From 1b2fb79a4b253b4e79ed182df343f5a52547daff Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Sat, 3 Oct 2026 08:39:06 +0200 Subject: [PATCH] wifi-scripts: map the 6 GHz encryption mode for stations too In the 6 GHz band an AP turns none into owe, the psk modes into sae, the WPA2-Enterprise modes into wpa3, and a transition mode into its WPA3 part. A station with the same configuration kept WPA-PSK, NONE, the WPA protocol or the 802.1X SHA-1 AKM. wpa_supplicant skips a 6 GHz BSS without an RSNE and removes the PSK AKMs there (events.c, "WPA PSK is not allowed on the 6 GHz band"), so that station could not join. WPA3 Specification v3.5 11.2 also says that a WPA3 station connecting there "shall not allow ... 802.1X SHA-1 AKM". Move encryption_band() from ap.uc to iface.uc and apply it in setup_sta() for mode sta. Mesh and ad-hoc keep their own handling. Signed-off-by: Felix Fietkau --- .../files-ucode/usr/share/ucode/wifi/ap.uc | 31 +------------------ .../files-ucode/usr/share/ucode/wifi/iface.uc | 29 +++++++++++++++++ .../usr/share/ucode/wifi/supplicant.uc | 3 ++ 3 files changed, 33 insertions(+), 30 deletions(-) diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc index 74629543869..ef24b13901a 100644 --- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc +++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc @@ -11,35 +11,6 @@ import { import * as netifd from 'wifi.netifd'; import * as iface from 'wifi.iface'; -/* - * The 6 GHz band allows WPA3 and OWE only (IEEE 802.11-2024 12.12.2, - * WPA3 Specification v3.5 11.2). - */ -const encryption_6g = { - 'sae-mixed': 'sae', - 'psk3-mixed': 'sae', - 'wpa3-mixed': 'wpa3', - 'wpa': 'wpa3', - 'wpa2': 'wpa3', - 'wpa-mixed': 'wpa3', - 'none': 'owe', - 'psk': 'sae', - 'psk2': 'sae', - 'psk-mixed': 'sae', -}; - -function encryption_band(encryption, band) { - if (band != '6g') - return encryption; - - let enc = split(encryption ?? 'none', '+', 2); - if (!encryption_6g[enc[0]]) - return encryption; - - enc[0] = encryption_6g[enc[0]]; - return join('+', enc); -} - function key_kind(key) { const n = length(key); @@ -684,7 +655,7 @@ export function generate(interface, data, config, vlans, stas, phy_features) { config.sae_station_passwords = station_password_count(stas); - config.encryption = encryption_band(config.encryption, data.config.band); + config.encryption = iface.encryption_band(config.encryption, data.config.band); iface.parse_encryption(config, data.config, phy_features); const refusal = bss_refusal(config, data.config.band); diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc index 3226534726c..c046d431221 100644 --- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc +++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc @@ -3,6 +3,35 @@ import { append_value, log } from 'wifi.common'; import * as fs from 'fs'; +/* + * The 6 GHz band allows WPA3 and OWE only (IEEE 802.11-2024 12.12.2, + * WPA3 Specification v3.5 11.2). + */ +const encryption_6g = { + 'sae-mixed': 'sae', + 'psk3-mixed': 'sae', + 'wpa3-mixed': 'wpa3', + 'wpa': 'wpa3', + 'wpa2': 'wpa3', + 'wpa-mixed': 'wpa3', + 'none': 'owe', + 'psk': 'sae', + 'psk2': 'sae', + 'psk-mixed': 'sae', +}; + +export function encryption_band(encryption, band) { + if (band != '6g') + return encryption; + + let enc = split(encryption ?? 'none', '+', 2); + if (!encryption_6g[enc[0]]) + return encryption; + + enc[0] = encryption_6g[enc[0]]; + return join('+', enc); +}; + export function parse_encryption(config, dev_config, phy_features) { if (!config.encryption) config.encryption = 'none'; diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.uc b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.uc index b28562b6c16..7945326a9f5 100644 --- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.uc +++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.uc @@ -61,6 +61,9 @@ export function ratelist(rates) { }; function setup_sta(data, config) { + /* use what a 6 GHz AP with the same configuration offers */ + if (config.mode == 'sta') + config.encryption = iface.encryption_band(config.encryption, data.band); iface.parse_encryption(config, data); if (config.auth_type in [ 'sae', 'owe', 'eap2', 'eap192', 'dpp' ])