src/pae/ieee802_1x_kay.c

   1 /*
   2  * IEEE 802.1X-2010 Key Agree Protocol of PAE state machine
   3  * Copyright (c) 2013, Qualcomm Atheros, Inc.
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include <time.h>
  10 #include "includes.h"
  11 #include "common.h"
  12 #include "list.h"
  13 #include "eloop.h"
  14 #include "wpabuf.h"
  15 #include "state_machine.h"
  16 #include "l2_packet/l2_packet.h"
  17 #include "common/eapol_common.h"
  18 #include "crypto/aes_wrap.h"
  19 #include "ieee802_1x_cp.h"
  20 #include "ieee802_1x_key.h"
  21 #include "ieee802_1x_kay.h"
  22 #include "ieee802_1x_kay_i.h"
  23 #include "ieee802_1x_secy_ops.h"
  24
  25
  26 #define DEFAULT_SA_KEY_LEN      16
  27 #define DEFAULT_ICV_LEN         16
  28 #define MAX_ICV_LEN             32  /* 32 bytes, 256 bits */
  29
  30 #define PENDING_PN_EXHAUSTION 0xC0000000
  31
  32 #define MKA_ALIGN_LENGTH(len) (((len) + 0x3) & ~0x3)
  33
  34 /* IEEE Std 802.1X-2010, Table 9-1 - MKA Algorithm Agility */
  35 #define MKA_ALGO_AGILITY_2009 { 0x00, 0x80, 0xC2, 0x01 }
  36 static u8 mka_algo_agility[4] = MKA_ALGO_AGILITY_2009;
  37
  38 /* IEEE802.1AE-2006 Table 14-1 MACsec Cipher Suites */
  39 static struct macsec_ciphersuite cipher_suite_tbl[] = {
  40         /* GCM-AES-128 */
  41         {
  42                 .id = CS_ID_GCM_AES_128,
  43                 .name = CS_NAME_GCM_AES_128,
  44                 .capable = MACSEC_CAP_INTEG_AND_CONF_0_30_50,
  45                 .sak_len = DEFAULT_SA_KEY_LEN,
  46                 .index = 0,
  47         },
  48 };
  49 #define CS_TABLE_SIZE (ARRAY_SIZE(cipher_suite_tbl))
  50 #define DEFAULT_CS_INDEX  0
  51
  52 static struct mka_alg mka_alg_tbl[] = {
  53         {
  54                 .parameter = MKA_ALGO_AGILITY_2009,
  55
  56                 /* 128-bit CAK, KEK, ICK, ICV */
  57                 .cak_len = DEFAULT_ICV_LEN,
  58                 .kek_len = DEFAULT_ICV_LEN,
  59                 .ick_len = DEFAULT_ICV_LEN,
  60                 .icv_len = DEFAULT_ICV_LEN,
  61
  62                 .cak_trfm = ieee802_1x_cak_128bits_aes_cmac,
  63                 .ckn_trfm = ieee802_1x_ckn_128bits_aes_cmac,
  64                 .kek_trfm = ieee802_1x_kek_128bits_aes_cmac,
  65                 .ick_trfm = ieee802_1x_ick_128bits_aes_cmac,
  66                 .icv_hash = ieee802_1x_icv_128bits_aes_cmac,
  67
  68                 .index = 1,
  69         },
  70 };
  71 #define MKA_ALG_TABLE_SIZE (ARRAY_SIZE(mka_alg_tbl))
  72
  73
  74 static int is_ki_equal(struct ieee802_1x_mka_ki *ki1,
  75                        struct ieee802_1x_mka_ki *ki2)
  76 {
  77         return os_memcmp(ki1->mi, ki2->mi, MI_LEN) == 0 &&
  78                 ki1->kn == ki2->kn;
  79 }
  80
  81
  82 struct mka_param_body_handler {
  83         int (*body_tx)(struct ieee802_1x_mka_participant *participant,
  84                        struct wpabuf *buf);
  85         int (*body_rx)(struct ieee802_1x_mka_participant *participant,
  86                        const u8 *mka_msg, size_t msg_len);
  87         int (*body_length)(struct ieee802_1x_mka_participant *participant);
  88         Boolean (*body_present)(struct ieee802_1x_mka_participant *participant);
  89 };
  90
  91
  92 static void set_mka_param_body_len(void *body, unsigned int len)
  93 {
  94         struct ieee802_1x_mka_hdr *hdr = body;
  95         hdr->length = (len >> 8) & 0x0f;
  96         hdr->length1 = len & 0xff;
  97 }
  98
  99
 100 static unsigned int get_mka_param_body_len(const void *body)
 101 {
 102         const struct ieee802_1x_mka_hdr *hdr = body;
 103         return (hdr->length << 8) | hdr->length1;
 104 }
 105
 106
 107 static u8 get_mka_param_body_type(const void *body)
 108 {
 109         const struct ieee802_1x_mka_hdr *hdr = body;
 110         return hdr->type;
 111 }
 112
 113
 114 /**
 115  * ieee802_1x_mka_dump_basic_body -
 116  */
 117 static void
 118 ieee802_1x_mka_dump_basic_body(struct ieee802_1x_mka_basic_body *body)
 119 {
 120         size_t body_len;
 121
 122         if (!body)
 123                 return;
 124
 125         body_len = get_mka_param_body_len(body);
 126         wpa_printf(MSG_DEBUG, "*** MKA Basic Parameter set ***");
 127         wpa_printf(MSG_DEBUG, "\tVersion.......: %d", body->version);
 128         wpa_printf(MSG_DEBUG, "\tPriority......: %d", body->priority);
 129         wpa_printf(MSG_DEBUG, "\tKeySvr........: %d", body->key_server);
 130         wpa_printf(MSG_DEBUG, "\tMACSecDesired.: %d", body->macsec_desired);
 131         wpa_printf(MSG_DEBUG, "\tMACSecCapable.: %d", body->macsec_capability);
 132         wpa_printf(MSG_DEBUG, "\tBody Length...: %zu", body_len);
 133         wpa_printf(MSG_DEBUG, "\tSCI MAC.......: " MACSTR,
 134                    MAC2STR(body->actor_sci.addr));
 135         wpa_printf(MSG_DEBUG, "\tSCI Port .....: %d",
 136                    be_to_host16(body->actor_sci.port));
 137         wpa_hexdump(MSG_DEBUG, "\tMember Id.....:",
 138                     body->actor_mi, sizeof(body->actor_mi));
 139         wpa_printf(MSG_DEBUG, "\tMessage Number: %d",
 140                    be_to_host32(body->actor_mn));
 141         wpa_hexdump(MSG_DEBUG, "\tAlgo Agility..:",
 142                     body->algo_agility, sizeof(body->algo_agility));
 143         wpa_hexdump_ascii(MSG_DEBUG, "\tCAK Name......:", body->ckn,
 144                           body_len + MKA_HDR_LEN - sizeof(*body));
 145 }
 146
 147
 148 /**
 149  * ieee802_1x_mka_dump_peer_body -
 150  */
 151 static void
 152 ieee802_1x_mka_dump_peer_body(struct ieee802_1x_mka_peer_body *body)
 153 {
 154         size_t body_len;
 155         size_t i;
 156         u8 *mi;
 157         be32 mn;
 158
 159         if (body == NULL)
 160                 return;
 161
 162         body_len = get_mka_param_body_len(body);
 163         if (body->type == MKA_LIVE_PEER_LIST) {
 164                 wpa_printf(MSG_DEBUG, "*** Live Peer List ***");
 165                 wpa_printf(MSG_DEBUG, "\tBody Length...: %zu", body_len);
 166         } else if (body->type == MKA_POTENTIAL_PEER_LIST) {
 167                 wpa_printf(MSG_DEBUG, "*** Potential Live Peer List ***");
 168                 wpa_printf(MSG_DEBUG, "\tBody Length...: %zu", body_len);
 169         }
 170
 171         for (i = 0; i < body_len; i += MI_LEN + sizeof(mn)) {
 172                 mi = body->peer + i;
 173                 os_memcpy(&mn, mi + MI_LEN, sizeof(mn));
 174                 wpa_hexdump_ascii(MSG_DEBUG, "\tMember Id.....:", mi, MI_LEN);
 175                 wpa_printf(MSG_DEBUG, "\tMessage Number: %d", be_to_host32(mn));
 176         }
 177 }
 178
 179
 180 /**
 181  * ieee802_1x_mka_dump_dist_sak_body -
 182  */
 183 static void
 184 ieee802_1x_mka_dump_dist_sak_body(struct ieee802_1x_mka_dist_sak_body *body)
 185 {
 186         size_t body_len;
 187
 188         if (body == NULL)
 189                 return;
 190
 191         body_len = get_mka_param_body_len(body);
 192         wpa_printf(MSG_INFO, "*** Distributed SAK ***");
 193         wpa_printf(MSG_INFO, "\tDistributed AN........: %d", body->dan);
 194         wpa_printf(MSG_INFO, "\tConfidentiality Offset: %d",
 195                    body->confid_offset);
 196         wpa_printf(MSG_INFO, "\tBody Length...........: %zu", body_len);
 197         if (!body_len)
 198                 return;
 199
 200         wpa_printf(MSG_INFO, "\tKey Number............: %d",
 201                    be_to_host32(body->kn));
 202         wpa_hexdump(MSG_INFO, "\tAES Key Wrap of SAK...:", body->sak, 24);
 203 }
 204
 205
 206 static const char * yes_no(int val)
 207 {
 208         return val ? "Yes" : "No";
 209 }
 210
 211
 212 /**
 213  * ieee802_1x_mka_dump_sak_use_body -
 214  */
 215 static void
 216 ieee802_1x_mka_dump_sak_use_body(struct ieee802_1x_mka_sak_use_body *body)
 217 {
 218         int body_len;
 219
 220         if (body == NULL)
 221                 return;
 222
 223         body_len = get_mka_param_body_len(body);
 224         wpa_printf(MSG_DEBUG, "*** MACsec SAK Use ***");
 225         wpa_printf(MSG_DEBUG, "\tLatest Key AN....: %d", body->lan);
 226         wpa_printf(MSG_DEBUG, "\tLatest Key Tx....: %s", yes_no(body->ltx));
 227         wpa_printf(MSG_DEBUG, "\tLatest Key Rx....: %s", yes_no(body->lrx));
 228         wpa_printf(MSG_DEBUG, "\tOld Key AN....: %d", body->oan);
 229         wpa_printf(MSG_DEBUG, "\tOld Key Tx....: %s", yes_no(body->otx));
 230         wpa_printf(MSG_DEBUG, "\tOld Key Rx....: %s", yes_no(body->orx));
 231         wpa_printf(MSG_DEBUG, "\tPlain Key Tx....: %s", yes_no(body->ptx));
 232         wpa_printf(MSG_DEBUG, "\tPlain Key Rx....: %s", yes_no(body->prx));
 233         wpa_printf(MSG_DEBUG, "\tDelay Protect....: %s",
 234                    yes_no(body->delay_protect));
 235         wpa_printf(MSG_DEBUG, "\tBody Length......: %d", body_len);
 236         if (!body_len)
 237                 return;
 238
 239         wpa_hexdump(MSG_DEBUG, "\tKey Server MI....:",
 240                     body->lsrv_mi, sizeof(body->lsrv_mi));
 241         wpa_printf(MSG_DEBUG, "\tKey Number.......: %u",
 242                    be_to_host32(body->lkn));
 243         wpa_printf(MSG_DEBUG, "\tLowest PN........: %u",
 244                    be_to_host32(body->llpn));
 245         wpa_hexdump_ascii(MSG_DEBUG, "\tOld Key Server MI....:",
 246                           body->osrv_mi, sizeof(body->osrv_mi));
 247         wpa_printf(MSG_DEBUG, "\tOld Key Number.......: %u",
 248                    be_to_host32(body->okn));
 249         wpa_printf(MSG_DEBUG, "\tOld Lowest PN........: %u",
 250                    be_to_host32(body->olpn));
 251 }
 252
 253
 254 /**
 255  * ieee802_1x_kay_get_participant -
 256  */
 257 static struct ieee802_1x_mka_participant *
 258 ieee802_1x_kay_get_participant(struct ieee802_1x_kay *kay, const u8 *ckn)
 259 {
 260         struct ieee802_1x_mka_participant *participant;
 261
 262         dl_list_for_each(participant, &kay->participant_list,
 263                          struct ieee802_1x_mka_participant, list) {
 264                 if (os_memcmp(participant->ckn.name, ckn,
 265                               participant->ckn.len) == 0)
 266                         return participant;
 267         }
 268
 269         wpa_printf(MSG_DEBUG, "KaY: participant is not found");
 270
 271         return NULL;
 272 }
 273
 274
 275 /**
 276  * ieee802_1x_kay_get_principal_participant -
 277  */
 278 static struct ieee802_1x_mka_participant *
 279 ieee802_1x_kay_get_principal_participant(struct ieee802_1x_kay *kay)
 280 {
 281         struct ieee802_1x_mka_participant *participant;
 282
 283         dl_list_for_each(participant, &kay->participant_list,
 284                          struct ieee802_1x_mka_participant, list) {
 285                 if (participant->principal)
 286                         return participant;
 287         }
 288
 289         wpa_printf(MSG_DEBUG, "KaY: principal participant is not founded");
 290         return NULL;
 291 }
 292
 293
 294 static struct ieee802_1x_kay_peer * get_peer_mi(struct dl_list *peers,
 295                                                 const u8 *mi)
 296 {
 297         struct ieee802_1x_kay_peer *peer;
 298
 299         dl_list_for_each(peer, peers, struct ieee802_1x_kay_peer, list) {
 300                 if (os_memcmp(peer->mi, mi, MI_LEN) == 0)
 301                         return peer;
 302         }
 303
 304         return NULL;
 305 }
 306
 307
 308 /**
 309  * ieee802_1x_kay_get_potential_peer
 310  */
 311 static struct ieee802_1x_kay_peer *
 312 ieee802_1x_kay_get_potential_peer(
 313         struct ieee802_1x_mka_participant *participant, const u8 *mi)
 314 {
 315         return get_peer_mi(&participant->potential_peers, mi);
 316 }
 317
 318
 319 /**
 320  * ieee802_1x_kay_get_live_peer
 321  */
 322 static struct ieee802_1x_kay_peer *
 323 ieee802_1x_kay_get_live_peer(struct ieee802_1x_mka_participant *participant,
 324                              const u8 *mi)
 325 {
 326         return get_peer_mi(&participant->live_peers, mi);
 327 }
 328
 329
 330 /**
 331  * ieee802_1x_kay_is_in_potential_peer
 332  */
 333 static Boolean
 334 ieee802_1x_kay_is_in_potential_peer(
 335         struct ieee802_1x_mka_participant *participant, const u8 *mi)
 336 {
 337         return ieee802_1x_kay_get_potential_peer(participant, mi) != NULL;
 338 }
 339
 340
 341 /**
 342  * ieee802_1x_kay_is_in_live_peer
 343  */
 344 static Boolean
 345 ieee802_1x_kay_is_in_live_peer(
 346         struct ieee802_1x_mka_participant *participant, const u8 *mi)
 347 {
 348         return ieee802_1x_kay_get_live_peer(participant, mi) != NULL;
 349 }
 350
 351
 352 /**
 353  * ieee802_1x_kay_is_in_peer
 354  */
 355 static Boolean
 356 ieee802_1x_kay_is_in_peer(struct ieee802_1x_mka_participant *participant,
 357                           const u8 *mi)
 358 {
 359         return ieee802_1x_kay_is_in_live_peer(participant, mi) ||
 360                 ieee802_1x_kay_is_in_potential_peer(participant, mi);
 361 }
 362
 363
 364 /**
 365  * ieee802_1x_kay_get_peer
 366  */
 367 static struct ieee802_1x_kay_peer *
 368 ieee802_1x_kay_get_peer(struct ieee802_1x_mka_participant *participant,
 369                         const u8 *mi)
 370 {
 371         struct ieee802_1x_kay_peer *peer;
 372
 373         peer = ieee802_1x_kay_get_live_peer(participant, mi);
 374         if (peer)
 375                 return peer;
 376
 377         return ieee802_1x_kay_get_potential_peer(participant, mi);
 378 }
 379
 380
 381 /**
 382  * ieee802_1x_kay_get_cipher_suite
 383  */
 384 static struct macsec_ciphersuite *
 385 ieee802_1x_kay_get_cipher_suite(struct ieee802_1x_mka_participant *participant,
 386                                 u8 *cs_id)
 387 {
 388         unsigned int i;
 389
 390         for (i = 0; i < CS_TABLE_SIZE; i++) {
 391                 if (os_memcmp(cipher_suite_tbl[i].id, cs_id, CS_ID_LEN) == 0)
 392                         return &cipher_suite_tbl[i];
 393         }
 394
 395         return NULL;
 396 }
 397
 398
 399 static Boolean sci_equal(const struct ieee802_1x_mka_sci *a,
 400                          const struct ieee802_1x_mka_sci *b)
 401 {
 402         return os_memcmp(a, b, sizeof(struct ieee802_1x_mka_sci)) == 0;
 403 }
 404
 405
 406 /**
 407  * ieee802_1x_kay_get_peer_sci
 408  */
 409 static struct ieee802_1x_kay_peer *
 410 ieee802_1x_kay_get_peer_sci(struct ieee802_1x_mka_participant *participant,
 411                             const struct ieee802_1x_mka_sci *sci)
 412 {
 413         struct ieee802_1x_kay_peer *peer;
 414
 415         dl_list_for_each(peer, &participant->live_peers,
 416                          struct ieee802_1x_kay_peer, list) {
 417                 if (sci_equal(&peer->sci, sci))
 418                         return peer;
 419         }
 420
 421         dl_list_for_each(peer, &participant->potential_peers,
 422                          struct ieee802_1x_kay_peer, list) {
 423                 if (sci_equal(&peer->sci, sci))
 424                         return peer;
 425         }
 426
 427         return NULL;
 428 }
 429
 430
 431 /**
 432  * ieee802_1x_kay_init_receive_sa -
 433  */
 434 static struct receive_sa *
 435 ieee802_1x_kay_init_receive_sa(struct receive_sc *psc, u8 an, u32 lowest_pn,
 436                                struct data_key *key)
 437 {
 438         struct receive_sa *psa;
 439
 440         if (!psc || !key)
 441                 return NULL;
 442
 443         psa = os_zalloc(sizeof(*psa));
 444         if (!psa) {
 445                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
 446                 return NULL;
 447         }
 448
 449         psa->pkey = key;
 450         psa->lowest_pn = lowest_pn;
 451         psa->next_pn = lowest_pn;
 452         psa->an = an;
 453         psa->sc = psc;
 454
 455         os_get_time(&psa->created_time);
 456         psa->in_use = FALSE;
 457
 458         dl_list_add(&psc->sa_list, &psa->list);
 459         wpa_printf(MSG_DEBUG,
 460                    "KaY: Create receive SA(AN: %hhu lowest_pn: %u of SC(channel: %d)",
 461                    an, lowest_pn, psc->channel);
 462
 463         return psa;
 464 }
 465
 466
 467 /**
 468  * ieee802_1x_kay_deinit_receive_sa -
 469  */
 470 static void ieee802_1x_kay_deinit_receive_sa(struct receive_sa *psa)
 471 {
 472         psa->pkey = NULL;
 473         wpa_printf(MSG_DEBUG,
 474                    "KaY: Delete receive SA(an: %hhu) of SC",
 475                    psa->an);
 476         dl_list_del(&psa->list);
 477         os_free(psa);
 478 }
 479
 480
 481 /**
 482  * ieee802_1x_kay_init_receive_sc -
 483  */
 484 static struct receive_sc *
 485 ieee802_1x_kay_init_receive_sc(const struct ieee802_1x_mka_sci *psci,
 486                                int channel)
 487 {
 488         struct receive_sc *psc;
 489
 490         if (!psci)
 491                 return NULL;
 492
 493         psc = os_zalloc(sizeof(*psc));
 494         if (!psc) {
 495                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
 496                 return NULL;
 497         }
 498
 499         os_memcpy(&psc->sci, psci, sizeof(psc->sci));
 500         psc->channel = channel;
 501
 502         os_get_time(&psc->created_time);
 503         psc->receiving = FALSE;
 504
 505         dl_list_init(&psc->sa_list);
 506         wpa_printf(MSG_DEBUG, "KaY: Create receive SC(channel: %d)", channel);
 507         wpa_hexdump(MSG_DEBUG, "SCI: ", (u8 *)psci, sizeof(*psci));
 508
 509         return psc;
 510 }
 511
 512
 513 /**
 514  * ieee802_1x_kay_deinit_receive_sc -
 515  **/
 516 static void
 517 ieee802_1x_kay_deinit_receive_sc(
 518         struct ieee802_1x_mka_participant *participant, struct receive_sc *psc)
 519 {
 520         struct receive_sa *psa, *pre_sa;
 521
 522         wpa_printf(MSG_DEBUG, "KaY: Delete receive SC(channel: %d)",
 523                    psc->channel);
 524         dl_list_for_each_safe(psa, pre_sa, &psc->sa_list, struct receive_sa,
 525                               list)  {
 526                 secy_disable_receive_sa(participant->kay, psa);
 527                 ieee802_1x_kay_deinit_receive_sa(psa);
 528         }
 529         dl_list_del(&psc->list);
 530         os_free(psc);
 531 }
 532
 533
 534 static void ieee802_1x_kay_dump_peer(struct ieee802_1x_kay_peer *peer)
 535 {
 536         wpa_hexdump(MSG_DEBUG, "\tMI: ", peer->mi, sizeof(peer->mi));
 537         wpa_printf(MSG_DEBUG, "\tMN: %d", peer->mn);
 538         wpa_hexdump(MSG_DEBUG, "\tSCI Addr: ", peer->sci.addr, ETH_ALEN);
 539         wpa_printf(MSG_DEBUG, "\tPort: %d", peer->sci.port);
 540 }
 541
 542
 543 static struct ieee802_1x_kay_peer *
 544 ieee802_1x_kay_create_peer(const u8 *mi, u32 mn)
 545 {
 546         struct ieee802_1x_kay_peer *peer;
 547
 548         peer = os_zalloc(sizeof(*peer));
 549         if (!peer) {
 550                 wpa_printf(MSG_ERROR, "KaY-%s: out of memory", __func__);
 551                 return NULL;
 552         }
 553
 554         os_memcpy(peer->mi, mi, MI_LEN);
 555         peer->mn = mn;
 556         peer->expire = time(NULL) + MKA_LIFE_TIME / 1000;
 557         peer->sak_used = FALSE;
 558
 559         return peer;
 560 }
 561
 562
 563 /**
 564  * ieee802_1x_kay_create_live_peer
 565  */
 566 static struct ieee802_1x_kay_peer *
 567 ieee802_1x_kay_create_live_peer(struct ieee802_1x_mka_participant *participant,
 568                                 const u8 *mi, u32 mn)
 569 {
 570         struct ieee802_1x_kay_peer *peer;
 571         struct receive_sc *rxsc;
 572         u32 sc_ch = 0;
 573
 574         peer = ieee802_1x_kay_create_peer(mi, mn);
 575         if (!peer)
 576                 return NULL;
 577
 578         os_memcpy(&peer->sci, &participant->current_peer_sci,
 579                   sizeof(peer->sci));
 580
 581         secy_get_available_receive_sc(participant->kay, &sc_ch);
 582
 583         rxsc = ieee802_1x_kay_init_receive_sc(&peer->sci, sc_ch);
 584         if (!rxsc) {
 585                 os_free(peer);
 586                 return NULL;
 587         }
 588
 589         dl_list_add(&participant->live_peers, &peer->list);
 590         dl_list_add(&participant->rxsc_list, &rxsc->list);
 591         secy_create_receive_sc(participant->kay, rxsc);
 592
 593         wpa_printf(MSG_DEBUG, "KaY: Live peer created");
 594         ieee802_1x_kay_dump_peer(peer);
 595
 596         return peer;
 597 }
 598
 599
 600 /**
 601  * ieee802_1x_kay_create_potential_peer
 602  */
 603 static struct ieee802_1x_kay_peer *
 604 ieee802_1x_kay_create_potential_peer(
 605         struct ieee802_1x_mka_participant *participant, const u8 *mi, u32 mn)
 606 {
 607         struct ieee802_1x_kay_peer *peer;
 608
 609         peer = ieee802_1x_kay_create_peer(mi, mn);
 610         if (!peer)
 611                 return NULL;
 612
 613         dl_list_add(&participant->potential_peers, &peer->list);
 614
 615         wpa_printf(MSG_DEBUG, "KaY: potential peer created");
 616         ieee802_1x_kay_dump_peer(peer);
 617
 618         return peer;
 619 }
 620
 621
 622 /**
 623  * ieee802_1x_kay_move_live_peer
 624  */
 625 static struct ieee802_1x_kay_peer *
 626 ieee802_1x_kay_move_live_peer(struct ieee802_1x_mka_participant *participant,
 627                               u8 *mi, u32 mn)
 628 {
 629         struct ieee802_1x_kay_peer *peer;
 630         struct receive_sc *rxsc;
 631         u32 sc_ch = 0;
 632
 633         peer = ieee802_1x_kay_get_potential_peer(participant, mi);
 634
 635         rxsc = ieee802_1x_kay_init_receive_sc(&participant->current_peer_sci,
 636                                               sc_ch);
 637         if (!rxsc)
 638                 return NULL;
 639
 640         os_memcpy(&peer->sci, &participant->current_peer_sci,
 641                   sizeof(peer->sci));
 642         peer->mn = mn;
 643         peer->expire = time(NULL) + MKA_LIFE_TIME / 1000;
 644
 645         wpa_printf(MSG_DEBUG, "KaY: move potential peer to live peer");
 646         ieee802_1x_kay_dump_peer(peer);
 647
 648         dl_list_del(&peer->list);
 649         dl_list_add_tail(&participant->live_peers, &peer->list);
 650
 651         secy_get_available_receive_sc(participant->kay, &sc_ch);
 652
 653         dl_list_add(&participant->rxsc_list, &rxsc->list);
 654         secy_create_receive_sc(participant->kay, rxsc);
 655
 656         return peer;
 657 }
 658
 659
 660
 661 /**
 662  *  ieee802_1x_mka_basic_body_present -
 663  */
 664 static Boolean
 665 ieee802_1x_mka_basic_body_present(
 666         struct ieee802_1x_mka_participant *participant)
 667 {
 668         return TRUE;
 669 }
 670
 671
 672 /**
 673  * ieee802_1x_mka_basic_body_length -
 674  */
 675 static int
 676 ieee802_1x_mka_basic_body_length(struct ieee802_1x_mka_participant *participant)
 677 {
 678         int length;
 679
 680         length = sizeof(struct ieee802_1x_mka_basic_body);
 681         length += participant->ckn.len;
 682         return MKA_ALIGN_LENGTH(length);
 683 }
 684
 685
 686 /**
 687  * ieee802_1x_mka_encode_basic_body
 688  */
 689 static int
 690 ieee802_1x_mka_encode_basic_body(
 691         struct ieee802_1x_mka_participant *participant,
 692         struct wpabuf *buf)
 693 {
 694         struct ieee802_1x_mka_basic_body *body;
 695         struct ieee802_1x_kay *kay = participant->kay;
 696         unsigned int length = ieee802_1x_mka_basic_body_length(participant);
 697
 698         body = wpabuf_put(buf, length);
 699
 700         body->version = kay->mka_version;
 701         body->priority = kay->actor_priority;
 702         if (participant->is_elected)
 703                 body->key_server = participant->is_key_server;
 704         else
 705                 body->key_server = participant->can_be_key_server;
 706
 707         body->macsec_desired = kay->macsec_desired;
 708         body->macsec_capability = kay->macsec_capable;
 709         set_mka_param_body_len(body, length - MKA_HDR_LEN);
 710
 711         os_memcpy(body->actor_sci.addr, kay->actor_sci.addr,
 712                   sizeof(kay->actor_sci.addr));
 713         body->actor_sci.port = kay->actor_sci.port;
 714
 715         os_memcpy(body->actor_mi, participant->mi, sizeof(body->actor_mi));
 716         participant->mn = participant->mn + 1;
 717         body->actor_mn = host_to_be32(participant->mn);
 718         os_memcpy(body->algo_agility, participant->kay->algo_agility,
 719                   sizeof(body->algo_agility));
 720
 721         os_memcpy(body->ckn, participant->ckn.name, participant->ckn.len);
 722
 723         ieee802_1x_mka_dump_basic_body(body);
 724
 725         return 0;
 726 }
 727
 728
 729 static Boolean
 730 reset_participant_mi(struct ieee802_1x_mka_participant *participant)
 731 {
 732         if (os_get_random(participant->mi, sizeof(participant->mi)) < 0)
 733                 return FALSE;
 734         participant->mn = 0;
 735
 736         return TRUE;
 737 }
 738
 739
 740 /**
 741  * ieee802_1x_mka_decode_basic_body -
 742  */
 743 static struct ieee802_1x_mka_participant *
 744 ieee802_1x_mka_decode_basic_body(struct ieee802_1x_kay *kay, const u8 *mka_msg,
 745                                  size_t msg_len)
 746 {
 747         struct ieee802_1x_mka_participant *participant;
 748         const struct ieee802_1x_mka_basic_body *body;
 749         struct ieee802_1x_kay_peer *peer;
 750
 751         body = (const struct ieee802_1x_mka_basic_body *) mka_msg;
 752
 753         if (body->version > MKA_VERSION_ID) {
 754                 wpa_printf(MSG_DEBUG,
 755                            "KaY: peer's version(%d) greater than mka current version(%d)",
 756                            body->version, MKA_VERSION_ID);
 757         }
 758         if (kay->is_obliged_key_server && body->key_server) {
 759                 wpa_printf(MSG_DEBUG, "I must be as key server");
 760                 return NULL;
 761         }
 762
 763         participant = ieee802_1x_kay_get_participant(kay, body->ckn);
 764         if (!participant) {
 765                 wpa_printf(MSG_DEBUG, "Peer is not included in my CA");
 766                 return NULL;
 767         }
 768
 769         /* If the peer's MI is my MI, I will choose new MI */
 770         if (os_memcmp(body->actor_mi, participant->mi, MI_LEN) == 0) {
 771                 if (!reset_participant_mi(participant))
 772                         return NULL;
 773         }
 774
 775         os_memcpy(participant->current_peer_id.mi, body->actor_mi, MI_LEN);
 776         participant->current_peer_id.mn = body->actor_mn;
 777         os_memcpy(participant->current_peer_sci.addr, body->actor_sci.addr,
 778                   sizeof(participant->current_peer_sci.addr));
 779         participant->current_peer_sci.port = body->actor_sci.port;
 780
 781         /* handler peer */
 782         peer = ieee802_1x_kay_get_peer(participant, body->actor_mi);
 783         if (!peer) {
 784                 /* Check duplicated SCI */
 785                 /* TODO: What policy should be applied to detect duplicated SCI
 786                  * is active attacker or a valid peer whose MI is be changed?
 787                  */
 788                 peer = ieee802_1x_kay_get_peer_sci(participant,
 789                                                    &body->actor_sci);
 790                 if (peer) {
 791                         wpa_printf(MSG_WARNING,
 792                                    "KaY: duplicated SCI detected, Maybe active attacker");
 793                         dl_list_del(&peer->list);
 794                         os_free(peer);
 795                 }
 796
 797                 peer = ieee802_1x_kay_create_potential_peer(
 798                         participant, body->actor_mi,
 799                         be_to_host32(body->actor_mn));
 800                 if (!peer)
 801                         return NULL;
 802
 803                 peer->macsec_desired = body->macsec_desired;
 804                 peer->macsec_capability = body->macsec_capability;
 805                 peer->is_key_server = (Boolean) body->key_server;
 806                 peer->key_server_priority = body->priority;
 807         } else if (peer->mn < be_to_host32(body->actor_mn)) {
 808                 peer->mn = be_to_host32(body->actor_mn);
 809                 peer->expire = time(NULL) + MKA_LIFE_TIME / 1000;
 810                 peer->macsec_desired = body->macsec_desired;
 811                 peer->macsec_capability = body->macsec_capability;
 812                 peer->is_key_server = (Boolean) body->key_server;
 813                 peer->key_server_priority = body->priority;
 814         } else {
 815                 wpa_printf(MSG_WARNING, "KaY: The peer MN have received");
 816                 return NULL;
 817         }
 818
 819         return participant;
 820 }
 821
 822
 823 /**
 824  * ieee802_1x_mka_live_peer_body_present
 825  */
 826 static Boolean
 827 ieee802_1x_mka_live_peer_body_present(
 828         struct ieee802_1x_mka_participant *participant)
 829 {
 830         return !dl_list_empty(&participant->live_peers);
 831 }
 832
 833
 834 /**
 835  * ieee802_1x_kay_get_live_peer_length
 836  */
 837 static int
 838 ieee802_1x_mka_get_live_peer_length(
 839         struct ieee802_1x_mka_participant *participant)
 840 {
 841         int len = MKA_HDR_LEN;
 842         struct ieee802_1x_kay_peer *peer;
 843
 844         dl_list_for_each(peer, &participant->live_peers,
 845                          struct ieee802_1x_kay_peer, list)
 846                 len += sizeof(struct ieee802_1x_mka_peer_id);
 847
 848         return MKA_ALIGN_LENGTH(len);
 849 }
 850
 851
 852 /**
 853  * ieee802_1x_mka_encode_live_peer_body -
 854  */
 855 static int
 856 ieee802_1x_mka_encode_live_peer_body(
 857         struct ieee802_1x_mka_participant *participant,
 858         struct wpabuf *buf)
 859 {
 860         struct ieee802_1x_mka_peer_body *body;
 861         struct ieee802_1x_kay_peer *peer;
 862         unsigned int length;
 863         struct ieee802_1x_mka_peer_id *body_peer;
 864
 865         length = ieee802_1x_mka_get_live_peer_length(participant);
 866         body = wpabuf_put(buf, sizeof(struct ieee802_1x_mka_peer_body));
 867
 868         body->type = MKA_LIVE_PEER_LIST;
 869         set_mka_param_body_len(body, length - MKA_HDR_LEN);
 870
 871         dl_list_for_each(peer, &participant->live_peers,
 872                          struct ieee802_1x_kay_peer, list) {
 873                 body_peer = wpabuf_put(buf,
 874                                        sizeof(struct ieee802_1x_mka_peer_id));
 875                 os_memcpy(body_peer->mi, peer->mi, MI_LEN);
 876                 body_peer->mn = host_to_be32(peer->mn);
 877                 body_peer++;
 878         }
 879
 880         ieee802_1x_mka_dump_peer_body(body);
 881         return 0;
 882 }
 883
 884 /**
 885  * ieee802_1x_mka_potential_peer_body_present
 886  */
 887 static Boolean
 888 ieee802_1x_mka_potential_peer_body_present(
 889         struct ieee802_1x_mka_participant *participant)
 890 {
 891         return !dl_list_empty(&participant->potential_peers);
 892 }
 893
 894
 895 /**
 896  * ieee802_1x_kay_get_potential_peer_length
 897  */
 898 static int
 899 ieee802_1x_mka_get_potential_peer_length(
 900         struct ieee802_1x_mka_participant *participant)
 901 {
 902         int len = MKA_HDR_LEN;
 903         struct ieee802_1x_kay_peer *peer;
 904
 905         dl_list_for_each(peer, &participant->potential_peers,
 906                          struct ieee802_1x_kay_peer, list)
 907                 len += sizeof(struct ieee802_1x_mka_peer_id);
 908
 909         return MKA_ALIGN_LENGTH(len);
 910 }
 911
 912
 913 /**
 914  * ieee802_1x_mka_encode_potential_peer_body -
 915  */
 916 static int
 917 ieee802_1x_mka_encode_potential_peer_body(
 918         struct ieee802_1x_mka_participant *participant,
 919         struct wpabuf *buf)
 920 {
 921         struct ieee802_1x_mka_peer_body *body;
 922         struct ieee802_1x_kay_peer *peer;
 923         unsigned int length;
 924         struct ieee802_1x_mka_peer_id *body_peer;
 925
 926         length = ieee802_1x_mka_get_potential_peer_length(participant);
 927         body = wpabuf_put(buf, sizeof(struct ieee802_1x_mka_peer_body));
 928
 929         body->type = MKA_POTENTIAL_PEER_LIST;
 930         set_mka_param_body_len(body, length - MKA_HDR_LEN);
 931
 932         dl_list_for_each(peer, &participant->potential_peers,
 933                          struct ieee802_1x_kay_peer, list) {
 934                 body_peer = wpabuf_put(buf,
 935                                        sizeof(struct ieee802_1x_mka_peer_id));
 936                 os_memcpy(body_peer->mi, peer->mi, MI_LEN);
 937                 body_peer->mn = host_to_be32(peer->mn);
 938                 body_peer++;
 939         }
 940
 941         ieee802_1x_mka_dump_peer_body(body);
 942         return 0;
 943 }
 944
 945
 946 /**
 947  * ieee802_1x_mka_i_in_peerlist -
 948  */
 949 static Boolean
 950 ieee802_1x_mka_i_in_peerlist(struct ieee802_1x_mka_participant *participant,
 951                              const u8 *mka_msg, size_t msg_len)
 952 {
 953         Boolean included = FALSE;
 954         struct ieee802_1x_mka_hdr *hdr;
 955         size_t body_len;
 956         size_t left_len;
 957         u8 body_type;
 958         u32 peer_mn;
 959         be32 _peer_mn;
 960         const u8 *peer_mi;
 961         const u8 *pos;
 962         size_t i;
 963
 964         pos = mka_msg;
 965         left_len = msg_len;
 966         while (left_len > (MKA_HDR_LEN + DEFAULT_ICV_LEN)) {
 967                 hdr = (struct ieee802_1x_mka_hdr *) pos;
 968                 body_len = get_mka_param_body_len(hdr);
 969                 body_type = get_mka_param_body_type(hdr);
 970
 971                 if (body_type != MKA_LIVE_PEER_LIST &&
 972                     body_type != MKA_POTENTIAL_PEER_LIST)
 973                         goto SKIP_PEER;
 974
 975                 ieee802_1x_mka_dump_peer_body(
 976                         (struct ieee802_1x_mka_peer_body *)pos);
 977
 978                 if (left_len < (MKA_HDR_LEN + body_len + DEFAULT_ICV_LEN)) {
 979                         wpa_printf(MSG_ERROR,
 980                                    "KaY: MKA Peer Packet Body Length (%zu bytes) is less than the Parameter Set Header Length (%zu bytes) + the Parameter Set Body Length (%zu bytes) + %d bytes of ICV",
 981                                    left_len, MKA_HDR_LEN,
 982                                    body_len, DEFAULT_ICV_LEN);
 983                         goto SKIP_PEER;
 984                 }
 985
 986                 if ((body_len % 16) != 0) {
 987                         wpa_printf(MSG_ERROR,
 988                                    "KaY: MKA Peer Packet Body Length (%zu bytes) should be a multiple of 16 octets",
 989                                    body_len);
 990                         goto SKIP_PEER;
 991                 }
 992
 993                 for (i = 0; i < body_len; i += MI_LEN + sizeof(peer_mn)) {
 994                         peer_mi = MKA_HDR_LEN + pos + i;
 995                         os_memcpy(&_peer_mn, peer_mi + MI_LEN,
 996                                   sizeof(_peer_mn));
 997                         peer_mn = be_to_host32(_peer_mn);
 998                         if (os_memcmp(peer_mi, participant->mi, MI_LEN) == 0 &&
 999                             peer_mn == participant->mn) {
1000                                 included = TRUE;
1001                                 break;
1002                         }
1003                 }
1004
1005                 if (included)
1006                         return TRUE;
1007
1008 SKIP_PEER:
1009                 left_len -= body_len + MKA_HDR_LEN;
1010                 pos += body_len + MKA_HDR_LEN;
1011         }
1012
1013         return FALSE;
1014 }
1015
1016
1017 /**
1018  * ieee802_1x_mka_decode_live_peer_body -
1019  */
1020 static int ieee802_1x_mka_decode_live_peer_body(
1021         struct ieee802_1x_mka_participant *participant,
1022         const u8 *peer_msg, size_t msg_len)
1023 {
1024         const struct ieee802_1x_mka_hdr *hdr;
1025         struct ieee802_1x_kay_peer *peer;
1026         size_t body_len;
1027         u32 peer_mn;
1028         be32 _peer_mn;
1029         const u8 *peer_mi;
1030         size_t i;
1031         Boolean is_included;
1032
1033         is_included = ieee802_1x_kay_is_in_live_peer(
1034                 participant, participant->current_peer_id.mi);
1035
1036         hdr = (const struct ieee802_1x_mka_hdr *) peer_msg;
1037         body_len = get_mka_param_body_len(hdr);
1038         if (body_len % 16 != 0) {
1039                 wpa_printf(MSG_ERROR,
1040                            "KaY: MKA Peer Packet Body Length (%zu bytes) should be a multiple of 16 octets",
1041                            body_len);
1042                 return -1;
1043         }
1044
1045         for (i = 0; i < body_len; i += MI_LEN + sizeof(peer_mn)) {
1046                 peer_mi = MKA_HDR_LEN + peer_msg + i;
1047                 os_memcpy(&_peer_mn, peer_mi + MI_LEN, sizeof(_peer_mn));
1048                 peer_mn = be_to_host32(_peer_mn);
1049
1050                 /* it is myself */
1051                 if (os_memcmp(peer_mi, participant->mi, MI_LEN) == 0) {
1052                         /* My message id is used by other participant */
1053                         if (peer_mn > participant->mn &&
1054                             !reset_participant_mi(participant))
1055                                 wpa_printf(MSG_DEBUG, "KaY: Could not update mi");
1056                         continue;
1057                 }
1058                 if (!is_included)
1059                         continue;
1060
1061                 peer = ieee802_1x_kay_get_peer(participant, peer_mi);
1062                 if (NULL != peer) {
1063                         peer->mn = peer_mn;
1064                         peer->expire = time(NULL) + MKA_LIFE_TIME / 1000;
1065                 } else {
1066                         if (!ieee802_1x_kay_create_potential_peer(
1067                                 participant, peer_mi, peer_mn)) {
1068                                 return -1;
1069                         }
1070                 }
1071         }
1072
1073         return 0;
1074 }
1075
1076
1077 /**
1078  * ieee802_1x_mka_decode_potential_peer_body -
1079  */
1080 static int
1081 ieee802_1x_mka_decode_potential_peer_body(
1082         struct ieee802_1x_mka_participant *participant,
1083         const u8 *peer_msg, size_t msg_len)
1084 {
1085         struct ieee802_1x_mka_hdr *hdr;
1086         size_t body_len;
1087         u32 peer_mn;
1088         be32 _peer_mn;
1089         const u8 *peer_mi;
1090         size_t i;
1091
1092         hdr = (struct ieee802_1x_mka_hdr *) peer_msg;
1093         body_len = get_mka_param_body_len(hdr);
1094         if (body_len % 16 != 0) {
1095                 wpa_printf(MSG_ERROR,
1096                            "KaY: MKA Peer Packet Body Length (%zu bytes) should be a multiple of 16 octets",
1097                            body_len);
1098                 return -1;
1099         }
1100
1101         for (i = 0; i < body_len; i += MI_LEN + sizeof(peer_mn)) {
1102                 peer_mi = MKA_HDR_LEN + peer_msg + i;
1103                 os_memcpy(&_peer_mn, peer_mi + MI_LEN, sizeof(_peer_mn));
1104                 peer_mn = be_to_host32(_peer_mn);
1105
1106                 /* it is myself */
1107                 if (os_memcmp(peer_mi, participant->mi, MI_LEN) == 0) {
1108                         /* My message id is used by other participant */
1109                         if (peer_mn > participant->mn &&
1110                             !reset_participant_mi(participant))
1111                                 wpa_printf(MSG_DEBUG, "KaY: Could not update mi");
1112                         continue;
1113                 }
1114         }
1115
1116         return 0;
1117 }
1118
1119
1120 /**
1121  * ieee802_1x_mka_sak_use_body_present
1122  */
1123 static Boolean
1124 ieee802_1x_mka_sak_use_body_present(
1125         struct ieee802_1x_mka_participant *participant)
1126 {
1127         if (participant->to_use_sak)
1128                 return TRUE;
1129         else
1130                 return FALSE;
1131 }
1132
1133
1134 /**
1135  * ieee802_1x_mka_get_sak_use_length
1136  */
1137 static int
1138 ieee802_1x_mka_get_sak_use_length(
1139         struct ieee802_1x_mka_participant *participant)
1140 {
1141         int length = MKA_HDR_LEN;
1142
1143         if (participant->kay->macsec_desired && participant->advised_desired)
1144                 length = sizeof(struct ieee802_1x_mka_sak_use_body);
1145
1146         return MKA_ALIGN_LENGTH(length);
1147 }
1148
1149
1150 /**
1151  *
1152  */
1153 static u32
1154 ieee802_1x_mka_get_lpn(struct ieee802_1x_mka_participant *principal,
1155                        struct ieee802_1x_mka_ki *ki)
1156 {
1157         struct receive_sa *rxsa;
1158         struct receive_sc *rxsc;
1159         u32 lpn = 0;
1160
1161         dl_list_for_each(rxsc, &principal->rxsc_list, struct receive_sc, list) {
1162                 dl_list_for_each(rxsa, &rxsc->sa_list, struct receive_sa, list)
1163                 {
1164                         if (is_ki_equal(&rxsa->pkey->key_identifier, ki)) {
1165                                 secy_get_receive_lowest_pn(principal->kay,
1166                                                            rxsa);
1167
1168                                 lpn = lpn > rxsa->lowest_pn ?
1169                                         lpn : rxsa->lowest_pn;
1170                                 break;
1171                         }
1172                 }
1173         }
1174
1175         if (lpn == 0)
1176                 lpn = 1;
1177
1178         return lpn;
1179 }
1180
1181
1182 /**
1183  * ieee802_1x_mka_encode_sak_use_body -
1184  */
1185 static int
1186 ieee802_1x_mka_encode_sak_use_body(
1187         struct ieee802_1x_mka_participant *participant,
1188         struct wpabuf *buf)
1189 {
1190         struct ieee802_1x_mka_sak_use_body *body;
1191         unsigned int length;
1192         u32 pn = 1;
1193
1194         length = ieee802_1x_mka_get_sak_use_length(participant);
1195         body = wpabuf_put(buf, length);
1196
1197         body->type = MKA_SAK_USE;
1198         set_mka_param_body_len(body, length - MKA_HDR_LEN);
1199
1200         if (length == MKA_HDR_LEN) {
1201                 body->ptx = TRUE;
1202                 body->prx = TRUE;
1203                 body->lan = 0;
1204                 body->lrx = FALSE;
1205                 body->ltx = FALSE;
1206                 body->delay_protect = FALSE;
1207                 return 0;
1208         }
1209
1210         /* data protect, lowest accept packet number */
1211         body->delay_protect = participant->kay->macsec_replay_protect;
1212         pn = ieee802_1x_mka_get_lpn(participant, &participant->lki);
1213         if (pn > participant->kay->pn_exhaustion) {
1214                 wpa_printf(MSG_WARNING, "KaY: My LPN exhaustion");
1215                 if (participant->is_key_server)
1216                         participant->new_sak = TRUE;
1217         }
1218
1219         body->llpn = host_to_be32(pn);
1220         pn = ieee802_1x_mka_get_lpn(participant, &participant->oki);
1221         body->olpn = host_to_be32(pn);
1222
1223         /* plain tx, plain rx */
1224         if (participant->kay->macsec_protect)
1225                 body->ptx = FALSE;
1226         else
1227                 body->ptx = TRUE;
1228
1229         if (participant->kay->macsec_validate == Strict)
1230                 body->prx = FALSE;
1231         else
1232                 body->prx = TRUE;
1233
1234         /* latest key: rx, tx, key server member identifier key number */
1235         body->lan = participant->lan;
1236         os_memcpy(body->lsrv_mi, participant->lki.mi,
1237                   sizeof(body->lsrv_mi));
1238         body->lkn = host_to_be32(participant->lki.kn);
1239         body->lrx = participant->lrx;
1240         body->ltx = participant->ltx;
1241
1242         /* old key: rx, tx, key server member identifier key number */
1243         body->oan = participant->oan;
1244         if (participant->oki.kn != participant->lki.kn &&
1245             participant->oki.kn != 0) {
1246                 body->otx = TRUE;
1247                 body->orx = TRUE;
1248                 os_memcpy(body->osrv_mi, participant->oki.mi,
1249                           sizeof(body->osrv_mi));
1250                 body->okn = host_to_be32(participant->oki.kn);
1251         } else {
1252                 body->otx = FALSE;
1253                 body->orx = FALSE;
1254         }
1255
1256         /* set CP's variable */
1257         if (body->ltx) {
1258                 if (!participant->kay->tx_enable)
1259                         participant->kay->tx_enable = TRUE;
1260
1261                 if (!participant->kay->port_enable)
1262                         participant->kay->port_enable = TRUE;
1263         }
1264         if (body->lrx) {
1265                 if (!participant->kay->rx_enable)
1266                         participant->kay->rx_enable = TRUE;
1267         }
1268
1269         ieee802_1x_mka_dump_sak_use_body(body);
1270         return 0;
1271 }
1272
1273
1274 /**
1275  * ieee802_1x_mka_decode_sak_use_body -
1276  */
1277 static int
1278 ieee802_1x_mka_decode_sak_use_body(
1279         struct ieee802_1x_mka_participant *participant,
1280         const u8 *mka_msg, size_t msg_len)
1281 {
1282         struct ieee802_1x_mka_hdr *hdr;
1283         struct ieee802_1x_mka_sak_use_body *body;
1284         struct ieee802_1x_kay_peer *peer;
1285         struct transmit_sa *txsa;
1286         struct data_key *sa_key = NULL;
1287         size_t body_len;
1288         struct ieee802_1x_mka_ki ki;
1289         u32 lpn;
1290         Boolean all_receiving;
1291         Boolean founded;
1292
1293         if (!participant->principal) {
1294                 wpa_printf(MSG_WARNING, "KaY: Participant is not principal");
1295                 return -1;
1296         }
1297         peer = ieee802_1x_kay_get_live_peer(participant,
1298                                             participant->current_peer_id.mi);
1299         if (!peer) {
1300                 wpa_printf(MSG_WARNING, "KaY: the peer is not my live peer");
1301                 return -1;
1302         }
1303
1304         hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1305         body_len = get_mka_param_body_len(hdr);
1306         body = (struct ieee802_1x_mka_sak_use_body *) mka_msg;
1307         ieee802_1x_mka_dump_sak_use_body(body);
1308
1309         if ((body_len != 0) && (body_len < 40)) {
1310                 wpa_printf(MSG_ERROR,
1311                            "KaY: MKA Use SAK Packet Body Length (%zu bytes) should be 0, 40, or more octets",
1312                            body_len);
1313                 return -1;
1314         }
1315
1316         /* TODO: what action should I take when peer does not support MACsec */
1317         if (body_len == 0) {
1318                 wpa_printf(MSG_WARNING, "KaY: Peer does not support MACsec");
1319                 return 0;
1320         }
1321
1322         /* TODO: when the plain tx or rx of peer is true, should I change
1323          * the attribute of controlled port
1324          */
1325         if (body->prx)
1326                 wpa_printf(MSG_WARNING, "KaY: peer's plain rx are TRUE");
1327
1328         if (body->ptx)
1329                 wpa_printf(MSG_WARNING, "KaY: peer's plain tx are TRUE");
1330
1331         /* check latest key is valid */
1332         if (body->ltx || body->lrx) {
1333                 founded = FALSE;
1334                 os_memcpy(ki.mi, body->lsrv_mi, sizeof(ki.mi));
1335                 ki.kn = be_to_host32(body->lkn);
1336                 dl_list_for_each(sa_key, &participant->sak_list,
1337                                  struct data_key, list) {
1338                         if (is_ki_equal(&sa_key->key_identifier, &ki)) {
1339                                 founded = TRUE;
1340                                 break;
1341                         }
1342                 }
1343                 if (!founded) {
1344                         wpa_printf(MSG_WARNING, "KaY: Latest key is invalid");
1345                         return -1;
1346                 }
1347                 if (os_memcmp(participant->lki.mi, body->lsrv_mi,
1348                               sizeof(participant->lki.mi)) == 0 &&
1349                     be_to_host32(body->lkn) == participant->lki.kn &&
1350                     body->lan == participant->lan) {
1351                         peer->sak_used = TRUE;
1352                 }
1353                 if (body->ltx && peer->is_key_server) {
1354                         ieee802_1x_cp_set_servertransmitting(
1355                                 participant->kay->cp, TRUE);
1356                         ieee802_1x_cp_sm_step(participant->kay->cp);
1357                 }
1358         }
1359
1360         /* check old key is valid */
1361         if (body->otx || body->orx) {
1362                 if (os_memcmp(participant->oki.mi, body->osrv_mi,
1363                               sizeof(participant->oki.mi)) != 0 ||
1364                     be_to_host32(body->okn) != participant->oki.kn ||
1365                     body->oan != participant->oan) {
1366                         wpa_printf(MSG_WARNING, "KaY: Old key is invalid");
1367                         return -1;
1368                 }
1369         }
1370
1371         /* TODO: how to set the MACsec hardware when delay_protect is true */
1372         if (body->delay_protect &&
1373             (!be_to_host32(body->llpn) || !be_to_host32(body->olpn))) {
1374                 wpa_printf(MSG_WARNING,
1375                            "KaY: Lowest packet number should greater than 0 when delay_protect is TRUE");
1376                 return -1;
1377         }
1378
1379         /* check all live peer have used the sak for receiving sa */
1380         all_receiving = TRUE;
1381         dl_list_for_each(peer, &participant->live_peers,
1382                          struct ieee802_1x_kay_peer, list) {
1383                 if (!peer->sak_used) {
1384                         all_receiving = FALSE;
1385                         break;
1386                 }
1387         }
1388         if (all_receiving) {
1389                 participant->to_dist_sak = FALSE;
1390                 ieee802_1x_cp_set_allreceiving(participant->kay->cp, TRUE);
1391                 ieee802_1x_cp_sm_step(participant->kay->cp);
1392         }
1393
1394         /* if i'm key server, and detects peer member pn exhaustion, rekey.*/
1395         lpn = be_to_host32(body->llpn);
1396         if (lpn > participant->kay->pn_exhaustion) {
1397                 if (participant->is_key_server) {
1398                         participant->new_sak = TRUE;
1399                         wpa_printf(MSG_WARNING, "KaY: Peer LPN exhaustion");
1400                 }
1401         }
1402
1403         founded = FALSE;
1404         dl_list_for_each(txsa, &participant->txsc->sa_list,
1405                          struct transmit_sa, list) {
1406                 if (sa_key != NULL && txsa->pkey == sa_key) {
1407                         founded = TRUE;
1408                         break;
1409                 }
1410         }
1411         if (!founded) {
1412                 wpa_printf(MSG_WARNING, "KaY: Can't find txsa");
1413                 return -1;
1414         }
1415
1416         /* FIXME: Secy creates txsa with default npn. If MKA detected Latest Key
1417          * npn is larger than txsa's npn, set it to txsa.
1418          */
1419         secy_get_transmit_next_pn(participant->kay, txsa);
1420         if (lpn > txsa->next_pn) {
1421                 secy_set_transmit_next_pn(participant->kay, txsa);
1422                 wpa_printf(MSG_INFO, "KaY: update lpn =0x%x", lpn);
1423         }
1424
1425         return 0;
1426 }
1427
1428
1429 /**
1430  * ieee802_1x_mka_dist_sak_body_present
1431  */
1432 static Boolean
1433 ieee802_1x_mka_dist_sak_body_present(
1434         struct ieee802_1x_mka_participant *participant)
1435 {
1436         if (!participant->to_dist_sak || !participant->new_key)
1437                 return FALSE;
1438
1439         return TRUE;
1440 }
1441
1442
1443 /**
1444  * ieee802_1x_kay_get_dist_sak_length
1445  */
1446 static int
1447 ieee802_1x_mka_get_dist_sak_length(
1448         struct ieee802_1x_mka_participant *participant)
1449 {
1450         int length = MKA_HDR_LEN;
1451         int cs_index = participant->kay->macsec_csindex;
1452
1453         if (participant->advised_desired) {
1454                 length = sizeof(struct ieee802_1x_mka_dist_sak_body);
1455                 if (cs_index != DEFAULT_CS_INDEX)
1456                         length += CS_ID_LEN;
1457
1458                 length += cipher_suite_tbl[cs_index].sak_len + 8;
1459         }
1460
1461         return MKA_ALIGN_LENGTH(length);
1462 }
1463
1464
1465 /**
1466  * ieee802_1x_mka_encode_dist_sak_body -
1467  */
1468 static int
1469 ieee802_1x_mka_encode_dist_sak_body(
1470         struct ieee802_1x_mka_participant *participant,
1471         struct wpabuf *buf)
1472 {
1473         struct ieee802_1x_mka_dist_sak_body *body;
1474         struct data_key *sak;
1475         unsigned int length;
1476         int cs_index;
1477         int sak_pos;
1478
1479         length = ieee802_1x_mka_get_dist_sak_length(participant);
1480         body = wpabuf_put(buf, length);
1481         body->type = MKA_DISTRIBUTED_SAK;
1482         set_mka_param_body_len(body, length - MKA_HDR_LEN);
1483         if (length == MKA_HDR_LEN) {
1484                 body->confid_offset = 0;
1485                 body->dan = 0;
1486                 return 0;
1487         }
1488
1489         sak = participant->new_key;
1490         body->confid_offset = sak->confidentiality_offset;
1491         body->dan = sak->an;
1492         body->kn = host_to_be32(sak->key_identifier.kn);
1493         cs_index = participant->kay->macsec_csindex;
1494         sak_pos = 0;
1495         if (cs_index != DEFAULT_CS_INDEX) {
1496                 os_memcpy(body->sak, cipher_suite_tbl[cs_index].id, CS_ID_LEN);
1497                 sak_pos = CS_ID_LEN;
1498         }
1499         if (aes_wrap(participant->kek.key, 16,
1500                      cipher_suite_tbl[cs_index].sak_len / 8,
1501                      sak->key, body->sak + sak_pos)) {
1502                 wpa_printf(MSG_ERROR, "KaY: AES wrap failed");
1503                 return -1;
1504         }
1505
1506         ieee802_1x_mka_dump_dist_sak_body(body);
1507
1508         return 0;
1509 }
1510
1511
1512 /**
1513  * ieee802_1x_kay_init_data_key -
1514  */
1515 static struct data_key *
1516 ieee802_1x_kay_init_data_key(const struct key_conf *conf)
1517 {
1518         struct data_key *pkey;
1519
1520         if (!conf)
1521                 return NULL;
1522
1523         pkey = os_zalloc(sizeof(*pkey));
1524         if (pkey == NULL) {
1525                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
1526                 return NULL;
1527         }
1528
1529         pkey->key = os_zalloc(conf->key_len);
1530         if (pkey->key == NULL) {
1531                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
1532                 os_free(pkey);
1533                 return NULL;
1534         }
1535
1536         os_memcpy(pkey->key, conf->key, conf->key_len);
1537         os_memcpy(&pkey->key_identifier, &conf->ki,
1538                   sizeof(pkey->key_identifier));
1539         pkey->confidentiality_offset = conf->offset;
1540         pkey->an = conf->an;
1541         pkey->transmits = conf->tx;
1542         pkey->receives = conf->rx;
1543         os_get_time(&pkey->created_time);
1544
1545         pkey->user = 1;
1546
1547         return pkey;
1548 }
1549
1550
1551 /**
1552  * ieee802_1x_kay_decode_dist_sak_body -
1553  */
1554 static int
1555 ieee802_1x_mka_decode_dist_sak_body(
1556         struct ieee802_1x_mka_participant *participant,
1557         const u8 *mka_msg, size_t msg_len)
1558 {
1559         struct ieee802_1x_mka_hdr *hdr;
1560         struct ieee802_1x_mka_dist_sak_body *body;
1561         struct ieee802_1x_kay_peer *peer;
1562         struct macsec_ciphersuite *cs;
1563         size_t body_len;
1564         struct key_conf *conf;
1565         struct data_key *sa_key = NULL;
1566         struct ieee802_1x_mka_ki sak_ki;
1567         int sak_len;
1568         u8 *wrap_sak;
1569         u8 *unwrap_sak;
1570
1571         hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1572         body_len = get_mka_param_body_len(hdr);
1573         if ((body_len != 0) && (body_len != 28) && (body_len < 36)) {
1574                 wpa_printf(MSG_ERROR,
1575                            "KaY: MKA Use SAK Packet Body Length (%zu bytes) should be 0, 28, 36, or more octets",
1576                            body_len);
1577                 return -1;
1578         }
1579
1580         if (!participant->principal) {
1581                 wpa_printf(MSG_ERROR,
1582                            "KaY: I can't accept the distributed SAK as I am not principal");
1583                 return -1;
1584         }
1585         if (participant->is_key_server) {
1586                 wpa_printf(MSG_ERROR,
1587                            "KaY: I can't accept the distributed SAK as myself is key server ");
1588                 return -1;
1589         }
1590         if (!participant->kay->macsec_desired ||
1591             participant->kay->macsec_capable == MACSEC_CAP_NOT_IMPLEMENTED) {
1592                 wpa_printf(MSG_ERROR,
1593                            "KaY: I am not MACsec-desired or without MACsec capable");
1594                 return -1;
1595         }
1596
1597         peer = ieee802_1x_kay_get_live_peer(participant,
1598                                             participant->current_peer_id.mi);
1599         if (!peer) {
1600                 wpa_printf(MSG_ERROR,
1601                            "KaY: The key server is not in my live peers list");
1602                 return -1;
1603         }
1604         if (!sci_equal(&participant->kay->key_server_sci, &peer->sci)) {
1605                 wpa_printf(MSG_ERROR, "KaY: The key server is not elected");
1606                 return -1;
1607         }
1608         if (body_len == 0) {
1609                 participant->kay->authenticated = TRUE;
1610                 participant->kay->secured = FALSE;
1611                 participant->kay->failed = FALSE;
1612                 participant->advised_desired = FALSE;
1613                 ieee802_1x_cp_connect_authenticated(participant->kay->cp);
1614                 ieee802_1x_cp_sm_step(participant->kay->cp);
1615                 wpa_printf(MSG_WARNING, "KaY:The Key server advise no MACsec");
1616                 participant->to_use_sak = TRUE;
1617                 return 0;
1618         }
1619         participant->advised_desired = TRUE;
1620         participant->kay->authenticated = FALSE;
1621         participant->kay->secured = TRUE;
1622         participant->kay->failed = FALSE;
1623         ieee802_1x_cp_connect_secure(participant->kay->cp);
1624         ieee802_1x_cp_sm_step(participant->kay->cp);
1625
1626         body = (struct ieee802_1x_mka_dist_sak_body *)mka_msg;
1627         ieee802_1x_mka_dump_dist_sak_body(body);
1628         dl_list_for_each(sa_key, &participant->sak_list, struct data_key, list)
1629         {
1630                 if (os_memcmp(sa_key->key_identifier.mi,
1631                               participant->current_peer_id.mi, MI_LEN) == 0 &&
1632                     sa_key->key_identifier.kn == be_to_host32(body->kn)) {
1633                         wpa_printf(MSG_WARNING, "KaY:The Key has installed");
1634                         return 0;
1635                 }
1636         }
1637         if (body_len == 28) {
1638                 sak_len = DEFAULT_SA_KEY_LEN;
1639                 wrap_sak =  body->sak;
1640                 participant->kay->macsec_csindex = DEFAULT_CS_INDEX;
1641         } else {
1642                 cs = ieee802_1x_kay_get_cipher_suite(participant, body->sak);
1643                 if (!cs) {
1644                         wpa_printf(MSG_ERROR,
1645                                    "KaY: I can't support the Cipher Suite advised by key server");
1646                         return -1;
1647                 }
1648                 sak_len = cs->sak_len;
1649                 wrap_sak = body->sak + CS_ID_LEN;
1650                 participant->kay->macsec_csindex = cs->index;
1651         }
1652
1653         unwrap_sak = os_zalloc(sak_len);
1654         if (!unwrap_sak) {
1655                 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
1656                 return -1;
1657         }
1658         if (aes_unwrap(participant->kek.key, 16, sak_len >> 3, wrap_sak,
1659                        unwrap_sak)) {
1660                 wpa_printf(MSG_ERROR, "KaY: AES unwrap failed");
1661                 os_free(unwrap_sak);
1662                 return -1;
1663         }
1664         wpa_hexdump(MSG_DEBUG, "\tAES Key Unwrap of SAK:", unwrap_sak, sak_len);
1665
1666         conf = os_zalloc(sizeof(*conf));
1667         if (!conf) {
1668                 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
1669                 os_free(unwrap_sak);
1670                 return -1;
1671         }
1672         conf->key_len = sak_len;
1673
1674         conf->key = os_zalloc(conf->key_len);
1675         if (!conf->key) {
1676                 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
1677                 os_free(unwrap_sak);
1678                 os_free(conf);
1679                 return -1;
1680         }
1681
1682         os_memcpy(conf->key, unwrap_sak, conf->key_len);
1683
1684         os_memcpy(&sak_ki.mi, &participant->current_peer_id.mi,
1685                   sizeof(sak_ki.mi));
1686         sak_ki.kn = be_to_host32(body->kn);
1687
1688         os_memcpy(conf->ki.mi, sak_ki.mi, MI_LEN);
1689         conf->ki.kn = sak_ki.kn;
1690         conf->an = body->dan;
1691         conf->offset = body->confid_offset;
1692         conf->rx = TRUE;
1693         conf->tx = TRUE;
1694
1695         sa_key = ieee802_1x_kay_init_data_key(conf);
1696         if (!sa_key) {
1697                 os_free(unwrap_sak);
1698                 os_free(conf->key);
1699                 os_free(conf);
1700                 return -1;
1701         }
1702
1703         dl_list_add(&participant->sak_list, &sa_key->list);
1704
1705         ieee802_1x_cp_set_ciphersuite(
1706                 participant->kay->cp,
1707                 cipher_suite_tbl[participant->kay->macsec_csindex].id);
1708         ieee802_1x_cp_sm_step(participant->kay->cp);
1709         ieee802_1x_cp_set_offset(participant->kay->cp, body->confid_offset);
1710         ieee802_1x_cp_sm_step(participant->kay->cp);
1711         ieee802_1x_cp_set_distributedki(participant->kay->cp, &sak_ki);
1712         ieee802_1x_cp_set_distributedan(participant->kay->cp, body->dan);
1713         ieee802_1x_cp_signal_newsak(participant->kay->cp);
1714         ieee802_1x_cp_sm_step(participant->kay->cp);
1715
1716         participant->to_use_sak = TRUE;
1717
1718         os_free(unwrap_sak);
1719         os_free(conf->key);
1720         os_free(conf);
1721
1722         return 0;
1723 }
1724
1725
1726 /**
1727  * ieee802_1x_mka_icv_body_present
1728  */
1729 static Boolean
1730 ieee802_1x_mka_icv_body_present(struct ieee802_1x_mka_participant *participant)
1731 {
1732         return TRUE;
1733 }
1734
1735
1736 /**
1737  * ieee802_1x_kay_get_icv_length
1738  */
1739 static int
1740 ieee802_1x_mka_get_icv_length(struct ieee802_1x_mka_participant *participant)
1741 {
1742         int length;
1743
1744         length = sizeof(struct ieee802_1x_mka_icv_body);
1745         length += mka_alg_tbl[participant->kay->mka_algindex].icv_len;
1746
1747         return MKA_ALIGN_LENGTH(length);
1748 }
1749
1750
1751 /**
1752  * ieee802_1x_mka_encode_icv_body -
1753  */
1754 static int
1755 ieee802_1x_mka_encode_icv_body(struct ieee802_1x_mka_participant *participant,
1756                                struct wpabuf *buf)
1757 {
1758         struct ieee802_1x_mka_icv_body *body;
1759         unsigned int length;
1760         u8 cmac[MAX_ICV_LEN];
1761
1762         length = ieee802_1x_mka_get_icv_length(participant);
1763         if (length != DEFAULT_ICV_LEN)  {
1764                 body = wpabuf_put(buf, MKA_HDR_LEN);
1765                 body->type = MKA_ICV_INDICATOR;
1766                 set_mka_param_body_len(body, length - MKA_HDR_LEN);
1767         }
1768
1769         if (mka_alg_tbl[participant->kay->mka_algindex].icv_hash(
1770                     participant->ick.key, wpabuf_head(buf), buf->used, cmac)) {
1771                 wpa_printf(MSG_ERROR, "KaY, omac1_aes_128 failed");
1772                 return -1;
1773         }
1774
1775         if (length != DEFAULT_ICV_LEN)  {
1776                 os_memcpy(wpabuf_put(buf, length - MKA_HDR_LEN), cmac,
1777                           length - MKA_HDR_LEN);
1778         } else {
1779                 os_memcpy(wpabuf_put(buf, length), cmac, length);
1780         }
1781
1782         return 0;
1783 }
1784
1785 /**
1786  * ieee802_1x_mka_decode_icv_body -
1787  */
1788 static u8 *
1789 ieee802_1x_mka_decode_icv_body(struct ieee802_1x_mka_participant *participant,
1790                                const u8 *mka_msg, size_t msg_len)
1791 {
1792         struct ieee802_1x_mka_hdr *hdr;
1793         struct ieee802_1x_mka_icv_body *body;
1794         size_t body_len;
1795         size_t left_len;
1796         u8 body_type;
1797         const u8 *pos;
1798
1799         pos = mka_msg;
1800         left_len = msg_len;
1801         while (left_len > (MKA_HDR_LEN + DEFAULT_ICV_LEN)) {
1802                 hdr = (struct ieee802_1x_mka_hdr *) pos;
1803                 body_len = get_mka_param_body_len(hdr);
1804                 body_type = get_mka_param_body_type(hdr);
1805
1806                 if (left_len < (body_len + MKA_HDR_LEN))
1807                         break;
1808
1809                 if (body_type != MKA_ICV_INDICATOR) {
1810                         left_len -= MKA_HDR_LEN + body_len;
1811                         pos += MKA_HDR_LEN + body_len;
1812                         continue;
1813                 }
1814
1815                 body = (struct ieee802_1x_mka_icv_body *)pos;
1816                 if (body_len
1817                         < mka_alg_tbl[participant->kay->mka_algindex].icv_len) {
1818                         return NULL;
1819                 }
1820
1821                 return body->icv;
1822         }
1823
1824         return (u8 *) (mka_msg + msg_len - DEFAULT_ICV_LEN);
1825 }
1826
1827
1828 /**
1829  * ieee802_1x_mka_decode_dist_cak_body-
1830  */
1831 static int
1832 ieee802_1x_mka_decode_dist_cak_body(
1833         struct ieee802_1x_mka_participant *participant,
1834         const u8 *mka_msg, size_t msg_len)
1835 {
1836         struct ieee802_1x_mka_hdr *hdr;
1837         size_t body_len;
1838
1839         hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1840         body_len = get_mka_param_body_len(hdr);
1841         if (body_len < 28) {
1842                 wpa_printf(MSG_ERROR,
1843                            "KaY: MKA Use SAK Packet Body Length (%zu bytes) should be 28 or more octets",
1844                            body_len);
1845                 return -1;
1846         }
1847
1848         return 0;
1849 }
1850
1851
1852 /**
1853  * ieee802_1x_mka_decode_kmd_body -
1854  */
1855 static int
1856 ieee802_1x_mka_decode_kmd_body(
1857         struct ieee802_1x_mka_participant *participant,
1858         const u8 *mka_msg, size_t msg_len)
1859 {
1860         struct ieee802_1x_mka_hdr *hdr;
1861         size_t body_len;
1862
1863         hdr = (struct ieee802_1x_mka_hdr *) mka_msg;
1864         body_len = get_mka_param_body_len(hdr);
1865         if (body_len < 5) {
1866                 wpa_printf(MSG_ERROR,
1867                            "KaY: MKA Use SAK Packet Body Length (%zu bytes) should be 5 or more octets",
1868                            body_len);
1869                 return -1;
1870         }
1871
1872         return 0;
1873 }
1874
1875
1876 /**
1877  * ieee802_1x_mka_decode_announce_body -
1878  */
1879 static int ieee802_1x_mka_decode_announce_body(
1880         struct ieee802_1x_mka_participant *participant,
1881         const u8 *mka_msg, size_t msg_len)
1882 {
1883         return 0;
1884 }
1885
1886
1887 static struct mka_param_body_handler mka_body_handler[] = {
1888         /* basic parameter set */
1889         {
1890                 ieee802_1x_mka_encode_basic_body,
1891                 NULL,
1892                 ieee802_1x_mka_basic_body_length,
1893                 ieee802_1x_mka_basic_body_present
1894         },
1895
1896         /* live peer list parameter set */
1897         {
1898                 ieee802_1x_mka_encode_live_peer_body,
1899                 ieee802_1x_mka_decode_live_peer_body,
1900                 ieee802_1x_mka_get_live_peer_length,
1901                 ieee802_1x_mka_live_peer_body_present
1902         },
1903
1904         /* potential peer list parameter set */
1905         {
1906                 ieee802_1x_mka_encode_potential_peer_body,
1907                 ieee802_1x_mka_decode_potential_peer_body,
1908                 ieee802_1x_mka_get_potential_peer_length,
1909                 ieee802_1x_mka_potential_peer_body_present
1910         },
1911
1912         /* sak use parameter set */
1913         {
1914                 ieee802_1x_mka_encode_sak_use_body,
1915                 ieee802_1x_mka_decode_sak_use_body,
1916                 ieee802_1x_mka_get_sak_use_length,
1917                 ieee802_1x_mka_sak_use_body_present
1918         },
1919
1920         /* distribute sak parameter set */
1921         {
1922                 ieee802_1x_mka_encode_dist_sak_body,
1923                 ieee802_1x_mka_decode_dist_sak_body,
1924                 ieee802_1x_mka_get_dist_sak_length,
1925                 ieee802_1x_mka_dist_sak_body_present
1926         },
1927
1928         /* distribute cak parameter set */
1929         {
1930                 NULL,
1931                 ieee802_1x_mka_decode_dist_cak_body,
1932                 NULL,
1933                 NULL
1934         },
1935
1936         /* kmd parameter set */
1937         {
1938                 NULL,
1939                 ieee802_1x_mka_decode_kmd_body,
1940                 NULL,
1941                 NULL
1942         },
1943
1944         /* announce parameter set */
1945         {
1946                 NULL,
1947                 ieee802_1x_mka_decode_announce_body,
1948                 NULL,
1949                 NULL
1950         },
1951
1952         /* icv parameter set */
1953         {
1954                 ieee802_1x_mka_encode_icv_body,
1955                 NULL,
1956                 ieee802_1x_mka_get_icv_length,
1957                 ieee802_1x_mka_icv_body_present
1958         },
1959 };
1960
1961
1962 /**
1963  * ieee802_1x_kay_deinit_data_key -
1964  */
1965 static void ieee802_1x_kay_deinit_data_key(struct data_key *pkey)
1966 {
1967         if (!pkey)
1968                 return;
1969
1970         pkey->user--;
1971         if (pkey->user > 1)
1972                 return;
1973
1974         dl_list_del(&pkey->list);
1975         os_free(pkey->key);
1976         os_free(pkey);
1977 }
1978
1979
1980 /**
1981  * ieee802_1x_kay_generate_new_sak -
1982  */
1983 static int
1984 ieee802_1x_kay_generate_new_sak(struct ieee802_1x_mka_participant *participant)
1985 {
1986         struct data_key *sa_key = NULL;
1987         struct key_conf *conf;
1988         struct ieee802_1x_kay_peer *peer;
1989         struct ieee802_1x_kay *kay = participant->kay;
1990         int ctx_len, ctx_offset;
1991         u8 *context;
1992
1993         /* check condition for generating a fresh SAK:
1994          * must have one live peer
1995          * and MKA life time elapse since last distribution
1996          * or potential peer is empty
1997          */
1998         if (dl_list_empty(&participant->live_peers)) {
1999                 wpa_printf(MSG_ERROR,
2000                            "KaY: Live peers list must not empty when generating fresh SAK");
2001                 return -1;
2002         }
2003
2004         /* FIXME: A fresh SAK not generated until
2005          * the live peer list contains at least one peer and
2006          * MKA life time has elapsed since the prior SAK was first distributed,
2007          * or the Key server's potential peer is empty
2008          * but I can't understand the second item, so
2009          * here only check first item and ingore
2010          *   && (!dl_list_empty(&participant->potential_peers))) {
2011          */
2012         if ((time(NULL) - kay->dist_time) < MKA_LIFE_TIME / 1000) {
2013                 wpa_printf(MSG_ERROR,
2014                            "KaY: Life time have not elapsed since prior SAK distributed");
2015                 return -1;
2016         }
2017
2018         conf = os_zalloc(sizeof(*conf));
2019         if (!conf) {
2020                 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
2021                 return -1;
2022         }
2023         conf->key_len = cipher_suite_tbl[kay->macsec_csindex].sak_len;
2024
2025         conf->key = os_zalloc(conf->key_len);
2026         if (!conf->key) {
2027                 os_free(conf);
2028                 wpa_printf(MSG_ERROR, "KaY-%s: Out of memory", __func__);
2029                 return -1;
2030         }
2031
2032         ctx_len = conf->key_len + sizeof(kay->dist_kn);
2033         dl_list_for_each(peer, &participant->live_peers,
2034                          struct ieee802_1x_kay_peer, list)
2035                 ctx_len += sizeof(peer->mi);
2036         ctx_len += sizeof(participant->mi);
2037
2038         context = os_zalloc(ctx_len);
2039         if (!context) {
2040                 os_free(conf->key);
2041                 os_free(conf);
2042                 return -1;
2043         }
2044         ctx_offset = 0;
2045         if (os_get_random(context + ctx_offset, conf->key_len) < 0) {
2046                 os_free(context);
2047                 os_free(conf->key);
2048                 os_free(conf);
2049                 return -1;
2050         }
2051         ctx_offset += conf->key_len;
2052         dl_list_for_each(peer, &participant->live_peers,
2053                          struct ieee802_1x_kay_peer, list) {
2054                 os_memcpy(context + ctx_offset, peer->mi, sizeof(peer->mi));
2055                 ctx_offset += sizeof(peer->mi);
2056         }
2057         os_memcpy(context + ctx_offset, participant->mi,
2058                   sizeof(participant->mi));
2059         ctx_offset += sizeof(participant->mi);
2060         os_memcpy(context + ctx_offset, &kay->dist_kn, sizeof(kay->dist_kn));
2061
2062         if (conf->key_len == 16) {
2063                 ieee802_1x_sak_128bits_aes_cmac(participant->cak.key,
2064                                                 context, ctx_len, conf->key);
2065         } else if (conf->key_len == 32) {
2066                 ieee802_1x_sak_128bits_aes_cmac(participant->cak.key,
2067                                                 context, ctx_len, conf->key);
2068         } else {
2069                 wpa_printf(MSG_ERROR, "KaY: SAK Length not support");
2070                 os_free(conf->key);
2071                 os_free(conf);
2072                 os_free(context);
2073                 return -1;
2074         }
2075         wpa_hexdump(MSG_DEBUG, "KaY: generated new SAK",
2076                     conf->key, conf->key_len);
2077
2078         os_memcpy(conf->ki.mi, participant->mi, MI_LEN);
2079         conf->ki.kn = participant->kay->dist_kn;
2080         conf->an = participant->kay->dist_an;
2081         conf->offset = kay->macsec_confidentiality;
2082         conf->rx = TRUE;
2083         conf->tx = TRUE;
2084
2085         sa_key = ieee802_1x_kay_init_data_key(conf);
2086         if (!sa_key) {
2087                 os_free(conf->key);
2088                 os_free(conf);
2089                 os_free(context);
2090                 return -1;
2091         }
2092         participant->new_key = sa_key;
2093
2094         dl_list_add(&participant->sak_list, &sa_key->list);
2095         ieee802_1x_cp_set_ciphersuite(participant->kay->cp,
2096                                       cipher_suite_tbl[kay->macsec_csindex].id);
2097         ieee802_1x_cp_sm_step(kay->cp);
2098         ieee802_1x_cp_set_offset(kay->cp, conf->offset);
2099         ieee802_1x_cp_sm_step(kay->cp);
2100         ieee802_1x_cp_set_distributedki(kay->cp, &conf->ki);
2101         ieee802_1x_cp_set_distributedan(kay->cp, conf->an);
2102         ieee802_1x_cp_signal_newsak(kay->cp);
2103         ieee802_1x_cp_sm_step(kay->cp);
2104
2105         dl_list_for_each(peer, &participant->live_peers,
2106                          struct ieee802_1x_kay_peer, list)
2107                 peer->sak_used = FALSE;
2108
2109         participant->kay->dist_kn++;
2110         participant->kay->dist_an++;
2111         if (participant->kay->dist_an > 3)
2112                 participant->kay->dist_an = 0;
2113
2114         participant->kay->dist_time = time(NULL);
2115
2116         os_free(conf->key);
2117         os_free(conf);
2118         os_free(context);
2119         return 0;
2120 }
2121
2122
2123 /**
2124  * ieee802_1x_kay_elect_key_server - elect the key server
2125  * when to elect: whenever the live peers list changes
2126  */
2127 static int
2128 ieee802_1x_kay_elect_key_server(struct ieee802_1x_mka_participant *participant)
2129 {
2130         struct ieee802_1x_kay_peer *peer;
2131         struct ieee802_1x_kay_peer *key_server = NULL;
2132         struct ieee802_1x_kay *kay = participant->kay;
2133         Boolean i_is_key_server;
2134
2135         if (participant->is_obliged_key_server) {
2136                 participant->new_sak = TRUE;
2137                 participant->to_dist_sak = FALSE;
2138                 ieee802_1x_cp_set_electedself(kay->cp, TRUE);
2139                 return 0;
2140         }
2141
2142         /* elect the key server among the peers */
2143         dl_list_for_each(peer, &participant->live_peers,
2144                          struct ieee802_1x_kay_peer, list) {
2145                 if (!peer->is_key_server)
2146                         continue;
2147
2148                 if (!key_server) {
2149                         key_server = peer;
2150                         continue;
2151                 }
2152
2153                 if (peer->key_server_priority <
2154                     key_server->key_server_priority) {
2155                         key_server = peer;
2156                 } else if (peer->key_server_priority ==
2157                            key_server->key_server_priority) {
2158                         if (os_memcmp(peer->sci.addr, key_server->sci.addr,
2159                                       ETH_ALEN) < 0)
2160                                 key_server = peer;
2161                 }
2162         }
2163
2164         /* elect the key server between me and the above elected peer */
2165         i_is_key_server = FALSE;
2166         if (key_server && participant->can_be_key_server) {
2167                 if (kay->actor_priority
2168                            < key_server->key_server_priority) {
2169                         i_is_key_server = TRUE;
2170                 } else if (kay->actor_priority
2171                                         == key_server->key_server_priority) {
2172                         if (os_memcmp(kay->actor_sci.addr, key_server->sci.addr,
2173                                       ETH_ALEN) < 0)
2174                                 i_is_key_server = TRUE;
2175                 }
2176         } else if (participant->can_be_key_server) {
2177                 i_is_key_server = TRUE;
2178         }
2179
2180         if (i_is_key_server) {
2181                 ieee802_1x_cp_set_electedself(kay->cp, TRUE);
2182                 if (!sci_equal(&kay->key_server_sci, &kay->actor_sci)) {
2183                         ieee802_1x_cp_signal_chgdserver(kay->cp);
2184                         ieee802_1x_cp_sm_step(kay->cp);
2185                 }
2186
2187                 participant->is_key_server = TRUE;
2188                 participant->principal = TRUE;
2189                 participant->new_sak = TRUE;
2190                 wpa_printf(MSG_DEBUG, "KaY: I is elected as key server");
2191                 participant->to_dist_sak = FALSE;
2192                 participant->is_elected = TRUE;
2193
2194                 os_memcpy(&kay->key_server_sci, &kay->actor_sci,
2195                           sizeof(kay->key_server_sci));
2196                 kay->key_server_priority = kay->actor_priority;
2197         } else if (key_server) {
2198                 ieee802_1x_cp_set_electedself(kay->cp, FALSE);
2199                 if (!sci_equal(&kay->key_server_sci, &key_server->sci)) {
2200                         ieee802_1x_cp_signal_chgdserver(kay->cp);
2201                         ieee802_1x_cp_sm_step(kay->cp);
2202                 }
2203
2204                 participant->is_key_server = FALSE;
2205                 participant->principal = TRUE;
2206                 participant->is_elected = TRUE;
2207
2208                 os_memcpy(&kay->key_server_sci, &key_server->sci,
2209                           sizeof(kay->key_server_sci));
2210                 kay->key_server_priority = key_server->key_server_priority;
2211         } else {
2212                 participant->principal = FALSE;
2213                 participant->is_key_server = FALSE;
2214                 participant->is_elected = FALSE;
2215         }
2216
2217         return 0;
2218 }
2219
2220
2221 /**
2222  * ieee802_1x_kay_decide_macsec_use - the key server determinate
2223  *               how to use MACsec: whether use MACsec and its capability
2224  * protectFrames will be advised if the key server and one of its live peers are
2225  * MACsec capable and one of those request MACsec protection
2226  */
2227 static int
2228 ieee802_1x_kay_decide_macsec_use(
2229         struct ieee802_1x_mka_participant *participant)
2230 {
2231         struct ieee802_1x_kay *kay = participant->kay;
2232         struct ieee802_1x_kay_peer *peer;
2233         enum macsec_cap less_capability;
2234         Boolean has_peer;
2235
2236         if (!participant->is_key_server)
2237                 return -1;
2238
2239         /* key server self is MACsec-desired and requesting MACsec */
2240         if (!kay->macsec_desired) {
2241                 participant->advised_desired = FALSE;
2242                 return -1;
2243         }
2244         if (kay->macsec_capable == MACSEC_CAP_NOT_IMPLEMENTED) {
2245                 participant->advised_desired = FALSE;
2246                 return -1;
2247         }
2248         less_capability = kay->macsec_capable;
2249
2250         /* at least one of peers is MACsec-desired and requesting MACsec */
2251         has_peer = FALSE;
2252         dl_list_for_each(peer, &participant->live_peers,
2253                          struct ieee802_1x_kay_peer, list) {
2254                 if (!peer->macsec_desired)
2255                         continue;
2256
2257                 if (peer->macsec_capability == MACSEC_CAP_NOT_IMPLEMENTED)
2258                         continue;
2259
2260                 less_capability = (less_capability < peer->macsec_capability) ?
2261                         less_capability : peer->macsec_capability;
2262                 has_peer = TRUE;
2263         }
2264
2265         if (has_peer) {
2266                 participant->advised_desired = TRUE;
2267                 participant->advised_capability = less_capability;
2268                 kay->authenticated = FALSE;
2269                 kay->secured = TRUE;
2270                 kay->failed = FALSE;
2271                 ieee802_1x_cp_connect_secure(kay->cp);
2272                 ieee802_1x_cp_sm_step(kay->cp);
2273         } else {
2274                 participant->advised_desired = FALSE;
2275                 participant->advised_capability = MACSEC_CAP_NOT_IMPLEMENTED;
2276                 participant->to_use_sak = FALSE;
2277                 kay->authenticated = TRUE;
2278                 kay->secured = FALSE;
2279                 kay->failed = FALSE;
2280                 kay->ltx_kn = 0;
2281                 kay->ltx_an = 0;
2282                 kay->lrx_kn = 0;
2283                 kay->lrx_an = 0;
2284                 kay->otx_kn = 0;
2285                 kay->otx_an = 0;
2286                 kay->orx_kn = 0;
2287                 kay->orx_an = 0;
2288                 ieee802_1x_cp_connect_authenticated(kay->cp);
2289                 ieee802_1x_cp_sm_step(kay->cp);
2290         }
2291
2292         return 0;
2293 }
2294
2295 static const u8 pae_group_addr[ETH_ALEN] = {
2296         0x01, 0x80, 0xc2, 0x00, 0x00, 0x03
2297 };
2298
2299
2300 /**
2301  * ieee802_1x_kay_encode_mkpdu -
2302  */
2303 static int
2304 ieee802_1x_kay_encode_mkpdu(struct ieee802_1x_mka_participant *participant,
2305                             struct wpabuf *pbuf)
2306 {
2307         unsigned int i;
2308         struct ieee8023_hdr *ether_hdr;
2309         struct ieee802_1x_hdr *eapol_hdr;
2310
2311         ether_hdr = wpabuf_put(pbuf, sizeof(*ether_hdr));
2312         os_memcpy(ether_hdr->dest, pae_group_addr, sizeof(ether_hdr->dest));
2313         os_memcpy(ether_hdr->src, participant->kay->actor_sci.addr,
2314                   sizeof(ether_hdr->dest));
2315         ether_hdr->ethertype = host_to_be16(ETH_P_EAPOL);
2316
2317         eapol_hdr = wpabuf_put(pbuf, sizeof(*eapol_hdr));
2318         eapol_hdr->version = EAPOL_VERSION;
2319         eapol_hdr->type = IEEE802_1X_TYPE_EAPOL_MKA;
2320         eapol_hdr->length = host_to_be16(pbuf->size - pbuf->used);
2321
2322         for (i = 0; i < ARRAY_SIZE(mka_body_handler); i++) {
2323                 if (mka_body_handler[i].body_present &&
2324                     mka_body_handler[i].body_present(participant)) {
2325                         if (mka_body_handler[i].body_tx(participant, pbuf))
2326                                 return -1;
2327                 }
2328         }
2329
2330         return 0;
2331 }
2332
2333 /**
2334  * ieee802_1x_participant_send_mkpdu -
2335  */
2336 static int
2337 ieee802_1x_participant_send_mkpdu(
2338         struct ieee802_1x_mka_participant *participant)
2339 {
2340         struct wpabuf *buf;
2341         struct ieee802_1x_kay *kay = participant->kay;
2342         size_t length = 0;
2343         unsigned int i;
2344
2345         wpa_printf(MSG_DEBUG, "KaY: to enpacket and send the MKPDU");
2346         length += sizeof(struct ieee802_1x_hdr) + sizeof(struct ieee8023_hdr);
2347         for (i = 0; i < ARRAY_SIZE(mka_body_handler); i++) {
2348                 if (mka_body_handler[i].body_present &&
2349                     mka_body_handler[i].body_present(participant))
2350                         length += mka_body_handler[i].body_length(participant);
2351         }
2352
2353         buf = wpabuf_alloc(length);
2354         if (!buf) {
2355                 wpa_printf(MSG_ERROR, "KaY: out of memory");
2356                 return -1;
2357         }
2358
2359         if (ieee802_1x_kay_encode_mkpdu(participant, buf)) {
2360                 wpa_printf(MSG_ERROR, "KaY: encode mkpdu fail!");
2361                 return -1;
2362         }
2363
2364         l2_packet_send(kay->l2_mka, NULL, 0, wpabuf_head(buf), wpabuf_len(buf));
2365         wpabuf_free(buf);
2366
2367         kay->active = TRUE;
2368         participant->active = TRUE;
2369
2370         return 0;
2371 }
2372
2373
2374 static void ieee802_1x_kay_deinit_transmit_sa(struct transmit_sa *psa);
2375 /**
2376  * ieee802_1x_participant_timer -
2377  */
2378 static void ieee802_1x_participant_timer(void *eloop_ctx, void *timeout_ctx)
2379 {
2380         struct ieee802_1x_mka_participant *participant;
2381         struct ieee802_1x_kay *kay;
2382         struct ieee802_1x_kay_peer *peer, *pre_peer;
2383         time_t now = time(NULL);
2384         Boolean lp_changed;
2385         struct receive_sc *rxsc, *pre_rxsc;
2386         struct transmit_sa *txsa, *pre_txsa;
2387
2388         participant = (struct ieee802_1x_mka_participant *)eloop_ctx;
2389         kay = participant->kay;
2390         if (participant->cak_life) {
2391                 if (now > participant->cak_life) {
2392                         kay->authenticated = FALSE;
2393                         kay->secured = FALSE;
2394                         kay->failed = TRUE;
2395                         ieee802_1x_kay_delete_mka(kay, &participant->ckn);
2396                         return;
2397                 }
2398         }
2399
2400         /* should delete MKA instance if there are not live peers
2401          * when the MKA life elapsed since its creating */
2402         if (participant->mka_life) {
2403                 if (dl_list_empty(&participant->live_peers)) {
2404                         if (now > participant->mka_life) {
2405                                 kay->authenticated = FALSE;
2406                                 kay->secured = FALSE;
2407                                 kay->failed = TRUE;
2408                                 ieee802_1x_kay_delete_mka(kay,
2409                                                           &participant->ckn);
2410                                 return;
2411                         }
2412                 } else {
2413                         participant->mka_life = 0;
2414                 }
2415         }
2416
2417         lp_changed = FALSE;
2418         dl_list_for_each_safe(peer, pre_peer, &participant->live_peers,
2419                               struct ieee802_1x_kay_peer, list) {
2420                 if (now > peer->expire) {
2421                         wpa_printf(MSG_DEBUG, "KaY: Live peer removed");
2422                         wpa_hexdump(MSG_DEBUG, "\tMI: ", peer->mi,
2423                                     sizeof(peer->mi));
2424                         wpa_printf(MSG_DEBUG, "\tMN: %d", peer->mn);
2425                         dl_list_for_each_safe(rxsc, pre_rxsc,
2426                                               &participant->rxsc_list,
2427                                               struct receive_sc, list) {
2428                                 if (sci_equal(&rxsc->sci, &peer->sci)) {
2429                                         secy_delete_receive_sc(kay, rxsc);
2430                                         ieee802_1x_kay_deinit_receive_sc(
2431                                                 participant, rxsc);
2432                                 }
2433                         }
2434                         dl_list_del(&peer->list);
2435                         os_free(peer);
2436                         lp_changed = TRUE;
2437                 }
2438         }
2439
2440         if (lp_changed) {
2441                 if (dl_list_empty(&participant->live_peers)) {
2442                         participant->advised_desired = FALSE;
2443                         participant->advised_capability =
2444                                 MACSEC_CAP_NOT_IMPLEMENTED;
2445                         participant->to_use_sak = FALSE;
2446                         kay->authenticated = TRUE;
2447                         kay->secured = FALSE;
2448                         kay->failed = FALSE;
2449                         kay->ltx_kn = 0;
2450                         kay->ltx_an = 0;
2451                         kay->lrx_kn = 0;
2452                         kay->lrx_an = 0;
2453                         kay->otx_kn = 0;
2454                         kay->otx_an = 0;
2455                         kay->orx_kn = 0;
2456                         kay->orx_an = 0;
2457                         dl_list_for_each_safe(txsa, pre_txsa,
2458                                               &participant->txsc->sa_list,
2459                                               struct transmit_sa, list) {
2460                                 secy_disable_transmit_sa(kay, txsa);
2461                                 ieee802_1x_kay_deinit_transmit_sa(txsa);
2462                         }
2463
2464                         ieee802_1x_cp_connect_authenticated(kay->cp);
2465                         ieee802_1x_cp_sm_step(kay->cp);
2466                 } else {
2467                         ieee802_1x_kay_elect_key_server(participant);
2468                         ieee802_1x_kay_decide_macsec_use(participant);
2469                 }
2470         }
2471
2472         dl_list_for_each_safe(peer, pre_peer, &participant->potential_peers,
2473                               struct ieee802_1x_kay_peer, list) {
2474                 if (now > peer->expire) {
2475                         wpa_printf(MSG_DEBUG, "KaY: Potential peer removed");
2476                         wpa_hexdump(MSG_DEBUG, "\tMI: ", peer->mi,
2477                                     sizeof(peer->mi));
2478                         wpa_printf(MSG_DEBUG, "\tMN: %d", peer->mn);
2479                         dl_list_del(&peer->list);
2480                         os_free(peer);
2481                 }
2482         }
2483
2484         if (participant->new_sak) {
2485                 if (!ieee802_1x_kay_generate_new_sak(participant))
2486                         participant->to_dist_sak = TRUE;
2487
2488                 participant->new_sak = FALSE;
2489         }
2490
2491         if (participant->retry_count < MAX_RETRY_CNT) {
2492                 ieee802_1x_participant_send_mkpdu(participant);
2493                 participant->retry_count++;
2494         }
2495
2496         eloop_register_timeout(MKA_HELLO_TIME / 1000, 0,
2497                                ieee802_1x_participant_timer,
2498                                participant, NULL);
2499 }
2500
2501
2502 /**
2503  * ieee802_1x_kay_init_transmit_sa -
2504  */
2505 static struct transmit_sa *
2506 ieee802_1x_kay_init_transmit_sa(struct transmit_sc *psc, u8 an, u32 next_PN,
2507                                 struct data_key *key)
2508 {
2509         struct transmit_sa *psa;
2510
2511         key->tx_latest = TRUE;
2512         key->rx_latest = TRUE;
2513
2514         psa = os_zalloc(sizeof(*psa));
2515         if (!psa) {
2516                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
2517                 return NULL;
2518         }
2519
2520         if (key->confidentiality_offset >= CONFIDENTIALITY_OFFSET_0 &&
2521             key->confidentiality_offset <= CONFIDENTIALITY_OFFSET_50)
2522                 psa->confidentiality = TRUE;
2523         else
2524                 psa->confidentiality = FALSE;
2525
2526         psa->an = an;
2527         psa->pkey = key;
2528         psa->next_pn = next_PN;
2529         psa->sc = psc;
2530
2531         os_get_time(&psa->created_time);
2532         psa->in_use = FALSE;
2533
2534         dl_list_add(&psc->sa_list, &psa->list);
2535         wpa_printf(MSG_DEBUG,
2536                    "KaY: Create transmit SA(an: %hhu, next_PN: %u) of SC(channel: %d)",
2537                    an, next_PN, psc->channel);
2538
2539         return psa;
2540 }
2541
2542
2543 /**
2544  * ieee802_1x_kay_deinit_transmit_sa -
2545  */
2546 static void ieee802_1x_kay_deinit_transmit_sa(struct transmit_sa *psa)
2547 {
2548         psa->pkey = NULL;
2549         wpa_printf(MSG_DEBUG,
2550                    "KaY: Delete transmit SA(an: %hhu) of SC",
2551                    psa->an);
2552         dl_list_del(&psa->list);
2553         os_free(psa);
2554 }
2555
2556
2557 /**
2558  * init_transmit_sc -
2559  */
2560 static struct transmit_sc *
2561 ieee802_1x_kay_init_transmit_sc(const struct ieee802_1x_mka_sci *sci,
2562                                 int channel)
2563 {
2564         struct transmit_sc *psc;
2565
2566         psc = os_zalloc(sizeof(*psc));
2567         if (!psc) {
2568                 wpa_printf(MSG_ERROR, "%s: out of memory", __func__);
2569                 return NULL;
2570         }
2571         os_memcpy(&psc->sci, sci, sizeof(psc->sci));
2572         psc->channel = channel;
2573
2574         os_get_time(&psc->created_time);
2575         psc->transmitting = FALSE;
2576         psc->encoding_sa = FALSE;
2577         psc->enciphering_sa = FALSE;
2578
2579         dl_list_init(&psc->sa_list);
2580         wpa_printf(MSG_DEBUG, "KaY: Create transmit SC(channel: %d)", channel);
2581         wpa_hexdump(MSG_DEBUG, "SCI: ", (u8 *)sci , sizeof(*sci));
2582
2583         return psc;
2584 }
2585
2586
2587 /**
2588  * ieee802_1x_kay_deinit_transmit_sc -
2589  */
2590 static void
2591 ieee802_1x_kay_deinit_transmit_sc(
2592         struct ieee802_1x_mka_participant *participant, struct transmit_sc *psc)
2593 {
2594         struct transmit_sa *psa, *tmp;
2595
2596         wpa_printf(MSG_DEBUG, "KaY: Delete transmit SC(channel: %d)",
2597                    psc->channel);
2598         dl_list_for_each_safe(psa, tmp, &psc->sa_list, struct transmit_sa,
2599                               list) {
2600                 secy_disable_transmit_sa(participant->kay, psa);
2601                 ieee802_1x_kay_deinit_transmit_sa(psa);
2602         }
2603
2604         os_free(psc);
2605 }
2606
2607
2608 /****************** Interface between CP and KAY *********************/
2609 /**
2610  * ieee802_1x_kay_set_latest_sa_attr -
2611  */
2612 int ieee802_1x_kay_set_latest_sa_attr(struct ieee802_1x_kay *kay,
2613                                       struct ieee802_1x_mka_ki *lki, u8 lan,
2614                                       Boolean ltx, Boolean lrx)
2615 {
2616         struct ieee802_1x_mka_participant *principal;
2617
2618         principal = ieee802_1x_kay_get_principal_participant(kay);
2619         if (!principal)
2620                 return -1;
2621
2622         if (!lki)
2623                 os_memset(&principal->lki, 0, sizeof(principal->lki));
2624         else
2625                 os_memcpy(&principal->lki, lki, sizeof(principal->lki));
2626
2627         principal->lan = lan;
2628         principal->ltx = ltx;
2629         principal->lrx = lrx;
2630         if (!lki) {
2631                 kay->ltx_kn = 0;
2632                 kay->lrx_kn = 0;
2633         } else {
2634                 kay->ltx_kn = lki->kn;
2635                 kay->lrx_kn = lki->kn;
2636         }
2637         kay->ltx_an = lan;
2638         kay->lrx_an = lan;
2639
2640         return 0;
2641 }
2642
2643
2644 /**
2645  * ieee802_1x_kay_set_old_sa_attr -
2646  */
2647 int ieee802_1x_kay_set_old_sa_attr(struct ieee802_1x_kay *kay,
2648                                    struct ieee802_1x_mka_ki *oki,
2649                                    u8 oan, Boolean otx, Boolean orx)
2650 {
2651         struct ieee802_1x_mka_participant *principal;
2652
2653         principal = ieee802_1x_kay_get_principal_participant(kay);
2654         if (!principal)
2655                 return -1;
2656
2657         if (!oki)
2658                 os_memset(&principal->oki, 0, sizeof(principal->oki));
2659         else
2660                 os_memcpy(&principal->oki, oki, sizeof(principal->oki));
2661
2662         principal->oan = oan;
2663         principal->otx = otx;
2664         principal->orx = orx;
2665
2666         if (!oki) {
2667                 kay->otx_kn = 0;
2668                 kay->orx_kn = 0;
2669         } else {
2670                 kay->otx_kn = oki->kn;
2671                 kay->orx_kn = oki->kn;
2672         }
2673         kay->otx_an = oan;
2674         kay->orx_an = oan;
2675
2676         return 0;
2677 }
2678
2679
2680 /**
2681  * ieee802_1x_kay_create_sas -
2682  */
2683 int ieee802_1x_kay_create_sas(struct ieee802_1x_kay *kay,
2684                               struct ieee802_1x_mka_ki *lki)
2685 {
2686         struct data_key *sa_key, *latest_sak;
2687         struct ieee802_1x_mka_participant *principal;
2688         struct receive_sc *rxsc;
2689         struct receive_sa *rxsa;
2690         struct transmit_sa *txsa;
2691
2692         principal = ieee802_1x_kay_get_principal_participant(kay);
2693         if (!principal)
2694                 return -1;
2695
2696         latest_sak = NULL;
2697         dl_list_for_each(sa_key, &principal->sak_list, struct data_key, list) {
2698                 if (is_ki_equal(&sa_key->key_identifier, lki)) {
2699                         sa_key->rx_latest = TRUE;
2700                         sa_key->tx_latest = TRUE;
2701                         latest_sak = sa_key;
2702                         principal->to_use_sak = TRUE;
2703                 } else {
2704                         sa_key->rx_latest = FALSE;
2705                         sa_key->tx_latest = FALSE;
2706                 }
2707         }
2708         if (!latest_sak) {
2709                 wpa_printf(MSG_ERROR, "lki related sak not found");
2710                 return -1;
2711         }
2712
2713         dl_list_for_each(rxsc, &principal->rxsc_list, struct receive_sc, list) {
2714                 rxsa = ieee802_1x_kay_init_receive_sa(rxsc, latest_sak->an, 1,
2715                                                       latest_sak);
2716                 if (!rxsa)
2717                         return -1;
2718
2719                 secy_create_receive_sa(kay, rxsa);
2720         }
2721
2722         txsa = ieee802_1x_kay_init_transmit_sa(principal->txsc, latest_sak->an,
2723                                                1, latest_sak);
2724         if (!txsa)
2725                 return -1;
2726
2727         secy_create_transmit_sa(kay, txsa);
2728
2729
2730
2731         return 0;
2732 }
2733
2734
2735 /**
2736  * ieee802_1x_kay_delete_sas -
2737  */
2738 int ieee802_1x_kay_delete_sas(struct ieee802_1x_kay *kay,
2739                               struct ieee802_1x_mka_ki *ki)
2740 {
2741         struct data_key *sa_key, *pre_key;
2742         struct transmit_sa *txsa, *pre_txsa;
2743         struct receive_sa *rxsa, *pre_rxsa;
2744         struct receive_sc *rxsc;
2745         struct ieee802_1x_mka_participant *principal;
2746
2747         wpa_printf(MSG_DEBUG, "KaY: Entry into %s", __func__);
2748         principal = ieee802_1x_kay_get_principal_participant(kay);
2749         if (!principal)
2750                 return -1;
2751
2752         /* remove the transmit sa */
2753         dl_list_for_each_safe(txsa, pre_txsa, &principal->txsc->sa_list,
2754                               struct transmit_sa, list) {
2755                 if (is_ki_equal(&txsa->pkey->key_identifier, ki)) {
2756                         secy_disable_transmit_sa(kay, txsa);
2757                         ieee802_1x_kay_deinit_transmit_sa(txsa);
2758                 }
2759         }
2760
2761         /* remove the receive sa */
2762         dl_list_for_each(rxsc, &principal->rxsc_list, struct receive_sc, list) {
2763                 dl_list_for_each_safe(rxsa, pre_rxsa, &rxsc->sa_list,
2764                                       struct receive_sa, list) {
2765                         if (is_ki_equal(&rxsa->pkey->key_identifier, ki)) {
2766                                 secy_disable_receive_sa(kay, rxsa);
2767                                 ieee802_1x_kay_deinit_receive_sa(rxsa);
2768                         }
2769                 }
2770         }
2771
2772         /* remove the sak */
2773         dl_list_for_each_safe(sa_key, pre_key, &principal->sak_list,
2774                               struct data_key, list) {
2775                 if (is_ki_equal(&sa_key->key_identifier, ki)) {
2776                         ieee802_1x_kay_deinit_data_key(sa_key);
2777                         break;
2778                 }
2779                 if (principal->new_key == sa_key)
2780                         principal->new_key = NULL;
2781         }
2782
2783         return 0;
2784 }
2785
2786
2787 /**
2788  * ieee802_1x_kay_enable_tx_sas -
2789  */
2790 int ieee802_1x_kay_enable_tx_sas(struct ieee802_1x_kay *kay,
2791                                  struct ieee802_1x_mka_ki *lki)
2792 {
2793         struct ieee802_1x_mka_participant *principal;
2794         struct transmit_sa *txsa;
2795
2796         principal = ieee802_1x_kay_get_principal_participant(kay);
2797         if (!principal)
2798                 return -1;
2799
2800         dl_list_for_each(txsa, &principal->txsc->sa_list, struct transmit_sa,
2801                          list) {
2802                 if (is_ki_equal(&txsa->pkey->key_identifier, lki)) {
2803                         txsa->in_use = TRUE;
2804                         secy_enable_transmit_sa(kay, txsa);
2805                         ieee802_1x_cp_set_usingtransmitas(
2806                                 principal->kay->cp, TRUE);
2807                         ieee802_1x_cp_sm_step(principal->kay->cp);
2808                 }
2809         }
2810
2811         return 0;
2812 }
2813
2814
2815 /**
2816  * ieee802_1x_kay_enable_rx_sas -
2817  */
2818 int ieee802_1x_kay_enable_rx_sas(struct ieee802_1x_kay *kay,
2819                                  struct ieee802_1x_mka_ki *lki)
2820 {
2821         struct ieee802_1x_mka_participant *principal;
2822         struct receive_sa *rxsa;
2823         struct receive_sc *rxsc;
2824
2825         principal = ieee802_1x_kay_get_principal_participant(kay);
2826         if (!principal)
2827                 return -1;
2828
2829         dl_list_for_each(rxsc, &principal->rxsc_list, struct receive_sc, list) {
2830                 dl_list_for_each(rxsa, &rxsc->sa_list, struct receive_sa, list)
2831                 {
2832                         if (is_ki_equal(&rxsa->pkey->key_identifier, lki)) {
2833                                 rxsa->in_use = TRUE;
2834                                 secy_enable_receive_sa(kay, rxsa);
2835                                 ieee802_1x_cp_set_usingreceivesas(
2836                                         principal->kay->cp, TRUE);
2837                                 ieee802_1x_cp_sm_step(principal->kay->cp);
2838                         }
2839                 }
2840         }
2841
2842         return 0;
2843 }
2844
2845
2846 /**
2847  * ieee802_1x_kay_enable_new_info -
2848  */
2849 int ieee802_1x_kay_enable_new_info(struct ieee802_1x_kay *kay)
2850 {
2851         struct ieee802_1x_mka_participant *principal;
2852
2853         principal = ieee802_1x_kay_get_principal_participant(kay);
2854         if (!principal)
2855                 return -1;
2856
2857         if (principal->retry_count < MAX_RETRY_CNT) {
2858                 ieee802_1x_participant_send_mkpdu(principal);
2859                 principal->retry_count++;
2860         }
2861
2862         return 0;
2863 }
2864
2865
2866 /**
2867  * ieee802_1x_kay_cp_conf -
2868  */
2869 int ieee802_1x_kay_cp_conf(struct ieee802_1x_kay *kay,
2870                            struct ieee802_1x_cp_conf *pconf)
2871 {
2872         pconf->protect = kay->macsec_protect;
2873         pconf->replay_protect = kay->macsec_replay_protect;
2874         pconf->validate = kay->macsec_validate;
2875
2876         return 0;
2877 }
2878
2879
2880 /**
2881  * ieee802_1x_kay_alloc_cp_sm -
2882  */
2883 static struct ieee802_1x_cp_sm *
2884 ieee802_1x_kay_alloc_cp_sm(struct ieee802_1x_kay *kay)
2885 {
2886         struct ieee802_1x_cp_conf conf;
2887
2888         os_memset(&conf, 0, sizeof(conf));
2889         conf.protect = kay->macsec_protect;
2890         conf.replay_protect = kay->macsec_replay_protect;
2891         conf.validate = kay->macsec_validate;
2892         conf.replay_window = kay->macsec_replay_window;
2893
2894         return ieee802_1x_cp_sm_init(kay, &conf);
2895 }
2896
2897
2898 /**
2899  * ieee802_1x_kay_mkpdu_sanity_check -
2900  *     sanity check specified in clause 11.11.2 of IEEE802.1X-2010
2901  */
2902 static int ieee802_1x_kay_mkpdu_sanity_check(struct ieee802_1x_kay *kay,
2903                                              const u8 *buf, size_t len)
2904 {
2905         struct ieee8023_hdr *eth_hdr;
2906         struct ieee802_1x_hdr *eapol_hdr;
2907         struct ieee802_1x_mka_hdr *mka_hdr;
2908         struct ieee802_1x_mka_basic_body *body;
2909         size_t mka_msg_len;
2910         struct ieee802_1x_mka_participant *participant;
2911         size_t body_len;
2912         u8 icv[MAX_ICV_LEN];
2913         u8 *msg_icv;
2914
2915         eth_hdr = (struct ieee8023_hdr *) buf;
2916         eapol_hdr = (struct ieee802_1x_hdr *) (eth_hdr + 1);
2917         mka_hdr = (struct ieee802_1x_mka_hdr *) (eapol_hdr + 1);
2918
2919         /* destination address should be not individual address */
2920         if (os_memcmp(eth_hdr->dest, pae_group_addr, ETH_ALEN) != 0) {
2921                 wpa_printf(MSG_MSGDUMP,
2922                            "KaY: ethernet destination address is not PAE group address");
2923                 return -1;
2924         }
2925
2926         /* MKPDU should not less than 32 octets */
2927         mka_msg_len = be_to_host16(eapol_hdr->length);
2928         if (mka_msg_len < 32) {
2929                 wpa_printf(MSG_MSGDUMP, "KaY: MKPDU is less than 32 octets");
2930                 return -1;
2931         }
2932         /* MKPDU should multiple 4 octets */
2933         if ((mka_msg_len % 4) != 0) {
2934                 wpa_printf(MSG_MSGDUMP,
2935                            "KaY: MKPDU is not multiple of 4 octets");
2936                 return -1;
2937         }
2938
2939         body = (struct ieee802_1x_mka_basic_body *) mka_hdr;
2940         ieee802_1x_mka_dump_basic_body(body);
2941         body_len = get_mka_param_body_len(body);
2942         /* EAPOL-MKA body should comprise basic parameter set and ICV */
2943         if (mka_msg_len < MKA_HDR_LEN + body_len + DEFAULT_ICV_LEN) {
2944                 wpa_printf(MSG_ERROR,
2945                            "KaY: Received EAPOL-MKA Packet Body Length (%zu bytes) is less than the Basic Parameter Set Header Length (%zu bytes) + the Basic Parameter Set Body Length (%zu bytes) + %d bytes of ICV",
2946                            mka_msg_len, MKA_HDR_LEN,
2947                            body_len, DEFAULT_ICV_LEN);
2948                 return -1;
2949         }
2950
2951         /* CKN should be owned by I */
2952         participant = ieee802_1x_kay_get_participant(kay, body->ckn);
2953         if (!participant) {
2954                 wpa_printf(MSG_DEBUG, "CKN is not included in my CA");
2955                 return -1;
2956         }
2957
2958         /* algorithm agility check */
2959         if (os_memcmp(body->algo_agility, mka_algo_agility,
2960                       sizeof(body->algo_agility)) != 0) {
2961                 wpa_printf(MSG_ERROR,
2962                            "KaY: peer's algorithm agility not supported for me");
2963                 return -1;
2964         }
2965
2966         /* ICV check */
2967         /*
2968          * The ICV will comprise the final octets of the packet body, whatever
2969          * its size, not the fixed length 16 octets, indicated by the EAPOL
2970          * packet body length.
2971          */
2972         if (mka_alg_tbl[kay->mka_algindex].icv_hash(
2973                     participant->ick.key,
2974                     buf, len - mka_alg_tbl[kay->mka_algindex].icv_len, icv)) {
2975                 wpa_printf(MSG_ERROR, "KaY: omac1_aes_128 failed");
2976                 return -1;
2977         }
2978         msg_icv = ieee802_1x_mka_decode_icv_body(participant, (u8 *) mka_hdr,
2979                                                  mka_msg_len);
2980
2981         if (msg_icv) {
2982                 if (os_memcmp_const(msg_icv, icv,
2983                                     mka_alg_tbl[kay->mka_algindex].icv_len) !=
2984                     0) {
2985                         wpa_printf(MSG_ERROR,
2986                                    "KaY: Computed ICV is not equal to Received ICV");
2987                 return -1;
2988                 }
2989         } else {
2990                 wpa_printf(MSG_ERROR, "KaY: No ICV");
2991                 return -1;
2992         }
2993
2994         return 0;
2995 }
2996
2997
2998 /**
2999  * ieee802_1x_kay_decode_mkpdu -
3000  */
3001 static int ieee802_1x_kay_decode_mkpdu(struct ieee802_1x_kay *kay,
3002                                        const u8 *buf, size_t len)
3003 {
3004         struct ieee802_1x_mka_participant *participant;
3005         struct ieee802_1x_mka_hdr *hdr;
3006         size_t body_len;
3007         size_t left_len;
3008         u8 body_type;
3009         int i;
3010         const u8 *pos;
3011         Boolean my_included;
3012         Boolean handled[256];
3013
3014         if (ieee802_1x_kay_mkpdu_sanity_check(kay, buf, len))
3015                 return -1;
3016
3017         /* handle basic parameter set */
3018         pos = buf + sizeof(struct ieee8023_hdr) + sizeof(struct ieee802_1x_hdr);
3019         left_len = len - sizeof(struct ieee8023_hdr) -
3020                 sizeof(struct ieee802_1x_hdr);
3021         participant = ieee802_1x_mka_decode_basic_body(kay, pos, left_len);
3022         if (!participant)
3023                 return -1;
3024
3025         /* to skip basic parameter set */
3026         hdr = (struct ieee802_1x_mka_hdr *) pos;
3027         body_len = get_mka_param_body_len(hdr);
3028         pos += body_len + MKA_HDR_LEN;
3029         left_len -= body_len + MKA_HDR_LEN;
3030
3031         /* check i am in the peer's peer list */
3032         my_included = ieee802_1x_mka_i_in_peerlist(participant, pos, left_len);
3033         if (my_included) {
3034                 /* accept the peer as live peer */
3035                 if (!ieee802_1x_kay_is_in_peer(
3036                             participant,
3037                             participant->current_peer_id.mi)) {
3038                         if (!ieee802_1x_kay_create_live_peer(
3039                                     participant,
3040                                     participant->current_peer_id.mi,
3041                                     be_to_host32(
3042                                             participant->current_peer_id.mn)))
3043                                 return -1;
3044                         ieee802_1x_kay_elect_key_server(participant);
3045                         ieee802_1x_kay_decide_macsec_use(participant);
3046                 }
3047                 if (ieee802_1x_kay_is_in_potential_peer(
3048                             participant, participant->current_peer_id.mi)) {
3049                         if (!ieee802_1x_kay_move_live_peer(
3050                                     participant,
3051                                     participant->current_peer_id.mi,
3052                                     be_to_host32(participant->
3053                                                  current_peer_id.mn)))
3054                                 return -1;
3055                         ieee802_1x_kay_elect_key_server(participant);
3056                         ieee802_1x_kay_decide_macsec_use(participant);
3057                 }
3058         }
3059
3060         /*
3061          * Handle other parameter set than basic parameter set.
3062          * Each parameter set should be present only once.
3063          */
3064         for (i = 0; i < 256; i++)
3065                 handled[i] = FALSE;
3066
3067         handled[0] = TRUE;
3068         while (left_len > MKA_HDR_LEN + DEFAULT_ICV_LEN) {
3069                 hdr = (struct ieee802_1x_mka_hdr *) pos;
3070                 body_len = get_mka_param_body_len(hdr);
3071                 body_type = get_mka_param_body_type(hdr);
3072
3073                 if (body_type == MKA_ICV_INDICATOR)
3074                         return 0;
3075
3076                 if (left_len < (MKA_HDR_LEN + body_len + DEFAULT_ICV_LEN)) {
3077                         wpa_printf(MSG_ERROR,
3078                                    "KaY: MKA Peer Packet Body Length (%zu bytes) is less than the Parameter Set Header Length (%zu bytes) + the Parameter Set Body Length (%zu bytes) + %d bytes of ICV",
3079                                    left_len, MKA_HDR_LEN,
3080                                    body_len, DEFAULT_ICV_LEN);
3081                         goto next_para_set;
3082                 }
3083
3084                 if (handled[body_type])
3085                         goto next_para_set;
3086
3087                 handled[body_type] = TRUE;
3088                 if (body_type < ARRAY_SIZE(mka_body_handler) &&
3089                     mka_body_handler[body_type].body_rx) {
3090                         mka_body_handler[body_type].body_rx
3091                                 (participant, pos, left_len);
3092                 } else {
3093                         wpa_printf(MSG_ERROR,
3094                                    "The type %d is not supported in this MKA version %d",
3095                                    body_type, MKA_VERSION_ID);
3096                 }
3097
3098 next_para_set:
3099                 pos += body_len + MKA_HDR_LEN;
3100                 left_len -= body_len + MKA_HDR_LEN;
3101         }
3102
3103         kay->active = TRUE;
3104         participant->retry_count = 0;
3105         participant->active = TRUE;
3106
3107         return 0;
3108 }
3109
3110
3111
3112 static void kay_l2_receive(void *ctx, const u8 *src_addr, const u8 *buf,
3113                            size_t len)
3114 {
3115         struct ieee802_1x_kay *kay = ctx;
3116         struct ieee8023_hdr *eth_hdr;
3117         struct ieee802_1x_hdr *eapol_hdr;
3118
3119         /* must contain at least ieee8023_hdr + ieee802_1x_hdr */
3120         if (len < sizeof(*eth_hdr) + sizeof(*eapol_hdr)) {
3121                 wpa_printf(MSG_MSGDUMP, "KaY: EAPOL frame too short (%lu)",
3122                            (unsigned long) len);
3123                 return;
3124         }
3125
3126         eth_hdr = (struct ieee8023_hdr *) buf;
3127         eapol_hdr = (struct ieee802_1x_hdr *) (eth_hdr + 1);
3128         if (len != sizeof(*eth_hdr) + sizeof(*eapol_hdr) +
3129             be_to_host16(eapol_hdr->length)) {
3130                 wpa_printf(MSG_MSGDUMP, "KAY: EAPOL MPDU is invalid: (%lu-%lu)",
3131                            (unsigned long) len,
3132                            (unsigned long) be_to_host16(eapol_hdr->length));
3133                 return;
3134         }
3135
3136         if (eapol_hdr->version < EAPOL_VERSION) {
3137                 wpa_printf(MSG_MSGDUMP, "KaY: version %d does not support MKA",
3138                            eapol_hdr->version);
3139                 return;
3140         }
3141         if (be_to_host16(eth_hdr->ethertype) != ETH_P_PAE ||
3142             eapol_hdr->type != IEEE802_1X_TYPE_EAPOL_MKA)
3143                 return;
3144
3145         wpa_hexdump(MSG_DEBUG, "RX EAPOL-MKA: ", buf, len);
3146         if (dl_list_empty(&kay->participant_list)) {
3147                 wpa_printf(MSG_ERROR, "KaY: no MKA participant instance");
3148                 return;
3149         }
3150
3151         ieee802_1x_kay_decode_mkpdu(kay, buf, len);
3152 }
3153
3154
3155 /**
3156  * ieee802_1x_kay_init -
3157  */
3158 struct ieee802_1x_kay *
3159 ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
3160                     const char *ifname, const u8 *addr)
3161 {
3162         struct ieee802_1x_kay *kay;
3163
3164         kay = os_zalloc(sizeof(*kay));
3165         if (!kay) {
3166                 wpa_printf(MSG_ERROR, "KaY-%s: out of memory", __func__);
3167                 return NULL;
3168         }
3169
3170         kay->ctx = ctx;
3171
3172         kay->enable = TRUE;
3173         kay->active = FALSE;
3174
3175         kay->authenticated = FALSE;
3176         kay->secured = FALSE;
3177         kay->failed = FALSE;
3178         kay->policy = policy;
3179
3180         os_strlcpy(kay->if_name, ifname, IFNAMSIZ);
3181         os_memcpy(kay->actor_sci.addr, addr, ETH_ALEN);
3182         kay->actor_sci.port = host_to_be16(0x0001);
3183         kay->actor_priority = DEFAULT_PRIO_NOT_KEY_SERVER;
3184
3185         /* While actor acts as a key server, shall distribute sakey */
3186         kay->dist_kn = 1;
3187         kay->dist_an = 0;
3188         kay->dist_time = 0;
3189
3190         kay->pn_exhaustion = PENDING_PN_EXHAUSTION;
3191         kay->macsec_csindex = DEFAULT_CS_INDEX;
3192         kay->mka_algindex = DEFAULT_MKA_ALG_INDEX;
3193         kay->mka_version = MKA_VERSION_ID;
3194
3195         os_memcpy(kay->algo_agility, mka_algo_agility,
3196                   sizeof(kay->algo_agility));
3197
3198         dl_list_init(&kay->participant_list);
3199
3200         if (policy == DO_NOT_SECURE) {
3201                 kay->macsec_capable = MACSEC_CAP_NOT_IMPLEMENTED;
3202                 kay->macsec_desired = FALSE;
3203                 kay->macsec_protect = FALSE;
3204                 kay->macsec_validate = Disabled;
3205                 kay->macsec_replay_protect = FALSE;
3206                 kay->macsec_replay_window = 0;
3207                 kay->macsec_confidentiality = CONFIDENTIALITY_NONE;
3208         } else {
3209                 kay->macsec_capable = MACSEC_CAP_INTEG_AND_CONF_0_30_50;
3210                 kay->macsec_desired = TRUE;
3211                 kay->macsec_protect = TRUE;
3212                 kay->macsec_validate = Strict;
3213                 kay->macsec_replay_protect = FALSE;
3214                 kay->macsec_replay_window = 0;
3215                 kay->macsec_confidentiality = CONFIDENTIALITY_OFFSET_0;
3216         }
3217
3218         wpa_printf(MSG_DEBUG, "KaY: state machine created");
3219
3220         /* Initialize the SecY must be prio to CP, as CP will control SecY */
3221         secy_init_macsec(kay);
3222         secy_get_available_transmit_sc(kay, &kay->sc_ch);
3223
3224         wpa_printf(MSG_DEBUG, "KaY: secy init macsec done");
3225
3226         /* init CP */
3227         kay->cp = ieee802_1x_kay_alloc_cp_sm(kay);
3228         if (kay->cp == NULL) {
3229                 ieee802_1x_kay_deinit(kay);
3230                 return NULL;
3231         }
3232
3233         if (policy == DO_NOT_SECURE) {
3234                 ieee802_1x_cp_connect_authenticated(kay->cp);
3235                 ieee802_1x_cp_sm_step(kay->cp);
3236         } else {
3237                 kay->l2_mka = l2_packet_init(kay->if_name, NULL, ETH_P_PAE,
3238                                              kay_l2_receive, kay, 1);
3239                 if (kay->l2_mka == NULL) {
3240                         wpa_printf(MSG_WARNING,
3241                                    "KaY: Failed to initialize L2 packet processing for MKA packet");
3242                         ieee802_1x_kay_deinit(kay);
3243                         return NULL;
3244                 }
3245         }
3246
3247         return kay;
3248 }
3249
3250
3251 /**
3252  * ieee802_1x_kay_deinit -
3253  */
3254 void
3255 ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay)
3256 {
3257         struct ieee802_1x_mka_participant *participant;
3258
3259         if (!kay)
3260                 return;
3261
3262         wpa_printf(MSG_DEBUG, "KaY: state machine removed");
3263
3264         while (!dl_list_empty(&kay->participant_list)) {
3265                 participant = dl_list_entry(kay->participant_list.next,
3266                                             struct ieee802_1x_mka_participant,
3267                                             list);
3268                 ieee802_1x_kay_delete_mka(kay, &participant->ckn);
3269         }
3270
3271         ieee802_1x_cp_sm_deinit(kay->cp);
3272         secy_deinit_macsec(kay);
3273
3274         if (kay->l2_mka) {
3275                 l2_packet_deinit(kay->l2_mka);
3276                 kay->l2_mka = NULL;
3277         }
3278
3279         os_free(kay->ctx);
3280         os_free(kay);
3281 }
3282
3283
3284 /**
3285  * ieee802_1x_kay_create_mka -
3286  */
3287 struct ieee802_1x_mka_participant *
3288 ieee802_1x_kay_create_mka(struct ieee802_1x_kay *kay, struct mka_key_name *ckn,
3289                           struct mka_key *cak, u32 life,
3290                           enum mka_created_mode mode, Boolean is_authenticator)
3291 {
3292         struct ieee802_1x_mka_participant *participant;
3293         unsigned int usecs;
3294
3295         if (!kay || !ckn || !cak) {
3296                 wpa_printf(MSG_ERROR, "KaY: ckn or cak is null");
3297                 return NULL;
3298         }
3299
3300         if (cak->len != mka_alg_tbl[kay->mka_algindex].cak_len) {
3301                 wpa_printf(MSG_ERROR, "KaY: CAK length not follow key schema");
3302                 return NULL;
3303         }
3304         if (ckn->len > MAX_CKN_LEN) {
3305                 wpa_printf(MSG_ERROR, "KaY: CKN is out of range(<=32 bytes)");
3306                 return NULL;
3307         }
3308         if (!kay->enable) {
3309                 wpa_printf(MSG_ERROR, "KaY: Now is at disable state");
3310                 return NULL;
3311         }
3312
3313         participant = os_zalloc(sizeof(*participant));
3314         if (!participant) {
3315                 wpa_printf(MSG_ERROR, "KaY-%s: out of memory", __func__);
3316                 return NULL;
3317         }
3318
3319         participant->ckn.len = ckn->len;
3320         os_memcpy(participant->ckn.name, ckn->name, ckn->len);
3321         participant->cak.len = cak->len;
3322         os_memcpy(participant->cak.key, cak->key, cak->len);
3323         if (life)
3324                 participant->cak_life = life + time(NULL);
3325
3326         switch (mode) {
3327         case EAP_EXCHANGE:
3328                 if (is_authenticator) {
3329                         participant->is_obliged_key_server = TRUE;
3330                         participant->can_be_key_server = TRUE;
3331                         participant->is_key_server = TRUE;
3332                         participant->principal = TRUE;
3333
3334                         os_memcpy(&kay->key_server_sci, &kay->actor_sci,
3335                                   sizeof(kay->key_server_sci));
3336                         kay->key_server_priority = kay->actor_priority;
3337                         participant->is_elected = TRUE;
3338                 } else {
3339                         participant->is_obliged_key_server = FALSE;
3340                         participant->can_be_key_server = FALSE;
3341                         participant->is_key_server = FALSE;
3342                         participant->is_elected = TRUE;
3343                 }
3344                 break;
3345
3346         default:
3347                 participant->is_obliged_key_server = FALSE;
3348                 participant->can_be_key_server = TRUE;
3349                 participant->is_key_server = TRUE;
3350                 participant->is_elected = FALSE;
3351                 break;
3352         }
3353
3354         participant->cached = FALSE;
3355
3356         participant->active = FALSE;
3357         participant->participant = FALSE;
3358         participant->retain = FALSE;
3359         participant->activate = DEFAULT;
3360
3361         if (participant->is_key_server)
3362                 participant->principal = TRUE;
3363
3364         dl_list_init(&participant->live_peers);
3365         dl_list_init(&participant->potential_peers);
3366
3367         participant->retry_count = 0;
3368         participant->kay = kay;
3369
3370         if (!reset_participant_mi(participant))
3371                 goto fail;
3372
3373         participant->lrx = FALSE;
3374         participant->ltx = FALSE;
3375         participant->orx = FALSE;
3376         participant->otx = FALSE;
3377         participant->to_dist_sak = FALSE;
3378         participant->to_use_sak = FALSE;
3379         participant->new_sak = FALSE;
3380         dl_list_init(&participant->sak_list);
3381         participant->new_key = NULL;
3382         dl_list_init(&participant->rxsc_list);
3383         participant->txsc = ieee802_1x_kay_init_transmit_sc(&kay->actor_sci,
3384                                                             kay->sc_ch);
3385         secy_cp_control_protect_frames(kay, kay->macsec_protect);
3386         secy_cp_control_replay(kay, kay->macsec_replay_protect,
3387                                kay->macsec_replay_window);
3388         secy_create_transmit_sc(kay, participant->txsc);
3389
3390         /* to derive KEK from CAK and CKN */
3391         participant->kek.len = mka_alg_tbl[kay->mka_algindex].kek_len;
3392         if (mka_alg_tbl[kay->mka_algindex].kek_trfm(participant->cak.key,
3393                                                     participant->ckn.name,
3394                                                     participant->ckn.len,
3395                                                     participant->kek.key)) {
3396                 wpa_printf(MSG_ERROR, "KaY: Derived KEK failed");
3397                 goto fail;
3398         }
3399         wpa_hexdump_key(MSG_DEBUG, "KaY: Derived KEK",
3400                         participant->kek.key, participant->kek.len);
3401
3402         /* to derive ICK from CAK and CKN */
3403         participant->ick.len = mka_alg_tbl[kay->mka_algindex].ick_len;
3404         if (mka_alg_tbl[kay->mka_algindex].ick_trfm(participant->cak.key,
3405                                                     participant->ckn.name,
3406                                                     participant->ckn.len,
3407                                                     participant->ick.key)) {
3408                 wpa_printf(MSG_ERROR, "KaY: Derived ICK failed");
3409                 goto fail;
3410         }
3411         wpa_hexdump_key(MSG_DEBUG, "KaY: Derived ICK",
3412                         participant->ick.key, participant->ick.len);
3413
3414         dl_list_add(&kay->participant_list, &participant->list);
3415         wpa_hexdump(MSG_DEBUG, "KaY: Participant created:",
3416                     ckn->name, ckn->len);
3417
3418         usecs = os_random() % (MKA_HELLO_TIME * 1000);
3419         eloop_register_timeout(0, usecs, ieee802_1x_participant_timer,
3420                                participant, NULL);
3421         participant->mka_life = MKA_LIFE_TIME / 1000 + time(NULL) +
3422                 usecs / 1000000;
3423
3424         return participant;
3425
3426 fail:
3427         os_free(participant);
3428         return NULL;
3429 }
3430
3431
3432 /**
3433  * ieee802_1x_kay_delete_mka -
3434  */
3435 void
3436 ieee802_1x_kay_delete_mka(struct ieee802_1x_kay *kay, struct mka_key_name *ckn)
3437 {
3438         struct ieee802_1x_mka_participant *participant;
3439         struct ieee802_1x_kay_peer *peer;
3440         struct data_key *sak;
3441         struct receive_sc *rxsc;
3442
3443         if (!kay || !ckn)
3444                 return;
3445
3446         wpa_printf(MSG_DEBUG, "KaY: participant removed");
3447
3448         /* get the participant */
3449         participant = ieee802_1x_kay_get_participant(kay, ckn->name);
3450         if (!participant) {
3451                 wpa_hexdump(MSG_DEBUG, "KaY: participant is not found",
3452                             ckn->name, ckn->len);
3453                 return;
3454         }
3455
3456         eloop_cancel_timeout(ieee802_1x_participant_timer, participant, NULL);
3457         dl_list_del(&participant->list);
3458
3459         /* remove live peer */
3460         while (!dl_list_empty(&participant->live_peers)) {
3461                 peer = dl_list_entry(participant->live_peers.next,
3462                                      struct ieee802_1x_kay_peer, list);
3463                 dl_list_del(&peer->list);
3464                 os_free(peer);
3465         }
3466
3467         /* remove potential peer */
3468         while (!dl_list_empty(&participant->potential_peers)) {
3469                 peer = dl_list_entry(participant->potential_peers.next,
3470                                      struct ieee802_1x_kay_peer, list);
3471                 dl_list_del(&peer->list);
3472                 os_free(peer);
3473         }
3474
3475         /* remove sak */
3476         while (!dl_list_empty(&participant->sak_list)) {
3477                 sak = dl_list_entry(participant->sak_list.next,
3478                                     struct data_key, list);
3479                 dl_list_del(&sak->list);
3480                 os_free(sak->key);
3481                 os_free(sak);
3482         }
3483         while (!dl_list_empty(&participant->rxsc_list)) {
3484                 rxsc = dl_list_entry(participant->rxsc_list.next,
3485                                      struct receive_sc, list);
3486                 secy_delete_receive_sc(kay, rxsc);
3487                 ieee802_1x_kay_deinit_receive_sc(participant, rxsc);
3488         }
3489         secy_delete_transmit_sc(kay, participant->txsc);
3490         ieee802_1x_kay_deinit_transmit_sc(participant, participant->txsc);
3491
3492         os_memset(&participant->cak, 0, sizeof(participant->cak));
3493         os_memset(&participant->kek, 0, sizeof(participant->kek));
3494         os_memset(&participant->ick, 0, sizeof(participant->ick));
3495         os_free(participant);
3496 }
3497
3498
3499 /**
3500  * ieee802_1x_kay_mka_participate -
3501  */
3502 void ieee802_1x_kay_mka_participate(struct ieee802_1x_kay *kay,
3503                                     struct mka_key_name *ckn,
3504                                     Boolean status)
3505 {
3506         struct ieee802_1x_mka_participant *participant;
3507
3508         if (!kay || !ckn)
3509                 return;
3510
3511         participant = ieee802_1x_kay_get_participant(kay, ckn->name);
3512         if (!participant)
3513                 return;
3514
3515         participant->active = status;
3516 }
3517
3518
3519 /**
3520  * ieee802_1x_kay_new_sak -
3521  */
3522 int
3523 ieee802_1x_kay_new_sak(struct ieee802_1x_kay *kay)
3524 {
3525         struct ieee802_1x_mka_participant *participant;
3526
3527         if (!kay)
3528                 return -1;
3529
3530         participant = ieee802_1x_kay_get_principal_participant(kay);
3531         if (!participant)
3532                 return -1;
3533
3534         participant->new_sak = TRUE;
3535         wpa_printf(MSG_DEBUG, "KaY: new SAK signal");
3536
3537         return 0;
3538 }
3539
3540
3541 /**
3542  * ieee802_1x_kay_change_cipher_suite -
3543  */
3544 int
3545 ieee802_1x_kay_change_cipher_suite(struct ieee802_1x_kay *kay, int cs_index)
3546 {
3547         struct ieee802_1x_mka_participant *participant;
3548
3549         if (!kay)
3550                 return -1;
3551
3552         if ((unsigned int) cs_index >= CS_TABLE_SIZE) {
3553                 wpa_printf(MSG_ERROR,
3554                            "KaY: Configured cipher suite index is out of range");
3555                 return -1;
3556         }
3557         if (kay->macsec_csindex == cs_index)
3558                 return -2;
3559
3560         if (cs_index == 0)
3561                 kay->macsec_desired = FALSE;
3562
3563         kay->macsec_csindex = cs_index;
3564         kay->macsec_capable = cipher_suite_tbl[kay->macsec_csindex].capable;
3565
3566         participant = ieee802_1x_kay_get_principal_participant(kay);
3567         if (participant) {
3568                 wpa_printf(MSG_INFO, "KaY: Cipher Suite changed");
3569                 participant->new_sak = TRUE;
3570         }
3571
3572         return 0;
3573 }