PAE: Use sci->port more consistently

[mech_eap.git] / src / pae / ieee802_1x_kay.c

diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c
index 7069c20..07720a0 100644 (file)
--- a/src/pae/ieee802_1x_kay.c
+++ b/src/pae/ieee802_1x_kay.c
@@ -148,7 +148,7 @@ ieee802_1x_mka_dump_peer_body(struct ieee802_1x_mka_peer_body *body)
        size_t body_len;
        size_t i;
        u8 *mi;
-       u32 mn;
+       be32 mn;
 
        if (body == NULL)
                return;
@@ -682,7 +682,7 @@ ieee802_1x_mka_encode_basic_body(
 
        os_memcpy(body->actor_sci.addr, kay->actor_sci.addr,
                  sizeof(kay->actor_sci.addr));
-       body->actor_sci.port = host_to_be16(kay->actor_sci.port);
+       body->actor_sci.port = kay->actor_sci.port;
 
        os_memcpy(body->actor_mi, participant->mi, sizeof(body->actor_mi));
        participant->mn = participant->mn + 1;
@@ -738,7 +738,7 @@ ieee802_1x_mka_decode_basic_body(struct ieee802_1x_kay *kay, const u8 *mka_msg,
        participant->current_peer_id.mn =  be_to_host32(body->actor_mn);
        os_memcpy(participant->current_peer_sci.addr, body->actor_sci.addr,
                  sizeof(participant->current_peer_sci.addr));
-       participant->current_peer_sci.port = be_to_host16(body->actor_sci.port);
+       participant->current_peer_sci.port = body->actor_sci.port;
 
        /* handler peer */
        peer = ieee802_1x_kay_get_peer(participant, body->actor_mi);
@@ -918,6 +918,7 @@ ieee802_1x_mka_i_in_peerlist(struct ieee802_1x_mka_participant *participant,
        size_t left_len;
        int body_type;
        u32 peer_mn;
+       be32 _peer_mn;
        const u8 *peer_mi;
        const u8 *pos;
        size_t i;
@@ -953,8 +954,9 @@ ieee802_1x_mka_i_in_peerlist(struct ieee802_1x_mka_participant *participant,
 
                for (i = 0; i < body_len; i += MI_LEN + sizeof(peer_mn)) {
                        peer_mi = MKA_HDR_LEN + pos + i;
-                       os_memcpy(&peer_mn, peer_mi + MI_LEN, sizeof(peer_mn));
-                       peer_mn = be_to_host32(peer_mn);
+                       os_memcpy(&_peer_mn, peer_mi + MI_LEN,
+                                 sizeof(_peer_mn));
+                       peer_mn = be_to_host32(_peer_mn);
                        if (os_memcmp(peer_mi, participant->mi, MI_LEN) == 0 &&
                            peer_mn == participant->mn) {
                                included = TRUE;
@@ -985,6 +987,7 @@ static int ieee802_1x_mka_decode_live_peer_body(
        struct ieee802_1x_kay_peer *peer;
        size_t body_len;
        u32 peer_mn;
+       be32 _peer_mn;
        const u8 *peer_mi;
        size_t i;
        Boolean is_included;
@@ -997,8 +1000,8 @@ static int ieee802_1x_mka_decode_live_peer_body(
 
        for (i = 0; i < body_len; i += MI_LEN + sizeof(peer_mn)) {
                peer_mi = MKA_HDR_LEN + peer_msg + i;
-               os_memcpy(&peer_mn, peer_mi + MI_LEN, sizeof(peer_mn));
-               peer_mn = be_to_host32(peer_mn);
+               os_memcpy(&_peer_mn, peer_mi + MI_LEN, sizeof(_peer_mn));
+               peer_mn = be_to_host32(_peer_mn);
 
                /* it is myself */
                if (os_memcmp(peer_mi, participant->mi, MI_LEN) == 0) {
@@ -1042,6 +1045,7 @@ ieee802_1x_mka_decode_potential_peer_body(
        struct ieee802_1x_mka_hdr *hdr;
        size_t body_len;
        u32 peer_mn;
+       be32 _peer_mn;
        const u8 *peer_mi;
        size_t i;
 
@@ -1050,8 +1054,8 @@ ieee802_1x_mka_decode_potential_peer_body(
 
        for (i = 0; i < body_len; i += MI_LEN + sizeof(peer_mn)) {
                peer_mi = MKA_HDR_LEN + peer_msg + i;
-               os_memcpy(&peer_mn, peer_mi + MI_LEN, sizeof(peer_mn));
-               peer_mn = be_to_host32(peer_mn);
+               os_memcpy(&_peer_mn, peer_mi + MI_LEN, sizeof(_peer_mn));
+               peer_mn = be_to_host32(_peer_mn);
 
                /* it is myself */
                if (os_memcmp(peer_mi, participant->mi, MI_LEN) == 0) {
@@ -1290,7 +1294,7 @@ ieee802_1x_mka_decode_sak_use_body(
        if (body->ltx || body->lrx) {
                founded = FALSE;
                os_memcpy(ki.mi, body->lsrv_mi, sizeof(ki.mi));
-               ki.kn = ntohl(body->lkn);
+               ki.kn = be_to_host32(body->lkn);
                dl_list_for_each(sa_key, &participant->sak_list,
                                 struct data_key, list) {
                        if (is_ki_equal(&sa_key->key_identifier, &ki)) {
@@ -1304,7 +1308,7 @@ ieee802_1x_mka_decode_sak_use_body(
                }
                if (os_memcmp(participant->lki.mi, body->lsrv_mi,
                              sizeof(participant->lki.mi)) == 0 &&
-                   ntohl(body->lkn) == participant->lki.kn &&
+                   be_to_host32(body->lkn) == participant->lki.kn &&
                    body->lan == participant->lan) {
                        peer->sak_used = TRUE;
                }
@@ -1319,7 +1323,7 @@ ieee802_1x_mka_decode_sak_use_body(
        if (body->otx || body->orx) {
                if (os_memcmp(participant->oki.mi, body->osrv_mi,
                              sizeof(participant->oki.mi)) != 0 ||
-                   ntohl(body->okn) != participant->oki.kn ||
+                   be_to_host32(body->okn) != participant->oki.kn ||
                    body->oan != participant->oan) {
                        wpa_printf(MSG_WARNING, "KaY: Old key is invalid");
                        return -1;
@@ -1327,7 +1331,8 @@ ieee802_1x_mka_decode_sak_use_body(
        }
 
        /* TODO: how to set the MACsec hardware when delay_protect is true */
-       if (body->delay_protect && (!ntohl(body->llpn) || !ntohl(body->olpn))) {
+       if (body->delay_protect &&
+           (!be_to_host32(body->llpn) || !be_to_host32(body->olpn))) {
                wpa_printf(MSG_WARNING,
                           "KaY: Lowest packet number should greater than 0 when delay_protect is TRUE");
                return -1;
@@ -1349,7 +1354,7 @@ ieee802_1x_mka_decode_sak_use_body(
        }
 
        /* if i'm key server, and detects peer member pn exhaustion, rekey.*/
-       lpn = ntohl(body->llpn);
+       lpn = be_to_host32(body->llpn);
        if (lpn > participant->kay->pn_exhaustion) {
                if (participant->is_key_server) {
                        participant->new_sak = TRUE;
@@ -1923,7 +1928,7 @@ static struct mka_param_body_handler mak_body_handler[] = {
 /**
  * ieee802_1x_kay_deinit_data_key -
  */
-void ieee802_1x_kay_deinit_data_key(struct data_key *pkey)
+static void ieee802_1x_kay_deinit_data_key(struct data_key *pkey)
 {
        if (!pkey)
                return;
@@ -3094,10 +3099,10 @@ static void kay_l2_receive(void *ctx, const u8 *src_addr, const u8 *buf,
        eth_hdr = (struct ieee8023_hdr *) buf;
        eapol_hdr = (struct ieee802_1x_hdr *) (eth_hdr + 1);
        if (len != sizeof(*eth_hdr) + sizeof(*eapol_hdr) +
-           ntohs(eapol_hdr->length)) {
+           be_to_host16(eapol_hdr->length)) {
                wpa_printf(MSG_MSGDUMP, "KAY: EAPOL MPDU is invalid: (%lu-%lu)",
                           (unsigned long) len,
-                          (unsigned long) ntohs(eapol_hdr->length));
+                          (unsigned long) be_to_host16(eapol_hdr->length));
                return;
        }
 
@@ -3106,7 +3111,7 @@ static void kay_l2_receive(void *ctx, const u8 *src_addr, const u8 *buf,
                           eapol_hdr->version);
                return;
        }
-       if (ntohs(eth_hdr->ethertype) != ETH_P_PAE ||
+       if (be_to_host16(eth_hdr->ethertype) != ETH_P_PAE ||
            eapol_hdr->type != IEEE802_1X_TYPE_EAPOL_MKA)
                return;
 
@@ -3147,7 +3152,7 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
 
        os_strlcpy(kay->if_name, ifname, IFNAMSIZ);
        os_memcpy(kay->actor_sci.addr, addr, ETH_ALEN);
-       kay->actor_sci.port = 0x0001;
+       kay->actor_sci.port = host_to_be16(0x0001);
        kay->actor_priority = DEFAULT_PRIO_NOT_KEY_SERVER;
 
        /* While actor acts as a key server, shall distribute sakey */
@@ -3169,7 +3174,7 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
                kay->macsec_capable = MACSEC_CAP_NOT_IMPLEMENTED;
                kay->macsec_desired = FALSE;
                kay->macsec_protect = FALSE;
-               kay->macsec_validate = FALSE;
+               kay->macsec_validate = Disabled;
                kay->macsec_replay_protect = FALSE;
                kay->macsec_replay_window = 0;
                kay->macsec_confidentiality = CONFIDENTIALITY_NONE;
@@ -3177,7 +3182,7 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
                kay->macsec_capable = MACSEC_CAP_INTEG_AND_CONF_0_30_50;
                kay->macsec_desired = TRUE;
                kay->macsec_protect = TRUE;
-               kay->macsec_validate = TRUE;
+               kay->macsec_validate = Strict;
                kay->macsec_replay_protect = FALSE;
                kay->macsec_replay_window = 0;
                kay->macsec_confidentiality = CONFIDENTIALITY_OFFSET_0;
@@ -3351,6 +3356,9 @@ ieee802_1x_kay_create_mka(struct ieee802_1x_kay *kay, struct mka_key_name *ckn,
        dl_list_init(&participant->rxsc_list);
        participant->txsc = ieee802_1x_kay_init_transmit_sc(&kay->actor_sci,
                                                            kay->sc_ch);
+       secy_cp_control_protect_frames(kay, kay->macsec_protect);
+       secy_cp_control_replay(kay, kay->macsec_replay_protect,
+                              kay->macsec_replay_window);
        secy_create_transmit_sc(kay, participant->txsc);
 
        /* to derive KEK from CAK and CKN */