[PATCH v3] AP: Skip GTK rekey on STA request when group rekeying is disabled

[Jouni Malinen]

On Tue, Aug 25, 2026 at 03:12:38PM +0800, Chao Meng wrote:
> wpa_receive() unconditionally processed EAPOL-Key Request frames for GTK
> rekeying received from a STA, even when the AP was configured with
> wpa_group_rekey=0 to disable periodic group rekeying.
> 
> Add a guard on wpa_auth->conf.wpa_group_rekey before canceling the rekey
> timeout and triggering a new GTK rekey. When group rekeying is
> administratively disabled, log an informational message and ignore the
> request.

wpa_group_rekey=0 does not mean that group rekeying is disabled; it
means that there is no periodic group rekeying. As an example,
wpa_strict_rekey=1 would perform rekeying that is not based on a
timeout. It feels reasonable to follow same for STA-requested cases. In
other words, I would add an explicit new configuration parameter to
disable STA-requested group rekeying if there is a real world use case
that depends on such functionality. In practice, it might make more
sense to add a configuration parameter that defines the minimum amount
of time in seconds from the last group rekeying that must have passed
before a STA-requested one is accepted. That could use -1 as a special
case of not allowing STAs to request group rekeying.

-- 
Jouni Malinen                                            PGP id EFC895FA