From faaaea8e67910ad2ceea56b938041430bca7baef Mon Sep 17 00:00:00 2001 From: Sarvesh Bodakhe Date: Mon, 6 Jul 2026 14:33:47 +0530 Subject: [PATCH] fix(wpa_supplicant): guard pbkdf2_sha256 for PSA-provided SHA-256 mbedtls 4.x is PSA-first: CONFIG_MBEDTLS_SHA256_C now maps to PSA_WANT_ALG_SHA_256, and on ESP targets the hardware SHA accelerator serves SHA-256 through PSA, leaving the legacy MBEDTLS_SHA256_C builtin macro undefined. The inner guard on pbkdf2_sha256 was gating on bare MBEDTLS_SHA256_C, so the function was compiled out and NAN ND-PMK derivation (nan_derive_nd_pmk_from_passphrase) failed to link. Guard on (MBEDTLS_SHA256_C || PSA_WANT_ALG_SHA_256) to match the idiom already used elsewhere in the supplicant mbedtls port (tls_mbedtls.c), covering both the legacy builtin and PSA-provided SHA-256. --- .../wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c index ff920feac5e..a8aa705bea3 100644 --- a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c +++ b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c @@ -1111,7 +1111,7 @@ int pbkdf2_sha1(const char *passphrase, const u8 *ssid, size_t ssid_len, #if defined(MBEDTLS_PKCS5_C) && defined(MBEDTLS_MD_C) #include "mbedtls/private/pkcs5.h" -#if defined(MBEDTLS_SHA256_C) +#if (defined(MBEDTLS_SHA256_C) || defined(PSA_WANT_ALG_SHA_256)) int pbkdf2_sha256(const char *passphrase, const u8 *salt, size_t salt_len, int iterations, u8 *buf, size_t buflen) { @@ -1128,7 +1128,7 @@ int pbkdf2_sha256(const char *passphrase, const u8 *salt, size_t salt_len, (unsigned int) iterations, (uint32_t) buflen, buf); return ret == 0 ? 0 : -1; } -#endif /* MBEDTLS_SHA256_C */ +#endif /* MBEDTLS_SHA256_C || PSA_WANT_ALG_SHA_256 */ #endif /* MBEDTLS_PKCS5_C && MBEDTLS_MD_C */