diff mbox series

[2/8] mka: Allow to setup MACsec replay protection

Message ID 20181102180220.20948-2-a.s.kartashev@gmail.com
State Accepted
Headers show
Series [1/8] wpa_debug: Support hexdump_ascii outputting into syslog | expand

Commit Message

Andrey Kartashev Nov. 2, 2018, 6:02 p.m. UTC 
From: Andrey Kartashev <andrey.kartashev@afconsult.com>

This patch adds new configuration parameters to allow user to setup
MACsec replay protection feature.
Note that according to IEEE 802.1X-2010 replay protection and delay
protection are different features: replay protection is related only too
SecY and does not appear on MKA level while delay protection is
something that KaY can use to manage SecY state.

Signed-off-by: Andrey Kartashev <andrey.kartashev@afconsult.com>
---
 src/pae/ieee802_1x_kay.c           | 10 ++++++----
 src/pae/ieee802_1x_kay.h           |  1 +
 wpa_supplicant/config.c            |  2 ++
 wpa_supplicant/config_file.c       |  2 ++
 wpa_supplicant/config_ssid.h       | 26 ++++++++++++++++++++++++++
 wpa_supplicant/wpa_cli.c           |  2 ++
 wpa_supplicant/wpa_supplicant.conf | 16 ++++++++++++++++
 wpa_supplicant/wpas_kay.c          |  5 +++--
 8 files changed, 58 insertions(+), 6 deletions(-)
diff mbox series

Patch

diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c
index cda23fcab..20dd10c07 100644
--- a/src/pae/ieee802_1x_kay.c
+++ b/src/pae/ieee802_1x_kay.c
@@ -1214,8 +1214,9 @@  ieee802_1x_mka_encode_sak_use_body(
 		return 0;
 	}
 
-	/* data protect, lowest accept packet number */
-	body->delay_protect = kay->macsec_replay_protect;
+	/* data delay protect (it is not same as replay protect!) */
+	body->delay_protect = FALSE;
+	/* lowest accept packet number */
 	pn = ieee802_1x_mka_get_lpn(participant, &participant->lki);
 	if (pn > kay->pn_exhaustion) {
 		wpa_printf(MSG_WARNING, "KaY: My LPN exhaustion");
@@ -3137,6 +3138,7 @@  static void kay_l2_receive(void *ctx, const u8 *src_addr, const u8 *buf,
  */
 struct ieee802_1x_kay *
 ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
+			Boolean macsec_replay_protect, u32 macsec_replay_window,
 		    u16 port, u8 priority, const char *ifname, const u8 *addr)
 {
 	struct ieee802_1x_kay *kay;
@@ -3196,8 +3198,8 @@  ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
 		kay->macsec_protect = TRUE;
 		kay->macsec_encrypt = policy == SHOULD_ENCRYPT;
 		kay->macsec_validate = Strict;
-		kay->macsec_replay_protect = FALSE;
-		kay->macsec_replay_window = 0;
+		kay->macsec_replay_protect = macsec_replay_protect;
+		kay->macsec_replay_window = macsec_replay_window;
 		if (kay->macsec_capable >= MACSEC_CAP_INTEG_AND_CONF)
 			kay->macsec_confidentiality = CONFIDENTIALITY_OFFSET_0;
 		else
diff --git a/src/pae/ieee802_1x_kay.h b/src/pae/ieee802_1x_kay.h
index b2650596c..57f1260b8 100644
--- a/src/pae/ieee802_1x_kay.h
+++ b/src/pae/ieee802_1x_kay.h
@@ -236,6 +236,7 @@  u64 mka_sci_u64(struct ieee802_1x_mka_sci *sci);
 
 struct ieee802_1x_kay *
 ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
+			Boolean macsec_replay_protect, u32 macsec_replay_window,
 		    u16 port, u8 priority, const char *ifname, const u8 *addr);
 void ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay);
 
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index c43960697..8cf418a47 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -2299,6 +2299,8 @@  static const struct parse_data ssid_fields[] = {
 #ifdef CONFIG_MACSEC
 	{ INT_RANGE(macsec_policy, 0, 1) },
 	{ INT_RANGE(macsec_integ_only, 0, 1) },
+	{ INT_RANGE(macsec_replay_protect, 0, 1) },
+	{ INT(macsec_replay_window) },
 	{ INT_RANGE(macsec_port, 1, 65534) },
 	{ INT_RANGE(mka_priority, 0, 255) },
 	{ FUNC_KEY(mka_cak) },
diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
index 09115e19d..3a0e13e65 100644
--- a/wpa_supplicant/config_file.c
+++ b/wpa_supplicant/config_file.c
@@ -853,6 +853,8 @@  static void wpa_config_write_network(FILE *f, struct wpa_ssid *ssid)
 	write_mka_cak(f, ssid);
 	write_mka_ckn(f, ssid);
 	INT(macsec_integ_only);
+	INT(macsec_replay_protect);
+	INT(macsec_replay_window);
 	INT(macsec_port);
 	INT_DEF(mka_priority, DEFAULT_PRIO_NOT_KEY_SERVER);
 #endif /* CONFIG_MACSEC */
diff --git a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h
index d2a52d760..a31ee1a2e 100644
--- a/wpa_supplicant/config_ssid.h
+++ b/wpa_supplicant/config_ssid.h
@@ -773,6 +773,32 @@  struct wpa_ssid {
 	 */
 	int macsec_integ_only;
 
+	/**
+	 * macsec_replay_protect - Enable MACsec replay protection
+	 *
+	 * This setting applies only when MACsec is in use, i.e.,
+	 *  - macsec_policy is enabled
+	 *  - the key server has decided to enable MACsec
+	 *
+	 * 0: Replay protection disabled (default)
+	 * 1: Replay protection enabled
+	 */
+	int macsec_replay_protect;
+
+	/**
+	 * macsec_replay_window - Set MACsec replay protection window (a window in
+	 * which replay is tolerated, to allow receipt of frames that have been
+	 * misordered by the network)
+	 *
+	 * This setting applies only when MACsec replay protection active, i.e.,
+	 *  - macsec_replay_protect is enabled
+	 *  - the key server has decided to enable MACsec
+	 *
+	 * 0: No replay window, strict check (default)
+	 * 1 ... 2^32-1: number of packets that could be misordered
+	 */
+	u32 macsec_replay_window;
+
 	/**
 	 * macsec_port - MACsec port (in SCI)
 	 *
diff --git a/wpa_supplicant/wpa_cli.c b/wpa_supplicant/wpa_cli.c
index 05e3ebf2f..9d39dcdd6 100644
--- a/wpa_supplicant/wpa_cli.c
+++ b/wpa_supplicant/wpa_cli.c
@@ -1426,6 +1426,8 @@  static const char *network_fields[] = {
 #ifdef CONFIG_MACSEC
 	"macsec_policy",
 	"macsec_integ_only",
+	"macsec_replay_protect",
+	"macsec_replay_window",
 	"macsec_port",
 	"mka_priority",
 #endif /* CONFIG_MACSEC */
diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
index 4f5916025..f46a25d6f 100644
--- a/wpa_supplicant/wpa_supplicant.conf
+++ b/wpa_supplicant/wpa_supplicant.conf
@@ -987,6 +987,22 @@  fast_reauth=1
 # 0: Encrypt traffic (default)
 # 1: Integrity only
 #
+# macsec_replay_protect: IEEE 802.1X/MACsec replay protection
+# This setting applies only when MACsec is in use, i.e.,
+#  - macsec_policy is enabled
+#  - the key server has decided to enable MACsec
+# 0: Replay protection disabled (default)
+# 1: Replay protection enabled
+#
+# macsec_replay_window: IEEE 802.1X/MACsec replay protection window
+# This determines a window in which replay is tolerated, to allow receipt
+# of frames that have been misordered by the network)
+# This setting applies only when MACsec replay protection active, i.e.,
+#  - macsec_replay_protect is enabled
+#  - the key server has decided to enable MACsec
+# 0: No replay window, strict check (default)
+# 1 ... 2^32-1: number of packets that could be misordered
+#
 # macsec_port: IEEE 802.1X/MACsec port
 # Port component of the SCI
 # Range: 1-65534 (default: 1)
diff --git a/wpa_supplicant/wpas_kay.c b/wpa_supplicant/wpas_kay.c
index d3d06b8ae..e10ce72da 100644
--- a/wpa_supplicant/wpas_kay.c
+++ b/wpa_supplicant/wpas_kay.c
@@ -232,8 +232,9 @@  int ieee802_1x_alloc_kay_sm(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 	kay_ctx->enable_transmit_sa = wpas_enable_transmit_sa;
 	kay_ctx->disable_transmit_sa = wpas_disable_transmit_sa;
 
-	res = ieee802_1x_kay_init(kay_ctx, policy, ssid->macsec_port,
-				  ssid->mka_priority, wpa_s->ifname,
+	res = ieee802_1x_kay_init(kay_ctx, policy,
+				  ssid->macsec_replay_protect, ssid->macsec_replay_window,
+				  ssid->macsec_port, ssid->mka_priority, wpa_s->ifname,
 				  wpa_s->own_addr);
 	/* ieee802_1x_kay_init() frees kay_ctx on failure */
 	if (res == NULL)