-
Notifications
You must be signed in to change notification settings - Fork 2.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
luci-mod-network: add ppsk option (support for private psk) #4513
Conversation
@Ansuel here is the luci patch updated. |
What's the status of this? Cause without this for those who brave enough to setup
|
Hi Alexander,
We need to wait for the core team to commit the patch in the master luci
repository. While that happens, you can use your own luci repository and
apply the patch...
You can always talk to the core team and ask them if there is anything you
can do to help them to review and commit the patch.
Best regards Alexander
On Tuesday, 29 November 2022, Alexander Georgievskiy < ***@***.***> wrote:
What's the status of this?
Cause without this for those who brave enough to setup ppsk via
/etc/config/wireless
subsequent update of configuration via luci destroy wifi completely
due to luci removing
uci del wireless.wifinet3.auth_server
uci del wireless.wifinet3.auth_secret
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you authored the thread.<
|
@jow- What's the status of this? Just tested mgiganto@6869ab1 on 0f6e166, no conflicts rebase, working fine: 1. Checking `Enable private psk key (PPSK)` leads to `ppsk mark`, `radius settings` being added (as expected)Checking leads to being added (as expected). |
@galeksandrp - the description text needs to be polished for better english and the option dependencies are not correct, the It likely works anyway because Also consistent use of acronyms and capitalization, e.g.: |
Thanks for the details @jow, I'll take a look.
The thing is, radius configuration is only expected to happen with
WPE, but in this case, we want it to be available and it is required
when WPA is using PPSK. Altough we can configure the radius all the
time, IMHO I think it is more clear to hide that parameters or delete
them if they cannot be used, and they can only be used when PPSK is
enabled.
May I know what would be the right approach from your point of view?
…On 15/03/2023, Jo-Philipp Wich ***@***.***> wrote:
@galeksandrp - the description text needs to be polished for better english
and the option dependencies are not correct, the `ppsk: "1"` dependency on
the RADIUS options looks wrong, those options should be available even if
ppsk is not in use.
It likely works anyway because `add_dependency_permutations()` adds a bunch
of other deps which make the options work but this renders the `o.depends({
ppsk: '1' });` calls redundant so they would need to be removed.
--
Reply to this email directly or view it on GitHub:
#4513 (comment)
You are receiving this because you authored the thread.
Message ID: ***@***.***>
|
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). This commit fixes issues found in openwrt#4513 Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). This commit fixes issues found in openwrt#4513 Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). This commit fixes issues found in openwrt#4513 Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). Commit fixes issues found in openwrt#4513 and was verified to work on `LuCI Master (git-23.093.56957-2145121) / OpenWrt SNAPSHOT (r22514-c8934099bf)` Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). Commit fixes issues found in openwrt#4513 and was verified to work on `LuCI Master (git-23.093.56957-2145121) / OpenWrt SNAPSHOT (r22514-c8934099bf)` Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
@jow- @mgiganto Could you please look if this galeksandrp@feature_ppsk adresses all the issues? |
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
Thanks for the suggestion Alexander!
I have to test :D
…On 08/04/2023, Alexander Georgievskiy ***@***.***> wrote:
@jow- @mgiganto Could you please look if this
galeksandrp@feature_ppsk adresses all the
issues?
--
Reply to this email directly or view it on GitHub:
#4513 (comment)
You are receiving this because you were mentioned.
Message ID: ***@***.***>
|
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
What's the status of this?
|
Thank you @galeksandrp! I tested it and made some extra modifications based on your idea. |
- `wireless.encryption.ppsk` option is `form.Flag` option that enables hostapd Private Pre-Shared Key (PPSK) feature. - Private Pre-Shared Key (PPSK) is a hostapd feature that allows use of different Pre-Shared Key for each STA MAC address. Private PSKs is stored on RADIUS server. - Private PSK feature is available starting from openwrt/openwrt@d12eb10 (PR openwrt/openwrt#3509). Commit fixes issues found in openwrt#4513 and was verified to work on openwrt/luci@2145121 / openwrt/openwrt@c8934099bf Signed-off-by: Alexander Georgievskiy <galeksandrp@gmail.com>
@jow- What's the status of this?
|
@jow- What's the status of this?
|
@mgiganto |
No. @jow- said that for mgiganto@6869ab1. It was fixed 5 months ago. Now there are array of structs. Each struct is o = ss.taboption('encryption', form.Value, 'auth_server', _('RADIUS Authentication Server'));
// Adds struct in array -----> o <----- And yes, in openwrt >wpa< is Enterprise WPA only
add_dependency_permutations(o, { mode: ['ap', 'ap-wds'], encryption: ['wpa', 'wpa2', 'wpa3', 'wpa3-mixed'] });
// Adds struct in array -----> o <----- And yes, WPA1 PSK is >psk<, WPA2 PSK is >psk2<
add_dependency_permutations(o, { mode: ['ap', 'ap-wds'], encryption: ['psk', 'psk2', 'psk+psk2', 'psk-mixed'], ppsk: ['1'] }); that means that RADIUS Auth Server setting will be available for
|
OK, could you please update your commit message to how I've edited your first message above? |
I'll be updating the description and review again the dependencies/
permutations.
Regarding to
"Yeah, not sure I get the ppsk: 1 parts. Are you saying that e.g. to use
the RADIUS auth_port, PPSK must be enabled? That's what these imply."
Yes, RADIUS is used in enterprise and when ppsk is enabled. It is not about
the port, it is about RADIUS usage itself. If we cannot use RADIUS (we ask
the password to it, because it changes per user at enterprise level and mac
at personal level), we don't need to enter any details about it and it
would mislead people.
"If that's the case (sounds wrong), please remove them, and force push.
Progress"
What do you want to be removed?
El lunes, 4 de diciembre de 2023, Paul Donald ***@***.***>
escribió:
OK, could you please update your commit message to how I've edited your
first message above?
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you were mentioned.<
|
Also, it was not compatible with wpa3 at the time of pushing it, this was
due to the SAE implementation. After this patch gets merged, I can recheck
things and see if I find a way to make it to work with SAE. WPA3 only uses
SAE, therefore we should not allow PPSK over it nor wpa3+mixed mode,
because in mixed mode it will use wpa3 whenever it is possible, which will
cause that only devices that doesn't support wpa3 will be able to connect.
Do you still think we should change the permutations to include the WPA3
(SAE) options?
El lunes, 4 de diciembre de 2023, Paul Donald ***@***.***>
escribió:
OK, could you please update your commit message to how I've edited your
first message above?
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you were mentioned.<
|
Update your commit message. Not the PR description. Nothing needs removing if the dependency permutations function as OR. Not AND. Has anyone else been able to test this? |
Include support in luci to enable the Private PSK. When Private PSK is enabled, clients can use a default password (common), or have their own private password that is associate with the client MAC. The password is retrieved from RADIUS server, asking for the client MAC, and when such client MAC is not defined, RADIUS should return a default password. RADIUS can also return other parameters like VLANs, which can be used to put clients dinamically in different vlans based on their MAC, or the default configuration. Private PSK is not compatible yet with SAE encryption, therefore cannot be used yet with WPA3 or WPA3-mixed. It implements the UI for the PPSK already in master: openwrt/openwrt#3509 Signed-off-by: Manuel Giganto <mgigantoregistros@gmail.com>
@systemcrash I have updated the commit message of the PR. |
Could you fix the following in your commit message please? It makes searching in git more consistent. |
Closed via 75a2fd2 |
Thank you @mgiganto |
Thanks to you @systemcrash! |
Back to the drawing board |
Thank you!
…On Sun, 31 Mar 2024 at 23:42, Daniel Nilsson ***@***.***> wrote:
Ping @mgiganto <https://github.com/mgiganto> I think you maybe missed the
revert in 05af14b
<05af14b>,
see #6902 <#6902>
—
Reply to this email directly, view it on GitHub
<#4513 (comment)>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/AFB3LF6V3PDX5UOSZZN7RKDY3CGOTAVCNFSM4SM62WMKU5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TEMBSHA4TGNRRGM4A>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
@mgiganto simply mandating jow- wrote: Let's take for example the first setting which is modified in this PR:
We can already see that mandating ppsk in every combination is wrong. There are a number of settings where Before, it was effectively:
Some settings depend on RADIUS being enabled. But most of the existing RADIUS settings do not ALSO depend on PPSK. So those dependency permutations must be corrected. So my suggestion is not to replace the permutations, but add new ones. e.g. add_dependency_permutations(o, { mode: ['ap', 'ap-wds'], encryption: ['wpa', 'wpa2', 'wpa3', 'wpa3-mixed'], ppsk: ['0'] });
add_dependency_permutations(o, { mode: ['ap', 'ap-wds'], encryption: ['psk', 'psk2', 'psk+psk2', 'psk-mixed'], ppsk: ['1'] });
So what depends on what here? PPSK does not work with SAE? |
Further, please update your commit message as I specified here |
The objective is to hide KEY field ONLY when PPSK=1, and in show it in any
other case, but I don't have a method to remove dependencies, so a reverse
logic needs to be applied, show the KEY field when PPSK=0 OR PPSK is not
defined.
I tried with add_dependency_permutations(o, { encryption: ['psk2',
'psk+psk2'], ppsk: [/^0?$/] }); but it is not working as expected.
Why?
Because PPSK is only defined for AP and AP-WDS, so other modes with PSK
encryption support like Client mode don't have PPSK defined at all and fail
on the dependency permutation...
Any ideas/suggestions?
I need to test the latest version of hostapd using SAE + ppsk, when I made
the PR the implementation of ppsk using SAE was broken on hostapd, so it
was disabled on purpose.
Chances are that it is working now, I need to build it with the latest
version to see it.
…On Mon, 1 Apr 2024 at 15:17, Paul Donald ***@***.***> wrote:
Further, please update your commit message as I specified here
<#4513 (comment)>
—
Reply to this email directly, view it on GitHub
<#4513 (comment)>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/AFB3LF72WOSNN6HMUCUZPSDY3FT6LAVCNFSM4SM62WMKU5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TEMBSHE4DEOBSGM2A>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
I am an idiot, forgot about Looks like this, but here is the question - Do PPSK will work on WDS setup? I bet it will, cause well, looks like openwrt allows all encryption schemes for AP-WDS. o = ss.taboption('encryption', form.Value, '_wpa_key', _('Key'));
add_dependency_permutations(o, { mode: ['ap', 'ap-wds'], encryption: ['psk', 'psk2', 'psk+psk2', 'psk-mixed'], ppsk: ['0'] });
add_dependency_permutations(o, { mode: ['sta', 'adhoc', 'mesh', 'sta-wds'], encryption: ['psk', 'psk2', 'psk+psk2', 'psk-mixed'] });
o.depends('encryption', 'sae');
o.depends('encryption', 'sae-mixed'); |
I am away until next week so i cannot test it but your idea about
segregating the problem and address it independently looks very promising
to me. I don't recall about WDS, I think it should work, the patch focus on
encryption mode, not wifi modes, and the only problem is pretty much hiding
the default key in the luci, which is done just to avoid confusion to
hostapd about having potentially 2 default passwords, one in radius, one
internal in hostapd.
Ppsk may potentially work in any mode that support psk encryption, it just
doesn't make sense to use it when you are initiating the connection,
because you are suppose to know your unique password previously, and if it
is a matter of using dynamic passwords, I can see easier ways.
El sábado, 15 de junio de 2024, Alexander Georgievskiy <
***@***.***> escribió:
I am an idiot, forgot about WiFi Client modes.
Looks like this, but here is the question - Do PPSK will work on WDS
setup?
o = ss.taboption('encryption', form.Value, '_wpa_key', _('Key'));
add_dependency_permutations(o, { mode: ['ap', 'ap-wds'], encryption:
['psk', 'psk2', 'psk+psk2', 'psk-mixed'], ppsk: ['0'] });
add_dependency_permutations(o, { mode: ['sta', 'adhoc', 'mesh',
'sta-wds'], encryption: ['psk', 'psk2', 'psk+psk2', 'psk-mixed'] });
o.depends('encryption', 'sae');
o.depends('encryption', 'sae-mixed');
Or should we don't touch poor WDS and let it die in peace?
o = ss.taboption('encryption', form.Value, '_wpa_key', _('Key'));
add_dependency_permutations(o, { mode: ['ap'], encryption: ['psk',
'psk2', 'psk+psk2', 'psk-mixed'], ppsk: ['0'] });
add_dependency_permutations(o, { mode: ['sta', 'adhoc', 'mesh', 'ap-wds',
'sta-wds'], encryption: ['psk', 'psk2', 'psk+psk2', 'psk-mixed'] });
o.depends('encryption', 'sae');
o.depends('encryption', 'sae-mixed');
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you were mentioned.<
|
@mgiganto do you want to take a last effort to get this working? |
Oh yeah, let me do one more check :)
El viernes, 26 de julio de 2024, Paul Donald ***@***.***>
escribió:
@mgiganto do you want to take a last effort to get this working?
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you were mentioned.<
|
Signed-off-by: Manuel Giganto <21214615+mgiganto@users.noreply.github.com>
This filter seems to solve the issue. |
modules/luci-mod-network/htdocs/luci-static/resources/view/network/wireless.js
Outdated
Show resolved
Hide resolved
Thank you @systemcrash, it is done. |
Hi @mgiganto could you please amend your commit SOB line to and remove the merge commit - just rebase everything onto master, please. Please also amend the commit subject lines to valid subject lines. e.g. |
This PR allows a luci user to enable a private psk (PPSK), where each
station may have its own PSK or use a common PSK if a private one is not defined.
Depends on PR 3509: openwrt/openwrt#3509
Signed-off-by: Manuel Giganto mgigantoregistros@gmail.com