summaryrefslogtreecommitdiff
path: root/package
AgeCommit message (Collapse)Author
2013-10-08hostapd: fix hostapd RSN preauthentication PMKSA cachingnbd
In 2009 OpenWrt's hostapd config added an "auth_cache" boolean to be used to address a reported issue #12129 [0] on a forum [1]. The reported issue on the ticket is different that the one described on the forum. The commit was r33359. This change broke proper RSN preauthentication [2] [3] [4] expectations on hostapd's configuration for WPA2 and this in turn disabled PMKSA caching and Opportunistic Key Caching. This change: * Leaves the "auth_cache" to be used only for WPA networks for those looking to use this as a workaround to a reported issue but annotates a warning over its usage. * Separate "auth_cache" from WPA2 RSN preauthentication, leaving WPA2 RSN preauthentication to enabled only with "rsn_preauth" with the expected and recommended settings. * Adds a new WPA2 RSN preauthentication "rsn_preauth_testing" to be used when evaluating funcionality for WPA2 RSN preauthentication with the expected and recommended settings with the only difference so far with what should be enabled by default to disable Opportunistic Key Caching. Disabling the PMKSA cache should mean the STA could not roam off and back onto the AP that had PMKSA caching disabled and would require a full authentication cycle. This fixes this for WPA2 networks with RSN preauthentication enabled. This change should be applied to AA as well as trunk. TL DR; The issue described on the forum has to do with failure of a STA being able to try to authenticate again with the AP if it failed its first try. This may have been an issue with hostapd in 2009 but as per some tests I cannot reproduce this today on a WPA2 network. The issue described on the ticket alludes to a security issue with the design of using a Radius server to authenticate to an AP. The issue vaguely alludes to the circumstances of zapping a user, deleting their authentication credentials to log in to the network, and that if RSN preauthentication is enabled with PMKSA caching that the user that was zapped would still be able to authenticate. Lets treat these as separate issues. I cannot reproduce the first issue reported on the forums of not being able to authenticate anymore on a WPA2 network. The issue reported on the ticket modified WPA2 RSN preauthentication by adding two fields to the hostapd configuration if auth_cache was enabled: * disable_pmksa_caching=1 * okc=0 The first one disables PMKSA authentication cache. The second one disables Opportunistic Key Caching. The issue reported on the ticket was fixed by implementing a workaround in hostapd's configuration. Disabling PMKSA caching breaks proper use of WPA2 RSN pre authentication. The usage of disable_pmksa_caching=1 prevents hostapd from adding PMKSA entries into its cache when a successful 802.1x authentication occurs. In practice RSN preauthentication would trigger a STA to perform authentication with other APs on the same SSID, it would then have its own supplicant PMKSA cache held. If a STA roams between one AP to another no new authenitcation would need to be performed as the new AP would already have authenticated the STA. The purpose of the PMKSA cache on the AP side would be for the AP to use the same PMKID for a STA when the STA roams off onto another BSSID and later comes back to it. Disabling Opportunistic Key Caching could help the reported issue as well but its not the correct place to address this. Opportunistic Key Caching enables an AP with different interfaces to share the PMKSA cache. Its a technical enhancement and disabling it would be useful to let a testing suite properly test for RSN preauthentication given that otherwise Opportunistic Key Caching would enable an interface being tested to derive its own derive the PMKSA entry. In production though okc=1 should be enabled to help with RSN preauthentication. The real fix for this particular issue outside of the scope of hostapd's configuration and it should not be dealt with as a workaround to its configuration and breaking expected RSN preauthentication and technical optimizations. Revert this change and enable users to pick and choose to enable or disable disable_pmksa_caching and okc expecting them to instead have read clearly more what these do. As for the core issure ported, the correct place to fix this is to enable a sort of messaging between the RADIUS server and its peers so that if caching for authentication is enabled that cache can be cleared upon user credential updates. Updating a user password (not just zapping a user) is another possible issue that would need to be resolved here. Another part of the solution might be to reduce the cache timing to account for any systematic limitations (RADIUS server not able to ask peers to clear cache might be one). [0] https://dev.openwrt.org/changeset/33359 [1] https://forum.openwrt.org/viewtopic.php?id=19596 [2] http://wireless.kernel.org/en/users/Documentation/hostapd#IEEE_802.11i.2FRSN.2FWPA2_pre-authentication [3] http://wireless.kernel.org/en/users/Documentation/wpa_supplicant#RSN_preauthentication [4] http://wiki.openwrt.org/doc/recipes/rsn_preauthentication Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38336 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-08hostapd: Add WPS unconfigured & WPS pin method supportnbd
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com> Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38335 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-08hostapd: Add eap_reauth_period config optionnbd
This adds the eap_reauth_period to be used for modifying the RADIUS server reauthentication authentication period, a parameter that gets passed directly to the hostapd configuration file. Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com> Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38334 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-07mac80211: wl12xx: build them againhauke
WL_TI is bool but was set to =m, which deactivated it. Now it is set to =y and should be activated in the config so the wl12xx driver gets build. This closes #14212. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38333 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-07mac80211: brcmfmac: BRCMFMAC_USB was not set in confighauke
Somehow BRCMFMAC_USB was not set in the build and brcmfmac.ko did not had usb support. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38332 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-07[package] openvpn: switch to new procd init script styleluka
Signed-off-by: Luka Perkov <luka@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38331 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-07[package] polarssl: update to 1.2.9luka
Signed-off-by: Luka Perkov <luka@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38330 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-07lantiq: fix ltq_ptm compileblogic
Signed-off-by: John Crispin <blogic@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38329 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-07odhcp6c: improve server selection, introduce "forceprefix" optioncyrus
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38314 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-07[package] iproute2: update to 3.11luka
Signed-off-by: Luka Perkov <luka@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38313 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-05ath9k: fix tx queueing issues after background scansnbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38304 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-04opkg: add support for SHA256 verificationcyrus
based on a patch by Evan Hunt <each@isc.org> Signed-off-by: Steven Barth <steven@midlink.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38302 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-03netifd: update to latest version, adds macvlan supportnbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38299 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-02broadcom-diag: fix 'autoload' number of diag.kohauke
Change the autoload number from '5' to '05' so the module loads earlier (as intended). Signed-off-by: Nathan Hintz <nlhintz@hotmail.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38293 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-02package/index: fix index creating when building without signingcyrus
Signed-off-by: Alexander Couzens <lynxis@fe80.eu> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38287 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-02odhcp6c: validate hop-limit on RAscyrus
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38285 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-02Add package signing infrastructurecyrus
Add package signing key and certificate configuration options to the "Image configuration" submenu. If enabled, the Packages.gz list will be signed as file Packages.sig. The passphrase for the signing key can be sourced from a file or entered by the user. The signing certificate is automatically added to the firmware image if opkg-smime is selected. Signed-off-by: Evan Hunt <each@isc.org> Signed-off-by: Steven Barth <steven@midlink.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38284 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-026relayd: remove compat ULA setting by default (too many bad sideeffects)cyrus
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38283 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-01c80211: add iwldvm to iwlwifi, this is needed to support the old wifi card.hauke
This closes #14258 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38277 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-01kernel: add industrialio-triggered-buffer.ko only when the config option is ↵hauke
selected. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38276 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-01ep93xx: fix sound dependencies for ep93xxhauke
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38274 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-01netifd: don't remove & readd addresses that only have a changed lifetimecyrus
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38269 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-10-01procd: fix incorrect use of sizeof() in vsnprintf()jow
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38268 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-30procd: update to latest git headblogic
this fixes the syslog problem when using eglibc on x86. Signed-off-by: John Crispin <blogic@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38267 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-30kernel: lib-textsearch needs to be auto probed for amanda nat to workblogic
https://dev.openwrt.org/ticket/14232 Signed-off-by: John Crispin <blogic@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38262 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-29mac80211: add AP inactivity handling / probing fixes to improve stabilitynbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38257 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-29mac80211: really fix the long standing wds ap tx power regression (#14153)nbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38255 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-29rpcd: fix missing option removal when merging subsequent uci set callsjow
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38254 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-29ubus: restrict unix domain socket permission to 0600 to disallow non-root ↵jow
connections git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38253 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-29ubox: support alternative spellings for modinfo and rmmodjow
After this change, "rmmod" and "modinfo" works even if the user gives the file name spelling instead of the kernel internal one, so that e.g. "rmmod nls_iso8859-1.ko" and "rmmod nls_iso8859_1" will both succeed. git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38252 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-29uci: change uci_ptr checking order in uci_delete()jow
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38251 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-29uhttpd: add a config option for using ustream-polarssl, and use it by defaultnbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38250 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-29ath9k: fix an AP mode powersave issue with aggregationnbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38249 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-28ubox: fix kmod loading for modules with varying dashes & underscores in ↵jow
names (#14182, #14189) Instead of canonicalizing module names in the internal avl tree simpyl use a custom strcmp() variant for the avl tree key comparisation. The custom comperator simply treats dashes and underscores the same, so "nls_iso8859-15" is equal to "nls-iso8859-15". This allows us to simplify the code considerably and makes manual "modprobe" invocations more forgiving when looking up the given module name. git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38248 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-28kernel: disable kmod-iio for linux 3.6 as well (to avoid build issues due to ↵nbd
missing config symbol changes) Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38247 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-27kernel: exclude regmap-spi.ko if SPI support cannot be selectednbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38245 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-27kernel: make sound-soc-core depend on kmod-ac97nbd
it has a conditional #ifdef based dependency on it, which trips up on some targets Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38242 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-27kernel: remove old kernel compat code for pcmcianbd
Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38239 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-27kernel: mark kmod-thermal menuconfig symbol as hidden to avoid building it ↵nbd
on targets with no thermal drivers Should fix build errors with Linux 3.3/3.6 targets, which use different kconfig symbols Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38238 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-27kernel: add thermal modulesluka
Signed-off-by: Luka Perkov <luka@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38230 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-26opkg: add build variant with signature supportcyrus
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38220 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-26[package] uboot-imx6: fix typo in nitrogen6dlXgluka
Signed-off-by: Luka Perkov <luka@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38205 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-26[package] uboot-imx6: add support for Nitrogen6x boardsluka
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38204 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-26[package] uboot-imx6: alphabetize wandboard variantsluka
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38203 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-25package/kernel: add support for industrial-io and AD799xjuhosg
Add support for industrial IO core and (still staging) driver for AD799x, a high precision I2C ADC family. Signed-off-by: Hartmut Knaack <knaack.h@gmx.de> [juhosg: update subject, reformat commit message] Signed-off-by: Gabor Juhos <juhosg@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38187 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-25package/kernel: add hwmon driver for ADT7410juhosg
Add support for the ADT7410 hwmon driver, a high precision I2C temperature sensor. Signed-off-by: Hartmut Knaack <knaack.h@gmx.de> [juhosg: update subject, reformat commit message] Signed-off-by: Gabor Juhos <juhosg@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38186 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-25package/kernel: move I2C-GPIO drivers from i2c.mk to other.mkjuhosg
Move pca953x support from i2c.mk to other.mk, where other GPIO drivers are located. Remove duplicate pcf857x support from i2c.mk. Signed-off-by: Hartmut Knaack <knaack.h@gmx.de> [juhosg: update subject, and reformat commit message] Signed-off-by: Gabor Juhos <juhosg@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38185 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-25uhttpd: fix appending https ports to cmdlinenbd
Otherwise it is started only on non-secure ports. Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38171 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-24iwinfo: add Ubiquiti WispStation M5 to hardware.txtjuhosg
Signed-off-by: Gabor Juhos <juhosg@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38145 3c298f89-4303-0410-b956-a3cf2f4a3e73
2013-09-23[package] fix various init scriptsluka
Changes include: * removing unused variables * replacing spaces with tabs where appropriate * more consistency with variable declarations Signed-off-by: Luka Perkov <luka@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38142 3c298f89-4303-0410-b956-a3cf2f4a3e73
generated by cgit v1.2.3 (git 2.46.0) at 2024-12-27 07:18:40 +0000