From b3512ccf7d01cdd278901f0ae0a9f7b101932523 Mon Sep 17 00:00:00 2001 From: Sarvesh Bodakhe Date: Sun, 17 May 2026 06:49:28 +0530 Subject: [PATCH] change(wifi): NAN security_cfg as pointer security_cfg in wifi_nan_publish_cfg_t / wifi_nan_subscribe_cfg_t is a large struct; pass it by pointer so callers don't bloat their cfg copy. Driver deep-copies during publish/subscribe, so caller may free right after the API returns. Add NULL-check when security_reqd is set. Update both example apps to declare a local security_cfg and assign its address. Add help text on EXAMPLE_NAN_SECURITY_ENABLED. --- .../esp_wifi/include/esp_wifi_types_generic.h | 8 +++-- .../include/injected/esp_wifi_types_generic.h | 8 +++-- .../esp_wifi/wifi_apps/nan_app/src/nan_app.c | 36 +++++++++++-------- .../nan_publisher/main/Kconfig.projbuild | 6 ++++ .../nan_publisher/main/publisher_main.c | 35 +++++++++--------- .../nan_subscriber/main/Kconfig.projbuild | 6 ++++ .../nan_subscriber/main/subscriber_main.c | 35 +++++++++--------- 7 files changed, 84 insertions(+), 50 deletions(-) diff --git a/components/esp_wifi/include/esp_wifi_types_generic.h b/components/esp_wifi/include/esp_wifi_types_generic.h index 73af06265f8..4e7055fe36b 100644 --- a/components/esp_wifi/include/esp_wifi_types_generic.h +++ b/components/esp_wifi/include/esp_wifi_types_generic.h @@ -1014,7 +1014,9 @@ typedef struct { unsigned int ttl; /**< Run publish function for a given time interval in seconds. If ttl=0 and usd_discovery_flag is enabled, only one Publish message is transmitted */ wifi_nan_usd_config_t usd_publish_config; /**< USD configuration parameters. Relevant only when 'usd_discovery_flag' is set. */ - wifi_nan_discovery_security_params_t security_cfg; /**< Security configuration parameters */ + wifi_nan_discovery_security_params_t *security_cfg; /**< Security configuration parameters. Used when security_reqd is set, NULL otherwise. + The driver makes a private copy during esp_wifi_nan_publish_service(); + the caller may free this immediately after the call returns. */ nan_vendor_ie_t *vendor_ie; /**< Vendor specific IE to be added in publish frames */ } wifi_nan_publish_cfg_t; @@ -1038,7 +1040,9 @@ typedef struct { unsigned int ttl; /**< Run subscribe function for a given time interval in seconds. If ttl=0 and usd_discovery_flag is enabled, the subscriber listens until the first service match is reported. */ wifi_nan_usd_config_t usd_subscribe_config; /**< USD configuration parameters. Relevant only when 'usd_discovery_flag' is set. */ - wifi_nan_discovery_security_params_t security_cfg; /**< Security configuration parameters */ + wifi_nan_discovery_security_params_t *security_cfg; /**< Security configuration parameters. Used when security_reqd is set, NULL otherwise. + The driver makes a private copy during esp_wifi_nan_subscribe_service(); + the caller may free this immediately after the call returns. */ nan_vendor_ie_t *vendor_ie; /**< Vendor specific IE to be added in subscribe frames */ } wifi_nan_subscribe_cfg_t; diff --git a/components/esp_wifi/remote/include/injected/esp_wifi_types_generic.h b/components/esp_wifi/remote/include/injected/esp_wifi_types_generic.h index e020d0a79cf..5c934cc9659 100644 --- a/components/esp_wifi/remote/include/injected/esp_wifi_types_generic.h +++ b/components/esp_wifi/remote/include/injected/esp_wifi_types_generic.h @@ -1014,7 +1014,9 @@ typedef struct { unsigned int ttl; /**< Run publish function for a given time interval in seconds. If ttl=0 and usd_discovery_flag is enabled, only one Publish message is transmitted */ wifi_nan_usd_config_t usd_publish_config; /**< USD configuration parameters. Relevant only when 'usd_discovery_flag' is set. */ - wifi_nan_discovery_security_params_t security_cfg; /**< Security configuration parameters */ + wifi_nan_discovery_security_params_t *security_cfg; /**< Security configuration parameters. Used when security_reqd is set, NULL otherwise. + The driver makes a private copy during esp_wifi_nan_publish_service(); + the caller may free this immediately after the call returns. */ nan_vendor_ie_t *vendor_ie; /**< Vendor specific IE to be added in publish frames */ } wifi_nan_publish_cfg_t; @@ -1038,7 +1040,9 @@ typedef struct { unsigned int ttl; /**< Run subscribe function for a given time interval in seconds. If ttl=0 and usd_discovery_flag is enabled, the subscriber listens until the first service match is reported. */ wifi_nan_usd_config_t usd_subscribe_config; /**< USD configuration parameters. Relevant only when 'usd_discovery_flag' is set. */ - wifi_nan_discovery_security_params_t security_cfg; /**< Security configuration parameters */ + wifi_nan_discovery_security_params_t *security_cfg; /**< Security configuration parameters. Used when security_reqd is set, NULL otherwise. + The driver makes a private copy during esp_wifi_nan_subscribe_service(); + the caller may free this immediately after the call returns. */ nan_vendor_ie_t *vendor_ie; /**< Vendor specific IE to be added in subscribe frames */ } wifi_nan_subscribe_cfg_t; diff --git a/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c b/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c index 2ba982c12ee..ab6f4765605 100644 --- a/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c +++ b/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c @@ -1416,15 +1416,19 @@ uint8_t esp_wifi_nan_publish_service(const wifi_nan_publish_cfg_t *publish_cfg) ESP_LOGE(TAG, "Encrypted datapath not enabled (CONFIG_ESP_WIFI_NAN_SECURITY)"); goto fail; #else - if (publish_cfg->security_cfg.num_credentials == 0 || - publish_cfg->security_cfg.num_credentials > ESP_WIFI_NAN_MAX_CREDS_PER_SVC) { + if (!publish_cfg->security_cfg) { + ESP_LOGE(TAG, "security_reqd set but security_cfg is NULL"); + goto fail; + } + if (publish_cfg->security_cfg->num_credentials == 0 || + publish_cfg->security_cfg->num_credentials > ESP_WIFI_NAN_MAX_CREDS_PER_SVC) { ESP_LOGE(TAG, "security_cfg.num_credentials=%u must be 1..%u", - publish_cfg->security_cfg.num_credentials, + publish_cfg->security_cfg->num_credentials, ESP_WIFI_NAN_MAX_CREDS_PER_SVC); goto fail; } - for (uint8_t i = 0; i < publish_cfg->security_cfg.num_credentials; i++) { - uint8_t csid = publish_cfg->security_cfg.creds[i].csid; + for (uint8_t i = 0; i < publish_cfg->security_cfg->num_credentials; i++) { + uint8_t csid = publish_cfg->security_cfg->creds[i].csid; if (csid != WIFI_NAN_CSID_NCS_SK_128) { ESP_LOGE(TAG, "creds[%u].csid=%u unsupported (only NCS-SK-128)", i, csid); goto fail; @@ -1449,7 +1453,7 @@ uint8_t esp_wifi_nan_publish_service(const wifi_nan_publish_cfg_t *publish_cfg) * tripping the task watchdog when num_credentials > 1. */ if (!nan_claim_own_svc_slot(ESP_NAN_PUBLISH, publish_cfg->service_name, #ifdef CONFIG_ESP_WIFI_NAN_SECURITY - &cfg->security_cfg + cfg->security_cfg #else NULL #endif @@ -1520,7 +1524,7 @@ uint8_t esp_wifi_nan_subscribe_service(const wifi_nan_subscribe_cfg_t *subscribe subscribe_cfg->service_name, sub_id); #ifdef CONFIG_ESP_WIFI_NAN_SECURITY nan_security_cache_subscriber_params(subscribe_cfg->service_name, - &subscribe_cfg->security_cfg); + subscribe_cfg->security_cfg); #endif return sub_id; } @@ -1532,15 +1536,19 @@ uint8_t esp_wifi_nan_subscribe_service(const wifi_nan_subscribe_cfg_t *subscribe ESP_LOGE(TAG, "Encrypted datapath not enabled (CONFIG_ESP_WIFI_NAN_SECURITY)"); return 0; #else - if (subscribe_cfg->security_cfg.num_credentials == 0 || - subscribe_cfg->security_cfg.num_credentials > ESP_WIFI_NAN_MAX_CREDS_PER_SVC) { + if (!subscribe_cfg->security_cfg) { + ESP_LOGE(TAG, "security_reqd set but security_cfg is NULL"); + return 0; + } + if (subscribe_cfg->security_cfg->num_credentials == 0 || + subscribe_cfg->security_cfg->num_credentials > ESP_WIFI_NAN_MAX_CREDS_PER_SVC) { ESP_LOGE(TAG, "security_cfg.num_credentials=%u must be 1..%u", - subscribe_cfg->security_cfg.num_credentials, + subscribe_cfg->security_cfg->num_credentials, ESP_WIFI_NAN_MAX_CREDS_PER_SVC); return 0; } - for (uint8_t i = 0; i < subscribe_cfg->security_cfg.num_credentials; i++) { - uint8_t csid = subscribe_cfg->security_cfg.creds[i].csid; + for (uint8_t i = 0; i < subscribe_cfg->security_cfg->num_credentials; i++) { + uint8_t csid = subscribe_cfg->security_cfg->creds[i].csid; if (csid != WIFI_NAN_CSID_NCS_SK_128) { ESP_LOGE(TAG, "creds[%u].csid=%u unsupported (only NCS-SK-128)", i, csid); return 0; @@ -1566,7 +1574,7 @@ uint8_t esp_wifi_nan_subscribe_service(const wifi_nan_subscribe_cfg_t *subscribe /* Pre-claim host slot BEFORE the blob's subscribe call; see comment on * the publish path for the watchdog rationale. */ if (!nan_claim_own_svc_slot(ESP_NAN_SUBSCRIBE, subscribe_cfg->service_name, - &subscribe_cfg->security_cfg)) { + subscribe_cfg->security_cfg)) { ESP_LOGE(TAG, "No free service slot"); goto fail; } @@ -1580,7 +1588,7 @@ uint8_t esp_wifi_nan_subscribe_service(const wifi_nan_subscribe_cfg_t *subscribe ESP_LOGI(TAG, "Started Subscribing to %s [Service ID - %u]", subscribe_cfg->service_name, sub_id); nan_finalize_own_svc(subscribe_cfg->service_name, (uint8_t) sub_id, false); #ifdef CONFIG_ESP_WIFI_NAN_SECURITY - nan_security_cache_subscriber_params(subscribe_cfg->service_name, &subscribe_cfg->security_cfg); + nan_security_cache_subscriber_params(subscribe_cfg->service_name, subscribe_cfg->security_cfg); #endif NAN_DATA_UNLOCK(); diff --git a/examples/wifi/wifi_aware/nan_publisher/main/Kconfig.projbuild b/examples/wifi/wifi_aware/nan_publisher/main/Kconfig.projbuild index 55dd37874c5..b336577c920 100644 --- a/examples/wifi/wifi_aware/nan_publisher/main/Kconfig.projbuild +++ b/examples/wifi/wifi_aware/nan_publisher/main/Kconfig.projbuild @@ -28,6 +28,12 @@ menu "Example Configuration" bool "Enable NAN Security" depends on ESP_WIFI_NAN_SECURITY default y + help + Enable encrypted NAN datapath (NDP Security) for this example. + When enabled the publisher advertises a secured service and + accepts only encrypted NDP setups from subscribers that share + the same credential (passphrase or PMK). + Disable to advertise an open (unencrypted) service. choice EXAMPLE_NAN_SECURITY_METHOD prompt "Security Method" diff --git a/examples/wifi/wifi_aware/nan_publisher/main/publisher_main.c b/examples/wifi/wifi_aware/nan_publisher/main/publisher_main.c index 56c6995b5d2..47be5ab4c0b 100644 --- a/examples/wifi/wifi_aware/nan_publisher/main/publisher_main.c +++ b/examples/wifi/wifi_aware/nan_publisher/main/publisher_main.c @@ -129,25 +129,28 @@ void wifi_nan_publish(void) .datapath_reqd = 1, #ifdef CONFIG_EXAMPLE_NAN_SECURITY_ENABLED .security_reqd = 1, - .security_cfg = { - .num_credentials = 1, - .creds = { - { - .csid = WIFI_NAN_CSID_NCS_SK_128, -#ifdef CONFIG_EXAMPLE_NAN_SEC_METHOD_PMK - .use_pmk = true, -#else - .use_pmk = false, - .passphrase = CONFIG_EXAMPLE_NAN_PASSPHRASE, -#endif - }, - }, - }, #endif }; +#ifdef CONFIG_EXAMPLE_NAN_SECURITY_ENABLED + wifi_nan_discovery_security_params_t security_cfg = { + .num_credentials = 1, + .creds = { + { + .csid = WIFI_NAN_CSID_NCS_SK_128, +#ifdef CONFIG_EXAMPLE_NAN_SEC_METHOD_PMK + .use_pmk = true, +#else + .use_pmk = false, + .passphrase = CONFIG_EXAMPLE_NAN_PASSPHRASE, +#endif + }, + }, + }; + publish_cfg.security_cfg = &security_cfg; +#endif #if defined(CONFIG_EXAMPLE_NAN_SECURITY_ENABLED) && defined(CONFIG_EXAMPLE_NAN_SEC_METHOD_PMK) - if (!decode_hex_string(CONFIG_EXAMPLE_NAN_PMK, publish_cfg.security_cfg.creds[0].pmk, - sizeof(publish_cfg.security_cfg.creds[0].pmk))) { + if (!decode_hex_string(CONFIG_EXAMPLE_NAN_PMK, security_cfg.creds[0].pmk, + sizeof(security_cfg.creds[0].pmk))) { ESP_LOGE(TAG, "Failed to decode CONFIG_EXAMPLE_NAN_PMK"); return; } diff --git a/examples/wifi/wifi_aware/nan_subscriber/main/Kconfig.projbuild b/examples/wifi/wifi_aware/nan_subscriber/main/Kconfig.projbuild index be176366843..36c87d4eaa7 100644 --- a/examples/wifi/wifi_aware/nan_subscriber/main/Kconfig.projbuild +++ b/examples/wifi/wifi_aware/nan_subscriber/main/Kconfig.projbuild @@ -38,6 +38,12 @@ menu "Example Configuration" bool "Enable NAN Security" depends on ESP_WIFI_NAN_SECURITY default y + help + Enable encrypted NAN datapath (NDP Security) for this example. + When enabled the subscriber only matches secured Publish SDFs + whose PMKID is derivable from the credential configured below + (passphrase or PMK) and sets up an encrypted NDP. + Disable to discover open (unencrypted) services. choice EXAMPLE_NAN_SECURITY_METHOD prompt "Security Method" diff --git a/examples/wifi/wifi_aware/nan_subscriber/main/subscriber_main.c b/examples/wifi/wifi_aware/nan_subscriber/main/subscriber_main.c index 9b6d4fcf81b..870cc0e7cc9 100644 --- a/examples/wifi/wifi_aware/nan_subscriber/main/subscriber_main.c +++ b/examples/wifi/wifi_aware/nan_subscriber/main/subscriber_main.c @@ -223,25 +223,28 @@ void wifi_nan_subscribe(void) .single_match_event = 1, #ifdef CONFIG_EXAMPLE_NAN_SECURITY_ENABLED .security_reqd = 1, - .security_cfg = { - .num_credentials = 1, - .creds = { - { - .csid = WIFI_NAN_CSID_NCS_SK_128, -#ifdef CONFIG_EXAMPLE_NAN_SEC_METHOD_PMK - .use_pmk = true, -#else - .use_pmk = false, - .passphrase = CONFIG_EXAMPLE_NAN_PASSPHRASE, -#endif - }, - }, - }, #endif }; +#ifdef CONFIG_EXAMPLE_NAN_SECURITY_ENABLED + wifi_nan_discovery_security_params_t security_cfg = { + .num_credentials = 1, + .creds = { + { + .csid = WIFI_NAN_CSID_NCS_SK_128, +#ifdef CONFIG_EXAMPLE_NAN_SEC_METHOD_PMK + .use_pmk = true, +#else + .use_pmk = false, + .passphrase = CONFIG_EXAMPLE_NAN_PASSPHRASE, +#endif + }, + }, + }; + subscribe_cfg.security_cfg = &security_cfg; +#endif #if defined(CONFIG_EXAMPLE_NAN_SECURITY_ENABLED) && defined(CONFIG_EXAMPLE_NAN_SEC_METHOD_PMK) - if (!decode_hex_string(CONFIG_EXAMPLE_NAN_PMK, subscribe_cfg.security_cfg.creds[0].pmk, - sizeof(subscribe_cfg.security_cfg.creds[0].pmk))) { + if (!decode_hex_string(CONFIG_EXAMPLE_NAN_PMK, security_cfg.creds[0].pmk, + sizeof(security_cfg.creds[0].pmk))) { ESP_LOGE(TAG, "Failed to decode CONFIG_EXAMPLE_NAN_PMK"); return; }