1 /*
2 * IEEE 802.1X-2010 Key Agreement Protocol of PAE state machine
3 * Copyright (c) 2013, Qualcomm Atheros, Inc.
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include <time.h>
10 #include "includes.h"
11 #include "common.h"
12 #include "list.h"
13 #include "eloop.h"
14 #include "wpabuf.h"
15 #include "state_machine.h"
16 #include "l2_packet/l2_packet.h"
17 #include "common/eapol_common.h"
18 #include "crypto/aes_wrap.h"
19 #include "ieee802_1x_cp.h"
20 #include "ieee802_1x_key.h"
21 #include "ieee802_1x_kay.h"
22 #include "ieee802_1x_kay_i.h"
23 #include "ieee802_1x_secy_ops.h"
24
25
26 #define DEFAULT_SA_KEY_LEN 16
27 #define DEFAULT_ICV_LEN 16
28 #define MAX_ICV_LEN 32 /* 32 bytes, 256 bits */
29
30 #define MAX_MISSING_SAK_USE 10 /* Accept up to 10 inbound MKPDUs without
31 * SAK-USE before dropping */
32
33 #define PENDING_PN_EXHAUSTION 0xC0000000
34
35 #define MKA_ALIGN_LENGTH(len) (((len) + 0x3) & ~0x3)
36
37 /* IEEE Std 802.1X-2010, Table 9-1 - MKA Algorithm Agility */
38 #define MKA_ALGO_AGILITY_2009 { 0x00, 0x80, 0xC2, 0x01 }
39 static u8 mka_algo_agility[4] = MKA_ALGO_AGILITY_2009;
40
41 /* IEEE802.1AE-2006 Table 14-1 MACsec Cipher Suites */
42 static struct macsec_ciphersuite cipher_suite_tbl[] = {
43 /* GCM-AES-128 */
44 {
45 .id = CS_ID_GCM_AES_128,
46 .name = CS_NAME_GCM_AES_128,
47 .capable = MACSEC_CAP_INTEG_AND_CONF_0_30_50,
48 .sak_len = DEFAULT_SA_KEY_LEN,
49 },
50 /* GCM-AES-256 */
51 {
52 .id = CS_ID_GCM_AES_256,
53 .name = CS_NAME_GCM_AES_256,
54 .capable = MACSEC_CAP_INTEG_AND_CONF_0_30_50,
55 .sak_len = 32,
56 },
57 };
58 #define CS_TABLE_SIZE (ARRAY_SIZE(cipher_suite_tbl))
59 #define DEFAULT_CS_INDEX 0
60
61 static struct mka_alg mka_alg_tbl[] = {
62 {
63 .parameter = MKA_ALGO_AGILITY_2009,
64
65 .icv_len = DEFAULT_ICV_LEN,
66
67 .cak_trfm = ieee802_1x_cak_aes_cmac,
68 .ckn_trfm = ieee802_1x_ckn_aes_cmac,
69 .kek_trfm = ieee802_1x_kek_aes_cmac,
70 .ick_trfm = ieee802_1x_ick_aes_cmac,
71 .icv_hash = ieee802_1x_icv_aes_cmac,
72 },
73 };
74 #define MKA_ALG_TABLE_SIZE (ARRAY_SIZE(mka_alg_tbl))
75
76
is_ki_equal(struct ieee802_1x_mka_ki * ki1,struct ieee802_1x_mka_ki * ki2)77 static int is_ki_equal(struct ieee802_1x_mka_ki *ki1,
78 struct ieee802_1x_mka_ki *ki2)
79 {
80 return os_memcmp(ki1->mi, ki2->mi, MI_LEN) == 0 &&
81 ki1->kn == ki2->kn;
82 }
83
84
set_mka_param_body_len(void * body,unsigned int len)85 static void set_mka_param_body_len(void *body, unsigned int len)
86 {
87 struct ieee802_1x_mka_hdr *hdr = body;
88 hdr->length = (len >> 8) & 0x0f;
89 hdr->length1 = len & 0xff;
90 }
91
92
get_mka_param_body_len(const void * body)93 static unsigned int get_mka_param_body_len(const void *body)
94 {
95 const struct ieee802_1x_mka_hdr *hdr = body;
96 return (hdr->length << 8) | hdr->length1;
97 }
98
99
get_mka_param_body_type(const void * body)100 static u8 get_mka_param_body_type(const void *body)
101 {
102 const struct ieee802_1x_mka_hdr *hdr = body;
103 return hdr->type;
104 }
105
106
mi_txt(const u8 * mi)107 static const char * mi_txt(const u8 *mi)
108 {
109 static char txt[MI_LEN * 2 + 1];
110
111 wpa_snprintf_hex(txt, sizeof(txt), mi, MI_LEN);
112 return txt;
113 }
114
115
sci_txt(const struct ieee802_1x_mka_sci * sci)116 static const char * sci_txt(const struct ieee802_1x_mka_sci *sci)
117 {
118 static char txt[ETH_ALEN * 3 + 1 + 5 + 1];
119
120 os_snprintf(txt, sizeof(txt), MACSTR "@%u",
121 MAC2STR(sci->addr), be_to_host16(sci->port));
122 return txt;
123 }
124
125
algo_agility_txt(const u8 * algo_agility)126 static const char * algo_agility_txt(const u8 *algo_agility)
127 {
128 static char txt[4 * 2 + 1];
129
130 wpa_snprintf_hex(txt, sizeof(txt), algo_agility, 4);
131 return txt;
132 }
133
134
135 /**
136 * ieee802_1x_mka_dump_basic_body -
137 */
138 static void
ieee802_1x_mka_dump_basic_body(struct ieee802_1x_mka_basic_body * body)139 ieee802_1x_mka_dump_basic_body(struct ieee802_1x_mka_basic_body *body)
140 {
141 size_t body_len;
142
143 if (!body)
144 return;
145
146 /* IEEE Std 802.1X-2010, Figure 11-8 */
147 body_len = get_mka_param_body_len(body);
148 wpa_printf(MSG_DEBUG, "MKA Basic Parameter Set");
149 wpa_printf(MSG_DEBUG, "\tMKA Version Identifier: %d", body->version);
150 wpa_printf(MSG_DEBUG, "\tKey Server Priority: %d", body->priority);
151 wpa_printf(MSG_DEBUG, "\tKey Server: %d", body->key_server);
152 wpa_printf(MSG_DEBUG, "\tMACsec Desired: %d", body->macsec_desired);
153 wpa_printf(MSG_DEBUG, "\tMACsec Capability: %d",
154 body->macsec_capability);
155 wpa_printf(MSG_DEBUG, "\tParameter set body length: %zu", body_len);
156 wpa_printf(MSG_DEBUG, "\tSCI: %s", sci_txt(&body->actor_sci));
157 wpa_printf(MSG_DEBUG, "\tActor's Member Identifier: %s",
158 mi_txt(body->actor_mi));
159 wpa_printf(MSG_DEBUG, "\tActor's Message Number: %d",
160 be_to_host32(body->actor_mn));
161 wpa_printf(MSG_DEBUG, "\tAlgorithm Agility: %s",
162 algo_agility_txt(body->algo_agility));
163 wpa_hexdump(MSG_DEBUG, "\tCAK Name", body->ckn,
164 body_len + MKA_HDR_LEN - sizeof(*body));
165 }
166
167
168 /**
169 * ieee802_1x_mka_dump_peer_body -
170 */
171 static void
ieee802_1x_mka_dump_peer_body(struct ieee802_1x_mka_peer_body * body)172 ieee802_1x_mka_dump_peer_body(struct ieee802_1x_mka_peer_body *body)
173 {
174 size_t body_len;
175 size_t i;
176 u8 *mi;
177 be32 mn;
178
179 if (body == NULL)
180 return;
181
182 /* IEEE Std 802.1X-2010, Figure 11-9 */
183 body_len = get_mka_param_body_len(body);
184 if (body->type == MKA_LIVE_PEER_LIST) {
185 wpa_printf(MSG_DEBUG, "Live Peer List parameter set");
186 wpa_printf(MSG_DEBUG, "\tBody Length: %zu", body_len);
187 } else if (body->type == MKA_POTENTIAL_PEER_LIST) {
188 wpa_printf(MSG_DEBUG, "Potential Peer List parameter set");
189 wpa_printf(MSG_DEBUG, "\tBody Length: %zu", body_len);
190 }
191
192 for (i = 0; i < body_len; i += MI_LEN + sizeof(mn)) {
193 mi = body->peer + i;
194 os_memcpy(&mn, mi + MI_LEN, sizeof(mn));
195 wpa_printf(MSG_DEBUG, "\tMember Id: %s Message Number: %d",
196 mi_txt(mi), be_to_host32(mn));
197 }
198 }
199
200
201 /**
202 * ieee802_1x_mka_dump_dist_sak_body -
203 */
204 static void
ieee802_1x_mka_dump_dist_sak_body(struct ieee802_1x_mka_dist_sak_body * body)205 ieee802_1x_mka_dump_dist_sak_body(struct ieee802_1x_mka_dist_sak_body *body)
206 {
207 size_t body_len;
208
209 if (body == NULL)
210 return;
211
212 /* IEEE Std 802.1X-2010, Figure 11-11 and 11-12 */
213 body_len = get_mka_param_body_len(body);
214 wpa_printf(MSG_DEBUG, "Distributed SAK parameter set");
215 wpa_printf(MSG_DEBUG, "\tDistributed AN........: %d", body->dan);
216 wpa_printf(MSG_DEBUG, "\tConfidentiality Offset: %d",
217 body->confid_offset);
218 wpa_printf(MSG_DEBUG, "\tBody Length...........: %zu", body_len);
219 if (!body_len)
220 return;
221
222 wpa_printf(MSG_DEBUG, "\tKey Number............: %d",
223 be_to_host32(body->kn));
224 if (body_len == 28) {
225 wpa_hexdump(MSG_DEBUG, "\tAES Key Wrap of SAK...:",
226 body->sak, 24);
227 } else if (body_len > CS_ID_LEN - sizeof(body->kn)) {
228 wpa_hexdump(MSG_DEBUG, "\tMACsec Cipher Suite...:",
229 body->sak, CS_ID_LEN);
230 wpa_hexdump(MSG_DEBUG, "\tAES Key Wrap of SAK...:",
231 body->sak + CS_ID_LEN,
232 body_len - CS_ID_LEN - sizeof(body->kn));
233 }
234 }
235
236
yes_no(int val)237 static const char * yes_no(int val)
238 {
239 return val ? "Yes" : "No";
240 }
241
242
243 /**
244 * ieee802_1x_mka_dump_sak_use_body -
245 */
246 static void
ieee802_1x_mka_dump_sak_use_body(struct ieee802_1x_mka_sak_use_body * body)247 ieee802_1x_mka_dump_sak_use_body(struct ieee802_1x_mka_sak_use_body *body)
248 {
249 int body_len;
250
251 if (body == NULL)
252 return;
253
254 /* IEEE Std 802.1X-2010, Figure 11-10 */
255 body_len = get_mka_param_body_len(body);
256 wpa_printf(MSG_DEBUG, "MACsec SAK Use parameter set");
257 wpa_printf(MSG_DEBUG, "\tLatest Key AN....: %d", body->lan);
258 wpa_printf(MSG_DEBUG, "\tLatest Key Tx....: %s", yes_no(body->ltx));
259 wpa_printf(MSG_DEBUG, "\tLatest Key Rx....: %s", yes_no(body->lrx));
260 wpa_printf(MSG_DEBUG, "\tOld Key AN.......: %d", body->oan);
261 wpa_printf(MSG_DEBUG, "\tOld Key Tx.......: %s", yes_no(body->otx));
262 wpa_printf(MSG_DEBUG, "\tOld Key Rx.......: %s", yes_no(body->orx));
263 wpa_printf(MSG_DEBUG, "\tPlain Tx.........: %s", yes_no(body->ptx));
264 wpa_printf(MSG_DEBUG, "\tPlain Rx.........: %s", yes_no(body->prx));
265 wpa_printf(MSG_DEBUG, "\tDelay Protect....: %s",
266 yes_no(body->delay_protect));
267 wpa_printf(MSG_DEBUG, "\tBody Length......: %d", body_len);
268 if (!body_len)
269 return;
270
271 wpa_printf(MSG_DEBUG, "\tKey Server MI....: %s", mi_txt(body->lsrv_mi));
272 wpa_printf(MSG_DEBUG, "\tKey Number.......: %u",
273 be_to_host32(body->lkn));
274 wpa_printf(MSG_DEBUG, "\tLowest PN........: %u",
275 be_to_host32(body->llpn));
276 wpa_printf(MSG_DEBUG, "\tOld Key Server MI: %s", mi_txt(body->osrv_mi));
277 wpa_printf(MSG_DEBUG, "\tOld Key Number...: %u",
278 be_to_host32(body->okn));
279 wpa_printf(MSG_DEBUG, "\tOld Lowest PN....: %u",
280 be_to_host32(body->olpn));
281 }
282
283
284 /**
285 * ieee802_1x_kay_get_participant -
286 */
287 static struct ieee802_1x_mka_participant *
ieee802_1x_kay_get_participant(struct ieee802_1x_kay * kay,const u8 * ckn,size_t len)288 ieee802_1x_kay_get_participant(struct ieee802_1x_kay *kay, const u8 *ckn,
289 size_t len)
290 {
291 struct ieee802_1x_mka_participant *participant;
292
293 dl_list_for_each(participant, &kay->participant_list,
294 struct ieee802_1x_mka_participant, list) {
295 if (participant->ckn.len == len &&
296 os_memcmp(participant->ckn.name, ckn,
297 participant->ckn.len) == 0)
298 return participant;
299 }
300
301 wpa_printf(MSG_DEBUG, "KaY: participant is not found");
302
303 return NULL;
304 }
305
306
307 /**
308 * ieee802_1x_kay_get_principal_participant -
309 */
310 static struct ieee802_1x_mka_participant *
ieee802_1x_kay_get_principal_participant(struct ieee802_1x_kay * kay)311 ieee802_1x_kay_get_principal_participant(struct ieee802_1x_kay *kay)
312 {
313 struct ieee802_1x_mka_participant *participant;
314
315 dl_list_for_each(participant, &kay->participant_list,
316 struct ieee802_1x_mka_participant, list) {
317 if (participant->principal)
318 return participant;
319 }
320
321 wpa_printf(MSG_DEBUG, "KaY: principal participant is not found");
322 return NULL;
323 }
324
325
get_peer_mi(struct dl_list * peers,const u8 * mi)326 static struct ieee802_1x_kay_peer * get_peer_mi(struct dl_list *peers,
327 const u8 *mi)
328 {
329 struct ieee802_1x_kay_peer *peer;
330
331 dl_list_for_each(peer, peers, struct ieee802_1x_kay_peer, list) {
332 if (os_memcmp(peer->mi, mi, MI_LEN) == 0)
333 return peer;
334 }
335
336 return NULL;
337 }
338
339
340 /**
341 * ieee802_1x_kay_get_potential_peer
342 */
343 static struct ieee802_1x_kay_peer *
ieee802_1x_kay_get_potential_peer(struct ieee802_1x_mka_participant * participant,const u8 * mi)344 ieee802_1x_kay_get_potential_peer(
345 struct ieee802_1x_mka_participant *participant, const u8 *mi)
346 {
347 return get_peer_mi(&participant->potential_peers, mi);
348 }
349
350
351 /**
352 * ieee802_1x_kay_get_live_peer
353 */
354 static struct ieee802_1x_kay_peer *
ieee802_1x_kay_get_live_peer(struct ieee802_1x_mka_participant * participant,const u8 * mi)355 ieee802_1x_kay_get_live_peer(struct ieee802_1x_mka_participant *participant,
356 const u8 *mi)
357 {
358 return get_peer_mi(&participant->live_peers, mi);
359 }
360
361
362 /**
363 * ieee802_1x_kay_is_in_potential_peer
364 */
365 static bool
ieee802_1x_kay_is_in_potential_peer(struct ieee802_1x_mka_participant * participant,const u8 * mi)366 ieee802_1x_kay_is_in_potential_peer(
367 struct ieee802_1x_mka_participant *participant, const u8 *mi)
368 {
369 return ieee802_1x_kay_get_potential_peer(participant, mi) != NULL;
370 }
371
372
373 /**
374 * ieee802_1x_kay_is_in_live_peer
375 */
376 static bool
ieee802_1x_kay_is_in_live_peer(struct ieee802_1x_mka_participant * participant,const u8 * mi)377 ieee802_1x_kay_is_in_live_peer(
378 struct ieee802_1x_mka_participant *participant, const u8 *mi)
379 {
380 return ieee802_1x_kay_get_live_peer(participant, mi) != NULL;
381 }
382
383
384 /**
385 * ieee802_1x_kay_get_peer
386 */
387 static struct ieee802_1x_kay_peer *
ieee802_1x_kay_get_peer(struct ieee802_1x_mka_participant * participant,const u8 * mi)388 ieee802_1x_kay_get_peer(struct ieee802_1x_mka_participant *participant,
389 const u8 *mi)
390 {
391 struct ieee802_1x_kay_peer *peer;
392
393 peer = ieee802_1x_kay_get_live_peer(participant, mi);
394 if (peer)
395 return peer;
396
397 return ieee802_1x_kay_get_potential_peer(participant, mi);
398 }
399
400
401 /**
402 * ieee802_1x_kay_get_cipher_suite
403 */
404 static struct macsec_ciphersuite *
ieee802_1x_kay_get_cipher_suite(struct ieee802_1x_mka_participant * participant,const u8 * cs_id,unsigned int * idx)405 ieee802_1x_kay_get_cipher_suite(struct ieee802_1x_mka_participant *participant,
406 const u8 *cs_id, unsigned int *idx)
407 {
408 unsigned int i;
409 u64 cs;
410 be64 _cs;
411
412 os_memcpy(&_cs, cs_id, CS_ID_LEN);
413 cs = be_to_host64(_cs);
414
415 for (i = 0; i < CS_TABLE_SIZE; i++) {
416 if (cipher_suite_tbl[i].id == cs) {
417 *idx = i;
418 return &cipher_suite_tbl[i];
419 }
420 }
421
422 return NULL;
423 }
424
425
mka_sci_u64(struct ieee802_1x_mka_sci * sci)426 u64 mka_sci_u64(struct ieee802_1x_mka_sci *sci)
427 {
428 struct ieee802_1x_mka_sci tmp;
429
430 os_memcpy(tmp.addr, sci->addr, ETH_ALEN);
431 tmp.port = sci->port;
432
433 return *((u64 *) &tmp);
434 }
435
436
sci_equal(const struct ieee802_1x_mka_sci * a,const struct ieee802_1x_mka_sci * b)437 static bool sci_equal(const struct ieee802_1x_mka_sci *a,
438 const struct ieee802_1x_mka_sci *b)
439 {
440 return os_memcmp(a, b, sizeof(struct ieee802_1x_mka_sci)) == 0;
441 }
442
443
444 /**
445 * ieee802_1x_kay_get_peer_sci
446 */
447 static struct ieee802_1x_kay_peer *
ieee802_1x_kay_get_peer_sci(struct ieee802_1x_mka_participant * participant,const struct ieee802_1x_mka_sci * sci)448 ieee802_1x_kay_get_peer_sci(struct ieee802_1x_mka_participant *participant,
449 const struct ieee802_1x_mka_sci *sci)
450 {
451 struct ieee802_1x_kay_peer *peer;
452
453 dl_list_for_each(peer, &participant->live_peers,
454 struct ieee802_1x_kay_peer, list) {
455 if (sci_equal(&peer->sci, sci))
456 return peer;
457 }
458
459 dl_list_for_each(peer, &participant->potential_peers,
460 struct ieee802_1x_kay_peer, list) {
461 if (sci_equal(&peer->sci, sci))
462 return peer;
463 }
464
465 return NULL;
466 }
467
468
469 static void ieee802_1x_kay_use_data_key(struct data_key *pkey);
470
471 /**
472 * ieee802_1x_kay_init_receive_sa -
473 */
474 static struct receive_sa *
ieee802_1x_kay_init_receive_sa(struct receive_sc * psc,u8 an,u32 lowest_pn,struct data_key * key)475 ieee802_1x_kay_init_receive_sa(struct receive_sc *psc, u8 an, u32 lowest_pn,
476 struct data_key *key)
477 {
478 struct receive_sa *psa;
479
480 if (!psc || !key)
481 return NULL;
482
483 psa = os_zalloc(sizeof(*psa));
484 if (!psa) {
485 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
486 return NULL;
487 }
488
489 ieee802_1x_kay_use_data_key(key);
490 psa->pkey = key;
491 psa->lowest_pn = lowest_pn;
492 psa->next_pn = lowest_pn;
493 psa->an = an;
494 psa->sc = psc;
495
496 os_get_time(&psa->created_time);
497 psa->in_use = false;
498
499 dl_list_add(&psc->sa_list, &psa->list);
500 wpa_printf(MSG_DEBUG,
501 "KaY: Create receive SA(an: %hhu lowest_pn: %u) of SC",
502 an, lowest_pn);
503
504 return psa;
505 }
506
507
508 static void ieee802_1x_kay_deinit_data_key(struct data_key *pkey);
509
510 /**
511 * ieee802_1x_kay_deinit_receive_sa -
512 */
ieee802_1x_kay_deinit_receive_sa(struct receive_sa * psa)513 static void ieee802_1x_kay_deinit_receive_sa(struct receive_sa *psa)
514 {
515 ieee802_1x_kay_deinit_data_key(psa->pkey);
516 psa->pkey = NULL;
517 wpa_printf(MSG_DEBUG,
518 "KaY: Delete receive SA(an: %hhu) of SC",
519 psa->an);
520 dl_list_del(&psa->list);
521 os_free(psa);
522 }
523
524
525 /**
526 * ieee802_1x_kay_init_receive_sc -
527 */
528 static struct receive_sc *
ieee802_1x_kay_init_receive_sc(const struct ieee802_1x_mka_sci * psci)529 ieee802_1x_kay_init_receive_sc(const struct ieee802_1x_mka_sci *psci)
530 {
531 struct receive_sc *psc;
532
533 if (!psci)
534 return NULL;
535
536 psc = os_zalloc(sizeof(*psc));
537 if (!psc) {
538 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
539 return NULL;
540 }
541
542 os_memcpy(&psc->sci, psci, sizeof(psc->sci));
543
544 os_get_time(&psc->created_time);
545 psc->receiving = false;
546
547 dl_list_init(&psc->sa_list);
548 wpa_printf(MSG_DEBUG, "KaY: Create receive SC: SCI %s",
549 sci_txt(&psc->sci));
550
551 return psc;
552 }
553
554
ieee802_1x_delete_receive_sa(struct ieee802_1x_kay * kay,struct receive_sa * sa)555 static void ieee802_1x_delete_receive_sa(struct ieee802_1x_kay *kay,
556 struct receive_sa *sa)
557 {
558 secy_disable_receive_sa(kay, sa);
559 secy_delete_receive_sa(kay, sa);
560 ieee802_1x_kay_deinit_receive_sa(sa);
561 }
562
563
564 /**
565 * ieee802_1x_kay_deinit_receive_sc -
566 **/
567 static void
ieee802_1x_kay_deinit_receive_sc(struct ieee802_1x_mka_participant * participant,struct receive_sc * psc)568 ieee802_1x_kay_deinit_receive_sc(
569 struct ieee802_1x_mka_participant *participant, struct receive_sc *psc)
570 {
571 struct receive_sa *psa, *pre_sa;
572
573 wpa_printf(MSG_DEBUG, "KaY: Delete receive SC");
574 dl_list_for_each_safe(psa, pre_sa, &psc->sa_list, struct receive_sa,
575 list)
576 ieee802_1x_delete_receive_sa(participant->kay, psa);
577
578 dl_list_del(&psc->list);
579 secy_delete_receive_sc(participant->kay, psc);
580 os_free(psc);
581 }
582
583
ieee802_1x_kay_dump_peer(struct ieee802_1x_kay_peer * peer)584 static void ieee802_1x_kay_dump_peer(struct ieee802_1x_kay_peer *peer)
585 {
586 wpa_printf(MSG_DEBUG, "\tMI: %s MN: %d SCI: %s",
587 mi_txt(peer->mi), peer->mn, sci_txt(&peer->sci));
588 }
589
590
591 static struct ieee802_1x_kay_peer *
ieee802_1x_kay_create_peer(const u8 * mi,u32 mn)592 ieee802_1x_kay_create_peer(const u8 *mi, u32 mn)
593 {
594 struct ieee802_1x_kay_peer *peer;
595 struct os_reltime now;
596
597 peer = os_zalloc(sizeof(*peer));
598 if (!peer) {
599 wpa_printf(MSG_ERROR, "KaY-%s: out of memory", __func__);
600 return NULL;
601 }
602
603 os_memcpy(peer->mi, mi, MI_LEN);
604 peer->mn = mn;
605 os_get_reltime(&now);
606 peer->expire = now.sec + MKA_LIFE_TIME / 1000;
607 peer->sak_used = false;
608 peer->missing_sak_use_count = 0;
609
610 return peer;
611 }
612
613
614 /**
615 * ieee802_1x_kay_create_live_peer
616 */
617 static struct ieee802_1x_kay_peer *
ieee802_1x_kay_create_live_peer(struct ieee802_1x_mka_participant * participant,const u8 * mi,u32 mn)618 ieee802_1x_kay_create_live_peer(struct ieee802_1x_mka_participant *participant,
619 const u8 *mi, u32 mn)
620 {
621 struct ieee802_1x_kay_peer *peer;
622 struct receive_sc *rxsc;
623
624 peer = ieee802_1x_kay_create_peer(mi, mn);
625 if (!peer)
626 return NULL;
627
628 os_memcpy(&peer->sci, &participant->current_peer_sci,
629 sizeof(peer->sci));
630
631 rxsc = ieee802_1x_kay_init_receive_sc(&peer->sci);
632 if (!rxsc) {
633 os_free(peer);
634 return NULL;
635 }
636
637 if (secy_create_receive_sc(participant->kay, rxsc)) {
638 os_free(rxsc);
639 os_free(peer);
640 return NULL;
641 }
642 dl_list_add(&participant->live_peers, &peer->list);
643 dl_list_add(&participant->rxsc_list, &rxsc->list);
644
645 wpa_printf(MSG_DEBUG, "KaY: Live peer created");
646 ieee802_1x_kay_dump_peer(peer);
647
648 return peer;
649 }
650
651
652 /**
653 * ieee802_1x_kay_create_potential_peer
654 */
655 static struct ieee802_1x_kay_peer *
ieee802_1x_kay_create_potential_peer(struct ieee802_1x_mka_participant * participant,const u8 * mi,u32 mn)656 ieee802_1x_kay_create_potential_peer(
657 struct ieee802_1x_mka_participant *participant, const u8 *mi, u32 mn)
658 {
659 struct ieee802_1x_kay_peer *peer;
660
661 peer = ieee802_1x_kay_create_peer(mi, mn);
662 if (!peer)
663 return NULL;
664
665 dl_list_add(&participant->potential_peers, &peer->list);
666
667 wpa_printf(MSG_DEBUG, "KaY: Potential peer created");
668 ieee802_1x_kay_dump_peer(peer);
669
670 return peer;
671 }
672
673
674 /**
675 * ieee802_1x_kay_move_live_peer
676 */
677 static struct ieee802_1x_kay_peer *
ieee802_1x_kay_move_live_peer(struct ieee802_1x_mka_participant * participant,u8 * mi,u32 mn)678 ieee802_1x_kay_move_live_peer(struct ieee802_1x_mka_participant *participant,
679 u8 *mi, u32 mn)
680 {
681 struct ieee802_1x_kay_peer *peer;
682 struct receive_sc *rxsc;
683 struct os_reltime now;
684
685 peer = ieee802_1x_kay_get_potential_peer(participant, mi);
686 if (!peer)
687 return NULL;
688
689 rxsc = ieee802_1x_kay_init_receive_sc(&participant->current_peer_sci);
690 if (!rxsc)
691 return NULL;
692
693 os_memcpy(&peer->sci, &participant->current_peer_sci,
694 sizeof(peer->sci));
695 peer->mn = mn;
696 os_get_reltime(&now);
697 peer->expire = now.sec + MKA_LIFE_TIME / 1000;
698
699 wpa_printf(MSG_DEBUG, "KaY: Move potential peer to live peer");
700 ieee802_1x_kay_dump_peer(peer);
701
702 dl_list_del(&peer->list);
703 if (secy_create_receive_sc(participant->kay, rxsc)) {
704 wpa_printf(MSG_ERROR, "KaY: Can't create SC, discard peer");
705 os_free(rxsc);
706 os_free(peer);
707 return NULL;
708 }
709 dl_list_add_tail(&participant->live_peers, &peer->list);
710
711 dl_list_add(&participant->rxsc_list, &rxsc->list);
712
713 return peer;
714 }
715
716
717
718 /**
719 * ieee802_1x_mka_basic_body_present -
720 */
721 static bool
ieee802_1x_mka_basic_body_present(struct ieee802_1x_mka_participant * participant)722 ieee802_1x_mka_basic_body_present(
723 struct ieee802_1x_mka_participant *participant)
724 {
725 return true;
726 }
727
728
729 /**
730 * ieee802_1x_mka_basic_body_length -
731 */
732 static int
ieee802_1x_mka_basic_body_length(struct ieee802_1x_mka_participant * participant)733 ieee802_1x_mka_basic_body_length(struct ieee802_1x_mka_participant *participant)
734 {
735 int length;
736
737 length = sizeof(struct ieee802_1x_mka_basic_body);
738 length += participant->ckn.len;
739 return MKA_ALIGN_LENGTH(length);
740 }
741
742
743 /**
744 * ieee802_1x_mka_encode_basic_body
745 */
746 static int
ieee802_1x_mka_encode_basic_body(struct ieee802_1x_mka_participant * participant,struct wpabuf * buf)747 ieee802_1x_mka_encode_basic_body(
748 struct ieee802_1x_mka_participant *participant,
749 struct wpabuf *buf)
750 {
751 struct ieee802_1x_mka_basic_body *body;
752 struct ieee802_1x_kay *kay = participant->kay;
753 unsigned int length = sizeof(struct ieee802_1x_mka_basic_body);
754
755 length += participant->ckn.len;
756 body = wpabuf_put(buf, MKA_ALIGN_LENGTH(length));
757
758 body->version = kay->mka_version;
759 body->priority = kay->actor_priority;
760 /* The Key Server flag is set if and only if the participant has not
761 * decided that another participant is or will be the Key Server. */
762 if (participant->is_elected)
763 body->key_server = participant->is_key_server;
764 else
765 body->key_server = participant->can_be_key_server;
766
767 body->macsec_desired = kay->macsec_desired;
768 body->macsec_capability = kay->macsec_capable;
769 set_mka_param_body_len(body, length - MKA_HDR_LEN);
770
771 os_memcpy(body->actor_sci.addr, kay->actor_sci.addr,
772 sizeof(kay->actor_sci.addr));
773 body->actor_sci.port = kay->actor_sci.port;
774
775 os_memcpy(body->actor_mi, participant->mi, sizeof(body->actor_mi));
776 participant->mn = participant->mn + 1;
777 body->actor_mn = host_to_be32(participant->mn);
778 os_memcpy(body->algo_agility, kay->algo_agility,
779 sizeof(body->algo_agility));
780
781 os_memcpy(body->ckn, participant->ckn.name, participant->ckn.len);
782
783 ieee802_1x_mka_dump_basic_body(body);
784
785 return 0;
786 }
787
788
789 static bool
reset_participant_mi(struct ieee802_1x_mka_participant * participant)790 reset_participant_mi(struct ieee802_1x_mka_participant *participant)
791 {
792 if (os_get_random(participant->mi, sizeof(participant->mi)) < 0)
793 return false;
794 participant->mn = 0;
795
796 return true;
797 }
798
799
800 /**
801 * ieee802_1x_mka_decode_basic_body -
802 */
803 static struct ieee802_1x_mka_participant *
ieee802_1x_mka_decode_basic_body(struct ieee802_1x_kay * kay,const u8 * mka_msg,size_t msg_len)804 ieee802_1x_mka_decode_basic_body(struct ieee802_1x_kay *kay, const u8 *mka_msg,
805 size_t msg_len)
806 {
807 struct ieee802_1x_mka_participant *participant;
808 const struct ieee802_1x_mka_basic_body *body;
809 struct ieee802_1x_kay_peer *peer;
810 size_t ckn_len;
811 size_t body_len;
812
813 body = (const struct ieee802_1x_mka_basic_body *) mka_msg;
814
815 if (body->version > MKA_VERSION_ID) {
816 wpa_printf(MSG_DEBUG,
817 "KaY: Peer's version(%d) greater than MKA current version(%d)",
818 body->version, MKA_VERSION_ID);
819 }
820 if (kay->is_obliged_key_server && body->key_server) {
821 wpa_printf(MSG_DEBUG, "KaY: I must be key server - ignore MKPDU claiming to be from a key server");
822 return NULL;
823 }
824
825 body_len = get_mka_param_body_len(body);
826 if (body_len < sizeof(struct ieee802_1x_mka_basic_body) - MKA_HDR_LEN) {
827 wpa_printf(MSG_DEBUG, "KaY: Too small body length %zu",
828 body_len);
829 return NULL;
830 }
831 ckn_len = body_len -
832 (sizeof(struct ieee802_1x_mka_basic_body) - MKA_HDR_LEN);
833 participant = ieee802_1x_kay_get_participant(kay, body->ckn, ckn_len);
834 if (!participant) {
835 wpa_printf(MSG_DEBUG,
836 "KaY: Peer is not included in my CA - ignore MKPDU");
837 return NULL;
838 }
839
840 /* If the peer's MI is my MI, I will choose new MI */
841 if (os_memcmp(body->actor_mi, participant->mi, MI_LEN) == 0) {
842 if (!reset_participant_mi(participant))
843 return NULL;
844 wpa_printf(MSG_DEBUG,
845 "KaY: Peer using my MI - selected a new random MI: %s",
846 mi_txt(participant->mi));
847 }
848
849 os_memcpy(participant->current_peer_id.mi, body->actor_mi, MI_LEN);
850 participant->current_peer_id.mn = body->actor_mn;
851 os_memcpy(participant->current_peer_sci.addr, body->actor_sci.addr,
852 sizeof(participant->current_peer_sci.addr));
853 participant->current_peer_sci.port = body->actor_sci.port;
854
855 /* handler peer */
856 peer = ieee802_1x_kay_get_peer(participant, body->actor_mi);
857 if (!peer) {
858 /* Check duplicated SCI
859 *
860 * A duplicated SCI indicates either an active attacker or
861 * a valid peer whose MI is being changed. The latter scenario
862 * is more likely because to have gotten this far the received
863 * MKPDU must have had a valid ICV, indicating the peer holds
864 * the same CAK as our participant.
865 *
866 * Before creating a new peer object for the new MI we must
867 * clean up the resources (SCs and SAs) associated with the
868 * old peer. An easy way to do this is to ignore MKPDUs with
869 * the new MI's for now and just wait for the old peer to
870 * time out and clean itself up (within MKA_LIFE_TIME).
871 *
872 * This method is preferable to deleting the old peer here
873 * and now and continuing on with processing because if this
874 * MKPDU is from an attacker it's better to ignore the MKPDU
875 * than to process it (and delete a valid peer as well).
876 */
877 peer = ieee802_1x_kay_get_peer_sci(participant,
878 &body->actor_sci);
879 if (peer) {
880 os_time_t new_expire;
881 struct os_reltime now;
882
883 wpa_printf(MSG_WARNING,
884 "KaY: duplicated SCI detected - maybe active attacker or peer selected new MI - ignore MKPDU");
885 /* Reduce timeout to speed up this process but left the
886 * chance for old one to prove aliveness. */
887 os_get_reltime(&now);
888 new_expire = now.sec + MKA_HELLO_TIME * 1.5 / 1000;
889 if (peer->expire > new_expire)
890 peer->expire = new_expire;
891 return NULL;
892 }
893
894 peer = ieee802_1x_kay_create_potential_peer(
895 participant, body->actor_mi,
896 be_to_host32(body->actor_mn));
897 if (!peer) {
898 wpa_printf(MSG_DEBUG,
899 "KaY: No potential peer entry found - ignore MKPDU");
900 return NULL;
901 }
902
903 peer->macsec_desired = body->macsec_desired;
904 peer->macsec_capability = body->macsec_capability;
905 peer->is_key_server = body->key_server;
906 peer->key_server_priority = body->priority;
907 } else if (peer->mn < be_to_host32(body->actor_mn)) {
908 peer->mn = be_to_host32(body->actor_mn);
909 peer->macsec_desired = body->macsec_desired;
910 peer->macsec_capability = body->macsec_capability;
911 peer->is_key_server = body->key_server;
912 peer->key_server_priority = body->priority;
913 } else {
914 wpa_printf(MSG_WARNING,
915 "KaY: The peer MN did not increase - ignore MKPDU");
916 return NULL;
917 }
918
919 return participant;
920 }
921
922
923 /**
924 * ieee802_1x_mka_live_peer_body_present
925 */
926 static bool
ieee802_1x_mka_live_peer_body_present(struct ieee802_1x_mka_participant * participant)927 ieee802_1x_mka_live_peer_body_present(
928 struct ieee802_1x_mka_participant *participant)
929 {
930 return !dl_list_empty(&participant->live_peers);
931 }
932
933
934 /**
935 * ieee802_1x_kay_get_live_peer_length
936 */
937 static int
ieee802_1x_mka_get_live_peer_length(struct ieee802_1x_mka_participant * participant)938 ieee802_1x_mka_get_live_peer_length(
939 struct ieee802_1x_mka_participant *participant)
940 {
941 int len = MKA_HDR_LEN;
942 struct ieee802_1x_kay_peer *peer;
943
944 dl_list_for_each(peer, &participant->live_peers,
945 struct ieee802_1x_kay_peer, list)
946 len += sizeof(struct ieee802_1x_mka_peer_id);
947
948 return MKA_ALIGN_LENGTH(len);
949 }
950
951
952 /**
953 * ieee802_1x_mka_encode_live_peer_body -
954 */
955 static int
ieee802_1x_mka_encode_live_peer_body(struct ieee802_1x_mka_participant * participant,struct wpabuf * buf)956 ieee802_1x_mka_encode_live_peer_body(
957 struct ieee802_1x_mka_participant *participant,
958 struct wpabuf *buf)
959 {
960 struct ieee802_1x_mka_peer_body *body;
961 struct ieee802_1x_kay_peer *peer;
962 unsigned int length;
963 struct ieee802_1x_mka_peer_id *body_peer;
964
965 length = ieee802_1x_mka_get_live_peer_length(participant);
966 body = wpabuf_put(buf, sizeof(struct ieee802_1x_mka_peer_body));
967
968 body->type = MKA_LIVE_PEER_LIST;
969 set_mka_param_body_len(body, length - MKA_HDR_LEN);
970
971 dl_list_for_each(peer, &participant->live_peers,
972 struct ieee802_1x_kay_peer, list) {
973 body_peer = wpabuf_put(buf,
974 sizeof(struct ieee802_1x_mka_peer_id));
975 os_memcpy(body_peer->mi, peer->mi, MI_LEN);
976 body_peer->mn = host_to_be32(peer->mn);
977 }
978
979 ieee802_1x_mka_dump_peer_body(body);
980 return 0;
981 }
982
983 /**
984 * ieee802_1x_mka_potential_peer_body_present
985 */
986 static bool
ieee802_1x_mka_potential_peer_body_present(struct ieee802_1x_mka_participant * participant)987 ieee802_1x_mka_potential_peer_body_present(
988 struct ieee802_1x_mka_participant *participant)
989 {
990 return !dl_list_empty(&participant->potential_peers);
991 }
992
993
994 /**
995 * ieee802_1x_kay_get_potential_peer_length
996 */
997 static int
ieee802_1x_mka_get_potential_peer_length(struct ieee802_1x_mka_participant * participant)998 ieee802_1x_mka_get_potential_peer_length(
999 struct ieee802_1x_mka_participant *participant)
1000 {
1001 int len = MKA_HDR_LEN;
1002 struct ieee802_1x_kay_peer *peer;
1003
1004 dl_list_for_each(peer, &participant->potential_peers,
1005 struct ieee802_1x_kay_peer, list)
1006 len += sizeof(struct ieee802_1x_mka_peer_id);
1007
1008 return MKA_ALIGN_LENGTH(len);
1009 }
1010
1011
1012 /**
1013 * ieee802_1x_mka_encode_potential_peer_body -
1014 */
1015 static int
ieee802_1x_mka_encode_potential_peer_body(struct ieee802_1x_mka_participant * participant,struct wpabuf * buf)1016 ieee802_1x_mka_encode_potential_peer_body(
1017 struct ieee802_1x_mka_participant *participant,
1018 struct wpabuf *buf)
1019 {
1020 struct ieee802_1x_mka_peer_body *body;
1021 struct ieee802_1x_kay_peer *peer;
1022 unsigned int length;
1023 struct ieee802_1x_mka_peer_id *body_peer;
1024
1025 length = ieee802_1x_mka_get_potential_peer_length(participant);
1026 body = wpabuf_put(buf, sizeof(struct ieee802_1x_mka_peer_body));
1027
1028 body->type = MKA_POTENTIAL_PEER_LIST;
1029 set_mka_param_body_len(body, length - MKA_HDR_LEN);
1030
1031 dl_list_for_each(peer, &participant->potential_peers,
1032 struct ieee802_1x_kay_peer, list) {
1033 body_peer = wpabuf_put(buf,
1034 sizeof(struct ieee802_1x_mka_peer_id));
1035 os_memcpy(body_peer->mi, peer->mi, MI_LEN);
1036 body_peer->mn = host_to_be32(peer->mn);
1037 }
1038
1039 ieee802_1x_mka_dump_peer_body(body);
1040 return 0;
1041 }
1042
1043
1044 /**
1045 * ieee802_1x_mka_i_in_peerlist -
1046 */
1047 static bool
ieee802_1x_mka_i_in_peerlist(struct ieee802_1x_mka_participant * participant,const u8 * mka_msg,size_t msg_len)1048 ieee802_1x_mka_i_in_peerlist(struct ieee802_1x_mka_participant *participant,
1049 const u8 *mka_msg, size_t msg_len)
1050 {
1051 struct ieee802_1x_mka_hdr *hdr;
1052 size_t body_len;
1053 size_t left_len;
1054 u8 body_type;
1055 const u8 *pos;
1056 size_t i;
1057
1058 for (pos = mka_msg, left_len = msg_len;
1059 left_len > MKA_HDR_LEN + DEFAULT_ICV_LEN;
1060 left_len -= MKA_ALIGN_LENGTH(body_len) + MKA_HDR_LEN,
1061 pos += MKA_ALIGN_LENGTH(body_len) + MKA_HDR_LEN) {
1062 hdr = (struct ieee802_1x_mka_hdr *) pos;
1063 body_len = get_mka_param_body_len(hdr);
1064 body_type = get_mka_param_body_type(hdr);
1065
1066 if (left_len < (MKA_HDR_LEN + MKA_ALIGN_LENGTH(body_len) + DEFAULT_ICV_LEN)) {
1067 wpa_printf(MSG_ERROR,
1068 "KaY: MKA Peer Packet Body Length (%zu bytes) is less than the Parameter Set Header Length (%zu bytes) + the Parameter Set Body Length (%zu bytes) + %d bytes of ICV",
1069 left_len, MKA_HDR_LEN,
1070 MKA_ALIGN_LENGTH(body_len),
1071 DEFAULT_ICV_LEN);
1072 return false;
1073 }
1074
1075 if (body_type != MKA_LIVE_PEER_LIST &&
1076 body_type != MKA_POTENTIAL_PEER_LIST)
1077 continue;
1078
1079 if ((body_len % 16) != 0) {
1080 wpa_printf(MSG_ERROR,
1081 "KaY: MKA Peer Packet Body Length (%zu bytes) should be a multiple of 16 octets",
1082 body_len);
1083 continue;
1084 }
1085
1086 ieee802_1x_mka_dump_peer_body(
1087 (struct ieee802_1x_mka_peer_body *)pos);
1088
1089 for (i = 0; i < body_len;
1090 i += sizeof(struct ieee802_1x_mka_peer_id)) {
1091 const struct ieee802_1x_mka_peer_id *peer_mi;
1092
1093 peer_mi = (const struct ieee802_1x_mka_peer_id *)
1094 (pos + MKA_HDR_LEN + i);
1095 if (os_memcmp(peer_mi->mi, participant->mi,
1096 MI_LEN) == 0) {
1097 u32 mn = be_to_host32(peer_mi->mn);
1098
1099 wpa_printf(MSG_DEBUG,
1100 "KaY: My MI - received MN %u, most recently transmitted MN %u",
1101 mn, participant->mn);
1102 /* IEEE Std 802.1X-2010 is not exactly clear
1103 * which values of MN should be accepted here.
1104 * It uses "acceptably recent MN" language
1105 * without defining what would be acceptable
1106 * recent. For now, allow the last two used MN
1107 * values (i.e., peer having copied my MI,MN
1108 * from either of the last two MKPDUs that I
1109 * have sent). */
1110 if (mn == participant->mn ||
1111 (participant->mn > 1 &&
1112 mn == participant->mn - 1))
1113 return true;
1114 }
1115 }
1116 }
1117
1118 return false;
1119 }
1120
1121
1122 /**
1123 * ieee802_1x_mka_decode_live_peer_body -
1124 */
ieee802_1x_mka_decode_live_peer_body(struct ieee802_1x_mka_participant * participant,const u8 * peer_msg,size_t msg_len)1125 static int ieee802_1x_mka_decode_live_peer_body(
1126 struct ieee802_1x_mka_participant *participant,
1127 const u8 *peer_msg, size_t msg_len)
1128 {
1129 const struct ieee802_1x_mka_hdr *hdr;
1130 struct ieee802_1x_kay_peer *peer;
1131 size_t body_len;
1132 size_t i;
1133 bool is_included;
1134
1135 is_included = ieee802_1x_kay_is_in_live_peer(
1136 participant, participant->current_peer_id.mi);
1137
1138 hdr = (const struct ieee802_1x_mka_hdr *) peer_msg;
1139 body_len = get_mka_param_body_len(hdr);
1140 if (body_len % 16 != 0) {
1141 wpa_printf(MSG_ERROR,
1142 "KaY: MKA Peer Packet Body Length (%zu bytes) should be a multiple of 16 octets",
1143 body_len);
1144 return -1;
1145 }
1146
1147 for (i = 0; i < body_len; i += sizeof(struct ieee802_1x_mka_peer_id)) {
1148 const struct ieee802_1x_mka_peer_id *peer_mi;
1149 u32 peer_mn;
1150
1151 peer_mi = (const struct ieee802_1x_mka_peer_id *)
1152 (peer_msg + MKA_HDR_LEN + i);
1153 peer_mn = be_to_host32(peer_mi->mn);
1154
1155 /* it is myself */
1156 if (os_memcmp(peer_mi, participant->mi, MI_LEN) == 0) {
1157 /* My message id is used by other participant */
1158 if (peer_mn > participant->mn &&
1159 !reset_participant_mi(participant))
1160 wpa_printf(MSG_DEBUG, "KaY: Could not update mi");
1161 continue;
1162 }
1163
1164 if (!is_included)
1165 continue;
1166
1167 peer = ieee802_1x_kay_get_peer(participant, peer_mi->mi);
1168 if (peer) {
1169 peer->mn = peer_mn;
1170 } else if (!ieee802_1x_kay_create_potential_peer(
1171 participant, peer_mi->mi, peer_mn)) {
1172 return -1;
1173 }
1174 }
1175
1176 return 0;
1177 }
1178
1179
1180 /**
1181 * ieee802_1x_mka_decode_potential_peer_body -
1182 */
1183 static int
ieee802_1x_mka_decode_potential_peer_body(struct ieee802_1x_mka_participant * participant,const u8 * peer_msg,size_t msg_len)1184 ieee802_1x_mka_decode_potential_peer_body(
1185 struct ieee802_1x_mka_participant *participant,
1186 const u8 *peer_msg, size_t msg_len)
1187 {
1188 const struct ieee802_1x_mka_hdr *hdr;
1189 size_t body_len;
1190 size_t i;
1191
1192 hdr = (const struct ieee802_1x_mka_hdr *) peer_msg;
1193 body_len = get_mka_param_body_len(hdr);
1194 if (body_len % 16 != 0) {
1195 wpa_printf(MSG_ERROR,
1196 "KaY: MKA Peer Packet Body Length (%zu bytes) should be a multiple of 16 octets",
1197 body_len);
1198 return -1;
1199 }
1200
1201 for (i = 0; i < body_len; i += sizeof(struct ieee802_1x_mka_peer_id)) {
1202 const struct ieee802_1x_mka_peer_id *peer_mi;
1203 u32 peer_mn;
1204
1205 peer_mi = (struct ieee802_1x_mka_peer_id *)
1206 (peer_msg + MKA_HDR_LEN + i);
1207 peer_mn = be_to_host32(peer_mi->mn);
1208
1209 /* it is myself */
1210 if (os_memcmp(peer_mi, participant->mi, MI_LEN) == 0) {
1211 /* My message id is used by other participant */
1212 if (peer_mn > participant->mn &&
1213 !reset_participant_mi(participant))
1214 wpa_printf(MSG_DEBUG, "KaY: Could not update mi");
1215 continue;
1216 }
1217 }
1218
1219 return 0;
1220 }
1221
1222
1223 /**
1224 * ieee802_1x_mka_sak_use_body_present
1225 */
1226 static bool
ieee802_1x_mka_sak_use_body_present(struct ieee802_1x_mka_participant * participant)1227 ieee802_1x_mka_sak_use_body_present(
1228 struct ieee802_1x_mka_participant *participant)
1229 {
1230 return participant->to_use_sak;
1231 }
1232
1233
1234 /**
1235 * ieee802_1x_mka_get_sak_use_length
1236 */
1237 static int
ieee802_1x_mka_get_sak_use_length(struct ieee802_1x_mka_participant * participant)1238 ieee802_1x_mka_get_sak_use_length(
1239 struct ieee802_1x_mka_participant *participant)
1240 {
1241 int length = MKA_HDR_LEN;
1242
1243 if (participant->kay->macsec_desired && participant->advised_desired)
1244 length = sizeof(struct ieee802_1x_mka_sak_use_body);
1245
1246 return MKA_ALIGN_LENGTH(length);
1247 }
1248
1249
1250 /**
1251 * ieee802_1x_mka_get_lpn
1252 */
1253 static u32
ieee802_1x_mka_get_lpn(struct ieee802_1x_mka_participant * principal,struct ieee802_1x_mka_ki * ki)1254 ieee802_1x_mka_get_lpn(struct ieee802_1x_mka_participant *principal,
1255 struct ieee802_1x_mka_ki *ki)
1256 {
1257 struct transmit_sa *txsa;
1258 u32 lpn = 0;
1259
1260 dl_list_for_each(txsa, &principal->txsc->sa_list,
1261 struct transmit_sa, list) {
1262 if (is_ki_equal(&txsa->pkey->key_identifier, ki)) {
1263 /* Per IEEE Std 802.1X-2010, Clause 9, "Each SecY uses
1264 * MKA to communicate the lowest PN used for
1265 * transmission with the SAK within the last two
1266 * seconds". Achieve this 2 second delay by setting the
1267 * lpn using the transmit next PN (i.e., txsa->next_pn)
1268 * that was read last time here (i.e., mka_hello_time
1269 * 2 seconds ago).
1270 *
1271 * The lowest acceptable PN is the same as the last
1272 * transmitted PN, which is one less than the next
1273 * transmit PN.
1274 *
1275 * NOTE: This method only works if mka_hello_time is 2s.
1276 */
1277 lpn = (txsa->next_pn > 0) ? (txsa->next_pn - 1) : 0;
1278
1279 /* Now read the current transmit next PN for use next
1280 * time through. */
1281 secy_get_transmit_next_pn(principal->kay, txsa);
1282 break;
1283 }
1284 }
1285
1286 if (lpn == 0)
1287 lpn = 1;
1288
1289 return lpn;
1290 }
1291
1292
1293 /**
1294 * ieee802_1x_mka_encode_sak_use_body -
1295 */
1296 static int
ieee802_1x_mka_encode_sak_use_body(struct ieee802_1x_mka_participant * participant,struct wpabuf * buf)1297 ieee802_1x_mka_encode_sak_use_body(
1298 struct ieee802_1x_mka_participant *participant,
1299 struct wpabuf *buf)
1300 {
1301 struct ieee802_1x_mka_sak_use_body *body;
1302 struct ieee802_1x_kay *kay = participant->kay;
1303 unsigned int length;
1304 u32 olpn, llpn;
1305
1306 length = ieee802_1x_mka_get_sak_use_length(participant);
1307 body = wpabuf_put(buf, length);
1308
1309 body->type = MKA_SAK_USE;
1310 set_mka_param_body_len(body, length - MKA_HDR_LEN);
1311
1312 if (length == MKA_HDR_LEN) {
1313 body->ptx = true;
1314 body->prx = true;
1315 body->lan = 0;
1316 body->lrx = false;
1317 body->ltx = false;
1318 body->delay_protect = false;
1319 return 0;
1320 }
1321
1322 /* data delay protect */
1323 body->delay_protect = kay->mka_hello_time <= MKA_BOUNDED_HELLO_TIME;
1324 /* lowest accept packet numbers */
1325 olpn = ieee802_1x_mka_get_lpn(participant, &participant->oki);
1326 body->olpn = host_to_be32(olpn);
1327 llpn = ieee802_1x_mka_get_lpn(participant, &participant->lki);
1328 body->llpn = host_to_be32(llpn);
1329 if (participant->is_key_server) {
1330 /* The CP will spend most of it's time in RETIRE where only
1331 * the old key is populated. Therefore we should be checking
1332 * the OLPN most of the time.
1333 */
1334 if (participant->lrx) {
1335 if (llpn > kay->pn_exhaustion) {
1336 wpa_printf(MSG_WARNING,
1337 "KaY: My LLPN exhaustion");
1338 participant->new_sak = true;
1339 }
1340 } else {
1341 if (olpn > kay->pn_exhaustion) {
1342 wpa_printf(MSG_WARNING,
1343 "KaY: My OLPN exhaustion");
1344 participant->new_sak = true;
1345 }
1346 }
1347 }
1348
1349 /* plain tx, plain rx */
1350 body->ptx = !kay->macsec_protect;
1351 body->prx = kay->macsec_validate != Strict;
1352
1353 /* latest key: rx, tx, key server member identifier key number */
1354 body->lan = participant->lan;
1355 os_memcpy(body->lsrv_mi, participant->lki.mi, sizeof(body->lsrv_mi));
1356 body->lkn = host_to_be32(participant->lki.kn);
1357 body->lrx = participant->lrx;
1358 body->ltx = participant->ltx;
1359
1360 /* old key: rx, tx, key server member identifier key number */
1361 body->oan = participant->oan;
1362 if (participant->oki.kn != participant->lki.kn &&
1363 participant->oki.kn != 0) {
1364 body->otx = true;
1365 body->orx = true;
1366 os_memcpy(body->osrv_mi, participant->oki.mi,
1367 sizeof(body->osrv_mi));
1368 body->okn = host_to_be32(participant->oki.kn);
1369 } else {
1370 body->otx = false;
1371 body->orx = false;
1372 }
1373
1374 /* set CP's variable */
1375 if (body->ltx) {
1376 kay->tx_enable = true;
1377 kay->port_enable = true;
1378 }
1379 if (body->lrx)
1380 kay->rx_enable = true;
1381
1382 ieee802_1x_mka_dump_sak_use_body(body);
1383 return 0;
1384 }
1385
1386
1387 /**
1388 * ieee802_1x_mka_decode_sak_use_body -
1389 */
1390 static int
ieee802_1x_mka_decode_sak_use_body(struct ieee802_1x_mka_participant * participant,const u8 * mka_msg,size_t msg_len)1391 ieee802_1x_mka_decode_sak_use_body(
1392 struct ieee802_1x_mka_participant *participant,
1393 const u8 *mka_msg, size_t msg_len)
1394 {
1395 struct ieee802_1x_mka_hdr *hdr;
1396 struct ieee802_1x_mka_sak_use_body *body;
1397 struct ieee802_1x_kay_peer *peer;
1398 struct data_key *sa_key = NULL;
1399 size_t body_len;
1400 struct ieee802_1x_mka_ki ki;
1401 u32 lpn;
1402 struct ieee802_1x_kay *kay = participant->kay;
1403 u32 olpn, llpn;
1404
1405 if (!participant->principal) {
1406 wpa_printf(MSG_WARNING, "KaY: Participant is not principal");
1407 return -1;
1408 }
1409 peer = ieee802_1x_kay_get_live_peer(participant,
1410 participant->current_peer_id.mi);
1411 if (!peer) {
1412 wpa_printf(MSG_WARNING,
1413 "KaY: The peer (%s) is not my live peer - ignore MACsec SAK Use parameter set",
1414 mi_txt(participant->current_peer_id.mi));
1415 return -1;
1416 }
1417
1418 hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1419 body_len = get_mka_param_body_len(hdr);
1420 body = (struct ieee802_1x_mka_sak_use_body *) mka_msg;
1421 ieee802_1x_mka_dump_sak_use_body(body);
1422
1423 if ((body_len != 0) && (body_len < 40)) {
1424 wpa_printf(MSG_ERROR,
1425 "KaY: MKA Use SAK Packet Body Length (%zu bytes) should be 0, 40, or more octets",
1426 body_len);
1427 return -1;
1428 }
1429
1430 /* TODO: what action should I take when peer does not support MACsec */
1431 if (body_len == 0) {
1432 wpa_printf(MSG_WARNING, "KaY: Peer does not support MACsec");
1433 return 0;
1434 }
1435
1436 /* TODO: when the plain tx or rx of peer is true, should I change
1437 * the attribute of controlled port
1438 */
1439 if (body->prx)
1440 wpa_printf(MSG_WARNING, "KaY: peer's plain rx are TRUE");
1441
1442 if (body->ptx)
1443 wpa_printf(MSG_WARNING, "KaY: peer's plain tx are TRUE");
1444 /* TODO: how to set the MACsec hardware when delay_protect is true */
1445 if (body->delay_protect &&
1446 (!be_to_host32(body->llpn) || !be_to_host32(body->olpn))) {
1447 wpa_printf(MSG_WARNING,
1448 "KaY: Lowest packet number should be greater than 0 when delay_protect is TRUE");
1449 return -1;
1450 }
1451
1452 olpn = be_to_host32(body->olpn);
1453 llpn = be_to_host32(body->llpn);
1454
1455 /* Our most recent distributed key should be the first in the list.
1456 * If it doesn't exist then we can't really do anything.
1457 * Be lenient and don't return error here as there are legitimate cases
1458 * where this can happen such as when a new participant joins the CA and
1459 * the first frame it receives can have a SAKuse but not distSAK.
1460 */
1461 sa_key = dl_list_first(&participant->sak_list, struct data_key, list);
1462 if (!sa_key) {
1463 wpa_printf(MSG_INFO,
1464 "KaY: We don't have a latest distributed key - ignore SAK use");
1465 return 0;
1466 }
1467
1468 /* The peer's most recent key will be the "latest key" if it is present
1469 * otherwise it will be the "old key" if in the RETIRE state.
1470 */
1471 if (body->lrx) {
1472 os_memcpy(ki.mi, body->lsrv_mi, sizeof(ki.mi));
1473 ki.kn = be_to_host32(body->lkn);
1474 lpn = llpn;
1475 } else {
1476 os_memcpy(ki.mi, body->osrv_mi, sizeof(ki.mi));
1477 ki.kn = be_to_host32(body->okn);
1478 lpn = olpn;
1479 }
1480
1481 /* If the most recent distributed keys don't agree then someone is out
1482 * of sync. Perhaps non key server hasn't processed the most recent
1483 * distSAK yet and the key server is processing an old packet after it
1484 * has done distSAK. Be lenient and don't return error in this
1485 * particular case; otherwise, the key server will reset its MI and
1486 * cause a traffic disruption which is really undesired for a simple
1487 * timing issue.
1488 */
1489 if (!is_ki_equal(&sa_key->key_identifier, &ki)) {
1490 wpa_printf(MSG_INFO,
1491 "KaY: Distributed keys don't match - ignore SAK use");
1492 return 0;
1493 }
1494 sa_key->next_pn = lpn;
1495
1496 /* The key server must check that all peers are using the most recent
1497 * distributed key. Non key servers must check if the key server is
1498 * transmitting.
1499 */
1500 if (participant->is_key_server) {
1501 struct ieee802_1x_kay_peer *peer_iter;
1502 bool all_receiving = true;
1503
1504 /* Distributed keys are equal from above comparison. */
1505 peer->sak_used = true;
1506
1507 dl_list_for_each(peer_iter, &participant->live_peers,
1508 struct ieee802_1x_kay_peer, list) {
1509 if (!peer_iter->sak_used) {
1510 all_receiving = false;
1511 break;
1512 }
1513 }
1514 if (all_receiving) {
1515 participant->to_dist_sak = false;
1516 ieee802_1x_cp_set_allreceiving(kay->cp, true);
1517 ieee802_1x_cp_sm_step(kay->cp);
1518 }
1519 } else if (peer->is_key_server) {
1520 if (body->ltx) {
1521 ieee802_1x_cp_set_servertransmitting(kay->cp, true);
1522 ieee802_1x_cp_sm_step(kay->cp);
1523 }
1524 }
1525
1526 /* If I'm key server, and detects peer member PN exhaustion, rekey.
1527 * We only need to check the PN of the most recent distributed key. This
1528 * could be the peer's "latest" or "old" key depending on its current
1529 * state. If both "old" and "latest" keys are present then the "old" key
1530 * has already been exhausted.
1531 */
1532 if (participant->is_key_server && lpn > kay->pn_exhaustion) {
1533 participant->new_sak = true;
1534 wpa_printf(MSG_WARNING, "KaY: Peer LPN exhaustion");
1535 }
1536
1537 /* Get the associated RX SAs of the keys for delay protection since both
1538 * can be in use. Delay protect window (communicated via MKA) is tighter
1539 * than SecY's current replay protect window, so tell SecY the new (and
1540 * higher) lpn.
1541 */
1542 if (body->delay_protect) {
1543 struct receive_sc *rxsc;
1544 struct receive_sa *rxsa;
1545 bool found = false;
1546
1547 dl_list_for_each(rxsc, &participant->rxsc_list,
1548 struct receive_sc, list) {
1549 dl_list_for_each(rxsa, &rxsc->sa_list,
1550 struct receive_sa, list) {
1551 if (sa_key && rxsa->pkey == sa_key) {
1552 found = true;
1553 break;
1554 }
1555 }
1556 if (found)
1557 break;
1558 }
1559 if (found) {
1560 secy_get_receive_lowest_pn(participant->kay, rxsa);
1561 if (lpn > rxsa->lowest_pn) {
1562 rxsa->lowest_pn = lpn;
1563 secy_set_receive_lowest_pn(participant->kay,
1564 rxsa);
1565 wpa_printf(MSG_DEBUG,
1566 "KaY: update dist LPN=0x%x", lpn);
1567 }
1568 }
1569
1570 /* FIX: Delay protection for the SA being replaced is not
1571 * implemented. Note that this key will be active for at least
1572 * MKA_SAK_RETIRE_TIME (3 seconds) but could be longer depending
1573 * on how long it takes to get from RECEIVE to TRANSMITTING or
1574 * if going via ABANDON. Delay protection does allow PNs within
1575 * a 2 second window, so getting PN would be a lot of work for
1576 * just 1 second's worth of protection.
1577 */
1578 }
1579
1580 return 0;
1581 }
1582
1583
1584 /**
1585 * ieee802_1x_mka_dist_sak_body_present
1586 */
1587 static bool
ieee802_1x_mka_dist_sak_body_present(struct ieee802_1x_mka_participant * participant)1588 ieee802_1x_mka_dist_sak_body_present(
1589 struct ieee802_1x_mka_participant *participant)
1590 {
1591 return participant->is_key_server && participant->to_dist_sak &&
1592 participant->new_key;
1593 }
1594
1595
1596 /**
1597 * ieee802_1x_kay_get_dist_sak_length
1598 */
1599 static int
ieee802_1x_mka_get_dist_sak_length(struct ieee802_1x_mka_participant * participant)1600 ieee802_1x_mka_get_dist_sak_length(
1601 struct ieee802_1x_mka_participant *participant)
1602 {
1603 int length = MKA_HDR_LEN;
1604 unsigned int cs_index = participant->kay->macsec_csindex;
1605
1606 if (participant->advised_desired && cs_index < CS_TABLE_SIZE) {
1607 length = sizeof(struct ieee802_1x_mka_dist_sak_body);
1608 if (cs_index != DEFAULT_CS_INDEX)
1609 length += CS_ID_LEN;
1610
1611 length += cipher_suite_tbl[cs_index].sak_len + 8;
1612 }
1613
1614 return MKA_ALIGN_LENGTH(length);
1615 }
1616
1617
1618 /**
1619 * ieee802_1x_mka_encode_dist_sak_body -
1620 */
1621 static int
ieee802_1x_mka_encode_dist_sak_body(struct ieee802_1x_mka_participant * participant,struct wpabuf * buf)1622 ieee802_1x_mka_encode_dist_sak_body(
1623 struct ieee802_1x_mka_participant *participant,
1624 struct wpabuf *buf)
1625 {
1626 struct ieee802_1x_mka_dist_sak_body *body;
1627 struct data_key *sak;
1628 unsigned int length;
1629 unsigned int cs_index;
1630 int sak_pos;
1631
1632 length = ieee802_1x_mka_get_dist_sak_length(participant);
1633 body = wpabuf_put(buf, length);
1634 body->type = MKA_DISTRIBUTED_SAK;
1635 set_mka_param_body_len(body, length - MKA_HDR_LEN);
1636 if (length == MKA_HDR_LEN) {
1637 body->confid_offset = 0;
1638 body->dan = 0;
1639 return 0;
1640 }
1641
1642 sak = participant->new_key;
1643 if (!sak) {
1644 wpa_printf(MSG_DEBUG,
1645 "KaY: No SAK available to build Distributed SAK parameter set");
1646 return -1;
1647 }
1648 body->confid_offset = sak->confidentiality_offset;
1649 body->dan = sak->an;
1650 body->kn = host_to_be32(sak->key_identifier.kn);
1651 cs_index = participant->kay->macsec_csindex;
1652 sak_pos = 0;
1653 if (cs_index >= CS_TABLE_SIZE)
1654 return -1;
1655 if (cs_index != DEFAULT_CS_INDEX) {
1656 be64 cs;
1657
1658 cs = host_to_be64(cipher_suite_tbl[cs_index].id);
1659 os_memcpy(body->sak, &cs, CS_ID_LEN);
1660 sak_pos = CS_ID_LEN;
1661 }
1662 if (aes_wrap(participant->kek.key, participant->kek.len,
1663 cipher_suite_tbl[cs_index].sak_len / 8,
1664 sak->key, body->sak + sak_pos)) {
1665 wpa_printf(MSG_ERROR, "KaY: AES wrap failed");
1666 return -1;
1667 }
1668
1669 ieee802_1x_mka_dump_dist_sak_body(body);
1670
1671 return 0;
1672 }
1673
1674
1675 /**
1676 * ieee802_1x_kay_init_data_key -
1677 */
ieee802_1x_kay_init_data_key(struct data_key * pkey)1678 static void ieee802_1x_kay_init_data_key(struct data_key *pkey)
1679 {
1680 pkey->transmits = true;
1681 pkey->receives = true;
1682 os_get_time(&pkey->created_time);
1683
1684 pkey->next_pn = 1;
1685 pkey->user = 1;
1686 }
1687
1688
1689 /**
1690 * ieee802_1x_kay_decode_dist_sak_body -
1691 */
1692 static int
ieee802_1x_mka_decode_dist_sak_body(struct ieee802_1x_mka_participant * participant,const u8 * mka_msg,size_t msg_len)1693 ieee802_1x_mka_decode_dist_sak_body(
1694 struct ieee802_1x_mka_participant *participant,
1695 const u8 *mka_msg, size_t msg_len)
1696 {
1697 struct ieee802_1x_mka_hdr *hdr;
1698 struct ieee802_1x_mka_dist_sak_body *body;
1699 struct ieee802_1x_kay_peer *peer;
1700 struct macsec_ciphersuite *cs;
1701 size_t body_len;
1702 struct data_key *sa_key = NULL;
1703 int sak_len;
1704 u8 *wrap_sak;
1705 u8 *unwrap_sak;
1706 struct ieee802_1x_kay *kay = participant->kay;
1707
1708 hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1709 body_len = get_mka_param_body_len(hdr);
1710 if ((body_len != 0) && (body_len != 28) && (body_len < 36)) {
1711 wpa_printf(MSG_ERROR,
1712 "KaY: MKA Use SAK Packet Body Length (%zu bytes) should be 0, 28, 36, or more octets",
1713 body_len);
1714 return -1;
1715 }
1716
1717 if (!participant->principal) {
1718 wpa_printf(MSG_ERROR,
1719 "KaY: I can't accept the distributed SAK as I am not principal");
1720 return -1;
1721 }
1722 if (participant->is_key_server) {
1723 wpa_printf(MSG_ERROR,
1724 "KaY: Reject distributed SAK since I'm a key server");
1725 return -1;
1726 }
1727 if (!kay->macsec_desired ||
1728 kay->macsec_capable == MACSEC_CAP_NOT_IMPLEMENTED) {
1729 wpa_printf(MSG_ERROR,
1730 "KaY: I am not MACsec-desired or without MACsec capable");
1731 return -1;
1732 }
1733
1734 peer = ieee802_1x_kay_get_live_peer(participant,
1735 participant->current_peer_id.mi);
1736 if (!peer) {
1737 wpa_printf(MSG_ERROR,
1738 "KaY: The key server is not in my live peers list");
1739 return -1;
1740 }
1741 if (!sci_equal(&kay->key_server_sci, &peer->sci)) {
1742 wpa_printf(MSG_ERROR, "KaY: The key server is not elected");
1743 return -1;
1744 }
1745
1746 if (body_len == 0) {
1747 kay->authenticated = true;
1748 kay->secured = false;
1749 kay->failed = false;
1750 participant->advised_desired = false;
1751 ieee802_1x_cp_connect_authenticated(kay->cp);
1752 ieee802_1x_cp_sm_step(kay->cp);
1753 wpa_printf(MSG_WARNING, "KaY: The Key server advise no MACsec");
1754 participant->to_use_sak = false;
1755 return 0;
1756 }
1757
1758 participant->advised_desired = true;
1759 kay->authenticated = false;
1760 kay->secured = true;
1761 kay->failed = false;
1762 ieee802_1x_cp_connect_secure(kay->cp);
1763 ieee802_1x_cp_sm_step(kay->cp);
1764
1765 body = (struct ieee802_1x_mka_dist_sak_body *)mka_msg;
1766 ieee802_1x_mka_dump_dist_sak_body(body);
1767 dl_list_for_each(sa_key, &participant->sak_list, struct data_key, list)
1768 {
1769 if (os_memcmp(sa_key->key_identifier.mi,
1770 participant->current_peer_id.mi, MI_LEN) == 0 &&
1771 sa_key->key_identifier.kn == be_to_host32(body->kn)) {
1772 wpa_printf(MSG_DEBUG,
1773 "KaY: SAK has already been installed - do not set it again");
1774 return 0;
1775 }
1776 }
1777
1778 if (body_len == 28) {
1779 sak_len = DEFAULT_SA_KEY_LEN;
1780 wrap_sak = body->sak;
1781 kay->macsec_csindex = DEFAULT_CS_INDEX;
1782 cs = &cipher_suite_tbl[kay->macsec_csindex];
1783 } else {
1784 unsigned int idx;
1785
1786 cs = ieee802_1x_kay_get_cipher_suite(participant, body->sak,
1787 &idx);
1788 if (!cs) {
1789 wpa_printf(MSG_ERROR,
1790 "KaY: I can't support the Cipher Suite advised by key server");
1791 return -1;
1792 }
1793 sak_len = cs->sak_len;
1794 wrap_sak = body->sak + CS_ID_LEN;
1795 kay->macsec_csindex = idx;
1796 }
1797
1798 unwrap_sak = os_zalloc(sak_len);
1799 if (!unwrap_sak) {
1800 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
1801 return -1;
1802 }
1803 if (aes_unwrap(participant->kek.key, participant->kek.len,
1804 sak_len >> 3, wrap_sak, unwrap_sak)) {
1805 wpa_printf(MSG_ERROR, "KaY: AES unwrap failed");
1806 os_free(unwrap_sak);
1807 return -1;
1808 }
1809 wpa_hexdump_key(MSG_DEBUG, "\tAES Key Unwrap of SAK.:",
1810 unwrap_sak, sak_len);
1811
1812 sa_key = os_zalloc(sizeof(*sa_key));
1813 if (!sa_key) {
1814 os_free(unwrap_sak);
1815 return -1;
1816 }
1817
1818 os_memcpy(&sa_key->key_identifier.mi, &participant->current_peer_id.mi,
1819 MI_LEN);
1820 sa_key->key_identifier.kn = be_to_host32(body->kn);
1821
1822 sa_key->key = unwrap_sak;
1823 sa_key->key_len = sak_len;
1824
1825 sa_key->confidentiality_offset = body->confid_offset;
1826 sa_key->an = body->dan;
1827 ieee802_1x_kay_init_data_key(sa_key);
1828
1829 ieee802_1x_kay_use_data_key(sa_key);
1830 dl_list_add(&participant->sak_list, &sa_key->list);
1831
1832 ieee802_1x_cp_set_ciphersuite(kay->cp, cs->id);
1833 ieee802_1x_cp_sm_step(kay->cp);
1834 ieee802_1x_cp_set_offset(kay->cp, body->confid_offset);
1835 ieee802_1x_cp_sm_step(kay->cp);
1836 ieee802_1x_cp_set_distributedki(kay->cp, &sa_key->key_identifier);
1837 ieee802_1x_cp_set_distributedan(kay->cp, body->dan);
1838 ieee802_1x_cp_signal_newsak(kay->cp);
1839 ieee802_1x_cp_sm_step(kay->cp);
1840
1841 kay->rcvd_keys++;
1842 participant->to_use_sak = true;
1843
1844 return 0;
1845 }
1846
1847
1848 /**
1849 * ieee802_1x_mka_icv_body_present
1850 */
1851 static bool
ieee802_1x_mka_icv_body_present(struct ieee802_1x_mka_participant * participant)1852 ieee802_1x_mka_icv_body_present(struct ieee802_1x_mka_participant *participant)
1853 {
1854 return true;
1855 }
1856
1857
1858 /**
1859 * ieee802_1x_kay_get_icv_length
1860 */
1861 static int
ieee802_1x_mka_get_icv_length(struct ieee802_1x_mka_participant * participant)1862 ieee802_1x_mka_get_icv_length(struct ieee802_1x_mka_participant *participant)
1863 {
1864 int length;
1865
1866 /* Determine if we need space for the ICV Indicator */
1867 if (mka_alg_tbl[participant->kay->mka_algindex].icv_len !=
1868 DEFAULT_ICV_LEN)
1869 length = sizeof(struct ieee802_1x_mka_icv_body);
1870 else
1871 length = 0;
1872 length += mka_alg_tbl[participant->kay->mka_algindex].icv_len;
1873
1874 return MKA_ALIGN_LENGTH(length);
1875 }
1876
1877
1878 /**
1879 * ieee802_1x_mka_encode_icv_body -
1880 */
1881 static int
ieee802_1x_mka_encode_icv_body(struct ieee802_1x_mka_participant * participant,struct wpabuf * buf)1882 ieee802_1x_mka_encode_icv_body(struct ieee802_1x_mka_participant *participant,
1883 struct wpabuf *buf)
1884 {
1885 struct ieee802_1x_mka_icv_body *body;
1886 unsigned int length;
1887 u8 cmac[MAX_ICV_LEN];
1888
1889 length = ieee802_1x_mka_get_icv_length(participant);
1890 if (mka_alg_tbl[participant->kay->mka_algindex].icv_len !=
1891 DEFAULT_ICV_LEN) {
1892 wpa_printf(MSG_DEBUG, "KaY: ICV Indicator");
1893 body = wpabuf_put(buf, MKA_HDR_LEN);
1894 body->type = MKA_ICV_INDICATOR;
1895 length -= MKA_HDR_LEN;
1896 set_mka_param_body_len(body, length);
1897 }
1898
1899 if (mka_alg_tbl[participant->kay->mka_algindex].icv_hash(
1900 participant->ick.key, participant->ick.len,
1901 wpabuf_head(buf), wpabuf_len(buf), cmac)) {
1902 wpa_printf(MSG_ERROR, "KaY: failed to calculate ICV");
1903 return -1;
1904 }
1905 wpa_hexdump(MSG_DEBUG, "KaY: ICV", cmac, length);
1906
1907 os_memcpy(wpabuf_put(buf, length), cmac, length);
1908
1909 return 0;
1910 }
1911
1912 /**
1913 * ieee802_1x_mka_decode_icv_body -
1914 */
1915 static const u8 *
ieee802_1x_mka_decode_icv_body(struct ieee802_1x_mka_participant * participant,const u8 * mka_msg,size_t msg_len)1916 ieee802_1x_mka_decode_icv_body(struct ieee802_1x_mka_participant *participant,
1917 const u8 *mka_msg, size_t msg_len)
1918 {
1919 const struct ieee802_1x_mka_hdr *hdr;
1920 const struct ieee802_1x_mka_icv_body *body;
1921 size_t body_len;
1922 size_t left_len;
1923 u8 body_type;
1924 const u8 *pos;
1925
1926 pos = mka_msg;
1927 left_len = msg_len;
1928 while (left_len > MKA_HDR_LEN + DEFAULT_ICV_LEN) {
1929 hdr = (const struct ieee802_1x_mka_hdr *) pos;
1930 body_len = MKA_ALIGN_LENGTH(get_mka_param_body_len(hdr));
1931 body_type = get_mka_param_body_type(hdr);
1932
1933 if (left_len < body_len + MKA_HDR_LEN)
1934 break;
1935
1936 if (body_type != MKA_ICV_INDICATOR) {
1937 left_len -= MKA_HDR_LEN + body_len;
1938 pos += MKA_HDR_LEN + body_len;
1939 continue;
1940 }
1941
1942 body = (const struct ieee802_1x_mka_icv_body *) pos;
1943 if (body_len
1944 < mka_alg_tbl[participant->kay->mka_algindex].icv_len)
1945 return NULL;
1946
1947 return body->icv;
1948 }
1949
1950 return mka_msg + msg_len - DEFAULT_ICV_LEN;
1951 }
1952
1953
1954 /**
1955 * ieee802_1x_mka_decode_dist_cak_body-
1956 */
1957 static int
ieee802_1x_mka_decode_dist_cak_body(struct ieee802_1x_mka_participant * participant,const u8 * mka_msg,size_t msg_len)1958 ieee802_1x_mka_decode_dist_cak_body(
1959 struct ieee802_1x_mka_participant *participant,
1960 const u8 *mka_msg, size_t msg_len)
1961 {
1962 struct ieee802_1x_mka_hdr *hdr;
1963 size_t body_len;
1964
1965 hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1966 body_len = get_mka_param_body_len(hdr);
1967 if (body_len < 28) {
1968 wpa_printf(MSG_ERROR,
1969 "KaY: MKA Use CAK Packet Body Length (%zu bytes) should be 28 or more octets",
1970 body_len);
1971 return -1;
1972 }
1973
1974 return 0;
1975 }
1976
1977
1978 /**
1979 * ieee802_1x_mka_decode_kmd_body -
1980 */
1981 static int
ieee802_1x_mka_decode_kmd_body(struct ieee802_1x_mka_participant * participant,const u8 * mka_msg,size_t msg_len)1982 ieee802_1x_mka_decode_kmd_body(
1983 struct ieee802_1x_mka_participant *participant,
1984 const u8 *mka_msg, size_t msg_len)
1985 {
1986 struct ieee802_1x_mka_hdr *hdr;
1987 size_t body_len;
1988
1989 hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1990 body_len = get_mka_param_body_len(hdr);
1991 if (body_len < 5) {
1992 wpa_printf(MSG_ERROR,
1993 "KaY: MKA Use KMD Packet Body Length (%zu bytes) should be 5 or more octets",
1994 body_len);
1995 return -1;
1996 }
1997
1998 return 0;
1999 }
2000
2001
2002 /**
2003 * ieee802_1x_mka_decode_announce_body -
2004 */
ieee802_1x_mka_decode_announce_body(struct ieee802_1x_mka_participant * participant,const u8 * mka_msg,size_t msg_len)2005 static int ieee802_1x_mka_decode_announce_body(
2006 struct ieee802_1x_mka_participant *participant,
2007 const u8 *mka_msg, size_t msg_len)
2008 {
2009 return 0;
2010 }
2011
2012
2013 struct mka_param_body_handler {
2014 int (*body_tx)(struct ieee802_1x_mka_participant *participant,
2015 struct wpabuf *buf);
2016 int (*body_rx)(struct ieee802_1x_mka_participant *participant,
2017 const u8 *mka_msg, size_t msg_len);
2018 int (*body_length)(struct ieee802_1x_mka_participant *participant);
2019 bool (*body_present)(struct ieee802_1x_mka_participant *participant);
2020 };
2021
2022
2023 static struct mka_param_body_handler mka_body_handler[] = {
2024 /* Basic parameter set */
2025 {
2026 .body_tx = ieee802_1x_mka_encode_basic_body,
2027 .body_rx = NULL,
2028 .body_length = ieee802_1x_mka_basic_body_length,
2029 .body_present = ieee802_1x_mka_basic_body_present
2030 },
2031
2032 /* Live Peer List parameter set */
2033 {
2034 .body_tx = ieee802_1x_mka_encode_live_peer_body,
2035 .body_rx = ieee802_1x_mka_decode_live_peer_body,
2036 .body_length = ieee802_1x_mka_get_live_peer_length,
2037 .body_present = ieee802_1x_mka_live_peer_body_present
2038 },
2039
2040 /* Potential Peer List parameter set */
2041 {
2042 .body_tx = ieee802_1x_mka_encode_potential_peer_body,
2043 .body_rx = ieee802_1x_mka_decode_potential_peer_body,
2044 .body_length = ieee802_1x_mka_get_potential_peer_length,
2045 .body_present = ieee802_1x_mka_potential_peer_body_present
2046 },
2047
2048 /* MACsec SAK Use parameter set */
2049 {
2050 .body_tx = ieee802_1x_mka_encode_sak_use_body,
2051 .body_rx = ieee802_1x_mka_decode_sak_use_body,
2052 .body_length = ieee802_1x_mka_get_sak_use_length,
2053 .body_present = ieee802_1x_mka_sak_use_body_present
2054 },
2055
2056 /* Distributed SAK parameter set */
2057 {
2058 .body_tx = ieee802_1x_mka_encode_dist_sak_body,
2059 .body_rx = ieee802_1x_mka_decode_dist_sak_body,
2060 .body_length = ieee802_1x_mka_get_dist_sak_length,
2061 .body_present = ieee802_1x_mka_dist_sak_body_present
2062 },
2063
2064 /* Distribute CAK parameter set */
2065 {
2066 .body_tx = NULL,
2067 .body_rx = ieee802_1x_mka_decode_dist_cak_body,
2068 .body_length = NULL,
2069 .body_present = NULL
2070 },
2071
2072 /* KMD parameter set */
2073 {
2074 .body_tx = NULL,
2075 .body_rx = ieee802_1x_mka_decode_kmd_body,
2076 .body_length = NULL,
2077 .body_present = NULL
2078 },
2079
2080 /* Announcement parameter set */
2081 {
2082 .body_tx = NULL,
2083 .body_rx = ieee802_1x_mka_decode_announce_body,
2084 .body_length = NULL,
2085 .body_present = NULL
2086 },
2087
2088 /* ICV Indicator parameter set */
2089 {
2090 .body_tx = ieee802_1x_mka_encode_icv_body,
2091 .body_rx = NULL,
2092 .body_length = ieee802_1x_mka_get_icv_length,
2093 .body_present = ieee802_1x_mka_icv_body_present
2094 },
2095 };
2096
2097
2098 /**
2099 * ieee802_1x_kay_use_data_key - Take reference on a key
2100 */
ieee802_1x_kay_use_data_key(struct data_key * pkey)2101 static void ieee802_1x_kay_use_data_key(struct data_key *pkey)
2102 {
2103 pkey->user++;
2104 }
2105
2106
2107 /**
2108 * ieee802_1x_kay_deinit_data_key - Release reference on a key and
2109 * free if there are no remaining users
2110 */
ieee802_1x_kay_deinit_data_key(struct data_key * pkey)2111 static void ieee802_1x_kay_deinit_data_key(struct data_key *pkey)
2112 {
2113 if (!pkey)
2114 return;
2115
2116 pkey->user--;
2117 if (pkey->user > 1)
2118 return;
2119
2120 os_free(pkey->key);
2121 os_free(pkey);
2122 }
2123
2124
2125 /**
2126 * ieee802_1x_kay_generate_new_sak -
2127 */
2128 static int
ieee802_1x_kay_generate_new_sak(struct ieee802_1x_mka_participant * participant)2129 ieee802_1x_kay_generate_new_sak(struct ieee802_1x_mka_participant *participant)
2130 {
2131 struct data_key *sa_key = NULL;
2132 struct ieee802_1x_kay_peer *peer;
2133 struct ieee802_1x_kay *kay = participant->kay;
2134 int ctx_len, ctx_offset;
2135 u8 *context;
2136 unsigned int key_len;
2137 u8 *key;
2138 struct macsec_ciphersuite *cs;
2139 struct os_reltime now;
2140
2141 /* check condition for generating a fresh SAK:
2142 * must have one live peer
2143 * and MKA life time elapse since last distribution
2144 * or potential peer is empty
2145 */
2146 if (dl_list_empty(&participant->live_peers)) {
2147 wpa_printf(MSG_ERROR,
2148 "KaY: Live peers list must not be empty when generating fresh SAK");
2149 return -1;
2150 }
2151
2152 /* FIXME: A fresh SAK not generated until
2153 * the live peer list contains at least one peer and
2154 * MKA life time has elapsed since the prior SAK was first distributed,
2155 * or the Key server's potential peer is empty
2156 * but I can't understand the second item, so
2157 * here only check first item and ingore
2158 * && (!dl_list_empty(&participant->potential_peers))) {
2159 */
2160 os_get_reltime(&now);
2161 if ((now.sec - kay->dist_time) < MKA_LIFE_TIME / 1000) {
2162 wpa_printf(MSG_ERROR,
2163 "KaY: Life time has not elapsed since prior SAK distributed");
2164 return -1;
2165 }
2166
2167 cs = &cipher_suite_tbl[kay->macsec_csindex];
2168 key_len = cs->sak_len;
2169 key = os_zalloc(key_len);
2170 if (!key) {
2171 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
2172 return -1;
2173 }
2174
2175 ctx_len = key_len + sizeof(kay->dist_kn);
2176 dl_list_for_each(peer, &participant->live_peers,
2177 struct ieee802_1x_kay_peer, list)
2178 ctx_len += sizeof(peer->mi);
2179 ctx_len += sizeof(participant->mi);
2180
2181 context = os_zalloc(ctx_len);
2182 if (!context)
2183 goto fail;
2184
2185 ctx_offset = 0;
2186 if (os_get_random(context + ctx_offset, key_len) < 0)
2187 goto fail;
2188
2189 ctx_offset += key_len;
2190 dl_list_for_each(peer, &participant->live_peers,
2191 struct ieee802_1x_kay_peer, list) {
2192 os_memcpy(context + ctx_offset, peer->mi, sizeof(peer->mi));
2193 ctx_offset += sizeof(peer->mi);
2194 }
2195 os_memcpy(context + ctx_offset, participant->mi,
2196 sizeof(participant->mi));
2197 ctx_offset += sizeof(participant->mi);
2198 os_memcpy(context + ctx_offset, &kay->dist_kn, sizeof(kay->dist_kn));
2199
2200 if (key_len == 16 || key_len == 32) {
2201 if (ieee802_1x_sak_aes_cmac(participant->cak.key,
2202 participant->cak.len,
2203 context, ctx_len,
2204 key, key_len)) {
2205 wpa_printf(MSG_ERROR, "KaY: Failed to generate SAK");
2206 goto fail;
2207 }
2208 } else {
2209 wpa_printf(MSG_ERROR, "KaY: SAK Length(%u) not supported",
2210 key_len);
2211 goto fail;
2212 }
2213 wpa_hexdump_key(MSG_DEBUG, "KaY: generated new SAK", key, key_len);
2214 os_free(context);
2215 context = NULL;
2216
2217 sa_key = os_zalloc(sizeof(*sa_key));
2218 if (!sa_key) {
2219 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
2220 goto fail;
2221 }
2222
2223 sa_key->key = key;
2224 sa_key->key_len = key_len;
2225 os_memcpy(sa_key->key_identifier.mi, participant->mi, MI_LEN);
2226 sa_key->key_identifier.kn = kay->dist_kn;
2227
2228 sa_key->confidentiality_offset = kay->macsec_confidentiality;
2229 sa_key->an = kay->dist_an;
2230 ieee802_1x_kay_init_data_key(sa_key);
2231
2232 participant->new_key = sa_key;
2233
2234 ieee802_1x_kay_use_data_key(sa_key);
2235 dl_list_add(&participant->sak_list, &sa_key->list);
2236
2237 ieee802_1x_cp_set_ciphersuite(kay->cp, cs->id);
2238 ieee802_1x_cp_sm_step(kay->cp);
2239 ieee802_1x_cp_set_offset(kay->cp, kay->macsec_confidentiality);
2240 ieee802_1x_cp_sm_step(kay->cp);
2241 ieee802_1x_cp_set_distributedki(kay->cp, &sa_key->key_identifier);
2242 ieee802_1x_cp_set_distributedan(kay->cp, sa_key->an);
2243 ieee802_1x_cp_signal_newsak(kay->cp);
2244 ieee802_1x_cp_sm_step(kay->cp);
2245
2246 dl_list_for_each(peer, &participant->live_peers,
2247 struct ieee802_1x_kay_peer, list)
2248 peer->sak_used = false;
2249
2250 kay->dist_kn++;
2251 kay->dist_an++;
2252 if (kay->dist_an > 3)
2253 kay->dist_an = 0;
2254
2255 kay->dist_time = now.sec;
2256
2257 return 0;
2258
2259 fail:
2260 os_free(key);
2261 os_free(context);
2262 return -1;
2263 }
2264
2265
compare_priorities(const struct ieee802_1x_kay_peer * peer,const struct ieee802_1x_kay_peer * other)2266 static int compare_priorities(const struct ieee802_1x_kay_peer *peer,
2267 const struct ieee802_1x_kay_peer *other)
2268 {
2269 if (peer->key_server_priority < other->key_server_priority)
2270 return -1;
2271 if (other->key_server_priority < peer->key_server_priority)
2272 return 1;
2273
2274 return os_memcmp(peer->sci.addr, other->sci.addr, ETH_ALEN);
2275 }
2276
2277
2278 /**
2279 * ieee802_1x_kay_elect_key_server - elect the key server
2280 * when to elect: whenever the live peers list changes
2281 */
2282 static int
ieee802_1x_kay_elect_key_server(struct ieee802_1x_mka_participant * participant)2283 ieee802_1x_kay_elect_key_server(struct ieee802_1x_mka_participant *participant)
2284 {
2285 struct ieee802_1x_kay_peer *peer;
2286 struct ieee802_1x_kay_peer *key_server = NULL;
2287 struct ieee802_1x_kay *kay = participant->kay;
2288 bool i_is_key_server;
2289 int priority_comparison;
2290
2291 if (participant->is_obliged_key_server) {
2292 participant->new_sak = true;
2293 participant->to_dist_sak = false;
2294 ieee802_1x_cp_set_electedself(kay->cp, true);
2295 return 0;
2296 }
2297
2298 /* elect the key server among the peers */
2299 dl_list_for_each(peer, &participant->live_peers,
2300 struct ieee802_1x_kay_peer, list) {
2301 if (!peer->is_key_server)
2302 continue;
2303
2304 if (!key_server) {
2305 key_server = peer;
2306 continue;
2307 }
2308
2309 if (compare_priorities(peer, key_server) < 0)
2310 key_server = peer;
2311 }
2312
2313 /* elect the key server between me and the above elected peer */
2314 i_is_key_server = false;
2315 if (key_server && participant->can_be_key_server) {
2316 struct ieee802_1x_kay_peer tmp;
2317
2318 tmp.key_server_priority = kay->actor_priority;
2319 os_memcpy(&tmp.sci, &kay->actor_sci, sizeof(tmp.sci));
2320 priority_comparison = compare_priorities(&tmp, key_server);
2321 if (priority_comparison < 0) {
2322 i_is_key_server = true;
2323 } else if (priority_comparison == 0) {
2324 wpa_printf(MSG_WARNING,
2325 "KaY: Cannot elect key server between me and peer, duplicate MAC detected");
2326 key_server = NULL;
2327 }
2328 } else if (participant->can_be_key_server) {
2329 i_is_key_server = true;
2330 }
2331
2332 if (i_is_key_server) {
2333 ieee802_1x_cp_set_electedself(kay->cp, true);
2334 if (!sci_equal(&kay->key_server_sci, &kay->actor_sci)) {
2335 ieee802_1x_cp_signal_chgdserver(kay->cp);
2336 ieee802_1x_cp_sm_step(kay->cp);
2337 }
2338
2339 participant->is_key_server = true;
2340 participant->principal = true;
2341 participant->new_sak = true;
2342 wpa_printf(MSG_DEBUG, "KaY: I am elected as key server");
2343 participant->to_dist_sak = false;
2344 participant->is_elected = true;
2345
2346 os_memcpy(&kay->key_server_sci, &kay->actor_sci,
2347 sizeof(kay->key_server_sci));
2348 kay->key_server_priority = kay->actor_priority;
2349 } else if (key_server) {
2350 wpa_printf(MSG_DEBUG,
2351 "KaY: Peer %s was elected as the key server",
2352 mi_txt(key_server->mi));
2353 ieee802_1x_cp_set_electedself(kay->cp, false);
2354 if (!sci_equal(&kay->key_server_sci, &key_server->sci)) {
2355 ieee802_1x_cp_signal_chgdserver(kay->cp);
2356 ieee802_1x_cp_sm_step(kay->cp);
2357 }
2358
2359 participant->is_key_server = false;
2360 participant->principal = true;
2361 participant->is_elected = true;
2362
2363 os_memcpy(&kay->key_server_sci, &key_server->sci,
2364 sizeof(kay->key_server_sci));
2365 kay->key_server_priority = key_server->key_server_priority;
2366 } else {
2367 participant->principal = false;
2368 participant->is_key_server = false;
2369 participant->is_elected = false;
2370 }
2371
2372 return 0;
2373 }
2374
2375
2376 /**
2377 * ieee802_1x_kay_decide_macsec_use - the key server determinate
2378 * how to use MACsec: whether use MACsec and its capability
2379 * protectFrames will be advised if the key server and one of its live peers are
2380 * MACsec capable and one of those request MACsec protection
2381 */
2382 static int
ieee802_1x_kay_decide_macsec_use(struct ieee802_1x_mka_participant * participant)2383 ieee802_1x_kay_decide_macsec_use(
2384 struct ieee802_1x_mka_participant *participant)
2385 {
2386 struct ieee802_1x_kay *kay = participant->kay;
2387 struct ieee802_1x_kay_peer *peer;
2388 enum macsec_cap less_capability;
2389 bool has_peer;
2390
2391 if (!participant->is_key_server)
2392 return -1;
2393
2394 /* key server self is MACsec-desired and requesting MACsec */
2395 if (!kay->macsec_desired) {
2396 participant->advised_desired = false;
2397 return -1;
2398 }
2399 if (kay->macsec_capable == MACSEC_CAP_NOT_IMPLEMENTED) {
2400 participant->advised_desired = false;
2401 return -1;
2402 }
2403 less_capability = kay->macsec_capable;
2404
2405 /* at least one of peers is MACsec-desired and requesting MACsec */
2406 has_peer = false;
2407 dl_list_for_each(peer, &participant->live_peers,
2408 struct ieee802_1x_kay_peer, list) {
2409 if (!peer->macsec_desired)
2410 continue;
2411
2412 if (peer->macsec_capability == MACSEC_CAP_NOT_IMPLEMENTED)
2413 continue;
2414
2415 less_capability = (less_capability < peer->macsec_capability) ?
2416 less_capability : peer->macsec_capability;
2417 has_peer = true;
2418 }
2419
2420 if (has_peer) {
2421 participant->advised_desired = true;
2422 participant->advised_capability = less_capability;
2423 kay->authenticated = false;
2424 kay->secured = true;
2425 kay->failed = false;
2426 ieee802_1x_cp_connect_secure(kay->cp);
2427 ieee802_1x_cp_sm_step(kay->cp);
2428 } else {
2429 participant->advised_desired = false;
2430 participant->advised_capability = MACSEC_CAP_NOT_IMPLEMENTED;
2431 participant->to_use_sak = false;
2432 kay->authenticated = true;
2433 kay->secured = false;
2434 kay->failed = false;
2435 kay->ltx_kn = 0;
2436 kay->ltx_an = 0;
2437 kay->lrx_kn = 0;
2438 kay->lrx_an = 0;
2439 kay->otx_kn = 0;
2440 kay->otx_an = 0;
2441 kay->orx_kn = 0;
2442 kay->orx_an = 0;
2443 ieee802_1x_cp_connect_authenticated(kay->cp);
2444 ieee802_1x_cp_sm_step(kay->cp);
2445 }
2446
2447 return 0;
2448 }
2449
2450 static const u8 pae_group_addr[ETH_ALEN] = {
2451 0x01, 0x80, 0xc2, 0x00, 0x00, 0x03
2452 };
2453
2454
2455 /**
2456 * ieee802_1x_kay_encode_mkpdu -
2457 */
2458 static int
ieee802_1x_kay_encode_mkpdu(struct ieee802_1x_mka_participant * participant,struct wpabuf * pbuf)2459 ieee802_1x_kay_encode_mkpdu(struct ieee802_1x_mka_participant *participant,
2460 struct wpabuf *pbuf)
2461 {
2462 unsigned int i;
2463 struct ieee8023_hdr *ether_hdr;
2464 struct ieee802_1x_hdr *eapol_hdr;
2465
2466 ether_hdr = wpabuf_put(pbuf, sizeof(*ether_hdr));
2467 os_memcpy(ether_hdr->dest, pae_group_addr, sizeof(ether_hdr->dest));
2468 os_memcpy(ether_hdr->src, participant->kay->actor_sci.addr,
2469 sizeof(ether_hdr->dest));
2470 ether_hdr->ethertype = host_to_be16(ETH_P_EAPOL);
2471 wpa_printf(MSG_DEBUG, "KaY: Ethernet header: DA=" MACSTR " SA=" MACSTR
2472 " Ethertype=0x%x",
2473 MAC2STR(ether_hdr->dest), MAC2STR(ether_hdr->src),
2474 be_to_host16(ether_hdr->ethertype));
2475
2476 eapol_hdr = wpabuf_put(pbuf, sizeof(*eapol_hdr));
2477 eapol_hdr->version = EAPOL_VERSION;
2478 eapol_hdr->type = IEEE802_1X_TYPE_EAPOL_MKA;
2479 eapol_hdr->length = host_to_be16(wpabuf_tailroom(pbuf));
2480 wpa_printf(MSG_DEBUG,
2481 "KaY: Common EAPOL PDU structure: Protocol Version=%u Packet Type=%u Packet Body Length=%u",
2482 eapol_hdr->version, eapol_hdr->type,
2483 be_to_host16(eapol_hdr->length));
2484
2485 for (i = 0; i < ARRAY_SIZE(mka_body_handler); i++) {
2486 if (mka_body_handler[i].body_present &&
2487 mka_body_handler[i].body_present(participant)) {
2488 if (mka_body_handler[i].body_tx(participant, pbuf))
2489 return -1;
2490 }
2491 }
2492
2493 return 0;
2494 }
2495
2496
2497 /**
2498 * ieee802_1x_participant_send_mkpdu -
2499 */
2500 static int
ieee802_1x_participant_send_mkpdu(struct ieee802_1x_mka_participant * participant)2501 ieee802_1x_participant_send_mkpdu(
2502 struct ieee802_1x_mka_participant *participant)
2503 {
2504 struct wpabuf *buf;
2505 struct ieee802_1x_kay *kay = participant->kay;
2506 size_t length = 0;
2507 unsigned int i;
2508
2509 wpa_printf(MSG_DEBUG, "KaY: Encode and send an MKPDU (ifname=%s)",
2510 kay->if_name);
2511 length += sizeof(struct ieee802_1x_hdr) + sizeof(struct ieee8023_hdr);
2512 for (i = 0; i < ARRAY_SIZE(mka_body_handler); i++) {
2513 if (mka_body_handler[i].body_present &&
2514 mka_body_handler[i].body_present(participant))
2515 length += mka_body_handler[i].body_length(participant);
2516 }
2517
2518 buf = wpabuf_alloc(length);
2519 if (!buf) {
2520 wpa_printf(MSG_ERROR, "KaY: out of memory");
2521 return -1;
2522 }
2523
2524 if (ieee802_1x_kay_encode_mkpdu(participant, buf)) {
2525 wpa_printf(MSG_ERROR, "KaY: encode mkpdu fail");
2526 return -1;
2527 }
2528
2529 wpa_hexdump_buf(MSG_MSGDUMP, "KaY: Outgoing MKPDU", buf);
2530 l2_packet_send(kay->l2_mka, NULL, 0, wpabuf_head(buf), wpabuf_len(buf));
2531 wpabuf_free(buf);
2532
2533 kay->active = true;
2534 participant->active = true;
2535
2536 return 0;
2537 }
2538
2539
2540 static void ieee802_1x_kay_deinit_transmit_sa(struct transmit_sa *psa);
2541
ieee802_1x_delete_transmit_sa(struct ieee802_1x_kay * kay,struct transmit_sa * sa)2542 static void ieee802_1x_delete_transmit_sa(struct ieee802_1x_kay *kay,
2543 struct transmit_sa *sa)
2544 {
2545 secy_disable_transmit_sa(kay, sa);
2546 secy_delete_transmit_sa(kay, sa);
2547 ieee802_1x_kay_deinit_transmit_sa(sa);
2548 }
2549
2550
2551 /**
2552 * ieee802_1x_participant_timer -
2553 */
ieee802_1x_participant_timer(void * eloop_ctx,void * timeout_ctx)2554 static void ieee802_1x_participant_timer(void *eloop_ctx, void *timeout_ctx)
2555 {
2556 struct ieee802_1x_mka_participant *participant;
2557 struct ieee802_1x_kay *kay;
2558 struct ieee802_1x_kay_peer *peer, *pre_peer;
2559 struct os_reltime now;
2560 bool lp_changed;
2561 struct receive_sc *rxsc, *pre_rxsc;
2562 struct transmit_sa *txsa, *pre_txsa;
2563
2564 os_get_reltime(&now);
2565
2566 participant = (struct ieee802_1x_mka_participant *)eloop_ctx;
2567 kay = participant->kay;
2568 wpa_printf(MSG_DEBUG, "KaY: Participant timer (ifname=%s)",
2569 kay->if_name);
2570 if (participant->cak_life) {
2571 if (now.sec > participant->cak_life)
2572 goto delete_mka;
2573 }
2574
2575 /* should delete MKA instance if there are not live peers
2576 * when the MKA life elapsed since its creating */
2577 if (participant->mka_life) {
2578 if (dl_list_empty(&participant->live_peers)) {
2579 if (now.sec > participant->mka_life)
2580 goto delete_mka;
2581 } else {
2582 participant->mka_life = 0;
2583 }
2584 }
2585
2586 lp_changed = false;
2587 dl_list_for_each_safe(peer, pre_peer, &participant->live_peers,
2588 struct ieee802_1x_kay_peer, list) {
2589 if (now.sec > peer->expire) {
2590 wpa_printf(MSG_DEBUG, "KaY: Live peer removed");
2591 wpa_hexdump(MSG_DEBUG, "\tMI: ", peer->mi,
2592 sizeof(peer->mi));
2593 wpa_printf(MSG_DEBUG, "\tMN: %d", peer->mn);
2594 dl_list_for_each_safe(rxsc, pre_rxsc,
2595 &participant->rxsc_list,
2596 struct receive_sc, list) {
2597 if (sci_equal(&rxsc->sci, &peer->sci)) {
2598 ieee802_1x_kay_deinit_receive_sc(
2599 participant, rxsc);
2600 }
2601 }
2602 dl_list_del(&peer->list);
2603 os_free(peer);
2604 lp_changed = true;
2605 }
2606 }
2607
2608 if (lp_changed) {
2609 if (dl_list_empty(&participant->live_peers)) {
2610 participant->advised_desired = false;
2611 participant->advised_capability =
2612 MACSEC_CAP_NOT_IMPLEMENTED;
2613 participant->to_use_sak = false;
2614 participant->ltx = false;
2615 participant->lrx = false;
2616 participant->otx = false;
2617 participant->orx = false;
2618 participant->is_key_server = false;
2619 participant->is_elected = false;
2620 kay->authenticated = false;
2621 kay->secured = false;
2622 kay->failed = false;
2623 kay->ltx_kn = 0;
2624 kay->ltx_an = 0;
2625 kay->lrx_kn = 0;
2626 kay->lrx_an = 0;
2627 kay->otx_kn = 0;
2628 kay->otx_an = 0;
2629 kay->orx_kn = 0;
2630 kay->orx_an = 0;
2631 dl_list_for_each_safe(txsa, pre_txsa,
2632 &participant->txsc->sa_list,
2633 struct transmit_sa, list) {
2634 ieee802_1x_delete_transmit_sa(kay, txsa);
2635 }
2636
2637 ieee802_1x_cp_connect_pending(kay->cp);
2638 ieee802_1x_cp_sm_step(kay->cp);
2639 } else {
2640 ieee802_1x_kay_elect_key_server(participant);
2641 ieee802_1x_kay_decide_macsec_use(participant);
2642 }
2643 }
2644
2645 dl_list_for_each_safe(peer, pre_peer, &participant->potential_peers,
2646 struct ieee802_1x_kay_peer, list) {
2647 if (now.sec > peer->expire) {
2648 wpa_printf(MSG_DEBUG, "KaY: Potential peer removed");
2649 wpa_hexdump(MSG_DEBUG, "\tMI: ", peer->mi,
2650 sizeof(peer->mi));
2651 wpa_printf(MSG_DEBUG, "\tMN: %d", peer->mn);
2652 dl_list_del(&peer->list);
2653 os_free(peer);
2654 }
2655 }
2656
2657 if (participant->new_sak && participant->is_key_server) {
2658 if (!ieee802_1x_kay_generate_new_sak(participant))
2659 participant->to_dist_sak = true;
2660
2661 participant->new_sak = false;
2662 }
2663
2664 if (participant->retry_count < MAX_RETRY_CNT ||
2665 participant->mode == PSK) {
2666 ieee802_1x_participant_send_mkpdu(participant);
2667 participant->retry_count++;
2668 }
2669
2670 eloop_register_timeout(kay->mka_hello_time / 1000, 0,
2671 ieee802_1x_participant_timer,
2672 participant, NULL);
2673
2674 return;
2675
2676 delete_mka:
2677 kay->authenticated = false;
2678 kay->secured = false;
2679 kay->failed = true;
2680 ieee802_1x_kay_delete_mka(kay, &participant->ckn);
2681 }
2682
2683
2684 /**
2685 * ieee802_1x_kay_init_transmit_sa -
2686 */
2687 static struct transmit_sa *
ieee802_1x_kay_init_transmit_sa(struct transmit_sc * psc,u8 an,u32 next_PN,struct data_key * key)2688 ieee802_1x_kay_init_transmit_sa(struct transmit_sc *psc, u8 an, u32 next_PN,
2689 struct data_key *key)
2690 {
2691 struct transmit_sa *psa;
2692
2693 key->tx_latest = true;
2694 key->rx_latest = true;
2695
2696 psa = os_zalloc(sizeof(*psa));
2697 if (!psa) {
2698 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
2699 return NULL;
2700 }
2701
2702 if (key->confidentiality_offset >= CONFIDENTIALITY_OFFSET_0 &&
2703 key->confidentiality_offset <= CONFIDENTIALITY_OFFSET_50)
2704 psa->confidentiality = true;
2705 else
2706 psa->confidentiality = false;
2707
2708 psa->an = an;
2709 ieee802_1x_kay_use_data_key(key);
2710 psa->pkey = key;
2711 psa->next_pn = next_PN;
2712 psa->sc = psc;
2713
2714 os_get_time(&psa->created_time);
2715 psa->in_use = false;
2716
2717 dl_list_add(&psc->sa_list, &psa->list);
2718 wpa_printf(MSG_DEBUG,
2719 "KaY: Create transmit SA(an: %hhu, next_pn: %u) of SC",
2720 an, next_PN);
2721
2722 return psa;
2723 }
2724
2725
2726 /**
2727 * ieee802_1x_kay_deinit_transmit_sa -
2728 */
ieee802_1x_kay_deinit_transmit_sa(struct transmit_sa * psa)2729 static void ieee802_1x_kay_deinit_transmit_sa(struct transmit_sa *psa)
2730 {
2731 ieee802_1x_kay_deinit_data_key(psa->pkey);
2732 psa->pkey = NULL;
2733 wpa_printf(MSG_DEBUG,
2734 "KaY: Delete transmit SA(an: %hhu) of SC",
2735 psa->an);
2736 dl_list_del(&psa->list);
2737 os_free(psa);
2738 }
2739
2740
2741 /**
2742 * init_transmit_sc -
2743 */
2744 static struct transmit_sc *
ieee802_1x_kay_init_transmit_sc(const struct ieee802_1x_mka_sci * sci)2745 ieee802_1x_kay_init_transmit_sc(const struct ieee802_1x_mka_sci *sci)
2746 {
2747 struct transmit_sc *psc;
2748
2749 psc = os_zalloc(sizeof(*psc));
2750 if (!psc) {
2751 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
2752 return NULL;
2753 }
2754 os_memcpy(&psc->sci, sci, sizeof(psc->sci));
2755
2756 os_get_time(&psc->created_time);
2757 psc->transmitting = false;
2758 psc->encoding_sa = false;
2759 psc->enciphering_sa = false;
2760
2761 dl_list_init(&psc->sa_list);
2762 wpa_printf(MSG_DEBUG, "KaY: Create transmit SC - SCI: %s",
2763 sci_txt(&psc->sci));
2764
2765 return psc;
2766 }
2767
2768
2769 /**
2770 * ieee802_1x_kay_deinit_transmit_sc -
2771 */
2772 static void
ieee802_1x_kay_deinit_transmit_sc(struct ieee802_1x_mka_participant * participant,struct transmit_sc * psc)2773 ieee802_1x_kay_deinit_transmit_sc(
2774 struct ieee802_1x_mka_participant *participant, struct transmit_sc *psc)
2775 {
2776 struct transmit_sa *psa, *tmp;
2777
2778 wpa_printf(MSG_DEBUG, "KaY: Delete transmit SC");
2779 dl_list_for_each_safe(psa, tmp, &psc->sa_list, struct transmit_sa, list)
2780 ieee802_1x_delete_transmit_sa(participant->kay, psa);
2781
2782 secy_delete_transmit_sc(participant->kay, psc);
2783 os_free(psc);
2784 }
2785
2786
2787 /****************** Interface between CP and KAY *********************/
2788 /**
2789 * ieee802_1x_kay_set_latest_sa_attr -
2790 */
ieee802_1x_kay_set_latest_sa_attr(struct ieee802_1x_kay * kay,struct ieee802_1x_mka_ki * lki,u8 lan,bool ltx,bool lrx)2791 int ieee802_1x_kay_set_latest_sa_attr(struct ieee802_1x_kay *kay,
2792 struct ieee802_1x_mka_ki *lki, u8 lan,
2793 bool ltx, bool lrx)
2794 {
2795 struct ieee802_1x_mka_participant *principal;
2796
2797 principal = ieee802_1x_kay_get_principal_participant(kay);
2798 if (!principal)
2799 return -1;
2800
2801 if (!lki)
2802 os_memset(&principal->lki, 0, sizeof(principal->lki));
2803 else
2804 os_memcpy(&principal->lki, lki, sizeof(principal->lki));
2805
2806 principal->lan = lan;
2807 principal->ltx = ltx;
2808 principal->lrx = lrx;
2809 if (!lki) {
2810 kay->ltx_kn = 0;
2811 kay->lrx_kn = 0;
2812 } else {
2813 kay->ltx_kn = lki->kn;
2814 kay->lrx_kn = lki->kn;
2815 }
2816 kay->ltx_an = lan;
2817 kay->lrx_an = lan;
2818
2819 return 0;
2820 }
2821
2822
2823 /**
2824 * ieee802_1x_kay_set_old_sa_attr -
2825 */
ieee802_1x_kay_set_old_sa_attr(struct ieee802_1x_kay * kay,struct ieee802_1x_mka_ki * oki,u8 oan,bool otx,bool orx)2826 int ieee802_1x_kay_set_old_sa_attr(struct ieee802_1x_kay *kay,
2827 struct ieee802_1x_mka_ki *oki,
2828 u8 oan, bool otx, bool orx)
2829 {
2830 struct ieee802_1x_mka_participant *principal;
2831
2832 principal = ieee802_1x_kay_get_principal_participant(kay);
2833 if (!principal)
2834 return -1;
2835
2836 if (!oki)
2837 os_memset(&principal->oki, 0, sizeof(principal->oki));
2838 else
2839 os_memcpy(&principal->oki, oki, sizeof(principal->oki));
2840
2841 principal->oan = oan;
2842 principal->otx = otx;
2843 principal->orx = orx;
2844
2845 if (!oki) {
2846 kay->otx_kn = 0;
2847 kay->orx_kn = 0;
2848 } else {
2849 kay->otx_kn = oki->kn;
2850 kay->orx_kn = oki->kn;
2851 }
2852 kay->otx_an = oan;
2853 kay->orx_an = oan;
2854
2855 return 0;
2856 }
2857
2858
lookup_txsa_by_an(struct transmit_sc * txsc,u8 an)2859 static struct transmit_sa * lookup_txsa_by_an(struct transmit_sc *txsc, u8 an)
2860 {
2861 struct transmit_sa *txsa;
2862
2863 dl_list_for_each(txsa, &txsc->sa_list, struct transmit_sa, list) {
2864 if (txsa->an == an)
2865 return txsa;
2866 }
2867
2868 return NULL;
2869 }
2870
2871
lookup_rxsa_by_an(struct receive_sc * rxsc,u8 an)2872 static struct receive_sa * lookup_rxsa_by_an(struct receive_sc *rxsc, u8 an)
2873 {
2874 struct receive_sa *rxsa;
2875
2876 dl_list_for_each(rxsa, &rxsc->sa_list, struct receive_sa, list) {
2877 if (rxsa->an == an)
2878 return rxsa;
2879 }
2880
2881 return NULL;
2882 }
2883
2884
2885 /**
2886 * ieee802_1x_kay_create_sas -
2887 */
ieee802_1x_kay_create_sas(struct ieee802_1x_kay * kay,struct ieee802_1x_mka_ki * lki)2888 int ieee802_1x_kay_create_sas(struct ieee802_1x_kay *kay,
2889 struct ieee802_1x_mka_ki *lki)
2890 {
2891 struct data_key *sa_key, *latest_sak;
2892 struct ieee802_1x_mka_participant *principal;
2893 struct receive_sc *rxsc;
2894 struct receive_sa *rxsa;
2895 struct transmit_sa *txsa;
2896
2897 principal = ieee802_1x_kay_get_principal_participant(kay);
2898 if (!principal)
2899 return -1;
2900
2901 latest_sak = NULL;
2902 dl_list_for_each(sa_key, &principal->sak_list, struct data_key, list) {
2903 if (is_ki_equal(&sa_key->key_identifier, lki)) {
2904 sa_key->rx_latest = true;
2905 sa_key->tx_latest = true;
2906 latest_sak = sa_key;
2907 principal->to_use_sak = true;
2908 } else {
2909 sa_key->rx_latest = false;
2910 sa_key->tx_latest = false;
2911 }
2912 }
2913 if (!latest_sak) {
2914 wpa_printf(MSG_ERROR, "KaY: lki related sak not found");
2915 return -1;
2916 }
2917
2918 dl_list_for_each(rxsc, &principal->rxsc_list, struct receive_sc, list) {
2919 while ((rxsa = lookup_rxsa_by_an(rxsc, latest_sak->an)) != NULL)
2920 ieee802_1x_delete_receive_sa(kay, rxsa);
2921
2922 rxsa = ieee802_1x_kay_init_receive_sa(rxsc, latest_sak->an, 1,
2923 latest_sak);
2924 if (!rxsa)
2925 return -1;
2926
2927 secy_create_receive_sa(kay, rxsa);
2928 }
2929
2930 while ((txsa = lookup_txsa_by_an(principal->txsc, latest_sak->an)) !=
2931 NULL)
2932 ieee802_1x_delete_transmit_sa(kay, txsa);
2933
2934 txsa = ieee802_1x_kay_init_transmit_sa(principal->txsc, latest_sak->an,
2935 latest_sak->next_pn ?
2936 latest_sak->next_pn : 1,
2937 latest_sak);
2938 if (!txsa)
2939 return -1;
2940
2941 secy_create_transmit_sa(kay, txsa);
2942
2943
2944
2945 return 0;
2946 }
2947
2948
2949 /**
2950 * ieee802_1x_kay_delete_sas -
2951 */
ieee802_1x_kay_delete_sas(struct ieee802_1x_kay * kay,struct ieee802_1x_mka_ki * ki)2952 int ieee802_1x_kay_delete_sas(struct ieee802_1x_kay *kay,
2953 struct ieee802_1x_mka_ki *ki)
2954 {
2955 struct data_key *sa_key, *pre_key;
2956 struct transmit_sa *txsa, *pre_txsa;
2957 struct receive_sa *rxsa, *pre_rxsa;
2958 struct receive_sc *rxsc;
2959 struct ieee802_1x_mka_participant *principal;
2960
2961 wpa_printf(MSG_DEBUG, "KaY: Entry into %s", __func__);
2962 principal = ieee802_1x_kay_get_principal_participant(kay);
2963 if (!principal)
2964 return -1;
2965
2966 /* remove the transmit sa */
2967 dl_list_for_each_safe(txsa, pre_txsa, &principal->txsc->sa_list,
2968 struct transmit_sa, list) {
2969 if (is_ki_equal(&txsa->pkey->key_identifier, ki))
2970 ieee802_1x_delete_transmit_sa(kay, txsa);
2971 }
2972
2973 /* remove the receive sa */
2974 dl_list_for_each(rxsc, &principal->rxsc_list, struct receive_sc, list) {
2975 dl_list_for_each_safe(rxsa, pre_rxsa, &rxsc->sa_list,
2976 struct receive_sa, list) {
2977 if (is_ki_equal(&rxsa->pkey->key_identifier, ki))
2978 ieee802_1x_delete_receive_sa(kay, rxsa);
2979 }
2980 }
2981
2982 /* remove the sak */
2983 dl_list_for_each_safe(sa_key, pre_key, &principal->sak_list,
2984 struct data_key, list) {
2985 if (is_ki_equal(&sa_key->key_identifier, ki)) {
2986 if (principal->new_key == sa_key)
2987 principal->new_key = NULL;
2988 dl_list_del(&sa_key->list);
2989 ieee802_1x_kay_deinit_data_key(sa_key);
2990 break;
2991 }
2992 }
2993
2994 return 0;
2995 }
2996
2997
2998 /**
2999 * ieee802_1x_kay_enable_tx_sas -
3000 */
ieee802_1x_kay_enable_tx_sas(struct ieee802_1x_kay * kay,struct ieee802_1x_mka_ki * lki)3001 int ieee802_1x_kay_enable_tx_sas(struct ieee802_1x_kay *kay,
3002 struct ieee802_1x_mka_ki *lki)
3003 {
3004 struct ieee802_1x_mka_participant *principal;
3005 struct transmit_sa *txsa;
3006
3007 principal = ieee802_1x_kay_get_principal_participant(kay);
3008 if (!principal)
3009 return -1;
3010
3011 dl_list_for_each(txsa, &principal->txsc->sa_list, struct transmit_sa,
3012 list) {
3013 if (is_ki_equal(&txsa->pkey->key_identifier, lki)) {
3014 txsa->in_use = true;
3015 secy_enable_transmit_sa(kay, txsa);
3016 ieee802_1x_cp_set_usingtransmitas(
3017 principal->kay->cp, true);
3018 ieee802_1x_cp_sm_step(principal->kay->cp);
3019 }
3020 }
3021
3022 return 0;
3023 }
3024
3025
3026 /**
3027 * ieee802_1x_kay_enable_rx_sas -
3028 */
ieee802_1x_kay_enable_rx_sas(struct ieee802_1x_kay * kay,struct ieee802_1x_mka_ki * lki)3029 int ieee802_1x_kay_enable_rx_sas(struct ieee802_1x_kay *kay,
3030 struct ieee802_1x_mka_ki *lki)
3031 {
3032 struct ieee802_1x_mka_participant *principal;
3033 struct receive_sa *rxsa;
3034 struct receive_sc *rxsc;
3035
3036 principal = ieee802_1x_kay_get_principal_participant(kay);
3037 if (!principal)
3038 return -1;
3039
3040 dl_list_for_each(rxsc, &principal->rxsc_list, struct receive_sc, list) {
3041 dl_list_for_each(rxsa, &rxsc->sa_list, struct receive_sa, list)
3042 {
3043 if (is_ki_equal(&rxsa->pkey->key_identifier, lki)) {
3044 rxsa->in_use = true;
3045 secy_enable_receive_sa(kay, rxsa);
3046 ieee802_1x_cp_set_usingreceivesas(
3047 principal->kay->cp, true);
3048 ieee802_1x_cp_sm_step(principal->kay->cp);
3049 }
3050 }
3051 }
3052
3053 return 0;
3054 }
3055
3056
3057 /**
3058 * ieee802_1x_kay_enable_new_info -
3059 */
ieee802_1x_kay_enable_new_info(struct ieee802_1x_kay * kay)3060 int ieee802_1x_kay_enable_new_info(struct ieee802_1x_kay *kay)
3061 {
3062 struct ieee802_1x_mka_participant *principal;
3063
3064 principal = ieee802_1x_kay_get_principal_participant(kay);
3065 if (!principal)
3066 return -1;
3067
3068 if (principal->retry_count < MAX_RETRY_CNT || principal->mode == PSK) {
3069 ieee802_1x_participant_send_mkpdu(principal);
3070 principal->retry_count++;
3071 }
3072
3073 return 0;
3074 }
3075
3076
3077 /**
3078 * ieee802_1x_kay_mkpdu_validity_check -
3079 * Validity checks specified in IEEE Std 802.1X-2010, 11.11.2 (Validation of
3080 * MKPDUs)
3081 */
ieee802_1x_kay_mkpdu_validity_check(struct ieee802_1x_kay * kay,const u8 * buf,size_t len)3082 static int ieee802_1x_kay_mkpdu_validity_check(struct ieee802_1x_kay *kay,
3083 const u8 *buf, size_t len)
3084 {
3085 struct ieee8023_hdr *eth_hdr;
3086 struct ieee802_1x_hdr *eapol_hdr;
3087 struct ieee802_1x_mka_hdr *mka_hdr;
3088 struct ieee802_1x_mka_basic_body *body;
3089 size_t mka_msg_len;
3090 struct ieee802_1x_mka_participant *participant;
3091 size_t body_len;
3092 size_t ckn_len;
3093 u8 icv[MAX_ICV_LEN];
3094 const u8 *msg_icv;
3095
3096 /* len > eth+eapol header already verified in kay_l2_receive();
3097 * likewise, eapol_hdr->length validated there */
3098 eth_hdr = (struct ieee8023_hdr *) buf;
3099 eapol_hdr = (struct ieee802_1x_hdr *) (eth_hdr + 1);
3100 mka_hdr = (struct ieee802_1x_mka_hdr *) (eapol_hdr + 1);
3101
3102 wpa_printf(MSG_DEBUG, "KaY: Ethernet header: DA=" MACSTR " SA=" MACSTR
3103 " Ethertype=0x%x",
3104 MAC2STR(eth_hdr->dest), MAC2STR(eth_hdr->src),
3105 be_to_host16(eth_hdr->ethertype));
3106
3107 /* the destination address shall not be an individual address */
3108 if (os_memcmp(eth_hdr->dest, pae_group_addr, ETH_ALEN) != 0) {
3109 wpa_printf(MSG_DEBUG,
3110 "KaY: ethernet destination address is not PAE group address");
3111 return -1;
3112 }
3113
3114 wpa_printf(MSG_DEBUG,
3115 "KaY: Common EAPOL PDU structure: Protocol Version=%u Packet Type=%u Packet Body Length=%u",
3116 eapol_hdr->version, eapol_hdr->type,
3117 be_to_host16(eapol_hdr->length));
3118
3119 /* MKPDU shall not be less than 32 octets */
3120 mka_msg_len = be_to_host16(eapol_hdr->length);
3121 if (mka_msg_len < 32) {
3122 wpa_printf(MSG_DEBUG, "KaY: MKPDU is less than 32 octets");
3123 return -1;
3124 }
3125 /* MKPDU shall be a multiple of 4 octets */
3126 if ((mka_msg_len % 4) != 0) {
3127 wpa_printf(MSG_DEBUG,
3128 "KaY: MKPDU is not multiple of 4 octets");
3129 return -1;
3130 }
3131
3132 wpa_hexdump(MSG_MSGDUMP, "KaY: EAPOL-MKA Packet Body (MKPDU)",
3133 mka_hdr, mka_msg_len);
3134
3135 /* Room for body_len already verified in kay_l2_receive() */
3136 body = (struct ieee802_1x_mka_basic_body *) mka_hdr;
3137 body_len = get_mka_param_body_len(body);
3138 /* EAPOL-MKA body should comprise basic parameter set and ICV */
3139 if (mka_msg_len < MKA_HDR_LEN + body_len + DEFAULT_ICV_LEN) {
3140 wpa_printf(MSG_ERROR,
3141 "KaY: Received EAPOL-MKA Packet Body Length (%zu bytes) is less than the Basic Parameter Set Header Length (%zu bytes) + the Basic Parameter Set Body Length (%zu bytes) + %d bytes of ICV",
3142 mka_msg_len, MKA_HDR_LEN,
3143 body_len, DEFAULT_ICV_LEN);
3144 return -1;
3145 }
3146
3147 if (body_len < sizeof(struct ieee802_1x_mka_basic_body) - MKA_HDR_LEN) {
3148 wpa_printf(MSG_DEBUG, "KaY: Too small body length %zu",
3149 body_len);
3150 return -1;
3151 }
3152 ckn_len = body_len -
3153 (sizeof(struct ieee802_1x_mka_basic_body) - MKA_HDR_LEN);
3154 if (ckn_len < 1 || ckn_len > MAX_CKN_LEN) {
3155 wpa_printf(MSG_WARNING,
3156 "KaY: Received EAPOL-MKA CKN Length (%zu bytes) is out of range (<= %u bytes)",
3157 ckn_len, MAX_CKN_LEN);
3158 return -1;
3159 }
3160
3161 ieee802_1x_mka_dump_basic_body(body);
3162
3163 /* CKN should be owned by I */
3164 participant = ieee802_1x_kay_get_participant(kay, body->ckn, ckn_len);
3165 if (!participant) {
3166 wpa_printf(MSG_DEBUG, "KaY: CKN is not included in my CA");
3167 return -1;
3168 }
3169
3170 /* algorithm agility check */
3171 if (os_memcmp(body->algo_agility, mka_algo_agility,
3172 sizeof(body->algo_agility)) != 0) {
3173 wpa_printf(MSG_INFO,
3174 "KaY: Peer's algorithm agility (%s) not supported",
3175 algo_agility_txt(body->algo_agility));
3176 return -1;
3177 }
3178
3179 /* ICV check */
3180 /*
3181 * The ICV will comprise the final octets of the packet body, whatever
3182 * its size, not the fixed length 16 octets, indicated by the EAPOL
3183 * packet body length.
3184 */
3185 if (len < mka_alg_tbl[kay->mka_algindex].icv_len ||
3186 mka_alg_tbl[kay->mka_algindex].icv_hash(
3187 participant->ick.key, participant->ick.len,
3188 buf, len - mka_alg_tbl[kay->mka_algindex].icv_len, icv)) {
3189 wpa_printf(MSG_ERROR, "KaY: Failed to calculate ICV");
3190 return -1;
3191 }
3192
3193 msg_icv = ieee802_1x_mka_decode_icv_body(participant,
3194 (const u8 *) mka_hdr,
3195 mka_msg_len);
3196 if (!msg_icv) {
3197 wpa_printf(MSG_WARNING, "KaY: No ICV in MKPDU - ignore it");
3198 return -1;
3199 }
3200 wpa_hexdump(MSG_DEBUG, "KaY: Received ICV",
3201 msg_icv, mka_alg_tbl[kay->mka_algindex].icv_len);
3202 if (os_memcmp_const(msg_icv, icv,
3203 mka_alg_tbl[kay->mka_algindex].icv_len) != 0) {
3204 wpa_printf(MSG_WARNING,
3205 "KaY: Computed ICV is not equal to Received ICV");
3206 wpa_hexdump(MSG_DEBUG, "KaY: Calculated ICV",
3207 icv, mka_alg_tbl[kay->mka_algindex].icv_len);
3208 return -1;
3209 }
3210
3211 return 0;
3212 }
3213
3214
3215 /**
3216 * ieee802_1x_kay_decode_mkpdu -
3217 */
ieee802_1x_kay_decode_mkpdu(struct ieee802_1x_kay * kay,const u8 * buf,size_t len)3218 static int ieee802_1x_kay_decode_mkpdu(struct ieee802_1x_kay *kay,
3219 const u8 *buf, size_t len)
3220 {
3221 struct ieee802_1x_mka_participant *participant;
3222 struct ieee802_1x_mka_hdr *hdr;
3223 struct ieee802_1x_kay_peer *peer;
3224 size_t body_len;
3225 size_t left_len;
3226 u8 body_type;
3227 int i;
3228 const u8 *pos;
3229 bool handled[256];
3230 bool bad_sak_use = false; /* Error detected while processing SAK Use
3231 * parameter set */
3232 bool i_in_peerlist, is_in_live_peer, is_in_potential_peer;
3233
3234 wpa_printf(MSG_DEBUG, "KaY: Decode received MKPDU (ifname=%s)",
3235 kay->if_name);
3236 if (ieee802_1x_kay_mkpdu_validity_check(kay, buf, len))
3237 return -1;
3238
3239 /* handle basic parameter set */
3240 pos = buf + sizeof(struct ieee8023_hdr) + sizeof(struct ieee802_1x_hdr);
3241 left_len = len - sizeof(struct ieee8023_hdr) -
3242 sizeof(struct ieee802_1x_hdr);
3243 participant = ieee802_1x_mka_decode_basic_body(kay, pos, left_len);
3244 if (!participant)
3245 return -1;
3246
3247 /* to skip basic parameter set */
3248 hdr = (struct ieee802_1x_mka_hdr *) pos;
3249 body_len = MKA_ALIGN_LENGTH(get_mka_param_body_len(hdr));
3250 if (left_len < body_len + MKA_HDR_LEN)
3251 return -1;
3252 pos += body_len + MKA_HDR_LEN;
3253 left_len -= body_len + MKA_HDR_LEN;
3254
3255 /* check i am in the peer's peer list */
3256 i_in_peerlist = ieee802_1x_mka_i_in_peerlist(participant, pos,
3257 left_len);
3258 is_in_live_peer = ieee802_1x_kay_is_in_live_peer(
3259 participant, participant->current_peer_id.mi);
3260 wpa_printf(MSG_DEBUG, "KaY: i_in_peerlist=%s is_in_live_peer=%s",
3261 yes_no(i_in_peerlist), yes_no(is_in_live_peer));
3262 if (i_in_peerlist && !is_in_live_peer) {
3263 /* accept the peer as live peer */
3264 is_in_potential_peer = ieee802_1x_kay_is_in_potential_peer(
3265 participant, participant->current_peer_id.mi);
3266 if (is_in_potential_peer) {
3267 if (!ieee802_1x_kay_move_live_peer(
3268 participant,
3269 participant->current_peer_id.mi,
3270 be_to_host32(participant->
3271 current_peer_id.mn)))
3272 return -1;
3273 } else if (!ieee802_1x_kay_create_live_peer(
3274 participant, participant->current_peer_id.mi,
3275 be_to_host32(participant->
3276 current_peer_id.mn))) {
3277 return -1;
3278 }
3279
3280 ieee802_1x_kay_elect_key_server(participant);
3281 ieee802_1x_kay_decide_macsec_use(participant);
3282 }
3283
3284 /*
3285 * Handle other parameter set than basic parameter set.
3286 * Each parameter set should be present only once.
3287 */
3288 for (i = 0; i < 256; i++)
3289 handled[i] = false;
3290
3291 handled[0] = true;
3292 for (; left_len > MKA_HDR_LEN + DEFAULT_ICV_LEN;
3293 pos += body_len + MKA_HDR_LEN,
3294 left_len -= body_len + MKA_HDR_LEN) {
3295 hdr = (struct ieee802_1x_mka_hdr *) pos;
3296 body_len = MKA_ALIGN_LENGTH(get_mka_param_body_len(hdr));
3297 body_type = get_mka_param_body_type(hdr);
3298
3299 if (body_type == MKA_ICV_INDICATOR)
3300 return 0;
3301
3302 if (left_len < (MKA_HDR_LEN + body_len + DEFAULT_ICV_LEN)) {
3303 wpa_printf(MSG_ERROR,
3304 "KaY: MKA Peer Packet Body Length (%zu bytes) is less than the Parameter Set Header Length (%zu bytes) + the Parameter Set Body Length (%zu bytes) + %d bytes of ICV",
3305 left_len, MKA_HDR_LEN,
3306 body_len, DEFAULT_ICV_LEN);
3307 return -1;
3308 }
3309
3310 if (handled[body_type]) {
3311 wpa_printf(MSG_DEBUG,
3312 "KaY: Ignore duplicated body type %u",
3313 body_type);
3314 continue;
3315 }
3316
3317 handled[body_type] = true;
3318 if (body_type < ARRAY_SIZE(mka_body_handler) &&
3319 mka_body_handler[body_type].body_rx) {
3320 if (mka_body_handler[body_type].body_rx
3321 (participant, pos, left_len) != 0) {
3322 /* Handle parameter set failure */
3323 if (body_type != MKA_SAK_USE) {
3324 wpa_printf(MSG_INFO,
3325 "KaY: Discarding Rx MKPDU: decode of parameter set type (%d) failed",
3326 body_type);
3327 return -1;
3328 }
3329
3330 /* Ideally DIST-SAK should be processed before
3331 * SAK-USE. Unfortunately IEEE Std 802.1X-2010,
3332 * 11.11.3 (Encoding MKPDUs) states SAK-USE(3)
3333 * must always be encoded before DIST-SAK(4).
3334 * Rather than redesigning mka_body_handler so
3335 * that it somehow processes DIST-SAK before
3336 * SAK-USE, just ignore SAK-USE failures if
3337 * DIST-SAK is also present in this MKPDU. */
3338 bad_sak_use = true;
3339 }
3340 } else {
3341 wpa_printf(MSG_ERROR,
3342 "KaY: The body type %d is not supported in this MKA version %d",
3343 body_type, MKA_VERSION_ID);
3344 }
3345 }
3346
3347 if (bad_sak_use && !handled[MKA_DISTRIBUTED_SAK]) {
3348 wpa_printf(MSG_INFO,
3349 "KaY: Discarding Rx MKPDU: decode of parameter set type (%d) failed",
3350 MKA_SAK_USE);
3351 if (!reset_participant_mi(participant))
3352 wpa_printf(MSG_DEBUG, "KaY: Could not update mi");
3353 else
3354 wpa_printf(MSG_DEBUG,
3355 "KaY: Selected a new random MI: %s",
3356 mi_txt(participant->mi));
3357 return -1;
3358 }
3359
3360 /* Detect missing parameter sets */
3361 peer = ieee802_1x_kay_get_live_peer(participant,
3362 participant->current_peer_id.mi);
3363 if (peer) {
3364 /* MKPDU is from live peer */
3365 if (!handled[MKA_SAK_USE]) {
3366 /* Once a live peer starts sending SAK-USE, it should be
3367 * sent every time. */
3368 if (peer->sak_used) {
3369 wpa_printf(MSG_INFO,
3370 "KaY: Discarding Rx MKPDU: Live Peer stopped sending SAK-USE");
3371 return -1;
3372 }
3373
3374 /* Live peer is probably hung if it hasn't sent SAK-USE
3375 * after a reasonable number of MKPDUs. Drop the MKPDU,
3376 * which will eventually force an timeout. */
3377 if (++peer->missing_sak_use_count >
3378 MAX_MISSING_SAK_USE) {
3379 wpa_printf(MSG_INFO,
3380 "KaY: Discarding Rx MKPDU: Live Peer not sending SAK-USE");
3381 return -1;
3382 }
3383 } else {
3384 struct os_reltime now;
3385
3386 os_get_reltime(&now);
3387 peer->missing_sak_use_count = 0;
3388
3389 /* Only update live peer watchdog after successful
3390 * decode of all parameter sets */
3391 peer->expire = now.sec + MKA_LIFE_TIME / 1000;
3392 }
3393 } else {
3394 /* MKPDU is from new or potential peer */
3395 peer = ieee802_1x_kay_get_peer(participant,
3396 participant->current_peer_id.mi);
3397 if (!peer) {
3398 wpa_printf(MSG_DEBUG, "KaY: No peer entry found");
3399 return -1;
3400 }
3401
3402 /* Do not update potential peer watchdog. Per IEEE Std
3403 * 802.1X-2010, 9.4.3, potential peers need to show liveness by
3404 * including our MI/MN in their transmitted MKPDU (within
3405 * potential or live parameter sets). Whena potential peer does
3406 * include our MI/MN in an MKPDU, we respond by moving the peer
3407 * from 'potential_peers' to 'live_peers'. */
3408 }
3409
3410 kay->active = true;
3411 participant->retry_count = 0;
3412 participant->active = true;
3413
3414 return 0;
3415 }
3416
3417
3418
kay_l2_receive(void * ctx,const u8 * src_addr,const u8 * buf,size_t len)3419 static void kay_l2_receive(void *ctx, const u8 *src_addr, const u8 *buf,
3420 size_t len)
3421 {
3422 struct ieee802_1x_kay *kay = ctx;
3423 struct ieee8023_hdr *eth_hdr;
3424 struct ieee802_1x_hdr *eapol_hdr;
3425 size_t calc_len;
3426
3427 /* IEEE Std 802.1X-2010, 11.4 (Validation of received EAPOL PDUs) */
3428
3429 /* must contain at least ieee8023_hdr + ieee802_1x_hdr */
3430 if (len < sizeof(*eth_hdr) + sizeof(*eapol_hdr)) {
3431 wpa_printf(MSG_MSGDUMP, "KaY: EAPOL frame too short (%lu)",
3432 (unsigned long) len);
3433 return;
3434 }
3435
3436 eth_hdr = (struct ieee8023_hdr *) buf;
3437 eapol_hdr = (struct ieee802_1x_hdr *) (eth_hdr + 1);
3438 calc_len = sizeof(*eth_hdr) + sizeof(*eapol_hdr) +
3439 be_to_host16(eapol_hdr->length);
3440 if (len < calc_len) {
3441 wpa_printf(MSG_MSGDUMP, "KaY: EAPOL MPDU is invalid: (received len %lu, calculated len %lu, EAPOL length %u)",
3442 (unsigned long) len,
3443 (unsigned long) calc_len,
3444 be_to_host16(eapol_hdr->length));
3445 return;
3446 }
3447 if (len > calc_len) {
3448 wpa_hexdump(MSG_DEBUG,
3449 "KaY: Ignore extra octets following the Packey Body field",
3450 &buf[calc_len], len - calc_len);
3451 len = calc_len;
3452 }
3453
3454 if (eapol_hdr->version < EAPOL_VERSION) {
3455 wpa_printf(MSG_MSGDUMP, "KaY: version %d does not support MKA",
3456 eapol_hdr->version);
3457 return;
3458 }
3459 if (be_to_host16(eth_hdr->ethertype) != ETH_P_PAE ||
3460 eapol_hdr->type != IEEE802_1X_TYPE_EAPOL_MKA)
3461 return; /* ignore other EAPOL types silently here */
3462
3463 wpa_hexdump(MSG_DEBUG, "KaY: RX EAPOL-MKA", buf, len);
3464 if (dl_list_empty(&kay->participant_list)) {
3465 wpa_printf(MSG_ERROR,
3466 "KaY: No MKA participant instance - ignore EAPOL-MKA");
3467 return;
3468 }
3469
3470 ieee802_1x_kay_decode_mkpdu(kay, buf, len);
3471 }
3472
3473
3474 /**
3475 * ieee802_1x_kay_init -
3476 */
3477 struct ieee802_1x_kay *
ieee802_1x_kay_init(struct ieee802_1x_kay_ctx * ctx,enum macsec_policy policy,bool macsec_replay_protect,u32 macsec_replay_window,u8 macsec_offload,u16 port,u8 priority,u32 macsec_csindex,const char * ifname,const u8 * addr)3478 ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
3479 bool macsec_replay_protect, u32 macsec_replay_window,
3480 u8 macsec_offload, u16 port, u8 priority,
3481 u32 macsec_csindex, const char *ifname, const u8 *addr)
3482 {
3483 struct ieee802_1x_kay *kay;
3484
3485 wpa_printf(MSG_DEBUG, "KaY: Initialize - ifname=%s addr=" MACSTR
3486 " port=%u priority=%u",
3487 ifname, MAC2STR(addr), port, priority);
3488 kay = os_zalloc(sizeof(*kay));
3489 if (!kay) {
3490 wpa_printf(MSG_ERROR, "KaY-%s: out of memory", __func__);
3491 os_free(ctx);
3492 return NULL;
3493 }
3494
3495 kay->ctx = ctx;
3496
3497 kay->enable = true;
3498 kay->active = false;
3499
3500 kay->authenticated = false;
3501 kay->secured = false;
3502 kay->failed = false;
3503 kay->policy = policy;
3504
3505 os_strlcpy(kay->if_name, ifname, IFNAMSIZ);
3506 os_memcpy(kay->actor_sci.addr, addr, ETH_ALEN);
3507 kay->actor_sci.port = host_to_be16(port ? port : 0x0001);
3508 wpa_printf(MSG_DEBUG, "KaY: Generated SCI: %s",
3509 sci_txt(&kay->actor_sci));
3510 kay->actor_priority = priority;
3511
3512 /* While actor acts as a key server, shall distribute sakey */
3513 kay->dist_kn = 1;
3514 kay->dist_an = 0;
3515 kay->dist_time = 0;
3516
3517 kay->pn_exhaustion = PENDING_PN_EXHAUSTION;
3518 kay->macsec_csindex = macsec_csindex;
3519 kay->mka_algindex = DEFAULT_MKA_ALG_INDEX;
3520 kay->mka_version = MKA_VERSION_ID;
3521
3522 os_memcpy(kay->algo_agility, mka_algo_agility,
3523 sizeof(kay->algo_agility));
3524
3525 dl_list_init(&kay->participant_list);
3526
3527 if (policy != DO_NOT_SECURE &&
3528 secy_get_capability(kay, &kay->macsec_capable) < 0)
3529 goto error;
3530
3531 if (policy == DO_NOT_SECURE ||
3532 kay->macsec_capable == MACSEC_CAP_NOT_IMPLEMENTED) {
3533 kay->macsec_capable = MACSEC_CAP_NOT_IMPLEMENTED;
3534 kay->macsec_desired = false;
3535 kay->macsec_protect = false;
3536 kay->macsec_encrypt = false;
3537 kay->macsec_validate = Disabled;
3538 kay->macsec_replay_protect = false;
3539 kay->macsec_replay_window = 0;
3540 kay->macsec_offload = 0;
3541 kay->macsec_confidentiality = CONFIDENTIALITY_NONE;
3542 kay->mka_hello_time = MKA_HELLO_TIME;
3543 } else {
3544 kay->macsec_desired = true;
3545 kay->macsec_protect = true;
3546 if (kay->macsec_capable >= MACSEC_CAP_INTEG_AND_CONF &&
3547 policy == SHOULD_ENCRYPT) {
3548 kay->macsec_encrypt = true;
3549 kay->macsec_confidentiality = CONFIDENTIALITY_OFFSET_0;
3550 } else { /* SHOULD_SECURE */
3551 kay->macsec_encrypt = false;
3552 kay->macsec_confidentiality = CONFIDENTIALITY_NONE;
3553 }
3554 kay->macsec_validate = Strict;
3555 kay->macsec_replay_protect = macsec_replay_protect;
3556 kay->macsec_replay_window = macsec_replay_window;
3557 kay->macsec_offload = macsec_offload;
3558 kay->mka_hello_time = MKA_HELLO_TIME;
3559 }
3560
3561 wpa_printf(MSG_DEBUG, "KaY: state machine created");
3562
3563 /* Initialize the SecY must be prio to CP, as CP will control SecY */
3564 if (secy_init_macsec(kay) < 0) {
3565 wpa_printf(MSG_DEBUG, "KaY: Could not initialize MACsec");
3566 goto error;
3567 }
3568
3569 wpa_printf(MSG_DEBUG, "KaY: secy init macsec done");
3570
3571 /* init CP */
3572 kay->cp = ieee802_1x_cp_sm_init(kay);
3573 if (kay->cp == NULL)
3574 goto error;
3575
3576 if (policy == DO_NOT_SECURE) {
3577 ieee802_1x_cp_connect_authenticated(kay->cp);
3578 ieee802_1x_cp_sm_step(kay->cp);
3579 } else {
3580 kay->l2_mka = l2_packet_init(kay->if_name, NULL, ETH_P_PAE,
3581 kay_l2_receive, kay, 1);
3582 if (kay->l2_mka == NULL) {
3583 wpa_printf(MSG_WARNING,
3584 "KaY: Failed to initialize L2 packet processing for MKA packet");
3585 goto error;
3586 }
3587 }
3588
3589 return kay;
3590
3591 error:
3592 ieee802_1x_kay_deinit(kay);
3593 return NULL;
3594 }
3595
3596
3597 /**
3598 * ieee802_1x_kay_deinit -
3599 */
3600 void
ieee802_1x_kay_deinit(struct ieee802_1x_kay * kay)3601 ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay)
3602 {
3603 struct ieee802_1x_mka_participant *participant;
3604
3605 if (!kay)
3606 return;
3607
3608 wpa_printf(MSG_DEBUG, "KaY: state machine removed");
3609
3610 while (!dl_list_empty(&kay->participant_list)) {
3611 participant = dl_list_entry(kay->participant_list.next,
3612 struct ieee802_1x_mka_participant,
3613 list);
3614 ieee802_1x_kay_delete_mka(kay, &participant->ckn);
3615 }
3616
3617 ieee802_1x_cp_sm_deinit(kay->cp);
3618 secy_deinit_macsec(kay);
3619
3620 if (kay->l2_mka) {
3621 l2_packet_deinit(kay->l2_mka);
3622 kay->l2_mka = NULL;
3623 }
3624
3625 os_free(kay->ctx);
3626 os_free(kay);
3627 }
3628
3629
mode_txt(enum mka_created_mode mode)3630 static const char * mode_txt(enum mka_created_mode mode)
3631 {
3632 switch (mode) {
3633 case PSK:
3634 return "PSK";
3635 case EAP_EXCHANGE:
3636 return "EAP";
3637 }
3638
3639 return "?";
3640 }
3641
3642
3643 /**
3644 * ieee802_1x_kay_create_mka -
3645 */
3646 struct ieee802_1x_mka_participant *
ieee802_1x_kay_create_mka(struct ieee802_1x_kay * kay,const struct mka_key_name * ckn,const struct mka_key * cak,u32 life,enum mka_created_mode mode,bool is_authenticator)3647 ieee802_1x_kay_create_mka(struct ieee802_1x_kay *kay,
3648 const struct mka_key_name *ckn,
3649 const struct mka_key *cak, u32 life,
3650 enum mka_created_mode mode, bool is_authenticator)
3651 {
3652 struct ieee802_1x_mka_participant *participant;
3653 unsigned int usecs;
3654
3655 wpa_printf(MSG_DEBUG,
3656 "KaY: Create MKA (ifname=%s mode=%s authenticator=%s)",
3657 kay->if_name, mode_txt(mode), yes_no(is_authenticator));
3658
3659 if (!kay || !ckn || !cak) {
3660 wpa_printf(MSG_ERROR, "KaY: ckn or cak is null");
3661 return NULL;
3662 }
3663
3664 if (cak->len != 16 && cak->len != 32) {
3665 wpa_printf(MSG_ERROR, "KaY: Unexpected CAK length %u",
3666 (unsigned int) cak->len);
3667 return NULL;
3668 }
3669 if (ckn->len > MAX_CKN_LEN) {
3670 wpa_printf(MSG_ERROR, "KaY: CKN is out of range (>32 bytes)");
3671 return NULL;
3672 }
3673 if (!kay->enable) {
3674 wpa_printf(MSG_ERROR, "KaY: Now is at disable state");
3675 return NULL;
3676 }
3677
3678 participant = os_zalloc(sizeof(*participant));
3679 if (!participant) {
3680 wpa_printf(MSG_ERROR, "KaY-%s: out of memory", __func__);
3681 return NULL;
3682 }
3683
3684 participant->ckn.len = ckn->len;
3685 os_memcpy(participant->ckn.name, ckn->name, ckn->len);
3686 wpa_hexdump(MSG_DEBUG, "KaY: CKN", participant->ckn.name,
3687 participant->ckn.len);
3688 participant->cak.len = cak->len;
3689 os_memcpy(participant->cak.key, cak->key, cak->len);
3690 wpa_hexdump_key(MSG_DEBUG, "KaY: CAK", participant->cak.key,
3691 participant->cak.len);
3692 if (life) {
3693 struct os_reltime now;
3694 os_get_reltime(&now);
3695
3696 participant->cak_life = life + now.sec;
3697 }
3698
3699 switch (mode) {
3700 case EAP_EXCHANGE:
3701 if (is_authenticator) {
3702 participant->is_obliged_key_server = true;
3703 participant->can_be_key_server = true;
3704 participant->is_key_server = true;
3705 participant->principal = true;
3706
3707 os_memcpy(&kay->key_server_sci, &kay->actor_sci,
3708 sizeof(kay->key_server_sci));
3709 kay->key_server_priority = kay->actor_priority;
3710 participant->is_elected = true;
3711 } else {
3712 participant->is_obliged_key_server = false;
3713 participant->can_be_key_server = false;
3714 participant->is_key_server = false;
3715 participant->is_elected = true;
3716 }
3717 break;
3718
3719 default:
3720 participant->is_obliged_key_server = false;
3721 participant->can_be_key_server = true;
3722 participant->is_key_server = true;
3723 participant->is_elected = false;
3724 break;
3725 }
3726
3727 participant->cached = false;
3728
3729 participant->active = false;
3730 participant->participant = false;
3731 participant->retain = false;
3732 participant->activate = DEFAULT;
3733
3734 if (participant->is_key_server)
3735 participant->principal = true;
3736
3737 dl_list_init(&participant->live_peers);
3738 dl_list_init(&participant->potential_peers);
3739
3740 participant->retry_count = 0;
3741 participant->kay = kay;
3742
3743 if (!reset_participant_mi(participant))
3744 goto fail;
3745 wpa_printf(MSG_DEBUG, "KaY: Selected random MI: %s",
3746 mi_txt(participant->mi));
3747
3748 participant->lrx = false;
3749 participant->ltx = false;
3750 participant->orx = false;
3751 participant->otx = false;
3752 participant->to_dist_sak = false;
3753 participant->to_use_sak = false;
3754 participant->new_sak = false;
3755 dl_list_init(&participant->sak_list);
3756 participant->new_key = NULL;
3757 dl_list_init(&participant->rxsc_list);
3758 participant->txsc = ieee802_1x_kay_init_transmit_sc(&kay->actor_sci);
3759 secy_cp_control_protect_frames(kay, kay->macsec_protect);
3760 secy_cp_control_replay(kay, kay->macsec_replay_protect,
3761 kay->macsec_replay_window);
3762 secy_cp_control_offload(kay, kay->macsec_offload);
3763 if (secy_create_transmit_sc(kay, participant->txsc))
3764 goto fail;
3765
3766 /* to derive KEK from CAK and CKN */
3767 participant->kek.len = participant->cak.len;
3768 if (mka_alg_tbl[kay->mka_algindex].kek_trfm(participant->cak.key,
3769 participant->cak.len,
3770 participant->ckn.name,
3771 participant->ckn.len,
3772 participant->kek.key,
3773 participant->kek.len)) {
3774 wpa_printf(MSG_ERROR, "KaY: KEK derivation failed");
3775 goto fail;
3776 }
3777 wpa_hexdump_key(MSG_DEBUG, "KaY: Derived KEK",
3778 participant->kek.key, participant->kek.len);
3779
3780 /* to derive ICK from CAK and CKN */
3781 participant->ick.len = participant->cak.len;
3782 if (mka_alg_tbl[kay->mka_algindex].ick_trfm(participant->cak.key,
3783 participant->cak.len,
3784 participant->ckn.name,
3785 participant->ckn.len,
3786 participant->ick.key,
3787 participant->ick.len)) {
3788 wpa_printf(MSG_ERROR, "KaY: ICK derivation failed");
3789 goto fail;
3790 }
3791 wpa_hexdump_key(MSG_DEBUG, "KaY: Derived ICK",
3792 participant->ick.key, participant->ick.len);
3793
3794 dl_list_add(&kay->participant_list, &participant->list);
3795
3796 usecs = os_random() % (kay->mka_hello_time * 1000);
3797 eloop_register_timeout(0, usecs, ieee802_1x_participant_timer,
3798 participant, NULL);
3799
3800 /* Disable MKA lifetime for PSK mode.
3801 * The peer(s) can take a long time to come up, because we
3802 * create a "standby" MKA, and we need it to remain live until
3803 * some peer appears.
3804 */
3805 if (mode != PSK) {
3806 struct os_reltime now;
3807 os_get_reltime(&now);
3808
3809 participant->mka_life = MKA_LIFE_TIME / 1000 + now.sec +
3810 usecs / 1000000;
3811 }
3812 participant->mode = mode;
3813
3814 return participant;
3815
3816 fail:
3817 os_free(participant->txsc);
3818 os_free(participant);
3819 return NULL;
3820 }
3821
3822
3823 /**
3824 * ieee802_1x_kay_delete_mka -
3825 */
3826 void
ieee802_1x_kay_delete_mka(struct ieee802_1x_kay * kay,struct mka_key_name * ckn)3827 ieee802_1x_kay_delete_mka(struct ieee802_1x_kay *kay, struct mka_key_name *ckn)
3828 {
3829 struct ieee802_1x_mka_participant *participant;
3830 struct ieee802_1x_kay_peer *peer;
3831 struct data_key *sak;
3832 struct receive_sc *rxsc;
3833
3834 if (!kay || !ckn)
3835 return;
3836
3837 wpa_printf(MSG_DEBUG, "KaY: participant removed");
3838
3839 /* get the participant */
3840 participant = ieee802_1x_kay_get_participant(kay, ckn->name, ckn->len);
3841 if (!participant) {
3842 wpa_hexdump(MSG_DEBUG, "KaY: participant is not found",
3843 ckn->name, ckn->len);
3844 return;
3845 }
3846
3847 eloop_cancel_timeout(ieee802_1x_participant_timer, participant, NULL);
3848 dl_list_del(&participant->list);
3849
3850 /* remove live peer */
3851 while (!dl_list_empty(&participant->live_peers)) {
3852 peer = dl_list_entry(participant->live_peers.next,
3853 struct ieee802_1x_kay_peer, list);
3854 dl_list_del(&peer->list);
3855 os_free(peer);
3856 }
3857
3858 /* remove potential peer */
3859 while (!dl_list_empty(&participant->potential_peers)) {
3860 peer = dl_list_entry(participant->potential_peers.next,
3861 struct ieee802_1x_kay_peer, list);
3862 dl_list_del(&peer->list);
3863 os_free(peer);
3864 }
3865
3866 /* remove sak */
3867 while (!dl_list_empty(&participant->sak_list)) {
3868 sak = dl_list_entry(participant->sak_list.next,
3869 struct data_key, list);
3870 dl_list_del(&sak->list);
3871 ieee802_1x_kay_deinit_data_key(sak);
3872 }
3873 while (!dl_list_empty(&participant->rxsc_list)) {
3874 rxsc = dl_list_entry(participant->rxsc_list.next,
3875 struct receive_sc, list);
3876 ieee802_1x_kay_deinit_receive_sc(participant, rxsc);
3877 }
3878 ieee802_1x_kay_deinit_transmit_sc(participant, participant->txsc);
3879
3880 os_memset(&participant->cak, 0, sizeof(participant->cak));
3881 os_memset(&participant->kek, 0, sizeof(participant->kek));
3882 os_memset(&participant->ick, 0, sizeof(participant->ick));
3883 os_free(participant);
3884 }
3885
3886
3887 /**
3888 * ieee802_1x_kay_mka_participate -
3889 */
ieee802_1x_kay_mka_participate(struct ieee802_1x_kay * kay,struct mka_key_name * ckn,bool status)3890 void ieee802_1x_kay_mka_participate(struct ieee802_1x_kay *kay,
3891 struct mka_key_name *ckn, bool status)
3892 {
3893 struct ieee802_1x_mka_participant *participant;
3894
3895 if (!kay || !ckn)
3896 return;
3897
3898 participant = ieee802_1x_kay_get_participant(kay, ckn->name, ckn->len);
3899 if (!participant)
3900 return;
3901
3902 participant->active = status;
3903 }
3904
3905
3906 /**
3907 * ieee802_1x_kay_new_sak -
3908 */
3909 int
ieee802_1x_kay_new_sak(struct ieee802_1x_kay * kay)3910 ieee802_1x_kay_new_sak(struct ieee802_1x_kay *kay)
3911 {
3912 struct ieee802_1x_mka_participant *participant;
3913
3914 if (!kay)
3915 return -1;
3916
3917 participant = ieee802_1x_kay_get_principal_participant(kay);
3918 if (!participant)
3919 return -1;
3920
3921 participant->new_sak = true;
3922 wpa_printf(MSG_DEBUG, "KaY: new SAK signal");
3923
3924 return 0;
3925 }
3926
3927
3928 /**
3929 * ieee802_1x_kay_change_cipher_suite -
3930 */
3931 int
ieee802_1x_kay_change_cipher_suite(struct ieee802_1x_kay * kay,unsigned int cs_index)3932 ieee802_1x_kay_change_cipher_suite(struct ieee802_1x_kay *kay,
3933 unsigned int cs_index)
3934 {
3935 struct ieee802_1x_mka_participant *participant;
3936 enum macsec_cap secy_cap;
3937
3938 if (!kay)
3939 return -1;
3940
3941 if (cs_index >= CS_TABLE_SIZE) {
3942 wpa_printf(MSG_ERROR,
3943 "KaY: Configured cipher suite index is out of range");
3944 return -1;
3945 }
3946 if (kay->macsec_csindex == cs_index)
3947 return -2;
3948
3949 if (cs_index == 0)
3950 kay->macsec_desired = false;
3951
3952 kay->macsec_csindex = cs_index;
3953 kay->macsec_capable = cipher_suite_tbl[kay->macsec_csindex].capable;
3954
3955 if (secy_get_capability(kay, &secy_cap) < 0)
3956 return -3;
3957
3958 if (kay->macsec_capable > secy_cap)
3959 kay->macsec_capable = secy_cap;
3960
3961 participant = ieee802_1x_kay_get_principal_participant(kay);
3962 if (participant) {
3963 wpa_printf(MSG_INFO, "KaY: Cipher Suite changed");
3964 participant->new_sak = true;
3965 }
3966
3967 return 0;
3968 }
3969
3970
3971 #ifdef CONFIG_CTRL_IFACE
3972
3973 /**
3974 * ieee802_1x_kay_get_status - Get IEEE 802.1X KaY status details
3975 * @sm: Pointer to KaY allocated with ieee802_1x_kay_init()
3976 * @buf: Buffer for status information
3977 * @buflen: Maximum buffer length
3978 * @verbose: Whether to include verbose status information
3979 * Returns: Number of bytes written to buf.
3980 *
3981 * Query KaY status information. This function fills in a text area with current
3982 * status information. If the buffer (buf) is not large enough, status
3983 * information will be truncated to fit the buffer.
3984 */
ieee802_1x_kay_get_status(struct ieee802_1x_kay * kay,char * buf,size_t buflen)3985 int ieee802_1x_kay_get_status(struct ieee802_1x_kay *kay, char *buf,
3986 size_t buflen)
3987 {
3988 char *pos, *end;
3989 int res, count;
3990 struct ieee802_1x_mka_participant *p;
3991
3992 if (!kay)
3993 return 0;
3994
3995 pos = buf;
3996 end = buf + buflen;
3997
3998 res = os_snprintf(pos, end - pos,
3999 "PAE KaY status=%s\n"
4000 "Authenticated=%s\n"
4001 "Secured=%s\n"
4002 "Failed=%s\n"
4003 "Actor Priority=%u\n"
4004 "Key Server Priority=%u\n"
4005 "Is Key Server=%s\n"
4006 "Number of Keys Distributed=%u\n"
4007 "Number of Keys Received=%u\n"
4008 "MKA Hello Time=%u\n",
4009 kay->active ? "Active" : "Not-Active",
4010 kay->authenticated ? "Yes" : "No",
4011 kay->secured ? "Yes" : "No",
4012 kay->failed ? "Yes" : "No",
4013 kay->actor_priority,
4014 kay->key_server_priority,
4015 kay->is_key_server ? "Yes" : "No",
4016 kay->dist_kn - 1,
4017 kay->rcvd_keys,
4018 kay->mka_hello_time);
4019 if (os_snprintf_error(buflen, res))
4020 return 0;
4021 pos += res;
4022
4023 res = os_snprintf(pos, end - pos,
4024 "actor_sci=%s\n", sci_txt(&kay->actor_sci));
4025 if (os_snprintf_error(buflen, res))
4026 return end - pos;
4027 pos += res;
4028
4029 res = os_snprintf(pos, end - pos,
4030 "key_server_sci=%s\n", sci_txt(&kay->key_server_sci));
4031 if (os_snprintf_error(buflen, res))
4032 return end - pos;
4033 pos += res;
4034
4035 count = 0;
4036 dl_list_for_each(p, &kay->participant_list,
4037 struct ieee802_1x_mka_participant, list) {
4038 char *pos2 = pos;
4039
4040 res = os_snprintf(pos2, end - pos2, "participant_idx=%d\nckn=",
4041 count);
4042 if (os_snprintf_error(buflen, res))
4043 return end - pos;
4044 pos2 += res;
4045 count++;
4046
4047 pos2 += wpa_snprintf_hex(pos2, end - pos2, p->ckn.name,
4048 p->ckn.len);
4049
4050 res = os_snprintf(pos2, end - pos2,
4051 "\nmi=%s\n"
4052 "mn=%u\n"
4053 "active=%s\n"
4054 "participant=%s\n"
4055 "retain=%s\n"
4056 "live_peers=%u\n"
4057 "potential_peers=%u\n"
4058 "is_key_server=%s\n"
4059 "is_elected=%s\n",
4060 mi_txt(p->mi), p->mn,
4061 yes_no(p->active),
4062 yes_no(p->participant),
4063 yes_no(p->retain),
4064 dl_list_len(&p->live_peers),
4065 dl_list_len(&p->potential_peers),
4066 yes_no(p->is_key_server),
4067 yes_no(p->is_elected));
4068 if (os_snprintf_error(buflen, res))
4069 return end - pos;
4070 pos2 += res;
4071 pos = pos2;
4072 }
4073
4074 return pos - buf;
4075 }
4076
4077
true_false(bool val)4078 static const char * true_false(bool val)
4079 {
4080 return val ? "true" : "false";
4081 }
4082
4083
activate_control_txt(enum activate_ctrl activate)4084 static const char * activate_control_txt(enum activate_ctrl activate)
4085 {
4086 switch (activate) {
4087 case DEFAULT:
4088 return "default";
4089 case DISABLED:
4090 return "disabled";
4091 case ON_OPER_UP:
4092 return "onOperUp";
4093 case ALWAYS:
4094 return "always";
4095 }
4096
4097 return "?";
4098 }
4099
4100
mka_mib_peer(struct dl_list * peers,bool live,char * buf,char * end)4101 static char * mka_mib_peer(struct dl_list *peers, bool live, char *buf,
4102 char *end)
4103 {
4104 char *pos = buf;
4105 struct ieee802_1x_kay_peer *p;
4106 int res;
4107
4108 dl_list_for_each(p, peers, struct ieee802_1x_kay_peer, list) {
4109 res = os_snprintf(pos, end - pos,
4110 "ieee8021XKayMkaPeerListMI=%s\n"
4111 "ieee8021XKayMkaPeerListMN=%u\n"
4112 "ieee8021XKayMkaPeerListType=%u\n"
4113 "ieee8021XKayMkaPeerListSCI=%s\n",
4114 mi_txt(p->mi),
4115 p->mn,
4116 live ? 1 : 2,
4117 sci_txt(&p->sci));
4118 if (os_snprintf_error(end - pos, res))
4119 return pos;
4120 pos += res;
4121 }
4122
4123 return pos;
4124 }
4125
4126
ieee802_1x_kay_get_mib(struct ieee802_1x_kay * kay,char * buf,size_t buflen)4127 int ieee802_1x_kay_get_mib(struct ieee802_1x_kay *kay, char *buf,
4128 size_t buflen)
4129 {
4130 char *pos, *end;
4131 int res;
4132 struct ieee802_1x_mka_participant *p;
4133
4134 if (!kay)
4135 return 0;
4136
4137 pos = buf;
4138 end = buf + buflen;
4139
4140 dl_list_for_each(p, &kay->participant_list,
4141 struct ieee802_1x_mka_participant, list) {
4142 char *pos2 = pos;
4143
4144 res = os_snprintf(pos2, end - pos2, "ieee8021XKayMkaPartCKN=");
4145 if (os_snprintf_error(buflen, res))
4146 return end - pos;
4147 pos2 += res;
4148
4149 pos2 += wpa_snprintf_hex(pos2, end - pos2, p->ckn.name,
4150 p->ckn.len);
4151
4152 res = os_snprintf(pos2, end - pos2,
4153 "\nieee8021XKayMkaPartCached=%s\n"
4154 "ieee8021XKayMkaPartActive=%s\n"
4155 "ieee8021XKayMkaPartRetain=%s\n"
4156 "ieee8021XKayMkaPartActivateControl=%s\n"
4157 "ieee8021XKayMkaPartPrincipal=%s\n",
4158 true_false(p->cached),
4159 true_false(p->active),
4160 true_false(p->retain),
4161 activate_control_txt(p->activate),
4162 true_false(p->principal));
4163 if (os_snprintf_error(buflen, res))
4164 return end - pos;
4165 pos2 += res;
4166 pos = pos2;
4167
4168 pos = mka_mib_peer(&p->live_peers, true, pos, end);
4169 pos = mka_mib_peer(&p->potential_peers, false, pos, end);
4170 }
4171
4172 return pos - buf;
4173 }
4174
4175 #endif /* CONFIG_CTRL_IFACE */
4176