ +/* + * wpa_supplicant / ubus support + * Copyright (c) 2018, Daniel Golle + * Copyright (c) 2013, Felix Fietkau + * + * This software may be distributed under the terms of the BSD license. + * See README for more details. + */ +#ifndef __WPAS_UBUS_H +#define __WPAS_UBUS_H + +struct wpa_supplicant; +#include "wps_supplicant.h" + +#ifdef UBUS_SUPPORT +#include + +struct wpas_ubus_bss { + struct ubus_object obj; +}; + +void wpas_ubus_add_bss(struct wpa_supplicant *wpa_s); +void wpas_ubus_free_bss(struct wpa_supplicant *wpa_s); + +#ifdef CONFIG_WPS +void wpas_ubus_notify(struct wpa_supplicant *wpa_s, const struct wps_credential *cred); +#endif + +#else +struct wpas_ubus_bss {}; + +static inline void wpas_ubus_add_iface(struct wpa_supplicant *wpa_s) +{ +} + +static inline void wpas_ubus_free_iface(struct wpa_supplicant *wpa_s) +{ +} + +static inline void wpas_ubus_add_bss(struct wpa_supplicant *wpa_s) +{ +} + +static inline void wpas_ubus_free_bss(struct wpa_supplicant *wpa_s) +{ +} + +static inline void wpas_ubus_notify(struct wpa_supplicant *wpa_s, struct wps_credential *cred) +{ +} +#endif + +#endif