Skip to content

Commit 8b1d537

Browse files
author
Mika Leppänen
committed
Adjusted EAPOL limits and timers
Set maximum ongoing security negotiation to 100 for large networks. Now both supplicant limit and TLS limit uses same value. Changed wait for supplicant to answer timeout on authenticator to 2 minutes, and wait timer after authentication has completed to 15 seconds. These will allow border router to cycle to next authentication faster. Made supplicant initial-Key timer configurable, but now yet enabled changes the configutations (very slow network set to 5000 devices to not to enable yet).
1 parent 8e72b80 commit 8b1d537

File tree

8 files changed

+162
-99
lines changed

8 files changed

+162
-99
lines changed

‎source/6LoWPAN/ws/ws_cfg_settings.c

Lines changed: 47 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -374,7 +374,13 @@ static void ws_cfg_network_size_config_set_small(ws_cfg_nw_size_t *cfg)
374374
cfg->sec_prot.sec_prot_trickle_imax = SEC_PROT_SMALL_IMAX;
375375
cfg->sec_prot.sec_prot_trickle_timer_exp = SEC_PROT_TIMER_EXPIRATIONS;
376376
cfg->sec_prot.sec_prot_retry_timeout = SEC_PROT_RETRY_TIMEOUT_SMALL;
377-
cfg->sec_prot.sec_max_ongoing_authentication = MAX_SIMULTANEOUS_EAP_TLS_NEGOTIATIONS_SMALL;
377+
378+
cfg->sec_prot.sec_max_ongoing_authentication = MAX_SIMULTANEOUS_SECURITY_NEGOTIATIONS_SMALL;
379+
380+
cfg->sec_prot.initial_key_retry_delay = DEFAULT_INITIAL_KEY_RETRY_TIMER;
381+
cfg->sec_prot.initial_key_imin = DEFAULT_INITIAL_KEY_TRICKLE_IMIN_SECS;
382+
cfg->sec_prot.initial_key_imax = DEFAULT_INITIAL_KEY_TRICKLE_IMAX_SECS;
383+
cfg->sec_prot.initial_key_retry_cnt = DEFAULT_INITIAL_KEY_RETRY_COUNT;
378384
}
379385

380386
static void ws_cfg_network_size_config_set_medium(ws_cfg_nw_size_t *cfg)
@@ -404,7 +410,13 @@ static void ws_cfg_network_size_config_set_medium(ws_cfg_nw_size_t *cfg)
404410
cfg->sec_prot.sec_prot_trickle_imax = SEC_PROT_SMALL_IMAX;
405411
cfg->sec_prot.sec_prot_trickle_timer_exp = SEC_PROT_TIMER_EXPIRATIONS;
406412
cfg->sec_prot.sec_prot_retry_timeout = SEC_PROT_RETRY_TIMEOUT_SMALL;
407-
cfg->sec_prot.sec_max_ongoing_authentication = MAX_SIMULTANEOUS_EAP_TLS_NEGOTIATIONS_MEDIUM;
413+
414+
cfg->sec_prot.sec_max_ongoing_authentication = MAX_SIMULTANEOUS_SECURITY_NEGOTIATIONS_MEDIUM;
415+
416+
cfg->sec_prot.initial_key_retry_delay = DEFAULT_INITIAL_KEY_RETRY_TIMER;
417+
cfg->sec_prot.initial_key_imin = DEFAULT_INITIAL_KEY_TRICKLE_IMIN_SECS;
418+
cfg->sec_prot.initial_key_imax = DEFAULT_INITIAL_KEY_TRICKLE_IMAX_SECS;
419+
cfg->sec_prot.initial_key_retry_cnt = DEFAULT_INITIAL_KEY_RETRY_COUNT;
408420
}
409421

410422
static void ws_cfg_network_size_config_set_large(ws_cfg_nw_size_t *cfg)
@@ -434,7 +446,21 @@ static void ws_cfg_network_size_config_set_large(ws_cfg_nw_size_t *cfg)
434446
cfg->sec_prot.sec_prot_trickle_imax = SEC_PROT_LARGE_IMAX;
435447
cfg->sec_prot.sec_prot_trickle_timer_exp = SEC_PROT_TIMER_EXPIRATIONS;
436448
cfg->sec_prot.sec_prot_retry_timeout = SEC_PROT_RETRY_TIMEOUT_LARGE;
437-
cfg->sec_prot.sec_max_ongoing_authentication = MAX_SIMULTANEOUS_EAP_TLS_NEGOTIATIONS_LARGE;
449+
450+
cfg->sec_prot.sec_max_ongoing_authentication = MAX_SIMULTANEOUS_SECURITY_NEGOTIATIONS_LARGE;
451+
452+
if (cfg->gen.network_size > 50 && cfg->gen.network_size != NETWORK_SIZE_AUTOMATIC) {
453+
// If more than 5000 devices uses very slow initial trickle timer
454+
cfg->sec_prot.initial_key_retry_delay = NONE_INITIAL_KEY_RETRY_TIMER;
455+
cfg->sec_prot.initial_key_imin = VERY_SLOW_NW_INITIAL_KEY_TRICKLE_IMIN_SECS;
456+
cfg->sec_prot.initial_key_imax = VERY_SLOW_NW_INITIAL_KEY_TRICKLE_IMAX_SECS;
457+
cfg->sec_prot.initial_key_retry_cnt = DEFAULT_INITIAL_KEY_RETRY_COUNT;
458+
} else {
459+
cfg->sec_prot.initial_key_retry_delay = DEFAULT_INITIAL_KEY_RETRY_TIMER;
460+
cfg->sec_prot.initial_key_imin = DEFAULT_INITIAL_KEY_TRICKLE_IMIN_SECS;
461+
cfg->sec_prot.initial_key_imax = DEFAULT_INITIAL_KEY_TRICKLE_IMAX_SECS;
462+
cfg->sec_prot.initial_key_retry_cnt = DEFAULT_INITIAL_KEY_RETRY_COUNT;
463+
}
438464
}
439465

440466
static void ws_cfg_network_size_config_set_certificate(ws_cfg_nw_size_t *cfg)
@@ -464,7 +490,13 @@ static void ws_cfg_network_size_config_set_certificate(ws_cfg_nw_size_t *cfg)
464490
cfg->sec_prot.sec_prot_trickle_imax = SEC_PROT_SMALL_IMAX;
465491
cfg->sec_prot.sec_prot_trickle_timer_exp = SEC_PROT_TIMER_EXPIRATIONS;
466492
cfg->sec_prot.sec_prot_retry_timeout = SEC_PROT_RETRY_TIMEOUT_SMALL;
467-
cfg->sec_prot.sec_max_ongoing_authentication = MAX_SIMULTANEOUS_EAP_TLS_NEGOTIATIONS_SMALL;
493+
494+
cfg->sec_prot.sec_max_ongoing_authentication = MAX_SIMULTANEOUS_SECURITY_NEGOTIATIONS_SMALL;
495+
496+
cfg->sec_prot.initial_key_retry_delay = DEFAULT_INITIAL_KEY_RETRY_TIMER;
497+
cfg->sec_prot.initial_key_imin = DEFAULT_INITIAL_KEY_TRICKLE_IMIN_SECS;
498+
cfg->sec_prot.initial_key_imax = DEFAULT_INITIAL_KEY_TRICKLE_IMAX_SECS;
499+
cfg->sec_prot.initial_key_retry_cnt = DEFAULT_INITIAL_KEY_RETRY_COUNT;
468500
}
469501

470502
static int8_t ws_cfg_gen_default_set(ws_gen_cfg_t *cfg)
@@ -1011,7 +1043,12 @@ static int8_t ws_cfg_sec_prot_default_set(ws_sec_prot_cfg_t *cfg)
10111043
cfg->sec_prot_trickle_imax = SEC_PROT_SMALL_IMAX;
10121044
cfg->sec_prot_trickle_timer_exp = 2;
10131045
cfg->sec_prot_retry_timeout = SEC_PROT_RETRY_TIMEOUT_SMALL;
1014-
cfg->sec_max_ongoing_authentication = MAX_SIMULTANEOUS_EAP_TLS_NEGOTIATIONS_MEDIUM;
1046+
cfg->sec_max_ongoing_authentication = MAX_SIMULTANEOUS_SECURITY_NEGOTIATIONS_MEDIUM;
1047+
cfg->initial_key_retry_delay = DEFAULT_INITIAL_KEY_RETRY_TIMER;
1048+
cfg->initial_key_imin = DEFAULT_INITIAL_KEY_TRICKLE_IMIN_SECS;
1049+
cfg->initial_key_imax = DEFAULT_INITIAL_KEY_TRICKLE_IMAX_SECS;
1050+
cfg->initial_key_retry_cnt = DEFAULT_INITIAL_KEY_RETRY_COUNT;
1051+
10151052
return CFG_SETTINGS_OK;
10161053
}
10171054

@@ -1032,7 +1069,11 @@ int8_t ws_cfg_sec_prot_validate(ws_sec_prot_cfg_t *cfg, ws_sec_prot_cfg_t *new_c
10321069
cfg->sec_prot_trickle_imax != new_cfg->sec_prot_trickle_imax ||
10331070
cfg->sec_prot_trickle_timer_exp != new_cfg->sec_prot_trickle_timer_exp ||
10341071
cfg->sec_prot_retry_timeout != new_cfg->sec_prot_retry_timeout ||
1035-
cfg->sec_max_ongoing_authentication != new_cfg->sec_max_ongoing_authentication) {
1072+
cfg->sec_max_ongoing_authentication != new_cfg->sec_max_ongoing_authentication ||
1073+
cfg->initial_key_retry_delay != new_cfg->initial_key_retry_delay ||
1074+
cfg->initial_key_imin != new_cfg->initial_key_retry_delay ||
1075+
cfg->initial_key_imax != new_cfg->initial_key_retry_delay ||
1076+
cfg->initial_key_retry_cnt != new_cfg->initial_key_retry_delay) {
10361077

10371078
return CFG_SETTINGS_CHANGED;
10381079
}

‎source/6LoWPAN/ws/ws_cfg_settings.h

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -108,11 +108,15 @@ typedef struct ws_sec_timer_cfg_s {
108108
* \brief Struct ws_sec_prot_cfg_t Security protocols configuration
109109
*/
110110
typedef struct ws_sec_prot_cfg_s {
111-
uint16_t sec_prot_retry_timeout; /**< Security protocol retry timeout; seconds; default 330 */
112-
uint16_t sec_prot_trickle_imin; /**< Security protocol trickle parameters Imin; seconds; default 30 */
113-
uint16_t sec_prot_trickle_imax; /**< Security protocol trickle parameters Imax; seconds; default 90 */
114-
uint8_t sec_prot_trickle_timer_exp; /**< Security protocol trickle timer expirations; default 2 */
115-
uint16_t sec_max_ongoing_authentication; /**< Pae authenticator max Accept ongoing authentication count */
111+
uint16_t sec_prot_retry_timeout; /**< Security protocol retry timeout; seconds; default 330 */
112+
uint16_t sec_prot_trickle_imin; /**< Security protocol trickle parameters Imin; seconds; default 30 */
113+
uint16_t sec_prot_trickle_imax; /**< Security protocol trickle parameters Imax; seconds; default 90 */
114+
uint8_t sec_prot_trickle_timer_exp; /**< Security protocol trickle timer expirations; default 2 */
115+
uint16_t sec_max_ongoing_authentication; /**< Pae authenticator max Accept ongoing authentication count */
116+
uint16_t initial_key_retry_delay; /**< Delay before starting initial key trickle; seconds; default 120 */
117+
uint16_t initial_key_imin; /**< Initial key trickle Imin; seconds; default 360 */
118+
uint16_t initial_key_imax; /**< Initial key trickle Imax; seconds; default 720 */
119+
uint8_t initial_key_retry_cnt; /**< Number of initial key retries; default 2 */
116120
} ws_sec_prot_cfg_t;
117121

118122
/**

‎source/6LoWPAN/ws/ws_config.h

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -203,10 +203,10 @@ extern uint8_t DEVICE_MIN_SENS;
203203

204204
#define SEC_PROT_TIMER_EXPIRATIONS 2 // Number of retries
205205

206-
// Maximum number of simultaneous EAP-TLS negotiations
207-
#define MAX_SIMULTANEOUS_EAP_TLS_NEGOTIATIONS_SMALL 3
208-
#define MAX_SIMULTANEOUS_EAP_TLS_NEGOTIATIONS_MEDIUM 20
209-
#define MAX_SIMULTANEOUS_EAP_TLS_NEGOTIATIONS_LARGE 50
206+
// Maximum number of simultaneous security negotiations
207+
#define MAX_SIMULTANEOUS_SECURITY_NEGOTIATIONS_SMALL 3
208+
#define MAX_SIMULTANEOUS_SECURITY_NEGOTIATIONS_MEDIUM 20
209+
#define MAX_SIMULTANEOUS_SECURITY_NEGOTIATIONS_LARGE 100
210210

211211
/*
212212
* Security protocol timer configuration parameters
@@ -222,4 +222,23 @@ extern uint8_t DEVICE_MIN_SENS;
222222
#define DEFAULT_GTK_MAX_MISMATCH 64 // 64 minutes
223223
#define DEFAULT_GTK_NEW_INSTALL_REQUIRED 80 // 80 percent of GTK lifetime --> 24 days
224224

225+
/*
226+
* Security protocol initial EAPOL-key parameters
227+
*/
228+
229+
// How long the wait is before the first initial EAPOL-key retry
230+
#define DEFAULT_INITIAL_KEY_RETRY_TIMER 120
231+
#define NONE_INITIAL_KEY_RETRY_TIMER 0
232+
233+
// Default trickle values for sending of initial EAPOL-key
234+
#define DEFAULT_INITIAL_KEY_TRICKLE_IMIN_SECS 360 /* 6 to 12 minutes */
235+
#define DEFAULT_INITIAL_KEY_TRICKLE_IMAX_SECS 720
236+
237+
// Very slow network values for sending of initial EAPOL-key
238+
#define VERY_SLOW_NW_INITIAL_KEY_TRICKLE_IMIN_SECS 600 /* 10 to 60 minutes */
239+
#define VERY_SLOW_NW_INITIAL_KEY_TRICKLE_IMAX_SECS 3600
240+
241+
// How many times sending of initial EAPOL-key is retried
242+
#define DEFAULT_INITIAL_KEY_RETRY_COUNT 2
243+
225244
#endif /* WS_CONFIG_H_ */

‎source/6LoWPAN/ws/ws_pae_auth.c

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -59,19 +59,18 @@
5959
#define PAE_TASKLET_EVENT 2
6060
#define PAE_TASKLET_TIMER 3
6161

62-
// Wait for for supplicant to indicate activity (e.g. to send a message)
63-
#define WAIT_FOR_AUTHENTICATION_TICKS 5 * 60 * 10 // 5 minutes
64-
62+
/* Wait for supplicant to indicate activity (e.g. to send a message) when
63+
authentication is ongoing */
64+
#define WAIT_FOR_AUTHENTICATION_TICKS 2 * 60 * 10 // 2 minutes
65+
// Wait after authentication has completed before supplicant entry goes inactive
66+
#define WAIT_AFTER_AUTHENTICATION_TICKS 15 * 10 // 15 seconds
6567

6668
/* If EAP-TLS is delayed due to simultaneous negotiations limit, defines how
6769
long to wait for previous negotiation to complete */
6870
#define EAP_TLS_NEGOTIATION_TRIGGER_TIMEOUT 60 * 10 // 60 seconds
6971

7072
// Default for maximum number of supplicants
71-
#define SUPPLICANT_MAX_NUMBER 1000
72-
73-
// Default for maximum number of active supplicants (making security negotiations)
74-
#define ACTIVE_SUPPLICANT_MAX_NUMBER 100
73+
#define SUPPLICANT_MAX_NUMBER 5000
7574

7675
/* Default for number of supplicants to purge per garbage collect call from
7776
nanostack monitor */
@@ -871,7 +870,7 @@ static kmp_api_t *ws_pae_auth_kmp_incoming_ind(kmp_service_t *service, kmp_type_
871870

872871
if (!supp_entry) {
873872
// Checks if active supplicant list has space for new supplicants
874-
if (ws_pae_lib_supp_list_active_limit_reached(&pae_auth->active_supp_list, ACTIVE_SUPPLICANT_MAX_NUMBER)) {
873+
if (ws_pae_lib_supp_list_active_limit_reached(&pae_auth->active_supp_list, pae_auth->sec_prot_cfg->sec_max_ongoing_authentication)) {
875874
tr_debug("PAE: active limit reached, eui-64: %s", trace_array(kmp_address_eui_64_get(addr), 8));
876875
return NULL;
877876
}
@@ -986,6 +985,8 @@ static void ws_pae_auth_next_kmp_trigger(pae_auth_t *pae_auth, supp_entry_t *sup
986985
kmp_type_e next_type = ws_pae_auth_next_protocol_get(pae_auth, supp_entry);
987986

988987
if (next_type == KMP_TYPE_NONE) {
988+
// Supplicant goes inactive after 15 seconds
989+
ws_pae_lib_supp_timer_ticks_set(supp_entry, WAIT_AFTER_AUTHENTICATION_TICKS);
989990
// All done
990991
return;
991992
} else {

‎source/6LoWPAN/ws/ws_pae_controller.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -624,7 +624,15 @@ int8_t ws_pae_controller_configure(protocol_interface_info_entry_t *interface_pt
624624
controller->sec_prot_cfg.sec_prot_trickle_params.k = 0;
625625
controller->sec_prot_cfg.sec_prot_trickle_params.TimerExpirations = sec_prot_cfg->sec_prot_trickle_timer_exp;
626626
controller->sec_prot_cfg.sec_prot_retry_timeout = sec_prot_cfg->sec_prot_retry_timeout * 10;
627+
627628
controller->sec_prot_cfg.sec_max_ongoing_authentication = sec_prot_cfg->sec_max_ongoing_authentication;
629+
630+
controller->sec_prot_cfg.initial_key_retry_delay = sec_prot_cfg->initial_key_retry_delay;
631+
controller->sec_prot_cfg.initial_key_trickle_params.Imin = sec_prot_cfg->initial_key_imin;
632+
controller->sec_prot_cfg.initial_key_trickle_params.Imax = sec_prot_cfg->initial_key_imax;
633+
controller->sec_prot_cfg.initial_key_trickle_params.k = 0;
634+
controller->sec_prot_cfg.initial_key_trickle_params.TimerExpirations = 2;
635+
controller->sec_prot_cfg.initial_key_retry_cnt = sec_prot_cfg->initial_key_retry_cnt;
628636
}
629637

630638
if (sec_timer_cfg) {

‎source/6LoWPAN/ws/ws_pae_supp.c

Lines changed: 25 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -110,36 +110,14 @@ typedef struct {
110110
bool entry_address_active: 1;
111111
} pae_supp_t;
112112

113-
// How many times sending of initial EAPOL-key is retried
114-
#define INITIAL_KEY_RETRY_COUNT 2
115-
116113
// How many times sending of initial EAPOL-key is initiated on key update
117114
#define KEY_UPDATE_RETRY_COUNT 3
118115
#define LIFETIME_MISMATCH_RETRY_COUNT 1 /* No retries */
119116

120-
// How long the wait is before the first initial EAPOL-key retry
121-
#define DEFAULT_INITIAL_KEY_RETRY_TIMER 120
122-
#define NONE_INITIAL_KEY_RETRY_TIMER 0
123-
124-
// Default trickle values for sending of initial EAPOL-key
125-
#define DEFAULT_TRICKLE_IMIN_SECS 360 /* 6 to 12 minutes */
126-
#define DEFAULT_TRICKLE_IMAX_SECS 720
127-
128-
// Very slow network values for sending of initial EAPOL-key
129-
#define VERY_SLOW_NW_TRICKLE_IMIN_SECS 600 /* 10 to 60 minutes */
130-
#define VERY_SLOW_NW_TRICKLE_IMAX_SECS 3600
131-
132117
// Trickle timer on how long to wait response after last retry before failing authentication
133118
#define LAST_INTERVAL_TRICKLE_IMIN_SECS 240 /* 4 minutes */
134119
#define LAST_INTERVAL_TRICKLE_IMAX_SECS 240
135120

136-
static trickle_params_t initial_eapol_key_trickle_params = {
137-
.Imin = DEFAULT_TRICKLE_IMIN_SECS, /* 360 second; ticks are 1 second */
138-
.Imax = DEFAULT_TRICKLE_IMAX_SECS, /* 720 second */
139-
.k = 0, /* infinity - no consistency checking */
140-
.TimerExpirations = 2
141-
};
142-
143121
static void ws_pae_supp_free(pae_supp_t *pae_supp);
144122
static void ws_pae_supp_authenticate_response(pae_supp_t *pae_supp, auth_result_e result);
145123
static int8_t ws_pae_supp_initial_key_send(pae_supp_t *pae_supp);
@@ -183,7 +161,6 @@ static const char *KEYS_FILE = KEYS_FILE_NAME;
183161

184162
static int8_t tasklet_id = -1;
185163
static NS_LIST_DEFINE(pae_supp_list, pae_supp_t, link);
186-
static uint8_t timing_value = 0; // Timing value set based e.g. on network size
187164

188165
static void ws_pae_supp_address_set(pae_supp_t *pae_supp, kmp_addr_t *address)
189166
{
@@ -552,7 +529,7 @@ int8_t ws_pae_supp_init(protocol_interface_info_entry_t *interface_ptr, const se
552529
pae_supp->initial_key_timer = 0;
553530
pae_supp->initial_key_retry_timer = 0;
554531
pae_supp->nw_keys_used_cnt = 0;
555-
pae_supp->initial_key_retry_cnt = INITIAL_KEY_RETRY_COUNT;
532+
pae_supp->initial_key_retry_cnt = DEFAULT_INITIAL_KEY_RETRY_COUNT;
556533
pae_supp->sec_keys_nw_info = sec_keys_nw_info;
557534
pae_supp->sec_timer_cfg = sec_timer_cfg;
558535
pae_supp->sec_prot_cfg = sec_prot_cfg;
@@ -852,46 +829,40 @@ void ws_pae_supp_slow_timer(uint16_t seconds)
852829

853830
static void ws_pae_supp_initial_trickle_timer_start(pae_supp_t *pae_supp)
854831
{
855-
pae_supp->auth_trickle_params = initial_eapol_key_trickle_params;
856-
857-
// Very fast, medium and slow network
858-
if (timing_value < 25) {
859-
/* Starts trickle for initial EAPOL-key. Sequence has fixed delay of 2 minutes,
860-
* one re-transmit interval, last re-transmit interval transmit time and a wait time
861-
* for the authenticator to answer the last re-transmit.
862-
*
863-
* Interval I [6,12] minutes. Sequence:
864-
*
865-
* fixed 2 minutes delay + I + last I transmit time t + wait for answer [2,4] minutes
866-
*
867-
* There are two retries. Minimum time that sequence takes before authentication failure
868-
* is 16 minutes and maximum is 30 minutes.
869-
*/
870-
pae_supp->initial_key_retry_timer = DEFAULT_INITIAL_KEY_RETRY_TIMER; // 2 minutes
871-
} else {
872-
/* Extremely slow network
873-
*
874-
* Starts trickle for initial EAPOL-key, Interval I [10,60] minutes. Sequence:
875-
* I + last I transmit time t + wait for answer [2,4] minutes
876-
* There are two retries. Minimum time that sequence takes before authentication failure
877-
* is 22 minutes and maximum is 124 minutes.
878-
*/
879-
pae_supp->auth_trickle_params.Imin = VERY_SLOW_NW_TRICKLE_IMIN_SECS;
880-
pae_supp->auth_trickle_params.Imax = VERY_SLOW_NW_TRICKLE_IMAX_SECS;
881-
pae_supp->initial_key_retry_timer = NONE_INITIAL_KEY_RETRY_TIMER; // 0 seconds
882-
}
832+
/* Starts trickle for initial EAPOL-key. Default sequence has fixed delay of 2 minutes,
833+
* one re-transmit interval, last re-transmit interval transmit time and a wait time
834+
* for the authenticator to answer the last re-transmit.
835+
*
836+
* Interval I [6,12] minutes. Sequence:
837+
*
838+
* fixed 2 minutes delay + I + last I transmit time t + wait for answer [2,4] minutes
839+
*
840+
* There are two retries. Minimum time that sequence takes before authentication failure
841+
* is 16 minutes and maximum is 30 minutes.
842+
*
843+
*
844+
* Extremely slow network
845+
*
846+
* Starts trickle for initial EAPOL-key, Interval I [10,60] minutes. Sequence:
847+
* I + last I transmit time t + wait for answer [2,4] minutes
848+
* There are two retries. Minimum time that sequence takes before authentication failure
849+
* is 22 minutes and maximum is 124 minutes.
850+
*/
851+
pae_supp->auth_trickle_params = pae_supp->sec_prot_cfg->initial_key_trickle_params;
852+
pae_supp->initial_key_retry_timer = pae_supp->sec_prot_cfg->initial_key_retry_delay;
853+
883854
trickle_start(&pae_supp->auth_trickle_timer, &pae_supp->auth_trickle_params);
884855
tr_info("Initial EAPOL-Key trickle I: [%i,%i] %i, t: %i", pae_supp->auth_trickle_params.Imin, pae_supp->auth_trickle_params.Imax, pae_supp->auth_trickle_timer.I, pae_supp->auth_trickle_timer.t);
885856
pae_supp->auth_trickle_running = true;
886-
pae_supp->initial_key_retry_cnt = INITIAL_KEY_RETRY_COUNT;
857+
pae_supp->initial_key_retry_cnt = pae_supp->sec_prot_cfg->initial_key_retry_cnt;
887858
}
888859

889860
static void ws_pae_supp_initial_last_interval_trickle_timer_start(pae_supp_t *pae_supp)
890861
{
891862
// Starts trickle last to wait response after last retry before failing authentication
892-
pae_supp->auth_trickle_params = initial_eapol_key_trickle_params;
893863
pae_supp->auth_trickle_params.Imin = LAST_INTERVAL_TRICKLE_IMIN_SECS;
894864
pae_supp->auth_trickle_params.Imax = LAST_INTERVAL_TRICKLE_IMAX_SECS;
865+
pae_supp->auth_trickle_params.k = 0;
895866
pae_supp->auth_trickle_params.TimerExpirations = 1;
896867
// Set I to [iMin,iMax] (4 to 4 minutes) -> t is [I/2 - I] (2 minutes to 4 minutes)
897868
trickle_start(&pae_supp->auth_trickle_timer, &pae_supp->auth_trickle_params);

‎source/Security/protocols/sec_prot_cfg.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ typedef struct sec_prot_cfg_s {
2424
trickle_params_t sec_prot_trickle_params;
2525
uint16_t sec_prot_retry_timeout;
2626
uint16_t sec_max_ongoing_authentication;
27+
uint16_t initial_key_retry_delay;
28+
trickle_params_t initial_key_trickle_params;
29+
uint8_t initial_key_retry_cnt;
2730
} sec_prot_cfg_t;
2831

2932
#endif /* SEC_PROT_CONF_H_ */

0 commit comments

Comments
 (0)