Added 4WH integrity protection and encryption

Added 4WH MIC validation and KDE encryption
Splitted 4WH handshake to supplicant and authenticator protocols
Re-organised modules: KMP and security protocols to own directories
Added KDE parser
Added draft security protocol key module

Author: Mika Leppänen

source/6LoWPAN/ws/ws_bootstrap.c

@@ -92,7 +92,12 @@ static uint16_t ws_bootstrap_routing_cost_calculate(protocol_interface_info_entr
 static uint16_t ws_bootstrap_rank_get(protocol_interface_info_entry_t *cur);
 static uint16_t ws_bootstrap_min_rank_inc_get(protocol_interface_info_entry_t *cur);
 
+#if !defined(HAVE_PAE_SUPP) && !defined(HAVE_PAE_AUTH)
 static void ws_bootstrap_set_test_key(protocol_interface_info_entry_t *cur);
+#else
+#define ws_bootstrap_set_test_key(cur)
+#endif
+static void ws_bootstrap_key_insert(uint8_t gtk_index, uint8_t *gtk, protocol_interface_info_entry_t *cur);
 static void ws_bootstrap_authentication_completed(bool success, protocol_interface_info_entry_t *cur);
 
 mac_neighbor_table_entry_t *ws_bootstrap_mac_neighbor_add(struct protocol_interface_info_entry *interface, const uint8_t *src64)
@@ -1370,7 +1375,7 @@ int ws_bootstrap_init(int8_t interface_id, net_6lowpan_mode_e bootstrap_mode)
 
     //Init PAE controller and set callback
     ws_pae_controller_init(cur);
-    ws_pae_controller_cb_register(&ws_bootstrap_authentication_completed);
+    ws_pae_controller_cb_register(&ws_bootstrap_authentication_completed, &ws_bootstrap_key_insert);
 
     //Init EAPOL PDU handler and register it to MPX
     ws_eapol_pdu_init(cur);
@@ -1733,7 +1738,21 @@ static void ws_bootstrap_start_discovery(protocol_interface_info_entry_t *cur)
 // Start authentication
 static void ws_bootstrap_start_authentication(void)
 {
-    ws_pae_controller_supplicant_authenticate();
+    ws_pae_controller_authenticate();
+}
+
+
+static void ws_bootstrap_key_insert(uint8_t gtk_index, uint8_t *gtk, protocol_interface_info_entry_t *cur)
+{
+    // Convert GTK to Group AES Key (GAK)
+
+    // Verify HASH etc.
+
+    mac_helper_security_key_clean(cur);
+    mac_helper_default_security_level_set(cur, AES_SECURITY_LEVEL_ENC_MIC64);
+    mac_helper_default_security_key_id_mode_set(cur, MAC_KEY_ID_MODE_IDX);
+    //Set Keys
+    mac_helper_security_default_key_set(cur, gtk, gtk_index + 1, MAC_KEY_ID_MODE_IDX);
 }
 
 static void ws_bootstrap_authentication_completed(bool success, protocol_interface_info_entry_t *cur)
@@ -1742,7 +1761,6 @@ static void ws_bootstrap_authentication_completed(bool success, protocol_interfa
         tr_debug("authentication success");
         ws_bootstrap_set_test_key(cur);
 
-
         ws_bootstrap_event_configuration_start(cur);
     } else {
         tr_debug("authentication failed");
@@ -1970,6 +1988,7 @@ static bool ws_bootstrap_address_registration_ongoing(protocol_interface_info_en
     return false;
 }
 
+#if !defined(HAVE_PAE_SUPP) && !defined(HAVE_PAE_AUTH)
 static void ws_bootstrap_set_test_key(protocol_interface_info_entry_t *cur)
 {
     uint8_t key_material[16];
@@ -1982,6 +2001,7 @@ static void ws_bootstrap_set_test_key(protocol_interface_info_entry_t *cur)
     //Set Keys
     mac_helper_security_default_key_set(cur, key_material, 1, MAC_KEY_ID_MODE_IDX);
 }
+#endif
 
 static void ws_bootstrap_event_handler(arm_event_s *event)
 {

source/6LoWPAN/ws/ws_pae_auth.c

@@ -30,11 +30,11 @@
 #include "Security/kmp/kmp_addr.h"
 #include "Security/kmp/kmp_api.h"
 #include "Security/kmp/kmp_socket_if.h"
-#include "Security/kmp/sec_prot.h"
-#include "Security/kmp/key_sec_prot.h"
-#include "Security/kmp/eap_tls_sec_prot.h"
-#include "Security/kmp/fwh_sec_prot.h"
-#include "Security/kmp/gkh_sec_prot.h"
+#include "Security/protocols/sec_prot_keys.h"
+#include "Security/protocols/key_sec_prot/key_sec_prot.h"
+#include "Security/protocols/eap_tls_sec_prot/eap_tls_sec_prot.h"
+#include "Security/protocols/fwh_sec_prot/auth_fwh_sec_prot.h"
+#include "Security/protocols/gkh_sec_prot/gkh_sec_prot.h"
 #include "6LoWPAN/ws/ws_pae_controller.h"
 #include "6LoWPAN/ws/ws_pae_auth.h"
 #include "6LoWPAN/ws/ws_pae_lib.h"
@@ -58,6 +58,7 @@ typedef struct {
     supp_list_t inactive_supp_list;                          /**< List of inactive supplicants */
     int8_t tasklet_id;                                       /**< Tasklet identifier */
     arm_event_storage_t *timer;                              /**< Timer */
+    sec_prot_gtk_keys_t *gtks;                               /**< GTKs */
 } pae_auth_data_t;
 
 static pae_auth_data_t *auth_data;
@@ -68,13 +69,14 @@ static int8_t ws_pae_auth_timer_if_start(kmp_api_t *kmp);
 static int8_t ws_pae_auth_timer_if_stop(kmp_api_t *kmp);
 static int8_t ws_pae_auth_timer_start(void);
 static int8_t ws_pae_auth_timer_stop(void);
+static void ws_pae_auth_kmp_service_addr_get(kmp_api_t *kmp, kmp_addr_t *local_addr, kmp_addr_t *remote_addr);
 static kmp_api_t *ws_pae_auth_kmp_incoming_ind(kmp_service_t *service, kmp_type_e type, const kmp_addr_t *addr);
 static void ws_pae_auth_kmp_api_create_confirm(kmp_api_t *kmp, kmp_result_e result);
 static void ws_pae_auth_kmp_api_create_indication(kmp_api_t *kmp, kmp_type_e type, kmp_addr_t *addr);
 static void ws_pae_auth_kmp_api_finished_indication(kmp_api_t *kmp, kmp_result_e result, kmp_sec_keys_t *sec_keys);
 static void ws_pae_auth_kmp_api_finished(kmp_api_t *kmp);
 
-int8_t ws_pae_auth_init(protocol_interface_info_entry_t *interface_ptr)
+int8_t ws_pae_auth_init(protocol_interface_info_entry_t *interface_ptr, sec_prot_gtk_keys_t *gtks)
 {
     if (auth_data) {
         return 0;
@@ -95,6 +97,8 @@ int8_t ws_pae_auth_init(protocol_interface_info_entry_t *interface_ptr)
         return -1;
     }
 
+    auth_data->gtks = gtks;
+
     if (kmp_service_init() < 0) {
         return -1;
     }
@@ -104,7 +108,7 @@ int8_t ws_pae_auth_init(protocol_interface_info_entry_t *interface_ptr)
         return -1;
     }
 
-    if (kmp_service_cb_register(auth_data->kmp_service, ws_pae_auth_kmp_incoming_ind)) {
+    if (kmp_service_cb_register(auth_data->kmp_service, ws_pae_auth_kmp_incoming_ind, ws_pae_auth_kmp_service_addr_get)) {
         return -1;
     }
 
@@ -128,7 +132,7 @@ int8_t ws_pae_auth_init(protocol_interface_info_entry_t *interface_ptr)
         return -1;
     }
 
-    if (fwh_auth_sec_prot_register(auth_data->kmp_service) < 0) {
+    if (auth_fwh_sec_prot_register(auth_data->kmp_service) < 0) {
         return -1;
     }
 
@@ -241,6 +245,27 @@ static int8_t ws_pae_auth_timer_stop(void)
     return 0;
 }
 
+static void ws_pae_auth_kmp_service_addr_get(kmp_api_t *kmp, kmp_addr_t *local_addr, kmp_addr_t *remote_addr)
+{
+#if 0
+    // Get own EUI-64
+    link_layer_address_s mac_params;
+    if (arm_nwk_mac_address_read(auth_data->interface_ptr->id, &mac_params) >= 0) {
+        kmp_address_eui_64_set(local_addr, mac_params.mac_long);
+    }
+#endif
+
+    // For now fixed since not yet support for EA-IE in supplicants
+    uint8_t addr[8] = {0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08};
+    kmp_address_eui_64_set(local_addr, addr);
+
+    // Get supplicant address
+    supp_entry_t *entry = kmp_api_data_get(kmp);
+    if (entry && entry->addr) {
+        kmp_address_copy(remote_addr, entry->addr);
+    }
+}
+
 static kmp_api_t *ws_pae_auth_kmp_incoming_ind(kmp_service_t *service, kmp_type_e type, const kmp_addr_t *addr)
 {
     // Find supplicant from list of active supplicants
@@ -261,6 +286,10 @@ static kmp_api_t *ws_pae_auth_kmp_incoming_ind(kmp_service_t *service, kmp_type_
         if (!supp_entry) {
             return 0;
         }
+        sec_prot_keys_init(&supp_entry->sec_keys, auth_data->gtks);
+    } else {
+        // Updates relay address
+        kmp_address_copy(supp_entry->addr, addr);
     }
 
     // Increases waiting time for supplicant authentication
@@ -272,16 +301,20 @@ static kmp_api_t *ws_pae_auth_kmp_incoming_ind(kmp_service_t *service, kmp_type_
         return kmp;
     }
 
-    // For further study: make needed validations here
-
     // Create a new KMP for initial eapol-key
     kmp = kmp_api_create(service, type + IEEE_802_1X_INITIAL_KEY);
-    kmp_api_data_set(kmp, supp_entry);
 
     if (!kmp) {
         return 0;
     }
 
+    kmp_api_data_set(kmp, supp_entry);
+    // Sets address to KMP
+    kmp_api_addr_set(kmp, supp_entry->addr);
+
+    // Sets security keys to KMP
+    kmp_api_sec_keys_set(kmp, &supp_entry->sec_keys);
+
     if (ws_pae_lib_kmp_list_add(&supp_entry->kmp_list, kmp) == NULL) {
         kmp_api_delete(kmp);
         return 0;
@@ -293,6 +326,11 @@ static kmp_api_t *ws_pae_auth_kmp_incoming_ind(kmp_service_t *service, kmp_type_
         ws_pae_auth_kmp_api_finished_indication,
         ws_pae_auth_kmp_api_finished);
 
+    if (kmp_api_start(kmp) < 0) {
+        ws_pae_lib_kmp_list_delete(&supp_entry->kmp_list, kmp);
+        return 0;
+    }
+
     return kmp;
 }
 
@@ -336,10 +374,14 @@ static void ws_pae_auth_kmp_api_finished_indication(kmp_api_t *kmp, kmp_result_e
     } else if (type == IEEE_802_1X_MKA) {
         // After EAP-TLS start 4WH towards supplicant
         type = IEEE_802_11_4WH;
+        // Insert GTK0
+        supp_entry->sec_keys.gtk_set_index = 0;
         tr_debug("PAE start 4WH, eui-64: %s", trace_array(kmp_address_eui_64_get(supp_entry->addr), 8));
     } else if (type == IEEE_802_11_4WH) {
         // After 4WH start GKH towards supplicant
         type = IEEE_802_11_GKH;
+        // Insert GTK1
+        supp_entry->sec_keys.gtk_set_index = 1;
         tr_debug("PAE start GKH, eui-64: %s", trace_array(kmp_address_eui_64_get(supp_entry->addr), 8));
     } else if (type == IEEE_802_11_GKH) {
         tr_debug("PAE authenticated, eui-64: %s", trace_array(kmp_address_eui_64_get(supp_entry->addr), 8));
@@ -369,7 +411,12 @@ static void ws_pae_auth_kmp_api_finished_indication(kmp_api_t *kmp, kmp_result_e
         ws_pae_auth_kmp_api_finished_indication,
         ws_pae_auth_kmp_api_finished);
 
-    kmp_api_create_request(new_kmp, type, supp_entry->addr, NULL);
+    if (kmp_api_start(kmp) < 0) {
+        ws_pae_lib_kmp_list_delete(&supp_entry->kmp_list, kmp);
+        return;
+    }
+
+    kmp_api_create_request(new_kmp, type, supp_entry->addr, &supp_entry->sec_keys);
 }
 
 static void ws_pae_auth_kmp_api_finished(kmp_api_t *kmp)

source/6LoWPAN/ws/ws_pae_auth.h

@@ -20,7 +20,7 @@
 
 #ifdef HAVE_PAE_AUTH
 
-int8_t ws_pae_auth_init(protocol_interface_info_entry_t *interface_ptr);
+int8_t ws_pae_auth_init(protocol_interface_info_entry_t *interface_ptr, sec_prot_gtk_keys_t *gtks);
 
 #else
 

source/6LoWPAN/ws/ws_pae_controller.c

@@ -25,31 +25,35 @@
 #include "NWK_INTERFACE/Include/protocol.h"
 #include "6LoWPAN/ws/ws_config.h"
 #include "6LoWPAN/ws/ws_pae_controller.h"
+#include "Security/protocols/sec_prot_keys.h"
 #include "6LoWPAN/ws/ws_pae_supp.h"
 #include "6LoWPAN/ws/ws_pae_auth.h"
 
 #ifdef HAVE_WS
 
 #define TRACE_GROUP "wspsc"
 
+static void ws_pae_controller_supp_key_insert(uint8_t gtk_index, uint8_t *gtk);
 static void ws_pae_controller_supp_auth_completed(bool success);
 
 typedef struct {
-    uint8_t target_eui_64[8];
-    protocol_interface_info_entry_t *interface_ptr;                 /**< List link entry */
-    ws_pae_controller_supplicant_auth_completed *auth_completed_cb;            /**< Called on boostrap */                           /**< List of KMP instances */
+    uint8_t target_eui_64[8];                            /**< EAPOL target */
+    sec_prot_gtk_keys_t gtks;                            /**< GTKs */
+    protocol_interface_info_entry_t *interface_ptr;      /**< List link entry */
+    ws_pae_controller_auth_completed *auth_completed;    /**< Authentication completed callback, continue bootstrap */
+    ws_pae_controller_key_insert *key_insert;            /**< Key insert callback */
 } pae_controller_data_t;
 
 static pae_controller_data_t *controller_data;
 
-void ws_pae_controller_supplicant_authenticate(void)
+void ws_pae_controller_authenticate(void)
 {
     if (!controller_data) {
         return;
     }
 
     ws_pae_supp_init(controller_data->interface_ptr);
-    ws_pae_supp_cb_register(ws_pae_controller_supp_auth_completed);
+    ws_pae_supp_cb_register(ws_pae_controller_supp_auth_completed, ws_pae_controller_supp_key_insert);
     if (ws_pae_supp_authenticate(controller_data->target_eui_64) > 0) {
         // Already authenticated
         ws_pae_controller_supp_auth_completed(true);
@@ -62,7 +66,31 @@ void ws_pae_controller_authenticator_start(void)
         return;
     }
 
-    ws_pae_auth_init(controller_data->interface_ptr);
+    // Test data
+    for (int i = 0; i < 16; i++) {
+        controller_data->gtks.gtk[0].key[i] = 0xcf - i;
+        controller_data->gtks.gtk[1].key[i] = 0xef - i;
+    }
+    controller_data->gtks.gtk[0].set = 1;
+    controller_data->gtks.gtk[0].live = 1;
+
+    controller_data->gtks.gtk[1].set = 1;
+    controller_data->gtks.gtk[1].live = 1;
+
+    ws_pae_auth_init(controller_data->interface_ptr, &controller_data->gtks);
+
+    controller_data->key_insert(0, controller_data->gtks.gtk[0].key, controller_data->interface_ptr);
+}
+
+static void ws_pae_controller_supp_key_insert(uint8_t gtk_index, uint8_t *gtk)
+{
+    if (!controller_data) {
+        return;
+    }
+
+    if (controller_data->key_insert) {
+        controller_data->key_insert(gtk_index, gtk, controller_data->interface_ptr);
+    }
 }
 
 static void ws_pae_controller_supp_auth_completed(bool success)
@@ -71,18 +99,19 @@ static void ws_pae_controller_supp_auth_completed(bool success)
         return;
     }
 
-    if (controller_data->auth_completed_cb) {
-        controller_data->auth_completed_cb(success, controller_data->interface_ptr);
+    if (controller_data->auth_completed) {
+        controller_data->auth_completed(success, controller_data->interface_ptr);
     }
 }
 
-void ws_pae_controller_cb_register(ws_pae_controller_supplicant_auth_completed *completed_cb)
+void ws_pae_controller_cb_register(ws_pae_controller_auth_completed *completed, ws_pae_controller_key_insert *key_insert)
 {
     if (!controller_data) {
         return;
     }
 
-    controller_data->auth_completed_cb = completed_cb;
+    controller_data->auth_completed = completed;
+    controller_data->key_insert = key_insert;
 }
 
 void ws_pae_controller_set_target(uint8_t *dest_eui_64)
@@ -97,8 +126,10 @@ void ws_pae_controller_init(protocol_interface_info_entry_t *interface_ptr)
     }
 
     controller_data = ns_dyn_mem_alloc(sizeof(pae_controller_data_t));
-    controller_data->auth_completed_cb = 0;
+    controller_data->auth_completed = 0;
+    controller_data->key_insert = 0;
     controller_data->interface_ptr = interface_ptr;
+    sec_prot_keys_gtks_init(&controller_data->gtks);
 }
 
 #endif /* HAVE_WS */

source/6LoWPAN/ws/ws_pae_controller.h

@@ -18,16 +18,18 @@
 #ifndef WS_PAE_CONTROLLER_H_
 #define WS_PAE_CONTROLLER_H_
 
-typedef void ws_pae_controller_supplicant_auth_completed(bool success, protocol_interface_info_entry_t *interface_ptr);
+typedef void ws_pae_controller_key_insert(uint8_t gtk_index, uint8_t *gtk, protocol_interface_info_entry_t *interface_ptr);
 
-void ws_pae_controller_supplicant_authenticate(void);
+typedef void ws_pae_controller_auth_completed(bool success, protocol_interface_info_entry_t *interface_ptr);
+
+void ws_pae_controller_authenticate(void);
 
 void ws_pae_controller_authenticator_start(void);
 
 void ws_pae_controller_set_target(uint8_t *dest_eui_64);
 
 void ws_pae_controller_init(protocol_interface_info_entry_t *interface_ptr);
 
-void ws_pae_controller_cb_register(ws_pae_controller_supplicant_auth_completed *completed_cb);
+void ws_pae_controller_cb_register(ws_pae_controller_auth_completed *completed, ws_pae_controller_key_insert *key_insert);
 
 #endif /* WS_PAE_CONTROLLER_H_ */