commits

commits@lists.open-mesh.org

1 participants
12373 discussions

[doc] backup-redmine/2024-02-03,main: doc: open-mesh/OpenHarbors-diagram-old-approach.dia (dd193af9)
by postmaster＠open-mesh.org 03 Feb '24

03 Feb '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine/2024-02-03,main >--------------------------------------------------------------- commit dd193af9ecf781060b89dbe458453cc681e706aa Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Thu Feb 1 04:40:10 2024 +0000 doc: open-mesh/OpenHarbors-diagram-old-approach.dia >--------------------------------------------------------------- dd193af9ecf781060b89dbe458453cc681e706aa open-mesh/OpenHarbors-diagram-old-approach.dia | Bin 0 -> 4234 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/open-mesh/OpenHarbors-diagram-old-approach.dia b/open-mesh/OpenHarbors-diagram-old-approach.dia new file mode 100644 index 00000000..3441245b Binary files /dev/null and b/open-mesh/OpenHarbors-diagram-old-approach.dia differ

1 0

[doc] backup-redmine/2024-02-03,main: doc: open-mesh/Download (0cb8ddab)
by postmaster＠open-mesh.org 03 Feb '24

03 Feb '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine/2024-02-03,main >--------------------------------------------------------------- commit 0cb8ddab19198ab05ce3f9969e52b7cdaba2b515 Author: Simon Wunderlich <sw(a)simonwunderlich.de> Date: Thu Feb 1 11:53:09 2024 +0000 doc: open-mesh/Download >--------------------------------------------------------------- 0cb8ddab19198ab05ce3f9969e52b7cdaba2b515 open-mesh/Download.textile | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/open-mesh/Download.textile b/open-mesh/Download.textile index f816aabd..a8f76a13 100644 --- a/open-mesh/Download.textile +++ b/open-mesh/Download.textile @@ -7,9 +7,9 @@ Please use the stable branch for your public infrastructure unless you know exac h2. Download Released Source Code -* The latest version of [[batman-adv:Wiki|batman-adv]] is "batman-adv-2023.3.tar.gz":https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-2023.3.tar.gz "md5":https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-2023.3.tar.gz.md5 "sha1":https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-2023.3.tar.gz.sha1 "asc":https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-2023.3.tar.gz.asc -* The latest version of batctl (management and control tool for batman-adv) is "batctl-2023.3.tar.gz":https://downloads.open-mesh.org/batman/stable/sources/batctl/batctl-2023.3.tar.gz "md5":https://downloads.open-mesh.org/batman/stable/sources/batctl/batctl-2023.3.tar.gz.md5 "sha1":https://downloads.open-mesh.org/batman/stable/sources/batctl/batctl-2023.3.tar.gz.sha1 "asc":https://downloads.open-mesh.org/batman/stable/sources/batctl/batctl-2023.3.tar.gz.asc -* The latest version of alfred (Almighty Lightweight Fact Remote Exchange Daemon) is "alfred-2023.3.tar.gz":https://downloads.open-mesh.org/batman/stable/sources/alfred/alfred-2023.3.tar.gz "md5":https://downloads.open-mesh.org/batman/stable/sources/alfred/alfred-2023.3.tar.gz.md5 "sha1":https://downloads.open-mesh.org/batman/stable/sources/alfred/alfred-2023.3.tar.gz.sha1 "asc":https://downloads.open-mesh.org/batman/stable/sources/alfred/alfred-2023.3.tar.gz.asc +* The latest version of [[batman-adv:Wiki|batman-adv]] is "batman-adv-2024.0.tar.gz":https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-2024.0.tar.gz "md5":https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-2024.0.tar.gz.md5 "sha1":https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-2024.0.tar.gz.sha1 "asc":https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-2024.0.tar.gz.asc +* The latest version of batctl (management and control tool for batman-adv) is "batctl-2024.0.tar.gz":https://downloads.open-mesh.org/batman/stable/sources/batctl/batctl-2024.0.tar.gz "md5":https://downloads.open-mesh.org/batman/stable/sources/batctl/batctl-2024.0.tar.gz.md5 "sha1":https://downloads.open-mesh.org/batman/stable/sources/batctl/batctl-2024.0.tar.gz.sha1 "asc":https://downloads.open-mesh.org/batman/stable/sources/batctl/batctl-2024.0.tar.gz.asc +* The latest version of alfred (Almighty Lightweight Fact Remote Exchange Daemon) is "alfred-2024.0.tar.gz":https://downloads.open-mesh.org/batman/stable/sources/alfred/alfred-2024.0.tar.gz "md5":https://downloads.open-mesh.org/batman/stable/sources/alfred/alfred-2024.0.tar.gz.md5 "sha1":https://downloads.open-mesh.org/batman/stable/sources/alfred/alfred-2024.0.tar.gz.sha1 "asc":https://downloads.open-mesh.org/batman/stable/sources/alfred/alfred-2024.0.tar.gz.asc * The latest stable version of batmand ([[open-mesh:BranchesExplained#batmand|unmaintained]]) is "batman-0.3.2.tar.gz":https://downloads.open-mesh.org/batman/releases/batman-0.3.2/batman-0.3.2.tar.gz "md5":https://downloads.open-mesh.org/batman/releases/batman-0.3.2/batman-0.3.2.tar.gz.md5 "sha1":https://downloads.open-mesh.org/batman/releases/batman-0.3.2/batman-0.3.2.tar.gz.sha1 "asc":https://downloads.open-mesh.org/batman/releases/batman-0.3.2/batman-0.3.2.tar.gz.asc * The latest version of the vis server for the batmand (package not needed for batman-adv) is "vis-0.3.2.tar.gz":https://downloads.open-mesh.org/batman/releases/batman-0.3.2/vis-0.3.2.tar.gz "md5":https://downloads.open-mesh.org/batman/releases/batman-0.3.2/vis-0.3.2.tar.gz.md5 "sha1":https://downloads.open-mesh.org/batman/releases/batman-0.3.2/vis-0.3.2.tar.gz.sha1 "asc":https://downloads.open-mesh.org/batman/releases/batman-0.3.2/vis-0.3.2.tar.gz.asc @@ -104,6 +104,7 @@ It follows an overview of linux versions and the batman-adv version they contain * linux 6.5 => batman-adv 2023.2 (get batctl 2023.2 from "here":https://downloads.open-mesh.org/batman/stable/sources/batctl/) * linux 6.6 => batman-adv 2023.3 (get batctl 2023.3 from "here":https://downloads.open-mesh.org/batman/stable/sources/batctl/) * linux 6.7 => batman-adv 2023.3 (get batctl 2023.3 from "here":https://downloads.open-mesh.org/batman/stable/sources/batctl/) +* linux 6.8 => batman-adv 2024.0 (get batctl 2024.0 from "here":https://downloads.open-mesh.org/batman/stable/sources/batctl/) h2. Arch Linux

1 0

[doc] backup-redmine/2024-02-03,main: doc: open-mesh/OpenHarbors (c3077c9e)
by postmaster＠open-mesh.org 03 Feb '24

03 Feb '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine/2024-02-03,main >--------------------------------------------------------------- commit c3077c9eae37c945c3fdc4c85ee7dd9bb1f28967 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Thu Feb 1 07:20:22 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- c3077c9eae37c945c3fdc4c85ee7dd9bb1f28967 open-mesh/OpenHarbors.textile | 52 ++++++++++++++++++++++++++++++------------- 1 file changed, 37 insertions(+), 15 deletions(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index ce242920..4eb773b2 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -82,6 +82,8 @@ Overall, in general: Allows to use an untrusted wireless community mesh network h3. Implementation Milestones/Tasks +Steps for a first, minimum implementation with real-world usability: + <pre><code> # Preparation: @@ -105,7 +107,8 @@ Hook into/within hostapd: ### On-demand initalization + EAP handling: [] parse domain from unencrypted EAP-TTLS username from EAPoL frames -[] create a UDP/L2TP tunnel to parsed domain +[] create a UDP/L2TP tunnel/session to parsed domain + (likely utilize the l2tp kernel module) [] associate/memorize MAC + UDP socket (address+port) [] encapsulate EAPoL [] EAPoL frames from client to the socket/tunnel: @@ -124,21 +127,40 @@ Hook into/within hostapd: [] decapsulate/remove our IP/UDP/L2TP header [] forward to mac80211 -## Remote side +## Remote Side / Remote Authenticator + +### Early initialization: -### Initialization +[] add configuration/enable option to hostapd +[] initialize socket to listen for L2TP packets on + a specific <UDP-port> +[] load mac80211/cfg80211 kernel modules -Option A) -* Setup/Utilize mac80211_hwsim kernel module? +### On-demand initialization + EAP handling: -Option B) -* +[] receive L2TP packets +[] initialize L2TP tunnel/session + (likely utilize the l2tp kernel module) +[] EAPoL frames from hostapd to the socket/tunnel: + [] encapsulate with our IP/UDP/L2TP header + [] forward to IP router/stack +[] EAPoL frames from the socket/tunnel to hostapd: + [] decapsulate/remove our IP/UDP/L2TP header + [] forward/handle in hostapd's existing EAPoL code +[] establish PMK from EAPoL exchange +[] setup mac80211/cfg80211 with PMK to use + the Linux kernel's software encryption/decryption + of WPA (likely via the mac80211_hwsim kernel module) + [] (likely) needs changes/additions / new API to mac80211(_hwsim) - * Remote Server side, initialization / EAP handling: - * Remote Server side, data forwarding, from client: - ... - * Remote Server side, data forwarding, to client: - ... +### Data forwarding: + +[] WPA CCMP frames from mac80211(_hwsim) to the socket/tunnel: + [] encapsulate with our IP/UDP/L2TP header to <domain> + [] forward to IP router/stack +[] WPA CCMP frames from socket/tunnel to mac80211(_hwsim): + [] decapsulate/remove our IP/UDP/L2TP header + [] forward to mac80211 ## Firmware Packaging/Integration @@ -148,7 +170,7 @@ AP/client side: [] allow building a hostapd/wpa_supplicant/wpad variant without OpenHarbor code (size tuneability matters - on embedded) + on embedded / for upstream acceptance) [] add an openharbor-client package [] add requirement to usable hostapd/wpa_supplicant/wpad @@ -157,9 +179,9 @@ AP/client side: [] add documentation/description to package [] add document/description on OpenWrt Wiki's "UCI /etc/config/wireless page":https://openwrt.org/docs/guide-user/network/wifi/basic -Remote side: +Remote Authenticator Side: -[] add an openharbor-server package +[] add an openharbor-server (openharbor-authenticator) package [] add documentation/description to package ### Freifunk/Gluon integration

1 0

[doc] backup-redmine/2024-02-03,main: doc: open-mesh/OpenHarbors (9a8c4251)
by postmaster＠open-mesh.org 03 Feb '24

03 Feb '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine/2024-02-03,main >--------------------------------------------------------------- commit 9a8c4251c873999b7d5cfede127bd6aa21688a8e Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Thu Feb 1 06:36:38 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 9a8c4251c873999b7d5cfede127bd6aa21688a8e open-mesh/OpenHarbors.textile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 223ca191..ce242920 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -53,8 +53,12 @@ The second issue with WBA OpenRoaming is that it currently requires a membership h2. Solution +---- + # Determine the tunnel destination from a domain suffix in the unencrypted login name (ak. "identity") the user provided -# Tunnel the full WPA exchange over IP +# Tunnel the full WPA exchange (EAPoL + encrypted payload) over IP + +--- Or in other words, move the 802.1x authenticator from the AP to a remote host of a user's choosing:

1 0

[doc] backup-redmine/2024-02-03,main: doc: open-mesh/OpenHarbors (7ffeffd1)
by postmaster＠open-mesh.org 03 Feb '24

03 Feb '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine/2024-02-03,main >--------------------------------------------------------------- commit 7ffeffd155132159017af68dd4ee3c4a4447053d Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Thu Feb 1 07:54:27 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 7ffeffd155132159017af68dd4ee3c4a4447053d

1 0

[doc] backup-redmine/2024-02-03,main: doc: open-mesh/OpenHarbors (0531ca9d)
by postmaster＠open-mesh.org 03 Feb '24

03 Feb '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine/2024-02-03,main >--------------------------------------------------------------- commit 0531ca9d572b7137d7c20e8b856b0dadd411564d Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Thu Feb 1 08:38:03 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 0531ca9d572b7137d7c20e8b856b0dadd411564d open-mesh/OpenHarbors.textile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 0897468d..1728691c 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -212,6 +212,9 @@ h3. Optional/additional/future Milestones/Ideas * Add RADIUS server option to (Gluon's) openharbor-server/authenticator integration, for a more sophisticated/flexible authentication management (for more technically versed people) +* Signal "OpenHarbor" capability via a vendor field in beacons? + To avoid a client only relying on the "OpenHarbor" ESSID name? + (if I recall correctly also Passpoint had options for similar signalling?) * Passpoint / Hotspot 2.0 compatibility * additional Layer 2 encapsulation method, which skips the IP/UDP/L2TP headers and uses a smaller, custom ethernet frame header

1 0

[doc] backup-redmine/2024-02-03,main: doc: open-mesh/OpenHarbors (3650f602)
by postmaster＠open-mesh.org 03 Feb '24

03 Feb '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine/2024-02-03,main >--------------------------------------------------------------- commit 3650f602cd9f57175e5d2f427d641d297d5918bc Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Thu Feb 1 04:57:49 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 3650f602cd9f57175e5d2f427d641d297d5918bc open-mesh/OpenHarbors.textile | 50 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile new file mode 100644 index 00000000..9c98359c --- /dev/null +++ b/open-mesh/OpenHarbors.textile @@ -0,0 +1,50 @@ +h1. Idea/Draft: OpenHarbors ("Gotham Docks") + +**DRAFT / NOT IMPLEMENTED** + +This document specifies a way to dynamically tunnel WPA over a potentially untrusted IP network to a gateway of the user's choice. + +h2. Issues + +h3. Issues with Gluon based mesh networks + +In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wiki/Freifunk involving "batman-adv":https://www.open-mesh.org/projects/batman-adv/wiki/ + "Gluon":https://github.com/freifunk-gluon/gluon/ has two issues: + +1) A user's internet traffic is typically unencrypted in the WLAN mesh cloud +2) A set of central gateways behind a VPN tunnel is used for internet traffic (which contradicts Freifunk's philosophy of decentralization, but became defacto mandatory due to for private people unclear Secondary Liability law in Germany: "''Störerhaftung''":https://de.wikipedia.org/wiki/St%C3%B6rerhaftung) + +!OpenHarbors-diagram-freifunk-unencrypted.png! + +Gluon also supports adding the following three types of WLAN encryption: + +1) "SAE":https://en.wikipedia.org/wiki/Simultaneous_Authentication_of_Equals to encrypt traffic between mesh nodes +2) "OWE":https://en.wikipedia.org/wiki/Opportunistic_Wireless_Encryption to encrypt traffic from a user device to the direct mesh node / AP +3) A "''Private WiFi''":https://gluon.readthedocs.io/en/latest/features/private-wlan.html with WPA-Personal/preshared key encryption, simply bridged to a mesh node's WAN port + +While 1)+2) protects against passive snooping, it however does not protect against an active attacker in an open, public network like Freifunk. Due to the open nature of Freifunk, the SAE password would need to be published / added to the firmware (source code) to allow anyone to setup their own mesh node. Overall Freifunk even with 1)+2) would still be susceptible to Man-in-the-Middle attacks. + +The issue with option 3) is that while it is secure, as the mesh node owner can configure their own, private password for it in the Gluon Config-Mode Web-GUI of their Gluon mesh router, it can't be used on foreign, other mesh nodes over the mesh network. + +!OpenHarbors-diagram-freifunk.png! + +h3. Issues with Passpoint/Hotspot 2.0/OpenRoaming solutions + +Industry leaders currently seem to propose and advocate for solutions based on Passpoint/Hotspot 2.0 which in turn builds upon "WPA-Enterprise":https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Target_users_(authentication_key_distribution). Potentially with "WBA OpenRoaming":https://wballiance.com/openroaming/ (Informational RFC: "here":https://datatracker.ietf.org/doc/draft-tomas-openroaming/ or similar trust/contract relations as a federation. Hotspot 2.0 was/is also a requirement for the EU "WiFi4EU":https://wifi4eu.ec.europa.eu/#/home initiative. + +Unfortunately, WPA-Enterprise / Hotspot 2.0/Passpoint like as follows has conceptual, compatibility issues with open wireless community mesh networks, like in the following scenario: + +!OpenHarbors-diagram-old-approach.png! + +* WPA payload frames are encrypted between the client device (ak. supplicant) and the AP it connects to through the Pairwise-Master-Key +* The PMK is securely established via EAP between client device and a RADIUS server (ak. authentication server) +* The communication between the AP and the RADIUS server might be encrypted via TLS ("RadSec":https://en.wikipedia.org/wiki/RadSec) +* However, the PMK after it was generated is then forwarded from the RADIUS server to the AP (ak. authenticator). + -> the RADIUS server needs to **trust** the AP here + +Which means the WPA-Enterprise approach (and therefore also its users like Wifi4EU / Passpoint/Hotspot 2.0, or also eduroam) only works if the APs are run by *trusted administrators*. Or a *trusted, closed source* firmware/vendor. + +h2. Solution + +1) Determine the tunnel destination from a domain suffix in the unencrypted login name the user provided +2) Tunnel the full WPA exchange over IP +

1 0

[doc] backup-redmine/2024-02-03,main: doc: open-mesh/OpenHarbors-diagram.png (e95856ee)
by postmaster＠open-mesh.org 03 Feb '24

03 Feb '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine/2024-02-03,main >--------------------------------------------------------------- commit e95856ee9c6ed03d1bb4a8f54171272ceb39c4ea Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Thu Feb 1 04:57:41 2024 +0000 doc: open-mesh/OpenHarbors-diagram.png >--------------------------------------------------------------- e95856ee9c6ed03d1bb4a8f54171272ceb39c4ea open-mesh/OpenHarbors-diagram.png | Bin 0 -> 173768 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/open-mesh/OpenHarbors-diagram.png b/open-mesh/OpenHarbors-diagram.png new file mode 100644 index 00000000..6f616266 Binary files /dev/null and b/open-mesh/OpenHarbors-diagram.png differ

1 0

[doc] backup-redmine/2024-02-03,main: doc: open-mesh/OpenHarbors-diagram-old-approach.png (173331d7)
by postmaster＠open-mesh.org 03 Feb '24

03 Feb '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine/2024-02-03,main >--------------------------------------------------------------- commit 173331d799a51c17e288bc0e1d823ad11db574d0 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Thu Feb 1 04:40:08 2024 +0000 doc: open-mesh/OpenHarbors-diagram-old-approach.png >--------------------------------------------------------------- 173331d799a51c17e288bc0e1d823ad11db574d0 open-mesh/OpenHarbors-diagram-old-approach.png | Bin 0 -> 103989 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/open-mesh/OpenHarbors-diagram-old-approach.png b/open-mesh/OpenHarbors-diagram-old-approach.png new file mode 100644 index 00000000..98c48d91 Binary files /dev/null and b/open-mesh/OpenHarbors-diagram-old-approach.png differ

1 0

[doc] backup-redmine/2024-02-03,main: doc: open-mesh/OpenHarbors-diagram-freifunk.dia (1a9b4556)
by postmaster＠open-mesh.org 03 Feb '24

03 Feb '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine/2024-02-03,main >--------------------------------------------------------------- commit 1a9b455663e81b52194acc8bd6cdac0c846dc5db Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Wed Jan 31 22:16:12 2024 +0000 doc: open-mesh/OpenHarbors-diagram-freifunk.dia >--------------------------------------------------------------- 1a9b455663e81b52194acc8bd6cdac0c846dc5db open-mesh/OpenHarbors-diagram-freifunk.dia | Bin 0 -> 4362 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/open-mesh/OpenHarbors-diagram-freifunk.dia b/open-mesh/OpenHarbors-diagram-freifunk.dia new file mode 100644 index 00000000..c39c0b71 Binary files /dev/null and b/open-mesh/OpenHarbors-diagram-freifunk.dia differ

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

commits