Skip to content

Commit 74dc531

Browse files
author
Mika Leppänen
authored
Merge pull request #1994 from ARMmbed/enable_eapol
Enable EAPOL flags
2 parents e921dcd + 2b6ddf0 commit 74dc531

File tree

23 files changed

+138
-48
lines changed

23 files changed

+138
-48
lines changed

‎source/6LoWPAN/ws/ws_pae_auth.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -361,7 +361,7 @@ int8_t ws_pae_auth_node_access_revoke_start(protocol_interface_info_entry_t *int
361361
// If active GTK lifetime is larger than revocation lifetime decrements active GTK lifetime
362362
if (active_lifetime > revocation_lifetime) {
363363
sec_prot_keys_gtk_lifetime_decrement(pae_auth->gtks, active_index, active_lifetime - revocation_lifetime);
364-
tr_info("Access revocation start, GTK active index: %i, revoked lifetime: %i", active_index, revocation_lifetime);
364+
tr_info("Access revocation start, GTK active index: %i, revoked lifetime: %"PRIu32"", active_index, revocation_lifetime);
365365
} else {
366366
// Otherwise decrements lifetime of the GTK to be installed after the active one
367367
int8_t second_index = sec_prot_keys_gtk_install_order_second_index_get(pae_auth->gtks);
@@ -372,7 +372,7 @@ int8_t ws_pae_auth_node_access_revoke_start(protocol_interface_info_entry_t *int
372372
uint32_t second_lifetime = sec_prot_keys_gtk_lifetime_get(pae_auth->gtks, second_index);
373373
if (second_lifetime > second_revocation_lifetime) {
374374
sec_prot_keys_gtk_lifetime_decrement(pae_auth->gtks, second_index, second_lifetime - second_revocation_lifetime);
375-
tr_info("Access revocation start, GTK second active index: %i, revoked lifetime: %i", second_index, second_revocation_lifetime);
375+
tr_info("Access revocation start, GTK second active index: %i, revoked lifetime: %"PRIu32"", second_index, second_revocation_lifetime);
376376
}
377377
// Removes other keys than active and GTK to be installed next
378378
not_removed_index = second_index;
@@ -547,11 +547,11 @@ void ws_pae_auth_slow_timer(uint16_t seconds)
547547
if (pae_auth->gtk_new_inst_req_exp) {
548548
int8_t second_index = sec_prot_keys_gtk_install_order_second_index_get(pae_auth->gtks);
549549
if (second_index < 0) {
550-
tr_info("GTK new install required active index: %i, time: %i, system time: %i", active_index, timer_seconds, protocol_core_monotonic_time / 10);
550+
tr_info("GTK new install required active index: %i, time: %"PRIu32", system time: %"PRIu32"", active_index, timer_seconds, protocol_core_monotonic_time / 10);
551551
ws_pae_auth_gtk_key_insert(pae_auth);
552552
ws_pae_auth_network_keys_from_gtks_set(pae_auth);
553553
} else {
554-
tr_info("GTK new install already done; second index: %i, time: %i, system time: %i", second_index, timer_seconds, protocol_core_monotonic_time / 10);
554+
tr_info("GTK new install already done; second index: %i, time: %"PRIu32", system time: %"PRIu32"", second_index, timer_seconds, protocol_core_monotonic_time / 10);
555555
}
556556
}
557557
}
@@ -560,7 +560,7 @@ void ws_pae_auth_slow_timer(uint16_t seconds)
560560
pae_auth->gtk_new_act_time_exp = ws_pae_timers_gtk_new_activation_time(pae_auth->timer_settings, timer_seconds);
561561
if (pae_auth->gtk_new_act_time_exp) {
562562
int8_t new_active_index = ws_pae_auth_new_gtk_activate(pae_auth);
563-
tr_info("GTK new activation time active index: %i, time: %i, new index: %i, system time: %i", active_index, timer_seconds, new_active_index, protocol_core_monotonic_time / 10);
563+
tr_info("GTK new activation time active index: %i, time: %"PRIu32", new index: %i, system time: %"PRIu32"", active_index, timer_seconds, new_active_index, protocol_core_monotonic_time / 10);
564564
if (new_active_index >= 0) {
565565
ws_pae_auth_network_key_index_set(pae_auth, new_active_index);
566566
}
@@ -571,7 +571,7 @@ void ws_pae_auth_slow_timer(uint16_t seconds)
571571
}
572572

573573
if (timer_seconds == 0) {
574-
tr_info("GTK expired index: %i, system time: %i", i, protocol_core_monotonic_time / 10);
574+
tr_info("GTK expired index: %i, system time: %"PRIu32"", i, protocol_core_monotonic_time / 10);
575575
ws_pae_auth_gtk_clear(pae_auth, i);
576576
ws_pae_auth_network_keys_from_gtks_set(pae_auth);
577577
}
@@ -621,7 +621,7 @@ static void ws_pae_auth_gtk_key_insert(pae_auth_t *pae_auth)
621621
// Authenticator keys are always fresh
622622
sec_prot_keys_gtk_status_all_fresh_set(pae_auth->gtks);
623623

624-
tr_info("GTK install new index: %i, lifetime: %i", install_index, lifetime);
624+
tr_info("GTK install new index: %i, lifetime: %"PRIu32"", install_index, lifetime);
625625
}
626626

627627
static int8_t ws_pae_auth_new_gtk_activate(pae_auth_t *pae_auth)

‎source/6LoWPAN/ws/ws_pae_controller.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -763,7 +763,7 @@ int8_t ws_pae_controller_gtk_update(int8_t interface_id, uint8_t *gtk[4])
763763
uint32_t lifetime = sec_prot_keys_gtk_install_order_last_lifetime_get(&controller->gtks);
764764
lifetime += controller->timer_settings.gtk_expire_offset;
765765
if (sec_prot_keys_gtk_set(&controller->gtks, i, gtk[i], lifetime) >= 0) {
766-
tr_info("GTK set index: %i, lifetime %"PRIx32", system time: %"PRIx32"", i, lifetime, protocol_core_monotonic_time / 10);
766+
tr_info("GTK set index: %i, lifetime %"PRIu32", system time: %"PRIu32"", i, lifetime, protocol_core_monotonic_time / 10);
767767
}
768768
}
769769
}

‎source/6LoWPAN/ws/ws_pae_lib.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -213,10 +213,10 @@ void ws_pae_lib_supp_list_slow_timer_update(supp_list_t *supp_list, timer_settin
213213
{
214214
ns_list_foreach(supp_entry_t, entry, supp_list) {
215215
if (sec_prot_keys_pmk_lifetime_decrement(&entry->sec_keys, timer_settings->pmk_lifetime, seconds)) {
216-
tr_info("PMK and PTK expired, eui-64: %s, system time: %"PRIx32"", trace_array(kmp_address_eui_64_get(entry->addr), 8), protocol_core_monotonic_time / 10);
216+
tr_info("PMK and PTK expired, eui-64: %s, system time: %"PRIu32"", trace_array(kmp_address_eui_64_get(entry->addr), 8), protocol_core_monotonic_time / 10);
217217
}
218218
if (sec_prot_keys_ptk_lifetime_decrement(&entry->sec_keys, timer_settings->ptk_lifetime, seconds)) {
219-
tr_info("PTK expired, eui-64: %s, system time: %"PRIx32"", trace_array(kmp_address_eui_64_get(entry->addr), 8), protocol_core_monotonic_time / 10);
219+
tr_info("PTK expired, eui-64: %s, system time: %"PRIu32"", trace_array(kmp_address_eui_64_get(entry->addr), 8), protocol_core_monotonic_time / 10);
220220
}
221221
}
222222

‎source/6LoWPAN/ws/ws_pae_timers.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ static void ws_pae_timers_calculate(timer_settings_t *timer_settings)
117117
time_to_update = gtk_revocation_lifetime - new_activation_time;
118118
}
119119

120-
tr_info("Key timers revocation lifetime: %"PRIx32", new activation time: %"PRIx32", max mismatch %i, time to update: %"PRIx32"", gtk_revocation_lifetime, new_activation_time, timer_settings->gtk_max_mismatch, time_to_update);
120+
tr_info("Key timers revocation lifetime: %"PRIu32", new activation time: %"PRIu32", max mismatch %i, time to update: %"PRIu32"", gtk_revocation_lifetime, new_activation_time, timer_settings->gtk_max_mismatch, time_to_update);
121121

122122
// If time to update results smaller GTK request Imax use it for calculation otherwise use GTK max mismatch
123123
if (time_to_update < timer_settings->gtk_max_mismatch) {

‎source/Security/protocols/eap_tls_sec_prot/auth_eap_tls_sec_prot.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -272,7 +272,7 @@ static void auth_eap_tls_sec_prot_tls_finished_indication(sec_prot_t *tls_prot,
272272

273273
if (result == SEC_RESULT_OK) {
274274
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_OVER;
275-
tr_error("EAP-TLS: handshake success");
275+
tr_info("EAP-TLS: handshake success");
276276
} else if (result == SEC_RESULT_CONF_ERROR) {
277277
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR;
278278
tr_error("EAP-TLS: handshake fatal error");

‎source/Security/protocols/eap_tls_sec_prot/supp_eap_tls_sec_prot.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ static void supp_eap_tls_sec_prot_tls_finished_indication(sec_prot_t *tls_prot,
281281

282282
if (result == SEC_RESULT_OK) {
283283
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_OVER;
284-
tr_error("EAP-TLS: handshake success");
284+
tr_info("EAP-TLS: handshake success");
285285
} else if (result == SEC_RESULT_CONF_ERROR) {
286286
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR;
287287
tr_error("EAP-TLS: handshake fatal error");

‎source/Security/protocols/fwh_sec_prot/supp_fwh_sec_prot.c

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ static int8_t supp_fwh_sec_prot_init(sec_prot_t *prot);
8686
static void supp_fwh_sec_prot_create_response(sec_prot_t *prot, sec_prot_result_e result);
8787
static void supp_fwh_sec_prot_delete(sec_prot_t *prot);
8888
static int8_t supp_fwh_sec_prot_receive(sec_prot_t *prot, void *pdu, uint16_t size);
89-
static fwh_sec_prot_msg_e supp_fwh_sec_prot_message_get(eapol_pdu_t *eapol_pdu, sec_prot_keys_t *sec_keys);
89+
static fwh_sec_prot_msg_e supp_fwh_sec_prot_message_get(sec_prot_t *prot, eapol_pdu_t *eapol_pdu);
9090
static void supp_fwh_sec_prot_state_machine(sec_prot_t *prot);
9191

9292
static int8_t supp_fwh_sec_prot_message_send(sec_prot_t *prot, fwh_sec_prot_msg_e msg);
@@ -96,6 +96,7 @@ static int8_t supp_fwh_sec_prot_ptk_generate(sec_prot_t *prot, sec_prot_keys_t *
9696
static int8_t supp_fwh_sec_prot_mic_validate(sec_prot_t *prot);
9797

9898
static void supp_fwh_sec_prot_recv_replay_counter_store(sec_prot_t *prot);
99+
static uint64_t supp_fwh_sec_prot_recv_replay_counter_get(sec_prot_t *prot);
99100
static void supp_fwh_sec_prot_anonce_store(sec_prot_t *prot);
100101
static int8_t supp_fwh_sec_prot_anonce_validate(sec_prot_t *prot);
101102
static void supp_fwh_sec_prot_security_replay_counter_update(sec_prot_t *prot);
@@ -137,6 +138,7 @@ static int8_t supp_fwh_sec_prot_init(sec_prot_t *prot)
137138

138139
data->common.ticks = 30 * 10; // 30 seconds
139140
data->msg3_retry_wait = false;
141+
data->recv_replay_cnt = 0;
140142

141143
uint8_t eui64[8] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08};
142144
sec_prot_lib_nonce_init(data->snonce, eui64, 1000);
@@ -167,7 +169,7 @@ static int8_t supp_fwh_sec_prot_receive(sec_prot_t *prot, void *pdu, uint16_t si
167169
// Decoding is successful
168170
if (eapol_parse_pdu_header(pdu, size, &data->recv_eapol_pdu)) {
169171
// Get message
170-
data->recv_msg = supp_fwh_sec_prot_message_get(&data->recv_eapol_pdu, prot->sec_keys);
172+
data->recv_msg = supp_fwh_sec_prot_message_get(prot, &data->recv_eapol_pdu);
171173
if (data->recv_msg != FWH_MESSAGE_UNKNOWN) {
172174
tr_info("4WH: recv %s", data->recv_msg == FWH_MESSAGE_1 ? "Message 1" : "Message 3");
173175

@@ -191,7 +193,7 @@ static int8_t supp_fwh_sec_prot_receive(sec_prot_t *prot, void *pdu, uint16_t si
191193
return ret_val;
192194
}
193195

194-
static fwh_sec_prot_msg_e supp_fwh_sec_prot_message_get(eapol_pdu_t *eapol_pdu, sec_prot_keys_t *sec_keys)
196+
static fwh_sec_prot_msg_e supp_fwh_sec_prot_message_get(sec_prot_t *prot, eapol_pdu_t *eapol_pdu)
195197
{
196198
fwh_sec_prot_msg_e msg = FWH_MESSAGE_UNKNOWN;
197199

@@ -203,17 +205,23 @@ static fwh_sec_prot_msg_e supp_fwh_sec_prot_message_get(eapol_pdu_t *eapol_pdu,
203205
uint8_t key_mask = sec_prot_lib_key_mask_get(eapol_pdu);
204206

205207
switch (key_mask) {
208+
// Message 1
206209
case KEY_INFO_KEY_ACK:
207-
// Must have valid replay counter
208-
if (eapol_pdu->msg.key.replay_counter > sec_prot_keys_pmk_replay_cnt_get(sec_keys)) {
210+
/* Must have valid replay counter, both larger for PMK and larger that is used on
211+
* the four way handshake session (note: PMK replay counter is not updated for Message 1
212+
* but session specific counter is)
213+
*/
214+
if (eapol_pdu->msg.key.replay_counter > sec_prot_keys_pmk_replay_cnt_get(prot->sec_keys) &&
215+
eapol_pdu->msg.key.replay_counter > supp_fwh_sec_prot_recv_replay_counter_get(prot)) {
209216
msg = FWH_MESSAGE_1;
210217
} else {
211218
tr_error("4WH: invalid replay counter %"PRId64, eapol_pdu->msg.key.replay_counter);
212219
}
213220
break;
221+
// Message 3
214222
case KEY_INFO_INSTALL | KEY_INFO_KEY_ACK | KEY_INFO_KEY_MIC | KEY_INFO_SECURED_KEY_FRAME:
215223
// Must have valid replay counter
216-
if (eapol_pdu->msg.key.replay_counter > sec_prot_keys_pmk_replay_cnt_get(sec_keys)) {
224+
if (eapol_pdu->msg.key.replay_counter > sec_prot_keys_pmk_replay_cnt_get(prot->sec_keys)) {
217225
if (eapol_pdu->msg.key.key_information.encrypted_key_data) {
218226
// This should include the GTK KDE, Lifetime KDE and GTKL KDE.
219227
// At least some of them should be present
@@ -346,6 +354,7 @@ static void supp_fwh_sec_prot_state_machine(sec_prot_t *prot)
346354
// Send 4WH message 2
347355
supp_fwh_sec_prot_message_send(prot, FWH_MESSAGE_2);
348356
data->common.ticks = 30 * 10; // 30 seconds
357+
return;
349358
} else if (data->recv_msg != FWH_MESSAGE_3) {
350359
return;
351360
}
@@ -467,6 +476,12 @@ static void supp_fwh_sec_prot_recv_replay_counter_store(sec_prot_t *prot)
467476
data->recv_replay_cnt = data->recv_eapol_pdu.msg.key.replay_counter;
468477
}
469478

479+
static uint64_t supp_fwh_sec_prot_recv_replay_counter_get(sec_prot_t *prot)
480+
{
481+
fwh_sec_prot_int_t *data = fwh_sec_prot_get(prot);
482+
return data->recv_replay_cnt;
483+
}
484+
470485
static void supp_fwh_sec_prot_anonce_store(sec_prot_t *prot)
471486
{
472487
fwh_sec_prot_int_t *data = fwh_sec_prot_get(prot);

‎source/Security/protocols/sec_prot.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -217,6 +217,8 @@ typedef sec_prot_t *sec_prot_by_type_get(sec_prot_t *prot, uint8_t type);
217217
*/
218218
typedef void sec_prot_receive_disable(sec_prot_t *prot);
219219

220+
typedef struct sec_prot_int_data_s sec_prot_int_data_t;
221+
220222
// Security protocol data
221223
struct sec_prot_s {
222224
sec_prot_create_request *create_req; /**< Create request */
@@ -246,7 +248,7 @@ struct sec_prot_s {
246248

247249
sec_prot_keys_t *sec_keys; /**< Security keys storage pointer */
248250
uint8_t header_size; /**< Header size */
249-
uint8_t data; /**< Protocol internal data */
251+
sec_prot_int_data_t *data; /**< Protocol internal data */
250252
};
251253

252254
#endif /* SEC_PROT_H_ */

‎source/Security/protocols/sec_prot_keys.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@ void sec_prot_keys_ptk_eui_64_write(sec_prot_keys_t *sec_keys, const uint8_t *eu
225225

226226
uint8_t *sec_prot_keys_ptk_eui_64_get(sec_prot_keys_t *sec_keys)
227227
{
228-
if (!sec_keys->ptk_eui_64 || !sec_keys->ptk_eui_64_set) {
228+
if (!sec_keys->ptk_eui_64_set) {
229229
return NULL;
230230
}
231231

@@ -564,7 +564,7 @@ bool sec_prot_keys_gtks_hash_update(sec_prot_gtk_keys_t *gtks, uint8_t *gtkhash)
564564
if (sec_prot_keys_gtk_is_set(gtks, i)) {
565565
uint32_t lifetime = sec_prot_keys_gtk_lifetime_get(gtks, i);
566566
if (lifetime > GTK_EXPIRE_MISMATCH_TIME) {
567-
tr_info("GTK mismatch %i expired time, lifetime: %"PRIx32"", i, lifetime);
567+
tr_info("GTK mismatch %i expired time, lifetime: %"PRIu32"", i, lifetime);
568568
mismatch = true;
569569
}
570570
sec_prot_keys_gtk_clear(gtks, i);

‎source/Security/protocols/sec_prot_lib.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -278,7 +278,7 @@ int8_t sec_prot_lib_pmkid_calc(const uint8_t *pmk, const uint8_t *auth_eui64, co
278278
ptr += EUI64_LEN;
279279
memcpy(ptr, supp_eui64, EUI64_LEN);
280280

281-
if (hmac_sha1_calc(pmk, PMK_LEN, data, data_len, pmkid) < 0) {
281+
if (hmac_sha1_calc(pmk, PMK_LEN, data, data_len, pmkid, PMKID_LEN) < 0) {
282282
return -1;
283283
}
284284

@@ -300,7 +300,7 @@ int8_t sec_prot_lib_ptkid_calc(const uint8_t *ptk, const uint8_t *auth_eui64, co
300300
ptr += EUI64_LEN;
301301
memcpy(ptr, supp_eui64, EUI64_LEN);
302302

303-
if (hmac_sha1_calc(ptk, PTK_LEN, data, data_len, ptkid) < 0) {
303+
if (hmac_sha1_calc(ptk, PTK_LEN, data, data_len, ptkid, PTKID_LEN) < 0) {
304304
return -1;
305305
}
306306

@@ -332,7 +332,7 @@ uint8_t *sec_prot_lib_message_build(uint8_t *ptk, uint8_t *kde, uint16_t kde_len
332332

333333
if (eapol_pdu->msg.key.key_information.key_mic) {
334334
uint8_t mic[EAPOL_KEY_MIC_LEN];
335-
if (hmac_sha1_calc(ptk, KCK_LEN, eapol_pdu_frame + header_size, eapol_pdu_size, mic) < 0) {
335+
if (hmac_sha1_calc(ptk, KCK_LEN, eapol_pdu_frame + header_size, eapol_pdu_size, mic, EAPOL_KEY_MIC_LEN) < 0) {
336336
ns_dyn_mem_free(eapol_pdu_frame);
337337
return NULL;
338338
}
@@ -402,7 +402,7 @@ int8_t sec_prot_lib_gtk_read(uint8_t *kde, uint16_t kde_len, sec_prot_keys_t *se
402402
}
403403
}
404404

405-
tr_info("GTK recv index %i lifetime %"PRIx32"", gtk_index, sec_prot_keys_gtk_lifetime_get(sec_keys->gtks, gtk_index));
405+
tr_info("GTK recv index %i lifetime %"PRIu32"", gtk_index, sec_prot_keys_gtk_lifetime_get(sec_keys->gtks, gtk_index));
406406

407407
return 0;
408408
}
@@ -415,7 +415,7 @@ int8_t sec_prot_lib_mic_validate(uint8_t *ptk, uint8_t *mic, uint8_t *pdu, uint8
415415
eapol_write_key_packet_mic(pdu, 0);
416416

417417
uint8_t calc_mic[EAPOL_KEY_MIC_LEN];
418-
if (hmac_sha1_calc(ptk, EAPOL_KEY_MIC_LEN, pdu, pdu_size, calc_mic) < 0) {
418+
if (hmac_sha1_calc(ptk, EAPOL_KEY_MIC_LEN, pdu, pdu_size, calc_mic, EAPOL_KEY_MIC_LEN) < 0) {
419419
tr_error("MIC invalid");
420420
return -1;
421421
}

‎source/Security/protocols/tls_sec_prot/tls_sec_prot.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ typedef enum {
5454
TLS_STATE_FINISHED = SEC_STATE_FINISHED
5555
} eap_tls_sec_prot_state_e;
5656

57+
typedef struct tls_sec_prot_lib_int_s tls_sec_prot_lib_int_t;
58+
5759
typedef struct {
5860
sec_prot_common_t common; /**< Common data */
5961
uint8_t new_pmk[PMK_LEN]; /**< New Pair Wise Master Key */
@@ -64,7 +66,7 @@ typedef struct {
6466
bool timer_running; /**< TLS timer running */
6567
bool finished; /**< TLS finished */
6668
bool calculating; /**< TLS is calculating */
67-
uint8_t tls_sec_inst; /**< TLS security library storage, SHALL BE THE LAST FIELD */
69+
tls_sec_prot_lib_int_t *tls_sec_inst; /**< TLS security library storage, SHALL BE THE LAST FIELD */
6870
} tls_sec_prot_int_t;
6971

7072
static uint16_t tls_sec_prot_size(void);

‎source/Service_Libs/hmac/hmac_sha1.c

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525

2626
#define TRACE_GROUP "hmac"
2727

28-
int8_t hmac_sha1_calc(const uint8_t *key, uint16_t key_len, const uint8_t *data, uint16_t data_len, uint8_t *result)
28+
int8_t hmac_sha1_calc(const uint8_t *key, uint16_t key_len, const uint8_t *data, uint16_t data_len, uint8_t *result, uint8_t result_len)
2929
{
3030
#ifdef EXTRA_DEBUG_INFO
3131
// Extensive debug for now, to be disabled later
@@ -62,13 +62,21 @@ int8_t hmac_sha1_calc(const uint8_t *key, uint16_t key_len, const uint8_t *data,
6262
if (mbedtls_md_hmac_update(&ctx, (const unsigned char *) data, data_len) != 0) {
6363
goto error;
6464
}
65-
if (mbedtls_md_hmac_finish(&ctx, result) != 0) {
65+
66+
uint8_t result_value[20];
67+
if (mbedtls_md_hmac_finish(&ctx, result_value) != 0) {
6668
goto error;
6769
}
6870
mbedtls_md_free(&ctx);
6971

72+
if (result_len > 20) {
73+
result_len = 20;
74+
}
75+
76+
memcpy(result, result_value, result_len);
77+
7078
#ifdef EXTRA_DEBUG_INFO
71-
tr_debug("hmac_sha_1 result %s\n", trace_array(result, 20));
79+
tr_debug("hmac_sha_1 result %s\n", trace_array(result_value, 20));
7280
#endif
7381
return 0;
7482

‎source/Service_Libs/hmac/hmac_sha1.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,13 @@
2727
* \param key_len key length
2828
* \param data pointer to data
2929
* \param data_len data length
30-
* \param result pointer to result, must be at least 160 bytes
30+
* \param result pointer to result
31+
* \param result_len in bytes, maximum is 20 bytes
3132
*
3233
* \return < 0 failure
3334
* \return >= 0 success
3435
*
3536
*/
36-
int8_t hmac_sha1_calc(const uint8_t *key, uint16_t key_len, const uint8_t *data, uint16_t data_len, uint8_t *result);
37+
int8_t hmac_sha1_calc(const uint8_t *key, uint16_t key_len, const uint8_t *data, uint16_t data_len, uint8_t *result, uint8_t result_len);
3738

3839
#endif /* HMAC_SHA1_ */

‎source/Service_Libs/ieee_802_11/ieee_802_11.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ int8_t ieee_802_11_prf_finish(ieee_802_11_prf_t *prf, uint8_t *result)
6767

6868
for (uint8_t i = 0; i < (prf->bits + 159) / 160; i++) {
6969
prf->string[prf->a_len + 1 + prf->b_len] = i; /* X (index) */
70-
if (hmac_sha1_calc(prf->key, prf->key_len, prf->string, string_len, result) < 0) {
70+
if (hmac_sha1_calc(prf->key, prf->key_len, prf->string, string_len, result, 20) < 0) {
7171
return -1;
7272
}
7373
result += 160 / 8;

‎source/configs/base/cfg_ws_border_router.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,5 @@
2424
#define HAVE_WS_BORDER_ROUTER
2525
#define HAVE_ND_PROXY
2626
#define MULTICAST_FORWARDING
27+
#define HAVE_PAE_AUTH
28+
#define HAVE_EAPOL_RELAY

‎source/configs/base/cfg_ws_router.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,5 @@
2222
#define HAVE_6LOWPAN_ND
2323
#define HAVE_MPL
2424
#define HAVE_WS
25+
#define HAVE_PAE_SUPP
26+
#define HAVE_EAPOL_RELAY

0 commit comments

Comments
 (0)