Corrected GTK update initial EAPOL-key trickle timer

Trickle timer on GTK update works now correctly. Initial EAPOL-key
is send on maximum three times to authenticator when GTK hash
mismatch is detected.

Author: Mika Leppänen

source/6LoWPAN/ws/ws_pae_supp.c

@@ -149,6 +149,7 @@ static int8_t ws_pae_supp_event_send(kmp_service_t *service, void *data);
 static void ws_pae_supp_tasklet_handler(arm_event_s *event);
 static void ws_pae_supp_initial_trickle_timer_start(pae_supp_t *pae_supp);
 static void ws_pae_supp_initial_last_interval_trickle_timer_start(pae_supp_t *pae_supp);
+static void ws_pae_supp_initial_key_update_trickle_timer_start(pae_supp_t *pae_supp, uint8_t timer_expirations);
 static bool ws_pae_supp_authentication_ongoing(pae_supp_t *pae_supp);
 static int8_t ws_pae_supp_timer_if_start(kmp_service_t *service, kmp_api_t *kmp);
 static int8_t ws_pae_supp_timer_if_stop(kmp_service_t *service, kmp_api_t *kmp);
@@ -339,16 +340,8 @@ int8_t ws_pae_supp_gtk_hash_update(protocol_interface_info_entry_t *interface_pt
             if (mismatch == GTK_LIFETIME_MISMATCH) {
                 timer_expirations = 1;
             }
-
-            pae_supp->auth_trickle_params.Imin = pae_supp->timer_settings->gtk_request_imin;
-            pae_supp->auth_trickle_params.Imax = pae_supp->timer_settings->gtk_request_imax;
-            pae_supp->auth_trickle_params.k = 0;
-            pae_supp->auth_trickle_params.TimerExpirations = timer_expirations;
-
-            // Starts trickle
-            trickle_start(&pae_supp->auth_trickle_timer, &pae_supp->auth_trickle_params);
-            pae_supp->auth_trickle_running = true;
-            pae_supp->initial_key_retry_timer = 0;
+            // Start trickle timer
+            ws_pae_supp_initial_key_update_trickle_timer_start(pae_supp, timer_expirations);
 
             // Starts supplicant timer
             ws_pae_supp_timer_start(pae_supp);
@@ -623,7 +616,7 @@ int8_t ws_pae_supp_init(protocol_interface_info_entry_t *interface_ptr, const se
     pae_supp->initial_key_retry_timer = 0;
     pae_supp->nw_keys_used_cnt = 0;
     pae_supp->timer_settings = timer_settings;
-    pae_supp->initial_key_retry_cnt = 0;
+    pae_supp->initial_key_retry_cnt = INITIAL_KEY_RETRY_COUNT;
     pae_supp->auth_trickle_running = false;
     pae_supp->auth_requested = false;
     pae_supp->timer_running = false;
@@ -864,21 +857,25 @@ void ws_pae_supp_slow_timer(uint16_t seconds)
             } else {
                 // Checks if trickle timer expires
                 if (trickle_timer(&pae_supp->auth_trickle_timer, &pae_supp->auth_trickle_params, seconds)) {
-                    if (pae_supp->initial_key_retry_cnt < INITIAL_KEY_RETRY_COUNT) {
+                    if (pae_supp->initial_key_retry_cnt > 0) {
                         if (ws_pae_supp_initial_key_send(pae_supp) < 0) {
                             tr_info("EAPOL-Key send failed");
                         }
                     }
-                    pae_supp->initial_key_retry_cnt++;
 
                     /* Wait time for the authenticator to answer the last re-transmit expires;
                        fails authentication */
-                    if (pae_supp->initial_key_retry_cnt > INITIAL_KEY_RETRY_COUNT) {
+                    if (pae_supp->initial_key_retry_cnt == 0) {
                         ws_pae_supp_authenticate_response(pae_supp, AUTH_RESULT_ERR_UNSPEC);
-                    } else if (pae_supp->initial_key_retry_cnt == INITIAL_KEY_RETRY_COUNT) {
-                        // Starts wait time for the authenticator to answer
-                        tr_info("Initial EAPOL-Key wait for last re-transmit answer");
-                        ws_pae_supp_initial_last_interval_trickle_timer_start(pae_supp);
+                    } else {
+                        if (pae_supp->initial_key_retry_cnt > 0) {
+                            pae_supp->initial_key_retry_cnt--;
+                        }
+                        if (pae_supp->initial_key_retry_cnt == 0) {
+                            // Starts wait time for the authenticator to answer
+                            tr_info("Initial EAPOL-Key wait for last re-transmit answer");
+                            ws_pae_supp_initial_last_interval_trickle_timer_start(pae_supp);
+                        }
                     }
                 }
 
@@ -947,7 +944,7 @@ static void ws_pae_supp_initial_trickle_timer_start(pae_supp_t *pae_supp)
     trickle_start(&pae_supp->auth_trickle_timer, &pae_supp->auth_trickle_params);
     tr_info("Initial EAPOL-Key trickle I: [%i,%i] %i, t: %i", pae_supp->auth_trickle_params.Imin, pae_supp->auth_trickle_params.Imax, pae_supp->auth_trickle_timer.I, pae_supp->auth_trickle_timer.t);
     pae_supp->auth_trickle_running = true;
-    pae_supp->initial_key_retry_cnt = 0;
+    pae_supp->initial_key_retry_cnt = INITIAL_KEY_RETRY_COUNT;
 }
 
 static void ws_pae_supp_initial_last_interval_trickle_timer_start(pae_supp_t *pae_supp)
@@ -962,6 +959,21 @@ static void ws_pae_supp_initial_last_interval_trickle_timer_start(pae_supp_t *pa
     tr_info("Initial EAPOL-Key trickle I: [%i,%i] %i, t: %i", pae_supp->auth_trickle_params.Imin, pae_supp->auth_trickle_params.Imax, pae_supp->auth_trickle_timer.I, pae_supp->auth_trickle_timer.t);
 }
 
+static void ws_pae_supp_initial_key_update_trickle_timer_start(pae_supp_t *pae_supp, uint8_t timer_expirations)
+{
+    // Starts trickle for the key update
+    pae_supp->auth_trickle_params.Imin = pae_supp->timer_settings->gtk_request_imin;
+    pae_supp->auth_trickle_params.Imax = pae_supp->timer_settings->gtk_request_imax;
+    pae_supp->auth_trickle_params.k = 0;
+    pae_supp->auth_trickle_params.TimerExpirations = timer_expirations;
+
+    trickle_start(&pae_supp->auth_trickle_timer, &pae_supp->auth_trickle_params);
+    tr_info("Initial EAPOL-Key trickle I: [%i,%i] %i, t: %i", pae_supp->auth_trickle_params.Imin, pae_supp->auth_trickle_params.Imax, pae_supp->auth_trickle_timer.I, pae_supp->auth_trickle_timer.t);
+    pae_supp->initial_key_retry_timer = NONE_INITIAL_KEY_RETRY_TIMER; // 0 seconds
+    pae_supp->auth_trickle_running = true;
+    pae_supp->initial_key_retry_cnt = timer_expirations;
+}
+
 static int8_t ws_pae_supp_timer_if_start(kmp_service_t *service, kmp_api_t *kmp)
 {
     pae_supp_t *pae_supp = ws_pae_supp_by_kmp_service_get(service);