Skip to content

Commit dce25d3

Browse files
author
Mika Leppänen
committed
Corrected security protocols init and security message routing
Security protocols run now 30 seconds timer on init to clean if protocol does not start (TLS runs longer timer since it is started at the same time as EAP-TLS starts). On incoming messages, the routing now prefers instances that are not terminating. But routes to also to terminating instances if other instances are not present. Added some validations to TLS protocol start and traces to security protocol init and finished.
1 parent 7b39e25 commit dce25d3

File tree

10 files changed

+105
-36
lines changed

10 files changed

+105
-36
lines changed

‎source/6LoWPAN/ws/ws_pae_lib.c

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,15 +76,21 @@ int8_t ws_pae_lib_kmp_list_delete(kmp_list_t *kmp_list, kmp_api_t *kmp)
7676

7777
kmp_api_t *ws_pae_lib_kmp_list_type_get(kmp_list_t *kmp_list, kmp_type_e type)
7878
{
79+
kmp_api_t *kmp = NULL;
80+
7981
ns_list_foreach(kmp_entry_t, cur, kmp_list) {
80-
/* If type matches and receiving of messages has not been disabled for the kmp
81-
(kmp is not in terminating phase) */
82-
if (kmp_api_type_get(cur->kmp) == type && !kmp_api_receive_disable(cur->kmp)) {
83-
return cur->kmp;
82+
// If kmp type matches
83+
if (kmp_api_type_get(cur->kmp) == type) {
84+
/* If receiving of messages has not been disabled for the kmp (kmp is not
85+
in terminating phase) prioritizes that kmp */
86+
if (!kmp_api_receive_disable(cur->kmp)) {
87+
return cur->kmp;
88+
}
89+
// Otherwise returns any kmp that matches
90+
kmp = cur->kmp;
8491
}
8592
}
86-
87-
return 0;
93+
return kmp;
8894
}
8995

9096
void ws_pae_lib_kmp_list_free(kmp_list_t *kmp_list)

‎source/Security/protocols/eap_tls_sec_prot/auth_eap_tls_sec_prot.c

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ static int8_t auth_eap_tls_sec_prot_message_handle(sec_prot_t *prot);
9898
static int8_t auth_eap_tls_sec_prot_message_send(sec_prot_t *prot, uint8_t eap_code, uint8_t eap_type, uint8_t tls_state);
9999

100100
static void auth_eap_tls_sec_prot_timer_timeout(sec_prot_t *prot, uint16_t ticks);
101-
static void auth_eap_tls_sec_prot_init_tls(sec_prot_t *prot);
101+
static int8_t auth_eap_tls_sec_prot_init_tls(sec_prot_t *prot);
102102
static void auth_eap_tls_sec_prot_delete_tls(sec_prot_t *prot);
103103

104104
static void auth_eap_tls_sec_prot_seq_id_update(sec_prot_t *prot);
@@ -348,16 +348,16 @@ static int8_t auth_eap_tls_sec_prot_tls_send(sec_prot_t *tls_prot, void *pdu, ui
348348
return 0;
349349
}
350350

351-
static void auth_eap_tls_sec_prot_init_tls(sec_prot_t *prot)
351+
static int8_t auth_eap_tls_sec_prot_init_tls(sec_prot_t *prot)
352352
{
353353
eap_tls_sec_prot_int_t *data = eap_tls_sec_prot_get(prot);
354354
if (data->tls_prot) {
355-
return;
355+
return 0;
356356
}
357357

358358
data->tls_prot = prot->type_get(prot, SEC_PROT_TYPE_TLS);
359359
if (!data->tls_prot) {
360-
return;
360+
return -1;
361361
}
362362

363363
data->tls_prot->header_size = TLS_HEAD_LEN;
@@ -369,6 +369,8 @@ static void auth_eap_tls_sec_prot_init_tls(sec_prot_t *prot)
369369
data->tls_prot->send = auth_eap_tls_sec_prot_tls_send;
370370

371371
data->tls_ongoing = true;
372+
373+
return 0;
372374
}
373375

374376
static void auth_eap_tls_sec_prot_delete_tls(sec_prot_t *prot)
@@ -388,14 +390,17 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
388390
// EAP-TLS authenticator state machine
389391
switch (sec_prot_state_get(&data->common)) {
390392
case EAP_TLS_STATE_INIT:
393+
tr_info("EAP-TLS init");
391394
sec_prot_state_set(prot, &data->common, EAP_TLS_STATE_CREATE_REQ);
395+
prot->timer_start(prot);
392396
break;
393397

394398
// Wait KMP-CREATE.request
395399
case EAP_TLS_STATE_CREATE_REQ:
396400
tr_info("EAP-TLS start, eui-64: %s", trace_array(sec_prot_remote_eui_64_addr_get(prot), 8));
397401

398-
prot->timer_start(prot);
402+
// Set default timeout for the total maximum length of the negotiation
403+
sec_prot_default_timeout_set(&data->common);
399404

400405
// KMP-CREATE.confirm
401406
prot->create_conf(prot, SEC_RESULT_OK);
@@ -469,8 +474,11 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
469474

470475
// All fragments received for a message
471476
if (result == EAP_TLS_MSG_RECEIVE_DONE) {
472-
auth_eap_tls_sec_prot_init_tls(prot);
473-
477+
// Initialize TLS protocol
478+
if (auth_eap_tls_sec_prot_init_tls(prot) < 0) {
479+
tr_error("TLS init failed");
480+
return;
481+
}
474482
if (data->tls_ongoing) {
475483
// Call TLS
476484
data->tls_prot->receive(data->tls_prot, data->tls_recv.data, data->tls_recv.total_len);
@@ -538,12 +546,14 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
538546
sec_prot_state_set(prot, &data->common, EAP_TLS_STATE_FINISHED);
539547
break;
540548

541-
case EAP_TLS_STATE_FINISHED:
549+
case EAP_TLS_STATE_FINISHED: {
550+
uint8_t *remote_eui_64 = sec_prot_remote_eui_64_addr_get(prot);
551+
tr_info("EAP-TLS finished, eui-64: %s", remote_eui_64 ? trace_array(sec_prot_remote_eui_64_addr_get(prot), 8) : "not set");
542552
auth_eap_tls_sec_prot_delete_tls(prot);
543553
prot->timer_stop(prot);
544554
prot->finished(prot);
545555
break;
546-
556+
}
547557
default:
548558
break;
549559
}

‎source/Security/protocols/eap_tls_sec_prot/supp_eap_tls_sec_prot.c

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ static int8_t supp_eap_tls_sec_prot_message_handle(sec_prot_t *prot);
9090
static int8_t supp_eap_tls_sec_prot_message_send(sec_prot_t *prot, uint8_t eap_code, uint8_t eap_type, uint8_t tls_state);
9191

9292
static void supp_eap_tls_sec_prot_timer_timeout(sec_prot_t *prot, uint16_t ticks);
93-
static void supp_eap_tls_sec_prot_init_tls(sec_prot_t *prot);
93+
static int8_t supp_eap_tls_sec_prot_init_tls(sec_prot_t *prot);
9494
static void supp_eap_tls_sec_prot_delete_tls(sec_prot_t *prot);
9595

9696
static void supp_eap_tls_sec_prot_seq_id_update(sec_prot_t *prot);
@@ -360,16 +360,16 @@ static int8_t supp_eap_tls_sec_prot_tls_send(sec_prot_t *tls_prot, void *pdu, ui
360360
return 0;
361361
}
362362

363-
static void supp_eap_tls_sec_prot_init_tls(sec_prot_t *prot)
363+
static int8_t supp_eap_tls_sec_prot_init_tls(sec_prot_t *prot)
364364
{
365365
eap_tls_sec_prot_int_t *data = eap_tls_sec_prot_get(prot);
366366
if (data->tls_prot) {
367-
return;
367+
return 0;
368368
}
369369

370370
data->tls_prot = prot->type_get(prot, SEC_PROT_TYPE_TLS);
371371
if (!data->tls_prot) {
372-
return;
372+
return -1;
373373
}
374374

375375
data->tls_prot->header_size = TLS_HEAD_LEN;
@@ -381,6 +381,8 @@ static void supp_eap_tls_sec_prot_init_tls(sec_prot_t *prot)
381381
data->tls_prot->send = supp_eap_tls_sec_prot_tls_send;
382382

383383
data->tls_ongoing = true;
384+
385+
return 0;
384386
}
385387

386388
static void supp_eap_tls_sec_prot_delete_tls(sec_prot_t *prot)
@@ -400,7 +402,9 @@ static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
400402
// EAP-TLS supplicant state machine
401403
switch (sec_prot_state_get(&data->common)) {
402404
case EAP_TLS_STATE_INIT:
405+
tr_info("EAP-TLS init");
403406
sec_prot_state_set(prot, &data->common, EAP_TLS_STATE_REQUEST_ID);
407+
prot->timer_start(prot);
404408
break;
405409

406410
// Wait EAP request, Identity (starts handshake on supplicant)
@@ -411,13 +415,14 @@ static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
411415
return;
412416
}
413417

418+
// Set default timeout for the total maximum length of the negotiation
419+
sec_prot_default_timeout_set(&data->common);
420+
414421
// Store sequence ID
415422
supp_eap_tls_sec_prot_seq_id_update(prot);
416423

417424
tr_info("EAP-TLS start");
418425

419-
prot->timer_start(prot);
420-
421426
// Send KMP-CREATE.indication
422427
prot->create_ind(prot);
423428
sec_prot_state_set(prot, &data->common, EAP_TLS_STATE_CREATE_RESP);
@@ -459,7 +464,10 @@ static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
459464
data->common.ticks = retry_timeout;
460465

461466
// Initialize TLS protocol
462-
supp_eap_tls_sec_prot_init_tls(prot);
467+
if (supp_eap_tls_sec_prot_init_tls(prot) < 0) {
468+
tr_error("TLS init failed");
469+
return;
470+
}
463471
// Request TLS to start (send client hello)
464472
data->tls_prot->create_req(data->tls_prot, prot->sec_keys);
465473
break;
@@ -523,6 +531,7 @@ static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
523531
break;
524532

525533
case EAP_TLS_STATE_FINISHED:
534+
tr_info("EAP-TLS finished");
526535
supp_eap_tls_sec_prot_delete_tls(prot);
527536
prot->timer_stop(prot);
528537
prot->finished(prot);

‎source/Security/protocols/fwh_sec_prot/auth_fwh_sec_prot.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -341,6 +341,7 @@ static void auth_fwh_sec_prot_state_machine(sec_prot_t *prot)
341341
// 4WH authenticator state machine
342342
switch (sec_prot_state_get(&data->common)) {
343343
case FWH_STATE_INIT:
344+
tr_info("4WH: init");
344345
prot->timer_start(prot);
345346
sec_prot_state_set(prot, &data->common, FWH_STATE_CREATE_REQ);
346347
break;
@@ -349,6 +350,9 @@ static void auth_fwh_sec_prot_state_machine(sec_prot_t *prot)
349350
case FWH_STATE_CREATE_REQ:
350351
tr_info("4WH: start, eui-64: %s", trace_array(sec_prot_remote_eui_64_addr_get(prot), 8));
351352

353+
// Set default timeout for the total maximum length of the negotiation
354+
sec_prot_default_timeout_set(&data->common);
355+
352356
uint8_t *pmk = sec_prot_keys_pmk_get(prot->sec_keys);
353357
if (!pmk) { // If PMK is not set fails
354358
prot->create_conf(prot, SEC_RESULT_ERROR);
@@ -429,10 +433,13 @@ static void auth_fwh_sec_prot_state_machine(sec_prot_t *prot)
429433
sec_prot_state_set(prot, &data->common, FWH_STATE_FINISHED);
430434
break;
431435

432-
case FWH_STATE_FINISHED:
436+
case FWH_STATE_FINISHED: {
437+
uint8_t *remote_eui_64 = sec_prot_remote_eui_64_addr_get(prot);
438+
tr_info("4WH: finished, eui-64: %s", remote_eui_64 ? trace_array(sec_prot_remote_eui_64_addr_get(prot), 8) : "not set");
433439
prot->timer_stop(prot);
434440
prot->finished(prot);
435441
break;
442+
}
436443

437444
default:
438445
break;

‎source/Security/protocols/fwh_sec_prot/supp_fwh_sec_prot.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,7 @@ static void supp_fwh_sec_prot_state_machine(sec_prot_t *prot)
310310
// 4WH supplicant state machine
311311
switch (sec_prot_state_get(&data->common)) {
312312
case FWH_STATE_INIT:
313+
tr_info("4WH: init");
313314
prot->timer_start(prot);
314315
sec_prot_state_set(prot, &data->common, FWH_STATE_MESSAGE_1);
315316
break;
@@ -325,6 +326,9 @@ static void supp_fwh_sec_prot_state_machine(sec_prot_t *prot)
325326
return;
326327
}
327328

329+
// Set default timeout for the total maximum length of the negotiation
330+
sec_prot_default_timeout_set(&data->common);
331+
328332
tr_info("4WH: start");
329333

330334
// Store authenticator nonce for check when 4WH Message 3 is received
@@ -467,6 +471,7 @@ static void supp_fwh_sec_prot_state_machine(sec_prot_t *prot)
467471
break;
468472

469473
case FWH_STATE_FINISHED:
474+
tr_info("4WH: finished");
470475
prot->timer_stop(prot);
471476
prot->finished(prot);
472477
break;

‎source/Security/protocols/gkh_sec_prot/auth_gkh_sec_prot.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -293,14 +293,17 @@ static void auth_gkh_sec_prot_state_machine(sec_prot_t *prot)
293293
// GKH authenticator state machine
294294
switch (sec_prot_state_get(&data->common)) {
295295
case GKH_STATE_INIT:
296+
tr_info("GKH init");
296297
sec_prot_state_set(prot, &data->common, GKH_STATE_CREATE_REQ);
298+
prot->timer_start(prot);
297299
break;
298300

299301
// Wait KMP-CREATE.request
300302
case GKH_STATE_CREATE_REQ:
301303
tr_info("GKH start, eui-64: %s", trace_array(sec_prot_remote_eui_64_addr_get(prot), 8));
302304

303-
prot->timer_start(prot);
305+
// Set default timeout for the total maximum length of the negotiation
306+
sec_prot_default_timeout_set(&data->common);
304307

305308
// KMP-CREATE.confirm
306309
prot->create_conf(prot, SEC_RESULT_OK);
@@ -340,10 +343,13 @@ static void auth_gkh_sec_prot_state_machine(sec_prot_t *prot)
340343
sec_prot_state_set(prot, &data->common, GKH_STATE_FINISHED);
341344
break;
342345

343-
case GKH_STATE_FINISHED:
346+
case GKH_STATE_FINISHED: {
347+
uint8_t *remote_eui_64 = sec_prot_remote_eui_64_addr_get(prot);
348+
tr_info("GKH finished, eui-64: %s", remote_eui_64 ? trace_array(sec_prot_remote_eui_64_addr_get(prot), 8) : "not set");
344349
prot->timer_stop(prot);
345350
prot->finished(prot);
346351
break;
352+
}
347353

348354
default:
349355
break;

‎source/Security/protocols/gkh_sec_prot/supp_gkh_sec_prot.c

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -230,7 +230,9 @@ static void supp_gkh_sec_prot_state_machine(sec_prot_t *prot)
230230
// GKH supplicant state machine
231231
switch (sec_prot_state_get(&data->common)) {
232232
case GKH_STATE_INIT:
233+
tr_info("GKH init");
233234
sec_prot_state_set(prot, &data->common, GKH_STATE_MESSAGE_1);
235+
prot->timer_start(prot);
234236
break;
235237

236238
// Wait GKH message 1 (starts handshake on supplicant)
@@ -243,11 +245,12 @@ static void supp_gkh_sec_prot_state_machine(sec_prot_t *prot)
243245
return;
244246
}
245247

246-
supp_gkh_sec_prot_security_replay_counter_update(prot);
248+
// Set default timeout for the total maximum length of the negotiation
249+
sec_prot_default_timeout_set(&data->common);
247250

248-
tr_debug("GKH start");
251+
supp_gkh_sec_prot_security_replay_counter_update(prot);
249252

250-
prot->timer_start(prot);
253+
tr_info("GKH start");
251254

252255
// Send KMP-CREATE.indication
253256
prot->create_ind(prot);
@@ -267,14 +270,15 @@ static void supp_gkh_sec_prot_state_machine(sec_prot_t *prot)
267270
break;
268271

269272
case GKH_STATE_FINISH:
270-
tr_debug("GKH finish");
273+
tr_info("GKH finish");
271274

272275
// KMP-FINISHED.indication,
273276
prot->finished_ind(prot, sec_prot_result_get(&data->common), prot->sec_keys);
274277
sec_prot_state_set(prot, &data->common, GKH_STATE_FINISHED);
275278
break;
276279

277280
case GKH_STATE_FINISHED:
281+
tr_info("GKH finished");
278282
prot->timer_stop(prot);
279283
prot->finished(prot);
280284
break;

‎source/Security/protocols/sec_prot_lib.c

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ void sec_prot_init(sec_prot_common_t *data)
4848
{
4949
data->state = SEC_STATE_INIT;
5050
data->result = SEC_RESULT_OK;
51-
data->ticks = SEC_TOTAL_TIMEOUT;
51+
data->ticks = SEC_INIT_TIMEOUT;
5252
data->trickle_running = false;
5353
}
5454

@@ -73,10 +73,14 @@ void sec_prot_timer_timeout_handle(sec_prot_t *prot, sec_prot_common_t *data, co
7373
if (data->ticks > ticks) {
7474
data->ticks -= ticks;
7575
} else {
76-
tr_debug("prot timeout");
76+
tr_debug("prot timeout, state: %i", data->state);
7777
data->ticks = 0;
7878
sec_prot_result_set(data, SEC_RESULT_TIMEOUT);
79-
sec_prot_state_set(prot, data, SEC_STATE_FINISH);
79+
if (data->state == SEC_STATE_INIT) {
80+
sec_prot_state_set(prot, data, SEC_STATE_FINISHED);
81+
} else {
82+
sec_prot_state_set(prot, data, SEC_STATE_FINISH);
83+
}
8084
}
8185
}
8286

@@ -167,6 +171,11 @@ bool sec_prot_result_ok_check(sec_prot_common_t *data)
167171
return false;
168172
}
169173

174+
void sec_prot_default_timeout_set(sec_prot_common_t *data)
175+
{
176+
data->ticks = SEC_TOTAL_TIMEOUT;
177+
}
178+
170179
void sec_prot_lib_nonce_generate(uint8_t *nonce)
171180
{
172181
// Use randlib

‎source/Security/protocols/sec_prot_lib.h

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
#define FWH_NONCE_LENGTH 32
3333
#define EUI64_LEN 8
3434
#define SEC_TOTAL_TIMEOUT 30 * 60 * 10 // 30 minutes
35+
#define SEC_INIT_TIMEOUT 60 * 10 // 60 seconds
3536
#define SEC_FINISHED_TIMEOUT 5 * 10 // 5 seconds
3637

3738

@@ -295,4 +296,12 @@ bool sec_prot_result_timeout_check(sec_prot_common_t *data);
295296
*/
296297
bool sec_prot_result_ok_check(sec_prot_common_t *data);
297298

299+
/**
300+
* sec_prot_default_timeout_set sets default timeout for protocol
301+
*
302+
* \param data common data
303+
*
304+
*/
305+
void sec_prot_default_timeout_set(sec_prot_common_t *data);
306+
298307
#endif /* SEC_PROT_LIB_H_ */

0 commit comments

Comments
 (0)