Skip to content

Commit a87646d

Browse files
author
Mika Leppänen
authored
On startup deletes NVM GTKs if EUI-64 has been changed (#2576)
BR and node now stores the EUI-64 with GTK to NVM so that when storage is read, the current EUI-64 can be compared to the stored one.
1 parent 509a6f9 commit a87646d

File tree

4 files changed

+44
-16
lines changed

4 files changed

+44
-16
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@
1010
### Changes
1111
* Added throttling of number of simultaneous EAPOL authentications based on Border Router TX queue size
1212
* Domain configuration functions implemented. Replacing existing PHY mode ID and channel plan ID set functions.
13-
* Added EAPOL authentication waiting queue to Border Router. Queue makes it possible to start new authentication faster after previous authentication has completed.
13+
* Added EAPOL authentication waiting queue to Border Router. Queue makes it possible to start new authentication faster after previous authentication has completed.
14+
* On startup deletes NVM GTKs if EUI-64 has been changed.
1415

1516
### Bugfix
1617
* All MAC TX failure causes now trigger target change on supplicant EAPOL inititial-key sending

‎source/6LoWPAN/ws/ws_pae_controller.c‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -141,8 +141,8 @@ static int8_t ws_pae_controller_frame_counter_read(pae_controller_t *controller)
141141
static void ws_pae_controller_frame_counter_reset(frame_counters_t *frame_counters);
142142
static void ws_pae_controller_frame_counter_index_reset(frame_counters_t *frame_counters, uint8_t index);
143143
static int8_t ws_pae_controller_nw_info_read(pae_controller_t *controller, sec_prot_gtk_keys_t *gtks);
144-
static int8_t ws_pae_controller_nvm_nw_info_write(protocol_interface_info_entry_t *interface_ptr, uint16_t pan_id, char *network_name, sec_prot_gtk_keys_t *gtks);
145-
static int8_t ws_pae_controller_nvm_nw_info_read(protocol_interface_info_entry_t *interface_ptr, uint16_t *pan_id, char *network_name, sec_prot_gtk_keys_t *gtks);
144+
static int8_t ws_pae_controller_nvm_nw_info_write(protocol_interface_info_entry_t *interface_ptr, uint16_t pan_id, char *network_name, uint8_t *gtk_eui64, sec_prot_gtk_keys_t *gtks);
145+
static int8_t ws_pae_controller_nvm_nw_info_read(protocol_interface_info_entry_t *interface_ptr, uint16_t *pan_id, char *network_name, uint8_t *gtk_eui64, sec_prot_gtk_keys_t *gtks);
146146

147147

148148
static const char *FRAME_COUNTER_FILE = FRAME_COUNTER_FILE_NAME;
@@ -371,7 +371,13 @@ static void ws_pae_controller_nw_info_updated_check(protocol_interface_info_entr
371371
}
372372

373373
if (controller->sec_keys_nw_info.updated || sec_prot_keys_gtks_are_updated(controller->sec_keys_nw_info.gtks)) {
374-
ws_pae_controller_nvm_nw_info_write(interface_ptr, controller->sec_keys_nw_info.key_pan_id, controller->sec_keys_nw_info.network_name, controller->sec_keys_nw_info.gtks);
374+
// Get own EUI-64
375+
uint8_t gtk_eui64[8] = {0};
376+
link_layer_address_s mac_params;
377+
if (arm_nwk_mac_address_read(interface_ptr->id, &mac_params) >= 0) {
378+
memcpy(gtk_eui64, mac_params.mac_long, 8);
379+
}
380+
ws_pae_controller_nvm_nw_info_write(interface_ptr, controller->sec_keys_nw_info.key_pan_id, controller->sec_keys_nw_info.network_name, gtk_eui64, controller->sec_keys_nw_info.gtks);
375381
controller->sec_keys_nw_info.updated = false;
376382
sec_prot_keys_gtks_updated_reset(controller->sec_keys_nw_info.gtks);
377383
}
@@ -844,32 +850,46 @@ static void ws_pae_controller_frame_counter_index_reset(frame_counters_t *frame_
844850

845851
static int8_t ws_pae_controller_nw_info_read(pae_controller_t *controller, sec_prot_gtk_keys_t *gtks)
846852
{
847-
if (ws_pae_controller_nvm_nw_info_read(controller->interface_ptr, &controller->sec_keys_nw_info.key_pan_id, controller->sec_keys_nw_info.network_name, gtks) < 0) {
853+
uint8_t nvm_gtk_eui64[8];
854+
if (ws_pae_controller_nvm_nw_info_read(controller->interface_ptr, &controller->sec_keys_nw_info.key_pan_id, controller->sec_keys_nw_info.network_name, nvm_gtk_eui64, gtks) < 0) {
848855
// If no stored GTKs and network info (pan_id and network name) exits
849856
return -1;
850857
}
851858

859+
/* Get own EUI-64 and compare to the one read from the NVM. In case of mismatch delete GTKs and make
860+
full authentication to update keys with new EUI-64 and in case of authenticator to update new
861+
authenticator EUI-64 to the network. */
862+
uint8_t gtk_eui64[8] = {0};
863+
link_layer_address_s mac_params;
864+
if (arm_nwk_mac_address_read(controller->interface_ptr->id, &mac_params) >= 0) {
865+
memcpy(gtk_eui64, mac_params.mac_long, 8);
866+
}
867+
if (memcmp(nvm_gtk_eui64, gtk_eui64, 8) != 0) {
868+
tr_warn("NVM EUI-64 mismatch, current: %s stored: %s", tr_array(gtk_eui64, 8), tr_array(nvm_gtk_eui64, 8));
869+
sec_prot_keys_gtks_clear(gtks);
870+
}
871+
852872
// Sets also new pan_id used for pan_id set by bootstrap
853873
controller->sec_keys_nw_info.new_pan_id = controller->sec_keys_nw_info.key_pan_id;
854874

855875
return 0;
856876
}
857877

858-
static int8_t ws_pae_controller_nvm_nw_info_write(protocol_interface_info_entry_t *interface_ptr, uint16_t pan_id, char *network_name, sec_prot_gtk_keys_t *gtks)
878+
static int8_t ws_pae_controller_nvm_nw_info_write(protocol_interface_info_entry_t *interface_ptr, uint16_t pan_id, char *network_name, uint8_t *gtk_eui64, sec_prot_gtk_keys_t *gtks)
859879
{
860880
nw_info_nvm_tlv_t *tlv = (nw_info_nvm_tlv_t *) ws_pae_controller_nvm_tlv_get(interface_ptr);
861881
if (!tlv) {
862882
return -1;
863883
}
864884

865-
ws_pae_nvm_store_nw_info_tlv_create(tlv, pan_id, network_name, gtks);
885+
ws_pae_nvm_store_nw_info_tlv_create(tlv, pan_id, network_name, gtk_eui64, gtks);
866886

867887
ws_pae_nvm_store_tlv_file_write(NW_INFO_FILE, (nvm_tlv_t *) tlv);
868888

869889
return 0;
870890
}
871891

872-
static int8_t ws_pae_controller_nvm_nw_info_read(protocol_interface_info_entry_t *interface_ptr, uint16_t *pan_id, char *network_name, sec_prot_gtk_keys_t *gtks)
892+
static int8_t ws_pae_controller_nvm_nw_info_read(protocol_interface_info_entry_t *interface_ptr, uint16_t *pan_id, char *network_name, uint8_t *gtk_eui64, sec_prot_gtk_keys_t *gtks)
873893
{
874894
nw_info_nvm_tlv_t *tlv_entry = (nw_info_nvm_tlv_t *) ws_pae_controller_nvm_tlv_get(interface_ptr);
875895
if (!tlv_entry) {
@@ -882,7 +902,7 @@ static int8_t ws_pae_controller_nvm_nw_info_read(protocol_interface_info_entry_t
882902
return -1;
883903
}
884904

885-
if (ws_pae_nvm_store_nw_info_tlv_read(tlv_entry, pan_id, network_name, gtks) < 0) {
905+
if (ws_pae_nvm_store_nw_info_tlv_read(tlv_entry, pan_id, network_name, gtk_eui64, gtks) < 0) {
886906
return -1;
887907
}
888908

@@ -964,7 +984,8 @@ int8_t ws_pae_controller_auth_init(protocol_interface_info_entry_t *interface_pt
964984
}
965985
if (!read_gtks_to || sec_prot_keys_gtk_count(read_gtks_to) == 0) {
966986
// Key material invalid or GTKs are expired, delete GTKs from NVM
967-
ws_pae_controller_nvm_nw_info_write(controller->interface_ptr, controller->sec_keys_nw_info.key_pan_id, controller->sec_keys_nw_info.network_name, NULL);
987+
uint8_t gtk_eui64[8] = {0}; // Set GTK EUI-64 to zero
988+
ws_pae_controller_nvm_nw_info_write(controller->interface_ptr, controller->sec_keys_nw_info.key_pan_id, controller->sec_keys_nw_info.network_name, gtk_eui64, NULL);
968989
}
969990
}
970991

‎source/6LoWPAN/ws/ws_pae_nvm_data.c‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ void ws_pae_nvm_store_generic_tlv_free(nvm_tlv_t *tlv_entry)
6767
ns_dyn_mem_free(tlv_entry);
6868
}
6969

70-
void ws_pae_nvm_store_nw_info_tlv_create(nw_info_nvm_tlv_t *tlv_entry, uint16_t pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks)
70+
void ws_pae_nvm_store_nw_info_tlv_create(nw_info_nvm_tlv_t *tlv_entry, uint16_t pan_id, char *nw_name, uint8_t *gtk_eui64, sec_prot_gtk_keys_t *gtks)
7171
{
7272
int len;
7373
tlv_entry->tag = PAE_NVM_NW_INFO_TAG;
@@ -87,6 +87,9 @@ void ws_pae_nvm_store_nw_info_tlv_create(nw_info_nvm_tlv_t *tlv_entry, uint16_t
8787
memcpy((char *)tlv, nw_name, len);
8888
tlv += 33;
8989

90+
memcpy((char *)tlv, gtk_eui64, 8);
91+
tlv += 8;
92+
9093
uint64_t current_time = ws_pae_current_time_get();
9194

9295
for (uint8_t i = 0; i < GTK_NUM; i++) {
@@ -119,7 +122,7 @@ void ws_pae_nvm_store_nw_info_tlv_create(nw_info_nvm_tlv_t *tlv_entry, uint16_t
119122

120123
}
121124

122-
int8_t ws_pae_nvm_store_nw_info_tlv_read(nw_info_nvm_tlv_t *tlv_entry, uint16_t *pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks)
125+
int8_t ws_pae_nvm_store_nw_info_tlv_read(nw_info_nvm_tlv_t *tlv_entry, uint16_t *pan_id, char *nw_name, uint8_t *gtk_eui64, sec_prot_gtk_keys_t *gtks)
123126
{
124127
if (!tlv_entry || !pan_id || !nw_name) {
125128
return -1;
@@ -144,6 +147,9 @@ int8_t ws_pae_nvm_store_nw_info_tlv_read(nw_info_nvm_tlv_t *tlv_entry, uint16_t
144147
}
145148
tlv += 33;
146149

150+
memcpy(gtk_eui64, (char *)tlv, 8);
151+
tlv += 8;
152+
147153
uint64_t current_time = ws_pae_current_time_get();
148154

149155
tr_debug("NVM NW_INFO current time: %"PRIi64, current_time);

‎source/6LoWPAN/ws/ws_pae_nvm_data.h‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@
3535
#define PAE_NVM_KEY_STORAGE_INDEX_TAG 4
3636
#define PAE_NVM_KEY_STORAGE_TAG 5
3737

38-
// pan_id (2) + network name (33) + (GTK set (1) + GTK expiry timestamp (8) + status (1) + install order (1) + GTK (16)) * 4
39-
#define PAE_NVM_NW_INFO_LEN 2 + 33 + (1 + 8 + 1 + 1 + GTK_LEN) * GTK_NUM
38+
// pan_id (2) + network name (33) + GTK EUI-64 (own EUI-64) (8) + (GTK set (1) + GTK expiry timestamp (8) + status (1) + install order (1) + GTK (16)) * 4
39+
#define PAE_NVM_NW_INFO_LEN 2 + 33 + 8 + (1 + 8 + 1 + 1 + GTK_LEN) * GTK_NUM
4040

4141
// PTK EUI-64 set (1) + PTK EUI-64 (8) + PMK set (1) + PMK lifetime (4) + PMK (32) + PMK replay counter (8) + PTK set (1) + PTK lifetime (4) + PTK (48)
4242
#define PAE_NVM_KEYS_LEN 1 + 8 + 1 + 4 + PMK_LEN + 8 + 1 + 4 + PTK_LEN
@@ -95,7 +95,7 @@ void ws_pae_nvm_store_generic_tlv_free(nvm_tlv_t *tlv_entry);
9595
* \return TLV entry or NULL
9696
*
9797
*/
98-
void ws_pae_nvm_store_nw_info_tlv_create(nw_info_nvm_tlv_t *tlv_entry, uint16_t pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks);
98+
void ws_pae_nvm_store_nw_info_tlv_create(nw_info_nvm_tlv_t *tlv_entry, uint16_t pan_id, char *nw_name, uint8_t *gtk_eui64, sec_prot_gtk_keys_t *gtks);
9999

100100
/**
101101
* ws_pae_nvm_store_nw_info_tlv_read read from NVM network info TLV
@@ -109,7 +109,7 @@ void ws_pae_nvm_store_nw_info_tlv_create(nw_info_nvm_tlv_t *tlv_entry, uint16_t
109109
* \return >= 0 success
110110
*
111111
*/
112-
int8_t ws_pae_nvm_store_nw_info_tlv_read(nw_info_nvm_tlv_t *tlv_entry, uint16_t *pan_id, char *nw_name, sec_prot_gtk_keys_t *gtks);
112+
int8_t ws_pae_nvm_store_nw_info_tlv_read(nw_info_nvm_tlv_t *tlv_entry, uint16_t *pan_id, char *nw_name, uint8_t *gtk_eui64, sec_prot_gtk_keys_t *gtks);
113113

114114
/**
115115
* ws_pae_nvm_store_keys_tlv_create create NVM keys TLV

0 commit comments

Comments
 (0)