You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
51 lines
1.9 KiB
51 lines
1.9 KiB
From e54691106b29f41aa3081b00eb4f48e411cebc72 Mon Sep 17 00:00:00 2001 |
|
Message-Id: <e54691106b29f41aa3081b00eb4f48e411cebc72.1488376602.git.dcaratti@redhat.com> |
|
From: Badrish Adiga H R <badrish.adigahr@gmail.com> |
|
Date: Fri, 6 Jan 2017 15:27:10 +0530 |
|
Subject: [PATCH] mka: Some bug fixes for MACsec in PSK mode |
|
|
|
Issue: |
|
------ |
|
The test setup has 2 peers running MACsec in PSK mode, Peer A with |
|
MAC address higher than MAC Address of peer B. Test sequence is |
|
1. Peer B starts with actor_priority 255 |
|
2. Peer A starts with priority 16, becomes key server. |
|
3. Peer A stops.. |
|
4. Peer A restarts with priority 255, but because of the stale values |
|
participant->is_key_server(=TRUE) and participant->is_elected(=TRUE) |
|
it continues to remain as Key Server. |
|
5. For peer B, key server election happens and since it has lower MAC |
|
address as compared to MAC address of A, it becomes the key server. |
|
Now we have 2 key servers in CA and is not correct. |
|
|
|
Root-cause & fix: |
|
----------------- |
|
When number of live peers become 0, the flags such lrx, ltx, orx, |
|
otx, etc. need to be cleared. In MACsec PSK mode, these stale values |
|
create problems while re-establishing CA. |
|
|
|
Signed-off-by: Badrish Adiga H R <badrish.adigahr@gmail.com> |
|
--- |
|
src/pae/ieee802_1x_kay.c | 6 ++++++ |
|
1 file changed, 6 insertions(+) |
|
|
|
diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c |
|
index 79a6878..92fd7ba 100644 |
|
--- a/src/pae/ieee802_1x_kay.c |
|
+++ b/src/pae/ieee802_1x_kay.c |
|
@@ -2378,6 +2378,12 @@ static void ieee802_1x_participant_timer(void *eloop_ctx, void *timeout_ctx) |
|
participant->advised_capability = |
|
MACSEC_CAP_NOT_IMPLEMENTED; |
|
participant->to_use_sak = FALSE; |
|
+ participant->ltx = FALSE; |
|
+ participant->lrx = FALSE; |
|
+ participant->otx = FALSE; |
|
+ participant->orx = FALSE; |
|
+ participant->is_key_server = FALSE; |
|
+ participant->is_elected = FALSE; |
|
kay->authenticated = TRUE; |
|
kay->secured = FALSE; |
|
kay->failed = FALSE; |
|
-- |
|
2.7.4 |
|
|
|
|