If authentication fails repeatedly e.g. because of a weak signal, the link
can end up in blocked state. If one of the nodes tries to establish a link
again before it is unblocked on the other side, it will block the link to
that other side. The same happens on the other side when it unblocks the
link. In that scenario, the link never recovers on its own.
To fix this, allow restarting authentication even if the link is in blocked
state, but don't initiate the attempt until the blocked period is over.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit f84053af5c0b0a159ea4d3e90b0c06574b4fde8d)
Some drivers that do their own sequence number allocation (e.g. ath9k, mwlwifi) rely
on being able to modify params->ssn on starting tx ampdu sessions.
This was broken by a change that modified it to use sta->tid_seq[tid] instead.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit ddd977fcc5838eb6bfb6cb9dad99dfe09a8ff67e)
When a ubus event handler denies a association with a non-zero return
value, the code jumps to preceeding code, creating an endless loop until
the event handler accepts the assc request.
Move the ubus handler further up the code to avoid creating such a loop.
Signed-off-by: David Bauer <mail@david-bauer.net>
They can be added as hex digit strings via the 'vendor_elements' option
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 1818b038d7275273adbd525b5ee76bc60b7d628c)
This makes it possible to avoid using a RADIUS server for WPA enterprise authentication
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from 98621c97822eb20a80ab2248a253972051ea6f08)
This allows WPA enterprise roaming in the same mobility domain without any
manual key configuration (aside from radius credentials)
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 704ab6a002172e76d41612f6d07ff179ef035d10)
Using a pointer one lifter after it freed is not the best idea.
Let's not do that.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry-picked from commit 63c01ad025981eaa841353dc0fc27e5017febe21)
This implements the mapping recommendations from RFC8325, with an
update from RFC8622. This ensures that DSCP marked packets are properly
sorted into WMM classes.
The map can be disabled by setting iw_qos_map_set to something invalid
like 'none'
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit a5e3def1822431ef6436cb493df77006dbacafd6)
This feature is useful on its own even without full interworking support
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit efff3520f4d8fe131c4bd54bb2e098139a7efa4d)
Both hostapd and netifd attempt to add a VLAN device to a bridge.
Depending on which one wins the race, bridge vlan settings might be incomplete,
or hostapd might run into an error and refuse to service the client.
Fix this by preventing hostapd from adding interfaces to the bridge and
instead rely entirely on netifd handling this properly
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit da4be02fcd5d642954b1c9d9855d9e8d1e6205f4)
(cherry-picked from commit 63c01ad025981eaa841353dc0fc27e5017febe21)
Avoids race conditions on bridge member add/remove
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 17d19a7d4398789ae8da3daf8e0db167d58b0782)
When using htmode 'HE20' with a radio mode that uses wpa-supplicant
(like mesh or sta), it will default to 40 MHz bw if disable_ht40 is not
set. This commit fixes this behaviour.
Signed-off-by: Jesus Fernandez Manzano <jesus.manzano@galgus.net>
(cherry-picked from commit af83e3ce0ff40dcecbe913676343bf86846294f7)
Use the VLAN interface instead of the bridge, to ensure that hostapd receives
untagged DHCP packets
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 7b46377a0cd9d809a3c340358121de77f005d4cc)
(cherry-picked from commit f1b98fa4fa8a86a9daf2a7177235f28cbd7c53ef)
In setups using VLAN bridge filtering, hostapd may need to communicate using
a VLAN interface on top of the bridge, instead of using the bridge directly
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 305c1b8d746b363f655c2f8d5a6497cca10a5d4e)
- add functionality to configure RADIUS NAS-Id and Operator-Name
- add functionality to configure RADIUS accounting interval
- enable RADIUS "Chargeable User Identity"
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 3bd6c8c728e72444bdf23b8904ef9c52ebb46bb7)
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit c76f1d8330c679774eb568a423feb57d956b3ca4)
Airtime policy configuration is extremely useful in multiple BSS scenarios.
Since nowadays most people configure both private and guest networks (at
least), it makes sense to enable it by default, except for the most limited
of the variants.
Size of the hostapd-basic-openssl binary (mipsel 24Kc -O2):
543944 bytes (airtime policy disabled)
548040 bytes (airtime policy enabled)
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
Acked-by: Daniel Golle <daniel@makrotopia.org>
(cherry-picked from commit d38f4565828264731f2a9cfe646491fba80315d3)
netifd is responsible for handling that, except if the vlan bridge
was provided by the config
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit cf45caeff16256f9db777e0e652ec3a38cd476a4)
No functional changes, just some renames to make it easier to keep mt76 in
sync with upstream
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit e62c5504701c7a665c9cf89ddbcb062f5ade6e37)
(cherry-picked from commit a889dcd3f21e50dc3e7f827ff0e486020562a6f8)
Required for an upcoming mt76 update
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 978e822db354daf974811f2717c6013fa3eb8079)
(cherry-picked from commit af9d31aacc286786a8765a44c2000d2eba02e61c)
This is needed for an upcoming mt76 update
also sync iw nl80211 with kernel backports
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 2bfac61483db32f8bd1f5b38702b39f206256265)
(cherry-picked from commit 36019ed5893cd11c86a7dbedca1c6a055654a3c0)
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 0f6887972adc48449a1f5efaa143fa3f740a8c36)
(cherry-picked from commit 6f2044c2d74dd0ae2cee3b25b2ac084513c0536a)
Improves airtime fairness, especially for devices with larger firmware buffers
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit a5888ad6b33840d913438ce664c0e7da7e7f53e6)
Without this, beamforming is probably not working
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit e2c4998f6dca7d9b74a8b01762040ff2c5e38fd7)
On systems using brmcfmac (e.g. Raspberry Pi Zero W) without this fix,
the final setup-call:
iw dev wlan0 ibss join ...
fails with returncode 161 and message:
"command failed: Not supported (-95)"
So this patch calls an explicit:
iw dev wlan0 set type ibss
just prior to the 'ibss join' command.
I have tested several ath9k and mt76xx devices
with different revisions: this patch does not harm.
please also apply to stable branch.
Signed-off-by: Bastian Bittorf <bb@npl.de>
(cherry-picked from commit ea5fce3f4616df3e4331e6b4e8e79767bded442c)
In some cases, spurious failures might be cleared by teardown and retry
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 42dda0ed3e941bc36661e29b990e2ee2adf7f508)
The channel offset used for VHT segment calculation was missing for HT
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit a0d81ba0d5e9d055c55b5e478cb913c217122317)
Use the right argument to fix setting unsupported capabilities to 0
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 49ef4dbee519e006bb998de11e3bdf1c10c43e6a)
Some drivers advertise it, but it's not supported at the moment
Reported-by: John Thomson <git@johnthomson.fastmail.com.au>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 42a99b18ff23fa768a6ae5f1076f15cbfa494f24)
The colon does not directly follow the "VHT Capabilities" string
Reported-by: John Thomson <git@johnthomson.fastmail.com.au>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 3518b793a2f2293e7e9124b5beae7b09887c5e32)
