[OpenWrt-Devel] Add support for multiple Radius servers
diff mbox series

Message ID CAHMF36G6ykq3uZ5VUp99092byVV4fG8s6sp0EsBD+QDG8fyYMg@mail.gmail.com
State New
Headers show
Series
  • [OpenWrt-Devel] Add support for multiple Radius servers
Related show

Commit Message

Matej Kupljen Nov. 25, 2019, 3:10 p.m. UTC
Hi all,

this patch adds support for specifying multiple radius servers, since
hostapd supports it.

BR,
Matej

From b10c290b4847a96323f9470dc2aed51543f08ab3 Mon Sep 17 00:00:00 2001
From: Matej Kupljen <matej.kupljen@gmail.com>
Date: Mon, 25 Nov 2019 15:37:01 +0100
Subject: [PATCH] Add support for multiple Radius servers

hostapd.conf supports specifying primary and more secondary Radius servers, but
UCI configuration does not.
This patch adds a list option for specifying Authentication and Accounting
servers and will convert them to hostapd.conf format.

As a filed separator between fields ';' has been selected and thus cannot be
used as a character in shared secret parameter. The format of the list is:

list 'secret;ip;port'

Signed-off-by: Matej Kupljen <matej.kupljen@gmail.com>
---
 .../network/services/hostapd/files/hostapd.sh | 41 +++++++++++++++++--
 1 file changed, 38 insertions(+), 3 deletions(-)

  case "$auth_type" in
@@ -387,10 +406,26 @@ hostapd_set_bss_options() {
  set_default auth_port 1812
  set_default dae_port 3799

+ # leave the default option for legacy compatibility
+ [ -n "$auth_server" ] && {
+ append bss_conf "auth_server_addr=$auth_server" "$N"
+ append bss_conf "auth_server_port=$auth_port" "$N"
+ append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+ }

- append bss_conf "auth_server_addr=$auth_server" "$N"
- append bss_conf "auth_server_port=$auth_port" "$N"
- append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+ # List of fallback RADIUS servers
+ json_get_values auth_servers_list auth_servers
+ for svr in $auth_servers_list; do
+ auth_secret=${svr%%;*}
+ svr=${svr#*;}
+ auth_server=${svr%%;*}
+ auth_port=${svr##*;}
+
+ set_default auth_port 1812
+ append bss_conf "auth_server_addr=$auth_server" "$N"
+ append bss_conf "auth_server_port=$auth_port" "$N"
+ append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+ done

  [ -n "$eap_reauth_period" ] && append bss_conf
"eap_reauth_period=$eap_reauth_period" "$N"

Patch
diff mbox series

diff --git a/package/network/services/hostapd/files/hostapd.sh
b/package/network/services/hostapd/files/hostapd.sh
index f03b98ff85..9047d48a87 100644
--- a/package/network/services/hostapd/files/hostapd.sh
+++ b/package/network/services/hostapd/files/hostapd.sh
@@ -188,6 +188,9 @@  hostapd_common_add_bss_config() {
  config_add_string auth_secret
  config_add_int 'auth_port:port' 'port:port'

+ config_add_array auth_servers
+ config_add_array acct_servers
+
  config_add_string acct_server
  config_add_string acct_secret
  config_add_int acct_port
@@ -316,6 +319,8 @@  hostapd_set_bss_options() {
  }

  [ -n "$nasid" ] && append bss_conf "nas_identifier=$nasid" "$N"
+
+ # legacy compatibility
  [ -n "$acct_server" ] && {
  append bss_conf "acct_server_addr=$acct_server" "$N"
  append bss_conf "acct_server_port=$acct_port" "$N"
@@ -337,6 +342,20 @@  hostapd_set_bss_options() {
  esac
  [ -n "$sae_require_mfp" ] && append bss_conf
"sae_require_mfp=$sae_require_mfp" "$N"

+ # List of acct servers
+ json_get_values acct_servers_list acct_servers
+ for svr in $acct_servers_list; do
+ acct_secret=${svr%%;*}
+ svr=${svr#*;}
+ acct_server=${svr%%;*}
+ acct_port=${svr##*;}
+
+ set_default acct_port 1813
+ append bss_conf "acct_server_addr=$acct_server" "$N"
+ append bss_conf "acct_server_port=$acct_port" "$N"
+ append bss_conf "acct_server_shared_secret=$acct_secret" "$N"
+ done
+
  local vlan_possible=""