From dfc38d03261322dc9781cad5b4b66affb7682cb4 Mon Sep 17 00:00:00 2001
From: Alain Lamar <alain_lamar@yahoo.de>
Date: Fri, 17 Apr 2020 22:52:55 +0200
Subject: wireless: T2306: Add new cipher suites to the WiFi configuration

    Yet, VyOS knows these two encryption schemes for WiFi:

        1. CCMP = AES in Counter mode with CBC-MAC (CCMP-128)
        2. TKIP = Temporal Key Integrity Protocol

    These encryption schemes are new and especially the Galois counter mode
    cipher suites are very desirable!

        1. CCMP-256 = AES in Counter mode with CBC-MAC with 256-bit key
        2. GCMP = Galois/counter mode protocol (GCMP-128)
        3. GCMP-256 = Galois/counter mode protocol with 256-bit key

    CCMP is supported by all WPA2 compatible NICs, so this remains the
    default cipher for bidirectional and group packets while using WPA2.

    Use 'iw list' to figure out which cipher suites your cards support
    prior to configuring other cipher suites than CCMP. AP NICs and
    STA NICs must both support at least one common cipher in a given
    list in order to associate successfully.
---
 interface-definitions/interfaces-wireless.xml.in | 54 +++++++++++++++++++++---
 1 file changed, 49 insertions(+), 5 deletions(-)

(limited to 'interface-definitions/interfaces-wireless.xml.in')

diff --git a/interface-definitions/interfaces-wireless.xml.in b/interface-definitions/interfaces-wireless.xml.in
index a5c6315fa..e5393e99e 100644
--- a/interface-definitions/interfaces-wireless.xml.in
+++ b/interface-definitions/interfaces-wireless.xml.in
@@ -605,22 +605,66 @@
                 <children>
                   <leafNode name="cipher">
                     <properties>
-                      <help>Cipher suite for WPA</help>
+                      <help>Cipher suite for WPA unicast packets</help>
                       <completionHelp>
-                        <list>TKIP CCMP</list>
+                        <list>GCMP-256 GCMP CCMP-256 CCMP TKIP</list>
                       </completionHelp>
+                      <valueHelp>
+                        <format>GCMP-256</format>
+                        <description>AES in Galois/counter mode with 256-bit key</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>GCMP</format>
+                        <description>AES in Galois/counter mode with 128-bit key</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>CCMP-256</format>
+                        <description>AES in Counter mode with CBC-MAC with 256-bit key</description>
+                      </valueHelp>
                       <valueHelp>
                         <format>CCMP</format>
-                        <description>AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]</description>
+                        <description>AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0] (supported on all WPA2 APs)</description>
                       </valueHelp>
                       <valueHelp>
                         <format>TKIP</format>
                         <description>Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]</description>
                       </valueHelp>
                       <constraint>
-                        <regex>(CCMP|TKIP)</regex>
+                        <regex>(GCMP-256|GCMP|CCMP-256|CCMP|TKIP)</regex>
                       </constraint>
-                      <constraintErrorMessage>Invalid WEP key</constraintErrorMessage>
+                      <constraintErrorMessage>Invalid cipher selection</constraintErrorMessage>
+                      <multi/>
+                    </properties>
+                  <leafNode name="group-cipher">
+                    <properties>
+                      <help>Cipher suite for WPA multicast and broadcast packets</help>
+                      <completionHelp>
+                        <list>GCMP-256 GCMP CCMP-256 CCMP TKIP</list>
+                      </completionHelp>
+                      <valueHelp>
+                        <format>GCMP-256</format>
+                        <description>AES in Galois/counter mode with 256-bit key</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>GCMP</format>
+                        <description>AES in Galois/counter mode with 128-bit key</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>CCMP-256</format>
+                        <description>AES in Counter mode with CBC-MAC with 256-bit key</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>CCMP</format>
+                        <description>AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0] (supported on all WPA2 APs)</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>TKIP</format>
+                        <description>Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]</description>
+                      </valueHelp>
+                      <constraint>
+                        <regex>(GCMP-256|GCMP|CCMP-256|CCMP|TKIP)</regex>
+                      </constraint>
+                      <constraintErrorMessage>Invalid group cipher selection</constraintErrorMessage>
                       <multi/>
                     </properties>
                   </leafNode>
-- 
cgit v1.2.3