hostapd: mesh: make forwarding configurable
[openwrt/openwrt.git] / package / network / services / hostapd / files / hostapd.sh
index 73ad6d67047601b52a4ec5cb393149c572c327c9..c3640689da60fb3bcaa4e7ce67b99b5f117b6690 100644 (file)
@@ -67,6 +67,7 @@ hostapd_common_add_device_config() {
        config_add_boolean legacy_rates
 
        config_add_string acs_chan_bias
+       config_add_array hostapd_options
 
        hostapd_add_log_config
 }
@@ -127,6 +128,11 @@ hostapd_prepare_device_config() {
        [ -n "$brlist" ] && append base_cfg "basic_rates=$brlist" "$N"
        append base_cfg "beacon_int=$beacon_int" "$N"
 
+       json_get_values opts hostapd_options
+       for val in $opts; do
+               append base_cfg "$val" "$N"
+       done
+
        cat > "$config" <<EOF
 driver=$driver
 $base_cfg
@@ -143,6 +149,9 @@ hostapd_common_add_bss_config() {
        config_add_int \
                wep_rekey eap_reauth_period \
                wpa_group_rekey wpa_pair_rekey wpa_master_rekey
+       config_add_boolean wpa_disable_eapol_key_retries
+
+       config_add_boolean tdls_prohibit
 
        config_add_boolean rsn_preauth auth_cache
        config_add_int ieee80211w
@@ -163,8 +172,10 @@ hostapd_common_add_bss_config() {
 
        config_add_string nasid
        config_add_string ownip
+       config_add_string radius_client_addr
        config_add_string iapp_interface
        config_add_string eap_type ca_cert client_cert identity anonymous_identity auth priv_key priv_key_pwd
+       config_add_string ieee80211w_mgmt_cipher
 
        config_add_int dynamic_vlan vlan_naming
        config_add_string vlan_tagged_interface vlan_bridge
@@ -178,7 +189,11 @@ hostapd_common_add_bss_config() {
        config_add_int wps_ap_setup_locked wps_independent
        config_add_string wps_device_type wps_device_name wps_manufacturer wps_pin
 
-       config_add_boolean ieee80211r pmk_r1_push
+       config_add_boolean ieee80211v wnm_sleep_mode bss_transition
+       config_add_int time_advertisement
+       config_add_string time_zone
+
+       config_add_boolean ieee80211r pmk_r1_push ft_psk_generate_local ft_over_ds
        config_add_int r0_key_lifetime reassociation_deadline
        config_add_string mobility_domain r1_key_holder
        config_add_array r0kh r1kh
@@ -208,6 +223,7 @@ hostapd_set_bss_options() {
 
        json_get_vars \
                wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey \
+               wpa_disable_eapol_key_retries tdls_prohibit \
                maxassoc max_inactivity disassoc_low_ack isolate auth_cache \
                wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 wps_ap_setup_locked \
                wps_independent wps_device_type wps_device_name wps_manufacturer wps_pin \
@@ -223,6 +239,8 @@ hostapd_set_bss_options() {
        set_default hidden 0
        set_default wmm 1
        set_default uapsd 1
+       set_default wpa_disable_eapol_key_retries 0
+       set_default tdls_prohibit 0
        set_default eapol_version 0
        set_default acct_port 1813
 
@@ -243,6 +261,8 @@ hostapd_set_bss_options() {
        append bss_conf "ignore_broadcast_ssid=$hidden" "$N"
        append bss_conf "uapsd_advertisement_enabled=$uapsd" "$N"
 
+       [ "$tdls_prohibit" -gt 0 ] && append bss_conf "tdls_prohibit=$tdls_prohibit" "$N"
+
        [ "$wpa" -gt 0 ] && {
                [ -n "$wpa_group_rekey"  ] && append bss_conf "wpa_group_rekey=$wpa_group_rekey" "$N"
                [ -n "$wpa_pair_rekey"   ] && append bss_conf "wpa_ptk_rekey=$wpa_pair_rekey"    "$N"
@@ -290,7 +310,7 @@ hostapd_set_bss_options() {
                        json_get_vars \
                                auth_server auth_secret auth_port \
                                dae_client dae_secret dae_port \
-                               ownip \
+                               ownip radius_client_addr \
                                eap_reauth_period
 
                        # radius can provide VLAN ID for clients
@@ -317,6 +337,7 @@ hostapd_set_bss_options() {
                        }
 
                        [ -n "$ownip" ] && append bss_conf "own_ip_addr=$ownip" "$N"
+                       [ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
                        append bss_conf "eapol_key_index_workaround=1" "$N"
                        append bss_conf "ieee8021x=1" "$N"
 
@@ -347,8 +368,8 @@ hostapd_set_bss_options() {
        [ -n "$wps_possible" -a -n "$config_methods" ] && {
                set_default ext_registrar 0
                set_default wps_device_type "6-0050F204-1"
-               set_default wps_device_name "Lede AP"
-               set_default wps_manufacturer "www.lede-project.org"
+               set_default wps_device_name "OpenWrt AP"
+               set_default wps_manufacturer "www.openwrt.org"
                set_default wps_independent 1
 
                wps_state=2
@@ -376,27 +397,45 @@ hostapd_set_bss_options() {
                append bss_conf "iapp_interface=$ifname" "$N"
        }
 
+       json_get_vars ieee80211v
+       set_default ieee80211v 0
+       if [ "$ieee80211v" -eq "1" ]; then
+               json_get_vars time_advertisement time_zone wnm_sleep_mode bss_transition
+
+               set_default time_advertisement 0
+               set_default wnm_sleep_mode 0
+               set_default bss_transition 0
+
+               append bss_conf "time_advertisement=$time_advertisement" "$N"
+               [ -n "$time_zone" ] && append bss_conf "time_zone=$time_zone" "$N"
+               append bss_conf "wnm_sleep_mode=$wnm_sleep_mode" "$N"
+               append bss_conf "bss_transition=$bss_transition" "$N"
+       fi
+
        if [ "$wpa" -ge "1" ]; then
                json_get_vars ieee80211r
                set_default ieee80211r 0
 
                if [ "$ieee80211r" -gt "0" ]; then
                        json_get_vars mobility_domain r0_key_lifetime r1_key_holder \
-                       reassociation_deadline pmk_r1_push
+                               reassociation_deadline pmk_r1_push ft_psk_generate_local ft_over_ds
                        json_get_values r0kh r0kh
                        json_get_values r1kh r1kh
 
                        set_default mobility_domain "4f57"
                        set_default r0_key_lifetime 10000
-                       set_default r1_key_holder "00004f577274"
                        set_default reassociation_deadline 1000
                        set_default pmk_r1_push 0
+                       set_default ft_psk_generate_local 0
+                       set_default ft_over_ds 1
 
                        append bss_conf "mobility_domain=$mobility_domain" "$N"
                        append bss_conf "r0_key_lifetime=$r0_key_lifetime" "$N"
-                       append bss_conf "r1_key_holder=$r1_key_holder" "$N"
+                       [ -n "$r1_key_holder" ] && append bss_conf "r1_key_holder=$r1_key_holder" "$N"
                        append bss_conf "reassociation_deadline=$reassociation_deadline" "$N"
                        append bss_conf "pmk_r1_push=$pmk_r1_push" "$N"
+                       append bss_conf "ft_psk_generate_local=$ft_psk_generate_local" "$N"
+                       append bss_conf "ft_over_ds=$ft_over_ds" "$N"
 
                        for kh in $r0kh; do
                                append bss_conf "r0kh=${kh//,/ }" "$N"
@@ -406,6 +445,8 @@ hostapd_set_bss_options() {
                        done
                fi
 
+               append bss_conf "wpa_disable_eapol_key_retries=$wpa_disable_eapol_key_retries" "$N"
+
                hostapd_append_wpa_key_mgmt
                [ -n "$wpa_key_mgmt" ] && append bss_conf "wpa_key_mgmt=$wpa_key_mgmt" "$N"
        fi
@@ -425,9 +466,10 @@ hostapd_set_bss_options() {
                # RSN -> allow management frame protection
                case "$ieee80211w" in
                        [012])
-                               json_get_vars ieee80211w_max_timeout ieee80211w_retry_timeout
+                               json_get_vars ieee80211w_mgmt_cipher ieee80211w_max_timeout ieee80211w_retry_timeout
                                append bss_conf "ieee80211w=$ieee80211w" "$N"
                                [ "$ieee80211w" -gt "0" ] && {
+                                       append bss_conf "group_mgmt_cipher=${ieee80211w_mgmt_cipher:-AES-128-CMAC}" "$N"
                                        [ -n "$ieee80211w_max_timeout" ] && \
                                                append bss_conf "assoc_sa_query_max_timeout=$ieee80211w_max_timeout" "$N"
                                        [ -n "$ieee80211w_retry_timeout" ] && \
@@ -580,8 +622,31 @@ EOF
        return 0
 }
 
+wpa_supplicant_set_fixed_freq() {
+       local freq="$1"
+       local htmode="$2"
+
+       append network_data "fixed_freq=1" "$N$T"
+       append network_data "frequency=$freq" "$N$T"
+       case "$htmode" in
+               NOHT) append network_data "disable_ht=1" "$N$T";;
+               HT20|VHT20) append network_data "disable_ht40=1" "$N$T";;
+               HT40*|VHT40*|VHT80*|VHT160*) append network_data "ht40=1" "$N$T";;
+       esac
+       case "$htmode" in
+               VHT*) append network_data "vht=1" "$N$T";;
+       esac
+       case "$htmode" in
+               VHT80) append network_data "max_oper_chwidth=1" "$N$T";;
+               VHT160) append network_data "max_oper_chwidth=2" "$N$T";;
+               *) append network_data "max_oper_chwidth=0" "$N$T";;
+       esac
+}
+
 wpa_supplicant_add_network() {
        local ifname="$1"
+       local freq="$2"
+       local htmode="$3"
 
        _wpa_supplicant_common "$1"
        wireless_vif_parse_encryption
@@ -603,11 +668,7 @@ wpa_supplicant_add_network() {
 
        [[ "$_w_mode" = "adhoc" ]] && {
                append network_data "mode=1" "$N$T"
-               [ -n "$channel" ] && {
-                       freq="$(get_freq "$phy" "$channel")"
-                       append network_data "fixed_freq=1" "$N$T"
-                       append network_data "frequency=$freq" "$N$T"
-               }
+               [ -n "$channel" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
 
                scan_ssid="scan_ssid=0"
 
@@ -615,14 +676,12 @@ wpa_supplicant_add_network() {
        }
 
        [[ "$_w_mode" = "mesh" ]] && {
-               json_get_vars mesh_id
+               json_get_vars mesh_id mesh_fwding
                ssid="${mesh_id}"
 
                append network_data "mode=5" "$N$T"
-               [ -n "$channel" ] && {
-                       freq="$(get_freq "$phy" "$channel")"
-                       append network_data "frequency=$freq" "$N$T"
-               }
+               [ -n "$mesh_fwding" ] && append network_data "mesh_fwding=${mesh_fwding}" "$N$T"
+               [ -n "$channel" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
                append wpa_key_mgmt "SAE"
                scan_ssid=""
        }
@@ -648,7 +707,11 @@ wpa_supplicant_add_network() {
                        if [ ${#key} -eq 64 ]; then
                                passphrase="psk=${key}"
                        else
-                               passphrase="psk=\"${key}\""
+                               if [ "$_w_mode" = "mesh" ]; then
+                                       passphrase="sae_password=\"${key}\""
+                               else
+                                       passphrase="psk=\"${key}\""
+                               fi
                        fi
                        append network_data "$passphrase" "$N$T"
                ;;
@@ -716,6 +779,7 @@ wpa_supplicant_add_network() {
                esac
        }
        [ -n "$bssid" ] && append network_data "bssid=$bssid" "$N$T"
+       [ -n "$beacon_int" ] && append network_data "beacon_int=$beacon_int" "$N$T"
 
        local bssid_blacklist bssid_whitelist
        json_get_values bssid_blacklist bssid_blacklist
@@ -738,10 +802,6 @@ wpa_supplicant_add_network() {
                append network_data "mcast_rate=$mc_rate" "$N$T"
        }
 
-       local ht_str
-       [[ "$_w_mode" = adhoc ]] || ibss_htmode=
-       [ -n "$ibss_htmode" ] && append network_data "htmode=$ibss_htmode" "$N$T"
-
        cat >> "$_config" <<EOF
 network={
        $scan_ssid
@@ -758,7 +818,7 @@ wpa_supplicant_run() {
 
        _wpa_supplicant_common "$ifname"
 
-       /usr/sbin/wpa_supplicant -B -s \
+       /usr/sbin/wpa_supplicant -B \
                ${network_bridge:+-b $network_bridge} \
                -P "/var/run/wpa_supplicant-${ifname}.pid" \
                -D ${_w_driver:-wext} \