From 475bb48880b281b34a2cc096e1e9401ce4cf541c Mon Sep 17 00:00:00 2001 From: Shreyas Sheth Date: Thu, 23 Jul 2026 16:24:40 +0530 Subject: [PATCH] fix(esp_wifi): Harden dpp Auth confirm and drop mismatched auth confirms --- .../esp_supplicant/src/esp_dpp.c | 23 ++++++++++++++----- components/wpa_supplicant/src/common/dpp.c | 6 +++++ 2 files changed, 23 insertions(+), 6 deletions(-) diff --git a/components/wpa_supplicant/esp_supplicant/src/esp_dpp.c b/components/wpa_supplicant/esp_supplicant/src/esp_dpp.c index 395d803ff52..95b3cf95067 100644 --- a/components/wpa_supplicant/esp_supplicant/src/esp_dpp.c +++ b/components/wpa_supplicant/esp_supplicant/src/esp_dpp.c @@ -368,7 +368,12 @@ static int esp_dpp_rx_auth_conf(struct action_rx_param *rx_param, uint8_t *dpp_d if (os_memcmp(rx_param->sa, auth->peer_mac_addr, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "DPP: MAC address mismatch (expected " MACSTR ") - drop", MAC2STR(auth->peer_mac_addr)); - return ESP_ERR_DPP_FAILURE; + return ESP_OK; + } + + if (auth->auth_success || !auth->waiting_auth_conf) { + wpa_printf(MSG_DEBUG, "DPP: Not waiting for Auth Confirm - drop"); + return ESP_OK; } eloop_cancel_timeout(esp_dpp_auth_conf_wait_timeout, NULL, NULL); @@ -401,7 +406,8 @@ static esp_err_t esp_dpp_rx_peer_disc_resp(struct action_rx_param *rx_param) uint8_t *buf; if (!dc) { - return ESP_ERR_DPP_FAILURE; + wpa_printf(MSG_DEBUG, "DPP: No config store for Peer Discovery Response - drop"); + return ESP_OK; } const uint8_t *trans_id; uint16_t trans_id_len; @@ -414,6 +420,11 @@ static esp_err_t esp_dpp_rx_peer_disc_resp(struct action_rx_param *rx_param) return ESP_OK; } + if (s_dpp_ctx.peer_disc_resp_received) { + wpa_printf(MSG_DEBUG, "DPP: Peer Discovery Response already processed - drop"); + return ESP_OK; + } + wpa_printf(MSG_DEBUG, "DPP: Peer Discovery from " MACSTR, MAC2STR(rx_param->sa)); trans_id = dpp_get_attr(&buf[2], len, DPP_ATTR_TRANSACTION_ID, &trans_id_len); @@ -426,6 +437,10 @@ static esp_err_t esp_dpp_rx_peer_disc_resp(struct action_rx_param *rx_param) return ESP_OK; } + eloop_cancel_timeout(peer_disc_timeout, ELOOP_ALL_CTX, ELOOP_ALL_CTX); + eloop_cancel_timeout(esp_dpp_peer_disc_retry, NULL, NULL); + s_dpp_ctx.peer_disc_resp_received = true; + const uint8_t *status_val; uint16_t status_len; const uint8_t *peer_connector; @@ -461,10 +476,6 @@ static esp_err_t esp_dpp_rx_peer_disc_resp(struct action_rx_param *rx_param) goto out; } - /* peer_disc_timeout handles timeout in Enrollee role */ - eloop_cancel_timeout(peer_disc_timeout, NULL, s_dpp_ctx.dpp_auth); - s_dpp_ctx.peer_disc_resp_received = true; - if (!conf->connector || !conf->net_access_key || !conf->c_sign_key) { wpa_printf(MSG_ERROR, "DPP: Incomplete config for network introduction"); ret = ESP_ERR_DPP_FAILURE; diff --git a/components/wpa_supplicant/src/common/dpp.c b/components/wpa_supplicant/src/common/dpp.c index dd29fd523a5..5e316d9899a 100644 --- a/components/wpa_supplicant/src/common/dpp.c +++ b/components/wpa_supplicant/src/common/dpp.c @@ -2793,6 +2793,12 @@ int dpp_auth_conf_rx(struct dpp_authentication *auth, const u8 *hdr, return -1; } + if (!auth->waiting_auth_conf) { + wpa_printf(MSG_DEBUG, + "DPP: Not waiting for Auth Confirm - drop"); + return -1; + } + auth->waiting_auth_conf = 0; wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA,