espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-11 13:17:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use message link security attribute to also control link security on transmission. (#111)

Browse Source
This commit is contained in:
Jonathan Hui
2016-06-06 15:33:58 -07:00
parent cd6f0d239f
commit c1d425b918
8 changed files with 42 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/Doxyfile.in
+1 -1
View File
@@ -30,7 +30,7 @@
# Description:
# This file describes the settings to be used by the
# documentation system # doxygen (www.doxygen.org) for Weave.
# documentation system # doxygen (www.doxygen.org) for OpenThread.
#
# This was initially autogenerated 'doxywizard' and then hand-tuned.
#
src/core/common/message.cpp
+5 -4
View File
@@ -107,6 +107,7 @@ Message *Message::New(uint8_t aType, uint16_t aReserved)
memset(message, 0, sizeof(*message));
message->SetType(aType);
message->SetReserved(aReserved);
message->SetLinkSecurityEnabled(true);
VerifyOrExit(message->SetLength(0) == kThreadError_None, Message::Free(*message));
@@ -498,14 +499,14 @@ void Message::SetDirectTransmission(void)
mInfo.mDirectTx = true;
}
bool Message::GetSecurityValid(void) const
bool Message::IsLinkSecurityEnabled(void) const
{
return mInfo.mSecurityValid;
return mInfo.mLinkSecurity;
}
void Message::SetSecurityValid(bool aSecurityValid)
void Message::SetLinkSecurityEnabled(bool aLinkSecurityEnabled)
{
mInfo.mSecurityValid = aSecurityValid;
mInfo.mLinkSecurity = aLinkSecurityEnabled;
}
uint16_t Message::UpdateChecksum(uint16_t aChecksum, uint16_t aOffset, uint16_t aLength) const
src/core/common/message.hpp
+8 -8
View File
@@ -114,7 +114,7 @@ struct MessageInfo
uint8_t mType : 2; ///< Identifies the type of message.
bool mDirectTx : 1; ///< Used to indicate whether a direct transmission is required.
bool mSecurityValid : 1; ///< Indicates whether received frames were secure and passed validation.
bool mLinkSecurity : 1; ///< Indicates whether or not link security is enabled.
};
/**
@@ -425,21 +425,21 @@ public:
void SetDirectTransmission(void);
/**
* This method indicates whether or not the message was secure and passed validation at the link layer.
* This method indicates whether or not link security is enabled for the message.
*
* @retval TRUE If the message was secure and passed validation at the link layer.
* @retval FALSE If the message was not secure or did not pass validation at the link layer.
* @retval TRUE If link security is enabled.
* @retval FALSE If link security is not enabled.
*
*/
bool GetSecurityValid(void) const;
bool IsLinkSecurityEnabled(void) const;
/**
* This method sets whether or not the message was secure and passed validation at the link layer.
* This method sets whether or not link security is enabled for the message.
*
* @param[in] aSecurityValid TRUE if the message was secure and passed link layer validation, FALSE otherwise.
* @param[in] aLinkSecurityEnabled TRUE if link security is enabled, FALSE otherwise.
*
*/
void SetSecurityValid(bool aSecurityValid);
void SetLinkSecurityEnabled(bool aLinkSecurityEnabled);
/**
* This method is used to update a checksum value.
src/core/thread/mesh_forwarder.cpp
+10 -21
View File
@@ -743,8 +743,6 @@ ThreadError MeshForwarder::SendFragment(Message &aMessage, Mac::Frame &aFrame)
uint16_t fcf;
Lowpan::FragmentHeader *fragmentHeader;
Lowpan::MeshHeader *meshHeader;
Ip6::Header ip6Header;
Ip6::UdpHeader udpHeader;
uint8_t *payload;
int headerLength;
int payloadLength;
@@ -775,18 +773,9 @@ ThreadError MeshForwarder::SendFragment(Message &aMessage, Mac::Frame &aFrame)
fcf |= Mac::Frame::kFcfAckRequest;
}
fcf |= Mac::Frame::kFcfSecurityEnabled;
aMessage.Read(0, sizeof(ip6Header), &ip6Header);
if (ip6Header.GetNextHeader() == Ip6::kProtoUdp)
if (aMessage.IsLinkSecurityEnabled())
{
aMessage.Read(sizeof(ip6Header), sizeof(udpHeader), &udpHeader);
if (udpHeader.GetDestinationPort() == Mle::kUdpPort)
{
fcf &= ~Mac::Frame::kFcfSecurityEnabled;
}
fcf |= Mac::Frame::kFcfSecurityEnabled;
}
aFrame.InitMacHeader(fcf, Mac::Frame::kKeyIdMode1 | Mac::Frame::kSecEncMic32);
@@ -1017,7 +1006,7 @@ void MeshForwarder::HandleReceivedFrame(Mac::Frame &aFrame, ThreadError aError)
SuccessOrExit(aFrame.GetDstAddr(macDest));
messageInfo.mLinkMargin = aFrame.GetPower() - -100;
messageInfo.mLqi = aFrame.GetLqi();
messageInfo.mSecurityValid = aFrame.GetSecurityValid();
messageInfo.mLinkSecurity = aFrame.GetSecurityEnabled();
payload = aFrame.GetPayload();
payloadLength = aFrame.GetPayloadLength();
@@ -1069,7 +1058,7 @@ void MeshForwarder::HandleMesh(uint8_t *aFrame, uint8_t aFrameLength, const Thre
Lowpan::MeshHeader *meshHeader = reinterpret_cast<Lowpan::MeshHeader *>(aFrame);
// Security Check: only process Mesh Header frames that had security enabled.
VerifyOrExit(aMessageInfo.mSecurityValid && meshHeader->IsValid(), error = kThreadError_Drop);
VerifyOrExit(aMessageInfo.mLinkSecurity && meshHeader->IsValid(), error = kThreadError_Drop);
meshSource.mLength = sizeof(meshSource.mShortAddress);
meshSource.mShortAddress = meshHeader->GetSource();
@@ -1103,7 +1092,7 @@ void MeshForwarder::HandleMesh(uint8_t *aFrame, uint8_t aFrameLength, const Thre
VerifyOrExit((message = Message::New(Message::kType6lowpan, 0)) != NULL, error = kThreadError_Drop);
SuccessOrExit(error = message->SetLength(aFrameLength));
message->Write(0, aFrameLength, aFrame);
message->SetSecurityValid(aMessageInfo.mSecurityValid);
message->SetLinkSecurityEnabled(aMessageInfo.mLinkSecurity);
SendMessage(*message);
}
@@ -1160,6 +1149,7 @@ void MeshForwarder::HandleFragment(uint8_t *aFrame, uint8_t aFrameLength,
aFrameLength -= fragmentHeader->GetHeaderLength();
VerifyOrExit((message = Message::New(Message::kTypeIp6, 0)) != NULL, error = kThreadError_NoBufs);
message->SetLinkSecurityEnabled(aMessageInfo.mLinkSecurity);
headerLength = mLowpan.Decompress(*message, aMacSource, aMacDest, aFrame, aFrameLength, datagramLength);
VerifyOrExit(headerLength > 0, error = kThreadError_NoBufs);
aFrame += headerLength;
@@ -1170,7 +1160,6 @@ void MeshForwarder::HandleFragment(uint8_t *aFrame, uint8_t aFrameLength,
message->Write(Ip6::Header::GetPayloadLengthOffset(), sizeof(datagramLength), &datagramLength);
message->SetDatagramTag(datagramTag);
message->SetTimeout(kReassemblyTimeout);
message->SetSecurityValid(aMessageInfo.mSecurityValid);
mReassemblyList.Enqueue(*message);
@@ -1190,7 +1179,7 @@ void MeshForwarder::HandleFragment(uint8_t *aFrame, uint8_t aFrameLength,
if (message->GetLength() == datagramLength &&
message->GetDatagramTag() == datagramTag &&
message->GetOffset() == fragmentHeader->GetDatagramOffset() &&
message->GetSecurityValid() == aMessageInfo.mSecurityValid)
message->IsLinkSecurityEnabled() == aMessageInfo.mLinkSecurity)
{
break;
}
@@ -1260,6 +1249,7 @@ void MeshForwarder::HandleLowpanHC(uint8_t *aFrame, uint8_t aFrameLength,
uint16_t ip6PayloadLength;
VerifyOrExit((message = Message::New(Message::kTypeIp6, 0)) != NULL, ;);
message->SetLinkSecurityEnabled(aMessageInfo.mLinkSecurity);
headerLength = mLowpan.Decompress(*message, aMacSource, aMacDest, aFrame, aFrameLength, 0);
VerifyOrExit(headerLength > 0, ;);
@@ -1272,7 +1262,6 @@ void MeshForwarder::HandleLowpanHC(uint8_t *aFrame, uint8_t aFrameLength,
message->Write(Ip6::Header::GetPayloadLengthOffset(), sizeof(ip6PayloadLength), &ip6PayloadLength);
message->Write(message->GetOffset(), aFrameLength, aFrame);
message->SetSecurityValid(aMessageInfo.mSecurityValid);
SuccessOrExit(error = HandleDatagram(*message, aMessageInfo));
@@ -1296,7 +1285,7 @@ ThreadError MeshForwarder::HandleDatagram(Message &aMessage, const ThreadMessage
// 3) IPv6 Next Header is UDP
// 4) Message contains UDP header
// 5) UDP Destination Port is the MLE port
VerifyOrExit(aMessage.GetSecurityValid() ||
VerifyOrExit(aMessage.IsLinkSecurityEnabled() ||
(sizeof(ip6) == aMessage.Read(0, sizeof(ip6), &ip6) &&
(ip6.GetDestination().IsLinkLocal() || ip6.GetDestination().IsLinkLocalMulticast()) &&
ip6.GetNextHeader() == Ip6::kProtoUdp &&
@@ -1321,7 +1310,7 @@ void MeshForwarder::HandleDataRequest(const Mac::Address &aMacSource, const Thre
int childIndex;
// Security Check: only process secure Data Poll frames.
VerifyOrExit(aMessageInfo.mSecurityValid, ;);
VerifyOrExit(aMessageInfo.mLinkSecurity, ;);
assert(mMle.GetDeviceState() != Mle::kDeviceStateDetached);
src/core/thread/mle.cpp
+5
View File
@@ -842,6 +842,7 @@ ThreadError Mle::SendParentRequest(void)
}
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, Header::kCommandParentRequest));
SuccessOrExit(error = AppendMode(*message, mDeviceMode));
SuccessOrExit(error = AppendChallenge(*message, mParentRequest.mChallenge, sizeof(mParentRequest.mChallenge)));
@@ -908,6 +909,7 @@ ThreadError Mle::SendChildIdRequest(void)
Ip6::Address destination;
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, Header::kCommandChildIdRequest));
SuccessOrExit(error = AppendResponse(*message, mChildIdRequest.mChallenge, mChildIdRequest.mChallengeLength));
SuccessOrExit(error = AppendLinkFrameCounter(*message));
@@ -951,6 +953,7 @@ ThreadError Mle::SendDataRequest(const Ip6::Address &aDestination, const uint8_t
Message *message;
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, Header::kCommandDataRequest));
SuccessOrExit(error = AppendTlvRequest(*message, aTlvs, aTlvsLength));
@@ -976,6 +979,7 @@ ThreadError Mle::SendDataResponse(const Ip6::Address &aDestination, const uint8_
bool stableOnly;
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, Header::kCommandDataResponse));
neighbor = mMleRouter.GetNeighbor(aDestination);
@@ -1016,6 +1020,7 @@ ThreadError Mle::SendChildUpdateRequest(void)
Message *message;
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, Header::kCommandChildUpdateRequest));
SuccessOrExit(error = AppendMode(*message, mDeviceMode));
src/core/thread/mle_router.cpp
+7
View File
@@ -426,6 +426,7 @@ ThreadError MleRouter::SendAdvertisement(void)
Message *message;
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, Header::kCommandAdvertisement));
SuccessOrExit(error = AppendSourceAddress(*message));
SuccessOrExit(error = AppendLeaderData(*message));
@@ -474,6 +475,7 @@ ThreadError MleRouter::SendLinkRequest(Neighbor *aNeighbor)
memset(&destination, 0, sizeof(destination));
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, Header::kCommandLinkRequest));
SuccessOrExit(error = AppendVersion(*message));
@@ -639,6 +641,7 @@ ThreadError MleRouter::SendLinkAccept(const Ip6::MessageInfo &aMessageInfo, Neig
Header::kCommandLinkAccept : Header::kCommandLinkAcceptAndRequest;
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, command));
SuccessOrExit(error = AppendVersion(*message));
SuccessOrExit(error = AppendSourceAddress(*message));
@@ -910,6 +913,7 @@ ThreadError MleRouter::SendLinkReject(const Ip6::Address &aDestination)
Message *message;
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, Header::kCommandLinkReject));
SuccessOrExit(error = AppendStatus(*message, StatusTlv::kError));
@@ -1506,6 +1510,7 @@ ThreadError MleRouter::SendParentResponse(Child *aChild, const ChallengeTlv &cha
Message *message;
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, Header::kCommandParentResponse));
SuccessOrExit(error = AppendSourceAddress(*message));
SuccessOrExit(error = AppendLeaderData(*message));
@@ -1803,6 +1808,7 @@ ThreadError MleRouter::SendChildIdResponse(Child *aChild)
Message *message;
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, Header::kCommandChildIdResponse));
SuccessOrExit(error = AppendSourceAddress(*message));
SuccessOrExit(error = AppendLeaderData(*message));
@@ -1864,6 +1870,7 @@ ThreadError MleRouter::SendChildUpdateResponse(Child *aChild, const Ip6::Message
Message *message;
VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;);
message->SetLinkSecurityEnabled(false);
SuccessOrExit(error = AppendHeader(*message, Header::kCommandChildUpdateResponse));
for (int i = 0; i < aTlvslength; i++)
src/core/thread/thread_netif.hpp
+3 -3
View File
@@ -215,9 +215,9 @@ private:
*/
struct ThreadMessageInfo
{
uint8_t mLinkMargin; ///< The Link Margin for a received message in dB.
uint8_t mLqi; ///< The Link Quality Indicator for a received message.
bool mSecurityValid; ///< Link security on all received frames was enabled and passed validation.
uint8_t mLinkMargin; ///< The Link Margin for a received message in dB.
uint8_t mLqi; ///< The Link Quality Indicator for a received message.
bool mLinkSecurity; ///< Indicates whether or not link security is enabled.
};
/**
src/ncp/ncp_base.cpp
+3 -3
View File
@@ -258,7 +258,7 @@ void NcpBase::HandleDatagramFromStack(Message &message)
"CiiS",
SPINEL_HEADER_FLAG | SPINEL_HEADER_IID_0,
SPINEL_CMD_PROP_VALUE_IS,
message.GetSecurityValid()
message.IsLinkSecurityEnabled()
? SPINEL_PROP_STREAM_NET
: SPINEL_PROP_STREAM_NET_INSECURE,
message.GetLength()
@@ -2164,7 +2164,7 @@ void NcpBase::SetPropertyHandler_STREAM_NET_INSECURE(uint8_t header, spinel_prop
else
{
// STREAM_NET_INSECURE packets are not secured at layer 2.
message->SetSecurityValid(false);
message->SetLinkSecurityEnabled(false);
parsedLength = spinel_datatype_unpack(
value_ptr,
@@ -2222,7 +2222,7 @@ void NcpBase::SetPropertyHandler_STREAM_NET(uint8_t header, spinel_prop_key_t ke
else
{
// STREAM_NET requires layer 2 security.
message->SetSecurityValid(true);
message->SetLinkSecurityEnabled(true);
parsedLength = spinel_datatype_unpack(
value_ptr,