hostapd: make rrm report independent of ieee80211k setting
[openwrt/openwrt.git] / package / network / services / hostapd / files / hostapd.sh
index 3c1504ca60beb601080032d33449d61fa1bc8ba1..832a05633922c2924b377b1366ad3dc8e9085941 100644 (file)
@@ -1,4 +1,5 @@
 . /lib/functions/network.sh
+. /lib/functions.sh
 
 wpa_supplicant_add_rate() {
        local var="$1"
@@ -47,6 +48,7 @@ hostapd_append_wpa_key_mgmt() {
                ;;
                eap192)
                        append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
+                       [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
                ;;
                eap-eap192)
                        append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
@@ -69,6 +71,8 @@ hostapd_append_wpa_key_mgmt() {
                        append wpa_key_mgmt "OWE"
                ;;
        esac
+
+       [ "$auth_osen" = "1" ] && append wpa_key_mgmt "OSEN"
 }
 
 hostapd_add_log_config() {
@@ -90,6 +94,8 @@ hostapd_common_add_device_config() {
 
        config_add_string country
        config_add_boolean country_ie doth
+       config_add_boolean spectrum_mgmt_required
+       config_add_int local_pwr_constraint
        config_add_string require_mode
        config_add_boolean legacy_rates
 
@@ -106,20 +112,27 @@ hostapd_prepare_device_config() {
        local base="${config%%.conf}"
        local base_cfg=
 
-       json_get_vars country country_ie beacon_int:100 doth require_mode legacy_rates acs_chan_bias
+       json_get_vars country country_ie beacon_int:100 dtim_period:2 doth require_mode legacy_rates \
+               acs_chan_bias local_pwr_constraint spectrum_mgmt_required airtime_mode
 
        hostapd_set_log_options base_cfg
 
        set_default country_ie 1
+       set_default spectrum_mgmt_required 0
        set_default doth 1
        set_default legacy_rates 1
+       set_default airtime_mode 0
 
        [ "$hwmode" = "b" ] && legacy_rates=1
 
        [ -n "$country" ] && {
                append base_cfg "country_code=$country" "$N"
 
-               [ "$country_ie" -gt 0 ] && append base_cfg "ieee80211d=1" "$N"
+               [ "$country_ie" -gt 0 ] && {
+                       append base_cfg "ieee80211d=1" "$N"
+                       [ -n "$local_pwr_constraint" ] && append base_cfg "local_pwr_constraint=$local_pwr_constraint" "$N"
+                       [ "$spectrum_mgmt_required" -gt 0 ] && append base_cfg "spectrum_mgmt_required=$spectrum_mgmt_required" "$N"
+               }
                [ "$hwmode" = "a" -a "$doth" -gt 0 ] && append base_cfg "ieee80211h=1" "$N"
        }
 
@@ -154,6 +167,8 @@ hostapd_prepare_device_config() {
        [ -n "$rlist" ] && append base_cfg "supported_rates=$rlist" "$N"
        [ -n "$brlist" ] && append base_cfg "basic_rates=$brlist" "$N"
        append base_cfg "beacon_int=$beacon_int" "$N"
+       append base_cfg "dtim_period=$dtim_period" "$N"
+       [ "$airtime_mode" -gt 0 ] && append base_cfg "airtime_mode=$airtime_mode" "$N"
 
        json_get_values opts hostapd_options
        for val in $opts; do
@@ -176,6 +191,7 @@ hostapd_common_add_bss_config() {
        config_add_int \
                wep_rekey eap_reauth_period \
                wpa_group_rekey wpa_pair_rekey wpa_master_rekey
+       config_add_boolean wpa_strict_rekey
        config_add_boolean wpa_disable_eapol_key_retries
 
        config_add_boolean tdls_prohibit
@@ -185,7 +201,7 @@ hostapd_common_add_bss_config() {
        config_add_int eapol_version
 
        config_add_string 'auth_server:host' 'server:host'
-       config_add_string auth_secret
+       config_add_string auth_secret key
        config_add_int 'auth_port:port' 'port:port'
 
        config_add_string acct_server
@@ -202,6 +218,10 @@ hostapd_common_add_bss_config() {
        config_add_string radius_client_addr
        config_add_string iapp_interface
        config_add_string eap_type ca_cert client_cert identity anonymous_identity auth priv_key priv_key_pwd
+       config_add_boolean ca_cert_usesystem ca_cert2_usesystem
+       config_add_string subject_match subject_match2
+       config_add_array altsubject_match altsubject_match2
+       config_add_array domain_match domain_match2 domain_suffix_match domain_suffix_match2
        config_add_string ieee80211w_mgmt_cipher
 
        config_add_int dynamic_vlan vlan_naming
@@ -241,10 +261,114 @@ hostapd_common_add_bss_config() {
        config_add_int mcast_rate
        config_add_array basic_rate
        config_add_array supported_rates
-       
+
        config_add_boolean sae_require_mfp
-       
+
        config_add_string 'owe_transition_bssid:macaddr' 'owe_transition_ssid:string'
+
+       config_add_boolean hs20 disable_dgaf osen
+       config_add_int anqp_domain_id
+       config_add_int hs20_deauth_req_timeout
+       config_add_array hs20_oper_friendly_name
+       config_add_array osu_provider
+       config_add_array operator_icon
+       config_add_array hs20_conn_capab
+       config_add_string osu_ssid hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp
+
+       config_add_int airtime_bss_weight airtime_bss_limit
+}
+
+hostapd_set_vlan_file() {
+       local ifname="$1"
+       local vlan="$2"
+       json_get_vars name vid
+       echo "${vid} ${ifname}-${name}" >> /var/run/hostapd-${ifname}.vlan
+       wireless_add_vlan "${vlan}" "${ifname}-${name}"
+}
+
+hostapd_set_vlan() {
+       local ifname="$1"
+
+       rm -f /var/run/hostapd-${ifname}.vlan
+       for_each_vlan hostapd_set_vlan_file ${ifname}
+}
+
+hostapd_set_psk_file() {
+       local ifname="$1"
+       local vlan="$2"
+       local vlan_id=""
+
+       json_get_vars mac vid key
+       set_default mac "00:00:00:00:00:00"
+       [ -n "$vid" ] && vlan_id="vlanid=$vid "
+       echo "${vlan_id} ${mac} ${key}" >> /var/run/hostapd-${ifname}.psk
+}
+
+hostapd_set_psk() {
+       local ifname="$1"
+
+       rm -f /var/run/hostapd-${ifname}.psk
+       for_each_station hostapd_set_psk_file ${ifname}
+}
+
+append_hs20_oper_friendly_name() {
+       append bss_conf "hs20_oper_friendly_name=$1" "$N"
+}
+
+append_osu_provider_service_desc() {
+       append bss_conf "osu_service_desc=$1" "$N"
+}
+
+append_hs20_icon() {
+       local width height lang type path
+       config_get width "$1" width
+       config_get height "$1" height
+       config_get lang "$1" lang
+       config_get type "$1" type
+       config_get path "$1" path
+
+       append bss_conf "hs20_icon=$width:$height:$lang:$type:$1:$path" "$N"
+}
+
+append_hs20_icons() {
+       config_load wireless
+       config_foreach append_hs20_icon hs20-icon
+}
+
+append_operator_icon() {
+       append bss_conf "operator_icon=$1" "$N"
+}
+
+append_osu_icon() {
+       append bss_conf "osu_icon=$1" "$N"
+}
+
+append_osu_provider() {
+       local cfgtype osu_server_uri osu_friendly_name osu_nai osu_nai2 osu_method_list 
+
+       config_load wireless
+       config_get cfgtype "$1" TYPE
+       [ "$cfgtype" != "osu-provider" ] && return
+
+       append bss_conf "# provider $1" "$N"
+       config_get osu_server_uri "$1" osu_server_uri
+       config_get osu_nai "$1" osu_nai
+       config_get osu_nai2 "$1" osu_nai2
+       config_get osu_method_list "$1" osu_method
+
+       append bss_conf "osu_server_uri=$osu_server_uri" "$N"
+       append bss_conf "osu_nai=$osu_nai" "$N"
+       append bss_conf "osu_nai2=$osu_nai2" "$N"
+       append bss_conf "osu_method_list=$osu_method_list" "$N"
+
+       config_list_foreach "$1" osu_service_desc append_osu_provider_service_desc
+       config_list_foreach "$1" osu_icon append_osu_icon
+
+       append bss_conf "$N"
+}
+
+append_hs20_conn_capab() {
+       [ -n "$1" ] && append bss_conf "hs20_conn_capab=$1" "$N"
 }
 
 hostapd_set_bss_options() {
@@ -254,11 +378,11 @@ hostapd_set_bss_options() {
 
        wireless_vif_parse_encryption
 
-       local bss_conf
+       local bss_conf bss_md5sum
        local wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey wpa_key_mgmt
 
        json_get_vars \
-               wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey \
+               wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey wpa_strict_rekey \
                wpa_disable_eapol_key_retries tdls_prohibit \
                maxassoc max_inactivity disassoc_low_ack isolate auth_cache \
                wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 wps_ap_setup_locked \
@@ -267,7 +391,8 @@ hostapd_set_bss_options() {
                iapp_interface eapol_version dynamic_vlan ieee80211w nasid \
                acct_server acct_secret acct_port acct_interval \
                bss_load_update_period chan_util_avg_period sae_require_mfp \
-               multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key
+               multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key \
+               airtime_bss_weight airtime_bss_limit
 
        set_default isolate 0
        set_default maxassoc 0
@@ -285,6 +410,8 @@ hostapd_set_bss_options() {
        set_default chan_util_avg_period 600
        set_default utf8_ssid 1
        set_default multi_ap 0
+       set_default airtime_bss_weight 0
+       set_default airtime_bss_limit 0
 
        append bss_conf "ctrl_interface=/var/run/hostapd"
        if [ "$isolate" -gt 0 ]; then
@@ -297,6 +424,9 @@ hostapd_set_bss_options() {
                append bss_conf "ap_max_inactivity=$max_inactivity" "$N"
        fi
 
+       [ "$airtime_bss_weight" -gt 0 ] && append bss_conf "airtime_bss_weight=$airtime_bss_weight" "$N"
+       [ "$airtime_bss_limit" -gt 0 ] && append bss_conf "airtime_bss_limit=$airtime_bss_limit" "$N"
+
        append bss_conf "bss_load_update_period=$bss_load_update_period" "$N"
        append bss_conf "chan_util_avg_period=$chan_util_avg_period" "$N"
        append bss_conf "disassoc_low_ack=$disassoc_low_ack" "$N"
@@ -313,6 +443,7 @@ hostapd_set_bss_options() {
                [ -n "$wpa_group_rekey"  ] && append bss_conf "wpa_group_rekey=$wpa_group_rekey" "$N"
                [ -n "$wpa_pair_rekey"   ] && append bss_conf "wpa_ptk_rekey=$wpa_pair_rekey"    "$N"
                [ -n "$wpa_master_rekey" ] && append bss_conf "wpa_gmk_rekey=$wpa_master_rekey"  "$N"
+               [ -n "$wpa_strict_rekey" ] && append bss_conf "wpa_strict_rekey=$wpa_strict_rekey" "$N"
        }
 
        [ -n "$nasid" ] && append bss_conf "nas_identifier=$nasid" "$N"
@@ -353,20 +484,23 @@ hostapd_set_bss_options() {
                ;;
                psk|sae|psk-sae)
                        json_get_vars key wpa_psk_file
-                       if [ ${#key} -lt 8 ]; then
-                               wireless_setup_vif_failed INVALID_WPA_PSK
-                               return 1
-                       elif [ ${#key} -eq 64 ]; then
+                       if [ ${#key} -eq 64 ]; then
                                append bss_conf "wpa_psk=$key" "$N"
-                       else
+                       elif [ ${#key} -ge 8 ] && [ ${#key} -le 63 ]; then
                                append bss_conf "wpa_passphrase=$key" "$N"
+                       elif [ -n "$key" ] || [ -z "$wpa_psk_file" ]; then
+                               wireless_setup_vif_failed INVALID_WPA_PSK
+                               return 1
                        fi
+                       [ -z "$wpa_psk_file" ] && set_default wpa_psk_file /var/run/hostapd-$ifname.psk
                        [ -n "$wpa_psk_file" ] && {
                                [ -e "$wpa_psk_file" ] || touch "$wpa_psk_file"
                                append bss_conf "wpa_psk_file=$wpa_psk_file" "$N"
                        }
                        [ "$eapol_version" -ge "1" -a "$eapol_version" -le "2" ] && append bss_conf "eapol_version=$eapol_version" "$N"
 
+                       set_default dynamic_vlan 0
+                       vlan_possible=1
                        wps_possible=1
                ;;
                eap|eap192|eap-eap192)
@@ -491,17 +625,16 @@ hostapd_set_bss_options() {
                append bss_conf "bss_transition=$bss_transition" "$N"
        fi
 
-       json_get_vars ieee80211k
+       json_get_vars ieee80211k rrm_neighbor_report rrm_beacon_report
        set_default ieee80211k 0
        if [ "$ieee80211k" -eq "1" ]; then
-               json_get_vars rrm_neighbor_report rrm_beacon_report
-
                set_default rrm_neighbor_report 1
                set_default rrm_beacon_report 1
-               append bss_conf "rrm_neighbor_report=$rrm_neighbor_report" "$N"
-               append bss_conf "rrm_beacon_report=$rrm_beacon_report" "$N"
        fi
 
+       [ "$rrm_neighbor_report" -eq "1" ] && append bss_conf "rrm_neighbor_report=1" "$N"
+       [ "$rrm_beacon_report" -eq "1" ] && append bss_conf "rrm_beacon_report=1" "$N"
+
        if [ "$wpa" -ge "1" ]; then
                json_get_vars ieee80211r
                set_default ieee80211r 0
@@ -510,10 +643,18 @@ hostapd_set_bss_options() {
                        json_get_vars mobility_domain ft_psk_generate_local ft_over_ds reassociation_deadline
                        
                        set_default mobility_domain "$(echo "$ssid" | md5sum | head -c 4)"
-                       set_default ft_psk_generate_local 1
                        set_default ft_over_ds 1
                        set_default reassociation_deadline 1000
 
+                       case "$auth_type" in
+                               psk|sae|psk-sae)
+                                       set_default ft_psk_generate_local 1
+                               ;;
+                               *)
+                                       set_default ft_psk_generate_local 0
+                               ;;
+                       esac
+
                        append bss_conf "mobility_domain=$mobility_domain" "$N"
                        append bss_conf "ft_psk_generate_local=$ft_psk_generate_local" "$N"
                        append bss_conf "ft_over_ds=$ft_over_ds" "$N"
@@ -615,6 +756,7 @@ hostapd_set_bss_options() {
        [ -n "$vlan_possible" -a -n "$dynamic_vlan" ] && {
                json_get_vars vlan_naming vlan_tagged_interface vlan_bridge vlan_file
                set_default vlan_naming 1
+               [ -z "$vlan_file" ] && set_default vlan_file /var/run/hostapd-$ifname.vlan
                append bss_conf "dynamic_vlan=$dynamic_vlan" "$N"
                append bss_conf "vlan_naming=$vlan_naming" "$N"
                [ -n "$vlan_bridge" ] && \
@@ -627,6 +769,37 @@ hostapd_set_bss_options() {
                }
        }
 
+       local hs20 disable_dgaf osen anqp_domain_id hs20_deauth_req_timeout \
+               osu_ssid hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp
+       json_get_vars hs20 disable_dgaf osen anqp_domain_id hs20_deauth_req_timeout \
+               osu_ssid hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp
+
+       set_default hs20 0
+       set_default disable_dgaf $hs20
+       set_default osen 0
+       set_default anqp_domain_id 0
+       set_default hs20_deauth_req_timeout 60
+       if [ "$hs20" = "1" ]; then
+               append bss_conf "hs20=1" "$N"
+               append_hs20_icons
+               append bss_conf "disable_dgaf=$disable_dgaf" "$N"
+               append bss_conf "osen=$osen" "$N"
+               append bss_conf "anqp_domain_id=$anqp_domain_id" "$N"
+               append bss_conf "hs20_deauth_req_timeout=$hs20_deauth_req_timeout" "$N"
+               [ -n "$osu_ssid" ] && append bss_conf "osu_ssid=$osu_ssid" "$N"
+               [ -n "$hs20_wan_metrics" ] && append bss_conf "hs20_wan_metrics=$hs20_wan_metrics" "$N"
+               [ -n "$hs20_operating_class" ] && append bss_conf "hs20_operating_class=$hs20_operating_class" "$N"
+               [ -n "$hs20_t_c_filename" ] && append bss_conf "hs20_t_c_filename=$hs20_t_c_filename" "$N"
+               [ -n "$hs20_t_c_timestamp" ] && append bss_conf "hs20_t_c_timestamp=$hs20_t_c_timestamp" "$N"
+               json_for_each_item append_hs20_conn_capab hs20_conn_capab
+               json_for_each_item append_hs20_oper_friendly_name hs20_oper_friendly_name
+               json_for_each_item append_osu_provider osu_provider
+               json_for_each_item append_operator_icon operator_icon
+       fi
+
+       bss_md5sum=$(echo $bss_conf | md5sum | cut -d" " -f1)
+       append bss_conf "config_id=$bss_md5sum" "$N"
+
        append "$var" "$bss_conf" "$N"
        return 0
 }
@@ -704,12 +877,9 @@ wpa_supplicant_prepare_interface() {
        local ap_scan=
 
        _w_mode="$mode"
-       _w_modestr=
 
-       [[ "$mode" = adhoc ]] && {
+       [ "$mode" = adhoc ] && {
                ap_scan="ap_scan=2"
-
-               _w_modestr="mode=1"
        }
 
        local country_str=
@@ -725,6 +895,7 @@ wpa_supplicant_prepare_interface() {
        fi
        wpa_supplicant_teardown_interface "$ifname"
        cat > "$_config" <<EOF
+${scan_list:+freq_list=$scan_list}
 $ap_scan
 $country_str
 EOF
@@ -748,7 +919,8 @@ wpa_supplicant_set_fixed_freq() {
        case "$htmode" in
                VHT80) append network_data "max_oper_chwidth=1" "$N$T";;
                VHT160) append network_data "max_oper_chwidth=2" "$N$T";;
-               *) append network_data "max_oper_chwidth=0" "$N$T";;
+               VHT20|VHT40) append network_data "max_oper_chwidth=0" "$N$T";;
+               *) append network_data "disable_vht=1" "$N$T";;
        esac
 }
 
@@ -787,16 +959,17 @@ wpa_supplicant_add_network() {
        local scan_ssid="scan_ssid=1"
        local freq wpa_key_mgmt
 
-       [[ "$_w_mode" = "adhoc" ]] && {
+       [ "$_w_mode" = "adhoc" ] && {
                append network_data "mode=1" "$N$T"
                [ -n "$freq" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
+               [ "$noscan" = "1" ] && append network_data "noscan=1" "$N$T"
 
                scan_ssid="scan_ssid=0"
 
                [ "$_w_driver" = "nl80211" ] || append wpa_key_mgmt "WPA-NONE"
        }
 
-       [[ "$_w_mode" = "mesh" ]] && {
+       [ "$_w_mode" = "mesh" ] && {
                json_get_vars mesh_id mesh_fwding mesh_rssi_threshold
                [ -n "$mesh_id" ] && ssid="${mesh_id}"
 
@@ -809,8 +982,6 @@ wpa_supplicant_add_network() {
                scan_ssid=""
        }
 
-       [ "$_w_mode" = "adhoc" -o "$_w_mode" = "mesh" ] && append network_data "$_w_modestr" "$N$T"
-
        [ "$multi_ap" = 1 -a "$_w_mode" = "sta" ] && append network_data "multi_ap_backhaul_sta=1" "$N$T"
 
        case "$auth_type" in
@@ -851,8 +1022,13 @@ wpa_supplicant_add_network() {
                        hostapd_append_wpa_key_mgmt
                        key_mgmt="$wpa_key_mgmt"
 
-                       json_get_vars eap_type identity anonymous_identity ca_cert
-                       [ -n "$ca_cert" ] && append network_data "ca_cert=\"$ca_cert\"" "$N$T"
+                       json_get_vars eap_type identity anonymous_identity ca_cert ca_cert_usesystem
+
+                       if [ "$ca_cert_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
+                               append network_data "ca_cert=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
+                       else
+                               [ -n "$ca_cert" ] && append network_data "ca_cert=\"$ca_cert\"" "$N$T"
+                       fi
                        [ -n "$identity" ] && append network_data "identity=\"$identity\"" "$N$T"
                        [ -n "$anonymous_identity" ] && append network_data "anonymous_identity=\"$anonymous_identity\"" "$N$T"
                        case "$eap_type" in
@@ -861,14 +1037,47 @@ wpa_supplicant_add_network() {
                                        append network_data "client_cert=\"$client_cert\"" "$N$T"
                                        append network_data "private_key=\"$priv_key\"" "$N$T"
                                        append network_data "private_key_passwd=\"$priv_key_pwd\"" "$N$T"
+
+                                       json_get_vars subject_match
+                                       [ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
+
+                                       json_get_values altsubject_match altsubject_match
+                                       if [ -n "$altsubject_match" ]; then
+                                               local list=
+                                               for x in $altsubject_match; do
+                                                       append list "$x" ";"
+                                               done
+                                               append network_data "altsubject_match=\"$list\"" "$N$T"
+                                       fi
+
+                                       json_get_values domain_match domain_match
+                                       if [ -n "$domain_match" ]; then
+                                               local list=
+                                               for x in $domain_match; do
+                                                       append list "$x" ";"
+                                               done
+                                               append network_data "domain_match=\"$list\"" "$N$T"
+                                       fi
+
+                                       json_get_values domain_suffix_match domain_suffix_match
+                                       if [ -n "$domain_suffix_match" ]; then
+                                               local list=
+                                               for x in $domain_suffix_match; do
+                                                       append list "$x" ";"
+                                               done
+                                               append network_data "domain_suffix_match=\"$list\"" "$N$T"
+                                       fi
                                ;;
                                fast|peap|ttls)
-                                       json_get_vars auth password ca_cert2 client_cert2 priv_key2 priv_key2_pwd
+                                       json_get_vars auth password ca_cert2 ca_cert2_usesystem client_cert2 priv_key2 priv_key2_pwd
                                        set_default auth MSCHAPV2
 
                                        if [ "$auth" = "EAP-TLS" ]; then
-                                               [ -n "$ca_cert2" ] &&
-                                                       append network_data "ca_cert2=\"$ca_cert2\"" "$N$T"
+                                               if [ "$ca_cert2_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
+                                                       append network_data "ca_cert2=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
+                                               else
+                                                       [ -n "$ca_cert2" ] && append network_data "ca_cert2=\"$ca_cert2\"" "$N$T"
+                                               fi
                                                append network_data "client_cert2=\"$client_cert2\"" "$N$T"
                                                append network_data "private_key2=\"$priv_key2\"" "$N$T"
                                                append network_data "private_key2_passwd=\"$priv_key2_pwd\"" "$N$T"
@@ -876,6 +1085,36 @@ wpa_supplicant_add_network() {
                                                append network_data "password=\"$password\"" "$N$T"
                                        fi
 
+                                       json_get_vars subject_match
+                                       [ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
+
+                                       json_get_values altsubject_match altsubject_match
+                                       if [ -n "$altsubject_match" ]; then
+                                               local list=
+                                               for x in $altsubject_match; do
+                                                       append list "$x" ";"
+                                               done
+                                               append network_data "altsubject_match=\"$list\"" "$N$T"
+                                       fi
+
+                                       json_get_values domain_match domain_match
+                                       if [ -n "$domain_match" ]; then
+                                               local list=
+                                               for x in $domain_match; do
+                                                       append list "$x" ";"
+                                               done
+                                               append network_data "domain_match=\"$list\"" "$N$T"
+                                       fi
+
+                                       json_get_values domain_suffix_match domain_suffix_match
+                                       if [ -n "$domain_suffix_match" ]; then
+                                               local list=
+                                               for x in $domain_suffix_match; do
+                                                       append list "$x" ";"
+                                               done
+                                               append network_data "domain_suffix_match=\"$list\"" "$N$T"
+                                       fi
+
                                        phase2proto="auth="
                                        case "$auth" in
                                                "auth"*)
@@ -885,6 +1124,35 @@ wpa_supplicant_add_network() {
                                                        auth="$(echo $auth | cut -b 5- )"
                                                        [ "$eap_type" = "ttls" ] &&
                                                                phase2proto="autheap="
+                                                       json_get_vars subject_match2
+                                                       [ -n "$subject_match2" ] && append network_data "subject_match2=\"$subject_match2\"" "$N$T"
+
+                                                       json_get_values altsubject_match2 altsubject_match2
+                                                       if [ -n "$altsubject_match2" ]; then
+                                                               local list=
+                                                               for x in $altsubject_match2; do
+                                                                       append list "$x" ";"
+                                                               done
+                                                               append network_data "altsubject_match2=\"$list\"" "$N$T"
+                                                       fi
+
+                                                       json_get_values domain_match2 domain_match2
+                                                       if [ -n "$domain_match2" ]; then
+                                                               local list=
+                                                               for x in $domain_match2; do
+                                                                       append list "$x" ";"
+                                                               done
+                                                               append network_data "domain_match2=\"$list\"" "$N$T"
+                                                       fi
+
+                                                       json_get_values domain_suffix_match2 domain_suffix_match2
+                                                       if [ -n "$domain_suffix_match2" ]; then
+                                                               local list=
+                                                               for x in $domain_suffix_match2; do
+                                                                       append list "$x" ";"
+                                                               done
+                                                               append network_data "domain_suffix_match2=\"$list\"" "$N$T"
+                                                       fi
                                                ;;
                                        esac
                                        append network_data "phase2=\"$phase2proto$auth\"" "$N$T"
@@ -950,27 +1218,29 @@ EOF
 }
 
 wpa_supplicant_run() {
-       local ifname="$1"; shift
+       local ifname="$1"
+       local hostapd_ctrl="$2"
 
        _wpa_supplicant_common "$ifname"
 
-       /usr/sbin/wpa_supplicant -B -s \
-               ${network_bridge:+-b $network_bridge} \
-               -P "/var/run/wpa_supplicant-${ifname}.pid" \
-               -D ${_w_driver:-wext} \
-               -i "$ifname" \
-               -c "$_config" \
-               -C "$_rpath" \
-               "$@"
+       ubus wait_for wpa_supplicant
+       ubus call wpa_supplicant config_add "{ \
+               \"driver\": \"${_w_driver:-wext}\", \"ctrl\": \"$_rpath\", \
+               \"iface\": \"$ifname\", \"config\": \"$_config\" \
+               ${network_bridge:+, \"bridge\": \"$network_bridge\"} \
+               ${hostapd_ctrl:+, \"hostapd_ctrl\": \"$hostapd_ctrl\"} \
+               }"
 
        ret="$?"
-       wireless_add_process "$(cat "/var/run/wpa_supplicant-${ifname}.pid")" /usr/sbin/wpa_supplicant 1
 
        [ "$ret" != 0 ] && wireless_setup_vif_failed WPA_SUPPLICANT_FAILED
 
+       local supplicant_pid=$(ubus call service list '{"name": "wpad"}' | jsonfilter -l 1 -e "@['wpad'].instances['supplicant'].pid")
+       wireless_add_process "$supplicant_pid" "/usr/sbin/wpa_supplicant" 1
+
        return $ret
 }
 
 hostapd_common_cleanup() {
-       killall hostapd wpa_supplicant meshd-nl80211
+       killall meshd-nl80211
 }