version 0.8.2

README.md

@@ -375,10 +375,11 @@ Options:
                             (example: US)
     --freq-band <GHz>       Set frequency band: 2.4 or 5 (default: 2.4)
     --driver                Choose your WiFi adapter driver (default: nl80211)
-    -w <WPA version>        '2' for WPA2, '1' for WPA, '1+2' for both
-                            (default: 2)
-    --psk                   Use 64 hex digits pre-shared-key instead of
-                            passphrase
+    -w <WPA version>        WPA version indicator, can be '2', '3', '1', '3+2',
+                            '3+2+1', '2+1'. Requires '-p'. (default: '2')
+                            (Note WPA1 is legacy and unsafe)
+    --psk                   Use 64 hex digits pre-shared-key. Value of '-p'
+                            should be hex string instead of password
     --mac-filter            Enable WiFi hotspot MAC address filtering
     --mac-filter-accept     Location of WiFi hotspot MAC address filter list
                             (defaults to /etc/hostapd/hostapd.accept)
@@ -444,7 +445,17 @@ Options:
 
 </details>
 
-## What changes are done to Linux system
+## System admins should know
+
+### Take care of concurrency
+
+Linux-router script is home-made, not enterprise-level.
+
+- You can run multiple linux-router instances and they work simultaneous, as long as you start/stop **one by one**, not all at once. We **can't ensure** its locks covering 100% race condition edge cases.
+
+- Use it after the system has fully booted. When you’re manually (re)starting/stopping some network-related services, stop linux-router first, otherwise those services (flushing iptables or some) may break linux-router's setup. 
+
+### What changes are done to Linux system
 
 On exit of a linux-router instance, script **will do cleanup**, i.e. undo most changes to system. Though, **some** changes (if needed) will **not** be undone, which are:
 

lnxrouter

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-VERSION=0.8.1
+VERSION=0.8.2
 PROGNAME="$(basename "$0")"
 
 export LC_ALL=C
@@ -92,10 +92,11 @@ Options:
                             (example: US)
     --freq-band <GHz>       Set frequency band: 2.4 or 5 (default: 2.4)
     --driver                Choose your WiFi adapter driver (default: nl80211)
-    -w <WPA version>        '2' for WPA2, '1' for WPA, '1+2' for both
-                            (default: 2)
-    --psk                   Use 64 hex digits pre-shared-key instead of
-                            passphrase
+    -w <WPA version>        WPA version indicator, can be '2', '3', '1', '3+2',
+                            '3+2+1', '2+1'. Requires '-p'. (default: '2')
+                            (Note WPA1 is legacy and unsafe)
+    --psk                   Use 64 hex digits pre-shared-key. Value of '-p'
+                            should be hex string instead of password
     --mac-filter            Enable WiFi hotspot MAC address filtering
     --mac-filter-accept     Location of WiFi hotspot MAC address filter list
                             (defaults to /etc/hostapd/hostapd.accept)
@@ -213,7 +214,9 @@ define_global_variables(){
     WIFI_IFACE=
     CHANNEL=default
     HOTSPOT20=0 # For enabling Hotspot 2.0
-    WPA_VERSION=2
+    WPA1_ENABLE=0 # Enable legacy unsafe WPA1
+    WPA2_ENABLE=1 # Enable WPA2 PSK-Personal
+    WPA3_ENABLE=0 # Enable WPA3 SAE
     MAC_FILTER=0
     MAC_FILTER_ACCEPT=/etc/hostapd/hostapd.accept
     DRIVER=nl80211
@@ -430,8 +433,29 @@ parse_user_options(){
                 ;;
             -w)
                 shift
-                WPA_VERSION="$1"
-                [[ "$WPA_VERSION" == "2+1" ]] && WPA_VERSION=1+2
+                case "$1" in
+                    "3")
+                        WPA1_ENABLE=0; WPA2_ENABLE=0; WPA3_ENABLE=1
+                        ;;
+                    "2")
+                        WPA1_ENABLE=0; WPA2_ENABLE=1; WPA3_ENABLE=0
+                        ;;
+                    "1")
+                        WPA1_ENABLE=1; WPA2_ENABLE=0; WPA3_ENABLE=0
+                        ;;
+                    "3+2")
+                        WPA1_ENABLE=0; WPA2_ENABLE=1; WPA3_ENABLE=1
+                        ;;
+                    "2+1"|"1+2") # '1+2' is for compatibility to old script.
+                        WPA1_ENABLE=1; WPA2_ENABLE=1; WPA3_ENABLE=0
+                        ;;
+                    "3+2+1")
+                        WPA1_ENABLE=1; WPA2_ENABLE=1; WPA3_ENABLE=1
+                        ;;
+                    *)
+                        echo "Invalid -w value" >&2
+                        exit 1
+                esac
                 shift
                 ;;
             --sta-timeout)
@@ -797,7 +821,7 @@ show_interface_pci_info() {  # pci id / model / virtual
         bus_id="$(echo "$device_path" | sed 's/\//\n/g' | tail -n 3 |sed -n 1p)"
         device_type_and_bus_id="PCI: $bus_id"
 
-        if which lspci >/dev/null 2>&1 ; then
+        if command -v lspci >/dev/null 2>&1 ; then
             device_fullname="$( lspci -D -nn -s "$bus_id" | awk '{$1="" ; print $0}' )"
         fi
 
@@ -916,7 +940,7 @@ haveged_watchdog() {
     local show_warn=1
     while :; do
         if [[ $(cat /proc/sys/kernel/random/entropy_avail) -lt 1000 ]]; then
-            if ! which haveged > /dev/null 2>&1; then
+            if ! command -v haveged > /dev/null 2>&1; then
                 if [[ $show_warn -eq 1 ]]; then
                     echo "WARN: Low entropy detected. We recommend you to install \`haveged'" 1>&2
                     show_warn=0
@@ -953,7 +977,7 @@ get_pid_by_dbus_name() {
     local DBUS_NAME="$1"
     local pid  r
 
-    which dbus-send >/dev/null 2>&1 || return 1
+    command -v dbus-send >/dev/null 2>&1 || return 1
 
     pid="$( dbus-send --system --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetConnectionUnixProcessID string:$DBUS_NAME  2>/dev/null | grep "   uint32 " | awk '{print $2}' )"
     r=$?
@@ -978,7 +1002,7 @@ is_nm_running() {
 
     [[ ! -n "$NM_PID" ]] && return 1 # not running
 
-    if (which nmcli >/dev/null 2>&1 ) && (nmcli -t -f RUNNING g 2>&1 | grep -E '^running$' >/dev/null 2>&1 ) ; then
+    if (command -v nmcli >/dev/null 2>&1 ) && (nmcli -t -f RUNNING g 2>&1 | grep -E '^running$' >/dev/null 2>&1 ) ; then
         if is_same_netns "$NM_PID"; then
             return 0
         fi
@@ -1027,7 +1051,7 @@ is_firewalld_running() {
 
     [[ ! -n "$FIREWALLD_PID" ]] && return 1 # not running
 
-    if (which firewall-cmd >/dev/null 2>&1 ) && [[ "$(firewall-cmd --state 2>&1)" == "running" ]] ; then
+    if (command -v firewall-cmd >/dev/null 2>&1 ) && [[ "$(firewall-cmd --state 2>&1)" == "running" ]] ; then
         if is_same_netns "$FIREWALLD_PID"; then
             echo "firewalld is running ($(firewall-cmd --version))"
             return 0
@@ -1773,13 +1797,13 @@ check_wifi_settings() {
         exit 1
     fi
 
-    if ! ( which iw > /dev/null 2>&1 && iw dev "$WIFI_IFACE" info > /dev/null 2>&1 ); then
+    if ! ( command -v iw > /dev/null 2>&1 && iw dev "$WIFI_IFACE" info > /dev/null 2>&1 ); then
         echo "WARN: Can't use 'iw' to operate interfce '$WIFI_IFACE', trying 'iwconfig' (not as good as 'iw') ..." >&2
         USE_IWCONFIG=1
     fi
 
     if [[ $USE_IWCONFIG -eq 1 ]]; then
-        if ! (which iwconfig > /dev/null 2>&1 && iwconfig "$WIFI_IFACE" > /dev/null 2>&1); then
+        if ! (command -v iwconfig > /dev/null 2>&1 && iwconfig "$WIFI_IFACE" > /dev/null 2>&1); then
             echo "ERROR: Can't use 'iwconfig' to operate interfce '$WIFI_IFACE'" >&2
             exit 1
         fi
@@ -1810,7 +1834,10 @@ check_wifi_settings() {
         fi
     fi
 
-    HOSTAPD=$(which hostapd)
+    HOSTAPD=$(command -v hostapd) || {
+        echo "ERROR: hostapd not found" >&2
+        exit 1
+    }
 
     if [[ $(get_adapter_kernel_module "${WIFI_IFACE}") =~ ^(8192[cd][ue]|8723a[sue])$ ]]; then
         if ! strings "$HOSTAPD" | grep -m1 rtl871xdrv > /dev/null 2>&1; then
@@ -1840,8 +1867,8 @@ check_wifi_settings() {
     fi
 
     if [[ $(get_adapter_kernel_module "${WIFI_IFACE}") =~ ^rtl[0-9].*$ ]]; then
-        if [[ $WPA_VERSION == '1' || $WPA_VERSION == '1+2' ]]; then
-            echo "WARN: Realtek drivers usually have problems with WPA1, WPA2 is recommended" >&2
+        if [[ $WPA1_ENABLE == '1' ]]; then
+            echo "WARN: Realtek drivers usually have problems with legacy WPA1" >&2
         fi
         echo "WARN: If AP doesn't work, read https://github.com/oblique/create_ap/blob/master/howto/realtek.md" >&2
     fi
@@ -1992,6 +2019,10 @@ dealwith_mac() {
 }
 
 write_hostapd_conf() {
+    local WPA_VERSION
+    local WPA_KEYMGMT
+    local WPA_KEY_TYPE
+
     cat <<- EOF > "$CONFDIR/hostapd.conf"
 		beacon_int=100
 		ssid=${SSID}
@@ -2025,7 +2056,21 @@ write_hostapd_conf() {
     fi
 
     if [[ -n "$PASSPHRASE" ]]; then
-        [[ "$WPA_VERSION" == "1+2" ]] && WPA_VERSION=3
+        WPA_VERSION=0    # 1 means wpa1. 2 means wpa2. 3 means wpa2+1
+        WPA_KEYMGMT=""   # WPA-PSK means wpa2 or wpa1. SAE means wpa3
+        if [[ $WPA1_ENABLE -eq 1 ]]; then
+            WPA_VERSION=$(($WPA_VERSION + 1))
+        fi
+        if [[ $WPA2_ENABLE -eq 1 || $WPA3_ENABLE -eq 1 ]]; then
+            WPA_VERSION=$(($WPA_VERSION + 2))
+        fi
+        if [[ $WPA1_ENABLE -eq 1 || $WPA2_ENABLE -eq 1 ]]; then
+            WPA_KEYMGMT+="WPA-PSK"
+        fi
+        if [[ $WPA3_ENABLE -eq 1 ]]; then
+            [[ ! -z "$WPA_KEYMGMT" ]] && WPA_KEYMGMT+=" "
+            WPA_KEYMGMT+="SAE"
+        fi
         if [[ $USE_PSK -eq 0 ]]; then
             WPA_KEY_TYPE=passphrase
         else
@@ -2034,7 +2079,7 @@ write_hostapd_conf() {
         cat <<- EOF >> "$CONFDIR/hostapd.conf"
 			wpa=${WPA_VERSION}
 			wpa_${WPA_KEY_TYPE}=${PASSPHRASE}
-			wpa_key_mgmt=WPA-PSK
+			wpa_key_mgmt=${WPA_KEYMGMT}
 			wpa_pairwise=CCMP
 			rsn_pairwise=CCMP
 		EOF
@@ -2233,7 +2278,7 @@ run_wifi_ap_processes() {
     # start access point
     #echo "hostapd command-line interface: hostapd_cli -p $CONFDIR/hostapd_ctrl"
     # start hostapd (use stdbuf when available for no delayed output in programs that redirect stdout)
-    STDBUF_PATH=$(which stdbuf)
+    STDBUF_PATH=$(command -v stdbuf)
     if [ $? -eq 0 ]; then
         STDBUF_PATH=$STDBUF_PATH" -oL"
     fi
@@ -2285,7 +2330,7 @@ start_dnsmasq() {
 }
 
 check_rfkill_unblock_wifi() {
-    if which rfkill > /dev/null 2>&1 ; then
+    if command -v rfkill > /dev/null 2>&1 ; then
         rfkill unblock $(rfkill | grep "$PHY" | awk '{print $1}') >/dev/null 2>&1
     fi
 }