|
 |
41389a |
From e54691106b29f41aa3081b00eb4f48e411cebc72 Mon Sep 17 00:00:00 2001
|
|
|
41389a |
Message-Id: <e54691106b29f41aa3081b00eb4f48e411cebc72.1488376602.git.dcaratti@redhat.com>
|
|
|
41389a |
From: Badrish Adiga H R <badrish.adigahr@gmail.com>
|
|
|
41389a |
Date: Fri, 6 Jan 2017 15:27:10 +0530
|
|
|
41389a |
Subject: [PATCH] mka: Some bug fixes for MACsec in PSK mode
|
|
|
41389a |
|
|
|
41389a |
Issue:
|
|
|
41389a |
------
|
|
|
41389a |
The test setup has 2 peers running MACsec in PSK mode, Peer A with
|
|
|
41389a |
MAC address higher than MAC Address of peer B. Test sequence is
|
|
|
41389a |
1. Peer B starts with actor_priority 255
|
|
|
41389a |
2. Peer A starts with priority 16, becomes key server.
|
|
|
41389a |
3. Peer A stops..
|
|
|
41389a |
4. Peer A restarts with priority 255, but because of the stale values
|
|
|
41389a |
participant->is_key_server(=TRUE) and participant->is_elected(=TRUE)
|
|
|
41389a |
it continues to remain as Key Server.
|
|
|
41389a |
5. For peer B, key server election happens and since it has lower MAC
|
|
|
41389a |
address as compared to MAC address of A, it becomes the key server.
|
|
|
41389a |
Now we have 2 key servers in CA and is not correct.
|
|
|
41389a |
|
|
|
41389a |
Root-cause & fix:
|
|
|
41389a |
-----------------
|
|
|
41389a |
When number of live peers become 0, the flags such lrx, ltx, orx,
|
|
|
41389a |
otx, etc. need to be cleared. In MACsec PSK mode, these stale values
|
|
|
41389a |
create problems while re-establishing CA.
|
|
|
41389a |
|
|
|
41389a |
Signed-off-by: Badrish Adiga H R <badrish.adigahr@gmail.com>
|
|
|
41389a |
---
|
|
|
41389a |
src/pae/ieee802_1x_kay.c | 6 ++++++
|
|
|
41389a |
1 file changed, 6 insertions(+)
|
|
|
41389a |
|
|
|
41389a |
diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c
|
|
|
41389a |
index 79a6878..92fd7ba 100644
|
|
|
41389a |
--- a/src/pae/ieee802_1x_kay.c
|
|
|
41389a |
+++ b/src/pae/ieee802_1x_kay.c
|
|
|
41389a |
@@ -2378,6 +2378,12 @@ static void ieee802_1x_participant_timer(void *eloop_ctx, void *timeout_ctx)
|
|
|
41389a |
participant->advised_capability =
|
|
|
41389a |
MACSEC_CAP_NOT_IMPLEMENTED;
|
|
|
41389a |
participant->to_use_sak = FALSE;
|
|
|
41389a |
+ participant->ltx = FALSE;
|
|
|
41389a |
+ participant->lrx = FALSE;
|
|
|
41389a |
+ participant->otx = FALSE;
|
|
|
41389a |
+ participant->orx = FALSE;
|
|
|
41389a |
+ participant->is_key_server = FALSE;
|
|
|
41389a |
+ participant->is_elected = FALSE;
|
|
|
41389a |
kay->authenticated = TRUE;
|
|
|
41389a |
kay->secured = FALSE;
|
|
|
41389a |
kay->failed = FALSE;
|
|
|
41389a |
--
|
|
|
41389a |
2.7.4
|
|
|
41389a |
|