Add Wi-Fi Aware group-key support to secured NDPs so group-addressed
traffic can be protected, for interop with iOS/macOS peers:
- GTK (NCS-GTK-CCM-128) protects group-addressed data.
- IGTK/BIGTK (BIP) protect group management traffic - multicast SDFs,
Beacons.
Capabilities are advertised in the CSIA IE: group_data_prot maps to GTKSA,
group_mgmt_prot to IGTKSA/BIGTKSA. The CSIA cannot encode IGTK/BIGTK
without GTK (WiFi Aware spec 9.5.21.2, Table 122), so enabling group_mgmt_prot
forces group_data_prot on for every secured service.
Expose per-service group_data_prot and device-global group_mgmt_prot.
security_cfg in wifi_nan_publish_cfg_t / wifi_nan_subscribe_cfg_t is a
large struct; pass it by pointer so callers don't bloat their cfg copy.
Driver deep-copies during publish/subscribe, so caller may free right
after the API returns. Add NULL-check when security_reqd is set.
Update both example apps to declare a local security_cfg and assign its
address. Add help text on EXAMPLE_NAN_SECURITY_ENABLED.
- Rename NAN_IPV6_ADDR_ID_LEN / IS_ZERO_NAN_ADDR_ID to ..._IPV6_IDENTIFIER
so the names no longer read like MAC-address constants; drop the
duplicate macro definition in esp_nan.h.
- Replace literal lengths with named macros: WIFI_OUI_LEN for
nan_vendor_ie_t.vendor_oui, and a new WIFI_MAC_ADDR_LEN (private)
applied to the NAN-related structs and callbacks in esp_private/wifi.h.
- Document each callback in struct nan_sync_callbacks and each helper
in struct nan_secure_dp_funcs: when fired / when invoked, what each
argument means, and the matching spec section where useful.
- Note in wifi_nan_datapath_req_t / wifi_nan_datapath_resp_t that they
cover the NCS-SK credential model only; pairing-based cipher suites
(NCS-PK-PASN) install per-peer ND-PMKs via a separate pairing API
without changing these structs. Record why per-NDP credential
injection at response time is not viable: the responder's PMKID
lookup happens at M1 receive time, before the indication event
surfaces to the host.
Replace scalar passphrase/PMK in wifi_nan_discovery_security_params_t
with wifi_nan_credential_t[N] array (cap 4) per Wi-Fi Aware v4.0
§9.5.21.4. Drop public PMKID array and service-level csid_bitmap.
Rename wifi_nan_datapath_security_params_t -> wifi_nan_security_params_t;
add wifi_nan_peer_sdf_security_t for multi-PMKID peer-RX. The
derive_security_params callback takes (svc_name, sec_cfg, out_derived[])
and runs once per credential on the WiFi task. Split nan_record_own_svc
into claim/finalize so the WiFi-task callback finds the pending slot
by name and mirrors derived material — no main-task PBKDF2.
nan_publisher / nan_subscriber demonstrate the secure NDP path:
publisher acts as the responder + UDP echo server, subscriber as the
initiator. Both support passphrase and pre-shared PMK modes via
menuconfig; PMK hex strings are decoded with the same helper on both
sides so endpoints derive matching PMKIDs.
- Add Country Code, Vendor IE to NAN frames
- Support parsing of multiple availibility & SDA attributes
- Add parsing of service response filter
- Support Bloom filter parsing and generation
- Record peer_svc for nan_indication_cb
- Add support for NDPE Extension attribute
1. fix(wifi): Rename old NAN configuration to NAN-Sync
- Rename CONFIG_ESP_WIFI_NAN_ENABLE to CONFIG_ESP_WIFI_NAN_SYNC_ENABLE to indicate
the support for Synchronized NAN (Wi-Fi Aware).
- Because the original flag really controls the synchronized feature set, rename it
to CONFIG_ESP_WIFI_NAN_SYNC_ENABLE so the NAN-Sync and NAN-USD paths can be
selected independently without confusion.
2. Document esp_wifi_start requirement and fix USD examples
3. Rename nan_callbacks to nan_sync_callbacks
4. Remove the discovery_flag, clarify docs for sync vs USD flows, and add USD start/stop APIs
5. Require esp_wifi_start() before USD start
6. docs(nan): add NAN-USD application examples
7. add migration guide and hints for NAN-USD proto field
8. Improve allow_broadcast documentation
9. Add attention to the API esp_wifi_remain_on_channel
10. fix(wifi): align NAN API renames and docs for v6.0
- keep shared APIs under esp_wifi_nan_* while reserving
sync/usd names for mode-specific entry points
- clarify synchronized-cluster scope in headers, docs, and migration notes (EN/zh-CN)
- update examples for renamed helpers and WIFI_NAN_SYNC_CONFIG_DEFAULT()
- rename `wifi_nan_config_t` to `wifi_nan_sync_config_t`
11. Mark NAN-USD as esp-idf experimental feature
1. Remove redundant fixes in upstream wpa_supplicant for USD
- Upstream supplicant has mostly fixed the issues regarding the
unnecessary resetting pauseStateTimeout.
- Upstream supplicant still needs one fix to avoid resetting the
pauseStateTimeout when subscribe message is received from the peer
which had triggered the pauseStateTimeout previously.
2. Replace array-based channel list with bitmap for NaN-USD
Use `wifi_scan_channel_bitmap_t` to represent the channel list for NaN-USD
publisher and subscriber configurations. This replaces the previous approach
that used a large array to store allowed channels.
Also aligns with internal scan bitmap conventions across Wi-Fi stack.
3. call esp_wifi_nan_stop() after USD exchange or STA stop
Ensure esp_wifi_nan_stop() is called after publish/subscribe activity
completes or when WIFI_EVENT_STA_STOP is received. This prevents NAN stop
errors due to inactive interface. NaN-USD currently uses STA interface
for Tx/Rx.
4. Fix task watchdog timer triggered in active USD subscriber:
As both USD supplicant and offchan TX component gets executed
in the wifi task, it created a deadlock like scenario where offchan TX
done callback was never getting executed and supplicant 'nan_de_timer'
keeps running but failing to send any subscribe frame.
5. Make sure that device is able to recieve action management frames
of size more than 1400 bytes.
6. Update proto field in SSI to match Wi-Fi Aware (NaN) spec format
The 'proto' field in the 'wifi_nan_wfa_ssi_t' structure previously used an
enum (wifi_nan_svc_proto_t), resulting in a 32-bit field. According to
the Wi-Fi NAN Specification (Table 5.7), this field must be a single
octet (8 bits). This commit updates the type to uint8_t to ensure
compliance with the specification.
This mismatch previously triggered warnings but did not cause functional
errors.
7. Set `allow_broadcast` to true in USD Remain on channel
This enables the peer discovery as USD uses NAN-Network Multicast BSSID
as A3 address in publish frames.
8. Implement custom channel<->frequency conversion for NAN-USD
NaN-USD only permits 20 MHz bandwidth channels in the 2.4 GHz and 5 GHz bands
(as per section 4.5.3 of the Wi-Fi Aware Specification v4.0). To avoid linking
a large portion of upstream supplicant code for frequency-to-channel and
channel-to-frequency conversion, implement minimal custom helper functions.
9. Limit NAN_DE_MAX_SERVICE to 2 for ESP_SUPPLICANT
10. Note: Upstream clamps negative `os_reltime` deltas to zero in `nan_de_srv_time_to_next()`,
but our ESP_SUPPLICANT port keeps `os_time_t` unsigned, so that guard just provokes a
compiler warning. We skip it for now because the scheduling loop validates past timestamps
before computing the diff.
Co-authored-by: Shyamal Khachane <shyamal.khachane@espressif.com>
Currently, several example dependencies rely on the fact that all
registered components are added to the build, along with components
specified in common requirements. This results in longer build times
because even unused components must be built. Switch all examples to use
idf_minimal_build to compile only the components actually required by
the example.
Signed-off-by: Frantisek Hrbata <frantisek.hrbata@espressif.com>
Currently, several examples do not explicitly state their component
dependencies, relying instead on the default behavior that includes all
registered components and commonly required ones in the build.
Explicitly adding component dependencies can reduce build time when
set(COMPONENTS main) is used.
Signed-off-by: Frantisek Hrbata <frantisek.hrbata@espressif.com>
Update wifi lib with below -
1. Create NAN Discovery SM for beaconing & cluster formation
2. Create NAN interface for Tx/Rx of beacons & action frames
3. Add commands & events for NAN Services Publish/Subscribe/Followup
4. Add NAN Datapath definitions, Events, Peer structures
5. Support for forming and parsing of Datapath related attributes
6. Modules for NDP Req, Resp, Confirm, Term, Peer management
7. NAN Interface related additions in Datapath, Data Tx Q's
In addition include below changes -
1. Add netif and driver support for NAN Interface
2. Add simple examples for Publisher-Subscriber usecases
3. Add an advanced console example that supports commands
for NAN Discovery, Services & Datapath
4. Add wifi_apps for providing better NAN API's and Peer management
Co-authored-by: Shyamal Khachane <shyamal.khachane@espressif.com>
Sarvesh Bodakhe
Kapil Gupta
Akshat Agrawal
yinqingzhao
Nachiket Kukade
Marek Fiala
wanckl
laokaiyao
entrop1a
Frantisek Hrbata
Ivan Grokhotkov