version 0.8.2

* add options for wifi66

* rebase to 0.7.6 and upgrade version to 0.8.0-unstable0

* fix channel detection

* can_transmit_to_channel: fix 5GHz and 6GHz freq range

* can_transmit_to_channel: limit freq integer part to 4 digits

* enable wmm when wifi 6 is enabled

* lint remove stray spaces

* Revert "lint remove stray spaces"

This reverts commit 8830b95cff.

---------

Co-authored-by: garywill <garywill@disroot.org>
Co-authored-by: Phani Pavan K <kphanipavan+goose@gmail.com>

README.md

@@ -4,7 +4,7 @@ Set Linux as router in one command. Able to provide Internet, or create WiFi hot
 
 It wraps `iptables`, `dnsmasq` etc. stuff. Use in one command, restore in one command or by `control-c` (or even by closing terminal window).
 
-[Linux-Router News & Developer Notes 📰](https://github.com/garywill/linux-router/issues/28) | [More tools and projects 🛠️](https://garywill.github.io) | [🍻 Buy me a coffee ❤️](https://github.com/garywill/receiving/blob/master/receiving_methods.md)
+[More tools and projects 🛠️](https://garywill.github.io) | [🍻 Buy me a coffee ❤️](https://github.com/garywill/receiving/blob/master/receiving_methods.md)
 
 
 ## Features
@@ -19,14 +19,17 @@ Basic features:
   - Specify upstream DNS (kind of a plain DNS proxy)
 - IPv6 (behind NATed LAN, like IPv4)
 - Creating WiFi hotspot:
+  - Wifi 3/4/5/6
+  - 2.4GHz, 5GHz
   - Channel selecting
   - Choose encryptions: WPA2/WPA, WPA2, WPA, No encryption
-  - Create AP on the same interface you are getting Internet (usually require same channel)
+  - Create AP on the same interface you are getting Internet (Need hardware support. Usually require same channel)
 - Transparent proxy (redsocks)
 - Transparent DNS proxy (hijack port 53 packets)
-- Detect NetworkManager and make sure it won't interfere (handle interface (un)managed status)
-- Detect firewalld and make sure it won't interfere our (by using `trusted` zone)
-- You can run many instances, to create many different networks. Has instances managing feature.
+- Detect and prevent interference from following Linux system daemons:
+  - NetworkManager (handle interface (un)managed status)
+  - firewalld (use temporary `trusted` zone)
+- Instances managing. You can run multiple instances, to create different sub-networks.
 
 **For many other features, see below [CLI usage](#cli-usage-and-other-features)**
 
@@ -82,9 +85,9 @@ I'm currently not packaging for any distro. If you do, open a PR and add the lin
 - iptables (or nftables with `iptables-nft` translation linked)
 - WiFi hotspot dependencies
   - hostapd
-  - iw
-  - iwconfig (you only need this if 'iw' can not recognize your adapter)
+  - iw (or iwconfig, when iw can not recognize adapter)
   - haveged (optional)
+  - crda and wireless-regdb (optional)
 
 
 
@@ -372,28 +375,29 @@ Options:
                             (example: US)
     --freq-band <GHz>       Set frequency band: 2.4 or 5 (default: 2.4)
     --driver                Choose your WiFi adapter driver (default: nl80211)
-    -w <WPA version>        '2' for WPA2, '1' for WPA, '1+2' for both
-                            (default: 2)
-    --psk                   Use 64 hex digits pre-shared-key instead of
-                            passphrase
+    -w <WPA version>        WPA version indicator, can be '2', '3', '1', '3+2',
+                            '3+2+1', '2+1'. Requires '-p'. (default: '2')
+                            (Note WPA1 is legacy and unsafe)
+    --psk                   Use 64 hex digits pre-shared-key. Value of '-p'
+                            should be hex string instead of password
     --mac-filter            Enable WiFi hotspot MAC address filtering
     --mac-filter-accept     Location of WiFi hotspot MAC address filter list
                             (defaults to /etc/hostapd/hostapd.accept)
     --hostapd-debug <level> 1 or 2. Passes -d or -dd to hostapd
     --isolate-clients       Disable wifi communication between clients
+    --sta-timeout <seconds> Timeout to disconnect a no-signal client
     --no-haveged            Do not run haveged automatically when needed
     --hs20                  Enable Hotspot 2.0
 
-    WiFi 4 (802.11n) configs:
-    --wifi4                 Enable IEEE 802.11n (HT)
-    --req-ht                Require station HT (High Throughput) mode
-    --ht-capab <HT caps>    HT capabilities (default: [HT40+])
-
-    WiFi 5 (802.11ac) configs:
-    --wifi5                 Enable IEEE 802.11ac (VHT)
-    --req-vht               Require station VHT (Very High Thoughtput) mode
-    --vht-capab <VHT caps>  VHT capabilities
+  WiFi 4 (802.11n) configs (2.4G/5GHz):  (default: not enable)
+    --wifi4                 Enable IEEE 802.11n (HT, High Throughput)
+    --ht-capab <HT caps>    HT capabilities (example: '[HT40+][DSSS_CCK-40]')
+                            (default: '[HT40+]')
+    --req-wifi4             Only support Wifi>=4 clients
 
+  WiFi 5 (802.11ac) configs (5GHz):  (default: not enable)
+    --wifi5                 Enable IEEE 802.11ac (VHT, Very High Thoughtput)
+    --vht-capab <VHT caps>  VHT capabilities (example: '[VHT160][RXLDPC]')
     --vht-ch-width <index>  Index of VHT channel width:
                                 0 for 20MHz or 40MHz (default)
                                 1 for 80MHz
@@ -403,9 +407,32 @@ Options:
                             segment. Use with '--vht-ch-width'
     --vht-seg1-ch <channel> Channel index of VHT center frequency for secondary
                             (second 80MHz) segment. Use with '--vht-ch-width 3'
+    --req-wifi5             Only support Wifi>=5 clients
+
+  WiFi 6 (802.11ax) configs (2.4G/5GHz):  (default: not enable)
+    --wifi6                 Enable IEEE 802.11ax (HE, High Efficiency)
+    --he-ch-width <index>   Index of HE channel width:
+                                0 for 20MHz or 40MHz (default)
+                                1 for 80MHz
+                                2 for 160MHz
+                                3 for 80+80MHz (Non-contigous 160MHz)
+    --he-seg0-ch <channel>  Channel index of HE center frequency for primary
+                            segment. Use with '--he-ch-width'
+    --he-seg1-ch <channel>  Channel index of HE center frequency for secondary
+                            (second 80MHz) segment. Use with '--he-ch-width 3'
+    --he-su-bfe             HE Single User Beamformee support
+    --he-su-bfr             HE Single User Beamformer support
+    --he-mu-bfr             HE Multi User Beamformer support
+    --req-wifi6             Only support Wifi>=6 clients
+    --p2ptwt                Peer-to-Peer Target Wake Time support
+
+    Note: Some cutting-edge Wifi features strongly depends on hostapd built
+          with specific flags enabled and compatible hardware
 
   Instance managing:
     --daemon                Run in background
+    --keep-confdir          Don't delete the temporary config dir after exit
+
     -l, --list-running      Show running instances
     --lc, --list-clients <id|interface>
                             List clients of an instance. Or list neighbors of
@@ -414,16 +441,21 @@ Options:
     --stop <id>             Stop a running instance
         For <id> you can use PID or subnet interface name.
         You can get them with '--list-running'
-                
-Examples:
-    lnxrouter -i eth1
-    lnxrouter --ap wlan0 MyAccessPoint -p MyPassPhrase
-    lnxrouter -i eth1 --tp <transparent-proxy> --dns <dns-proxy>
 ```
 
 </details>
 
-## What changes are done to Linux system
+## System admins should know
+
+### Take care of concurrency
+
+Linux-router script is home-made, not enterprise-level.
+
+- You can run multiple linux-router instances and they work simultaneous, as long as you start/stop **one by one**, not all at once. We **can't ensure** its locks covering 100% race condition edge cases.
+
+- Use it after the system has fully booted. When you’re manually (re)starting/stopping some network-related services, stop linux-router first, otherwise those services (flushing iptables or some) may break linux-router's setup. 
+
+### What changes are done to Linux system
 
 On exit of a linux-router instance, script **will do cleanup**, i.e. undo most changes to system. Though, **some** changes (if needed) will **not** be undone, which are:
 
@@ -442,7 +474,7 @@ Visit [**my homepage** 🏡](https://garywill.github.io) to see **more tools and
 > 
 > 🥂 ( ^\_^) o自自o (^_^ ) 🍻
 
-🤝 Bisides, thank [create_ap](https://github.com/oblique/create_ap) by [oblique](https://github.com/oblique). This script was forked from create\_ap. Now they are quite different. (See `history` branch for how I modified create_ap). 🤝 Also thank those who contributed to that project.
+🤝 Bisides, thank [create_ap](https://github.com/oblique/create_ap) by [oblique](https://github.com/oblique). This script was forked from create\_ap. Now they are quite different. 🤝 Also thank those people who contributed to that project.
 
 👨‍💻 You can be contributor, too! 
 

lnxrouter

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-VERSION=0.7.6
+VERSION=0.8.2
 PROGNAME="$(basename "$0")"
 
 export LC_ALL=C
@@ -92,28 +92,29 @@ Options:
                             (example: US)
     --freq-band <GHz>       Set frequency band: 2.4 or 5 (default: 2.4)
     --driver                Choose your WiFi adapter driver (default: nl80211)
-    -w <WPA version>        '2' for WPA2, '1' for WPA, '1+2' for both
-                            (default: 2)
-    --psk                   Use 64 hex digits pre-shared-key instead of
-                            passphrase
+    -w <WPA version>        WPA version indicator, can be '2', '3', '1', '3+2',
+                            '3+2+1', '2+1'. Requires '-p'. (default: '2')
+                            (Note WPA1 is legacy and unsafe)
+    --psk                   Use 64 hex digits pre-shared-key. Value of '-p'
+                            should be hex string instead of password
     --mac-filter            Enable WiFi hotspot MAC address filtering
     --mac-filter-accept     Location of WiFi hotspot MAC address filter list
                             (defaults to /etc/hostapd/hostapd.accept)
     --hostapd-debug <level> 1 or 2. Passes -d or -dd to hostapd
     --isolate-clients       Disable wifi communication between clients
+    --sta-timeout <seconds> Timeout to disconnect a no-signal client
     --no-haveged            Do not run haveged automatically when needed
     --hs20                  Enable Hotspot 2.0
 
-    WiFi 4 (802.11n) configs:
-    --wifi4                 Enable IEEE 802.11n (HT)
-    --req-ht                Require station HT (High Throughput) mode
-    --ht-capab <HT caps>    HT capabilities (default: [HT40+])
-
-    WiFi 5 (802.11ac) configs:
-    --wifi5                 Enable IEEE 802.11ac (VHT)
-    --req-vht               Require station VHT (Very High Thoughtput) mode
-    --vht-capab <VHT caps>  VHT capabilities
+  WiFi 4 (802.11n) configs (2.4G/5GHz):  (default: not enable)
+    --wifi4                 Enable IEEE 802.11n (HT, High Throughput)
+    --ht-capab <HT caps>    HT capabilities (example: '[HT40+][DSSS_CCK-40]')
+                            (default: '[HT40+]')
+    --req-wifi4             Only support Wifi>=4 clients
 
+  WiFi 5 (802.11ac) configs (5GHz):  (default: not enable)
+    --wifi5                 Enable IEEE 802.11ac (VHT, Very High Thoughtput)
+    --vht-capab <VHT caps>  VHT capabilities (example: '[VHT160][RXLDPC]')
     --vht-ch-width <index>  Index of VHT channel width:
                                 0 for 20MHz or 40MHz (default)
                                 1 for 80MHz
@@ -123,9 +124,32 @@ Options:
                             segment. Use with '--vht-ch-width'
     --vht-seg1-ch <channel> Channel index of VHT center frequency for secondary
                             (second 80MHz) segment. Use with '--vht-ch-width 3'
+    --req-wifi5             Only support Wifi>=5 clients
+
+  WiFi 6 (802.11ax) configs (2.4G/5GHz):  (default: not enable)
+    --wifi6                 Enable IEEE 802.11ax (HE, High Efficiency)
+    --he-ch-width <index>   Index of HE channel width:
+                                0 for 20MHz or 40MHz (default)
+                                1 for 80MHz
+                                2 for 160MHz
+                                3 for 80+80MHz (Non-contigous 160MHz)
+    --he-seg0-ch <channel>  Channel index of HE center frequency for primary
+                            segment. Use with '--he-ch-width'
+    --he-seg1-ch <channel>  Channel index of HE center frequency for secondary
+                            (second 80MHz) segment. Use with '--he-ch-width 3'
+    --he-su-bfe             HE Single User Beamformee support
+    --he-su-bfr             HE Single User Beamformer support
+    --he-mu-bfr             HE Multi User Beamformer support
+    --req-wifi6             Only support Wifi>=6 clients
+    --p2ptwt                Peer-to-Peer Target Wake Time support
+
+    Note: Some cutting-edge Wifi features strongly depends on hostapd built
+          with specific flags enabled and compatible hardware
 
   Instance managing:
     --daemon                Run in background
+    --keep-confdir          Don't delete the temporary config dir after exit
+
     -l, --list-running      Show running instances
     --lc, --list-clients <id|interface>
                             List clients of an instance. Or list neighbors of
@@ -190,18 +214,11 @@ define_global_variables(){
     WIFI_IFACE=
     CHANNEL=default
     HOTSPOT20=0 # For enabling Hotspot 2.0
-    WPA_VERSION=2
+    WPA1_ENABLE=0 # Enable legacy unsafe WPA1
+    WPA2_ENABLE=1 # Enable WPA2 PSK-Personal
+    WPA3_ENABLE=0 # Enable WPA3 SAE
     MAC_FILTER=0
     MAC_FILTER_ACCEPT=/etc/hostapd/hostapd.accept
-    IEEE80211N=0
-    REQUIREHT=0
-    IEEE80211AC=0
-    REQUIREVHT=0
-    HT_CAPAB='[HT40+]'
-    VHT_CAPAB=
-    VHTCHANNELWIDTH=0
-    VHTSEG0CHINDEX=0
-    VHTSEG1CHINDEX=0
     DRIVER=nl80211
     NO_VIRT=0 # not use virtual interface
     COUNTRY=
@@ -211,8 +228,32 @@ define_global_variables(){
     USE_PSK=0
     ISOLATE_CLIENTS=0
     QR=0 # show wifi qr
+    STATIMEOUT=
+
+    #wifi4
+    IEEE80211N=0
+    REQUIREHT=0
+    HT_CAPAB='[HT40+]'
+    #wifi5
+    IEEE80211AC=0
+    REQUIREVHT=0
+    VHT_CAPAB=
+    VHTCHANNELWIDTH=0
+    VHTSEG0CHINDEX=
+    VHTSEG1CHINDEX=
+    #wifi6
+    IEEE80211AX=0
+    REQUIREHE=0
+    HECHANNELWIDTH=0
+    HESEG0CHINDEX=
+    HESEG1CHINDEX=
+    HESUBFE=0
+    HESUBFR=0
+    HEMUBFR=0
+    P2PTWT=0
 
     # script variables
+    PHY=
     VWIFI_IFACE=  # virtual wifi interface name, if created
     VIRT_NAME= # name to use for virtual interface if --virt-name is used
     AP_IFACE=     # can be VWIFI_IFACE or WIFI_IFACE
@@ -230,7 +271,9 @@ define_global_variables(){
     NM_UNM_LIST=  # it's called "list" but for now one interface
     NM_PID=
     FIREWALLD_PID=
+    OLD_FIREWALLD_ZONE=
     TMP_FIREWALLD_ZONE=
+    KEEP_CONFDIR=
 }
 
 parse_user_options(){
@@ -268,8 +311,6 @@ parse_user_options(){
                 SHARE_METHOD=redsocks
                 shift
                 ;;
-                
-                
             -g)
                 shift
                 GATEWAY4="$1"
@@ -298,7 +339,6 @@ parse_user_options(){
                 shift
                 MAC_USE_RANDOM=1
                 ;;
-                
             --dns)
                 shift
                 DNS="$1"
@@ -348,12 +388,11 @@ parse_user_options(){
                 shift
                 DNS_NOCACHE=1
                 ;;
-            
             --isolate-clients)
                 shift
                 ISOLATE_CLIENTS=1
                 ;;
-                
+            # wifi ap
             --ap)
                 shift
                 WIFI_IFACE="$1"
@@ -370,8 +409,6 @@ parse_user_options(){
                 shift
                 QR=1
                 ;;
-                
-                
             --hidden)
                 shift
                 HIDDEN=1
@@ -385,7 +422,6 @@ parse_user_options(){
                 MAC_FILTER_ACCEPT="$1"
                 shift
                 ;;
-
             -c)
                 shift
                 CHANNEL="$1"
@@ -397,50 +433,34 @@ parse_user_options(){
                 ;;
             -w)
                 shift
-                WPA_VERSION="$1"
-                [[ "$WPA_VERSION" == "2+1" ]] && WPA_VERSION=1+2
+                case "$1" in
+                    "3")
+                        WPA1_ENABLE=0; WPA2_ENABLE=0; WPA3_ENABLE=1
+                        ;;
+                    "2")
+                        WPA1_ENABLE=0; WPA2_ENABLE=1; WPA3_ENABLE=0
+                        ;;
+                    "1")
+                        WPA1_ENABLE=1; WPA2_ENABLE=0; WPA3_ENABLE=0
+                        ;;
+                    "3+2")
+                        WPA1_ENABLE=0; WPA2_ENABLE=1; WPA3_ENABLE=1
+                        ;;
+                    "2+1"|"1+2") # '1+2' is for compatibility to old script.
+                        WPA1_ENABLE=1; WPA2_ENABLE=1; WPA3_ENABLE=0
+                        ;;
+                    "3+2+1")
+                        WPA1_ENABLE=1; WPA2_ENABLE=1; WPA3_ENABLE=1
+                        ;;
+                    *)
+                        echo "Invalid -w value" >&2
+                        exit 1
+                esac
                 shift
                 ;;
-
-            --wifi4|--ieee80211n)
+            --sta-timeout)
                 shift
-                IEEE80211N=1
-                ;;
-            --req-ht|--require-ht)
-                shift
-                REQUIREHT=1
-                ;;
-            --wifi5|--ieee80211ac)
-                shift
-                IEEE80211AC=1
-                ;;
-            --req-vht|--require-vht)
-                shift
-                REQUIREVHT=1
-                ;;
-            --ht-capab)
-                shift
-                HT_CAPAB="$1"
-                shift
-                ;;
-            --vht-capab)
-                shift
-                VHT_CAPAB="$1"
-                shift
-                ;;
-            --vht-ch-width|--vht-channel-width)
-                shift
-                VHTCHANNELWIDTH="$1"
-                shift
-                ;;
-            --vht-seg0-ch|--vht-seg0-channel)
-                shift
-                VHTSEG0CHINDEX="$1"
-                shift
-                ;;
-            --vht-seg1-ch|--vht-seg1-channel)
-                shift
-                VHTSEG1CHINDEX="$1"
+                STATIMEOUT="$1"
                 shift
                 ;;
             --driver)
@@ -457,7 +477,6 @@ parse_user_options(){
                 VIRT_NAME="$1"
                 shift
                 ;;
-
             --country)
                 shift
                 COUNTRY="$1"
@@ -488,7 +507,90 @@ parse_user_options(){
                 shift
                 USE_PSK=1
                 ;;
-
+            # wifi 4
+            --wifi4|--ieee80211n)
+                shift
+                IEEE80211N=1
+                ;;
+            --req-wifi4|--req-ht|--require-ht)
+                shift
+                REQUIREHT=1
+                ;;
+            --ht-capab)
+                shift
+                HT_CAPAB="$1"
+                shift
+                ;;
+            # wifi 5
+            --wifi5|--ieee80211ac)
+                shift
+                IEEE80211AC=1
+                ;;
+            --req-wifi5|--req-vht|--require-vht)
+                shift
+                REQUIREVHT=1
+                ;;
+            --vht-capab)
+                shift
+                VHT_CAPAB="$1"
+                shift
+                ;;
+            --vht-ch-width|--vht-channel-width)
+                shift
+                VHTCHANNELWIDTH="$1"
+                shift
+                ;;
+            --vht-seg0-ch|--vht-seg0-channel)
+                shift
+                VHTSEG0CHINDEX="$1"
+                shift
+                ;;
+            --vht-seg1-ch|--vht-seg1-channel)
+                shift
+                VHTSEG1CHINDEX="$1"
+                shift
+                ;;
+            # wifi 6
+            --wifi6|--ieee80211ax)
+                shift
+                IEEE80211AX=1
+                ;;
+            --req-wifi6|--req-he|--require-he)
+                shift
+                REQUIREHE=1
+                ;;
+            --he-ch-width|--he-channel-width)
+                shift
+                HECHANNELWIDTH="$1"
+                shift
+                ;;
+            --he-seg0-ch|--he-seg0-channel)
+                shift
+                HESEG0CHINDEX="$1"
+                shift
+                ;;
+            --he-seg1-ch|--he-seg1-channel)
+                shift
+                HESEG1CHINDEX="$1"
+                shift
+                ;;
+            --he-su-bfe)
+                shift
+                HESUBFE=1
+                ;;
+            --he-su-bfr)
+                shift
+                HESUBFR=1
+                ;;
+            --he-mu-bfr)
+                shift
+                HEMUBFR=1
+                ;;
+            --p2ptwt)
+                shift
+                P2PTWT=1
+                ;;
+            # instance managing
             --daemon)
                 shift
                 DAEMONIZE=1
@@ -507,7 +609,10 @@ parse_user_options(){
                 LIST_CLIENTS_ID="$1"
                 shift
                 ;;
-
+            --keep-confdir)
+                shift
+                KEEP_CONFDIR=1
+                ;;
             *)
                 echo  "Invalid parameter: $1" 1>&2
                 exit 1
@@ -582,7 +687,6 @@ get_interface_phy_device() { # only for wifi interface
             return 0
         fi
     done
-    echo "Failed to get phy interface" >&2
     return 1
 }
 
@@ -622,38 +726,51 @@ can_be_ap() {
 }
 
 can_transmit_to_channel() {
-    local IFACE CHANNEL_NUM CHANNEL_INFO
+    local IFACE CHANNEL_NUM CHANNEL_INFO CHANNEL_FREQ_FILTER
     IFACE=$1
     CHANNEL_NUM=$2
+    if [[ $FREQ_BAND == "2.4" ]]; then
+        CHANNEL_FREQ_FILTER="(24)"
+    elif [[ $FREQ_BAND -eq 5 ]]; then
+        CHANNEL_FREQ_FILTER="(5[1-8])"
+    elif [[ $FREQ_BAND -eq 6 ]]; then
+        CHANNEL_FREQ_FILTER="((59)|(6[0-9])|(7[0-1]))"
+    fi
 
     if [[ $USE_IWCONFIG -eq 0 ]]; then
-        CHANNEL_INFO=$(get_adapter_info "${IFACE}" | grep -E " [0-9]+(\.[0-9]+){0,1} MHz \[${CHANNEL_NUM}\]")
+        CHANNEL_INFO=$(get_adapter_info "${IFACE}" | grep -E " ${CHANNEL_FREQ_FILTER}[0-9]{2}(\.[0-9]+){0,1} MHz \[${CHANNEL_NUM}\]")
         [[ -z "${CHANNEL_INFO}" ]] && return 1
-        [[ "${CHANNEL_INFO}" == *no\ IR* ]] && return 1
-        [[ "${CHANNEL_INFO}" == *disabled* ]] && return 1
+        [[ "${CHANNEL_INFO}" == *no\ IR* ]] && return 2
+        [[ "${CHANNEL_INFO}" == *disabled* ]] && return 3
         return 0
     else
-        CHANNEL_NUM=$(printf '%02d' ${CHANNEL_NUM})
+        CHANNEL_NUM="$(printf '%02d' "${CHANNEL_NUM}")"
         CHANNEL_INFO=$(iwlist "${IFACE}" channel | grep -E "Channel[[:blank:]]${CHANNEL_NUM}[[:blank:]]?:")
         [[ -z "${CHANNEL_INFO}" ]] && return 1
         return 0
     fi
 }
 
-# taken from iw/util.c
 ieee80211_frequency_to_channel() {
     local FREQ=$1
-    if [[ $FREQ -eq 2484 ]]; then
+
+    # 2.4G
+    if [[ $FREQ -ge 2412 && $FREQ -le 2472 ]]; then # 2.4 GHz band: Channels 1-13 (2412~2472 MHz)
+        echo $(( (FREQ - 2407) / 5 ))
+    elif [[ $FREQ -eq 2484 ]]; then # 2.4 GHz Channel 14 (2484 MHz, Japan only)
         echo 14
-    elif [[ $FREQ -lt 2484 ]]; then
-        echo $(( ($FREQ - 2407) / 5 ))
-    elif [[ $FREQ -ge 4910 && $FREQ -le 4980 ]]; then
-        echo $(( ($FREQ - 4000) / 5 ))
-    elif [[ $FREQ -le 45000 ]]; then
-        echo $(( ($FREQ - 5000) / 5 ))
-    elif [[ $FREQ -ge 58320 && $FREQ -le 64800 ]]; then
-        echo $(( ($FREQ - 56160) / 2160 ))
-    else
+
+    # 5G
+    elif [[ $FREQ -ge 5160 && $FREQ -le 5885 ]]; then # 5 GHz band: Standard Channels 36-165 (5180~5825 MHz) (extra: 32, 169-177)
+        echo $(( (FREQ - 5000) / 5 ))
+
+    # 6G
+    elif [[ $FREQ -ge 5955 && $FREQ -le 7115 ]]; then # 6 GHz band: Channels 1-233 (5955~7115 MHz), Wi-Fi 6E/7
+        echo $(( (FREQ - 5950) / 5 ))
+    elif [[ $FREQ -eq 5935 ]]; then # 6 GHz band: Special case for 5935 MHz (Channel 2, rare)
+        echo 2
+
+    else # Frequency not in supported Wi-Fi bands (2.4/5/6 GHz)
         echo 0
     fi
 }
@@ -673,7 +790,7 @@ is_unicast_macaddr() {
     local x
     x=$(echo "$1" | cut -d: -f1)
     x=$(printf '%d' "0x${x}")
-    [[ $(expr $x % 2) -eq 0 ]]
+    [[ $(expr "$x" % 2) -eq 0 ]]
 }
 
 get_interface_mac() {
@@ -704,7 +821,7 @@ show_interface_pci_info() {  # pci id / model / virtual
         bus_id="$(echo "$device_path" | sed 's/\//\n/g' | tail -n 3 |sed -n 1p)"
         device_type_and_bus_id="PCI: $bus_id"
 
-        if which lspci >/dev/null 2>&1 ; then
+        if command -v lspci >/dev/null 2>&1 ; then
             device_fullname="$( lspci -D -nn -s "$bus_id" | awk '{$1="" ; print $0}' )"
         fi
 
@@ -716,7 +833,7 @@ show_interface_pci_info() {  # pci id / model / virtual
     [[ -n "$driver" ]] && echo "System-already-loaded driver: $driver"
     [[ -n "$device_fullname" ]] && echo "$device_fullname"
     echo ""
-    # TODO usb
+    # TODO Fix pci and usb devices
 }
 
 alloc_new_vface_name() { # only for wifi
@@ -781,15 +898,15 @@ generate_random_mac() {
 is_ip4_lan_range_available() { # checks 192.168.x.x
     ( ip -4 address | grep "inet 192\.168\.$1\." > /dev/null 2>&1 ) && return 1
     ( ip -4 route | grep "^192\.168\.$1\." > /dev/null 2>&1 ) && return 1
-    ( ip -4 route get 192.168.$1.0 2>&1 | grep -E "\bvia\b|\bunreachable\b" > /dev/null 2>&1 ) && \
-    ( ip -4 route get 192.168.$1.255 2>&1 | grep  -E "\bvia\b|\bunreachable\b" > /dev/null 2>&1 )  && return 0
+    ( ip -4 route get "192.168.$1.0" 2>&1 | grep -E "\bvia\b|\bunreachable\b" > /dev/null 2>&1 ) && \
+    ( ip -4 route get "192.168.$1.255" 2>&1 | grep  -E "\bvia\b|\bunreachable\b" > /dev/null 2>&1 )  && return 0
     return 1
 }
 is_ip6_lan_range_available() {  # checks fdxx::
     ( ip -6 address | grep -i "inet6 fd$1:$2$3:$4$5:$6$7:" > /dev/null 2>&1 ) && return 1
     ( ip -6 route | grep -i "^fd$1:$2$3:$4$5:$6$7:" > /dev/null 2>&1 ) && return 1
-    ( ip -6 route get fd$1:$2$3:$4$5:$6$7:: 2>&1 | grep -E "\bvia\b|\bunreachable\b" > /dev/null 2>&1 ) && \
-    ( ip -6 route get fd$1:$2$3:$4$5:$6$7:ffff:ffff:ffff:ffff 2>&1 | grep -E "\bvia\b|\bunreachable\b" > /dev/null 2>&1 )  && return 0
+    ( ip -6 route get "fd$1:$2$3:$4$5:$6$7::" 2>&1 | grep -E "\bvia\b|\bunreachable\b" > /dev/null 2>&1 ) && \
+    ( ip -6 route get "fd$1:$2$3:$4$5:$6$7:ffff:ffff:ffff:ffff" 2>&1 | grep -E "\bvia\b|\bunreachable\b" > /dev/null 2>&1 )  && return 0
     return 1
 }
 
@@ -823,7 +940,7 @@ haveged_watchdog() {
     local show_warn=1
     while :; do
         if [[ $(cat /proc/sys/kernel/random/entropy_avail) -lt 1000 ]]; then
-            if ! which haveged > /dev/null 2>&1; then
+            if ! command -v haveged > /dev/null 2>&1; then
                 if [[ $show_warn -eq 1 ]]; then
                     echo "WARN: Low entropy detected. We recommend you to install \`haveged'" 1>&2
                     show_warn=0
@@ -831,7 +948,7 @@ haveged_watchdog() {
             elif ! pidof haveged > /dev/null 2>&1; then # TODO judge zombie ?
                 echo "Low entropy detected, starting haveged" 1>&2
                 # boost low-entropy
-                haveged -w 1024 -p $COMMON_CONFDIR/haveged.pid
+                haveged -w 1024 -p "$COMMON_CONFDIR/haveged.pid"
             fi
         fi
         sleep 2
@@ -860,7 +977,7 @@ get_pid_by_dbus_name() {
     local DBUS_NAME="$1"
     local pid  r
 
-    which dbus-send >/dev/null 2>&1 || return 1
+    command -v dbus-send >/dev/null 2>&1 || return 1
 
     pid="$( dbus-send --system --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetConnectionUnixProcessID string:$DBUS_NAME  2>/dev/null | grep "   uint32 " | awk '{print $2}' )"
     r=$?
@@ -870,8 +987,12 @@ get_pid_by_dbus_name() {
 }
 is_same_netns() {
     local pid2="$1"
+    local my_netns his_netns
     [[ ! -f /proc/$$/ns/net ]] && return 0 # no netns feature. treat as same
-    [[ "$(readlink /proc/$$/ns/net)" == "$(readlink /proc/$pid2/ns/net)" ]] && return 0
+    my_netns="$(readlink "/proc/$$/ns/net")"
+    his_netns="$(readlink "/proc/$pid2/ns/net")"
+    [[ ! -n "$his_netns" ]] && return 1 # can't find his pid or netns (maybe different pidns), treat as not same
+    [[ "$my_netns" == "$his_netns" ]] && return 0
     return 1
 }
 #-----------------
@@ -881,7 +1002,7 @@ is_nm_running() {
 
     [[ ! -n "$NM_PID" ]] && return 1 # not running
 
-    if (which nmcli >/dev/null 2>&1 ) && (nmcli -t -f RUNNING g 2>&1 | grep -E '^running$' >/dev/null 2>&1 ) ; then
+    if (command -v nmcli >/dev/null 2>&1 ) && (nmcli -t -f RUNNING g 2>&1 | grep -E '^running$' >/dev/null 2>&1 ) ; then
         if is_same_netns "$NM_PID"; then
             return 0
         fi
@@ -918,7 +1039,7 @@ nm_set_managed() {
     NM_UNM_LIST=
 }
 nm_restore_manage() {
-    if [[ $NM_UNM_LIST ]]; then
+    if [[ -n "$NM_UNM_LIST" ]]; then
         echo "Restore $NM_UNM_LIST managed by NetworkManager"
         nm_set_managed "$NM_UNM_LIST"
         sleep 0.5
@@ -930,7 +1051,7 @@ is_firewalld_running() {
 
     [[ ! -n "$FIREWALLD_PID" ]] && return 1 # not running
 
-    if (which firewall-cmd >/dev/null 2>&1 ) && [[ "$(firewall-cmd --state 2>&1)" == "running" ]] ; then
+    if (command -v firewall-cmd >/dev/null 2>&1 ) && [[ "$(firewall-cmd --state 2>&1)" == "running" ]] ; then
         if is_same_netns "$FIREWALLD_PID"; then
             echo "firewalld is running ($(firewall-cmd --version))"
             return 0
@@ -940,18 +1061,28 @@ is_firewalld_running() {
     FIREWALLD_PID=  # cancel value if treat as not running
     return 1  # not running
 }
-firewalld_add_tmpzone() {
-#     TMP_FIREWALLD_ZONE="lrt${$}${SUBNET_IFACE}"
-    TMP_FIREWALLD_ZONE="trusted"
-#     firewall-cmd --new-zone=$TMP_FIREWALLD_ZONE  || die "Failed creating temporary firewalld zone"
+firewalld_addto_tmptrustedzone() {
+    OLD_FIREWALLD_ZONE="$(firewall-cmd --get-zone-of-interface=$SUBNET_IFACE 2>/dev/null)"
+    [[ "$OLD_FIREWALLD_ZONE" == 'trusted' ]] && return
+
+    TMP_FIREWALLD_ZONE="trusted" # need subnet interface into this zone during linux-router working
+    if [[ -n "$OLD_FIREWALLD_ZONE" ]]; then
+        echo "Getting $SUBNET_IFACE out from firewalld zone '$OLD_FIREWALLD_ZONE' ..."
+        firewall-cmd --zone=$OLD_FIREWALLD_ZONE --remove-interface=$SUBNET_IFACE >/dev/null || die "Failed removing $SUBNET_IFACE from firewalld '$OLD_FIREWALLD_ZONE' zone"
+    fi
     echo "Adding $SUBNET_IFACE to firewalld '$TMP_FIREWALLD_ZONE' zone"
-    firewall-cmd --zone=$TMP_FIREWALLD_ZONE --add-interface=$SUBNET_IFACE >/dev/null || die "Failed adding interface to firewalld temporary zone"
+    firewall-cmd --zone=$TMP_FIREWALLD_ZONE --add-interface=$SUBNET_IFACE >/dev/null || die "Failed adding interface to firewalld temporary '$TMP_FIREWALLD_ZONE' zone"
+
 }
-firewalld_del_tmpzone() {
+firewalld_restoreoldzone() {
     if [[ -n "$TMP_FIREWALLD_ZONE" ]];then
         echo "Removing $SUBNET_IFACE from firewalld '$TMP_FIREWALLD_ZONE' zone"
         firewall-cmd --zone=$TMP_FIREWALLD_ZONE --remove-interface=$SUBNET_IFACE >/dev/null
-#         firewall-cmd --delete-zone=$TMP_FIREWALLD_ZONE
+
+        if [[ -n "$OLD_FIREWALLD_ZONE" ]]; then
+            echo "Restoring $SUBNET_IFACE to firewalld '$OLD_FIREWALLD_ZONE' zone"
+            firewall-cmd --zone=$OLD_FIREWALLD_ZONE --add-interface=$SUBNET_IFACE >/dev/null
+        fi
     fi
 }
 
@@ -1078,7 +1209,7 @@ start_nat() {
 
             # forward subnet -> internet
             iptb "$iv" v filter I FORWARD  -i "$SUBNET_IFACE"  -s "$SUBNET_NET" \
-                -o $INTERNET_IFACE \
+                -o "$INTERNET_IFACE" \
                 -j ACCEPT || die
 
             # forward any -> subnet
@@ -1184,8 +1315,8 @@ allow_dhcp() {
     echo
     echo "iptables: allow dhcp"
 
-    iptb 4 v filter I INPUT -i ${SUBNET_IFACE} -p udp -m udp --dport 67 -j ACCEPT || die
-    iptb 6 v filter I INPUT -i ${SUBNET_IFACE} -p udp -m udp --dport 547 -j ACCEPT || die
+    iptb 4 v filter I INPUT -i "${SUBNET_IFACE}" -p udp -m udp --dport 67 -j ACCEPT || die
+    iptb 6 v filter I INPUT -i "${SUBNET_IFACE}" -p udp -m udp --dport 547 -j ACCEPT || die
 }
 
 # TODO: use 'DNAT' instead of '--to-ports' to support other IP
@@ -1222,8 +1353,8 @@ start_redsocks() {
         iptb "$iv" v nat I PREROUTING -i "$SUBNET_IFACE" -s "$SUBNET_NET" -j lrt${$}${SUBNET_IFACE}-TP || die
 
 
-        iptb "$iv" v filter I INPUT -i "$SUBNET_IFACE" -s "$SUBNET_NET" -p tcp -m tcp --dport ${TP_PORT}  -j ACCEPT || die
-        iptb "$iv" v filter I INPUT -i "$SUBNET_IFACE" -s "$SUBNET_NET" -p udp -m udp --dport ${TP_PORT}  -j ACCEPT || die
+        iptb "$iv" v filter I INPUT -i "$SUBNET_IFACE" -s "$SUBNET_NET" -p tcp -m tcp --dport "${TP_PORT}"  -j ACCEPT || die
+        iptb "$iv" v filter I INPUT -i "$SUBNET_IFACE" -s "$SUBNET_NET" -p udp -m udp --dport "${TP_PORT}"  -j ACCEPT || die
     done
 }
 
@@ -1324,13 +1455,13 @@ _cleanup() {
 
     ip addr flush "${SUBNET_IFACE}"
 
-    rm -rf "$CONFDIR"
+    [[ ! "$KEEP_CONFDIR" -eq 1 ]] && rm -rf "$CONFDIR"
 
     ip link set down dev "${SUBNET_IFACE}"
 
-    firewalld_del_tmpzone
+    firewalld_restoreoldzone
 
-    if [[ $VWIFI_IFACE ]]; then # the subnet interface (virtual wifi interface) will be removed
+    if [[ -n "$VWIFI_IFACE" ]]; then # the subnet interface (virtual wifi interface) will be removed
         iw dev "${VWIFI_IFACE}" del
         dealloc_vface_name "$VWIFI_IFACE"
     fi
@@ -1360,6 +1491,7 @@ clean_iptables() {
 
 cleanup() {
     trap "" SIGINT SIGUSR1 SIGUSR2 EXIT SIGTERM
+    touch "$CONFDIR/exit_$(date +"%Y-%m-%d_%H:%M:%S.%6N")"
     echo
     echo
     echo "Doing cleanup.. "
@@ -1402,12 +1534,14 @@ init_conf_dirs() {
     cd "$TMPDIR" || die "Couldn't change directory to linux-router's temporary path"
 
     CONFDIR="$(mktemp -d $TMPDIR/lnxrouter.${TARGET_IFACE}.conf.XXXXXX)" || die "Instance couldn't make config dir" # config dir for one instance
-    chmod 755 "$CONFDIR"
-    #echo "Config dir: $CONFDIR"
+    echo "Config dir: $CONFDIR"
+    chmod 755 "$CONFDIR" || die "chmod config dir failed"
     echo $$ > "$CONFDIR/pid"
 
+    touch "$CONFDIR/begin_$(date +"%Y-%m-%d_%H:%M:%S.%6N")"
+
     COMMON_CONFDIR="$TMPDIR/lnxrouter_common.conf" # config dir for all instances
-    mkdir -p "$COMMON_CONFDIR"
+    mkdir -p "$COMMON_CONFDIR" || die "Failed creating common config dir"
 }
 
 #== functions to deal with running instances
@@ -1657,14 +1791,19 @@ daemonizing_check(){
 
 #============================
 check_wifi_settings() {
+    PHY="$(get_interface_phy_device "$WIFI_IFACE")"
+    if [[ -z "$PHY" ]]; then
+        echo "ERROR: Can't get phy of wifi interface '$WIFI_IFACE' (Did you spell the interface name right?)" >&2
+        exit 1
+    fi
 
-    if ! ( which iw > /dev/null 2>&1 && iw dev "$WIFI_IFACE" info > /dev/null 2>&1 ); then
-        echo "WARN: Can't use 'iw' to operate interfce '$WIFI_IFACE', trying 'iwconfig' (not as good as 'iw') ... (Did you spell the interface name right?)" >&2
+    if ! ( command -v iw > /dev/null 2>&1 && iw dev "$WIFI_IFACE" info > /dev/null 2>&1 ); then
+        echo "WARN: Can't use 'iw' to operate interfce '$WIFI_IFACE', trying 'iwconfig' (not as good as 'iw') ..." >&2
         USE_IWCONFIG=1
     fi
 
     if [[ $USE_IWCONFIG -eq 1 ]]; then
-        if ! (which iwconfig > /dev/null 2>&1 && iwconfig "$WIFI_IFACE" > /dev/null 2>&1); then
+        if ! (command -v iwconfig > /dev/null 2>&1 && iwconfig "$WIFI_IFACE" > /dev/null 2>&1); then
             echo "ERROR: Can't use 'iwconfig' to operate interfce '$WIFI_IFACE'" >&2
             exit 1
         fi
@@ -1695,7 +1834,10 @@ check_wifi_settings() {
         fi
     fi
 
-    HOSTAPD=$(which hostapd)
+    HOSTAPD=$(command -v hostapd) || {
+        echo "ERROR: hostapd not found" >&2
+        exit 1
+    }
 
     if [[ $(get_adapter_kernel_module "${WIFI_IFACE}") =~ ^(8192[cd][ue]|8723a[sue])$ ]]; then
         if ! strings "$HOSTAPD" | grep -m1 rtl871xdrv > /dev/null 2>&1; then
@@ -1725,8 +1867,8 @@ check_wifi_settings() {
     fi
 
     if [[ $(get_adapter_kernel_module "${WIFI_IFACE}") =~ ^rtl[0-9].*$ ]]; then
-        if [[ $WPA_VERSION == '1' || $WPA_VERSION == '1+2' ]]; then
-            echo "WARN: Realtek drivers usually have problems with WPA1, WPA2 is recommended" >&2
+        if [[ $WPA1_ENABLE == '1' ]]; then
+            echo "WARN: Realtek drivers usually have problems with legacy WPA1" >&2
         fi
         echo "WARN: If AP doesn't work, read https://github.com/oblique/create_ap/blob/master/howto/realtek.md" >&2
     fi
@@ -1846,6 +1988,8 @@ prepare_wifi_interface() {
             CHANNEL=36
         fi
     fi
+
+    echo "Freq band: $FREQ_BAND GHz   Channel: $CHANNEL"
 }
 
 decide_subnet_interface() {
@@ -1875,6 +2019,10 @@ dealwith_mac() {
 }
 
 write_hostapd_conf() {
+    local WPA_VERSION
+    local WPA_KEYMGMT
+    local WPA_KEY_TYPE
+
     cat <<- EOF > "$CONFDIR/hostapd.conf"
 		beacon_int=100
 		ssid=${SSID}
@@ -1907,57 +2055,22 @@ write_hostapd_conf() {
 		EOF
     fi
 
-    if [[ $HOTSPOT20 -eq 1 ]]; then
-        echo "hs20=1" >> "$CONFDIR/hostapd.conf"
-    fi
-
-    if [[ $IEEE80211N -eq 1 ]]; then
-        cat <<- EOF >> "$CONFDIR/hostapd.conf"
-			ieee80211n=1
-			ht_capab=${HT_CAPAB}
-		EOF
-    fi
-
-    if [[ $REQUIREHT -eq 1 ]]; then
-        echo "require_ht=1" >> "$CONFDIR/hostapd.conf"
-    fi
-
-    if [[ $IEEE80211AC -eq 1 ]]; then
-        echo "ieee80211ac=1" >> "$CONFDIR/hostapd.conf"
-    fi
-
-    if [[ $REQUIREVHT -eq 1 ]]; then
-        echo "require_vht=1" >> "$CONFDIR/hostapd.conf"
-    fi
-
-    if [[ -n "$VHT_CAPAB" ]]; then
-        echo "vht_capab=${VHT_CAPAB}" >> "$CONFDIR/hostapd.conf"
-    fi
-
-	if [[ $VHTCHANNELWIDTH -gt 0 ]]; then
-		cat <<- EOF >> "$CONFDIR/hostapd.conf"
-			vht_oper_chwidth=${VHTCHANNELWIDTH}
-		EOF
-	fi
-
-	if [[ $VHTSEG0CHINDEX -gt 0 ]]; then
-		cat <<- EOF >> "$CONFDIR/hostapd.conf"
-			vht_oper_centr_freq_seg0_idx=${VHTSEG0CHINDEX}
-		EOF
-	fi
-
-	if [[ $VHTSEG1CHINDEX -gt 0 ]]; then
-		cat <<- EOF >> "$CONFDIR/hostapd.conf"
-			vht_oper_centr_freq_seg1_idx=${VHTSEG1CHINDEX}
-		EOF
-	fi
-
-    if [[ $IEEE80211N -eq 1 ]] || [[ $IEEE80211AC -eq 1 ]]; then
-        echo "wmm_enabled=1" >> "$CONFDIR/hostapd.conf"
-    fi
-
     if [[ -n "$PASSPHRASE" ]]; then
-        [[ "$WPA_VERSION" == "1+2" ]] && WPA_VERSION=3
+        WPA_VERSION=0    # 1 means wpa1. 2 means wpa2. 3 means wpa2+1
+        WPA_KEYMGMT=""   # WPA-PSK means wpa2 or wpa1. SAE means wpa3
+        if [[ $WPA1_ENABLE -eq 1 ]]; then
+            WPA_VERSION=$(($WPA_VERSION + 1))
+        fi
+        if [[ $WPA2_ENABLE -eq 1 || $WPA3_ENABLE -eq 1 ]]; then
+            WPA_VERSION=$(($WPA_VERSION + 2))
+        fi
+        if [[ $WPA1_ENABLE -eq 1 || $WPA2_ENABLE -eq 1 ]]; then
+            WPA_KEYMGMT+="WPA-PSK"
+        fi
+        if [[ $WPA3_ENABLE -eq 1 ]]; then
+            [[ ! -z "$WPA_KEYMGMT" ]] && WPA_KEYMGMT+=" "
+            WPA_KEYMGMT+="SAE"
+        fi
         if [[ $USE_PSK -eq 0 ]]; then
             WPA_KEY_TYPE=passphrase
         else
@@ -1966,13 +2079,98 @@ write_hostapd_conf() {
         cat <<- EOF >> "$CONFDIR/hostapd.conf"
 			wpa=${WPA_VERSION}
 			wpa_${WPA_KEY_TYPE}=${PASSPHRASE}
-			wpa_key_mgmt=WPA-PSK
+			wpa_key_mgmt=${WPA_KEYMGMT}
 			wpa_pairwise=CCMP
 			rsn_pairwise=CCMP
 		EOF
     else
         echo "WARN: WiFi is not protected by password" >&2
     fi
+
+    if [[ $HOTSPOT20 -eq 1 ]]; then
+        echo "hs20=1" >> "$CONFDIR/hostapd.conf"
+    fi
+
+    if [[ -n "$STATIMEOUT" ]]; then
+        echo "ap_max_inactivity=${STATIMEOUT}" >> "$CONFDIR/hostapd.conf"
+    fi
+
+    if [[ $IEEE80211N -eq 1 ]]; then # wifi4
+        echo "ieee80211n=1" >> "$CONFDIR/hostapd.conf"
+
+        if [[ -n "$HT_CAPAB" ]]; then
+            echo "ht_capab=${HT_CAPAB}" >> "$CONFDIR/hostapd.conf"
+        fi
+
+        if [[ $REQUIREHT -eq 1 ]]; then
+            echo "require_ht=1" >> "$CONFDIR/hostapd.conf"
+        fi
+    fi
+
+    if [[ $IEEE80211AC -eq 1 ]]; then # wifi5
+        echo "ieee80211ac=1" >> "$CONFDIR/hostapd.conf"
+
+        if [[ -n "$VHT_CAPAB" ]]; then
+            echo "vht_capab=${VHT_CAPAB}" >> "$CONFDIR/hostapd.conf"
+        fi
+
+        if [[ -n "$VHTCHANNELWIDTH" ]]; then
+            echo "vht_oper_chwidth=${VHTCHANNELWIDTH}" >> "$CONFDIR/hostapd.conf"
+        fi
+
+        if [[ -n "$VHTSEG0CHINDEX" ]]; then
+            echo "vht_oper_centr_freq_seg0_idx=${VHTSEG0CHINDEX}" >> "$CONFDIR/hostapd.conf"
+        fi
+
+        if [[ -n "$VHTSEG1CHINDEX" ]]; then
+            echo "vht_oper_centr_freq_seg1_idx=${VHTSEG1CHINDEX}" >> "$CONFDIR/hostapd.conf"
+        fi
+
+        if [[ $REQUIREVHT -eq 1 ]]; then
+            echo "require_vht=1" >> "$CONFDIR/hostapd.conf"
+        fi
+    fi
+
+    if [[ $IEEE80211AX -eq 1 ]]; then # wifi6
+        echo "ieee80211ax=1" >> "$CONFDIR/hostapd.conf"
+
+        if [[ $REQUIREHE -eq 1 ]]; then
+            echo "require_he=1" >> "$CONFDIR/hostapd.conf"
+        fi
+
+        if [[ $HESUBFE -eq 1 ]]; then
+            echo "he_su_beamformee=1" >> "$CONFDIR/hostapd.conf"
+        fi
+
+        if [[ $HESUBFR -eq 1 ]]; then
+            echo "he_su_beamformer=1" >> "$CONFDIR/hostapd.conf"
+        fi
+
+        if [[ $HEMUBFR -eq 1 ]]; then
+            echo "he_mu_beamformer=1" >> "$CONFDIR/hostapd.conf"
+        fi
+
+        if [[ -n "$HECHANNELWIDTH" ]]; then
+            echo "he_oper_chwidth=${HECHANNELWIDTH}" >> "$CONFDIR/hostapd.conf"
+        fi
+
+        if [[ -n "$HESEG0CHINDEX" ]]; then
+            echo "he_oper_centr_freq_seg0_idx=${HESEG0CHINDEX}" >> "$CONFDIR/hostapd.conf"
+        fi
+
+        if [[ -n "$HESEG1CHINDEX" ]]; then
+            echo "he_oper_centr_freq_seg1_idx=${HESEG1CHINDEX}" >> "$CONFDIR/hostapd.conf"
+        fi
+    fi
+
+    if [[ $P2PTWT -eq 1 ]]; then
+        echo "peer_to_peer_twt=1" >> "$CONFDIR/hostapd.conf"
+    fi
+
+    if [[ $IEEE80211N -eq 1 ]] || [[ $IEEE80211AC -eq 1 ]] || [[ $IEEE80211AX -eq 1 ]]; then
+        echo "wmm_enabled=1" >> "$CONFDIR/hostapd.conf"
+    fi
+
     chmod 600 "$CONFDIR/hostapd.conf"
 }
 
@@ -2080,15 +2278,16 @@ run_wifi_ap_processes() {
     # start access point
     #echo "hostapd command-line interface: hostapd_cli -p $CONFDIR/hostapd_ctrl"
     # start hostapd (use stdbuf when available for no delayed output in programs that redirect stdout)
-    STDBUF_PATH=$(which stdbuf)
+    STDBUF_PATH=$(command -v stdbuf)
     if [ $? -eq 0 ]; then
         STDBUF_PATH=$STDBUF_PATH" -oL"
     fi
     echo
     echo "Starting hostapd"
 
-    if which complain > /dev/null 2>&1; then
-        complain hostapd
+    if COMPLAIN_CMD="$(command -v aa-complain || command -v complain)"; then
+        echo "Setting hostapd to AppArmor complain mode..."
+        "$COMPLAIN_CMD" hostapd
     fi
 
     # hostapd '-P' works only when use '-B' (run in background)
@@ -2108,10 +2307,9 @@ start_dnsmasq() {
     echo
     echo "Starting dnsmasq"
 
-    if which complain > /dev/null 2>&1; then
-        # openSUSE's apparmor does not allow dnsmasq to read files.
-        # remove restriction.
-        complain dnsmasq
+    if COMPLAIN_CMD="$(command -v aa-complain || command -v complain)"; then
+        echo "Setting dnsmasq to AppArmor complain mode..."
+        "$COMPLAIN_CMD" dnsmasq
     fi
 
     # Using '-d'(no daemon) dnsmasq will not turn into 'nobody'
@@ -2132,10 +2330,8 @@ start_dnsmasq() {
 }
 
 check_rfkill_unblock_wifi() {
-    local PHY
-    if which rfkill > /dev/null 2>&1 ; then
-        PHY=$(get_interface_phy_device "${SUBNET_IFACE}")
-        [[ -n $PHY ]] && rfkill unblock $(rfkill | grep "$PHY" | awk '{print $1}') >/dev/null 2>&1
+    if command -v rfkill > /dev/null 2>&1 ; then
+        rfkill unblock $(rfkill | grep "$PHY" | awk '{print $1}') >/dev/null 2>&1
     fi
 }
 
@@ -2217,7 +2413,7 @@ fi
 
 # judge channel availability after changing country code
 if [[ $WIFI_IFACE ]] ; then
-    can_transmit_to_channel "${AP_IFACE}" ${CHANNEL} || die "Your adapter can not transmit to channel ${CHANNEL}, frequency band ${FREQ_BAND}GHz."
+    can_transmit_to_channel "${AP_IFACE}" ${CHANNEL} || die "Your adapter can not transmit to channel ${CHANNEL}, frequency band ${FREQ_BAND}GHz. (Tips: 1. Check usable channels: 'iw phy $PHY info'.  2. Check country code then check again.  )"
 fi
 
 [[ $WIFI_IFACE ]] && write_hostapd_conf
@@ -2322,7 +2518,7 @@ fi
 
 
 echo ""
-is_firewalld_running && firewalld_add_tmpzone
+is_firewalld_running && firewalld_addto_tmptrustedzone
 
 
 echo