461d904086
This package adds support for SAE on 802.11s mesh connections. Enabling this package will require all 802.11s mesh connections to be encrypted using the SAE key agreement scheme. The security of SAE relies upon the authentication through a shared secret. In the context of public mesh networks a shared secret is an obvious oxymoron. Still this functionality provides an improvement over unencrypted mesh connections in that it protects against a passive attacker who did not observe the key agreement. In addition Management Frame Protection (802.11w) gets automatically enabled on mesh interfaces to prevent protocol-level deauthentication attacks. If `wifi.mesh.sae` is enabled a shared secret will automatically be derived from the `prefix6` variable. This is as secure as it gets for a public mesh network. For *private* mesh networks `wifi.mesh.sae_passphrase` should be set to your shared secret. Fixes #1636
30 lines
689 B
Lua
Executable File
30 lines
689 B
Lua
Executable File
#!/usr/bin/lua
|
|
|
|
local util = require 'gluon.util'
|
|
local site = require 'gluon.site'
|
|
local hash = require 'hash'
|
|
local uci = require('simple-uci').cursor()
|
|
|
|
|
|
local function configure_sae(vif)
|
|
uci:set('wireless', vif, 'encryption', 'sae')
|
|
uci:set('wireless', vif, 'key', site.wifi.mesh.sae_passphrase() or hash.md5(site.prefix6()))
|
|
end
|
|
|
|
util.foreach_radio(uci, function(radio, _, _)
|
|
local radio_name = radio['.name']
|
|
local vif = 'mesh_' .. radio_name
|
|
local enable = site.wifi.mesh.sae(false)
|
|
|
|
if uci:get('wireless', vif) then
|
|
uci:delete('wireless', vif, 'encryption')
|
|
uci:delete('wireless', vif, 'key')
|
|
|
|
if enable then
|
|
configure_sae(vif)
|
|
end
|
|
end
|
|
end)
|
|
|
|
uci:save('wireless')
|