Re: [PATCH] gsupplicant: MFP optional for WPA2-Personal

Hi Michael,

On 5/12/25 3:52 AM, Michael Trimarchi wrote:
> From: "Dembianny, Sven (GDE-EDSD5)" <[email protected]>
> 
> Previous MFP support was restricted to WPA3, however it is also possible
> to set MFP to mandatory on APs with WPA2.

Yes, assuming your device supports it.  But I'm not quite sure how this 
description corresponds to the actual patch?  It looks like the intent is to 
always set ieee80211w=1 (MFP Capable set, MFP Required not set) which enables 
the use of MFP by wpa_supplicant even on WPA2 networks.

> 
> wpa_supplicant config:
> 
> * WPA2-Personal: key_mgmt="WPA-PSK-SHA256" ; iee80211w=1
> 
> It is important that the default value of MFPC bit is 1 on the final-commercial
> version of the device. It is a mandatory WFA requirement.

Which 'device'?  I think you may be referring to something specific to your use 
case here.

> ---
>   gsupplicant/supplicant.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/gsupplicant/supplicant.c b/gsupplicant/supplicant.c
> index f3be9e7b..2ebfa2c6 100644
> --- a/gsupplicant/supplicant.c
> +++ b/gsupplicant/supplicant.c
> @@ -4955,6 +4955,7 @@ static void add_network_security(DBusMessageIter *dict, GSupplicantSSID *ssid)
>   		add_network_security_ciphers(dict, ssid);
>   		break;
>   	case G_SUPPLICANT_SECURITY_PSK:
> +		ieee80211w = G_SUPPLICANT_MFP_OPTIONAL;
>   		if (ssid->keymgmt & G_SUPPLICANT_KEYMGMT_SAE) {

doc/coding-style.txt item M1

>   			if (ssid->keymgmt & G_SUPPLICANT_KEYMGMT_WPA_PSK) {
>   				/*
> @@ -4962,15 +4963,16 @@ static void add_network_security(DBusMessageIter *dict, GSupplicantSSID *ssid)
>   				 * WPA2-Personal (PSK) and WPA3-Personal (SAE)
>   				 */
>   				key_mgmt = "SAE WPA-PSK";
> -				ieee80211w = G_SUPPLICANT_MFP_OPTIONAL;
>   			} else {
>   				key_mgmt = "SAE";
>   				ieee80211w = G_SUPPLICANT_MFP_REQUIRED;
>   			}
> -			add_network_ieee80211w(dict, ssid, ieee80211w);
> +		} else if (ssid->keymgmt & G_SUPPLICANT_KEYMGMT_WPA_PSK_256) {
> +			key_mgmt = "WPA-PSK-SHA256";

This part seems to be unrelated to the commit description and has nothing to do 
with MFP?  Also, you might also want to enable SHA256 in WPA3 Transition mode?

>   		} else {
>   			key_mgmt = "WPA-PSK";
>   		}
> +		add_network_ieee80211w(dict, ssid, ieee80211w);

Ditto item M1.

>   		add_network_security_psk(dict, ssid);
>   		add_network_security_ciphers(dict, ssid);
>   		add_network_security_proto(dict, ssid);

Regards,
-Denis