Skip to content
flintOS

radio_esp32::supplicant

The radio glue for the first-party WPA2 supplicant.

[crate::wifi] registers a wpa_funcs table with the blob; this fills it. The blob drives the six station callbacks, and this routes them through [wpa]’s pure 4-way handshake:

  • sta_connect derives the PMK from the passphrase and SSID (via [crypto::wpa_psk]) and creates a [wpa::Supplicant].
  • sta_rx_eapol feeds each EAPOL-Key frame to the supplicant and acts on what it returns — sending a reply through esp_wifi_internal_tx, and, on completion, remembering the keys to install.
  • the keys install after message 4 has left, from the blob’s EAPOL transmit-done callback, because installing the pairwise key any earlier would encrypt message 4 and the AP could not read it.

What is not host-tested

Section titled “What is not host-tested”

Everything here is unsafe FFI into the blob and register reads: it cannot be exercised off-target, and full validation is a real WPA2 AP. The logic it drives — the whole handshake — is host-tested in [wpa]; this file is the wiring, kept as thin as the blob’s shape allows.