The WiFi 6E (6 GHz) standard mandates WPA3 and management frame
protection. While wifi-scripts already silently upgrades mixed modes
(psk-sae -> sae) on 6 GHz radios, the LuCI encryption dropdown still
offers all WPA2/WPA/WEP options, leading to confusing hostapd failures
when users pick an unsupported mode.
When the radio band is 6 GHz, hide encryption options that are
incompatible with the standard:
- WPA2-PSK, WPA-PSK, WPA-PSK/WPA2-PSK Mixed Mode
- WPA2-PSK/WPA3-SAE Mixed Mode (6 GHz does not allow WPA2 fallback)
- WPA2-EAP, WPA-EAP, WPA2-EAP/WPA3-EAP Mixed Mode
- WEP
- No Encryption (6 GHz requires protected management frames)
This leaves WPA3-SAE, WPA3-EAP, WPA3-EAP 192-bit, and OWE as the
available choices for 6 GHz interfaces.
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
Views that returned headings, tables and control rows with nothing around
them now wrap that content in a section: the system and kernel logs,
Processes, the nftables and iptables views, Startup, the wireless station
list, DSL stats and the package manager. The nftables rule tables also
drop an !important that no theme could override.
Nothing changes in the stock bootstrap theme; themes that draw
.cbi-section as a panel get the structure they need.
Signed-off-by: Ivan Kvashonkin <vizzlef@gmail.com>
The WLAN roaming tab label used a lowercase "r" in "roaming",
inconsistent with the title-case convention used by other tabs
(e.g. "MAC-Filter", "Advanced Settings"). Capitalize it to
"WLAN Roaming" and update the msgid in all translation files.
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
netifd only understands packets_per_port which it converts/writes to
sysfs packets_per_slave.
Also, the value 0 is valid.
Closes#8830
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Some settings that were missing from the device configuration have been
added to control auto-negotiation, PHY speed, duplex, and rx/tx pause.
If the interface has available Phy links speeds, those values will be
used, otherwise, static values will be used, such as 10Mbps half/full.
100Mbps half/full, 1Gbps full, 2.5Gbps full, etc...
Signed-off-by: Matheus Sampaio Queiroga <srherobrine20@gmail.com>
rpcd iwinfo freqlist does not set a `no_ir` field.
It is instead a flag so check in the flags list instead.
Signed-off-by: Samuele Yang <samuele.yang@morsemicro.com>
Expose three per-BSS WPA3 tuning options in the wireless security tab:
- gcmp256: advertise the GCMP-256 pairwise cipher
- sae_ext_key: advertise the SAE-EXT-KEY AKM (SAE using a group-dependent
hash, aka SAE-GDH)
- transition_disable: signal Transition Disable (WPA3 Specification v3.5
section 13) so a client that connected once no longer downgrades
GCMP-256 and SAE-EXT-KEY are mandatory for Wi-Fi 7 (EHT) but break
interoperability with some clients. The wifi-scripts backend therefore
defaults them on only for WPA3-Personal Compatibility Mode (sae-compat)
on an EHT radio, and off everywhere else. The gcmp256/sae_ext_key
checkboxes mirror that default, derived from both the encryption mode and
the radio htmode, so the box shows the real default: leaving it untouched
keeps the option unset (the backend decides), while toggling it writes an
explicit override. As htmode is a radio property, not a wifi-iface one,
it is read from the current selection of the radio's frequency widget
(falling back to the saved config) instead of a same-section dependency.
transition_disable is offered only for the WPA3-only modes where the
signalled bitmap is non-empty.
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/luci/pull/8790
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Expose the sae-compat encryption mode (WPA3-Personal Compatibility Mode)
in the wireless security settings. It advertises WPA2-PSK in the base
RSNE while offering SAE through RSN Override elements, so that both
legacy WPA2 and modern WPA3 clients can connect to a single SSID.
The mode relies on RSN overriding, which is an access-point feature, so
it is offered for AP mode only. It gets the passphrase field and, like
the other WPA2/WPA3 modes, the 802.11r, KRACK-countermeasure and WPS
options.
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/luci/pull/8790
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Override theme-wide input min-widths and button resets so port labels stay
inside tiles and T/U colour-coding renders on openwrt-2020 and material.
Use theme CSS variables for row and border colours where available.
Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>
Co-authored-by: LLM (Composer)
The negotiated link speed of a network device isn't shown on the Network
configuration pages, so a link stuck below its capability (e.g. a gigabit
port at 100 Mbit/s) goes unnoticed.
Add a "Link Speed" column to the Devices tab showing the negotiated speed,
with the device's ethtool-supported speeds in a tooltip when available, and
"-" when the device has no carrier or reports no speed. The columns are
ordered by OSI layer: link speed (L1) before MAC (L2) and MTU (L3).
The current speed comes from the device link state; the supported speeds are
the distinct network.device status "link-supported" modes, fetched once in
load(). Add the network.device "status" ACL grant so the view can call it.
Signed-off-by: Paul Tobias <github@tobias.pt>
Register a new "Switch/VLAN config" entry in the Network top-level
menu and add the view at view/network/switch-vlan.js.
The menu entry is only visible when the network configuration
contains either a bridge device with vlan_filtering explicitly
enabled or at least one bridge-vlan section (mirroring the implicit
enable behaviour of the existing Bridge VLAN filtering dialog).
The view itself locates the first such bridge in declaration order,
detects configurations that the new view cannot represent (PVID
different from the untagged VLAN, duplicate untagged memberships,
etc.) and blocks access with an explanatory error in that case.
The following shortcomings resulted in an alternative Switch/VLAN
view:
- To reach the current switch/VLAN config page, one has to click
through: Network -> Interfaces -> Devices -> Configure... (the
respective switch/bridge) -> Bridge VLAN filtering which - at
least for dedicated switches - is not sth. I feel comfortable
having to do every time I want to make a basic change.
- While ~5 ports might still fit next to each other, starting with
2 figure numbers (at the latest), we end up scrolling
horizontally. Finding a higher port to configure on a 24 or 48
port switch inevitably results in plenty of horizontal scrolling,
while at the same time you have to memorise which row maps to
which VLAN-ID, as those scroll out the moment you start
scrolling.
- Every port needs to be configured by its own, no way to bulk-conf
them, to apply the same VLAN config onto multiple ports (e.g.
applying the same tag onto a large number or all ports).
- Ports and VLAN-IDs are defined by sole numbers. There's no way to
annotate them, e.g. a VLAN ID as "iot" or "mgmt", or a port as
e.g. "uplink" or "server-mirko".
With the following changes:
- Add a dedicated "Switch/VLAN config" entry within the top-level
"Network" dropdown (you might remember we already had such for
swconfig back then, before it got obsoleted by DSA and conf via
vlan aware bridges).
- Avoid horizontal scrolling by showing switch ports in multiple
rows if not fitting screen width.
- Allow selection of multiple ports to configure them all the same
way at once.
- Introduce labels for ports and VLANs; they're optional annotations
and don't serve any functional purpose except hinting the user,
hence stored in respective sections within /etc/config/luci.
- Visualising which VLANs are assigned to which ports by colour-
coding the ports when hovering over configured VLANs.
Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>
Co-authored-by: Opus and/or Composer
_('<em>%s</em>') caused redundant strings like <em>%s</em> to appear in i18n.
_('<em>Add</em>') caused redundant strings like <em>Add</em> to appear in i18n.
in addition, delete an extra space.
Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
This reverts commit 6bcdc18d65.
Since the bug where a write operation is executed when the input
matches the default has been fixed in form.js, this workaround
is no longer needed and is being reverted.
Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
In handleJoinConfirm(), when the scanned BSS has no VHT/HT info,
uci.remove('wireless', radioDev.getName(), 'htmode') is called
intending to remove only the htmode option. However, uci.remove()
only accepts (conf, sid) and silently ignores the third parameter,
causing the entire wifi-device section to be deleted from the
rpcd session delta.
This makes the radio disappear from the Wireless Overview page
until the session delta is cleared.
Fix by using uci.unset() which correctly handles three parameters
(conf, sid, opt) to remove a single option.
Signed-off-by: Weicheng Xiao <weicheng.xiao@outlook.com>
dnsmasq behaviour changed slightly and MACs separated
by hyphen are no longer accepted. Accept only colon
separator when validating. Also enforce hex doublets,
i.e. 00 instead of 0.
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
After the ES2016 rework, a very old bug was reverted where the WiFi SSID was
treated as raw HTML and directly appended to DOM.
This might result in XSS vulnerability with specially crafted SSID from the
Access Point around.
This is only triggered on opening the modal as the normal wireless.js view
doesn't scan the Access Point.
To fix this and make it more clear that SSID must be always escaped, move the
SSID handling to a dedicated variable and use the document.createTextNode()
to escape it similar to how it's done in similar place like the
channel_analysis.js
Fixes: cdce600aae ("luci-mod-network: give wireless.js ES2016 treatment and refactor")
Reported-by: Sasha Romijn <sct@mxsasha.eu>
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The Kernel receives the name suffix, so evaluate length on
the user provided name and disconnect the formatted name
code length check.
Closes#8390
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
OpenWrt commit 3cc56a5 chaged the default value of `mobility_domain` and
`r1_key_holder` options. This commit removes the stale hard-coded `4f57`
from luci to avoid ambiguity.
Closes: openwrt/luci#8267
Signed-off-by: Youfu Zhang <zhangyoufu@gmail.com>
Adds PoE/PSE configuration support for modern linux (PSE-PD).
This change is based on the PSE-PD backport (from 6.17)
and netifd|ubus changes.
* Add getPSE() [receive all status information]
and hasPSE() [has the device PSE hardware?]
* Changes ACL permissions to query network.device status information
* Add two new PoE icons (PoE active with link up + link down) for
the port status page
* Changes port status to show PoE information, next to link information
and data transfer.
* Add a new tab for PoE/PSE to the device configuration,
which will only be displayed if the device supports PSE
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
odhcpd specific flag. PD-P only works with dhcpv6_pd and dhcpv6.
Also move some DHCPv6 specific settings to a new DHCPv6 tab.
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
For use with dnsmasq tags
Note that a MAC tab is possible but the same functionality
is present in the leases tab which handles MACs and tags.
A MAC tab has a 1:1 tag:MAC relationship, whereas the leases
has a many:many relationship.
The dnsmasq init file needs updating to use 'tag' in
place of 'networkid', which is an older legacy format still
understood by dnsmasq, but all documentation uses 'tag'.
tag names shall not match:
- network devices/interfaces
- service names
Three dnsmasq reserved tag names are:
- known
- !known
- known-othernet
Tag names can be prepended with '!' to invert their usage.
Closes#7178
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Fiddling with the dnsmasq/odhcpd specific settings is (at least in my
experience) a much less common operation than wanting to see/change
leases and their configuration, so reorder the tabs to show leases first
and dnsmasq/odhcpd tabs second/third.
Signed-off-by: David Härdeman <david@hardeman.nu>
For odhcpd, an empty "dhcpv4" is equivalent to "disabled",
but for dnsmasq, an empty "dhcpv4" is equivalent to "enabled",
so an empty "dhcpv4" is ambiguous.
Fixes https://github.com/openwrt/openwrt/issues/21220
Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
Sergei S.
Michael Pfeifroth
Ivan Kvashonkin
Paul Donald
Matheus Sampaio Queiroga
Samuele Yang
Hauke Mehrtens
Coia Prant
Mirko VogtandStarDev
Paul Tobias
Jo-Philipp Wich
Andy Chiang
weicheng04
Ramon Van Gorkom
Vishnu Verma
Christian Marangi
Youfu Zhang
Carlo Szelinsky
David Härdeman
Liangbin Lian