From 099613e4150471923689242609b7a92e78227b52 Mon Sep 17 00:00:00 2001 From: Sabrina Dubroca Date: Tue, 19 Jul 2016 11:56:51 +0200 Subject: [PATCH] mka: Fix multiple key server election bugs 1. The comparison between SCI's of two servers with identical priority is broken, and would always return TRUE. Just use os_memcmp(), which provides the ordering we need. 2. If no peer can be key server but this instance can, then become the key server. 3. The ordering of blocks between peer as key server and ourself as key server overwrites settings. Simple reordering fixes this. 4. Default to being the key server, so that we advertise our ability in the MKPDUs we send. That's the only way peers can know we can be key server. Cleared automatically as soon as we find a better peer. Signed-off-by: Sabrina Dubroca --- src/pae/ieee802_1x_kay.c | 37 ++++++++++++++----------------------- 1 file changed, 14 insertions(+), 23 deletions(-) diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c index 6980b094e..0233eab08 100644 --- a/src/pae/ieee802_1x_kay.c +++ b/src/pae/ieee802_1x_kay.c @@ -2097,7 +2097,6 @@ ieee802_1x_kay_elect_key_server(struct ieee802_1x_mka_participant *participant) struct ieee802_1x_kay_peer *key_server = NULL; struct ieee802_1x_kay *kay = participant->kay; Boolean i_is_key_server; - int i; if (participant->is_obliged_key_server) { participant->new_sak = TRUE; @@ -2122,11 +2121,9 @@ ieee802_1x_kay_elect_key_server(struct ieee802_1x_mka_participant *participant) key_server = peer; } else if (peer->key_server_priority == key_server->key_server_priority) { - for (i = 0; i < 6; i++) { - if (peer->sci.addr[i] < - key_server->sci.addr[i]) - key_server = peer; - } + if (os_memcmp(peer->sci.addr, key_server->sci.addr, + ETH_ALEN) < 0) + key_server = peer; } } @@ -2138,20 +2135,12 @@ ieee802_1x_kay_elect_key_server(struct ieee802_1x_mka_participant *participant) i_is_key_server = TRUE; } else if (kay->actor_priority == key_server->key_server_priority) { - for (i = 0; i < 6; i++) { - if (kay->actor_sci.addr[i] - < key_server->sci.addr[i]) { - i_is_key_server = TRUE; - } - } + if (os_memcmp(kay->actor_sci.addr, key_server->sci.addr, + ETH_ALEN) < 0) + i_is_key_server = TRUE; } - } - - if (!key_server && !i_is_key_server) { - participant->principal = FALSE; - participant->is_key_server = FALSE; - participant->is_elected = FALSE; - return 0; + } else if (participant->can_be_key_server) { + i_is_key_server = TRUE; } if (i_is_key_server) { @@ -2172,9 +2161,7 @@ ieee802_1x_kay_elect_key_server(struct ieee802_1x_mka_participant *participant) os_memcpy(&kay->key_server_sci, &kay->actor_sci, sizeof(kay->key_server_sci)); kay->key_server_priority = kay->actor_priority; - } - - if (key_server) { + } else if (key_server) { ieee802_1x_cp_set_electedself(kay->cp, FALSE); if (os_memcmp(&kay->key_server_sci, &key_server->sci, sizeof(kay->key_server_sci))) { @@ -2189,6 +2176,10 @@ ieee802_1x_kay_elect_key_server(struct ieee802_1x_mka_participant *participant) os_memcpy(&kay->key_server_sci, &key_server->sci, sizeof(kay->key_server_sci)); kay->key_server_priority = key_server->key_server_priority; + } else { + participant->principal = FALSE; + participant->is_key_server = FALSE; + participant->is_elected = FALSE; } return 0; @@ -3320,7 +3311,7 @@ ieee802_1x_kay_create_mka(struct ieee802_1x_kay *kay, struct mka_key_name *ckn, default: participant->is_obliged_key_server = FALSE; participant->can_be_key_server = TRUE; - participant->is_key_server = FALSE; + participant->is_key_server = TRUE; participant->is_elected = FALSE; break; }