In 2009 OpenWrt's hostapd config added an "auth_cache" boolean
to be used to address a reported issue #12129 [0] on a forum [1].
The reported issue on the ticket is different that the one
described on the forum. The commit was r33359. This change broke
proper RSN preauthentication [2] [3] [4] expectations on hostapd's
configuration for WPA2 and this in turn disabled PMKSA caching and
Opportunistic Key Caching. This change:
* Leaves the "auth_cache" to be used only for WPA networks for those
looking to use this as a workaround to a reported issue but annotates
a warning over its usage.
* Separate "auth_cache" from WPA2 RSN preauthentication, leaving
WPA2 RSN preauthentication to enabled only with "rsn_preauth" with
the expected and recommended settings.
* Adds a new WPA2 RSN preauthentication "rsn_preauth_testing" to
be used when evaluating funcionality for WPA2 RSN preauthentication
with the expected and recommended settings with the only difference
so far with what should be enabled by default to disable Opportunistic
Key Caching.
Disabling the PMKSA cache should mean the STA could not roam off and back
onto the AP that had PMKSA caching disabled and would require a full
authentication cycle. This fixes this for WPA2 networks with
RSN preauthentication enabled.
This change should be applied to AA as well as trunk.
TL DR;
The issue described on the forum has to do with failure of a STA
being able to try to authenticate again with the AP if it failed
its first try. This may have been an issue with hostapd in 2009
but as per some tests I cannot reproduce this today on a WPA2
network.
The issue described on the ticket alludes to a security issue with the
design of using a Radius server to authenticate to an AP. The issue
vaguely alludes to the circumstances of zapping a user, deleting their
authentication credentials to log in to the network, and that if
RSN preauthentication is enabled with PMKSA caching that the user
that was zapped would still be able to authenticate.
Lets treat these as separate issues.
I cannot reproduce the first issue reported on the forums of not
being able to authenticate anymore on a WPA2 network.
The issue reported on the ticket modified WPA2 RSN preauthentication
by adding two fields to the hostapd configuration if auth_cache
was enabled:
* disable_pmksa_caching=1
* okc=0
The first one disables PMKSA authentication cache.
The second one disables Opportunistic Key Caching.
The issue reported on the ticket was fixed by implementing a workaround
in hostapd's configuration. Disabling PMKSA caching breaks proper use
of WPA2 RSN pre authentication. The usage of disable_pmksa_caching=1
prevents hostapd from adding PMKSA entries into its cache when a successful
802.1x authentication occurs. In practice RSN preauthentication would
trigger a STA to perform authentication with other APs on the same SSID,
it would then have its own supplicant PMKSA cache held. If a STA roams
between one AP to another no new authenitcation would need to be performed
as the new AP would already have authenticated the STA. The purpose of the
PMKSA cache on the AP side would be for the AP to use the same PMKID for
a STA when the STA roams off onto another BSSID and later comes back to it.
Disabling Opportunistic Key Caching could help the reported issue
as well but its not the correct place to address this. Opportunistic
Key Caching enables an AP with different interfaces to share the
PMKSA cache. Its a technical enhancement and disabling it would
be useful to let a testing suite properly test for RSN preauthentication
given that otherwise Opportunistic Key Caching would enable an
interface being tested to derive its own derive the PMKSA entry.
In production though okc=1 should be enabled to help with RSN
preauthentication.
The real fix for this particular issue outside of the scope of hostapd's
configuration and it should not be dealt with as a workaround to
its configuration and breaking expected RSN preauthentication and
technical optimizations. Revert this change and enable users to pick
and choose to enable or disable disable_pmksa_caching and okc expecting them
to instead have read clearly more what these do.
As for the core issure ported, the correct place to fix this is to
enable a sort of messaging between the RADIUS server and its peers
so that if caching for authentication is enabled that cache can be
cleared upon user credential updates. Updating a user password
(not just zapping a user) is another possible issue that would need
to be resolved here. Another part of the solution might be to reduce
the cache timing to account for any systematic limitations (RADIUS
server not able to ask peers to clear cache might be
one).
[0] https://dev.openwrt.org/changeset/33359
[1] https://forum.openwrt.org/viewtopic.php?id=19596
[2] http://wireless.kernel.org/en/users/Documentation/hostapd#IEEE_802.11i.2FRSN.2FWPA2_pre-authentication
[3] http://wireless.kernel.org/en/users/Documentation/wpa_supplicant#RSN_preauthentication
[4] http://wiki.openwrt.org/doc/recipes/rsn_preauthentication
Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
SVN-Revision: 38336
This adds the eap_reauth_period to be used for modifying
the RADIUS server reauthentication authentication period,
a parameter that gets passed directly to the hostapd
configuration file.
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
SVN-Revision: 38334
WL_TI is bool but was set to =m, which deactivated it. Now it is set to
=y and should be activated in the config so the wl12xx driver gets
build.
This closes#14212.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 38333
Somehow BRCMFMAC_USB was not set in the build and brcmfmac.ko did not had usb support.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 38332
Change the autoload number from '5' to '05' so the module loads earlier (as intended).
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
SVN-Revision: 38293
Add package signing key and certificate configuration options to the
"Image configuration" submenu. If enabled, the Packages.gz list will
be signed as file Packages.sig. The passphrase for the signing key can
be sourced from a file or entered by the user. The signing certificate
is automatically added to the firmware image if opkg-smime is selected.
Signed-off-by: Evan Hunt <each@isc.org>
Signed-off-by: Steven Barth <steven@midlink.org>
SVN-Revision: 38284
After this change, "rmmod" and "modinfo" works even if the user gives
the file name spelling instead of the kernel internal one, so that e.g.
"rmmod nls_iso8859-1.ko" and "rmmod nls_iso8859_1" will both succeed.
SVN-Revision: 38252
Instead of canonicalizing module names in the internal avl tree simpyl use a
custom strcmp() variant for the avl tree key comparisation. The custom comperator
simply treats dashes and underscores the same, so "nls_iso8859-15" is equal to
"nls-iso8859-15".
This allows us to simplify the code considerably and makes manual "modprobe"
invocations more forgiving when looking up the given module name.
SVN-Revision: 38248
Should fix build errors with Linux 3.3/3.6 targets, which use different
kconfig symbols
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 38238
Add support for the ADT7410 hwmon driver, a high precision
I2C temperature sensor.
Signed-off-by: Hartmut Knaack <knaack.h@gmx.de>
[juhosg: update subject, reformat commit message]
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
SVN-Revision: 38186
Move pca953x support from i2c.mk to other.mk, where other
GPIO drivers are located. Remove duplicate pcf857x support
from i2c.mk.
Signed-off-by: Hartmut Knaack <knaack.h@gmx.de>
[juhosg: update subject, and reformat commit message]
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
SVN-Revision: 38185
Changes include:
* removing unused variables
* replacing spaces with tabs where appropriate
* more consistency with variable declarations
Signed-off-by: Luka Perkov <luka@openwrt.org>
SVN-Revision: 38142
This is now the version which was send for mainline Linux kernel
inclusion. The data needed to detection a board is now stored in init
data.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 38036
This is based on a patch by Mathias Adam.
Signed-off-by: Mathias Adam <m.adam--openwrt@adamis.de>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 38001
This patch adds board detection for the Linksys E1000 V2.1 router, as well
as GPIO support for same.
This fixes bug #14135. Currently, wired networking isn't working on the
router, and I haven't tried the wireless, but with this patch, OpenWRT
successfully boots, and all the LEDs and buttons work properly.
Signed-off-by: Zachary Catlin <zcatlin@indiana.edu>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 37977
Most of the Linksys devices without an own GPIO configuration where
detected as WRT54G. On one board this made OpenWrt to boot into
failsafe every time, because one GPIO configurated as button was not a
button.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 37970
- fixes buffer corruption with JSON-RPC list calls
- change JSON-RPC protocol to include the session ID into the call
attributes instead of passing it via the URL
- forcibly pass effective session ID as "ubus_rpc_session" attribute
to called procedures
- change ubus acl checking to conform with new ubus session namespace
SVN-Revision: 37962
- recalculate session ACLs on reload
- support negative access group expressions in /etc/config/rpcd
- prevent destryoing the default session
- use "ubus_rpc_session" attribute as session identifier to enforce JSON-RPC proxy security
SVN-Revision: 37961
The imx sata module has only been backported to imx6 target. This change will
fix buildbot errors due to missing patches in other targets. Keep this until
all targets use kernel version with imx sata support in them.
Signed-off-by: Luka Perkov <luka@openwrt.org>
SVN-Revision: 37950
- introduces persistent null session to allow access to procedures without login
- implements session.login procedure to support user logins via json-rpc
SVN-Revision: 37941
- adds support for service triggering on config commit
- adds uci transaction support
- adds daemon reload support without loosing session data
- exports headers for use by external plugins
- drops LuCI2 in favor to an out of tree plugin
SVN-Revision: 37921
This fixes the following error:
keyspan: Unknown symbol ezusb_fx1_ihex_firmware_download (err 0)
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 37899
This enables usage of the ath10k driver on OpenWrt. Only 2.0 PCI hardware
is supported. The ath10k firmware is currently only available
through github so use that as its source for now.
This goes build tested, not run time tested.
[Hauke: I did some minor changes]
Cc: ath10k@lists.infradead.org
Cc: Kalle Valo <kvalo@qca.qualcomm.com>
Cc: Kathy Giori <kgiori@qca.qualcomm.com>
Cc: Mathieu Olivari <mathieu@qca.qualcomm.com>
Cc: Jerome Proffit <jproffit@qca.qualcomm.com>
Cc: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Cc: Matthew McClintock <mmcclint@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 37898
The package makes it possible to create custom SPI
buses via GPIO lines.
This module is based on i2c-gpio-custom and allows to
configure an SPI bus via GPIO lines and expose it to
userspace without rebuilding the kernel. This is maily
intended to connect microcontrollers and other simple
SPI devices without making an ad-hoc kernel driver.
Signed-off-by: Marco Burato <zmaster.adsl@gmail.com>
[juhosg:
- change subject,
- extend and reformat commit message,
- cleanup checkpatch errors/warnings in module source]
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
SVN-Revision: 37872
Backport some rt2x00 specific changes from
wireless-testing/master-2013-08-26 to add
support for RT3573 based devices.
Also refresh the rt2x00 specific patches.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
SVN-Revision: 37843
Currently package/Makefile only passes /lib /usr/lib and /usr/lib/ebtables
to mklibs. However, other libs can also reside in different subdirectories
(in my case /usr/lib/ipsec). Hence, create the list of library directories
dynamically.
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
SVN-Revision: 37841
hostapd supports "Dynamic Authorization Extensions", making it possible
to forcibly disconnect a user by sending it a RADIUS "Disconnect-Request"
packet.
I've added three new variables to enable setting of the
"radius_das_client" and "radius_das_port" variables in the hostapd
configuration, which enable these extensions.
* dae_client - IP of the client that can send disconnect requests
* dae_secret - shared secret for DAE packets
These are combined into the "radius_das_client" option in hostapd.conf
To enable the server, both dae_client and dae_secret must be set.
* dae_port - optional, default value is 3799 as specified in RFC 5176
Signed-off-by: Martijn van de Streek <martijn@vandestreek.net>
SVN-Revision: 37734
WEP in WDS is currently broken in hostapd. Add a patch
to fix the issue.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
SVN-Revision: 37733
Use the "start_disabled" option in hostapd that was added
in the earlier patch.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
SVN-Revision: 37732
Add a patch for hostapd that introduces a config option
"start_disabled" which can be used to bring up an AP
interface with beaconing disabled. This is useful in
a Repeater-AP setup where the Repeater AP has to start
beaconing only after the WDS link has been established.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
SVN-Revision: 37730
The BCM4331 supports a PCIe max request size of 512 bytes and uses
that, but the PCIe controller in the BCM4706 just supports 128 Bytes
and that causes a DMA error for packages bigger than 126 bytes. This
fixes the problem by setting the BCM4331 also to 128 Bytes.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 37709
The current dependency prevents building of the
rt2800{pci,usb} drivers for RT3883. Change the
dependency to fix this.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
SVN-Revision: 37699
When CONFIG_LLC gets build as a module, also p8022.ko and psnap.ko are
getting build as a module. kmod-appletalk depends on llc.ko and
psnap.ko, but at least psnap.ko,was not packed. On most systems
CONFIG_LLC will be build into the kernel so this problem does not show
up.
This fixes the missing dependency of kmod-appletalk on psnap.ko
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 37673
This adds button and led info, which I determined
by manually poking the gpio values.
Signed-off-by: Josh Stone <cuviper@gmail.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 37655
TL-WR720N-v3 has a slider switch composed of 2 GPIO buttons which can be
used to swtich between 3 positions. At leat 1 button is in pressed state
in any of those positions. Initialize 'last_state' as 0 (released) will
cause the device to automatically enter failsafe mode on every bootup.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
SVN-Revision: 37643
Comparing the RTSDK driver and mac80211 revealed, that this register needs
to have a special setup on rt5350.
Signed-off-by: John Crispin <blogic@openwrt.org>
SVN-Revision: 37608
This patch enables setting the wifi led polarity from OF.
It can be used in a DTS' wmac section like this:
ralink,led-polarity = <1>;
Valid values are 0 or 1.
Signed-off-by: Felix Kaechele <heffer@fedoraproject.org>
SVN-Revision: 37607
this patches updates openvpn to v2.3.2
and adds a PKG_MD5SUM to the Makefile
This release fixes a memory access violation when cipher none is used
on ar71xx - at least with my config
Signed-off-by: Peter Wagner <tripolar@gmx.at>
SVN-Revision: 37560
This patch modifies the uci scripts to be able to
start meshd-nl80211 for encrypted mesh networks,
therefor a new script (authsae.sh) is inserted.
Signed-off-by: Emanuel Taube <emanuel.taube@gmail.com>
[etienne.champetier@free.fr: just update mac80211.sh path]
Signed-off-by: Etienne CHAMPETIER <etienne.champetier@free.fr>
SVN-Revision: 37554
This patch adds authsae open80211s authentication daemon (http://open80211s.org)
It's a rework of Peter Naulls patch (http://patchwork.openwrt.org/patch/1350/)
I've excluded the sample conf file as it's useless when used with mac80211.sh (Emanuel Taube patch)
It now link against libnl-tiny instead of libnl (patch merged in authsae git)
Authsae is 58 Ko (OPENSSL_WITH_EC option adds 35Ko to libopenssl)
Signed-off-by: Peter Naulls <peter@chocky.org>
Signed-off-by: Etienne CHAMPETIER <etienne.champetier@free.fr>
SVN-Revision: 37553
- discard vfat labels with only spaces
- support using swap files
- support extroot when required kmods and block-mount are installed on jffs2
SVN-Revision: 37551
This patch adds EC compilation options to openssl
OPENSSL_WITH_EC is needed for authsae (OPENSSL_WITH_EC2M isn't)
Activating ec (but not ec2m) in openssl take 35Ko more on ar71xx (ipk size)
Activating both take 52Ko.
Signed-off-by: Etienne CHAMPETIER <etienne.champetier@free.fr>
SVN-Revision: 37523
Properly define the config symbol to n so it doesn't break build for
targets which do have it available (e.g. mostly everything except arm).
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 37489
This forces all packets (even for un-aggregated traffic) through
software queues to improve fairness and stability
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 37483
The malta target is broken since procd is used
as init. The initramfs image boots fine, however
the console is not working.
Improve the early console handling to fix the
problem.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
SVN-Revision: 37451
