Skip to content

Commit 7f2814a

Browse files
kapilkedawatkapilkedawat
committed
fix(esp_wifi): Flush PMK when EAP config is changed
1 parent bbf7f9b commit 7f2814a

File tree

2 files changed

+52
-13
lines changed

2 files changed

+52
-13
lines changed

‎components/wpa_supplicant/esp_supplicant/src/esp_eap_client.c‎

Lines changed: 39 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
#include "esp_wpas_glue.h"
3939
#include "esp_eap_client_i.h"
4040
#include "esp_eap_client.h"
41+
#include "eloop.h"
4142

4243
#define WPA2_VERSION "v2.0"
4344

@@ -63,6 +64,7 @@ static void eap_peer_sm_deinit(void);
6364
static int eap_sm_rx_eapol_internal(u8 *src_addr, u8 *buf, u32 len, uint8_t *bssid);
6465
static int wpa2_start_eapol_internal(void);
6566
int wpa2_post(uint32_t sig, uint32_t par);
67+
extern bool g_wpa_config_changed;
6668

6769
#ifdef USE_WPA2_TASK
6870
#define WPA2_TASK_PRIORITY 7
@@ -73,6 +75,11 @@ static void *s_wpa2_api_lock = NULL;
7375
static void *s_wifi_wpa2_sync_sem = NULL;
7476
static bool s_disable_time_check = true;
7577

78+
static void config_changed_handler(void *ctx, void *data)
79+
{
80+
g_wpa_config_changed = true;
81+
}
82+
7683
static void wpa2_api_lock(void)
7784
{
7885
if (s_wpa2_api_lock == NULL) {
@@ -812,6 +819,7 @@ static esp_err_t esp_client_enable_fn(void *arg)
812819
wpa_printf(MSG_ERROR, "Register EAP Peer methods Failure");
813820
}
814821
#endif
822+
g_wpa_config_changed = true;
815823
return ESP_OK;
816824
}
817825

@@ -875,6 +883,7 @@ static esp_err_t eap_client_disable_fn(void *param)
875883
#endif
876884

877885
sm->wpa_sm_eap_disable = NULL;
886+
g_wpa_config_changed = true;
878887
return ESP_OK;
879888
}
880889

@@ -922,6 +931,7 @@ esp_err_t esp_eap_client_set_certificate_and_key(const unsigned char *client_cer
922931
g_wpa_private_key_passwd = private_key_passwd;
923932
g_wpa_private_key_passwd_len = private_key_passwd_len;
924933
}
934+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
925935

926936
return ESP_OK;
927937
}
@@ -937,6 +947,7 @@ void esp_eap_client_clear_certificate_and_key(void)
937947
os_free(g_wpa_pac_file);
938948
g_wpa_pac_file = NULL;
939949
g_wpa_pac_file_len = 0;
950+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
940951
}
941952

942953
esp_err_t esp_eap_client_set_ca_cert(const unsigned char *ca_cert, int ca_cert_len)
@@ -947,7 +958,7 @@ esp_err_t esp_eap_client_set_ca_cert(const unsigned char *ca_cert, int ca_cert_l
947958
}
948959

949960
/* CA certs Set/updated, flushing current PMK cache */
950-
wpa_sm_pmksa_cache_flush(get_wpa_sm(), NULL);
961+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
951962

952963
return ESP_OK;
953964
}
@@ -956,6 +967,7 @@ void esp_eap_client_clear_ca_cert(void)
956967
{
957968
g_wpa_ca_cert = NULL;
958969
g_wpa_ca_cert_len = 0;
970+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
959971
}
960972

961973
#define ANONYMOUS_ID_LEN_MAX 128
@@ -972,23 +984,27 @@ esp_err_t esp_eap_client_set_identity(const unsigned char *identity, int len)
972984

973985
g_wpa_anonymous_identity = (u8 *)os_zalloc(len);
974986
if (g_wpa_anonymous_identity == NULL) {
987+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
975988
return ESP_ERR_NO_MEM;
976989
}
977990

978991
os_memcpy(g_wpa_anonymous_identity, identity, len);
979992
g_wpa_anonymous_identity_len = len;
993+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
980994

981995
return ESP_OK;
982996
}
983997

984998
void esp_eap_client_clear_identity(void)
985999
{
986-
if (g_wpa_anonymous_identity) {
987-
os_free(g_wpa_anonymous_identity);
1000+
if (!g_wpa_anonymous_identity) {
1001+
return;
9881002
}
9891003

1004+
os_free(g_wpa_anonymous_identity);
9901005
g_wpa_anonymous_identity = NULL;
9911006
g_wpa_anonymous_identity_len = 0;
1007+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
9921008
}
9931009

9941010
#define USERNAME_LEN_MAX 128
@@ -1005,11 +1021,13 @@ esp_err_t esp_eap_client_set_username(const unsigned char *username, int len)
10051021

10061022
g_wpa_username = (u8 *)os_zalloc(len);
10071023
if (g_wpa_username == NULL) {
1024+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
10081025
return ESP_ERR_NO_MEM;
10091026
}
10101027

10111028
os_memcpy(g_wpa_username, username, len);
10121029
g_wpa_username_len = len;
1030+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
10131031

10141032
return ESP_OK;
10151033
}
@@ -1022,6 +1040,7 @@ void esp_eap_client_clear_username(void)
10221040

10231041
g_wpa_username = NULL;
10241042
g_wpa_username_len = 0;
1043+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
10251044
}
10261045

10271046
esp_err_t esp_eap_client_set_password(const unsigned char *password, int len)
@@ -1037,11 +1056,13 @@ esp_err_t esp_eap_client_set_password(const unsigned char *password, int len)
10371056

10381057
g_wpa_password = (u8 *)os_zalloc(len);
10391058
if (g_wpa_password == NULL) {
1059+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
10401060
return ESP_ERR_NO_MEM;
10411061
}
10421062

10431063
os_memcpy(g_wpa_password, password, len);
10441064
g_wpa_password_len = len;
1065+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
10451066

10461067
return ESP_OK;
10471068
}
@@ -1053,6 +1074,7 @@ void esp_eap_client_clear_password(void)
10531074
}
10541075
g_wpa_password = NULL;
10551076
g_wpa_password_len = 0;
1077+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
10561078
}
10571079

10581080
esp_err_t esp_eap_client_set_new_password(const unsigned char *new_password, int len)
@@ -1068,11 +1090,13 @@ esp_err_t esp_eap_client_set_new_password(const unsigned char *new_password, int
10681090

10691091
g_wpa_new_password = (u8 *)os_zalloc(len);
10701092
if (g_wpa_new_password == NULL) {
1093+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
10711094
return ESP_ERR_NO_MEM;
10721095
}
10731096

10741097
os_memcpy(g_wpa_new_password, new_password, len);
10751098
g_wpa_password_len = len;
1099+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
10761100

10771101
return ESP_OK;
10781102
}
@@ -1084,11 +1108,13 @@ void esp_eap_client_clear_new_password(void)
10841108
}
10851109
g_wpa_new_password = NULL;
10861110
g_wpa_new_password_len = 0;
1111+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
10871112
}
10881113

10891114
esp_err_t esp_eap_client_set_disable_time_check(bool disable)
10901115
{
10911116
s_disable_time_check = disable;
1117+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
10921118
return ESP_OK;
10931119
}
10941120

@@ -1125,13 +1151,15 @@ esp_err_t esp_eap_client_set_ttls_phase2_method(esp_eap_ttls_phase2_types type)
11251151
g_wpa_ttls_phase2_type = "auth=MSCHAPV2";
11261152
break;
11271153
}
1154+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
11281155
return ESP_OK;
11291156
}
11301157

11311158
esp_err_t esp_eap_client_set_suiteb_192bit_certification(bool enable)
11321159
{
11331160
#ifdef CONFIG_SUITEB192
11341161
g_wpa_suiteb_certification = enable;
1162+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
11351163
return ESP_OK;
11361164
#else
11371165
return ESP_FAIL;
@@ -1150,6 +1178,7 @@ esp_err_t esp_eap_client_set_pac_file(const unsigned char *pac_file, int pac_fil
11501178
} else { // The file contains pac data
11511179
g_wpa_pac_file = (u8 *)os_zalloc(pac_file_len);
11521180
if (g_wpa_pac_file == NULL) {
1181+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
11531182
return ESP_ERR_NO_MEM;
11541183
}
11551184
os_memcpy(g_wpa_pac_file, pac_file, pac_file_len);
@@ -1158,6 +1187,7 @@ esp_err_t esp_eap_client_set_pac_file(const unsigned char *pac_file, int pac_fil
11581187
} else {
11591188
return ESP_FAIL;
11601189
}
1190+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
11611191

11621192
return ESP_OK;
11631193
}
@@ -1187,9 +1217,11 @@ esp_err_t esp_eap_client_set_fast_params(esp_eap_fast_config config)
11871217
}
11881218
g_wpa_phase1_options = (char *)os_zalloc(sizeof(config_for_supplicant));
11891219
if (g_wpa_phase1_options == NULL) {
1220+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
11901221
return ESP_ERR_NO_MEM;
11911222
}
11921223
os_memcpy(g_wpa_phase1_options, &config_for_supplicant, sizeof(config_for_supplicant));
1224+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
11931225
return ESP_OK;
11941226

11951227
}
@@ -1203,6 +1235,7 @@ esp_err_t esp_eap_client_use_default_cert_bundle(bool use_default_bundle)
12031235
} else {
12041236
esp_crt_bundle_attach_fn = NULL;
12051237
}
1238+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
12061239
return ESP_OK;
12071240
#else
12081241
return ESP_FAIL;
@@ -1228,16 +1261,16 @@ esp_err_t esp_eap_client_set_domain_name(const char *domain_name)
12281261
}
12291262

12301263
if (!domain_name) {
1264+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
12311265
return ESP_OK;
12321266
}
12331267
g_wpa_domain_match = os_strdup(domain_name);
12341268
if (!g_wpa_domain_match) {
1269+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
12351270
return ESP_ERR_NO_MEM;
12361271
}
12371272

1238-
/* flushing the PMK only needed when going for a better security ie no-domain name to domain name
1239-
* or changing the domain name */
1240-
wpa_sm_pmksa_cache_flush(get_wpa_sm(), NULL);
1273+
eloop_register_timeout(0, 0, config_changed_handler, NULL, NULL);
12411274

12421275
return ESP_OK;
12431276
#endif

‎components/wpa_supplicant/esp_supplicant/src/esp_wpa_main.c‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -50,6 +50,7 @@
5050
bool g_wpa_pmk_caching_disabled = 0;
5151
const wifi_osi_funcs_t *wifi_funcs;
5252
struct wpa_funcs *wpa_cb;
53+
bool g_wpa_config_changed;
5354

5455
void wpa_install_key(enum wpa_alg alg, u8 *addr, int key_idx, int set_tx,
5556
u8 *seq, size_t seq_len, u8 *key, size_t key_len, enum key_flag key_flag)
@@ -226,11 +227,22 @@ int dpp_connect(uint8_t *bssid, bool pdr_done)
226227
}
227228
#endif
228229

230+
static void wpa_config_reload(void)
231+
{
232+
struct wpa_sm *sm = &gWpaSm;
233+
wpa_sm_pmksa_cache_flush(sm, NULL);
234+
}
235+
229236
int wpa_sta_connect(uint8_t *bssid)
230237
{
231238
/* use this API to set AP specific IEs during connection */
232239
int ret = 0;
233240
ret = wpa_config_profile(bssid);
241+
242+
if (g_wpa_config_changed) {
243+
wpa_config_reload();
244+
g_wpa_config_changed = false;
245+
}
234246
if (ret == 0) {
235247
ret = wpa_config_bss(bssid);
236248
if (ret) {
@@ -444,12 +456,6 @@ static bool hostap_sta_join(void **sta, u8 *bssid, u8 *wpa_ie, u8 wpa_ie_len, u8
444456
}
445457
#endif
446458

447-
static void wpa_config_reload(void)
448-
{
449-
struct wpa_sm *sm = &gWpaSm;
450-
wpa_sm_pmksa_cache_flush(sm, NULL);
451-
}
452-
453459
int esp_supplicant_init(void)
454460
{
455461
int ret = ESP_OK;

0 commit comments

Comments
 (0)