src/pae/ieee802_1x_kay.c

   1 /*
   2  * IEEE 802.1X-2010 Key Agree Protocol of PAE state machine
   3  * Copyright (c) 2013, Qualcomm Atheros, Inc.
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include <time.h>
  10 #include "includes.h"
  11 #include "common.h"
  12 #include "list.h"
  13 #include "eloop.h"
  14 #include "wpabuf.h"
  15 #include "state_machine.h"
  16 #include "l2_packet/l2_packet.h"
  17 #include "common/eapol_common.h"
  18 #include "crypto/aes_wrap.h"
  19 #include "ieee802_1x_cp.h"
  20 #include "ieee802_1x_key.h"
  21 #include "ieee802_1x_kay.h"
  22 #include "ieee802_1x_kay_i.h"
  23 #include "ieee802_1x_secy_ops.h"
  24
  25
  26 #define DEFAULT_SA_KEY_LEN      16
  27 #define DEFAULT_ICV_LEN         16
  28 #define MAX_ICV_LEN             32  /* 32 bytes, 256 bits */
  29
  30 #define PENDING_PN_EXHAUSTION 0xC0000000
  31
  32 #define MKA_ALIGN_LENGTH(len) (((len) + 0x3) & ~0x3)
  33
  34 /* IEEE Std 802.1X-2010, Table 9-1 - MKA Algorithm Agility */
  35 #define MKA_ALGO_AGILITY_2009 { 0x00, 0x80, 0xC2, 0x01 }
  36 static u8 mka_algo_agility[4] = MKA_ALGO_AGILITY_2009;
  37
  38 /* IEEE802.1AE-2006 Table 14-1 MACsec Cipher Suites */
  39 static struct macsec_ciphersuite cipher_suite_tbl[] = {
  40         /* GCM-AES-128 */
  41         {
  42                 .id = CS_ID_GCM_AES_128,
  43                 .name = CS_NAME_GCM_AES_128,
  44                 .capable = MACSEC_CAP_INTEG_AND_CONF_0_30_50,
  45                 .sak_len = DEFAULT_SA_KEY_LEN,
  46                 .index = 0,
  47         },
  48 };
  49 #define CS_TABLE_SIZE (ARRAY_SIZE(cipher_suite_tbl))
  50 #define DEFAULT_CS_INDEX  0
  51
  52 static struct mka_alg mka_alg_tbl[] = {
  53         {
  54                 .parameter = MKA_ALGO_AGILITY_2009,
  55
  56                 /* 128-bit CAK, KEK, ICK, ICV */
  57                 .cak_len = DEFAULT_ICV_LEN,
  58                 .kek_len = DEFAULT_ICV_LEN,
  59                 .ick_len = DEFAULT_ICV_LEN,
  60                 .icv_len = DEFAULT_ICV_LEN,
  61
  62                 .cak_trfm = ieee802_1x_cak_128bits_aes_cmac,
  63                 .ckn_trfm = ieee802_1x_ckn_128bits_aes_cmac,
  64                 .kek_trfm = ieee802_1x_kek_128bits_aes_cmac,
  65                 .ick_trfm = ieee802_1x_ick_128bits_aes_cmac,
  66                 .icv_hash = ieee802_1x_icv_128bits_aes_cmac,
  67
  68                 .index = 1,
  69         },
  70 };
  71 #define MKA_ALG_TABLE_SIZE (ARRAY_SIZE(mka_alg_tbl))
  72
  73
  74 static int is_ki_equal(struct ieee802_1x_mka_ki *ki1,
  75                        struct ieee802_1x_mka_ki *ki2)
  76 {
  77         return os_memcmp(ki1->mi, ki2->mi, MI_LEN) == 0 &&
  78                 ki1->kn == ki2->kn;
  79 }
  80
  81
  82 static void set_mka_param_body_len(void *body, unsigned int len)
  83 {
  84         struct ieee802_1x_mka_hdr *hdr = body;
  85         hdr->length = (len >> 8) & 0x0f;
  86         hdr->length1 = len & 0xff;
  87 }
  88
  89
  90 static unsigned int get_mka_param_body_len(const void *body)
  91 {
  92         const struct ieee802_1x_mka_hdr *hdr = body;
  93         return (hdr->length << 8) | hdr->length1;
  94 }
  95
  96
  97 static u8 get_mka_param_body_type(const void *body)
  98 {
  99         const struct ieee802_1x_mka_hdr *hdr = body;
 100         return hdr->type;
 101 }
 102
 103
 104 /**
 105  * ieee802_1x_mka_dump_basic_body -
 106  */
 107 static void
 108 ieee802_1x_mka_dump_basic_body(struct ieee802_1x_mka_basic_body *body)
 109 {
 110         size_t body_len;
 111
 112         if (!body)
 113                 return;
 114
 115         body_len = get_mka_param_body_len(body);
 116         wpa_printf(MSG_DEBUG, "*** MKA Basic Parameter set ***");
 117         wpa_printf(MSG_DEBUG, "\tVersion.......: %d", body->version);
 118         wpa_printf(MSG_DEBUG, "\tPriority......: %d", body->priority);
 119         wpa_printf(MSG_DEBUG, "\tKeySvr........: %d", body->key_server);
 120         wpa_printf(MSG_DEBUG, "\tMACSecDesired.: %d", body->macsec_desired);
 121         wpa_printf(MSG_DEBUG, "\tMACSecCapable.: %d", body->macsec_capability);
 122         wpa_printf(MSG_DEBUG, "\tBody Length...: %zu", body_len);
 123         wpa_printf(MSG_DEBUG, "\tSCI MAC.......: " MACSTR,
 124                    MAC2STR(body->actor_sci.addr));
 125         wpa_printf(MSG_DEBUG, "\tSCI Port .....: %d",
 126                    be_to_host16(body->actor_sci.port));
 127         wpa_hexdump(MSG_DEBUG, "\tMember Id.....:",
 128                     body->actor_mi, sizeof(body->actor_mi));
 129         wpa_printf(MSG_DEBUG, "\tMessage Number: %d",
 130                    be_to_host32(body->actor_mn));
 131         wpa_hexdump(MSG_DEBUG, "\tAlgo Agility..:",
 132                     body->algo_agility, sizeof(body->algo_agility));
 133         wpa_hexdump_ascii(MSG_DEBUG, "\tCAK Name......:", body->ckn,
 134                           body_len + MKA_HDR_LEN - sizeof(*body));
 135 }
 136
 137
 138 /**
 139  * ieee802_1x_mka_dump_peer_body -
 140  */
 141 static void
 142 ieee802_1x_mka_dump_peer_body(struct ieee802_1x_mka_peer_body *body)
 143 {
 144         size_t body_len;
 145         size_t i;
 146         u8 *mi;
 147         be32 mn;
 148
 149         if (body == NULL)
 150                 return;
 151
 152         body_len = get_mka_param_body_len(body);
 153         if (body->type == MKA_LIVE_PEER_LIST) {
 154                 wpa_printf(MSG_DEBUG, "*** Live Peer List ***");
 155                 wpa_printf(MSG_DEBUG, "\tBody Length...: %zu", body_len);
 156         } else if (body->type == MKA_POTENTIAL_PEER_LIST) {
 157                 wpa_printf(MSG_DEBUG, "*** Potential Live Peer List ***");
 158                 wpa_printf(MSG_DEBUG, "\tBody Length...: %zu", body_len);
 159         }
 160
 161         for (i = 0; i < body_len; i += MI_LEN + sizeof(mn)) {
 162                 mi = body->peer + i;
 163                 os_memcpy(&mn, mi + MI_LEN, sizeof(mn));
 164                 wpa_hexdump_ascii(MSG_DEBUG, "\tMember Id.....:", mi, MI_LEN);
 165                 wpa_printf(MSG_DEBUG, "\tMessage Number: %d", be_to_host32(mn));
 166         }
 167 }
 168
 169
 170 /**
 171  * ieee802_1x_mka_dump_dist_sak_body -
 172  */
 173 static void
 174 ieee802_1x_mka_dump_dist_sak_body(struct ieee802_1x_mka_dist_sak_body *body)
 175 {
 176         size_t body_len;
 177
 178         if (body == NULL)
 179                 return;
 180
 181         body_len = get_mka_param_body_len(body);
 182         wpa_printf(MSG_INFO, "*** Distributed SAK ***");
 183         wpa_printf(MSG_INFO, "\tDistributed AN........: %d", body->dan);
 184         wpa_printf(MSG_INFO, "\tConfidentiality Offset: %d",
 185                    body->confid_offset);
 186         wpa_printf(MSG_INFO, "\tBody Length...........: %zu", body_len);
 187         if (!body_len)
 188                 return;
 189
 190         wpa_printf(MSG_INFO, "\tKey Number............: %d",
 191                    be_to_host32(body->kn));
 192         wpa_hexdump(MSG_INFO, "\tAES Key Wrap of SAK...:", body->sak, 24);
 193 }
 194
 195
 196 static const char * yes_no(int val)
 197 {
 198         return val ? "Yes" : "No";
 199 }
 200
 201
 202 /**
 203  * ieee802_1x_mka_dump_sak_use_body -
 204  */
 205 static void
 206 ieee802_1x_mka_dump_sak_use_body(struct ieee802_1x_mka_sak_use_body *body)
 207 {
 208         int body_len;
 209
 210         if (body == NULL)
 211                 return;
 212
 213         body_len = get_mka_param_body_len(body);
 214         wpa_printf(MSG_DEBUG, "*** MACsec SAK Use ***");
 215         wpa_printf(MSG_DEBUG, "\tLatest Key AN....: %d", body->lan);
 216         wpa_printf(MSG_DEBUG, "\tLatest Key Tx....: %s", yes_no(body->ltx));
 217         wpa_printf(MSG_DEBUG, "\tLatest Key Rx....: %s", yes_no(body->lrx));
 218         wpa_printf(MSG_DEBUG, "\tOld Key AN....: %d", body->oan);
 219         wpa_printf(MSG_DEBUG, "\tOld Key Tx....: %s", yes_no(body->otx));
 220         wpa_printf(MSG_DEBUG, "\tOld Key Rx....: %s", yes_no(body->orx));
 221         wpa_printf(MSG_DEBUG, "\tPlain Key Tx....: %s", yes_no(body->ptx));
 222         wpa_printf(MSG_DEBUG, "\tPlain Key Rx....: %s", yes_no(body->prx));
 223         wpa_printf(MSG_DEBUG, "\tDelay Protect....: %s",
 224                    yes_no(body->delay_protect));
 225         wpa_printf(MSG_DEBUG, "\tBody Length......: %d", body_len);
 226         if (!body_len)
 227                 return;
 228
 229         wpa_hexdump(MSG_DEBUG, "\tKey Server MI....:",
 230                     body->lsrv_mi, sizeof(body->lsrv_mi));
 231         wpa_printf(MSG_DEBUG, "\tKey Number.......: %u",
 232                    be_to_host32(body->lkn));
 233         wpa_printf(MSG_DEBUG, "\tLowest PN........: %u",
 234                    be_to_host32(body->llpn));
 235         wpa_hexdump_ascii(MSG_DEBUG, "\tOld Key Server MI....:",
 236                           body->osrv_mi, sizeof(body->osrv_mi));
 237         wpa_printf(MSG_DEBUG, "\tOld Key Number.......: %u",
 238                    be_to_host32(body->okn));
 239         wpa_printf(MSG_DEBUG, "\tOld Lowest PN........: %u",
 240                    be_to_host32(body->olpn));
 241 }
 242
 243
 244 /**
 245  * ieee802_1x_kay_get_participant -
 246  */
 247 static struct ieee802_1x_mka_participant *
 248 ieee802_1x_kay_get_participant(struct ieee802_1x_kay *kay, const u8 *ckn)
 249 {
 250         struct ieee802_1x_mka_participant *participant;
 251
 252         dl_list_for_each(participant, &kay->participant_list,
 253                          struct ieee802_1x_mka_participant, list) {
 254                 if (os_memcmp(participant->ckn.name, ckn,
 255                               participant->ckn.len) == 0)
 256                         return participant;
 257         }
 258
 259         wpa_printf(MSG_DEBUG, "KaY: participant is not found");
 260
 261         return NULL;
 262 }
 263
 264
 265 /**
 266  * ieee802_1x_kay_get_principal_participant -
 267  */
 268 static struct ieee802_1x_mka_participant *
 269 ieee802_1x_kay_get_principal_participant(struct ieee802_1x_kay *kay)
 270 {
 271         struct ieee802_1x_mka_participant *participant;
 272
 273         dl_list_for_each(participant, &kay->participant_list,
 274                          struct ieee802_1x_mka_participant, list) {
 275                 if (participant->principal)
 276                         return participant;
 277         }
 278
 279         wpa_printf(MSG_DEBUG, "KaY: principal participant is not found");
 280         return NULL;
 281 }
 282
 283
 284 static struct ieee802_1x_kay_peer * get_peer_mi(struct dl_list *peers,
 285                                                 const u8 *mi)
 286 {
 287         struct ieee802_1x_kay_peer *peer;
 288
 289         dl_list_for_each(peer, peers, struct ieee802_1x_kay_peer, list) {
 290                 if (os_memcmp(peer->mi, mi, MI_LEN) == 0)
 291                         return peer;
 292         }
 293
 294         return NULL;
 295 }
 296
 297
 298 /**
 299  * ieee802_1x_kay_get_potential_peer
 300  */
 301 static struct ieee802_1x_kay_peer *
 302 ieee802_1x_kay_get_potential_peer(
 303         struct ieee802_1x_mka_participant *participant, const u8 *mi)
 304 {
 305         return get_peer_mi(&participant->potential_peers, mi);
 306 }
 307
 308
 309 /**
 310  * ieee802_1x_kay_get_live_peer
 311  */
 312 static struct ieee802_1x_kay_peer *
 313 ieee802_1x_kay_get_live_peer(struct ieee802_1x_mka_participant *participant,
 314                              const u8 *mi)
 315 {
 316         return get_peer_mi(&participant->live_peers, mi);
 317 }
 318
 319
 320 /**
 321  * ieee802_1x_kay_is_in_potential_peer
 322  */
 323 static Boolean
 324 ieee802_1x_kay_is_in_potential_peer(
 325         struct ieee802_1x_mka_participant *participant, const u8 *mi)
 326 {
 327         return ieee802_1x_kay_get_potential_peer(participant, mi) != NULL;
 328 }
 329
 330
 331 /**
 332  * ieee802_1x_kay_is_in_live_peer
 333  */
 334 static Boolean
 335 ieee802_1x_kay_is_in_live_peer(
 336         struct ieee802_1x_mka_participant *participant, const u8 *mi)
 337 {
 338         return ieee802_1x_kay_get_live_peer(participant, mi) != NULL;
 339 }
 340
 341
 342 /**
 343  * ieee802_1x_kay_get_peer
 344  */
 345 static struct ieee802_1x_kay_peer *
 346 ieee802_1x_kay_get_peer(struct ieee802_1x_mka_participant *participant,
 347                         const u8 *mi)
 348 {
 349         struct ieee802_1x_kay_peer *peer;
 350
 351         peer = ieee802_1x_kay_get_live_peer(participant, mi);
 352         if (peer)
 353                 return peer;
 354
 355         return ieee802_1x_kay_get_potential_peer(participant, mi);
 356 }
 357
 358
 359 /**
 360  * ieee802_1x_kay_get_cipher_suite
 361  */
 362 static struct macsec_ciphersuite *
 363 ieee802_1x_kay_get_cipher_suite(struct ieee802_1x_mka_participant *participant,
 364                                 const u8 *cs_id)
 365 {
 366         unsigned int i;
 367         u64 cs;
 368         be64 _cs;
 369
 370         os_memcpy(&_cs, cs_id, CS_ID_LEN);
 371         cs = be_to_host64(_cs);
 372
 373         for (i = 0; i < CS_TABLE_SIZE; i++) {
 374                 if (cipher_suite_tbl[i].id == cs)
 375                         return &cipher_suite_tbl[i];
 376         }
 377
 378         return NULL;
 379 }
 380
 381
 382 static Boolean sci_equal(const struct ieee802_1x_mka_sci *a,
 383                          const struct ieee802_1x_mka_sci *b)
 384 {
 385         return os_memcmp(a, b, sizeof(struct ieee802_1x_mka_sci)) == 0;
 386 }
 387
 388
 389 /**
 390  * ieee802_1x_kay_get_peer_sci
 391  */
 392 static struct ieee802_1x_kay_peer *
 393 ieee802_1x_kay_get_peer_sci(struct ieee802_1x_mka_participant *participant,
 394                             const struct ieee802_1x_mka_sci *sci)
 395 {
 396         struct ieee802_1x_kay_peer *peer;
 397
 398         dl_list_for_each(peer, &participant->live_peers,
 399                          struct ieee802_1x_kay_peer, list) {
 400                 if (sci_equal(&peer->sci, sci))
 401                         return peer;
 402         }
 403
 404         dl_list_for_each(peer, &participant->potential_peers,
 405                          struct ieee802_1x_kay_peer, list) {
 406                 if (sci_equal(&peer->sci, sci))
 407                         return peer;
 408         }
 409
 410         return NULL;
 411 }
 412
 413
 414 /**
 415  * ieee802_1x_kay_init_receive_sa -
 416  */
 417 static struct receive_sa *
 418 ieee802_1x_kay_init_receive_sa(struct receive_sc *psc, u8 an, u32 lowest_pn,
 419                                struct data_key *key)
 420 {
 421         struct receive_sa *psa;
 422
 423         if (!psc || !key)
 424                 return NULL;
 425
 426         psa = os_zalloc(sizeof(*psa));
 427         if (!psa) {
 428                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
 429                 return NULL;
 430         }
 431
 432         psa->pkey = key;
 433         psa->lowest_pn = lowest_pn;
 434         psa->next_pn = lowest_pn;
 435         psa->an = an;
 436         psa->sc = psc;
 437
 438         os_get_time(&psa->created_time);
 439         psa->in_use = FALSE;
 440
 441         dl_list_add(&psc->sa_list, &psa->list);
 442         wpa_printf(MSG_DEBUG,
 443                    "KaY: Create receive SA(AN: %hhu lowest_pn: %u of SC(channel: %d)",
 444                    an, lowest_pn, psc->channel);
 445
 446         return psa;
 447 }
 448
 449
 450 /**
 451  * ieee802_1x_kay_deinit_receive_sa -
 452  */
 453 static void ieee802_1x_kay_deinit_receive_sa(struct receive_sa *psa)
 454 {
 455         psa->pkey = NULL;
 456         wpa_printf(MSG_DEBUG,
 457                    "KaY: Delete receive SA(an: %hhu) of SC",
 458                    psa->an);
 459         dl_list_del(&psa->list);
 460         os_free(psa);
 461 }
 462
 463
 464 /**
 465  * ieee802_1x_kay_init_receive_sc -
 466  */
 467 static struct receive_sc *
 468 ieee802_1x_kay_init_receive_sc(const struct ieee802_1x_mka_sci *psci,
 469                                int channel)
 470 {
 471         struct receive_sc *psc;
 472
 473         if (!psci)
 474                 return NULL;
 475
 476         psc = os_zalloc(sizeof(*psc));
 477         if (!psc) {
 478                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
 479                 return NULL;
 480         }
 481
 482         os_memcpy(&psc->sci, psci, sizeof(psc->sci));
 483         psc->channel = channel;
 484
 485         os_get_time(&psc->created_time);
 486         psc->receiving = FALSE;
 487
 488         dl_list_init(&psc->sa_list);
 489         wpa_printf(MSG_DEBUG, "KaY: Create receive SC(channel: %d)", channel);
 490         wpa_hexdump(MSG_DEBUG, "SCI: ", (u8 *)psci, sizeof(*psci));
 491
 492         return psc;
 493 }
 494
 495
 496 /**
 497  * ieee802_1x_kay_deinit_receive_sc -
 498  **/
 499 static void
 500 ieee802_1x_kay_deinit_receive_sc(
 501         struct ieee802_1x_mka_participant *participant, struct receive_sc *psc)
 502 {
 503         struct receive_sa *psa, *pre_sa;
 504
 505         wpa_printf(MSG_DEBUG, "KaY: Delete receive SC(channel: %d)",
 506                    psc->channel);
 507         dl_list_for_each_safe(psa, pre_sa, &psc->sa_list, struct receive_sa,
 508                               list)  {
 509                 secy_disable_receive_sa(participant->kay, psa);
 510                 ieee802_1x_kay_deinit_receive_sa(psa);
 511         }
 512         dl_list_del(&psc->list);
 513         os_free(psc);
 514 }
 515
 516
 517 static void ieee802_1x_kay_dump_peer(struct ieee802_1x_kay_peer *peer)
 518 {
 519         wpa_hexdump(MSG_DEBUG, "\tMI: ", peer->mi, sizeof(peer->mi));
 520         wpa_printf(MSG_DEBUG, "\tMN: %d", peer->mn);
 521         wpa_hexdump(MSG_DEBUG, "\tSCI Addr: ", peer->sci.addr, ETH_ALEN);
 522         wpa_printf(MSG_DEBUG, "\tPort: %d", peer->sci.port);
 523 }
 524
 525
 526 static struct ieee802_1x_kay_peer *
 527 ieee802_1x_kay_create_peer(const u8 *mi, u32 mn)
 528 {
 529         struct ieee802_1x_kay_peer *peer;
 530
 531         peer = os_zalloc(sizeof(*peer));
 532         if (!peer) {
 533                 wpa_printf(MSG_ERROR, "KaY-%s: out of memory", __func__);
 534                 return NULL;
 535         }
 536
 537         os_memcpy(peer->mi, mi, MI_LEN);
 538         peer->mn = mn;
 539         peer->expire = time(NULL) + MKA_LIFE_TIME / 1000;
 540         peer->sak_used = FALSE;
 541
 542         return peer;
 543 }
 544
 545
 546 /**
 547  * ieee802_1x_kay_create_live_peer
 548  */
 549 static struct ieee802_1x_kay_peer *
 550 ieee802_1x_kay_create_live_peer(struct ieee802_1x_mka_participant *participant,
 551                                 const u8 *mi, u32 mn)
 552 {
 553         struct ieee802_1x_kay_peer *peer;
 554         struct receive_sc *rxsc;
 555         u32 sc_ch = 0;
 556
 557         peer = ieee802_1x_kay_create_peer(mi, mn);
 558         if (!peer)
 559                 return NULL;
 560
 561         os_memcpy(&peer->sci, &participant->current_peer_sci,
 562                   sizeof(peer->sci));
 563
 564         secy_get_available_receive_sc(participant->kay, &sc_ch);
 565
 566         rxsc = ieee802_1x_kay_init_receive_sc(&peer->sci, sc_ch);
 567         if (!rxsc) {
 568                 os_free(peer);
 569                 return NULL;
 570         }
 571
 572         dl_list_add(&participant->live_peers, &peer->list);
 573         dl_list_add(&participant->rxsc_list, &rxsc->list);
 574         secy_create_receive_sc(participant->kay, rxsc);
 575
 576         wpa_printf(MSG_DEBUG, "KaY: Live peer created");
 577         ieee802_1x_kay_dump_peer(peer);
 578
 579         return peer;
 580 }
 581
 582
 583 /**
 584  * ieee802_1x_kay_create_potential_peer
 585  */
 586 static struct ieee802_1x_kay_peer *
 587 ieee802_1x_kay_create_potential_peer(
 588         struct ieee802_1x_mka_participant *participant, const u8 *mi, u32 mn)
 589 {
 590         struct ieee802_1x_kay_peer *peer;
 591
 592         peer = ieee802_1x_kay_create_peer(mi, mn);
 593         if (!peer)
 594                 return NULL;
 595
 596         dl_list_add(&participant->potential_peers, &peer->list);
 597
 598         wpa_printf(MSG_DEBUG, "KaY: potential peer created");
 599         ieee802_1x_kay_dump_peer(peer);
 600
 601         return peer;
 602 }
 603
 604
 605 /**
 606  * ieee802_1x_kay_move_live_peer
 607  */
 608 static struct ieee802_1x_kay_peer *
 609 ieee802_1x_kay_move_live_peer(struct ieee802_1x_mka_participant *participant,
 610                               u8 *mi, u32 mn)
 611 {
 612         struct ieee802_1x_kay_peer *peer;
 613         struct receive_sc *rxsc;
 614         u32 sc_ch = 0;
 615
 616         peer = ieee802_1x_kay_get_potential_peer(participant, mi);
 617
 618         rxsc = ieee802_1x_kay_init_receive_sc(&participant->current_peer_sci,
 619                                               sc_ch);
 620         if (!rxsc)
 621                 return NULL;
 622
 623         os_memcpy(&peer->sci, &participant->current_peer_sci,
 624                   sizeof(peer->sci));
 625         peer->mn = mn;
 626         peer->expire = time(NULL) + MKA_LIFE_TIME / 1000;
 627
 628         wpa_printf(MSG_DEBUG, "KaY: move potential peer to live peer");
 629         ieee802_1x_kay_dump_peer(peer);
 630
 631         dl_list_del(&peer->list);
 632         dl_list_add_tail(&participant->live_peers, &peer->list);
 633
 634         secy_get_available_receive_sc(participant->kay, &sc_ch);
 635
 636         dl_list_add(&participant->rxsc_list, &rxsc->list);
 637         secy_create_receive_sc(participant->kay, rxsc);
 638
 639         return peer;
 640 }
 641
 642
 643
 644 /**
 645  *  ieee802_1x_mka_basic_body_present -
 646  */
 647 static Boolean
 648 ieee802_1x_mka_basic_body_present(
 649         struct ieee802_1x_mka_participant *participant)
 650 {
 651         return TRUE;
 652 }
 653
 654
 655 /**
 656  * ieee802_1x_mka_basic_body_length -
 657  */
 658 static int
 659 ieee802_1x_mka_basic_body_length(struct ieee802_1x_mka_participant *participant)
 660 {
 661         int length;
 662
 663         length = sizeof(struct ieee802_1x_mka_basic_body);
 664         length += participant->ckn.len;
 665         return MKA_ALIGN_LENGTH(length);
 666 }
 667
 668
 669 /**
 670  * ieee802_1x_mka_encode_basic_body
 671  */
 672 static int
 673 ieee802_1x_mka_encode_basic_body(
 674         struct ieee802_1x_mka_participant *participant,
 675         struct wpabuf *buf)
 676 {
 677         struct ieee802_1x_mka_basic_body *body;
 678         struct ieee802_1x_kay *kay = participant->kay;
 679         unsigned int length = ieee802_1x_mka_basic_body_length(participant);
 680
 681         body = wpabuf_put(buf, length);
 682
 683         body->version = kay->mka_version;
 684         body->priority = kay->actor_priority;
 685         if (participant->is_elected)
 686                 body->key_server = participant->is_key_server;
 687         else
 688                 body->key_server = participant->can_be_key_server;
 689
 690         body->macsec_desired = kay->macsec_desired;
 691         body->macsec_capability = kay->macsec_capable;
 692         set_mka_param_body_len(body, length - MKA_HDR_LEN);
 693
 694         os_memcpy(body->actor_sci.addr, kay->actor_sci.addr,
 695                   sizeof(kay->actor_sci.addr));
 696         body->actor_sci.port = kay->actor_sci.port;
 697
 698         os_memcpy(body->actor_mi, participant->mi, sizeof(body->actor_mi));
 699         participant->mn = participant->mn + 1;
 700         body->actor_mn = host_to_be32(participant->mn);
 701         os_memcpy(body->algo_agility, kay->algo_agility,
 702                   sizeof(body->algo_agility));
 703
 704         os_memcpy(body->ckn, participant->ckn.name, participant->ckn.len);
 705
 706         ieee802_1x_mka_dump_basic_body(body);
 707
 708         return 0;
 709 }
 710
 711
 712 static Boolean
 713 reset_participant_mi(struct ieee802_1x_mka_participant *participant)
 714 {
 715         if (os_get_random(participant->mi, sizeof(participant->mi)) < 0)
 716                 return FALSE;
 717         participant->mn = 0;
 718
 719         return TRUE;
 720 }
 721
 722
 723 /**
 724  * ieee802_1x_mka_decode_basic_body -
 725  */
 726 static struct ieee802_1x_mka_participant *
 727 ieee802_1x_mka_decode_basic_body(struct ieee802_1x_kay *kay, const u8 *mka_msg,
 728                                  size_t msg_len)
 729 {
 730         struct ieee802_1x_mka_participant *participant;
 731         const struct ieee802_1x_mka_basic_body *body;
 732         struct ieee802_1x_kay_peer *peer;
 733
 734         body = (const struct ieee802_1x_mka_basic_body *) mka_msg;
 735
 736         if (body->version > MKA_VERSION_ID) {
 737                 wpa_printf(MSG_DEBUG,
 738                            "KaY: peer's version(%d) greater than mka current version(%d)",
 739                            body->version, MKA_VERSION_ID);
 740         }
 741         if (kay->is_obliged_key_server && body->key_server) {
 742                 wpa_printf(MSG_DEBUG, "I must be as key server");
 743                 return NULL;
 744         }
 745
 746         participant = ieee802_1x_kay_get_participant(kay, body->ckn);
 747         if (!participant) {
 748                 wpa_printf(MSG_DEBUG, "Peer is not included in my CA");
 749                 return NULL;
 750         }
 751
 752         /* If the peer's MI is my MI, I will choose new MI */
 753         if (os_memcmp(body->actor_mi, participant->mi, MI_LEN) == 0) {
 754                 if (!reset_participant_mi(participant))
 755                         return NULL;
 756         }
 757
 758         os_memcpy(participant->current_peer_id.mi, body->actor_mi, MI_LEN);
 759         participant->current_peer_id.mn = body->actor_mn;
 760         os_memcpy(participant->current_peer_sci.addr, body->actor_sci.addr,
 761                   sizeof(participant->current_peer_sci.addr));
 762         participant->current_peer_sci.port = body->actor_sci.port;
 763
 764         /* handler peer */
 765         peer = ieee802_1x_kay_get_peer(participant, body->actor_mi);
 766         if (!peer) {
 767                 /* Check duplicated SCI */
 768                 /* TODO: What policy should be applied to detect duplicated SCI
 769                  * is active attacker or a valid peer whose MI is be changed?
 770                  */
 771                 peer = ieee802_1x_kay_get_peer_sci(participant,
 772                                                    &body->actor_sci);
 773                 if (peer) {
 774                         wpa_printf(MSG_WARNING,
 775                                    "KaY: duplicated SCI detected, Maybe active attacker");
 776                         dl_list_del(&peer->list);
 777                         os_free(peer);
 778                 }
 779
 780                 peer = ieee802_1x_kay_create_potential_peer(
 781                         participant, body->actor_mi,
 782                         be_to_host32(body->actor_mn));
 783                 if (!peer)
 784                         return NULL;
 785
 786                 peer->macsec_desired = body->macsec_desired;
 787                 peer->macsec_capability = body->macsec_capability;
 788                 peer->is_key_server = (Boolean) body->key_server;
 789                 peer->key_server_priority = body->priority;
 790         } else if (peer->mn < be_to_host32(body->actor_mn)) {
 791                 peer->mn = be_to_host32(body->actor_mn);
 792                 peer->expire = time(NULL) + MKA_LIFE_TIME / 1000;
 793                 peer->macsec_desired = body->macsec_desired;
 794                 peer->macsec_capability = body->macsec_capability;
 795                 peer->is_key_server = (Boolean) body->key_server;
 796                 peer->key_server_priority = body->priority;
 797         } else {
 798                 wpa_printf(MSG_WARNING, "KaY: The peer MN have received");
 799                 return NULL;
 800         }
 801
 802         return participant;
 803 }
 804
 805
 806 /**
 807  * ieee802_1x_mka_live_peer_body_present
 808  */
 809 static Boolean
 810 ieee802_1x_mka_live_peer_body_present(
 811         struct ieee802_1x_mka_participant *participant)
 812 {
 813         return !dl_list_empty(&participant->live_peers);
 814 }
 815
 816
 817 /**
 818  * ieee802_1x_kay_get_live_peer_length
 819  */
 820 static int
 821 ieee802_1x_mka_get_live_peer_length(
 822         struct ieee802_1x_mka_participant *participant)
 823 {
 824         int len = MKA_HDR_LEN;
 825         struct ieee802_1x_kay_peer *peer;
 826
 827         dl_list_for_each(peer, &participant->live_peers,
 828                          struct ieee802_1x_kay_peer, list)
 829                 len += sizeof(struct ieee802_1x_mka_peer_id);
 830
 831         return MKA_ALIGN_LENGTH(len);
 832 }
 833
 834
 835 /**
 836  * ieee802_1x_mka_encode_live_peer_body -
 837  */
 838 static int
 839 ieee802_1x_mka_encode_live_peer_body(
 840         struct ieee802_1x_mka_participant *participant,
 841         struct wpabuf *buf)
 842 {
 843         struct ieee802_1x_mka_peer_body *body;
 844         struct ieee802_1x_kay_peer *peer;
 845         unsigned int length;
 846         struct ieee802_1x_mka_peer_id *body_peer;
 847
 848         length = ieee802_1x_mka_get_live_peer_length(participant);
 849         body = wpabuf_put(buf, sizeof(struct ieee802_1x_mka_peer_body));
 850
 851         body->type = MKA_LIVE_PEER_LIST;
 852         set_mka_param_body_len(body, length - MKA_HDR_LEN);
 853
 854         dl_list_for_each(peer, &participant->live_peers,
 855                          struct ieee802_1x_kay_peer, list) {
 856                 body_peer = wpabuf_put(buf,
 857                                        sizeof(struct ieee802_1x_mka_peer_id));
 858                 os_memcpy(body_peer->mi, peer->mi, MI_LEN);
 859                 body_peer->mn = host_to_be32(peer->mn);
 860         }
 861
 862         ieee802_1x_mka_dump_peer_body(body);
 863         return 0;
 864 }
 865
 866 /**
 867  * ieee802_1x_mka_potential_peer_body_present
 868  */
 869 static Boolean
 870 ieee802_1x_mka_potential_peer_body_present(
 871         struct ieee802_1x_mka_participant *participant)
 872 {
 873         return !dl_list_empty(&participant->potential_peers);
 874 }
 875
 876
 877 /**
 878  * ieee802_1x_kay_get_potential_peer_length
 879  */
 880 static int
 881 ieee802_1x_mka_get_potential_peer_length(
 882         struct ieee802_1x_mka_participant *participant)
 883 {
 884         int len = MKA_HDR_LEN;
 885         struct ieee802_1x_kay_peer *peer;
 886
 887         dl_list_for_each(peer, &participant->potential_peers,
 888                          struct ieee802_1x_kay_peer, list)
 889                 len += sizeof(struct ieee802_1x_mka_peer_id);
 890
 891         return MKA_ALIGN_LENGTH(len);
 892 }
 893
 894
 895 /**
 896  * ieee802_1x_mka_encode_potential_peer_body -
 897  */
 898 static int
 899 ieee802_1x_mka_encode_potential_peer_body(
 900         struct ieee802_1x_mka_participant *participant,
 901         struct wpabuf *buf)
 902 {
 903         struct ieee802_1x_mka_peer_body *body;
 904         struct ieee802_1x_kay_peer *peer;
 905         unsigned int length;
 906         struct ieee802_1x_mka_peer_id *body_peer;
 907
 908         length = ieee802_1x_mka_get_potential_peer_length(participant);
 909         body = wpabuf_put(buf, sizeof(struct ieee802_1x_mka_peer_body));
 910
 911         body->type = MKA_POTENTIAL_PEER_LIST;
 912         set_mka_param_body_len(body, length - MKA_HDR_LEN);
 913
 914         dl_list_for_each(peer, &participant->potential_peers,
 915                          struct ieee802_1x_kay_peer, list) {
 916                 body_peer = wpabuf_put(buf,
 917                                        sizeof(struct ieee802_1x_mka_peer_id));
 918                 os_memcpy(body_peer->mi, peer->mi, MI_LEN);
 919                 body_peer->mn = host_to_be32(peer->mn);
 920         }
 921
 922         ieee802_1x_mka_dump_peer_body(body);
 923         return 0;
 924 }
 925
 926
 927 /**
 928  * ieee802_1x_mka_i_in_peerlist -
 929  */
 930 static Boolean
 931 ieee802_1x_mka_i_in_peerlist(struct ieee802_1x_mka_participant *participant,
 932                              const u8 *mka_msg, size_t msg_len)
 933 {
 934         struct ieee802_1x_mka_hdr *hdr;
 935         size_t body_len;
 936         size_t left_len;
 937         u8 body_type;
 938         const u8 *pos;
 939         size_t i;
 940
 941         for (pos = mka_msg, left_len = msg_len;
 942              left_len > MKA_HDR_LEN + DEFAULT_ICV_LEN;
 943              left_len -= body_len + MKA_HDR_LEN,
 944                      pos += body_len + MKA_HDR_LEN) {
 945                 hdr = (struct ieee802_1x_mka_hdr *) pos;
 946                 body_len = get_mka_param_body_len(hdr);
 947                 body_type = get_mka_param_body_type(hdr);
 948
 949                 if (body_type != MKA_LIVE_PEER_LIST &&
 950                     body_type != MKA_POTENTIAL_PEER_LIST)
 951                         continue;
 952
 953                 ieee802_1x_mka_dump_peer_body(
 954                         (struct ieee802_1x_mka_peer_body *)pos);
 955
 956                 if (left_len < (MKA_HDR_LEN + body_len + DEFAULT_ICV_LEN)) {
 957                         wpa_printf(MSG_ERROR,
 958                                    "KaY: MKA Peer Packet Body Length (%zu bytes) is less than the Parameter Set Header Length (%zu bytes) + the Parameter Set Body Length (%zu bytes) + %d bytes of ICV",
 959                                    left_len, MKA_HDR_LEN,
 960                                    body_len, DEFAULT_ICV_LEN);
 961                         continue;
 962                 }
 963
 964                 if ((body_len % 16) != 0) {
 965                         wpa_printf(MSG_ERROR,
 966                                    "KaY: MKA Peer Packet Body Length (%zu bytes) should be a multiple of 16 octets",
 967                                    body_len);
 968                         continue;
 969                 }
 970
 971                 for (i = 0; i < body_len;
 972                      i += sizeof(struct ieee802_1x_mka_peer_id)) {
 973                         const struct ieee802_1x_mka_peer_id *peer_mi;
 974
 975                         peer_mi = (const struct ieee802_1x_mka_peer_id *)
 976                                 (pos + MKA_HDR_LEN + i);
 977                         if (os_memcmp(peer_mi->mi, participant->mi,
 978                                       MI_LEN) == 0 &&
 979                             be_to_host32(peer_mi->mn) == participant->mn)
 980                                 return TRUE;
 981                 }
 982         }
 983
 984         return FALSE;
 985 }
 986
 987
 988 /**
 989  * ieee802_1x_mka_decode_live_peer_body -
 990  */
 991 static int ieee802_1x_mka_decode_live_peer_body(
 992         struct ieee802_1x_mka_participant *participant,
 993         const u8 *peer_msg, size_t msg_len)
 994 {
 995         const struct ieee802_1x_mka_hdr *hdr;
 996         struct ieee802_1x_kay_peer *peer;
 997         size_t body_len;
 998         size_t i;
 999         Boolean is_included;
1000
1001         is_included = ieee802_1x_kay_is_in_live_peer(
1002                 participant, participant->current_peer_id.mi);
1003
1004         hdr = (const struct ieee802_1x_mka_hdr *) peer_msg;
1005         body_len = get_mka_param_body_len(hdr);
1006         if (body_len % 16 != 0) {
1007                 wpa_printf(MSG_ERROR,
1008                            "KaY: MKA Peer Packet Body Length (%zu bytes) should be a multiple of 16 octets",
1009                            body_len);
1010                 return -1;
1011         }
1012
1013         for (i = 0; i < body_len; i += sizeof(struct ieee802_1x_mka_peer_id)) {
1014                 const struct ieee802_1x_mka_peer_id *peer_mi;
1015                 u32 peer_mn;
1016
1017                 peer_mi = (const struct ieee802_1x_mka_peer_id *)
1018                         (peer_msg + MKA_HDR_LEN + i);
1019                 peer_mn = be_to_host32(peer_mi->mn);
1020
1021                 /* it is myself */
1022                 if (os_memcmp(peer_mi, participant->mi, MI_LEN) == 0) {
1023                         /* My message id is used by other participant */
1024                         if (peer_mn > participant->mn &&
1025                             !reset_participant_mi(participant))
1026                                 wpa_printf(MSG_DEBUG, "KaY: Could not update mi");
1027                         continue;
1028                 }
1029
1030                 if (!is_included)
1031                         continue;
1032
1033                 peer = ieee802_1x_kay_get_peer(participant, peer_mi->mi);
1034                 if (peer) {
1035                         peer->mn = peer_mn;
1036                         peer->expire = time(NULL) + MKA_LIFE_TIME / 1000;
1037                 } else if (!ieee802_1x_kay_create_potential_peer(
1038                                 participant, peer_mi->mi, peer_mn)) {
1039                         return -1;
1040                 }
1041         }
1042
1043         return 0;
1044 }
1045
1046
1047 /**
1048  * ieee802_1x_mka_decode_potential_peer_body -
1049  */
1050 static int
1051 ieee802_1x_mka_decode_potential_peer_body(
1052         struct ieee802_1x_mka_participant *participant,
1053         const u8 *peer_msg, size_t msg_len)
1054 {
1055         const struct ieee802_1x_mka_hdr *hdr;
1056         size_t body_len;
1057         size_t i;
1058
1059         hdr = (const struct ieee802_1x_mka_hdr *) peer_msg;
1060         body_len = get_mka_param_body_len(hdr);
1061         if (body_len % 16 != 0) {
1062                 wpa_printf(MSG_ERROR,
1063                            "KaY: MKA Peer Packet Body Length (%zu bytes) should be a multiple of 16 octets",
1064                            body_len);
1065                 return -1;
1066         }
1067
1068         for (i = 0; i < body_len; i += sizeof(struct ieee802_1x_mka_peer_id)) {
1069                 const struct ieee802_1x_mka_peer_id *peer_mi;
1070                 u32 peer_mn;
1071
1072                 peer_mi = (struct ieee802_1x_mka_peer_id *)
1073                         (peer_msg + MKA_HDR_LEN + i);
1074                 peer_mn = be_to_host32(peer_mi->mn);
1075
1076                 /* it is myself */
1077                 if (os_memcmp(peer_mi, participant->mi, MI_LEN) == 0) {
1078                         /* My message id is used by other participant */
1079                         if (peer_mn > participant->mn &&
1080                             !reset_participant_mi(participant))
1081                                 wpa_printf(MSG_DEBUG, "KaY: Could not update mi");
1082                         continue;
1083                 }
1084         }
1085
1086         return 0;
1087 }
1088
1089
1090 /**
1091  * ieee802_1x_mka_sak_use_body_present
1092  */
1093 static Boolean
1094 ieee802_1x_mka_sak_use_body_present(
1095         struct ieee802_1x_mka_participant *participant)
1096 {
1097         return participant->to_use_sak;
1098 }
1099
1100
1101 /**
1102  * ieee802_1x_mka_get_sak_use_length
1103  */
1104 static int
1105 ieee802_1x_mka_get_sak_use_length(
1106         struct ieee802_1x_mka_participant *participant)
1107 {
1108         int length = MKA_HDR_LEN;
1109
1110         if (participant->kay->macsec_desired && participant->advised_desired)
1111                 length = sizeof(struct ieee802_1x_mka_sak_use_body);
1112
1113         return MKA_ALIGN_LENGTH(length);
1114 }
1115
1116
1117 /**
1118  *
1119  */
1120 static u32
1121 ieee802_1x_mka_get_lpn(struct ieee802_1x_mka_participant *principal,
1122                        struct ieee802_1x_mka_ki *ki)
1123 {
1124         struct receive_sa *rxsa;
1125         struct receive_sc *rxsc;
1126         u32 lpn = 0;
1127
1128         dl_list_for_each(rxsc, &principal->rxsc_list, struct receive_sc, list) {
1129                 dl_list_for_each(rxsa, &rxsc->sa_list, struct receive_sa, list)
1130                 {
1131                         if (is_ki_equal(&rxsa->pkey->key_identifier, ki)) {
1132                                 secy_get_receive_lowest_pn(principal->kay,
1133                                                            rxsa);
1134
1135                                 lpn = lpn > rxsa->lowest_pn ?
1136                                         lpn : rxsa->lowest_pn;
1137                                 break;
1138                         }
1139                 }
1140         }
1141
1142         if (lpn == 0)
1143                 lpn = 1;
1144
1145         return lpn;
1146 }
1147
1148
1149 /**
1150  * ieee802_1x_mka_encode_sak_use_body -
1151  */
1152 static int
1153 ieee802_1x_mka_encode_sak_use_body(
1154         struct ieee802_1x_mka_participant *participant,
1155         struct wpabuf *buf)
1156 {
1157         struct ieee802_1x_mka_sak_use_body *body;
1158         struct ieee802_1x_kay *kay = participant->kay;
1159         unsigned int length;
1160         u32 pn = 1;
1161
1162         length = ieee802_1x_mka_get_sak_use_length(participant);
1163         body = wpabuf_put(buf, length);
1164
1165         body->type = MKA_SAK_USE;
1166         set_mka_param_body_len(body, length - MKA_HDR_LEN);
1167
1168         if (length == MKA_HDR_LEN) {
1169                 body->ptx = TRUE;
1170                 body->prx = TRUE;
1171                 body->lan = 0;
1172                 body->lrx = FALSE;
1173                 body->ltx = FALSE;
1174                 body->delay_protect = FALSE;
1175                 return 0;
1176         }
1177
1178         /* data protect, lowest accept packet number */
1179         body->delay_protect = kay->macsec_replay_protect;
1180         pn = ieee802_1x_mka_get_lpn(participant, &participant->lki);
1181         if (pn > kay->pn_exhaustion) {
1182                 wpa_printf(MSG_WARNING, "KaY: My LPN exhaustion");
1183                 if (participant->is_key_server)
1184                         participant->new_sak = TRUE;
1185         }
1186
1187         body->llpn = host_to_be32(pn);
1188         pn = ieee802_1x_mka_get_lpn(participant, &participant->oki);
1189         body->olpn = host_to_be32(pn);
1190
1191         /* plain tx, plain rx */
1192         body->ptx = !kay->macsec_protect;
1193         body->prx = kay->macsec_validate != Strict;
1194
1195         /* latest key: rx, tx, key server member identifier key number */
1196         body->lan = participant->lan;
1197         os_memcpy(body->lsrv_mi, participant->lki.mi, sizeof(body->lsrv_mi));
1198         body->lkn = host_to_be32(participant->lki.kn);
1199         body->lrx = participant->lrx;
1200         body->ltx = participant->ltx;
1201
1202         /* old key: rx, tx, key server member identifier key number */
1203         body->oan = participant->oan;
1204         if (participant->oki.kn != participant->lki.kn &&
1205             participant->oki.kn != 0) {
1206                 body->otx = TRUE;
1207                 body->orx = TRUE;
1208                 os_memcpy(body->osrv_mi, participant->oki.mi,
1209                           sizeof(body->osrv_mi));
1210                 body->okn = host_to_be32(participant->oki.kn);
1211         } else {
1212                 body->otx = FALSE;
1213                 body->orx = FALSE;
1214         }
1215
1216         /* set CP's variable */
1217         if (body->ltx) {
1218                 kay->tx_enable = TRUE;
1219                 kay->port_enable = TRUE;
1220         }
1221         if (body->lrx)
1222                 kay->rx_enable = TRUE;
1223
1224         ieee802_1x_mka_dump_sak_use_body(body);
1225         return 0;
1226 }
1227
1228
1229 /**
1230  * ieee802_1x_mka_decode_sak_use_body -
1231  */
1232 static int
1233 ieee802_1x_mka_decode_sak_use_body(
1234         struct ieee802_1x_mka_participant *participant,
1235         const u8 *mka_msg, size_t msg_len)
1236 {
1237         struct ieee802_1x_mka_hdr *hdr;
1238         struct ieee802_1x_mka_sak_use_body *body;
1239         struct ieee802_1x_kay_peer *peer;
1240         struct transmit_sa *txsa;
1241         struct data_key *sa_key = NULL;
1242         size_t body_len;
1243         struct ieee802_1x_mka_ki ki;
1244         u32 lpn;
1245         Boolean all_receiving;
1246         Boolean found;
1247         struct ieee802_1x_kay *kay = participant->kay;
1248
1249         if (!participant->principal) {
1250                 wpa_printf(MSG_WARNING, "KaY: Participant is not principal");
1251                 return -1;
1252         }
1253         peer = ieee802_1x_kay_get_live_peer(participant,
1254                                             participant->current_peer_id.mi);
1255         if (!peer) {
1256                 wpa_printf(MSG_WARNING, "KaY: the peer is not my live peer");
1257                 return -1;
1258         }
1259
1260         hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1261         body_len = get_mka_param_body_len(hdr);
1262         body = (struct ieee802_1x_mka_sak_use_body *) mka_msg;
1263         ieee802_1x_mka_dump_sak_use_body(body);
1264
1265         if ((body_len != 0) && (body_len < 40)) {
1266                 wpa_printf(MSG_ERROR,
1267                            "KaY: MKA Use SAK Packet Body Length (%zu bytes) should be 0, 40, or more octets",
1268                            body_len);
1269                 return -1;
1270         }
1271
1272         /* TODO: what action should I take when peer does not support MACsec */
1273         if (body_len == 0) {
1274                 wpa_printf(MSG_WARNING, "KaY: Peer does not support MACsec");
1275                 return 0;
1276         }
1277
1278         /* TODO: when the plain tx or rx of peer is true, should I change
1279          * the attribute of controlled port
1280          */
1281         if (body->prx)
1282                 wpa_printf(MSG_WARNING, "KaY: peer's plain rx are TRUE");
1283
1284         if (body->ptx)
1285                 wpa_printf(MSG_WARNING, "KaY: peer's plain tx are TRUE");
1286
1287         /* check latest key is valid */
1288         if (body->ltx || body->lrx) {
1289                 found = FALSE;
1290                 os_memcpy(ki.mi, body->lsrv_mi, sizeof(ki.mi));
1291                 ki.kn = be_to_host32(body->lkn);
1292                 dl_list_for_each(sa_key, &participant->sak_list,
1293                                  struct data_key, list) {
1294                         if (is_ki_equal(&sa_key->key_identifier, &ki)) {
1295                                 found = TRUE;
1296                                 break;
1297                         }
1298                 }
1299                 if (!found) {
1300                         wpa_printf(MSG_WARNING, "KaY: Latest key is invalid");
1301                         return -1;
1302                 }
1303                 if (os_memcmp(participant->lki.mi, body->lsrv_mi,
1304                               sizeof(participant->lki.mi)) == 0 &&
1305                     be_to_host32(body->lkn) == participant->lki.kn &&
1306                     body->lan == participant->lan) {
1307                         peer->sak_used = TRUE;
1308                 }
1309                 if (body->ltx && peer->is_key_server) {
1310                         ieee802_1x_cp_set_servertransmitting(kay->cp, TRUE);
1311                         ieee802_1x_cp_sm_step(kay->cp);
1312                 }
1313         }
1314
1315         /* check old key is valid */
1316         if (body->otx || body->orx) {
1317                 if (os_memcmp(participant->oki.mi, body->osrv_mi,
1318                               sizeof(participant->oki.mi)) != 0 ||
1319                     be_to_host32(body->okn) != participant->oki.kn ||
1320                     body->oan != participant->oan) {
1321                         wpa_printf(MSG_WARNING, "KaY: Old key is invalid");
1322                         return -1;
1323                 }
1324         }
1325
1326         /* TODO: how to set the MACsec hardware when delay_protect is true */
1327         if (body->delay_protect &&
1328             (!be_to_host32(body->llpn) || !be_to_host32(body->olpn))) {
1329                 wpa_printf(MSG_WARNING,
1330                            "KaY: Lowest packet number should greater than 0 when delay_protect is TRUE");
1331                 return -1;
1332         }
1333
1334         /* check all live peer have used the sak for receiving sa */
1335         all_receiving = TRUE;
1336         dl_list_for_each(peer, &participant->live_peers,
1337                          struct ieee802_1x_kay_peer, list) {
1338                 if (!peer->sak_used) {
1339                         all_receiving = FALSE;
1340                         break;
1341                 }
1342         }
1343         if (all_receiving) {
1344                 participant->to_dist_sak = FALSE;
1345                 ieee802_1x_cp_set_allreceiving(kay->cp, TRUE);
1346                 ieee802_1x_cp_sm_step(kay->cp);
1347         }
1348
1349         /* if i'm key server, and detects peer member pn exhaustion, rekey.*/
1350         lpn = be_to_host32(body->llpn);
1351         if (lpn > kay->pn_exhaustion) {
1352                 if (participant->is_key_server) {
1353                         participant->new_sak = TRUE;
1354                         wpa_printf(MSG_WARNING, "KaY: Peer LPN exhaustion");
1355                 }
1356         }
1357
1358         found = FALSE;
1359         dl_list_for_each(txsa, &participant->txsc->sa_list,
1360                          struct transmit_sa, list) {
1361                 if (sa_key != NULL && txsa->pkey == sa_key) {
1362                         found = TRUE;
1363                         break;
1364                 }
1365         }
1366         if (!found) {
1367                 wpa_printf(MSG_WARNING, "KaY: Can't find txsa");
1368                 return -1;
1369         }
1370
1371         /* FIXME: Secy creates txsa with default npn. If MKA detected Latest Key
1372          * npn is larger than txsa's npn, set it to txsa.
1373          */
1374         secy_get_transmit_next_pn(kay, txsa);
1375         if (lpn > txsa->next_pn) {
1376                 secy_set_transmit_next_pn(kay, txsa);
1377                 wpa_printf(MSG_INFO, "KaY: update lpn =0x%x", lpn);
1378         }
1379
1380         return 0;
1381 }
1382
1383
1384 /**
1385  * ieee802_1x_mka_dist_sak_body_present
1386  */
1387 static Boolean
1388 ieee802_1x_mka_dist_sak_body_present(
1389         struct ieee802_1x_mka_participant *participant)
1390 {
1391         return participant->to_dist_sak && participant->new_key;
1392 }
1393
1394
1395 /**
1396  * ieee802_1x_kay_get_dist_sak_length
1397  */
1398 static int
1399 ieee802_1x_mka_get_dist_sak_length(
1400         struct ieee802_1x_mka_participant *participant)
1401 {
1402         int length = MKA_HDR_LEN;
1403         unsigned int cs_index = participant->kay->macsec_csindex;
1404
1405         if (participant->advised_desired) {
1406                 length = sizeof(struct ieee802_1x_mka_dist_sak_body);
1407                 if (cs_index != DEFAULT_CS_INDEX)
1408                         length += CS_ID_LEN;
1409
1410                 length += cipher_suite_tbl[cs_index].sak_len + 8;
1411         }
1412
1413         return MKA_ALIGN_LENGTH(length);
1414 }
1415
1416
1417 /**
1418  * ieee802_1x_mka_encode_dist_sak_body -
1419  */
1420 static int
1421 ieee802_1x_mka_encode_dist_sak_body(
1422         struct ieee802_1x_mka_participant *participant,
1423         struct wpabuf *buf)
1424 {
1425         struct ieee802_1x_mka_dist_sak_body *body;
1426         struct data_key *sak;
1427         unsigned int length;
1428         unsigned int cs_index;
1429         int sak_pos;
1430
1431         length = ieee802_1x_mka_get_dist_sak_length(participant);
1432         body = wpabuf_put(buf, length);
1433         body->type = MKA_DISTRIBUTED_SAK;
1434         set_mka_param_body_len(body, length - MKA_HDR_LEN);
1435         if (length == MKA_HDR_LEN) {
1436                 body->confid_offset = 0;
1437                 body->dan = 0;
1438                 return 0;
1439         }
1440
1441         sak = participant->new_key;
1442         body->confid_offset = sak->confidentiality_offset;
1443         body->dan = sak->an;
1444         body->kn = host_to_be32(sak->key_identifier.kn);
1445         cs_index = participant->kay->macsec_csindex;
1446         sak_pos = 0;
1447         if (cs_index != DEFAULT_CS_INDEX) {
1448                 be64 cs;
1449
1450                 cs = host_to_be64(cipher_suite_tbl[cs_index].id);
1451                 os_memcpy(body->sak, &cs, CS_ID_LEN);
1452                 sak_pos = CS_ID_LEN;
1453         }
1454         if (aes_wrap(participant->kek.key, 16,
1455                      cipher_suite_tbl[cs_index].sak_len / 8,
1456                      sak->key, body->sak + sak_pos)) {
1457                 wpa_printf(MSG_ERROR, "KaY: AES wrap failed");
1458                 return -1;
1459         }
1460
1461         ieee802_1x_mka_dump_dist_sak_body(body);
1462
1463         return 0;
1464 }
1465
1466
1467 /**
1468  * ieee802_1x_kay_init_data_key -
1469  */
1470 static struct data_key *
1471 ieee802_1x_kay_init_data_key(const struct key_conf *conf)
1472 {
1473         struct data_key *pkey;
1474
1475         if (!conf)
1476                 return NULL;
1477
1478         pkey = os_zalloc(sizeof(*pkey));
1479         if (pkey == NULL) {
1480                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
1481                 return NULL;
1482         }
1483
1484         pkey->key = os_zalloc(conf->key_len);
1485         if (pkey->key == NULL) {
1486                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
1487                 os_free(pkey);
1488                 return NULL;
1489         }
1490
1491         os_memcpy(pkey->key, conf->key, conf->key_len);
1492         os_memcpy(&pkey->key_identifier, &conf->ki,
1493                   sizeof(pkey->key_identifier));
1494         pkey->confidentiality_offset = conf->offset;
1495         pkey->an = conf->an;
1496         pkey->transmits = conf->tx;
1497         pkey->receives = conf->rx;
1498         os_get_time(&pkey->created_time);
1499
1500         pkey->user = 1;
1501
1502         return pkey;
1503 }
1504
1505
1506 /**
1507  * ieee802_1x_kay_decode_dist_sak_body -
1508  */
1509 static int
1510 ieee802_1x_mka_decode_dist_sak_body(
1511         struct ieee802_1x_mka_participant *participant,
1512         const u8 *mka_msg, size_t msg_len)
1513 {
1514         struct ieee802_1x_mka_hdr *hdr;
1515         struct ieee802_1x_mka_dist_sak_body *body;
1516         struct ieee802_1x_kay_peer *peer;
1517         struct macsec_ciphersuite *cs;
1518         size_t body_len;
1519         struct key_conf *conf;
1520         struct data_key *sa_key = NULL;
1521         struct ieee802_1x_mka_ki sak_ki;
1522         int sak_len;
1523         u8 *wrap_sak;
1524         u8 *unwrap_sak;
1525         struct ieee802_1x_kay *kay = participant->kay;
1526
1527         hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1528         body_len = get_mka_param_body_len(hdr);
1529         if ((body_len != 0) && (body_len != 28) && (body_len < 36)) {
1530                 wpa_printf(MSG_ERROR,
1531                            "KaY: MKA Use SAK Packet Body Length (%zu bytes) should be 0, 28, 36, or more octets",
1532                            body_len);
1533                 return -1;
1534         }
1535
1536         if (!participant->principal) {
1537                 wpa_printf(MSG_ERROR,
1538                            "KaY: I can't accept the distributed SAK as I am not principal");
1539                 return -1;
1540         }
1541         if (participant->is_key_server) {
1542                 wpa_printf(MSG_ERROR,
1543                            "KaY: I can't accept the distributed SAK as myself is key server ");
1544                 return -1;
1545         }
1546         if (!kay->macsec_desired ||
1547             kay->macsec_capable == MACSEC_CAP_NOT_IMPLEMENTED) {
1548                 wpa_printf(MSG_ERROR,
1549                            "KaY: I am not MACsec-desired or without MACsec capable");
1550                 return -1;
1551         }
1552
1553         peer = ieee802_1x_kay_get_live_peer(participant,
1554                                             participant->current_peer_id.mi);
1555         if (!peer) {
1556                 wpa_printf(MSG_ERROR,
1557                            "KaY: The key server is not in my live peers list");
1558                 return -1;
1559         }
1560         if (!sci_equal(&kay->key_server_sci, &peer->sci)) {
1561                 wpa_printf(MSG_ERROR, "KaY: The key server is not elected");
1562                 return -1;
1563         }
1564
1565         if (body_len == 0) {
1566                 kay->authenticated = TRUE;
1567                 kay->secured = FALSE;
1568                 kay->failed = FALSE;
1569                 participant->advised_desired = FALSE;
1570                 ieee802_1x_cp_connect_authenticated(kay->cp);
1571                 ieee802_1x_cp_sm_step(kay->cp);
1572                 wpa_printf(MSG_WARNING, "KaY:The Key server advise no MACsec");
1573                 participant->to_use_sak = TRUE;
1574                 return 0;
1575         }
1576
1577         participant->advised_desired = TRUE;
1578         kay->authenticated = FALSE;
1579         kay->secured = TRUE;
1580         kay->failed = FALSE;
1581         ieee802_1x_cp_connect_secure(kay->cp);
1582         ieee802_1x_cp_sm_step(kay->cp);
1583
1584         body = (struct ieee802_1x_mka_dist_sak_body *)mka_msg;
1585         ieee802_1x_mka_dump_dist_sak_body(body);
1586         dl_list_for_each(sa_key, &participant->sak_list, struct data_key, list)
1587         {
1588                 if (os_memcmp(sa_key->key_identifier.mi,
1589                               participant->current_peer_id.mi, MI_LEN) == 0 &&
1590                     sa_key->key_identifier.kn == be_to_host32(body->kn)) {
1591                         wpa_printf(MSG_WARNING, "KaY:The Key has installed");
1592                         return 0;
1593                 }
1594         }
1595
1596         if (body_len == 28) {
1597                 sak_len = DEFAULT_SA_KEY_LEN;
1598                 wrap_sak =  body->sak;
1599                 kay->macsec_csindex = DEFAULT_CS_INDEX;
1600         } else {
1601                 cs = ieee802_1x_kay_get_cipher_suite(participant, body->sak);
1602                 if (!cs) {
1603                         wpa_printf(MSG_ERROR,
1604                                    "KaY: I can't support the Cipher Suite advised by key server");
1605                         return -1;
1606                 }
1607                 sak_len = cs->sak_len;
1608                 wrap_sak = body->sak + CS_ID_LEN;
1609                 kay->macsec_csindex = cs->index;
1610         }
1611
1612         unwrap_sak = os_zalloc(sak_len);
1613         if (!unwrap_sak) {
1614                 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
1615                 return -1;
1616         }
1617         if (aes_unwrap(participant->kek.key, 16, sak_len >> 3, wrap_sak,
1618                        unwrap_sak)) {
1619                 wpa_printf(MSG_ERROR, "KaY: AES unwrap failed");
1620                 os_free(unwrap_sak);
1621                 return -1;
1622         }
1623         wpa_hexdump(MSG_DEBUG, "\tAES Key Unwrap of SAK:", unwrap_sak, sak_len);
1624
1625         conf = os_zalloc(sizeof(*conf));
1626         if (!conf) {
1627                 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
1628                 os_free(unwrap_sak);
1629                 return -1;
1630         }
1631         conf->key_len = sak_len;
1632
1633         conf->key = os_zalloc(conf->key_len);
1634         if (!conf->key) {
1635                 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
1636                 os_free(unwrap_sak);
1637                 os_free(conf);
1638                 return -1;
1639         }
1640
1641         os_memcpy(conf->key, unwrap_sak, conf->key_len);
1642
1643         os_memcpy(&sak_ki.mi, &participant->current_peer_id.mi,
1644                   sizeof(sak_ki.mi));
1645         sak_ki.kn = be_to_host32(body->kn);
1646
1647         os_memcpy(conf->ki.mi, sak_ki.mi, MI_LEN);
1648         conf->ki.kn = sak_ki.kn;
1649         conf->an = body->dan;
1650         conf->offset = body->confid_offset;
1651         conf->rx = TRUE;
1652         conf->tx = TRUE;
1653
1654         sa_key = ieee802_1x_kay_init_data_key(conf);
1655         if (!sa_key) {
1656                 os_free(unwrap_sak);
1657                 os_free(conf->key);
1658                 os_free(conf);
1659                 return -1;
1660         }
1661
1662         dl_list_add(&participant->sak_list, &sa_key->list);
1663
1664         ieee802_1x_cp_set_ciphersuite(kay->cp,
1665                                       cipher_suite_tbl[kay->macsec_csindex].id);
1666         ieee802_1x_cp_sm_step(kay->cp);
1667         ieee802_1x_cp_set_offset(kay->cp, body->confid_offset);
1668         ieee802_1x_cp_sm_step(kay->cp);
1669         ieee802_1x_cp_set_distributedki(kay->cp, &sak_ki);
1670         ieee802_1x_cp_set_distributedan(kay->cp, body->dan);
1671         ieee802_1x_cp_signal_newsak(kay->cp);
1672         ieee802_1x_cp_sm_step(kay->cp);
1673
1674         participant->to_use_sak = TRUE;
1675
1676         os_free(unwrap_sak);
1677         os_free(conf->key);
1678         os_free(conf);
1679
1680         return 0;
1681 }
1682
1683
1684 /**
1685  * ieee802_1x_mka_icv_body_present
1686  */
1687 static Boolean
1688 ieee802_1x_mka_icv_body_present(struct ieee802_1x_mka_participant *participant)
1689 {
1690         return TRUE;
1691 }
1692
1693
1694 /**
1695  * ieee802_1x_kay_get_icv_length
1696  */
1697 static int
1698 ieee802_1x_mka_get_icv_length(struct ieee802_1x_mka_participant *participant)
1699 {
1700         int length;
1701
1702         length = sizeof(struct ieee802_1x_mka_icv_body);
1703         length += mka_alg_tbl[participant->kay->mka_algindex].icv_len;
1704
1705         return MKA_ALIGN_LENGTH(length);
1706 }
1707
1708
1709 /**
1710  * ieee802_1x_mka_encode_icv_body -
1711  */
1712 static int
1713 ieee802_1x_mka_encode_icv_body(struct ieee802_1x_mka_participant *participant,
1714                                struct wpabuf *buf)
1715 {
1716         struct ieee802_1x_mka_icv_body *body;
1717         unsigned int length;
1718         u8 cmac[MAX_ICV_LEN];
1719
1720         length = ieee802_1x_mka_get_icv_length(participant);
1721         if (length != DEFAULT_ICV_LEN)  {
1722                 body = wpabuf_put(buf, MKA_HDR_LEN);
1723                 body->type = MKA_ICV_INDICATOR;
1724                 set_mka_param_body_len(body, length - MKA_HDR_LEN);
1725         }
1726
1727         if (mka_alg_tbl[participant->kay->mka_algindex].icv_hash(
1728                     participant->ick.key, wpabuf_head(buf), buf->used, cmac)) {
1729                 wpa_printf(MSG_ERROR, "KaY, omac1_aes_128 failed");
1730                 return -1;
1731         }
1732
1733         if (length != DEFAULT_ICV_LEN)
1734                 length -= MKA_HDR_LEN;
1735         os_memcpy(wpabuf_put(buf, length), cmac, length);
1736
1737         return 0;
1738 }
1739
1740 /**
1741  * ieee802_1x_mka_decode_icv_body -
1742  */
1743 static u8 *
1744 ieee802_1x_mka_decode_icv_body(struct ieee802_1x_mka_participant *participant,
1745                                const u8 *mka_msg, size_t msg_len)
1746 {
1747         struct ieee802_1x_mka_hdr *hdr;
1748         struct ieee802_1x_mka_icv_body *body;
1749         size_t body_len;
1750         size_t left_len;
1751         u8 body_type;
1752         const u8 *pos;
1753
1754         pos = mka_msg;
1755         left_len = msg_len;
1756         while (left_len > (MKA_HDR_LEN + DEFAULT_ICV_LEN)) {
1757                 hdr = (struct ieee802_1x_mka_hdr *) pos;
1758                 body_len = get_mka_param_body_len(hdr);
1759                 body_type = get_mka_param_body_type(hdr);
1760
1761                 if (left_len < (body_len + MKA_HDR_LEN))
1762                         break;
1763
1764                 if (body_type != MKA_ICV_INDICATOR) {
1765                         left_len -= MKA_HDR_LEN + body_len;
1766                         pos += MKA_HDR_LEN + body_len;
1767                         continue;
1768                 }
1769
1770                 body = (struct ieee802_1x_mka_icv_body *)pos;
1771                 if (body_len
1772                         < mka_alg_tbl[participant->kay->mka_algindex].icv_len) {
1773                         return NULL;
1774                 }
1775
1776                 return body->icv;
1777         }
1778
1779         return (u8 *) (mka_msg + msg_len - DEFAULT_ICV_LEN);
1780 }
1781
1782
1783 /**
1784  * ieee802_1x_mka_decode_dist_cak_body-
1785  */
1786 static int
1787 ieee802_1x_mka_decode_dist_cak_body(
1788         struct ieee802_1x_mka_participant *participant,
1789         const u8 *mka_msg, size_t msg_len)
1790 {
1791         struct ieee802_1x_mka_hdr *hdr;
1792         size_t body_len;
1793
1794         hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1795         body_len = get_mka_param_body_len(hdr);
1796         if (body_len < 28) {
1797                 wpa_printf(MSG_ERROR,
1798                            "KaY: MKA Use SAK Packet Body Length (%zu bytes) should be 28 or more octets",
1799                            body_len);
1800                 return -1;
1801         }
1802
1803         return 0;
1804 }
1805
1806
1807 /**
1808  * ieee802_1x_mka_decode_kmd_body -
1809  */
1810 static int
1811 ieee802_1x_mka_decode_kmd_body(
1812         struct ieee802_1x_mka_participant *participant,
1813         const u8 *mka_msg, size_t msg_len)
1814 {
1815         struct ieee802_1x_mka_hdr *hdr;
1816         size_t body_len;
1817
1818         hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1819         body_len = get_mka_param_body_len(hdr);
1820         if (body_len < 5) {
1821                 wpa_printf(MSG_ERROR,
1822                            "KaY: MKA Use SAK Packet Body Length (%zu bytes) should be 5 or more octets",
1823                            body_len);
1824                 return -1;
1825         }
1826
1827         return 0;
1828 }
1829
1830
1831 /**
1832  * ieee802_1x_mka_decode_announce_body -
1833  */
1834 static int ieee802_1x_mka_decode_announce_body(
1835         struct ieee802_1x_mka_participant *participant,
1836         const u8 *mka_msg, size_t msg_len)
1837 {
1838         return 0;
1839 }
1840
1841
1842 struct mka_param_body_handler {
1843         int (*body_tx)(struct ieee802_1x_mka_participant *participant,
1844                        struct wpabuf *buf);
1845         int (*body_rx)(struct ieee802_1x_mka_participant *participant,
1846                        const u8 *mka_msg, size_t msg_len);
1847         int (*body_length)(struct ieee802_1x_mka_participant *participant);
1848         Boolean (*body_present)(struct ieee802_1x_mka_participant *participant);
1849 };
1850
1851
1852 static struct mka_param_body_handler mka_body_handler[] = {
1853         /* basic parameter set */
1854         {
1855                 .body_tx      = ieee802_1x_mka_encode_basic_body,
1856                 .body_rx      = NULL,
1857                 .body_length  = ieee802_1x_mka_basic_body_length,
1858                 .body_present = ieee802_1x_mka_basic_body_present
1859         },
1860
1861         /* live peer list parameter set */
1862         {
1863                 .body_tx      = ieee802_1x_mka_encode_live_peer_body,
1864                 .body_rx      = ieee802_1x_mka_decode_live_peer_body,
1865                 .body_length  = ieee802_1x_mka_get_live_peer_length,
1866                 .body_present = ieee802_1x_mka_live_peer_body_present
1867         },
1868
1869         /* potential peer list parameter set */
1870         {
1871                 .body_tx      = ieee802_1x_mka_encode_potential_peer_body,
1872                 .body_rx      = ieee802_1x_mka_decode_potential_peer_body,
1873                 .body_length  = ieee802_1x_mka_get_potential_peer_length,
1874                 .body_present = ieee802_1x_mka_potential_peer_body_present
1875         },
1876
1877         /* sak use parameter set */
1878         {
1879                 .body_tx      = ieee802_1x_mka_encode_sak_use_body,
1880                 .body_rx      = ieee802_1x_mka_decode_sak_use_body,
1881                 .body_length  = ieee802_1x_mka_get_sak_use_length,
1882                 .body_present = ieee802_1x_mka_sak_use_body_present
1883         },
1884
1885         /* distribute sak parameter set */
1886         {
1887                 .body_tx      = ieee802_1x_mka_encode_dist_sak_body,
1888                 .body_rx      = ieee802_1x_mka_decode_dist_sak_body,
1889                 .body_length  = ieee802_1x_mka_get_dist_sak_length,
1890                 .body_present = ieee802_1x_mka_dist_sak_body_present
1891         },
1892
1893         /* distribute cak parameter set */
1894         {
1895                 .body_tx      = NULL,
1896                 .body_rx      = ieee802_1x_mka_decode_dist_cak_body,
1897                 .body_length  = NULL,
1898                 .body_present = NULL
1899         },
1900
1901         /* kmd parameter set */
1902         {
1903                 .body_tx      = NULL,
1904                 .body_rx      = ieee802_1x_mka_decode_kmd_body,
1905                 .body_length  = NULL,
1906                 .body_present = NULL
1907         },
1908
1909         /* announce parameter set */
1910         {
1911                 .body_tx      = NULL,
1912                 .body_rx      = ieee802_1x_mka_decode_announce_body,
1913                 .body_length  = NULL,
1914                 .body_present = NULL
1915         },
1916
1917         /* icv parameter set */
1918         {
1919                 .body_tx      = ieee802_1x_mka_encode_icv_body,
1920                 .body_rx      = NULL,
1921                 .body_length  = ieee802_1x_mka_get_icv_length,
1922                 .body_present = ieee802_1x_mka_icv_body_present
1923         },
1924 };
1925
1926
1927 /**
1928  * ieee802_1x_kay_deinit_data_key -
1929  */
1930 static void ieee802_1x_kay_deinit_data_key(struct data_key *pkey)
1931 {
1932         if (!pkey)
1933                 return;
1934
1935         pkey->user--;
1936         if (pkey->user > 1)
1937                 return;
1938
1939         dl_list_del(&pkey->list);
1940         os_free(pkey->key);
1941         os_free(pkey);
1942 }
1943
1944
1945 /**
1946  * ieee802_1x_kay_generate_new_sak -
1947  */
1948 static int
1949 ieee802_1x_kay_generate_new_sak(struct ieee802_1x_mka_participant *participant)
1950 {
1951         struct data_key *sa_key = NULL;
1952         struct key_conf *conf;
1953         struct ieee802_1x_kay_peer *peer;
1954         struct ieee802_1x_kay *kay = participant->kay;
1955         int ctx_len, ctx_offset;
1956         u8 *context;
1957
1958         /* check condition for generating a fresh SAK:
1959          * must have one live peer
1960          * and MKA life time elapse since last distribution
1961          * or potential peer is empty
1962          */
1963         if (dl_list_empty(&participant->live_peers)) {
1964                 wpa_printf(MSG_ERROR,
1965                            "KaY: Live peers list must not empty when generating fresh SAK");
1966                 return -1;
1967         }
1968
1969         /* FIXME: A fresh SAK not generated until
1970          * the live peer list contains at least one peer and
1971          * MKA life time has elapsed since the prior SAK was first distributed,
1972          * or the Key server's potential peer is empty
1973          * but I can't understand the second item, so
1974          * here only check first item and ingore
1975          *   && (!dl_list_empty(&participant->potential_peers))) {
1976          */
1977         if ((time(NULL) - kay->dist_time) < MKA_LIFE_TIME / 1000) {
1978                 wpa_printf(MSG_ERROR,
1979                            "KaY: Life time have not elapsed since prior SAK distributed");
1980                 return -1;
1981         }
1982
1983         conf = os_zalloc(sizeof(*conf));
1984         if (!conf) {
1985                 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
1986                 return -1;
1987         }
1988         conf->key_len = cipher_suite_tbl[kay->macsec_csindex].sak_len;
1989
1990         conf->key = os_zalloc(conf->key_len);
1991         if (!conf->key) {
1992                 os_free(conf);
1993                 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
1994                 return -1;
1995         }
1996
1997         ctx_len = conf->key_len + sizeof(kay->dist_kn);
1998         dl_list_for_each(peer, &participant->live_peers,
1999                          struct ieee802_1x_kay_peer, list)
2000                 ctx_len += sizeof(peer->mi);
2001         ctx_len += sizeof(participant->mi);
2002
2003         context = os_zalloc(ctx_len);
2004         if (!context) {
2005                 os_free(conf->key);
2006                 os_free(conf);
2007                 return -1;
2008         }
2009         ctx_offset = 0;
2010         if (os_get_random(context + ctx_offset, conf->key_len) < 0) {
2011                 os_free(context);
2012                 os_free(conf->key);
2013                 os_free(conf);
2014                 return -1;
2015         }
2016         ctx_offset += conf->key_len;
2017         dl_list_for_each(peer, &participant->live_peers,
2018                          struct ieee802_1x_kay_peer, list) {
2019                 os_memcpy(context + ctx_offset, peer->mi, sizeof(peer->mi));
2020                 ctx_offset += sizeof(peer->mi);
2021         }
2022         os_memcpy(context + ctx_offset, participant->mi,
2023                   sizeof(participant->mi));
2024         ctx_offset += sizeof(participant->mi);
2025         os_memcpy(context + ctx_offset, &kay->dist_kn, sizeof(kay->dist_kn));
2026
2027         if (conf->key_len == 16) {
2028                 ieee802_1x_sak_128bits_aes_cmac(participant->cak.key,
2029                                                 context, ctx_len, conf->key);
2030         } else if (conf->key_len == 32) {
2031                 ieee802_1x_sak_128bits_aes_cmac(participant->cak.key,
2032                                                 context, ctx_len, conf->key);
2033         } else {
2034                 wpa_printf(MSG_ERROR, "KaY: SAK Length not support");
2035                 os_free(conf->key);
2036                 os_free(conf);
2037                 os_free(context);
2038                 return -1;
2039         }
2040         wpa_hexdump(MSG_DEBUG, "KaY: generated new SAK",
2041                     conf->key, conf->key_len);
2042
2043         os_memcpy(conf->ki.mi, participant->mi, MI_LEN);
2044         conf->ki.kn = kay->dist_kn;
2045         conf->an = kay->dist_an;
2046         conf->offset = kay->macsec_confidentiality;
2047         conf->rx = TRUE;
2048         conf->tx = TRUE;
2049
2050         sa_key = ieee802_1x_kay_init_data_key(conf);
2051         if (!sa_key) {
2052                 os_free(conf->key);
2053                 os_free(conf);
2054                 os_free(context);
2055                 return -1;
2056         }
2057         participant->new_key = sa_key;
2058
2059         dl_list_add(&participant->sak_list, &sa_key->list);
2060         ieee802_1x_cp_set_ciphersuite(kay->cp,
2061                                       cipher_suite_tbl[kay->macsec_csindex].id);
2062         ieee802_1x_cp_sm_step(kay->cp);
2063         ieee802_1x_cp_set_offset(kay->cp, conf->offset);
2064         ieee802_1x_cp_sm_step(kay->cp);
2065         ieee802_1x_cp_set_distributedki(kay->cp, &conf->ki);
2066         ieee802_1x_cp_set_distributedan(kay->cp, conf->an);
2067         ieee802_1x_cp_signal_newsak(kay->cp);
2068         ieee802_1x_cp_sm_step(kay->cp);
2069
2070         dl_list_for_each(peer, &participant->live_peers,
2071                          struct ieee802_1x_kay_peer, list)
2072                 peer->sak_used = FALSE;
2073
2074         kay->dist_kn++;
2075         kay->dist_an++;
2076         if (kay->dist_an > 3)
2077                 kay->dist_an = 0;
2078
2079         kay->dist_time = time(NULL);
2080
2081         os_free(conf->key);
2082         os_free(conf);
2083         os_free(context);
2084         return 0;
2085 }
2086
2087
2088 static int compare_priorities(const struct ieee802_1x_kay_peer *peer,
2089                               const struct ieee802_1x_kay_peer *other)
2090 {
2091         if (peer->key_server_priority < other->key_server_priority)
2092                 return -1;
2093         if (other->key_server_priority < peer->key_server_priority)
2094                 return 1;
2095
2096         return os_memcmp(peer->sci.addr, other->sci.addr, ETH_ALEN);
2097 }
2098
2099
2100 /**
2101  * ieee802_1x_kay_elect_key_server - elect the key server
2102  * when to elect: whenever the live peers list changes
2103  */
2104 static int
2105 ieee802_1x_kay_elect_key_server(struct ieee802_1x_mka_participant *participant)
2106 {
2107         struct ieee802_1x_kay_peer *peer;
2108         struct ieee802_1x_kay_peer *key_server = NULL;
2109         struct ieee802_1x_kay *kay = participant->kay;
2110         Boolean i_is_key_server;
2111
2112         if (participant->is_obliged_key_server) {
2113                 participant->new_sak = TRUE;
2114                 participant->to_dist_sak = FALSE;
2115                 ieee802_1x_cp_set_electedself(kay->cp, TRUE);
2116                 return 0;
2117         }
2118
2119         /* elect the key server among the peers */
2120         dl_list_for_each(peer, &participant->live_peers,
2121                          struct ieee802_1x_kay_peer, list) {
2122                 if (!peer->is_key_server)
2123                         continue;
2124
2125                 if (!key_server) {
2126                         key_server = peer;
2127                         continue;
2128                 }
2129
2130                 if (compare_priorities(peer, key_server) < 0)
2131                         key_server = peer;
2132         }
2133
2134         /* elect the key server between me and the above elected peer */
2135         i_is_key_server = FALSE;
2136         if (key_server && participant->can_be_key_server) {
2137                 struct ieee802_1x_kay_peer tmp;
2138
2139                 tmp.key_server_priority = kay->actor_priority;
2140                 os_memcpy(&tmp.sci, &kay->actor_sci, sizeof(tmp.sci));
2141                 if (compare_priorities(&tmp, key_server) < 0)
2142                         i_is_key_server = TRUE;
2143         } else if (participant->can_be_key_server) {
2144                 i_is_key_server = TRUE;
2145         }
2146
2147         if (i_is_key_server) {
2148                 ieee802_1x_cp_set_electedself(kay->cp, TRUE);
2149                 if (!sci_equal(&kay->key_server_sci, &kay->actor_sci)) {
2150                         ieee802_1x_cp_signal_chgdserver(kay->cp);
2151                         ieee802_1x_cp_sm_step(kay->cp);
2152                 }
2153
2154                 participant->is_key_server = TRUE;
2155                 participant->principal = TRUE;
2156                 participant->new_sak = TRUE;
2157                 wpa_printf(MSG_DEBUG, "KaY: I is elected as key server");
2158                 participant->to_dist_sak = FALSE;
2159                 participant->is_elected = TRUE;
2160
2161                 os_memcpy(&kay->key_server_sci, &kay->actor_sci,
2162                           sizeof(kay->key_server_sci));
2163                 kay->key_server_priority = kay->actor_priority;
2164         } else if (key_server) {
2165                 ieee802_1x_cp_set_electedself(kay->cp, FALSE);
2166                 if (!sci_equal(&kay->key_server_sci, &key_server->sci)) {
2167                         ieee802_1x_cp_signal_chgdserver(kay->cp);
2168                         ieee802_1x_cp_sm_step(kay->cp);
2169                 }
2170
2171                 participant->is_key_server = FALSE;
2172                 participant->principal = TRUE;
2173                 participant->is_elected = TRUE;
2174
2175                 os_memcpy(&kay->key_server_sci, &key_server->sci,
2176                           sizeof(kay->key_server_sci));
2177                 kay->key_server_priority = key_server->key_server_priority;
2178         } else {
2179                 participant->principal = FALSE;
2180                 participant->is_key_server = FALSE;
2181                 participant->is_elected = FALSE;
2182         }
2183
2184         return 0;
2185 }
2186
2187
2188 /**
2189  * ieee802_1x_kay_decide_macsec_use - the key server determinate
2190  *               how to use MACsec: whether use MACsec and its capability
2191  * protectFrames will be advised if the key server and one of its live peers are
2192  * MACsec capable and one of those request MACsec protection
2193  */
2194 static int
2195 ieee802_1x_kay_decide_macsec_use(
2196         struct ieee802_1x_mka_participant *participant)
2197 {
2198         struct ieee802_1x_kay *kay = participant->kay;
2199         struct ieee802_1x_kay_peer *peer;
2200         enum macsec_cap less_capability;
2201         Boolean has_peer;
2202
2203         if (!participant->is_key_server)
2204                 return -1;
2205
2206         /* key server self is MACsec-desired and requesting MACsec */
2207         if (!kay->macsec_desired) {
2208                 participant->advised_desired = FALSE;
2209                 return -1;
2210         }
2211         if (kay->macsec_capable == MACSEC_CAP_NOT_IMPLEMENTED) {
2212                 participant->advised_desired = FALSE;
2213                 return -1;
2214         }
2215         less_capability = kay->macsec_capable;
2216
2217         /* at least one of peers is MACsec-desired and requesting MACsec */
2218         has_peer = FALSE;
2219         dl_list_for_each(peer, &participant->live_peers,
2220                          struct ieee802_1x_kay_peer, list) {
2221                 if (!peer->macsec_desired)
2222                         continue;
2223
2224                 if (peer->macsec_capability == MACSEC_CAP_NOT_IMPLEMENTED)
2225                         continue;
2226
2227                 less_capability = (less_capability < peer->macsec_capability) ?
2228                         less_capability : peer->macsec_capability;
2229                 has_peer = TRUE;
2230         }
2231
2232         if (has_peer) {
2233                 participant->advised_desired = TRUE;
2234                 participant->advised_capability = less_capability;
2235                 kay->authenticated = FALSE;
2236                 kay->secured = TRUE;
2237                 kay->failed = FALSE;
2238                 ieee802_1x_cp_connect_secure(kay->cp);
2239                 ieee802_1x_cp_sm_step(kay->cp);
2240         } else {
2241                 participant->advised_desired = FALSE;
2242                 participant->advised_capability = MACSEC_CAP_NOT_IMPLEMENTED;
2243                 participant->to_use_sak = FALSE;
2244                 kay->authenticated = TRUE;
2245                 kay->secured = FALSE;
2246                 kay->failed = FALSE;
2247                 kay->ltx_kn = 0;
2248                 kay->ltx_an = 0;
2249                 kay->lrx_kn = 0;
2250                 kay->lrx_an = 0;
2251                 kay->otx_kn = 0;
2252                 kay->otx_an = 0;
2253                 kay->orx_kn = 0;
2254                 kay->orx_an = 0;
2255                 ieee802_1x_cp_connect_authenticated(kay->cp);
2256                 ieee802_1x_cp_sm_step(kay->cp);
2257         }
2258
2259         return 0;
2260 }
2261
2262 static const u8 pae_group_addr[ETH_ALEN] = {
2263         0x01, 0x80, 0xc2, 0x00, 0x00, 0x03
2264 };
2265
2266
2267 /**
2268  * ieee802_1x_kay_encode_mkpdu -
2269  */
2270 static int
2271 ieee802_1x_kay_encode_mkpdu(struct ieee802_1x_mka_participant *participant,
2272                             struct wpabuf *pbuf)
2273 {
2274         unsigned int i;
2275         struct ieee8023_hdr *ether_hdr;
2276         struct ieee802_1x_hdr *eapol_hdr;
2277
2278         ether_hdr = wpabuf_put(pbuf, sizeof(*ether_hdr));
2279         os_memcpy(ether_hdr->dest, pae_group_addr, sizeof(ether_hdr->dest));
2280         os_memcpy(ether_hdr->src, participant->kay->actor_sci.addr,
2281                   sizeof(ether_hdr->dest));
2282         ether_hdr->ethertype = host_to_be16(ETH_P_EAPOL);
2283
2284         eapol_hdr = wpabuf_put(pbuf, sizeof(*eapol_hdr));
2285         eapol_hdr->version = EAPOL_VERSION;
2286         eapol_hdr->type = IEEE802_1X_TYPE_EAPOL_MKA;
2287         eapol_hdr->length = host_to_be16(pbuf->size - pbuf->used);
2288
2289         for (i = 0; i < ARRAY_SIZE(mka_body_handler); i++) {
2290                 if (mka_body_handler[i].body_present &&
2291                     mka_body_handler[i].body_present(participant)) {
2292                         if (mka_body_handler[i].body_tx(participant, pbuf))
2293                                 return -1;
2294                 }
2295         }
2296
2297         return 0;
2298 }
2299
2300 /**
2301  * ieee802_1x_participant_send_mkpdu -
2302  */
2303 static int
2304 ieee802_1x_participant_send_mkpdu(
2305         struct ieee802_1x_mka_participant *participant)
2306 {
2307         struct wpabuf *buf;
2308         struct ieee802_1x_kay *kay = participant->kay;
2309         size_t length = 0;
2310         unsigned int i;
2311
2312         wpa_printf(MSG_DEBUG, "KaY: to enpacket and send the MKPDU");
2313         length += sizeof(struct ieee802_1x_hdr) + sizeof(struct ieee8023_hdr);
2314         for (i = 0; i < ARRAY_SIZE(mka_body_handler); i++) {
2315                 if (mka_body_handler[i].body_present &&
2316                     mka_body_handler[i].body_present(participant))
2317                         length += mka_body_handler[i].body_length(participant);
2318         }
2319
2320         buf = wpabuf_alloc(length);
2321         if (!buf) {
2322                 wpa_printf(MSG_ERROR, "KaY: out of memory");
2323                 return -1;
2324         }
2325
2326         if (ieee802_1x_kay_encode_mkpdu(participant, buf)) {
2327                 wpa_printf(MSG_ERROR, "KaY: encode mkpdu fail!");
2328                 return -1;
2329         }
2330
2331         l2_packet_send(kay->l2_mka, NULL, 0, wpabuf_head(buf), wpabuf_len(buf));
2332         wpabuf_free(buf);
2333
2334         kay->active = TRUE;
2335         participant->active = TRUE;
2336
2337         return 0;
2338 }
2339
2340
2341 static void ieee802_1x_kay_deinit_transmit_sa(struct transmit_sa *psa);
2342 /**
2343  * ieee802_1x_participant_timer -
2344  */
2345 static void ieee802_1x_participant_timer(void *eloop_ctx, void *timeout_ctx)
2346 {
2347         struct ieee802_1x_mka_participant *participant;
2348         struct ieee802_1x_kay *kay;
2349         struct ieee802_1x_kay_peer *peer, *pre_peer;
2350         time_t now = time(NULL);
2351         Boolean lp_changed;
2352         struct receive_sc *rxsc, *pre_rxsc;
2353         struct transmit_sa *txsa, *pre_txsa;
2354
2355         participant = (struct ieee802_1x_mka_participant *)eloop_ctx;
2356         kay = participant->kay;
2357         if (participant->cak_life) {
2358                 if (now > participant->cak_life)
2359                         goto delete_mka;
2360         }
2361
2362         /* should delete MKA instance if there are not live peers
2363          * when the MKA life elapsed since its creating */
2364         if (participant->mka_life) {
2365                 if (dl_list_empty(&participant->live_peers)) {
2366                         if (now > participant->mka_life)
2367                                 goto delete_mka;
2368                 } else {
2369                         participant->mka_life = 0;
2370                 }
2371         }
2372
2373         lp_changed = FALSE;
2374         dl_list_for_each_safe(peer, pre_peer, &participant->live_peers,
2375                               struct ieee802_1x_kay_peer, list) {
2376                 if (now > peer->expire) {
2377                         wpa_printf(MSG_DEBUG, "KaY: Live peer removed");
2378                         wpa_hexdump(MSG_DEBUG, "\tMI: ", peer->mi,
2379                                     sizeof(peer->mi));
2380                         wpa_printf(MSG_DEBUG, "\tMN: %d", peer->mn);
2381                         dl_list_for_each_safe(rxsc, pre_rxsc,
2382                                               &participant->rxsc_list,
2383                                               struct receive_sc, list) {
2384                                 if (sci_equal(&rxsc->sci, &peer->sci)) {
2385                                         secy_delete_receive_sc(kay, rxsc);
2386                                         ieee802_1x_kay_deinit_receive_sc(
2387                                                 participant, rxsc);
2388                                 }
2389                         }
2390                         dl_list_del(&peer->list);
2391                         os_free(peer);
2392                         lp_changed = TRUE;
2393                 }
2394         }
2395
2396         if (lp_changed) {
2397                 if (dl_list_empty(&participant->live_peers)) {
2398                         participant->advised_desired = FALSE;
2399                         participant->advised_capability =
2400                                 MACSEC_CAP_NOT_IMPLEMENTED;
2401                         participant->to_use_sak = FALSE;
2402                         kay->authenticated = TRUE;
2403                         kay->secured = FALSE;
2404                         kay->failed = FALSE;
2405                         kay->ltx_kn = 0;
2406                         kay->ltx_an = 0;
2407                         kay->lrx_kn = 0;
2408                         kay->lrx_an = 0;
2409                         kay->otx_kn = 0;
2410                         kay->otx_an = 0;
2411                         kay->orx_kn = 0;
2412                         kay->orx_an = 0;
2413                         dl_list_for_each_safe(txsa, pre_txsa,
2414                                               &participant->txsc->sa_list,
2415                                               struct transmit_sa, list) {
2416                                 secy_disable_transmit_sa(kay, txsa);
2417                                 ieee802_1x_kay_deinit_transmit_sa(txsa);
2418                         }
2419
2420                         ieee802_1x_cp_connect_authenticated(kay->cp);
2421                         ieee802_1x_cp_sm_step(kay->cp);
2422                 } else {
2423                         ieee802_1x_kay_elect_key_server(participant);
2424                         ieee802_1x_kay_decide_macsec_use(participant);
2425                 }
2426         }
2427
2428         dl_list_for_each_safe(peer, pre_peer, &participant->potential_peers,
2429                               struct ieee802_1x_kay_peer, list) {
2430                 if (now > peer->expire) {
2431                         wpa_printf(MSG_DEBUG, "KaY: Potential peer removed");
2432                         wpa_hexdump(MSG_DEBUG, "\tMI: ", peer->mi,
2433                                     sizeof(peer->mi));
2434                         wpa_printf(MSG_DEBUG, "\tMN: %d", peer->mn);
2435                         dl_list_del(&peer->list);
2436                         os_free(peer);
2437                 }
2438         }
2439
2440         if (participant->new_sak) {
2441                 if (!ieee802_1x_kay_generate_new_sak(participant))
2442                         participant->to_dist_sak = TRUE;
2443
2444                 participant->new_sak = FALSE;
2445         }
2446
2447         if (participant->retry_count < MAX_RETRY_CNT) {
2448                 ieee802_1x_participant_send_mkpdu(participant);
2449                 participant->retry_count++;
2450         }
2451
2452         eloop_register_timeout(MKA_HELLO_TIME / 1000, 0,
2453                                ieee802_1x_participant_timer,
2454                                participant, NULL);
2455
2456         return;
2457
2458 delete_mka:
2459         kay->authenticated = FALSE;
2460         kay->secured = FALSE;
2461         kay->failed = TRUE;
2462         ieee802_1x_kay_delete_mka(kay, &participant->ckn);
2463 }
2464
2465
2466 /**
2467  * ieee802_1x_kay_init_transmit_sa -
2468  */
2469 static struct transmit_sa *
2470 ieee802_1x_kay_init_transmit_sa(struct transmit_sc *psc, u8 an, u32 next_PN,
2471                                 struct data_key *key)
2472 {
2473         struct transmit_sa *psa;
2474
2475         key->tx_latest = TRUE;
2476         key->rx_latest = TRUE;
2477
2478         psa = os_zalloc(sizeof(*psa));
2479         if (!psa) {
2480                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
2481                 return NULL;
2482         }
2483
2484         if (key->confidentiality_offset >= CONFIDENTIALITY_OFFSET_0 &&
2485             key->confidentiality_offset <= CONFIDENTIALITY_OFFSET_50)
2486                 psa->confidentiality = TRUE;
2487         else
2488                 psa->confidentiality = FALSE;
2489
2490         psa->an = an;
2491         psa->pkey = key;
2492         psa->next_pn = next_PN;
2493         psa->sc = psc;
2494
2495         os_get_time(&psa->created_time);
2496         psa->in_use = FALSE;
2497
2498         dl_list_add(&psc->sa_list, &psa->list);
2499         wpa_printf(MSG_DEBUG,
2500                    "KaY: Create transmit SA(an: %hhu, next_PN: %u) of SC(channel: %d)",
2501                    an, next_PN, psc->channel);
2502
2503         return psa;
2504 }
2505
2506
2507 /**
2508  * ieee802_1x_kay_deinit_transmit_sa -
2509  */
2510 static void ieee802_1x_kay_deinit_transmit_sa(struct transmit_sa *psa)
2511 {
2512         psa->pkey = NULL;
2513         wpa_printf(MSG_DEBUG,
2514                    "KaY: Delete transmit SA(an: %hhu) of SC",
2515                    psa->an);
2516         dl_list_del(&psa->list);
2517         os_free(psa);
2518 }
2519
2520
2521 /**
2522  * init_transmit_sc -
2523  */
2524 static struct transmit_sc *
2525 ieee802_1x_kay_init_transmit_sc(const struct ieee802_1x_mka_sci *sci,
2526                                 int channel)
2527 {
2528         struct transmit_sc *psc;
2529
2530         psc = os_zalloc(sizeof(*psc));
2531         if (!psc) {
2532                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
2533                 return NULL;
2534         }
2535         os_memcpy(&psc->sci, sci, sizeof(psc->sci));
2536         psc->channel = channel;
2537
2538         os_get_time(&psc->created_time);
2539         psc->transmitting = FALSE;
2540         psc->encoding_sa = FALSE;
2541         psc->enciphering_sa = FALSE;
2542
2543         dl_list_init(&psc->sa_list);
2544         wpa_printf(MSG_DEBUG, "KaY: Create transmit SC(channel: %d)", channel);
2545         wpa_hexdump(MSG_DEBUG, "SCI: ", (u8 *)sci , sizeof(*sci));
2546
2547         return psc;
2548 }
2549
2550
2551 /**
2552  * ieee802_1x_kay_deinit_transmit_sc -
2553  */
2554 static void
2555 ieee802_1x_kay_deinit_transmit_sc(
2556         struct ieee802_1x_mka_participant *participant, struct transmit_sc *psc)
2557 {
2558         struct transmit_sa *psa, *tmp;
2559
2560         wpa_printf(MSG_DEBUG, "KaY: Delete transmit SC(channel: %d)",
2561                    psc->channel);
2562         dl_list_for_each_safe(psa, tmp, &psc->sa_list, struct transmit_sa,
2563                               list) {
2564                 secy_disable_transmit_sa(participant->kay, psa);
2565                 ieee802_1x_kay_deinit_transmit_sa(psa);
2566         }
2567
2568         os_free(psc);
2569 }
2570
2571
2572 /****************** Interface between CP and KAY *********************/
2573 /**
2574  * ieee802_1x_kay_set_latest_sa_attr -
2575  */
2576 int ieee802_1x_kay_set_latest_sa_attr(struct ieee802_1x_kay *kay,
2577                                       struct ieee802_1x_mka_ki *lki, u8 lan,
2578                                       Boolean ltx, Boolean lrx)
2579 {
2580         struct ieee802_1x_mka_participant *principal;
2581
2582         principal = ieee802_1x_kay_get_principal_participant(kay);
2583         if (!principal)
2584                 return -1;
2585
2586         if (!lki)
2587                 os_memset(&principal->lki, 0, sizeof(principal->lki));
2588         else
2589                 os_memcpy(&principal->lki, lki, sizeof(principal->lki));
2590
2591         principal->lan = lan;
2592         principal->ltx = ltx;
2593         principal->lrx = lrx;
2594         if (!lki) {
2595                 kay->ltx_kn = 0;
2596                 kay->lrx_kn = 0;
2597         } else {
2598                 kay->ltx_kn = lki->kn;
2599                 kay->lrx_kn = lki->kn;
2600         }
2601         kay->ltx_an = lan;
2602         kay->lrx_an = lan;
2603
2604         return 0;
2605 }
2606
2607
2608 /**
2609  * ieee802_1x_kay_set_old_sa_attr -
2610  */
2611 int ieee802_1x_kay_set_old_sa_attr(struct ieee802_1x_kay *kay,
2612                                    struct ieee802_1x_mka_ki *oki,
2613                                    u8 oan, Boolean otx, Boolean orx)
2614 {
2615         struct ieee802_1x_mka_participant *principal;
2616
2617         principal = ieee802_1x_kay_get_principal_participant(kay);
2618         if (!principal)
2619                 return -1;
2620
2621         if (!oki)
2622                 os_memset(&principal->oki, 0, sizeof(principal->oki));
2623         else
2624                 os_memcpy(&principal->oki, oki, sizeof(principal->oki));
2625
2626         principal->oan = oan;
2627         principal->otx = otx;
2628         principal->orx = orx;
2629
2630         if (!oki) {
2631                 kay->otx_kn = 0;
2632                 kay->orx_kn = 0;
2633         } else {
2634                 kay->otx_kn = oki->kn;
2635                 kay->orx_kn = oki->kn;
2636         }
2637         kay->otx_an = oan;
2638         kay->orx_an = oan;
2639
2640         return 0;
2641 }
2642
2643
2644 /**
2645  * ieee802_1x_kay_create_sas -
2646  */
2647 int ieee802_1x_kay_create_sas(struct ieee802_1x_kay *kay,
2648                               struct ieee802_1x_mka_ki *lki)
2649 {
2650         struct data_key *sa_key, *latest_sak;
2651         struct ieee802_1x_mka_participant *principal;
2652         struct receive_sc *rxsc;
2653         struct receive_sa *rxsa;
2654         struct transmit_sa *txsa;
2655
2656         principal = ieee802_1x_kay_get_principal_participant(kay);
2657         if (!principal)
2658                 return -1;
2659
2660         latest_sak = NULL;
2661         dl_list_for_each(sa_key, &principal->sak_list, struct data_key, list) {
2662                 if (is_ki_equal(&sa_key->key_identifier, lki)) {
2663                         sa_key->rx_latest = TRUE;
2664                         sa_key->tx_latest = TRUE;
2665                         latest_sak = sa_key;
2666                         principal->to_use_sak = TRUE;
2667                 } else {
2668                         sa_key->rx_latest = FALSE;
2669                         sa_key->tx_latest = FALSE;
2670                 }
2671         }
2672         if (!latest_sak) {
2673                 wpa_printf(MSG_ERROR, "lki related sak not found");
2674                 return -1;
2675         }
2676
2677         dl_list_for_each(rxsc, &principal->rxsc_list, struct receive_sc, list) {
2678                 rxsa = ieee802_1x_kay_init_receive_sa(rxsc, latest_sak->an, 1,
2679                                                       latest_sak);
2680                 if (!rxsa)
2681                         return -1;
2682
2683                 secy_create_receive_sa(kay, rxsa);
2684         }
2685
2686         txsa = ieee802_1x_kay_init_transmit_sa(principal->txsc, latest_sak->an,
2687                                                1, latest_sak);
2688         if (!txsa)
2689                 return -1;
2690
2691         secy_create_transmit_sa(kay, txsa);
2692
2693
2694
2695         return 0;
2696 }
2697
2698
2699 /**
2700  * ieee802_1x_kay_delete_sas -
2701  */
2702 int ieee802_1x_kay_delete_sas(struct ieee802_1x_kay *kay,
2703                               struct ieee802_1x_mka_ki *ki)
2704 {
2705         struct data_key *sa_key, *pre_key;
2706         struct transmit_sa *txsa, *pre_txsa;
2707         struct receive_sa *rxsa, *pre_rxsa;
2708         struct receive_sc *rxsc;
2709         struct ieee802_1x_mka_participant *principal;
2710
2711         wpa_printf(MSG_DEBUG, "KaY: Entry into %s", __func__);
2712         principal = ieee802_1x_kay_get_principal_participant(kay);
2713         if (!principal)
2714                 return -1;
2715
2716         /* remove the transmit sa */
2717         dl_list_for_each_safe(txsa, pre_txsa, &principal->txsc->sa_list,
2718                               struct transmit_sa, list) {
2719                 if (is_ki_equal(&txsa->pkey->key_identifier, ki)) {
2720                         secy_disable_transmit_sa(kay, txsa);
2721                         ieee802_1x_kay_deinit_transmit_sa(txsa);
2722                 }
2723         }
2724
2725         /* remove the receive sa */
2726         dl_list_for_each(rxsc, &principal->rxsc_list, struct receive_sc, list) {
2727                 dl_list_for_each_safe(rxsa, pre_rxsa, &rxsc->sa_list,
2728                                       struct receive_sa, list) {
2729                         if (is_ki_equal(&rxsa->pkey->key_identifier, ki)) {
2730                                 secy_disable_receive_sa(kay, rxsa);
2731                                 ieee802_1x_kay_deinit_receive_sa(rxsa);
2732                         }
2733                 }
2734         }
2735
2736         /* remove the sak */
2737         dl_list_for_each_safe(sa_key, pre_key, &principal->sak_list,
2738                               struct data_key, list) {
2739                 if (is_ki_equal(&sa_key->key_identifier, ki)) {
2740                         ieee802_1x_kay_deinit_data_key(sa_key);
2741                         break;
2742                 }
2743                 if (principal->new_key == sa_key)
2744                         principal->new_key = NULL;
2745         }
2746
2747         return 0;
2748 }
2749
2750
2751 /**
2752  * ieee802_1x_kay_enable_tx_sas -
2753  */
2754 int ieee802_1x_kay_enable_tx_sas(struct ieee802_1x_kay *kay,
2755                                  struct ieee802_1x_mka_ki *lki)
2756 {
2757         struct ieee802_1x_mka_participant *principal;
2758         struct transmit_sa *txsa;
2759
2760         principal = ieee802_1x_kay_get_principal_participant(kay);
2761         if (!principal)
2762                 return -1;
2763
2764         dl_list_for_each(txsa, &principal->txsc->sa_list, struct transmit_sa,
2765                          list) {
2766                 if (is_ki_equal(&txsa->pkey->key_identifier, lki)) {
2767                         txsa->in_use = TRUE;
2768                         secy_enable_transmit_sa(kay, txsa);
2769                         ieee802_1x_cp_set_usingtransmitas(
2770                                 principal->kay->cp, TRUE);
2771                         ieee802_1x_cp_sm_step(principal->kay->cp);
2772                 }
2773         }
2774
2775         return 0;
2776 }
2777
2778
2779 /**
2780  * ieee802_1x_kay_enable_rx_sas -
2781  */
2782 int ieee802_1x_kay_enable_rx_sas(struct ieee802_1x_kay *kay,
2783                                  struct ieee802_1x_mka_ki *lki)
2784 {
2785         struct ieee802_1x_mka_participant *principal;
2786         struct receive_sa *rxsa;
2787         struct receive_sc *rxsc;
2788
2789         principal = ieee802_1x_kay_get_principal_participant(kay);
2790         if (!principal)
2791                 return -1;
2792
2793         dl_list_for_each(rxsc, &principal->rxsc_list, struct receive_sc, list) {
2794                 dl_list_for_each(rxsa, &rxsc->sa_list, struct receive_sa, list)
2795                 {
2796                         if (is_ki_equal(&rxsa->pkey->key_identifier, lki)) {
2797                                 rxsa->in_use = TRUE;
2798                                 secy_enable_receive_sa(kay, rxsa);
2799                                 ieee802_1x_cp_set_usingreceivesas(
2800                                         principal->kay->cp, TRUE);
2801                                 ieee802_1x_cp_sm_step(principal->kay->cp);
2802                         }
2803                 }
2804         }
2805
2806         return 0;
2807 }
2808
2809
2810 /**
2811  * ieee802_1x_kay_enable_new_info -
2812  */
2813 int ieee802_1x_kay_enable_new_info(struct ieee802_1x_kay *kay)
2814 {
2815         struct ieee802_1x_mka_participant *principal;
2816
2817         principal = ieee802_1x_kay_get_principal_participant(kay);
2818         if (!principal)
2819                 return -1;
2820
2821         if (principal->retry_count < MAX_RETRY_CNT) {
2822                 ieee802_1x_participant_send_mkpdu(principal);
2823                 principal->retry_count++;
2824         }
2825
2826         return 0;
2827 }
2828
2829
2830 /**
2831  * ieee802_1x_kay_cp_conf -
2832  */
2833 int ieee802_1x_kay_cp_conf(struct ieee802_1x_kay *kay,
2834                            struct ieee802_1x_cp_conf *pconf)
2835 {
2836         pconf->protect = kay->macsec_protect;
2837         pconf->replay_protect = kay->macsec_replay_protect;
2838         pconf->validate = kay->macsec_validate;
2839
2840         return 0;
2841 }
2842
2843
2844 /**
2845  * ieee802_1x_kay_alloc_cp_sm -
2846  */
2847 static struct ieee802_1x_cp_sm *
2848 ieee802_1x_kay_alloc_cp_sm(struct ieee802_1x_kay *kay)
2849 {
2850         struct ieee802_1x_cp_conf conf;
2851
2852         os_memset(&conf, 0, sizeof(conf));
2853         conf.protect = kay->macsec_protect;
2854         conf.replay_protect = kay->macsec_replay_protect;
2855         conf.validate = kay->macsec_validate;
2856         conf.replay_window = kay->macsec_replay_window;
2857
2858         return ieee802_1x_cp_sm_init(kay, &conf);
2859 }
2860
2861
2862 /**
2863  * ieee802_1x_kay_mkpdu_sanity_check -
2864  *     sanity check specified in clause 11.11.2 of IEEE802.1X-2010
2865  */
2866 static int ieee802_1x_kay_mkpdu_sanity_check(struct ieee802_1x_kay *kay,
2867                                              const u8 *buf, size_t len)
2868 {
2869         struct ieee8023_hdr *eth_hdr;
2870         struct ieee802_1x_hdr *eapol_hdr;
2871         struct ieee802_1x_mka_hdr *mka_hdr;
2872         struct ieee802_1x_mka_basic_body *body;
2873         size_t mka_msg_len;
2874         struct ieee802_1x_mka_participant *participant;
2875         size_t body_len;
2876         u8 icv[MAX_ICV_LEN];
2877         u8 *msg_icv;
2878
2879         eth_hdr = (struct ieee8023_hdr *) buf;
2880         eapol_hdr = (struct ieee802_1x_hdr *) (eth_hdr + 1);
2881         mka_hdr = (struct ieee802_1x_mka_hdr *) (eapol_hdr + 1);
2882
2883         /* destination address should be not individual address */
2884         if (os_memcmp(eth_hdr->dest, pae_group_addr, ETH_ALEN) != 0) {
2885                 wpa_printf(MSG_MSGDUMP,
2886                            "KaY: ethernet destination address is not PAE group address");
2887                 return -1;
2888         }
2889
2890         /* MKPDU should not be less than 32 octets */
2891         mka_msg_len = be_to_host16(eapol_hdr->length);
2892         if (mka_msg_len < 32) {
2893                 wpa_printf(MSG_MSGDUMP, "KaY: MKPDU is less than 32 octets");
2894                 return -1;
2895         }
2896         /* MKPDU should be a multiple of 4 octets */
2897         if ((mka_msg_len % 4) != 0) {
2898                 wpa_printf(MSG_MSGDUMP,
2899                            "KaY: MKPDU is not multiple of 4 octets");
2900                 return -1;
2901         }
2902
2903         body = (struct ieee802_1x_mka_basic_body *) mka_hdr;
2904         ieee802_1x_mka_dump_basic_body(body);
2905         body_len = get_mka_param_body_len(body);
2906         /* EAPOL-MKA body should comprise basic parameter set and ICV */
2907         if (mka_msg_len < MKA_HDR_LEN + body_len + DEFAULT_ICV_LEN) {
2908                 wpa_printf(MSG_ERROR,
2909                            "KaY: Received EAPOL-MKA Packet Body Length (%zu bytes) is less than the Basic Parameter Set Header Length (%zu bytes) + the Basic Parameter Set Body Length (%zu bytes) + %d bytes of ICV",
2910                            mka_msg_len, MKA_HDR_LEN,
2911                            body_len, DEFAULT_ICV_LEN);
2912                 return -1;
2913         }
2914
2915         /* CKN should be owned by I */
2916         participant = ieee802_1x_kay_get_participant(kay, body->ckn);
2917         if (!participant) {
2918                 wpa_printf(MSG_DEBUG, "CKN is not included in my CA");
2919                 return -1;
2920         }
2921
2922         /* algorithm agility check */
2923         if (os_memcmp(body->algo_agility, mka_algo_agility,
2924                       sizeof(body->algo_agility)) != 0) {
2925                 wpa_printf(MSG_ERROR,
2926                            "KaY: peer's algorithm agility not supported for me");
2927                 return -1;
2928         }
2929
2930         /* ICV check */
2931         /*
2932          * The ICV will comprise the final octets of the packet body, whatever
2933          * its size, not the fixed length 16 octets, indicated by the EAPOL
2934          * packet body length.
2935          */
2936         if (mka_alg_tbl[kay->mka_algindex].icv_hash(
2937                     participant->ick.key,
2938                     buf, len - mka_alg_tbl[kay->mka_algindex].icv_len, icv)) {
2939                 wpa_printf(MSG_ERROR, "KaY: omac1_aes_128 failed");
2940                 return -1;
2941         }
2942
2943         msg_icv = ieee802_1x_mka_decode_icv_body(participant, (u8 *) mka_hdr,
2944                                                  mka_msg_len);
2945         if (!msg_icv) {
2946                 wpa_printf(MSG_ERROR, "KaY: No ICV");
2947                 return -1;
2948         }
2949         if (os_memcmp_const(msg_icv, icv,
2950                             mka_alg_tbl[kay->mka_algindex].icv_len) != 0) {
2951                 wpa_printf(MSG_ERROR,
2952                            "KaY: Computed ICV is not equal to Received ICV");
2953                 return -1;
2954         }
2955
2956         return 0;
2957 }
2958
2959
2960 /**
2961  * ieee802_1x_kay_decode_mkpdu -
2962  */
2963 static int ieee802_1x_kay_decode_mkpdu(struct ieee802_1x_kay *kay,
2964                                        const u8 *buf, size_t len)
2965 {
2966         struct ieee802_1x_mka_participant *participant;
2967         struct ieee802_1x_mka_hdr *hdr;
2968         size_t body_len;
2969         size_t left_len;
2970         u8 body_type;
2971         int i;
2972         const u8 *pos;
2973         Boolean handled[256];
2974
2975         if (ieee802_1x_kay_mkpdu_sanity_check(kay, buf, len))
2976                 return -1;
2977
2978         /* handle basic parameter set */
2979         pos = buf + sizeof(struct ieee8023_hdr) + sizeof(struct ieee802_1x_hdr);
2980         left_len = len - sizeof(struct ieee8023_hdr) -
2981                 sizeof(struct ieee802_1x_hdr);
2982         participant = ieee802_1x_mka_decode_basic_body(kay, pos, left_len);
2983         if (!participant)
2984                 return -1;
2985
2986         /* to skip basic parameter set */
2987         hdr = (struct ieee802_1x_mka_hdr *) pos;
2988         body_len = get_mka_param_body_len(hdr);
2989         pos += body_len + MKA_HDR_LEN;
2990         left_len -= body_len + MKA_HDR_LEN;
2991
2992         /* check i am in the peer's peer list */
2993         if (ieee802_1x_mka_i_in_peerlist(participant, pos, left_len) &&
2994             !ieee802_1x_kay_is_in_live_peer(participant,
2995                                             participant->current_peer_id.mi)) {
2996                 /* accept the peer as live peer */
2997                 if (ieee802_1x_kay_is_in_potential_peer(
2998                             participant, participant->current_peer_id.mi)) {
2999                         if (!ieee802_1x_kay_move_live_peer(
3000                                     participant,
3001                                     participant->current_peer_id.mi,
3002                                     be_to_host32(participant->
3003                                                  current_peer_id.mn)))
3004                                 return -1;
3005                 } else if (!ieee802_1x_kay_create_live_peer(
3006                                    participant, participant->current_peer_id.mi,
3007                                    be_to_host32(participant->
3008                                                 current_peer_id.mn))) {
3009                                 return -1;
3010                 }
3011
3012                 ieee802_1x_kay_elect_key_server(participant);
3013                 ieee802_1x_kay_decide_macsec_use(participant);
3014         }
3015
3016         /*
3017          * Handle other parameter set than basic parameter set.
3018          * Each parameter set should be present only once.
3019          */
3020         for (i = 0; i < 256; i++)
3021                 handled[i] = FALSE;
3022
3023         handled[0] = TRUE;
3024         for (; left_len > MKA_HDR_LEN + DEFAULT_ICV_LEN;
3025              pos += body_len + MKA_HDR_LEN,
3026                      left_len -= body_len + MKA_HDR_LEN) {
3027                 hdr = (struct ieee802_1x_mka_hdr *) pos;
3028                 body_len = get_mka_param_body_len(hdr);
3029                 body_type = get_mka_param_body_type(hdr);
3030
3031                 if (body_type == MKA_ICV_INDICATOR)
3032                         return 0;
3033
3034                 if (left_len < (MKA_HDR_LEN + body_len + DEFAULT_ICV_LEN)) {
3035                         wpa_printf(MSG_ERROR,
3036                                    "KaY: MKA Peer Packet Body Length (%zu bytes) is less than the Parameter Set Header Length (%zu bytes) + the Parameter Set Body Length (%zu bytes) + %d bytes of ICV",
3037                                    left_len, MKA_HDR_LEN,
3038                                    body_len, DEFAULT_ICV_LEN);
3039                         continue;
3040                 }
3041
3042                 if (handled[body_type])
3043                         continue;
3044
3045                 handled[body_type] = TRUE;
3046                 if (body_type < ARRAY_SIZE(mka_body_handler) &&
3047                     mka_body_handler[body_type].body_rx) {
3048                         mka_body_handler[body_type].body_rx
3049                                 (participant, pos, left_len);
3050                 } else {
3051                         wpa_printf(MSG_ERROR,
3052                                    "The type %d is not supported in this MKA version %d",
3053                                    body_type, MKA_VERSION_ID);
3054                 }
3055         }
3056
3057         kay->active = TRUE;
3058         participant->retry_count = 0;
3059         participant->active = TRUE;
3060
3061         return 0;
3062 }
3063
3064
3065
3066 static void kay_l2_receive(void *ctx, const u8 *src_addr, const u8 *buf,
3067                            size_t len)
3068 {
3069         struct ieee802_1x_kay *kay = ctx;
3070         struct ieee8023_hdr *eth_hdr;
3071         struct ieee802_1x_hdr *eapol_hdr;
3072
3073         /* must contain at least ieee8023_hdr + ieee802_1x_hdr */
3074         if (len < sizeof(*eth_hdr) + sizeof(*eapol_hdr)) {
3075                 wpa_printf(MSG_MSGDUMP, "KaY: EAPOL frame too short (%lu)",
3076                            (unsigned long) len);
3077                 return;
3078         }
3079
3080         eth_hdr = (struct ieee8023_hdr *) buf;
3081         eapol_hdr = (struct ieee802_1x_hdr *) (eth_hdr + 1);
3082         if (len != sizeof(*eth_hdr) + sizeof(*eapol_hdr) +
3083             be_to_host16(eapol_hdr->length)) {
3084                 wpa_printf(MSG_MSGDUMP, "KAY: EAPOL MPDU is invalid: (%lu-%lu)",
3085                            (unsigned long) len,
3086                            (unsigned long) be_to_host16(eapol_hdr->length));
3087                 return;
3088         }
3089
3090         if (eapol_hdr->version < EAPOL_VERSION) {
3091                 wpa_printf(MSG_MSGDUMP, "KaY: version %d does not support MKA",
3092                            eapol_hdr->version);
3093                 return;
3094         }
3095         if (be_to_host16(eth_hdr->ethertype) != ETH_P_PAE ||
3096             eapol_hdr->type != IEEE802_1X_TYPE_EAPOL_MKA)
3097                 return;
3098
3099         wpa_hexdump(MSG_DEBUG, "RX EAPOL-MKA: ", buf, len);
3100         if (dl_list_empty(&kay->participant_list)) {
3101                 wpa_printf(MSG_ERROR, "KaY: no MKA participant instance");
3102                 return;
3103         }
3104
3105         ieee802_1x_kay_decode_mkpdu(kay, buf, len);
3106 }
3107
3108
3109 /**
3110  * ieee802_1x_kay_init -
3111  */
3112 struct ieee802_1x_kay *
3113 ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
3114                     const char *ifname, const u8 *addr)
3115 {
3116         struct ieee802_1x_kay *kay;
3117
3118         kay = os_zalloc(sizeof(*kay));
3119         if (!kay) {
3120                 wpa_printf(MSG_ERROR, "KaY-%s: out of memory", __func__);
3121                 return NULL;
3122         }
3123
3124         kay->ctx = ctx;
3125
3126         kay->enable = TRUE;
3127         kay->active = FALSE;
3128
3129         kay->authenticated = FALSE;
3130         kay->secured = FALSE;
3131         kay->failed = FALSE;
3132         kay->policy = policy;
3133
3134         os_strlcpy(kay->if_name, ifname, IFNAMSIZ);
3135         os_memcpy(kay->actor_sci.addr, addr, ETH_ALEN);
3136         kay->actor_sci.port = host_to_be16(0x0001);
3137         kay->actor_priority = DEFAULT_PRIO_NOT_KEY_SERVER;
3138
3139         /* While actor acts as a key server, shall distribute sakey */
3140         kay->dist_kn = 1;
3141         kay->dist_an = 0;
3142         kay->dist_time = 0;
3143
3144         kay->pn_exhaustion = PENDING_PN_EXHAUSTION;
3145         kay->macsec_csindex = DEFAULT_CS_INDEX;
3146         kay->mka_algindex = DEFAULT_MKA_ALG_INDEX;
3147         kay->mka_version = MKA_VERSION_ID;
3148
3149         os_memcpy(kay->algo_agility, mka_algo_agility,
3150                   sizeof(kay->algo_agility));
3151
3152         dl_list_init(&kay->participant_list);
3153
3154         if (policy == DO_NOT_SECURE) {
3155                 kay->macsec_capable = MACSEC_CAP_NOT_IMPLEMENTED;
3156                 kay->macsec_desired = FALSE;
3157                 kay->macsec_protect = FALSE;
3158                 kay->macsec_validate = Disabled;
3159                 kay->macsec_replay_protect = FALSE;
3160                 kay->macsec_replay_window = 0;
3161                 kay->macsec_confidentiality = CONFIDENTIALITY_NONE;
3162         } else {
3163                 kay->macsec_capable = MACSEC_CAP_INTEG_AND_CONF_0_30_50;
3164                 kay->macsec_desired = TRUE;
3165                 kay->macsec_protect = TRUE;
3166                 kay->macsec_validate = Strict;
3167                 kay->macsec_replay_protect = FALSE;
3168                 kay->macsec_replay_window = 0;
3169                 kay->macsec_confidentiality = CONFIDENTIALITY_OFFSET_0;
3170         }
3171
3172         wpa_printf(MSG_DEBUG, "KaY: state machine created");
3173
3174         /* Initialize the SecY must be prio to CP, as CP will control SecY */
3175         secy_init_macsec(kay);
3176         secy_get_available_transmit_sc(kay, &kay->sc_ch);
3177
3178         wpa_printf(MSG_DEBUG, "KaY: secy init macsec done");
3179
3180         /* init CP */
3181         kay->cp = ieee802_1x_kay_alloc_cp_sm(kay);
3182         if (kay->cp == NULL) {
3183                 ieee802_1x_kay_deinit(kay);
3184                 return NULL;
3185         }
3186
3187         if (policy == DO_NOT_SECURE) {
3188                 ieee802_1x_cp_connect_authenticated(kay->cp);
3189                 ieee802_1x_cp_sm_step(kay->cp);
3190         } else {
3191                 kay->l2_mka = l2_packet_init(kay->if_name, NULL, ETH_P_PAE,
3192                                              kay_l2_receive, kay, 1);
3193                 if (kay->l2_mka == NULL) {
3194                         wpa_printf(MSG_WARNING,
3195                                    "KaY: Failed to initialize L2 packet processing for MKA packet");
3196                         ieee802_1x_kay_deinit(kay);
3197                         return NULL;
3198                 }
3199         }
3200
3201         return kay;
3202 }
3203
3204
3205 /**
3206  * ieee802_1x_kay_deinit -
3207  */
3208 void
3209 ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay)
3210 {
3211         struct ieee802_1x_mka_participant *participant;
3212
3213         if (!kay)
3214                 return;
3215
3216         wpa_printf(MSG_DEBUG, "KaY: state machine removed");
3217
3218         while (!dl_list_empty(&kay->participant_list)) {
3219                 participant = dl_list_entry(kay->participant_list.next,
3220                                             struct ieee802_1x_mka_participant,
3221                                             list);
3222                 ieee802_1x_kay_delete_mka(kay, &participant->ckn);
3223         }
3224
3225         ieee802_1x_cp_sm_deinit(kay->cp);
3226         secy_deinit_macsec(kay);
3227
3228         if (kay->l2_mka) {
3229                 l2_packet_deinit(kay->l2_mka);
3230                 kay->l2_mka = NULL;
3231         }
3232
3233         os_free(kay->ctx);
3234         os_free(kay);
3235 }
3236
3237
3238 /**
3239  * ieee802_1x_kay_create_mka -
3240  */
3241 struct ieee802_1x_mka_participant *
3242 ieee802_1x_kay_create_mka(struct ieee802_1x_kay *kay, struct mka_key_name *ckn,
3243                           struct mka_key *cak, u32 life,
3244                           enum mka_created_mode mode, Boolean is_authenticator)
3245 {
3246         struct ieee802_1x_mka_participant *participant;
3247         unsigned int usecs;
3248
3249         if (!kay || !ckn || !cak) {
3250                 wpa_printf(MSG_ERROR, "KaY: ckn or cak is null");
3251                 return NULL;
3252         }
3253
3254         if (cak->len != mka_alg_tbl[kay->mka_algindex].cak_len) {
3255                 wpa_printf(MSG_ERROR, "KaY: CAK length not follow key schema");
3256                 return NULL;
3257         }
3258         if (ckn->len > MAX_CKN_LEN) {
3259                 wpa_printf(MSG_ERROR, "KaY: CKN is out of range(<=32 bytes)");
3260                 return NULL;
3261         }
3262         if (!kay->enable) {
3263                 wpa_printf(MSG_ERROR, "KaY: Now is at disable state");
3264                 return NULL;
3265         }
3266
3267         participant = os_zalloc(sizeof(*participant));
3268         if (!participant) {
3269                 wpa_printf(MSG_ERROR, "KaY-%s: out of memory", __func__);
3270                 return NULL;
3271         }
3272
3273         participant->ckn.len = ckn->len;
3274         os_memcpy(participant->ckn.name, ckn->name, ckn->len);
3275         participant->cak.len = cak->len;
3276         os_memcpy(participant->cak.key, cak->key, cak->len);
3277         if (life)
3278                 participant->cak_life = life + time(NULL);
3279
3280         switch (mode) {
3281         case EAP_EXCHANGE:
3282                 if (is_authenticator) {
3283                         participant->is_obliged_key_server = TRUE;
3284                         participant->can_be_key_server = TRUE;
3285                         participant->is_key_server = TRUE;
3286                         participant->principal = TRUE;
3287
3288                         os_memcpy(&kay->key_server_sci, &kay->actor_sci,
3289                                   sizeof(kay->key_server_sci));
3290                         kay->key_server_priority = kay->actor_priority;
3291                         participant->is_elected = TRUE;
3292                 } else {
3293                         participant->is_obliged_key_server = FALSE;
3294                         participant->can_be_key_server = FALSE;
3295                         participant->is_key_server = FALSE;
3296                         participant->is_elected = TRUE;
3297                 }
3298                 break;
3299
3300         default:
3301                 participant->is_obliged_key_server = FALSE;
3302                 participant->can_be_key_server = TRUE;
3303                 participant->is_key_server = TRUE;
3304                 participant->is_elected = FALSE;
3305                 break;
3306         }
3307
3308         participant->cached = FALSE;
3309
3310         participant->active = FALSE;
3311         participant->participant = FALSE;
3312         participant->retain = FALSE;
3313         participant->activate = DEFAULT;
3314
3315         if (participant->is_key_server)
3316                 participant->principal = TRUE;
3317
3318         dl_list_init(&participant->live_peers);
3319         dl_list_init(&participant->potential_peers);
3320
3321         participant->retry_count = 0;
3322         participant->kay = kay;
3323
3324         if (!reset_participant_mi(participant))
3325                 goto fail;
3326
3327         participant->lrx = FALSE;
3328         participant->ltx = FALSE;
3329         participant->orx = FALSE;
3330         participant->otx = FALSE;
3331         participant->to_dist_sak = FALSE;
3332         participant->to_use_sak = FALSE;
3333         participant->new_sak = FALSE;
3334         dl_list_init(&participant->sak_list);
3335         participant->new_key = NULL;
3336         dl_list_init(&participant->rxsc_list);
3337         participant->txsc = ieee802_1x_kay_init_transmit_sc(&kay->actor_sci,
3338                                                             kay->sc_ch);
3339         secy_cp_control_protect_frames(kay, kay->macsec_protect);
3340         secy_cp_control_replay(kay, kay->macsec_replay_protect,
3341                                kay->macsec_replay_window);
3342         secy_create_transmit_sc(kay, participant->txsc);
3343
3344         /* to derive KEK from CAK and CKN */
3345         participant->kek.len = mka_alg_tbl[kay->mka_algindex].kek_len;
3346         if (mka_alg_tbl[kay->mka_algindex].kek_trfm(participant->cak.key,
3347                                                     participant->ckn.name,
3348                                                     participant->ckn.len,
3349                                                     participant->kek.key)) {
3350                 wpa_printf(MSG_ERROR, "KaY: Derived KEK failed");
3351                 goto fail;
3352         }
3353         wpa_hexdump_key(MSG_DEBUG, "KaY: Derived KEK",
3354                         participant->kek.key, participant->kek.len);
3355
3356         /* to derive ICK from CAK and CKN */
3357         participant->ick.len = mka_alg_tbl[kay->mka_algindex].ick_len;
3358         if (mka_alg_tbl[kay->mka_algindex].ick_trfm(participant->cak.key,
3359                                                     participant->ckn.name,
3360                                                     participant->ckn.len,
3361                                                     participant->ick.key)) {
3362                 wpa_printf(MSG_ERROR, "KaY: Derived ICK failed");
3363                 goto fail;
3364         }
3365         wpa_hexdump_key(MSG_DEBUG, "KaY: Derived ICK",
3366                         participant->ick.key, participant->ick.len);
3367
3368         dl_list_add(&kay->participant_list, &participant->list);
3369         wpa_hexdump(MSG_DEBUG, "KaY: Participant created:",
3370                     ckn->name, ckn->len);
3371
3372         usecs = os_random() % (MKA_HELLO_TIME * 1000);
3373         eloop_register_timeout(0, usecs, ieee802_1x_participant_timer,
3374                                participant, NULL);
3375         participant->mka_life = MKA_LIFE_TIME / 1000 + time(NULL) +
3376                 usecs / 1000000;
3377
3378         return participant;
3379
3380 fail:
3381         os_free(participant);
3382         return NULL;
3383 }
3384
3385
3386 /**
3387  * ieee802_1x_kay_delete_mka -
3388  */
3389 void
3390 ieee802_1x_kay_delete_mka(struct ieee802_1x_kay *kay, struct mka_key_name *ckn)
3391 {
3392         struct ieee802_1x_mka_participant *participant;
3393         struct ieee802_1x_kay_peer *peer;
3394         struct data_key *sak;
3395         struct receive_sc *rxsc;
3396
3397         if (!kay || !ckn)
3398                 return;
3399
3400         wpa_printf(MSG_DEBUG, "KaY: participant removed");
3401
3402         /* get the participant */
3403         participant = ieee802_1x_kay_get_participant(kay, ckn->name);
3404         if (!participant) {
3405                 wpa_hexdump(MSG_DEBUG, "KaY: participant is not found",
3406                             ckn->name, ckn->len);
3407                 return;
3408         }
3409
3410         eloop_cancel_timeout(ieee802_1x_participant_timer, participant, NULL);
3411         dl_list_del(&participant->list);
3412
3413         /* remove live peer */
3414         while (!dl_list_empty(&participant->live_peers)) {
3415                 peer = dl_list_entry(participant->live_peers.next,
3416                                      struct ieee802_1x_kay_peer, list);
3417                 dl_list_del(&peer->list);
3418                 os_free(peer);
3419         }
3420
3421         /* remove potential peer */
3422         while (!dl_list_empty(&participant->potential_peers)) {
3423                 peer = dl_list_entry(participant->potential_peers.next,
3424                                      struct ieee802_1x_kay_peer, list);
3425                 dl_list_del(&peer->list);
3426                 os_free(peer);
3427         }
3428
3429         /* remove sak */
3430         while (!dl_list_empty(&participant->sak_list)) {
3431                 sak = dl_list_entry(participant->sak_list.next,
3432                                     struct data_key, list);
3433                 dl_list_del(&sak->list);
3434                 os_free(sak->key);
3435                 os_free(sak);
3436         }
3437         while (!dl_list_empty(&participant->rxsc_list)) {
3438                 rxsc = dl_list_entry(participant->rxsc_list.next,
3439                                      struct receive_sc, list);
3440                 secy_delete_receive_sc(kay, rxsc);
3441                 ieee802_1x_kay_deinit_receive_sc(participant, rxsc);
3442         }
3443         secy_delete_transmit_sc(kay, participant->txsc);
3444         ieee802_1x_kay_deinit_transmit_sc(participant, participant->txsc);
3445
3446         os_memset(&participant->cak, 0, sizeof(participant->cak));
3447         os_memset(&participant->kek, 0, sizeof(participant->kek));
3448         os_memset(&participant->ick, 0, sizeof(participant->ick));
3449         os_free(participant);
3450 }
3451
3452
3453 /**
3454  * ieee802_1x_kay_mka_participate -
3455  */
3456 void ieee802_1x_kay_mka_participate(struct ieee802_1x_kay *kay,
3457                                     struct mka_key_name *ckn,
3458                                     Boolean status)
3459 {
3460         struct ieee802_1x_mka_participant *participant;
3461
3462         if (!kay || !ckn)
3463                 return;
3464
3465         participant = ieee802_1x_kay_get_participant(kay, ckn->name);
3466         if (!participant)
3467                 return;
3468
3469         participant->active = status;
3470 }
3471
3472
3473 /**
3474  * ieee802_1x_kay_new_sak -
3475  */
3476 int
3477 ieee802_1x_kay_new_sak(struct ieee802_1x_kay *kay)
3478 {
3479         struct ieee802_1x_mka_participant *participant;
3480
3481         if (!kay)
3482                 return -1;
3483
3484         participant = ieee802_1x_kay_get_principal_participant(kay);
3485         if (!participant)
3486                 return -1;
3487
3488         participant->new_sak = TRUE;
3489         wpa_printf(MSG_DEBUG, "KaY: new SAK signal");
3490
3491         return 0;
3492 }
3493
3494
3495 /**
3496  * ieee802_1x_kay_change_cipher_suite -
3497  */
3498 int
3499 ieee802_1x_kay_change_cipher_suite(struct ieee802_1x_kay *kay,
3500                                    unsigned int cs_index)
3501 {
3502         struct ieee802_1x_mka_participant *participant;
3503
3504         if (!kay)
3505                 return -1;
3506
3507         if (cs_index >= CS_TABLE_SIZE) {
3508                 wpa_printf(MSG_ERROR,
3509                            "KaY: Configured cipher suite index is out of range");
3510                 return -1;
3511         }
3512         if (kay->macsec_csindex == cs_index)
3513                 return -2;
3514
3515         if (cs_index == 0)
3516                 kay->macsec_desired = FALSE;
3517
3518         kay->macsec_csindex = cs_index;
3519         kay->macsec_capable = cipher_suite_tbl[kay->macsec_csindex].capable;
3520
3521         participant = ieee802_1x_kay_get_principal_participant(kay);
3522         if (participant) {
3523                 wpa_printf(MSG_INFO, "KaY: Cipher Suite changed");
3524                 participant->new_sak = TRUE;
3525         }
3526
3527         return 0;
3528 }