[PATCH 01/20] common: Add IEEE 802.11bn Security Profile element definitions

Andrei Otcheretianski andrei.otcheretianski at intel.com
Wed Jun 10 06:11:54 PDT 2026


From: Ilan Peer <ilan.peer at intel.com>

Define the Security Profile element ID extension and related field
constants from IEEE Draft P802.11bn/D1.4, 9.4.2.364, along with the
table of predefined security profiles in Table 9-bb14.

Also, add the WLAN_STATUS_REJECTED_INVALID_SECURITY_PROFILE status
code (159).

Signed-off-by: Ilan Peer <ilan.peer at intel.com>
---
 src/common/ieee802_11_defs.h | 59 ++++++++++++++++++++++++++++++
 src/common/wpa_common.c      | 69 ++++++++++++++++++++++++++++++++++++
 src/common/wpa_common.h      | 35 ++++++++++++++++++
 3 files changed, 163 insertions(+)

diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
index 7c76b2dfc7..f36b498f5e 100644
--- a/src/common/ieee802_11_defs.h
+++ b/src/common/ieee802_11_defs.h
@@ -3375,6 +3375,65 @@ struct ieee80211_uhr_operation {
 #define UHR_OPER_PARAMS_NPCA_MOPLEN_NPCA		0x00400000
 #define UHR_OPER_PARAMS_NPCA_DIS_SUBCH_BITMAP_PRES	0x00800000
 
+/*
+ * The following definitions are based on IEEE Draft P802.11bn/D1.4,
+ * Section 9.4.2.364 (Security Profile element)
+ */
+
+/* See Figure 9-aa71 (Reduced RSN Capabilities field) */
+#define SECURITY_PROFILE_REDUCED_RSN_CAPAB_EXT_KEY_ID	BIT(0)
+#define SECURITY_PROFILE_REDUCED_RSN_CAPAB_OCVC			BIT(1)
+
+/* See Figure 9-aa72 (Security Profile Indication field) */
+#define SECURITY_PROFILE_IND_OCTETS_BITMAP_MASK		0x0F
+#define SECURITY_PROFILE_IND_OCTETS_BITMAP_SHIFT	0
+#define SECURITY_PROFILE_IND_VENDOR_SPECIFIC_MASK	0xF0
+#define SECURITY_PROFILE_IND_VENDOR_SPECIFIC_SHIFT	4
+
+/* See Table 9-bb14 (Security Profile Number Values) */
+enum security_profile_num {
+	SECURITY_PROFILE_EPPKE = 0,
+	SECURITY_PROFILE_EPPKE_SAE = 1,
+	SECURITY_PROFILE_EPPKE_FT_SAE = 2,
+	SECURITY_PROFILE_8021X_5_FRAME_PROT = 3,
+	SECURITY_PROFILE_8021X_FT_3_FRAME_PROT = 4,
+	SECURITY_PROFILE_8021X_23_FRAME_PROT = 5,
+	SECURITY_PROFILE_8021X_FT_22_FRAME_PROT = 6,
+	SECURITY_PROFILE_8021X_12_FRAME_PROT = 7,
+	SECURITY_PROFILE_NONE_18 = 8,
+	SECURITY_PROFILE_SAE_24 = 9,
+	SECURITY_PROFILE_FT_SAE_25 = 10,
+	SECURITY_PROFILE_8021X_5 = 11,
+	SECURITY_PROFILE_8021X_FT_3 = 12,
+	SECURITY_PROFILE_8021X_23 = 13,
+	SECURITY_PROFILE_8021X_FT_22 = 14,
+	SECURITY_PROFILE_8021X_12 = 15,
+	SECURITY_PROFILE_MAX = 15,
+};
+
+/* See Figure 9-aa73 (Vendor Specific Security Profile field) */
+#define SECURITY_PROFILE_VENDOR_SPECIFIC_LEN			4
+
+/* See Figure 9-aa70 (Security Profile element format) */
+struct ieee80211_security_profile_element {
+	u8 reduced_rsn_capab;
+	u8 security_profile_ind;
+
+	/*
+	 * Followed by variable length fields:
+	 * Security Profile Bitmap
+	 * Vendor Specific Security Profile List
+	 * Extended RSN Capabilities
+	 */
+	u8 variable[];
+} STRUCT_PACKED;
+
+/* See Figure 9-aa73 (Vendor Specific Security Profile field format) */
+struct ieee80211_vendor_specific_security_profile {
+	u8 oui[3];
+	u8 oui_type;
+} STRUCT_PACKED;
+
 #ifdef _MSC_VER
 #pragma pack(pop)
 #endif /* _MSC_VER */
diff --git a/src/common/wpa_common.c b/src/common/wpa_common.c
index e759ac4e52..506a78e1f7 100644
--- a/src/common/wpa_common.c
+++ b/src/common/wpa_common.c
@@ -4802,3 +4802,72 @@ void wpa_add_supported_groups(struct wpabuf *buf, const int *groups)
 	for (i = 0; i < count; i++)
 		wpabuf_put_le16(buf, groups[i]);
 }
+
+
+/*
+ * Global table of security profiles defined in Draft P802.11bn/D1.4,
+ * Table 9-bb14 (Security Profile Number Values).
+ */
+#define SEC_PROF(_num, _akm, _akm2, _cipher, _mfp, _dot1x, _enc_priv, _kek) \
+	[_num] = {							      \
+		.number = _num,						      \
+		.akm = _akm,						      \
+		.akm2 = _akm2,						      \
+		.pairwise_cipher = _cipher,				      \
+		.mfp = _mfp,						      \
+		.dot1x_in_auth_frame = _dot1x,				      \
+		.assoc_frame_enc_and_pmksa_privacy = _enc_priv,		      \
+		.kek_in_pasn = _kek,					      \
+	}
+
+const struct ieee80211_security_profile
+g_security_profiles[SECURITY_PROFILE_MAX + 1] = {
+	SEC_PROF(SECURITY_PROFILE_EPPKE,
+		 WPA_KEY_MGMT_EPPKE, 0, WPA_CIPHER_GCMP_256,
+		 true, false, true, true),
+	SEC_PROF(SECURITY_PROFILE_EPPKE_SAE,
+		 WPA_KEY_MGMT_EPPKE, WPA_KEY_MGMT_SAE_EXT_KEY,
+		 WPA_CIPHER_GCMP_256, true, false, true, true),
+	SEC_PROF(SECURITY_PROFILE_EPPKE_FT_SAE,
+		 WPA_KEY_MGMT_EPPKE, WPA_KEY_MGMT_FT_SAE_EXT_KEY,
+		 WPA_CIPHER_GCMP_256, true, false, true, true),
+	SEC_PROF(SECURITY_PROFILE_8021X_5_FRAME_PROT,
+		 WPA_KEY_MGMT_IEEE8021X_SHA256, 0, WPA_CIPHER_GCMP_256,
+		 true, true, true, false),
+	SEC_PROF(SECURITY_PROFILE_8021X_FT_3_FRAME_PROT,
+		 WPA_KEY_MGMT_FT_IEEE8021X, 0, WPA_CIPHER_GCMP_256,
+		 true, true, true, false),
+	SEC_PROF(SECURITY_PROFILE_8021X_23_FRAME_PROT,
+		 WPA_KEY_MGMT_IEEE8021X_SHA384, 0, WPA_CIPHER_GCMP_256,
+		 true, true, true, false),
+	SEC_PROF(SECURITY_PROFILE_8021X_FT_22_FRAME_PROT,
+		 WPA_KEY_MGMT_FT_IEEE8021X_SHA384, 0, WPA_CIPHER_GCMP_256,
+		 true, true, true, false),
+	SEC_PROF(SECURITY_PROFILE_8021X_12_FRAME_PROT,
+		 WPA_KEY_MGMT_IEEE8021X_SUITE_B_192, 0, WPA_CIPHER_GCMP_256,
+		 true, true, true, false),
+	SEC_PROF(SECURITY_PROFILE_NONE_18,
+		 WPA_KEY_MGMT_OWE, 0, WPA_CIPHER_GCMP_256,
+		 true, false, false, false),
+	SEC_PROF(SECURITY_PROFILE_SAE_24,
+		 WPA_KEY_MGMT_SAE_EXT_KEY, 0, WPA_CIPHER_GCMP_256,
+		 true, false, false, false),
+	SEC_PROF(SECURITY_PROFILE_FT_SAE_25,
+		 WPA_KEY_MGMT_FT_SAE_EXT_KEY, 0, WPA_CIPHER_GCMP_256,
+		 true, false, false, false),
+	SEC_PROF(SECURITY_PROFILE_8021X_5,
+		 WPA_KEY_MGMT_IEEE8021X_SHA256, 0, WPA_CIPHER_GCMP_256,
+		 true, false, false, false),
+	SEC_PROF(SECURITY_PROFILE_8021X_FT_3,
+		 WPA_KEY_MGMT_FT_IEEE8021X, 0, WPA_CIPHER_GCMP_256,
+		 true, false, false, false),
+	SEC_PROF(SECURITY_PROFILE_8021X_23,
+		 WPA_KEY_MGMT_IEEE8021X_SHA384, 0, WPA_CIPHER_GCMP_256,
+		 true, false, false, false),
+	SEC_PROF(SECURITY_PROFILE_8021X_FT_22,
+		 WPA_KEY_MGMT_FT_IEEE8021X_SHA384, 0, WPA_CIPHER_GCMP_256,
+		 true, false, false, false),
+	SEC_PROF(SECURITY_PROFILE_8021X_12,
+		 WPA_KEY_MGMT_IEEE8021X_SUITE_B_192, 0, WPA_CIPHER_GCMP_256,
+		 true, false, false, false),
+};
diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h
index 98a1c7213a..268819db46 100644
--- a/src/common/wpa_common.h
+++ b/src/common/wpa_common.h
@@ -10,6 +10,7 @@
 #define WPA_COMMON_H
 
 #include "common/defs.h"
+#include "ieee802_11_defs.h"
 
 /* IEEE 802.11i */
 #define PMKID_LEN 16
@@ -854,4 +855,38 @@ int wpa_auth_802_1x_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const u8 *spa,
 			       size_t kdk_len);
 void wpa_add_supported_groups(struct wpabuf *buf, const int *groups);
 
+/**
+ * struct ieee80211_security_profile - IEEE 802.11bn Security Profile
+ *
+ * Represents a security profile as described in Table 9-bb14
+ * (Security Profile Number Values) in Draft P802.11bn/D1.4.
+ * Each profile specifies an atomic set of AKM, pairwise
+ * cipher and security capabilities supported by an AP (or AP MLD).
+ *
+ * @number: Security profile number (See SECURITY_PROFILE_*).
+ * @akm: Primary AKM (See WPA_KEY_MGMT_*).
+ * @akm2: Secondary AKM for combined profiles such as EPPKE+SAE
+ *	(See WPA_KEY_MGMT_* bit), or 0 if not applicable.
+ * @pairwise_cipher: Pairwise cipher (See WPA_CIPHER_*).
+ * @mfp: MFP (MFPR and MFPC) value in the RSN Capabilities field.
+ * @dot1x_in_auth_frame: IEEE 802.1X Authentication Utilizing Authentication
+ *	Frame Support.
+ * @assoc_frame_enc_and_pmksa_privacy: (Re)Association Frame Encryption Support
+ *	and PMKSA Caching Privacy Support.
+ * @kek_in_pasn: KEK In PASN.
+ */
+struct ieee80211_security_profile {
+	u8 number;
+	u32 akm;
+	u32 akm2;
+	u32 pairwise_cipher;
+	bool mfp;
+	bool dot1x_in_auth_frame;
+	bool assoc_frame_enc_and_pmksa_privacy;
+	bool kek_in_pasn;
+};
+
+extern const struct ieee80211_security_profile
+	g_security_profiles[SECURITY_PROFILE_MAX + 1];
+
 #endif /* WPA_COMMON_H */
-- 
2.53.0




More information about the Hostap mailing list