- Forbid TKIP cipher suites for WPA3-Enterprise scan results
- Use reason 210 (NO_AP_FOUND_W_COMPATIBLE_SECURITY) when an AP is
found during a connecting scan but filtered out for incompatible
security
- Stop NAN timers from re-arming after esp_wifi_stop
failure_retry_cnt was being set after esp_wifi_set_config(), so the
retry count was never applied to the driver. Move it before the
set_config call so that WPS connection retries work as intended.
wifi_station_wps_start() calls esp_wifi_disconnect() to leave a
previously connected AP before scanning for WPS registrars. When the
STA is already connected, the async disconnect event triggers
wps_sm_notify_deauth() which incorrectly treats it as a handshake failure,
disabling WPS entirely.
Guard wps_handle_failure() so it only fires when wps_get_status() is
WPS_STATUS_PENDING, i.e. the STA has found a WPS AP and is actively
in the M1-M8 exchange.
In auth_sae_queue(), when wpa3_hostap_post_evt() fails, the queued
entry was left on the list and never freed. This leaks memory under
SAE commit floods or when the event queue is full.
Free the entry and remove it from the list on post failure.
- Fixes the authmode sent in WIFI_EVENT_STA_CONNECTED for WPA3-Enterprise, which
was previously taken directly from the AKM field. This caused incorrect values in some cases.
- Updates the "security" log to show the correct wifi_auth_mode_t.
- Fixes wrong authmode strength used in the connection path.
When a WPS handshake is already in progress and the enrollee sends another EAPOL-Start
(e.g., due to missed packets or timeout), the registrar resets its state by calling
'eap_wsc_reset()'. This function frees 'sm->eap_method_priv' and then calls
'esp_wifi_ap_wps_disable()', which internally triggers another call to 'eap_wsc_reset()'.
This results in a double reset where the second invocation accesses the already freed
'sm->eap_method_priv', leading to a crash.
This fix sets 'sm->eap_method_priv' to NULL immediately after freeing it to ensure
any subsequent calls to eap_wsc_reset() do not access an invalid pointer.
Ensure that NON-PMF station does not attemp connection retries when
'esp_wifi_disconnect()' is called before the 4-way-handshake completes,
even if 'failure_retry_cnt' allows retries.
This fixes the issue where station was not able connect using WPS if it was
already in connected state.
wifi_wps_scan_done() issues an esp_wifi_disconnect() before
calling esp_wifi_connect() to associate with the newly discovered AP. This
behavior incorrectly triggered a failure event (WIFI_EVENT_STA_WPS_ER_FAILED)
even though the disconnection was part of the normal WPS flow. This commit
prevents sending the false failure event, ensuring expected WPS behavior.
This event is triggered when external station tries connecting to softAP
with wrong password.
Currently supported softAP AUTH modes: WPA-PSK, WPA2-PSK and WPA3-PSK (SAE-auth)
- Fix wrong reason code reported when softAP issues a disconnect for station
- Fix wrong reason code reported when association timeout happens at station
- Deprecate enums WIFI_REASON_ASSOC_EXPIRE, WIFI_REASON_NOT_AUTHED, WIFI_REASON_NOT_ASSOCED
and use WIFI_REASON_DISASSOC_DUE_TO_INACTIVITY,
WIFI_REASON_CLASS2_FRAME_FROM_NONAUTH_STA,
WIFI_REASON_CLASS3_FRAME_FROM_NONASSOC_STA respectively
- Update wifi documentation related to reason codes
Add support to recognize APs supporting 'WPA3-Enterprise-Only Mode' and
'WPA3-Enterprise-Transition Mode' using authmodes WIFI_AUTH_WPA3_ENTERPRISE
and WIFI_AUTH_WPA2_WPA3_ENTERPRISE, respectively.
When registrar somehow misses the WSC_DONE sent by station and station
goes for next connection after sending deauth, make sure that softAP
disables the registrar.
- Ensure that wpa_supplicant's state machine registers the requirement for rsnxe
before deciding to add rsnxe to a assoc request.
Co-authored-by: jgujarathi <jash.gujarathi@espressif.com>
Add back above authmodes instead of removing and merging them with WIFI_AUTH_WPA3_PSK
in minor releases during v5.x.
These authmodes will be removed from v6.0
1. Fix wrong reason code in 'WIFI_EVENT_AP_STADISCONNECTED' event
2. cleanup in softAP for disconnecting connected station
3. Update examples to display reason while processing WIFI_EVENT_AP_STADISCONNECTED event
- Avoid downgrading TLS ciphersuites when client RSA keys are larger than RSA-2048 bit.
- Note that when using bigger certificates on low-power chips without crypto
hardware acceleration, it is recommended to adjust the task watchdog timer (TWDT)
if it is enabled. For precise information on timing requirements, you can check
performance numbers at https://github.com/espressif/mbedtls/wiki/Performance-Numbers.
In TLS v1.2, It was possible to disable server certificate validation simply by using
API 'mbedtls_ssl_conf_authmode'. But this behaviour is changed in TLS v1.3. We can not
disable server certificate validation in TLS v1.3 using this API anymore.
For more details, refer https://github.com/Mbed-TLS/mbedtls/issues/7075
Make sure that WPS registrar public APIs do not modify supplicant
data in application task context. Execute API functionlity in eloop
context to prevent protential race conditions.
Avoid dereferencing a dangling function pointer in 'eap_server_sm_deinit()'.
This issue arises when hostap unregisteres EAP methods before it removes
the server state machine for station.
- Updated WiFi libraries based on the IDF changes
- Renamed esp_wifi_native.h to esp_wifi_types_native.h
- Reverted forward declarations of native wifi types and HE types
- Forward declare as opaque structs only if we don't have native types (csi and ctrl_packet types)
- Add support for WPA3 + WPA3_EXT_PSK mixed mode
- Improvements in scan and connect path as per specifications along with
minor bugfixes
- When AP advertises all PSK modes (WPA, WPA2 and WPA3), make sure that
station treats it as WPA2_WPA3_PSK mixed mode.
Closes https://github.com/espressif/esp-idf/issues/12517
1) Add parameter to configure reason code of deauth frame
2) Add logs to indicate MIC failure 4-Way-Handshake
3) Process RSNXE capabilities only if AP advertises them
Executing supplicant WIFI_EVENT_STA_CONNECTED and WIFI_EVENT_STA_DISCONNECTED handlers in event-handler context can lead to concurrency issues.
Moving the functionality into 'wpa_sta_connected_cb' and 'wpa_sta_disconnected_cb' callbacks and execute in ppTask context.
1) station: send deauth while going from assoc to init, if reason is assoc timeout
2) softAP pmf: do not drop open deauth/disassoc if keys are not generated
3) softAP pmf: improvements in SA query handling
Update wifi libs with below changes -
1. reject AP when assoc comeback time given is greater than 5 seconds
2. handle when assoc req is received before SA query procedure is finished
Closes https://github.com/espressif/esp-idf/issues/9428
Sarvesh Bodakhe
