[PATCH] AP: Allow the default group management cipher to be written in RSNE

[Jouni Malinen]

On Sat, Oct 10, 2026 at 03:55:37PM -0400, Kyle Crenshaw wrote:
> Since commit 44fa5e747b7a ("FT: Remove optional fields from RSNE when
> using PMF"), hostapd leaves the PMKID Count and Group Management Cipher
> Suite fields out of the RSNE when PMF is enabled and the cipher is the
> default AES-128-CMAC. That is valid, but some drivers do not transmit
> the RSNE from hostapd in Beacon and Probe Response frames. Their
> firmware builds the element itself and always includes these two
> fields. One example is Broadcom FullMAC (BCM43602, firmware
> 7.35.177.61) in AP mode.

If the driver does not use the RSNE from hostapd, there should be a
mechanism that would allow the driver to indicate that to hostapd to
adapt for this automatically.

> Add explicit_group_mgmt_cipher=1. With it, the PMKID Count and Group
> Management Cipher Suite fields are written whenever PMF is enabled, so
> the msg 3/4 RSNE matches what such firmware advertises. This restores
> the encoding hostapd used before v2.5, including for FT. Commit
> 44fa5e747b7a removed it partly to work around stations that rejected
> msg 3/4 during FT initial mobility domain association when these
> fields were present, so the default (0) keeps the current shorter
> RSNE. This also brings back the AES-128-CMAC case that commit
> 2c0e21ef27c6 removed as unreachable.
> 
> This is a configuration parameter rather than something derived from
> the driver, because a generic driver interface such as driver_bsd
> cannot tell whether the firmware below it builds its own RSNE.

I don't really like to make something like this depend on the user or
some upper layer component trying to figure out when to use such a
workaround. In other words, the correct way to address this is to
introduce that driver interface mechanism to allow the RSNE to be
synchronized instead of making hostapd configurable to try to emulate
what any particular driver might do.

-- 
Jouni Malinen                                            PGP id EFC895FA