Skip to content

Commit 7e3b99c

Browse files
author
Arto Kinnunen
committed
Merge branch 'release_internal' into release_external
* release_internal: Key update to MAC is forced when nw name changes Corrected identifier range alloc and added define for timeout FHSS WS: spread broadcast messages better on BC channel (ARMmbed#2449)
2 parents 9a1b353 + 50b7a64 commit 7e3b99c

File tree

7 files changed

+50
-30
lines changed

7 files changed

+50
-30
lines changed

‎source/6LoWPAN/ws/ws_pae_auth.c‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ typedef struct {
108108
bool gtk_new_act_time_exp: 1; /**< GTK new activation time expired */
109109
} pae_auth_t;
110110

111-
static int8_t ws_pae_auth_network_keys_from_gtks_set(pae_auth_t *pae_auth);
111+
static int8_t ws_pae_auth_network_keys_from_gtks_set(pae_auth_t *pae_auth, bool force_install);
112112
static int8_t ws_pae_auth_active_gtk_set(pae_auth_t *pae_auth, uint8_t index);
113113
static int8_t ws_pae_auth_network_key_index_set(pae_auth_t *pae_auth, uint8_t index);
114114
static void ws_pae_auth_free(pae_auth_t *pae_auth);
@@ -345,7 +345,7 @@ void ws_pae_auth_start(protocol_interface_info_entry_t *interface_ptr)
345345
pae_auth->nw_info_updated(pae_auth->interface_ptr);
346346

347347
// Inserts keys and updates GTK hash on stack
348-
ws_pae_auth_network_keys_from_gtks_set(pae_auth);
348+
ws_pae_auth_network_keys_from_gtks_set(pae_auth, false);
349349

350350
// Sets active key index
351351
ws_pae_auth_network_key_index_set(pae_auth, index);
@@ -362,7 +362,7 @@ void ws_pae_auth_gtks_updated(protocol_interface_info_entry_t *interface_ptr)
362362
return;
363363
}
364364

365-
ws_pae_auth_network_keys_from_gtks_set(pae_auth);
365+
ws_pae_auth_network_keys_from_gtks_set(pae_auth, false);
366366
}
367367

368368
int8_t ws_pae_auth_nw_key_index_update(protocol_interface_info_entry_t *interface_ptr, uint8_t index)
@@ -470,7 +470,7 @@ int8_t ws_pae_auth_node_access_revoke_start(protocol_interface_info_entry_t *int
470470

471471
// Adds new GTK
472472
ws_pae_auth_gtk_key_insert(pae_auth);
473-
ws_pae_auth_network_keys_from_gtks_set(pae_auth);
473+
ws_pae_auth_network_keys_from_gtks_set(pae_auth, false);
474474

475475
// Update keys to NVM as needed
476476
pae_auth->nw_info_updated(pae_auth->interface_ptr);
@@ -535,8 +535,11 @@ int8_t ws_pae_auth_nw_info_set(protocol_interface_info_entry_t *interface_ptr, u
535535
}
536536
pae_auth->pan_id = pan_id;
537537

538+
bool force_install = false;
538539
if (strlen((char *) &pae_auth->network_name) > 0 && strcmp((char *) &pae_auth->network_name, network_name) != 0) {
539540
update_keys = true;
541+
// Force GTK install to update the new network name to GAK
542+
force_install = true;
540543
}
541544
strcpy((char *) &pae_auth->network_name, network_name);
542545

@@ -548,7 +551,7 @@ int8_t ws_pae_auth_nw_info_set(protocol_interface_info_entry_t *interface_ptr, u
548551
pae_auth->nw_keys_remove(pae_auth->interface_ptr);
549552
}
550553

551-
ws_pae_auth_network_keys_from_gtks_set(pae_auth);
554+
ws_pae_auth_network_keys_from_gtks_set(pae_auth, force_install);
552555

553556
int8_t index = sec_prot_keys_gtk_status_active_get(pae_auth->sec_keys_nw_info->gtks);
554557
if (index >= 0) {
@@ -559,7 +562,7 @@ int8_t ws_pae_auth_nw_info_set(protocol_interface_info_entry_t *interface_ptr, u
559562
return 0;
560563
}
561564

562-
static int8_t ws_pae_auth_network_keys_from_gtks_set(pae_auth_t *pae_auth)
565+
static int8_t ws_pae_auth_network_keys_from_gtks_set(pae_auth_t *pae_auth, bool force_install)
563566
{
564567
// Authenticator keys are always fresh
565568
sec_prot_keys_gtk_status_all_fresh_set(pae_auth->sec_keys_nw_info->gtks);
@@ -571,7 +574,7 @@ static int8_t ws_pae_auth_network_keys_from_gtks_set(pae_auth_t *pae_auth)
571574
}
572575

573576
if (pae_auth->nw_key_insert) {
574-
pae_auth->nw_key_insert(pae_auth->interface_ptr, pae_auth->sec_keys_nw_info->gtks);
577+
pae_auth->nw_key_insert(pae_auth->interface_ptr, pae_auth->sec_keys_nw_info->gtks, force_install);
575578
}
576579

577580
return 0;
@@ -716,7 +719,7 @@ void ws_pae_auth_slow_timer(uint16_t seconds)
716719
if (second_index < 0) {
717720
tr_info("GTK new install required active index: %i, time: %"PRIu32", system time: %"PRIu32"", active_index, timer_seconds, protocol_core_monotonic_time / 10);
718721
ws_pae_auth_gtk_key_insert(pae_auth);
719-
ws_pae_auth_network_keys_from_gtks_set(pae_auth);
722+
ws_pae_auth_network_keys_from_gtks_set(pae_auth, false);
720723
// Update keys to NVM as needed
721724
pae_auth->nw_info_updated(pae_auth->interface_ptr);
722725
} else {
@@ -744,7 +747,7 @@ void ws_pae_auth_slow_timer(uint16_t seconds)
744747
if (timer_seconds == 0) {
745748
tr_info("GTK expired index: %i, system time: %"PRIu32"", i, protocol_core_monotonic_time / 10);
746749
ws_pae_auth_gtk_clear(pae_auth, i);
747-
ws_pae_auth_network_keys_from_gtks_set(pae_auth);
750+
ws_pae_auth_network_keys_from_gtks_set(pae_auth, false);
748751
// Update keys to NVM as needed
749752
pae_auth->nw_info_updated(pae_auth->interface_ptr);
750753
}

‎source/6LoWPAN/ws/ws_pae_auth.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -207,12 +207,13 @@ typedef void ws_pae_auth_gtk_hash_set(protocol_interface_info_entry_t *interface
207207
*
208208
* \param interface_ptr interface
209209
* \param gtks group keys
210+
* \param force_install TRUE force install keys, FALSE install keys only if GTKs has changed
210211
*
211212
* \return < 0 failure
212213
* \return >= 0 success
213214
*
214215
*/
215-
typedef int8_t ws_pae_auth_nw_key_insert(protocol_interface_info_entry_t *interface_ptr, sec_prot_gtk_keys_t *gtks);
216+
typedef int8_t ws_pae_auth_nw_key_insert(protocol_interface_info_entry_t *interface_ptr, sec_prot_gtk_keys_t *gtks, bool force_install);
216217

217218
/**
218219
* ws_pae_auth_nw_keys_remove remove network keys callback

‎source/6LoWPAN/ws/ws_pae_controller.c‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ static void ws_pae_controller_nvm_frame_counter_write(nvm_tlv_t *tlv_entry);
126126
static int8_t ws_pae_controller_nvm_frame_counter_read(uint32_t *restart_cnt, uint64_t *stored_time, uint16_t *pan_version, frame_counters_t *counters);
127127
static pae_controller_t *ws_pae_controller_get_or_create(int8_t interface_id);
128128
static void ws_pae_controller_gtk_hash_set(protocol_interface_info_entry_t *interface_ptr, uint8_t *gtkhash);
129-
static int8_t ws_pae_controller_nw_key_check_and_insert(protocol_interface_info_entry_t *interface_ptr, sec_prot_gtk_keys_t *gtks);
129+
static int8_t ws_pae_controller_nw_key_check_and_insert(protocol_interface_info_entry_t *interface_ptr, sec_prot_gtk_keys_t *gtks, bool force_install);
130130
static void ws_pae_controller_active_nw_key_clear(nw_key_t *nw_key);
131131
static void ws_pae_controller_active_nw_key_set(protocol_interface_info_entry_t *cur, uint8_t index);
132132
static int8_t ws_pae_controller_gak_from_gtk(uint8_t *gak, uint8_t *gtk, char *network_name);
@@ -137,6 +137,7 @@ static void ws_pae_controller_nw_key_index_check_and_set(protocol_interface_info
137137
static void ws_pae_controller_data_init(pae_controller_t *controller);
138138
static int8_t ws_pae_controller_frame_counter_read(pae_controller_t *controller);
139139
static void ws_pae_controller_frame_counter_reset(frame_counters_t *frame_counters);
140+
static void ws_pae_controller_frame_counter_index_reset(frame_counters_t *frame_counters, uint8_t index);
140141
static int8_t ws_pae_controller_nw_info_read(pae_controller_t *controller, sec_prot_gtk_keys_t *gtks);
141142
static int8_t ws_pae_controller_nvm_nw_info_write(protocol_interface_info_entry_t *interface_ptr, uint16_t pan_id, char *network_name, sec_prot_gtk_keys_t *gtks);
142143
static int8_t ws_pae_controller_nvm_nw_info_read(protocol_interface_info_entry_t *interface_ptr, uint16_t *pan_id, char *network_name, sec_prot_gtk_keys_t *gtks);
@@ -165,7 +166,7 @@ int8_t ws_pae_controller_authenticate(protocol_interface_info_entry_t *interface
165166
// In case test keys are set uses those and does not initiate authentication
166167
if (controller->gtks_set) {
167168
if (sec_prot_keys_gtks_are_updated(&controller->gtks)) {
168-
ws_pae_controller_nw_key_check_and_insert(controller->interface_ptr, &controller->gtks);
169+
ws_pae_controller_nw_key_check_and_insert(controller->interface_ptr, &controller->gtks, false);
169170
sec_prot_keys_gtks_updated_reset(&controller->gtks);
170171
ws_pae_supp_gtks_set(controller->interface_ptr, &controller->gtks);
171172
}
@@ -403,7 +404,7 @@ int8_t ws_pae_controller_nw_key_valid(protocol_interface_info_entry_t *interface
403404
return ws_pae_supp_nw_key_valid(interface_ptr, br_iid);
404405
}
405406

406-
static int8_t ws_pae_controller_nw_key_check_and_insert(protocol_interface_info_entry_t *interface_ptr, sec_prot_gtk_keys_t *gtks)
407+
static int8_t ws_pae_controller_nw_key_check_and_insert(protocol_interface_info_entry_t *interface_ptr, sec_prot_gtk_keys_t *gtks, bool force_install)
407408
{
408409
pae_controller_t *controller = ws_pae_controller_get(interface_ptr);
409410
if (!controller) {
@@ -429,6 +430,13 @@ static int8_t ws_pae_controller_nw_key_check_and_insert(protocol_interface_info_
429430
tr_info("NW key remove: %i", i);
430431
}
431432

433+
if (force_install) {
434+
// Install always
435+
nw_key[i].installed = false;
436+
// Frame counters are fresh
437+
ws_pae_controller_frame_counter_index_reset(&controller->frame_counters, i);
438+
}
439+
432440
// If GTK key is not set, continues to next GTK
433441
if (!gtk) {
434442
continue;
@@ -798,13 +806,18 @@ static int8_t ws_pae_controller_frame_counter_read(pae_controller_t *controller)
798806
static void ws_pae_controller_frame_counter_reset(frame_counters_t *frame_counters)
799807
{
800808
for (uint8_t index = 0; index < GTK_NUM; index++) {
801-
memset(frame_counters->counter[index].gtk, 0, GTK_LEN);
802-
frame_counters->counter[index].frame_counter = 0;
803-
frame_counters->counter[index].stored_frame_counter = 0;
804-
frame_counters->counter[index].set = false;
809+
ws_pae_controller_frame_counter_index_reset(frame_counters, index);
805810
}
806811
}
807812

813+
static void ws_pae_controller_frame_counter_index_reset(frame_counters_t *frame_counters, uint8_t index)
814+
{
815+
memset(frame_counters->counter[index].gtk, 0, GTK_LEN);
816+
frame_counters->counter[index].frame_counter = 0;
817+
frame_counters->counter[index].stored_frame_counter = 0;
818+
frame_counters->counter[index].set = false;
819+
}
820+
808821
static int8_t ws_pae_controller_nw_info_read(pae_controller_t *controller, sec_prot_gtk_keys_t *gtks)
809822
{
810823
if (ws_pae_controller_nvm_nw_info_read(controller->interface_ptr, &controller->sec_keys_nw_info.key_pan_id, controller->sec_keys_nw_info.network_name, gtks) < 0) {

‎source/6LoWPAN/ws/ws_pae_supp.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -355,7 +355,7 @@ int8_t ws_pae_supp_gtk_hash_update(protocol_interface_info_entry_t *interface_pt
355355
}
356356

357357
// Modify keys
358-
pae_supp->nw_key_insert(pae_supp->interface_ptr, pae_supp->sec_keys_nw_info->gtks);
358+
pae_supp->nw_key_insert(pae_supp->interface_ptr, pae_supp->sec_keys_nw_info->gtks, false);
359359

360360
return 0;
361361
}
@@ -521,7 +521,7 @@ static int8_t ws_pae_supp_nw_keys_valid_check(pae_supp_t *pae_supp, uint16_t pan
521521
(sec_prot_keys_pmk_get(&pae_supp->entry.sec_keys) != NULL) &&
522522
(sec_prot_keys_ptk_get(&pae_supp->entry.sec_keys) != NULL)) {
523523
tr_debug("Existing keys used, counter %i", pae_supp->nw_keys_used_cnt);
524-
if (pae_supp->nw_key_insert(pae_supp->interface_ptr, pae_supp->sec_keys_nw_info->gtks) >= 0) {
524+
if (pae_supp->nw_key_insert(pae_supp->interface_ptr, pae_supp->sec_keys_nw_info->gtks, false) >= 0) {
525525
tr_debug("Keys inserted");
526526
}
527527
pae_supp->nw_keys_used_cnt++;
@@ -1260,7 +1260,7 @@ static void ws_pae_supp_kmp_api_finished_indication(kmp_api_t *kmp, kmp_result_e
12601260
if ((type == IEEE_802_11_4WH || type == IEEE_802_11_GKH) && result == KMP_RESULT_OK) {
12611261
if (sec_keys) {
12621262
sec_prot_keys_t *keys = sec_keys;
1263-
pae_supp->nw_key_insert(pae_supp->interface_ptr, keys->gtks);
1263+
pae_supp->nw_key_insert(pae_supp->interface_ptr, keys->gtks, false);
12641264
}
12651265

12661266
ws_pae_supp_authenticate_response(pae_supp, AUTH_RESULT_OK);

‎source/6LoWPAN/ws/ws_pae_supp.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -221,12 +221,13 @@ typedef const uint8_t *ws_pae_supp_auth_next_target(protocol_interface_info_entr
221221
*
222222
* \param interface_ptr interface
223223
* \param gtks group keys
224+
* \param force_install TRUE force install keys, FALSE install keys only if GTKs has changed
224225
*
225226
* \return < 0 failure
226227
* \return >= 0 success
227228
*
228229
*/
229-
typedef int8_t ws_pae_supp_nw_key_insert(protocol_interface_info_entry_t *interface_ptr, sec_prot_gtk_keys_t *gtks);
230+
typedef int8_t ws_pae_supp_nw_key_insert(protocol_interface_info_entry_t *interface_ptr, sec_prot_gtk_keys_t *gtks, bool force_install);
230231

231232
/**
232233
* ws_pae_supp_gtk_hash_ptr_get get pointer to GTK hash storage callback

‎source/Security/protocols/radius_sec_prot/radius_client_sec_prot.c‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,8 @@ typedef enum {
7979
#define RADIUS_ID_RANGE_SIZE 10
8080
#define RADIUS_ID_RANGE_NUM (255 / RADIUS_ID_RANGE_SIZE) - 1
8181

82+
#define RADIUS_ID_TIMEOUT 60
83+
8284
typedef struct radius_client_sec_prot_lib_int_s radius_client_sec_prot_lib_int_t;
8385

8486
typedef struct {
@@ -120,7 +122,6 @@ typedef struct {
120122
static uint16_t radius_client_sec_prot_size(void);
121123
static int8_t radius_client_sec_prot_init(sec_prot_t *prot);
122124
static int8_t radius_client_sec_prot_shared_data_timeout(uint16_t ticks);
123-
static void radius_identifier_timer_value_set(uint8_t conn_num, uint8_t id_range, uint8_t value);
124125
static int8_t radius_client_sec_prot_shared_data_delete(void);
125126
static void radius_identifier_timer_value_set(uint8_t conn_num, uint8_t id_range, uint8_t value);
126127
static void radius_client_sec_prot_create_response(sec_prot_t *prot, sec_prot_result_e result);
@@ -541,17 +542,17 @@ static uint8_t radius_client_sec_prot_identifier_allocate(sec_prot_t *prot, uint
541542
{
542543
radius_client_sec_prot_int_t *data = radius_client_sec_prot_get(prot);
543544

544-
if (!data->radius_id_range_set || value >= (data->radius_id_range * RADIUS_ID_RANGE_SIZE) + RADIUS_ID_RANGE_SIZE) {
545+
if (!data->radius_id_range_set || value >= (data->radius_id_range * RADIUS_ID_RANGE_SIZE) + RADIUS_ID_RANGE_SIZE - 1) {
545546
for (uint8_t conn_num = 0; conn_num < RADIUS_CONN_NUMBER; conn_num++) {
546547
for (uint8_t id_range = 0; id_range < RADIUS_ID_RANGE_NUM; id_range++) {
547548
if (shared_data->radius_identifier_timer[conn_num][id_range] == 0) {
548549
// If range has been already reserved
549550
if (data->radius_id_range_set) {
550-
// Set previous range to timeout in 5 seconds
551-
radius_identifier_timer_value_set(data->radius_id_conn_num, data->radius_id_range, 5);
551+
// Set previous range to timeout at 1/5 of identifier timeout
552+
radius_identifier_timer_value_set(data->radius_id_conn_num, data->radius_id_range, RADIUS_ID_TIMEOUT / 5);
552553
}
553554
// Set timeout for new range to 60 seconds
554-
radius_identifier_timer_value_set(conn_num, id_range, 60);
555+
radius_identifier_timer_value_set(conn_num, id_range, RADIUS_ID_TIMEOUT);
555556
data->radius_id_conn_num = conn_num;
556557
data->radius_id_range = id_range;
557558
data->radius_id_range_set = true;
@@ -560,7 +561,7 @@ static uint8_t radius_client_sec_prot_identifier_allocate(sec_prot_t *prot, uint
560561
}
561562
}
562563
} else {
563-
radius_identifier_timer_value_set(data->radius_id_conn_num, data->radius_id_range, 60);
564+
radius_identifier_timer_value_set(data->radius_id_conn_num, data->radius_id_range, RADIUS_ID_TIMEOUT);
564565
return value + 1;
565566
}
566567

@@ -572,7 +573,8 @@ static void radius_client_sec_prot_identifier_free(sec_prot_t *prot)
572573
radius_client_sec_prot_int_t *data = radius_client_sec_prot_get(prot);
573574

574575
if (data->radius_id_range_set) {
575-
radius_identifier_timer_value_set(data->radius_id_conn_num, data->radius_id_range, 5);
576+
// Timeout at 1/5 of identifier timeout
577+
radius_identifier_timer_value_set(data->radius_id_conn_num, data->radius_id_range, RADIUS_ID_TIMEOUT / 5);
576578
}
577579
}
578580

‎source/Service_Libs/fhss/fhss_ws.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -305,12 +305,12 @@ static void fhss_broadcast_handler(const fhss_api_t *fhss_api, uint16_t delay)
305305

306306
/* Start timer with random timeout to trigger broadcast TX queue poll event.
307307
* Min random is 1/50 of the channel dwell interval.
308-
* Max random is 1/10 of the channel dwell interval.
308+
* Max random is 3/4 of the channel dwell interval.
309309
* Event timer resolution is 50us.
310310
*/
311311
uint32_t bc_dwell_us = MS_TO_US(fhss_structure->ws->fhss_configuration.fhss_bc_dwell_interval);
312312
uint16_t bc_min_random = (bc_dwell_us / 50) / 50;
313-
uint16_t bc_max_random = (bc_dwell_us / 10) / 50;
313+
uint16_t bc_max_random = (bc_dwell_us - (bc_dwell_us / 4)) / 50;
314314
eventOS_callback_timer_start(fhss_structure->fhss_event_timer, randLIB_get_random_in_range(bc_min_random, bc_max_random));
315315
} else {
316316
fhss_structure->ws->unicast_start_time_us = fhss_structure->callbacks.read_timestamp(fhss_structure->fhss_api);

0 commit comments

Comments
 (0)