wifi-scripts: map the 6 GHz encryption mode for stations too

In the 6 GHz band an AP turns none into owe, the psk modes into sae, the
WPA2-Enterprise modes into wpa3, and a transition mode into its WPA3
part. A station with the same configuration kept WPA-PSK, NONE, the WPA
protocol or the 802.1X SHA-1 AKM. wpa_supplicant skips a 6 GHz BSS
without an RSNE and removes the PSK AKMs there (events.c, "WPA PSK is
not allowed on the 6 GHz band"), so that station could not join. WPA3
Specification v3.5 11.2 also says that a WPA3 station connecting there
"shall not allow ... 802.1X SHA-1 AKM".

Move encryption_band() from ap.uc to iface.uc and apply it in
setup_sta() for mode sta. Mesh and ad-hoc keep their own handling.

Signed-off-by: Felix Fietkau <nbd@nbd.name>

package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc

@@ -11,35 +11,6 @@ import {
 import * as netifd from 'wifi.netifd';
 import * as iface from 'wifi.iface';
 
-/*
- * The 6 GHz band allows WPA3 and OWE only (IEEE 802.11-2024 12.12.2,
- * WPA3 Specification v3.5 11.2).
- */
-const encryption_6g = {
-	'sae-mixed': 'sae',
-	'psk3-mixed': 'sae',
-	'wpa3-mixed': 'wpa3',
-	'wpa': 'wpa3',
-	'wpa2': 'wpa3',
-	'wpa-mixed': 'wpa3',
-	'none': 'owe',
-	'psk': 'sae',
-	'psk2': 'sae',
-	'psk-mixed': 'sae',
-};
-
-function encryption_band(encryption, band) {
-	if (band != '6g')
-		return encryption;
-
-	let enc = split(encryption ?? 'none', '+', 2);
-	if (!encryption_6g[enc[0]])
-		return encryption;
-
-	enc[0] = encryption_6g[enc[0]];
-	return join('+', enc);
-}
-
 function key_kind(key) {
 	const n = length(key);
 
@@ -684,7 +655,7 @@ export function generate(interface, data, config, vlans, stas, phy_features) {
 
 	config.sae_station_passwords = station_password_count(stas);
 
-	config.encryption = encryption_band(config.encryption, data.config.band);
+	config.encryption = iface.encryption_band(config.encryption, data.config.band);
 	iface.parse_encryption(config, data.config, phy_features);
 
 	const refusal = bss_refusal(config, data.config.band);

package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc

@@ -3,6 +3,35 @@
 import { append_value, log } from 'wifi.common';
 import * as fs from 'fs';
 
+/*
+ * The 6 GHz band allows WPA3 and OWE only (IEEE 802.11-2024 12.12.2,
+ * WPA3 Specification v3.5 11.2).
+ */
+const encryption_6g = {
+	'sae-mixed': 'sae',
+	'psk3-mixed': 'sae',
+	'wpa3-mixed': 'wpa3',
+	'wpa': 'wpa3',
+	'wpa2': 'wpa3',
+	'wpa-mixed': 'wpa3',
+	'none': 'owe',
+	'psk': 'sae',
+	'psk2': 'sae',
+	'psk-mixed': 'sae',
+};
+
+export function encryption_band(encryption, band) {
+	if (band != '6g')
+		return encryption;
+
+	let enc = split(encryption ?? 'none', '+', 2);
+	if (!encryption_6g[enc[0]])
+		return encryption;
+
+	enc[0] = encryption_6g[enc[0]];
+	return join('+', enc);
+};
+
 export function parse_encryption(config, dev_config, phy_features) {
 	if (!config.encryption)
 		config.encryption = 'none';

package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.uc

@@ -61,6 +61,9 @@ export function ratelist(rates) {
 };
 
 function setup_sta(data, config) {
+	/* use what a 6 GHz AP with the same configuration offers */
+	if (config.mode == 'sta')
+		config.encryption = iface.encryption_band(config.encryption, data.band);
 	iface.parse_encryption(config, data);
 
 	if (config.auth_type in [ 'sae', 'owe', 'eap2', 'eap192', 'dpp' ])