wifi-scripts: map the encryption of an MLD station by all its bands

setup_sta() mapped the encryption mode by the band of the radio that
rendered the network block. An MLD station on 2.4, 5 and 6 GHz radios
was set up for 6 GHz, so psk2 became sae with PMF required. The
station then skipped a WPA2-PSK BSS on 2.4 GHz.

An AP MLD maps each link by its own band: the 6 GHz link takes SAE,
and the other links keep psk2. A station has one network block for
all its links, so it must allow the AKM of each band it can join.

netifd passes mlo_bands to an MLD station as well. With 6 GHz among
other bands, psk2 now becomes sae-mixed and wpa2 becomes wpa3-mixed.
wpa_supplicant removes the PSK AKMs for a 6 GHz BSS (events.c, "WPA
PSK is not allowed on the 6 GHz band"), so the station uses SAE
there. PMF optional meets the MFPR that a 6 GHz BSS sets. With 6 GHz
bands only, the 6 GHz mapping applies as before. Other modes keep
their station behaviour on a mixed MLD.

Signed-off-by: Felix Fietkau <nbd@nbd.name>

package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json

@@ -726,11 +726,11 @@
 			"type": "number"
 		},
 		"mlo": {
-			"description": "Multi-Link Operation. On an AP MLD, psk and psk-mixed become psk2, and wpa and wpa-mixed become wpa2; psk2 keeps PSK in the RSNE of the 2.4 and 5 GHz links for single-link stations and offers SAE in the RSNE Override 2 element of every link, which multi-link associations use. The 6 GHz link uses SAE. If the AP MLD has a 6 GHz link, none becomes owe on the other links",
+			"description": "Multi-Link Operation. On an AP MLD, psk and psk-mixed become psk2, and wpa and wpa-mixed become wpa2; psk2 keeps PSK in the RSNE of the 2.4 and 5 GHz links for single-link stations and offers SAE in the RSNE Override 2 element of every link, which multi-link associations use. The 6 GHz link uses SAE. If the AP MLD has a 6 GHz link, none becomes owe on the other links. On an MLD station with a 6 GHz radio and radios of other bands, psk2 becomes sae-mixed and wpa2 becomes wpa3-mixed",
 			"type": "boolean"
 		},
 		"mlo_bands": {
-			"description": "Bands of all radios of the AP MLD, set by netifd",
+			"description": "Bands of all radios of the AP MLD or MLD station, set by netifd",
 			"type": "array",
 			"items": {
 				"type": "string"

package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc

@@ -43,24 +43,46 @@ const encryption_mld_6g = {
 	'none': 'owe',
 };
 
-/* mld_bands: null for a single-link BSS, else the bands of the AP MLD */
-export function encryption_band(encryption, band, mld_bands) {
-	let modes;
-	if (band == '6g')
-		modes = encryption_6g;
-	else if (index(mld_bands ?? [], '6g') >= 0)
-		modes = encryption_mld_6g;
-	else if (mld_bands != null)
-		modes = encryption_mld;
-	else
-		return encryption;
+/*
+ * One network block serves all links of an MLD station, and wpa_supplicant
+ * removes the PSK AKMs for a 6 GHz BSS.
+ */
+const encryption_sta_mixed_6g = {
+	'psk2': 'sae-mixed',
+	'wpa2': 'wpa3-mixed',
+};
 
+function encryption_map(encryption, modes) {
 	let enc = split(encryption ?? 'none', '+', 2);
 	if (!modes[enc[0]])
 		return encryption;
 
 	enc[0] = modes[enc[0]];
 	return join('+', enc);
+}
+
+/* mld_bands: null for a single-link BSS, else the bands of the AP MLD */
+export function encryption_band(encryption, band, mld_bands) {
+	if (band == '6g')
+		return encryption_map(encryption, encryption_6g);
+	if (index(mld_bands ?? [], '6g') >= 0)
+		return encryption_map(encryption, encryption_mld_6g);
+	if (mld_bands != null)
+		return encryption_map(encryption, encryption_mld);
+
+	return encryption;
+};
+
+/* mld_bands: null for a single-link station, else the bands of the MLD */
+export function encryption_sta_band(encryption, band, mld_bands) {
+	if (!length(mld_bands))
+		return encryption_band(encryption, band);
+	if (index(mld_bands, '6g') < 0)
+		return encryption;
+	if (length(mld_bands) == 1)
+		return encryption_map(encryption, encryption_6g);
+
+	return encryption_map(encryption, encryption_sta_mixed_6g);
 };
 
 export function parse_encryption(config, dev_config, phy_features) {

package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.uc

@@ -69,7 +69,8 @@ function setup_sta(data, config, phy_features) {
 
 	/* use what a 6 GHz AP with the same configuration offers */
 	if (config.mode == 'sta')
-		config.encryption = iface.encryption_band(config.encryption, data.band);
+		config.encryption = iface.encryption_sta_band(config.encryption, data.band,
+			config.mlo ? config.mlo_bands : null);
 
 	/* WPA3 Specification v3.5 2.5 items 9 and 10: "A STA that enables EHT
 	 * or MLO shall, in its Network Profile, allow AKM suite selector