4 files changed, 15 insertions, 0 deletions
diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
index 455013aa..3e396945 100644
--- a/src/ap/ap_config.c
+++ b/src/ap/ap_config.c
@@ -554,6 +554,7 @@ void hostapd_config_free_bss(struct hostapd_bss_config *conf)
 #endif /* CONFIG_HS20 */
 
 	wpabuf_free(conf->vendor_elements);
+	wpabuf_free(conf->assocresp_elements);
 
 	os_free(conf->sae_groups);
 
diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
index 71fc06e4..254f4bca 100644
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -535,6 +535,7 @@ struct hostapd_bss_config {
 #endif /* CONFIG_RADIUS_TEST */
 
 	struct wpabuf *vendor_elements;
+	struct wpabuf *assocresp_elements;
 
 	unsigned int sae_anti_clogging_threshold;
 	int *sae_groups;
diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
index 6cafcb74..b9029bb7 100644
--- a/src/ap/ap_drv_ops.c
+++ b/src/ap/ap_drv_ops.c
@@ -207,6 +207,11 @@ int hostapd_build_ap_extra_ies(struct hostapd_data *hapd,
 		if (wpabuf_resize(&proberesp, add) == 0)
 			wpabuf_put_buf(proberesp, hapd->conf->vendor_elements);
 	}
+	if (hapd->conf->assocresp_elements) {
+		size_t add = wpabuf_len(hapd->conf->assocresp_elements);
+		if (wpabuf_resize(&assocresp, add) == 0)
+			wpabuf_put_buf(assocresp, hapd->conf->assocresp_elements);
+	}
 
 	*beacon_ret = beacon;
 	*proberesp_ret = proberesp;
diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
index 288852db..0176c442 100644
--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -1690,6 +1690,14 @@ static void send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
 		p = hostapd_eid_p2p_manage(hapd, p);
 #endif /* CONFIG_P2P_MANAGER */
 
+	if (hapd->conf->assocresp_elements &&
+	    (size_t) (buf + sizeof(buf) - p) >=
+	    wpabuf_len(hapd->conf->assocresp_elements)) {
+		os_memcpy(p, wpabuf_head(hapd->conf->assocresp_elements),
+			  wpabuf_len(hapd->conf->assocresp_elements));
+		p += wpabuf_len(hapd->conf->assocresp_elements);
+	}
+
 	send_len += p - reply->u.assoc_resp.variable;
 
 	if (hostapd_drv_send_mlme(hapd, reply, send_len, 0) < 0)