|
 |
b645d2 |
From 088d53dd15b14a1868b70fd0b8d695ac6b68f642 Mon Sep 17 00:00:00 2001
|
|
|
b645d2 |
Message-Id: <088d53dd15b14a1868b70fd0b8d695ac6b68f642.1488376601.git.dcaratti@redhat.com>
|
|
|
b645d2 |
From: Sabrina Dubroca <sd@queasysnail.net>
|
|
|
b645d2 |
Date: Tue, 15 Nov 2016 18:06:23 +0100
|
|
|
b645d2 |
Subject: [PATCH] mka: Fix getting capabilities from the driver
|
|
|
b645d2 |
|
|
|
b645d2 |
In commit a25e4efc9e428d968e83398bd8c9c94698ba5851 ('mka: Add driver op
|
|
|
b645d2 |
to get macsec capabilities') I added some code to check the driver's
|
|
|
b645d2 |
capabilities. This commit has two problems:
|
|
|
b645d2 |
- wrong enum type set in kay->macsec_confidentiality
|
|
|
b645d2 |
- ignores that drivers could report MACSEC_CAP_NOT_IMPLEMENTED, in
|
|
|
b645d2 |
which case the MKA would claim that MACsec is supported.
|
|
|
b645d2 |
|
|
|
b645d2 |
Fix this by interpreting MACSEC_CAP_NOT_IMPLEMENTED in the same way as a
|
|
|
b645d2 |
DO_NOT_SECURE policy, and set the correct value in
|
|
|
b645d2 |
kay->macsec_confidentiality.
|
|
|
b645d2 |
|
|
|
b645d2 |
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
|
|
|
b645d2 |
---
|
|
|
b645d2 |
src/pae/ieee802_1x_kay.c | 16 +++++++++-------
|
|
|
b645d2 |
1 file changed, 9 insertions(+), 7 deletions(-)
|
|
|
b645d2 |
|
|
|
b645d2 |
diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c
|
|
|
b645d2 |
index 63bbd13..2841b10 100644
|
|
|
b645d2 |
--- a/src/pae/ieee802_1x_kay.c
|
|
|
b645d2 |
+++ b/src/pae/ieee802_1x_kay.c
|
|
|
b645d2 |
@@ -3111,7 +3111,14 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
|
|
|
b645d2 |
|
|
|
b645d2 |
dl_list_init(&kay->participant_list);
|
|
|
b645d2 |
|
|
|
b645d2 |
- if (policy == DO_NOT_SECURE) {
|
|
|
b645d2 |
+ if (policy != DO_NOT_SECURE &&
|
|
|
b645d2 |
+ secy_get_capability(kay, &kay->macsec_capable) < 0) {
|
|
|
b645d2 |
+ os_free(kay);
|
|
|
b645d2 |
+ return NULL;
|
|
|
b645d2 |
+ }
|
|
|
b645d2 |
+
|
|
|
b645d2 |
+ if (policy == DO_NOT_SECURE ||
|
|
|
b645d2 |
+ kay->macsec_capable == MACSEC_CAP_NOT_IMPLEMENTED) {
|
|
|
b645d2 |
kay->macsec_capable = MACSEC_CAP_NOT_IMPLEMENTED;
|
|
|
b645d2 |
kay->macsec_desired = FALSE;
|
|
|
b645d2 |
kay->macsec_protect = FALSE;
|
|
|
b645d2 |
@@ -3120,11 +3127,6 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
|
|
|
b645d2 |
kay->macsec_replay_window = 0;
|
|
|
b645d2 |
kay->macsec_confidentiality = CONFIDENTIALITY_NONE;
|
|
|
b645d2 |
} else {
|
|
|
b645d2 |
- if (secy_get_capability(kay, &kay->macsec_capable) < 0) {
|
|
|
b645d2 |
- os_free(kay);
|
|
|
b645d2 |
- return NULL;
|
|
|
b645d2 |
- }
|
|
|
b645d2 |
-
|
|
|
b645d2 |
kay->macsec_desired = TRUE;
|
|
|
b645d2 |
kay->macsec_protect = TRUE;
|
|
|
b645d2 |
kay->macsec_validate = Strict;
|
|
|
b645d2 |
@@ -3133,7 +3135,7 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
|
|
|
b645d2 |
if (kay->macsec_capable >= MACSEC_CAP_INTEG_AND_CONF)
|
|
|
b645d2 |
kay->macsec_confidentiality = CONFIDENTIALITY_OFFSET_0;
|
|
|
b645d2 |
else
|
|
|
b645d2 |
- kay->macsec_confidentiality = MACSEC_CAP_INTEGRITY;
|
|
|
b645d2 |
+ kay->macsec_confidentiality = CONFIDENTIALITY_NONE;
|
|
|
b645d2 |
}
|
|
|
b645d2 |
|
|
|
b645d2 |
wpa_printf(MSG_DEBUG, "KaY: state machine created");
|
|
|
b645d2 |
--
|
|
|
b645d2 |
2.7.4
|
|
|
b645d2 |
|