gluon/package/gluon-mesh-wireless-sae/luasrc/lib/gluon/upgrade/205-wireless-mesh-sae

#!/usr/bin/lua

local site = require 'gluon.site'
local wireless = require 'gluon.wireless'
local hash = require 'hash'
local uci = require('simple-uci').cursor()


local function configure_sae(vif)
	uci:set('wireless', vif, 'encryption', 'sae')
	uci:set('wireless', vif, 'key', site.wifi.mesh.sae_passphrase() or hash.md5(site.prefix6()))
end

wireless.foreach_radio(uci, function(radio)
	local radio_name = radio['.name']
	local vif = 'mesh_' .. radio_name
	local enable = site.wifi.mesh.sae(false)

	if uci:get('wireless', vif) then
		uci:delete('wireless', vif, 'encryption')
		uci:delete('wireless', vif, 'key')

		if enable then
			configure_sae(vif)
		end
	end
end)

uci:save('wireless')
Add gluon-mesh-wireless-sae package This package adds support for SAE on 802.11s mesh connections. Enabling this package will require all 802.11s mesh connections to be encrypted using the SAE key agreement scheme. The security of SAE relies upon the authentication through a shared secret. In the context of public mesh networks a shared secret is an obvious oxymoron. Still this functionality provides an improvement over unencrypted mesh connections in that it protects against a passive attacker who did not observe the key agreement. In addition Management Frame Protection (802.11w) gets automatically enabled on mesh interfaces to prevent protocol-level deauthentication attacks. If `wifi.mesh.sae` is enabled a shared secret will automatically be derived from the `prefix6` variable. This is as secure as it gets for a public mesh network. For private mesh networks `wifi.mesh.sae_passphrase` should be set to your shared secret. Fixes #1636 2019-02-05 01:34:12 +00:00			`#!/usr/bin/lua`

			`local site = require 'gluon.site'`
gluon-core: move wireless-related utils to wireless module Separate wireless-related helper methods from the util module to a new wireless module. This keeps them separated, as the amount of wireless helpers increased in the past, justifying a separate module. 2020-05-24 22:57:35 +00:00			`local wireless = require 'gluon.wireless'`
Add gluon-mesh-wireless-sae package This package adds support for SAE on 802.11s mesh connections. Enabling this package will require all 802.11s mesh connections to be encrypted using the SAE key agreement scheme. The security of SAE relies upon the authentication through a shared secret. In the context of public mesh networks a shared secret is an obvious oxymoron. Still this functionality provides an improvement over unencrypted mesh connections in that it protects against a passive attacker who did not observe the key agreement. In addition Management Frame Protection (802.11w) gets automatically enabled on mesh interfaces to prevent protocol-level deauthentication attacks. If `wifi.mesh.sae` is enabled a shared secret will automatically be derived from the `prefix6` variable. This is as secure as it gets for a public mesh network. For private mesh networks `wifi.mesh.sae_passphrase` should be set to your shared secret. Fixes #1636 2019-02-05 01:34:12 +00:00			`local hash = require 'hash'`
			`local uci = require('simple-uci').cursor()`


			`local function configure_sae(vif)`
			`uci:set('wireless', vif, 'encryption', 'sae')`
			`uci:set('wireless', vif, 'key', site.wifi.mesh.sae_passphrase() or hash.md5(site.prefix6()))`
			`end`

mesh-wireless-sae: drop unused function parameters Drop these unused parameters in the function description, as only the first parameter is referenced within the function block. 2021-05-02 00:19:58 +00:00			`wireless.foreach_radio(uci, function(radio)`
Add gluon-mesh-wireless-sae package This package adds support for SAE on 802.11s mesh connections. Enabling this package will require all 802.11s mesh connections to be encrypted using the SAE key agreement scheme. The security of SAE relies upon the authentication through a shared secret. In the context of public mesh networks a shared secret is an obvious oxymoron. Still this functionality provides an improvement over unencrypted mesh connections in that it protects against a passive attacker who did not observe the key agreement. In addition Management Frame Protection (802.11w) gets automatically enabled on mesh interfaces to prevent protocol-level deauthentication attacks. If `wifi.mesh.sae` is enabled a shared secret will automatically be derived from the `prefix6` variable. This is as secure as it gets for a public mesh network. For private mesh networks `wifi.mesh.sae_passphrase` should be set to your shared secret. Fixes #1636 2019-02-05 01:34:12 +00:00			`local radio_name = radio['.name']`
			`local vif = 'mesh_' .. radio_name`
			`local enable = site.wifi.mesh.sae(false)`

			`if uci:get('wireless', vif) then`
			`uci:delete('wireless', vif, 'encryption')`
			`uci:delete('wireless', vif, 'key')`

			`if enable then`
			`configure_sae(vif)`
			`end`
			`end`
			`end)`

			`uci:save('wireless')`