nixos/wireless: implement opportunistic WPA3

It turns out it's actually possible to fall back to WPA2 in case the
authentication fails with WPA3. This was suggested to me in the hostapd
mailing list: add another network block with only WPA2 and lower
priority, for each network with WPA3. For clients with missing/broken
WPA3, wpa_supplicant will:

1. try the network block with higher priority first
2. fail and temporarily disable the network block
3. try the fallback network block and connect

This takes a little more time (still <5s) because wpa_supplicant
retries a couple times before disabling the network block, but it allows
old client to gracefully fall back to WPA2 on mixed WPA2/WPA3 networks.

To avoid downgrade attacks, clients with proper WPA3 should disable
this; in the future we may want to disable this option by default.

0 files changed, 0 insertions, 0 deletions