Just a build issue fix depending on GCC5+ configuration, fixes:
assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
return discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
Signed-off-by: Richard Allen <richard@bryghtlabs.com>
In H2E (Hash-to-Element) mode, sae_parse_commit() parses the optional
Anti-Clogging Token Container by calling sae_parse_token_container().
However, callers of sae_parse_commit() that do not require retrieving
the anti-clogging token (such as PASN initiator/responder and SME auth)
pass NULL for the token and token_len output arguments.
If the peer sends a Commit frame containing a valid Anti-Clogging
Token Container element, sae_parse_token_container() unconditionally
sets *token and *token_len, resulting in a NULL pointer dereference
(SIGSEGV) and crashing wpa_supplicant.
Fix this by adding NULL checks before writing to token and token_len.
Update the debug log to print the token directly using 'pos'.
Fixes: 5e32fb0170f4 ("SAE: Use Anti-Clogging Token Container element with H2E")
Signed-off-by: Amarnath Hullur Subramanyam <amarnathhs@google.com>
When wpa_supplicant was processing EAPOL-Key msg 1/4 with a PMKID
indicated by the AP/Authenticator, a PMKSA for the same AA was accepted
without enforcing matching network_ctx (i.e., same network configuration
block) and AKMP. This could allow misbehaving APs to make wpa_supplicant
use an unacceptable PMKSA entry that was generated for a different
network for AKMP under certain conditions. This could result in showing
a connection to an incorrect network when an attacker has credentials to
one network in wpa_supplicant configuration, but not to another network.
Fix this by accepting the PMKID to set the PMKSA for an association only
if the PMKSA with the same PMKID is for the same network and was
generated using the same AKMP.
Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
The Wi-Fi task deletes itself when esp_wifi_deinit() is called, and FreeRTOS
only reclaims its TCB and stack from the idle task afterwards. Test apps that
read the heap right after deinit therefore see that memory as still allocated
and report a leak, most visibly as the eloop unit tests failing on ESP32.
Wait for the idle task at every point where a test deinitialises Wi-Fi
before a leak check, replacing the single-tick delays that only matched what
esp_wifi_deinit() already waits for internally.
(cherry picked from commit bff264775a)
1) Fix crash while connecting to dpp akm
2) Fix phy ref cnt for power management for offchannel_tx
3) Introduced a variable to indicate dpp ap for scan results
4) Introduced WIFI_AUTH_UNKNOWN for ap with misconfigured security parameters
Richard Allen
Jimi Chen
Jouni Malinen
Aditi
Sarvesh Bodakhe
Akshat Agrawal
Jiang Jiang Jian
Shreyas Sheth
Sajia
Kapil Gupta
Ashish Sharma
Nachiket Kukade
Fu Hanxi