wifi: T4353: fix Jinja2 linting errors

1 files changed, 0 insertions, 741 deletions

diff --git a/data/templates/wifi/hostapd.conf.tmpl b/data/templates/wifi/hostapd.conf.tmpl
deleted file mode 100644
index 79d005b15..000000000
--- a/data/templates/wifi/hostapd.conf.tmpl
+++ /dev/null
@@ -1,741 +0,0 @@
-### Autogenerated by interfaces-wireless.py ###
-{% if description %}
-# Description: {{ description }}
-# User-friendly description of device; up to 32 octets encoded in UTF-8
-device_name={{ description | truncate(32, True) }}
-{% endif %}
-
-# AP netdevice name (without 'ap' postfix, i.e., wlan0 uses wlan0ap for
-# management frames with the Host AP driver); wlan0 with many nl80211 drivers
-# Note: This attribute can be overridden by the values supplied with the '-i'
-# command line parameter.
-interface={{ ifname }}
-
-{% if is_bridge_member is vyos_defined %}
-# In case of atheros and nl80211 driver interfaces, an additional
-# configuration parameter, bridge, may be used to notify hostapd if the
-# interface is included in a bridge. This parameter is not used with Host AP
-# driver. If the bridge parameter is not set, the drivers will automatically
-# figure out the bridge interface (assuming sysfs is enabled and mounted to
-# /sys) and this parameter may not be needed.
-#
-# For nl80211, this parameter can be used to request the AP interface to be
-# added to the bridge automatically (brctl may refuse to do this before hostapd
-# has been started to change the interface mode). If needed, the bridge
-# interface is also created.
-{# as there can only be one bridge interface it is save to loop #}
-{%   for bridge in is_bridge_member %}
-bridge={{ bridge }}
-{%   endfor %}
-{% endif %}
-
-# Driver interface type (hostap/wired/none/nl80211/bsd);
-# default: hostap). nl80211 is used with all Linux mac80211 drivers.
-# Use driver=none if building hostapd as a standalone RADIUS server that does
-# not control any wireless/wired driver.
-driver=nl80211
-
-# Levels (minimum value for logged events):
-#  0 = verbose debugging
-#  1 = debugging
-#  2 = informational messages
-#  3 = notification
-#  4 = warning
-logger_syslog=-1
-logger_syslog_level=0
-logger_stdout=-1
-logger_stdout_level=0
-
-{% if country_code %}
-# Country code (ISO/IEC 3166-1). Used to set regulatory domain.
-# Set as needed to indicate country in which device is operating.
-# This can limit available channels and transmit power.
-country_code={{ country_code | upper }}
-
-# Enable IEEE 802.11d. This advertises the country_code and the set of allowed
-# channels and transmit power levels based on the regulatory limits. The
-# country_code setting must be configured with the correct country for
-# IEEE 802.11d functions.
-ieee80211d=1
-{% endif %}
-
-{% if ssid %}
-# SSID to be used in IEEE 802.11 management frames
-ssid={{ ssid }}
-{% endif %}
-
-{% if channel %}
-# Channel number (IEEE 802.11)
-# (default: 0, i.e., not set)
-# Please note that some drivers do not use this value from hostapd and the
-# channel will need to be configured separately with iwconfig.
-channel={{ channel }}
-{% endif %}
-
-{% if mode is vyos_defined %}
-# Operation mode (a = IEEE 802.11a (5 GHz), b = IEEE 802.11b (2.4 GHz),
-# g = IEEE 802.11g (2.4 GHz), ad = IEEE 802.11ad (60 GHz); a/g options are used
-# with IEEE 802.11n (HT), too, to specify band). For IEEE 802.11ac (VHT), this
-# needs to be set to hw_mode a. For IEEE 802.11ax (HE) on 6 GHz this needs
-# to be set to hw_mode a. When using ACS (see channel parameter), a
-# special value "any" can be used to indicate that any support band can be used.
-# This special case is currently supported only with drivers with which
-# offloaded ACS is used.
-{%   if mode is vyos_defined('n') %}
-hw_mode=g
-{%   elif mode is vyos_defined('ac') %}
-hw_mode=a
-ieee80211h=1
-ieee80211ac=1
-{%   else %}
-hw_mode={{ mode }}
-{%   endif %}
-{% endif %}
-
-# ieee80211w: Whether management frame protection (MFP) is enabled
-# 0 = disabled (default)
-# 1 = optional
-# 2 = required
-{% if 'disabled' in mgmt_frame_protection %}
-ieee80211w=0
-{% elif 'optional' in mgmt_frame_protection %}
-ieee80211w=1
-{% elif 'required' in mgmt_frame_protection %}
-ieee80211w=2
-{% endif %}
-
-{% if capabilities is vyos_defined %}
-# ht_capab: HT capabilities (list of flags)
-# LDPC coding capability: [LDPC] = supported
-# Supported channel width set: [HT40-] = both 20 MHz and 40 MHz with secondary
-#	channel below the primary channel; [HT40+] = both 20 MHz and 40 MHz
-#	with secondary channel above the primary channel
-#	(20 MHz only if neither is set)
-#	Note: There are limits on which channels can be used with HT40- and
-#	HT40+. Following table shows the channels that may be available for
-#	HT40- and HT40+ use per IEEE 802.11n Annex J:
-#	freq		HT40-		HT40+
-#	2.4 GHz		5-13		1-7 (1-9 in Europe/Japan)
-#	5 GHz		40,48,56,64	36,44,52,60
-#	(depending on the location, not all of these channels may be available
-#	for use)
-#	Please note that 40 MHz channels may switch their primary and secondary
-#	channels if needed or creation of 40 MHz channel maybe rejected based
-#	on overlapping BSSes. These changes are done automatically when hostapd
-#	is setting up the 40 MHz channel.
-# Spatial Multiplexing (SM) Power Save: [SMPS-STATIC] or [SMPS-DYNAMIC]
-#	(SMPS disabled if neither is set)
-# HT-greenfield: [GF] (disabled if not set)
-# Short GI for 20 MHz: [SHORT-GI-20] (disabled if not set)
-# Short GI for 40 MHz: [SHORT-GI-40] (disabled if not set)
-# Tx STBC: [TX-STBC] (disabled if not set)
-# Rx STBC: [RX-STBC1] (one spatial stream), [RX-STBC12] (one or two spatial
-#	streams), or [RX-STBC123] (one, two, or three spatial streams); Rx STBC
-#	disabled if none of these set
-# HT-delayed Block Ack: [DELAYED-BA] (disabled if not set)
-# Maximum A-MSDU length: [MAX-AMSDU-7935] for 7935 octets (3839 octets if not
-#	set)
-# DSSS/CCK Mode in 40 MHz: [DSSS_CCK-40] = allowed (not allowed if not set)
-# 40 MHz intolerant [40-INTOLERANT] (not advertised if not set)
-# L-SIG TXOP protection support: [LSIG-TXOP-PROT] (disabled if not set)
-{%   set output = namespace(value='')  %}
-
-{%   if capabilities.ht.fourtymhz_incapable is vyos_defined %}
-{%     set output.value = output.value ~ '[40-INTOLERANT]' %}
-{%   endif %}
-{%   if capabilities.ht.delayed_block_ack is vyos_defined %}
-{%     set output.value = output.value ~ '[DELAYED-BA]' %}
-{%   endif %}
-{%   if capabilities.ht.dsss_cck_40 is vyos_defined %}
-{%     set output.value = output.value ~ '[DSSS_CCK-40]' %}
-{%   endif %}
-{%   if capabilities.ht.greenfield is vyos_defined %}
-{%     set output.value = output.value ~ '[GF]' %}
-{%   endif %}
-{%   if capabilities.ht.ldpc is vyos_defined %}
-{%     set output.value = output.value ~ '[LDPC]' %}
-{%   endif %}
-{%   if capabilities.ht.lsig_protection is vyos_defined %}
-{%     set output.value = output.value ~ '[LSIG-TXOP-PROT]' %}
-{%   endif %}
-{%   if capabilities.ht.stbc.tx is vyos_defined %}
-{%     set output.value = output.value ~ '[TX-STBC]' %}
-{%   endif %}
-{%   if capabilities.ht.stbc.rx is vyos_defined %}
-{%     set output.value = output.value ~ '[RX-STBC-' ~ capabilities.ht.stbc.rx | upper ~ ']' %}
-{%   endif %}
-{%   if capabilities.ht.max_amsdu is vyos_defined %}
-{%     set output.value = output.value ~ '[MAX-AMSDU-' ~ capabilities.ht.max_amsdu ~ ']' %}
-{%   endif %}
-{%   if capabilities.ht.smps is vyos_defined %}
-{%     set output.value = output.value ~ '[SMPS-' ~ capabilities.ht.smps | upper ~ ']' %}
-{%   endif %}
-
-{% if capabilities.ht.channel_set_width is vyos_defined %}
-{%   for csw in capabilities.ht.channel_set_width %}
-{%     set output.value = output.value ~ '[' ~ csw | upper ~ ']'  %}
-{%   endfor %}
-{% endif %}
-
-{% if capabilities.ht.short_gi is vyos_defined %}
-{%   for short_gi in capabilities.ht.short_gi %}
-{%     set output.value = output.value ~ '[SHORT-GI-' ~ short_gi | upper ~ ']'  %}
-{%   endfor %}
-{% endif %}
-
-ht_capab={{ output.value }}
-
-{%   if capabilities.ht.auto_powersave is vyos_defined %}
-# WMM-PS Unscheduled Automatic Power Save Delivery [U-APSD]
-# Enable this flag if U-APSD supported outside hostapd (eg., Firmware/driver)
-uapsd_advertisement_enabled=1
-{%   endif %}
-{% endif %}
-
-# Required for full HT and VHT functionality
-wme_enabled=1
-
-
-{% if capabilities.require_ht is vyos_defined %}
-# Require stations to support HT PHY (reject association if they do not)
-require_ht=1
-{% endif %}
-
-{% if capabilities.vht is vyos_defined %}
-# vht_capab: VHT capabilities (list of flags)
-#
-# vht_max_mpdu_len: [MAX-MPDU-7991] [MAX-MPDU-11454]
-# Indicates maximum MPDU length
-# 0 = 3895 octets (default)
-# 1 = 7991 octets
-# 2 = 11454 octets
-# 3 = reserved
-#
-# supported_chan_width: [VHT160] [VHT160-80PLUS80]
-# Indicates supported Channel widths
-# 0 = 160 MHz & 80+80 channel widths are not supported (default)
-# 1 = 160 MHz channel width is supported
-# 2 = 160 MHz & 80+80 channel widths are supported
-# 3 = reserved
-#
-# Rx LDPC coding capability: [RXLDPC]
-# Indicates support for receiving LDPC coded pkts
-# 0 = Not supported (default)
-# 1 = Supported
-#
-# Short GI for 80 MHz: [SHORT-GI-80]
-# Indicates short GI support for reception of packets transmitted with TXVECTOR
-# params format equal to VHT and CBW = 80Mhz
-# 0 = Not supported (default)
-# 1 = Supported
-#
-# Short GI for 160 MHz: [SHORT-GI-160]
-# Indicates short GI support for reception of packets transmitted with TXVECTOR
-# params format equal to VHT and CBW = 160Mhz
-# 0 = Not supported (default)
-# 1 = Supported
-#
-# Tx STBC: [TX-STBC-2BY1]
-# Indicates support for the transmission of at least 2x1 STBC
-# 0 = Not supported (default)
-# 1 = Supported
-#
-# Rx STBC: [RX-STBC-1] [RX-STBC-12] [RX-STBC-123] [RX-STBC-1234]
-# Indicates support for the reception of PPDUs using STBC
-# 0 = Not supported (default)
-# 1 = support of one spatial stream
-# 2 = support of one and two spatial streams
-# 3 = support of one, two and three spatial streams
-# 4 = support of one, two, three and four spatial streams
-# 5,6,7 = reserved
-#
-# SU Beamformer Capable: [SU-BEAMFORMER]
-# Indicates support for operation as a single user beamformer
-# 0 = Not supported (default)
-# 1 = Supported
-#
-# SU Beamformee Capable: [SU-BEAMFORMEE]
-# Indicates support for operation as a single user beamformee
-# 0 = Not supported (default)
-# 1 = Supported
-#
-# Compressed Steering Number of Beamformer Antennas Supported:
-# [BF-ANTENNA-2] [BF-ANTENNA-3] [BF-ANTENNA-4]
-#   Beamformee's capability indicating the maximum number of beamformer
-#   antennas the beamformee can support when sending compressed beamforming
-#   feedback
-# If SU beamformer capable, set to maximum value minus 1
-# else reserved (default)
-#
-# Number of Sounding Dimensions:
-# [SOUNDING-DIMENSION-2] [SOUNDING-DIMENSION-3] [SOUNDING-DIMENSION-4]
-# Beamformer's capability indicating the maximum value of the NUM_STS parameter
-# in the TXVECTOR of a VHT NDP
-# If SU beamformer capable, set to maximum value minus 1
-# else reserved (default)
-#
-# MU Beamformer Capable: [MU-BEAMFORMER]
-# Indicates support for operation as an MU beamformer
-# 0 = Not supported or sent by Non-AP STA (default)
-# 1 = Supported
-#
-# VHT TXOP PS: [VHT-TXOP-PS]
-# Indicates whether or not the AP supports VHT TXOP Power Save Mode
-#  or whether or not the STA is in VHT TXOP Power Save mode
-# 0 = VHT AP doesn't support VHT TXOP PS mode (OR) VHT STA not in VHT TXOP PS
-#  mode
-# 1 = VHT AP supports VHT TXOP PS mode (OR) VHT STA is in VHT TXOP power save
-#  mode
-#
-# +HTC-VHT Capable: [HTC-VHT]
-# Indicates whether or not the STA supports receiving a VHT variant HT Control
-# field.
-# 0 = Not supported (default)
-# 1 = supported
-#
-# Maximum A-MPDU Length Exponent: [MAX-A-MPDU-LEN-EXP0]..[MAX-A-MPDU-LEN-EXP7]
-# Indicates the maximum length of A-MPDU pre-EOF padding that the STA can recv
-# This field is an integer in the range of 0 to 7.
-# The length defined by this field is equal to
-# 2 pow(13 ~ Maximum A-MPDU Length Exponent) -1 octets
-#
-# VHT Link Adaptation Capable: [VHT-LINK-ADAPT2] [VHT-LINK-ADAPT3]
-# Indicates whether or not the STA supports link adaptation using VHT variant
-# HT Control field
-# If +HTC-VHTcapable is 1
-#  0 = (no feedback) if the STA does not provide VHT MFB (default)
-#  1 = reserved
-#  2 = (Unsolicited) if the STA provides only unsolicited VHT MFB
-#  3 = (Both) if the STA can provide VHT MFB in response to VHT MRQ and if the
-#      STA provides unsolicited VHT MFB
-# Reserved if +HTC-VHTcapable is 0
-#
-# Rx Antenna Pattern Consistency: [RX-ANTENNA-PATTERN]
-# Indicates the possibility of Rx antenna pattern change
-# 0 = Rx antenna pattern might change during the lifetime of an association
-# 1 = Rx antenna pattern does not change during the lifetime of an association
-#
-# Tx Antenna Pattern Consistency: [TX-ANTENNA-PATTERN]
-# Indicates the possibility of Tx antenna pattern change
-# 0 = Tx antenna pattern might change during the lifetime of an association
-# 1 = Tx antenna pattern does not change during the lifetime of an
-
-{%   if capabilities.vht.center_channel_freq.freq_1 is vyos_defined %}
-# center freq = 5 GHz ~ (5 * index)
-# So index 42 gives center freq 5.210 GHz
-# which is channel 42 in 5G band
-vht_oper_centr_freq_seg0_idx={{ capabilities.vht.center_channel_freq.freq_1 }}
-{%   endif %}
-
-{%   if capabilities.vht.center_channel_freq.freq_2 is vyos_defined %}
-# center freq = 5 GHz ~ (5 * index)
-# So index 159 gives center freq 5.795 GHz
-# which is channel 159 in 5G band
-vht_oper_centr_freq_seg1_idx={{ capabilities.vht.center_channel_freq.freq_2 }}
-{%   endif %}
-
-{%   if capabilities.vht.channel_set_width is vyos_defined %}
-vht_oper_chwidth={{ capabilities.vht.channel_set_width }}
-{%   endif %}
-
-{%   set output = namespace(value='')  %}
-{%   if capabilities.vht.stbc.tx is vyos_defined %}
-{%     set output.value = output.value ~ '[TX-STBC-2BY1]' %}
-{%   endif %}
-{%   if capabilities.vht.stbc.rx is vyos_defined %}
-{%     set output.value = output.value ~ '[RX-STBC-' ~ capabilities.vht.stbc.rx ~ ']' %}
-{%   endif %}
-{%   if capabilities.vht.ldpc is vyos_defined %}
-{%     set output.value = output.value ~ '[RXLDPC]' %}
-{%   endif %}
-{%   if capabilities.vht.tx_powersave is vyos_defined %}
-{%     set output.value = output.value ~ '[VHT-TXOP-PS]' %}
-{%   endif %}
-{%   if capabilities.vht.vht_cf is vyos_defined %}
-{%     set output.value = output.value ~ '[HTC-VHT]' %}
-{%   endif %}
-{%   if capabilities.vht.antenna_pattern_fixed is vyos_defined %}
-{%     set output.value = output.value ~ '[RX-ANTENNA-PATTERN][TX-ANTENNA-PATTERN]' %}
-{%   endif %}
-{%   if capabilities.vht.max_mpdu is vyos_defined %}
-{%     set output.value = output.value ~ '[MAX-MPDU-' ~ capabilities.vht.max_mpdu ~ ']' %}
-{%   endif %}
-{%   if capabilities.vht.max_mpdu_exp is vyos_defined %}
-{%     set output.value = output.value ~ '[MAX-A-MPDU-LEN-EXP-' ~ capabilities.vht.max_mpdu_exp ~ ']' %}
-{%     if capabilities.vht.max_mpdu_exp is vyos_defined('2') %}
-{%       set output.value = output.value ~ '[VHT160]' %}
-{%     endif %}
-{%     if capabilities.vht.max_mpdu_exp is vyos_defined('3') %}
-{%       set output.value = output.value ~ '[VHT160-80PLUS80]' %}
-{%     endif %}
-{%   endif %}
-{%   if capabilities.vht.link_adaptation is vyos_defined('unsolicited') %}
-{%     set output.value = output.value ~ '[VHT-LINK-ADAPT2]' %}
-{%   elif capabilities.vht.link_adaptation is vyos_defined('both') %}
-{%     set output.value = output.value ~ '[VHT-LINK-ADAPT3]' %}
-{%   endif %}
-
-{%   for short_gi in capabilities.vht.short_gi if capabilities.vht.short_gi is vyos_defined %}
-{%     set output.value = output.value ~ '[SHORT-GI-' ~ short_gi | upper ~ ']'  %}
-{%   endfor %}
-
-{%   for beamform in capabilities.vht.beamform if capabilities.vht.beamform is vyos_defined %}
-{%     set output.value = output.value ~ '[SU-BEAMFORMER]' if beamform is vyos_defined('single-user-beamformer') else '' %}
-{%     set output.value = output.value ~ '[SU-BEAMFORMEE]' if beamform is vyos_defined('single-user-beamformee') else '' %}
-{%     set output.value = output.value ~ '[MU-BEAMFORMER]' if beamform is vyos_defined('multi-user-beamformer')  else '' %}
-{%     set output.value = output.value ~ '[MU-BEAMFORMEE]' if beamform is vyos_defined('multi-user-beamformee')  else '' %}
-{%   endfor %}
-
-{%   if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1  %}
-{%     if capabilities.vht.beamform is vyos_defined %}
-{%       if capabilities.vht.beamform == 'single-user-beamformer' %}
-{%         if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1 and capabilities.vht.antenna_count | int < 6  %}
-{%           set output.value = output.value ~ '[BF-ANTENNA-' ~ capabilities.vht.antenna_count | int -1 ~ ']' %}
-{%           set output.value = output.value ~ '[SOUNDING-DIMENSION-' ~ capabilities.vht.antenna_count | int -1 ~ ']' %}
-{%         endif %}
-{%       endif %}
-{%       if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1 and capabilities.vht.antenna_count | int < 5  %}
-{%         set output.value = output.value ~ '[BF-ANTENNA-' ~ capabilities.vht.antenna_count ~ ']' %}
-{%         set output.value = output.value ~ '[SOUNDING-DIMENSION-' ~ capabilities.vht.antenna_count ~ ']' %}
-{%       endif %}
-{%     endif %}
-{%   endif %}
-
-vht_capab={{ output.value }}
-{% endif %}
-
-# ieee80211n: Whether IEEE 802.11n (HT) is enabled
-# 0 = disabled (default)
-# 1 = enabled
-# Note: You will also need to enable WMM for full HT functionality.
-# Note: hw_mode=g (2.4 GHz) and hw_mode=a (5 GHz) is used to specify the band.
-{% if capabilities.require_vht is vyos_defined %}
-ieee80211n=0
-# Require stations to support VHT PHY (reject association if they do not)
-require_vht=1
-{% else %}
-{%   if 'n' in mode or 'ac' in mode %}
-ieee80211n=1
-{%   else %}
-ieee80211n=0
-{%   endif %}
-{% endif %}
-
-{% if disable_broadcast_ssid is vyos_defined %}
-# Send empty SSID in beacons and ignore probe request frames that do not
-# specify full SSID, i.e., require stations to know SSID.
-# default: disabled (0)
-# 1 = send empty (length=0) SSID in beacon and ignore probe request for
-#     broadcast SSID
-# 2 = clear SSID (ASCII 0), but keep the original length (this may be required
-#     with some clients that do not support empty SSID) and ignore probe
-#     requests for broadcast SSID
-ignore_broadcast_ssid=1
-{% endif %}
-
-# Station MAC address -based authentication
-# Please note that this kind of access control requires a driver that uses
-# hostapd to take care of management frame processing and as such, this can be
-# used with driver=hostap or driver=nl80211, but not with driver=atheros.
-# 0 = accept unless in deny list
-# 1 = deny unless in accept list
-# 2 = use external RADIUS server (accept/deny lists are searched first)
-macaddr_acl=0
-
-{% if max_stations is vyos_defined %}
-# Maximum number of stations allowed in station table. New stations will be
-# rejected after the station table is full. IEEE 802.11 has a limit of 2007
-# different association IDs, so this number should not be larger than that.
-# (default: 2007)
-max_num_sta={{ max_stations }}
-{% endif %}
-
-{% if isolate_stations is vyos_defined %}
-# Client isolation can be used to prevent low-level bridging of frames between
-# associated stations in the BSS. By default, this bridging is allowed.
-ap_isolate=1
-{% endif %}
-
-{% if reduce_transmit_power is vyos_defined %}
-# Add Power Constraint element to Beacon and Probe Response frames
-# This config option adds Power Constraint element when applicable and Country
-# element is added. Power Constraint element is required by Transmit Power
-# Control. This can be used only with ieee80211d=1.
-# Valid values are 0..255.
-local_pwr_constraint={{ reduce_transmit_power }}
-{% endif %}
-
-{% if expunge_failing_stations is vyos_defined %}
-# Disassociate stations based on excessive transmission failures or other
-# indications of connection loss. This depends on the driver capabilities and
-# may not be available with all drivers.
-disassoc_low_ack=1
-{% endif %}
-
-
-{% if security.wep is vyos_defined %}
-# IEEE 802.11 specifies two authentication algorithms. hostapd can be
-# configured to allow both of these or only one. Open system authentication
-# should be used with IEEE 802.1X.
-# Bit fields of allowed authentication algorithms:
-# bit 0 = Open System Authentication
-# bit 1 = Shared Key Authentication (requires WEP)
-auth_algs=2
-
-# WEP rekeying (disabled if key lengths are not set or are set to 0)
-# Key lengths for default/broadcast and individual/unicast keys:
-# 5 = 40-bit WEP (also known as 64-bit WEP with 40 secret bits)
-# 13 = 104-bit WEP (also known as 128-bit WEP with 104 secret bits)
-wep_key_len_broadcast=5
-wep_key_len_unicast=5
-
-# Static WEP key configuration
-#
-# The key number to use when transmitting.
-# It must be between 0 and 3, and the corresponding key must be set.
-# default: not set
-wep_default_key=0
-
-# The WEP keys to use.
-# A key may be a quoted string or unquoted hexadecimal digits.
-# The key length should be 5, 13, or 16 characters, or 10, 26, or 32
-# digits, depending on whether 40-bit (64-bit), 104-bit (128-bit), or
-# 128-bit (152-bit) WEP is used.
-# Only the default key must be supplied; the others are optional.
-{%   if security.wep.key is vyos_defined %}
-{%     for key in sec_wep_key %}
-wep_key{{ loop.index -1 }}={{ security.wep.key }}
-{%     endfor %}
-{%   endif %}
-
-
-{% elif security.wpa is vyos_defined %}
-##### WPA/IEEE 802.11i configuration ##########################################
-
-# Enable WPA. Setting this variable configures the AP to require WPA (either
-# WPA-PSK or WPA-RADIUS/EAP based on other configuration). For WPA-PSK, either
-# wpa_psk or wpa_passphrase must be set and wpa_key_mgmt must include WPA-PSK.
-# Instead of wpa_psk / wpa_passphrase, wpa_psk_radius might suffice.
-# For WPA-RADIUS/EAP, ieee8021x must be set (but without dynamic WEP keys),
-# RADIUS authentication server must be configured, and WPA-EAP must be included
-# in wpa_key_mgmt.
-# This field is a bit field that can be used to enable WPA (IEEE 802.11i/D3.0)
-# and/or WPA2 (full IEEE 802.11i/RSN):
-# bit0 = WPA
-# bit1 = IEEE 802.11i/RSN (WPA2) (dot11RSNAEnabled)
-# Note that WPA3 is also configured with bit1 since it uses RSN just like WPA2.
-# In other words, for WPA3, wpa 2 is used the configuration (and
-# wpa_key_mgmt=SAE for WPA3-Personal instead of wpa_key_mgmt=WPA-PSK).
-{%   if security.wpa.mode is vyos_defined('wpa+wpa2') %}
-wpa=3
-{%   elif security.wpa.mode is vyos_defined('wpa2') or security.wpa.mode is vyos_defined('wpa3') %}
-wpa=2
-{%   elif security.wpa.mode is vyos_defined('wpa') %}
-wpa=1
-{%   endif %}
-
-{%   if security.wpa.cipher is vyos_defined %}
-# Set of accepted cipher suites (encryption algorithms) for pairwise keys
-# (unicast packets). This is a space separated list of algorithms:
-# CCMP = AES in Counter mode with CBC-MAC (CCMP-128)
-# TKIP = Temporal Key Integrity Protocol
-# CCMP-256 = AES in Counter mode with CBC-MAC with 256-bit key
-# GCMP = Galois/counter mode protocol (GCMP-128)
-# GCMP-256 = Galois/counter mode protocol with 256-bit key
-# Group cipher suite (encryption algorithm for broadcast and multicast frames)
-# is automatically selected based on this configuration. If only CCMP is
-# allowed as the pairwise cipher, group cipher will also be CCMP. Otherwise,
-# TKIP will be used as the group cipher. The optional group_cipher parameter can
-# be used to override this automatic selection.
-
-{%     if security.wpa.mode is vyos_defined('wpa2') %}
-# Pairwise cipher for RSN/WPA2 (default: use wpa_pairwise value)
-rsn_pairwise={{ security.wpa.cipher | join(" ") }}
-{%     else %}
-# Pairwise cipher for WPA (v1) (default: TKIP)
-wpa_pairwise={{ security.wpa.cipher | join(" ") }}
-{%     endif %}
-{%   endif %}
-
-{%   if security.wpa.group_cipher is vyos_defined %}
-# Optional override for automatic group cipher selection
-# This can be used to select a specific group cipher regardless of which
-# pairwise ciphers were enabled for WPA and RSN. It should be noted that
-# overriding the group cipher with an unexpected value can result in
-# interoperability issues and in general, this parameter is mainly used for
-# testing purposes.
-group_cipher={{ security.wpa.group_cipher | join(" ") }}
-{%   endif %}
-
-{%   if security.wpa.passphrase is vyos_defined %}
-# IEEE 802.11 specifies two authentication algorithms. hostapd can be
-# configured to allow both of these or only one. Open system authentication
-# should be used with IEEE 802.1X.
-# Bit fields of allowed authentication algorithms:
-# bit 0 = Open System Authentication
-# bit 1 = Shared Key Authentication (requires WEP)
-auth_algs=1
-
-# WPA pre-shared keys for WPA-PSK. This can be either entered as a 256-bit
-# secret in hex format (64 hex digits), wpa_psk, or as an ASCII passphrase
-# (8..63 characters) that will be converted to PSK. This conversion uses SSID
-# so the PSK changes when ASCII passphrase is used and the SSID is changed.
-wpa_passphrase={{ security.wpa.passphrase }}
-
-# Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
-# entries are separated with a space. WPA-PSK-SHA256 and WPA-EAP-SHA256 can be
-# added to enable SHA256-based stronger algorithms.
-# WPA-PSK = WPA-Personal / WPA2-Personal
-# WPA-PSK-SHA256 = WPA2-Personal using SHA256
-# WPA-EAP = WPA-Enterprise / WPA2-Enterprise
-# WPA-EAP-SHA256 = WPA2-Enterprise using SHA256
-# SAE = SAE (WPA3-Personal)
-# WPA-EAP-SUITE-B-192 = WPA3-Enterprise with 192-bit security/CNSA suite
-{%   if security.wpa.mode is vyos_defined('wpa3') %}
-wpa_key_mgmt=SAE
-{%   else %}
-wpa_key_mgmt=WPA-PSK WPA-PSK-SHA256
-{%   endif %}
-
-{%   elif security.wpa.radius is vyos_defined %}
-##### IEEE 802.1X-2004 related configuration ##################################
-# Require IEEE 802.1X authorization
-ieee8021x=1
-
-# Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
-# entries are separated with a space. WPA-PSK-SHA256 and WPA-EAP-SHA256 can be
-# added to enable SHA256-based stronger algorithms.
-# WPA-PSK = WPA-Personal / WPA2-Personal
-# WPA-PSK-SHA256 = WPA2-Personal using SHA256
-# WPA-EAP = WPA-Enterprise / WPA2-Enterprise
-# WPA-EAP-SHA256 = WPA2-Enterprise using SHA256
-# SAE = SAE (WPA3-Personal)
-# WPA-EAP-SUITE-B-192 = WPA3-Enterprise with 192-bit security/CNSA suite
-{%   if security.wpa.mode is vyos_defined('wpa3') %}
-wpa_key_mgmt=WPA-EAP-SUITE-B-192
-{%   else %}
-wpa_key_mgmt=WPA-EAP WPA-EAP-SHA256
-{%   endif %}
-
-{%     if security.wpa.radius.server is vyos_defined %}
-# RADIUS client forced local IP address for the access point
-# Normally the local IP address is determined automatically based on configured
-# IP addresses, but this field can be used to force a specific address to be
-# used, e.g., when the device has multiple IP addresses.
-# The own IP address of the access point (used as NAS-IP-Address)
-{%       if security.wpa.radius.source_address is vyos_defined %}
-radius_client_addr={{ security.wpa.radius.source_address }}
-own_ip_addr={{ security.wpa.radius.source_address }}
-{%       else %}
-own_ip_addr=127.0.0.1
-{%       endif %}
-
-{%       for radius in security.wpa.radius.server if not radius.disabled %}
-# RADIUS authentication server
-auth_server_addr={{ radius.server }}
-auth_server_port={{ radius.port }}
-auth_server_shared_secret={{ radius.key }}
-
-{%         if radius.acc_port %}
-# RADIUS accounting server
-acct_server_addr={{ radius.server }}
-acct_server_port={{ radius.acc_port }}
-acct_server_shared_secret={{ radius.key }}
-{%         endif %}
-{%       endfor %}
-{%     else %}
-# Open system
-auth_algs=1
-{%     endif %}
-{%   endif %}
-{% endif %}
-
-# TX queue parameters (EDCF / bursting)
-# tx_queue_<queue name>_<param>
-# queues: data0, data1, data2, data3
-#		(data0 is the highest priority queue)
-# parameters:
-#   aifs: AIFS (default 2)
-#   cwmin: cwMin (1, 3, 7, 15, 31, 63, 127, 255, 511, 1023, 2047, 4095, 8191,
-#	   16383, 32767)
-#   cwmax: cwMax (same values as cwMin, cwMax >= cwMin)
-#   burst: maximum length (in milliseconds with precision of up to 0.1 ms) for
-#          bursting
-#
-# Default WMM parameters (IEEE 802.11 draft; 11-03-0504-03-000e):
-# These parameters are used by the access point when transmitting frames
-# to the clients.
-#
-# Low priority / AC_BK = background
-tx_queue_data3_aifs=7
-tx_queue_data3_cwmin=15
-tx_queue_data3_cwmax=1023
-tx_queue_data3_burst=0
-# Note: for IEEE 802.11b mode: cWmin=31 cWmax=1023 burst=0
-#
-# Normal priority / AC_BE = best effort
-tx_queue_data2_aifs=3
-tx_queue_data2_cwmin=15
-tx_queue_data2_cwmax=63
-tx_queue_data2_burst=0
-# Note: for IEEE 802.11b mode: cWmin=31 cWmax=127 burst=0
-#
-# High priority / AC_VI = video
-tx_queue_data1_aifs=1
-tx_queue_data1_cwmin=7
-tx_queue_data1_cwmax=15
-tx_queue_data1_burst=3.0
-# Note: for IEEE 802.11b mode: cWmin=15 cWmax=31 burst=6.0
-#
-# Highest priority / AC_VO = voice
-tx_queue_data0_aifs=1
-tx_queue_data0_cwmin=3
-tx_queue_data0_cwmax=7
-tx_queue_data0_burst=1.5
-
-# Default WMM parameters (IEEE 802.11 draft; 11-03-0504-03-000e):
-# for 802.11a or 802.11g networks
-# These parameters are sent to WMM clients when they associate.
-# The parameters will be used by WMM clients for frames transmitted to the
-# access point.
-#
-# note - txop_limit is in units of 32microseconds
-# note - acm is admission control mandatory flag. 0 = admission control not
-# required, 1 = mandatory
-# note - Here cwMin and cmMax are in exponent form. The actual cw value used
-# will be (2^n)-1 where n is the value given here. The allowed range for these
-# wmm_ac_??_{cwmin,cwmax} is 0..15 with cwmax >= cwmin.
-#
-wmm_enabled=1
-
-# Low priority / AC_BK = background
-wmm_ac_bk_cwmin=4
-wmm_ac_bk_cwmax=10
-wmm_ac_bk_aifs=7
-wmm_ac_bk_txop_limit=0
-wmm_ac_bk_acm=0
-# Note: for IEEE 802.11b mode: cWmin=5 cWmax=10
-#
-# Normal priority / AC_BE = best effort
-wmm_ac_be_aifs=3
-wmm_ac_be_cwmin=4
-wmm_ac_be_cwmax=10
-wmm_ac_be_txop_limit=0
-wmm_ac_be_acm=0
-# Note: for IEEE 802.11b mode: cWmin=5 cWmax=7
-#
-# High priority / AC_VI = video
-wmm_ac_vi_aifs=2
-wmm_ac_vi_cwmin=3
-wmm_ac_vi_cwmax=4
-wmm_ac_vi_txop_limit=94
-wmm_ac_vi_acm=0
-# Note: for IEEE 802.11b mode: cWmin=4 cWmax=5 txop_limit=188
-#
-# Highest priority / AC_VO = voice
-wmm_ac_vo_aifs=2
-wmm_ac_vo_cwmin=2
-wmm_ac_vo_cwmax=3
-wmm_ac_vo_txop_limit=47
-wmm_ac_vo_acm=0
-