diff --git a/doc/Doxyfile.in b/doc/Doxyfile.in index 2d4224328..83e400694 100644 --- a/doc/Doxyfile.in +++ b/doc/Doxyfile.in @@ -30,7 +30,7 @@ # Description: # This file describes the settings to be used by the -# documentation system # doxygen (www.doxygen.org) for Weave. +# documentation system # doxygen (www.doxygen.org) for OpenThread. # # This was initially autogenerated 'doxywizard' and then hand-tuned. # diff --git a/src/core/common/message.cpp b/src/core/common/message.cpp index a96b48538..d524b0ce2 100644 --- a/src/core/common/message.cpp +++ b/src/core/common/message.cpp @@ -107,6 +107,7 @@ Message *Message::New(uint8_t aType, uint16_t aReserved) memset(message, 0, sizeof(*message)); message->SetType(aType); message->SetReserved(aReserved); + message->SetLinkSecurityEnabled(true); VerifyOrExit(message->SetLength(0) == kThreadError_None, Message::Free(*message)); @@ -498,14 +499,14 @@ void Message::SetDirectTransmission(void) mInfo.mDirectTx = true; } -bool Message::GetSecurityValid(void) const +bool Message::IsLinkSecurityEnabled(void) const { - return mInfo.mSecurityValid; + return mInfo.mLinkSecurity; } -void Message::SetSecurityValid(bool aSecurityValid) +void Message::SetLinkSecurityEnabled(bool aLinkSecurityEnabled) { - mInfo.mSecurityValid = aSecurityValid; + mInfo.mLinkSecurity = aLinkSecurityEnabled; } uint16_t Message::UpdateChecksum(uint16_t aChecksum, uint16_t aOffset, uint16_t aLength) const diff --git a/src/core/common/message.hpp b/src/core/common/message.hpp index af6d58fa4..c2c03b6d8 100644 --- a/src/core/common/message.hpp +++ b/src/core/common/message.hpp @@ -114,7 +114,7 @@ struct MessageInfo uint8_t mType : 2; ///< Identifies the type of message. bool mDirectTx : 1; ///< Used to indicate whether a direct transmission is required. - bool mSecurityValid : 1; ///< Indicates whether received frames were secure and passed validation. + bool mLinkSecurity : 1; ///< Indicates whether or not link security is enabled. }; /** @@ -425,21 +425,21 @@ public: void SetDirectTransmission(void); /** - * This method indicates whether or not the message was secure and passed validation at the link layer. + * This method indicates whether or not link security is enabled for the message. * - * @retval TRUE If the message was secure and passed validation at the link layer. - * @retval FALSE If the message was not secure or did not pass validation at the link layer. + * @retval TRUE If link security is enabled. + * @retval FALSE If link security is not enabled. * */ - bool GetSecurityValid(void) const; + bool IsLinkSecurityEnabled(void) const; /** - * This method sets whether or not the message was secure and passed validation at the link layer. + * This method sets whether or not link security is enabled for the message. * - * @param[in] aSecurityValid TRUE if the message was secure and passed link layer validation, FALSE otherwise. + * @param[in] aLinkSecurityEnabled TRUE if link security is enabled, FALSE otherwise. * */ - void SetSecurityValid(bool aSecurityValid); + void SetLinkSecurityEnabled(bool aLinkSecurityEnabled); /** * This method is used to update a checksum value. diff --git a/src/core/thread/mesh_forwarder.cpp b/src/core/thread/mesh_forwarder.cpp index 76c918cc8..5326d4b6e 100644 --- a/src/core/thread/mesh_forwarder.cpp +++ b/src/core/thread/mesh_forwarder.cpp @@ -743,8 +743,6 @@ ThreadError MeshForwarder::SendFragment(Message &aMessage, Mac::Frame &aFrame) uint16_t fcf; Lowpan::FragmentHeader *fragmentHeader; Lowpan::MeshHeader *meshHeader; - Ip6::Header ip6Header; - Ip6::UdpHeader udpHeader; uint8_t *payload; int headerLength; int payloadLength; @@ -775,18 +773,9 @@ ThreadError MeshForwarder::SendFragment(Message &aMessage, Mac::Frame &aFrame) fcf |= Mac::Frame::kFcfAckRequest; } - fcf |= Mac::Frame::kFcfSecurityEnabled; - - aMessage.Read(0, sizeof(ip6Header), &ip6Header); - - if (ip6Header.GetNextHeader() == Ip6::kProtoUdp) + if (aMessage.IsLinkSecurityEnabled()) { - aMessage.Read(sizeof(ip6Header), sizeof(udpHeader), &udpHeader); - - if (udpHeader.GetDestinationPort() == Mle::kUdpPort) - { - fcf &= ~Mac::Frame::kFcfSecurityEnabled; - } + fcf |= Mac::Frame::kFcfSecurityEnabled; } aFrame.InitMacHeader(fcf, Mac::Frame::kKeyIdMode1 | Mac::Frame::kSecEncMic32); @@ -1017,7 +1006,7 @@ void MeshForwarder::HandleReceivedFrame(Mac::Frame &aFrame, ThreadError aError) SuccessOrExit(aFrame.GetDstAddr(macDest)); messageInfo.mLinkMargin = aFrame.GetPower() - -100; messageInfo.mLqi = aFrame.GetLqi(); - messageInfo.mSecurityValid = aFrame.GetSecurityValid(); + messageInfo.mLinkSecurity = aFrame.GetSecurityEnabled(); payload = aFrame.GetPayload(); payloadLength = aFrame.GetPayloadLength(); @@ -1069,7 +1058,7 @@ void MeshForwarder::HandleMesh(uint8_t *aFrame, uint8_t aFrameLength, const Thre Lowpan::MeshHeader *meshHeader = reinterpret_cast(aFrame); // Security Check: only process Mesh Header frames that had security enabled. - VerifyOrExit(aMessageInfo.mSecurityValid && meshHeader->IsValid(), error = kThreadError_Drop); + VerifyOrExit(aMessageInfo.mLinkSecurity && meshHeader->IsValid(), error = kThreadError_Drop); meshSource.mLength = sizeof(meshSource.mShortAddress); meshSource.mShortAddress = meshHeader->GetSource(); @@ -1103,7 +1092,7 @@ void MeshForwarder::HandleMesh(uint8_t *aFrame, uint8_t aFrameLength, const Thre VerifyOrExit((message = Message::New(Message::kType6lowpan, 0)) != NULL, error = kThreadError_Drop); SuccessOrExit(error = message->SetLength(aFrameLength)); message->Write(0, aFrameLength, aFrame); - message->SetSecurityValid(aMessageInfo.mSecurityValid); + message->SetLinkSecurityEnabled(aMessageInfo.mLinkSecurity); SendMessage(*message); } @@ -1160,6 +1149,7 @@ void MeshForwarder::HandleFragment(uint8_t *aFrame, uint8_t aFrameLength, aFrameLength -= fragmentHeader->GetHeaderLength(); VerifyOrExit((message = Message::New(Message::kTypeIp6, 0)) != NULL, error = kThreadError_NoBufs); + message->SetLinkSecurityEnabled(aMessageInfo.mLinkSecurity); headerLength = mLowpan.Decompress(*message, aMacSource, aMacDest, aFrame, aFrameLength, datagramLength); VerifyOrExit(headerLength > 0, error = kThreadError_NoBufs); aFrame += headerLength; @@ -1170,7 +1160,6 @@ void MeshForwarder::HandleFragment(uint8_t *aFrame, uint8_t aFrameLength, message->Write(Ip6::Header::GetPayloadLengthOffset(), sizeof(datagramLength), &datagramLength); message->SetDatagramTag(datagramTag); message->SetTimeout(kReassemblyTimeout); - message->SetSecurityValid(aMessageInfo.mSecurityValid); mReassemblyList.Enqueue(*message); @@ -1190,7 +1179,7 @@ void MeshForwarder::HandleFragment(uint8_t *aFrame, uint8_t aFrameLength, if (message->GetLength() == datagramLength && message->GetDatagramTag() == datagramTag && message->GetOffset() == fragmentHeader->GetDatagramOffset() && - message->GetSecurityValid() == aMessageInfo.mSecurityValid) + message->IsLinkSecurityEnabled() == aMessageInfo.mLinkSecurity) { break; } @@ -1260,6 +1249,7 @@ void MeshForwarder::HandleLowpanHC(uint8_t *aFrame, uint8_t aFrameLength, uint16_t ip6PayloadLength; VerifyOrExit((message = Message::New(Message::kTypeIp6, 0)) != NULL, ;); + message->SetLinkSecurityEnabled(aMessageInfo.mLinkSecurity); headerLength = mLowpan.Decompress(*message, aMacSource, aMacDest, aFrame, aFrameLength, 0); VerifyOrExit(headerLength > 0, ;); @@ -1272,7 +1262,6 @@ void MeshForwarder::HandleLowpanHC(uint8_t *aFrame, uint8_t aFrameLength, message->Write(Ip6::Header::GetPayloadLengthOffset(), sizeof(ip6PayloadLength), &ip6PayloadLength); message->Write(message->GetOffset(), aFrameLength, aFrame); - message->SetSecurityValid(aMessageInfo.mSecurityValid); SuccessOrExit(error = HandleDatagram(*message, aMessageInfo)); @@ -1296,7 +1285,7 @@ ThreadError MeshForwarder::HandleDatagram(Message &aMessage, const ThreadMessage // 3) IPv6 Next Header is UDP // 4) Message contains UDP header // 5) UDP Destination Port is the MLE port - VerifyOrExit(aMessage.GetSecurityValid() || + VerifyOrExit(aMessage.IsLinkSecurityEnabled() || (sizeof(ip6) == aMessage.Read(0, sizeof(ip6), &ip6) && (ip6.GetDestination().IsLinkLocal() || ip6.GetDestination().IsLinkLocalMulticast()) && ip6.GetNextHeader() == Ip6::kProtoUdp && @@ -1321,7 +1310,7 @@ void MeshForwarder::HandleDataRequest(const Mac::Address &aMacSource, const Thre int childIndex; // Security Check: only process secure Data Poll frames. - VerifyOrExit(aMessageInfo.mSecurityValid, ;); + VerifyOrExit(aMessageInfo.mLinkSecurity, ;); assert(mMle.GetDeviceState() != Mle::kDeviceStateDetached); diff --git a/src/core/thread/mle.cpp b/src/core/thread/mle.cpp index a3b797432..e4edc9a14 100644 --- a/src/core/thread/mle.cpp +++ b/src/core/thread/mle.cpp @@ -842,6 +842,7 @@ ThreadError Mle::SendParentRequest(void) } VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, Header::kCommandParentRequest)); SuccessOrExit(error = AppendMode(*message, mDeviceMode)); SuccessOrExit(error = AppendChallenge(*message, mParentRequest.mChallenge, sizeof(mParentRequest.mChallenge))); @@ -908,6 +909,7 @@ ThreadError Mle::SendChildIdRequest(void) Ip6::Address destination; VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, Header::kCommandChildIdRequest)); SuccessOrExit(error = AppendResponse(*message, mChildIdRequest.mChallenge, mChildIdRequest.mChallengeLength)); SuccessOrExit(error = AppendLinkFrameCounter(*message)); @@ -951,6 +953,7 @@ ThreadError Mle::SendDataRequest(const Ip6::Address &aDestination, const uint8_t Message *message; VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, Header::kCommandDataRequest)); SuccessOrExit(error = AppendTlvRequest(*message, aTlvs, aTlvsLength)); @@ -976,6 +979,7 @@ ThreadError Mle::SendDataResponse(const Ip6::Address &aDestination, const uint8_ bool stableOnly; VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, Header::kCommandDataResponse)); neighbor = mMleRouter.GetNeighbor(aDestination); @@ -1016,6 +1020,7 @@ ThreadError Mle::SendChildUpdateRequest(void) Message *message; VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, Header::kCommandChildUpdateRequest)); SuccessOrExit(error = AppendMode(*message, mDeviceMode)); diff --git a/src/core/thread/mle_router.cpp b/src/core/thread/mle_router.cpp index 854417164..9ba0caf8a 100644 --- a/src/core/thread/mle_router.cpp +++ b/src/core/thread/mle_router.cpp @@ -426,6 +426,7 @@ ThreadError MleRouter::SendAdvertisement(void) Message *message; VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, Header::kCommandAdvertisement)); SuccessOrExit(error = AppendSourceAddress(*message)); SuccessOrExit(error = AppendLeaderData(*message)); @@ -474,6 +475,7 @@ ThreadError MleRouter::SendLinkRequest(Neighbor *aNeighbor) memset(&destination, 0, sizeof(destination)); VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, Header::kCommandLinkRequest)); SuccessOrExit(error = AppendVersion(*message)); @@ -639,6 +641,7 @@ ThreadError MleRouter::SendLinkAccept(const Ip6::MessageInfo &aMessageInfo, Neig Header::kCommandLinkAccept : Header::kCommandLinkAcceptAndRequest; VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, command)); SuccessOrExit(error = AppendVersion(*message)); SuccessOrExit(error = AppendSourceAddress(*message)); @@ -910,6 +913,7 @@ ThreadError MleRouter::SendLinkReject(const Ip6::Address &aDestination) Message *message; VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, Header::kCommandLinkReject)); SuccessOrExit(error = AppendStatus(*message, StatusTlv::kError)); @@ -1506,6 +1510,7 @@ ThreadError MleRouter::SendParentResponse(Child *aChild, const ChallengeTlv &cha Message *message; VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, Header::kCommandParentResponse)); SuccessOrExit(error = AppendSourceAddress(*message)); SuccessOrExit(error = AppendLeaderData(*message)); @@ -1803,6 +1808,7 @@ ThreadError MleRouter::SendChildIdResponse(Child *aChild) Message *message; VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, Header::kCommandChildIdResponse)); SuccessOrExit(error = AppendSourceAddress(*message)); SuccessOrExit(error = AppendLeaderData(*message)); @@ -1864,6 +1870,7 @@ ThreadError MleRouter::SendChildUpdateResponse(Child *aChild, const Ip6::Message Message *message; VerifyOrExit((message = Ip6::Udp::NewMessage(0)) != NULL, ;); + message->SetLinkSecurityEnabled(false); SuccessOrExit(error = AppendHeader(*message, Header::kCommandChildUpdateResponse)); for (int i = 0; i < aTlvslength; i++) diff --git a/src/core/thread/thread_netif.hpp b/src/core/thread/thread_netif.hpp index c12f77e7d..e362d32ff 100644 --- a/src/core/thread/thread_netif.hpp +++ b/src/core/thread/thread_netif.hpp @@ -215,9 +215,9 @@ private: */ struct ThreadMessageInfo { - uint8_t mLinkMargin; ///< The Link Margin for a received message in dB. - uint8_t mLqi; ///< The Link Quality Indicator for a received message. - bool mSecurityValid; ///< Link security on all received frames was enabled and passed validation. + uint8_t mLinkMargin; ///< The Link Margin for a received message in dB. + uint8_t mLqi; ///< The Link Quality Indicator for a received message. + bool mLinkSecurity; ///< Indicates whether or not link security is enabled. }; /** diff --git a/src/ncp/ncp_base.cpp b/src/ncp/ncp_base.cpp index 78442cd11..2052c7ebf 100644 --- a/src/ncp/ncp_base.cpp +++ b/src/ncp/ncp_base.cpp @@ -258,7 +258,7 @@ void NcpBase::HandleDatagramFromStack(Message &message) "CiiS", SPINEL_HEADER_FLAG | SPINEL_HEADER_IID_0, SPINEL_CMD_PROP_VALUE_IS, - message.GetSecurityValid() + message.IsLinkSecurityEnabled() ? SPINEL_PROP_STREAM_NET : SPINEL_PROP_STREAM_NET_INSECURE, message.GetLength() @@ -2164,7 +2164,7 @@ void NcpBase::SetPropertyHandler_STREAM_NET_INSECURE(uint8_t header, spinel_prop else { // STREAM_NET_INSECURE packets are not secured at layer 2. - message->SetSecurityValid(false); + message->SetLinkSecurityEnabled(false); parsedLength = spinel_datatype_unpack( value_ptr, @@ -2222,7 +2222,7 @@ void NcpBase::SetPropertyHandler_STREAM_NET(uint8_t header, spinel_prop_key_t ke else { // STREAM_NET requires layer 2 security. - message->SetSecurityValid(true); + message->SetLinkSecurityEnabled(true); parsedLength = spinel_datatype_unpack( value_ptr,