[PATCH wireless-next 2/2] wifi: cfg80211/mac80211: extend cfg80211_rx_assoc_resp_data() for assoc encryption

Kavita Kavita
2026-04-27T15:09:25Z

Extend cfg80211_rx_assoc_resp_data with a new assoc_encrypted field to
indicate if the (re)association exchange is encrypted.

Currently, when epp_peer flag is set, unprotected (Re)Association
Request/Response frames are dropped. This ensures that by the time
the (Re)Association Response is processed, the entire association
exchange is encrypted over the air.

Set assoc_encrypted in cfg80211_rx_assoc_resp_data based on epp_peer
flag when processing the (Re)Association Response.

Signed-off-by: Kavita Kavita <kavita.kavita@oss.qualcomm.com>
---
include/net/cfg80211.h | 2 ++
net/mac80211/mlme.c | 9 +++++++++
net/wireless/mlme.c | 1 +
3 files changed, 12 insertions(+)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index b29fcb4e1a4b..f728f565f7e4 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -8302,6 +8302,7 @@ void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr);
* as the AC bitmap in the QoS info field
* @req_ies: information elements from the (Re)Association Request frame
* @req_ies_len: length of req_ies data
+ * @assoc_encrypted: indicate if the (re)association exchange is encrypted.
* @ap_mld_addr: AP MLD address (in case of MLO)
* @links: per-link information indexed by link ID, use links[0] for
* non-MLO connections
@@ -8316,6 +8317,7 @@ struct cfg80211_rx_assoc_resp_data {
const u8 *req_ies;
size_t req_ies_len;
int uapsd_queues;
+ bool assoc_encrypted;
const u8 *ap_mld_addr;
struct {
u8 addr[ETH_ALEN] __aligned(2);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 160ae65a5c64..3fd98e55d337 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -6658,6 +6658,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
.type = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_TYPE,
};
struct ieee802_11_elems *elems;
+ struct sta_info *sta;
int ac;
const u8 *elem_start;
unsigned int elem_len;
@@ -6853,6 +6854,14 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
resp.ap_mld_addr = ap_mld_addr;
}

+ /*
+ * If epp_peer set, unprotected (Re)Association Request/Response frames
+ * are dropped, which ensures that the (re)association exchange is
+ * encrypted over the air.
+ */
+ sta = sta_info_get_bss(sdata, sdata->vif.cfg.ap_addr);
+ resp.assoc_encrypted = sta && sta->sta.epp_peer;
+
ieee80211_destroy_assoc_data(sdata,
status_code == WLAN_STATUS_SUCCESS ?
ASSOC_SUCCESS :
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index bd72317c4964..d196b5c086cc 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -38,6 +38,7 @@ void cfg80211_rx_assoc_resp(struct net_device *dev,
u.assoc_resp.variable),
.status = le16_to_cpu(mgmt->u.assoc_resp.status_code),
.ap_mld_addr = data->ap_mld_addr,
+ .assoc_encrypted = data->assoc_encrypted,
};
unsigned int link_id;

--
2.34.1