Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

T6496: Added support for WPA-Enterprise client-mode (backport #3711) #4085

Merged
merged 3 commits into from
Sep 19, 2024
Merged

T6496: Added support for WPA-Enterprise client-mode (backport #3711) #4085

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d505264
wireless: T6496: support for EAP-MSCHAPv2 client over wifi
part1cleth1ef Jun 10, 2024
c8f116c
wireless: T6496: use ascii regex for WPA passphrase constraint
c-po Jul 5, 2024
b76a5c9
wireless: T6496: use mac-address validator on BSSID and move it up on…
c-po Jul 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion data/templates/wifi/wpa_supplicant.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,8 @@ network={
# If not set, this defaults to: WPA-PSK WPA-EAP
{% if security.wpa.mode is vyos_defined('wpa3') %}
key_mgmt=SAE
{% elif security.wpa.username is vyos_defined %}
key_mgmt=WPA-EAP WPA-EAP-SHA256
{% else %}
key_mgmt=WPA-PSK WPA-PSK-SHA256
{% endif %}
Expand All @@ -76,8 +78,18 @@ network={
# from ASCII passphrase. This process uses lot of CPU and wpa_supplicant
# startup and reconfiguration time can be optimized by generating the PSK only
# only when the passphrase or SSID has actually changed.
{% if security.wpa.username is vyos_defined %}
identity="{{ security.wpa.username }}"
password="{{ security.wpa.passphrase }}"
phase2="auth=MSCHAPV2"
eap=PEAP
{% elif security.wpa.username is not vyos_defined %}
psk="{{ security.wpa.passphrase }}"
{% else %}
{% else %}
key_mgmt=NONE
{% endif %}
{% endif %}
{% if bssid is vyos_defined %}
bssid={{ bssid }}
{% endif %}
}
20 changes: 17 additions & 3 deletions interface-definitions/interfaces_wireless.xml.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -935,15 +935,16 @@
</properties>
<defaultValue>wpa+wpa2</defaultValue>
</leafNode>
#include <include/generic-username.xml.i>
<leafNode name="passphrase">
<properties>
<help>WPA personal shared pass phrase. If you are using special characters in the WPA passphrase then single quotes are required.</help>
<help>WPA passphrase. If you are using special characters in the WPA passphrase then single quotes are required.</help>
<valueHelp>
<format>txt</format>
<description>Passphrase of at least 8 but not more than 63 printable characters</description>
<description>Passphrase of at least 8 but not more than 63 printable characters for WPA-Personal and any passphrase for WPA-Enterprise</description>
</valueHelp>
<constraint>
<regex>.{8,63}</regex>
<regex>[[:ascii:]]{1,256}</regex>
</constraint>
<constraintErrorMessage>Invalid WPA pass phrase, must be 8 to 63 printable characters!</constraintErrorMessage>
</properties>
Expand Down Expand Up @@ -976,6 +977,19 @@
<constraintErrorMessage>Invalid SSID</constraintErrorMessage>
</properties>
</leafNode>
<leafNode name="bssid">
<properties>
<help>Basic Service Set Identifier (BSSID) - currently station mode only</help>
<valueHelp>
<format>macaddr</format>
<description>BSSID (MAC) address</description>
</valueHelp>
<constraint>
<validator name="mac-address"/>
</constraint>
<constraintErrorMessage>Invalid BSSID</constraintErrorMessage>
</properties>
</leafNode>
<leafNode name="type">
<properties>
<help>Wireless device type for this interface</help>
Expand Down
9 changes: 8 additions & 1 deletion src/conf_mode/interfaces_wireless.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,11 +193,18 @@ def verify(wifi):
if not any(i in ['passphrase', 'radius'] for i in wpa):
raise ConfigError('Misssing WPA key or RADIUS server')

if 'username' in wpa:
if 'passphrase' not in wpa:
raise ConfigError('WPA-Enterprise configured - missing passphrase!')
elif 'passphrase' in wpa:
# check if passphrase meets the regex .{8,63}
if len(wpa['passphrase']) < 8 or len(wpa['passphrase']) > 63:
raise ConfigError('WPA passphrase must be between 8 and 63 characters long')
if 'radius' in wpa:
if 'server' in wpa['radius']:
for server in wpa['radius']['server']:
if 'key' not in wpa['radius']['server'][server]:
raise ConfigError(f'Misssing RADIUS shared secret key for server: {server}')
raise ConfigError(f'Missing RADIUS shared secret key for server: {server}')

if 'capabilities' in wifi:
capabilities = wifi['capabilities']
Expand Down
Loading