[PATCH] AP: Disconnect station when PMKSA entry expires

[HungTsung Huang]

Hi Jouni,

Thanks for the feedback. I agree that the Deauthentication frame should be
sent only for a currently associated STA, and only when the PMKSA entry is
removed due to expiration.

I see two possible ways to implement that:

1. Add a free reason to the AP PMKSA cache free callback, similar to the
   supplicant PMKSA cache enum pmksa_free_reason. This makes replacement,
   explicit removal, flush, and expiration distinguishable through the same
   free callback API.

2. Add a separate expiration-only callback in the AP PMKSA cache and call it
   only from pmksa_cache_expire(). This keeps the existing free callback API
   unchanged and limits the new behavior to the expiration path.

Option 1 follows the existing supplicant PMKSA cache style more closely, but
touches more AP PMKSA cache call sites. Option 2 is a smaller AP-side change
and keeps the deauthentication trigger clearly tied to expiration only.

Which direction would you prefer for hostapd?

Thank you.