[OpenWrt-Devel] hostapd: enable PMKSA and OK caching for WPA3-Personal
diff mbox series

Message ID 20191029224203.203330-1-mail@david-bauer.net
State Accepted
Delegated to: David Bauer
Headers show
Series
  • [OpenWrt-Devel] hostapd: enable PMKSA and OK caching for WPA3-Personal
Related show

Commit Message

David Bauer Oct. 29, 2019, 10:42 p.m. UTC
This enables PMKSA and opportunistic key caching by default for
WPA2/WPA3-Personal, WPA3-Personal and OWE auth types.
Otherwise, Apple devices won't connect to the WPA3 network.

This should not degrade security, as there's no external authentication
provider.

Tested with OCEDO Koala and iPhone 7 (iOS 13.1).

Signed-off-by: David Bauer <mail@david-bauer.net>
---
 package/network/services/hostapd/files/hostapd.sh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

Comments

Hauke Mehrtens Oct. 30, 2019, 7:47 p.m. UTC | #1
On 10/29/19 11:42 PM, David Bauer wrote:
> This enables PMKSA and opportunistic key caching by default for
> WPA2/WPA3-Personal, WPA3-Personal and OWE auth types.
> Otherwise, Apple devices won't connect to the WPA3 network.
> 
> This should not degrade security, as there's no external authentication
> provider.
> 
> Tested with OCEDO Koala and iPhone 7 (iOS 13.1).
> 
> Signed-off-by: David Bauer <mail@david-bauer.net>

Do you know which, PMKSA or OKC, is needed for the iPhone?

I do not understand why the iPhone only works when one of these options
is set, you should probably ask on the hostapd mailing list for help,
this could be also a bug in hostapd.

> ---
>  package/network/services/hostapd/files/hostapd.sh | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh
> index 8da8539e8a..fdbce815df 100644
> --- a/package/network/services/hostapd/files/hostapd.sh
> +++ b/package/network/services/hostapd/files/hostapd.sh
> @@ -540,7 +540,14 @@ hostapd_set_bss_options() {
>  			append bss_conf "rsn_preauth=1" "$N"
>  			append bss_conf "rsn_preauth_interfaces=$network_bridge" "$N"
>  		else
> -			set_default auth_cache 0
> +			case "$auth_type" in
> +			sae|psk-sae|owe)
> +				set_default auth_cache 1
> +			;;
> +			*)
> +				set_default auth_cache 0
> +			;;
> +			esac
>  		fi
>  
>  		append bss_conf "okc=$auth_cache" "$N"
>
David Bauer Oct. 30, 2019, 10 p.m. UTC | #2
Hello Hauke,

On 10/30/19 8:47 PM, Hauke Mehrtens wrote:
> Do you know which, PMKSA or OKC, is needed for the iPhone?

PMKSA caching is the one required to work with the iPhone (however OKC should not be harmful).

> 
> I do not understand why the iPhone only works when one of these options
> is set, you should probably ask on the hostapd mailing list for help,
> this could be also a bug in hostapd.

This is due to the fact, that Apple sends the PMKID in the first association request
(before the EAPOL handshake).

In case PMKID caching is disabled, the association is rejected at this point.

An OpenWrt / Android (probably all wpa_supplicant based clients without sae_pmkid_in_assoc
enabled) will send an empty PMKID list, thus not triggering the issue.

As the PMKID in association seems not to be against the spec, we either have to

a) ignore the PMKID list in the association request
b) enable caching for WPA3-personal / OWE

(I'm not an expert in this field, so feel free to point out wrong assumptions here)

Best wishes
David

> 
>> ---
>>  package/network/services/hostapd/files/hostapd.sh | 9 ++++++++-
>>  1 file changed, 8 insertions(+), 1 deletion(-)
>>
>> diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh
>> index 8da8539e8a..fdbce815df 100644
>> --- a/package/network/services/hostapd/files/hostapd.sh
>> +++ b/package/network/services/hostapd/files/hostapd.sh
>> @@ -540,7 +540,14 @@ hostapd_set_bss_options() {
>>  			append bss_conf "rsn_preauth=1" "$N"
>>  			append bss_conf "rsn_preauth_interfaces=$network_bridge" "$N"
>>  		else
>> -			set_default auth_cache 0
>> +			case "$auth_type" in
>> +			sae|psk-sae|owe)
>> +				set_default auth_cache 1
>> +			;;
>> +			*)
>> +				set_default auth_cache 0
>> +			;;
>> +			esac
>>  		fi
>>  
>>  		append bss_conf "okc=$auth_cache" "$N"
>>
> 
>

Patch
diff mbox series

diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh
index 8da8539e8a..fdbce815df 100644
--- a/package/network/services/hostapd/files/hostapd.sh
+++ b/package/network/services/hostapd/files/hostapd.sh
@@ -540,7 +540,14 @@  hostapd_set_bss_options() {
 			append bss_conf "rsn_preauth=1" "$N"
 			append bss_conf "rsn_preauth_interfaces=$network_bridge" "$N"
 		else
-			set_default auth_cache 0
+			case "$auth_type" in
+			sae|psk-sae|owe)
+				set_default auth_cache 1
+			;;
+			*)
+				set_default auth_cache 0
+			;;
+			esac
 		fi
 
 		append bss_conf "okc=$auth_cache" "$N"