netifd-wireless.sh update for cipher selection

[Ramon00]

Updated netifd-wireless.sh to allow multiple cipher selection for different wpa versions. Works together with updates to luci-mod-network PR commited today.

https://github.com/openwrt/luci/pull/8079

[Neustradamus]

Forum link:

• https://forum.openwrt.org/t/security-enhancement-for-wpa3-looking-for-testers-of-prs/242883

[systemcrash]

@Ramon00 could you demonstrate a result of before and after this PR for those properties, i.e. how they look? What fundamentally changed.

[Ramon00]

in /var/run/hostapd-phy*.conf before for wpa3-sae it would set by default wpa_pairwise=CCMP now by default for wpae-sae it sets wpa_pairwise=CCMP CCMP-256 GCMP GCMP-256 It will now also parse multiple ciphers in /etc/config/wireless , e.g. it allows option encryption 'sae+ccmp+ccmp256+gcmp+gcmp256' or option encryption 'sae+ccmp256+gcmp256' instead of just only limited choice like sae+CCMP or sae+GCMP. It would not (correctly) parse multiple. The Luci PR now also allows you to select any cipher combination you just checkmark the ciphers you like. Note on WPA3-SAE luci did not allow selecting ciphers at all (you could still set it to GCMP via the config file).

If people disagree with the defaults I put it then let me know, i can adjust. As you can see in the code:

			wpa3-192*) wpa_cipher="GCMP-256 ";;
			sae*|wpa3*) wpa_cipher="CCMP CCMP-256 GCMP GCMP-256 "	;;
			psk2*|wpa2*) wpa_cipher="TKIP CCMP CCMP-256 "	;;
			psk*|wep*) wpa_cipher="TKIP CCMP "	;;
			owe*) wpa_cipher="CCMP "	;;

I actually see i put in wep instead of wpa. Let me update the PR. (Not that anybody in their right mind is using wep or wpa....)

[Ramon00]

@nbd168 what do I need to do to get this merged?

[Ramon00]

For the commit message body, wrap your lines at 74 char

Ok done.

[systemcrash]

friendly ping to @nbd168 for wifi crypto changes

[Ramon00]

so this PR is going nowhere it seems. Let me give it one last attempt before I close this PR. @hauke could you have a look?

[systemcrash]

Recommend revising commit message. Compare with previous commits in this repo. Details from https://github.com/openwrt/netifd/pull/60#issuecomment-3533693220 would do well in the commit message.

[Ramon00]

Recommend revising commit message. Compare with previous commits in this repo. Details from #60 (comment) would do well in the commit message.

The commit message is not that different from the other commit messages as far as I can see, but im happy to update it to anything if that helps it merge this PR. What do you suggest i change it into?

[Ramon00]

updated the commit message.

[systemcrash]

Works togetherwith. Otherwise, better.

[Ramon00]

@systemcrash how about i close this PR, and you recreate it? I guess you carry some more weight around here.

[Ramon00]

oh well, i will just patch my own installs, guess people do not care enough about security and performance