mirror/openwrt
1
0
Fork 1
mirror of https://git.openwrt.org/openwrt/openwrt.git synced 2026-01-28 03:37:17 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

wifi-scripts: add sae_track_password option

Browse source 
This is useful if multiple passwords were specified without
the use of a SAE password identifier. This is the only
way to get multiple passwords for a single peer to work
without resorting to password identifiers.

Unfortunately, support for password identifiers is non-existent
on Android and macOS; and possibly others. So this is the only
option in that case.

As an alternative, one could also continue to use WPA2-PSK instead
as that could easily resort to a bruteforce approach without any
complications.

Signed-off-by: Rany Hany <rany_hany@riseup.net>
Link: https://github.com/openwrt/openwrt/pull/20597
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit is contained in:
Rany Hany 2025-10-30 12:43:14 +00:00 • committed by Robert Marko
parent bcdb29f78f
commit 8e457b69a2
3 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json
View file

@ -961,6 +961,10 @@
"description": "Require MFP for all associations using SAE",
"type": "boolean"
},
"sae_track_password": {
"description": "Tracking of SAE password use",
"type": "number"
},
"server:host": {
"type": "string"
},

2
package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc
View file

@ -170,7 +170,7 @@ function iface_auth_type(config) {
}
append_vars(config, [
'sae_require_mfp', 'sae_pwe', 'time_advertisement', 'time_zone',
'sae_require_mfp', 'sae_pwe', 'sae_track_password', 'time_advertisement', 'time_zone',
'wpa_group_rekey', 'wpa_ptk_rekey', 'wpa_gmk_rekey', 'wpa_strict_rekey',
'macaddr_acl', 'wpa_psk_radius', 'wpa_psk', 'wpa_passphrase', 'wpa_psk_file',
'eapol_version', 'dynamic_vlan', 'radius_request_cui', 'eap_reauth_period',

5
package/network/config/wifi-scripts/files/lib/netifd/hostapd.sh
View file

@ -360,7 +360,7 @@ hostapd_common_add_bss_config() {
config_add_array supported_rates
config_add_boolean sae_require_mfp
config_add_int sae_pwe
config_add_int sae_pwe sae_track_password
config_add_string 'owe_transition_bssid:macaddr' 'owe_transition_ssid:string'
config_add_string owe_transition_ifname
@ -549,7 +549,7 @@ hostapd_set_bss_options() {
macfilter ssid utf8_ssid uapsd hidden short_preamble rsn_preauth \
iapp_interface eapol_version dynamic_vlan ieee80211w nasid \
acct_secret acct_port acct_interval \
bss_load_update_period chan_util_avg_period sae_require_mfp sae_pwe \
bss_load_update_period chan_util_avg_period sae_require_mfp sae_pwe sae_track_password \
multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key skip_inactivity_poll \
ppsk airtime_bss_weight airtime_bss_limit airtime_sta_weight \
multicast_to_unicast_all proxy_arp per_sta_vif na_mcast_to_ucast \
@ -645,6 +645,7 @@ hostapd_set_bss_options() {
esac
[ -n "$sae_require_mfp" ] && append bss_conf "sae_require_mfp=$sae_require_mfp" "$N"
[ -n "$sae_pwe" ] && append bss_conf "sae_pwe=$sae_pwe" "$N"
[ -n "$sae_track_password" ] && append bss_conf "sae_track_password=$sae_track_password" "$N"
local vlan_possible=""