Hi all,
this patch adds support for specifying multiple radius servers, since
hostapd supports it.
BR,
Matej
>From b10c290b4847a96323f9470dc2aed51543f08ab3 Mon Sep 17 00:00:00 2001
From: Matej Kupljen <matej.kupl...@gmail.com>
Date: Mon, 25 Nov 2019 15:37:01 +0100
Subject: [PATCH] Add support for multiple Radius servers
hostapd.conf supports specifying primary and more secondary Radius servers, but
UCI configuration does not.
This patch adds a list option for specifying Authentication and Accounting
servers and will convert them to hostapd.conf format.
As a filed separator between fields ';' has been selected and thus cannot be
used as a character in shared secret parameter. The format of the list is:
list 'secret;ip;port'
Signed-off-by: Matej Kupljen <matej.kupl...@gmail.com>
---
.../network/services/hostapd/files/hostapd.sh | 41 +++++++++++++++++--
1 file changed, 38 insertions(+), 3 deletions(-)
diff --git a/package/network/services/hostapd/files/hostapd.sh
b/package/network/services/hostapd/files/hostapd.sh
index f03b98ff85..9047d48a87 100644
--- a/package/network/services/hostapd/files/hostapd.sh
+++ b/package/network/services/hostapd/files/hostapd.sh
@@ -188,6 +188,9 @@ hostapd_common_add_bss_config() {
config_add_string auth_secret
config_add_int 'auth_port:port' 'port:port'
+ config_add_array auth_servers
+ config_add_array acct_servers
+
config_add_string acct_server
config_add_string acct_secret
config_add_int acct_port
@@ -316,6 +319,8 @@ hostapd_set_bss_options() {
}
[ -n "$nasid" ] && append bss_conf "nas_identifier=$nasid" "$N"
+
+ # legacy compatibility
[ -n "$acct_server" ] && {
append bss_conf "acct_server_addr=$acct_server" "$N"
append bss_conf "acct_server_port=$acct_port" "$N"
@@ -337,6 +342,20 @@ hostapd_set_bss_options() {
esac
[ -n "$sae_require_mfp" ] && append bss_conf
"sae_require_mfp=$sae_require_mfp" "$N"
+ # List of acct servers
+ json_get_values acct_servers_list acct_servers
+ for svr in $acct_servers_list; do
+ acct_secret=${svr%%;*}
+ svr=${svr#*;}
+ acct_server=${svr%%;*}
+ acct_port=${svr##*;}
+
+ set_default acct_port 1813
+ append bss_conf "acct_server_addr=$acct_server" "$N"
+ append bss_conf "acct_server_port=$acct_port" "$N"
+ append bss_conf "acct_server_shared_secret=$acct_secret" "$N"
+ done
+
local vlan_possible=""
case "$auth_type" in
@@ -387,10 +406,26 @@ hostapd_set_bss_options() {
set_default auth_port 1812
set_default dae_port 3799
+ # leave the default option for legacy compatibility
+ [ -n "$auth_server" ] && {
+ append bss_conf "auth_server_addr=$auth_server" "$N"
+ append bss_conf "auth_server_port=$auth_port" "$N"
+ append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+ }
- append bss_conf "auth_server_addr=$auth_server" "$N"
- append bss_conf "auth_server_port=$auth_port" "$N"
- append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+ # List of fallback RADIUS servers
+ json_get_values auth_servers_list auth_servers
+ for svr in $auth_servers_list; do
+ auth_secret=${svr%%;*}
+ svr=${svr#*;}
+ auth_server=${svr%%;*}
+ auth_port=${svr##*;}
+
+ set_default auth_port 1812
+ append bss_conf "auth_server_addr=$auth_server" "$N"
+ append bss_conf "auth_server_port=$auth_port" "$N"
+ append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+ done
[ -n "$eap_reauth_period" ] && append bss_conf
"eap_reauth_period=$eap_reauth_period" "$N"
--
2.17.1
_______________________________________________
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
