[PATCH 11/21] wpa_supplicant: Add CIP support
Benjamin Berg
benjamin at sipsolutions.net
Tue Oct 27 06:16:57 PDT 2026
From: Benjamin Berg <benjamin.berg at intel.com>
Enable CIP when supported by the driver and access point. The support
can be disabled explicitly using the new disable_cip configuration
option.
Signed-off-by: Benjamin Berg <benjamin.berg at intel.com>
Reviewed-by: Andrei Otcheretianski <andrei.otcheretianski at intel.com>
---
wpa_supplicant/config.c | 1 +
wpa_supplicant/config_file.c | 1 +
wpa_supplicant/config_ssid.h | 8 ++++++++
wpa_supplicant/ctrl_iface.c | 1 +
wpa_supplicant/pasn_supplicant.c | 5 +++++
wpa_supplicant/sme.c | 2 ++
wpa_supplicant/wnm_sta.c | 8 ++++++++
wpa_supplicant/wpa_cli.c | 1 +
wpa_supplicant/wpa_supplicant.c | 8 ++++++++
wpa_supplicant/wpa_supplicant.conf | 6 ++++++
wpa_supplicant/wpa_supplicant_i.h | 1 +
11 files changed, 42 insertions(+)
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index afe770b584..da879ab45e 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -3000,6 +3000,7 @@ static const struct parse_data ssid_fields[] = {
{ INT_RANGE(sae_pk, 0, 2) },
{ INT_RANGE(disable_eht, 0, 1)},
{ INT_RANGE(disable_uhr, 0, 1)},
+ { INT_RANGE(disable_cip, 0, 1)},
{ INT_RANGE(enable_4addr_mode, 0, 1)},
{ INT_RANGE(max_idle, 0, 65535)},
{ BOOL(ssid_protection)},
diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
index b01134945e..52498a7505 100644
--- a/wpa_supplicant/config_file.c
+++ b/wpa_supplicant/config_file.c
@@ -1046,6 +1046,7 @@ static void wpa_config_write_network(FILE *f, struct wpa_ssid *ssid,
#endif /* CONFIG_HE_OVERRIDES */
INT(disable_eht);
INT(disable_uhr);
+ INT(disable_cip);
INT(enable_4addr_mode);
INT(max_idle);
INT(ssid_protection);
diff --git a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h
index 86bd8d6172..2df499d822 100644
--- a/wpa_supplicant/config_ssid.h
+++ b/wpa_supplicant/config_ssid.h
@@ -1308,6 +1308,14 @@ struct wpa_ssid {
*/
int disable_uhr;
+ /**
+ * disable_cip - Disable Control Integrity Protocol for this network
+ *
+ * By default, use it if it is available, but this can be configured
+ * to 1 to have it disabled.
+ */
+ int disable_cip;
+
/**
* enable_4addr_mode - Set 4addr mode after association
* 0 = Do not attempt to set 4addr mode
diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index 397a91c293..0fddb68375 100644
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -10734,6 +10734,7 @@ static int wpas_ctrl_resend_assoc(struct wpa_supplicant *wpa_s)
params.mgmt_frame_protection = wpa_s->sme.mfp;
params.spp_amsdu = wpa_s->sme.spp_amsdu;
params.rrm_used = wpa_s->rrm.rrm_used;
+ params.cip = wpa_s->sme.cip;
if (wpa_s->sme.prev_bssid_set)
params.prev_bssid = wpa_s->sme.prev_bssid;
wpa_printf(MSG_INFO, "TESTING: Resend association request");
diff --git a/wpa_supplicant/pasn_supplicant.c b/wpa_supplicant/pasn_supplicant.c
index 76415fdbee..67e85b777e 100644
--- a/wpa_supplicant/pasn_supplicant.c
+++ b/wpa_supplicant/pasn_supplicant.c
@@ -1113,6 +1113,11 @@ static void wpas_pasn_auth_start_cb(struct wpa_radio_work *work, int deinit)
}
#endif /* CONFIG_ENC_ASSOC */
+ if (wpa_drv_get_cip_supported(wpa_s) &&
+ ieee802_11_rsnx_capab(rsnxe, WLAN_RSNX_CAPAB_CIP) &&
+ (awork->cipher & WPA_CIPHER_GCMP_256))
+ capab |= BIT_ULL(WLAN_RSNX_CAPAB_CIP);
+
pasn_set_rsnxe_caps(pasn, capab);
pasn_register_callbacks(pasn, wpa_s, wpas_pasn_send_mlme, NULL, NULL,
NULL);
diff --git a/wpa_supplicant/sme.c b/wpa_supplicant/sme.c
index 1e4dc15dec..2d6aff0947 100644
--- a/wpa_supplicant/sme.c
+++ b/wpa_supplicant/sme.c
@@ -2338,6 +2338,7 @@ static void sme_send_authentication(struct wpa_supplicant *wpa_s,
}
wpa_s->sme.spp_amsdu = wpa_sm_uses_spp_amsdu(wpa_s->wpa);
+ wpa_s->sme.cip = wpa_sm_uses_cip(wpa_s->wpa);
#ifdef CONFIG_P2P
if (wpa_s->global->p2p) {
@@ -5802,6 +5803,7 @@ mscs_fail:
params.mgmt_frame_protection = wpa_s->sme.mfp;
params.spp_amsdu = wpa_s->sme.spp_amsdu;
params.rrm_used = wpa_s->rrm.rrm_used;
+ params.cip = wpa_s->sme.cip;
if (wpa_s->sme.prev_bssid_set)
params.prev_bssid = wpa_s->sme.prev_bssid;
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index d9a9206d63..f007a62746 100644
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -348,6 +348,14 @@ static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s,
}
wpa_wnmsleep_install_key(wpa_s->wpa,
WNM_SLEEP_SUBELEM_BIGTK, ptr);
+ } else if (*ptr == WNM_SLEEP_SUBELEM_CIGTK) {
+ if (ptr[1] < 1 + 6 + WPA_CIGTK_LEN) {
+ wpa_printf(MSG_DEBUG,
+ "WNM: Too short CIGTK subelem");
+ break;
+ }
+ wpa_wnmsleep_install_key(wpa_s->wpa,
+ WNM_SLEEP_SUBELEM_CIGTK, ptr);
} else
break; /* skip the loop */
ptr += 2 + ptr[1];
diff --git a/wpa_supplicant/wpa_cli.c b/wpa_supplicant/wpa_cli.c
index db3e81b1bd..977148d0f0 100644
--- a/wpa_supplicant/wpa_cli.c
+++ b/wpa_supplicant/wpa_cli.c
@@ -1498,6 +1498,7 @@ static const char *network_fields[] = {
#endif /* CONFIG_HE_OVERRIDES */
"disable_eht",
"disable_uhr",
+ "disable_cip",
"ap_max_inactivity", "dtim_period", "beacon_int",
#ifdef CONFIG_MACSEC
"macsec_policy",
diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 3f7ea41f0b..3275a61c7f 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -2945,6 +2945,14 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
no_valid_sp:
}
+ wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_CONTROL_INTEGRITY_PROTOCOL,
+ !ssid->disable_cip &&
+ wpa_drv_get_cip_supported(wpa_s) &&
+ ieee802_11_rsnx_capab(bss_rsnx,
+ WLAN_RSNX_CAPAB_CIP) &&
+ (wpa_s->pairwise_cipher & WPA_CIPHER_GCMP_256) &&
+ (wpa_s->wpa_proto & WPA_PROTO_RSN));
+
if (!skip_default_rsne) {
if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie,
wpa_ie_len)) {
diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
index 4fc3cca529..9ef9b7c984 100644
--- a/wpa_supplicant/wpa_supplicant.conf
+++ b/wpa_supplicant/wpa_supplicant.conf
@@ -1846,6 +1846,12 @@ fast_reauth=1
# the extended capabilities are not cryptographically checked.
#always_use_proxy_arp=0
+# Control Integrity Protocol
+# disable_cip - Disable CIP in STA
+# Set to 0 to enable CIP (default behavior)
+# Set to 1 to disable CIP
+#disable_cip=0
+
##### Fast Session Transfer (FST) support #####################################
#
# The options in this section are only available when the build configuration
diff --git a/wpa_supplicant/wpa_supplicant_i.h b/wpa_supplicant/wpa_supplicant_i.h
index 1ff84a4725..60a029e498 100644
--- a/wpa_supplicant/wpa_supplicant_i.h
+++ b/wpa_supplicant/wpa_supplicant_i.h
@@ -1148,6 +1148,7 @@ struct wpa_supplicant {
u16 obss_scan_int;
u16 bss_max_idle_period;
bool spp_amsdu;
+ bool cip;
#ifdef CONFIG_SAE
struct sae_data sae;
struct wpabuf *sae_token;
--
2.56.0
More information about the Hostap
mailing list