wpa_supplicant: Allow configuring the MACsec port for MKA

Previously, wpa_supplicant only supported hardcoded port == 1 in the
SCI, but users may want to choose a different port.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>

diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c
index 7664e2d5a7e52e21b683c1526c2cce3e73e6ba4d..3a495ca7a8a4609250265bdbc2fb5667ef378fa3 100644 (file)
--- a/src/pae/ieee802_1x_kay.c
+++ b/src/pae/ieee802_1x_kay.c
@@ -3071,7 +3071,7 @@ static void kay_l2_receive(void *ctx, const u8 *src_addr, const u8 *buf,
  */
 struct ieee802_1x_kay *
 ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
-                   const char *ifname, const u8 *addr)
+                   u16 port, const char *ifname, const u8 *addr)
 {
        struct ieee802_1x_kay *kay;
 
@@ -3093,7 +3093,7 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
 
        os_strlcpy(kay->if_name, ifname, IFNAMSIZ);
        os_memcpy(kay->actor_sci.addr, addr, ETH_ALEN);
-       kay->actor_sci.port = host_to_be16(0x0001);
+       kay->actor_sci.port = host_to_be16(port ? port : 0x0001);
        kay->actor_priority = DEFAULT_PRIO_NOT_KEY_SERVER;
 
        /* While actor acts as a key server, shall distribute sakey */

diff --git a/src/pae/ieee802_1x_kay.h b/src/pae/ieee802_1x_kay.h
index fb49f6206f99b7046c12806999bfdc2e0d6a4b38..ea5a0ddcff5d3a16c09652d8b5205cadd54ba8c0 100644 (file)
--- a/src/pae/ieee802_1x_kay.h
+++ b/src/pae/ieee802_1x_kay.h
@@ -233,7 +233,7 @@ struct ieee802_1x_kay {
 
 struct ieee802_1x_kay *
 ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
-                   const char *ifname, const u8 *addr);
+                   u16 port, const char *ifname, const u8 *addr);
 void ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay);
 
 struct ieee802_1x_mka_participant *

diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index afb631ec5758196f6416d0fa7db53f2826a10df2..2120a6ec67d7ed73d0c29957eec9217936917ebf 100644 (file)
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -2126,6 +2126,7 @@ static const struct parse_data ssid_fields[] = {
 #ifdef CONFIG_MACSEC
        { INT_RANGE(macsec_policy, 0, 1) },
        { INT_RANGE(macsec_integ_only, 0, 1) },
+       { INT_RANGE(macsec_port, 1, 65534) },
        { FUNC_KEY(mka_cak) },
        { FUNC_KEY(mka_ckn) },
 #endif /* CONFIG_MACSEC */

diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
index f605fa9a66ca3616e763bcfaf797d0036b88ad1a..2e3d57ee0d6dcb4f9ed2137ce9d8e17a651c6777 100644 (file)
--- a/wpa_supplicant/config_file.c
+++ b/wpa_supplicant/config_file.c
@@ -809,6 +809,7 @@ static void wpa_config_write_network(FILE *f, struct wpa_ssid *ssid)
        write_mka_cak(f, ssid);
        write_mka_ckn(f, ssid);
        INT(macsec_integ_only);
+       INT(macsec_port);
 #endif /* CONFIG_MACSEC */
 #ifdef CONFIG_HS20
        INT(update_identifier);

diff --git a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h
index b8c3192c52e1f3158e16c0f9cb16cf4abe3be68d..fe0f7fab56b65d31953d102acf4e75dfe745b272 100644 (file)
--- a/wpa_supplicant/config_ssid.h
+++ b/wpa_supplicant/config_ssid.h
@@ -741,6 +741,15 @@ struct wpa_ssid {
         */
        int macsec_integ_only;
 
+       /**
+        * macsec_port - MACsec port (in SCI)
+        *
+        * Port component of the SCI.
+        *
+        * Range: 1-65534 (default: 1)
+        */
+       int macsec_port;
+
        /**
         * mka_ckn - MKA pre-shared CKN
         */

diff --git a/wpa_supplicant/wpa_cli.c b/wpa_supplicant/wpa_cli.c
index aed95e66a7d46659da9c9244315a6f2d59a9bb53..f11028a9ea1b5739e5fac0c27487d71690dacba4 100644 (file)
--- a/wpa_supplicant/wpa_cli.c
+++ b/wpa_supplicant/wpa_cli.c
@@ -1391,6 +1391,7 @@ static const char *network_fields[] = {
 #ifdef CONFIG_MACSEC
        "macsec_policy",
        "macsec_integ_only",
+       "macsec_port",
 #endif /* CONFIG_MACSEC */
 #ifdef CONFIG_HS20
        "update_identifier",

diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
index b23c5e6de8c14fb9df21ea1dd410a07481145814..82aa24ec340311890243d4d50b530627307290b4 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.conf
+++ b/wpa_supplicant/wpa_supplicant.conf
@@ -899,6 +899,10 @@ fast_reauth=1
 # 0: Encrypt traffic (default)
 # 1: Integrity only
 #
+# macsec_port: IEEE 802.1X/MACsec port
+# Port component of the SCI
+# Range: 1-65534 (default: 1)
+#
 # mka_cak and mka_ckn: IEEE 802.1X/MACsec pre-shared authentication mode
 # This allows to configure MACsec with a pre-shared key using a (CAK,CKN) pair.
 # In this mode, instances of wpa_supplicant can act as peers, one of

diff --git a/wpa_supplicant/wpas_kay.c b/wpa_supplicant/wpas_kay.c
index 2ff48954b316ce44e15fa003f27701197db40eed..d3fefda856f854e30993671e18300d394a806610 100644 (file)
--- a/wpa_supplicant/wpas_kay.c
+++ b/wpa_supplicant/wpas_kay.c
@@ -232,8 +232,8 @@ int ieee802_1x_alloc_kay_sm(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
        kay_ctx->enable_transmit_sa = wpas_enable_transmit_sa;
        kay_ctx->disable_transmit_sa = wpas_disable_transmit_sa;
 
-       res = ieee802_1x_kay_init(kay_ctx, policy, wpa_s->ifname,
-                                 wpa_s->own_addr);
+       res = ieee802_1x_kay_init(kay_ctx, policy, ssid->macsec_port,
+                                 wpa_s->ifname, wpa_s->own_addr);
        if (res == NULL) {
                os_free(kay_ctx);
                return -1;