DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

DPP: Delete PKEX code and identifier on success completion of PKEX

Browse source 
We are not supposed to reuse these without being explicitly requested to
perform PKEX again. There is not a strong use case for being able to
provision an Enrollee multiple times with PKEX, so this should have no
issues on the Enrollee. For a Configurator, there might be some use
cases that would benefit from being able to use the same code with
multiple Enrollee devices, e.g., for guess access with a laptop and a
smart phone. That case will now require a new DPP_PKEX_ADD command on
the Configurator after each completion of the provisioning exchange.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This commit is contained in:
Jouni Malinen 2022-07-19 21:23:04 +03:00 • committed by Jouni Malinen
parent d86ed5b72b
commit 15af83cf18
2 changed files with 41 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
src/ap/dpp_hostapd.c
View file

@ -279,6 +279,22 @@ static int hostapd_dpp_pkex_next_channel(struct hostapd_data *hapd,
}
static void hostapd_dpp_pkex_clear_code(struct hostapd_data *hapd)
{
if (!hapd->dpp_pkex_code && !hapd->dpp_pkex_identifier)
return;
/* Delete PKEX code and identifier on successful completion of
* PKEX. We are not supposed to reuse these without being
* explicitly requested to perform PKEX again. */
wpa_printf(MSG_DEBUG, "DPP: Delete PKEX code/identifier");
os_free(hapd->dpp_pkex_code);
hapd->dpp_pkex_code = NULL;
os_free(hapd->dpp_pkex_identifier);
hapd->dpp_pkex_identifier = NULL;
}
#ifdef CONFIG_DPP2
static int hostapd_dpp_pkex_done(void *ctx, void *conn,
struct dpp_bootstrap_info *peer_bi)
@ -290,6 +306,8 @@ static int hostapd_dpp_pkex_done(void *ctx, void *conn,
struct dpp_bootstrap_info *own_bi = NULL;
struct dpp_authentication *auth;
hostapd_dpp_pkex_clear_code(hapd);
if (!cmd)
cmd = "";
wpa_printf(MSG_DEBUG, "DPP: Start authentication after PKEX (cmd: %s)",
@ -2244,6 +2262,7 @@ hostapd_dpp_rx_pkex_commit_reveal_req(struct hostapd_data *hapd, const u8 *src,
wpabuf_head(msg), wpabuf_len(msg));
wpabuf_free(msg);
hostapd_dpp_pkex_clear_code(hapd);
bi = dpp_pkex_finish(hapd->iface->interfaces->dpp, pkex, src, freq);
if (!bi)
return;
@ -2276,6 +2295,7 @@ hostapd_dpp_rx_pkex_commit_reveal_resp(struct hostapd_data *hapd, const u8 *src,
return;
}
hostapd_dpp_pkex_clear_code(hapd);
bi = dpp_pkex_finish(ifaces->dpp, pkex, src, freq);
if (!bi)
return;
@ -3229,7 +3249,7 @@ int hostapd_dpp_pkex_remove(struct hostapd_data *hapd, const char *id)
return -1;
}
if ((id_val != 0 && id_val != 1) || !hapd->dpp_pkex_code)
if ((id_val != 0 && id_val != 1))
return -1;
/* TODO: Support multiple PKEX entries */

21
wpa_supplicant/dpp_supplicant.c
View file

@ -2712,6 +2712,22 @@ static int wpas_dpp_pkex_next_channel(struct wpa_supplicant *wpa_s,
}
static void wpas_dpp_pkex_clear_code(struct wpa_supplicant *wpa_s)
{
if (!wpa_s->dpp_pkex_code && !wpa_s->dpp_pkex_identifier)
return;
/* Delete PKEX code and identifier on successful completion of
* PKEX. We are not supposed to reuse these without being
* explicitly requested to perform PKEX again. */
os_free(wpa_s->dpp_pkex_code);
wpa_s->dpp_pkex_code = NULL;
os_free(wpa_s->dpp_pkex_identifier);
wpa_s->dpp_pkex_identifier = NULL;
}
#ifdef CONFIG_DPP2
static int wpas_dpp_pkex_done(void *ctx, void *conn,
struct dpp_bootstrap_info *peer_bi)
@ -2723,6 +2739,8 @@ static int wpas_dpp_pkex_done(void *ctx, void *conn,
struct dpp_bootstrap_info *own_bi = NULL;
struct dpp_authentication *auth;
wpas_dpp_pkex_clear_code(wpa_s);
if (!cmd)
cmd = "";
wpa_printf(MSG_DEBUG, "DPP: Start authentication after PKEX (cmd: %s)",
@ -3048,6 +3066,7 @@ wpas_dpp_pkex_finish(struct wpa_supplicant *wpa_s, const u8 *peer,
{
struct dpp_bootstrap_info *bi;
wpas_dpp_pkex_clear_code(wpa_s);
bi = dpp_pkex_finish(wpa_s->dpp, wpa_s->dpp_pkex, peer, freq);
if (!bi)
return NULL;
@ -4256,7 +4275,7 @@ int wpas_dpp_pkex_remove(struct wpa_supplicant *wpa_s, const char *id)
return -1;
}
if ((id_val != 0 && id_val != 1) || !wpa_s->dpp_pkex_code)
if ((id_val != 0 && id_val != 1))
return -1;
/* TODO: Support multiple PKEX entries */