With TLS v1.3, the Finished message from the client can require
fragmentation. Postpone key derivation and marking of the EAP session
fully completed until all the fragments of that last message are sent to
avoid losing all the subsequent fragments.
Signed-off-by: Jouni Malinen <j@w1.fi>
This adds support for optional functionality to validate server
certificate chain in TLS-based EAP methods in an external program.
wpa_supplicant control interface is used to indicate when such
validation is needed and what the result of the external validation is.
This external validation can extend or replace the internal validation.
When ca_cert or ca_path parameter is set, the internal validation is
used. If these parameters are omitted, only the external validation is
used. It needs to be understood that leaving those parameters out will
disable most of the validation steps done with the TLS library and that
configuration is not really recommend.
By default, the external validation is not used. It can be enabled by
addingtls_ext_cert_check=1 into the network profile phase1 parameter.
When enabled, external validation is required through the CTRL-REQ/RSP
mechanism similarly to other EAP authentication parameters through the
control interface.
The request to perform external validation is indicated by the following
event:
CTRL-REQ-EXT_CERT_CHECK-<id>:External server certificate validation needed for SSID <ssid>
Before that event, the server certificate chain is provided with the
CTRL-EVENT-EAP-PEER-CERT events that include the cert=<hexdump>
parameter. depth=# indicates which certificate is in question (0 for the
server certificate, 1 for its issues, and so on).
The result of the external validation is provided with the following
command:
CTRL-RSP-EXT_CERT_CHECK-<id>:<good|bad>
It should be noted that this is currently enabled only for OpenSSL (and
BoringSSL/LibreSSL). Due to the constraints in the library API, the
validation result from external processing cannot be reported cleanly
with TLS alert. In other words, if the external validation reject the
server certificate chain, the pending TLS handshake is terminated
without sending more messages to the server.
Signed-off-by: Jouni Malinen <j@w1.fi>
Fix issues with DPP stop listen and DPP auth data deinit
Closes WIFIBUG-443, WIFIBUG-442, WIFIBUG-421, and WIFIBUG-423
See merge request espressif/esp-idf!29404
- move .tbss to NOLOAD section
- remove xtensa-specific entities from riscv scripts
- explicit eh_frame terminator instead of "align magic"
- 80 characters line length limit
- refactor comments
- discard .rela sections (the rela data will go to relates sections)
fix(i2c_master): Fix issue that initialize esp32 fails and using i2c_master_probe issue IF NO PULL-UP ON PINS. And add nack check
Closes IDFGH-11838, IDFGH-13142, and IDFGH-13398
See merge request espressif/esp-idf!29667
Enable FTM Responder mode for ESP32C6. Update wifi libs with below -
1. Break FTM State Machine code into separate functions
2. Use dynamic allocation for FTM session to save memory
3. Add API to get FTM report instead of event based mechanism
4. Add FTM Request retry and comeback support
Closes https://github.com/espressif/esp-idf/issues/6810
fix(wpa_supplicant): Avoid dereferencing a dangling function pointer in WPS
Closes WIFI-6373, WIFIBUG-301, and WIFIBUG-163
See merge request espressif/esp-idf!28521
1. mem_burst_length register field correction
2. remove dma buffer addr range restriction
3. M2M periph sel ID no need to be identical for TX and RX channels
4. correct rx descriptor owner field auto clear
5. remove fsm idle assertion for ERR_EOF
This commit rewrite the 'usb_wrap_ll.h' API as follows:
- All APIs renamed from 'usb_fsls_phy_ll_...()' to 'usb_wrap_ll_...()'
- APIs now match their equivalent counter parts in 'usb_serial_jtag_ll.h'
For targets that only contain a USJ peripheral (and not a DWC OTG), their
'usb_fsls_phy_ll.h' headers only contain a single function
('usb_fsls_phy_ll_int_jtag_enable()') whose feature is already covered by
functions in 'usb_serial_jtag_ll.h'. Thus, this header is redundant.
This commit does the following:
- Remove 'usb_fsls_phy_ll.h' for targets that only contain a USJ peripheral
- Rename 'usb_fsls_phy_[hal|ll].[h|c]' to `usb_wrap_[hal|ll].[h|c]` for targets
that contain a DWC OTG peripheral. This better reflects the underlying peripheral
that the LL header accesses.
Make sure that WPS registrar public APIs do not modify supplicant
data in application task context. Execute API functionlity in eloop
context to prevent protential race conditions.
Avoid dereferencing a dangling function pointer in 'eap_server_sm_deinit()'.
This issue arises when hostap unregisteres EAP methods before it removes
the server state machine for station.
