Skip to content

Commit 7f7c01a

Browse files
author
Mika Leppänen
committed
Added retry traces to authenticator EAP-TLS, 4WH, and GKH
1 parent a87646d commit 7f7c01a

File tree

3 files changed

+30
-26
lines changed

3 files changed

+30
-26
lines changed

‎source/Security/protocols/eap_tls_sec_prot/auth_eap_tls_sec_prot.c

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ static int8_t auth_eap_tls_sec_prot_receive(sec_prot_t *prot, void *pdu, uint16_
8989
static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot);
9090

9191
static int8_t auth_eap_tls_sec_prot_message_handle(sec_prot_t *prot);
92-
static int8_t auth_eap_tls_sec_prot_message_send(sec_prot_t *prot, uint8_t eap_code, uint8_t eap_type, uint8_t tls_state);
92+
static int8_t auth_eap_tls_sec_prot_message_send(sec_prot_t *prot, uint8_t eap_code, uint8_t eap_type, uint8_t tls_state, bool retry);
9393

9494
static void auth_eap_tls_sec_prot_timer_timeout(sec_prot_t *prot, uint16_t ticks);
9595
static int8_t auth_eap_tls_sec_prot_init_tls(sec_prot_t *prot);
@@ -247,7 +247,7 @@ static int8_t auth_eap_tls_sec_prot_message_handle(sec_prot_t *prot)
247247
return eap_tls_sec_prot_lib_message_handle(data_ptr, length, new_seq_id, &data->tls_send, &data->tls_recv);
248248
}
249249

250-
static int8_t auth_eap_tls_sec_prot_message_send(sec_prot_t *prot, uint8_t eap_code, uint8_t eap_type, uint8_t tls_state)
250+
static int8_t auth_eap_tls_sec_prot_message_send(sec_prot_t *prot, uint8_t eap_code, uint8_t eap_type, uint8_t tls_state, bool retry)
251251
{
252252
eap_tls_sec_prot_int_t *data = eap_tls_sec_prot_get(prot);
253253

@@ -275,9 +275,9 @@ static int8_t auth_eap_tls_sec_prot_message_send(sec_prot_t *prot, uint8_t eap_c
275275
return -1;
276276
}
277277

278-
tr_info("EAP-TLS: send %s type %s id %i flags %x len %i, eui-64: %s", eap_msg_trace[eap_code - 1],
279-
eap_type == EAP_IDENTITY ? "IDENTITY" : "TLS", data->eap_id_seq, flags, eapol_pdu_size,
280-
trace_array(sec_prot_remote_eui_64_addr_get(prot), 8));
278+
tr_info("EAP-TLS: %s %s type %s id %i flags %x len %i, eui-64: %s", retry ? "retry" : "send",
279+
eap_msg_trace[eap_code - 1], eap_type == EAP_IDENTITY ? "IDENTITY" : "TLS",
280+
data->eap_id_seq, flags, eapol_pdu_size, trace_array(sec_prot_remote_eui_64_addr_get(prot), 8));
281281

282282
if (prot->send(prot, eapol_decoded_data, eapol_pdu_size + prot->header_size) < 0) {
283283
return -1;
@@ -418,7 +418,7 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
418418
auth_eap_tls_sec_prot_seq_id_update(prot);
419419

420420
// Sends EAP request, Identity
421-
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_IDENTITY, EAP_TLS_EXCHANGE_NONE);
421+
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_IDENTITY, EAP_TLS_EXCHANGE_NONE, false);
422422

423423
// Start trickle timer to re-send if no response
424424
sec_prot_timer_trickle_start(&data->common, &prot->sec_cfg->prot_cfg.sec_prot_trickle_params);
@@ -432,7 +432,7 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
432432
// On timeout
433433
if (sec_prot_result_timeout_check(&data->common)) {
434434
// Re-sends EAP request, Identity
435-
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_IDENTITY, EAP_TLS_EXCHANGE_NONE);
435+
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_IDENTITY, EAP_TLS_EXCHANGE_NONE, true);
436436
return;
437437
}
438438

@@ -442,7 +442,7 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
442442
}
443443

444444
// Sends EAP request, TLS EAP start
445-
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_TLS, EAP_TLS_EXCHANGE_START);
445+
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_TLS, EAP_TLS_EXCHANGE_START, false);
446446

447447
// Start trickle timer to re-send if no response
448448
sec_prot_timer_trickle_start(&data->common, &prot->sec_cfg->prot_cfg.sec_prot_trickle_params);
@@ -456,12 +456,13 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
456456

457457
// On timeout
458458
if (sec_prot_result_timeout_check(&data->common)) {
459+
459460
if (sec_prot_state_get(&data->common) == EAP_TLS_STATE_RESPONSE_START) {
460461
// Re-sends EAP request, TLS EAP start
461-
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_TLS, EAP_TLS_EXCHANGE_START);
462+
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_TLS, EAP_TLS_EXCHANGE_START, true);
462463
} else {
463464
// Re-sends EAP request, TLS EAP
464-
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_TLS, EAP_TLS_EXCHANGE_ONGOING);
465+
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_TLS, EAP_TLS_EXCHANGE_ONGOING, true);
465466
}
466467
return;
467468
}
@@ -475,7 +476,7 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
475476
}
476477
if (result == EAP_TLS_MSG_IDENTITY) {
477478
// If received EAP response, Identity: re-sends EAP request, TLS EAP start
478-
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_TLS, EAP_TLS_EXCHANGE_START);
479+
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_TLS, EAP_TLS_EXCHANGE_START, true);
479480
return;
480481
}
481482

@@ -524,7 +525,7 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
524525
data->send_pending = false;
525526

526527
// Sends EAP request, TLS EAP, TLS exchange
527-
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_TLS, EAP_TLS_EXCHANGE_ONGOING);
528+
auth_eap_tls_sec_prot_message_send(prot, EAP_REQ, EAP_TLS, EAP_TLS_EXCHANGE_ONGOING, false);
528529

529530
// Start trickle timer to re-send if no response
530531
sec_prot_timer_trickle_start(&data->common, &prot->sec_cfg->prot_cfg.sec_prot_trickle_params);
@@ -534,10 +535,10 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
534535
// Supplicant PMK is now valid
535536
sec_prot_keys_pmk_mismatch_reset(prot->sec_keys);
536537
// Sends EAP success
537-
auth_eap_tls_sec_prot_message_send(prot, EAP_SUCCESS, 0, EAP_TLS_EXCHANGE_NONE);
538+
auth_eap_tls_sec_prot_message_send(prot, EAP_SUCCESS, 0, EAP_TLS_EXCHANGE_NONE, false);
538539
} else {
539540
// Sends EAP failure
540-
auth_eap_tls_sec_prot_message_send(prot, EAP_FAILURE, 0, EAP_TLS_EXCHANGE_NONE);
541+
auth_eap_tls_sec_prot_message_send(prot, EAP_FAILURE, 0, EAP_TLS_EXCHANGE_NONE, false);
541542
sec_prot_result_set(&data->common, SEC_RESULT_ERROR);
542543
}
543544

‎source/Security/protocols/fwh_sec_prot/auth_fwh_sec_prot.c

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ static int8_t auth_fwh_sec_prot_receive(sec_prot_t *prot, void *pdu, uint16_t si
8080
static fwh_sec_prot_msg_e auth_fwh_sec_prot_message_get(eapol_pdu_t *eapol_pdu, sec_prot_keys_t *sec_keys);
8181
static void auth_fwh_sec_prot_state_machine(sec_prot_t *prot);
8282

83-
static int8_t auth_fwh_sec_prot_message_send(sec_prot_t *prot, fwh_sec_prot_msg_e msg);
83+
static int8_t auth_fwh_sec_prot_message_send(sec_prot_t *prot, fwh_sec_prot_msg_e msg, bool retry);
8484
static void auth_fwh_sec_prot_timer_timeout(sec_prot_t *prot, uint16_t ticks);
8585

8686
static int8_t auth_fwh_sec_prot_ptk_generate(sec_prot_t *prot, sec_prot_keys_t *sec_keys);
@@ -204,7 +204,7 @@ static fwh_sec_prot_msg_e auth_fwh_sec_prot_message_get(eapol_pdu_t *eapol_pdu,
204204
return msg;
205205
}
206206

207-
static int8_t auth_fwh_sec_prot_message_send(sec_prot_t *prot, fwh_sec_prot_msg_e msg)
207+
static int8_t auth_fwh_sec_prot_message_send(sec_prot_t *prot, fwh_sec_prot_msg_e msg, bool retry)
208208
{
209209
fwh_sec_prot_int_t *data = fwh_sec_prot_get(prot);
210210

@@ -301,7 +301,9 @@ static int8_t auth_fwh_sec_prot_message_send(sec_prot_t *prot, fwh_sec_prot_msg_
301301
return -1;
302302
}
303303

304-
tr_info("4WH: send %s, eui-64: %s", msg == FWH_MESSAGE_1 ? "Message 1" : "Message 3", trace_array(sec_prot_remote_eui_64_addr_get(prot), 8));
304+
tr_info("4WH: %s %s, eui-64: %s", retry ? "retry" : "send",
305+
msg == FWH_MESSAGE_1 ? "Message 1" : "Message 3",
306+
trace_array(sec_prot_remote_eui_64_addr_get(prot), 8));
305307

306308
if (prot->send(prot, eapol_pdu_frame, eapol_pdu_size + prot->header_size) < 0) {
307309
return -1;
@@ -347,7 +349,7 @@ static void auth_fwh_sec_prot_state_machine(sec_prot_t *prot)
347349

348350
// Sends 4WH Message 1
349351
sec_prot_lib_nonce_generate(data->nonce);
350-
auth_fwh_sec_prot_message_send(prot, FWH_MESSAGE_1);
352+
auth_fwh_sec_prot_message_send(prot, FWH_MESSAGE_1, false);
351353

352354
// Start trickle timer to re-send if no response
353355
sec_prot_timer_trickle_start(&data->common, &prot->sec_cfg->prot_cfg.sec_prot_trickle_params);
@@ -360,7 +362,7 @@ static void auth_fwh_sec_prot_state_machine(sec_prot_t *prot)
360362
if (sec_prot_result_timeout_check(&data->common)) {
361363
// Re-sends 4WH Message 1
362364
sec_prot_lib_nonce_generate(data->nonce);
363-
auth_fwh_sec_prot_message_send(prot, FWH_MESSAGE_1);
365+
auth_fwh_sec_prot_message_send(prot, FWH_MESSAGE_1, true);
364366
} else {
365367
if (data->recv_msg != FWH_MESSAGE_2) {
366368
return;
@@ -375,7 +377,7 @@ static void auth_fwh_sec_prot_state_machine(sec_prot_t *prot)
375377
}
376378

377379
// Sends 4WH Message 3
378-
auth_fwh_sec_prot_message_send(prot, FWH_MESSAGE_3);
380+
auth_fwh_sec_prot_message_send(prot, FWH_MESSAGE_3, false);
379381

380382
// Start trickle timer to re-send if no response
381383
sec_prot_timer_trickle_start(&data->common, &prot->sec_cfg->prot_cfg.sec_prot_trickle_params);
@@ -388,7 +390,7 @@ static void auth_fwh_sec_prot_state_machine(sec_prot_t *prot)
388390
case FWH_STATE_MESSAGE_4:
389391
if (sec_prot_result_timeout_check(&data->common)) {
390392
// Re-sends 4WH Message 3
391-
auth_fwh_sec_prot_message_send(prot, FWH_MESSAGE_3);
393+
auth_fwh_sec_prot_message_send(prot, FWH_MESSAGE_3, true);
392394
} else {
393395
if (data->recv_msg != FWH_MESSAGE_4) {
394396
return;

‎source/Security/protocols/gkh_sec_prot/auth_gkh_sec_prot.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ static int8_t auth_gkh_sec_prot_receive(sec_prot_t *prot, void *pdu, uint16_t si
7171
static gkh_sec_prot_msg_e auth_gkh_sec_prot_message_get(eapol_pdu_t *eapol_pdu, sec_prot_keys_t *sec_keys);
7272
static void auth_gkh_sec_prot_state_machine(sec_prot_t *prot);
7373

74-
static int8_t auth_gkh_sec_prot_message_send(sec_prot_t *prot, gkh_sec_prot_msg_e msg);
74+
static int8_t auth_gkh_sec_prot_message_send(sec_prot_t *prot, gkh_sec_prot_msg_e msg, bool retry);
7575
static void auth_gkh_sec_prot_timer_timeout(sec_prot_t *prot, uint16_t ticks);
7676
static int8_t auth_gkh_sec_prot_mic_validate(sec_prot_t *prot);
7777

@@ -180,7 +180,7 @@ static gkh_sec_prot_msg_e auth_gkh_sec_prot_message_get(eapol_pdu_t *eapol_pdu,
180180
return msg;
181181
}
182182

183-
static int8_t auth_gkh_sec_prot_message_send(sec_prot_t *prot, gkh_sec_prot_msg_e msg)
183+
static int8_t auth_gkh_sec_prot_message_send(sec_prot_t *prot, gkh_sec_prot_msg_e msg, bool retry)
184184
{
185185
uint16_t kde_len = 0;
186186

@@ -249,7 +249,8 @@ static int8_t auth_gkh_sec_prot_message_send(sec_prot_t *prot, gkh_sec_prot_msg_
249249
return -1;
250250
}
251251

252-
tr_info("GKH: send Message 1, eui-64: %s", trace_array(sec_prot_remote_eui_64_addr_get(prot), 8));
252+
tr_info("GKH: %s Message 1, eui-64: %s", retry ? "retry" : "send",
253+
trace_array(sec_prot_remote_eui_64_addr_get(prot), 8));
253254

254255
if (prot->send(prot, eapol_pdu_frame, eapol_pdu_size + prot->header_size) < 0) {
255256
return -1;
@@ -287,7 +288,7 @@ static void auth_gkh_sec_prot_state_machine(sec_prot_t *prot)
287288
prot->create_conf(prot, SEC_RESULT_OK);
288289

289290
// Sends GKH Message 1
290-
auth_gkh_sec_prot_message_send(prot, GKH_MESSAGE_1);
291+
auth_gkh_sec_prot_message_send(prot, GKH_MESSAGE_1, false);
291292

292293
// Start trickle timer to re-send if no response
293294
sec_prot_timer_trickle_start(&data->common, &prot->sec_cfg->prot_cfg.sec_prot_trickle_params);
@@ -303,7 +304,7 @@ static void auth_gkh_sec_prot_state_machine(sec_prot_t *prot)
303304

304305
if (sec_prot_result_timeout_check(&data->common)) {
305306
// Re-sends GKH Message 1
306-
auth_gkh_sec_prot_message_send(prot, GKH_MESSAGE_1);
307+
auth_gkh_sec_prot_message_send(prot, GKH_MESSAGE_1, true);
307308
} else {
308309
if (auth_gkh_sec_prot_mic_validate(prot) < 0) {
309310
return;

0 commit comments

Comments
 (0)