You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
176 lines
6.5 KiB
176 lines
6.5 KiB
From 65dfa872862641c17e4f6276c56fad0a6c18d219 Mon Sep 17 00:00:00 2001 |
|
Message-Id: <65dfa872862641c17e4f6276c56fad0a6c18d219.1488376602.git.dcaratti@redhat.com> |
|
From: Badrish Adiga H R <badrish.adigahr@gmail.com> |
|
Date: Mon, 5 Dec 2016 06:53:55 -0800 |
|
Subject: [PATCH] mka: Make MKA actor priority configurable |
|
|
|
This adds a new wpa_supplicant network profile parameter |
|
mka_priority=0..255 to set the priority of the MKA Actor. |
|
|
|
Signed-off-by: Badrish Adiga H R <badrish.adigahr@gmail.com> |
|
--- |
|
src/pae/ieee802_1x_kay.c | 4 ++-- |
|
src/pae/ieee802_1x_kay.h | 2 +- |
|
wpa_supplicant/config.c | 5 +++++ |
|
wpa_supplicant/config_file.c | 2 ++ |
|
wpa_supplicant/config_ssid.h | 7 +++++++ |
|
wpa_supplicant/wpa_cli.c | 1 + |
|
wpa_supplicant/wpa_supplicant.conf | 8 +++++--- |
|
wpa_supplicant/wpas_kay.c | 3 ++- |
|
8 files changed, 25 insertions(+), 7 deletions(-) |
|
|
|
diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c |
|
index cf5782a..1004b32 100644 |
|
--- a/src/pae/ieee802_1x_kay.c |
|
+++ b/src/pae/ieee802_1x_kay.c |
|
@@ -3083,7 +3083,7 @@ static void kay_l2_receive(void *ctx, const u8 *src_addr, const u8 *buf, |
|
*/ |
|
struct ieee802_1x_kay * |
|
ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy, |
|
- u16 port, const char *ifname, const u8 *addr) |
|
+ u16 port, u8 priority, const char *ifname, const u8 *addr) |
|
{ |
|
struct ieee802_1x_kay *kay; |
|
|
|
@@ -3106,7 +3106,7 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy, |
|
os_strlcpy(kay->if_name, ifname, IFNAMSIZ); |
|
os_memcpy(kay->actor_sci.addr, addr, ETH_ALEN); |
|
kay->actor_sci.port = host_to_be16(port ? port : 0x0001); |
|
- kay->actor_priority = DEFAULT_PRIO_NOT_KEY_SERVER; |
|
+ kay->actor_priority = priority; |
|
|
|
/* While actor acts as a key server, shall distribute sakey */ |
|
kay->dist_kn = 1; |
|
diff --git a/src/pae/ieee802_1x_kay.h b/src/pae/ieee802_1x_kay.h |
|
index b38e814..8f394fd 100644 |
|
--- a/src/pae/ieee802_1x_kay.h |
|
+++ b/src/pae/ieee802_1x_kay.h |
|
@@ -236,7 +236,7 @@ u64 mka_sci_u64(struct ieee802_1x_mka_sci *sci); |
|
|
|
struct ieee802_1x_kay * |
|
ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy, |
|
- u16 port, const char *ifname, const u8 *addr); |
|
+ u16 port, u8 priority, const char *ifname, const u8 *addr); |
|
void ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay); |
|
|
|
struct ieee802_1x_mka_participant * |
|
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c |
|
index 2120a6e..2a26d2d 100644 |
|
--- a/wpa_supplicant/config.c |
|
+++ b/wpa_supplicant/config.c |
|
@@ -11,6 +11,7 @@ |
|
#include "common.h" |
|
#include "utils/uuid.h" |
|
#include "utils/ip_addr.h" |
|
+#include "common/ieee802_1x_defs.h" |
|
#include "crypto/sha1.h" |
|
#include "rsn_supp/wpa.h" |
|
#include "eap_peer/eap.h" |
|
@@ -2127,6 +2128,7 @@ static const struct parse_data ssid_fields[] = { |
|
{ INT_RANGE(macsec_policy, 0, 1) }, |
|
{ INT_RANGE(macsec_integ_only, 0, 1) }, |
|
{ INT_RANGE(macsec_port, 1, 65534) }, |
|
+ { INT_RANGE(mka_priority, 0, 255) }, |
|
{ FUNC_KEY(mka_cak) }, |
|
{ FUNC_KEY(mka_ckn) }, |
|
#endif /* CONFIG_MACSEC */ |
|
@@ -2617,6 +2619,9 @@ void wpa_config_set_network_defaults(struct wpa_ssid *ssid) |
|
#ifdef CONFIG_IEEE80211W |
|
ssid->ieee80211w = MGMT_FRAME_PROTECTION_DEFAULT; |
|
#endif /* CONFIG_IEEE80211W */ |
|
+#ifdef CONFIG_MACSEC |
|
+ ssid->mka_priority = DEFAULT_PRIO_NOT_KEY_SERVER; |
|
+#endif /* CONFIG_MACSEC */ |
|
ssid->mac_addr = -1; |
|
} |
|
|
|
diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c |
|
index b9b1d4d..98e3591 100644 |
|
--- a/wpa_supplicant/config_file.c |
|
+++ b/wpa_supplicant/config_file.c |
|
@@ -19,6 +19,7 @@ |
|
#include "config.h" |
|
#include "base64.h" |
|
#include "uuid.h" |
|
+#include "common/ieee802_1x_defs.h" |
|
#include "p2p/p2p.h" |
|
#include "eap_peer/eap_methods.h" |
|
#include "eap_peer/eap.h" |
|
@@ -813,6 +814,7 @@ static void wpa_config_write_network(FILE *f, struct wpa_ssid *ssid) |
|
write_mka_ckn(f, ssid); |
|
INT(macsec_integ_only); |
|
INT(macsec_port); |
|
+ INT_DEF(mka_priority, DEFAULT_PRIO_NOT_KEY_SERVER); |
|
#endif /* CONFIG_MACSEC */ |
|
#ifdef CONFIG_HS20 |
|
INT(update_identifier); |
|
diff --git a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h |
|
index fe0f7fa..69ace37 100644 |
|
--- a/wpa_supplicant/config_ssid.h |
|
+++ b/wpa_supplicant/config_ssid.h |
|
@@ -751,6 +751,13 @@ struct wpa_ssid { |
|
int macsec_port; |
|
|
|
/** |
|
+ * mka_priority - Priority of MKA Actor |
|
+ * |
|
+ * Range: 0-255 (default: 255) |
|
+ */ |
|
+ int mka_priority; |
|
+ |
|
+ /** |
|
* mka_ckn - MKA pre-shared CKN |
|
*/ |
|
#define MACSEC_CKN_LEN 32 |
|
diff --git a/wpa_supplicant/wpa_cli.c b/wpa_supplicant/wpa_cli.c |
|
index f11028a..21adc17 100644 |
|
--- a/wpa_supplicant/wpa_cli.c |
|
+++ b/wpa_supplicant/wpa_cli.c |
|
@@ -1392,6 +1392,7 @@ static const char *network_fields[] = { |
|
"macsec_policy", |
|
"macsec_integ_only", |
|
"macsec_port", |
|
+ "mka_priority", |
|
#endif /* CONFIG_MACSEC */ |
|
#ifdef CONFIG_HS20 |
|
"update_identifier", |
|
diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf |
|
index edb230d..94cef4a 100644 |
|
--- a/wpa_supplicant/wpa_supplicant.conf |
|
+++ b/wpa_supplicant/wpa_supplicant.conf |
|
@@ -901,13 +901,15 @@ fast_reauth=1 |
|
# Port component of the SCI |
|
# Range: 1-65534 (default: 1) |
|
# |
|
-# mka_cak and mka_ckn: IEEE 802.1X/MACsec pre-shared authentication mode |
|
+# mka_cak, mka_ckn, and mka_priority: IEEE 802.1X/MACsec pre-shared key mode |
|
# This allows to configure MACsec with a pre-shared key using a (CAK,CKN) pair. |
|
-# In this mode, instances of wpa_supplicant can act as peers, one of |
|
-# which will become the key server and start distributing SAKs. |
|
+# In this mode, instances of wpa_supplicant can act as MACsec peers. The peer |
|
+# with lower priority will become the key server and start distributing SAKs. |
|
# mka_cak (CAK = Secure Connectivity Association Key) takes a 16-bytes (128 bit) |
|
# hex-string (32 hex-digits) |
|
# mka_ckn (CKN = CAK Name) takes a 32-bytes (256 bit) hex-string (64 hex-digits) |
|
+# mka_priority (Priority of MKA Actor) is in 0..255 range with 255 being |
|
+# default priority |
|
# |
|
# mixed_cell: This option can be used to configure whether so called mixed |
|
# cells, i.e., networks that use both plaintext and encryption in the same |
|
diff --git a/wpa_supplicant/wpas_kay.c b/wpa_supplicant/wpas_kay.c |
|
index d3fefda..d087e00 100644 |
|
--- a/wpa_supplicant/wpas_kay.c |
|
+++ b/wpa_supplicant/wpas_kay.c |
|
@@ -233,7 +233,8 @@ int ieee802_1x_alloc_kay_sm(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid) |
|
kay_ctx->disable_transmit_sa = wpas_disable_transmit_sa; |
|
|
|
res = ieee802_1x_kay_init(kay_ctx, policy, ssid->macsec_port, |
|
- wpa_s->ifname, wpa_s->own_addr); |
|
+ ssid->mka_priority, wpa_s->ifname, |
|
+ wpa_s->own_addr); |
|
if (res == NULL) { |
|
os_free(kay_ctx); |
|
return -1; |
|
-- |
|
2.7.4 |
|
|
|
|