Commit Graph

95 Commits

Author SHA1 Message Date
zhangyanjiao
3acd9861bf wpa_supplicant: Use WPA3 flag to reduce code size
Flag ESP32_WIFI_ENABLE_WPA3_SAE from Menuconfig is used to
control the stack size required by WPA3. Use the same flag
to compile out the WPA3 code and control the code size.
With this flag disabled code footprint reduces by about 7.7kB
in libwpa_supplicant.a
Update WiFi libs with added checks to cleanly handle disabling
of WPA3 callbacks.
2020-12-22 15:50:52 +08:00
kapil.gupta
33c296b78e wpa_supplicant: Replace internal RSA APIs by mbedtls APIs
Curretly wpa_supplicant uses internal APIs for RSA operations
which internally uses lots of big num operations.

Big num operations are CPU expensive and can take a lot of time
which can cause watchdog timer to tigger.

This can be optimize by using mbedtls APIs which uses
hardware blocks for big num operations.

To fix this, write new crypto_mbedtls-rsa.c which has APIs
similar to crypto_internal-rsa.c but uses mbedtls APIs.
2020-12-22 15:37:38 +08:00
kapil.gupta
9fce81f9af esp_wifi: Update WiFi lib
1. Fixes the issue when PMF packets are not sent after mode change.
2. Add support for 802.1x sha256 auth key mode
2020-12-14 14:51:52 +08:00
Nachiket Kukade
2343aab4da wpa_supplicant: Increase PMK Lifetime to a very high value
For WPA3 connection nearing PMK lifetime expiry, PMK Cache
needs a re-authentication or the cache will expire. After
current expiry of 12 hours Station ends up sending a deauth
to the AP. An SAE re-authentication also cannot occur without
a disconnection with current implementation. So increase the
PMK lifetime to 100 days for now.
2020-11-09 15:40:08 +05:30
Nachiket Kukade
c59eb27698 esp_wifi: Update wifi lib
1. Add STA checks during STA PMF operations
2. Fix WPA2-Ent issue with Open AP
3. Skip WPA-TKIP profile if PMF is required
4. Skip & clear Supplicant PMK Cache with mismatching AP config
2020-10-26 15:55:54 +08:00
kapil.gupta
379624de53 esp_wifi: Add WPS Reason code in all failures 2020-10-21 17:09:36 +05:30
Jiang Jiang Jian
c4f4e15cc7 Merge branch 'cherry-pick-4dcaa0e6-3' into 'release/v4.2'
wpa_supplicant: Deinit wpa2 states in wifi deinit(backport v4.2)

See merge request espressif/esp-idf!10163
2020-09-15 12:06:49 +08:00
Nachiket Kukade
d17e6a75e0 espnow/pmf: Implement ESPNOW + PMF Co-existance
H/W decryption of Mgmt frames was disabled for PMF and done through
S/W. If ESPNOW packets go through this path, it affects backward
compatibility since method of decrypting Mgmt packets is different in H/W.

To address PMF + ESPNOW Co-existance, CCMP decryption method is modified
for ESPNOW packets so that they can be decrypted correctly. Since Tx
of ESPNOW packets can still be done in H/W alongside PMF, no change
required in encryption method in S/W.

Co-Authored-By: Nachiket Kukade <nachiket.kukade@espressif.com>
Co-Authored-By: zhangyanjiao <zhangyanjiao@espressif.com>
Co-Authored-By: kapil.gupta <kapil.gupta@espressif.com>
2020-09-02 15:06:51 +08:00
Jiang Jiang Jian
e050feeb26 Merge branch 'bugfix/clean_wpa2_wifi_deinit' into 'master'
wpa_supplicant: Deinit wpa2 states in wifi deinit

See merge request espressif/esp-idf!10103

(cherry picked from commit 4dcaa0e6f4)

06bc7f1d wpa_supplicant: Deinit wpa2 states in wifi deinit
2020-08-26 16:55:04 +08:00
Nachiket Kukade
21dc9fcb5d wpa_supplicant: Fix WPA3 and WPA2 transition related failures
1. If Device is connected to AP in WPA3-PSK mode, AP switching
security to WPA2-PSK causes connection failures even after reset.
Fix is to not store WPA3's PMK in NVS for caching.

2. AP switching back to WPA3 causes even more connection failures.
This is due to device not clearing Supplicant level PMK Cache when
it is no longer valid. Fix is to clear the Cache when 4-way handshake
fails and to check Key Mgmt of Cache before using.

3. When AP switches from WPA3 to WPA2, device's PMF config in
Supplicant remains enabled. This may cause failures during
4-way handshake. So clear PMF config in when PMF is no longer used.
2020-08-10 09:05:48 +00:00
Jiang Jiang Jian
501ca00178 Merge branch 'feature/esp_tls_for_supplicant_v4.2' into 'release/v4.2'
wpa_supplicant: Support for mbedtls tls handshake(backport v4.2)

See merge request espressif/esp-idf!9821
2020-08-07 14:01:54 +08:00
Jiang Jiang Jian
33dab9d165 Merge branch 'bugfix/fix_softap_mode_wpa_memory_leak_issue_v4.2' into 'release/v4.2'
bugfix: fix softap mode wpa memory leak (backport v4.2)

See merge request espressif/esp-idf!9845
2020-07-31 16:45:38 +08:00
ronghulin
157ecfaf43 bugfix: fix softap mode wpa memory leak 2020-07-29 14:14:35 +08:00
Nachiket Kukade
3af4b51a5c Fix handling of multiple AP credentials in WPS
WPS can send multiple AP credentials, while existing implementation
will only use the first credentials which could be for the 5G band.
Fix this by passing these credentials to the App and attempting
to connect using each of those. Older Apps will remain compatible
without breaking WPS, but the issue will remain.
2020-07-27 21:41:20 +08:00
kapil.gupta
ebd1bb9a12 wpa_supplicant: Fix IOT issue with latest freeradius
Fix inter operability issue with freeradius version 3.0.21
and openssl 1.1.1f when internal tls client is used which
requires extension elements in client hello.

closes https://github.com/espressif/esp-idf/issues/5273
closes https://github.com/espressif/esp-idf/issues/5627
2020-07-27 18:49:47 +05:30
kapil.gupta
89ef69cbd0 wpa_supplicant: Fix invalid pointer deference and memleak
Add following changes as part of this:

1. EAP client will crash during validation of key size when CA
certs and keys not present. Add changes to validate it first.
2. Free memory allocated in TLS context
2020-07-27 18:49:07 +05:30
kapil.gupta
4b7c8d4a2d wpa_supplicant: Support for mbedtls tls handshake
Add support for mbedtls based tls handshake, this removes
dependency from internal implementation of EAP client.
2020-07-27 18:47:27 +05:30
Angus Gratton
c69210c0f2 wpa_supplicant: Allow building with mbedTLS integration but no hardware MPI
Also disable the relevant function in bignum.h based on config, so fails at
compile not link time.

Closes https://github.com/espressif/esp-idf/issues/5321
2020-06-02 13:35:48 +10:00
Jiang Jiang Jian
af97a5abc3 Merge branch 'workaround/wps_iot_fixes' into 'master'
wpa_supplicant: WPS Inter operatability Fixes

See merge request espressif/esp-idf!8654
2020-05-20 11:32:34 +08:00
kapil.gupta
fb53a454b9 ESP-WIFI: Optimize 4way handshake failure time
In case of wrong passpharse, AP will keep on sending 1/4 multiple
times which may take around 10 secs to disconnect and detect
wrong password event.

Add changes to reject EAPOL1 after 3 consecutive reception
2020-05-19 16:55:42 +05:30
kapil.gupta
76335b2558 wpa_supplicant: WPS Inter operatability Fixes
Add WPS IOT fixes under config option

Current fixes under this flag.
1. Allow NULL-padded WPS attributes.
2. Bypass WPS-Config method validation
2020-05-19 08:05:52 +00:00
Nachiket Kukade
c643d0a611 wpa_supplicant: Allow NULL-padded WPS attributes
Some AP's keep NULL-padding at the end of some variable length WPS
Attributes. This is not as par the WPS2.0 specs, but to avoid interop
issues, ignore the padding by reducing the attribute length by 1.
2020-05-19 08:05:52 +00:00
Nachiket Kukade
b302b4bb43 wpa_supplicant: Fix memory leaks in WPA3 connection
1. Buffers for SAE messages are not freed after the handshake.
   This causes memory leak, free buffers after SAE handshake.
2. SAE global data is not freed until the next WPA3 connection
   takes place, holding up heap space without reason. Free this
   data after SAE handshake is complete or event fails.
3. Update wifi lib which includes memory leak fix during BIP
   encryption/decryption operations.
2020-05-13 22:54:03 +05:30
Nachiket Kukade
f36455052d wpa_supplicant: Fix formatting of file esp_wpa3.c
Replace tabs with spaces in esp_wpa3.c.
2020-05-13 22:54:03 +05:30
Jiang Jiang Jian
5f2be35525 Merge branch 'bugfix/supplicant_general_fixes' into 'master'
wpa_supplicant: Fix some memleaks and invalid memory access

Closes IDF-1335

See merge request espressif/esp-idf!8201
2020-05-12 11:03:14 +08:00
Zhang Jun Hao
e9b3feb85d fix(wpa_supplicant): fix memleak in wpa3 feature 2020-05-07 17:28:07 +08:00
kapil.gupta
3b5fcbe06f wpa_supplicant: Fix some memleaks and invalid memory access
Add changes to fix issues reported in clang analyzer
2020-05-06 10:31:59 +00:00
Shubham Kulkarni
f2cdebd906 esp_wps.c: Fix datatype for wps task handle 2020-05-04 13:26:58 +05:30
Hrudaynath Dhabe
d8a7cfdde4 wpa_supplicant: Minor bugfix with wpa_supplicant debug logs. 2020-04-19 16:40:06 +05:30
kapil.gupta
ab784bb53a wpa_supplicant: Port dpp feature from supplicant
Add files required for DPP feature from upstream.
These file expose the functionality to create DPP packets.
Ported crypto layer from openssl to mbedtls.

Interfacing to use these API will be added in seperate commit
2020-04-14 18:53:35 +05:30
Sagar Bijwe
665b0b4b3b wpa_supplicant: Fix compilation errors when USE_MBEDTLS is disabled.
This is a regression from earlier commit related to TLSV12 which used
sha functions that are currently declared static.
Solution: Follow upstream code structure and resolve the errors.
2020-04-09 16:53:41 +05:30
Sagar Bijwe
a830ddd9ba wpa_supplicant: Fix wpa_supplicant TLS 1.2 issues
1) Fixed compilation issues.
2) Added tlsprf.c from upstream
3) Enabled SHA256 in supplicant compilation.
2020-03-31 17:16:10 +05:30
David Cermak
62f9f42b54 wpa_supplicant: ignore static analysis violations 2020-03-27 19:17:36 +01:00
kapil.gupta
0ae58fc59f wpa_supplicant: Add parsing support for WEP40 key
WEP key is passed as ascii key without "", add parsing support
in supplicant for this.
2020-03-16 06:14:19 +00:00
Nachiket Kukade
30d6220394 esp_wifi: Support for additional WPA3 testcases
1. Anti-Clogging Token Request support
2. Return correct status from SAE modules for invalid scenarios
3. Add PMK Caching support for WPA3
2020-03-03 19:01:51 +05:30
Sagar Bijwe
0f1710d878 wpa_supplicant: Fix SAE test-case failure on mbedtls version udpate
Problem:
mbedtls_ctr_drbg_context was initialized in crypto_ec_point_mul. This
was okay in releases before 2.16.4 as entropy_len used to get set to
MBEDTLS_CTR_DRBG_ENTROPY_LEN in function mbedtls_ctr_drbg_seed. The
function is now changed to set the length to
MBEDTLS_CTR_DRBG_ENTROPY_LEN if previous length is 0 and hence the bug.

Solution:
Initialize mbedtls_ctr_drbg_context in crypto_ec_point_mul.
2020-02-26 17:50:08 +05:30
Hrudaynath Dhabe
ec50c5344b wpa_supplicant: Fix configurable debug log feature's warning issue 2020-01-31 05:34:07 +00:00
morris
e30cd361a8 global: rename esp32s2beta to esp32s2 2020-01-22 12:14:38 +08:00
morris
1c2cc5430e global: bring up esp32s2(not beta) 2020-01-16 17:41:31 +08:00
Konstantin Kondrashov
2c793cef06 idf: Support a custom toolchain with time_t wide 64-bits
Allows resolving the Y2K38 problem.

Closes: IDF-350

Closes: https://github.com/espressif/esp-idf/issues/584
2020-01-10 12:58:54 +08:00
liu zhifu
fde2f33912 esp_wifi/supplicant: fix some WiFi stop memory leak 2019-12-18 13:51:27 +08:00
Nachiket Kukade
5618cf5100 wpa_supplicant: Fix MD5 mismatch in esp_wifi_driver.h
Make cosmetic changes in esp_wifi_driver.h in both IDF
and wifi library to match the md5sum.
2019-11-27 12:43:04 +00:00
Nachiket Kukade
f2e37c4ca8 wpa_supplicant: Support WPA3 4-way handshake, add config option
1. Add changes in 4-way handshake path to allow SAE key mgmt.
2. Support for configuring WAP3 at init time, added Kconfig option.
3. Handle and propagate error conditions properly.
4. Link changes from WiFi library.
2019-11-26 10:59:55 +05:30
Nachiket Kukade
da07b2b4a7 wpa_supplicant: Add SAE handshake support for WPA3-PSK
Under WPA3-Personal, SAE authentication is used to derive PMK
which is more secure and immune to offline dictionary attacks.
1. Add modules to generate SAE commit/confirm for the handshake
2. Add modules that build and parse SAE data in Auth frames
3. Add WPA3 association and key mgmt definitions
4. Invert y-bit while solving for ECC co-ordinate -
     Once an X co-ordinate is obtained, solving for Y co-ordinate
     using an elliptical curve equation results in 2 possible values,
     Y and (P - Y), where p is the prime number. The co-ordinates are
     used for deriving keys in SAE handshake. As par the 802.11 spec
     if LSB of X is same as LSB of Y then Y is chosen, (P - Y) otherwise.
     This is not what is implemented, so fix this behavior to obtain the
     correct Y co-ordinate.
2019-11-26 04:24:57 +00:00
Sagar Bijwe
aceb141d2b wpa_supplicant: Adding SAE modules with testcase
This change ports SAE(Simultaneous Authentication of Equals)
feature from wpa_supplicant and makes it work with mbedtls
crypto APIs. Currently only group 19 is supported. A sample
SAE handshake is included in the testcase. Other minor
changes for DH groups are also included.
2019-11-26 04:24:57 +00:00
Nachiket Kukade
75ea0df916 Add encryption/decryption support for PMF
1. Add CCMP, AES crypto modules for unicast protected Mgmt frames
2. Add support for computing SHA256 MIC on Bcast Mgmt frames
3. Add support for storing iGTK during 4-way handshake.
4. Provide APIs to MLME for utilizing the SW crypto modules
5. Link PMF changes from WiFi library submodule
2019-11-25 04:11:09 +00:00
Nachiket Kukade
773e095a65 Add support for PMF configuration and negotiation
1. Add APIs for configuring PMF through set config.
2. Map Supplicant and Wifi Cipher types.
3. Add support for PMF negotiation while generating RSN IE.
2019-11-25 04:11:09 +00:00
Hrudaynath Dhabe
e543dbfe79 wpa_supplicant: Set assoc_ie_len based on generated RSN/WPA IE 2019-11-11 23:22:14 +08:00
Jiang Jiang Jian
cb6e2fc858 Merge branch 'feature/wifi_pmk_caching' into 'master'
wifi: Add PMK caching feature for station WPA2-enterprise

Closes IDF-969

See merge request espressif/esp-idf!6156
2019-11-01 15:11:20 +08:00
Hrudaynath Dhabe
4d3356be52 wifi: Add PMK caching feature for station WPA2-enterprise
4. Pmksa cache expiry after dot11RSNAConfigPMKLifetime timeout.
2019-10-31 10:51:30 +00:00