cli vs dbus interface difference for SAE without has_driver_key_mgmt

ValdikSS iam at valdikss.org.ru
Mon Sep 14 11:07:31 PDT 2026


Hello list,

I found that wpa_supplicant populates SAE support data in different 
fields over different interfaces (cli vs dbus).
On Raspberry Pi's Broadcom adapter, SAE is present in wpa_cli auth_alg, 
but dbus interface has it in KeyMgmt (only in the most recent release 
2.12, commit d82c9e6, NetworkManager uses KeyMgmt SAE check)

This happens because if the driver does not report AKMs, key_mgmt gets 
populated from the template:

driver_nl80211_capa.c, wpa_driver_nl80211_capa()

if (!drv->has_driver_key_mgmt) {
	drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
…
	if (drv->capa.flags & WPA_DRIVER_FLAGS_SME)
		drv->capa.key_mgmt |=
			WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA256 |
…
			WPA_DRIVER_CAPA_KEY_MGMT_SAE_EXT_KEY |
			WPA_DRIVER_CAPA_KEY_MGMT_SAE;
…


SAE gets into key_mgmt *variable* only if WPA_DRIVER_FLAGS_SME (not SAE) 
is supported. WPA_DRIVER_FLAGS_SME is NOT supported in my driver: my 
driver does not report NL80211_CMD_AUTHENTICATE support.

src/drivers/driver_nl80211_capa.c:253-254, wiphy_info_supp_cmds()
	case NL80211_CMD_AUTHENTICATE:
		info->auth_supported = 1;

src/drivers/driver_nl80211_capa.c:1634-1635, wpa_driver_nl80211_get_info()
	if (info->auth_supported)
		drv->capa.flags |= WPA_DRIVER_FLAGS_SME;



However dbus interface adds SAE into KeyMgmt report list by checking 
WPA_DRIVER_FLAGS_SAE (not SME) flag, thanks to commit d82c9e6 mentioned 
above:

wpa_supplicant/dbus/dbus_new_handlers.c:3447-3449
	if (((capa.key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_SAE) ||
	     (capa.flags & WPA_DRIVER_FLAGS_SAE)) &&
	    !wpa_dbus_dict_string_array_add_element(&iter_array, "sae"))

The same applies to cli interface, but for some reason it's added to 
auth_alg, not key_mgmt:

wpa_supplicant/ctrl_iface.c, ctrl_iface_get_capability_auth_alg()
	if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE) {
		ret = os_snprintf(pos, end - pos, "%sSAE",
				  pos == buf ? "" : " ");



* Is FLAGS_SME check in wpa_driver_nl80211_capa() a bug?
* Is it possible to unify output in wpa_cli and dbus?




More information about the Hostap mailing list