1
1
From 48ef50fa866aae087f63c7de8a47e76537f88691 Mon Sep 17 00:00:00 2001
2
+
2
3
From: Era Mayflower <
[email protected] >
3
- Date: Mon, 9 Mar 2020 19:47:02 +0000
4
+
4
5
Subject: [PATCH] macsec: Netlink support of XPN cipher suites (IEEE 802.1AEbw)
5
6
6
7
Netlink support of extended packet number cipher suites,
@@ -25,16 +26,25 @@ Depends on: macsec: Support XPN frame handling - IEEE 802.1AEbw.
25
26
Signed-off-by: Era Mayflower <
[email protected] >
26
27
Signed-off-by: David S. Miller <
[email protected] >
27
28
---
28
- drivers/net/macsec.c | 161 ++++++++++++++++++++++++++++++---
29
- include/net/macsec.h | 3 +
30
- include/uapi/linux/if_macsec.h | 8 +-
31
- 3 files changed, 157 insertions(+), 15 deletions(-)
29
+ drivers/net/macsec.c | 164 +++++++++++++++++++++++++++++++++++++---
30
+ include/uapi/linux/if_macsec.h | 8 +-
31
+ 2 files changed, 157 insertions(+), 15 deletions(-)
32
32
33
33
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
34
- index 6c71e250cccb..49b138e7aeac 100644
34
+ index a41a6cd78..0b86908b9 100644
35
35
--- a/drivers/net/macsec.c
36
36
+++ b/drivers/net/macsec.c
37
- @@ -240,11 +240,13 @@ static struct macsec_cb *macsec_skb_cb(struct sk_buff *skb)
37
+ @@ -25,6 +25,9 @@
38
+
39
+ #include <uapi/linux/if_macsec.h>
40
+
41
+ + #define MACSEC_DEFAULT_PN_LEN 4
42
+ + #define MACSEC_XPN_PN_LEN 8
43
+ +
44
+ #define MACSEC_SALT_LEN 12
45
+ #define MACSEC_NUM_AN 4 /* 2 bits for the association number */
46
+
47
+ @@ -444,11 +447,13 @@ static struct macsec_cb *macsec_skb_cb(struct sk_buff *skb)
38
48
#define MACSEC_PORT_ES (htons(0x0001))
39
49
#define MACSEC_PORT_SCB (0x0000)
40
50
#define MACSEC_UNDEF_SCI ((__force sci_t)0xffffffffffffffffULL)
@@ -48,23 +58,23 @@ index 6c71e250cccb..49b138e7aeac 100644
48
58
#define DEFAULT_SEND_SCI true
49
59
#define DEFAULT_ENCRYPT false
50
60
#define DEFAULT_ENCODING_SA 0
51
- @@ -1311 ,6 +1313 ,7 @@ static int init_rx_sa(struct macsec_rx_sa *rx_sa, char *sak, int key_len,
61
+ @@ -1438 ,6 +1443 ,7 @@ static int init_rx_sa(struct macsec_rx_sa *rx_sa, char *sak, int key_len,
52
62
return PTR_ERR(rx_sa->key.tfm);
53
63
}
54
64
55
65
+ rx_sa->ssci = MACSEC_UNDEF_SSCI;
56
66
rx_sa->active = false;
57
67
rx_sa->next_pn = 1;
58
68
refcount_set(&rx_sa->refcnt, 1);
59
- @@ -1409 ,6 +1412 ,7 @@ static int init_tx_sa(struct macsec_tx_sa *tx_sa, char *sak, int key_len,
69
+ @@ -1536 ,6 +1542 ,7 @@ static int init_tx_sa(struct macsec_tx_sa *tx_sa, char *sak, int key_len,
60
70
return PTR_ERR(tx_sa->key.tfm);
61
71
}
62
72
63
73
+ tx_sa->ssci = MACSEC_UNDEF_SSCI;
64
74
tx_sa->active = false;
65
75
refcount_set(&tx_sa->refcnt, 1);
66
76
spin_lock_init(&tx_sa->lock);
67
- @@ -1452 ,6 +1456 ,16 @@ static int nla_put_sci(struct sk_buff *skb, int attrtype, sci_t value,
77
+ @@ -1579 ,6 +1586 ,16 @@ static int nla_put_sci(struct sk_buff *skb, int attrtype, sci_t value,
68
78
return nla_put_u64_64bit(skb, attrtype, (__force u64)value, padattr);
69
79
}
70
80
@@ -81,7 +91,7 @@ index 6c71e250cccb..49b138e7aeac 100644
81
91
static struct macsec_tx_sa *get_txsa_from_nl(struct net *net,
82
92
struct nlattr **attrs,
83
93
struct nlattr **tb_sa,
84
- @@ -1567 ,11 +1581 ,14 @@ static const struct nla_policy macsec_genl_rxsc_policy[NUM_MACSEC_RXSC_ATTR] = {
94
+ @@ -1694 ,11 +1711 ,14 @@ static const struct nla_policy macsec_genl_rxsc_policy[NUM_MACSEC_RXSC_ATTR] = {
85
95
static const struct nla_policy macsec_genl_sa_policy[NUM_MACSEC_SA_ATTR] = {
86
96
[MACSEC_SA_ATTR_AN] = { .type = NLA_U8 },
87
97
[MACSEC_SA_ATTR_ACTIVE] = { .type = NLA_U8 },
@@ -96,8 +106,8 @@ index 6c71e250cccb..49b138e7aeac 100644
96
106
+ .len = MACSEC_SALT_LEN, },
97
107
};
98
108
99
- static const struct nla_policy macsec_genl_offload_policy[NUM_MACSEC_OFFLOAD_ATTR] = {
100
- @@ -1644 ,7 +1661 ,8 @@ static bool validate_add_rxsa(struct nlattr **attrs)
109
+ static int parse_sa_config( struct nlattr **attrs, struct nlattr **tb_sa)
110
+ @@ -1737 ,7 +1757 ,8 @@ static bool validate_add_rxsa(struct nlattr **attrs)
101
111
if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN)
102
112
return false;
103
113
@@ -107,15 +117,15 @@ index 6c71e250cccb..49b138e7aeac 100644
107
117
return false;
108
118
109
119
if (attrs[MACSEC_SA_ATTR_ACTIVE]) {
110
- @@ -1666 ,6 +1684 ,7 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
120
+ @@ -1759 ,6 +1780 ,7 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
111
121
struct macsec_rx_sc *rx_sc;
112
122
struct macsec_rx_sa *rx_sa;
113
123
unsigned char assoc_num;
114
124
+ int pn_len;
115
125
struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
116
126
struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
117
127
int err;
118
- @@ -1698 ,6 +1717 ,29 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
128
+ @@ -1791 ,6 +1813 ,29 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
119
129
return -EINVAL;
120
130
}
121
131
@@ -145,7 +155,7 @@ index 6c71e250cccb..49b138e7aeac 100644
145
155
rx_sa = rtnl_dereference(rx_sc->sa[assoc_num]);
146
156
if (rx_sa) {
147
157
rtnl_unlock();
148
- @@ -1720,7 +1762,7 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
158
+ @@ -1813,13 +1858,19 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
149
159
150
160
if (tb_sa[MACSEC_SA_ATTR_PN]) {
151
161
spin_lock_bh(&rx_sa->lock);
@@ -154,9 +164,8 @@ index 6c71e250cccb..49b138e7aeac 100644
154
164
spin_unlock_bh(&rx_sa->lock);
155
165
}
156
166
157
- @@ -1750,6 +1792,12 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
158
- goto cleanup;
159
- }
167
+ if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
168
+ rx_sa->active = !!nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]);
160
169
161
170
+ if (secy->xpn) {
162
171
+ rx_sa->ssci = nla_get_ssci(tb_sa[MACSEC_SA_ATTR_SSCI]);
@@ -165,17 +174,17 @@ index 6c71e250cccb..49b138e7aeac 100644
165
174
+ }
166
175
+
167
176
nla_memcpy(rx_sa->key.id, tb_sa[MACSEC_SA_ATTR_KEYID], MACSEC_KEYID_LEN);
177
+ rx_sa->sc = rx_sc;
168
178
rcu_assign_pointer(rx_sc->sa[assoc_num], rx_sa);
169
-
170
- @@ -1874,6 +1922,7 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
179
+ @@ -1915,6 +1966,7 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
171
180
struct macsec_tx_sc *tx_sc;
172
181
struct macsec_tx_sa *tx_sa;
173
182
unsigned char assoc_num;
174
183
+ int pn_len;
175
184
struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
176
- bool was_operational;
177
185
int err;
178
- @@ -1906,6 +1955,29 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
186
+
187
+ @@ -1946,6 +1998,29 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
179
188
return -EINVAL;
180
189
}
181
190
@@ -205,17 +214,8 @@ index 6c71e250cccb..49b138e7aeac 100644
205
214
tx_sa = rtnl_dereference(tx_sc->sa[assoc_num]);
206
215
if (tx_sa) {
207
216
rtnl_unlock();
208
- @@ -1927,7 +1999,7 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
209
- }
210
-
211
- spin_lock_bh(&tx_sa->lock);
212
- - tx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
213
- + tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
214
- spin_unlock_bh(&tx_sa->lock);
215
-
216
- if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
217
- @@ -1958,6 +2030,12 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
218
- goto cleanup;
217
+ @@ -1966,10 +2041,16 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
218
+ return err;
219
219
}
220
220
221
221
+ if (secy->xpn) {
@@ -225,9 +225,14 @@ index 6c71e250cccb..49b138e7aeac 100644
225
225
+ }
226
226
+
227
227
nla_memcpy(tx_sa->key.id, tb_sa[MACSEC_SA_ATTR_KEYID], MACSEC_KEYID_LEN);
228
- rcu_assign_pointer(tx_sc->sa[assoc_num], tx_sa);
229
228
230
- @@ -2164,7 +2242,9 @@ static bool validate_upd_sa(struct nlattr **attrs)
229
+ spin_lock_bh(&tx_sa->lock);
230
+ - tx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
231
+ + tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
232
+ spin_unlock_bh(&tx_sa->lock);
233
+
234
+ if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
235
+ @@ -2107,7 +2188,9 @@ static bool validate_upd_sa(struct nlattr **attrs)
231
236
{
232
237
if (!attrs[MACSEC_SA_ATTR_AN] ||
233
238
attrs[MACSEC_SA_ATTR_KEY] ||
@@ -238,7 +243,7 @@ index 6c71e250cccb..49b138e7aeac 100644
238
243
return false;
239
244
240
245
if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN)
241
- @@ -2214,9 +2294,19 @@ static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info)
246
+ @@ -2152,8 +2235,18 @@ static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info)
242
247
}
243
248
244
249
if (tb_sa[MACSEC_SA_ATTR_PN]) {
@@ -253,13 +258,12 @@ index 6c71e250cccb..49b138e7aeac 100644
253
258
+ }
254
259
+
255
260
spin_lock_bh(&tx_sa->lock);
256
- prev_pn = tx_sa->next_pn_halves;
257
261
- tx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
258
262
+ tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
259
263
spin_unlock_bh(&tx_sa->lock);
260
264
}
261
265
262
- @@ -2300,9 +2390,19 @@ static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info)
266
+ @@ -2200,8 +2293,18 @@ static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info)
263
267
}
264
268
265
269
if (tb_sa[MACSEC_SA_ATTR_PN]) {
@@ -274,13 +278,12 @@ index 6c71e250cccb..49b138e7aeac 100644
274
278
+ }
275
279
+
276
280
spin_lock_bh(&rx_sa->lock);
277
- prev_pn = rx_sa->next_pn_halves;
278
281
- rx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
279
282
+ rx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
280
283
spin_unlock_bh(&rx_sa->lock);
281
284
}
282
285
283
- @@ -2749 ,10 +2849 ,10 @@ static int nla_put_secy(struct macsec_secy *secy, struct sk_buff *skb)
286
+ @@ -2467 ,10 +2570 ,10 @@ static int nla_put_secy(struct macsec_secy *secy, struct sk_buff *skb)
284
287
285
288
switch (secy->key_len) {
286
289
case MACSEC_GCM_AES_128_SAK_LEN:
@@ -293,7 +296,7 @@ index 6c71e250cccb..49b138e7aeac 100644
293
296
break;
294
297
default:
295
298
goto cancel;
296
- @@ -2843 ,6 +2943 ,8 @@ dump_secy(struct macsec_secy *secy, struct net_device *dev,
299
+ @@ -2552 ,6 +2655 ,8 @@ static int dump_secy(struct macsec_secy *secy, struct net_device *dev,
297
300
for (i = 0, j = 1; i < MACSEC_NUM_AN; i++) {
298
301
struct macsec_tx_sa *tx_sa = rtnl_dereference(tx_sc->sa[i]);
299
302
struct nlattr *txsa_nest;
@@ -302,7 +305,7 @@ index 6c71e250cccb..49b138e7aeac 100644
302
305
303
306
if (!tx_sa)
304
307
continue;
305
- @@ -2853 ,9 +2955 ,18 @@ dump_secy(struct macsec_secy *secy, struct net_device *dev,
308
+ @@ -2562 ,9 +2667 ,18 @@ static int dump_secy(struct macsec_secy *secy, struct net_device *dev,
306
309
goto nla_put_failure;
307
310
}
308
311
@@ -322,7 +325,7 @@ index 6c71e250cccb..49b138e7aeac 100644
322
325
nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, tx_sa->active)) {
323
326
nla_nest_cancel(skb, txsa_nest);
324
327
nla_nest_cancel(skb, txsa_list);
325
- @@ -2928 ,6 +3039 ,8 @@ dump_secy(struct macsec_secy *secy, struct net_device *dev,
328
+ @@ -2636 ,6 +2750 ,8 @@ static int dump_secy(struct macsec_secy *secy, struct net_device *dev,
326
329
for (i = 0, k = 1; i < MACSEC_NUM_AN; i++) {
327
330
struct macsec_rx_sa *rx_sa = rtnl_dereference(rx_sc->sa[i]);
328
331
struct nlattr *rxsa_nest;
@@ -331,7 +334,7 @@ index 6c71e250cccb..49b138e7aeac 100644
331
334
332
335
if (!rx_sa)
333
336
continue;
334
- @@ -2957 ,9 +3070 ,18 @@ dump_secy(struct macsec_secy *secy, struct net_device *dev,
337
+ @@ -2664 ,9 +2780 ,18 @@ static int dump_secy(struct macsec_secy *secy, struct net_device *dev,
335
338
}
336
339
nla_nest_end(skb, attr);
337
340
@@ -351,7 +354,7 @@ index 6c71e250cccb..49b138e7aeac 100644
351
354
nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, rx_sa->active)) {
352
355
nla_nest_cancel(skb, rxsa_nest);
353
356
nla_nest_cancel(skb, rxsc_nest);
354
- @@ -3503 ,9 +3625 ,19 @@ static int macsec_changelink_common(struct net_device *dev,
357
+ @@ -3173 ,9 +3298 ,19 @@ static int macsec_changelink_common(struct net_device *dev,
355
358
case MACSEC_CIPHER_ID_GCM_AES_128:
356
359
case MACSEC_DEFAULT_CIPHER_ID:
357
360
secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;
@@ -371,15 +374,15 @@ index 6c71e250cccb..49b138e7aeac 100644
371
374
break;
372
375
default:
373
376
return -EINVAL;
374
- @@ -3695 ,6 +3827 ,7 @@ static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len)
377
+ @@ -3314 ,6 +3449 ,7 @@ static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len)
375
378
secy->validate_frames = MACSEC_VALIDATE_DEFAULT;
376
379
secy->protect_frames = true;
377
380
secy->replay_protect = false;
378
381
+ secy->xpn = DEFAULT_XPN;
379
382
380
383
secy->sci = sci;
381
384
secy->tx_sc.active = true;
382
- @@ -3824 ,6 +3957 ,8 @@ static int macsec_validate_attr(struct nlattr *tb[], struct nlattr *data[],
385
+ @@ -3448 ,6 +3584 ,8 @@ static int macsec_validate_attr(struct nlattr *tb[], struct nlattr *data[],
383
386
switch (csid) {
384
387
case MACSEC_CIPHER_ID_GCM_AES_128:
385
388
case MACSEC_CIPHER_ID_GCM_AES_256:
@@ -388,7 +391,7 @@ index 6c71e250cccb..49b138e7aeac 100644
388
391
case MACSEC_DEFAULT_CIPHER_ID:
389
392
if (icv_len < MACSEC_MIN_ICV_LEN ||
390
393
icv_len > MACSEC_STD_ICV_LEN)
391
- @@ -3897 ,10 +4032 ,10 @@ static int macsec_fill_info(struct sk_buff *skb,
394
+ @@ -3521 ,10 +3659 ,10 @@ static int macsec_fill_info(struct sk_buff *skb,
392
395
393
396
switch (secy->key_len) {
394
397
case MACSEC_GCM_AES_128_SAK_LEN:
@@ -401,22 +404,8 @@ index 6c71e250cccb..49b138e7aeac 100644
401
404
break;
402
405
default:
403
406
goto nla_put_failure;
404
- diff --git a/include/net/macsec.h b/include/net/macsec.h
405
- index 43cd54e17877..2e4780dbf5c6 100644
406
- --- a/include/net/macsec.h
407
- +++ b/include/net/macsec.h
408
- @@ -11,6 +11,9 @@
409
- #include <uapi/linux/if_link.h>
410
- #include <uapi/linux/if_macsec.h>
411
-
412
- + #define MACSEC_DEFAULT_PN_LEN 4
413
- + #define MACSEC_XPN_PN_LEN 8
414
- +
415
- #define MACSEC_SALT_LEN 12
416
- #define MACSEC_NUM_AN 4 /* 2 bits for the association number */
417
-
418
407
diff --git a/include/uapi/linux/if_macsec.h b/include/uapi/linux/if_macsec.h
419
- index 1d63c43c38cc..3af2aa069a36 100644
408
+ index 98e4d5d7c..df638ba7a 100644
420
409
--- a/include/uapi/linux/if_macsec.h
421
410
+++ b/include/uapi/linux/if_macsec.h
422
411
@@ -22,9 +22,11 @@
@@ -432,7 +421,7 @@ index 1d63c43c38cc..3af2aa069a36 100644
432
421
433
422
/* deprecated cipher ID for GCM-AES-128 */
434
423
#define MACSEC_DEFAULT_CIPHER_ID 0x0080020001000001ULL
435
- @@ -88 ,11 +90 ,13 @@ enum macsec_sa_attrs {
424
+ @@ -87 ,11 +89 ,13 @@ enum macsec_sa_attrs {
436
425
MACSEC_SA_ATTR_UNSPEC,
437
426
MACSEC_SA_ATTR_AN, /* config/dump, u8 0..3 */
438
427
MACSEC_SA_ATTR_ACTIVE, /* config/dump, u8 0..1 */
@@ -447,6 +436,3 @@ index 1d63c43c38cc..3af2aa069a36 100644
447
436
__MACSEC_SA_ATTR_END,
448
437
NUM_MACSEC_SA_ATTR = __MACSEC_SA_ATTR_END,
449
438
MACSEC_SA_ATTR_MAX = __MACSEC_SA_ATTR_END - 1,
450
- - -
451
- 2.25.1
452
-
0 commit comments