You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
145 lines
5.2 KiB
145 lines
5.2 KiB
From e0d9fd344d20bb35efcd5c37ece0a5d67632439d Mon Sep 17 00:00:00 2001 |
|
Message-Id: <e0d9fd344d20bb35efcd5c37ece0a5d67632439d.1488376602.git.dcaratti@redhat.com> |
|
From: Sabrina Dubroca <sd@queasysnail.net> |
|
Date: Wed, 2 Nov 2016 16:38:39 +0100 |
|
Subject: [PATCH] wpa_supplicant: Allow configuring the MACsec port for MKA |
|
|
|
Previously, wpa_supplicant only supported hardcoded port == 1 in the |
|
SCI, but users may want to choose a different port. |
|
|
|
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> |
|
--- |
|
src/pae/ieee802_1x_kay.c | 4 ++-- |
|
src/pae/ieee802_1x_kay.h | 2 +- |
|
wpa_supplicant/config.c | 1 + |
|
wpa_supplicant/config_file.c | 1 + |
|
wpa_supplicant/config_ssid.h | 9 +++++++++ |
|
wpa_supplicant/wpa_cli.c | 1 + |
|
wpa_supplicant/wpa_supplicant.conf | 4 ++++ |
|
wpa_supplicant/wpas_kay.c | 4 ++-- |
|
8 files changed, 21 insertions(+), 5 deletions(-) |
|
|
|
diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c |
|
index 7664e2d..3a495ca 100644 |
|
--- a/src/pae/ieee802_1x_kay.c |
|
+++ b/src/pae/ieee802_1x_kay.c |
|
@@ -3071,7 +3071,7 @@ static void kay_l2_receive(void *ctx, const u8 *src_addr, const u8 *buf, |
|
*/ |
|
struct ieee802_1x_kay * |
|
ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy, |
|
- const char *ifname, const u8 *addr) |
|
+ u16 port, const char *ifname, const u8 *addr) |
|
{ |
|
struct ieee802_1x_kay *kay; |
|
|
|
@@ -3093,7 +3093,7 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy, |
|
|
|
os_strlcpy(kay->if_name, ifname, IFNAMSIZ); |
|
os_memcpy(kay->actor_sci.addr, addr, ETH_ALEN); |
|
- kay->actor_sci.port = host_to_be16(0x0001); |
|
+ kay->actor_sci.port = host_to_be16(port ? port : 0x0001); |
|
kay->actor_priority = DEFAULT_PRIO_NOT_KEY_SERVER; |
|
|
|
/* While actor acts as a key server, shall distribute sakey */ |
|
diff --git a/src/pae/ieee802_1x_kay.h b/src/pae/ieee802_1x_kay.h |
|
index fb49f62..ea5a0dd 100644 |
|
--- a/src/pae/ieee802_1x_kay.h |
|
+++ b/src/pae/ieee802_1x_kay.h |
|
@@ -233,7 +233,7 @@ struct ieee802_1x_kay { |
|
|
|
struct ieee802_1x_kay * |
|
ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy, |
|
- const char *ifname, const u8 *addr); |
|
+ u16 port, const char *ifname, const u8 *addr); |
|
void ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay); |
|
|
|
struct ieee802_1x_mka_participant * |
|
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c |
|
index afb631e..2120a6e 100644 |
|
--- a/wpa_supplicant/config.c |
|
+++ b/wpa_supplicant/config.c |
|
@@ -2126,6 +2126,7 @@ static const struct parse_data ssid_fields[] = { |
|
#ifdef CONFIG_MACSEC |
|
{ INT_RANGE(macsec_policy, 0, 1) }, |
|
{ INT_RANGE(macsec_integ_only, 0, 1) }, |
|
+ { INT_RANGE(macsec_port, 1, 65534) }, |
|
{ FUNC_KEY(mka_cak) }, |
|
{ FUNC_KEY(mka_ckn) }, |
|
#endif /* CONFIG_MACSEC */ |
|
diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c |
|
index f605fa9..2e3d57e 100644 |
|
--- a/wpa_supplicant/config_file.c |
|
+++ b/wpa_supplicant/config_file.c |
|
@@ -809,6 +809,7 @@ static void wpa_config_write_network(FILE *f, struct wpa_ssid *ssid) |
|
write_mka_cak(f, ssid); |
|
write_mka_ckn(f, ssid); |
|
INT(macsec_integ_only); |
|
+ INT(macsec_port); |
|
#endif /* CONFIG_MACSEC */ |
|
#ifdef CONFIG_HS20 |
|
INT(update_identifier); |
|
diff --git a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h |
|
index b8c3192..fe0f7fa 100644 |
|
--- a/wpa_supplicant/config_ssid.h |
|
+++ b/wpa_supplicant/config_ssid.h |
|
@@ -742,6 +742,15 @@ struct wpa_ssid { |
|
int macsec_integ_only; |
|
|
|
/** |
|
+ * macsec_port - MACsec port (in SCI) |
|
+ * |
|
+ * Port component of the SCI. |
|
+ * |
|
+ * Range: 1-65534 (default: 1) |
|
+ */ |
|
+ int macsec_port; |
|
+ |
|
+ /** |
|
* mka_ckn - MKA pre-shared CKN |
|
*/ |
|
#define MACSEC_CKN_LEN 32 |
|
diff --git a/wpa_supplicant/wpa_cli.c b/wpa_supplicant/wpa_cli.c |
|
index aed95e6..f11028a 100644 |
|
--- a/wpa_supplicant/wpa_cli.c |
|
+++ b/wpa_supplicant/wpa_cli.c |
|
@@ -1391,6 +1391,7 @@ static const char *network_fields[] = { |
|
#ifdef CONFIG_MACSEC |
|
"macsec_policy", |
|
"macsec_integ_only", |
|
+ "macsec_port", |
|
#endif /* CONFIG_MACSEC */ |
|
#ifdef CONFIG_HS20 |
|
"update_identifier", |
|
diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf |
|
index b23c5e6..82aa24e 100644 |
|
--- a/wpa_supplicant/wpa_supplicant.conf |
|
+++ b/wpa_supplicant/wpa_supplicant.conf |
|
@@ -899,6 +899,10 @@ fast_reauth=1 |
|
# 0: Encrypt traffic (default) |
|
# 1: Integrity only |
|
# |
|
+# macsec_port: IEEE 802.1X/MACsec port |
|
+# Port component of the SCI |
|
+# Range: 1-65534 (default: 1) |
|
+# |
|
# mka_cak and mka_ckn: IEEE 802.1X/MACsec pre-shared authentication mode |
|
# This allows to configure MACsec with a pre-shared key using a (CAK,CKN) pair. |
|
# In this mode, instances of wpa_supplicant can act as peers, one of |
|
diff --git a/wpa_supplicant/wpas_kay.c b/wpa_supplicant/wpas_kay.c |
|
index 2ff4895..d3fefda 100644 |
|
--- a/wpa_supplicant/wpas_kay.c |
|
+++ b/wpa_supplicant/wpas_kay.c |
|
@@ -232,8 +232,8 @@ int ieee802_1x_alloc_kay_sm(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid) |
|
kay_ctx->enable_transmit_sa = wpas_enable_transmit_sa; |
|
kay_ctx->disable_transmit_sa = wpas_disable_transmit_sa; |
|
|
|
- res = ieee802_1x_kay_init(kay_ctx, policy, wpa_s->ifname, |
|
- wpa_s->own_addr); |
|
+ res = ieee802_1x_kay_init(kay_ctx, policy, ssid->macsec_port, |
|
+ wpa_s->ifname, wpa_s->own_addr); |
|
if (res == NULL) { |
|
os_free(kay_ctx); |
|
return -1; |
|
-- |
|
2.7.4 |
|
|
|
|