Commit graph

56 commits

Author SHA1 Message Date
Badrish Adiga H R
7508c2ad99 PAE: Make KaY specific details available via control interface
Add KaY details to the STATUS command output.

Signed-off-by: Badrish Adiga H R <badrish.adigahr@hpe.com>
2016-12-18 17:47:05 +02:00
Sabrina Dubroca
f014d9dbf0 macsec_linux: Add a driver for macsec on Linux kernels
This uses libnl3 to communicate with the macsec module available on
Linux. A recent enough version of libnl is needed for the macsec.h file
(which is not yet available in a formal libnl release at the time of
this commit).

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-30 20:08:36 +02:00
Sabrina Dubroca
e0d9fd344d wpa_supplicant: Allow configuring the MACsec port for MKA
Previously, wpa_supplicant only supported hardcoded port == 1 in the
SCI, but users may want to choose a different port.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-20 00:35:31 +02:00
Sabrina Dubroca
7b4d546e3d wpa_supplicant: Add macsec_integ_only setting for MKA
So that the user can turn encryption on (MACsec provides
confidentiality+integrity) or off (MACsec provides integrity only). This
commit adds the configuration parameter while the actual behavior change
to disable encryption in the driver is handled in the following commit.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-20 00:35:16 +02:00
Sabrina Dubroca
008e224dbb mka: Disable peer detection timeout for PSK mode
The first peer may take a long time to come up. In PSK mode we are
basically in a p2p system, and we cannot know when a peer will join the
key exchange. Wait indefinitely, and let the administrator decide if
they want to abort.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-20 00:35:11 +02:00
Sabrina Dubroca
088d53dd15 mka: Fix getting capabilities from the driver
In commit a25e4efc9e ('mka: Add driver op
to get macsec capabilities') I added some code to check the driver's
capabilities. This commit has two problems:
 - wrong enum type set in kay->macsec_confidentiality
 - ignores that drivers could report MACSEC_CAP_NOT_IMPLEMENTED, in
   which case the MKA would claim that MACsec is supported.

Fix this by interpreting MACSEC_CAP_NOT_IMPLEMENTED in the same way as a
DO_NOT_SECURE policy, and set the correct value in
kay->macsec_confidentiality.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-19 17:29:54 +02:00
Sabrina Dubroca
99b82bf537 mka: Implement reference counting on data_key
struct data_key already had a 'user' field for reference counting, but
it was basically unused.

Add an ieee802_1x_kay_use_data_key() function to take a reference on a
key, and use ieee802_1x_kay_deinit_data_key() to release the reference.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-10-29 11:38:57 +03:00
Sabrina Dubroca
23c3528a84 mka: Add support for removing SAs
So that the core can notify drivers that need to perform some operations
when an SA is deleted.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-10-29 11:35:38 +03:00
Sabrina Dubroca
6f551abdfc mka: Remove "channel" hacks from the stack and the macsec_qca driver
This is specific to the macsec_qca driver. The core implementation
shouldn't care about this, and only deal with the complete secure
channel, and pass this down to the driver.

Drivers that have such limitations should take care of these in their
->create functions and throw an error.

Since the core MKA no longer saves the channel number, the macsec_qca
driver must be able to recover it. Add a map (which is just an array
since it's quite short) to match SCIs to channel numbers, and lookup
functions that will be called in every place where functions would get
the channel from the core code. Getting an available channel should be
part of channel creation, instead of being a preparation step.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-10-29 11:24:08 +03:00
Sabrina Dubroca
a25e4efc9e mka: Add driver op to get macsec capabilities
This also implements the macsec_get_capability for the macsec_qca
driver to maintain the existing behavior.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-10-09 11:30:48 +03:00
Sabrina Dubroca
7dcec24881 mka: Clean up key allocation
Assign cs in ieee802_1x_mka_decode_dist_sak_body and reuse it.

Cleanup of key allocation: ieee802_1x_kay_generate_new_sak() and
ieee802_1x_mka_decode_dist_sak_body() both allocate a struct key_conf,
fill it, and ask ieee802_1x_kay_init_data_key() to allocate and set up a
struct data_key. They also allocate multiple key buffers and copy the
same data around. Stop moving data from buffer to buffer, and just
allocate what we really need.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 22:24:33 +03:00
Sabrina Dubroca
95e9460d6a mka: Get rid of struct ieee802_1x_cp_conf
Instead of copying from kay to a temporary struct, and then from the
struct to the sm, just copy from kay to cp.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:56:17 +03:00
Sabrina Dubroca
07a6bfe1d2 mka: Store cipher suite ID in a u64 instead of u8 pointer
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:55:54 +03:00
Jouni Malinen
535a8b8712 mka: Make csindex unsigned
This avoids unnecessary typecasting while still being able to compare
the value to CS_TABLE_SIZE without compiler warnings.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-08-28 21:48:45 +03:00
Sabrina Dubroca
343eb3b036 mka: Reorganize live peer creation and key server election
This modifies ieee802_1x_kay_decode_mkpdu() check for peer including me
in its peer list.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:41:21 +03:00
Sabrina Dubroca
34dbe90ac5 mka: Share a single delete mka implementation
Share mka deletion implementation in ieee802_1x_participant_timer() for
the cak_life and mka_life expiration cases.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:31:28 +03:00
Sabrina Dubroca
0dabf79b5d mka: Introduce compare_priorities()
This takes care of priority comparison followed by MAC address
comparison if the priorities are identical.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:27:05 +03:00
Sabrina Dubroca
53080f770c mka: Clean up ieee802_1x_kay_mkpdu_sanity_check()
This drops one indentation level and makes the code a bit more readable.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:19:37 +03:00
Sabrina Dubroca
05283e7a6f mka: Simplify ieee802_1x_mka_dist_sak_body_present()
No need for an if statement to figure out Boolean return value.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:17:43 +03:00
Sabrina Dubroca
87b19c8d88 mka: Replace participant->kay with a local kay variable
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:17:36 +03:00
Sabrina Dubroca
f9ea083be3 mka: Fix typos in grammar in variable names and comments
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:59:58 +03:00
Sabrina Dubroca
921171f51c mka: Use named initializers for mka_body_handler[]
Also move the struct definition to be next to this array definition.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:57:23 +03:00
Sabrina Dubroca
46bbda2b83 mka: Clean up ieee802_1x_mka_decode_potential_peer_body()
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:50:49 +03:00
Sabrina Dubroca
cf375eb2da mka: Simplify ieee802_1x_mka_encode_icv_body() memory copying
There is no need to maintain two os_memcpy() calls to cover different
cmac lengths.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:47:25 +03:00
Sabrina Dubroca
8b4a148842 mka: Simplify ieee802_1x_mka_sak_use_body_present()
to_use_sak is a Boolean variable, so there is no need for an if
statement to figure out whether to return TRUE or FALSE.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:46:19 +03:00
Sabrina Dubroca
b3df7836e8 mka: Reorganize loops in number of KaY functions
Use for loop to remove unnecessary goto use and similar cleanup to
simplify the loops in ieee802_1x_mka_i_in_peerlist(),
ieee802_1x_mka_decode_live_peer_body(), and
ieee802_1x_kay_decode_mkpdu().

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:44:04 +03:00
Sabrina Dubroca
de7f5337f4 mka: Remove unused body_peer incrementation
Each loop iteration resets body_peer in the beginning, so there is no
need to increment this pointer in the end.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:35:45 +03:00
Sabrina Dubroca
2b13bcad70 mka: Add reset_participant_mi() helper
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:34:56 +03:00
Sabrina Dubroca
3ceb458254 mka: Clean up printf formats
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:31:10 +03:00
Sabrina Dubroca
8fab9e1cae mka: Use named initializers for static structs
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:30:48 +03:00
Sabrina Dubroca
d4f668fded mka: Add MKA_ALIGN_LENGTH macro
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:29:20 +03:00
Sabrina Dubroca
1de7a9f882 mka: Add helper functions for dumping and creating peer
This allows more code reuse for creating live/potential peer and dumping
peer entries.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:58 +03:00
Sabrina Dubroca
d9639d1a4e mka: Clean up ieee802_1x_kay_get_cipher_suite() lookup function
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
7c547cff6b mka: Refactor the get_*_peer() functions
Add ieee802_1x_kay_get_potential_peer() similarly to the previously used
ieee802_1x_kay_get_live_peer() and use these helper functions more
consistently to avoid multiple implementations of peer lookups.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
515bc1aec1 mka: Fix a typo in mka_body_handler (mak to mka)
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
a33e3c3214 mka: Add a helper function, sci_equal(), for sci comparison
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
2e9448989f mka: Fix a typo in macsec_capbility
Spell "capability" correctly in the variable name.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:29:15 +03:00
Sabrina Dubroca
cfe0a0194b mka: Fix use after free
We must cancel the timer when we delete an MKA instance.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-07 11:44:04 +03:00
Sabrina Dubroca
d68b73cfa5 mka: Add check for body length when decoding peers
The standard says that the body length must be a multiple of 16B.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-07 11:42:37 +03:00
Sabrina Dubroca
ad19e71e68 mka: Avoid reading past the end of mka_body_handler
body_type, used to index in mka_body_handler, can be any u8 value, but
we have only ARRAY_SIZE(mka_body_handler) elements.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-07 11:42:19 +03:00
Jouni Malinen
65b47738e8 mka: Return u8 from get_mka_param_body_type()
This uses a more accurate variable type for body_type and makes it
cleaner to compare this to other unsigned values.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-08-07 11:42:03 +03:00
Sabrina Dubroca
ac285c007c mka: Add error handling around ieee802_1x_kay_move_live_peer()
ieee802_1x_kay_move_live_peer() can fail. In that case, we should not
proceed.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-07 11:36:17 +03:00
Sabrina Dubroca
90bff0e2aa mka: Avoid inconsistent state in ieee802_1x_kay_move_live_peer()
If the memory allocation in ieee802_1x_kay_init_receive_sc() fails, we
end up in an inconsistent state where the peer is moved to the live
peers list and its sci is setup, but we don't have an rxsc.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-07 11:34:50 +03:00
Sabrina Dubroca
12447457bf mka: Fix length when encoding SAK-use
The room we actually use is length. This could also mess up the
receiver, since it will advance by the actual length (as indicated by
the parameter body's length), which could differ from the offset at
which we stored the next item.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-07 11:32:23 +03:00
Sabrina Dubroca
71dc78904f mka: Fix memory leak in ieee802_1x_kay_create_live_peer() error path
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-07 11:31:41 +03:00
Sabrina Dubroca
099613e415 mka: Fix multiple key server election bugs
1. The comparison between SCI's of two servers with identical priority
   is broken, and would always return TRUE. Just use os_memcmp(), which
   provides the ordering we need.

2. If no peer can be key server but this instance can, then become the
   key server.

3. The ordering of blocks between peer as key server and ourself as key
   server overwrites settings. Simple reordering fixes this.

4. Default to being the key server, so that we advertise our ability in
   the MKPDUs we send. That's the only way peers can know we can be key
   server. Cleared automatically as soon as we find a better peer.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-07 11:31:17 +03:00
Jouni Malinen
4874b78290 PAE: Use big endian version in current_peer_id.mn to be more consistent
This gets rid of sparse warnings related to mismatching annotation and
byte swapping.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-06-24 19:02:58 +03:00
Jouni Malinen
ce256b4a49 PAE: Use sci->port more consistently
This is now annotated as be16, so use it as such in all cases instead of
first storing host byte order value and then swapping that to big endian
in other instances of the same structure. This gets rid of number of
sparse warnings.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-06-24 19:02:58 +03:00
Jouni Malinen
799a7ed8a9 PAE: Mark ieee802_1x_kay_deinit_data_key() static
This function is not used outside this file.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-06-24 01:40:24 +03:00
Jouni Malinen
4e7f5a4a2a PAE: Use be16/be32 instead of u16/u32 for spartse
This converts some of the PAE code to use a design that gets rid
unnecessary warnings from sparse and allows more thorough validation of
byte order operations.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-06-24 01:38:48 +03:00