1 files changed, 15 insertions, 11 deletions
diff --git a/data/templates/wifi/hostapd.conf.j2 b/data/templates/wifi/hostapd.conf.j2
index f2312d2d4..c3f32da72 100644
--- a/data/templates/wifi/hostapd.conf.j2
+++ b/data/templates/wifi/hostapd.conf.j2
@@ -340,6 +340,11 @@ vht_oper_chwidth={{ capabilities.vht.channel_set_width }}
 {%     endif %}
 
 {%     set output = namespace(value='')  %}
+{%     if capabilities.vht.channel_set_width is vyos_defined('2') %}
+{%         set output.value = output.value ~ '[VHT160]' %}
+{%     elif capabilities.vht.channel_set_width is vyos_defined('3') %}
+{%         set output.value = output.value ~ '[VHT160-80PLUS80]' %}
+{%     endif %}
 {%     if capabilities.vht.stbc.tx is vyos_defined %}
 {%         set output.value = output.value ~ '[TX-STBC-2BY1]' %}
 {%     endif %}
@@ -363,30 +368,21 @@ vht_oper_chwidth={{ capabilities.vht.channel_set_width }}
 {%     endif %}
 {%     if capabilities.vht.max_mpdu_exp is vyos_defined %}
 {%         set output.value = output.value ~ '[MAX-A-MPDU-LEN-EXP-' ~ capabilities.vht.max_mpdu_exp ~ ']' %}
-{%         if capabilities.vht.max_mpdu_exp is vyos_defined('2') %}
-{%             set output.value = output.value ~ '[VHT160]' %}
-{%         endif %}
-{%         if capabilities.vht.max_mpdu_exp is vyos_defined('3') %}
-{%             set output.value = output.value ~ '[VHT160-80PLUS80]' %}
-{%         endif %}
 {%     endif %}
 {%     if capabilities.vht.link_adaptation is vyos_defined('unsolicited') %}
 {%         set output.value = output.value ~ '[VHT-LINK-ADAPT2]' %}
 {%     elif capabilities.vht.link_adaptation is vyos_defined('both') %}
 {%         set output.value = output.value ~ '[VHT-LINK-ADAPT3]' %}
 {%     endif %}
-
 {%     for short_gi in capabilities.vht.short_gi if capabilities.vht.short_gi is vyos_defined %}
 {%         set output.value = output.value ~ '[SHORT-GI-' ~ short_gi | upper ~ ']'  %}
 {%     endfor %}
-
 {%     for beamform in capabilities.vht.beamform if capabilities.vht.beamform is vyos_defined %}
 {%         set output.value = output.value ~ '[SU-BEAMFORMER]' if beamform is vyos_defined('single-user-beamformer') else '' %}
 {%         set output.value = output.value ~ '[SU-BEAMFORMEE]' if beamform is vyos_defined('single-user-beamformee') else '' %}
 {%         set output.value = output.value ~ '[MU-BEAMFORMER]' if beamform is vyos_defined('multi-user-beamformer')  else '' %}
 {%         set output.value = output.value ~ '[MU-BEAMFORMEE]' if beamform is vyos_defined('multi-user-beamformee')  else '' %}
 {%     endfor %}
-
 {%     if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1  %}
 {%         if capabilities.vht.beamform is vyos_defined %}
 {%             if capabilities.vht.beamform == 'single-user-beamformer' %}
@@ -430,14 +426,22 @@ ieee80211n={{ '1' if 'n' in mode or 'ac' in mode else '0' }}
 ignore_broadcast_ssid=1
 {% endif %}
 
-# Station MAC address -based authentication
+{% if type is vyos_defined('access-point') %}
+# Station MAC address-based authentication
 # Please note that this kind of access control requires a driver that uses
 # hostapd to take care of management frame processing and as such, this can be
 # used with driver=hostap or driver=nl80211, but not with driver=atheros.
 # 0 = accept unless in deny list
 # 1 = deny unless in accept list
 # 2 = use external RADIUS server (accept/deny lists are searched first)
-macaddr_acl=0
+macaddr_acl={{ '0' if security.station_address.mode is vyos_defined('accept') else '1' }}
+
+# Accept/deny lists are read from separate files (containing list of
+# MAC addresses, one per line). Use absolute path name to make sure that the
+# files can be read on SIGHUP configuration reloads.
+accept_mac_file={{ hostapd_accept_station_conf }}
+deny_mac_file={{ hostapd_deny_station_conf }}
+{% endif %}
 
 {% if max_stations is vyos_defined %}
 # Maximum number of stations allowed in station table. New stations will be