luci-base: raise maximum POST value size to 100KB
[project/luci.git] / modules / luci-mod-admin-full / luasrc / model / cbi / admin_network / wifi.lua
1 -- Copyright 2008 Steven Barth <steven@midlink.org>
2 -- Licensed to the public under the Apache License 2.0.
3
4 local wa = require "luci.tools.webadmin"
5 local nw = require "luci.model.network"
6 local ut = require "luci.util"
7 local nt = require "luci.sys".net
8 local fs = require "nixio.fs"
9
10 arg[1] = arg[1] or ""
11
12 m = Map("wireless", "",
13         translate("The <em>Device Configuration</em> section covers physical settings of the radio " ..
14                 "hardware such as channel, transmit power or antenna selection which are shared among all " ..
15                 "defined wireless networks (if the radio hardware is multi-SSID capable). Per network settings " ..
16                 "like encryption or operation mode are grouped in the <em>Interface Configuration</em>."))
17
18 m:chain("network")
19 m:chain("firewall")
20 m.redirect = luci.dispatcher.build_url("admin/network/wireless")
21
22 local ifsection
23
24 function m.on_commit(map)
25         local wnet = nw:get_wifinet(arg[1])
26         if ifsection and wnet then
27                 ifsection.section = wnet.sid
28                 m.title = luci.util.pcdata(wnet:get_i18n())
29         end
30 end
31
32 nw.init(m.uci)
33
34 local wnet = nw:get_wifinet(arg[1])
35 local wdev = wnet and wnet:get_device()
36
37 -- redirect to overview page if network does not exist anymore (e.g. after a revert)
38 if not wnet or not wdev then
39         luci.http.redirect(luci.dispatcher.build_url("admin/network/wireless"))
40         return
41 end
42
43 -- wireless toggle was requested, commit and reload page
44 function m.parse(map)
45         local new_cc = m:formvalue("cbid.wireless.%s.country" % wdev:name())
46         local old_cc = m:get(wdev:name(), "country")
47
48         if m:formvalue("cbid.wireless.%s.__toggle" % wdev:name()) then
49                 if wdev:get("disabled") == "1" or wnet:get("disabled") == "1" then
50                         wnet:set("disabled", nil)
51                 else
52                         wnet:set("disabled", "1")
53                 end
54                 wdev:set("disabled", nil)
55
56                 nw:commit("wireless")
57                 luci.sys.call("(env -i /bin/ubus call network reload) >/dev/null 2>/dev/null")
58
59                 luci.http.redirect(luci.dispatcher.build_url("admin/network/wireless", arg[1]))
60                 return
61         end
62
63         Map.parse(map)
64
65         if m:get(wdev:name(), "type") == "mac80211" and new_cc and new_cc ~= old_cc then
66                 luci.sys.call("iw reg set %s" % ut.shellquote(new_cc))
67                 luci.http.redirect(luci.dispatcher.build_url("admin/network/wireless", arg[1]))
68                 return
69         end
70 end
71
72 m.title = luci.util.pcdata(wnet:get_i18n())
73
74
75 local function txpower_list(iw)
76         local list = iw.txpwrlist or { }
77         local off  = tonumber(iw.txpower_offset) or 0
78         local new  = { }
79         local prev = -1
80         local _, val
81         for _, val in ipairs(list) do
82                 local dbm = val.dbm + off
83                 local mw  = math.floor(10 ^ (dbm / 10))
84                 if mw ~= prev then
85                         prev = mw
86                         new[#new+1] = {
87                                 display_dbm = dbm,
88                                 display_mw  = mw,
89                                 driver_dbm  = val.dbm,
90                                 driver_mw   = val.mw
91                         }
92                 end
93         end
94         return new
95 end
96
97 local function txpower_current(pwr, list)
98         pwr = tonumber(pwr)
99         if pwr ~= nil then
100                 local _, item
101                 for _, item in ipairs(list) do
102                         if item.driver_dbm >= pwr then
103                                 return item.driver_dbm
104                         end
105                 end
106         end
107         return pwr or ""
108 end
109
110 local iw = luci.sys.wifi.getiwinfo(arg[1])
111 local hw_modes      = iw.hwmodelist or { }
112 local tx_power_list = txpower_list(iw)
113 local tx_power_cur  = txpower_current(wdev:get("txpower"), tx_power_list)
114
115 s = m:section(NamedSection, wdev:name(), "wifi-device", translate("Device Configuration"))
116 s.addremove = false
117
118 s:tab("general", translate("General Setup"))
119 s:tab("macfilter", translate("MAC-Filter"))
120 s:tab("advanced", translate("Advanced Settings"))
121
122 --[[
123 back = s:option(DummyValue, "_overview", translate("Overview"))
124 back.value = ""
125 back.titleref = luci.dispatcher.build_url("admin", "network", "wireless")
126 ]]
127
128 st = s:taboption("general", DummyValue, "__status", translate("Status"))
129 st.template = "admin_network/wifi_status"
130 st.ifname   = arg[1]
131
132 en = s:taboption("general", Button, "__toggle")
133
134 if wdev:get("disabled") == "1" or wnet:get("disabled") == "1" then
135         en.title      = translate("Wireless network is disabled")
136         en.inputtitle = translate("Enable")
137         en.inputstyle = "apply"
138 else
139         en.title      = translate("Wireless network is enabled")
140         en.inputtitle = translate("Disable")
141         en.inputstyle = "reset"
142 end
143
144
145 local hwtype = wdev:get("type")
146
147 -- NanoFoo
148 local nsantenna = wdev:get("antenna")
149
150 -- Check whether there are client interfaces on the same radio,
151 -- if yes, lock the channel choice as these stations will dicatate the freq
152 local found_sta = nil
153 local _, net
154 if wnet:mode() ~= "sta" then
155         for _, net in ipairs(wdev:get_wifinets()) do
156                 if net:mode() == "sta" and net:get("disabled") ~= "1" then
157                         if not found_sta then
158                                 found_sta = {}
159                                 found_sta.channel = net:channel()
160                                 found_sta.names = {}
161                         end
162                         found_sta.names[#found_sta.names+1] = net:shortname()
163                 end
164         end
165 end
166
167 if found_sta then
168         ch = s:taboption("general", DummyValue, "choice", translate("Channel"))
169         ch.value = translatef("Locked to channel %s used by: %s",
170                 found_sta.channel or "(auto)", table.concat(found_sta.names, ", "))
171 else
172         ch = s:taboption("general", Value, "_mode_freq", '<br />'..translate("Operating frequency"))
173         ch.hwmodes = hw_modes
174         ch.htmodes = iw.htmodelist
175         ch.freqlist = iw.freqlist
176         ch.template = "cbi/wireless_modefreq"
177
178         function ch.cfgvalue(self, section)
179                 return {
180                         m:get(section, "hwmode") or "",
181                         m:get(section, "channel") or "auto",
182                         m:get(section, "htmode") or ""
183                 }
184         end
185
186         function ch.formvalue(self, section)
187                 return {
188                         m:formvalue(self:cbid(section) .. ".band") or (hw_modes.g and "11g" or "11a"),
189                         m:formvalue(self:cbid(section) .. ".channel") or "auto",
190                         m:formvalue(self:cbid(section) .. ".htmode") or ""
191                 }
192         end
193
194         function ch.write(self, section, value)
195                 m:set(section, "hwmode", value[1])
196                 m:set(section, "channel", value[2])
197                 m:set(section, "htmode", value[3])
198         end
199 end
200
201 ------------------- MAC80211 Device ------------------
202
203 if hwtype == "mac80211" then
204         if #tx_power_list > 0 then
205                 tp = s:taboption("general", ListValue,
206                         "txpower", translate("Transmit Power"), "dBm")
207                 tp.rmempty = true
208                 tp.default = tx_power_cur
209                 function tp.cfgvalue(...)
210                         return txpower_current(Value.cfgvalue(...), tx_power_list)
211                 end
212
213                 tp:value("", translate("auto"))
214                 for _, p in ipairs(tx_power_list) do
215                         tp:value(p.driver_dbm, "%i dBm (%i mW)"
216                                 %{ p.display_dbm, p.display_mw })
217                 end
218         end
219
220         local cl = iw and iw.countrylist
221         if cl and #cl > 0 then
222                 cc = s:taboption("advanced", ListValue, "country", translate("Country Code"), translate("Use ISO/IEC 3166 alpha2 country codes."))
223                 cc.default = tostring(iw and iw.country or "00")
224                 for _, c in ipairs(cl) do
225                         cc:value(c.alpha2, "%s - %s" %{ c.alpha2, c.name })
226                 end
227         else
228                 s:taboption("advanced", Value, "country", translate("Country Code"), translate("Use ISO/IEC 3166 alpha2 country codes."))
229         end
230
231         legacyrates = s:taboption("advanced", Flag, "legacy_rates", translate("Allow legacy 802.11b rates"))
232         legacyrates.rmempty = false
233         legacyrates.default = "1"
234
235         s:taboption("advanced", Value, "distance", translate("Distance Optimization"),
236                 translate("Distance to farthest network member in meters."))
237
238         -- external antenna profiles
239         local eal = iw and iw.extant
240         if eal and #eal > 0 then
241                 ea = s:taboption("advanced", ListValue, "extant", translate("Antenna Configuration"))
242                 for _, eap in ipairs(eal) do
243                         ea:value(eap.id, "%s (%s)" %{ eap.name, eap.description })
244                         if eap.selected then
245                                 ea.default = eap.id
246                         end
247                 end
248         end
249
250         s:taboption("advanced", Value, "frag", translate("Fragmentation Threshold"))
251         s:taboption("advanced", Value, "rts", translate("RTS/CTS Threshold"))
252 end
253
254
255 ------------------- Broadcom Device ------------------
256
257 if hwtype == "broadcom" then
258         tp = s:taboption("general",
259                 (#tx_power_list > 0) and ListValue or Value,
260                 "txpower", translate("Transmit Power"), "dBm")
261
262         tp.rmempty = true
263         tp.default = tx_power_cur
264
265         function tp.cfgvalue(...)
266                 return txpower_current(Value.cfgvalue(...), tx_power_list)
267         end
268
269         tp:value("", translate("auto"))
270         for _, p in ipairs(tx_power_list) do
271                 tp:value(p.driver_dbm, "%i dBm (%i mW)"
272                         %{ p.display_dbm, p.display_mw })
273         end
274
275         mode = s:taboption("advanced", ListValue, "hwmode", translate("Band"))
276         if hw_modes.b then
277                 mode:value("11b", "2.4GHz (802.11b)")
278                 if hw_modes.g then
279                         mode:value("11bg", "2.4GHz (802.11b+g)")
280                 end
281         end
282         if hw_modes.g then
283                 mode:value("11g", "2.4GHz (802.11g)")
284                 mode:value("11gst", "2.4GHz (802.11g + Turbo)")
285                 mode:value("11lrs", "2.4GHz (802.11g Limited Rate Support)")
286         end
287         if hw_modes.a then mode:value("11a", "5GHz (802.11a)") end
288         if hw_modes.n then
289                 if hw_modes.g then
290                         mode:value("11ng", "2.4GHz (802.11g+n)")
291                         mode:value("11n", "2.4GHz (802.11n)")
292                 end
293                 if hw_modes.a then
294                         mode:value("11na", "5GHz (802.11a+n)")
295                         mode:value("11n", "5GHz (802.11n)")
296                 end
297                 htmode = s:taboption("advanced", ListValue, "htmode", translate("HT mode (802.11n)"))
298                 htmode:depends("hwmode", "11ng")
299                 htmode:depends("hwmode", "11na")
300                 htmode:depends("hwmode", "11n")
301                 htmode:value("HT20", "20MHz")
302                 htmode:value("HT40", "40MHz")
303         end
304
305         ant1 = s:taboption("advanced", ListValue, "txantenna", translate("Transmitter Antenna"))
306         ant1.widget = "radio"
307         ant1:depends("diversity", "")
308         ant1:value("3", translate("auto"))
309         ant1:value("0", translate("Antenna 1"))
310         ant1:value("1", translate("Antenna 2"))
311
312         ant2 = s:taboption("advanced", ListValue, "rxantenna", translate("Receiver Antenna"))
313         ant2.widget = "radio"
314         ant2:depends("diversity", "")
315         ant2:value("3", translate("auto"))
316         ant2:value("0", translate("Antenna 1"))
317         ant2:value("1", translate("Antenna 2"))
318
319         s:taboption("advanced", Flag, "frameburst", translate("Frame Bursting"))
320
321         s:taboption("advanced", Value, "distance", translate("Distance Optimization"))
322         --s:option(Value, "slottime", translate("Slot time"))
323
324         s:taboption("advanced", Value, "country", translate("Country Code"))
325         s:taboption("advanced", Value, "maxassoc", translate("Connection Limit"))
326 end
327
328
329 --------------------- HostAP Device ---------------------
330
331 if hwtype == "prism2" then
332         s:taboption("advanced", Value, "txpower", translate("Transmit Power"), "att units").rmempty = true
333
334         s:taboption("advanced", Flag, "diversity", translate("Diversity")).rmempty = false
335
336         s:taboption("advanced", Value, "txantenna", translate("Transmitter Antenna"))
337         s:taboption("advanced", Value, "rxantenna", translate("Receiver Antenna"))
338 end
339
340
341 ----------------------- Interface -----------------------
342
343 s = m:section(NamedSection, wnet.sid, "wifi-iface", translate("Interface Configuration"))
344 ifsection = s
345 s.addremove = false
346 s.anonymous = true
347 s.defaults.device = wdev:name()
348
349 s:tab("general", translate("General Setup"))
350 s:tab("encryption", translate("Wireless Security"))
351 s:tab("macfilter", translate("MAC-Filter"))
352 s:tab("advanced", translate("Advanced Settings"))
353
354 mode = s:taboption("general", ListValue, "mode", translate("Mode"))
355 mode.override_values = true
356 mode:value("ap", translate("Access Point"))
357 mode:value("sta", translate("Client"))
358 mode:value("adhoc", translate("Ad-Hoc"))
359
360 meshid = s:taboption("general", Value, "mesh_id", translate("Mesh Id"))
361 meshid:depends({mode="mesh"})
362
363 meshfwd = s:taboption("advanced", Flag, "mesh_fwding", translate("Forward mesh peer traffic"))
364 meshfwd.rmempty = false
365 meshfwd.default = "1"
366 meshfwd:depends({mode="mesh"})
367
368 ssid = s:taboption("general", Value, "ssid", translate("<abbr title=\"Extended Service Set Identifier\">ESSID</abbr>"))
369 ssid.datatype = "maxlength(32)"
370 ssid:depends({mode="ap"})
371 ssid:depends({mode="sta"})
372 ssid:depends({mode="adhoc"})
373 ssid:depends({mode="ahdemo"})
374 ssid:depends({mode="monitor"})
375 ssid:depends({mode="ap-wds"})
376 ssid:depends({mode="sta-wds"})
377 ssid:depends({mode="wds"})
378
379 bssid = s:taboption("general", Value, "bssid", translate("<abbr title=\"Basic Service Set Identifier\">BSSID</abbr>"))
380
381 network = s:taboption("general", Value, "network", translate("Network"),
382         translate("Choose the network(s) you want to attach to this wireless interface or " ..
383                 "fill out the <em>create</em> field to define a new network."))
384
385 network.rmempty = true
386 network.template = "cbi/network_netlist"
387 network.widget = "checkbox"
388 network.novirtual = true
389
390 function network.write(self, section, value)
391         local i = nw:get_interface(section)
392         if i then
393                 if value == '-' then
394                         value = m:formvalue(self:cbid(section) .. ".newnet")
395                         if value and #value > 0 then
396                                 local n = nw:add_network(value, {proto="none"})
397                                 if n then n:add_interface(i) end
398                         else
399                                 local n = i:get_network()
400                                 if n then n:del_interface(i) end
401                         end
402                 else
403                         local v
404                         for _, v in ipairs(i:get_networks()) do
405                                 v:del_interface(i)
406                         end
407                         for v in ut.imatch(value) do
408                                 local n = nw:get_network(v)
409                                 if n then
410                                         if not n:is_empty() then
411                                                 n:set("type", "bridge")
412                                         end
413                                         n:add_interface(i)
414                                 end
415                         end
416                 end
417         end
418 end
419
420 -------------------- MAC80211 Interface ----------------------
421
422 if hwtype == "mac80211" then
423         if fs.access("/usr/sbin/iw") then
424                 mode:value("mesh", "802.11s")
425         end
426
427         mode:value("ahdemo", translate("Pseudo Ad-Hoc (ahdemo)"))
428         mode:value("monitor", translate("Monitor"))
429         bssid:depends({mode="adhoc"})
430         bssid:depends({mode="sta"})
431         bssid:depends({mode="sta-wds"})
432
433         mp = s:taboption("macfilter", ListValue, "macfilter", translate("MAC-Address Filter"))
434         mp:depends({mode="ap"})
435         mp:depends({mode="ap-wds"})
436         mp:value("", translate("disable"))
437         mp:value("allow", translate("Allow listed only"))
438         mp:value("deny", translate("Allow all except listed"))
439
440         ml = s:taboption("macfilter", DynamicList, "maclist", translate("MAC-List"))
441         ml.datatype = "macaddr"
442         ml:depends({macfilter="allow"})
443         ml:depends({macfilter="deny"})
444         nt.mac_hints(function(mac, name) ml:value(mac, "%s (%s)" %{ mac, name }) end)
445
446         mode:value("ap-wds", "%s (%s)" % {translate("Access Point"), translate("WDS")})
447         mode:value("sta-wds", "%s (%s)" % {translate("Client"), translate("WDS")})
448
449         function mode.write(self, section, value)
450                 if value == "ap-wds" then
451                         ListValue.write(self, section, "ap")
452                         m.uci:set("wireless", section, "wds", 1)
453                 elseif value == "sta-wds" then
454                         ListValue.write(self, section, "sta")
455                         m.uci:set("wireless", section, "wds", 1)
456                 else
457                         ListValue.write(self, section, value)
458                         m.uci:delete("wireless", section, "wds")
459                 end
460         end
461
462         function mode.cfgvalue(self, section)
463                 local mode = ListValue.cfgvalue(self, section)
464                 local wds  = m.uci:get("wireless", section, "wds") == "1"
465
466                 if mode == "ap" and wds then
467                         return "ap-wds"
468                 elseif mode == "sta" and wds then
469                         return "sta-wds"
470                 else
471                         return mode
472                 end
473         end
474
475         hidden = s:taboption("general", Flag, "hidden", translate("Hide <abbr title=\"Extended Service Set Identifier\">ESSID</abbr>"))
476         hidden:depends({mode="ap"})
477         hidden:depends({mode="ap-wds"})
478
479         wmm = s:taboption("general", Flag, "wmm", translate("WMM Mode"))
480         wmm:depends({mode="ap"})
481         wmm:depends({mode="ap-wds"})
482         wmm.default = wmm.enabled
483
484         isolate = s:taboption("advanced", Flag, "isolate", translate("Isolate Clients"),
485          translate("Prevents client-to-client communication"))
486         isolate:depends({mode="ap"})
487         isolate:depends({mode="ap-wds"})
488
489         ifname = s:taboption("advanced", Value, "ifname", translate("Interface name"), translate("Override default interface name"))
490         ifname.optional = true
491 end
492
493
494 -------------------- Broadcom Interface ----------------------
495
496 if hwtype == "broadcom" then
497         mode:value("wds", translate("WDS"))
498         mode:value("monitor", translate("Monitor"))
499
500         hidden = s:taboption("general", Flag, "hidden", translate("Hide <abbr title=\"Extended Service Set Identifier\">ESSID</abbr>"))
501         hidden:depends({mode="ap"})
502         hidden:depends({mode="adhoc"})
503         hidden:depends({mode="wds"})
504
505         isolate = s:taboption("advanced", Flag, "isolate", translate("Separate Clients"),
506          translate("Prevents client-to-client communication"))
507         isolate:depends({mode="ap"})
508
509         s:taboption("advanced", Flag, "doth", "802.11h")
510         s:taboption("advanced", Flag, "wmm", translate("WMM Mode"))
511
512         bssid:depends({mode="wds"})
513         bssid:depends({mode="adhoc"})
514 end
515
516
517 ----------------------- HostAP Interface ---------------------
518
519 if hwtype == "prism2" then
520         mode:value("wds", translate("WDS"))
521         mode:value("monitor", translate("Monitor"))
522
523         hidden = s:taboption("general", Flag, "hidden", translate("Hide <abbr title=\"Extended Service Set Identifier\">ESSID</abbr>"))
524         hidden:depends({mode="ap"})
525         hidden:depends({mode="adhoc"})
526         hidden:depends({mode="wds"})
527
528         bssid:depends({mode="sta"})
529
530         mp = s:taboption("macfilter", ListValue, "macpolicy", translate("MAC-Address Filter"))
531         mp:value("", translate("disable"))
532         mp:value("allow", translate("Allow listed only"))
533         mp:value("deny", translate("Allow all except listed"))
534         ml = s:taboption("macfilter", DynamicList, "maclist", translate("MAC-List"))
535         ml:depends({macpolicy="allow"})
536         ml:depends({macpolicy="deny"})
537         nt.mac_hints(function(mac, name) ml:value(mac, "%s (%s)" %{ mac, name }) end)
538
539         s:taboption("advanced", Value, "rate", translate("Transmission Rate"))
540         s:taboption("advanced", Value, "frag", translate("Fragmentation Threshold"))
541         s:taboption("advanced", Value, "rts", translate("RTS/CTS Threshold"))
542 end
543
544
545 ------------------- WiFI-Encryption -------------------
546
547 encr = s:taboption("encryption", ListValue, "encryption", translate("Encryption"))
548 encr.override_values = true
549 encr.override_depends = true
550 encr:depends({mode="ap"})
551 encr:depends({mode="sta"})
552 encr:depends({mode="adhoc"})
553 encr:depends({mode="ahdemo"})
554 encr:depends({mode="ap-wds"})
555 encr:depends({mode="sta-wds"})
556 encr:depends({mode="mesh"})
557
558 cipher = s:taboption("encryption", ListValue, "cipher", translate("Cipher"))
559 cipher:depends({encryption="wpa"})
560 cipher:depends({encryption="wpa2"})
561 cipher:depends({encryption="psk"})
562 cipher:depends({encryption="psk2"})
563 cipher:depends({encryption="wpa-mixed"})
564 cipher:depends({encryption="psk-mixed"})
565 cipher:value("auto", translate("auto"))
566 cipher:value("ccmp", translate("Force CCMP (AES)"))
567 cipher:value("tkip", translate("Force TKIP"))
568 cipher:value("tkip+ccmp", translate("Force TKIP and CCMP (AES)"))
569
570 function encr.cfgvalue(self, section)
571         local v = tostring(ListValue.cfgvalue(self, section))
572         if v == "wep" then
573                 return "wep-open"
574         elseif v and v:match("%+") then
575                 return (v:gsub("%+.+$", ""))
576         end
577         return v
578 end
579
580 function encr.write(self, section, value)
581         local e = tostring(encr:formvalue(section))
582         local c = tostring(cipher:formvalue(section))
583         if value == "wpa" or value == "wpa2"  then
584                 self.map.uci:delete("wireless", section, "key")
585         end
586         if e and (c == "tkip" or c == "ccmp" or c == "tkip+ccmp") then
587                 e = e .. "+" .. c
588         end
589         self.map:set(section, "encryption", e)
590 end
591
592 function cipher.cfgvalue(self, section)
593         local v = tostring(ListValue.cfgvalue(encr, section))
594         if v and v:match("%+") then
595                 v = v:gsub("^[^%+]+%+", "")
596                 if v == "aes" then v = "ccmp"
597                 elseif v == "tkip+aes" then v = "tkip+ccmp"
598                 elseif v == "aes+tkip" then v = "tkip+ccmp"
599                 elseif v == "ccmp+tkip" then v = "tkip+ccmp"
600                 end
601         end
602         return v
603 end
604
605 function cipher.write(self, section)
606         return encr:write(section)
607 end
608
609
610 encr:value("none", "No Encryption")
611 encr:value("wep-open",   translate("WEP Open System"), {mode="ap"}, {mode="sta"}, {mode="ap-wds"}, {mode="sta-wds"}, {mode="adhoc"}, {mode="ahdemo"}, {mode="wds"})
612 encr:value("wep-shared", translate("WEP Shared Key"),  {mode="ap"}, {mode="sta"}, {mode="ap-wds"}, {mode="sta-wds"}, {mode="adhoc"}, {mode="ahdemo"}, {mode="wds"})
613
614 if hwtype == "mac80211" or hwtype == "prism2" then
615         local supplicant = fs.access("/usr/sbin/wpa_supplicant")
616         local hostapd = fs.access("/usr/sbin/hostapd")
617
618         -- Probe EAP support
619         local has_ap_eap  = (os.execute("hostapd -veap >/dev/null 2>/dev/null") == 0)
620         local has_sta_eap = (os.execute("wpa_supplicant -veap >/dev/null 2>/dev/null") == 0)
621
622         if hostapd and supplicant then
623                 encr:value("psk", "WPA-PSK", {mode="ap"}, {mode="sta"}, {mode="ap-wds"}, {mode="sta-wds"}, {mode="adhoc"})
624                 encr:value("psk2", "WPA2-PSK", {mode="ap"}, {mode="sta"}, {mode="ap-wds"}, {mode="sta-wds"}, {mode="adhoc"})
625                 encr:value("psk-mixed", "WPA-PSK/WPA2-PSK Mixed Mode", {mode="ap"}, {mode="sta"}, {mode="ap-wds"}, {mode="sta-wds"}, {mode="adhoc"})
626                 if has_ap_eap and has_sta_eap then
627                         encr:value("wpa", "WPA-EAP", {mode="ap"}, {mode="sta"}, {mode="ap-wds"}, {mode="sta-wds"})
628                         encr:value("wpa2", "WPA2-EAP", {mode="ap"}, {mode="sta"}, {mode="ap-wds"}, {mode="sta-wds"})
629                 end
630         elseif hostapd and not supplicant then
631                 encr:value("psk", "WPA-PSK", {mode="ap"}, {mode="ap-wds"})
632                 encr:value("psk2", "WPA2-PSK", {mode="ap"}, {mode="ap-wds"})
633                 encr:value("psk-mixed", "WPA-PSK/WPA2-PSK Mixed Mode", {mode="ap"}, {mode="ap-wds"})
634                 if has_ap_eap then
635                         encr:value("wpa", "WPA-EAP", {mode="ap"}, {mode="ap-wds"})
636                         encr:value("wpa2", "WPA2-EAP", {mode="ap"}, {mode="ap-wds"})
637                 end
638                 encr.description = translate(
639                         "WPA-Encryption requires wpa_supplicant (for client mode) or hostapd (for AP " ..
640                         "and ad-hoc mode) to be installed."
641                 )
642         elseif not hostapd and supplicant then
643                 encr:value("psk", "WPA-PSK", {mode="sta"}, {mode="sta-wds"}, {mode="adhoc"})
644                 encr:value("psk2", "WPA2-PSK", {mode="sta"}, {mode="sta-wds"}, {mode="adhoc"})
645                 encr:value("psk-mixed", "WPA-PSK/WPA2-PSK Mixed Mode", {mode="sta"}, {mode="sta-wds"}, {mode="adhoc"})
646                 if has_sta_eap then
647                         encr:value("wpa", "WPA-EAP", {mode="sta"}, {mode="sta-wds"})
648                         encr:value("wpa2", "WPA2-EAP", {mode="sta"}, {mode="sta-wds"})
649                 end
650                 encr.description = translate(
651                         "WPA-Encryption requires wpa_supplicant (for client mode) or hostapd (for AP " ..
652                         "and ad-hoc mode) to be installed."
653                 )
654         else
655                 encr.description = translate(
656                         "WPA-Encryption requires wpa_supplicant (for client mode) or hostapd (for AP " ..
657                         "and ad-hoc mode) to be installed."
658                 )
659         end
660 elseif hwtype == "broadcom" then
661         encr:value("psk", "WPA-PSK")
662         encr:value("psk2", "WPA2-PSK")
663         encr:value("psk+psk2", "WPA-PSK/WPA2-PSK Mixed Mode")
664 end
665
666 auth_server = s:taboption("encryption", Value, "auth_server", translate("Radius-Authentication-Server"))
667 auth_server:depends({mode="ap", encryption="wpa"})
668 auth_server:depends({mode="ap", encryption="wpa2"})
669 auth_server:depends({mode="ap-wds", encryption="wpa"})
670 auth_server:depends({mode="ap-wds", encryption="wpa2"})
671 auth_server.rmempty = true
672 auth_server.datatype = "host(0)"
673
674 auth_port = s:taboption("encryption", Value, "auth_port", translate("Radius-Authentication-Port"), translatef("Default %d", 1812))
675 auth_port:depends({mode="ap", encryption="wpa"})
676 auth_port:depends({mode="ap", encryption="wpa2"})
677 auth_port:depends({mode="ap-wds", encryption="wpa"})
678 auth_port:depends({mode="ap-wds", encryption="wpa2"})
679 auth_port.rmempty = true
680 auth_port.datatype = "port"
681
682 auth_secret = s:taboption("encryption", Value, "auth_secret", translate("Radius-Authentication-Secret"))
683 auth_secret:depends({mode="ap", encryption="wpa"})
684 auth_secret:depends({mode="ap", encryption="wpa2"})
685 auth_secret:depends({mode="ap-wds", encryption="wpa"})
686 auth_secret:depends({mode="ap-wds", encryption="wpa2"})
687 auth_secret.rmempty = true
688 auth_secret.password = true
689
690 acct_server = s:taboption("encryption", Value, "acct_server", translate("Radius-Accounting-Server"))
691 acct_server:depends({mode="ap", encryption="wpa"})
692 acct_server:depends({mode="ap", encryption="wpa2"})
693 acct_server:depends({mode="ap-wds", encryption="wpa"})
694 acct_server:depends({mode="ap-wds", encryption="wpa2"})
695 acct_server.rmempty = true
696 acct_server.datatype = "host(0)"
697
698 acct_port = s:taboption("encryption", Value, "acct_port", translate("Radius-Accounting-Port"), translatef("Default %d", 1813))
699 acct_port:depends({mode="ap", encryption="wpa"})
700 acct_port:depends({mode="ap", encryption="wpa2"})
701 acct_port:depends({mode="ap-wds", encryption="wpa"})
702 acct_port:depends({mode="ap-wds", encryption="wpa2"})
703 acct_port.rmempty = true
704 acct_port.datatype = "port"
705
706 acct_secret = s:taboption("encryption", Value, "acct_secret", translate("Radius-Accounting-Secret"))
707 acct_secret:depends({mode="ap", encryption="wpa"})
708 acct_secret:depends({mode="ap", encryption="wpa2"})
709 acct_secret:depends({mode="ap-wds", encryption="wpa"})
710 acct_secret:depends({mode="ap-wds", encryption="wpa2"})
711 acct_secret.rmempty = true
712 acct_secret.password = true
713
714 wpakey = s:taboption("encryption", Value, "_wpa_key", translate("Key"))
715 wpakey:depends("encryption", "psk")
716 wpakey:depends("encryption", "psk2")
717 wpakey:depends("encryption", "psk+psk2")
718 wpakey:depends("encryption", "psk-mixed")
719 wpakey.datatype = "wpakey"
720 wpakey.rmempty = true
721 wpakey.password = true
722
723 wpakey.cfgvalue = function(self, section, value)
724         local key = m.uci:get("wireless", section, "key")
725         if key == "1" or key == "2" or key == "3" or key == "4" then
726                 return nil
727         end
728         return key
729 end
730
731 wpakey.write = function(self, section, value)
732         self.map.uci:set("wireless", section, "key", value)
733         self.map.uci:delete("wireless", section, "key1")
734 end
735
736
737 wepslot = s:taboption("encryption", ListValue, "_wep_key", translate("Used Key Slot"))
738 wepslot:depends("encryption", "wep-open")
739 wepslot:depends("encryption", "wep-shared")
740 wepslot:value("1", translatef("Key #%d", 1))
741 wepslot:value("2", translatef("Key #%d", 2))
742 wepslot:value("3", translatef("Key #%d", 3))
743 wepslot:value("4", translatef("Key #%d", 4))
744
745 wepslot.cfgvalue = function(self, section)
746         local slot = tonumber(m.uci:get("wireless", section, "key"))
747         if not slot or slot < 1 or slot > 4 then
748                 return 1
749         end
750         return slot
751 end
752
753 wepslot.write = function(self, section, value)
754         self.map.uci:set("wireless", section, "key", value)
755 end
756
757 local slot
758 for slot=1,4 do
759         wepkey = s:taboption("encryption", Value, "key" .. slot, translatef("Key #%d", slot))
760         wepkey:depends("encryption", "wep-open")
761         wepkey:depends("encryption", "wep-shared")
762         wepkey.datatype = "wepkey"
763         wepkey.rmempty = true
764         wepkey.password = true
765
766         function wepkey.write(self, section, value)
767                 if value and (#value == 5 or #value == 13) then
768                         value = "s:" .. value
769                 end
770                 return Value.write(self, section, value)
771         end
772 end
773
774
775 if hwtype == "mac80211" or hwtype == "prism2" then
776
777         -- Probe 802.11r support (and EAP support as a proxy for Openwrt)
778         local has_80211r = (os.execute("hostapd -v11r 2>/dev/null || hostapd -veap 2>/dev/null") == 0)
779
780         ieee80211r = s:taboption("encryption", Flag, "ieee80211r",
781                 translate("802.11r Fast Transition"),
782                 translate("Enables fast roaming among access points that belong " ..
783                         "to the same Mobility Domain"))
784         ieee80211r:depends({mode="ap", encryption="wpa"})
785         ieee80211r:depends({mode="ap", encryption="wpa2"})
786         ieee80211r:depends({mode="ap-wds", encryption="wpa"})
787         ieee80211r:depends({mode="ap-wds", encryption="wpa2"})
788         if has_80211r then
789                 ieee80211r:depends({mode="ap", encryption="psk"})
790                 ieee80211r:depends({mode="ap", encryption="psk2"})
791                 ieee80211r:depends({mode="ap", encryption="psk-mixed"})
792                 ieee80211r:depends({mode="ap-wds", encryption="psk"})
793                 ieee80211r:depends({mode="ap-wds", encryption="psk2"})
794                 ieee80211r:depends({mode="ap-wds", encryption="psk-mixed"})
795         end
796         ieee80211r.rmempty = true
797
798         nasid = s:taboption("encryption", Value, "nasid", translate("NAS ID"),
799                 translate("Used for two different purposes: RADIUS NAS ID and " ..
800                         "802.11r R0KH-ID. Not needed with normal WPA(2)-PSK."))
801         nasid:depends({mode="ap", encryption="wpa"})
802         nasid:depends({mode="ap", encryption="wpa2"})
803         nasid:depends({mode="ap-wds", encryption="wpa"})
804         nasid:depends({mode="ap-wds", encryption="wpa2"})
805         nasid:depends({ieee80211r="1"})
806         nasid.rmempty = true
807
808         mobility_domain = s:taboption("encryption", Value, "mobility_domain",
809                         translate("Mobility Domain"),
810                         translate("4-character hexadecimal ID"))
811         mobility_domain:depends({ieee80211r="1"})
812         mobility_domain.placeholder = "4f57"
813         mobility_domain.datatype = "and(hexstring,rangelength(4,4))"
814         mobility_domain.rmempty = true
815
816         reassociation_deadline = s:taboption("encryption", Value, "reassociation_deadline",
817                 translate("Reassociation Deadline"),
818                 translate("time units (TUs / 1.024 ms) [1000-65535]"))
819         reassociation_deadline:depends({ieee80211r="1"})
820         reassociation_deadline.placeholder = "1000"
821         reassociation_deadline.datatype = "range(1000,65535)"
822         reassociation_deadline.rmempty = true
823
824         ft_protocol = s:taboption("encryption", ListValue, "ft_over_ds", translate("FT protocol"))
825         ft_protocol:depends({ieee80211r="1"})
826         ft_protocol:value("1", translatef("FT over DS"))
827         ft_protocol:value("0", translatef("FT over the Air"))
828         ft_protocol.rmempty = true
829
830         ft_psk_generate_local = s:taboption("encryption", Flag, "ft_psk_generate_local",
831                 translate("Generate PMK locally"),
832                 translate("When using a PSK, the PMK can be generated locally without inter AP communications"))
833         ft_psk_generate_local:depends({ieee80211r="1"})
834
835         r0_key_lifetime = s:taboption("encryption", Value, "r0_key_lifetime",
836                         translate("R0 Key Lifetime"), translate("minutes"))
837         r0_key_lifetime:depends({ieee80211r="1", ft_psk_generate_local=""})
838         r0_key_lifetime.placeholder = "10000"
839         r0_key_lifetime.datatype = "uinteger"
840         r0_key_lifetime.rmempty = true
841
842         r1_key_holder = s:taboption("encryption", Value, "r1_key_holder",
843                         translate("R1 Key Holder"),
844                         translate("6-octet identifier as a hex string - no colons"))
845         r1_key_holder:depends({ieee80211r="1", ft_psk_generate_local=""})
846         r1_key_holder.placeholder = "00004f577274"
847         r1_key_holder.datatype = "and(hexstring,rangelength(12,12))"
848         r1_key_holder.rmempty = true
849
850         pmk_r1_push = s:taboption("encryption", Flag, "pmk_r1_push", translate("PMK R1 Push"))
851         pmk_r1_push:depends({ieee80211r="1", ft_psk_generate_local=""})
852         pmk_r1_push.placeholder = "0"
853         pmk_r1_push.rmempty = true
854
855         r0kh = s:taboption("encryption", DynamicList, "r0kh", translate("External R0 Key Holder List"),
856                 translate("List of R0KHs in the same Mobility Domain. " ..
857                         "<br />Format: MAC-address,NAS-Identifier,128-bit key as hex string. " ..
858                         "<br />This list is used to map R0KH-ID (NAS Identifier) to a destination " ..
859                         "MAC address when requesting PMK-R1 key from the R0KH that the STA " ..
860                         "used during the Initial Mobility Domain Association."))
861         r0kh:depends({ieee80211r="1", ft_psk_generate_local=""})
862         r0kh.rmempty = true
863
864         r1kh = s:taboption("encryption", DynamicList, "r1kh", translate("External R1 Key Holder List"),
865                 translate ("List of R1KHs in the same Mobility Domain. "..
866                         "<br />Format: MAC-address,R1KH-ID as 6 octets with colons,128-bit key as hex string. "..
867                         "<br />This list is used to map R1KH-ID to a destination MAC address " ..
868                         "when sending PMK-R1 key from the R0KH. This is also the " ..
869                         "list of authorized R1KHs in the MD that can request PMK-R1 keys."))
870         r1kh:depends({ieee80211r="1", ft_psk_generate_local=""})
871         r1kh.rmempty = true
872         -- End of 802.11r options
873
874         eaptype = s:taboption("encryption", ListValue, "eap_type", translate("EAP-Method"))
875         eaptype:value("tls",  "TLS")
876         eaptype:value("ttls", "TTLS")
877         eaptype:value("peap", "PEAP")
878         eaptype:value("fast", "FAST")
879         eaptype:depends({mode="sta", encryption="wpa"})
880         eaptype:depends({mode="sta", encryption="wpa2"})
881         eaptype:depends({mode="sta-wds", encryption="wpa"})
882         eaptype:depends({mode="sta-wds", encryption="wpa2"})
883
884         cacert = s:taboption("encryption", FileUpload, "ca_cert", translate("Path to CA-Certificate"))
885         cacert:depends({mode="sta", encryption="wpa"})
886         cacert:depends({mode="sta", encryption="wpa2"})
887         cacert:depends({mode="sta-wds", encryption="wpa"})
888         cacert:depends({mode="sta-wds", encryption="wpa2"})
889         cacert.rmempty = true
890
891         clientcert = s:taboption("encryption", FileUpload, "client_cert", translate("Path to Client-Certificate"))
892         clientcert:depends({mode="sta", eap_type="tls", encryption="wpa"})
893         clientcert:depends({mode="sta", eap_type="tls", encryption="wpa2"})
894         clientcert:depends({mode="sta-wds", eap_type="tls", encryption="wpa"})
895         clientcert:depends({mode="sta-wds", eap_type="tls", encryption="wpa2"})
896
897         privkey = s:taboption("encryption", FileUpload, "priv_key", translate("Path to Private Key"))
898         privkey:depends({mode="sta", eap_type="tls", encryption="wpa2"})
899         privkey:depends({mode="sta", eap_type="tls", encryption="wpa"})
900         privkey:depends({mode="sta-wds", eap_type="tls", encryption="wpa2"})
901         privkey:depends({mode="sta-wds", eap_type="tls", encryption="wpa"})
902
903         privkeypwd = s:taboption("encryption", Value, "priv_key_pwd", translate("Password of Private Key"))
904         privkeypwd:depends({mode="sta", eap_type="tls", encryption="wpa2"})
905         privkeypwd:depends({mode="sta", eap_type="tls", encryption="wpa"})
906         privkeypwd:depends({mode="sta-wds", eap_type="tls", encryption="wpa2"})
907         privkeypwd:depends({mode="sta-wds", eap_type="tls", encryption="wpa"})
908         privkeypwd.rmempty = true
909         privkeypwd.password = true
910
911         auth = s:taboption("encryption", ListValue, "auth", translate("Authentication"))
912         auth:value("PAP", "PAP", {eap_type="ttls"})
913         auth:value("CHAP", "CHAP", {eap_type="ttls"})
914         auth:value("MSCHAP", "MSCHAP", {eap_type="ttls"})
915         auth:value("MSCHAPV2", "MSCHAPv2", {eap_type="ttls"})
916         auth:value("EAP-GTC")
917         auth:value("EAP-MD5")
918         auth:value("EAP-MSCHAPV2")
919         auth:value("EAP-TLS")
920         auth:depends({mode="sta", eap_type="fast", encryption="wpa2"})
921         auth:depends({mode="sta", eap_type="fast", encryption="wpa"})
922         auth:depends({mode="sta", eap_type="peap", encryption="wpa2"})
923         auth:depends({mode="sta", eap_type="peap", encryption="wpa"})
924         auth:depends({mode="sta", eap_type="ttls", encryption="wpa2"})
925         auth:depends({mode="sta", eap_type="ttls", encryption="wpa"})
926         auth:depends({mode="sta-wds", eap_type="fast", encryption="wpa2"})
927         auth:depends({mode="sta-wds", eap_type="fast", encryption="wpa"})
928         auth:depends({mode="sta-wds", eap_type="peap", encryption="wpa2"})
929         auth:depends({mode="sta-wds", eap_type="peap", encryption="wpa"})
930         auth:depends({mode="sta-wds", eap_type="ttls", encryption="wpa2"})
931         auth:depends({mode="sta-wds", eap_type="ttls", encryption="wpa"})
932
933         cacert2 = s:taboption("encryption", FileUpload, "ca_cert2", translate("Path to inner CA-Certificate"))
934         cacert2:depends({mode="sta", auth="EAP-TLS", encryption="wpa"})
935         cacert2:depends({mode="sta", auth="EAP-TLS", encryption="wpa2"})
936         cacert2:depends({mode="sta-wds", auth="EAP-TLS", encryption="wpa"})
937         cacert2:depends({mode="sta-wds", auth="EAP-TLS", encryption="wpa2"})
938
939         clientcert2 = s:taboption("encryption", FileUpload, "client_cert2", translate("Path to inner Client-Certificate"))
940         clientcert2:depends({mode="sta", auth="EAP-TLS", encryption="wpa"})
941         clientcert2:depends({mode="sta", auth="EAP-TLS", encryption="wpa2"})
942         clientcert2:depends({mode="sta-wds", auth="EAP-TLS", encryption="wpa"})
943         clientcert2:depends({mode="sta-wds", auth="EAP-TLS", encryption="wpa2"})
944
945         privkey2 = s:taboption("encryption", FileUpload, "priv_key2", translate("Path to inner Private Key"))
946         privkey2:depends({mode="sta", auth="EAP-TLS", encryption="wpa"})
947         privkey2:depends({mode="sta", auth="EAP-TLS", encryption="wpa2"})
948         privkey2:depends({mode="sta-wds", auth="EAP-TLS", encryption="wpa"})
949         privkey2:depends({mode="sta-wds", auth="EAP-TLS", encryption="wpa2"})
950
951         privkeypwd2 = s:taboption("encryption", Value, "priv_key2_pwd", translate("Password of inner Private Key"))
952         privkeypwd2:depends({mode="sta", auth="EAP-TLS", encryption="wpa"})
953         privkeypwd2:depends({mode="sta", auth="EAP-TLS", encryption="wpa2"})
954         privkeypwd2:depends({mode="sta-wds", auth="EAP-TLS", encryption="wpa"})
955         privkeypwd2:depends({mode="sta-wds", auth="EAP-TLS", encryption="wpa2"})
956         privkeypwd2.rmempty = true
957         privkeypwd2.password = true
958
959         identity = s:taboption("encryption", Value, "identity", translate("Identity"))
960         identity:depends({mode="sta", eap_type="fast", encryption="wpa2"})
961         identity:depends({mode="sta", eap_type="fast", encryption="wpa"})
962         identity:depends({mode="sta", eap_type="peap", encryption="wpa2"})
963         identity:depends({mode="sta", eap_type="peap", encryption="wpa"})
964         identity:depends({mode="sta", eap_type="ttls", encryption="wpa2"})
965         identity:depends({mode="sta", eap_type="ttls", encryption="wpa"})
966         identity:depends({mode="sta-wds", eap_type="fast", encryption="wpa2"})
967         identity:depends({mode="sta-wds", eap_type="fast", encryption="wpa"})
968         identity:depends({mode="sta-wds", eap_type="peap", encryption="wpa2"})
969         identity:depends({mode="sta-wds", eap_type="peap", encryption="wpa"})
970         identity:depends({mode="sta-wds", eap_type="ttls", encryption="wpa2"})
971         identity:depends({mode="sta-wds", eap_type="ttls", encryption="wpa"})
972         identity:depends({mode="sta", eap_type="tls", encryption="wpa2"})
973         identity:depends({mode="sta", eap_type="tls", encryption="wpa"})
974         identity:depends({mode="sta-wds", eap_type="tls", encryption="wpa2"})
975         identity:depends({mode="sta-wds", eap_type="tls", encryption="wpa"})
976
977         anonymous_identity = s:taboption("encryption", Value, "anonymous_identity", translate("Anonymous Identity"))
978         anonymous_identity:depends({mode="sta", eap_type="fast", encryption="wpa2"})
979         anonymous_identity:depends({mode="sta", eap_type="fast", encryption="wpa"})
980         anonymous_identity:depends({mode="sta", eap_type="peap", encryption="wpa2"})
981         anonymous_identity:depends({mode="sta", eap_type="peap", encryption="wpa"})
982         anonymous_identity:depends({mode="sta", eap_type="ttls", encryption="wpa2"})
983         anonymous_identity:depends({mode="sta", eap_type="ttls", encryption="wpa"})
984         anonymous_identity:depends({mode="sta-wds", eap_type="fast", encryption="wpa2"})
985         anonymous_identity:depends({mode="sta-wds", eap_type="fast", encryption="wpa"})
986         anonymous_identity:depends({mode="sta-wds", eap_type="peap", encryption="wpa2"})
987         anonymous_identity:depends({mode="sta-wds", eap_type="peap", encryption="wpa"})
988         anonymous_identity:depends({mode="sta-wds", eap_type="ttls", encryption="wpa2"})
989         anonymous_identity:depends({mode="sta-wds", eap_type="ttls", encryption="wpa"})
990         anonymous_identity:depends({mode="sta", eap_type="tls", encryption="wpa2"})
991         anonymous_identity:depends({mode="sta", eap_type="tls", encryption="wpa"})
992         anonymous_identity:depends({mode="sta-wds", eap_type="tls", encryption="wpa2"})
993         anonymous_identity:depends({mode="sta-wds", eap_type="tls", encryption="wpa"})
994
995         password = s:taboption("encryption", Value, "password", translate("Password"))
996         password:depends({mode="sta", eap_type="fast", encryption="wpa2"})
997         password:depends({mode="sta", eap_type="fast", encryption="wpa"})
998         password:depends({mode="sta", eap_type="peap", encryption="wpa2"})
999         password:depends({mode="sta", eap_type="peap", encryption="wpa"})
1000         password:depends({mode="sta", eap_type="ttls", encryption="wpa2"})
1001         password:depends({mode="sta", eap_type="ttls", encryption="wpa"})
1002         password:depends({mode="sta-wds", eap_type="fast", encryption="wpa2"})
1003         password:depends({mode="sta-wds", eap_type="fast", encryption="wpa"})
1004         password:depends({mode="sta-wds", eap_type="peap", encryption="wpa2"})
1005         password:depends({mode="sta-wds", eap_type="peap", encryption="wpa"})
1006         password:depends({mode="sta-wds", eap_type="ttls", encryption="wpa2"})
1007         password:depends({mode="sta-wds", eap_type="ttls", encryption="wpa"})
1008         password.rmempty = true
1009         password.password = true
1010 end
1011
1012 -- ieee802.11w options
1013 if hwtype == "mac80211" then
1014         local has_80211w = (os.execute("hostapd -v11w 2>/dev/null || hostapd -veap 2>/dev/null") == 0)
1015         if has_80211w then
1016                 ieee80211w = s:taboption("encryption", ListValue, "ieee80211w",
1017                         translate("802.11w Management Frame Protection"),
1018                         translate("Requires the 'full' version of wpad/hostapd " ..
1019                                 "and support from the wifi driver <br />(as of Feb 2017: " ..
1020                                 "ath9k and ath10k, in LEDE also mwlwifi and mt76)"))
1021                 ieee80211w.default = ""
1022                 ieee80211w.rmempty = true
1023                 ieee80211w:value("", translate("Disabled (default)"))
1024                 ieee80211w:value("1", translate("Optional"))
1025                 ieee80211w:value("2", translate("Required"))
1026                 ieee80211w:depends({mode="ap", encryption="wpa2"})
1027                 ieee80211w:depends({mode="ap-wds", encryption="wpa2"})
1028                 ieee80211w:depends({mode="ap", encryption="psk2"})
1029                 ieee80211w:depends({mode="ap", encryption="psk-mixed"})
1030                 ieee80211w:depends({mode="ap-wds", encryption="psk2"})
1031                 ieee80211w:depends({mode="ap-wds", encryption="psk-mixed"})
1032
1033                 max_timeout = s:taboption("encryption", Value, "ieee80211w_max_timeout",
1034                                 translate("802.11w maximum timeout"),
1035                                 translate("802.11w Association SA Query maximum timeout"))
1036                 max_timeout:depends({ieee80211w="1"})
1037                 max_timeout:depends({ieee80211w="2"})
1038                 max_timeout.datatype = "uinteger"
1039                 max_timeout.placeholder = "1000"
1040                 max_timeout.rmempty = true
1041
1042                 retry_timeout = s:taboption("encryption", Value, "ieee80211w_retry_timeout",
1043                                 translate("802.11w retry timeout"),
1044                                 translate("802.11w Association SA Query retry timeout"))
1045                 retry_timeout:depends({ieee80211w="1"})
1046                 retry_timeout:depends({ieee80211w="2"})
1047                 retry_timeout.datatype = "uinteger"
1048                 retry_timeout.placeholder = "201"
1049                 retry_timeout.rmempty = true
1050         end
1051
1052         local key_retries = s:taboption("encryption", Flag, "wpa_disable_eapol_key_retries",
1053                 translate("Enable key reinstallation (KRACK) countermeasures"),
1054                 translate("Complicates key reinstallation attacks on the client side by disabling retransmission of EAPOL-Key frames that are used to install keys. This workaround might cause interoperability issues and reduced robustness of key negotiation especially in environments with heavy traffic load."))
1055
1056         key_retries:depends({mode="ap", encryption="wpa2"})
1057         key_retries:depends({mode="ap", encryption="psk2"})
1058         key_retries:depends({mode="ap", encryption="psk-mixed"})
1059         key_retries:depends({mode="ap-wds", encryption="wpa2"})
1060         key_retries:depends({mode="ap-wds", encryption="psk2"})
1061         key_retries:depends({mode="ap-wds", encryption="psk-mixed"})
1062 end
1063
1064 if hwtype == "mac80211" or hwtype == "prism2" then
1065         local wpasupplicant = fs.access("/usr/sbin/wpa_supplicant")
1066         local hostcli = fs.access("/usr/sbin/hostapd_cli")
1067         if hostcli and wpasupplicant then
1068                 wps = s:taboption("encryption", Flag, "wps_pushbutton", translate("Enable WPS pushbutton, requires WPA(2)-PSK"))
1069                 wps.enabled = "1"
1070                 wps.disabled = "0"
1071                 wps.rmempty = false
1072                 wps:depends("encryption", "psk")
1073                 wps:depends("encryption", "psk2")
1074                 wps:depends("encryption", "psk-mixed")
1075         end
1076 end
1077
1078 return m