[PATCH] Add support for multiple Radius servers

[Matej Kupljen]

hostapd.conf supports specifying primary and more secondary Radius servers, but
UCI configuration does not.
This patch adds a list option for specifying Authentication and Accounting
servers and will convert them to hostapd.conf format.

As a filed separator between fields ';' has been selected and thus cannot be
used as a character in shared secret parameter. The format of the list is:

list 'secret;ip;port'

Signed-off-by: Matej Kupljen <matej.kupljen at gmail.com>
---
 .../network/services/hostapd/files/hostapd.sh | 41 +++++++++++++++++--
 1 file changed, 38 insertions(+), 3 deletions(-)

diff --git a/package/network/services/hostapd/files/hostapd.sh
b/package/network/services/hostapd/files/hostapd.sh
index f03b98ff85..9047d48a87 100644
--- a/package/network/services/hostapd/files/hostapd.sh
+++ b/package/network/services/hostapd/files/hostapd.sh
@@ -188,6 +188,9 @@ hostapd_common_add_bss_config() {
  config_add_string auth_secret
  config_add_int 'auth_port:port' 'port:port'

+ config_add_array auth_servers
+ config_add_array acct_servers
+
  config_add_string acct_server
  config_add_string acct_secret
  config_add_int acct_port
@@ -316,6 +319,8 @@ hostapd_set_bss_options() {
  }

  [ -n "$nasid" ] && append bss_conf "nas_identifier=$nasid" "$N"
+
+ # legacy compatibility
  [ -n "$acct_server" ] && {
  append bss_conf "acct_server_addr=$acct_server" "$N"
  append bss_conf "acct_server_port=$acct_port" "$N"
@@ -337,6 +342,20 @@ hostapd_set_bss_options() {
  esac
  [ -n "$sae_require_mfp" ] && append bss_conf
"sae_require_mfp=$sae_require_mfp" "$N"

+ # List of acct servers
+ json_get_values acct_servers_list acct_servers
+ for svr in $acct_servers_list; do
+ acct_secret=${svr%%;*}
+ svr=${svr#*;}
+ acct_server=${svr%%;*}
+ acct_port=${svr##*;}
+
+ set_default acct_port 1813
+ append bss_conf "acct_server_addr=$acct_server" "$N"
+ append bss_conf "acct_server_port=$acct_port" "$N"
+ append bss_conf "acct_server_shared_secret=$acct_secret" "$N"
+ done
+
  local vlan_possible=""

  case "$auth_type" in
@@ -387,10 +406,26 @@ hostapd_set_bss_options() {
  set_default auth_port 1812
  set_default dae_port 3799

+ # leave the default option for legacy compatibility
+ [ -n "$auth_server" ] && {
+ append bss_conf "auth_server_addr=$auth_server" "$N"
+ append bss_conf "auth_server_port=$auth_port" "$N"
+ append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+ }

- append bss_conf "auth_server_addr=$auth_server" "$N"
- append bss_conf "auth_server_port=$auth_port" "$N"
- append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+ # List of fallback RADIUS servers
+ json_get_values auth_servers_list auth_servers
+ for svr in $auth_servers_list; do
+ auth_secret=${svr%%;*}
+ svr=${svr#*;}
+ auth_server=${svr%%;*}
+ auth_port=${svr##*;}
+
+ set_default auth_port 1812
+ append bss_conf "auth_server_addr=$auth_server" "$N"
+ append bss_conf "auth_server_port=$auth_port" "$N"
+ append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+ done

  [ -n "$eap_reauth_period" ] && append bss_conf
"eap_reauth_period=$eap_reauth_period" "$N"

-- 
2.17.1

_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel