espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-31 03:07:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(esp_wifi): Flush PMK when EAP config is changed

Browse Source
This commit is contained in:
Kapil Gupta
2025-04-30 15:34:16 +05:30
parent b3baf8c026
commit c2560ed96d
2 changed files with 51 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
components/wpa_supplicant/esp_supplicant/src/esp_eap_client.c
View File

@ -38,6 +38,7 @@
#include "esp_wpas_glue.h" #include "esp_wpas_glue.h"
#include "esp_eap_client_i.h" #include "esp_eap_client_i.h"
#include "esp_eap_client.h" #include "esp_eap_client.h"
#include "eloop.h"
#define WPA2_VERSION "v2.0" #define WPA2_VERSION "v2.0"
@ -63,6 +64,7 @@ static void eap_peer_sm_deinit(void);
static int eap_sm_rx_eapol_internal(u8 *src_addr, u8 *buf, u32 len, uint8_t *bssid); static int eap_sm_rx_eapol_internal(u8 *src_addr, u8 *buf, u32 len, uint8_t *bssid);
static int wpa2_start_eapol_internal(void); static int wpa2_start_eapol_internal(void);
int wpa2_post(uint32_t sig, uint32_t par); int wpa2_post(uint32_t sig, uint32_t par);
extern bool g_wpa_config_changed;
#ifdef USE_WPA2_TASK #ifdef USE_WPA2_TASK
#define WPA2_TASK_PRIORITY 7 #define WPA2_TASK_PRIORITY 7
@ -73,6 +75,11 @@ static void *s_wpa2_api_lock = NULL;
static void *s_wifi_wpa2_sync_sem = NULL; static void *s_wifi_wpa2_sync_sem = NULL;
static bool s_disable_time_check = true; static bool s_disable_time_check = true;
static void config_changed_handler(void *ctx, void *data)
{
g_wpa_config_changed = true;
}
static void wpa2_api_lock(void) static void wpa2_api_lock(void)
{ {
if (s_wpa2_api_lock == NULL) { if (s_wpa2_api_lock == NULL) {
@ -812,6 +819,7 @@ static esp_err_t esp_client_enable_fn(void *arg)
wpa_printf(MSG_ERROR, "Register EAP Peer methods Failure"); wpa_printf(MSG_ERROR, "Register EAP Peer methods Failure");
} }
#endif #endif
g_wpa_config_changed = true;
return ESP_OK; return ESP_OK;
} }
@ -861,6 +869,7 @@ static esp_err_t eap_client_disable_fn(void *param)
#endif #endif
sm->wpa_sm_eap_disable = NULL; sm->wpa_sm_eap_disable = NULL;
g_wpa_config_changed = true;
return ESP_OK; return ESP_OK;
} }
@ -908,6 +917,7 @@ esp_err_t esp_eap_client_set_certificate_and_key(const unsigned char *client_cer
g_wpa_private_key_passwd = private_key_passwd; g_wpa_private_key_passwd = private_key_passwd;
g_wpa_private_key_passwd_len = private_key_passwd_len; g_wpa_private_key_passwd_len = private_key_passwd_len;
} }
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
} }
@ -923,6 +933,7 @@ void esp_eap_client_clear_certificate_and_key(void)
os_free(g_wpa_pac_file); os_free(g_wpa_pac_file);
g_wpa_pac_file = NULL; g_wpa_pac_file = NULL;
g_wpa_pac_file_len = 0; g_wpa_pac_file_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
} }
esp_err_t esp_eap_client_set_ca_cert(const unsigned char *ca_cert, int ca_cert_len) esp_err_t esp_eap_client_set_ca_cert(const unsigned char *ca_cert, int ca_cert_len)
@ -933,7 +944,7 @@ esp_err_t esp_eap_client_set_ca_cert(const unsigned char *ca_cert, int ca_cert_l
} }
/* CA certs Set/updated, flushing current PMK cache */ /* CA certs Set/updated, flushing current PMK cache */
wpa_sm_pmksa_cache_flush(get_wpa_sm(), NULL); eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
} }
@ -942,6 +953,7 @@ void esp_eap_client_clear_ca_cert(void)
{ {
g_wpa_ca_cert = NULL; g_wpa_ca_cert = NULL;
g_wpa_ca_cert_len = 0; g_wpa_ca_cert_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
} }
#define ANONYMOUS_ID_LEN_MAX 128 #define ANONYMOUS_ID_LEN_MAX 128
@ -958,23 +970,27 @@ esp_err_t esp_eap_client_set_identity(const unsigned char *identity, int len)
g_wpa_anonymous_identity = (u8 *)os_zalloc(len); g_wpa_anonymous_identity = (u8 *)os_zalloc(len);
if (g_wpa_anonymous_identity == NULL) { if (g_wpa_anonymous_identity == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM; return ESP_ERR_NO_MEM;
} }
os_memcpy(g_wpa_anonymous_identity, identity, len); os_memcpy(g_wpa_anonymous_identity, identity, len);
g_wpa_anonymous_identity_len = len; g_wpa_anonymous_identity_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
} }
void esp_eap_client_clear_identity(void) void esp_eap_client_clear_identity(void)
{ {
if (g_wpa_anonymous_identity) { if (!g_wpa_anonymous_identity) {
os_free(g_wpa_anonymous_identity); return;
} }
os_free(g_wpa_anonymous_identity);
g_wpa_anonymous_identity = NULL; g_wpa_anonymous_identity = NULL;
g_wpa_anonymous_identity_len = 0; g_wpa_anonymous_identity_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
} }
#define USERNAME_LEN_MAX 128 #define USERNAME_LEN_MAX 128
@ -991,11 +1007,13 @@ esp_err_t esp_eap_client_set_username(const unsigned char *username, int len)
g_wpa_username = (u8 *)os_zalloc(len); g_wpa_username = (u8 *)os_zalloc(len);
if (g_wpa_username == NULL) { if (g_wpa_username == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM; return ESP_ERR_NO_MEM;
} }
os_memcpy(g_wpa_username, username, len); os_memcpy(g_wpa_username, username, len);
g_wpa_username_len = len; g_wpa_username_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
} }
@ -1008,6 +1026,7 @@ void esp_eap_client_clear_username(void)
g_wpa_username = NULL; g_wpa_username = NULL;
g_wpa_username_len = 0; g_wpa_username_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
} }
esp_err_t esp_eap_client_set_password(const unsigned char *password, int len) esp_err_t esp_eap_client_set_password(const unsigned char *password, int len)
@ -1023,11 +1042,13 @@ esp_err_t esp_eap_client_set_password(const unsigned char *password, int len)
g_wpa_password = (u8 *)os_zalloc(len); g_wpa_password = (u8 *)os_zalloc(len);
if (g_wpa_password == NULL) { if (g_wpa_password == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM; return ESP_ERR_NO_MEM;
} }
os_memcpy(g_wpa_password, password, len); os_memcpy(g_wpa_password, password, len);
g_wpa_password_len = len; g_wpa_password_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
} }
@ -1039,6 +1060,7 @@ void esp_eap_client_clear_password(void)
} }
g_wpa_password = NULL; g_wpa_password = NULL;
g_wpa_password_len = 0; g_wpa_password_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
} }
esp_err_t esp_eap_client_set_new_password(const unsigned char *new_password, int len) esp_err_t esp_eap_client_set_new_password(const unsigned char *new_password, int len)
@ -1054,11 +1076,13 @@ esp_err_t esp_eap_client_set_new_password(const unsigned char *new_password, int
g_wpa_new_password = (u8 *)os_zalloc(len); g_wpa_new_password = (u8 *)os_zalloc(len);
if (g_wpa_new_password == NULL) { if (g_wpa_new_password == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM; return ESP_ERR_NO_MEM;
} }
os_memcpy(g_wpa_new_password, new_password, len); os_memcpy(g_wpa_new_password, new_password, len);
g_wpa_password_len = len; g_wpa_password_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
} }
@ -1070,11 +1094,13 @@ void esp_eap_client_clear_new_password(void)
} }
g_wpa_new_password = NULL; g_wpa_new_password = NULL;
g_wpa_new_password_len = 0; g_wpa_new_password_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
} }
esp_err_t esp_eap_client_set_disable_time_check(bool disable) esp_err_t esp_eap_client_set_disable_time_check(bool disable)
{ {
s_disable_time_check = disable; s_disable_time_check = disable;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
} }
@ -1111,6 +1137,7 @@ esp_err_t esp_eap_client_set_ttls_phase2_method(esp_eap_ttls_phase2_types type)
g_wpa_ttls_phase2_type = "auth=MSCHAPV2"; g_wpa_ttls_phase2_type = "auth=MSCHAPV2";
break; break;
} }
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
} }
@ -1118,6 +1145,7 @@ esp_err_t esp_eap_client_set_suiteb_192bit_certification(bool enable)
{ {
#ifdef CONFIG_SUITEB192 #ifdef CONFIG_SUITEB192
g_wpa_suiteb_certification = enable; g_wpa_suiteb_certification = enable;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
#else #else
return ESP_FAIL; return ESP_FAIL;
@ -1136,6 +1164,7 @@ esp_err_t esp_eap_client_set_pac_file(const unsigned char *pac_file, int pac_fil
} else { // The file contains pac data } else { // The file contains pac data
g_wpa_pac_file = (u8 *)os_zalloc(pac_file_len); g_wpa_pac_file = (u8 *)os_zalloc(pac_file_len);
if (g_wpa_pac_file == NULL) { if (g_wpa_pac_file == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM; return ESP_ERR_NO_MEM;
} }
os_memcpy(g_wpa_pac_file, pac_file, pac_file_len); os_memcpy(g_wpa_pac_file, pac_file, pac_file_len);
@ -1144,6 +1173,7 @@ esp_err_t esp_eap_client_set_pac_file(const unsigned char *pac_file, int pac_fil
} else { } else {
return ESP_FAIL; return ESP_FAIL;
} }
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
} }
@ -1173,9 +1203,11 @@ esp_err_t esp_eap_client_set_fast_params(esp_eap_fast_config config)
} }
g_wpa_phase1_options = (char *)os_zalloc(sizeof(config_for_supplicant)); g_wpa_phase1_options = (char *)os_zalloc(sizeof(config_for_supplicant));
if (g_wpa_phase1_options == NULL) { if (g_wpa_phase1_options == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM; return ESP_ERR_NO_MEM;
} }
os_memcpy(g_wpa_phase1_options, &config_for_supplicant, sizeof(config_for_supplicant)); os_memcpy(g_wpa_phase1_options, &config_for_supplicant, sizeof(config_for_supplicant));
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
} }
@ -1189,6 +1221,7 @@ esp_err_t esp_eap_client_use_default_cert_bundle(bool use_default_bundle)
} else { } else {
esp_crt_bundle_attach_fn = NULL; esp_crt_bundle_attach_fn = NULL;
} }
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
#else #else
return ESP_FAIL; return ESP_FAIL;
@ -1214,16 +1247,16 @@ esp_err_t esp_eap_client_set_domain_name(const char *domain_name)
} }
if (!domain_name) { if (!domain_name) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK; return ESP_OK;
} }
g_wpa_domain_match = os_strdup(domain_name); g_wpa_domain_match = os_strdup(domain_name);
if (!g_wpa_domain_match) { if (!g_wpa_domain_match) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM; return ESP_ERR_NO_MEM;
} }
/* flushing the PMK only needed when going for a better security ie no-domain name to domain name eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
* or changing the domain name */
wpa_sm_pmksa_cache_flush(get_wpa_sm(), NULL);
return ESP_OK; return ESP_OK;
#endif #endif

18
components/wpa_supplicant/esp_supplicant/src/esp_wpa_main.c
View File

@ -50,6 +50,7 @@
bool g_wpa_pmk_caching_disabled = 0; bool g_wpa_pmk_caching_disabled = 0;
const wifi_osi_funcs_t *wifi_funcs; const wifi_osi_funcs_t *wifi_funcs;
struct wpa_funcs *wpa_cb; struct wpa_funcs *wpa_cb;
bool g_wpa_config_changed;
void wpa_install_key(enum wpa_alg alg, u8 *addr, int key_idx, int set_tx, void wpa_install_key(enum wpa_alg alg, u8 *addr, int key_idx, int set_tx,
u8 *seq, size_t seq_len, u8 *key, size_t key_len, enum key_flag key_flag) u8 *seq, size_t seq_len, u8 *key, size_t key_len, enum key_flag key_flag)
@ -226,11 +227,22 @@ int dpp_connect(uint8_t *bssid, bool pdr_done)
} }
#endif #endif
static void wpa_config_reload(void)
{
struct wpa_sm *sm = &gWpaSm;
wpa_sm_pmksa_cache_flush(sm, NULL);
}
int wpa_sta_connect(uint8_t *bssid) int wpa_sta_connect(uint8_t *bssid)
{ {
/* use this API to set AP specific IEs during connection */ /* use this API to set AP specific IEs during connection */
int ret = 0; int ret = 0;
ret = wpa_config_profile(bssid); ret = wpa_config_profile(bssid);
if (g_wpa_config_changed) {
wpa_config_reload();
g_wpa_config_changed = false;
}
if (ret == 0) { if (ret == 0) {
ret = wpa_config_bss(bssid); ret = wpa_config_bss(bssid);
if (ret) { if (ret) {
@ -444,12 +456,6 @@ fail:
} }
#endif #endif
static void wpa_config_reload(void)
{
struct wpa_sm *sm = &gWpaSm;
wpa_sm_pmksa_cache_flush(sm, NULL);
}
int esp_supplicant_init(void) int esp_supplicant_init(void)
{ {
int ret = ESP_OK; int ret = ESP_OK;