wpa_supplicant: rework wpa_key_mgmt handling

[openwrt/openwrt.git] / package / network / services / hostapd / files / netifd.sh

diff --git a/package/network/services/hostapd/files/netifd.sh b/package/network/services/hostapd/files/netifd.sh
index e6b0b0d769c6301f05696d4ca963241c3ac11620..b87672c4d72c7fc3d4915363b49dbcfe08a3eda7 100644 (file)
--- a/package/network/services/hostapd/files/netifd.sh
+++ b/package/network/services/hostapd/files/netifd.sh
@@ -186,7 +186,8 @@ hostapd_set_bss_options() {
                wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 \
                wps_device_type wps_device_name wps_manufacturer wps_pin \
                macfilter ssid wmm uapsd hidden short_preamble rsn_preauth \
-               iapp_interface eapol_version acct_server acct_secret acct_port
+               iapp_interface eapol_version acct_server acct_secret acct_port \
+               dynamic_vlan
 
        set_default isolate 0
        set_default maxassoc 0
@@ -229,6 +230,8 @@ hostapd_set_bss_options() {
                        append bss_conf "acct_server_shared_secret=$acct_secret" "$N"
        }
 
+       local vlan_possible=""
+
        case "$auth_type" in
                none)
                        wps_possible=1
@@ -260,9 +263,10 @@ hostapd_set_bss_options() {
                                auth_server auth_secret auth_port \
                                dae_client dae_secret dae_port \
                                ownip \
-                               eap_reauth_period dynamic_vlan \
-                               vlan_naming vlan_tagged_interface \
-                               vlan_bridge vlan_file
+                               eap_reauth_period
+
+                       # radius can provide VLAN ID for clients
+                       vlan_possible=1
 
                        # legacy compatibility
                        [ -n "$auth_server" ] || json_get_var auth_server server
@@ -272,7 +276,6 @@ hostapd_set_bss_options() {
                        set_default auth_port 1812
                        set_default dae_port 3799
 
-                       set_default vlan_naming 1
 
                        append bss_conf "auth_server_addr=$auth_server" "$N"
                        append bss_conf "auth_server_port=$auth_port" "$N"
@@ -290,19 +293,6 @@ hostapd_set_bss_options() {
                        append bss_conf "ieee8021x=1" "$N"
                        append wpa_key_mgmt "WPA-EAP"
 
-                       [ -n "$dynamic_vlan" ] && {
-                               append bss_conf "dynamic_vlan=$dynamic_vlan" "$N"
-                               append bss_conf "vlan_naming=$vlan_naming" "$N"
-                               [ -n "$vlan_bridge" ] && \
-                                       append bss_conf "vlan_bridge=$vlan_bridge" "$N"
-                               [ -n "$vlan_tagged_interface" ] && \
-                                       append bss_conf "vlan_tagged_interface=$vlan_tagged_interface" "$N"
-                               [ -n "$vlan_file" ] && {
-                                       [ -e "$vlan_file" ] || touch "$vlan_file"
-                                       append bss_conf "vlan_file=$vlan_file" "$N"
-                               }
-                       }
-
                        [ "$eapol_version" -ge "1" -a "$eapol_version" -le "2" ] && append bss_conf "eapol_version=$eapol_version" "$N"
                ;;
                wep)
@@ -427,6 +417,8 @@ hostapd_set_bss_options() {
                allow)
                        append bss_conf "macaddr_acl=1" "$N"
                        append bss_conf "accept_mac_file=$_macfile" "$N"
+                       # accept_mac_file can be used to set MAC to VLAN ID mapping
+                       vlan_possible=1
                ;;
                deny)
                        append bss_conf "macaddr_acl=0" "$N"
@@ -450,6 +442,21 @@ hostapd_set_bss_options() {
                ) > "$_macfile"
        }
 
+       [ -n "$vlan_possible" -a -n "$dynamic_vlan" ] && {
+               json_get_vars vlan_naming vlan_tagged_interface vlan_bridge vlan_file
+               set_default vlan_naming 1
+               append bss_conf "dynamic_vlan=$dynamic_vlan" "$N"
+               append bss_conf "vlan_naming=$vlan_naming" "$N"
+               [ -n "$vlan_bridge" ] && \
+                       append bss_conf "vlan_bridge=$vlan_bridge" "$N"
+               [ -n "$vlan_tagged_interface" ] && \
+                       append bss_conf "vlan_tagged_interface=$vlan_tagged_interface" "$N"
+               [ -n "$vlan_file" ] && {
+                       [ -e "$vlan_file" ] || touch "$vlan_file"
+                       append bss_conf "vlan_file=$vlan_file" "$N"
+               }
+       }
+
        append "$var" "$bss_conf" "$N"
        return 0
 }
@@ -566,11 +573,8 @@ wpa_supplicant_add_network() {
        local network_data=
        local T="       "
 
-       local wpa_key_mgmt="WPA-PSK"
        local scan_ssid="scan_ssid=1"
-       local freq
-
-       [ "$ieee80211r" -gt 0 ] && wpa_key_mgmt="FT-PSK $wpa_key_mgmt"
+       local freq wpa_key_mgmt
 
        [[ "$_w_mode" = "adhoc" ]] && {
                append network_data "mode=1" "$N$T"
@@ -582,7 +586,7 @@ wpa_supplicant_add_network() {
 
                scan_ssid="scan_ssid=0"
 
-               [ "$_w_driver" = "nl80211" ] || wpa_key_mgmt="WPA-NONE"
+               [ "$_w_driver" = "nl80211" ] || append wpa_key_mgmt "WPA-NONE"
        }
 
        [[ "$_w_mode" = "mesh" ]] && {
@@ -594,7 +598,7 @@ wpa_supplicant_add_network() {
                        freq="$(get_freq "$phy" "$channel")"
                        append network_data "frequency=$freq" "$N$T"
                }
-               wpa_key_mgmt="SAE"
+               append wpa_key_mgmt "SAE"
                scan_ssid=""
        }
 
@@ -610,7 +614,10 @@ wpa_supplicant_add_network() {
                psk)
                        local passphrase
 
+                       append wpa_key_mgmt "WPA-PSK"
+                       [ "$ieee80211r" -gt 0 ] && append wpa_key_mgmt "FT-PSK"
                        key_mgmt="$wpa_key_mgmt"
+
                        if [ ${#key} -eq 64 ]; then
                                passphrase="psk=${key}"
                        else
@@ -619,8 +626,9 @@ wpa_supplicant_add_network() {
                        append network_data "$passphrase" "$N$T"
                ;;
                eap)
-                       key_mgmt='WPA-EAP'
-                       [ "$ieee80211r" -gt 0 ] && key_mgmt="FT-EAP $key_mgmt"
+                       append wpa_key_mgmt "WPA-EAP"
+                       [ "$ieee80211r" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+                       key_mgmt="$wpa_key_mgmt"
 
                        json_get_vars eap_type identity anonymous_identity ca_cert
                        [ -n "$ca_cert" ] && append network_data "ca_cert=\"$ca_cert\"" "$N$T"