Add Wi-Fi Aware group-key support to secured NDPs so group-addressed
traffic can be protected, for interop with iOS/macOS peers:
- GTK (NCS-GTK-CCM-128) protects group-addressed data.
- IGTK/BIGTK (BIP) protect group management traffic - multicast SDFs,
Beacons.
Capabilities are advertised in the CSIA IE: group_data_prot maps to GTKSA,
group_mgmt_prot to IGTKSA/BIGTKSA. The CSIA cannot encode IGTK/BIGTK
without GTK (WiFi Aware spec 9.5.21.2, Table 122), so enabling group_mgmt_prot
forces group_data_prot on for every secured service.
Expose per-service group_data_prot and device-global group_mgmt_prot.
security_cfg in wifi_nan_publish_cfg_t / wifi_nan_subscribe_cfg_t is a
large struct; pass it by pointer so callers don't bloat their cfg copy.
Driver deep-copies during publish/subscribe, so caller may free right
after the API returns. Add NULL-check when security_reqd is set.
Update both example apps to declare a local security_cfg and assign its
address. Add help text on EXAMPLE_NAN_SECURITY_ENABLED.
- Rename NAN_IPV6_ADDR_ID_LEN / IS_ZERO_NAN_ADDR_ID to ..._IPV6_IDENTIFIER
so the names no longer read like MAC-address constants; drop the
duplicate macro definition in esp_nan.h.
- Replace literal lengths with named macros: WIFI_OUI_LEN for
nan_vendor_ie_t.vendor_oui, and a new WIFI_MAC_ADDR_LEN (private)
applied to the NAN-related structs and callbacks in esp_private/wifi.h.
- Document each callback in struct nan_sync_callbacks and each helper
in struct nan_secure_dp_funcs: when fired / when invoked, what each
argument means, and the matching spec section where useful.
- Note in wifi_nan_datapath_req_t / wifi_nan_datapath_resp_t that they
cover the NCS-SK credential model only; pairing-based cipher suites
(NCS-PK-PASN) install per-peer ND-PMKs via a separate pairing API
without changing these structs. Record why per-NDP credential
injection at response time is not viable: the responder's PMKID
lookup happens at M1 receive time, before the indication event
surfaces to the host.
Replace scalar passphrase/PMK in wifi_nan_discovery_security_params_t
with wifi_nan_credential_t[N] array (cap 4) per Wi-Fi Aware v4.0
§9.5.21.4. Drop public PMKID array and service-level csid_bitmap.
Rename wifi_nan_datapath_security_params_t -> wifi_nan_security_params_t;
add wifi_nan_peer_sdf_security_t for multi-PMKID peer-RX. The
derive_security_params callback takes (svc_name, sec_cfg, out_derived[])
and runs once per credential on the WiFi task. Split nan_record_own_svc
into claim/finalize so the WiFi-task callback finds the pending slot
by name and mirrors derived material — no main-task PBKDF2.
nan_publisher / nan_subscriber demonstrate the secure NDP path:
publisher acts as the responder + UDP echo server, subscriber as the
initiator. Both support passphrase and pre-shared PMK modes via
menuconfig; PMK hex strings are decoded with the same helper on both
sides so endpoints derive matching PMKIDs.
- Add Country Code, Vendor IE to NAN frames
- Support parsing of multiple availibility & SDA attributes
- Add parsing of service response filter
- Support Bloom filter parsing and generation
- Record peer_svc for nan_indication_cb
- Add support for NDPE Extension attribute
fix(esp_wifi): Fixed some issues in roaming app found using static analysis
Closes WIFIBUG-1836 and WIFIBUG-1842
See merge request espressif/esp-idf!47372
-Require STA DH IE for OWE associations.
- Send failures using Association Response (no silent deauth-only path).
- Include RSNE in OWE Association Response alongside DH Parameter IE.
- Check wpabuf_resize return values when building OWE Assoc Response IEs.
- Recognize OWE AKM in RSN IE when CONFIG_OWE_SOFTAP without CONFIG_OWE_STA.
- Docs: SoftAP OWE-only; no transition mode; trim misleading OPEN→OWE note.
fix(wifi): fix crash issue in sleep wake process and cannot sleep after switch ps mode
Closes WIFIBUG-1687 and WIFI-7187
See merge request espressif/esp-idf!45291
Split the idf_performance.h and target ver, which hold the performance
thresholds, into the headers of each testing.
In the past pytest also parse the common header to get the thresholds.
Now the logic is also removed. Performance thresholds are supposed to be
in the pytest scripts.
Where esp_event is used as depends_components:
- components/esp_event/host_test
- components/esp_event/test_apps
- examples/system/esp_event/default_event_loop
- examples/system/esp_event/user_event_loops
