catspeed-cc/openwrt
2
1
Fork 0
Code Issues Pull Requests Activity

wifi-scripts: ucode: advertise SAE-EXT-KEY AKM alongside SAE

Browse Source 
WPA3 Specification v3.5 §2.5.4 mandates that an AP's BSS Configuration
enables AKM suite selector 00-0F-AC:24 (SAE-EXT-KEY, SAE with a
group-dependent hash) whenever EHT or MLO is enabled. The WPA3 and
Wi-Fi Enhanced Open Deployment Guide v1.1 also recommends it on
non-EHT APs (Tables 3, 5, 6, 8).

Add a new sae_ext_key UCI option (enabled by default) that advertises
SAE-EXT-KEY, and FT-SAE-EXT-KEY when 802.11r is enabled, alongside
plain SAE/FT-SAE for the sae and psk-sae encryption modes.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit is contained in:
Hauke Mehrtens 2026-04-19 20:28:28 +02:00
parent 1f86f4e471
commit a12cec9ea3
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json
View File

@ -962,6 +962,11 @@
"rsn_preauth": {
"type": "boolean"
},
"sae_ext_key": {
"description": "Advertise the SAE-EXT-KEY AKM alongside plain SAE. Mandatory for EHT, enabled by default.",
"type": "boolean",
"default": true
},
"sae_password_file": {
"description": "External file containing VLAN SAE MAC address triplets",
"type": "string"

14
package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc
View File

@ -148,14 +148,24 @@ export function wpa_key_mgmt(config) {
case 'sae':
append_value(config, 'wpa_key_mgmt', 'SAE');
if (config.ieee80211r)
if (config.sae_ext_key)
append_value(config, 'wpa_key_mgmt', 'SAE-EXT-KEY');
if (config.ieee80211r) {
append_value(config, 'wpa_key_mgmt', 'FT-SAE');
if (config.sae_ext_key)
append_value(config, 'wpa_key_mgmt', 'FT-SAE-EXT-KEY');
}
break;
case 'psk-sae':
append_value(config, 'wpa_key_mgmt', 'SAE');
if (config.ieee80211r)
if (config.sae_ext_key)
append_value(config, 'wpa_key_mgmt', 'SAE-EXT-KEY');
if (config.ieee80211r) {
append_value(config, 'wpa_key_mgmt', 'FT-SAE');
if (config.sae_ext_key)
append_value(config, 'wpa_key_mgmt', 'FT-SAE-EXT-KEY');
}
append_value(config, 'wpa_key_mgmt', 'WPA-PSK');
if (config.ieee80211w)