wifi-scripts: ucode: only advertise GCMP-256 when the driver supports it

The GCMP-256 pairwise cipher was advertised based only on the BSS htmode
(HE/EHT), without checking whether the driver actually implements it. On
phys that do not support GCMP-256 this makes hostapd reject the
configuration and fail to start.

Query the phy's NL80211 cipher suite list in device_capabilities() and
expose a phy_features.cipher_gcmp256 flag, then only offer GCMP-256 when
the driver advertises the GCMP-256 cipher suite (00-0F-AC:9, 0x000fac09),
mirroring how the HT/VHT feature flags are already gated on the reported
phy capabilities. This covers both the sae/sae-mixed "GCMP-256 CCMP"
pairwise default and the GCMP-256 pairwise cipher in the sae-compat RSNE
Override 2 element.

The "GCMP-256 CCMP" default now keys off driver support alone instead of
the htmode; a follow-up commit reintroduces the per-mode/EHT restriction
via a gcmp256 option.

Fixes: 1f86f4e471f8 ("wifi-scripts: ucode: simplify wpa_pairwise default selection")
Fixes: 86b9eec8f02b ("wifi-scripts: ucode: add WPA3-Personal Compatibility Mode")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24041
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc
index 6c675b79a4d6ebdbecbb45eb05b75b9e68e2c765..e539b00f286a9cd6d48d47aa7a00f7cb5457b49e 100644 (file)
--- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc
+++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc
@@ -551,7 +551,7 @@ export function generate(interface, data, config, vlans, stas, phy_features) {
        config.start_disabled = data.ap_start_disabled;
        iface_setup(config);
 
-       iface.parse_encryption(config, data.config);
+       iface.parse_encryption(config, data.config, phy_features);
        if (data.config.band == '6g') {
                if (config.auth_type == 'psk-sae')
                        config.auth_type = 'sae';

diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc
index 5f56e324e4d65b42fe6fa1ea86cfe4b57a273c3c..64d52cb7543174c143c5718d8c9f7c3fcf93638c 100644 (file)
--- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc
+++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc
@@ -14,6 +14,8 @@ import * as fs from 'fs';
 const NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER = 33;
 const NL80211_EXT_FEATURE_RADAR_BACKGROUND = 61;
 
+const WLAN_CIPHER_SUITE_GCMP_256 = 0x000fac09;
+
 let phy_features = {};
 let phy_capabilities = {};
 
@@ -496,6 +498,7 @@ function device_capabilities(config) {
 
        phy_features.ftm_responder = device_extended_features(phy.extended_features, NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
        phy_features.radar_background = device_extended_features(phy.extended_features, NL80211_EXT_FEATURE_RADAR_BACKGROUND);
+       phy_features.cipher_gcmp256 = WLAN_CIPHER_SUITE_GCMP_256 in (phy.cipher_suites ?? []);
 }
 
 function generate(config) {

diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc
index 0193eaeef1a1532c6cdfc7fa13a61a4408cd0923..a05a0d392029944d06b482159e5031103b67a736 100644 (file)
--- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc
+++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc
@@ -3,7 +3,7 @@
 import { append_value, log } from 'wifi.common';
 import * as fs from 'fs';
 
-export function parse_encryption(config, dev_config) {
+export function parse_encryption(config, dev_config, phy_features) {
        if (!config.encryption)
                return;
 
@@ -62,7 +62,7 @@ export function parse_encryption(config, dev_config) {
                config.wpa_pairwise = 'CCMP';
                if (dev_config.band != '6g')
                        config.rsn_override_pairwise = 'CCMP';
-               if (wildcard(dev_config.htmode ?? '', 'EHT*'))
+               if (phy_features?.cipher_gcmp256 && wildcard(dev_config.htmode ?? '', 'EHT*'))
                        config.rsn_override_pairwise_2 = 'GCMP-256';
                break;
 
@@ -107,7 +107,7 @@ export function parse_encryption(config, dev_config) {
                config.wpa_pairwise ??= null;
        else if (config.hw_mode == 'ad')
                config.wpa_pairwise ??= 'GCMP';
-       else if (wildcard(dev_config?.htmode, 'EHT*') || wildcard(dev_config?.htmode, 'HE*'))
+       else if (phy_features?.cipher_gcmp256)
                config.wpa_pairwise ??= 'GCMP-256 CCMP';
        else
                config.wpa_pairwise ??= 'CCMP';