wireless-ap: Allow to enable/disable 802.11w Management Frame Protection

This is disabled by default, because loads of stations have issues
associating with an AP that has 802.11w enabled.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
index 245b4cf87d7f9d8ce636ba70acc7509d2b853d97..bf0c5fc9ee0c6928cea4e19588bf4517e29328f6 100644 (file)
--- a/src/functions/functions.hostapd
+++ b/src/functions/functions.hostapd
@@ -41,6 +41,7 @@ hostapd_config_write() {
        local encryption
        local environment="${WIRELESS_DEFAULT_ENVIRONMENT}"
        local key
+       local mfp="off"
        local mode
        local ssid
        local wmm="1"
@@ -68,6 +69,9 @@ hostapd_config_write() {
                        --key=*)
                                key=$(cli_get_val "${1}")
                                ;;
+                       --mfp=*)
+                               mfp="$(cli_get_val "${1}")"
+                               ;;
                        --mode=*)
                                mode=$(cli_get_val "${1}")
 
@@ -133,6 +137,12 @@ hostapd_config_write() {
                return ${EXIT_ERROR}
        fi
 
+       # Management Frame Proection
+       if ! isbool mfp; then
+               error "Invalid value for --mfp: ${mfp}"
+               return ${EXIT_ERROR}
+       fi
+
        # 802.11ac/n flags
        local ieee80211ac
        local ieee80211n
@@ -325,6 +335,13 @@ hostapd_config_write() {
                print "vht_oper_chwidth=${vht_oper_chwidth}"
 
                print
+
+               # 802.11w - Management Frame Protection (MFP)
+               if enabled mfp; then
+                       print "ieee80211w=2" # required
+               else
+                       print "ieee80211w=0"
+               fi
        ) >> ${file}
 
        # Control interface.

diff --git a/src/helpers/hostapd-config-helper b/src/helpers/hostapd-config-helper
index d3292c3a0edd12c6e4ec58c0ac83226bcdf11b20..7af723d28e404013fb67a78f6e5bd139c5517389 100644 (file)
--- a/src/helpers/hostapd-config-helper
+++ b/src/helpers/hostapd-config-helper
@@ -45,6 +45,7 @@ case "${action}" in
                        --encryption="${ENCRYPTION}" \
                        --environment="${ENVIRONMENT}" \
                        --key="${KEY}" \
+                       --mfp="${MFP}" \
                        --mode="${MODE}" \
                        --ssid="${SSID}" \
                || exit $?

diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
index 6db39b8c99537af98c9a69139b63ae8dcdc28e13..7073cbc72a237c5094bc462479cb730c353e2f4b 100644 (file)
--- a/src/hooks/ports/wireless-ap
+++ b/src/hooks/ports/wireless-ap
@@ -25,6 +25,7 @@ HOOK_PORT_PATTERN="${PORT_PATTERN_ACCESSPOINT}"
 
 HOOK_SETTINGS="ADDRESS BROADCAST_SSID CHANNEL CHANNEL_BANDWIDTH DFS MODE PHY"
 HOOK_SETTINGS="${HOOK_SETTINGS} ENCRYPTION ENVIRONMENT KEY SSID"
+HOOK_SETTINGS="${HOOK_SETTINGS} MFP"
 
 ADDRESS=$(mac_generate)
 BROADCAST_SSID=on
@@ -37,6 +38,10 @@ SSID=
 # Perform radar detection by default when possible
 DFS="on"
 
+# 802.11w - Management Frame Protection
+# Disable by default because many clients cannot connect when enabled
+MFP="off"
+
 ENVIRONMENT="${WIRELESS_DEFAULT_ENVIRONMENT}"
 
 hook_check_settings() {
@@ -46,6 +51,7 @@ hook_check_settings() {
        assert isbool BROADCAST_SSID
        assert isset CHANNEL
        assert isbool DFS
+       assert isbool MFP
        assert isset MODE
        assert isoneof MODE ${HOSTAPD_SUPPORTED_MODES}
        assert isset PHY
@@ -104,6 +110,18 @@ hook_parse_cmdline() {
                        --mac=*)
                                ADDRESS=$(cli_get_val "${1}")
                                ;;
+                       --mfp=*)
+                               MFP="$(cli_get_val "${1}")"
+
+                               if enabled MFP; then
+                                       MFP="on"
+                               elif disabled MFP; then
+                                       MFP="off"
+                               else
+                                       error "Invalid value for --mfp: ${MFP}"
+                                       return ${EXIT_ERROR}
+                               fi
+                               ;;
                        --mode=*)
                                MODE=$(cli_get_val "${1}")