From 1f445bad48e2e9cd3be63740a898c7968dcd4181 Mon Sep 17 00:00:00 2001 From: Shu Chen Date: Wed, 9 Nov 2016 17:19:46 +0800 Subject: [PATCH] Security Policy feature enhancement. (#948) * Initialize the Security Policy Tlv in Active Dataset * Apply Security Policy configuration from Active Dataset * Do not include NetworkMasterKey Tlv in MGMT_GET.rsp if Security Policy 'O' bit is disabled * THCI: add startNativeCommissioner() and sendBeacons() support --- src/core/thread/key_manager.cpp | 2 ++ src/core/thread/key_manager.hpp | 24 ++++++++++++++ src/core/thread/meshcop_dataset_manager.cpp | 35 +++++++++++++++++++-- src/core/thread/mle.cpp | 10 ++++++ tools/harness-thci/ARM.py | 17 ++++++++-- 5 files changed, 82 insertions(+), 6 deletions(-) diff --git a/src/core/thread/key_manager.cpp b/src/core/thread/key_manager.cpp index 577bbe68d..471b492c6 100644 --- a/src/core/thread/key_manager.cpp +++ b/src/core/thread/key_manager.cpp @@ -57,6 +57,8 @@ KeyManager::KeyManager(ThreadNetif &aThreadNetif): mKeyRotationTime = kDefaultKeyRotationTime; mKeySwitchGuardTime = kDefaultKeySwitchGuardTime; mKeySwitchGuardEnabled = false; + + mSecurityPolicyFlags = 0xff; } void KeyManager::Start(void) diff --git a/src/core/thread/key_manager.hpp b/src/core/thread/key_manager.hpp index e8168198c..ca8030b22 100644 --- a/src/core/thread/key_manager.hpp +++ b/src/core/thread/key_manager.hpp @@ -251,6 +251,28 @@ public: */ void SetKeySwitchGuardTime(uint32_t aKeySwitchGuardTime) { mKeySwitchGuardTime = aKeySwitchGuardTime; } + /** + * This method returns the Security Policy Flags. + * + * The Security Policy Flags specifies network administrator preferences for which + * security-related operations are allowed or disallowed. + * + * @returns The SecurityPolicy Flags. + * + */ + uint8_t GetSecurityPolicyFlags(void) const { return mSecurityPolicyFlags; } + + /** + * This method sets the Security Policy Flags. + * + * The Security Policy Flags specifies network administrator preferences for which + * security-related operations are allowed or disallowed. + * + * @param[in] aSecurityPolicyFlags The Security Policy Flags. + * + */ + void SetSecurityPolicyFlags(uint8_t aSecurityPolicyFlags) { mSecurityPolicyFlags = aSecurityPolicyFlags; } + private: enum { @@ -286,6 +308,8 @@ private: uint8_t mKek[kMaxKeyLength]; uint32_t mKekFrameCounter; + + uint8_t mSecurityPolicyFlags; }; /** diff --git a/src/core/thread/meshcop_dataset_manager.cpp b/src/core/thread/meshcop_dataset_manager.cpp index 88f47a3b6..078bd87d1 100644 --- a/src/core/thread/meshcop_dataset_manager.cpp +++ b/src/core/thread/meshcop_dataset_manager.cpp @@ -132,6 +132,14 @@ ThreadError DatasetManager::ApplyConfiguration(void) break; } + case Tlv::kSecurityPolicy: + { + const SecurityPolicyTlv *securityPolicy = static_cast(cur); + mNetif.GetKeyManager().SetKeyRotation(securityPolicy->GetRotationTime()); + mNetif.GetKeyManager().SetSecurityPolicyFlags(securityPolicy->GetFlags()); + break; + } + default: { break; @@ -744,12 +752,30 @@ void DatasetManager::SendGetResponse(const Coap::Header &aRequestHeader, const I if (aLength == 0) { - SuccessOrExit(error = message->Append(mNetwork.GetBytes(), mNetwork.GetSize())); + const Tlv *cur = reinterpret_cast(mNetwork.GetBytes()); + const Tlv *end = reinterpret_cast(mNetwork.GetBytes() + mNetwork.GetSize()); + + while (cur < end) + { + if (cur->GetType() != Tlv::kNetworkMasterKey || + (mNetif.GetKeyManager().GetSecurityPolicyFlags() & OT_SECURITY_POLICY_OBTAIN_MASTER_KEY)) + { + SuccessOrExit(error = message->Append(cur, sizeof(Tlv) + cur->GetLength())); + } + + cur = cur->GetNext(); + } } else { for (index = 0; index < aLength; index++) { + if (aTlvs[index] == Tlv::kNetworkMasterKey && + !(mNetif.GetKeyManager().GetSecurityPolicyFlags() & OT_SECURITY_POLICY_OBTAIN_MASTER_KEY)) + { + continue; + } + if ((tlv = mNetwork.Get(static_cast(aTlvs[index]))) != NULL) { SuccessOrExit(error = message->Append(tlv, sizeof(Tlv) + tlv->GetLength())); @@ -815,14 +841,12 @@ void ActiveDataset::StartLeader(void) // Master Key const uint8_t *key; uint8_t keyLength; - key = mNetif.GetKeyManager().GetMasterKey(&keyLength); memcpy(dataset.mMasterKey.m8, key, keyLength); dataset.mIsMasterKeySet = true; // Network Name const char *name; - name = mNetif.GetMac().GetNetworkName(); memcpy(dataset.mNetworkName.m8, name, strlen(name)); dataset.mIsNetworkNameSet = true; @@ -831,6 +855,11 @@ void ActiveDataset::StartLeader(void) dataset.mPanId = mNetif.GetMac().GetPanId(); dataset.mIsPanIdSet = true; + // Security Policy + dataset.mSecurityPolicy.mRotationTime = static_cast(mNetif.GetKeyManager().GetKeyRotation()); + dataset.mSecurityPolicy.mFlags = mNetif.GetKeyManager().GetSecurityPolicyFlags(); + dataset.mIsSecurityPolicySet = true; + mLocal.Set(dataset); } diff --git a/src/core/thread/mle.cpp b/src/core/thread/mle.cpp index 32b21c041..3fda4268e 100644 --- a/src/core/thread/mle.cpp +++ b/src/core/thread/mle.cpp @@ -2651,6 +2651,16 @@ ThreadError Mle::SendDiscoveryResponse(const Ip6::Address &aDestination, uint16_ // Discovery Response TLV discoveryResponse.Init(); discoveryResponse.SetVersion(kVersion); + + if (mNetif.GetKeyManager().GetSecurityPolicyFlags() & OT_SECURITY_POLICY_NATIVE_COMMISSIONING) + { + discoveryResponse.SetNativeCommissioner(true); + } + else + { + discoveryResponse.SetNativeCommissioner(false); + } + SuccessOrExit(error = message->Append(&discoveryResponse, sizeof(discoveryResponse))); // Extended PAN ID TLV diff --git a/tools/harness-thci/ARM.py b/tools/harness-thci/ARM.py index f02c99287..d7861004f 100644 --- a/tools/harness-thci/ARM.py +++ b/tools/harness-thci/ARM.py @@ -1104,7 +1104,7 @@ class ARM(IThci): print '%s call powerDown' % self.port self.isPowerDown = True self._sendline('reset') - time.sleep(3) + time.sleep(5) self.setMAC(self.mac) def powerUp(self): @@ -1271,7 +1271,7 @@ class ARM(IThci): self.setNetworkKey(self.networkKey) self.setMLPrefix(self.localprefix) self.setPSKc(self.pskc) - self.__setSecurityPolicy(self.securityPolicySecs) + self.__setSecurityPolicy("672 onrcb") self.__setChannelMask("0xffff") self.isWhiteListEnabled = False self.isBlackListEnabled = False @@ -1913,7 +1913,16 @@ class ARM(IThci): return self.__sendCommand(cmd) def startNativeCommissioner(self, strPSKc='GRLpassWord'): - pass + #TODO: Support the whole Native Commissioner functionality + # Currently it only aims to trigger a Discovery Request message to pass Certification test 5.8.4 + print '%s call startNativeCommissioner' % self.port + self.__sendCommand('ifconfig up') + cmd = 'joiner start %s' %(strPSKc) + print cmd + if self.__sendCommand(cmd)[0] == "Done": + return True + else: + return False def startCollapsedCommissioner(self): """start Collapsed Commissioner @@ -2493,6 +2502,8 @@ class ARM(IThci): def sendBeacons(self, sAddr, xCommissionerSessionId, listChannelMask, xPanId): print '%s call sendBeacons' % self.port + self._sendline('scan') + return True def updateRouterStatus(self): print '%s call updateRouterStatus' % self.port