|
 |
049c96 |
From 2eacdef42c7194133be00b2de64cabd72b88aef1 Mon Sep 17 00:00:00 2001
|
|
|
049c96 |
From: Davide Caratti <dcaratti@redhat.com>
|
|
|
049c96 |
Date: Wed, 6 Jul 2016 18:41:36 +0200
|
|
|
049c96 |
Subject: [PATCH] ip: add MACsec support
|
|
|
049c96 |
|
|
|
049c96 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1300765
|
|
|
049c96 |
Upstream Status: iproute2.git commit b26fc590ce62
|
|
|
049c96 |
|
|
|
049c96 |
Conflicts:
|
|
|
049c96 |
- context conflict due to missing code cleanup (lack of upstream commit
|
|
|
049c96 |
892e21248cfd)
|
|
|
049c96 |
- context conflict due to missing support for foo-over-udp (lack of upstream
|
|
|
049c96 |
commit 6928747b6e79)
|
|
|
049c96 |
|
|
|
049c96 |
commit b26fc590ce6272835da35c016f6a99f5f43d6a88
|
|
|
049c96 |
Author: Sabrina Dubroca <sd@queasysnail.net>
|
|
|
049c96 |
Date: Wed Jun 8 09:34:21 2016 -0700
|
|
|
049c96 |
|
|
|
049c96 |
ip: add MACsec support
|
|
|
049c96 |
|
|
|
049c96 |
Extend ip-link to create MACsec devices
|
|
|
049c96 |
|
|
|
049c96 |
ip link add link <master> <macsec> type macsec [options]
|
|
|
049c96 |
|
|
|
049c96 |
Add `ip macsec` command to configure receive-side secure channels and
|
|
|
049c96 |
secure associations within a macsec netdevice.
|
|
|
049c96 |
|
|
|
049c96 |
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
|
|
|
049c96 |
Acked-by: Phil Sutter <phil@nwl.cc>
|
|
|
049c96 |
|
|
|
049c96 |
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
|
|
|
049c96 |
---
|
|
|
049c96 |
ip/Makefile | 2 +-
|
|
|
049c96 |
ip/ip.c | 3 +-
|
|
|
049c96 |
ip/ip_common.h | 1 +
|
|
|
049c96 |
ip/ipmacsec.c | 1301 +++++++++++++++++++++++++++++++++++++++++++++++++
|
|
|
049c96 |
man/man8/Makefile | 2 +-
|
|
|
049c96 |
man/man8/ip-link.8.in | 85 ++++
|
|
|
049c96 |
man/man8/ip-macsec.8 | 98 ++++
|
|
|
049c96 |
7 files changed, 1489 insertions(+), 3 deletions(-)
|
|
|
049c96 |
create mode 100644 ip/ipmacsec.c
|
|
|
049c96 |
create mode 100644 man/man8/ip-macsec.8
|
|
|
049c96 |
|
|
|
049c96 |
diff --git a/ip/Makefile b/ip/Makefile
|
|
|
049c96 |
index 5aad224..f6de690 100644
|
|
|
049c96 |
--- a/ip/Makefile
|
|
|
049c96 |
+++ b/ip/Makefile
|
|
|
049c96 |
@@ -6,7 +6,7 @@ IPOBJ=ip.o ipaddress.o ipaddrlabel.o iproute.o iprule.o ipnetns.o \
|
|
|
049c96 |
iplink_macvlan.o ipl2tp.o link_vti.o link_vti6.o \
|
|
|
049c96 |
iplink_vxlan.o tcp_metrics.o iplink_ipoib.o ipnetconf.o link_ip6tnl.o \
|
|
|
049c96 |
link_iptnl.o link_gre6.o iplink_bond.o iplink_bond_slave.o \
|
|
|
049c96 |
- iplink_bridge.o iplink_bridge_slave.o \
|
|
|
049c96 |
+ iplink_bridge.o iplink_bridge_slave.o ipmacsec.o \
|
|
|
049c96 |
iplink_geneve.o
|
|
|
049c96 |
|
|
|
049c96 |
RTMONOBJ=rtmon.o
|
|
|
049c96 |
diff --git a/ip/ip.c b/ip/ip.c
|
|
|
049c96 |
index 8b9b9c0..d6f1391 100644
|
|
|
049c96 |
--- a/ip/ip.c
|
|
|
049c96 |
+++ b/ip/ip.c
|
|
|
049c96 |
@@ -49,7 +49,7 @@ static void usage(void)
|
|
|
049c96 |
" ip [ -force ] -batch filename\n"
|
|
|
049c96 |
"where OBJECT := { link | address | addrlabel | route | rule | neigh | ntable |\n"
|
|
|
049c96 |
" tunnel | tuntap | maddress | mroute | mrule | monitor | xfrm |\n"
|
|
|
049c96 |
-" netns | l2tp | tcp_metrics | token }\n"
|
|
|
049c96 |
+" netns | l2tp | macsec | tcp_metrics | token }\n"
|
|
|
049c96 |
" OPTIONS := { -V[ersion] | -s[tatistics] | -d[etails] | -r[esolve] |\n"
|
|
|
049c96 |
" -h[uman-readable] | -iec |\n"
|
|
|
049c96 |
" -f[amily] { inet | inet6 | ipx | dnet | bridge | link } |\n"
|
|
|
049c96 |
@@ -81,6 +81,7 @@ static const struct cmd {
|
|
|
049c96 |
{ "ntbl", do_ipntable },
|
|
|
049c96 |
{ "link", do_iplink },
|
|
|
049c96 |
{ "l2tp", do_ipl2tp },
|
|
|
049c96 |
+ { "macsec", do_ipmacsec },
|
|
|
049c96 |
{ "tunnel", do_iptunnel },
|
|
|
049c96 |
{ "tunl", do_iptunnel },
|
|
|
049c96 |
{ "tuntap", do_iptuntap },
|
|
|
049c96 |
diff --git a/ip/ip_common.h b/ip/ip_common.h
|
|
|
049c96 |
index 880890e..c3e7fda 100644
|
|
|
049c96 |
--- a/ip/ip_common.h
|
|
|
049c96 |
+++ b/ip/ip_common.h
|
|
|
049c96 |
@@ -44,6 +44,7 @@ extern int do_iptunnel(int argc, char **argv);
|
|
|
049c96 |
extern int do_ip6tunnel(int argc, char **argv);
|
|
|
049c96 |
extern int do_iptuntap(int argc, char **argv);
|
|
|
049c96 |
extern int do_iplink(int argc, char **argv);
|
|
|
049c96 |
+int do_ipmacsec(int argc, char **argv);
|
|
|
049c96 |
extern int do_ipmonitor(int argc, char **argv);
|
|
|
049c96 |
extern int do_multiaddr(int argc, char **argv);
|
|
|
049c96 |
extern int do_multiroute(int argc, char **argv);
|
|
|
049c96 |
diff --git a/ip/ipmacsec.c b/ip/ipmacsec.c
|
|
|
049c96 |
new file mode 100644
|
|
|
049c96 |
index 0000000..34ba341
|
|
|
049c96 |
--- /dev/null
|
|
|
049c96 |
+++ b/ip/ipmacsec.c
|
|
|
049c96 |
@@ -0,0 +1,1301 @@
|
|
|
049c96 |
+/*
|
|
|
049c96 |
+ * ipmacsec.c "ip macsec".
|
|
|
049c96 |
+ *
|
|
|
049c96 |
+ * This program is free software; you can redistribute it and/or
|
|
|
049c96 |
+ * modify it under the terms of the GNU General Public License
|
|
|
049c96 |
+ * as published by the Free Software Foundation; either version
|
|
|
049c96 |
+ * 2 of the License, or (at your option) any later version.
|
|
|
049c96 |
+ *
|
|
|
049c96 |
+ * Authors: Sabrina Dubroca <sd@queasysnail.net>
|
|
|
049c96 |
+ */
|
|
|
049c96 |
+
|
|
|
049c96 |
+#include <stdio.h>
|
|
|
049c96 |
+#include <stdlib.h>
|
|
|
049c96 |
+#include <string.h>
|
|
|
049c96 |
+#include <errno.h>
|
|
|
049c96 |
+#include <linux/genetlink.h>
|
|
|
049c96 |
+#include <linux/if_ether.h>
|
|
|
049c96 |
+#include <linux/if_macsec.h>
|
|
|
049c96 |
+
|
|
|
049c96 |
+#include "rt_names.h"
|
|
|
049c96 |
+#include "utils.h"
|
|
|
049c96 |
+#include "ip_common.h"
|
|
|
049c96 |
+#include "ll_map.h"
|
|
|
049c96 |
+#include "libgenl.h"
|
|
|
049c96 |
+
|
|
|
049c96 |
+static const char *values_on_off[] = { "off", "on" };
|
|
|
049c96 |
+
|
|
|
049c96 |
+static const char *VALIDATE_STR[] = {
|
|
|
049c96 |
+ [MACSEC_VALIDATE_DISABLED] = "disabled",
|
|
|
049c96 |
+ [MACSEC_VALIDATE_CHECK] = "check",
|
|
|
049c96 |
+ [MACSEC_VALIDATE_STRICT] = "strict",
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+struct sci {
|
|
|
049c96 |
+ __u64 sci;
|
|
|
049c96 |
+ __u16 port;
|
|
|
049c96 |
+ char abuf[6];
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+struct sa_desc {
|
|
|
049c96 |
+ __u8 an;
|
|
|
049c96 |
+ __u32 pn;
|
|
|
049c96 |
+ __u8 key_id[MACSEC_KEYID_LEN];
|
|
|
049c96 |
+ __u32 key_len;
|
|
|
049c96 |
+ __u8 key[MACSEC_MAX_KEY_LEN];
|
|
|
049c96 |
+ __u8 active;
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+struct cipher_args {
|
|
|
049c96 |
+ __u64 id;
|
|
|
049c96 |
+ __u8 icv_len;
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+struct txsc_desc {
|
|
|
049c96 |
+ int ifindex;
|
|
|
049c96 |
+ __u64 sci;
|
|
|
049c96 |
+ __be16 port;
|
|
|
049c96 |
+ struct cipher_args cipher;
|
|
|
049c96 |
+ __u32 window;
|
|
|
049c96 |
+ enum macsec_validation_type validate;
|
|
|
049c96 |
+ __u8 encoding_sa;
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+struct rxsc_desc {
|
|
|
049c96 |
+ int ifindex;
|
|
|
049c96 |
+ __u64 sci;
|
|
|
049c96 |
+ __u8 active;
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+#define MACSEC_BUFLEN 1024
|
|
|
049c96 |
+
|
|
|
049c96 |
+
|
|
|
049c96 |
+/* netlink socket */
|
|
|
049c96 |
+static struct rtnl_handle genl_rth;
|
|
|
049c96 |
+static int genl_family = -1;
|
|
|
049c96 |
+
|
|
|
049c96 |
+#define MACSEC_GENL_REQ(_req, _bufsiz, _cmd, _flags) \
|
|
|
049c96 |
+ GENL_REQUEST(_req, _bufsiz, genl_family, 0, MACSEC_GENL_VERSION, \
|
|
|
049c96 |
+ _cmd, _flags)
|
|
|
049c96 |
+
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void init_genl(void)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ if (genl_family >= 0)
|
|
|
049c96 |
+ return;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (rtnl_open_byproto(&genl_rth, 0, NETLINK_GENERIC) < 0) {
|
|
|
049c96 |
+ fprintf(stderr, "Cannot open generic netlink socket\n");
|
|
|
049c96 |
+ exit(1);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ genl_family = genl_resolve_family(&genl_rth, MACSEC_GENL_NAME);
|
|
|
049c96 |
+ if (genl_family < 0)
|
|
|
049c96 |
+ exit(1);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void ipmacsec_usage(void)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ fprintf(stderr, "Usage: ip macsec add DEV tx sa { 0..3 } [ OPTS ] key ID KEY\n");
|
|
|
049c96 |
+ fprintf(stderr, " ip macsec set DEV tx sa { 0..3 } [ OPTS ]\n");
|
|
|
049c96 |
+ fprintf(stderr, " ip macsec del DEV tx sa { 0..3 }\n");
|
|
|
049c96 |
+ fprintf(stderr, " ip macsec add DEV rx SCI [ on | off ]\n");
|
|
|
049c96 |
+ fprintf(stderr, " ip macsec set DEV rx SCI [ on | off ]\n");
|
|
|
049c96 |
+ fprintf(stderr, " ip macsec del DEV rx SCI\n");
|
|
|
049c96 |
+ fprintf(stderr, " ip macsec add DEV rx SCI sa { 0..3 } [ OPTS ] key ID KEY\n");
|
|
|
049c96 |
+ fprintf(stderr, " ip macsec set DEV rx SCI sa { 0..3 } [ OPTS ]\n");
|
|
|
049c96 |
+ fprintf(stderr, " ip macsec del DEV rx SCI sa { 0..3 }\n");
|
|
|
049c96 |
+ fprintf(stderr, " ip macsec show\n");
|
|
|
049c96 |
+ fprintf(stderr, " ip macsec show DEV\n");
|
|
|
049c96 |
+ fprintf(stderr, "where OPTS := [ pn <u32> ] [ on | off ]\n");
|
|
|
049c96 |
+ fprintf(stderr, " ID := 128-bit hex string\n");
|
|
|
049c96 |
+ fprintf(stderr, " KEY := 128-bit hex string\n");
|
|
|
049c96 |
+ fprintf(stderr, " SCI := { sci <u64> | port <u16> address <lladdr> }\n");
|
|
|
049c96 |
+
|
|
|
049c96 |
+ exit(-1);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int one_of(const char *msg, const char *realval, const char **list,
|
|
|
049c96 |
+ size_t len, int *index)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ int i;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ for (i = 0; i < len; i++) {
|
|
|
049c96 |
+ if (matches(realval, list[i]) == 0) {
|
|
|
049c96 |
+ *index = i;
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ fprintf(stderr, "Error: argument of \"%s\" must be one of ", msg);
|
|
|
049c96 |
+ for (i = 0; i < len; i++)
|
|
|
049c96 |
+ fprintf(stderr, "\"%s\", ", list[i]);
|
|
|
049c96 |
+ fprintf(stderr, "not \"%s\"\n", realval);
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int get_an(__u8 *val, const char *arg)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ int ret = get_u8(val, arg, 0);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (ret)
|
|
|
049c96 |
+ return ret;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (*val > 3)
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int get_sci(__u64 *sci, const char *arg)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ return get_u64(sci, arg, 16);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int get_port(__be16 *port, const char *arg)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ return get_be16(port, arg, 10);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+#define _STR(a) #a
|
|
|
049c96 |
+#define STR(a) _STR(a)
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void get_icvlen(__u8 *icvlen, char *arg)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ int ret = get_u8(icvlen, arg, 10);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (ret)
|
|
|
049c96 |
+ invarg("expected ICV length", arg);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (*icvlen < MACSEC_MIN_ICV_LEN || *icvlen > MACSEC_MAX_ICV_LEN)
|
|
|
049c96 |
+ invarg("ICV length must be in the range {"
|
|
|
049c96 |
+ STR(MACSEC_MIN_ICV_LEN) ".." STR(MACSEC_MAX_ICV_LEN)
|
|
|
049c96 |
+ "}", arg);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static bool get_sa(int *argcp, char ***argvp, __u8 *an)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ int argc = *argcp;
|
|
|
049c96 |
+ char **argv = *argvp;
|
|
|
049c96 |
+ int ret;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (argc <= 0 || strcmp(*argv, "sa") != 0)
|
|
|
049c96 |
+ return false;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ ret = get_an(an, *argv);
|
|
|
049c96 |
+ if (ret)
|
|
|
049c96 |
+ invarg("expected an { 0..3 }", *argv);
|
|
|
049c96 |
+ argc--; argv++;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ *argvp = argv;
|
|
|
049c96 |
+ *argcp = argc;
|
|
|
049c96 |
+ return true;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int parse_sa_args(int *argcp, char ***argvp, struct sa_desc *sa)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ int argc = *argcp;
|
|
|
049c96 |
+ char **argv = *argvp;
|
|
|
049c96 |
+ int ret;
|
|
|
049c96 |
+ bool active_set = false;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ while (argc > 0) {
|
|
|
049c96 |
+ if (strcmp(*argv, "pn") == 0) {
|
|
|
049c96 |
+ if (sa->pn != 0)
|
|
|
049c96 |
+ duparg2("pn", "pn");
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ ret = get_u32(&sa->pn, *argv, 0);
|
|
|
049c96 |
+ if (ret)
|
|
|
049c96 |
+ invarg("expected pn", *argv);
|
|
|
049c96 |
+ if (sa->pn == 0)
|
|
|
049c96 |
+ invarg("expected pn != 0", *argv);
|
|
|
049c96 |
+ } else if (strcmp(*argv, "key") == 0) {
|
|
|
049c96 |
+ unsigned int len;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ if (!hexstring_a2n(*argv, sa->key_id, MACSEC_KEYID_LEN,
|
|
|
049c96 |
+ &len))
|
|
|
049c96 |
+ invarg("expected key id", *argv);
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ if (!hexstring_a2n(*argv, sa->key, MACSEC_MAX_KEY_LEN,
|
|
|
049c96 |
+ &sa->key_len))
|
|
|
049c96 |
+ invarg("expected key", *argv);
|
|
|
049c96 |
+ } else if (strcmp(*argv, "on") == 0) {
|
|
|
049c96 |
+ if (active_set)
|
|
|
049c96 |
+ duparg2("on/off", "on");
|
|
|
049c96 |
+ sa->active = true;
|
|
|
049c96 |
+ active_set = true;
|
|
|
049c96 |
+ } else if (strcmp(*argv, "off") == 0) {
|
|
|
049c96 |
+ if (active_set)
|
|
|
049c96 |
+ duparg2("on/off", "off");
|
|
|
049c96 |
+ sa->active = false;
|
|
|
049c96 |
+ active_set = true;
|
|
|
049c96 |
+ } else {
|
|
|
049c96 |
+ fprintf(stderr, "macsec: unknown command \"%s\"?\n",
|
|
|
049c96 |
+ *argv);
|
|
|
049c96 |
+ ipmacsec_usage();
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ argv++; argc--;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ *argvp = argv;
|
|
|
049c96 |
+ *argcp = argc;
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static __u64 make_sci(char *addr, __be16 port)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ __u64 sci;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ memcpy(&sci, addr, ETH_ALEN);
|
|
|
049c96 |
+ memcpy(((char *)&sci) + ETH_ALEN, &port, sizeof(port));
|
|
|
049c96 |
+
|
|
|
049c96 |
+ return sci;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static bool sci_complete(bool sci, bool port, bool addr, bool port_only)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ return sci || (port && (addr || port_only));
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int get_sci_portaddr(struct sci *sci, int *argcp, char ***argvp,
|
|
|
049c96 |
+ bool port_only, bool optional)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ int argc = *argcp;
|
|
|
049c96 |
+ char **argv = *argvp;
|
|
|
049c96 |
+ int ret;
|
|
|
049c96 |
+ bool p = false, a = false, s = false;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ while (argc > 0) {
|
|
|
049c96 |
+ if (strcmp(*argv, "sci") == 0) {
|
|
|
049c96 |
+ if (p)
|
|
|
049c96 |
+ invarg("expected address", *argv);
|
|
|
049c96 |
+ if (a)
|
|
|
049c96 |
+ invarg("expected port", *argv);
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ ret = get_sci(&sci->sci, *argv);
|
|
|
049c96 |
+ if (ret)
|
|
|
049c96 |
+ invarg("expected sci", *argv);
|
|
|
049c96 |
+ s = true;
|
|
|
049c96 |
+ } else if (strcmp(*argv, "port") == 0) {
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ ret = get_port(&sci->port, *argv);
|
|
|
049c96 |
+ if (ret)
|
|
|
049c96 |
+ invarg("expected port", *argv);
|
|
|
049c96 |
+ if (sci->port == 0)
|
|
|
049c96 |
+ invarg("expected port != 0", *argv);
|
|
|
049c96 |
+ p = true;
|
|
|
049c96 |
+ } else if (strcmp(*argv, "address") == 0) {
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ ret = ll_addr_a2n(sci->abuf, sizeof(sci->abuf), *argv);
|
|
|
049c96 |
+ if (ret < 0)
|
|
|
049c96 |
+ invarg("expected lladdr", *argv);
|
|
|
049c96 |
+ a = true;
|
|
|
049c96 |
+ } else if (optional) {
|
|
|
049c96 |
+ break;
|
|
|
049c96 |
+ } else {
|
|
|
049c96 |
+ invarg("expected sci, port, or address", *argv);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ argv++; argc--;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (sci_complete(s, p, a, port_only))
|
|
|
049c96 |
+ break;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (!optional && !sci_complete(s, p, a, port_only))
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (p && a)
|
|
|
049c96 |
+ sci->sci = make_sci(sci->abuf, sci->port);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ *argvp = argv;
|
|
|
049c96 |
+ *argcp = argc;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ return p || a || s;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static bool parse_rxsci(int *argcp, char ***argvp, struct rxsc_desc *rxsc,
|
|
|
049c96 |
+ struct sa_desc *rxsa)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct sci sci = { 0 };
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (*argcp == 0 ||
|
|
|
049c96 |
+ get_sci_portaddr(&sci, argcp, argvp, false, false) < 0) {
|
|
|
049c96 |
+ fprintf(stderr, "expected sci\n");
|
|
|
049c96 |
+ ipmacsec_usage();
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ rxsc->sci = sci.sci;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ return get_sa(argcp, argvp, &rxsa->an);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int parse_rxsci_args(int *argcp, char ***argvp, struct rxsc_desc *rxsc)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ int argc = *argcp;
|
|
|
049c96 |
+ char **argv = *argvp;
|
|
|
049c96 |
+ bool active_set = false;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ while (argc > 0) {
|
|
|
049c96 |
+ if (strcmp(*argv, "on") == 0) {
|
|
|
049c96 |
+ if (active_set)
|
|
|
049c96 |
+ duparg2("on/off", "on");
|
|
|
049c96 |
+ rxsc->active = true;
|
|
|
049c96 |
+ active_set = true;
|
|
|
049c96 |
+ } else if (strcmp(*argv, "off") == 0) {
|
|
|
049c96 |
+ if (active_set)
|
|
|
049c96 |
+ duparg2("on/off", "off");
|
|
|
049c96 |
+ rxsc->active = false;
|
|
|
049c96 |
+ active_set = true;
|
|
|
049c96 |
+ } else {
|
|
|
049c96 |
+ fprintf(stderr, "macsec: unknown command \"%s\"?\n",
|
|
|
049c96 |
+ *argv);
|
|
|
049c96 |
+ ipmacsec_usage();
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ argv++; argc--;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ *argvp = argv;
|
|
|
049c96 |
+ *argcp = argc;
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+enum cmd {
|
|
|
049c96 |
+ CMD_ADD,
|
|
|
049c96 |
+ CMD_DEL,
|
|
|
049c96 |
+ CMD_UPD,
|
|
|
049c96 |
+ __CMD_MAX
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+static const enum macsec_nl_commands macsec_commands[__CMD_MAX][2][2] = {
|
|
|
049c96 |
+ [CMD_ADD] = {
|
|
|
049c96 |
+ [0] = {-1, MACSEC_CMD_ADD_RXSC},
|
|
|
049c96 |
+ [1] = {MACSEC_CMD_ADD_TXSA, MACSEC_CMD_ADD_RXSA},
|
|
|
049c96 |
+ },
|
|
|
049c96 |
+ [CMD_UPD] = {
|
|
|
049c96 |
+ [0] = {-1, MACSEC_CMD_UPD_RXSC},
|
|
|
049c96 |
+ [1] = {MACSEC_CMD_UPD_TXSA, MACSEC_CMD_UPD_RXSA},
|
|
|
049c96 |
+ },
|
|
|
049c96 |
+ [CMD_DEL] = {
|
|
|
049c96 |
+ [0] = {-1, MACSEC_CMD_DEL_RXSC},
|
|
|
049c96 |
+ [1] = {MACSEC_CMD_DEL_TXSA, MACSEC_CMD_DEL_RXSA},
|
|
|
049c96 |
+ },
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int do_modify_nl(enum cmd c, enum macsec_nl_commands cmd, int ifindex,
|
|
|
049c96 |
+ struct rxsc_desc *rxsc, struct sa_desc *sa)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct rtattr *attr_sa;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ MACSEC_GENL_REQ(req, MACSEC_BUFLEN, cmd, NLM_F_REQUEST);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ addattr32(&req.n, MACSEC_BUFLEN, MACSEC_ATTR_IFINDEX, ifindex);
|
|
|
049c96 |
+ if (rxsc) {
|
|
|
049c96 |
+ struct rtattr *attr_rxsc;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ attr_rxsc = addattr_nest(&req.n, MACSEC_BUFLEN,
|
|
|
049c96 |
+ MACSEC_ATTR_RXSC_CONFIG);
|
|
|
049c96 |
+ addattr64(&req.n, MACSEC_BUFLEN,
|
|
|
049c96 |
+ MACSEC_RXSC_ATTR_SCI, rxsc->sci);
|
|
|
049c96 |
+ if (c != CMD_DEL && rxsc->active != 0xff)
|
|
|
049c96 |
+ addattr8(&req.n, MACSEC_BUFLEN,
|
|
|
049c96 |
+ MACSEC_RXSC_ATTR_ACTIVE, rxsc->active);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ addattr_nest_end(&req.n, attr_rxsc);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (sa->an == 0xff)
|
|
|
049c96 |
+ goto talk;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ attr_sa = addattr_nest(&req.n, MACSEC_BUFLEN, MACSEC_ATTR_SA_CONFIG);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ addattr8(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_AN, sa->an);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (c != CMD_DEL) {
|
|
|
049c96 |
+ if (sa->pn)
|
|
|
049c96 |
+ addattr32(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_PN,
|
|
|
049c96 |
+ sa->pn);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (sa->key_len) {
|
|
|
049c96 |
+ addattr_l(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_KEYID,
|
|
|
049c96 |
+ sa->key_id, MACSEC_KEYID_LEN);
|
|
|
049c96 |
+ addattr_l(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_KEY,
|
|
|
049c96 |
+ sa->key, sa->key_len);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (sa->active != 0xff) {
|
|
|
049c96 |
+ addattr8(&req.n, MACSEC_BUFLEN,
|
|
|
049c96 |
+ MACSEC_SA_ATTR_ACTIVE, sa->active);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ addattr_nest_end(&req.n, attr_sa);
|
|
|
049c96 |
+
|
|
|
049c96 |
+talk:
|
|
|
049c96 |
+ if (rtnl_talk(&genl_rth, &req.n, NULL, 0) < 0)
|
|
|
049c96 |
+ return -2;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static bool check_sa_args(enum cmd c, struct sa_desc *sa)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ if (c == CMD_ADD) {
|
|
|
049c96 |
+ if (!sa->key_len) {
|
|
|
049c96 |
+ fprintf(stderr, "cannot create SA without key\n");
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (sa->pn == 0) {
|
|
|
049c96 |
+ fprintf(stderr, "must specify a packet number != 0\n");
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+ } else if (c == CMD_UPD) {
|
|
|
049c96 |
+ if (sa->key_len) {
|
|
|
049c96 |
+ fprintf(stderr, "cannot change key on SA\n");
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int do_modify_txsa(enum cmd c, int argc, char **argv, int ifindex)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct sa_desc txsa = {0};
|
|
|
049c96 |
+ enum macsec_nl_commands cmd;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ txsa.an = 0xff;
|
|
|
049c96 |
+ txsa.active = 0xff;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (argc == 0 || !get_sa(&argc, &argv, &txsa.an))
|
|
|
049c96 |
+ ipmacsec_usage();
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (c == CMD_DEL)
|
|
|
049c96 |
+ goto modify;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (parse_sa_args(&argc, &argv, &txsa))
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (check_sa_args(c, &txsa))
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+
|
|
|
049c96 |
+modify:
|
|
|
049c96 |
+ cmd = macsec_commands[c][1][0];
|
|
|
049c96 |
+ return do_modify_nl(c, cmd, ifindex, NULL, &txsa);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int do_modify_rxsci(enum cmd c, int argc, char **argv, int ifindex)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct rxsc_desc rxsc = {0};
|
|
|
049c96 |
+ struct sa_desc rxsa = {0};
|
|
|
049c96 |
+ bool sa_set;
|
|
|
049c96 |
+ enum macsec_nl_commands cmd;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ rxsc.ifindex = ifindex;
|
|
|
049c96 |
+ rxsc.active = 0xff;
|
|
|
049c96 |
+ rxsa.an = 0xff;
|
|
|
049c96 |
+ rxsa.active = 0xff;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ sa_set = parse_rxsci(&argc, &argv, &rxsc, &rxsa);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (c == CMD_DEL)
|
|
|
049c96 |
+ goto modify;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (sa_set && (parse_sa_args(&argc, &argv, &rxsa) ||
|
|
|
049c96 |
+ check_sa_args(c, &rxsa)))
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ if (!sa_set && parse_rxsci_args(&argc, &argv, &rxsc))
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+
|
|
|
049c96 |
+modify:
|
|
|
049c96 |
+ cmd = macsec_commands[c][sa_set][1];
|
|
|
049c96 |
+ return do_modify_nl(c, cmd, rxsc.ifindex, &rxsc, &rxsa);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int do_modify(enum cmd c, int argc, char **argv)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ int ifindex;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (argc == 0)
|
|
|
049c96 |
+ ipmacsec_usage();
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ifindex = ll_name_to_index(*argv);
|
|
|
049c96 |
+ if (!ifindex) {
|
|
|
049c96 |
+ fprintf(stderr, "Device \"%s\" does not exist.\n", *argv);
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+ argc--; argv++;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (argc == 0)
|
|
|
049c96 |
+ ipmacsec_usage();
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (strcmp(*argv, "tx") == 0)
|
|
|
049c96 |
+ return do_modify_txsa(c, argc-1, argv+1, ifindex);
|
|
|
049c96 |
+ if (strcmp(*argv, "rx") == 0)
|
|
|
049c96 |
+ return do_modify_rxsci(c, argc-1, argv+1, ifindex);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ipmacsec_usage();
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+/* dump/show */
|
|
|
049c96 |
+static struct {
|
|
|
049c96 |
+ int ifindex;
|
|
|
049c96 |
+ __u64 sci;
|
|
|
049c96 |
+} filter;
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int validate_dump(struct rtattr **attrs)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ return attrs[MACSEC_ATTR_IFINDEX] && attrs[MACSEC_ATTR_SECY] &&
|
|
|
049c96 |
+ attrs[MACSEC_ATTR_TXSA_LIST] && attrs[MACSEC_ATTR_RXSC_LIST] &&
|
|
|
049c96 |
+ attrs[MACSEC_ATTR_TXSC_STATS] && attrs[MACSEC_ATTR_SECY_STATS];
|
|
|
049c96 |
+
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int validate_secy_dump(struct rtattr **attrs)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ return attrs[MACSEC_SECY_ATTR_SCI] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_ENCODING_SA] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_CIPHER_SUITE] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_ICV_LEN] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_PROTECT] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_REPLAY] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_OPER] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_VALIDATE] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_ENCRYPT] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_INC_SCI] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_ES] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_SCB];
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void print_flag(FILE *f, struct rtattr *attrs[], const char *desc,
|
|
|
049c96 |
+ int field)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ if (attrs[field])
|
|
|
049c96 |
+ fprintf(f, "%s %s ", desc,
|
|
|
049c96 |
+ values_on_off[!!rta_getattr_u8(attrs[field])]);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+#define DEFAULT_CIPHER_NAME "GCM-AES-128"
|
|
|
049c96 |
+
|
|
|
049c96 |
+static const char *cs_id_to_name(__u64 cid)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ switch (cid) {
|
|
|
049c96 |
+ case MACSEC_DEFAULT_CIPHER_ID:
|
|
|
049c96 |
+ case MACSEC_DEFAULT_CIPHER_ALT:
|
|
|
049c96 |
+ return DEFAULT_CIPHER_NAME;
|
|
|
049c96 |
+ default:
|
|
|
049c96 |
+ return "(unknown)";
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void print_cipher_suite(const char *prefix, __u64 cid, __u8 icv_len)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ printf("%scipher suite: %s, using ICV length %d\n", prefix,
|
|
|
049c96 |
+ cs_id_to_name(cid), icv_len);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void print_attrs(const char *prefix, struct rtattr *attrs[])
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ print_flag(stdout, attrs, "protect", MACSEC_SECY_ATTR_PROTECT);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (attrs[MACSEC_SECY_ATTR_VALIDATE]) {
|
|
|
049c96 |
+ __u8 val = rta_getattr_u8(attrs[MACSEC_SECY_ATTR_VALIDATE]);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("validate %s ", VALIDATE_STR[val]);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ print_flag(stdout, attrs, "sc", MACSEC_RXSC_ATTR_ACTIVE);
|
|
|
049c96 |
+ print_flag(stdout, attrs, "sa", MACSEC_SA_ATTR_ACTIVE);
|
|
|
049c96 |
+ print_flag(stdout, attrs, "encrypt", MACSEC_SECY_ATTR_ENCRYPT);
|
|
|
049c96 |
+ print_flag(stdout, attrs, "send_sci", MACSEC_SECY_ATTR_INC_SCI);
|
|
|
049c96 |
+ print_flag(stdout, attrs, "end_station", MACSEC_SECY_ATTR_ES);
|
|
|
049c96 |
+ print_flag(stdout, attrs, "scb", MACSEC_SECY_ATTR_SCB);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ print_flag(stdout, attrs, "replay", MACSEC_SECY_ATTR_REPLAY);
|
|
|
049c96 |
+ if (attrs[MACSEC_SECY_ATTR_WINDOW]) {
|
|
|
049c96 |
+ printf("window %d ",
|
|
|
049c96 |
+ rta_getattr_u32(attrs[MACSEC_SECY_ATTR_WINDOW]));
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (attrs[MACSEC_SECY_ATTR_CIPHER_SUITE] &&
|
|
|
049c96 |
+ attrs[MACSEC_SECY_ATTR_ICV_LEN]) {
|
|
|
049c96 |
+ printf("\n");
|
|
|
049c96 |
+ print_cipher_suite(prefix,
|
|
|
049c96 |
+ rta_getattr_u64(attrs[MACSEC_SECY_ATTR_CIPHER_SUITE]),
|
|
|
049c96 |
+ rta_getattr_u8(attrs[MACSEC_SECY_ATTR_ICV_LEN]));
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void print_one_stat(const char **names, struct rtattr **attr, int idx,
|
|
|
049c96 |
+ bool long_stat)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ int pad = strlen(names[idx]) + 1;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (attr[idx]) {
|
|
|
049c96 |
+ if (long_stat)
|
|
|
049c96 |
+ printf("%*llu", pad, rta_getattr_u64(attr[idx]));
|
|
|
049c96 |
+ else
|
|
|
049c96 |
+ printf("%*u", pad, rta_getattr_u32(attr[idx]));
|
|
|
049c96 |
+ } else {
|
|
|
049c96 |
+ printf("%*c", pad, '-');
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static const char *txsc_stats_names[NUM_MACSEC_TXSC_STATS_ATTR] = {
|
|
|
049c96 |
+ [MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED] = "OutOctetsProtected",
|
|
|
049c96 |
+ [MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED] = "OutOctetsEncrypted",
|
|
|
049c96 |
+ [MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED] = "OutPktsProtected",
|
|
|
049c96 |
+ [MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED] = "OutPktsEncrypted",
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void print_txsc_stats(const char *prefix, struct rtattr *attr)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct rtattr *stats[MACSEC_TXSC_STATS_ATTR_MAX + 1];
|
|
|
049c96 |
+ int i;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (!attr || show_stats == 0)
|
|
|
049c96 |
+ return;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ parse_rtattr_nested(stats, MACSEC_TXSC_STATS_ATTR_MAX + 1, attr);
|
|
|
049c96 |
+ printf("%sstats:", prefix);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ for (i = 1; i < NUM_MACSEC_TXSC_STATS_ATTR; i++) {
|
|
|
049c96 |
+ if (!txsc_stats_names[i])
|
|
|
049c96 |
+ continue;
|
|
|
049c96 |
+ printf(" %s", txsc_stats_names[i]);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("\n%s ", prefix);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ for (i = 1; i < NUM_MACSEC_TXSC_STATS_ATTR; i++) {
|
|
|
049c96 |
+ if (!txsc_stats_names[i])
|
|
|
049c96 |
+ continue;
|
|
|
049c96 |
+ print_one_stat(txsc_stats_names, stats, i, true);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("\n");
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static const char *secy_stats_names[NUM_MACSEC_SECY_STATS_ATTR] = {
|
|
|
049c96 |
+ [MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED] = "OutPktsUntagged",
|
|
|
049c96 |
+ [MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED] = "InPktsUntagged",
|
|
|
049c96 |
+ [MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG] = "OutPktsTooLong",
|
|
|
049c96 |
+ [MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG] = "InPktsNoTag",
|
|
|
049c96 |
+ [MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG] = "InPktsBadTag",
|
|
|
049c96 |
+ [MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI] = "InPktsUnknownSCI",
|
|
|
049c96 |
+ [MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI] = "InPktsNoSCI",
|
|
|
049c96 |
+ [MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN] = "InPktsOverrun",
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void print_secy_stats(const char *prefix, struct rtattr *attr)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct rtattr *stats[MACSEC_SECY_STATS_ATTR_MAX + 1];
|
|
|
049c96 |
+ int i;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (!attr || show_stats == 0)
|
|
|
049c96 |
+ return;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ parse_rtattr_nested(stats, MACSEC_SECY_STATS_ATTR_MAX + 1, attr);
|
|
|
049c96 |
+ printf("%sstats:", prefix);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ for (i = 1; i < NUM_MACSEC_SECY_STATS_ATTR; i++) {
|
|
|
049c96 |
+ if (!secy_stats_names[i])
|
|
|
049c96 |
+ continue;
|
|
|
049c96 |
+ printf(" %s", secy_stats_names[i]);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("\n%s ", prefix);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ for (i = 1; i < NUM_MACSEC_SECY_STATS_ATTR; i++) {
|
|
|
049c96 |
+ if (!secy_stats_names[i])
|
|
|
049c96 |
+ continue;
|
|
|
049c96 |
+ print_one_stat(secy_stats_names, stats, i, true);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("\n");
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static const char *rxsa_stats_names[NUM_MACSEC_SA_STATS_ATTR] = {
|
|
|
049c96 |
+ [MACSEC_SA_STATS_ATTR_IN_PKTS_OK] = "InPktsOK",
|
|
|
049c96 |
+ [MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID] = "InPktsInvalid",
|
|
|
049c96 |
+ [MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID] = "InPktsNotValid",
|
|
|
049c96 |
+ [MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA] = "InPktsNotUsingSA",
|
|
|
049c96 |
+ [MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA] = "InPktsUnusedSA",
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void print_rxsa_stats(const char *prefix, struct rtattr *attr)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct rtattr *stats[MACSEC_SA_STATS_ATTR_MAX + 1];
|
|
|
049c96 |
+ int i;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (!attr || show_stats == 0)
|
|
|
049c96 |
+ return;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ parse_rtattr_nested(stats, MACSEC_SA_STATS_ATTR_MAX + 1, attr);
|
|
|
049c96 |
+ printf("%s%s ", prefix, prefix);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ for (i = 1; i < NUM_MACSEC_SA_STATS_ATTR; i++) {
|
|
|
049c96 |
+ if (!rxsa_stats_names[i])
|
|
|
049c96 |
+ continue;
|
|
|
049c96 |
+ printf(" %s", rxsa_stats_names[i]);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("\n%s%s ", prefix, prefix);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ for (i = 1; i < NUM_MACSEC_SA_STATS_ATTR; i++) {
|
|
|
049c96 |
+ if (!rxsa_stats_names[i])
|
|
|
049c96 |
+ continue;
|
|
|
049c96 |
+ print_one_stat(rxsa_stats_names, stats, i, false);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("\n");
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static const char *txsa_stats_names[NUM_MACSEC_SA_STATS_ATTR] = {
|
|
|
049c96 |
+ [MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED] = "OutPktsProtected",
|
|
|
049c96 |
+ [MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED] = "OutPktsEncrypted",
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void print_txsa_stats(const char *prefix, struct rtattr *attr)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct rtattr *stats[MACSEC_SA_STATS_ATTR_MAX + 1];
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (!attr || show_stats == 0)
|
|
|
049c96 |
+ return;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ parse_rtattr_nested(stats, MACSEC_SA_STATS_ATTR_MAX + 1, attr);
|
|
|
049c96 |
+ printf("%s%s %s %s\n", prefix, prefix,
|
|
|
049c96 |
+ txsa_stats_names[MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED],
|
|
|
049c96 |
+ txsa_stats_names[MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED]);
|
|
|
049c96 |
+ printf("%s%s ", prefix, prefix);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ print_one_stat(txsa_stats_names, stats,
|
|
|
049c96 |
+ MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED, false);
|
|
|
049c96 |
+ print_one_stat(txsa_stats_names, stats,
|
|
|
049c96 |
+ MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED, false);
|
|
|
049c96 |
+ printf("\n");
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void print_tx_sc(const char *prefix, __u64 sci, __u8 encoding_sa,
|
|
|
049c96 |
+ struct rtattr *txsc_stats, struct rtattr *secy_stats,
|
|
|
049c96 |
+ struct rtattr *sa)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct rtattr *sa_attr[MACSEC_SA_ATTR_MAX + 1];
|
|
|
049c96 |
+ struct rtattr *a;
|
|
|
049c96 |
+ int rem;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("%sTXSC: %016llx on SA %d\n", prefix, sci, encoding_sa);
|
|
|
049c96 |
+ print_secy_stats(prefix, secy_stats);
|
|
|
049c96 |
+ print_txsc_stats(prefix, txsc_stats);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ rem = RTA_PAYLOAD(sa);
|
|
|
049c96 |
+ for (a = RTA_DATA(sa); RTA_OK(a, rem); a = RTA_NEXT(a, rem)) {
|
|
|
049c96 |
+ SPRINT_BUF(keyid);
|
|
|
049c96 |
+ bool state;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ parse_rtattr_nested(sa_attr, MACSEC_SA_ATTR_MAX + 1, a);
|
|
|
049c96 |
+ state = rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_ACTIVE]);
|
|
|
049c96 |
+ printf("%s%s%d: PN %u, state %s, key %s\n", prefix, prefix,
|
|
|
049c96 |
+ rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_AN]),
|
|
|
049c96 |
+ rta_getattr_u32(sa_attr[MACSEC_SA_ATTR_PN]),
|
|
|
049c96 |
+ values_on_off[state],
|
|
|
049c96 |
+ hexstring_n2a(RTA_DATA(sa_attr[MACSEC_SA_ATTR_KEYID]),
|
|
|
049c96 |
+ RTA_PAYLOAD(sa_attr[MACSEC_SA_ATTR_KEYID]),
|
|
|
049c96 |
+ keyid, sizeof(keyid)));
|
|
|
049c96 |
+ print_txsa_stats(prefix, sa_attr[MACSEC_SA_ATTR_STATS]);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static const char *rxsc_stats_names[NUM_MACSEC_RXSC_STATS_ATTR] = {
|
|
|
049c96 |
+ [MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED] = "InOctetsValidated",
|
|
|
049c96 |
+ [MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED] = "InOctetsDecrypted",
|
|
|
049c96 |
+ [MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED] = "InPktsUnchecked",
|
|
|
049c96 |
+ [MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED] = "InPktsDelayed",
|
|
|
049c96 |
+ [MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK] = "InPktsOK",
|
|
|
049c96 |
+ [MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID] = "InPktsInvalid",
|
|
|
049c96 |
+ [MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE] = "InPktsLate",
|
|
|
049c96 |
+ [MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID] = "InPktsNotValid",
|
|
|
049c96 |
+ [MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA] = "InPktsNotUsingSA",
|
|
|
049c96 |
+ [MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA] = "InPktsUnusedSA",
|
|
|
049c96 |
+};
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void print_rxsc_stats(const char *prefix, struct rtattr *attr)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct rtattr *stats[MACSEC_RXSC_STATS_ATTR_MAX + 1];
|
|
|
049c96 |
+ int i;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (!attr || show_stats == 0)
|
|
|
049c96 |
+ return;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ parse_rtattr_nested(stats, MACSEC_RXSC_STATS_ATTR_MAX + 1, attr);
|
|
|
049c96 |
+ printf("%sstats:", prefix);
|
|
|
049c96 |
+ for (i = 1; i < NUM_MACSEC_RXSC_STATS_ATTR; i++) {
|
|
|
049c96 |
+ if (!rxsc_stats_names[i])
|
|
|
049c96 |
+ continue;
|
|
|
049c96 |
+ printf(" %s", rxsc_stats_names[i]);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("\n%s ", prefix);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ for (i = 1; i < NUM_MACSEC_RXSC_STATS_ATTR; i++) {
|
|
|
049c96 |
+ if (!rxsc_stats_names[i])
|
|
|
049c96 |
+ continue;
|
|
|
049c96 |
+ print_one_stat(rxsc_stats_names, stats, i, true);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("\n");
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void print_rx_sc(const char *prefix, __u64 sci, __u8 active,
|
|
|
049c96 |
+ struct rtattr *rxsc_stats, struct rtattr *sa)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct rtattr *sa_attr[MACSEC_SA_ATTR_MAX + 1];
|
|
|
049c96 |
+ struct rtattr *a;
|
|
|
049c96 |
+ int rem;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("%sRXSC: %016llx, state %s\n", prefix, sci,
|
|
|
049c96 |
+ values_on_off[!!active]);
|
|
|
049c96 |
+ print_rxsc_stats(prefix, rxsc_stats);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ rem = RTA_PAYLOAD(sa);
|
|
|
049c96 |
+ for (a = RTA_DATA(sa); RTA_OK(a, rem); a = RTA_NEXT(a, rem)) {
|
|
|
049c96 |
+ SPRINT_BUF(keyid);
|
|
|
049c96 |
+ bool state;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ parse_rtattr_nested(sa_attr, MACSEC_SA_ATTR_MAX + 1, a);
|
|
|
049c96 |
+ state = rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_ACTIVE]);
|
|
|
049c96 |
+ printf("%s%s%d: PN %u, state %s, key %s\n", prefix, prefix,
|
|
|
049c96 |
+ rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_AN]),
|
|
|
049c96 |
+ rta_getattr_u32(sa_attr[MACSEC_SA_ATTR_PN]),
|
|
|
049c96 |
+ values_on_off[state],
|
|
|
049c96 |
+ hexstring_n2a(RTA_DATA(sa_attr[MACSEC_SA_ATTR_KEYID]),
|
|
|
049c96 |
+ RTA_PAYLOAD(sa_attr[MACSEC_SA_ATTR_KEYID]),
|
|
|
049c96 |
+ keyid, sizeof(keyid)));
|
|
|
049c96 |
+ print_rxsa_stats(prefix, sa_attr[MACSEC_SA_ATTR_STATS]);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int process(const struct sockaddr_nl *who, struct nlmsghdr *n,
|
|
|
049c96 |
+ void *arg)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ struct genlmsghdr *ghdr;
|
|
|
049c96 |
+ struct rtattr *attrs[MACSEC_ATTR_MAX + 1], *sc, *c;
|
|
|
049c96 |
+ struct rtattr *attrs_secy[MACSEC_SECY_ATTR_MAX + 1];
|
|
|
049c96 |
+ int len = n->nlmsg_len;
|
|
|
049c96 |
+ int ifindex;
|
|
|
049c96 |
+ __u64 sci;
|
|
|
049c96 |
+ __u8 encoding_sa;
|
|
|
049c96 |
+ int rem;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (n->nlmsg_type != genl_family)
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ len -= NLMSG_LENGTH(GENL_HDRLEN);
|
|
|
049c96 |
+ if (len < 0)
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ghdr = NLMSG_DATA(n);
|
|
|
049c96 |
+ if (ghdr->cmd != MACSEC_CMD_GET_TXSC)
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ parse_rtattr(attrs, MACSEC_ATTR_MAX, (void *) ghdr + GENL_HDRLEN, len);
|
|
|
049c96 |
+ if (!validate_dump(attrs)) {
|
|
|
049c96 |
+ printf("incomplete dump message\n");
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ifindex = rta_getattr_u32(attrs[MACSEC_ATTR_IFINDEX]);
|
|
|
049c96 |
+ parse_rtattr_nested(attrs_secy, MACSEC_SECY_ATTR_MAX + 1,
|
|
|
049c96 |
+ attrs[MACSEC_ATTR_SECY]);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (!validate_secy_dump(attrs_secy)) {
|
|
|
049c96 |
+ printf("incomplete dump message\n");
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ sci = rta_getattr_u64(attrs_secy[MACSEC_SECY_ATTR_SCI]);
|
|
|
049c96 |
+ encoding_sa = rta_getattr_u8(attrs_secy[MACSEC_SECY_ATTR_ENCODING_SA]);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (filter.ifindex && ifindex != filter.ifindex)
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (filter.sci && sci != filter.sci)
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ printf("%d: %s: ", ifindex, ll_index_to_name(ifindex));
|
|
|
049c96 |
+ print_attrs(" ", attrs_secy);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ print_tx_sc(" ", sci, encoding_sa,
|
|
|
049c96 |
+ attrs[MACSEC_ATTR_TXSC_STATS],
|
|
|
049c96 |
+ attrs[MACSEC_ATTR_SECY_STATS],
|
|
|
049c96 |
+ attrs[MACSEC_ATTR_TXSA_LIST]);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (!attrs[MACSEC_ATTR_RXSC_LIST])
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ sc = attrs[MACSEC_ATTR_RXSC_LIST];
|
|
|
049c96 |
+ rem = RTA_PAYLOAD(sc);
|
|
|
049c96 |
+ for (c = RTA_DATA(sc); RTA_OK(c, rem); c = RTA_NEXT(c, rem)) {
|
|
|
049c96 |
+ struct rtattr *sc_attr[MACSEC_RXSC_ATTR_MAX + 1];
|
|
|
049c96 |
+
|
|
|
049c96 |
+ parse_rtattr_nested(sc_attr, MACSEC_RXSC_ATTR_MAX + 1, c);
|
|
|
049c96 |
+ print_rx_sc(" ",
|
|
|
049c96 |
+ rta_getattr_u64(sc_attr[MACSEC_RXSC_ATTR_SCI]),
|
|
|
049c96 |
+ rta_getattr_u32(sc_attr[MACSEC_RXSC_ATTR_ACTIVE]),
|
|
|
049c96 |
+ sc_attr[MACSEC_RXSC_ATTR_STATS],
|
|
|
049c96 |
+ sc_attr[MACSEC_RXSC_ATTR_SA_LIST]);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int do_dump(int ifindex)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ MACSEC_GENL_REQ(req, MACSEC_BUFLEN, MACSEC_CMD_GET_TXSC,
|
|
|
049c96 |
+ NLM_F_REQUEST | NLM_F_DUMP);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ memset(&filter, 0, sizeof(filter));
|
|
|
049c96 |
+ filter.ifindex = ifindex;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ req.n.nlmsg_seq = genl_rth.dump = ++genl_rth.seq;
|
|
|
049c96 |
+ if (rtnl_send(&genl_rth, &req, req.n.nlmsg_len) < 0) {
|
|
|
049c96 |
+ perror("Failed to send dump request");
|
|
|
049c96 |
+ exit(1);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (rtnl_dump_filter(&genl_rth, process, stdout) < 0) {
|
|
|
049c96 |
+ fprintf(stderr, "Dump terminated\n");
|
|
|
049c96 |
+ exit(1);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int do_show(int argc, char **argv)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ int ifindex;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (argc == 0)
|
|
|
049c96 |
+ return do_dump(0);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ifindex = ll_name_to_index(*argv);
|
|
|
049c96 |
+ if (ifindex == 0) {
|
|
|
049c96 |
+ fprintf(stderr, "Device \"%s\" does not exist.\n", *argv);
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ argc--, argv++;
|
|
|
049c96 |
+ if (argc == 0)
|
|
|
049c96 |
+ return do_dump(ifindex);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ipmacsec_usage();
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+int do_ipmacsec(int argc, char **argv)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ init_genl();
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (argc < 1)
|
|
|
049c96 |
+ ipmacsec_usage();
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (matches(*argv, "help") == 0)
|
|
|
049c96 |
+ ipmacsec_usage();
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (matches(*argv, "show") == 0)
|
|
|
049c96 |
+ return do_show(argc-1, argv+1);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (matches(*argv, "add") == 0)
|
|
|
049c96 |
+ return do_modify(CMD_ADD, argc-1, argv+1);
|
|
|
049c96 |
+ if (matches(*argv, "set") == 0)
|
|
|
049c96 |
+ return do_modify(CMD_UPD, argc-1, argv+1);
|
|
|
049c96 |
+ if (matches(*argv, "delete") == 0)
|
|
|
049c96 |
+ return do_modify(CMD_DEL, argc-1, argv+1);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ fprintf(stderr, "Command \"%s\" is unknown, try \"ip macsec help\".\n",
|
|
|
049c96 |
+ *argv);
|
|
|
049c96 |
+ exit(-1);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+/* device creation */
|
|
|
049c96 |
+static void macsec_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ if (!tb)
|
|
|
049c96 |
+ return;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (tb[IFLA_MACSEC_SCI]) {
|
|
|
049c96 |
+ fprintf(f, "sci %016llx ",
|
|
|
049c96 |
+ rta_getattr_u64(tb[IFLA_MACSEC_SCI]));
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ print_flag(f, tb, "protect", IFLA_MACSEC_PROTECT);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (tb[IFLA_MACSEC_CIPHER_SUITE]) {
|
|
|
049c96 |
+ __u64 csid = rta_getattr_u64(tb[IFLA_MACSEC_CIPHER_SUITE]);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ fprintf(f, "cipher %s ", cs_id_to_name(csid));
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (tb[IFLA_MACSEC_ICV_LEN]) {
|
|
|
049c96 |
+ fprintf(f, "icvlen %hhu ",
|
|
|
049c96 |
+ rta_getattr_u8(tb[IFLA_MACSEC_ICV_LEN]));
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (tb[IFLA_MACSEC_ENCODING_SA]) {
|
|
|
049c96 |
+ fprintf(f, "encodingsa %hhu ",
|
|
|
049c96 |
+ rta_getattr_u8(tb[IFLA_MACSEC_ENCODING_SA]));
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (tb[IFLA_MACSEC_VALIDATION]) {
|
|
|
049c96 |
+ __u8 val = rta_getattr_u8(tb[IFLA_MACSEC_VALIDATION]);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ fprintf(f, "validate %s ", VALIDATE_STR[val]);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ print_flag(f, tb, "encrypt", IFLA_MACSEC_ENCRYPT);
|
|
|
049c96 |
+ print_flag(f, tb, "send_sci", IFLA_MACSEC_INC_SCI);
|
|
|
049c96 |
+ print_flag(f, tb, "end_station", IFLA_MACSEC_ES);
|
|
|
049c96 |
+ print_flag(f, tb, "scb", IFLA_MACSEC_SCB);
|
|
|
049c96 |
+
|
|
|
049c96 |
+ print_flag(f, tb, "replay", IFLA_MACSEC_REPLAY_PROTECT);
|
|
|
049c96 |
+ if (tb[IFLA_MACSEC_WINDOW]) {
|
|
|
049c96 |
+ fprintf(f, "window %d ",
|
|
|
049c96 |
+ rta_getattr_u32(tb[IFLA_MACSEC_WINDOW]));
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int do_cipher_suite(struct cipher_args *cipher, int *argcp,
|
|
|
049c96 |
+ char ***argvp)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ char **argv = *argvp;
|
|
|
049c96 |
+ int argc = *argcp;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (argc == 0)
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (strcmp(*argv, "default") == 0 ||
|
|
|
049c96 |
+ strcmp(*argv, "gcm-aes-128") == 0 ||
|
|
|
049c96 |
+ strcmp(*argv, "GCM-AES-128") == 0)
|
|
|
049c96 |
+ cipher->id = MACSEC_DEFAULT_CIPHER_ID;
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (strcmp(*argv, "icvlen") == 0) {
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ if (cipher->icv_len != 0)
|
|
|
049c96 |
+ duparg2("icvlen", "icvlen");
|
|
|
049c96 |
+ get_icvlen(&cipher->icv_len, *argv);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+ *argcp = argc;
|
|
|
049c96 |
+ *argvp = argv;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static bool check_txsc_flags(bool es, bool scb, bool sci)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ if (sci && (es || scb))
|
|
|
049c96 |
+ return false;
|
|
|
049c96 |
+ if (es && scb)
|
|
|
049c96 |
+ return false;
|
|
|
049c96 |
+ return true;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void usage(FILE *f)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ fprintf(f,
|
|
|
049c96 |
+ "Usage: ... macsec [ port PORT | sci SCI ]\n"
|
|
|
049c96 |
+ " [ cipher CIPHER_SUITE ]\n"
|
|
|
049c96 |
+ " [ encrypt { on | off } ]\n"
|
|
|
049c96 |
+ " [ send_sci { on | off } ]\n"
|
|
|
049c96 |
+ " [ end_station { on | off } ]\n"
|
|
|
049c96 |
+ " [ scb { on | off } ]\n"
|
|
|
049c96 |
+ " [ protect { on | off } ]\n"
|
|
|
049c96 |
+ " [ replay { on | off} window { 0..2^32-1 } ]\n"
|
|
|
049c96 |
+ " [ validate { strict | check | disabled } ]\n"
|
|
|
049c96 |
+ " [ encodingsa { 0..3 } ]\n"
|
|
|
049c96 |
+ );
|
|
|
049c96 |
+ fprintf(f, "CIPHER_SUITE := [ default = gcm-aes-128 ] icvlen { 8..32 }\n");
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static int macsec_parse_opt(struct link_util *lu, int argc, char **argv,
|
|
|
049c96 |
+ struct nlmsghdr *hdr)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ int ret;
|
|
|
049c96 |
+ __u8 encoding_sa = 0xff;
|
|
|
049c96 |
+ __u32 window = -1;
|
|
|
049c96 |
+ struct cipher_args cipher = {0};
|
|
|
049c96 |
+ enum macsec_validation_type validate;
|
|
|
049c96 |
+ bool es = false, scb = false, send_sci = false;
|
|
|
049c96 |
+ int replay_protect = -1;
|
|
|
049c96 |
+ struct sci sci = { 0 };
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ret = get_sci_portaddr(&sci, &argc, &argv, true, true);
|
|
|
049c96 |
+ if (ret < 0) {
|
|
|
049c96 |
+ fprintf(stderr, "expected sci\n");
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (ret > 0) {
|
|
|
049c96 |
+ if (sci.sci)
|
|
|
049c96 |
+ addattr_l(hdr, MACSEC_BUFLEN, IFLA_MACSEC_SCI,
|
|
|
049c96 |
+ &sci.sci, sizeof(sci.sci));
|
|
|
049c96 |
+ else
|
|
|
049c96 |
+ addattr_l(hdr, MACSEC_BUFLEN, IFLA_MACSEC_PORT,
|
|
|
049c96 |
+ &sci.port, sizeof(sci.port));
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ while (argc > 0) {
|
|
|
049c96 |
+ if (strcmp(*argv, "cipher") == 0) {
|
|
|
049c96 |
+ if (cipher.id)
|
|
|
049c96 |
+ duparg2("cipher", "cipher");
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ if (do_cipher_suite(&cipher, &argc, &argv))
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ } else if (strcmp(*argv, "encrypt") == 0) {
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ int i;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ret = one_of("encrypt", *argv, values_on_off,
|
|
|
049c96 |
+ ARRAY_SIZE(values_on_off), &i);
|
|
|
049c96 |
+ if (ret != 0)
|
|
|
049c96 |
+ return ret;
|
|
|
049c96 |
+ addattr8(hdr, MACSEC_BUFLEN, IFLA_MACSEC_ENCRYPT, i);
|
|
|
049c96 |
+ } else if (strcmp(*argv, "send_sci") == 0) {
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ int i;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ret = one_of("send_sci", *argv, values_on_off,
|
|
|
049c96 |
+ ARRAY_SIZE(values_on_off), &i);
|
|
|
049c96 |
+ if (ret != 0)
|
|
|
049c96 |
+ return ret;
|
|
|
049c96 |
+ send_sci = i;
|
|
|
049c96 |
+ addattr8(hdr, MACSEC_BUFLEN,
|
|
|
049c96 |
+ IFLA_MACSEC_INC_SCI, send_sci);
|
|
|
049c96 |
+ } else if (strcmp(*argv, "end_station") == 0) {
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ int i;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ret = one_of("end_station", *argv, values_on_off,
|
|
|
049c96 |
+ ARRAY_SIZE(values_on_off), &i);
|
|
|
049c96 |
+ if (ret != 0)
|
|
|
049c96 |
+ return ret;
|
|
|
049c96 |
+ es = i;
|
|
|
049c96 |
+ addattr8(hdr, MACSEC_BUFLEN, IFLA_MACSEC_ES, es);
|
|
|
049c96 |
+ } else if (strcmp(*argv, "scb") == 0) {
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ int i;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ret = one_of("scb", *argv, values_on_off,
|
|
|
049c96 |
+ ARRAY_SIZE(values_on_off), &i);
|
|
|
049c96 |
+ if (ret != 0)
|
|
|
049c96 |
+ return ret;
|
|
|
049c96 |
+ scb = i;
|
|
|
049c96 |
+ addattr8(hdr, MACSEC_BUFLEN, IFLA_MACSEC_SCB, scb);
|
|
|
049c96 |
+ } else if (strcmp(*argv, "protect") == 0) {
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ int i;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ret = one_of("protect", *argv, values_on_off,
|
|
|
049c96 |
+ ARRAY_SIZE(values_on_off), &i);
|
|
|
049c96 |
+ if (ret != 0)
|
|
|
049c96 |
+ return ret;
|
|
|
049c96 |
+ addattr8(hdr, MACSEC_BUFLEN, IFLA_MACSEC_PROTECT, i);
|
|
|
049c96 |
+ } else if (strcmp(*argv, "replay") == 0) {
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ int i;
|
|
|
049c96 |
+
|
|
|
049c96 |
+ ret = one_of("replay", *argv, values_on_off,
|
|
|
049c96 |
+ ARRAY_SIZE(values_on_off), &i);
|
|
|
049c96 |
+ if (ret != 0)
|
|
|
049c96 |
+ return ret;
|
|
|
049c96 |
+ replay_protect = !!i;
|
|
|
049c96 |
+ } else if (strcmp(*argv, "window") == 0) {
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ ret = get_u32(&window, *argv, 0);
|
|
|
049c96 |
+ if (ret)
|
|
|
049c96 |
+ invarg("expected replay window size", *argv);
|
|
|
049c96 |
+ } else if (strcmp(*argv, "validate") == 0) {
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ ret = one_of("validate", *argv,
|
|
|
049c96 |
+ VALIDATE_STR, ARRAY_SIZE(VALIDATE_STR),
|
|
|
049c96 |
+ (int *)&validate);
|
|
|
049c96 |
+ if (ret != 0)
|
|
|
049c96 |
+ return ret;
|
|
|
049c96 |
+ addattr8(hdr, MACSEC_BUFLEN,
|
|
|
049c96 |
+ IFLA_MACSEC_VALIDATION, validate);
|
|
|
049c96 |
+ } else if (strcmp(*argv, "encodingsa") == 0) {
|
|
|
049c96 |
+ if (encoding_sa != 0xff)
|
|
|
049c96 |
+ duparg2("encodingsa", "encodingsa");
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ ret = get_an(&encoding_sa, *argv);
|
|
|
049c96 |
+ if (ret)
|
|
|
049c96 |
+ invarg("expected an { 0..3 }", *argv);
|
|
|
049c96 |
+ } else {
|
|
|
049c96 |
+ fprintf(stderr, "macsec: unknown command \"%s\"?\n",
|
|
|
049c96 |
+ *argv);
|
|
|
049c96 |
+ usage(stderr);
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ argv++; argc--;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (!check_txsc_flags(es, scb, send_sci)) {
|
|
|
049c96 |
+ fprintf(stderr, "invalid combination of send_sci/end_station/scb\n");
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (window != -1 && replay_protect == -1) {
|
|
|
049c96 |
+ fprintf(stderr,
|
|
|
049c96 |
+ "replay window set, but replay protection not enabled. did you mean 'replay on window %u'?\n",
|
|
|
049c96 |
+ window);
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ } else if (window == -1 && replay_protect == 1) {
|
|
|
049c96 |
+ fprintf(stderr,
|
|
|
049c96 |
+ "replay protection enabled, but no window set. did you mean 'replay on window VALUE'?\n");
|
|
|
049c96 |
+ return -1;
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (cipher.id) {
|
|
|
049c96 |
+ addattr_l(hdr, MACSEC_BUFLEN, IFLA_MACSEC_CIPHER_SUITE,
|
|
|
049c96 |
+ &cipher.id, sizeof(cipher.id));
|
|
|
049c96 |
+ addattr_l(hdr, MACSEC_BUFLEN, IFLA_MACSEC_ICV_LEN,
|
|
|
049c96 |
+ &cipher.icv_len, sizeof(cipher.icv_len));
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (replay_protect != -1) {
|
|
|
049c96 |
+ addattr32(hdr, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window);
|
|
|
049c96 |
+ addattr8(hdr, MACSEC_BUFLEN, IFLA_MACSEC_REPLAY_PROTECT,
|
|
|
049c96 |
+ replay_protect);
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ if (encoding_sa != 0xff) {
|
|
|
049c96 |
+ addattr_l(hdr, MACSEC_BUFLEN, IFLA_MACSEC_ENCODING_SA,
|
|
|
049c96 |
+ &encoding_sa, sizeof(encoding_sa));
|
|
|
049c96 |
+ }
|
|
|
049c96 |
+
|
|
|
049c96 |
+ return 0;
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+static void macsec_print_help(struct link_util *lu, int argc, char **argv,
|
|
|
049c96 |
+ FILE *f)
|
|
|
049c96 |
+{
|
|
|
049c96 |
+ usage(f);
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+struct link_util macsec_link_util = {
|
|
|
049c96 |
+ .id = "macsec",
|
|
|
049c96 |
+ .maxattr = IFLA_MACSEC_MAX,
|
|
|
049c96 |
+ .parse_opt = macsec_parse_opt,
|
|
|
049c96 |
+ .print_help = macsec_print_help,
|
|
|
049c96 |
+ .print_opt = macsec_print_opt,
|
|
|
049c96 |
+ .slave = false,
|
|
|
049c96 |
+};
|
|
|
049c96 |
diff --git a/man/man8/Makefile b/man/man8/Makefile
|
|
|
049c96 |
index 8389fce..f3a3fa5 100644
|
|
|
049c96 |
--- a/man/man8/Makefile
|
|
|
049c96 |
+++ b/man/man8/Makefile
|
|
|
049c96 |
@@ -7,7 +7,7 @@ MAN8PAGES = $(TARGETS) ip.8 arpd.8 lnstat.8 routel.8 rtacct.8 rtmon.8 rtpr.8 ss.
|
|
|
049c96 |
tc-netem.8 tc-pfifo.8 tc-pfifo_fast.8 tc-prio.8 tc-red.8 \
|
|
|
049c96 |
tc-sfb.8 tc-sfq.8 tc-stab.8 tc-tbf.8 \
|
|
|
049c96 |
bridge.8 rtstat.8 ctstat.8 nstat.8 routef.8 \
|
|
|
049c96 |
- ip-addrlabel.8 ip-l2tp.8 \
|
|
|
049c96 |
+ ip-addrlabel.8 ip-l2tp.8 ip-macsec.8 \
|
|
|
049c96 |
ip-maddress.8 ip-monitor.8 ip-mroute.8 ip-neighbour.8 \
|
|
|
049c96 |
ip-netns.8 ip-ntable.8 ip-rule.8 ip-tunnel.8 ip-xfrm.8 \
|
|
|
049c96 |
ip-tcp_metrics.8 ip-netconf.8 ip-token.8 \
|
|
|
049c96 |
diff --git a/man/man8/ip-link.8.in b/man/man8/ip-link.8.in
|
|
|
049c96 |
index 3002e47..ac3bb77 100644
|
|
|
049c96 |
--- a/man/man8/ip-link.8.in
|
|
|
049c96 |
+++ b/man/man8/ip-link.8.in
|
|
|
049c96 |
@@ -235,6 +235,9 @@ Link types:
|
|
|
049c96 |
.sp
|
|
|
049c96 |
.BR geneve
|
|
|
049c96 |
- GEneric NEtwork Virtualization Encapsulation
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BR macsec
|
|
|
049c96 |
+- Interface for IEEE 802.1AE MAC Security (MACsec)
|
|
|
049c96 |
.in -8
|
|
|
049c96 |
|
|
|
049c96 |
.TP
|
|
|
049c96 |
@@ -751,6 +754,88 @@ forces the underlying interface into promiscuous mode. Passing the
|
|
|
049c96 |
using standard tools.
|
|
|
049c96 |
.in -8
|
|
|
049c96 |
|
|
|
049c96 |
+.TP
|
|
|
049c96 |
+MACsec Type Support
|
|
|
049c96 |
+For a link of type
|
|
|
049c96 |
+.I MACsec
|
|
|
049c96 |
+the following additional arguments are supported:
|
|
|
049c96 |
+
|
|
|
049c96 |
+.BI "ip link add link " DEVICE " name " NAME " type macsec"
|
|
|
049c96 |
+[
|
|
|
049c96 |
+.BI port " PORT"
|
|
|
049c96 |
+|
|
|
|
049c96 |
+.BI sci " SCI"
|
|
|
049c96 |
+] [
|
|
|
049c96 |
+.BI cipher " CIPHER_SUITE"
|
|
|
049c96 |
+] [
|
|
|
049c96 |
+.BR encrypt " {"
|
|
|
049c96 |
+.BR on " | " off " } ] [ "
|
|
|
049c96 |
+.BR send_sci " { " on " | " off " } ] ["
|
|
|
049c96 |
+.BR es " { " on " | " off " } ] ["
|
|
|
049c96 |
+.BR scb " { " on " | " off " } ] ["
|
|
|
049c96 |
+.BR protect " { " on " | " off " } ] ["
|
|
|
049c96 |
+.BR replay " { " on " | " off " }"
|
|
|
049c96 |
+.BR window " { "
|
|
|
049c96 |
+.IR 0..2^32-1 " } ] ["
|
|
|
049c96 |
+.BR validate " { " strict " | " check " | " disabled " } ] ["
|
|
|
049c96 |
+.BR encoding " { "
|
|
|
049c96 |
+.IR 0..3 " } ]"
|
|
|
049c96 |
+
|
|
|
049c96 |
+.in +8
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BI port " PORT "
|
|
|
049c96 |
+- sets the port number for this MACsec device.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BI sci " SCI "
|
|
|
049c96 |
+- sets the SCI for this MACsec device.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BI cipher " CIPHER_SUITE "
|
|
|
049c96 |
+- defines the cipher suite to use.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BR "encrypt on " or " encrypt off"
|
|
|
049c96 |
+- switches between authenticated encryption, or authenticity mode only.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BR "send_sci on " or " send_sci off"
|
|
|
049c96 |
+- specifies whether the SCI is included in every packet, or only when it is necessary.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BR "es on " or " es off"
|
|
|
049c96 |
+- sets the End Station bit.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BR "scb on " or " scb off"
|
|
|
049c96 |
+- sets the Single Copy Broadcast bit.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BR "protect on " or " protect off"
|
|
|
049c96 |
+- enables MACsec protection on the device.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BR "replay on " or " replay off"
|
|
|
049c96 |
+- enables replay protection on the device.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.in +8
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BI window " SIZE "
|
|
|
049c96 |
+- sets the size of the replay window.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.in -8
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BR "validate strict " or " validate check " or " validate disabled"
|
|
|
049c96 |
+- sets the validation mode on the device.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BI encoding " AN "
|
|
|
049c96 |
+- sets the active secure association for transmission.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.in -8
|
|
|
049c96 |
+
|
|
|
049c96 |
.SS ip link delete - delete virtual link
|
|
|
049c96 |
|
|
|
049c96 |
.TP
|
|
|
049c96 |
diff --git a/man/man8/ip-macsec.8 b/man/man8/ip-macsec.8
|
|
|
049c96 |
new file mode 100644
|
|
|
049c96 |
index 0000000..e8455d7
|
|
|
049c96 |
--- /dev/null
|
|
|
049c96 |
+++ b/man/man8/ip-macsec.8
|
|
|
049c96 |
@@ -0,0 +1,98 @@
|
|
|
049c96 |
+.TH IP\-MACSEC 8 "07 Mar 2016" "iproute" "Linux"
|
|
|
049c96 |
+.SH NAME
|
|
|
049c96 |
+ip-macsec \- MACsec device configuration
|
|
|
049c96 |
+.SH "SYNOPSIS"
|
|
|
049c96 |
+.BI "ip link add link " DEVICE " name " NAME " type macsec "
|
|
|
049c96 |
+[ [
|
|
|
049c96 |
+.BR cipher " { " default " | " gcm-aes-128 " } ] "
|
|
|
049c96 |
+.BI icvlen " ICVLEN"
|
|
|
049c96 |
+] [ [
|
|
|
049c96 |
+.BR encrypt " { " on " | " off " } ] ["
|
|
|
049c96 |
+.BR send_sci " { " on " | " off " } ] ["
|
|
|
049c96 |
+.BR end_station " { " on " | " off " } ] ["
|
|
|
049c96 |
+.BR scb " { " on " | " off " } ] ["
|
|
|
049c96 |
+.BR protect " { " on " | " off " } ] ["
|
|
|
049c96 |
+.BR replay " { " on " | " off " } ] ["
|
|
|
049c96 |
+.BI window " WINDOW"
|
|
|
049c96 |
+] [
|
|
|
049c96 |
+.BI encodingsa " SA"
|
|
|
049c96 |
+]
|
|
|
049c96 |
+
|
|
|
049c96 |
+.BI "ip macsec add " DEV " tx sa"
|
|
|
049c96 |
+.RI "{ " 0..3 " } [ " OPTS " ]"
|
|
|
049c96 |
+.BI key " ID KEY"
|
|
|
049c96 |
+.br
|
|
|
049c96 |
+.BI "ip macsec set " DEV " tx sa"
|
|
|
049c96 |
+.RI "{ " 0..3 " } [ " OPTS " ]"
|
|
|
049c96 |
+.br
|
|
|
049c96 |
+.BI "ip macsec del " DEV " tx sa"
|
|
|
049c96 |
+.RI "{ " 0..3 " }"
|
|
|
049c96 |
+
|
|
|
049c96 |
+.BI "ip macsec add " DEV " rx " SCI
|
|
|
049c96 |
+.RB [ " on " | " off " ]
|
|
|
049c96 |
+.br
|
|
|
049c96 |
+.BI "ip macsec set " DEV " rx " SCI
|
|
|
049c96 |
+.RB [ " on " | " off " ]
|
|
|
049c96 |
+.br
|
|
|
049c96 |
+.BI "ip macsec del " DEV " rx " SCI
|
|
|
049c96 |
+
|
|
|
049c96 |
+.BI "ip macsec add " DEV " rx " SCI " sa"
|
|
|
049c96 |
+.RI "{ " 0..3 " } [ " OPTS " ]"
|
|
|
049c96 |
+.BI key " ID KEY"
|
|
|
049c96 |
+.br
|
|
|
049c96 |
+.BI "ip macsec set " DEV " rx " SCI " sa"
|
|
|
049c96 |
+.RI "{ " 0..3 " } [ " OPTS " ]"
|
|
|
049c96 |
+.br
|
|
|
049c96 |
+.BI "ip macsec del " DEV " rx " SCI " sa"
|
|
|
049c96 |
+.RI "{ " 0..3 " }"
|
|
|
049c96 |
+
|
|
|
049c96 |
+.B ip macsec show
|
|
|
049c96 |
+.RI [ " DEV " ]
|
|
|
049c96 |
+
|
|
|
049c96 |
+.IR OPTS " := [ "
|
|
|
049c96 |
+.BR pn " { "
|
|
|
049c96 |
+.IR 1..2^32-1 " } ] ["
|
|
|
049c96 |
+.BR on " | " off " ]"
|
|
|
049c96 |
+.br
|
|
|
049c96 |
+.IR SCI " := { "
|
|
|
049c96 |
+.B sci
|
|
|
049c96 |
+.IR <u64> " | "
|
|
|
049c96 |
+.BI port " <u16> " address " <lladdr> "
|
|
|
049c96 |
+}
|
|
|
049c96 |
+
|
|
|
049c96 |
+
|
|
|
049c96 |
+.SH DESCRIPTION
|
|
|
049c96 |
+The
|
|
|
049c96 |
+.B ip macsec
|
|
|
049c96 |
+commands are used to configure transmit secure associations and receive secure channels and their secure associations on a MACsec device created with the
|
|
|
049c96 |
+.B ip link add
|
|
|
049c96 |
+command using the
|
|
|
049c96 |
+.I macsec
|
|
|
049c96 |
+type.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.SH EXAMPLES
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
+.SS Create a MACsec device on link eth0
|
|
|
049c96 |
+.nf
|
|
|
049c96 |
+# ip link add device eth0 macsec0 type macsec port 11 encrypt on
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
+.SS Configure a secure association on that device
|
|
|
049c96 |
+.nf
|
|
|
049c96 |
+# ip macsec add macsec0 tx sa 0 pn 1024 on key 01 81818181818181818181818181818181
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
+.SS Configure a receive channel
|
|
|
049c96 |
+.nf
|
|
|
049c96 |
+# ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
+.SS Configure a receive association
|
|
|
049c96 |
+.nf
|
|
|
049c96 |
+# ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0 sa 0 pn 1 on key 00 82828282828282828282828282828282
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
+.SS Display MACsec configuration
|
|
|
049c96 |
+.nf
|
|
|
049c96 |
+# ip macsec show
|
|
|
049c96 |
+.SH SEE ALSO
|
|
|
049c96 |
+.br
|
|
|
049c96 |
+.BR ip-link (8)
|
|
|
049c96 |
+.SH AUTHOR
|
|
|
049c96 |
+Sabrina Dubroca <sd@queasysnail.net>
|
|
|
049c96 |
--
|
|
|
049c96 |
1.8.3.1
|
|
|
049c96 |
|