mka: Make MKA actor priority configurable

This adds a new wpa_supplicant network profile parameter
mka_priority=0..255 to set the priority of the MKA Actor.

Signed-off-by: Badrish Adiga H R <badrish.adigahr@gmail.com>
This commit is contained in:
Badrish Adiga H R 2016-12-05 06:53:55 -08:00 committed by Jouni Malinen
parent 1106833537
commit 65dfa87286
8 changed files with 25 additions and 7 deletions

View file

@ -3083,7 +3083,7 @@ static void kay_l2_receive(void *ctx, const u8 *src_addr, const u8 *buf,
*/ */
struct ieee802_1x_kay * struct ieee802_1x_kay *
ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy, ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
u16 port, const char *ifname, const u8 *addr) u16 port, u8 priority, const char *ifname, const u8 *addr)
{ {
struct ieee802_1x_kay *kay; struct ieee802_1x_kay *kay;
@ -3106,7 +3106,7 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
os_strlcpy(kay->if_name, ifname, IFNAMSIZ); os_strlcpy(kay->if_name, ifname, IFNAMSIZ);
os_memcpy(kay->actor_sci.addr, addr, ETH_ALEN); os_memcpy(kay->actor_sci.addr, addr, ETH_ALEN);
kay->actor_sci.port = host_to_be16(port ? port : 0x0001); kay->actor_sci.port = host_to_be16(port ? port : 0x0001);
kay->actor_priority = DEFAULT_PRIO_NOT_KEY_SERVER; kay->actor_priority = priority;
/* While actor acts as a key server, shall distribute sakey */ /* While actor acts as a key server, shall distribute sakey */
kay->dist_kn = 1; kay->dist_kn = 1;

View file

@ -236,7 +236,7 @@ u64 mka_sci_u64(struct ieee802_1x_mka_sci *sci);
struct ieee802_1x_kay * struct ieee802_1x_kay *
ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy, ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
u16 port, const char *ifname, const u8 *addr); u16 port, u8 priority, const char *ifname, const u8 *addr);
void ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay); void ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay);
struct ieee802_1x_mka_participant * struct ieee802_1x_mka_participant *

View file

@ -11,6 +11,7 @@
#include "common.h" #include "common.h"
#include "utils/uuid.h" #include "utils/uuid.h"
#include "utils/ip_addr.h" #include "utils/ip_addr.h"
#include "common/ieee802_1x_defs.h"
#include "crypto/sha1.h" #include "crypto/sha1.h"
#include "rsn_supp/wpa.h" #include "rsn_supp/wpa.h"
#include "eap_peer/eap.h" #include "eap_peer/eap.h"
@ -2127,6 +2128,7 @@ static const struct parse_data ssid_fields[] = {
{ INT_RANGE(macsec_policy, 0, 1) }, { INT_RANGE(macsec_policy, 0, 1) },
{ INT_RANGE(macsec_integ_only, 0, 1) }, { INT_RANGE(macsec_integ_only, 0, 1) },
{ INT_RANGE(macsec_port, 1, 65534) }, { INT_RANGE(macsec_port, 1, 65534) },
{ INT_RANGE(mka_priority, 0, 255) },
{ FUNC_KEY(mka_cak) }, { FUNC_KEY(mka_cak) },
{ FUNC_KEY(mka_ckn) }, { FUNC_KEY(mka_ckn) },
#endif /* CONFIG_MACSEC */ #endif /* CONFIG_MACSEC */
@ -2617,6 +2619,9 @@ void wpa_config_set_network_defaults(struct wpa_ssid *ssid)
#ifdef CONFIG_IEEE80211W #ifdef CONFIG_IEEE80211W
ssid->ieee80211w = MGMT_FRAME_PROTECTION_DEFAULT; ssid->ieee80211w = MGMT_FRAME_PROTECTION_DEFAULT;
#endif /* CONFIG_IEEE80211W */ #endif /* CONFIG_IEEE80211W */
#ifdef CONFIG_MACSEC
ssid->mka_priority = DEFAULT_PRIO_NOT_KEY_SERVER;
#endif /* CONFIG_MACSEC */
ssid->mac_addr = -1; ssid->mac_addr = -1;
} }

View file

@ -19,6 +19,7 @@
#include "config.h" #include "config.h"
#include "base64.h" #include "base64.h"
#include "uuid.h" #include "uuid.h"
#include "common/ieee802_1x_defs.h"
#include "p2p/p2p.h" #include "p2p/p2p.h"
#include "eap_peer/eap_methods.h" #include "eap_peer/eap_methods.h"
#include "eap_peer/eap.h" #include "eap_peer/eap.h"
@ -813,6 +814,7 @@ static void wpa_config_write_network(FILE *f, struct wpa_ssid *ssid)
write_mka_ckn(f, ssid); write_mka_ckn(f, ssid);
INT(macsec_integ_only); INT(macsec_integ_only);
INT(macsec_port); INT(macsec_port);
INT_DEF(mka_priority, DEFAULT_PRIO_NOT_KEY_SERVER);
#endif /* CONFIG_MACSEC */ #endif /* CONFIG_MACSEC */
#ifdef CONFIG_HS20 #ifdef CONFIG_HS20
INT(update_identifier); INT(update_identifier);

View file

@ -750,6 +750,13 @@ struct wpa_ssid {
*/ */
int macsec_port; int macsec_port;
/**
* mka_priority - Priority of MKA Actor
*
* Range: 0-255 (default: 255)
*/
int mka_priority;
/** /**
* mka_ckn - MKA pre-shared CKN * mka_ckn - MKA pre-shared CKN
*/ */

View file

@ -1392,6 +1392,7 @@ static const char *network_fields[] = {
"macsec_policy", "macsec_policy",
"macsec_integ_only", "macsec_integ_only",
"macsec_port", "macsec_port",
"mka_priority",
#endif /* CONFIG_MACSEC */ #endif /* CONFIG_MACSEC */
#ifdef CONFIG_HS20 #ifdef CONFIG_HS20
"update_identifier", "update_identifier",

View file

@ -901,13 +901,15 @@ fast_reauth=1
# Port component of the SCI # Port component of the SCI
# Range: 1-65534 (default: 1) # Range: 1-65534 (default: 1)
# #
# mka_cak and mka_ckn: IEEE 802.1X/MACsec pre-shared authentication mode # mka_cak, mka_ckn, and mka_priority: IEEE 802.1X/MACsec pre-shared key mode
# This allows to configure MACsec with a pre-shared key using a (CAK,CKN) pair. # This allows to configure MACsec with a pre-shared key using a (CAK,CKN) pair.
# In this mode, instances of wpa_supplicant can act as peers, one of # In this mode, instances of wpa_supplicant can act as MACsec peers. The peer
# which will become the key server and start distributing SAKs. # with lower priority will become the key server and start distributing SAKs.
# mka_cak (CAK = Secure Connectivity Association Key) takes a 16-bytes (128 bit) # mka_cak (CAK = Secure Connectivity Association Key) takes a 16-bytes (128 bit)
# hex-string (32 hex-digits) # hex-string (32 hex-digits)
# mka_ckn (CKN = CAK Name) takes a 32-bytes (256 bit) hex-string (64 hex-digits) # mka_ckn (CKN = CAK Name) takes a 32-bytes (256 bit) hex-string (64 hex-digits)
# mka_priority (Priority of MKA Actor) is in 0..255 range with 255 being
# default priority
# #
# mixed_cell: This option can be used to configure whether so called mixed # mixed_cell: This option can be used to configure whether so called mixed
# cells, i.e., networks that use both plaintext and encryption in the same # cells, i.e., networks that use both plaintext and encryption in the same

View file

@ -233,7 +233,8 @@ int ieee802_1x_alloc_kay_sm(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
kay_ctx->disable_transmit_sa = wpas_disable_transmit_sa; kay_ctx->disable_transmit_sa = wpas_disable_transmit_sa;
res = ieee802_1x_kay_init(kay_ctx, policy, ssid->macsec_port, res = ieee802_1x_kay_init(kay_ctx, policy, ssid->macsec_port,
wpa_s->ifname, wpa_s->own_addr); ssid->mka_priority, wpa_s->ifname,
wpa_s->own_addr);
if (res == NULL) { if (res == NULL) {
os_free(kay_ctx); os_free(kay_ctx);
return -1; return -1;