espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-29 18:27:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(esp_wifi): Flush PMK when EAP config is changed

Browse Source
This commit is contained in:
Kapil Gupta
2025-04-30 15:34:16 +05:30
parent b3baf8c026
commit c2560ed96d
2 changed files with 51 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
components/wpa_supplicant/esp_supplicant/src/esp_eap_client.c
View File

@ -38,6 +38,7 @@
#include "esp_wpas_glue.h"
#include "esp_eap_client_i.h"
#include "esp_eap_client.h"
#include "eloop.h"
#define WPA2_VERSION "v2.0"
@ -63,6 +64,7 @@ static void eap_peer_sm_deinit(void);
static int eap_sm_rx_eapol_internal(u8 *src_addr, u8 *buf, u32 len, uint8_t *bssid);
static int wpa2_start_eapol_internal(void);
int wpa2_post(uint32_t sig, uint32_t par);
extern bool g_wpa_config_changed;
#ifdef USE_WPA2_TASK
#define WPA2_TASK_PRIORITY 7
@ -73,6 +75,11 @@ static void *s_wpa2_api_lock = NULL;
static void *s_wifi_wpa2_sync_sem = NULL;
static bool s_disable_time_check = true;
static void config_changed_handler(void *ctx, void *data)
{
g_wpa_config_changed = true;
}
static void wpa2_api_lock(void)
{
if (s_wpa2_api_lock == NULL) {
@ -812,6 +819,7 @@ static esp_err_t esp_client_enable_fn(void *arg)
wpa_printf(MSG_ERROR, "Register EAP Peer methods Failure");
}
#endif
g_wpa_config_changed = true;
return ESP_OK;
}
@ -861,6 +869,7 @@ static esp_err_t eap_client_disable_fn(void *param)
#endif
sm->wpa_sm_eap_disable = NULL;
g_wpa_config_changed = true;
return ESP_OK;
}
@ -908,6 +917,7 @@ esp_err_t esp_eap_client_set_certificate_and_key(const unsigned char *client_cer
g_wpa_private_key_passwd = private_key_passwd;
g_wpa_private_key_passwd_len = private_key_passwd_len;
}
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@ -923,6 +933,7 @@ void esp_eap_client_clear_certificate_and_key(void)
os_free(g_wpa_pac_file);
g_wpa_pac_file = NULL;
g_wpa_pac_file_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
esp_err_t esp_eap_client_set_ca_cert(const unsigned char *ca_cert, int ca_cert_len)
@ -933,7 +944,7 @@ esp_err_t esp_eap_client_set_ca_cert(const unsigned char *ca_cert, int ca_cert_l
}
/* CA certs Set/updated, flushing current PMK cache */
wpa_sm_pmksa_cache_flush(get_wpa_sm(), NULL);
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@ -942,6 +953,7 @@ void esp_eap_client_clear_ca_cert(void)
{
g_wpa_ca_cert = NULL;
g_wpa_ca_cert_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
#define ANONYMOUS_ID_LEN_MAX 128
@ -958,23 +970,27 @@ esp_err_t esp_eap_client_set_identity(const unsigned char *identity, int len)
g_wpa_anonymous_identity = (u8 *)os_zalloc(len);
if (g_wpa_anonymous_identity == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_anonymous_identity, identity, len);
g_wpa_anonymous_identity_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
void esp_eap_client_clear_identity(void)
{
if (g_wpa_anonymous_identity) {
os_free(g_wpa_anonymous_identity);
if (!g_wpa_anonymous_identity) {
return;
}
os_free(g_wpa_anonymous_identity);
g_wpa_anonymous_identity = NULL;
g_wpa_anonymous_identity_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
#define USERNAME_LEN_MAX 128
@ -991,11 +1007,13 @@ esp_err_t esp_eap_client_set_username(const unsigned char *username, int len)
g_wpa_username = (u8 *)os_zalloc(len);
if (g_wpa_username == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_username, username, len);
g_wpa_username_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@ -1008,6 +1026,7 @@ void esp_eap_client_clear_username(void)
g_wpa_username = NULL;
g_wpa_username_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
esp_err_t esp_eap_client_set_password(const unsigned char *password, int len)
@ -1023,11 +1042,13 @@ esp_err_t esp_eap_client_set_password(const unsigned char *password, int len)
g_wpa_password = (u8 *)os_zalloc(len);
if (g_wpa_password == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_password, password, len);
g_wpa_password_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@ -1039,6 +1060,7 @@ void esp_eap_client_clear_password(void)
}
g_wpa_password = NULL;
g_wpa_password_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
esp_err_t esp_eap_client_set_new_password(const unsigned char *new_password, int len)
@ -1054,11 +1076,13 @@ esp_err_t esp_eap_client_set_new_password(const unsigned char *new_password, int
g_wpa_new_password = (u8 *)os_zalloc(len);
if (g_wpa_new_password == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_new_password, new_password, len);
g_wpa_password_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@ -1070,11 +1094,13 @@ void esp_eap_client_clear_new_password(void)
}
g_wpa_new_password = NULL;
g_wpa_new_password_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
esp_err_t esp_eap_client_set_disable_time_check(bool disable)
{
s_disable_time_check = disable;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@ -1111,6 +1137,7 @@ esp_err_t esp_eap_client_set_ttls_phase2_method(esp_eap_ttls_phase2_types type)
g_wpa_ttls_phase2_type = "auth=MSCHAPV2";
break;
}
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@ -1118,6 +1145,7 @@ esp_err_t esp_eap_client_set_suiteb_192bit_certification(bool enable)
{
#ifdef CONFIG_SUITEB192
g_wpa_suiteb_certification = enable;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
#else
return ESP_FAIL;
@ -1136,6 +1164,7 @@ esp_err_t esp_eap_client_set_pac_file(const unsigned char *pac_file, int pac_fil
} else { // The file contains pac data
g_wpa_pac_file = (u8 *)os_zalloc(pac_file_len);
if (g_wpa_pac_file == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_pac_file, pac_file, pac_file_len);
@ -1144,6 +1173,7 @@ esp_err_t esp_eap_client_set_pac_file(const unsigned char *pac_file, int pac_fil
} else {
return ESP_FAIL;
}
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@ -1173,9 +1203,11 @@ esp_err_t esp_eap_client_set_fast_params(esp_eap_fast_config config)
}
g_wpa_phase1_options = (char *)os_zalloc(sizeof(config_for_supplicant));
if (g_wpa_phase1_options == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_phase1_options, &config_for_supplicant, sizeof(config_for_supplicant));
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@ -1189,6 +1221,7 @@ esp_err_t esp_eap_client_use_default_cert_bundle(bool use_default_bundle)
} else {
esp_crt_bundle_attach_fn = NULL;
}
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
#else
return ESP_FAIL;
@ -1214,16 +1247,16 @@ esp_err_t esp_eap_client_set_domain_name(const char *domain_name)
}
if (!domain_name) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
g_wpa_domain_match = os_strdup(domain_name);
if (!g_wpa_domain_match) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
/* flushing the PMK only needed when going for a better security ie no-domain name to domain name
* or changing the domain name */
wpa_sm_pmksa_cache_flush(get_wpa_sm(), NULL);
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
#endif

18
components/wpa_supplicant/esp_supplicant/src/esp_wpa_main.c
View File

@ -50,6 +50,7 @@
bool g_wpa_pmk_caching_disabled = 0;
const wifi_osi_funcs_t *wifi_funcs;
struct wpa_funcs *wpa_cb;
bool g_wpa_config_changed;
void wpa_install_key(enum wpa_alg alg, u8 *addr, int key_idx, int set_tx,
u8 *seq, size_t seq_len, u8 *key, size_t key_len, enum key_flag key_flag)
@ -226,11 +227,22 @@ int dpp_connect(uint8_t *bssid, bool pdr_done)
}
#endif
static void wpa_config_reload(void)
{
struct wpa_sm *sm = &gWpaSm;
wpa_sm_pmksa_cache_flush(sm, NULL);
}
int wpa_sta_connect(uint8_t *bssid)
{
/* use this API to set AP specific IEs during connection */
int ret = 0;
ret = wpa_config_profile(bssid);
if (g_wpa_config_changed) {
wpa_config_reload();
g_wpa_config_changed = false;
}
if (ret == 0) {
ret = wpa_config_bss(bssid);
if (ret) {
@ -444,12 +456,6 @@ fail:
}
#endif
static void wpa_config_reload(void)
{
struct wpa_sm *sm = &gWpaSm;
wpa_sm_pmksa_cache_flush(sm, NULL);
}
int esp_supplicant_init(void)
{
int ret = ESP_OK;