diff mbox series

[v3] AP: Skip GTK rekey on STA request when group rekeying is disabled

Message ID 20260825071238.23028-1-chao.meng@unisoc.com
State New
Headers show
Series [v3] AP: Skip GTK rekey on STA request when group rekeying is disabled | expand

Commit Message

Chao Meng Aug. 25, 2026, 7:12 a.m. UTC 
wpa_receive() unconditionally processed EAPOL-Key Request frames for GTK
rekeying received from a STA, even when the AP was configured with
wpa_group_rekey=0 to disable periodic group rekeying.

Add a guard on wpa_auth->conf.wpa_group_rekey before canceling the rekey
timeout and triggering a new GTK rekey. When group rekeying is
administratively disabled, log an informational message and ignore the
request.

Signed-off-by: Chao Meng <chao.meng@unisoc.com>
---
 src/ap/wpa_auth.c | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

--
2.21.0.windows.1
diff mbox series

Patch

diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
index d736d1bc9..5f32f8da1 100644
--- a/src/ap/wpa_auth.c
+++ b/src/ap/wpa_auth.c
@@ -2005,15 +2005,20 @@  void wpa_receive(struct wpa_authenticator *wpa_auth,
                                        LOGGER_INFO,
                                        "received EAPOL-Key Request for GTK rekeying");

-                       eloop_cancel_timeout(wpa_rekey_gtk,
-                                            wpa_get_primary_auth(wpa_auth),
-                                            NULL);
-                       if (wpa_auth_gtk_rekey_in_process(wpa_auth))
-                               wpa_auth_logger(wpa_auth, NULL, LOGGER_DEBUG,
-                                               "skip new GTK rekey - already in process");
-                       else
-                               wpa_rekey_gtk(wpa_get_primary_auth(wpa_auth),
-                                             NULL);
+                       if (wpa_auth->conf.wpa_group_rekey)     {
+                               eloop_cancel_timeout(wpa_rekey_gtk,
+                                                    wpa_get_primary_auth(wpa_auth),
+                                                    NULL);
+                               if (wpa_auth_gtk_rekey_in_process(wpa_auth))
+                                       wpa_auth_logger(wpa_auth, NULL, LOGGER_DEBUG,
+                                                       "skip new GTK rekey - already in process");
+                               else
+                                       wpa_rekey_gtk(wpa_get_primary_auth(wpa_auth),
+                                                     NULL);
+                       } else{
+                               wpa_auth_logger(wpa_auth, NULL, LOGGER_INFO,
+                                               "skip new GTK rekey - group rekeying disabled");
+                       }
                }
        } else {
                /* Do not allow the same key replay counter to be reused. */