On the Linux port, tasks are pthreads that cannot be forcibly paused;
the scheduler "unschedules" a task only by selecting a different next
task, and the outgoing task keeps running until it next blocks itself
in event_wait (e.g. via vPortYield). If the scheduler later switches
back into such a task (event_signal) before it ever parked in
event_wait, that wake is never consumed and event_triggered stays
latched. The task's next voluntary block then returns immediately
instead of blocking (e.g. vTaskDelay(100ms) returning in 0ms), which
desynchronizes kernel and port scheduling state.
Clear the outgoing task's pending event when switching to a different
task, under s_port_mutex and atomically with the scheduling decision.
Any latched-but-unconsumed wake is stale at that point; a legitimate
wake can only be delivered later, once the scheduler selects the task
again as next_thread.
Add event_clear() to the wait_for_event helper to support this.
Verified: minimal repros (busy-wait with another ready task, and
pthread-blocked task) now measure 92-101 ms for vTaskDelay(100ms)
instead of 0 ms; linux_freertos kernel test app 18/18 pass; the
previously failing esp_linenoise host test suite passes 34/34.
In httpd_parse.c, cb_headers_complete() converted the HTTP parser's
content_length (uint64_t) to the request's content_len (size_t) via an
unsafe cast through (int). On a 32-bit size_t target a Content-Length
above 4 GiB silently truncated, enabling request smuggling where the
server and an upstream proxy disagree on the body length (CWE-681).
Reject any Content-Length above UINT32_MAX with 413 Content Too Large
before any handler runs. UINT32_MAX is the largest body length the
server can represent in size_t content_len on every target, so this is
the maximum the server can support; no configuration knob is needed.
Closes SEC-102
Closes SEC-229
Drop the internal assert in dac_continuous_enable() and call
dac_priv_enable_channel() directly, since the surrounding state
machine already guarantees the preconditions.
Co-authored-by: Cursor <cursoragent@cursor.com>
GCC 16 flags the volatile accumulator in the cache writeback loops even
though it is volatile, as it is only used to update itself. Drop the
accumulator and rely on the volatile-qualified psram pointer to keep
the cache-line reads from being optimized out.
GCC 16 raised the default level of -Wunused-but-set-variable and now
flags variables that are only used to update themselves. Remove the
'removed' counter in pmksa_cache_flush() (its only read was commented
out) and mark the EAP-FAST PAC entry counters as unused, since their
only read is inside wpa_printf(MSG_DEBUG, ...) which compiles to a
no-op when debug logging is disabled.
The six key-material hexdumps (ND-IGTK/BIGTK/TK/GTK and the peer IGTK/BIGTK)
kept a leftover '##' dev-grep marker on their tag string. Drop it; the
descriptive labels stay and the dumps remain at ESP_LOG_DEBUG.
- Tighten the own GTK Key ID guard from ">3" (which admitted 0 and 3) to
the spec range 1..2 (Wi-Fi Aware v4.0 §7.1.3.2).
- When the Encrypted-Key-Data bit is clear, ignore the Key Data instead of
parsing KDEs from the clear: group KDEs are only ever carried KEK-wrapped
(§7.1.3.5; 802.11-2020 §12.7.2). Also store the peer IPN/BIPN from the
IGTK/BIGTK KDEs for the BIP RX replay-counter seed.
The peer IGTK/BIGTK were installed with an all-zero seq, so the blob's BIP
RX replay counter started at 0 instead of the peer's advertised value. Store
the 6-octet IPN/BIPN from the IGTK/BIGTK KDE (the octets after the 2-byte
Key ID, per 802.11 Fig 12-42/12-47) into the NDL and pass them as the
install seq. The parser side of this lands with the group-KDE guards.
Rebuilt libs with NAN group-key (GTK/IGTK/BIGTK) support, matching the
nan_key_type_t and group-protection header updates so the MD5-checked
esp_wifi_driver.h and esp_wifi_types_generic.h verify.
Refresh stale/missing documentation now that the features are implemented:
- group_data_prot / group_mgmt_prot in wifi_nan_discovery_security_params_t
(esp_wifi_types_generic.h) and wifi_nan_security_params_t (esp_private/
wifi.h): describe GTKSA / IGTKSA+BIGTKSA instead of "not supported".
- CSID enum: document NCS-GTK-CCM-128 (set internally via group_data_prot,
not user-selectable) and NCS-PK-PASN-128 (NAN Pairing, via the Wi-Fi
Aware component).
- Drop "dummy" from the esp_nan_construct_nira() doc (it builds a real
NIRA) and a stale "IGTK/BIGTK are placeholders" comment.
The NAN key-type selectors are defined by the blob in esp_wifi_driver.h
(nan_key_type_t), which nan_i.h already includes. Add the group-integrity
key types NAN_KEY_ND_IGTK (3) and NAN_KEY_ND_BIGTK (4) there to match the
blob, and drop the duplicate host definitions from nan_i.h so a single
shared enum is used. Resolves the review request to declare these in
nan_key_type_t and avoids redefining the typedef.
Move the NAN_KEY_ND_TK/ND_GTK/NM_TK/ND_IGTK/ND_BIGTK selectors from #defines
into a nan_key_type_t enum, and finalize their doc wording (drop the
"provisional" note now that the IGTK/BIGTK values are verified against the
blob ABI). They are still passed to esp_wifi_set_nan_key_internal() as the
int key_flag argument, so no call-site or ABI change. Also tidy the
surrounding doc comments.
Replace the three NAN_KDE_OUI_RSN_* byte writes in nan_kde_put_hdr() with a
single nan_kde_rsn_oui[] array, and remove the now-unused NAN_KDE_OUI_RSN_*
byte macros and the never-used NAN_KDE_OUI_WFA_* byte macros. The combined
NAN_KDE_OUI_RSN / NAN_KDE_OUI_WFA (used by the KDE parser) are kept.
Remove the dead commented-out ESP_LOGI debug prints flagged in review: the
"Sent Publish to Peer" line in nan_app.c, and the SCIA-construct,
CSIA-construct and CSIA-len-getter blocks in nan_security.c.
The NAN-started handler brought the netif up via esp_netif_action_connected()
using the NAN-started event's base/event_id/data. Feeding a "connected"
action from a "started" event and handing it an unrelated event payload is
fragile: it would misbehave if the action handler ever interpreted data
(which is not a wifi_event_sta_connected_t here).
esp_netif_up() is private to the esp_netif component, so keep the public
esp_netif_action_connected() but pass NULL base, 0 event_id, NULL data. This
is safe because the NAN netif is not a DHCP client: the handler only calls
esp_netif_up() and never reads the event args.
The MR had turned the active ESP_LOGD("GET SCIA LEN") into a commented-out
ESP_LOGI. Restore the original ESP_LOGD so the log stays live at DEBUG and
no dead commented code is left behind.
esp_nan_action_start() read group_mgmt_prot back from the blob via
esp_wifi_get_config() and defaulted to true when the read failed, which
force-enabled device-global IGTK/BIGTK (BIP beacons, forced GTKSA) on a
path where the user's intent is unknown. group_mgmt_prot is a pure
pass-through user flag, so capture it directly into s_nan_ctx from the
config in esp_wifi_nan_sync_start() (next to use_nvs_for_caching) and drop
the read-back and its ambiguous default. Behaviour now follows the user's
config exactly (default false via WIFI_NAN_SYNC_CONFIG_DEFAULT).
The default initializer explicitly sets every other bool field but omitted
the new group_mgmt_prot, leaving the intended default ambiguous. Set it to
false so the macro stays exhaustive; both example apps use it.
