openwrt-mirror/openwrt
1
0 Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2026-10-12 17:48:12 +04:00
Code Issues Packages Projects Releases Wiki Activity

wifi-scripts: no WPS on 6 GHz

Browse Source 
A WPS enrollee associates with Open System authentication and without
an RSNE; hostapd's check_assoc_ies() accepts a station with a WPS IE
and drops its RSNE. IEEE 802.11-2024 12.12.2 forbids Open System
authentication without encryption in the 6 GHz band.

iface_wps() enabled WPS on any BSS that iface_auth_type() marked
wps_possible (open, OWE and the personal modes) when wps_pushbutton or
wps_label was set, whatever the band. hostapd_config_check_bss_6g()
does not look at wps_state, so the 6 GHz link of an AP MLD ran WPS, and
an enrollee was accepted with Open System authentication there.

Clear wps_possible in iface_wps() for the 6 GHz band, as it already does
for multi_ap 1. iface_wps() is the one place that decides whether WPS is
written, so the rule holds for every auth type that sets wps_possible.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau committed 2026-10-08 09:50:39 +02:00
1 parent e6ae8f914a
commit 7519263cb1
2 files changed
+7 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json
+2 -2
View File
@@ -1233,7 +1233,7 @@
"default": true
},
"wps_label": {
"description": "Support WPS labels",
"description": "Support WPS labels. Ignored in the 6 GHz band, which has no WPS",
"type": "boolean"
},
"wps_manufacturer": {
@@ -1249,7 +1249,7 @@
"default": "ap_pin"
},
"wps_pushbutton": {
"description": "Support WPS pushbutton",
"description": "Support WPS pushbutton. Ignored in the 6 GHz band, which has no WPS",
"type": "boolean"
}
}
package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc
+5 -2
View File
@@ -285,13 +285,16 @@ function iface_ppsk(config) {
append('macaddr_acl', '2');
}
function iface_wps(config) {
function iface_wps(config, band) {
push_config(config, 'config_methods', 'wps_pushbutton', 'push_button');
push_config(config, 'config_methods', 'wps_label', 'label');
if (config.multi_ap == 1)
config.wps_possible = false;
if (band == '6g')
config.wps_possible = false;
if (config.wps_possible && length(config.config_methods)) {
config.eap_server = 1;
set_default(config, 'wps_state', 2);
@@ -631,7 +634,7 @@ export function generate(interface, data, config, vlans, stas, phy_features) {
iface_ppsk(config);
iface_wps(config);
iface_wps(config, data.config.band);
iface_rrm(config);