Skip to content

Commit 40dc215

Browse files
author
Mika Leppänen
committed
Set frame counter increment to 1000000
Removed not needed NVM writes for PAN ID and network name on supplicant. Added frame counter maximum value check.
1 parent a57acc8 commit 40dc215

File tree

6 files changed

+55
-19
lines changed

6 files changed

+55
-19
lines changed

‎source/6LoWPAN/ws/ws_config.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -174,8 +174,8 @@ extern uint8_t DEVICE_MIN_SENS;
174174
#define FRAME_COUNTER_STORE_INTERVAL 60 // Time interval (on seconds) between checking if frame counter storing is needed
175175
#define FRAME_COUNTER_STORE_FORCE_INTERVAL (3600 * 20) // Time interval (on seconds) before frame counter storing is forced (if no other storing operations triggered)
176176
#define FRAME_COUNTER_STORE_TRIGGER 5 // Delay (on seconds) before storing, when storing of frame counters is triggered
177-
#define FRAME_COUNTER_INCREMENT 1000 // How much frame counter is incremented on start up
178-
#define FRAME_COUNTER_STORE_THRESHOLD 800 // How much frame counter must increment before it is stored
177+
#define FRAME_COUNTER_INCREMENT 1000000 // How much frame counter is incremented on start up
178+
#define FRAME_COUNTER_STORE_THRESHOLD 994999 // How much frame counter must increment before it is stored
179179

180180

181181
/*

‎source/6LoWPAN/ws/ws_pae_auth.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -440,7 +440,7 @@ int8_t ws_pae_auth_node_access_revoke_start(protocol_interface_info_entry_t *int
440440

441441
// If active GTK lifetime is larger than revocation lifetime decrements active GTK lifetime
442442
if (active_lifetime > revocation_lifetime) {
443-
sec_prot_keys_gtk_lifetime_decrement(pae_auth->sec_keys_nw_info->gtks, active_index, current_time, active_lifetime - revocation_lifetime);
443+
sec_prot_keys_gtk_lifetime_decrement(pae_auth->sec_keys_nw_info->gtks, active_index, current_time, active_lifetime - revocation_lifetime, true);
444444
tr_info("Access revocation start, GTK active index: %i, revoked lifetime: %"PRIu32"", active_index, revocation_lifetime);
445445
} else {
446446
// Otherwise decrements lifetime of the GTK to be installed after the active one
@@ -451,7 +451,7 @@ int8_t ws_pae_auth_node_access_revoke_start(protocol_interface_info_entry_t *int
451451

452452
uint32_t second_lifetime = sec_prot_keys_gtk_lifetime_get(pae_auth->sec_keys_nw_info->gtks, second_index);
453453
if (second_lifetime > second_revocation_lifetime) {
454-
sec_prot_keys_gtk_lifetime_decrement(pae_auth->sec_keys_nw_info->gtks, second_index, current_time, second_lifetime - second_revocation_lifetime);
454+
sec_prot_keys_gtk_lifetime_decrement(pae_auth->sec_keys_nw_info->gtks, second_index, current_time, second_lifetime - second_revocation_lifetime, true);
455455
tr_info("Access revocation start, GTK second active index: %i, revoked lifetime: %"PRIu32"", second_index, second_revocation_lifetime);
456456
}
457457
// Removes other keys than active and GTK to be installed next
@@ -710,7 +710,7 @@ void ws_pae_auth_slow_timer(uint16_t seconds)
710710
if (!sec_prot_keys_gtk_is_set(pae_auth->sec_keys_nw_info->gtks, i)) {
711711
continue;
712712
}
713-
uint32_t timer_seconds = sec_prot_keys_gtk_lifetime_decrement(pae_auth->sec_keys_nw_info->gtks, i, current_time, seconds);
713+
uint32_t timer_seconds = sec_prot_keys_gtk_lifetime_decrement(pae_auth->sec_keys_nw_info->gtks, i, current_time, seconds, true);
714714
if (active_index == i) {
715715
if (!pae_auth->gtk_new_inst_req_exp) {
716716
pae_auth->gtk_new_inst_req_exp = ws_pae_timers_gtk_new_install_required(pae_auth->sec_cfg, timer_seconds);

‎source/6LoWPAN/ws/ws_pae_controller.c‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -783,8 +783,14 @@ static int8_t ws_pae_controller_frame_counter_read(pae_controller_t *controller)
783783
// Checks frame counters
784784
for (uint8_t index = 0; index < GTK_NUM; index++) {
785785
if (controller->frame_counters.counter[index].set) {
786-
// Increments frame counters
787-
controller->frame_counters.counter[index].frame_counter += FRAME_COUNTER_INCREMENT;
786+
// If there is room on frame counter space
787+
if (controller->frame_counters.counter[index].frame_counter < (UINT32_MAX - FRAME_COUNTER_INCREMENT * 2)) {
788+
// Increments frame counters
789+
controller->frame_counters.counter[index].frame_counter += FRAME_COUNTER_INCREMENT;
790+
} else {
791+
tr_error("Frame counter space exhausted");
792+
controller->frame_counters.counter[index].frame_counter = UINT32_MAX;
793+
}
788794
controller->frame_counters.counter[index].stored_frame_counter =
789795
controller->frame_counters.counter[index].frame_counter;
790796

@@ -891,6 +897,7 @@ int8_t ws_pae_controller_supp_init(protocol_interface_info_entry_t *interface_pt
891897
ws_pae_controller_nw_info_read(controller, controller->sec_keys_nw_info.gtks);
892898
// Set active key back to fresh so that it can be used again after re-start
893899
sec_prot_keys_gtk_status_active_to_fresh_set(&controller->gtks);
900+
sec_prot_keys_gtks_updated_reset(&controller->gtks);
894901

895902
return 0;
896903
}

‎source/6LoWPAN/ws/ws_pae_supp.c‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -549,11 +549,13 @@ int8_t ws_pae_supp_nw_info_set(protocol_interface_info_entry_t *interface_ptr, u
549549
sec_prot_keys_ptk_delete(&pae_supp->entry.sec_keys);
550550
sec_prot_keys_ptk_eui_64_delete(&pae_supp->entry.sec_keys);
551551
// Delete GTKs
552-
sec_prot_keys_gtks_init(pae_supp->sec_keys_nw_info->gtks);
553-
sec_prot_keys_gtks_updated_set(pae_supp->sec_keys_nw_info->gtks);
554-
ws_pae_supp_nvm_update(pae_supp);
552+
sec_prot_keys_gtks_clear(pae_supp->sec_keys_nw_info->gtks);
553+
// If data is changed, store to NVM
554+
if (sec_prot_keys_are_updated(&pae_supp->entry.sec_keys) ||
555+
sec_prot_keys_gtks_are_updated(pae_supp->sec_keys_nw_info->gtks)) {
556+
ws_pae_supp_nvm_update(pae_supp);
557+
}
555558
}
556-
557559
return 0;
558560
}
559561

@@ -888,7 +890,7 @@ void ws_pae_supp_slow_timer(uint16_t seconds)
888890
continue;
889891
}
890892
uint64_t current_time = ws_pae_current_time_get();
891-
sec_prot_keys_gtk_lifetime_decrement(pae_supp->sec_keys_nw_info->gtks, i, current_time, seconds);
893+
sec_prot_keys_gtk_lifetime_decrement(pae_supp->sec_keys_nw_info->gtks, i, current_time, seconds, false);
892894
}
893895

894896
if (pae_supp->initial_key_timer > 0) {

‎source/Security/protocols/sec_prot_keys.c‎

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,16 @@ void sec_prot_keys_gtks_init(sec_prot_gtk_keys_t *gtks)
9696
gtks->updated = false;
9797
}
9898

99+
void sec_prot_keys_gtks_clear(sec_prot_gtk_keys_t *gtks)
100+
{
101+
for (uint8_t i = 0; i < GTK_NUM; i++) {
102+
if (sec_prot_keys_gtk_is_set(gtks, i)) {
103+
gtks->updated = true;
104+
}
105+
}
106+
memset(gtks, 0, sizeof(sec_prot_gtk_keys_t));
107+
}
108+
99109
void sec_prot_keys_gtks_delete(sec_prot_gtk_keys_t *gtks)
100110
{
101111
ns_dyn_mem_free(gtks);
@@ -113,12 +123,15 @@ void sec_prot_keys_pmk_write(sec_prot_keys_t *sec_keys, uint8_t *pmk, uint32_t p
113123

114124
void sec_prot_keys_pmk_delete(sec_prot_keys_t *sec_keys)
115125
{
126+
if (sec_keys->pmk_key_replay_cnt != 0 || sec_keys->pmk_key_replay_cnt_set ||
127+
sec_keys->pmk_lifetime != 0 || sec_keys->pmk_set) {
128+
sec_keys->updated = true;
129+
}
116130
memset(sec_keys->pmk, 0, PMK_LEN);
117131
sec_keys->pmk_key_replay_cnt = 0;
118132
sec_keys->pmk_key_replay_cnt_set = false;
119133
sec_keys->pmk_lifetime = 0;
120134
sec_keys->pmk_set = false;
121-
sec_keys->updated = true;
122135
}
123136

124137
uint8_t *sec_prot_keys_pmk_get(sec_prot_keys_t *sec_keys)
@@ -222,10 +235,12 @@ void sec_prot_keys_ptk_write(sec_prot_keys_t *sec_keys, uint8_t *ptk, uint32_t p
222235

223236
void sec_prot_keys_ptk_delete(sec_prot_keys_t *sec_keys)
224237
{
238+
if (sec_keys->ptk_lifetime != 0 || sec_keys->ptk_set) {
239+
sec_keys->updated = true;
240+
}
225241
memset(sec_keys->ptk, 0, PTK_LEN);
226242
sec_keys->ptk_lifetime = 0;
227243
sec_keys->ptk_set = false;
228-
sec_keys->updated = true;
229244
}
230245

231246
uint8_t *sec_prot_keys_ptk_get(sec_prot_keys_t *sec_keys)
@@ -279,9 +294,11 @@ uint8_t *sec_prot_keys_ptk_eui_64_get(sec_prot_keys_t *sec_keys)
279294

280295
void sec_prot_keys_ptk_eui_64_delete(sec_prot_keys_t *sec_keys)
281296
{
297+
if (sec_keys->ptk_eui_64_set) {
298+
sec_keys->updated = true;
299+
}
282300
memset(sec_keys->ptk_eui_64, 0, 8);
283301
sec_keys->ptk_eui_64_set = false;
284-
sec_keys->updated = true;
285302
}
286303

287304
bool sec_prot_keys_ptk_lifetime_decrement(sec_prot_keys_t *sec_keys, uint8_t seconds)
@@ -490,7 +507,7 @@ uint32_t sec_prot_keys_gtk_lifetime_get(sec_prot_gtk_keys_t *gtks, uint8_t index
490507
return gtks->gtk[index].lifetime;
491508
}
492509

493-
uint32_t sec_prot_keys_gtk_lifetime_decrement(sec_prot_gtk_keys_t *gtks, uint8_t index, uint64_t current_time, uint16_t seconds)
510+
uint32_t sec_prot_keys_gtk_lifetime_decrement(sec_prot_gtk_keys_t *gtks, uint8_t index, uint64_t current_time, uint16_t seconds, bool gtk_update_enable)
494511
{
495512
if (gtks->gtk[index].lifetime > seconds) {
496513
gtks->gtk[index].lifetime -= seconds;
@@ -508,7 +525,7 @@ uint32_t sec_prot_keys_gtk_lifetime_decrement(sec_prot_gtk_keys_t *gtks, uint8_t
508525
diff = expirytime - gtks->gtk[index].expirytime;
509526
}
510527
// If timestamps differ for more than 5 minutes marks field as updated (and stores to NVM)
511-
if (diff > 300) {
528+
if (diff > 300 && gtk_update_enable) {
512529
gtks->updated = true;
513530
}
514531

@@ -588,7 +605,8 @@ int8_t sec_prot_keys_gtk_status_active_set(sec_prot_gtk_keys_t *gtks, uint8_t in
588605
}
589606
}
590607
gtks->gtk[index].status = GTK_STATUS_ACTIVE;
591-
gtks->updated = true;
608+
/* Changing fresh to active does not change the gtks updated state since active
609+
keys are set to fresh on nvm read on startup */
592610
return 0;
593611
}
594612

‎source/Security/protocols/sec_prot_keys.h‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,14 @@ sec_prot_gtk_keys_t *sec_prot_keys_gtks_create(void);
200200
*/
201201
void sec_prot_keys_gtks_init(sec_prot_gtk_keys_t *gtks);
202202

203+
/**
204+
* sec_prot_keys_gtks_init clear GTK keys
205+
*
206+
* \param gtks GTK keys
207+
*
208+
*/
209+
void sec_prot_keys_gtks_clear(sec_prot_gtk_keys_t *gtks);
210+
203211
/**
204212
* sec_prot_keys_gtks_delete frees GTK keys memory
205213
*
@@ -616,11 +624,12 @@ uint32_t sec_prot_keys_gtk_lifetime_get(sec_prot_gtk_keys_t *gtks, uint8_t index
616624
* \param index index for GTK
617625
* \param current_time current timestamp
618626
* \param seconds elapsed seconds
627+
* \param gtk_update_enable enable GTK status to be updated
619628
*
620629
* \return new GTK lifetime
621630
*
622631
*/
623-
uint32_t sec_prot_keys_gtk_lifetime_decrement(sec_prot_gtk_keys_t *gtks, uint8_t index, uint64_t current_time, uint16_t seconds);
632+
uint32_t sec_prot_keys_gtk_lifetime_decrement(sec_prot_gtk_keys_t *gtks, uint8_t index, uint64_t current_time, uint16_t seconds, bool gtk_update_enable);
624633

625634
/**
626635
* sec_prot_keys_gtk_exptime_from_lifetime_get converts GTK lifetime to expiry time.

0 commit comments

Comments
 (0)