From e5eaadfe900ba892a499f72add35f4c685559e08 Mon Sep 17 00:00:00 2001 From: Shreyas Sheth Date: Thu, 6 Aug 2026 15:59:41 +0530 Subject: [PATCH] fix(esp_wifi): Harden dpp Auth confirm and drop mismatched auth confirms --- components/esp_wifi/lib | 2 +- .../wpa_supplicant/esp_supplicant/src/esp_dpp.c | 15 +++++++++++++-- components/wpa_supplicant/src/common/dpp.c | 6 ++++++ 3 files changed, 20 insertions(+), 3 deletions(-) diff --git a/components/esp_wifi/lib b/components/esp_wifi/lib index 5ead154e5d8..9f5fd97aef6 160000 --- a/components/esp_wifi/lib +++ b/components/esp_wifi/lib @@ -1 +1 @@ -Subproject commit 5ead154e5d8a237dfbcd82ed75c2677f68b7d0bc +Subproject commit 9f5fd97aef6743a579e3b16ccdf8580d05bf0e09 diff --git a/components/wpa_supplicant/esp_supplicant/src/esp_dpp.c b/components/wpa_supplicant/esp_supplicant/src/esp_dpp.c index 5215231aea8..be751f8ba01 100644 --- a/components/wpa_supplicant/esp_supplicant/src/esp_dpp.c +++ b/components/wpa_supplicant/esp_supplicant/src/esp_dpp.c @@ -222,6 +222,7 @@ static void gas_query_req_tx(struct dpp_authentication *auth) esp_dpp_send_action_frame(auth->peer_mac_addr, wpabuf_head(buf), wpabuf_len(buf), auth->curr_chan, OFFCHAN_TX_WAIT_TIME, WIFI_OFFCHAN_TX_REQ); + wpabuf_free(buf); } static int esp_dpp_handle_config_obj(struct dpp_authentication *auth, @@ -291,8 +292,12 @@ static void esp_dpp_rx_auth_conf(struct action_rx_param *rx_param, uint8_t *dpp_ if (os_memcmp(rx_param->sa, auth->peer_mac_addr, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "DPP: MAC address mismatch (expected " MACSTR ") - drop", MAC2STR(auth->peer_mac_addr)); - rc = ESP_ERR_DPP_FAILURE; - goto fail; + return; + } + + if (auth->auth_success || !auth->waiting_auth_conf) { + wpa_printf(MSG_DEBUG, "DPP: Not waiting for Auth Confirm - drop"); + return; } eloop_cancel_timeout(esp_dpp_auth_conf_wait_timeout, NULL, NULL); @@ -333,6 +338,11 @@ static esp_err_t esp_dpp_rx_peer_disc_resp(struct action_rx_param *rx_param) return ESP_ERR_INVALID_ARG; } + if (!auth) { + wpa_printf(MSG_DEBUG, "DPP: No DPP Authentication in progress - drop"); + return ESP_OK; + } + if (rx_param->vendor_data_len < 2) { wpa_printf(MSG_INFO, "DPP: Too short vendor specific data"); return ESP_FAIL; @@ -1036,6 +1046,7 @@ esp_err_t esp_dpp_start_net_intro_protocol(uint8_t *bssid) wpabuf_free(buf); return ESP_FAIL; } + wpabuf_free(buf); } else { return ESP_ERR_NO_MEM; } diff --git a/components/wpa_supplicant/src/common/dpp.c b/components/wpa_supplicant/src/common/dpp.c index 2b248fe4147..e189b6d3cea 100644 --- a/components/wpa_supplicant/src/common/dpp.c +++ b/components/wpa_supplicant/src/common/dpp.c @@ -2698,6 +2698,12 @@ int dpp_auth_conf_rx(struct dpp_authentication *auth, const u8 *hdr, return -1; } + if (!auth->waiting_auth_conf) { + wpa_printf(MSG_DEBUG, + "DPP: Not waiting for Auth Confirm - drop"); + return -1; + } + auth->waiting_auth_conf = 0; wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA,