From e443cc2c5949e8d15a37baddf1dced18f4a7701a Mon Sep 17 00:00:00 2001 From: Arjen <18398758+Origami74@users.noreply.github.com> Date: Wed, 15 Jul 2026 20:41:39 +0200 Subject: [PATCH] =?UTF-8?q?docs(openwrt):=20correct=20open-SSID/mesh=20sec?= =?UTF-8?q?urity=20framing=20=E2=80=94=20peering=20is=20open=20by=20design?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fips-ap-setup/fips-mesh-setup comments and both how-tos claimed a stranger "cannot pass the FIPS handshake" / "their frames die at the handshake" / the handshake surface "drops them". That is wrong: FIPS peer admission is open. An inbound handshake from any net-new identity is promoted (node::handlers::handshake::promote_connection), gated only by the daemon's max-peers cap — there is no allowlist, no PSK, and the AuthChallenge path is not wired to admission. The Noise IK handshake provides authentication (no impersonation of another identity, no MITM), not authorization. Restate the model accurately in all five places: a stranger on the open SSID (or the open mesh) can associate AND form a FIPS peer link — that is the point of open access. Containment is the isolated fips_ap zone (no path to br-lan or the WAN) plus the max-peers cap, not the handshake. Clarify that AP client isolation is an L2 control only: a peered stranger is an overlay peer like any other, so the FIPS overlay, not L2, is the trust boundary between clients. --- docs/how-to/set-up-80211s-mesh-backhaul.md | 14 ++++++----- docs/how-to/set-up-open-access-ssid.md | 25 +++++++++++++------ .../openwrt-ipk/files/usr/bin/fips-ap-setup | 14 ++++++++--- .../openwrt-ipk/files/usr/bin/fips-mesh-setup | 6 +++-- 4 files changed, 39 insertions(+), 20 deletions(-) diff --git a/docs/how-to/set-up-80211s-mesh-backhaul.md b/docs/how-to/set-up-80211s-mesh-backhaul.md index e7e1941..6cfde17 100644 --- a/docs/how-to/set-up-80211s-mesh-backhaul.md +++ b/docs/how-to/set-up-80211s-mesh-backhaul.md @@ -21,12 +21,14 @@ Two deliberate choices distinguish this from a stock 802.11s setup: handshake, so SAE at L2 would duplicate that work, add a shared credential to provision across routers, and (on ath10k) force the firmware into its slower raw Tx/Rx mode. A stranger can form an - 802.11s peering with your router, but their frames die at the FIPS - handshake — the same security model as mDNS and BLE discovery, where - the advert is only a hint and the handshake is the authentication. - What you concede: L2 metadata (MAC addresses, frame sizes) is - visible in the air, and a hostile radio can burn airtime — both true - of any radio link regardless of L2 encryption. + 802.11s peering with your router *and* a FIPS peer link on top of it — + the same open model as mDNS and BLE discovery, where the advert is + only a hint and the handshake authenticates each link (no + impersonation, no MITM) rather than gating who may peer. Admission is + open up to the daemon's max-peers cap. What you concede: any nearby + radio can peer and reach the FIPS overlay surface; L2 metadata (MAC + addresses, frame sizes) is visible in the air; a hostile radio can + burn airtime — all inherent to an open radio link. - **`mesh_fwding 0`** — disables 802.11s's own HWMP routing so each mesh link is a plain neighbor link. FIPS is the routing layer; two routing layers would fight, and broadcast discovery beacons would diff --git a/docs/how-to/set-up-open-access-ssid.md b/docs/how-to/set-up-open-access-ssid.md index 199869a..bd212d4 100644 --- a/docs/how-to/set-up-open-access-ssid.md +++ b/docs/how-to/set-up-open-access-ssid.md @@ -30,10 +30,16 @@ Three deliberate choices distinguish this from a stock guest network: only security type that needs zero provisioning, and OWE is left out for now for exactly this uniformity reason (OWE-transition mode is inconsistent across client vendors). Every FIPS peer link is already - authenticated and encrypted by the Noise IK handshake — a stranger - can associate, but their traffic dies at the FIPS handshake. What - you concede: L2 metadata is visible in the air and a hostile radio - can burn airtime — both true of any radio link. + authenticated and encrypted by the Noise IK handshake. A stranger + can associate *and* form a FIPS peer link — that is the point of open + access; the handshake authenticates each link (no impersonation, no + MITM) but does not gate who may peer, and admission is open up to the + daemon's max-peers cap. What confines a hostile peer is the isolated + `fips_ap` zone (no path to br-lan or the WAN — see below), not the + handshake. What you concede: any nearby device can reach the FIPS + overlay surface (handshake, discovery, lookup, routing) and peer with + the router; L2 metadata is visible in the air; a hostile radio can + burn airtime — all inherent to an open radio link. - **No DHCP — IPv6 router advertisements only.** odhcpd announces a ULA prefix (`fd..`-range) for stateless SLAAC: no DHCPv4, no DHCPv6, no lease state. FIPS itself only needs link-local + mDNS, but @@ -214,10 +220,13 @@ stays associated — that is the designed steady state, not an error. - **Airtime is shared per radio.** An access AP and a mesh backhaul on the same radio share one channel. On dual/tri-band hardware, dedicate a band to the backhaul and serve clients on the others. -- **Strangers can associate — by design.** They reach only the FIPS - handshake surface, which drops them. Do not add forwardings to the - `fips_ap` zone: that would turn the open SSID into a hotspot and - hand the isolation away. +- **Strangers can associate and peer — by design.** Open access means + any nearby device can complete the Noise handshake and become a FIPS + peer (up to the max-peers cap); the handshake authenticates each link, + it does not restrict who joins. They reach only the FIPS overlay + surface — the isolated zone gives no path to br-lan or the WAN. Do not + add forwardings to the `fips_ap` zone: that would turn the open SSID + into a hotspot and hand the isolation away. - **Roaming is client-driven.** Clients decide when to hop BSSIDs (standard ESS behavior) and renumber on each router; FIPS sessions ride through because the overlay identity is the anchor. Expect a diff --git a/packaging/openwrt-ipk/files/usr/bin/fips-ap-setup b/packaging/openwrt-ipk/files/usr/bin/fips-ap-setup index 413e33c..cd8d250 100755 --- a/packaging/openwrt-ipk/files/usr/bin/fips-ap-setup +++ b/packaging/openwrt-ipk/files/usr/bin/fips-ap-setup @@ -16,7 +16,12 @@ # the security type must be uniform across ALL routers anyway: clients # key a saved network on SSID + security type, so one router with a PSK # splits the ESS into a different saved network. A stranger can -# associate but cannot pass the FIPS handshake. +# associate AND form a FIPS peer link — that is the point of open +# access. The Noise handshake authenticates each link (no +# impersonation of another identity, no MITM); it does NOT gate who +# may peer. Admission is open up to the daemon's max-peers cap; the +# firewall zone below is what confines every client to the FIPS +# overlay (no path to br-lan or the WAN). # - NO DHCP — odhcpd announces a ULA prefix in router # advertisements (stateless SLAAC, no lease state). FIPS itself only # needs link-local + mDNS, but Android's provisioning check requires an @@ -174,9 +179,10 @@ fi # --------------------------------------------------------------------------- # Wireless: open AP with client isolation. Clients of the same AP cannot -# exchange L2 frames — two FIPS phones on one router still reach each other -# through the router at the overlay layer, while a stranger cannot reach -# other clients at all. +# exchange L2 frames directly — two FIPS phones on one router still reach +# each other through the router at the overlay layer. Isolation is an L2 +# control only: a stranger who peers is an overlay peer like any other, so +# the FIPS overlay (not L2) is the trust boundary between clients. # --------------------------------------------------------------------------- uci -q delete "wireless.$SECTION" diff --git a/packaging/openwrt-ipk/files/usr/bin/fips-mesh-setup b/packaging/openwrt-ipk/files/usr/bin/fips-mesh-setup index 82d12ca..55ec8dd 100755 --- a/packaging/openwrt-ipk/files/usr/bin/fips-mesh-setup +++ b/packaging/openwrt-ipk/files/usr/bin/fips-mesh-setup @@ -14,8 +14,10 @@ # - encryption 'none' — the mesh is OPEN on purpose. FIPS's Noise IK # handshake authenticates and encrypts every peer link, so SAE would # only duplicate that (and on ath10k it forces the slower raw Tx/Rx -# firmware mode). A stranger can form an 802.11s peering but cannot -# pass the FIPS handshake. +# firmware mode). A stranger can form an 802.11s peering AND a FIPS +# peer link — the Noise handshake authenticates each link (no +# impersonation of another identity, no MITM), it does not gate who +# may peer. Admission is open up to the daemon's max-peers cap. # - mesh_fwding '0' — disables 802.11s HWMP forwarding so each mesh # link is a plain L2 neighbor link. FIPS is the routing layer; two # routing layers would fight.