From d0e2943621055fc0314d5bb40261290640a28c19 Mon Sep 17 00:00:00 2001 From: Sarvesh Bodakhe Date: Wed, 1 Jul 2026 15:39:20 +0530 Subject: [PATCH] fix(nan): source group_mgmt_prot from start config, not blob read-back esp_nan_action_start() read group_mgmt_prot back from the blob via esp_wifi_get_config() and defaulted to true when the read failed, which force-enabled device-global IGTK/BIGTK (BIP beacons, forced GTKSA) on a path where the user's intent is unknown. group_mgmt_prot is a pure pass-through user flag, so capture it directly into s_nan_ctx from the config in esp_wifi_nan_sync_start() (next to use_nvs_for_caching) and drop the read-back and its ambiguous default. Behaviour now follows the user's config exactly (default false via WIFI_NAN_SYNC_CONFIG_DEFAULT). --- .../esp_wifi/wifi_apps/nan_app/src/nan_app.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c b/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c index 44695c0010e..379519f78fb 100644 --- a/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c +++ b/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c @@ -1845,17 +1845,9 @@ void esp_nan_action_start(esp_netif_t *nan_netif) esp_nan_internal_register_callbacks(&nan_cb); #ifdef CONFIG_ESP_WIFI_NAN_SECURITY - /* Device-global group-management protection (IGTKSA/BIGTKSA), one per NMI, - * sourced from the NAN start config (wifi_nan_sync_config_t.group_mgmt_prot). - * The blob stores it at nan_start; we read it back here. Default on if the - * config can't be read, preserving protected-by-default behavior. */ - { - wifi_config_t nan_cfg = {0}; - s_nan_ctx.group_mgmt_prot = - (esp_wifi_get_config(WIFI_IF_NAN, &nan_cfg) == ESP_OK) - ? nan_cfg.nan.group_mgmt_prot : true; - } - /* Install the device-global IGTK/BIGTK for TX now (when enabled) so Beacons + /* s_nan_ctx.group_mgmt_prot (device-global IGTKSA/BIGTKSA, one per NMI) was + * captured from the user's start config in esp_wifi_nan_sync_start(). + * Install the device-global IGTK/BIGTK for TX now (when enabled) so Beacons * (BIGTK) and group-addressed SDFs (IGTK) are BIP-protected from the first * frame, like iOS. The blob gates beacon BIP-TX on an active BIGTK index * only (no NDP state), so installing here is sufficient. */ @@ -1939,6 +1931,7 @@ esp_err_t esp_wifi_nan_sync_start(const wifi_nan_sync_config_t *nan_cfg) s_nan_ctx.num_peer_creds = 0; memset(s_nan_ctx.peer_creds, 0, sizeof(s_nan_ctx.peer_creds)); s_nan_ctx.use_nvs_for_caching = nan_cfg->use_nvs_for_caching; + s_nan_ctx.group_mgmt_prot = nan_cfg->group_mgmt_prot; s_nan_ctx.nik_lifetime = 0; if (nan_cfg->reset_current_nvs_creds) {