Skip to content

Commit 48ef50f

Browse files
Era Mayflowerdavem330
Era Mayflower
authored and
davem330
committed
macsec: Netlink support of XPN cipher suites (IEEE 802.1AEbw)
Netlink support of extended packet number cipher suites, allows adding and updating XPN macsec interfaces. Added support in: * Creating interfaces with GCM-AES-XPN-128 and GCM-AES-XPN-256 suites. * Setting and getting 64bit packet numbers with of SAs. * Setting (only on SA creation) and getting ssci of SAs. * Setting salt when installing a SAK. Added 2 cipher suite identifiers according to 802.1AE-2018 table 14-1: * MACSEC_CIPHER_ID_GCM_AES_XPN_128 * MACSEC_CIPHER_ID_GCM_AES_XPN_256 In addition, added 2 new netlink attribute types: * MACSEC_SA_ATTR_SSCI * MACSEC_SA_ATTR_SALT Depends on: macsec: Support XPN frame handling - IEEE 802.1AEbw. Signed-off-by: Era Mayflower <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent a21ecf0 commit 48ef50f

File tree

3 files changed

+157
-15
lines changed

3 files changed

+157
-15
lines changed

‎drivers/net/macsec.c‎

Lines changed: 148 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -240,11 +240,13 @@ static struct macsec_cb *macsec_skb_cb(struct sk_buff *skb)
240240
#define MACSEC_PORT_ES (htons(0x0001))
241241
#define MACSEC_PORT_SCB (0x0000)
242242
#define MACSEC_UNDEF_SCI ((__force sci_t)0xffffffffffffffffULL)
243+
#define MACSEC_UNDEF_SSCI ((__force ssci_t)0xffffffff)
243244

244245
#define MACSEC_GCM_AES_128_SAK_LEN 16
245246
#define MACSEC_GCM_AES_256_SAK_LEN 32
246247

247248
#define DEFAULT_SAK_LEN MACSEC_GCM_AES_128_SAK_LEN
249+
#define DEFAULT_XPN false
248250
#define DEFAULT_SEND_SCI true
249251
#define DEFAULT_ENCRYPT false
250252
#define DEFAULT_ENCODING_SA 0
@@ -1311,6 +1313,7 @@ static int init_rx_sa(struct macsec_rx_sa *rx_sa, char *sak, int key_len,
13111313
return PTR_ERR(rx_sa->key.tfm);
13121314
}
13131315

1316+
rx_sa->ssci = MACSEC_UNDEF_SSCI;
13141317
rx_sa->active = false;
13151318
rx_sa->next_pn = 1;
13161319
refcount_set(&rx_sa->refcnt, 1);
@@ -1409,6 +1412,7 @@ static int init_tx_sa(struct macsec_tx_sa *tx_sa, char *sak, int key_len,
14091412
return PTR_ERR(tx_sa->key.tfm);
14101413
}
14111414

1415+
tx_sa->ssci = MACSEC_UNDEF_SSCI;
14121416
tx_sa->active = false;
14131417
refcount_set(&tx_sa->refcnt, 1);
14141418
spin_lock_init(&tx_sa->lock);
@@ -1452,6 +1456,16 @@ static int nla_put_sci(struct sk_buff *skb, int attrtype, sci_t value,
14521456
return nla_put_u64_64bit(skb, attrtype, (__force u64)value, padattr);
14531457
}
14541458

1459+
static ssci_t nla_get_ssci(const struct nlattr *nla)
1460+
{
1461+
return (__force ssci_t)nla_get_u32(nla);
1462+
}
1463+
1464+
static int nla_put_ssci(struct sk_buff *skb, int attrtype, ssci_t value)
1465+
{
1466+
return nla_put_u32(skb, attrtype, (__force u64)value);
1467+
}
1468+
14551469
static struct macsec_tx_sa *get_txsa_from_nl(struct net *net,
14561470
struct nlattr **attrs,
14571471
struct nlattr **tb_sa,
@@ -1567,11 +1581,14 @@ static const struct nla_policy macsec_genl_rxsc_policy[NUM_MACSEC_RXSC_ATTR] = {
15671581
static const struct nla_policy macsec_genl_sa_policy[NUM_MACSEC_SA_ATTR] = {
15681582
[MACSEC_SA_ATTR_AN] = { .type = NLA_U8 },
15691583
[MACSEC_SA_ATTR_ACTIVE] = { .type = NLA_U8 },
1570-
[MACSEC_SA_ATTR_PN] = { .type = NLA_U32 },
1584+
[MACSEC_SA_ATTR_PN] = { .type = NLA_MIN_LEN, .len = 4 },
15711585
[MACSEC_SA_ATTR_KEYID] = { .type = NLA_BINARY,
15721586
.len = MACSEC_KEYID_LEN, },
15731587
[MACSEC_SA_ATTR_KEY] = { .type = NLA_BINARY,
15741588
.len = MACSEC_MAX_KEY_LEN, },
1589+
[MACSEC_SA_ATTR_SSCI] = { .type = NLA_U32 },
1590+
[MACSEC_SA_ATTR_SALT] = { .type = NLA_BINARY,
1591+
.len = MACSEC_SALT_LEN, },
15751592
};
15761593

15771594
static const struct nla_policy macsec_genl_offload_policy[NUM_MACSEC_OFFLOAD_ATTR] = {
@@ -1644,7 +1661,8 @@ static bool validate_add_rxsa(struct nlattr **attrs)
16441661
if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN)
16451662
return false;
16461663

1647-
if (attrs[MACSEC_SA_ATTR_PN] && nla_get_u32(attrs[MACSEC_SA_ATTR_PN]) == 0)
1664+
if (attrs[MACSEC_SA_ATTR_PN] &&
1665+
*(u64 *)nla_data(attrs[MACSEC_SA_ATTR_PN]) == 0)
16481666
return false;
16491667

16501668
if (attrs[MACSEC_SA_ATTR_ACTIVE]) {
@@ -1666,6 +1684,7 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
16661684
struct macsec_rx_sc *rx_sc;
16671685
struct macsec_rx_sa *rx_sa;
16681686
unsigned char assoc_num;
1687+
int pn_len;
16691688
struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
16701689
struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
16711690
int err;
@@ -1698,6 +1717,29 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
16981717
return -EINVAL;
16991718
}
17001719

1720+
pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
1721+
if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
1722+
pr_notice("macsec: nl: add_rxsa: bad pn length: %d != %d\n",
1723+
nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
1724+
rtnl_unlock();
1725+
return -EINVAL;
1726+
}
1727+
1728+
if (secy->xpn) {
1729+
if (!tb_sa[MACSEC_SA_ATTR_SSCI] || !tb_sa[MACSEC_SA_ATTR_SALT]) {
1730+
rtnl_unlock();
1731+
return -EINVAL;
1732+
}
1733+
1734+
if (nla_len(tb_sa[MACSEC_SA_ATTR_SALT]) != MACSEC_SALT_LEN) {
1735+
pr_notice("macsec: nl: add_rxsa: bad salt length: %d != %d\n",
1736+
nla_len(tb_sa[MACSEC_SA_ATTR_SALT]),
1737+
MACSEC_SA_ATTR_SALT);
1738+
rtnl_unlock();
1739+
return -EINVAL;
1740+
}
1741+
}
1742+
17011743
rx_sa = rtnl_dereference(rx_sc->sa[assoc_num]);
17021744
if (rx_sa) {
17031745
rtnl_unlock();
@@ -1720,7 +1762,7 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
17201762

17211763
if (tb_sa[MACSEC_SA_ATTR_PN]) {
17221764
spin_lock_bh(&rx_sa->lock);
1723-
rx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
1765+
rx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
17241766
spin_unlock_bh(&rx_sa->lock);
17251767
}
17261768

@@ -1750,6 +1792,12 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
17501792
goto cleanup;
17511793
}
17521794

1795+
if (secy->xpn) {
1796+
rx_sa->ssci = nla_get_ssci(tb_sa[MACSEC_SA_ATTR_SSCI]);
1797+
nla_memcpy(rx_sa->key.salt.bytes, tb_sa[MACSEC_SA_ATTR_SALT],
1798+
MACSEC_SALT_LEN);
1799+
}
1800+
17531801
nla_memcpy(rx_sa->key.id, tb_sa[MACSEC_SA_ATTR_KEYID], MACSEC_KEYID_LEN);
17541802
rcu_assign_pointer(rx_sc->sa[assoc_num], rx_sa);
17551803

@@ -1874,6 +1922,7 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
18741922
struct macsec_tx_sc *tx_sc;
18751923
struct macsec_tx_sa *tx_sa;
18761924
unsigned char assoc_num;
1925+
int pn_len;
18771926
struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
18781927
bool was_operational;
18791928
int err;
@@ -1906,6 +1955,29 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
19061955
return -EINVAL;
19071956
}
19081957

1958+
pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
1959+
if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
1960+
pr_notice("macsec: nl: add_txsa: bad pn length: %d != %d\n",
1961+
nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
1962+
rtnl_unlock();
1963+
return -EINVAL;
1964+
}
1965+
1966+
if (secy->xpn) {
1967+
if (!tb_sa[MACSEC_SA_ATTR_SSCI] || !tb_sa[MACSEC_SA_ATTR_SALT]) {
1968+
rtnl_unlock();
1969+
return -EINVAL;
1970+
}
1971+
1972+
if (nla_len(tb_sa[MACSEC_SA_ATTR_SALT]) != MACSEC_SALT_LEN) {
1973+
pr_notice("macsec: nl: add_txsa: bad salt length: %d != %d\n",
1974+
nla_len(tb_sa[MACSEC_SA_ATTR_SALT]),
1975+
MACSEC_SA_ATTR_SALT);
1976+
rtnl_unlock();
1977+
return -EINVAL;
1978+
}
1979+
}
1980+
19091981
tx_sa = rtnl_dereference(tx_sc->sa[assoc_num]);
19101982
if (tx_sa) {
19111983
rtnl_unlock();
@@ -1927,7 +1999,7 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
19271999
}
19282000

19292001
spin_lock_bh(&tx_sa->lock);
1930-
tx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
2002+
tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
19312003
spin_unlock_bh(&tx_sa->lock);
19322004

19332005
if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
@@ -1958,6 +2030,12 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
19582030
goto cleanup;
19592031
}
19602032

2033+
if (secy->xpn) {
2034+
tx_sa->ssci = nla_get_ssci(tb_sa[MACSEC_SA_ATTR_SSCI]);
2035+
nla_memcpy(tx_sa->key.salt.bytes, tb_sa[MACSEC_SA_ATTR_SALT],
2036+
MACSEC_SALT_LEN);
2037+
}
2038+
19612039
nla_memcpy(tx_sa->key.id, tb_sa[MACSEC_SA_ATTR_KEYID], MACSEC_KEYID_LEN);
19622040
rcu_assign_pointer(tx_sc->sa[assoc_num], tx_sa);
19632041

@@ -2164,7 +2242,9 @@ static bool validate_upd_sa(struct nlattr **attrs)
21642242
{
21652243
if (!attrs[MACSEC_SA_ATTR_AN] ||
21662244
attrs[MACSEC_SA_ATTR_KEY] ||
2167-
attrs[MACSEC_SA_ATTR_KEYID])
2245+
attrs[MACSEC_SA_ATTR_KEYID] ||
2246+
attrs[MACSEC_SA_ATTR_SSCI] ||
2247+
attrs[MACSEC_SA_ATTR_SALT])
21682248
return false;
21692249

21702250
if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN)
@@ -2214,9 +2294,19 @@ static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info)
22142294
}
22152295

22162296
if (tb_sa[MACSEC_SA_ATTR_PN]) {
2297+
int pn_len;
2298+
2299+
pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
2300+
if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
2301+
pr_notice("macsec: nl: upd_txsa: bad pn length: %d != %d\n",
2302+
nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
2303+
rtnl_unlock();
2304+
return -EINVAL;
2305+
}
2306+
22172307
spin_lock_bh(&tx_sa->lock);
22182308
prev_pn = tx_sa->next_pn_halves;
2219-
tx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
2309+
tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
22202310
spin_unlock_bh(&tx_sa->lock);
22212311
}
22222312

@@ -2300,9 +2390,19 @@ static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info)
23002390
}
23012391

23022392
if (tb_sa[MACSEC_SA_ATTR_PN]) {
2393+
int pn_len;
2394+
2395+
pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
2396+
if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
2397+
pr_notice("macsec: nl: upd_rxsa: bad pn length: %d != %d\n",
2398+
nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
2399+
rtnl_unlock();
2400+
return -EINVAL;
2401+
}
2402+
23032403
spin_lock_bh(&rx_sa->lock);
23042404
prev_pn = rx_sa->next_pn_halves;
2305-
rx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
2405+
rx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
23062406
spin_unlock_bh(&rx_sa->lock);
23072407
}
23082408

@@ -2749,10 +2849,10 @@ static int nla_put_secy(struct macsec_secy *secy, struct sk_buff *skb)
27492849

27502850
switch (secy->key_len) {
27512851
case MACSEC_GCM_AES_128_SAK_LEN:
2752-
csid = MACSEC_DEFAULT_CIPHER_ID;
2852+
csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID;
27532853
break;
27542854
case MACSEC_GCM_AES_256_SAK_LEN:
2755-
csid = MACSEC_CIPHER_ID_GCM_AES_256;
2855+
csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256;
27562856
break;
27572857
default:
27582858
goto cancel;
@@ -2843,6 +2943,8 @@ dump_secy(struct macsec_secy *secy, struct net_device *dev,
28432943
for (i = 0, j = 1; i < MACSEC_NUM_AN; i++) {
28442944
struct macsec_tx_sa *tx_sa = rtnl_dereference(tx_sc->sa[i]);
28452945
struct nlattr *txsa_nest;
2946+
u64 pn;
2947+
int pn_len;
28462948

28472949
if (!tx_sa)
28482950
continue;
@@ -2853,9 +2955,18 @@ dump_secy(struct macsec_secy *secy, struct net_device *dev,
28532955
goto nla_put_failure;
28542956
}
28552957

2958+
if (secy->xpn) {
2959+
pn = tx_sa->next_pn;
2960+
pn_len = MACSEC_XPN_PN_LEN;
2961+
} else {
2962+
pn = tx_sa->next_pn_halves.lower;
2963+
pn_len = MACSEC_DEFAULT_PN_LEN;
2964+
}
2965+
28562966
if (nla_put_u8(skb, MACSEC_SA_ATTR_AN, i) ||
2857-
nla_put_u32(skb, MACSEC_SA_ATTR_PN, tx_sa->next_pn_halves.lower) ||
2967+
nla_put(skb, MACSEC_SA_ATTR_PN, pn_len, &pn) ||
28582968
nla_put(skb, MACSEC_SA_ATTR_KEYID, MACSEC_KEYID_LEN, tx_sa->key.id) ||
2969+
(secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, tx_sa->ssci)) ||
28592970
nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, tx_sa->active)) {
28602971
nla_nest_cancel(skb, txsa_nest);
28612972
nla_nest_cancel(skb, txsa_list);
@@ -2928,6 +3039,8 @@ dump_secy(struct macsec_secy *secy, struct net_device *dev,
29283039
for (i = 0, k = 1; i < MACSEC_NUM_AN; i++) {
29293040
struct macsec_rx_sa *rx_sa = rtnl_dereference(rx_sc->sa[i]);
29303041
struct nlattr *rxsa_nest;
3042+
u64 pn;
3043+
int pn_len;
29313044

29323045
if (!rx_sa)
29333046
continue;
@@ -2957,9 +3070,18 @@ dump_secy(struct macsec_secy *secy, struct net_device *dev,
29573070
}
29583071
nla_nest_end(skb, attr);
29593072

3073+
if (secy->xpn) {
3074+
pn = rx_sa->next_pn;
3075+
pn_len = MACSEC_XPN_PN_LEN;
3076+
} else {
3077+
pn = rx_sa->next_pn_halves.lower;
3078+
pn_len = MACSEC_DEFAULT_PN_LEN;
3079+
}
3080+
29603081
if (nla_put_u8(skb, MACSEC_SA_ATTR_AN, i) ||
2961-
nla_put_u32(skb, MACSEC_SA_ATTR_PN, rx_sa->next_pn_halves.lower) ||
3082+
nla_put(skb, MACSEC_SA_ATTR_PN, pn_len, &pn) ||
29623083
nla_put(skb, MACSEC_SA_ATTR_KEYID, MACSEC_KEYID_LEN, rx_sa->key.id) ||
3084+
(secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, rx_sa->ssci)) ||
29633085
nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, rx_sa->active)) {
29643086
nla_nest_cancel(skb, rxsa_nest);
29653087
nla_nest_cancel(skb, rxsc_nest);
@@ -3503,9 +3625,19 @@ static int macsec_changelink_common(struct net_device *dev,
35033625
case MACSEC_CIPHER_ID_GCM_AES_128:
35043626
case MACSEC_DEFAULT_CIPHER_ID:
35053627
secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;
3628+
secy->xpn = false;
35063629
break;
35073630
case MACSEC_CIPHER_ID_GCM_AES_256:
35083631
secy->key_len = MACSEC_GCM_AES_256_SAK_LEN;
3632+
secy->xpn = false;
3633+
break;
3634+
case MACSEC_CIPHER_ID_GCM_AES_XPN_128:
3635+
secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;
3636+
secy->xpn = true;
3637+
break;
3638+
case MACSEC_CIPHER_ID_GCM_AES_XPN_256:
3639+
secy->key_len = MACSEC_GCM_AES_256_SAK_LEN;
3640+
secy->xpn = true;
35093641
break;
35103642
default:
35113643
return -EINVAL;
@@ -3695,6 +3827,7 @@ static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len)
36953827
secy->validate_frames = MACSEC_VALIDATE_DEFAULT;
36963828
secy->protect_frames = true;
36973829
secy->replay_protect = false;
3830+
secy->xpn = DEFAULT_XPN;
36983831

36993832
secy->sci = sci;
37003833
secy->tx_sc.active = true;
@@ -3824,6 +3957,8 @@ static int macsec_validate_attr(struct nlattr *tb[], struct nlattr *data[],
38243957
switch (csid) {
38253958
case MACSEC_CIPHER_ID_GCM_AES_128:
38263959
case MACSEC_CIPHER_ID_GCM_AES_256:
3960+
case MACSEC_CIPHER_ID_GCM_AES_XPN_128:
3961+
case MACSEC_CIPHER_ID_GCM_AES_XPN_256:
38273962
case MACSEC_DEFAULT_CIPHER_ID:
38283963
if (icv_len < MACSEC_MIN_ICV_LEN ||
38293964
icv_len > MACSEC_STD_ICV_LEN)
@@ -3897,10 +4032,10 @@ static int macsec_fill_info(struct sk_buff *skb,
38974032

38984033
switch (secy->key_len) {
38994034
case MACSEC_GCM_AES_128_SAK_LEN:
3900-
csid = MACSEC_DEFAULT_CIPHER_ID;
4035+
csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID;
39014036
break;
39024037
case MACSEC_GCM_AES_256_SAK_LEN:
3903-
csid = MACSEC_CIPHER_ID_GCM_AES_256;
4038+
csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256;
39044039
break;
39054040
default:
39064041
goto nla_put_failure;

‎include/net/macsec.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@
1111
#include <uapi/linux/if_link.h>
1212
#include <uapi/linux/if_macsec.h>
1313

14+
#define MACSEC_DEFAULT_PN_LEN 4
15+
#define MACSEC_XPN_PN_LEN 8
16+
1417
#define MACSEC_SALT_LEN 12
1518
#define MACSEC_NUM_AN 4 /* 2 bits for the association number */
1619

0 commit comments

Comments
 (0)