Auth_type in hostapd.sh (WPA3)

parsley72 · October 5, 2019, 7:47pm

I've been looking at the code for hostapd in 19.07 but I can't figure out where the value auth_type is coming from:

openwrt/openwrt/blob/openwrt-19.07/package/network/services/hostapd/files/hostapd.sh#L40


			done
			wep_keyidx=$((key - 1))
		;;
		*)
			append $var "wep_key0=$(prepare_key_wep "$key")" "$N$T"
		;;
	esac
}


hostapd_append_wpa_key_mgmt() {
	local auth_type_l="$(echo $auth_type | tr 'a-z' 'A-Z')"


	case "$auth_type" in
		psk|eap)
			append wpa_key_mgmt "WPA-$auth_type_l"
			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type_l}"
			[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-${auth_type_l}-SHA256"
		;;
		eap192)
			append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
		;;

Can someone give me a hint?

Thanks.

hnyman · October 5, 2019, 8:14pm

Took a few minutes to figure it out, but it comes from lib/netifd/netifd-wireless.sh via the function wireless_vif_parse_encryption that is called in the functions that access auth_type (or by the functions that call the functions using auth_type).

The source is in the netifd package source, not in the main OpenWrt source:
https://git.openwrt.org/?p=project/netifd.git;a=blob;f=scripts/netifd-wireless.sh;h=6bc48c6a3f1c6cf7dc8219f189df4c31ab3cd656;hb=HEAD#l191

parsley72 · October 6, 2019, 6:16pm

I was trying to follow @est31's instructions but on 19.07:

gist.github.com

https://gist.github.com/est31/d92d17acbb4ea152296f9b38764cd791

wpa3-project.md

# Trying to deploy WPA3 on my home network

## Introduction

Recently, news broke about a new possible offline attack on WPA2 [using PMKID](https://hashcat.net/forum/thread-7717.html). To summarize the attack, WPA2 protected APs can end up broadcasting PMKID values which can then be used to offline-brute-force the password.

These PMKID values are computed this way:
```
PMKID = HMAC-SHA1-128(PMK, "PMK Name" | MAC_AP | MAC_STA)
```

This file has been truncated. show original

They added append wpa_key_mgmt "SAE" to hostapd_append_wpa_key_mgmt(). I thought 19.07 would set this automatically but no. I was trying to go upstream but this comes from json_get_vars encryption. Does anyone know how to enable WPA3 on 19.07?

Thanks.

hnyman · October 6, 2019, 6:22pm

If you want WPA3, use the current master. There the support works ok and also LuCI supports WPA3. Discussion e.g. in Wpa3 support in OpenWrt? - #91 by knacky

The support in 19.07 is not complete. @jow has done effort in fixing things in LuCI and the supporting packages in master, but some of those fixes (e.g. for rpcd, iwinfo) have not yet been backported to 19.07.

parsley72 · October 6, 2019, 7:11pm

I tried installing master but LuCI didn't work. I'm doing a talk about WPA3 at the end of the week and was hoping to have a demo. I've got 18.06 running with SAE but was hoping to get something better.

castillofrancodamian · October 6, 2019, 8:08pm

ar71xx does not work in snapshots, if you are using it.

parsley72 · October 6, 2019, 8:49pm

Ah right, I'm using a Netgear WNDR3700 v1.

So is it possible to turn on WPA3 in 19.07?

lantis1008 · October 6, 2019, 9:33pm

Yes, just use UCI to set encryption to "sae" and everything else is handled.

Are you seeing different behaviour?

parsley72 · October 7, 2019, 12:34am

I tried editing /etc/config/wireless directly, that didn't seem to work. I'll try UCI tonight - I assume it's:
uci set wireless.@wifi-iface[0].encryption=sae

lantis1008 · October 7, 2019, 1:05am

That should do it.
I've personally got mine set to "sae-mixed" for non WPA3 aware devices as well.

hnyman · October 7, 2019, 4:55am

In that case you could use my community build for the wndr3700 series.

The master build has LuCI and has the up-to-date support for wpa3.

ar71xx-master-r11159-27bf8abe69-20191005

parsley72 · October 7, 2019, 8:49am

Thanks @hnyman that seems to be working well. It died when I tried turning on 5GHz as well so I had to factory reset and start again, but 2.4GHz seems to be working fine.

@lantis1008 the point of the demo is to setup a WPA3 network so people can see how their devices fail to connect, but thanks for the info.