802.11s and WPA3-SAE

Hello,

I've successfully set up 802.11s mesh on three open-wrt devices. Although, they only associate when selecting no encryption under wireless security in LuCI. In the GUI, WPA3-SAE is the only option that doesn't bring up the red text warning incompatibility with 802.11s/mesh mode. Yet, when selecting that option and ensuring the keys are identical between devices, the nodes won't associate.

Is this something that I can fix? What are the implications of leaving my 802.11s network open?

My three devices are identical with the following details:

OpenWrt 22.03

$ iw phy | grep -B 6 "mesh point"

terminal output:

        Supported interface modes:
                 * IBSS
                 * managed
                 * AP
                 * AP/VLAN
                 * monitor
                 * mesh point
--
                        * 2457 MHz [10] (23.0 dBm)
                        * 2462 MHz [11] (23.0 dBm)
                        * 2467 MHz [12] (disabled)
                        * 2472 MHz [13] (disabled)
                        * 2484 MHz [14] (disabled)
        valid interface combinations:
                 * #{ managed } <= 2048, #{ AP, mesh point } <= 8, #{ P2P-client, P2P-GO } <= 1, #{ IBSS } <= 1,

$ vim /etc/config/wireless

terminal output:

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/ahb/18100000.wmac'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option cell_density '0'
 
config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'node2'
        option encryption 'psk2'
        option key 'matrix444555'
 
config wifi-iface 'wifinet1'
        option device 'radio0'
        option mode 'mesh'
        option mesh_fwding '1'
        option mesh_rssi_threshold '0'
        option network 'lan'
        option mesh_id 'mesh'
        option key 'waterworld1995'
        option encryption 'none'

$ opkg list-installed

Terminal output

1. luci-app-firewall - git-23.093.42704-1c01c64

2. luci-app-opkg - git-23.093.42303-e16f620

3. luci-app-yggdrasil - git-21.202.59029-3953b1a

4. luci-base - git-23.093.57104-ce20b4a

5. luci-i18n-yggdrasil-en - git-23.252.26706-18eed14

6. luci-lib-base - git-20.232.39649-1f6dc29

7. luci-lib-ip - git-20.250.76529-62505bd

8. luci-lib-jsonc - git-22.097.61921-7513345

9. luci-lib-nixio - git-20.234.06894-c4a4e43

10. luci-mod-admin-full - git-19.253.48496-3f93650

11. luci-mod-network - git-23.093.42704-52965f4

12. luci-mod-status - git-23.093.42411-713f701

13. luci-mod-system - git-23.013.73113-588381e

14. luci-proto-ipv6 - git-21.148.48881-79947af

15. luci-proto-ppp - git-21.158.38888-88b9d84

16. luci-ssl - git-20.244.36115-e10f954

17. luci-theme-bootstrap - git-23.093.42704-b47268a

18. mtd - 26

19. netifd - 2022-08-25-76d2d41b-1

20. nftables-json - 1.0.2-2.1

21. odhcp6c - 2022-08-05-7d21e8d8-18

22. odhcpd-ipv6only - 2023-01-02-4a673e1c-2

23. openwrt-keyring - 2022-03-25-62471e69-3

24. opkg - 2022-02-24-d038e5b6-1

25. ppp - 2.4.9.git-2021-01-04-3

26. ppp-mod-pppoe - 2.4.9.git-2021-01-04-3

27. procd - 2022-06-01-7a009685-2

28. procd-seccomp - 2022-06-01-7a009685-2

29. procd-ujail - 2022-06-01-7a009685-2

30. px5g-wolfssl - 6.2

31. rpcd - 2022-12-15-7de4820c-1

32. rpcd-mod-file - 2022-12-15-7de4820c-1

33. rpcd-mod-iwinfo - 2022-12-15-7de4820c-1

34. rpcd-mod-luci - 20210614

35. rpcd-mod-rrdns - 20170710

36. swconfig - 12

37. ubi-utils - 2.1.4-1

38. uboot-envtools - 2022.01-38

39. ubox - 2021-08-03-205defb5-2

40. ubus - 2022-06-01-2bebf93c-1

41. ubusd - 2022-06-01-2bebf93c-1

42. uci - 2021-10-22-f84f49f0-6

43. uclient-fetch - 2023-04-13-007d9454-1

44. ucode - 2022-12-02-46d93c9c-1

45. ucode-mod-fs - 2022-12-02-46d93c9c-1

46. ucode-mod-ubus - 2022-12-02-46d93c9c-1

47. ucode-mod-uci - 2022-12-02-46d93c9c-1

48. uhttpd - 2022-10-31-23977554-1

49. uhttpd-mod-ubus - 2022-10-31-23977554-1

50. urandom-seed - 3

51. urngd - 2020-01-21-c7f7b6b6-1

52. usign - 2020-05-23-f1f65026-1

53. wireless-regdb - 2023.02.13-1

54. wpad-basic-wolfssl - 2022-01-16-cff80b4f-16.2

55. yggdrasil - 0.4.3-1

I'm using sae encryption in all my 802.11s meshes. You also need to use full or mesh version of wpad.

See:

Also to ensure consistent connectivity between all your nodes you should also install the mesh11sd package.