Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/wpa_supplicant_upstream_security_issues_v6.0' into 'release/v6.0'

Browse Source 
esp_wifi: Port security issues from upstream supplicant (v6.0)

See merge request espressif/esp-idf!52675
This commit is contained in:
Jiang Jiang Jian
2026-09-15 12:03:35 +08:00
parent d27b57156f 0e59d78459
commit dc330a5273
6 changed files with 38 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
components/wpa_supplicant/src/common/sae.c
View File

@@ -1828,10 +1828,12 @@ static void sae_parse_token_container(struct sae_data *sae,
pos, end - pos);
if (!sae_is_token_container_elem(pos, end))
return;
*token = pos + 3;
*token_len = pos[1] - 1;
if (token)
*token = pos + 3;
if (token_len)
*token_len = pos[1] - 1;
wpa_hexdump(MSG_DEBUG, "SAE: Anti-Clogging Token (in container)",
*token, *token_len);
pos + 3, pos[1] - 1);
}

30
components/wpa_supplicant/src/rsn_supp/pmksa_cache.c
View File

@@ -136,6 +136,7 @@ pmksa_cache_add(struct rsn_pmksa_cache *pmksa, const u8 *pmk, size_t pmk_len,
entry->reauth_time = now.sec + dot11RSNAConfigPMKLifetime / 100 * dot11RSNAConfigPMKReauthThreshold;
entry->akmp = akmp;
os_memcpy(entry->aa, aa, ETH_ALEN);
os_memcpy(entry->spa, spa, ETH_ALEN);
entry->network_ctx = network_ctx;
return pmksa_cache_add_entry(pmksa, entry);
@@ -306,19 +307,23 @@ void pmksa_cache_deinit(struct rsn_pmksa_cache *pmksa)
* pmksa_cache_get - Fetch a PMKSA cache entry
* @pmksa: Pointer to PMKSA cache data from pmksa_cache_init()
* @aa: Authenticator address or %NULL to match any
* @spa: Supplicant address or %NULL to skip SPA matching (not recommended)
* @pmkid: PMKID or %NULL to match any
* @network_ctx: Network context or %NULL to match any
* Returns: Pointer to PMKSA cache entry or %NULL if no match was found
*/
struct rsn_pmksa_cache_entry * pmksa_cache_get(struct rsn_pmksa_cache *pmksa,
const u8 *aa, const u8 *pmkid,
const void *network_ctx)
const u8 *aa, const u8 *spa, const u8 *pmkid,
const void *network_ctx, int akmp)
{
struct rsn_pmksa_cache_entry *entry = pmksa->pmksa;
while (entry) {
if ((aa == NULL || os_memcmp(entry->aa, aa, ETH_ALEN) == 0) &&
(spa == NULL ||
os_memcmp(entry->spa, spa, ETH_ALEN) == 0) &&
(pmkid == NULL ||
os_memcmp(entry->pmkid, pmkid, PMKID_LEN) == 0) &&
(!akmp || akmp == entry->akmp) &&
(network_ctx == NULL || network_ctx == entry->network_ctx))
return entry;
entry = entry->next;
@@ -362,7 +367,7 @@ pmksa_cache_clone_entry(struct rsn_pmksa_cache *pmksa,
*/
struct rsn_pmksa_cache_entry *
pmksa_cache_get_opportunistic(struct rsn_pmksa_cache *pmksa, void *network_ctx,
const u8 *aa)
const u8 *aa, int akmp)
{
struct rsn_pmksa_cache_entry *entry = pmksa->pmksa;
@@ -370,7 +375,8 @@ pmksa_cache_get_opportunistic(struct rsn_pmksa_cache *pmksa, void *network_ctx,
if (network_ctx == NULL)
return NULL;
while (entry) {
if (entry->network_ctx == network_ctx) {
if (entry->network_ctx == network_ctx &&
(!akmp || akmp == entry->akmp)) {
entry = pmksa_cache_clone_entry(pmksa, entry, aa);
if (entry) {
wpa_printf(MSG_DEBUG, "RSN: added "
@@ -435,15 +441,15 @@ int pmksa_cache_set_current(struct wpa_sm *sm, const u8 *pmkid,
sm->cur_pmksa = NULL;
if (pmkid)
sm->cur_pmksa = pmksa_cache_get(pmksa, NULL, pmkid,
network_ctx);
sm->cur_pmksa = pmksa_cache_get(pmksa, NULL, sm->own_addr, pmkid,
network_ctx, sm->key_mgmt);
if (sm->cur_pmksa == NULL && bssid)
sm->cur_pmksa = pmksa_cache_get(pmksa, bssid, NULL,
network_ctx);
sm->cur_pmksa = pmksa_cache_get(pmksa, bssid, sm->own_addr, NULL,
network_ctx, sm->key_mgmt);
if (sm->cur_pmksa == NULL && try_opportunistic && bssid)
sm->cur_pmksa = pmksa_cache_get_opportunistic(pmksa,
network_ctx,
bssid);
bssid, sm->key_mgmt);
if (sm->cur_pmksa) {
wpa_hexdump(MSG_DEBUG, "RSN: PMKSA cache entry found - PMKID",
sm->cur_pmksa->pmkid, PMKID_LEN);
@@ -471,7 +477,7 @@ int pmksa_cache_list(struct rsn_pmksa_cache *pmksa, char *buf, size_t len)
struct rsn_pmksa_cache_entry *entry;
struct os_reltime now;
ret = os_snprintf(pos, buf + len - pos,
"Index / AA / PMKID / expiration (in seconds) / "
"Index / AA / SPA / PMKID / expiration (in seconds) / "
"opportunistic\n");
if (os_snprintf_error(buf + len - pos, ret))
return pos - buf;
@@ -481,8 +487,8 @@ int pmksa_cache_list(struct rsn_pmksa_cache *pmksa, char *buf, size_t len)
os_get_reltime(&now);
while (entry) {
i++;
ret = os_snprintf(pos, buf + len - pos, "%d " MACSTR " ",
i, MAC2STR(entry->aa));
ret = os_snprintf(pos, buf + len - pos, "%d " MACSTR " " MACSTR " ",
i, MAC2STR(entry->aa), MAC2STR(entry->spa));
if (os_snprintf_error(buf + len - pos, ret))
return pos - buf;
pos += ret;

12
components/wpa_supplicant/src/rsn_supp/pmksa_cache.h
View File

@@ -20,6 +20,8 @@ struct rsn_pmksa_cache_entry {
os_time_t expiration;
int akmp; /* WPA_KEY_MGMT_* */
u8 aa[ETH_ALEN];
/** Supplicant MAC (SPA) this PMKSA was created for; used when matching cache */
u8 spa[ETH_ALEN];
os_time_t reauth_time;
@@ -52,8 +54,8 @@ pmksa_cache_init(void (*free_cb)(struct rsn_pmksa_cache_entry *entry,
void *ctx, struct wpa_sm *sm);
void pmksa_cache_deinit(struct rsn_pmksa_cache *pmksa);
struct rsn_pmksa_cache_entry * pmksa_cache_get(struct rsn_pmksa_cache *pmksa,
const u8 *aa, const u8 *pmkid,
const void *network_ctx);
const u8 *aa, const u8 *spa, const u8 *pmkid,
const void *network_ctx, int akmp);
int pmksa_cache_list(struct rsn_pmksa_cache *pmksa, char *buf, size_t len);
struct rsn_pmksa_cache_entry *
pmksa_cache_add(struct rsn_pmksa_cache *pmksa, const u8 *pmk, size_t pmk_len,
@@ -69,7 +71,7 @@ int pmksa_cache_set_current(struct wpa_sm *sm, const u8 *pmkid,
int try_opportunistic);
struct rsn_pmksa_cache_entry *
pmksa_cache_get_opportunistic(struct rsn_pmksa_cache *pmksa,
void *network_ctx, const u8 *aa);
void *network_ctx, const u8 *aa, int akmp);
void pmksa_cache_flush(struct rsn_pmksa_cache *pmksa, void *network_ctx,
const u8 *pmk, size_t pmk_len);
@@ -88,8 +90,8 @@ static inline void pmksa_cache_deinit(struct rsn_pmksa_cache *pmksa)
}
static inline struct rsn_pmksa_cache_entry *
pmksa_cache_get(struct rsn_pmksa_cache *pmksa, const u8 *aa, const u8 *pmkid,
const void *network_ctx)
pmksa_cache_get(struct rsn_pmksa_cache *pmksa, const u8 *aa, const u8 *spa,
const u8 *pmkid, const void *network_ctx, int akmp)
{
return NULL;
}

10
components/wpa_supplicant/src/rsn_supp/wpa.c
View File

@@ -404,8 +404,8 @@ static int wpa_supplicant_get_pmk(struct wpa_sm *sm,
* not have enough time to get the association information
* event before receiving this 1/4 message, so try to find a
* matching PMKSA cache entry here. */
sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr, pmkid,
NULL);
sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr, sm->own_addr,
pmkid, sm->network_ctx, sm->key_mgmt);
if (sm->cur_pmksa) {
wpa_printf(MSG_DEBUG,
"RSN: found matching PMKID from PMKSA cache");
@@ -474,7 +474,8 @@ static int wpa_supplicant_get_pmk(struct wpa_sm *sm,
sm->network_ctx, sm->key_mgmt);
}
if (!sm->cur_pmksa && pmkid &&
pmksa_cache_get(sm->pmksa, src_addr, pmkid, NULL))
pmksa_cache_get(sm->pmksa, src_addr, sm->own_addr, pmkid,
sm->network_ctx, sm->key_mgmt))
{
wpa_printf( MSG_DEBUG,
"RSN: the new PMK matches with the "
@@ -2687,7 +2688,8 @@ int wpa_set_bss(uint8_t *macddr, uint8_t *bssid, uint8_t pairwise_cipher, uint8_
struct rsn_pmksa_cache_entry *pmksa = NULL;
if (use_pmk_cache) {
pmksa = pmksa_cache_get(sm->pmksa, (const u8 *)bssid, NULL, NULL);
pmksa = pmksa_cache_get(sm->pmksa, (const u8 *)bssid, sm->own_addr,
NULL, NULL, 0);
if (pmksa && (pmksa->akmp != sm->key_mgmt)) {
use_pmk_cache = false;
}

2
components/wpa_supplicant/src/tls/tlsv1_client.c
View File

@@ -614,7 +614,7 @@ int tlsv1_client_prf(struct tlsv1_client *conn, const char *label,
int tlsv1_client_get_cipher(struct tlsv1_client *conn, char *buf,
size_t buflen)
{
char *cipher;
const char *cipher;
switch (conn->rl.cipher_suite) {
case TLS_RSA_WITH_RC4_128_MD5:

2
components/wpa_supplicant/src/tls/x509v3.c
View File

@@ -459,7 +459,7 @@ int x509_parse_name(const u8 *buf, size_t len, struct x509_name *name,
}
static char * x509_name_attr_str(enum x509_name_attr_type type)
static const char * x509_name_attr_str(enum x509_name_attr_type type)
{
switch (type) {
case X509_NAME_ATTR_NOT_USED: