Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(wifi): add NAN group data and management frame protection

Browse Source 
Add Wi-Fi Aware group-key support to secured NDPs so group-addressed
traffic can be protected, for interop with iOS/macOS peers:

- GTK (NCS-GTK-CCM-128) protects group-addressed data.
- IGTK/BIGTK (BIP) protect group management traffic - multicast SDFs,
  Beacons.

Capabilities are advertised in the CSIA IE: group_data_prot maps to GTKSA,
group_mgmt_prot to IGTKSA/BIGTKSA. The CSIA cannot encode IGTK/BIGTK
without GTK (WiFi Aware spec 9.5.21.2, Table 122), so enabling group_mgmt_prot
forces group_data_prot on for every secured service.

Expose per-service group_data_prot and device-global group_mgmt_prot.
This commit is contained in:
Sarvesh Bodakhe
2026-07-01 13:35:15 +05:30
parent 59296315b1
commit 932a9e33d8
11 changed files with 1052 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_wifi/include/esp_private/wifi.h
+22 -8
View File
@@ -89,10 +89,11 @@ typedef struct {
uint8_t num_pmkids; /**< Number of parsed PMKIDs */
uint8_t pmkids[NAN_PEER_MAX_PMKIDS][ESP_WIFI_NAN_NDP_PMKID_LEN]; /**< Parsed ND-PMKIDs */
uint8_t group_data_prot: 1; /**< Peer advertises group data frame protection */
uint8_t group_mgmt_prot: 1; /**< Peer advertises group mgmt frame protection */
uint8_t group_mgmt_prot: 1; /**< Peer advertises IGTKSA (CSIA caps bits 1-2 != 0) */
uint8_t pairing_setup: 1; /**< Pairing setup: 0 - disabled, 1 - enabled */
uint8_t npk_nik_caching: 1; /**< NPK/NIK caching: 0 - disabled, 1 - enabled (valid if pairing_setup) */
uint8_t reserved: 4; /**< Reserved */
uint8_t group_bigtk_prot: 1; /**< Peer advertises BIGTKSA (CSIA caps bits 1-2 == 10) */
uint8_t reserved: 3; /**< Reserved */
} wifi_nan_peer_sdf_security_t;
/* NAN Peer info parsed from SDF */
@@ -230,9 +231,11 @@ struct nan_secure_dp_funcs {
* with the given Key Data field length. */
uint32_t (*get_shared_key_desc_attr_len)(uint16_t key_data_len);
/* Byte length of the M4 Shared Key Descriptor including any
* encrypted KDE payload (GTK/IGTK/BIGTK). */
int (*ndp_security_install_get_shared_desc_len)(void);
/* Exact byte length of the M4 (NDP Security Install) Shared Key Descriptor
* attribute for this NDP, including any encrypted KDE payload (GTK/IGTK/BIGTK).
* @ndp_id + @peer_nmi identify the NDL so the host returns the exact length the
* builder will write (no over-reservation / on-air zero-padding). */
int (*ndp_security_install_get_shared_desc_len)(uint8_t ndp_id, const uint8_t *peer_nmi);
uint8_t (*get_ndp_resp_num_pmkids)(uint8_t ndp_id, const uint8_t *peer_nmi);
uint32_t (*get_ndp_resp_shared_key_desc_len)(uint8_t ndp_id, const uint8_t *peer_nmi);
@@ -362,10 +365,21 @@ struct nan_secure_dp_funcs {
const wifi_nan_discovery_security_params_t *sec_cfg,
wifi_nan_security_params_t *out_derived);
/* Returns the cipher-suite bitmap negotiated for an in-flight NDP,
* or 0 if the NDP is open. Used by RX/TX paths to decide whether
* to apply CCMP/GCMP and which key length to use. */
/* Returns the full cipher-suite bitmap negotiated for an in-flight NDP
* (including the group cipher NCS-GTK when group-addressed data protection
* is in use), or 0 if the NDP is open. The blob treats this as an opaque
* value passed straight to the host CSIA callbacks (construct_csia /
* get_csia_len) to build the on-air M1/M3 CSIA own-bitmap; it must NOT
* interpret individual CSID bits. Pairwise cipher selection and key install
* are host-driven and independent of this value. */
uint16_t (*get_ndp_security_csid)(uint8_t ndp_id, const uint8_t *peer_nmi);
/* Exact byte length of the M3 (NDP Confirm) Shared Key Descriptor attribute for
* this NDP, including any encrypted KDE payload (GTK/IGTK/BIGTK). @ndp_id +
* @peer_nmi identify the NDL. Mirrors ndp_security_install_get_shared_desc_len
* for the initiator path. Appended at the end of the struct to preserve the
* layout of the fields above. */
int (*ndp_confirm_get_shared_desc_len)(uint8_t ndp_id, const uint8_t *peer_nmi);
};
/**