Skip to content

Commit e696759

Browse files
pandafynemesifier
pandafy
authored and
nemesifier
committed
[chores] OpenWrt: documented WPA3 and improved WPA3 schema #194
Closes #194
1 parent cf18c62 commit e696759

4 files changed

Lines changed: 214 additions & 137 deletions

File tree

‎docs/source/backends/openwrt.rst‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1273,6 +1273,171 @@ UCI Output::
12731273
option password 'test-password'
12741274
option ssid 'enterprise-client'
12751275

1276+
WPA3 Personal (Simultaneous Authentication of Equals)
1277+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1278+
1279+
The following example shows a typical wireless access
1280+
point using *WPA3 Personal (SAE)* encryption:
1281+
1282+
.. code-block:: python
1283+
1284+
{
1285+
"interfaces": [
1286+
{
1287+
"name": "wlan0",
1288+
"type": "wireless",
1289+
"wireless": {
1290+
"radio": "radio0",
1291+
"mode": "access_point",
1292+
"ssid": "wpa3-personal",
1293+
"encryption": {
1294+
"protocol": "wpa3_personal",
1295+
# WPA3 only supports ccmp
1296+
"cipher": "ccmp",
1297+
"key": "passphrase012345",
1298+
# Management Frame Protection is required for WPA3
1299+
"ieee80211w": "2",
1300+
}
1301+
}
1302+
}
1303+
]
1304+
}
1305+
1306+
UCI output::
1307+
1308+
package network
1309+
1310+
config interface `'wlan0'
1311+
option ifname 'wlan0'
1312+
option proto 'none'
1313+
1314+
package wireless
1315+
1316+
config wifi-iface 'wifi_wlan0'
1317+
option device 'radio0'
1318+
option encryption 'sae+ccmp'
1319+
option ieee80211w '2'
1320+
option ifname 'wlan0'
1321+
option key 'passphrase012345'
1322+
option mode 'ap'
1323+
option network 'wlan0'
1324+
option ssid 'wpa3-personal'
1325+
1326+
WPA3 Enterprise (802.1x) ap
1327+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
1328+
1329+
The following example shows a typical wireless access
1330+
point using *WPA3 Enterprise (802.1x)* security on **OpenWRT**,
1331+
you can use this type of configuration for networks like
1332+
`eduroam <https://www.eduroam.org/>`_:
1333+
1334+
.. code-block:: python
1335+
1336+
{
1337+
"interfaces": [
1338+
{
1339+
"name": "wlan0",
1340+
"type": "wireless",
1341+
"wireless": {
1342+
"radio": "radio0",
1343+
"mode": "access_point",
1344+
"ssid": "eduroam",
1345+
"encryption": {
1346+
"protocol": "wpa3_enterprise",
1347+
# WPA3 only supports ccmp
1348+
"cipher": "ccmp",
1349+
"key": "radius_secret",
1350+
"server": "192.168.0.1",
1351+
"port": 1812,
1352+
"acct_server": "192.168.0.2",
1353+
"acct_port": 1813,
1354+
"nasid": "hostname",
1355+
"ieee80211w": "2",
1356+
}
1357+
}
1358+
}
1359+
]
1360+
}
1361+
1362+
UCI Output::
1363+
1364+
package network
1365+
1366+
config interface 'wlan0'
1367+
option ifname 'wlan0'
1368+
option proto 'none'
1369+
1370+
package wireless
1371+
1372+
config wifi-iface 'wifi_wlan0'
1373+
option acct_port '1813'
1374+
option acct_server '192.168.0.2'
1375+
option device 'radio0'
1376+
option encryption 'wpa3+ccmp'
1377+
option ieee80211w '2'
1378+
option ifname 'wlan0'
1379+
option key 'radius_secret'
1380+
option mode 'ap'
1381+
option nasid 'hostname'
1382+
option network 'wlan0'
1383+
option port '1812'
1384+
option server '192.168.0.1'
1385+
option ssid 'eduroam'
1386+
1387+
WPA3 Enterprise (802.1x) client
1388+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1389+
1390+
*WPA3 Enterprise (802.1x)* client example:
1391+
1392+
.. code-block:: python
1393+
1394+
{
1395+
"interfaces": [
1396+
{
1397+
"name": "wlan0",
1398+
"type": "wireless",
1399+
"wireless": {
1400+
"radio": "radio0",
1401+
"mode": "station",
1402+
"ssid": "enterprise-client",
1403+
"bssid": "00:26:b9:20:5f:09",
1404+
"encryption": {
1405+
"protocol": "wpa3_enterprise",
1406+
# WPA3 only supports ccmp
1407+
"cipher": "ccmp",
1408+
"eap_type": "tls",
1409+
"identity": "test-identity",
1410+
"password": "test-password",
1411+
"ieee80211w": "2",
1412+
}
1413+
}
1414+
}
1415+
]
1416+
}
1417+
1418+
UCI Output::
1419+
1420+
package network
1421+
1422+
config interface 'wlan0'
1423+
option ifname 'wlan0'
1424+
option proto 'none'
1425+
1426+
package wireless
1427+
1428+
config wifi-iface 'wifi_wlan0'
1429+
option bssid '00:26:b9:20:5f:09'
1430+
option device 'radio0'
1431+
option eap_type 'tls'
1432+
option encryption 'wpa3+ccmp'
1433+
option identity 'test-identity'
1434+
option ieee80211w '2'
1435+
option ifname 'wlan0'
1436+
option mode 'sta'
1437+
option network 'wlan0'
1438+
option password 'test-password'
1439+
option ssid 'enterprise-client'
1440+
12761441
Dialup settings
12771442
---------------
12781443

‎netjsonconfig/backends/openwrt/converters/wireless.py‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -125,13 +125,6 @@ def __intermediate_encryption(self, wireless):
125125
uci['key'] = encryption['key']
126126
# add ciphers
127127
cipher = encryption.get('cipher')
128-
if (
129-
protocol == 'wpa3_personal'
130-
or protocol == 'wpa3_enterprise'
131-
or protocol == 'wpa2_personal_mixed'
132-
or protocol == 'wpa2_enterprise_mixed'
133-
):
134-
cipher = 'ccmp'
135128
if cipher and protocol.startswith('wpa') and cipher != 'auto':
136129
uci['encryption'] += '+{0}'.format(cipher)
137130
return uci

‎netjsonconfig/schema.py‎

Lines changed: 40 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -360,8 +360,8 @@
360360
{"$ref": "#/definitions/encryption_none"},
361361
{"$ref": "#/definitions/encryption_wpa3_personal"},
362362
{"$ref": "#/definitions/encryption_wpa3_enterprise_ap"},
363-
{"$ref": "#/definitions/encryption_wpa3_2_personal"},
364-
{"$ref": "#/definitions/encryption_wpa3_2_enterprise_ap"},
363+
{"$ref": "#/definitions/encryption_wpa3_personal_mixed"},
364+
{"$ref": "#/definitions/encryption_wpa3_enterprise_ap_mixed"},
365365
{"$ref": "#/definitions/encryption_wpa_personal"},
366366
{"$ref": "#/definitions/encryption_wpa_enterprise_ap"},
367367
{"$ref": "#/definitions/encryption_wps"},
@@ -381,8 +381,8 @@
381381
{"$ref": "#/definitions/encryption_none"},
382382
{"$ref": "#/definitions/encryption_wpa3_personal"},
383383
{"$ref": "#/definitions/encryption_wpa3_enterprise_sta"},
384-
{"$ref": "#/definitions/encryption_wpa3_2_personal"},
385-
{"$ref": "#/definitions/encryption_wpa3_2_enterprise_sta"},
384+
{"$ref": "#/definitions/encryption_wpa3_personal_mixed"},
385+
{"$ref": "#/definitions/encryption_wpa3_enterprise_sta_mixed"},
386386
{"$ref": "#/definitions/encryption_wpa_personal"},
387387
{"$ref": "#/definitions/encryption_wpa_enterprise_sta"},
388388
{"$ref": "#/definitions/encryption_wep"},
@@ -451,6 +451,18 @@
451451
}
452452
}
453453
},
454+
"encryption_cipher_ccmp_required": {
455+
"required": ["cipher"],
456+
"properties": {
457+
"cipher": {
458+
"type": "string",
459+
"enum": ["ccmp"],
460+
"options": {"enum_titles": ["Force CCMP (AES)"]},
461+
"readOnly": True,
462+
"propertyOrder": 3,
463+
}
464+
},
465+
},
454466
"encryption_mfp_property": {
455467
"properties": {
456468
"ieee80211w": {
@@ -469,6 +481,7 @@
469481
"type": "string",
470482
"title": "management frame protection",
471483
"enum": ["2"],
484+
"readOnly": True,
472485
"options": {"enum_titles": ["required"]},
473486
"propertyOrder": 4,
474487
}
@@ -480,17 +493,18 @@
480493
"ieee80211w": {
481494
"type": "string",
482495
"title": "management frame protection",
483-
"enum": ["1", "2"],
496+
"enum": ["1"],
497+
"readOnly": True,
484498
"options": {"enum_titles": ["optional", "required"]},
485499
"propertyOrder": 4,
486500
}
487501
},
488502
},
489503
"encryption_wpa3_personal": {
490-
"title": "WPA3 only Personal",
504+
"title": "WPA3 Personal",
491505
"allOf": [
492506
{"$ref": "#/definitions/encryption_base_settings"},
493-
{"$ref": "#/definitions/encryption_cipher_property"},
507+
{"$ref": "#/definitions/encryption_cipher_ccmp_required"},
494508
{"$ref": "#/definitions/encryption_mfp_property_required"},
495509
{
496510
"properties": {
@@ -503,11 +517,11 @@
503517
},
504518
],
505519
},
506-
"encryption_wpa3_2_personal": {
507-
"title": "WPA3/WPA2 Personal",
520+
"encryption_wpa3_personal_mixed": {
521+
"title": "WPA3/WPA2 Personal Mixed Mode",
508522
"allOf": [
509523
{"$ref": "#/definitions/encryption_base_settings"},
510-
{"$ref": "#/definitions/encryption_cipher_property"},
524+
{"$ref": "#/definitions/encryption_cipher_ccmp_required"},
511525
{"$ref": "#/definitions/encryption_mfp_property_optional"},
512526
{
513527
"properties": {
@@ -622,7 +636,7 @@
622636
}
623637
}
624638
},
625-
"encryption_wpa3_2_enterprise_base_settings": {
639+
"encryption_wpa3_enterprise_mixed_base_settings": {
626640
"properties": {
627641
"protocol": {
628642
"type": "string",
@@ -634,42 +648,46 @@
634648
}
635649
},
636650
"encryption_wpa3_enterprise_ap": {
637-
"title": "WPA3 only Enterprise (access point)",
651+
"title": "WPA3 Enterprise (access point)",
638652
"allOf": [
639653
{"$ref": "#/definitions/encryption_base_settings"},
640-
{"$ref": "#/definitions/encryption_cipher_property"},
654+
{"$ref": "#/definitions/encryption_cipher_ccmp_required"},
641655
{"$ref": "#/definitions/encryption_mfp_property_required"},
642656
{"$ref": "#/definitions/encryption_wpa3_enterprise_base_settings"},
643657
{"$ref": "#/definitions/encryption_wpa_enterprise_ap_base_settings"},
644658
],
645659
},
646-
"encryption_wpa3_2_enterprise_ap": {
647-
"title": "WPA3/WPA2 Enterprise (access point)",
660+
"encryption_wpa3_enterprise_ap_mixed": {
661+
"title": "WPA3/WPA2 Enterprise (access point) Mixed Mode",
648662
"allOf": [
649663
{"$ref": "#/definitions/encryption_base_settings"},
650-
{"$ref": "#/definitions/encryption_cipher_property"},
664+
{"$ref": "#/definitions/encryption_cipher_ccmp_required"},
651665
{"$ref": "#/definitions/encryption_mfp_property_optional"},
652-
{"$ref": "#/definitions/encryption_wpa3_2_enterprise_base_settings"},
666+
{
667+
"$ref": "#/definitions/encryption_wpa3_enterprise_mixed_base_settings"
668+
},
653669
{"$ref": "#/definitions/encryption_wpa_enterprise_ap_base_settings"},
654670
],
655671
},
656672
"encryption_wpa3_enterprise_sta": {
657-
"title": "WPA3 only Enterprise (client)",
673+
"title": "WPA3 Enterprise (client)",
658674
"additionalProperties": True,
659675
"allOf": [
660-
{"$ref": "#/definitions/encryption_cipher_property"},
676+
{"$ref": "#/definitions/encryption_cipher_ccmp_required"},
661677
{"$ref": "#/definitions/encryption_mfp_property_required"},
662678
{"$ref": "#/definitions/encryption_wpa3_enterprise_base_settings"},
663679
{"$ref": "#/definitions/encryption_wpa_enterprise_sta_base_settings"},
664680
],
665681
},
666-
"encryption_wpa3_2_enterprise_sta": {
682+
"encryption_wpa3_enterprise_sta_mixed": {
667683
"title": "WPA3/WPA2 Enterprise (client)",
668684
"additionalProperties": True,
669685
"allOf": [
670-
{"$ref": "#/definitions/encryption_cipher_property"},
686+
{"$ref": "#/definitions/encryption_cipher_ccmp_required"},
671687
{"$ref": "#/definitions/encryption_mfp_property_optional"},
672-
{"$ref": "#/definitions/encryption_wpa3_2_enterprise_base_settings"},
688+
{
689+
"$ref": "#/definitions/encryption_wpa3_enterprise_mixed_base_settings"
690+
},
673691
{"$ref": "#/definitions/encryption_wpa_enterprise_sta_base_settings"},
674692
],
675693
},

0 commit comments

Comments
 (0)