mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-12 06:57:57 +04:00
Felix Fietkau
e0e11b78f7
On an EHT BSS or an AP MLD with sae, psk3, sae-mixed or psk3-mixed, the RSNE Override 2 element carries SAE-EXT-KEY and GCMP-256 (CCMP without phy support). An explicit sae_ext_key 1 and gcmp256 1 also put both items into the RSNE, and the element stayed as a duplicate. A configuration that asks for an RSNE with AKM 24 and GCMP-256 and an RSNXE only sets sae_ext_key 1 and gcmp256 1. The Beacon then had an RSNO2E and an RSNXOE in addition. A duplicate RSNO2E adds nothing. A client sees both items in the RSNE, and the RSNE meets WPA3 Specification v3.5 2.5 items 4 and 5. Build the element only when the RSNE lacks its AKM or its pairwise cipher. Without an RSNO2E, hostapd writes no RSNXOE either (wpa_auth_gen_wpa_ie()). The default keeps the element as before, with the client fixes of commitsfc652db52aand5e067465ff, and so does a BSS with one of the two options. One exception: without phy support for GCMP-256, the element carries SAE-EXT-KEY and CCMP, which an RSNE with sae_ext_key 1 already offers, so that BSS sends no element. 0 still keeps an item out of both elements. sae-compat keeps its own elements. On an AP MLD, the decision covers all links (ap.uc mld_rsno2()): WPA3 Specification v3.5 14.2 requires an identical RSNE Override 2 element on all links of an AP MLD that uses RSN overriding. The element goes only where the RSNE of every link offers both items. A psk2 or psk-mixed AP MLD has PSK in the RSNE of its 2.4 and 5 GHz links, so all its links keep the element, also the 6 GHz link, whose RSNE has SAE. An AP MLD of sae whose RSNE has both items on every link uses no RSN overriding. IEEE 802.11be-2024 12.6.2 then requires the same RSNE on every link except the AKM list and MFPR, and one common AKM. The links share SAE and SAE-EXT-KEY, also on a 6 GHz link. Signed-off-by: Felix Fietkau <nbd@nbd.name>