From 2e2e63e3d3b5ac87e0be170cb77f5b6d30fb4f7c Mon Sep 17 00:00:00 2001 From: Akshat Agrawal Date: Mon, 8 Jun 2026 17:06:54 +0530 Subject: [PATCH] Address Review comments --- .../esp_wifi/include/esp_wifi_types_generic.h | 2 +- .../include/injected/esp_wifi_types_generic.h | 2 +- .../esp_wifi/wifi_apps/nan_app/src/nan_i.h | 2 +- .../wifi_apps/nan_app/src/nan_pairing.c | 20 +++++++++++----- .../include/esp_private/esp_supp_nan.h | 23 +++++++++++++++---- .../esp_supplicant/src/esp_nan_supp_i.h | 1 + .../esp_supplicant/src/esp_nan_supplicant.c | 14 +++++++++-- .../esp_supplicant/src/esp_wifi_driver.h | 2 +- 8 files changed, 49 insertions(+), 17 deletions(-) diff --git a/components/esp_wifi/include/esp_wifi_types_generic.h b/components/esp_wifi/include/esp_wifi_types_generic.h index 3e28f14e7b3..412c1a22b2e 100644 --- a/components/esp_wifi/include/esp_wifi_types_generic.h +++ b/components/esp_wifi/include/esp_wifi_types_generic.h @@ -1583,7 +1583,7 @@ typedef struct { * @brief Argument structure for WIFI_EVENT_NAN_CLUSTER_JOIN event */ typedef struct { - uint8_t cluster_id[6]; /**< Cluster ID (BSSID) that was joined/started */ + uint8_t cluster_id[6]; /**< NAN Cluster ID (BSSID) that was joined/started by the device */ } wifi_event_nan_cluster_join_t; /** diff --git a/components/esp_wifi/remote/include/injected/esp_wifi_types_generic.h b/components/esp_wifi/remote/include/injected/esp_wifi_types_generic.h index e4e98fcc114..266a5027bf3 100644 --- a/components/esp_wifi/remote/include/injected/esp_wifi_types_generic.h +++ b/components/esp_wifi/remote/include/injected/esp_wifi_types_generic.h @@ -1583,7 +1583,7 @@ typedef struct { * @brief Argument structure for WIFI_EVENT_NAN_CLUSTER_JOIN event */ typedef struct { - uint8_t cluster_id[6]; /**< Cluster ID (BSSID) that was joined/started */ + uint8_t cluster_id[6]; /**< NAN Cluster ID (BSSID) that was joined/started by the device */ } wifi_event_nan_cluster_join_t; /** diff --git a/components/esp_wifi/wifi_apps/nan_app/src/nan_i.h b/components/esp_wifi/wifi_apps/nan_app/src/nan_i.h index 54eeb252000..c58587ec7aa 100644 --- a/components/esp_wifi/wifi_apps/nan_app/src/nan_i.h +++ b/components/esp_wifi/wifi_apps/nan_app/src/nan_i.h @@ -291,7 +291,7 @@ typedef struct { bool own_nik_valid; uint8_t cached_nira_nonce[8]; uint8_t cached_nira_tag[8]; - bool cached_nira_valid; + bool nira_cached; #endif #ifdef CONFIG_ESP_WIFI_PASN_SUPPORT struct nan_pasn_data *nan_pasn_data; diff --git a/components/esp_wifi/wifi_apps/nan_app/src/nan_pairing.c b/components/esp_wifi/wifi_apps/nan_app/src/nan_pairing.c index c5d5ae120e1..71d4043d416 100644 --- a/components/esp_wifi/wifi_apps/nan_app/src/nan_pairing.c +++ b/components/esp_wifi/wifi_apps/nan_app/src/nan_pairing.c @@ -50,7 +50,8 @@ static void nan_pairing_key_installed_cb(const uint8_t *peer_nmi, uint8_t role, uint8_t ndp_csid, const uint8_t *nd_pmk, - size_t nd_pmk_len); + size_t nd_pmk_len, + uint32_t nik_lifetime_sec); #endif bool nan_pairing_validate_publish_bootstrapping(uint16_t bootstrapping_methods) @@ -259,6 +260,7 @@ esp_err_t esp_wifi_nan_pairing_start(wifi_nan_pairing_config_t *cfg) switch (cfg->self_role) { case NAN_PAIRING_ROLE_RESPONDER: ret = esp_nan_supp_pasn_responder_init(cfg->peer_nmi, cfg->cred.pincode, + NAN_PAIRING_DEFAULT_NIK_LIFETIME_SEC, nan_pairing_key_installed_cb); if (ret != 0) { ESP_LOGE(TAG, "NAN PASN responder init failed for "MACSTR, MAC2STR(cfg->peer_nmi)); @@ -267,6 +269,7 @@ esp_err_t esp_wifi_nan_pairing_start(wifi_nan_pairing_config_t *cfg) break; case NAN_PAIRING_ROLE_INITIATOR: ret = esp_nan_supp_pasn_initiator_auth(cfg->peer_nmi, cfg->cred.pincode, + NAN_PAIRING_DEFAULT_NIK_LIFETIME_SEC, nan_pairing_key_installed_cb); if (ret != 0) { ESP_LOGE(TAG, "NAN PASN initiator auth failed for "MACSTR, MAC2STR(cfg->peer_nmi)); @@ -310,7 +313,7 @@ int esp_nan_construct_nira(uint8_t *frm) } #ifdef CONFIG_ESP_WIFI_NAN_SECURITY - if (s_nan_ctx.cached_nira_valid) { + if (s_nan_ctx.nira_cached) { nonce = s_nan_ctx.cached_nira_nonce; tag = s_nan_ctx.cached_nira_tag; } else { @@ -355,7 +358,7 @@ int esp_nan_construct_nira(uint8_t *frm) memcpy(s_nan_ctx.cached_nira_nonce, fresh_nonce, NAN_NIRA_NONCE_LEN); memcpy(s_nan_ctx.cached_nira_tag, fresh_tag, NAN_NIRA_TAG_LEN); - s_nan_ctx.cached_nira_valid = true; + s_nan_ctx.nira_cached = true; nonce = fresh_nonce; tag = fresh_tag; @@ -768,18 +771,22 @@ static void nan_pairing_key_installed_cb(const uint8_t *peer_nmi, uint8_t role, uint8_t ndp_csid, const uint8_t *nd_pmk, - size_t nd_pmk_len) + size_t nd_pmk_len, + uint32_t nik_lifetime_sec) { if (!peer_nmi) { return; } #if defined(CONFIG_ESP_WIFI_NAN_SECURITY) + uint32_t lifetime_sec = nik_lifetime_sec ? + nik_lifetime_sec : NAN_PAIRING_DEFAULT_NIK_LIFETIME_SEC; + /* Cache ND-PMK for future paired NDPs (Wi-Fi Aware v4.0 ยง7.6.4.2). */ if (ndp_csid && nd_pmk && nd_pmk_len == ESP_WIFI_NAN_NDP_PMK_LEN) { (void)nan_app_register_paired_peer(peer_nmi, role, ndp_csid, nd_pmk, nd_pmk_len, - NAN_PAIRING_DEFAULT_NIK_LIFETIME_SEC); + lifetime_sec); } else { ESP_LOGW(TAG, "Pairing complete for " MACSTR ": ND-PMK unavailable (csid=%u nd_pmk_len=%u); " @@ -790,6 +797,7 @@ static void nan_pairing_key_installed_cb(const uint8_t *peer_nmi, (void)ndp_csid; (void)nd_pmk; (void)nd_pmk_len; + (void)nik_lifetime_sec; #endif if (role == NAN_ROLE_PAIRING_INITIATOR) { @@ -879,7 +887,7 @@ void nan_app_receive_pairing_followup(uint8_t svc_id, uint8_t peer_svc_id, evt.status = WIFI_NAN_PAIRING_STATUS_ACCEPTED; evt.reason_code = 0; MACADDR_COPY(evt.peer_nmi, peer_mac); - esp_nan_disable_pairing(); + esp_nan_disable_pairing(p_peer_svc->own_svc_id); nan_app_post_event(WIFI_EVENT_NAN_PAIRING_CONFIRM, &evt, sizeof(evt)); } } diff --git a/components/wpa_supplicant/esp_supplicant/include/esp_private/esp_supp_nan.h b/components/wpa_supplicant/esp_supplicant/include/esp_private/esp_supp_nan.h index 1ab35e54cfa..865b93ac18b 100644 --- a/components/wpa_supplicant/esp_supplicant/include/esp_private/esp_supp_nan.h +++ b/components/wpa_supplicant/esp_supplicant/include/esp_private/esp_supp_nan.h @@ -64,14 +64,19 @@ enum nan_role { * @param role enum nan_role value for the local device. * @param ndp_csid NCS-SK CSID for paired-peer NDP (WIFI_NAN_CSID_NCS_SK_128 * or _SK_256), 0 if no usable cipher mapping was available. - * @param nd_pmk ND-PMK bytes (32) or NULL if KDK was absent. - * @param nd_pmk_len Length of @a nd_pmk (32 when present, 0 otherwise). + * @param nd_pmk ND-PMK bytes (32) or NULL if KDK was absent. + * @param nd_pmk_len Length of @a nd_pmk (32 when present, 0 otherwise). + * @param nik_lifetime_sec NIK / paired-peer cache lifetime in seconds, as supplied + * to @ref esp_nan_supp_pasn_initiator_auth or + * @ref esp_nan_supp_pasn_responder_init. The NAN app + * substitutes 86400 s when this is 0. */ typedef void (*esp_nan_pairing_key_installed_cb_t)(const uint8_t *peer_nmi, uint8_t role, uint8_t ndp_csid, const uint8_t *nd_pmk, - size_t nd_pmk_len); + size_t nd_pmk_len, + uint32_t nik_lifetime_sec); /** * Last PASN key material after successful pairing (PMK + flattened PTK KCK|KEK|TK|KDK). @@ -98,11 +103,15 @@ struct nan_pasn_key_material { * pairing responder. Runs on the wpa_supplicant eloop thread. * * @param peer_nmi Peer NMI (6 bytes). - * @param pincode 6-digit PIN (0..999999), or @c UINT32_MAX for the default PIN. + * @param pincode 6-digit PIN (0..999999), or @c UINT32_MAX for the default PIN. + * @param nik_lifetime_sec NIK lifetime in seconds; forwarded unchanged to + * @c pairing_key_installed_cb (NAN app currently + * passes 86400). * @param pairing_key_installed_cb Callback invoked after pairwise key installation with peer NMI. * @return 0 on success, -1 on failure. */ int esp_nan_supp_pasn_responder_init(const uint8_t *peer_nmi, uint32_t pincode, + uint32_t nik_lifetime_sec, esp_nan_pairing_key_installed_cb_t pairing_key_installed_cb); /** @@ -113,11 +122,15 @@ int esp_nan_supp_pasn_responder_init(const uint8_t *peer_nmi, uint32_t pincode, * Runs on the wpa_supplicant eloop thread. * * @param peer_nmi Peer NMI (6 bytes). - * @param pincode 6-digit PIN (0..999999), or @c UINT32_MAX for the default PIN. + * @param pincode 6-digit PIN (0..999999), or @c UINT32_MAX for the default PIN. + * @param nik_lifetime_sec NIK lifetime in seconds; forwarded unchanged to + * @c pairing_key_installed_cb (NAN app currently + * passes 86400). * @param pairing_key_installed_cb Callback invoked after pairwise key installation with peer NMI. * @return 0 on success, -1 on failure. */ int esp_nan_supp_pasn_initiator_auth(const uint8_t *peer_nmi, uint32_t pincode, + uint32_t nik_lifetime_sec, esp_nan_pairing_key_installed_cb_t pairing_key_installed_cb); /** diff --git a/components/wpa_supplicant/esp_supplicant/src/esp_nan_supp_i.h b/components/wpa_supplicant/esp_supplicant/src/esp_nan_supp_i.h index 92accd57134..044cdcf1c83 100644 --- a/components/wpa_supplicant/esp_supplicant/src/esp_nan_supp_i.h +++ b/components/wpa_supplicant/esp_supplicant/src/esp_nan_supp_i.h @@ -43,6 +43,7 @@ struct nan_pasn_data { size_t pasn_ptk_len; struct pasn_data *pasn; nan_pasn_pairing_key_installed_cb_t pairing_key_installed_cb; + uint32_t nik_lifetime_sec; }; int nan_initiate_pasn_verify(struct nan_pasn_data *pd, const uint8_t *peer_addr, diff --git a/components/wpa_supplicant/esp_supplicant/src/esp_nan_supplicant.c b/components/wpa_supplicant/esp_supplicant/src/esp_nan_supplicant.c index 3a3ea9d2edd..c332d1a47bd 100644 --- a/components/wpa_supplicant/esp_supplicant/src/esp_nan_supplicant.c +++ b/components/wpa_supplicant/esp_supplicant/src/esp_nan_supplicant.c @@ -1254,7 +1254,8 @@ static int nan_handle_pasn_auth(struct nan_pasn_data *nan, nan->pairing_key_installed_cb(pasn->peer_addr, (uint8_t)nan->dev_role, nan_pasn_pasn_cipher_to_ndp_csid(pasn->cipher), - nd_pmk, nd_pmk_len); + nd_pmk, nd_pmk_len, + nan->nik_lifetime_sec); } forced_memzero(pasn_get_ptk(pasn), sizeof(pasn->ptk)); nan_pasn_data_deinit(nan); @@ -1311,7 +1312,8 @@ int nan_pasn_auth_rx(struct nan_pasn_data *nan, const struct ieee80211_auth *mgm nan->pairing_key_installed_cb(pasn->peer_addr, (uint8_t)nan->dev_role, nan_pasn_pasn_cipher_to_ndp_csid(pasn->cipher), - nd_pmk, nd_pmk_len); + nd_pmk, nd_pmk_len, + nan->nik_lifetime_sec); } } #ifdef CONFIG_TESTING_OPTIONS @@ -1550,6 +1552,7 @@ int nan_pasn_auth_initiate(struct nan_pasn_data *pd, const uint8_t *peer_addr, i struct nan_pasn_eloop_ctx { uint8_t peer_addr[ETH_ALEN]; uint32_t pincode; + uint32_t nik_lifetime_sec; esp_nan_pairing_key_installed_cb_t pairing_key_installed_cb; }; @@ -1580,6 +1583,7 @@ static void nan_pasn_auth_eloop_cb(void *eloop_ctx, void *user_data) esp_nan_app_set_pasn_data(pd); pd->pairing_key_installed_cb = ctx->pairing_key_installed_cb; + pd->nik_lifetime_sec = ctx->nik_lifetime_sec; if (ctx->pincode != UINT32_MAX) { n = os_snprintf(pin_digits, sizeof(pin_digits), "%06u", @@ -1610,6 +1614,7 @@ static void nan_pasn_auth_eloop_cb(void *eloop_ctx, void *user_data) } int esp_nan_supp_pasn_initiator_auth(const uint8_t *peer_nmi, uint32_t pincode, + uint32_t nik_lifetime_sec, esp_nan_pairing_key_installed_cb_t pairing_key_installed_cb) { struct nan_pasn_eloop_ctx *ctx; @@ -1621,6 +1626,7 @@ int esp_nan_supp_pasn_initiator_auth(const uint8_t *peer_nmi, uint32_t pincode, os_memcpy(ctx->peer_addr, peer_nmi, ETH_ALEN); ctx->pincode = pincode; + ctx->nik_lifetime_sec = nik_lifetime_sec; ctx->pairing_key_installed_cb = pairing_key_installed_cb; if (eloop_register_timeout(0, 0, nan_pasn_auth_eloop_cb, NULL, ctx) != 0) { @@ -1773,6 +1779,7 @@ fail: struct pasn_responder_eloop_ctx { uint8_t peer_addr[ETH_ALEN]; uint32_t pincode; + uint32_t nik_lifetime_sec; esp_nan_pairing_key_installed_cb_t pairing_key_installed_cb; }; @@ -1789,12 +1796,14 @@ static void pasn_responder_init_eloop_cb(void *eloop_ctx, void *user_data) pd = esp_nan_app_get_pasn_data(); if (pd) { pd->pairing_key_installed_cb = ctx->pairing_key_installed_cb; + pd->nik_lifetime_sec = ctx->nik_lifetime_sec; } } os_free(ctx); } int esp_nan_supp_pasn_responder_init(const uint8_t *peer_nmi, uint32_t pincode, + uint32_t nik_lifetime_sec, esp_nan_pairing_key_installed_cb_t pairing_key_installed_cb) { struct pasn_responder_eloop_ctx *ctx; @@ -1805,6 +1814,7 @@ int esp_nan_supp_pasn_responder_init(const uint8_t *peer_nmi, uint32_t pincode, } ctx->pincode = pincode; + ctx->nik_lifetime_sec = nik_lifetime_sec; os_memcpy(ctx->peer_addr, peer_nmi, ETH_ALEN); ctx->pairing_key_installed_cb = pairing_key_installed_cb; diff --git a/components/wpa_supplicant/esp_supplicant/src/esp_wifi_driver.h b/components/wpa_supplicant/esp_supplicant/src/esp_wifi_driver.h index 35e5e93a3ba..59fd3c62d98 100644 --- a/components/wpa_supplicant/esp_supplicant/src/esp_wifi_driver.h +++ b/components/wpa_supplicant/esp_supplicant/src/esp_wifi_driver.h @@ -334,6 +334,6 @@ void esp_wifi_ap_set_group_mgmt_cipher_internal(wifi_cipher_type_t cipher); uint8_t esp_wifi_op_class_supported_internal(uint8_t op_class, uint8_t min_chan, uint8_t max_chan, uint8_t inc, uint8_t bw, channel_bitmap_t *non_pref_channels); bool esp_wifi_is_wpa3_compatible_mode_enabled(uint8_t if_index); uint8_t esp_wifi_ap_get_owe_config_internal(void); -esp_err_t esp_nan_disable_pairing(void); +esp_err_t esp_nan_disable_pairing(uint8_t svc_id); #endif /* _ESP_WIFI_DRIVER_H_ */