From patchwork Tue Dec 3 05:10:52 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Mart=C3=ADnek_Petr?= X-Patchwork-Id: 2017567 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=2vQRWGfB; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=elvac.eu header.i=@elvac.eu header.a=rsa-sha256 header.s=s192048 header.b=X5HCewwz; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Y2TTP6wJZz1yQN for ; Tue, 3 Dec 2024 16:18:49 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:To :From:Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=Q9BvecAhQ9vNhqgR7I8Pe8hwveGtGaMghsyVEYUmYR8=; b=2vQRWGfBMmChCS hIwkTt52xLK/vGao5sCePhWW5CK1+4TYOUPndlsFpySrMFICbJTnvyqSb8p1MQiO8TfzL9ObYSL93 q5bgGwRxXtH5hkpZTtgQ0avYa47MyDLLwfSkmPA802TOhBcUPDwdB3j4K1ECw8IYub64s3vUk14AK hHjBDNOkKEG+2/MYg882Twrx4/rrvMjhLCS/s9RdlyNlBWHBE8EHQRknYzfJFfJR0h4F1ccZEY11a BKOO80oWCAw5M12aNVTTtMlKR1kelrfiQNuBGT8iZzqOumC6Br4w1MK/cC0TT4+H+PbND1XjJphq3 7NKvqH193/eo9HOR7oxw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1tILIh-00000008JFj-2Spk; Tue, 03 Dec 2024 05:18:19 +0000 Received: from mail.elvac.eu ([193.85.188.218]) by bombadil.infradead.org with esmtps (Exim 4.98 #2 (Red Hat Linux)) id 1tILBX-00000008IDO-0Ucg for hostap@lists.infradead.org; Tue, 03 Dec 2024 05:10:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; d=elvac.eu; s=s192048; c=simple/simple; t=1733202653; h=from:subject:to:date:message-id; bh=2b4VVM6QnOevjhJLSJJYcRoz4zYfnfOFg6OhTv7SEkY=; b=X5HCewwz4bJ+SigLakLzT4AL/VGErTwsMuRTkYfzfHNtLPGSz80nKuEPp5US2qMkB4TC+f7L8WI ux1Exn059kprhDT3NntihzYi6quLDuAC7gpoQyqh3Vyu6h933egkmp6AtwGcCDQy9p5IkhlUWMEiC h8Hiy3XkwXLMi0vCjt3Qcfg5asZ/FordYjvW5Yh9oVkt5Ranq7aV2HfuQyyOXF6B8si643/1deNgj xnZIAOx43l085nz1ImMOzgwP05oSh5Vz2W+rPf8OU8lclKWWcfapGDU+oEj2XHOv8FKfzYbHloTRx OhXg35Twzjwe1IBxbiRih72It+UYuU/oKsIg== Received: from srv-email.elcomgroup.cz (2001:af0:8002:701::193:17) by srv-email.elcomgroup.cz (2001:af0:8002:701::193:17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 3 Dec 2024 06:10:52 +0100 Received: from srv-email.elcomgroup.cz ([10.0.193.17]) by srv-email.elcomgroup.cz ([10.0.193.17]) with mapi id 15.02.1544.011; Tue, 3 Dec 2024 06:10:52 +0100 From: =?iso-8859-1?q?Mart=EDnek_Petr?= To: "hostap@lists.infradead.org" Subject: wap_supplicant MACSEC add option to always include ICV Indicator Thread-Topic: wap_supplicant MACSEC add option to always include ICV Indicator Thread-Index: AQHbRUEVaW9EzICxfUGrRetewNIIiw== Date: Tue, 3 Dec 2024 05:10:52 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [91.139.107.244] x-gfi-smtp-submission: 1 x-gfi-smtp-hellodomain: srv-email.elcomgroup.cz x-gfi-smtp-remoteip: 2001:af0:8002:701::193:17 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20241202_211055_315030_09E595BB X-CRM114-Status: UNSURE ( 7.35 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.1 (--) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Hello, CISCO C3560CX (SW version 15.2(7)E8, SW image C3560CX-UNIVERSALK9-M) requires ICV Indicator to be present even when ICV is 16bytes. Therefore I would like to ask, if it is possible to add config optio [...] Content analysis details: (-2.1 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [193.85.188.218 listed in sa-accredit.habeas.com] 0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [193.85.188.218 listed in sa-trusted.bondedsender.org] 0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [193.85.188.218 listed in bl.score.senderscore.com] X-BeenThere: hostap@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Hostap" Errors-To: hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org Hello, CISCO C3560CX (SW version 15.2(7)E8, SW image  C3560CX-UNIVERSALK9-M) requires ICV Indicator to be present even when ICV is 16bytes. Therefore I would like to ask, if it is possible to add config option to always send ICV Indicator. (I've include my patch that adds macsec_icv_indicator config option) Thanks Petr diff -Naur a/src/ap/ap_config.h b/src/ap/ap_config.h --- a/src/ap/ap_config.h    2024-07-20 20:04:37.000000000 +0200 +++ b/src/ap/ap_config.h    2024-12-02 10:11:55.470226000 +0100 @@ -906,6 +906,13 @@      int macsec_csindex;        /** +     * macsec_icv_indicator - Always include ICV Indicator +     * (for compatibility with older MACSEC switches) +     * +     * Range: 0-1 (default: 0) +     */ +    int macsec_icv_indicator; +    /**       * mka_ckn - MKA pre-shared CKN       */  #define MACSEC_CKN_MAX_LEN 32 diff -Naur a/src/ap/wpa_auth_kay.c b/src/ap/wpa_auth_kay.c --- a/src/ap/wpa_auth_kay.c    2024-07-20 20:04:37.000000000 +0200 +++ b/src/ap/wpa_auth_kay.c    2024-12-02 10:10:27.603235000 +0100 @@ -331,6 +331,7 @@                    hapd->conf->macsec_port,                    hapd->conf->mka_priority,                    hapd->conf->macsec_csindex, +                  hapd->conf->macsec_icv_indicator,                    hapd->conf->iface,                    hapd->own_addr);      /* ieee802_1x_kay_init() frees kay_ctx on failure */ diff -Naur a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c --- a/src/pae/ieee802_1x_kay.c    2024-07-20 20:04:37.000000000 +0200 +++ b/src/pae/ieee802_1x_kay.c    2024-12-02 10:08:38.580487000 +0100 @@ -1871,7 +1871,7 @@        /* Determine if we need space for the ICV Indicator */      if (mka_alg_tbl[participant->kay->mka_algindex].icv_len != -        DEFAULT_ICV_LEN) +        DEFAULT_ICV_LEN || participant->kay->include_icv_indicator)          length = sizeof(struct ieee802_1x_mka_icv_body);      else          length = 0; @@ -1894,7 +1894,7 @@        length = ieee802_1x_mka_get_icv_length(participant);      if (mka_alg_tbl[participant->kay->mka_algindex].icv_len != -        DEFAULT_ICV_LEN)  { +        DEFAULT_ICV_LEN || participant->kay->include_icv_indicator)  {          wpa_printf(MSG_DEBUG, "KaY: ICV Indicator");          body = wpabuf_put(buf, MKA_HDR_LEN);          body->type = MKA_ICV_INDICATOR; @@ -3495,7 +3495,8 @@  ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,              bool macsec_replay_protect, u32 macsec_replay_window,              u8 macsec_offload, u16 port, u8 priority, -            u32 macsec_csindex, const char *ifname, const u8 *addr) +            u32 macsec_csindex, bool include_icv_indicator, +            const char *ifname, const u8 *addr)  {      struct ieee802_1x_kay *kay;   @@ -3533,6 +3534,7 @@        kay->pn_exhaustion = PENDING_PN_EXHAUSTION;      kay->macsec_csindex = macsec_csindex; +    kay->include_icv_indicator = include_icv_indicator;      kay->mka_algindex = DEFAULT_MKA_ALG_INDEX;      kay->mka_version = MKA_VERSION_ID;   diff -Naur a/src/pae/ieee802_1x_kay.h b/src/pae/ieee802_1x_kay.h --- a/src/pae/ieee802_1x_kay.h    2024-07-20 20:04:37.000000000 +0200 +++ b/src/pae/ieee802_1x_kay.h    2024-12-02 10:07:47.261076000 +0100 @@ -206,6 +206,7 @@      struct ieee802_1x_kay_ctx *ctx;      bool is_key_server;      bool is_obliged_key_server; +    bool include_icv_indicator;  /* Always include ICV Indicator */      char if_name[IFNAMSIZ];      u8 macsec_offload;   @@ -243,7 +244,8 @@  ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,              bool macsec_replay_protect, u32 macsec_replay_window,              u8 macsec_offload, u16 port, u8 priority, -            u32 macsec_csindex, const char *ifname, const u8 *addr); +            u32 macsec_csindex, bool include_icv_indicator, +            const char *ifname, const u8 *addr);  void ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay);    struct ieee802_1x_mka_participant * diff -Naur a/wpa_supplicant/config.c b/wpa_supplicant/config.c --- a/wpa_supplicant/config.c    2024-07-20 20:04:37.000000000 +0200 +++ b/wpa_supplicant/config.c    2024-12-02 09:55:39.717430000 +0100 @@ -2721,6 +2721,7 @@      { INT_RANGE(macsec_port, 1, 65534) },      { INT_RANGE(mka_priority, 0, 255) },      { INT_RANGE(macsec_csindex, 0, 1) }, +    { INT_RANGE(macsec_icv_indicator, 0, 1) },      { FUNC_KEY(mka_cak) },      { FUNC_KEY(mka_ckn) },  #endif /* CONFIG_MACSEC */ diff -Naur a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c --- a/wpa_supplicant/config_file.c    2024-07-20 20:04:37.000000000 +0200 +++ b/wpa_supplicant/config_file.c    2024-12-02 09:55:28.949554000 +0100 @@ -818,6 +818,7 @@      INT(macsec_port);      INT_DEF(mka_priority, DEFAULT_PRIO_NOT_KEY_SERVER);      INT(macsec_csindex); +    INT(macsec_icv_indicator);  #endif /* CONFIG_MACSEC */  #ifdef CONFIG_HS20      INT(update_identifier); diff -Naur a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h --- a/wpa_supplicant/config_ssid.h    2024-07-20 20:04:37.000000000 +0200 +++ b/wpa_supplicant/config_ssid.h    2024-12-02 10:07:54.668991000 +0100 @@ -964,6 +964,14 @@      int macsec_csindex;        /** +     * macsec_icv_indicator - Always include ICV Indicator +     * (for compatibility with older MACSEC switches) +     * +     * Range: 0-1 (default: 0) +     */ +    int macsec_icv_indicator; + +    /**       * mka_ckn - MKA pre-shared CKN       */  #define MACSEC_CKN_MAX_LEN 32 diff -Naur a/wpa_supplicant/wpas_kay.c b/wpa_supplicant/wpas_kay.c --- a/wpa_supplicant/wpas_kay.c    2024-07-20 20:04:37.000000000 +0200 +++ b/wpa_supplicant/wpas_kay.c    2024-12-02 09:57:59.939820000 +0100 @@ -249,7 +249,7 @@                    ssid->macsec_replay_window,                    ssid->macsec_offload, ssid->macsec_port,                    ssid->mka_priority, ssid->macsec_csindex, -                  wpa_s->ifname, wpa_s->own_addr); +                  ssid->macsec_icv_indicator, wpa_s->ifname, wpa_s->own_addr);      /* ieee802_1x_kay_init() frees kay_ctx on failure */      if (res == NULL)          return -1; diff -Naur a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf --- a/wpa_supplicant/wpa_supplicant.conf    2024-07-20 20:04:37.000000000 +0200 +++ b/wpa_supplicant/wpa_supplicant.conf    2024-12-02 10:14:35.752386000 +0100 @@ -1173,6 +1173,10 @@  # mka_priority (Priority of MKA Actor) is in 0..255 range with 255 being  # default priority  # +# macsec_icv_indicator: always include ICV indicator +# 0 = ICV Indicator is not included when ICV has default length (default) +# 1 = ICV Indicator is always included (compatibility mode) +#  # mixed_cell: This option can be used to configure whether so called mixed  # cells, i.e., networks that use both plaintext and encryption in the same  # SSID, are allowed when selecting a BSS from scan results.