Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proactively rekey #36

Merged
merged 3 commits into from
Sep 3, 2021
Merged

Proactively rekey #36

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9044c64
Proactively rekey
Pterosaur Aug 16, 2021
66ce5d3
Rename variable from macsec_rekey_period to mka_rekey_period
Pterosaur Aug 28, 2021
5bac625
Merge branch 'master' into refresh_key_proactively
Pterosaur Sep 3, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/ap/wpa_auth_kay.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,6 +328,7 @@ int ieee802_1x_alloc_kay_sm_hapd(struct hostapd_data *hapd,
res = ieee802_1x_kay_init(kay_ctx, policy, 0, 0, 1,
hapd->conf->macsec_replay_protect,
hapd->conf->macsec_replay_window,
0,
hapd->conf->macsec_port,
hapd->conf->mka_priority, hapd->conf->iface,
hapd->own_addr);
Expand Down
10 changes: 10 additions & 0 deletions src/pae/ieee802_1x_kay.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1398,6 +1398,13 @@ ieee802_1x_mka_encode_sak_use_body(
participant->new_sak = true;
}
}
if (kay->mka_rekey_period != 0 && kay->dist_time != 0) {
if ((kay->dist_time + kay->mka_rekey_period) < time(NULL)) {
participant->new_sak = true;
wpa_printf(MSG_WARNING,
"KaY: Rekey period");
}
}
}

/* plain tx, plain rx */
Expand Down Expand Up @@ -3558,6 +3565,7 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
int macsec_ciphersuite, enum confidentiality_offset macsec_offset,
bool macsec_include_sci,
bool macsec_replay_protect, u32 macsec_replay_window,
int mka_rekey_period,
u16 port, u8 priority, const char *ifname, const u8 *addr)
{
struct ieee802_1x_kay *kay;
Expand Down Expand Up @@ -3600,6 +3608,8 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
kay->mka_algindex = DEFAULT_MKA_ALG_INDEX;
kay->mka_version = MKA_VERSION_ID;

kay->mka_rekey_period = mka_rekey_period;

os_memcpy(kay->algo_agility, mka_algo_agility,
sizeof(kay->algo_agility));

Expand Down
3 changes: 3 additions & 0 deletions src/pae/ieee802_1x_kay.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,6 +222,8 @@ struct ieee802_1x_kay {
u8 dist_an;
time_t dist_time;

int mka_rekey_period;

u8 mka_version;
u8 algo_agility[4];

Expand Down Expand Up @@ -249,6 +251,7 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
int macsec_ciphersuite, enum confidentiality_offset macsec_offset,
bool macsec_include_sci,
bool macsec_replay_protect, u32 macsec_replay_window,
int mka_rekey_period,
u16 port, u8 priority, const char *ifname, const u8 *addr);
void ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay);

Expand Down
2 changes: 2 additions & 0 deletions wpa_supplicant/config.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
#include "fst/fst.h"
#include "config.h"

#include <limits.h>

#if !defined(CONFIG_CTRL_IFACE) && defined(CONFIG_NO_CONFIG_WRITE)
#define NO_CONFIG_WRITE
Expand Down Expand Up @@ -2554,6 +2555,7 @@ static const struct parse_data ssid_fields[] = {
{ INT_RANGE(macsec_policy, 0, 1) },
{ INT_RANGE(macsec_integ_only, 0, 1) },
{ INT_RANGE(macsec_ciphersuite, 0, 3) },
{ INT_RANGE(mka_rekey_period, 0, INT_MAX) },
{ INT_RANGE(macsec_conf_offset, 0, 3) },
{ INT_RANGE(macsec_include_sci, 0, 1) },
{ INT_RANGE(macsec_replay_protect, 0, 1) },
Expand Down
1 change: 1 addition & 0 deletions wpa_supplicant/config_file.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -903,6 +903,7 @@ static void wpa_config_write_network(FILE *f, struct wpa_ssid *ssid)
write_mka_ckn(f, ssid);
INT(macsec_integ_only);
INT(macsec_ciphersuite);
INT_DEF(mka_rekey_period, 0);
INT(macsec_conf_offset);
INT(macsec_include_sci);
INT(macsec_replay_protect);
Expand Down
7 changes: 7 additions & 0 deletions wpa_supplicant/config_ssid.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -904,6 +904,13 @@ struct wpa_ssid {
*/
int macsec_replay_protect;

/**
* mka_rekey_period - The period of proactively refresh(Unit second).
*
* Default 0 which means never proactive refresh SAK
*/
int mka_rekey_period;

/**
* macsec_replay_window - MACsec replay protection window
*
Expand Down
1 change: 1 addition & 0 deletions wpa_supplicant/wpa_cli.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1478,6 +1478,7 @@ static const char *network_fields[] = {
"macsec_policy",
"macsec_integ_only",
"macsec_ciphersuite",
"mka_rekey_period",
"macsec_conf_offset",
"macsec_include_sci",
"macsec_replay_protect",
Expand Down
1 change: 1 addition & 0 deletions wpa_supplicant/wpas_kay.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,6 +243,7 @@ int ieee802_1x_alloc_kay_sm(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
ssid->macsec_ciphersuite, ssid->macsec_conf_offset,
ssid->macsec_include_sci,
ssid->macsec_replay_protect, ssid->macsec_replay_window,
ssid->mka_rekey_period,
ssid->macsec_port, ssid->mka_priority, wpa_s->ifname,
wpa_s->own_addr);
/* ieee802_1x_kay_init() frees kay_ctx on failure */
Expand Down