Allow macsec_csindex to be configured and select the cipher suite when
the participant acts as a key server.
Signed-off-by: leiwei <quic_leiwei@quicinc.com>
The associated SAs have been deleted and the key server has changed so
there's no point in keeping the key values.
Note that this isn't specified in IEEE Std 802.1X-2010.
Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
Previously the ABANDON->RECEIVE state change was impossible and did not
match the CP state machine in IEEE Std 802.1X-2010 Figure 12-2.
Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
The RECEIVE and RETIRE states were incorrect which can result in
incorrect information being advertised in SAKuse MKPDUs. Change these to
match IEEE Std 802.1X-2010, Figure 12-2 (CP state machine).
hostapd/wpa_supplicant implemented an interpretation of the standard as
described in a proposed amendment titled "MKA pending PN exhastion"
which was deemed to be wrong. This amendment was included in IEEE Std
802.1Xck-2018.
Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
It looks like it is possible for the RECEIVE state to leak memory where
a previously allocated sm->lki is moved to sm->oki while sm->oki is
pointing to not yet freed entry. It is not clear how this can be
triggered, but it has come up in hwsim testing under heavy load.
Free sm->oki if it is still set in RECEIVE before replacing it with
sm->lki to avoid this memory leak.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Go through the SM_STEP_RUN() global transition to get into the INIT
state to follow the state machine design more closely.
Signed-off-by: Jouni Malinen <j@w1.fi>
While IEEE Std 802.1X-2010 talks about arbitrary authorization data that
could be passed to the CP from sources like RADIUS server, there is not
much point in trying to implement this as an arbitrary memory buffer in
wpa_supplicant. Should such data be supported in the future, it would
much more likely use more detailed data structures that encode the
received data in easier to use form.
Signed-off-by: Jouni Malinen <j@w1.fi>
Per IEEE Std 802.1X-2010, Figure 12-2 (CP state machine), READY to
TRANSMIT transition includes !controlledPortEnabled condition.
Signed-off-by: Michael Siedzik <msiedzik@extremenetworks.com>
Per IEEE Std 802.1X-2010, Figure 12-2 (CP state machine), READY should
move to ABANDON (not RECEIVE) when new_sak or changed_connect is true.
Signed-off-by: Michael Siedzik <msiedzik@extremenetworks.com>
Per IEEE Std 802.1X-2010, Figure 12-2 (CP state machine), RECEIVING to
TRANSMIT transition includes !controlledPortEnabled condition.
Signed-off-by: Michael Siedzik <msiedzik@extremenetworks.com>
Per IEEE Std 802.1X-2010, Figure 12-2 (CP state machine), deleteSAs(oki)
is used upon entering RETIRE. Do that in addition to freeing sm->oki.
Signed-off-by: Michael Siedzik <msiedzik@extremenetworks.com>
Instead of copying from kay to a temporary struct, and then from the
struct to the sm, just copy from kay to cp.
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
This is a known constant value (CS_ID_LEN, i.e., the length of the EUI64
identifier) and does not need to be provided separately in these
function calls.
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
