Skip to content

Commit 7d853de

Browse files
author
Mika Leppänen
committed
When EAPOL waiting queue is full oldest entry is removed
When list is full oldest supplicant entry is deleted and purge request (empty EAPOL message) for that supplicant is sent to LLC to remove the LLC EAPOL entry.
1 parent 3aeb2af commit 7d853de

File tree

5 files changed

+206
-4
lines changed

5 files changed

+206
-4
lines changed

‎source/6LoWPAN/ws/ws_pae_auth.c

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
#include "Security/protocols/fwh_sec_prot/auth_fwh_sec_prot.h"
4545
#include "Security/protocols/gkh_sec_prot/auth_gkh_sec_prot.h"
4646
#include "Security/protocols/radius_sec_prot/radius_client_sec_prot.h"
47+
#include "Security/protocols/msg_sec_prot/msg_sec_prot.h"
4748
#include "6LoWPAN/ws/ws_cfg_settings.h"
4849
#include "6LoWPAN/ws/ws_pae_controller.h"
4950
#include "6LoWPAN/ws/ws_pae_timers.h"
@@ -237,6 +238,10 @@ int8_t ws_pae_auth_init(protocol_interface_info_entry_t *interface_ptr, sec_prot
237238
goto error;
238239
}
239240

241+
if (msg_sec_prot_register(pae_auth->kmp_service) < 0) {
242+
goto error;
243+
}
244+
240245
if (tasklet_id < 0) {
241246
tasklet_id = eventOS_event_handler_create(ws_pae_auth_tasklet_handler, PAE_TASKLET_INIT);
242247
if (tasklet_id < 0) {
@@ -964,10 +969,20 @@ static supp_entry_t *ws_pae_auth_waiting_supp_list_add(pae_auth_t *pae_auth, sup
964969
ns_list_add_to_start(&pae_auth->waiting_supp_list, supp_entry);
965970
pae_auth->waiting_supp_list_size++;
966971
} else {
967-
// Create a new supplicant entry if not at limit
972+
// If the waiting list if full removes the oldest entry from the list
968973
if (pae_auth->waiting_supp_list_size > WAITING_SUPPLICANT_LIST_MAX_SIZE) {
969-
tr_info("PAE: waiting list full, eui-64: %s", trace_array(addr->eui_64, 8));
970-
return NULL;
974+
supp_entry_t *delete_supp = ns_list_get_last(&pae_auth->waiting_supp_list);
975+
if (!delete_supp) {
976+
return NULL;
977+
}
978+
tr_info("PAE: waiting list full, eui-64: %s, deleted eui-64: %s", trace_array(addr->eui_64, 8), trace_array(delete_supp->addr.eui_64, 8));
979+
// Create new instance
980+
kmp_api_t *new_kmp = ws_pae_auth_kmp_create_and_start(pae_auth->kmp_service, MSG_PROT, pae_auth->relay_socked_msg_if_instance_id, delete_supp, pae_auth->sec_cfg);
981+
if (!new_kmp) {
982+
return NULL;
983+
}
984+
kmp_api_create_request(new_kmp, MSG_PROT, &delete_supp->addr, &delete_supp->sec_keys);
985+
(void) ws_pae_lib_supp_list_remove(pae_auth, &pae_auth->waiting_supp_list, delete_supp, ws_pae_auth_waiting_supp_deleted);
971986
}
972987
supp_entry = ws_pae_lib_supp_list_add(&pae_auth->waiting_supp_list, addr);
973988
if (!supp_entry) {
@@ -981,7 +996,7 @@ static supp_entry_t *ws_pae_auth_waiting_supp_list_add(pae_auth_t *pae_auth, sup
981996
// 90 percent of the EAPOL temporary entry lifetime (10 ticks per second)
982997
supp_entry->waiting_ticks = pae_auth->sec_cfg->timing_cfg.temp_eapol_min_timeout * 900 / 100;
983998

984-
tr_debug("PAE: to waiting, list size %i, retry %i, eui-64: %s", pae_auth->waiting_supp_list_size, supp_entry->waiting_ticks, trace_array(supp_entry->addr.eui_64, 8));
999+
tr_info("PAE: to waiting, list size %i, retry %i, eui-64: %s", pae_auth->waiting_supp_list_size, supp_entry->waiting_ticks, trace_array(supp_entry->addr.eui_64, 8));
9851000

9861001
return supp_entry;
9871002
}

‎source/Security/kmp/kmp_api.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ typedef enum {
3333

3434
IEEE_802_1X_MKA = 1,
3535
RADIUS_IEEE_802_1X_MKA = 2,
36+
MSG_PROT = 5,
3637
IEEE_802_11_4WH = 6,
3738
IEEE_802_11_GKH = 7,
3839
TLS_PROT = 8,

‎source/Security/protocols/msg_sec_prot/msg_sec_prot.c

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
/*
2+
* Copyright (c) 2021, Arm Limited and affiliates.
3+
* SPDX-License-Identifier: Apache-2.0
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
#include "nsconfig.h"
19+
#include <string.h>
20+
#include "ns_types.h"
21+
#include "ns_list.h"
22+
#include "ns_trace.h"
23+
#include "nsdynmemLIB.h"
24+
#include "fhss_config.h"
25+
#include "NWK_INTERFACE/Include/protocol.h"
26+
#include "6LoWPAN/ws/ws_config.h"
27+
#include "Security/protocols/sec_prot_cfg.h"
28+
#include "Security/kmp/kmp_addr.h"
29+
#include "Security/kmp/kmp_api.h"
30+
#include "Security/PANA/pana_eap_header.h"
31+
#include "Security/eapol/eapol_helper.h"
32+
#include "Security/eapol/kde_helper.h"
33+
#include "Security/protocols/sec_prot_certs.h"
34+
#include "Security/protocols/sec_prot_keys.h"
35+
#include "Security/protocols/sec_prot.h"
36+
#include "Security/protocols/sec_prot_lib.h"
37+
#include "Security/protocols/msg_sec_prot/msg_sec_prot.h"
38+
39+
#ifdef HAVE_WS
40+
41+
#define TRACE_GROUP "msep"
42+
43+
typedef enum {
44+
MSG_STATE_INIT = SEC_STATE_INIT,
45+
MSG_STATE_CREATE_REQ = SEC_STATE_CREATE_REQ,
46+
MSG_STATE_FINISH = SEC_STATE_FINISH,
47+
MSG_STATE_FINISHED = SEC_STATE_FINISHED
48+
} msg_sec_prot_state_e;
49+
50+
typedef struct {
51+
sec_prot_common_t common; /**< Common data */
52+
} msg_sec_prot_int_t;
53+
54+
static uint16_t msg_sec_prot_size(void);
55+
static int8_t msg_sec_prot_init(sec_prot_t *prot);
56+
static void msg_sec_prot_delete(sec_prot_t *prot);
57+
58+
static void msg_sec_prot_create_request(sec_prot_t *prot, sec_prot_keys_t *sec_keys);
59+
static void msg_sec_prot_state_machine(sec_prot_t *prot);
60+
static int8_t msg_sec_prot_auth_rejected_send(sec_prot_t *prot, sec_prot_keys_t *sec_keys);
61+
62+
#define msg_sec_prot_get(prot) (msg_sec_prot_int_t *) &prot->data
63+
64+
int8_t msg_sec_prot_register(kmp_service_t *service)
65+
{
66+
if (!service) {
67+
return -1;
68+
}
69+
70+
if (kmp_service_sec_protocol_register(service, MSG_PROT, msg_sec_prot_size, msg_sec_prot_init) < 0) {
71+
return -1;
72+
}
73+
74+
return 0;
75+
}
76+
77+
static uint16_t msg_sec_prot_size(void)
78+
{
79+
return sizeof(msg_sec_prot_int_t);
80+
}
81+
82+
static int8_t msg_sec_prot_init(sec_prot_t *prot)
83+
{
84+
prot->create_req = msg_sec_prot_create_request;
85+
prot->delete = msg_sec_prot_delete;
86+
prot->state_machine = msg_sec_prot_state_machine;
87+
88+
msg_sec_prot_int_t *data = msg_sec_prot_get(prot);
89+
sec_prot_init(&data->common);
90+
sec_prot_state_set(prot, &data->common, MSG_STATE_INIT);
91+
92+
return 0;
93+
}
94+
95+
static void msg_sec_prot_delete(sec_prot_t *prot)
96+
{
97+
(void) prot;
98+
}
99+
100+
static void msg_sec_prot_create_request(sec_prot_t *prot, sec_prot_keys_t *sec_keys)
101+
{
102+
(void) sec_keys;
103+
104+
prot->state_machine(prot);
105+
}
106+
107+
static int8_t msg_sec_prot_auth_rejected_send(sec_prot_t *prot, sec_prot_keys_t *sec_keys)
108+
{
109+
(void) sec_keys;
110+
111+
uint8_t *eapol_pdu_frame = ns_dyn_mem_temporary_alloc(prot->header_size);
112+
113+
// Send zero length message to relay which requests LLC to remove EAPOL temporary entry based on EUI-64
114+
if (prot->send(prot, eapol_pdu_frame, prot->header_size) < 0) {
115+
return -1;
116+
}
117+
118+
return 0;
119+
}
120+
121+
static void msg_sec_prot_state_machine(sec_prot_t *prot)
122+
{
123+
msg_sec_prot_int_t *data = msg_sec_prot_get(prot);
124+
125+
switch (sec_prot_state_get(&data->common)) {
126+
case MSG_STATE_INIT:
127+
sec_prot_state_set(prot, &data->common, MSG_STATE_CREATE_REQ);
128+
break;
129+
case MSG_STATE_CREATE_REQ:
130+
// KMP-CREATE.confirm
131+
prot->create_conf(prot, sec_prot_result_get(&data->common));
132+
// Authentication rejected (will continue only after new EAPOL Initial-Key)
133+
(void) msg_sec_prot_auth_rejected_send(prot, prot->sec_keys);
134+
sec_prot_state_set(prot, &data->common, MSG_STATE_FINISH);
135+
break;
136+
case MSG_STATE_FINISH:
137+
sec_prot_state_set(prot, &data->common, MSG_STATE_FINISHED);
138+
/* fall through */
139+
case MSG_STATE_FINISHED:
140+
prot->finished(prot);
141+
break;
142+
default:
143+
break;
144+
}
145+
}
146+
147+
#endif /* HAVE_WS */
148+

‎source/Security/protocols/msg_sec_prot/msg_sec_prot.h

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/*
2+
* Copyright (c) 2021, Arm Limited and affiliates.
3+
* SPDX-License-Identifier: Apache-2.0
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
#ifndef MSG_SEC_PROT_H_
19+
#define MSG_SEC_PROT_H_
20+
21+
/*
22+
* Message security protocol. Protocol can be used for sending messages from
23+
* authenticator EAPOL components to lower layers on authenticator.
24+
*
25+
*/
26+
27+
/**
28+
* msg_sec_prot_register register message security protocol to KMP service
29+
*
30+
* \param service KMP service
31+
*
32+
* \return < 0 failure
33+
* \return >= 0 success
34+
*/
35+
int8_t msg_sec_prot_register(kmp_service_t *service);
36+
37+
#endif /* MSG_SEC_PROT_H_ */

‎sources.mk

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,7 @@ SRCS += \
123123
source/Security/protocols/gkh_sec_prot/supp_gkh_sec_prot.c \
124124
source/Security/protocols/radius_sec_prot/radius_client_sec_prot.c \
125125
source/Security/protocols/radius_sec_prot/avp_helper.c \
126+
source/Security/protocols/msg_sec_prot/msg_sec_prot.c \
126127
source/Security/protocols/tls_sec_prot/tls_sec_prot.c \
127128
source/Security/protocols/tls_sec_prot/tls_sec_prot_lib.c \
128129
source/Security/PANA/eap_protocol.c \

0 commit comments

Comments
 (0)