feedc0de/esp-idf
1
0
Fork 0
forked from espressif/esp-idf
Code Pull Requests Activity

fix(esp_wifi): Flush PMK when EAP configuration is changed

Browse Source
This commit is contained in:
Kapil Gupta
2025-04-08 12:45:00 +05:30
parent 8a57b738e9
commit 816e7bf914
2 changed files with 51 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
components/wpa_supplicant/esp_supplicant/src/esp_eap_client.c
View File

@@ -38,6 +38,7 @@
#include "esp_wpas_glue.h"
#include "esp_eap_client_i.h"
#include "esp_eap_client.h"
#include "eloop.h"
#define WPA2_VERSION "v2.0"
@@ -63,6 +64,7 @@ static void eap_peer_sm_deinit(void);
static int eap_sm_rx_eapol_internal(u8 *src_addr, u8 *buf, u32 len, uint8_t *bssid);
static int wpa2_start_eapol_internal(void);
int wpa2_post(uint32_t sig, uint32_t par);
extern bool g_wpa_config_changed;
#ifdef USE_WPA2_TASK
#define WPA2_TASK_PRIORITY 7
@@ -73,6 +75,11 @@ static void *s_wpa2_api_lock = NULL;
static void *s_wifi_wpa2_sync_sem = NULL;
static bool s_disable_time_check = true;
static void config_changed_handler(void *ctx, void *data)
{
g_wpa_config_changed = true;
}
static void wpa2_api_lock(void)
{
if (s_wpa2_api_lock == NULL) {
@@ -811,6 +818,7 @@ static esp_err_t esp_client_enable_fn(void *arg)
wpa_printf(MSG_ERROR, "Register EAP Peer methods Failure\n");
}
#endif
g_wpa_config_changed = true;
return ESP_OK;
}
@@ -860,6 +868,7 @@ static esp_err_t eap_client_disable_fn(void *param)
#endif
sm->wpa_sm_eap_disable = NULL;
g_wpa_config_changed = true;
return ESP_OK;
}
@@ -907,6 +916,7 @@ esp_err_t esp_eap_client_set_certificate_and_key(const unsigned char *client_cer
g_wpa_private_key_passwd = private_key_passwd;
g_wpa_private_key_passwd_len = private_key_passwd_len;
}
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@@ -922,6 +932,7 @@ void esp_eap_client_clear_certificate_and_key(void)
os_free(g_wpa_pac_file);
g_wpa_pac_file = NULL;
g_wpa_pac_file_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
esp_err_t esp_eap_client_set_ca_cert(const unsigned char *ca_cert, int ca_cert_len)
@@ -932,7 +943,7 @@ esp_err_t esp_eap_client_set_ca_cert(const unsigned char *ca_cert, int ca_cert_l
}
/* CA certs Set/updated, flushing current PMK cache */
wpa_sm_pmksa_cache_flush(get_wpa_sm(), NULL);
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@@ -941,6 +952,7 @@ void esp_eap_client_clear_ca_cert(void)
{
g_wpa_ca_cert = NULL;
g_wpa_ca_cert_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
#define ANONYMOUS_ID_LEN_MAX 128
@@ -957,23 +969,27 @@ esp_err_t esp_eap_client_set_identity(const unsigned char *identity, int len)
g_wpa_anonymous_identity = (u8 *)os_zalloc(len);
if (g_wpa_anonymous_identity == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_anonymous_identity, identity, len);
g_wpa_anonymous_identity_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
void esp_eap_client_clear_identity(void)
{
if (g_wpa_anonymous_identity) {
os_free(g_wpa_anonymous_identity);
if (!g_wpa_anonymous_identity) {
return;
}
os_free(g_wpa_anonymous_identity);
g_wpa_anonymous_identity = NULL;
g_wpa_anonymous_identity_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
#define USERNAME_LEN_MAX 128
@@ -990,11 +1006,13 @@ esp_err_t esp_eap_client_set_username(const unsigned char *username, int len)
g_wpa_username = (u8 *)os_zalloc(len);
if (g_wpa_username == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_username, username, len);
g_wpa_username_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@@ -1007,6 +1025,7 @@ void esp_eap_client_clear_username(void)
g_wpa_username = NULL;
g_wpa_username_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
esp_err_t esp_eap_client_set_password(const unsigned char *password, int len)
@@ -1022,11 +1041,13 @@ esp_err_t esp_eap_client_set_password(const unsigned char *password, int len)
g_wpa_password = (u8 *)os_zalloc(len);
if (g_wpa_password == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_password, password, len);
g_wpa_password_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@@ -1038,6 +1059,7 @@ void esp_eap_client_clear_password(void)
}
g_wpa_password = NULL;
g_wpa_password_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
esp_err_t esp_eap_client_set_new_password(const unsigned char *new_password, int len)
@@ -1053,11 +1075,13 @@ esp_err_t esp_eap_client_set_new_password(const unsigned char *new_password, int
g_wpa_new_password = (u8 *)os_zalloc(len);
if (g_wpa_new_password == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_new_password, new_password, len);
g_wpa_password_len = len;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@@ -1069,11 +1093,13 @@ void esp_eap_client_clear_new_password(void)
}
g_wpa_new_password = NULL;
g_wpa_new_password_len = 0;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
}
esp_err_t esp_eap_client_set_disable_time_check(bool disable)
{
s_disable_time_check = disable;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@@ -1110,6 +1136,7 @@ esp_err_t esp_eap_client_set_ttls_phase2_method(esp_eap_ttls_phase2_types type)
g_wpa_ttls_phase2_type = "auth=MSCHAPV2";
break;
}
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@@ -1117,6 +1144,7 @@ esp_err_t esp_eap_client_set_suiteb_192bit_certification(bool enable)
{
#ifdef CONFIG_SUITEB192
g_wpa_suiteb_certification = enable;
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
#else
return ESP_FAIL;
@@ -1135,6 +1163,7 @@ esp_err_t esp_eap_client_set_pac_file(const unsigned char *pac_file, int pac_fil
} else { // The file contains pac data
g_wpa_pac_file = (u8 *)os_zalloc(pac_file_len);
if (g_wpa_pac_file == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_pac_file, pac_file, pac_file_len);
@@ -1143,6 +1172,7 @@ esp_err_t esp_eap_client_set_pac_file(const unsigned char *pac_file, int pac_fil
} else {
return ESP_FAIL;
}
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@@ -1172,9 +1202,11 @@ esp_err_t esp_eap_client_set_fast_params(esp_eap_fast_config config)
}
g_wpa_phase1_options = (char *)os_zalloc(sizeof(config_for_supplicant));
if (g_wpa_phase1_options == NULL) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
os_memcpy(g_wpa_phase1_options, &config_for_supplicant, sizeof(config_for_supplicant));
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
@@ -1188,6 +1220,7 @@ esp_err_t esp_eap_client_use_default_cert_bundle(bool use_default_bundle)
} else {
esp_crt_bundle_attach_fn = NULL;
}
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
#else
return ESP_FAIL;
@@ -1213,16 +1246,16 @@ esp_err_t esp_eap_client_set_domain_name(const char *domain_name)
}
if (!domain_name) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
}
g_wpa_domain_match = os_strdup(domain_name);
if (!g_wpa_domain_match) {
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_ERR_NO_MEM;
}
/* flushing the PMK only needed when going for a better security ie no-domain name to domain name
* or changing the domain name */
wpa_sm_pmksa_cache_flush(get_wpa_sm(), NULL);
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
return ESP_OK;
#endif

18
components/wpa_supplicant/esp_supplicant/src/esp_wpa_main.c
View File

@@ -44,6 +44,7 @@
const wifi_osi_funcs_t *wifi_funcs;
struct wpa_funcs *wpa_cb;
bool g_wpa_config_changed;
void wpa_install_key(enum wpa_alg alg, u8 *addr, int key_idx, int set_tx,
u8 *seq, size_t seq_len, u8 *key, size_t key_len, enum key_flag key_flag)
@@ -200,11 +201,22 @@ bool wpa_deattach(void)
return true;
}
static void wpa_config_reload(void)
{
struct wpa_sm *sm = &gWpaSm;
wpa_sm_pmksa_cache_flush(sm, NULL);
}
int wpa_sta_connect(uint8_t *bssid)
{
/* use this API to set AP specific IEs during connection */
int ret = 0;
ret = wpa_config_profile(bssid);
if (g_wpa_config_changed) {
wpa_config_reload();
g_wpa_config_changed = false;
}
if (ret == 0) {
ret = wpa_config_bss(bssid);
if (ret) {
@@ -351,12 +363,6 @@ fail:
}
#endif
static void wpa_config_reload(void)
{
struct wpa_sm *sm = &gWpaSm;
wpa_sm_pmksa_cache_flush(sm, NULL);
}
int esp_supplicant_init(void)
{
int ret = ESP_OK;