Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

luci-mod-network: add ppsk option (support for private psk) #4513

Closed
wants to merge 4 commits into from

Conversation

mgiganto
Copy link

@mgiganto mgiganto commented Oct 12, 2020

This PR allows a luci user to enable a private psk (PPSK), where each
station may have its own PSK or use a common PSK if a private one is not defined.

Depends on PR 3509: openwrt/openwrt#3509

Signed-off-by: Manuel Giganto mgigantoregistros@gmail.com

@mgiganto
Copy link
Author

@Ansuel here is the luci patch updated.
This is the luci side for openwrt/openwrt#3509

@galeksandrp
Copy link
Contributor

What's the status of this?

Cause without this for those who brave enough to setup ppsk via /etc/config/wireless
subsequent update of configuration via luci destroy wifi completely
due to luci removing

uci del wireless.wifinet3.auth_server
uci del wireless.wifinet3.auth_secret

@mgiganto
Copy link
Author

mgiganto commented Dec 9, 2022 via email

@galeksandrp
Copy link
Contributor

galeksandrp commented Mar 15, 2023

@jow- What's the status of this?

Just tested mgiganto@6869ab1 on 0f6e166, no conflicts rebase, working fine:

1. Checking `Enable private psk key (PPSK)` leads to `ppsk mark`, `radius settings` being added (as expected)

Checking Enable private psk key (PPSK)

image

leads to ppsk mark, radius settings

image

being added (as expected).

2. Unchecking `Enable private psk key (PPSK)` leads to `ppsk mark`, `radius settings` being removed (as expected)

Unchecking Enable private psk key (PPSK)

image

leads to ppsk mark, radius settings

image

being removed (as expected).

@jow-
Copy link
Contributor

jow- commented Mar 15, 2023

@galeksandrp - the description text needs to be polished for better english and the option dependencies are not correct, the ppsk: "1" dependency on the RADIUS options looks wrong, those options should be available even if ppsk is not in use.

It likely works anyway because add_dependency_permutations() adds a bunch of other deps which make the options work but this renders the o.depends({ ppsk: '1' }); calls redundant so they would need to be removed.

Also consistent use of acronyms and capitalization, e.g.: Enable private psk key (PPSK) is redundant, should be either Enable private shared keys (PPSK) or Enable private PSK (PPSK) or Enable PPSK and simply explain the PPSK acronym in the long description.

@mgiganto
Copy link
Author

mgiganto commented Mar 15, 2023 via email

galeksandrp added a commit to galeksandrp/luci that referenced this pull request Apr 8, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.

- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.

- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

This commit fixes issues found in openwrt#4513

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
galeksandrp added a commit to galeksandrp/luci that referenced this pull request Apr 8, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.

- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.

- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

This commit fixes issues found in openwrt#4513

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
galeksandrp pushed a commit to galeksandrp/luci that referenced this pull request Apr 8, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.

- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.

- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

This commit fixes issues found in openwrt#4513

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
galeksandrp pushed a commit to galeksandrp/luci that referenced this pull request Apr 8, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.

- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.

- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

Commit fixes issues found in openwrt#4513 and was verified to work on `LuCI Master (git-23.093.56957-2145121) / OpenWrt SNAPSHOT (r22514-c8934099bf)`

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
galeksandrp added a commit to galeksandrp/luci that referenced this pull request Apr 8, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.

- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.

- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

Commit fixes issues found in openwrt#4513 and was verified to work on `LuCI Master (git-23.093.56957-2145121) / OpenWrt SNAPSHOT (r22514-c8934099bf)`

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
galeksandrp added a commit to galeksandrp/luci that referenced this pull request Apr 8, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.

- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.

- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
@galeksandrp
Copy link
Contributor

@jow- @mgiganto Could you please look if this galeksandrp@feature_ppsk adresses all the issues?

galeksandrp added a commit to galeksandrp/luci that referenced this pull request Apr 8, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.

- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.

- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
galeksandrp added a commit to galeksandrp/luci that referenced this pull request Apr 8, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.

- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.

- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
galeksandrp added a commit to galeksandrp/luci that referenced this pull request Apr 8, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.
- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.
- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
galeksandrp added a commit to galeksandrp/luci that referenced this pull request Apr 8, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.
- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.
- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
@mgiganto
Copy link
Author

mgiganto commented Apr 14, 2023 via email

galeksandrp added a commit to galeksandrp/luci that referenced this pull request Jun 25, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.
- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.
- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
@galeksandrp
Copy link
Contributor

galeksandrp commented Jun 25, 2023

What's the status of this?

Checked galeksandrp@9c8fdb4 on LuCI Master (git-23.158.78004-23a246e), works fine.

Tested like

uclient-fetch -O /www/luci-static/resources/view/network/wireless.js https://raw.githubusercontent.com/galeksandrp/luci/feature_ppsk/modules/luci-mod-network/htdocs/luci-static/resources/view/network/wireless.js

Joke is that freeradius3 is destroyed in snapshot, but that is another story.

@mgiganto
Copy link
Author

mgiganto commented Jul 25, 2023

Thank you @galeksandrp! I tested it and made some extra modifications based on your idea.
This way is definitely much cleaner than the original code!
What do you think now @jow- ?

galeksandrp added a commit to galeksandrp/luci that referenced this pull request Aug 30, 2023
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature.
- Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server.
- Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509).

Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf

Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
@galeksandrp
Copy link
Contributor

@jow- What's the status of this?

Checked mgiganto@a380dcf on LuCI Master git-23.236.53281-98e3743, works fine.
Only checked simple PPSK, I am not using per STA vlan.

@galeksandrp
Copy link
Contributor

@jow- What's the status of this?

Checked mgiganto@a380dcf on LuCI Master (git-23.292.78363-ee6a4da), works fine.
Only checked simple PPSK, I am not using per STA vlan.

@systemcrash
Copy link
Contributor

@galeksandrp - the description text needs to be polished for better english and the option dependencies are not correct, the ppsk: "1" dependency on the RADIUS options looks wrong, those options should be available even if ppsk is not in use.

It likely works anyway because add_dependency_permutations() adds a bunch of other deps which make the options work but this renders the o.depends({ ppsk: '1' }); calls redundant so they would need to be removed.

Also consistent use of acronyms and capitalization, e.g.: Enable private psk key (PPSK) is redundant, should be either Enable private shared keys (PPSK) or Enable private PSK (PPSK) or Enable PPSK and simply explain the PPSK acronym in the long description.

@mgiganto
Yeah, not sure I get the ppsk: 1 parts. Are you saying that e.g. to use the RADIUS auth_port, PPSK must be enabled? That's what these imply. If that's the case (sounds wrong), please remove them, and force push. Progress...

@galeksandrp
Copy link
Contributor

galeksandrp commented Dec 4, 2023

@systemcrash

Are you saying that e.g. to use the RADIUS auth_port, PPSK must be enabled

No. @jow- said that for mgiganto@6869ab1. It was fixed 5 months ago.

Now there are array of structs. Each struct is dependency permutation - eg independent struct of conditions.
Structs in that array traversed with OR logic.

o = ss.taboption('encryption', form.Value, 'auth_server', _('RADIUS Authentication Server'));
// Adds struct in array -----> o <----- And yes, in openwrt >wpa< is Enterprise WPA only
add_dependency_permutations(o, { mode: ['ap', 'ap-wds'], encryption: ['wpa', 'wpa2', 'wpa3', 'wpa3-mixed'] });
// Adds struct in array -----> o <----- And yes, WPA1 PSK is >psk<, WPA2 PSK is >psk2<
add_dependency_permutations(o, { mode: ['ap', 'ap-wds'], encryption: ['psk', 'psk2', 'psk+psk2', 'psk-mixed'], ppsk: ['1'] });

that means that RADIUS Auth Server setting will be available for

  • AP/APWDS+WPA without PSK(enterprise WPA)
    OR
  • AP/APWDS+PSK(any sort that is not SAE)+PPSK

@systemcrash
Copy link
Contributor

OK, could you please update your commit message to how I've edited your first message above?

@mgiganto
Copy link
Author

mgiganto commented Dec 27, 2023 via email

@mgiganto
Copy link
Author

mgiganto commented Dec 27, 2023 via email

@systemcrash
Copy link
Contributor

I'll be updating the description and review again the dependencies/ permutations. Regarding to "Yeah, not sure I get the ppsk: 1 parts. Are you saying that e.g. to use the RADIUS auth_port, PPSK must be enabled? That's what these imply." Yes, RADIUS is used in enterprise and when ppsk is enabled. It is not about the port, it is about RADIUS usage itself. If we cannot use RADIUS (we ask the password to it, because it changes per user at enterprise level and mac at personal level), we don't need to enter any details about it and it would mislead people. "If that's the case (sounds wrong), please remove them, and force push. Progress" What do you want to be removed? El lunes, 4 de diciembre de 2023, Paul Donald @.***> escribió:
OK, could you please update your commit message to how I've edited your
first message above?

Update your commit message. Not the PR description.

Nothing needs removing if the dependency permutations function as OR. Not AND.

Has anyone else been able to test this?

Include support in luci to enable the Private PSK.
When Private PSK is enabled, clients can use a default password (common),
or have their own private password that is associate with the client MAC.

The password is retrieved from RADIUS server, asking for the client MAC,
and when such client MAC is not defined, RADIUS should return a default
password.

RADIUS can also return other parameters like VLANs, which can be used to
put clients dinamically in different vlans based on their MAC, or the
default configuration.

Private PSK is not compatible yet with SAE encryption, therefore cannot
be used yet with WPA3 or WPA3-mixed.

It implements the UI for the PPSK already in master: openwrt/openwrt#3509

Signed-off-by: Manuel Giganto <mgigantoregistros@gmail.com>
@mgiganto
Copy link
Author

mgiganto commented Jan 28, 2024

@systemcrash I have updated the commit message of the PR.

@systemcrash
Copy link
Contributor

@systemcrash I have updated the commit message of the PR.

Could you fix the following in your commit message please? It makes searching in git more consistent.
dinamically -> dynamically
associate -> associated

@systemcrash
Copy link
Contributor

Closed via 75a2fd2

@systemcrash
Copy link
Contributor

Thank you @mgiganto

@mgiganto
Copy link
Author

Thanks to you @systemcrash!

@systemcrash systemcrash reopened this Feb 14, 2024
@systemcrash
Copy link
Contributor

Back to the drawing board

@dannil
Copy link
Contributor

dannil commented Mar 31, 2024

Ping @mgiganto I think you maybe missed the revert in 05af14b, see #6902

@mgiganto
Copy link
Author

mgiganto commented Apr 1, 2024 via email

@systemcrash
Copy link
Contributor

systemcrash commented Apr 1, 2024

@mgiganto simply mandating ppsk: '1' is not correct.

jow- wrote: the ppsk: "1" dependency on the RADIUS options looks wrong, those options should be available even if ppsk is not in use.

Let's take for example the first setting which is modified in this PR: auth_server.

add_dependency_permutations yields:

Object { mode: "ap", encryption: "psk", ppsk: "1" }
Object { mode: "ap-wds", encryption: "psk", ppsk: "1" }
Object { mode: "ap", encryption: "psk2", ppsk: "1" }
Object { mode: "ap-wds", encryption: "psk2", ppsk: "1" }
Object { mode: "ap", encryption: "psk+psk2", ppsk: "1" }
Object { mode: "ap-wds", encryption: "psk+psk2", ppsk: "1" }
Object { mode: "ap", encryption: "psk-mixed", ppsk: "1" }
Object { mode: "ap-wds", encryption: "psk-mixed", ppsk: "1" }

We can already see that mandating ppsk in every combination is wrong. There are a number of settings where auth_server works WITHOUT PPSK, for example, before this PR.

Before, it was effectively:

Object { mode: "ap", encryption: "wpa", ppsk: "0" }
Object { mode: "ap-wds", encryption: "wpa", ppsk: "0" }
Object { mode: "ap", encryption: "wpa2", ppsk: "0" }
Object { mode: "ap-wds", encryption: "wpa2", ppsk: "0" }
Object { mode: "ap", encryption: "wpa3", ppsk: "0" }
Object { mode: "ap-wds", encryption: "wpa3", ppsk: "0" }
Object { mode: "ap", encryption: "wpa3-mixed", ppsk: "0" }
Object { mode: "ap-wds", encryption: "wpa3-mixed", ppsk: "0" }

Some settings depend on RADIUS being enabled. But most of the existing RADIUS settings do not ALSO depend on PPSK.

So those dependency permutations must be corrected.

So my suggestion is not to replace the permutations, but add new ones.

e.g.

				add_dependency_permutations(o, { mode: ['ap', 'ap-wds'], encryption: ['wpa', 'wpa2', 'wpa3', 'wpa3-mixed'], ppsk: ['0'] });
				add_dependency_permutations(o, { mode: ['ap', 'ap-wds'], encryption: ['psk', 'psk2', 'psk+psk2', 'psk-mixed'], ppsk: ['1'] });

WPA3 only uses
SAE, therefore we should not allow PPSK over it nor wpa3+mixed mode,
because in mixed mode it will use wpa3 whenever it is possible, which will
cause that only devices that doesn't support wpa3 will be able to connect.

So what depends on what here? PPSK does not work with SAE?

@systemcrash
Copy link
Contributor

Further, please update your commit message as I specified here

@mgiganto
Copy link
Author

mgiganto commented Apr 8, 2024 via email

@galeksandrp
Copy link
Contributor

galeksandrp commented Jun 15, 2024

I am an idiot, forgot about WiFi Client modes.

Looks like this, but here is the question - Do PPSK will work on WDS setup?

I bet it will, cause well, looks like openwrt allows all encryption schemes for AP-WDS.

o = ss.taboption('encryption', form.Value, '_wpa_key', _('Key'));
add_dependency_permutations(o, { mode: ['ap', 'ap-wds'], encryption: ['psk', 'psk2', 'psk+psk2', 'psk-mixed'], ppsk: ['0'] });
add_dependency_permutations(o, { mode: ['sta', 'adhoc', 'mesh', 'sta-wds'], encryption: ['psk', 'psk2', 'psk+psk2', 'psk-mixed'] });
o.depends('encryption', 'sae');
o.depends('encryption', 'sae-mixed');

@mgiganto
Copy link
Author

mgiganto commented Jun 19, 2024 via email

@systemcrash
Copy link
Contributor

@mgiganto do you want to take a last effort to get this working?

@mgiganto
Copy link
Author

mgiganto commented Aug 4, 2024 via email

Signed-off-by: Manuel Giganto <21214615+mgiganto@users.noreply.github.com>
@mgiganto
Copy link
Author

This filter seems to solve the issue.
My computer is out of service right now, so I modified the commit directly on github website.

@mgiganto
Copy link
Author

Thank you @systemcrash, it is done.

@systemcrash
Copy link
Contributor

Hi @mgiganto could you please amend your commit SOB line to
Signed-off-by: Manuel Giganto <mgigantoregistros@gmail.com>

and remove the merge commit - just rebase everything onto master, please. Please also amend the commit subject lines to valid subject lines. e.g.
luci-mod-network: PPSK etc.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants