summaryrefslogtreecommitdiff
path: root/package/network/services
AgeCommit message (Collapse)Author
2013-10-08hostapd: fix hostapd RSN preauthentication PMKSA cachingnbd
In 2009 OpenWrt's hostapd config added an "auth_cache" boolean to be used to address a reported issue #12129 [0] on a forum [1]. The reported issue on the ticket is different that the one described on the forum. The commit was r33359. This change broke proper RSN preauthentication [2] [3] [4] expectations on hostapd's configuration for WPA2 and this in turn disabled PMKSA caching and Opportunistic Key Caching. This change: * Leaves the "auth_cache" to be used only for WPA networks for those looking to use this as a workaround to a reported issue but annotates a warning over its usage. * Separate "auth_cache" from WPA2 RSN preauthentication, leaving WPA2 RSN preauthentication to enabled only with "rsn_preauth" with the expected and recommended settings. * Adds a new WPA2 RSN preauthentication "rsn_preauth_testing" to be used when evaluating funcionality for WPA2 RSN preauthentication with the expected and recommended settings with the only difference so far with what should be enabled by default to disable Opportunistic Key Caching. Disabling the PMKSA cache should mean the STA could not roam off and back onto the AP that had PMKSA caching disabled and would require a full authentication cycle. This fixes this for WPA2 networks with RSN preauthentication enabled. This change should be applied to AA as well as trunk. TL DR; The issue described on the forum has to do with failure of a STA being able to try to authenticate again with the AP if it failed its first try. This may have been an issue with hostapd in 2009 but as per some tests I cannot reproduce this today on a WPA2 network. The issue described on the ticket alludes to a security issue with the design of using a Radius server to authenticate to an AP. The issue vaguely alludes to the circumstances of zapping a user, deleting their authentication credentials to log in to the network, and that if RSN preauthentication is enabled with PMKSA caching that the user that was zapped would still be able to authenticate. Lets treat these as separate issues. I cannot reproduce the first issue reported on the forums of not being able to authenticate anymore on a WPA2 network. The issue reported on the ticket modified WPA2 RSN preauthentication by adding two fields to the hostapd configuration if auth_cache was enabled: * disable_pmksa_caching=1 * okc=0 The first one disables PMKSA authentication cache. The second one disables Opportunistic Key Caching. The issue reported on the ticket was fixed by implementing a workaround in hostapd's configuration. Disabling PMKSA caching breaks proper use of WPA2 RSN pre authentication. The usage of disable_pmksa_caching=1 prevents hostapd from adding PMKSA entries into its cache when a successful 802.1x authentication occurs. In practice RSN preauthentication would trigger a STA to perform authentication with other APs on the same SSID, it would then have its own supplicant PMKSA cache held. If a STA roams between one AP to another no new authenitcation would need to be performed as the new AP would already have authenticated the STA. The purpose of the PMKSA cache on the AP side would be for the AP to use the same PMKID for a STA when the STA roams off onto another BSSID and later comes back to it. Disabling Opportunistic Key Caching could help the reported issue as well but its not the correct place to address this. Opportunistic Key Caching enables an AP with different interfaces to share the PMKSA cache. Its a technical enhancement and disabling it would be useful to let a testing suite properly test for RSN preauthentication given that otherwise Opportunistic Key Caching would enable an interface being tested to derive its own derive the PMKSA entry. In production though okc=1 should be enabled to help with RSN preauthentication. The real fix for this particular issue outside of the scope of hostapd's configuration and it should not be dealt with as a workaround to its configuration and breaking expected RSN preauthentication and technical optimizations. Revert this change and enable users to pick and choose to enable or disable disable_pmksa_caching and okc expecting them to instead have read clearly more what these do. As for the core issure ported, the correct place to fix this is to enable a sort of messaging between the RADIUS server and its peers so that if caching for authentication is enabled that cache can be cleared upon user credential updates. Updating a user password (not just zapping a user) is another possible issue that would need to be resolved here. Another part of the solution might be to reduce the cache timing to account for any systematic limitations (RADIUS server not able to ask peers to clear cache might be one). [0] https://dev.openwrt.org/changeset/33359 [1] https://forum.openwrt.org/viewtopic.php?id=19596 [2] http://wireless.kernel.org/en/users/Documentation/hostapd#IEEE_802.11i.2FRSN.2FWPA2_pre-authentication [3] http://wireless.kernel.org/en/users/Documentation/wpa_supplicant#RSN_preauthentication [4] http://wiki.openwrt.org/doc/recipes/rsn_preauthentication Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38336 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-08hostapd: Add WPS unconfigured & WPS pin method supportnbd
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com> Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38335 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-08hostapd: Add eap_reauth_period config optionnbd
This adds the eap_reauth_period to be used for modifying the RADIUS server reauthentication authentication period, a parameter that gets passed directly to the hostapd configuration file. Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com> Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38334 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-07[package] openvpn: switch to new procd init script styleluka
Signed-off-by: Luka Perkov <luka@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38331 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-29uhttpd: add a config option for using ustream-polarssl, and use it by defaultnbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38250 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-25uhttpd: fix appending https ports to cmdlinenbd
Otherwise it is started only on non-secure ports. Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38171 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-23[package] fix various init scriptsluka
Changes include: * removing unused variables * replacing spaces with tabs where appropriate * more consistency with variable declarations Signed-off-by: Luka Perkov <luka@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38142 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-17procd: convert various packages to procd style init.d scriptsblogic
Signed-off-by: John Crispin <blogic@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38023 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-14hostapd: adjust the md5sum for the uploaded source tarball (fixes #14155)nbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37990 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-13uhttpd: udpat to git headjow
- fixes buffer corruption with JSON-RPC list calls - change JSON-RPC protocol to include the session ID into the call attributes instead of passing it via the URL - forcibly pass effective session ID as "ubus_rpc_session" attribute to called procedures - change ubus acl checking to conform with new ubus session namespace git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37962 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-08-25lldpd: Add libbsd dependency when using eglibcacinonyx
Signed-off-by: Vasilis Tsiligiannis <acinonyx@openwrt.gr> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37837 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-08-08hostapd: fix typo in version numbernbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37742 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-08-08hostapd: fix ubus reconnect handlingnbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37741 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-08-08hostapd: add a build variant for wpa_supplicant with p2p (aka Wi-Fi Direct) ↵nbd
support Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37739 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-08-08hostapd: update to latest version (20130707)nbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37738 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-08-06hostapd: Settings for DAE/CoA servernbd
hostapd supports "Dynamic Authorization Extensions", making it possible to forcibly disconnect a user by sending it a RADIUS "Disconnect-Request" packet. I've added three new variables to enable setting of the "radius_das_client" and "radius_das_port" variables in the hostapd configuration, which enable these extensions. * dae_client - IP of the client that can send disconnect requests * dae_secret - shared secret for DAE packets These are combined into the "radius_das_client" option in hostapd.conf To enable the server, both dae_client and dae_secret must be set. * dae_port - optional, default value is 3799 as specified in RFC 5176 Signed-off-by: Martijn van de Streek <martijn@vandestreek.net> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37734 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-08-06hostapd: Fix WDS/WEP usagenbd
WEP in WDS is currently broken in hostapd. Add a patch to fix the issue. Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37733 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-08-06hostapd: Refresh patchesnbd
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37731 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-08-06hostapd: Add an option to disable beaconingnbd
Add a patch for hostapd that introduces a config option "start_disabled" which can be used to bring up an AP interface with beaconing disabled. This is useful in a Repeater-AP setup where the Repeater AP has to start beaconing only after the WDS link has been established. Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37730 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-07-31uhttpd: update to the latest version, fixes a crash on early cgi/lua process ↵nbd
termination Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37628 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-07-26openvpn: update to 2.3.2nbd
this patches updates openvpn to v2.3.2 and adds a PKG_MD5SUM to the Makefile This release fixes a memory access violation when cipher none is used on ar71xx - at least with my config Signed-off-by: Peter Wagner <tripolar@gmx.at> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37560 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-07-26uhttpd: update to latest version, fixes issues with POST and keep-alive (#13940)nbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37556 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-07-26authsae: add myself as a maintainernbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37555 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-07-26authsae: adapt uci scripts to use authsaenbd
This patch modifies the uci scripts to be able to start meshd-nl80211 for encrypted mesh networks, therefor a new script (authsae.sh) is inserted. Signed-off-by: Emanuel Taube <emanuel.taube@gmail.com> [etienne.champetier@free.fr: just update mac80211.sh path] Signed-off-by: Etienne CHAMPETIER <etienne.champetier@free.fr> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37554 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-07-26authsae 80211s authentication daemonnbd
This patch adds authsae open80211s authentication daemon (http://open80211s.org) It's a rework of Peter Naulls patch (http://patchwork.openwrt.org/patch/1350/) I've excluded the sample conf file as it's useless when used with mac80211.sh (Emanuel Taube patch) It now link against libnl-tiny instead of libnl (patch merged in authsae git) Authsae is 58 Ko (OPENSSL_WITH_EC option adds 35Ko to libopenssl) Signed-off-by: Peter Naulls <peter@chocky.org> Signed-off-by: Etienne CHAMPETIER <etienne.champetier@free.fr> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37553 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-07-20ead: fix compile errors with recent kernelsnbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37482 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-07-11dropbear: register a config.change triggerblogic
Signed-off-by: John Crispin <blogic@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37245 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-07-04lldpd: upgrade to 0.7.5jow
lldpd 0.7.1 has several alignment issues that trip a system configured to fault on misaligned accesses. Version 0.7.5 fixes that along with a few other minor issues. Signed-off-by: John Szakmeister <john@szakmeister.net> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37168 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-07-01hostapd: truncate default mac file before adding entries to it (#13797)jow
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37114 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-06-30hostapd: fix multi-ssid and AP+STA, clean up codenbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37111 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-06-30hostapd: update to latest git versionnbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37110 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-06-24hostapd: fix superflous comablogic
this cause the wps trigegr to be copied to the wrong place https://dev.openwrt.org/ticket/13753 Signed-off-by: John Crispin <blogic@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37031 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-06-21hostapd: remove old button hotplug scriptblogic
Signed-off-by: John Crispin <blogic@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36991 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-06-17hostapd: correctly handle macfile uci optionjow
Make hostapd.sh correctly handle the macfile uci option. Such option specifies the macfile name to pass into the hostapd configuration file. Moreover, if a maclist option has been specified, copy the macfile before appending new entries. Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36944 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-06-17dnsmasq: use host-record instead of addressjow
Using "--address" for individual host A records is broken, use "--host-record" instead. The following patch changes dnsmasq.init to build individual host records using "--host-record" instead of "--address". Signed-off-by: Adam Gensler <openwrt at gnslr.us> [jow: shorter description, simplified shell script code] git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36943 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-06-13uhttpd: expose missing options to ucijow
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36932 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-06-10ppp: correctly handle address when reloadingcyrus
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36904 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-06-01uhttpd: update to latest version, fixes CGI related crashesnbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36817 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-05-30uhttpd: update again to fix a ubus plugin crash bugnbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36770 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-05-30uhttpd: update to latest version, fixes script timeout for ubus requestsnbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36767 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-05-23uhttpd: update to latest version, fixes #13564, #13560, improves error ↵nbd
handling as pointed out in #13537 Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36696 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-05-17dnsmasq: add directory for external hosts-filescyrus
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36655 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-05-16uhttpd: update to latest version, fixes index page processing ordernbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36644 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-05-14uhttpd: update to latest version, fixes a SSL connection memory leaknbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36636 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-05-07add uci support for "proxy-dnssec" in dnsmasqcyrus
This patch simply adds support for the "--proxy-dnssec" command in dnsmasq into the init file so it can be used with /etc/config/dhcp. Signed-off-by: Adam Gensler <openwrt@kristenandadam.net> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36570 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-05-06ipset-dns: support simultaneously populating IPv4 and IPv6 setsjow
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36554 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-05-06Add ipset-dns - a tiny DNS proxy service which puts resolved ip addresses ↵jow
into a specified ipset git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36552 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-05-03hostapd: enable 802.11r for the -full variant (#13250)nbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36533 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-04-24dnsmasq: update to 2.66cyrus
Thanks to Christoph König for patches. git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36412 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-04-23hostapd: return the frequency to some ubus calls to make integration easiernbd
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36410 3c298f89-4303-0410-b956-a3cf2f4a3e73
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-08 04:03:20 +0000