[PATCH v3 1/2] dpp: Fix association with hidden SSID via directed probing

[Gustavo Bertoli]

When a station receives a DPP Configuration Object and the AP's
SSID is hidden (ignore_broadcast_ssid=1), the auto-provisioned
network never associates. The DPP handshake completes successfully
and the Config Object is accepted, but wpa_supplicant subsequently
triggers a passive scan. Because the AP does not respond to wildcard
Probe Requests, no matching network is found and the session sits
silently disconnected.

Log shows the handshake succeeding without any subsequent SME
authentication attempts:

wlan1: DPP-CONF-RECEIVED
wlan1: DPP-CONFOBJ-AKM sae
wlan1: DPP-CONFOBJ-SSID DPP
wlan1: DPP-NETWORK-ID 0
wlan1: DPP-TX dst=... type=11

wpas_dpp_add_network() leaves ssid->scan_ssid=0. The DPP enrollee
receives the SSID through an authenticated channel (the DPP Config
Object) and already knows the exact target SSID.

Set scan_ssid=1 only when the provisioned SSID is not visible in the
BSS scan cache. A hidden AP advertises an empty SSID in beacons, so
wpa_bss_get() finds no matching entry - enabling directed probing only
when actually required. Broadcast SSIDs found in scan results keep
scan_ssid=0, avoiding unnecessary directed probes that would impact
privacy.

Signed-off-by: Gustavo Bertoli <gubertoli at gmail.com>
---
 wpa_supplicant/dpp_supplicant.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/wpa_supplicant/dpp_supplicant.c b/wpa_supplicant/dpp_supplicant.c
index a55d0e7ab..6a3bf6a3e 100644
--- a/wpa_supplicant/dpp_supplicant.c
+++ b/wpa_supplicant/dpp_supplicant.c
@@ -1446,6 +1446,9 @@ static struct wpa_ssid * wpas_dpp_add_network(struct wpa_supplicant *wpa_s,
 	os_memcpy(ssid->ssid, conf->ssid, conf->ssid_len);
 	ssid->ssid_len = conf->ssid_len;
 
+	if (!wpa_bss_get(wpa_s, NULL, conf->ssid, conf->ssid_len))
+		ssid->scan_ssid = 1;
+
 #ifdef CONFIG_DPP3
 	if (conf->akm == DPP_AKM_SAE && conf->password_id[0]) {
 		size_t len = os_strlen(conf->password_id);
-- 
2.43.0