1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * drivers/net/macsec.c - MACsec device
5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
8 #include <linux/types.h>
9 #include <linux/skbuff.h>
10 #include <linux/socket.h>
11 #include <linux/module.h>
12 #include <crypto/aead.h>
13 #include <linux/etherdevice.h>
14 #include <linux/netdevice.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/refcount.h>
17 #include <net/genetlink.h>
19 #include <net/gro_cells.h>
20 #include <net/macsec.h>
21 #include <net/dst_metadata.h>
22 #include <linux/phy.h>
23 #include <linux/byteorder/generic.h>
24 #include <linux/if_arp.h>
26 #include <uapi/linux/if_macsec.h>
28 /* SecTAG length = macsec_eth_header without the optional SCI */
29 #define MACSEC_TAG_LEN 6
31 struct macsec_eth_header
{
35 #if defined(__LITTLE_ENDIAN_BITFIELD)
38 #elif defined(__BIG_ENDIAN_BITFIELD)
42 #error "Please fix <asm/byteorder.h>"
45 u8 secure_channel_id
[8]; /* optional */
48 /* minimum secure data length deemed "not short", see IEEE 802.1AE-2006 9.7 */
49 #define MIN_NON_SHORT_LEN 48
51 #define GCM_AES_IV_LEN 12
53 #define for_each_rxsc(secy, sc) \
54 for (sc = rcu_dereference_bh(secy->rx_sc); \
56 sc = rcu_dereference_bh(sc->next))
57 #define for_each_rxsc_rtnl(secy, sc) \
58 for (sc = rtnl_dereference(secy->rx_sc); \
60 sc = rtnl_dereference(sc->next))
62 #define pn_same_half(pn1, pn2) (!(((pn1) >> 31) ^ ((pn2) >> 31)))
66 u8 short_secure_channel_id
[4];
74 u8 secure_channel_id
[8];
80 #define MACSEC_VALIDATE_DEFAULT MACSEC_VALIDATE_STRICT
82 struct pcpu_secy_stats
{
83 struct macsec_dev_stats stats
;
84 struct u64_stats_sync syncp
;
88 * struct macsec_dev - private data
90 * @real_dev: pointer to underlying netdevice
91 * @dev_tracker: refcount tracker for @real_dev reference
92 * @stats: MACsec device stats
93 * @secys: linked list of SecY's on the underlying device
94 * @gro_cells: pointer to the Generic Receive Offload cell
95 * @offload: status of offloading on the MACsec device
98 struct macsec_secy secy
;
99 struct net_device
*real_dev
;
100 netdevice_tracker dev_tracker
;
101 struct pcpu_secy_stats __percpu
*stats
;
102 struct list_head secys
;
103 struct gro_cells gro_cells
;
104 enum macsec_offload offload
;
108 * struct macsec_rxh_data - rx_handler private argument
109 * @secys: linked list of SecY's on this underlying device
111 struct macsec_rxh_data
{
112 struct list_head secys
;
115 static struct macsec_dev
*macsec_priv(const struct net_device
*dev
)
117 return (struct macsec_dev
*)netdev_priv(dev
);
120 static struct macsec_rxh_data
*macsec_data_rcu(const struct net_device
*dev
)
122 return rcu_dereference_bh(dev
->rx_handler_data
);
125 static struct macsec_rxh_data
*macsec_data_rtnl(const struct net_device
*dev
)
127 return rtnl_dereference(dev
->rx_handler_data
);
131 struct aead_request
*req
;
133 struct macsec_tx_sa
*tx_sa
;
134 struct macsec_rx_sa
*rx_sa
;
141 static struct macsec_rx_sa
*macsec_rxsa_get(struct macsec_rx_sa __rcu
*ptr
)
143 struct macsec_rx_sa
*sa
= rcu_dereference_bh(ptr
);
145 if (!sa
|| !sa
->active
)
148 if (!refcount_inc_not_zero(&sa
->refcnt
))
154 static struct macsec_rx_sa
*macsec_active_rxsa_get(struct macsec_rx_sc
*rx_sc
)
156 struct macsec_rx_sa
*sa
= NULL
;
159 for (an
= 0; an
< MACSEC_NUM_AN
; an
++) {
160 sa
= macsec_rxsa_get(rx_sc
->sa
[an
]);
167 static void free_rx_sc_rcu(struct rcu_head
*head
)
169 struct macsec_rx_sc
*rx_sc
= container_of(head
, struct macsec_rx_sc
, rcu_head
);
171 free_percpu(rx_sc
->stats
);
175 static struct macsec_rx_sc
*macsec_rxsc_get(struct macsec_rx_sc
*sc
)
177 return refcount_inc_not_zero(&sc
->refcnt
) ? sc
: NULL
;
180 static void macsec_rxsc_put(struct macsec_rx_sc
*sc
)
182 if (refcount_dec_and_test(&sc
->refcnt
))
183 call_rcu(&sc
->rcu_head
, free_rx_sc_rcu
);
186 static void free_rxsa(struct rcu_head
*head
)
188 struct macsec_rx_sa
*sa
= container_of(head
, struct macsec_rx_sa
, rcu
);
190 crypto_free_aead(sa
->key
.tfm
);
191 free_percpu(sa
->stats
);
195 static void macsec_rxsa_put(struct macsec_rx_sa
*sa
)
197 if (refcount_dec_and_test(&sa
->refcnt
))
198 call_rcu(&sa
->rcu
, free_rxsa
);
201 static struct macsec_tx_sa
*macsec_txsa_get(struct macsec_tx_sa __rcu
*ptr
)
203 struct macsec_tx_sa
*sa
= rcu_dereference_bh(ptr
);
205 if (!sa
|| !sa
->active
)
208 if (!refcount_inc_not_zero(&sa
->refcnt
))
214 static void free_txsa(struct rcu_head
*head
)
216 struct macsec_tx_sa
*sa
= container_of(head
, struct macsec_tx_sa
, rcu
);
218 crypto_free_aead(sa
->key
.tfm
);
219 free_percpu(sa
->stats
);
223 static void macsec_txsa_put(struct macsec_tx_sa
*sa
)
225 if (refcount_dec_and_test(&sa
->refcnt
))
226 call_rcu(&sa
->rcu
, free_txsa
);
229 static struct macsec_cb
*macsec_skb_cb(struct sk_buff
*skb
)
231 BUILD_BUG_ON(sizeof(struct macsec_cb
) > sizeof(skb
->cb
));
232 return (struct macsec_cb
*)skb
->cb
;
235 #define MACSEC_PORT_SCB (0x0000)
236 #define MACSEC_UNDEF_SCI ((__force sci_t)0xffffffffffffffffULL)
237 #define MACSEC_UNDEF_SSCI ((__force ssci_t)0xffffffff)
239 #define MACSEC_GCM_AES_128_SAK_LEN 16
240 #define MACSEC_GCM_AES_256_SAK_LEN 32
242 #define DEFAULT_SAK_LEN MACSEC_GCM_AES_128_SAK_LEN
243 #define DEFAULT_XPN false
244 #define DEFAULT_SEND_SCI true
245 #define DEFAULT_ENCRYPT false
246 #define DEFAULT_ENCODING_SA 0
247 #define MACSEC_XPN_MAX_REPLAY_WINDOW (((1 << 30) - 1))
249 static sci_t
make_sci(const u8
*addr
, __be16 port
)
253 memcpy(&sci
, addr
, ETH_ALEN
);
254 memcpy(((char *)&sci
) + ETH_ALEN
, &port
, sizeof(port
));
259 static sci_t
macsec_frame_sci(struct macsec_eth_header
*hdr
, bool sci_present
)
264 memcpy(&sci
, hdr
->secure_channel_id
,
265 sizeof(hdr
->secure_channel_id
));
267 sci
= make_sci(hdr
->eth
.h_source
, MACSEC_PORT_ES
);
272 static unsigned int macsec_sectag_len(bool sci_present
)
274 return MACSEC_TAG_LEN
+ (sci_present
? MACSEC_SCI_LEN
: 0);
277 static unsigned int macsec_hdr_len(bool sci_present
)
279 return macsec_sectag_len(sci_present
) + ETH_HLEN
;
282 static unsigned int macsec_extra_len(bool sci_present
)
284 return macsec_sectag_len(sci_present
) + sizeof(__be16
);
287 /* Fill SecTAG according to IEEE 802.1AE-2006 10.5.3 */
288 static void macsec_fill_sectag(struct macsec_eth_header
*h
,
289 const struct macsec_secy
*secy
, u32 pn
,
292 const struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
294 memset(&h
->tci_an
, 0, macsec_sectag_len(sci_present
));
295 h
->eth
.h_proto
= htons(ETH_P_MACSEC
);
298 h
->tci_an
|= MACSEC_TCI_SC
;
299 memcpy(&h
->secure_channel_id
, &secy
->sci
,
300 sizeof(h
->secure_channel_id
));
302 if (tx_sc
->end_station
)
303 h
->tci_an
|= MACSEC_TCI_ES
;
305 h
->tci_an
|= MACSEC_TCI_SCB
;
308 h
->packet_number
= htonl(pn
);
310 /* with GCM, C/E clear for !encrypt, both set for encrypt */
312 h
->tci_an
|= MACSEC_TCI_CONFID
;
313 else if (secy
->icv_len
!= MACSEC_DEFAULT_ICV_LEN
)
314 h
->tci_an
|= MACSEC_TCI_C
;
316 h
->tci_an
|= tx_sc
->encoding_sa
;
319 static void macsec_set_shortlen(struct macsec_eth_header
*h
, size_t data_len
)
321 if (data_len
< MIN_NON_SHORT_LEN
)
322 h
->short_length
= data_len
;
325 /* Checks if a MACsec interface is being offloaded to an hardware engine */
326 static bool macsec_is_offloaded(struct macsec_dev
*macsec
)
328 if (macsec
->offload
== MACSEC_OFFLOAD_MAC
||
329 macsec
->offload
== MACSEC_OFFLOAD_PHY
)
335 /* Checks if underlying layers implement MACsec offloading functions. */
336 static bool macsec_check_offload(enum macsec_offload offload
,
337 struct macsec_dev
*macsec
)
339 if (!macsec
|| !macsec
->real_dev
)
342 if (offload
== MACSEC_OFFLOAD_PHY
)
343 return macsec
->real_dev
->phydev
&&
344 macsec
->real_dev
->phydev
->macsec_ops
;
345 else if (offload
== MACSEC_OFFLOAD_MAC
)
346 return macsec
->real_dev
->features
& NETIF_F_HW_MACSEC
&&
347 macsec
->real_dev
->macsec_ops
;
352 static const struct macsec_ops
*__macsec_get_ops(enum macsec_offload offload
,
353 struct macsec_dev
*macsec
,
354 struct macsec_context
*ctx
)
357 memset(ctx
, 0, sizeof(*ctx
));
358 ctx
->offload
= offload
;
360 if (offload
== MACSEC_OFFLOAD_PHY
)
361 ctx
->phydev
= macsec
->real_dev
->phydev
;
362 else if (offload
== MACSEC_OFFLOAD_MAC
)
363 ctx
->netdev
= macsec
->real_dev
;
366 if (offload
== MACSEC_OFFLOAD_PHY
)
367 return macsec
->real_dev
->phydev
->macsec_ops
;
369 return macsec
->real_dev
->macsec_ops
;
372 /* Returns a pointer to the MACsec ops struct if any and updates the MACsec
373 * context device reference if provided.
375 static const struct macsec_ops
*macsec_get_ops(struct macsec_dev
*macsec
,
376 struct macsec_context
*ctx
)
378 if (!macsec_check_offload(macsec
->offload
, macsec
))
381 return __macsec_get_ops(macsec
->offload
, macsec
, ctx
);
384 /* validate MACsec packet according to IEEE 802.1AE-2018 9.12 */
385 static bool macsec_validate_skb(struct sk_buff
*skb
, u16 icv_len
, bool xpn
)
387 struct macsec_eth_header
*h
= (struct macsec_eth_header
*)skb
->data
;
388 int len
= skb
->len
- 2 * ETH_ALEN
;
389 int extra_len
= macsec_extra_len(!!(h
->tci_an
& MACSEC_TCI_SC
)) + icv_len
;
391 /* a) It comprises at least 17 octets */
395 /* b) MACsec EtherType: already checked */
397 /* c) V bit is clear */
398 if (h
->tci_an
& MACSEC_TCI_VERSION
)
401 /* d) ES or SCB => !SC */
402 if ((h
->tci_an
& MACSEC_TCI_ES
|| h
->tci_an
& MACSEC_TCI_SCB
) &&
403 (h
->tci_an
& MACSEC_TCI_SC
))
406 /* e) Bits 7 and 8 of octet 4 of the SecTAG are clear */
410 /* rx.pn != 0 if not XPN (figure 10-5 with 802.11AEbw-2013 amendment) */
411 if (!h
->packet_number
&& !xpn
)
414 /* length check, f) g) h) i) */
416 return len
== extra_len
+ h
->short_length
;
417 return len
>= extra_len
+ MIN_NON_SHORT_LEN
;
420 #define MACSEC_NEEDED_HEADROOM (macsec_extra_len(true))
421 #define MACSEC_NEEDED_TAILROOM MACSEC_STD_ICV_LEN
423 static void macsec_fill_iv_xpn(unsigned char *iv
, ssci_t ssci
, u64 pn
,
426 struct gcm_iv_xpn
*gcm_iv
= (struct gcm_iv_xpn
*)iv
;
428 gcm_iv
->ssci
= ssci
^ salt
.ssci
;
429 gcm_iv
->pn
= cpu_to_be64(pn
) ^ salt
.pn
;
432 static void macsec_fill_iv(unsigned char *iv
, sci_t sci
, u32 pn
)
434 struct gcm_iv
*gcm_iv
= (struct gcm_iv
*)iv
;
437 gcm_iv
->pn
= htonl(pn
);
440 static struct macsec_eth_header
*macsec_ethhdr(struct sk_buff
*skb
)
442 return (struct macsec_eth_header
*)skb_mac_header(skb
);
445 static void __macsec_pn_wrapped(struct macsec_secy
*secy
,
446 struct macsec_tx_sa
*tx_sa
)
448 pr_debug("PN wrapped, transitioning to !oper\n");
449 tx_sa
->active
= false;
450 if (secy
->protect_frames
)
451 secy
->operational
= false;
454 void macsec_pn_wrapped(struct macsec_secy
*secy
, struct macsec_tx_sa
*tx_sa
)
456 spin_lock_bh(&tx_sa
->lock
);
457 __macsec_pn_wrapped(secy
, tx_sa
);
458 spin_unlock_bh(&tx_sa
->lock
);
460 EXPORT_SYMBOL_GPL(macsec_pn_wrapped
);
462 static pn_t
tx_sa_update_pn(struct macsec_tx_sa
*tx_sa
,
463 struct macsec_secy
*secy
)
467 spin_lock_bh(&tx_sa
->lock
);
469 pn
= tx_sa
->next_pn_halves
;
473 tx_sa
->next_pn_halves
.lower
++;
475 if (tx_sa
->next_pn
== 0)
476 __macsec_pn_wrapped(secy
, tx_sa
);
477 spin_unlock_bh(&tx_sa
->lock
);
482 static void macsec_encrypt_finish(struct sk_buff
*skb
, struct net_device
*dev
)
484 struct macsec_dev
*macsec
= netdev_priv(dev
);
486 skb
->dev
= macsec
->real_dev
;
487 skb_reset_mac_header(skb
);
488 skb
->protocol
= eth_hdr(skb
)->h_proto
;
491 static unsigned int macsec_msdu_len(struct sk_buff
*skb
)
493 struct macsec_dev
*macsec
= macsec_priv(skb
->dev
);
494 struct macsec_secy
*secy
= &macsec
->secy
;
495 bool sci_present
= macsec_skb_cb(skb
)->has_sci
;
497 return skb
->len
- macsec_hdr_len(sci_present
) - secy
->icv_len
;
500 static void macsec_count_tx(struct sk_buff
*skb
, struct macsec_tx_sc
*tx_sc
,
501 struct macsec_tx_sa
*tx_sa
)
503 unsigned int msdu_len
= macsec_msdu_len(skb
);
504 struct pcpu_tx_sc_stats
*txsc_stats
= this_cpu_ptr(tx_sc
->stats
);
506 u64_stats_update_begin(&txsc_stats
->syncp
);
507 if (tx_sc
->encrypt
) {
508 txsc_stats
->stats
.OutOctetsEncrypted
+= msdu_len
;
509 txsc_stats
->stats
.OutPktsEncrypted
++;
510 this_cpu_inc(tx_sa
->stats
->OutPktsEncrypted
);
512 txsc_stats
->stats
.OutOctetsProtected
+= msdu_len
;
513 txsc_stats
->stats
.OutPktsProtected
++;
514 this_cpu_inc(tx_sa
->stats
->OutPktsProtected
);
516 u64_stats_update_end(&txsc_stats
->syncp
);
519 static void count_tx(struct net_device
*dev
, int ret
, int len
)
521 if (likely(ret
== NET_XMIT_SUCCESS
|| ret
== NET_XMIT_CN
))
522 dev_sw_netstats_tx_add(dev
, 1, len
);
525 static void macsec_encrypt_done(void *data
, int err
)
527 struct sk_buff
*skb
= data
;
528 struct net_device
*dev
= skb
->dev
;
529 struct macsec_dev
*macsec
= macsec_priv(dev
);
530 struct macsec_tx_sa
*sa
= macsec_skb_cb(skb
)->tx_sa
;
533 aead_request_free(macsec_skb_cb(skb
)->req
);
536 macsec_count_tx(skb
, &macsec
->secy
.tx_sc
, macsec_skb_cb(skb
)->tx_sa
);
537 /* packet is encrypted/protected so tx_bytes must be calculated */
538 len
= macsec_msdu_len(skb
) + 2 * ETH_ALEN
;
539 macsec_encrypt_finish(skb
, dev
);
540 ret
= dev_queue_xmit(skb
);
541 count_tx(dev
, ret
, len
);
542 rcu_read_unlock_bh();
548 static struct aead_request
*macsec_alloc_req(struct crypto_aead
*tfm
,
550 struct scatterlist
**sg
,
553 size_t size
, iv_offset
, sg_offset
;
554 struct aead_request
*req
;
557 size
= sizeof(struct aead_request
) + crypto_aead_reqsize(tfm
);
559 size
+= GCM_AES_IV_LEN
;
561 size
= ALIGN(size
, __alignof__(struct scatterlist
));
563 size
+= sizeof(struct scatterlist
) * num_frags
;
565 tmp
= kmalloc(size
, GFP_ATOMIC
);
569 *iv
= (unsigned char *)(tmp
+ iv_offset
);
570 *sg
= (struct scatterlist
*)(tmp
+ sg_offset
);
573 aead_request_set_tfm(req
, tfm
);
578 static struct sk_buff
*macsec_encrypt(struct sk_buff
*skb
,
579 struct net_device
*dev
)
582 struct scatterlist
*sg
;
583 struct sk_buff
*trailer
;
586 struct macsec_eth_header
*hh
;
587 size_t unprotected_len
;
588 struct aead_request
*req
;
589 struct macsec_secy
*secy
;
590 struct macsec_tx_sc
*tx_sc
;
591 struct macsec_tx_sa
*tx_sa
;
592 struct macsec_dev
*macsec
= macsec_priv(dev
);
596 secy
= &macsec
->secy
;
597 tx_sc
= &secy
->tx_sc
;
599 /* 10.5.1 TX SA assignment */
600 tx_sa
= macsec_txsa_get(tx_sc
->sa
[tx_sc
->encoding_sa
]);
602 secy
->operational
= false;
604 return ERR_PTR(-EINVAL
);
607 if (unlikely(skb_headroom(skb
) < MACSEC_NEEDED_HEADROOM
||
608 skb_tailroom(skb
) < MACSEC_NEEDED_TAILROOM
)) {
609 struct sk_buff
*nskb
= skb_copy_expand(skb
,
610 MACSEC_NEEDED_HEADROOM
,
611 MACSEC_NEEDED_TAILROOM
,
617 macsec_txsa_put(tx_sa
);
619 return ERR_PTR(-ENOMEM
);
622 skb
= skb_unshare(skb
, GFP_ATOMIC
);
624 macsec_txsa_put(tx_sa
);
625 return ERR_PTR(-ENOMEM
);
629 unprotected_len
= skb
->len
;
631 sci_present
= macsec_send_sci(secy
);
632 hh
= skb_push(skb
, macsec_extra_len(sci_present
));
633 memmove(hh
, eth
, 2 * ETH_ALEN
);
635 pn
= tx_sa_update_pn(tx_sa
, secy
);
636 if (pn
.full64
== 0) {
637 macsec_txsa_put(tx_sa
);
639 return ERR_PTR(-ENOLINK
);
641 macsec_fill_sectag(hh
, secy
, pn
.lower
, sci_present
);
642 macsec_set_shortlen(hh
, unprotected_len
- 2 * ETH_ALEN
);
644 skb_put(skb
, secy
->icv_len
);
646 if (skb
->len
- ETH_HLEN
> macsec_priv(dev
)->real_dev
->mtu
) {
647 struct pcpu_secy_stats
*secy_stats
= this_cpu_ptr(macsec
->stats
);
649 u64_stats_update_begin(&secy_stats
->syncp
);
650 secy_stats
->stats
.OutPktsTooLong
++;
651 u64_stats_update_end(&secy_stats
->syncp
);
653 macsec_txsa_put(tx_sa
);
655 return ERR_PTR(-EINVAL
);
658 ret
= skb_cow_data(skb
, 0, &trailer
);
659 if (unlikely(ret
< 0)) {
660 macsec_txsa_put(tx_sa
);
665 req
= macsec_alloc_req(tx_sa
->key
.tfm
, &iv
, &sg
, ret
);
667 macsec_txsa_put(tx_sa
);
669 return ERR_PTR(-ENOMEM
);
673 macsec_fill_iv_xpn(iv
, tx_sa
->ssci
, pn
.full64
, tx_sa
->key
.salt
);
675 macsec_fill_iv(iv
, secy
->sci
, pn
.lower
);
677 sg_init_table(sg
, ret
);
678 ret
= skb_to_sgvec(skb
, sg
, 0, skb
->len
);
679 if (unlikely(ret
< 0)) {
680 aead_request_free(req
);
681 macsec_txsa_put(tx_sa
);
686 if (tx_sc
->encrypt
) {
687 int len
= skb
->len
- macsec_hdr_len(sci_present
) -
689 aead_request_set_crypt(req
, sg
, sg
, len
, iv
);
690 aead_request_set_ad(req
, macsec_hdr_len(sci_present
));
692 aead_request_set_crypt(req
, sg
, sg
, 0, iv
);
693 aead_request_set_ad(req
, skb
->len
- secy
->icv_len
);
696 macsec_skb_cb(skb
)->req
= req
;
697 macsec_skb_cb(skb
)->tx_sa
= tx_sa
;
698 macsec_skb_cb(skb
)->has_sci
= sci_present
;
699 aead_request_set_callback(req
, 0, macsec_encrypt_done
, skb
);
702 ret
= crypto_aead_encrypt(req
);
703 if (ret
== -EINPROGRESS
) {
705 } else if (ret
!= 0) {
708 aead_request_free(req
);
709 macsec_txsa_put(tx_sa
);
710 return ERR_PTR(-EINVAL
);
714 aead_request_free(req
);
715 macsec_txsa_put(tx_sa
);
720 static bool macsec_post_decrypt(struct sk_buff
*skb
, struct macsec_secy
*secy
, u32 pn
)
722 struct macsec_rx_sa
*rx_sa
= macsec_skb_cb(skb
)->rx_sa
;
723 struct pcpu_rx_sc_stats
*rxsc_stats
= this_cpu_ptr(rx_sa
->sc
->stats
);
724 struct macsec_eth_header
*hdr
= macsec_ethhdr(skb
);
727 spin_lock(&rx_sa
->lock
);
728 if (rx_sa
->next_pn_halves
.lower
>= secy
->replay_window
)
729 lowest_pn
= rx_sa
->next_pn_halves
.lower
- secy
->replay_window
;
731 /* Now perform replay protection check again
732 * (see IEEE 802.1AE-2006 figure 10-5)
734 if (secy
->replay_protect
&& pn
< lowest_pn
&&
735 (!secy
->xpn
|| pn_same_half(pn
, lowest_pn
))) {
736 spin_unlock(&rx_sa
->lock
);
737 u64_stats_update_begin(&rxsc_stats
->syncp
);
738 rxsc_stats
->stats
.InPktsLate
++;
739 u64_stats_update_end(&rxsc_stats
->syncp
);
740 DEV_STATS_INC(secy
->netdev
, rx_dropped
);
744 if (secy
->validate_frames
!= MACSEC_VALIDATE_DISABLED
) {
745 unsigned int msdu_len
= macsec_msdu_len(skb
);
746 u64_stats_update_begin(&rxsc_stats
->syncp
);
747 if (hdr
->tci_an
& MACSEC_TCI_E
)
748 rxsc_stats
->stats
.InOctetsDecrypted
+= msdu_len
;
750 rxsc_stats
->stats
.InOctetsValidated
+= msdu_len
;
751 u64_stats_update_end(&rxsc_stats
->syncp
);
754 if (!macsec_skb_cb(skb
)->valid
) {
755 spin_unlock(&rx_sa
->lock
);
758 if (hdr
->tci_an
& MACSEC_TCI_C
||
759 secy
->validate_frames
== MACSEC_VALIDATE_STRICT
) {
760 u64_stats_update_begin(&rxsc_stats
->syncp
);
761 rxsc_stats
->stats
.InPktsNotValid
++;
762 u64_stats_update_end(&rxsc_stats
->syncp
);
763 this_cpu_inc(rx_sa
->stats
->InPktsNotValid
);
764 DEV_STATS_INC(secy
->netdev
, rx_errors
);
768 u64_stats_update_begin(&rxsc_stats
->syncp
);
769 if (secy
->validate_frames
== MACSEC_VALIDATE_CHECK
) {
770 rxsc_stats
->stats
.InPktsInvalid
++;
771 this_cpu_inc(rx_sa
->stats
->InPktsInvalid
);
772 } else if (pn
< lowest_pn
) {
773 rxsc_stats
->stats
.InPktsDelayed
++;
775 rxsc_stats
->stats
.InPktsUnchecked
++;
777 u64_stats_update_end(&rxsc_stats
->syncp
);
779 u64_stats_update_begin(&rxsc_stats
->syncp
);
780 if (pn
< lowest_pn
) {
781 rxsc_stats
->stats
.InPktsDelayed
++;
783 rxsc_stats
->stats
.InPktsOK
++;
784 this_cpu_inc(rx_sa
->stats
->InPktsOK
);
786 u64_stats_update_end(&rxsc_stats
->syncp
);
788 // Instead of "pn >=" - to support pn overflow in xpn
789 if (pn
+ 1 > rx_sa
->next_pn_halves
.lower
) {
790 rx_sa
->next_pn_halves
.lower
= pn
+ 1;
791 } else if (secy
->xpn
&&
792 !pn_same_half(pn
, rx_sa
->next_pn_halves
.lower
)) {
793 rx_sa
->next_pn_halves
.upper
++;
794 rx_sa
->next_pn_halves
.lower
= pn
+ 1;
797 spin_unlock(&rx_sa
->lock
);
803 static void macsec_reset_skb(struct sk_buff
*skb
, struct net_device
*dev
)
805 skb
->pkt_type
= PACKET_HOST
;
806 skb
->protocol
= eth_type_trans(skb
, dev
);
808 skb_reset_network_header(skb
);
809 if (!skb_transport_header_was_set(skb
))
810 skb_reset_transport_header(skb
);
811 skb_reset_mac_len(skb
);
814 static void macsec_finalize_skb(struct sk_buff
*skb
, u8 icv_len
, u8 hdr_len
)
816 skb
->ip_summed
= CHECKSUM_NONE
;
817 memmove(skb
->data
+ hdr_len
, skb
->data
, 2 * ETH_ALEN
);
818 skb_pull(skb
, hdr_len
);
819 pskb_trim_unique(skb
, skb
->len
- icv_len
);
822 static void count_rx(struct net_device
*dev
, int len
)
824 dev_sw_netstats_rx_add(dev
, len
);
827 static void macsec_decrypt_done(void *data
, int err
)
829 struct sk_buff
*skb
= data
;
830 struct net_device
*dev
= skb
->dev
;
831 struct macsec_dev
*macsec
= macsec_priv(dev
);
832 struct macsec_rx_sa
*rx_sa
= macsec_skb_cb(skb
)->rx_sa
;
833 struct macsec_rx_sc
*rx_sc
= rx_sa
->sc
;
837 aead_request_free(macsec_skb_cb(skb
)->req
);
840 macsec_skb_cb(skb
)->valid
= true;
843 pn
= ntohl(macsec_ethhdr(skb
)->packet_number
);
844 if (!macsec_post_decrypt(skb
, &macsec
->secy
, pn
)) {
845 rcu_read_unlock_bh();
850 macsec_finalize_skb(skb
, macsec
->secy
.icv_len
,
851 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
853 macsec_reset_skb(skb
, macsec
->secy
.netdev
);
855 if (gro_cells_receive(&macsec
->gro_cells
, skb
) == NET_RX_SUCCESS
)
858 rcu_read_unlock_bh();
861 macsec_rxsa_put(rx_sa
);
862 macsec_rxsc_put(rx_sc
);
866 static struct sk_buff
*macsec_decrypt(struct sk_buff
*skb
,
867 struct net_device
*dev
,
868 struct macsec_rx_sa
*rx_sa
,
870 struct macsec_secy
*secy
)
873 struct scatterlist
*sg
;
874 struct sk_buff
*trailer
;
876 struct aead_request
*req
;
877 struct macsec_eth_header
*hdr
;
879 u16 icv_len
= secy
->icv_len
;
881 macsec_skb_cb(skb
)->valid
= false;
882 skb
= skb_share_check(skb
, GFP_ATOMIC
);
884 return ERR_PTR(-ENOMEM
);
886 ret
= skb_cow_data(skb
, 0, &trailer
);
887 if (unlikely(ret
< 0)) {
891 req
= macsec_alloc_req(rx_sa
->key
.tfm
, &iv
, &sg
, ret
);
894 return ERR_PTR(-ENOMEM
);
897 hdr
= (struct macsec_eth_header
*)skb
->data
;
898 hdr_pn
= ntohl(hdr
->packet_number
);
901 pn_t recovered_pn
= rx_sa
->next_pn_halves
;
903 recovered_pn
.lower
= hdr_pn
;
904 if (hdr_pn
< rx_sa
->next_pn_halves
.lower
&&
905 !pn_same_half(hdr_pn
, rx_sa
->next_pn_halves
.lower
))
906 recovered_pn
.upper
++;
908 macsec_fill_iv_xpn(iv
, rx_sa
->ssci
, recovered_pn
.full64
,
911 macsec_fill_iv(iv
, sci
, hdr_pn
);
914 sg_init_table(sg
, ret
);
915 ret
= skb_to_sgvec(skb
, sg
, 0, skb
->len
);
916 if (unlikely(ret
< 0)) {
917 aead_request_free(req
);
922 if (hdr
->tci_an
& MACSEC_TCI_E
) {
923 /* confidentiality: ethernet + macsec header
924 * authenticated, encrypted payload
926 int len
= skb
->len
- macsec_hdr_len(macsec_skb_cb(skb
)->has_sci
);
928 aead_request_set_crypt(req
, sg
, sg
, len
, iv
);
929 aead_request_set_ad(req
, macsec_hdr_len(macsec_skb_cb(skb
)->has_sci
));
930 skb
= skb_unshare(skb
, GFP_ATOMIC
);
932 aead_request_free(req
);
933 return ERR_PTR(-ENOMEM
);
936 /* integrity only: all headers + data authenticated */
937 aead_request_set_crypt(req
, sg
, sg
, icv_len
, iv
);
938 aead_request_set_ad(req
, skb
->len
- icv_len
);
941 macsec_skb_cb(skb
)->req
= req
;
943 aead_request_set_callback(req
, 0, macsec_decrypt_done
, skb
);
946 ret
= crypto_aead_decrypt(req
);
947 if (ret
== -EINPROGRESS
) {
949 } else if (ret
!= 0) {
950 /* decryption/authentication failed
951 * 10.6 if validateFrames is disabled, deliver anyway
953 if (ret
!= -EBADMSG
) {
958 macsec_skb_cb(skb
)->valid
= true;
962 aead_request_free(req
);
967 static struct macsec_rx_sc
*find_rx_sc(struct macsec_secy
*secy
, sci_t sci
)
969 struct macsec_rx_sc
*rx_sc
;
971 for_each_rxsc(secy
, rx_sc
) {
972 if (rx_sc
->sci
== sci
)
979 static struct macsec_rx_sc
*find_rx_sc_rtnl(struct macsec_secy
*secy
, sci_t sci
)
981 struct macsec_rx_sc
*rx_sc
;
983 for_each_rxsc_rtnl(secy
, rx_sc
) {
984 if (rx_sc
->sci
== sci
)
991 static enum rx_handler_result
handle_not_macsec(struct sk_buff
*skb
)
993 /* Deliver to the uncontrolled port by default */
994 enum rx_handler_result ret
= RX_HANDLER_PASS
;
995 struct ethhdr
*hdr
= eth_hdr(skb
);
996 struct metadata_dst
*md_dst
;
997 struct macsec_rxh_data
*rxd
;
998 struct macsec_dev
*macsec
;
1001 rxd
= macsec_data_rcu(skb
->dev
);
1002 md_dst
= skb_metadata_dst(skb
);
1004 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1005 struct sk_buff
*nskb
;
1006 struct pcpu_secy_stats
*secy_stats
= this_cpu_ptr(macsec
->stats
);
1007 struct net_device
*ndev
= macsec
->secy
.netdev
;
1009 /* If h/w offloading is enabled, HW decodes frames and strips
1010 * the SecTAG, so we have to deduce which port to deliver to.
1012 if (macsec_is_offloaded(macsec
) && netif_running(ndev
)) {
1013 struct macsec_rx_sc
*rx_sc
= NULL
;
1015 if (md_dst
&& md_dst
->type
== METADATA_MACSEC
)
1016 rx_sc
= find_rx_sc(&macsec
->secy
, md_dst
->u
.macsec_info
.sci
);
1018 if (md_dst
&& md_dst
->type
== METADATA_MACSEC
&& !rx_sc
)
1021 if (ether_addr_equal_64bits(hdr
->h_dest
,
1023 /* exact match, divert skb to this port */
1025 skb
->pkt_type
= PACKET_HOST
;
1026 ret
= RX_HANDLER_ANOTHER
;
1028 } else if (is_multicast_ether_addr_64bits(
1030 /* multicast frame, deliver on this port too */
1031 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1036 if (ether_addr_equal_64bits(hdr
->h_dest
,
1038 nskb
->pkt_type
= PACKET_BROADCAST
;
1040 nskb
->pkt_type
= PACKET_MULTICAST
;
1043 } else if (rx_sc
|| ndev
->flags
& IFF_PROMISC
) {
1045 skb
->pkt_type
= PACKET_HOST
;
1046 ret
= RX_HANDLER_ANOTHER
;
1053 /* 10.6 If the management control validateFrames is not
1054 * Strict, frames without a SecTAG are received, counted, and
1055 * delivered to the Controlled Port
1057 if (macsec
->secy
.validate_frames
== MACSEC_VALIDATE_STRICT
) {
1058 u64_stats_update_begin(&secy_stats
->syncp
);
1059 secy_stats
->stats
.InPktsNoTag
++;
1060 u64_stats_update_end(&secy_stats
->syncp
);
1061 DEV_STATS_INC(macsec
->secy
.netdev
, rx_dropped
);
1065 /* deliver on this port */
1066 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1072 if (__netif_rx(nskb
) == NET_RX_SUCCESS
) {
1073 u64_stats_update_begin(&secy_stats
->syncp
);
1074 secy_stats
->stats
.InPktsUntagged
++;
1075 u64_stats_update_end(&secy_stats
->syncp
);
1084 static rx_handler_result_t
macsec_handle_frame(struct sk_buff
**pskb
)
1086 struct sk_buff
*skb
= *pskb
;
1087 struct net_device
*dev
= skb
->dev
;
1088 struct macsec_eth_header
*hdr
;
1089 struct macsec_secy
*secy
= NULL
;
1090 struct macsec_rx_sc
*rx_sc
;
1091 struct macsec_rx_sa
*rx_sa
;
1092 struct macsec_rxh_data
*rxd
;
1093 struct macsec_dev
*macsec
;
1098 struct pcpu_rx_sc_stats
*rxsc_stats
;
1099 struct pcpu_secy_stats
*secy_stats
;
1103 if (skb_headroom(skb
) < ETH_HLEN
)
1106 hdr
= macsec_ethhdr(skb
);
1107 if (hdr
->eth
.h_proto
!= htons(ETH_P_MACSEC
))
1108 return handle_not_macsec(skb
);
1110 skb
= skb_unshare(skb
, GFP_ATOMIC
);
1113 return RX_HANDLER_CONSUMED
;
1115 pulled_sci
= pskb_may_pull(skb
, macsec_extra_len(true));
1117 if (!pskb_may_pull(skb
, macsec_extra_len(false)))
1121 hdr
= macsec_ethhdr(skb
);
1123 /* Frames with a SecTAG that has the TCI E bit set but the C
1124 * bit clear are discarded, as this reserved encoding is used
1125 * to identify frames with a SecTAG that are not to be
1126 * delivered to the Controlled Port.
1128 if ((hdr
->tci_an
& (MACSEC_TCI_C
| MACSEC_TCI_E
)) == MACSEC_TCI_E
)
1129 return RX_HANDLER_PASS
;
1131 /* now, pull the extra length */
1132 if (hdr
->tci_an
& MACSEC_TCI_SC
) {
1137 /* ethernet header is part of crypto processing */
1138 skb_push(skb
, ETH_HLEN
);
1140 macsec_skb_cb(skb
)->has_sci
= !!(hdr
->tci_an
& MACSEC_TCI_SC
);
1141 macsec_skb_cb(skb
)->assoc_num
= hdr
->tci_an
& MACSEC_AN_MASK
;
1142 sci
= macsec_frame_sci(hdr
, macsec_skb_cb(skb
)->has_sci
);
1145 rxd
= macsec_data_rcu(skb
->dev
);
1147 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1148 struct macsec_rx_sc
*sc
= find_rx_sc(&macsec
->secy
, sci
);
1150 sc
= sc
? macsec_rxsc_get(sc
) : NULL
;
1153 secy
= &macsec
->secy
;
1163 macsec
= macsec_priv(dev
);
1164 secy_stats
= this_cpu_ptr(macsec
->stats
);
1165 rxsc_stats
= this_cpu_ptr(rx_sc
->stats
);
1167 if (!macsec_validate_skb(skb
, secy
->icv_len
, secy
->xpn
)) {
1168 u64_stats_update_begin(&secy_stats
->syncp
);
1169 secy_stats
->stats
.InPktsBadTag
++;
1170 u64_stats_update_end(&secy_stats
->syncp
);
1171 DEV_STATS_INC(secy
->netdev
, rx_errors
);
1175 rx_sa
= macsec_rxsa_get(rx_sc
->sa
[macsec_skb_cb(skb
)->assoc_num
]);
1177 /* 10.6.1 if the SA is not in use */
1179 /* If validateFrames is Strict or the C bit in the
1180 * SecTAG is set, discard
1182 struct macsec_rx_sa
*active_rx_sa
= macsec_active_rxsa_get(rx_sc
);
1183 if (hdr
->tci_an
& MACSEC_TCI_C
||
1184 secy
->validate_frames
== MACSEC_VALIDATE_STRICT
) {
1185 u64_stats_update_begin(&rxsc_stats
->syncp
);
1186 rxsc_stats
->stats
.InPktsNotUsingSA
++;
1187 u64_stats_update_end(&rxsc_stats
->syncp
);
1188 DEV_STATS_INC(secy
->netdev
, rx_errors
);
1190 this_cpu_inc(active_rx_sa
->stats
->InPktsNotUsingSA
);
1194 /* not Strict, the frame (with the SecTAG and ICV
1195 * removed) is delivered to the Controlled Port.
1197 u64_stats_update_begin(&rxsc_stats
->syncp
);
1198 rxsc_stats
->stats
.InPktsUnusedSA
++;
1199 u64_stats_update_end(&rxsc_stats
->syncp
);
1201 this_cpu_inc(active_rx_sa
->stats
->InPktsUnusedSA
);
1205 /* First, PN check to avoid decrypting obviously wrong packets */
1206 hdr_pn
= ntohl(hdr
->packet_number
);
1207 if (secy
->replay_protect
) {
1210 spin_lock(&rx_sa
->lock
);
1211 late
= rx_sa
->next_pn_halves
.lower
>= secy
->replay_window
&&
1212 hdr_pn
< (rx_sa
->next_pn_halves
.lower
- secy
->replay_window
);
1215 late
= late
&& pn_same_half(rx_sa
->next_pn_halves
.lower
, hdr_pn
);
1216 spin_unlock(&rx_sa
->lock
);
1219 u64_stats_update_begin(&rxsc_stats
->syncp
);
1220 rxsc_stats
->stats
.InPktsLate
++;
1221 u64_stats_update_end(&rxsc_stats
->syncp
);
1222 DEV_STATS_INC(macsec
->secy
.netdev
, rx_dropped
);
1227 macsec_skb_cb(skb
)->rx_sa
= rx_sa
;
1229 /* Disabled && !changed text => skip validation */
1230 if (hdr
->tci_an
& MACSEC_TCI_C
||
1231 secy
->validate_frames
!= MACSEC_VALIDATE_DISABLED
)
1232 skb
= macsec_decrypt(skb
, dev
, rx_sa
, sci
, secy
);
1235 /* the decrypt callback needs the reference */
1236 if (PTR_ERR(skb
) != -EINPROGRESS
) {
1237 macsec_rxsa_put(rx_sa
);
1238 macsec_rxsc_put(rx_sc
);
1242 return RX_HANDLER_CONSUMED
;
1245 if (!macsec_post_decrypt(skb
, secy
, hdr_pn
))
1249 macsec_finalize_skb(skb
, secy
->icv_len
,
1250 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
1252 macsec_reset_skb(skb
, secy
->netdev
);
1255 macsec_rxsa_put(rx_sa
);
1256 macsec_rxsc_put(rx_sc
);
1259 ret
= gro_cells_receive(&macsec
->gro_cells
, skb
);
1260 if (ret
== NET_RX_SUCCESS
)
1263 DEV_STATS_INC(macsec
->secy
.netdev
, rx_dropped
);
1268 return RX_HANDLER_CONSUMED
;
1271 macsec_rxsa_put(rx_sa
);
1273 macsec_rxsc_put(rx_sc
);
1278 return RX_HANDLER_CONSUMED
;
1281 /* 10.6.1 if the SC is not found */
1282 cbit
= !!(hdr
->tci_an
& MACSEC_TCI_C
);
1284 macsec_finalize_skb(skb
, MACSEC_DEFAULT_ICV_LEN
,
1285 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
1287 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1288 struct sk_buff
*nskb
;
1290 secy_stats
= this_cpu_ptr(macsec
->stats
);
1292 /* If validateFrames is Strict or the C bit in the
1293 * SecTAG is set, discard
1296 macsec
->secy
.validate_frames
== MACSEC_VALIDATE_STRICT
) {
1297 u64_stats_update_begin(&secy_stats
->syncp
);
1298 secy_stats
->stats
.InPktsNoSCI
++;
1299 u64_stats_update_end(&secy_stats
->syncp
);
1300 DEV_STATS_INC(macsec
->secy
.netdev
, rx_errors
);
1304 /* not strict, the frame (with the SecTAG and ICV
1305 * removed) is delivered to the Controlled Port.
1307 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1311 macsec_reset_skb(nskb
, macsec
->secy
.netdev
);
1313 ret
= __netif_rx(nskb
);
1314 if (ret
== NET_RX_SUCCESS
) {
1315 u64_stats_update_begin(&secy_stats
->syncp
);
1316 secy_stats
->stats
.InPktsUnknownSCI
++;
1317 u64_stats_update_end(&secy_stats
->syncp
);
1319 DEV_STATS_INC(macsec
->secy
.netdev
, rx_dropped
);
1325 return RX_HANDLER_PASS
;
1328 static struct crypto_aead
*macsec_alloc_tfm(char *key
, int key_len
, int icv_len
)
1330 struct crypto_aead
*tfm
;
1333 tfm
= crypto_alloc_aead("gcm(aes)", 0, 0);
1338 ret
= crypto_aead_setkey(tfm
, key
, key_len
);
1342 ret
= crypto_aead_setauthsize(tfm
, icv_len
);
1348 crypto_free_aead(tfm
);
1349 return ERR_PTR(ret
);
1352 static int init_rx_sa(struct macsec_rx_sa
*rx_sa
, char *sak
, int key_len
,
1355 rx_sa
->stats
= alloc_percpu(struct macsec_rx_sa_stats
);
1359 rx_sa
->key
.tfm
= macsec_alloc_tfm(sak
, key_len
, icv_len
);
1360 if (IS_ERR(rx_sa
->key
.tfm
)) {
1361 free_percpu(rx_sa
->stats
);
1362 return PTR_ERR(rx_sa
->key
.tfm
);
1365 rx_sa
->ssci
= MACSEC_UNDEF_SSCI
;
1366 rx_sa
->active
= false;
1368 refcount_set(&rx_sa
->refcnt
, 1);
1369 spin_lock_init(&rx_sa
->lock
);
1374 static void clear_rx_sa(struct macsec_rx_sa
*rx_sa
)
1376 rx_sa
->active
= false;
1378 macsec_rxsa_put(rx_sa
);
1381 static void free_rx_sc(struct macsec_rx_sc
*rx_sc
)
1385 for (i
= 0; i
< MACSEC_NUM_AN
; i
++) {
1386 struct macsec_rx_sa
*sa
= rtnl_dereference(rx_sc
->sa
[i
]);
1388 RCU_INIT_POINTER(rx_sc
->sa
[i
], NULL
);
1393 macsec_rxsc_put(rx_sc
);
1396 static struct macsec_rx_sc
*del_rx_sc(struct macsec_secy
*secy
, sci_t sci
)
1398 struct macsec_rx_sc
*rx_sc
, __rcu
**rx_scp
;
1400 for (rx_scp
= &secy
->rx_sc
, rx_sc
= rtnl_dereference(*rx_scp
);
1402 rx_scp
= &rx_sc
->next
, rx_sc
= rtnl_dereference(*rx_scp
)) {
1403 if (rx_sc
->sci
== sci
) {
1406 rcu_assign_pointer(*rx_scp
, rx_sc
->next
);
1414 static struct macsec_rx_sc
*create_rx_sc(struct net_device
*dev
, sci_t sci
,
1417 struct macsec_rx_sc
*rx_sc
;
1418 struct macsec_dev
*macsec
;
1419 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
1420 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
1421 struct macsec_secy
*secy
;
1423 list_for_each_entry(macsec
, &rxd
->secys
, secys
) {
1424 if (find_rx_sc_rtnl(&macsec
->secy
, sci
))
1425 return ERR_PTR(-EEXIST
);
1428 rx_sc
= kzalloc(sizeof(*rx_sc
), GFP_KERNEL
);
1430 return ERR_PTR(-ENOMEM
);
1432 rx_sc
->stats
= netdev_alloc_pcpu_stats(struct pcpu_rx_sc_stats
);
1433 if (!rx_sc
->stats
) {
1435 return ERR_PTR(-ENOMEM
);
1439 rx_sc
->active
= active
;
1440 refcount_set(&rx_sc
->refcnt
, 1);
1442 secy
= &macsec_priv(dev
)->secy
;
1443 rcu_assign_pointer(rx_sc
->next
, secy
->rx_sc
);
1444 rcu_assign_pointer(secy
->rx_sc
, rx_sc
);
1452 static int init_tx_sa(struct macsec_tx_sa
*tx_sa
, char *sak
, int key_len
,
1455 tx_sa
->stats
= alloc_percpu(struct macsec_tx_sa_stats
);
1459 tx_sa
->key
.tfm
= macsec_alloc_tfm(sak
, key_len
, icv_len
);
1460 if (IS_ERR(tx_sa
->key
.tfm
)) {
1461 free_percpu(tx_sa
->stats
);
1462 return PTR_ERR(tx_sa
->key
.tfm
);
1465 tx_sa
->ssci
= MACSEC_UNDEF_SSCI
;
1466 tx_sa
->active
= false;
1467 refcount_set(&tx_sa
->refcnt
, 1);
1468 spin_lock_init(&tx_sa
->lock
);
1473 static void clear_tx_sa(struct macsec_tx_sa
*tx_sa
)
1475 tx_sa
->active
= false;
1477 macsec_txsa_put(tx_sa
);
1480 static struct genl_family macsec_fam
;
1482 static struct net_device
*get_dev_from_nl(struct net
*net
,
1483 struct nlattr
**attrs
)
1485 int ifindex
= nla_get_u32(attrs
[MACSEC_ATTR_IFINDEX
]);
1486 struct net_device
*dev
;
1488 dev
= __dev_get_by_index(net
, ifindex
);
1490 return ERR_PTR(-ENODEV
);
1492 if (!netif_is_macsec(dev
))
1493 return ERR_PTR(-ENODEV
);
1498 static enum macsec_offload
nla_get_offload(const struct nlattr
*nla
)
1500 return (__force
enum macsec_offload
)nla_get_u8(nla
);
1503 static sci_t
nla_get_sci(const struct nlattr
*nla
)
1505 return (__force sci_t
)nla_get_u64(nla
);
1508 static int nla_put_sci(struct sk_buff
*skb
, int attrtype
, sci_t value
,
1511 return nla_put_u64_64bit(skb
, attrtype
, (__force u64
)value
, padattr
);
1514 static ssci_t
nla_get_ssci(const struct nlattr
*nla
)
1516 return (__force ssci_t
)nla_get_u32(nla
);
1519 static int nla_put_ssci(struct sk_buff
*skb
, int attrtype
, ssci_t value
)
1521 return nla_put_u32(skb
, attrtype
, (__force u64
)value
);
1524 static struct macsec_tx_sa
*get_txsa_from_nl(struct net
*net
,
1525 struct nlattr
**attrs
,
1526 struct nlattr
**tb_sa
,
1527 struct net_device
**devp
,
1528 struct macsec_secy
**secyp
,
1529 struct macsec_tx_sc
**scp
,
1532 struct net_device
*dev
;
1533 struct macsec_secy
*secy
;
1534 struct macsec_tx_sc
*tx_sc
;
1535 struct macsec_tx_sa
*tx_sa
;
1537 if (!tb_sa
[MACSEC_SA_ATTR_AN
])
1538 return ERR_PTR(-EINVAL
);
1540 *assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1542 dev
= get_dev_from_nl(net
, attrs
);
1544 return ERR_CAST(dev
);
1546 if (*assoc_num
>= MACSEC_NUM_AN
)
1547 return ERR_PTR(-EINVAL
);
1549 secy
= &macsec_priv(dev
)->secy
;
1550 tx_sc
= &secy
->tx_sc
;
1552 tx_sa
= rtnl_dereference(tx_sc
->sa
[*assoc_num
]);
1554 return ERR_PTR(-ENODEV
);
1562 static struct macsec_rx_sc
*get_rxsc_from_nl(struct net
*net
,
1563 struct nlattr
**attrs
,
1564 struct nlattr
**tb_rxsc
,
1565 struct net_device
**devp
,
1566 struct macsec_secy
**secyp
)
1568 struct net_device
*dev
;
1569 struct macsec_secy
*secy
;
1570 struct macsec_rx_sc
*rx_sc
;
1573 dev
= get_dev_from_nl(net
, attrs
);
1575 return ERR_CAST(dev
);
1577 secy
= &macsec_priv(dev
)->secy
;
1579 if (!tb_rxsc
[MACSEC_RXSC_ATTR_SCI
])
1580 return ERR_PTR(-EINVAL
);
1582 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
1583 rx_sc
= find_rx_sc_rtnl(secy
, sci
);
1585 return ERR_PTR(-ENODEV
);
1593 static struct macsec_rx_sa
*get_rxsa_from_nl(struct net
*net
,
1594 struct nlattr
**attrs
,
1595 struct nlattr
**tb_rxsc
,
1596 struct nlattr
**tb_sa
,
1597 struct net_device
**devp
,
1598 struct macsec_secy
**secyp
,
1599 struct macsec_rx_sc
**scp
,
1602 struct macsec_rx_sc
*rx_sc
;
1603 struct macsec_rx_sa
*rx_sa
;
1605 if (!tb_sa
[MACSEC_SA_ATTR_AN
])
1606 return ERR_PTR(-EINVAL
);
1608 *assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1609 if (*assoc_num
>= MACSEC_NUM_AN
)
1610 return ERR_PTR(-EINVAL
);
1612 rx_sc
= get_rxsc_from_nl(net
, attrs
, tb_rxsc
, devp
, secyp
);
1614 return ERR_CAST(rx_sc
);
1616 rx_sa
= rtnl_dereference(rx_sc
->sa
[*assoc_num
]);
1618 return ERR_PTR(-ENODEV
);
1624 static const struct nla_policy macsec_genl_policy
[NUM_MACSEC_ATTR
] = {
1625 [MACSEC_ATTR_IFINDEX
] = { .type
= NLA_U32
},
1626 [MACSEC_ATTR_RXSC_CONFIG
] = { .type
= NLA_NESTED
},
1627 [MACSEC_ATTR_SA_CONFIG
] = { .type
= NLA_NESTED
},
1628 [MACSEC_ATTR_OFFLOAD
] = { .type
= NLA_NESTED
},
1631 static const struct nla_policy macsec_genl_rxsc_policy
[NUM_MACSEC_RXSC_ATTR
] = {
1632 [MACSEC_RXSC_ATTR_SCI
] = { .type
= NLA_U64
},
1633 [MACSEC_RXSC_ATTR_ACTIVE
] = { .type
= NLA_U8
},
1636 static const struct nla_policy macsec_genl_sa_policy
[NUM_MACSEC_SA_ATTR
] = {
1637 [MACSEC_SA_ATTR_AN
] = { .type
= NLA_U8
},
1638 [MACSEC_SA_ATTR_ACTIVE
] = { .type
= NLA_U8
},
1639 [MACSEC_SA_ATTR_PN
] = NLA_POLICY_MIN_LEN(4),
1640 [MACSEC_SA_ATTR_KEYID
] = { .type
= NLA_BINARY
,
1641 .len
= MACSEC_KEYID_LEN
, },
1642 [MACSEC_SA_ATTR_KEY
] = { .type
= NLA_BINARY
,
1643 .len
= MACSEC_MAX_KEY_LEN
, },
1644 [MACSEC_SA_ATTR_SSCI
] = { .type
= NLA_U32
},
1645 [MACSEC_SA_ATTR_SALT
] = { .type
= NLA_BINARY
,
1646 .len
= MACSEC_SALT_LEN
, },
1649 static const struct nla_policy macsec_genl_offload_policy
[NUM_MACSEC_OFFLOAD_ATTR
] = {
1650 [MACSEC_OFFLOAD_ATTR_TYPE
] = { .type
= NLA_U8
},
1653 /* Offloads an operation to a device driver */
1654 static int macsec_offload(int (* const func
)(struct macsec_context
*),
1655 struct macsec_context
*ctx
)
1659 if (unlikely(!func
))
1662 if (ctx
->offload
== MACSEC_OFFLOAD_PHY
)
1663 mutex_lock(&ctx
->phydev
->lock
);
1667 if (ctx
->offload
== MACSEC_OFFLOAD_PHY
)
1668 mutex_unlock(&ctx
->phydev
->lock
);
1673 static int parse_sa_config(struct nlattr
**attrs
, struct nlattr
**tb_sa
)
1675 if (!attrs
[MACSEC_ATTR_SA_CONFIG
])
1678 if (nla_parse_nested_deprecated(tb_sa
, MACSEC_SA_ATTR_MAX
, attrs
[MACSEC_ATTR_SA_CONFIG
], macsec_genl_sa_policy
, NULL
))
1684 static int parse_rxsc_config(struct nlattr
**attrs
, struct nlattr
**tb_rxsc
)
1686 if (!attrs
[MACSEC_ATTR_RXSC_CONFIG
])
1689 if (nla_parse_nested_deprecated(tb_rxsc
, MACSEC_RXSC_ATTR_MAX
, attrs
[MACSEC_ATTR_RXSC_CONFIG
], macsec_genl_rxsc_policy
, NULL
))
1695 static bool validate_add_rxsa(struct nlattr
**attrs
)
1697 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
1698 !attrs
[MACSEC_SA_ATTR_KEY
] ||
1699 !attrs
[MACSEC_SA_ATTR_KEYID
])
1702 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
1705 if (attrs
[MACSEC_SA_ATTR_PN
] &&
1706 nla_get_u64(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
1709 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
1710 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
1714 if (nla_len(attrs
[MACSEC_SA_ATTR_KEYID
]) != MACSEC_KEYID_LEN
)
1720 static int macsec_add_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
1722 struct net_device
*dev
;
1723 struct nlattr
**attrs
= info
->attrs
;
1724 struct macsec_secy
*secy
;
1725 struct macsec_rx_sc
*rx_sc
;
1726 struct macsec_rx_sa
*rx_sa
;
1727 unsigned char assoc_num
;
1729 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
1730 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
1733 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1736 if (parse_sa_config(attrs
, tb_sa
))
1739 if (parse_rxsc_config(attrs
, tb_rxsc
))
1742 if (!validate_add_rxsa(tb_sa
))
1746 rx_sc
= get_rxsc_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, &dev
, &secy
);
1747 if (IS_ERR(rx_sc
)) {
1749 return PTR_ERR(rx_sc
);
1752 assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1754 if (nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]) != secy
->key_len
) {
1755 pr_notice("macsec: nl: add_rxsa: bad key length: %d != %d\n",
1756 nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]), secy
->key_len
);
1761 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
1762 if (tb_sa
[MACSEC_SA_ATTR_PN
] &&
1763 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
1764 pr_notice("macsec: nl: add_rxsa: bad pn length: %d != %d\n",
1765 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
1771 if (!tb_sa
[MACSEC_SA_ATTR_SSCI
] || !tb_sa
[MACSEC_SA_ATTR_SALT
]) {
1776 if (nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]) != MACSEC_SALT_LEN
) {
1777 pr_notice("macsec: nl: add_rxsa: bad salt length: %d != %d\n",
1778 nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]),
1785 rx_sa
= rtnl_dereference(rx_sc
->sa
[assoc_num
]);
1791 rx_sa
= kmalloc(sizeof(*rx_sa
), GFP_KERNEL
);
1797 err
= init_rx_sa(rx_sa
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
1798 secy
->key_len
, secy
->icv_len
);
1805 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
1806 spin_lock_bh(&rx_sa
->lock
);
1807 rx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
1808 spin_unlock_bh(&rx_sa
->lock
);
1811 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
1812 rx_sa
->active
= !!nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
1817 rx_sa
->ssci
= nla_get_ssci(tb_sa
[MACSEC_SA_ATTR_SSCI
]);
1818 nla_memcpy(rx_sa
->key
.salt
.bytes
, tb_sa
[MACSEC_SA_ATTR_SALT
],
1822 /* If h/w offloading is available, propagate to the device */
1823 if (macsec_is_offloaded(netdev_priv(dev
))) {
1824 const struct macsec_ops
*ops
;
1825 struct macsec_context ctx
;
1827 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
1833 ctx
.sa
.assoc_num
= assoc_num
;
1834 ctx
.sa
.rx_sa
= rx_sa
;
1836 memcpy(ctx
.sa
.key
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
1839 err
= macsec_offload(ops
->mdo_add_rxsa
, &ctx
);
1840 memzero_explicit(ctx
.sa
.key
, secy
->key_len
);
1845 nla_memcpy(rx_sa
->key
.id
, tb_sa
[MACSEC_SA_ATTR_KEYID
], MACSEC_KEYID_LEN
);
1846 rcu_assign_pointer(rx_sc
->sa
[assoc_num
], rx_sa
);
1853 macsec_rxsa_put(rx_sa
);
1858 static bool validate_add_rxsc(struct nlattr
**attrs
)
1860 if (!attrs
[MACSEC_RXSC_ATTR_SCI
])
1863 if (attrs
[MACSEC_RXSC_ATTR_ACTIVE
]) {
1864 if (nla_get_u8(attrs
[MACSEC_RXSC_ATTR_ACTIVE
]) > 1)
1871 static int macsec_add_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
1873 struct net_device
*dev
;
1874 sci_t sci
= MACSEC_UNDEF_SCI
;
1875 struct nlattr
**attrs
= info
->attrs
;
1876 struct macsec_rx_sc
*rx_sc
;
1877 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
1878 struct macsec_secy
*secy
;
1882 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1885 if (parse_rxsc_config(attrs
, tb_rxsc
))
1888 if (!validate_add_rxsc(tb_rxsc
))
1892 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
1895 return PTR_ERR(dev
);
1898 secy
= &macsec_priv(dev
)->secy
;
1899 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
1901 if (tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
])
1902 active
= nla_get_u8(tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]);
1904 rx_sc
= create_rx_sc(dev
, sci
, active
);
1905 if (IS_ERR(rx_sc
)) {
1907 return PTR_ERR(rx_sc
);
1910 if (macsec_is_offloaded(netdev_priv(dev
))) {
1911 const struct macsec_ops
*ops
;
1912 struct macsec_context ctx
;
1914 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
1923 ret
= macsec_offload(ops
->mdo_add_rxsc
, &ctx
);
1933 del_rx_sc(secy
, sci
);
1939 static bool validate_add_txsa(struct nlattr
**attrs
)
1941 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
1942 !attrs
[MACSEC_SA_ATTR_PN
] ||
1943 !attrs
[MACSEC_SA_ATTR_KEY
] ||
1944 !attrs
[MACSEC_SA_ATTR_KEYID
])
1947 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
1950 if (nla_get_u64(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
1953 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
1954 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
1958 if (nla_len(attrs
[MACSEC_SA_ATTR_KEYID
]) != MACSEC_KEYID_LEN
)
1964 static int macsec_add_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
1966 struct net_device
*dev
;
1967 struct nlattr
**attrs
= info
->attrs
;
1968 struct macsec_secy
*secy
;
1969 struct macsec_tx_sc
*tx_sc
;
1970 struct macsec_tx_sa
*tx_sa
;
1971 unsigned char assoc_num
;
1973 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
1974 bool was_operational
;
1977 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1980 if (parse_sa_config(attrs
, tb_sa
))
1983 if (!validate_add_txsa(tb_sa
))
1987 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
1990 return PTR_ERR(dev
);
1993 secy
= &macsec_priv(dev
)->secy
;
1994 tx_sc
= &secy
->tx_sc
;
1996 assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1998 if (nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]) != secy
->key_len
) {
1999 pr_notice("macsec: nl: add_txsa: bad key length: %d != %d\n",
2000 nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]), secy
->key_len
);
2005 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
2006 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
2007 pr_notice("macsec: nl: add_txsa: bad pn length: %d != %d\n",
2008 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2014 if (!tb_sa
[MACSEC_SA_ATTR_SSCI
] || !tb_sa
[MACSEC_SA_ATTR_SALT
]) {
2019 if (nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]) != MACSEC_SALT_LEN
) {
2020 pr_notice("macsec: nl: add_txsa: bad salt length: %d != %d\n",
2021 nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]),
2028 tx_sa
= rtnl_dereference(tx_sc
->sa
[assoc_num
]);
2034 tx_sa
= kmalloc(sizeof(*tx_sa
), GFP_KERNEL
);
2040 err
= init_tx_sa(tx_sa
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
2041 secy
->key_len
, secy
->icv_len
);
2048 spin_lock_bh(&tx_sa
->lock
);
2049 tx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2050 spin_unlock_bh(&tx_sa
->lock
);
2052 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2053 tx_sa
->active
= !!nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2055 was_operational
= secy
->operational
;
2056 if (assoc_num
== tx_sc
->encoding_sa
&& tx_sa
->active
)
2057 secy
->operational
= true;
2060 tx_sa
->ssci
= nla_get_ssci(tb_sa
[MACSEC_SA_ATTR_SSCI
]);
2061 nla_memcpy(tx_sa
->key
.salt
.bytes
, tb_sa
[MACSEC_SA_ATTR_SALT
],
2065 /* If h/w offloading is available, propagate to the device */
2066 if (macsec_is_offloaded(netdev_priv(dev
))) {
2067 const struct macsec_ops
*ops
;
2068 struct macsec_context ctx
;
2070 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2076 ctx
.sa
.assoc_num
= assoc_num
;
2077 ctx
.sa
.tx_sa
= tx_sa
;
2079 memcpy(ctx
.sa
.key
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
2082 err
= macsec_offload(ops
->mdo_add_txsa
, &ctx
);
2083 memzero_explicit(ctx
.sa
.key
, secy
->key_len
);
2088 nla_memcpy(tx_sa
->key
.id
, tb_sa
[MACSEC_SA_ATTR_KEYID
], MACSEC_KEYID_LEN
);
2089 rcu_assign_pointer(tx_sc
->sa
[assoc_num
], tx_sa
);
2096 secy
->operational
= was_operational
;
2097 macsec_txsa_put(tx_sa
);
2102 static int macsec_del_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
2104 struct nlattr
**attrs
= info
->attrs
;
2105 struct net_device
*dev
;
2106 struct macsec_secy
*secy
;
2107 struct macsec_rx_sc
*rx_sc
;
2108 struct macsec_rx_sa
*rx_sa
;
2110 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2111 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2114 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2117 if (parse_sa_config(attrs
, tb_sa
))
2120 if (parse_rxsc_config(attrs
, tb_rxsc
))
2124 rx_sa
= get_rxsa_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, tb_sa
,
2125 &dev
, &secy
, &rx_sc
, &assoc_num
);
2126 if (IS_ERR(rx_sa
)) {
2128 return PTR_ERR(rx_sa
);
2131 if (rx_sa
->active
) {
2136 /* If h/w offloading is available, propagate to the device */
2137 if (macsec_is_offloaded(netdev_priv(dev
))) {
2138 const struct macsec_ops
*ops
;
2139 struct macsec_context ctx
;
2141 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2147 ctx
.sa
.assoc_num
= assoc_num
;
2148 ctx
.sa
.rx_sa
= rx_sa
;
2151 ret
= macsec_offload(ops
->mdo_del_rxsa
, &ctx
);
2156 RCU_INIT_POINTER(rx_sc
->sa
[assoc_num
], NULL
);
2168 static int macsec_del_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
2170 struct nlattr
**attrs
= info
->attrs
;
2171 struct net_device
*dev
;
2172 struct macsec_secy
*secy
;
2173 struct macsec_rx_sc
*rx_sc
;
2175 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2178 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2181 if (parse_rxsc_config(attrs
, tb_rxsc
))
2184 if (!tb_rxsc
[MACSEC_RXSC_ATTR_SCI
])
2188 dev
= get_dev_from_nl(genl_info_net(info
), info
->attrs
);
2191 return PTR_ERR(dev
);
2194 secy
= &macsec_priv(dev
)->secy
;
2195 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
2197 rx_sc
= del_rx_sc(secy
, sci
);
2203 /* If h/w offloading is available, propagate to the device */
2204 if (macsec_is_offloaded(netdev_priv(dev
))) {
2205 const struct macsec_ops
*ops
;
2206 struct macsec_context ctx
;
2208 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2216 ret
= macsec_offload(ops
->mdo_del_rxsc
, &ctx
);
2231 static int macsec_del_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
2233 struct nlattr
**attrs
= info
->attrs
;
2234 struct net_device
*dev
;
2235 struct macsec_secy
*secy
;
2236 struct macsec_tx_sc
*tx_sc
;
2237 struct macsec_tx_sa
*tx_sa
;
2239 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2242 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2245 if (parse_sa_config(attrs
, tb_sa
))
2249 tx_sa
= get_txsa_from_nl(genl_info_net(info
), attrs
, tb_sa
,
2250 &dev
, &secy
, &tx_sc
, &assoc_num
);
2251 if (IS_ERR(tx_sa
)) {
2253 return PTR_ERR(tx_sa
);
2256 if (tx_sa
->active
) {
2261 /* If h/w offloading is available, propagate to the device */
2262 if (macsec_is_offloaded(netdev_priv(dev
))) {
2263 const struct macsec_ops
*ops
;
2264 struct macsec_context ctx
;
2266 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2272 ctx
.sa
.assoc_num
= assoc_num
;
2273 ctx
.sa
.tx_sa
= tx_sa
;
2276 ret
= macsec_offload(ops
->mdo_del_txsa
, &ctx
);
2281 RCU_INIT_POINTER(tx_sc
->sa
[assoc_num
], NULL
);
2293 static bool validate_upd_sa(struct nlattr
**attrs
)
2295 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
2296 attrs
[MACSEC_SA_ATTR_KEY
] ||
2297 attrs
[MACSEC_SA_ATTR_KEYID
] ||
2298 attrs
[MACSEC_SA_ATTR_SSCI
] ||
2299 attrs
[MACSEC_SA_ATTR_SALT
])
2302 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
2305 if (attrs
[MACSEC_SA_ATTR_PN
] && nla_get_u64(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
2308 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
2309 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
2316 static int macsec_upd_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
2318 struct nlattr
**attrs
= info
->attrs
;
2319 struct net_device
*dev
;
2320 struct macsec_secy
*secy
;
2321 struct macsec_tx_sc
*tx_sc
;
2322 struct macsec_tx_sa
*tx_sa
;
2324 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2325 bool was_operational
, was_active
;
2331 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2334 if (parse_sa_config(attrs
, tb_sa
))
2337 if (!validate_upd_sa(tb_sa
))
2341 tx_sa
= get_txsa_from_nl(genl_info_net(info
), attrs
, tb_sa
,
2342 &dev
, &secy
, &tx_sc
, &assoc_num
);
2343 if (IS_ERR(tx_sa
)) {
2345 return PTR_ERR(tx_sa
);
2348 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2351 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
2352 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
2353 pr_notice("macsec: nl: upd_txsa: bad pn length: %d != %d\n",
2354 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2359 spin_lock_bh(&tx_sa
->lock
);
2360 prev_pn
= tx_sa
->next_pn_halves
;
2361 tx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2362 spin_unlock_bh(&tx_sa
->lock
);
2365 was_active
= tx_sa
->active
;
2366 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2367 tx_sa
->active
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2369 was_operational
= secy
->operational
;
2370 if (assoc_num
== tx_sc
->encoding_sa
)
2371 secy
->operational
= tx_sa
->active
;
2373 /* If h/w offloading is available, propagate to the device */
2374 if (macsec_is_offloaded(netdev_priv(dev
))) {
2375 const struct macsec_ops
*ops
;
2376 struct macsec_context ctx
;
2378 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2384 ctx
.sa
.assoc_num
= assoc_num
;
2385 ctx
.sa
.tx_sa
= tx_sa
;
2386 ctx
.sa
.update_pn
= !!prev_pn
.full64
;
2389 ret
= macsec_offload(ops
->mdo_upd_txsa
, &ctx
);
2399 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2400 spin_lock_bh(&tx_sa
->lock
);
2401 tx_sa
->next_pn_halves
= prev_pn
;
2402 spin_unlock_bh(&tx_sa
->lock
);
2404 tx_sa
->active
= was_active
;
2405 secy
->operational
= was_operational
;
2410 static int macsec_upd_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
2412 struct nlattr
**attrs
= info
->attrs
;
2413 struct net_device
*dev
;
2414 struct macsec_secy
*secy
;
2415 struct macsec_rx_sc
*rx_sc
;
2416 struct macsec_rx_sa
*rx_sa
;
2418 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2419 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2426 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2429 if (parse_rxsc_config(attrs
, tb_rxsc
))
2432 if (parse_sa_config(attrs
, tb_sa
))
2435 if (!validate_upd_sa(tb_sa
))
2439 rx_sa
= get_rxsa_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, tb_sa
,
2440 &dev
, &secy
, &rx_sc
, &assoc_num
);
2441 if (IS_ERR(rx_sa
)) {
2443 return PTR_ERR(rx_sa
);
2446 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2449 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
2450 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
2451 pr_notice("macsec: nl: upd_rxsa: bad pn length: %d != %d\n",
2452 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2457 spin_lock_bh(&rx_sa
->lock
);
2458 prev_pn
= rx_sa
->next_pn_halves
;
2459 rx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2460 spin_unlock_bh(&rx_sa
->lock
);
2463 was_active
= rx_sa
->active
;
2464 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2465 rx_sa
->active
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2467 /* If h/w offloading is available, propagate to the device */
2468 if (macsec_is_offloaded(netdev_priv(dev
))) {
2469 const struct macsec_ops
*ops
;
2470 struct macsec_context ctx
;
2472 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2478 ctx
.sa
.assoc_num
= assoc_num
;
2479 ctx
.sa
.rx_sa
= rx_sa
;
2480 ctx
.sa
.update_pn
= !!prev_pn
.full64
;
2483 ret
= macsec_offload(ops
->mdo_upd_rxsa
, &ctx
);
2492 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2493 spin_lock_bh(&rx_sa
->lock
);
2494 rx_sa
->next_pn_halves
= prev_pn
;
2495 spin_unlock_bh(&rx_sa
->lock
);
2497 rx_sa
->active
= was_active
;
2502 static int macsec_upd_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
2504 struct nlattr
**attrs
= info
->attrs
;
2505 struct net_device
*dev
;
2506 struct macsec_secy
*secy
;
2507 struct macsec_rx_sc
*rx_sc
;
2508 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2509 unsigned int prev_n_rx_sc
;
2513 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2516 if (parse_rxsc_config(attrs
, tb_rxsc
))
2519 if (!validate_add_rxsc(tb_rxsc
))
2523 rx_sc
= get_rxsc_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, &dev
, &secy
);
2524 if (IS_ERR(rx_sc
)) {
2526 return PTR_ERR(rx_sc
);
2529 was_active
= rx_sc
->active
;
2530 prev_n_rx_sc
= secy
->n_rx_sc
;
2531 if (tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]) {
2532 bool new = !!nla_get_u8(tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]);
2534 if (rx_sc
->active
!= new)
2535 secy
->n_rx_sc
+= new ? 1 : -1;
2537 rx_sc
->active
= new;
2540 /* If h/w offloading is available, propagate to the device */
2541 if (macsec_is_offloaded(netdev_priv(dev
))) {
2542 const struct macsec_ops
*ops
;
2543 struct macsec_context ctx
;
2545 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2554 ret
= macsec_offload(ops
->mdo_upd_rxsc
, &ctx
);
2564 secy
->n_rx_sc
= prev_n_rx_sc
;
2565 rx_sc
->active
= was_active
;
2570 static bool macsec_is_configured(struct macsec_dev
*macsec
)
2572 struct macsec_secy
*secy
= &macsec
->secy
;
2573 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
2579 for (i
= 0; i
< MACSEC_NUM_AN
; i
++)
2586 static int macsec_update_offload(struct net_device
*dev
, enum macsec_offload offload
)
2588 enum macsec_offload prev_offload
;
2589 const struct macsec_ops
*ops
;
2590 struct macsec_context ctx
;
2591 struct macsec_dev
*macsec
;
2594 macsec
= macsec_priv(dev
);
2596 /* Check if the offloading mode is supported by the underlying layers */
2597 if (offload
!= MACSEC_OFFLOAD_OFF
&&
2598 !macsec_check_offload(offload
, macsec
))
2601 /* Check if the net device is busy. */
2602 if (netif_running(dev
))
2605 /* Check if the device already has rules configured: we do not support
2608 if (macsec_is_configured(macsec
))
2611 prev_offload
= macsec
->offload
;
2613 ops
= __macsec_get_ops(offload
== MACSEC_OFFLOAD_OFF
? prev_offload
: offload
,
2618 macsec
->offload
= offload
;
2620 ctx
.secy
= &macsec
->secy
;
2621 ret
= offload
== MACSEC_OFFLOAD_OFF
? macsec_offload(ops
->mdo_del_secy
, &ctx
)
2622 : macsec_offload(ops
->mdo_add_secy
, &ctx
);
2624 macsec
->offload
= prev_offload
;
2629 static int macsec_upd_offload(struct sk_buff
*skb
, struct genl_info
*info
)
2631 struct nlattr
*tb_offload
[MACSEC_OFFLOAD_ATTR_MAX
+ 1];
2632 struct nlattr
**attrs
= info
->attrs
;
2633 enum macsec_offload offload
;
2634 struct macsec_dev
*macsec
;
2635 struct net_device
*dev
;
2638 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2641 if (!attrs
[MACSEC_ATTR_OFFLOAD
])
2644 if (nla_parse_nested_deprecated(tb_offload
, MACSEC_OFFLOAD_ATTR_MAX
,
2645 attrs
[MACSEC_ATTR_OFFLOAD
],
2646 macsec_genl_offload_policy
, NULL
))
2651 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
2656 macsec
= macsec_priv(dev
);
2658 if (!tb_offload
[MACSEC_OFFLOAD_ATTR_TYPE
]) {
2663 offload
= nla_get_u8(tb_offload
[MACSEC_OFFLOAD_ATTR_TYPE
]);
2665 if (macsec
->offload
!= offload
)
2666 ret
= macsec_update_offload(dev
, offload
);
2672 static void get_tx_sa_stats(struct net_device
*dev
, int an
,
2673 struct macsec_tx_sa
*tx_sa
,
2674 struct macsec_tx_sa_stats
*sum
)
2676 struct macsec_dev
*macsec
= macsec_priv(dev
);
2679 /* If h/w offloading is available, propagate to the device */
2680 if (macsec_is_offloaded(macsec
)) {
2681 const struct macsec_ops
*ops
;
2682 struct macsec_context ctx
;
2684 ops
= macsec_get_ops(macsec
, &ctx
);
2686 ctx
.sa
.assoc_num
= an
;
2687 ctx
.sa
.tx_sa
= tx_sa
;
2688 ctx
.stats
.tx_sa_stats
= sum
;
2689 ctx
.secy
= &macsec_priv(dev
)->secy
;
2690 macsec_offload(ops
->mdo_get_tx_sa_stats
, &ctx
);
2695 for_each_possible_cpu(cpu
) {
2696 const struct macsec_tx_sa_stats
*stats
=
2697 per_cpu_ptr(tx_sa
->stats
, cpu
);
2699 sum
->OutPktsProtected
+= stats
->OutPktsProtected
;
2700 sum
->OutPktsEncrypted
+= stats
->OutPktsEncrypted
;
2704 static int copy_tx_sa_stats(struct sk_buff
*skb
, struct macsec_tx_sa_stats
*sum
)
2706 if (nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED
,
2707 sum
->OutPktsProtected
) ||
2708 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED
,
2709 sum
->OutPktsEncrypted
))
2715 static void get_rx_sa_stats(struct net_device
*dev
,
2716 struct macsec_rx_sc
*rx_sc
, int an
,
2717 struct macsec_rx_sa
*rx_sa
,
2718 struct macsec_rx_sa_stats
*sum
)
2720 struct macsec_dev
*macsec
= macsec_priv(dev
);
2723 /* If h/w offloading is available, propagate to the device */
2724 if (macsec_is_offloaded(macsec
)) {
2725 const struct macsec_ops
*ops
;
2726 struct macsec_context ctx
;
2728 ops
= macsec_get_ops(macsec
, &ctx
);
2730 ctx
.sa
.assoc_num
= an
;
2731 ctx
.sa
.rx_sa
= rx_sa
;
2732 ctx
.stats
.rx_sa_stats
= sum
;
2733 ctx
.secy
= &macsec_priv(dev
)->secy
;
2735 macsec_offload(ops
->mdo_get_rx_sa_stats
, &ctx
);
2740 for_each_possible_cpu(cpu
) {
2741 const struct macsec_rx_sa_stats
*stats
=
2742 per_cpu_ptr(rx_sa
->stats
, cpu
);
2744 sum
->InPktsOK
+= stats
->InPktsOK
;
2745 sum
->InPktsInvalid
+= stats
->InPktsInvalid
;
2746 sum
->InPktsNotValid
+= stats
->InPktsNotValid
;
2747 sum
->InPktsNotUsingSA
+= stats
->InPktsNotUsingSA
;
2748 sum
->InPktsUnusedSA
+= stats
->InPktsUnusedSA
;
2752 static int copy_rx_sa_stats(struct sk_buff
*skb
,
2753 struct macsec_rx_sa_stats
*sum
)
2755 if (nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_OK
, sum
->InPktsOK
) ||
2756 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID
,
2757 sum
->InPktsInvalid
) ||
2758 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID
,
2759 sum
->InPktsNotValid
) ||
2760 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA
,
2761 sum
->InPktsNotUsingSA
) ||
2762 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA
,
2763 sum
->InPktsUnusedSA
))
2769 static void get_rx_sc_stats(struct net_device
*dev
,
2770 struct macsec_rx_sc
*rx_sc
,
2771 struct macsec_rx_sc_stats
*sum
)
2773 struct macsec_dev
*macsec
= macsec_priv(dev
);
2776 /* If h/w offloading is available, propagate to the device */
2777 if (macsec_is_offloaded(macsec
)) {
2778 const struct macsec_ops
*ops
;
2779 struct macsec_context ctx
;
2781 ops
= macsec_get_ops(macsec
, &ctx
);
2783 ctx
.stats
.rx_sc_stats
= sum
;
2784 ctx
.secy
= &macsec_priv(dev
)->secy
;
2786 macsec_offload(ops
->mdo_get_rx_sc_stats
, &ctx
);
2791 for_each_possible_cpu(cpu
) {
2792 const struct pcpu_rx_sc_stats
*stats
;
2793 struct macsec_rx_sc_stats tmp
;
2796 stats
= per_cpu_ptr(rx_sc
->stats
, cpu
);
2798 start
= u64_stats_fetch_begin(&stats
->syncp
);
2799 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2800 } while (u64_stats_fetch_retry(&stats
->syncp
, start
));
2802 sum
->InOctetsValidated
+= tmp
.InOctetsValidated
;
2803 sum
->InOctetsDecrypted
+= tmp
.InOctetsDecrypted
;
2804 sum
->InPktsUnchecked
+= tmp
.InPktsUnchecked
;
2805 sum
->InPktsDelayed
+= tmp
.InPktsDelayed
;
2806 sum
->InPktsOK
+= tmp
.InPktsOK
;
2807 sum
->InPktsInvalid
+= tmp
.InPktsInvalid
;
2808 sum
->InPktsLate
+= tmp
.InPktsLate
;
2809 sum
->InPktsNotValid
+= tmp
.InPktsNotValid
;
2810 sum
->InPktsNotUsingSA
+= tmp
.InPktsNotUsingSA
;
2811 sum
->InPktsUnusedSA
+= tmp
.InPktsUnusedSA
;
2815 static int copy_rx_sc_stats(struct sk_buff
*skb
, struct macsec_rx_sc_stats
*sum
)
2817 if (nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED
,
2818 sum
->InOctetsValidated
,
2819 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2820 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED
,
2821 sum
->InOctetsDecrypted
,
2822 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2823 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED
,
2824 sum
->InPktsUnchecked
,
2825 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2826 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED
,
2828 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2829 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK
,
2831 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2832 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID
,
2834 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2835 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE
,
2837 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2838 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID
,
2839 sum
->InPktsNotValid
,
2840 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2841 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA
,
2842 sum
->InPktsNotUsingSA
,
2843 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2844 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA
,
2845 sum
->InPktsUnusedSA
,
2846 MACSEC_RXSC_STATS_ATTR_PAD
))
2852 static void get_tx_sc_stats(struct net_device
*dev
,
2853 struct macsec_tx_sc_stats
*sum
)
2855 struct macsec_dev
*macsec
= macsec_priv(dev
);
2858 /* If h/w offloading is available, propagate to the device */
2859 if (macsec_is_offloaded(macsec
)) {
2860 const struct macsec_ops
*ops
;
2861 struct macsec_context ctx
;
2863 ops
= macsec_get_ops(macsec
, &ctx
);
2865 ctx
.stats
.tx_sc_stats
= sum
;
2866 ctx
.secy
= &macsec_priv(dev
)->secy
;
2867 macsec_offload(ops
->mdo_get_tx_sc_stats
, &ctx
);
2872 for_each_possible_cpu(cpu
) {
2873 const struct pcpu_tx_sc_stats
*stats
;
2874 struct macsec_tx_sc_stats tmp
;
2877 stats
= per_cpu_ptr(macsec_priv(dev
)->secy
.tx_sc
.stats
, cpu
);
2879 start
= u64_stats_fetch_begin(&stats
->syncp
);
2880 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2881 } while (u64_stats_fetch_retry(&stats
->syncp
, start
));
2883 sum
->OutPktsProtected
+= tmp
.OutPktsProtected
;
2884 sum
->OutPktsEncrypted
+= tmp
.OutPktsEncrypted
;
2885 sum
->OutOctetsProtected
+= tmp
.OutOctetsProtected
;
2886 sum
->OutOctetsEncrypted
+= tmp
.OutOctetsEncrypted
;
2890 static int copy_tx_sc_stats(struct sk_buff
*skb
, struct macsec_tx_sc_stats
*sum
)
2892 if (nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED
,
2893 sum
->OutPktsProtected
,
2894 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2895 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED
,
2896 sum
->OutPktsEncrypted
,
2897 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2898 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED
,
2899 sum
->OutOctetsProtected
,
2900 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2901 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED
,
2902 sum
->OutOctetsEncrypted
,
2903 MACSEC_TXSC_STATS_ATTR_PAD
))
2909 static void get_secy_stats(struct net_device
*dev
, struct macsec_dev_stats
*sum
)
2911 struct macsec_dev
*macsec
= macsec_priv(dev
);
2914 /* If h/w offloading is available, propagate to the device */
2915 if (macsec_is_offloaded(macsec
)) {
2916 const struct macsec_ops
*ops
;
2917 struct macsec_context ctx
;
2919 ops
= macsec_get_ops(macsec
, &ctx
);
2921 ctx
.stats
.dev_stats
= sum
;
2922 ctx
.secy
= &macsec_priv(dev
)->secy
;
2923 macsec_offload(ops
->mdo_get_dev_stats
, &ctx
);
2928 for_each_possible_cpu(cpu
) {
2929 const struct pcpu_secy_stats
*stats
;
2930 struct macsec_dev_stats tmp
;
2933 stats
= per_cpu_ptr(macsec_priv(dev
)->stats
, cpu
);
2935 start
= u64_stats_fetch_begin(&stats
->syncp
);
2936 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2937 } while (u64_stats_fetch_retry(&stats
->syncp
, start
));
2939 sum
->OutPktsUntagged
+= tmp
.OutPktsUntagged
;
2940 sum
->InPktsUntagged
+= tmp
.InPktsUntagged
;
2941 sum
->OutPktsTooLong
+= tmp
.OutPktsTooLong
;
2942 sum
->InPktsNoTag
+= tmp
.InPktsNoTag
;
2943 sum
->InPktsBadTag
+= tmp
.InPktsBadTag
;
2944 sum
->InPktsUnknownSCI
+= tmp
.InPktsUnknownSCI
;
2945 sum
->InPktsNoSCI
+= tmp
.InPktsNoSCI
;
2946 sum
->InPktsOverrun
+= tmp
.InPktsOverrun
;
2950 static int copy_secy_stats(struct sk_buff
*skb
, struct macsec_dev_stats
*sum
)
2952 if (nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED
,
2953 sum
->OutPktsUntagged
,
2954 MACSEC_SECY_STATS_ATTR_PAD
) ||
2955 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED
,
2956 sum
->InPktsUntagged
,
2957 MACSEC_SECY_STATS_ATTR_PAD
) ||
2958 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG
,
2959 sum
->OutPktsTooLong
,
2960 MACSEC_SECY_STATS_ATTR_PAD
) ||
2961 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG
,
2963 MACSEC_SECY_STATS_ATTR_PAD
) ||
2964 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG
,
2966 MACSEC_SECY_STATS_ATTR_PAD
) ||
2967 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI
,
2968 sum
->InPktsUnknownSCI
,
2969 MACSEC_SECY_STATS_ATTR_PAD
) ||
2970 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI
,
2972 MACSEC_SECY_STATS_ATTR_PAD
) ||
2973 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN
,
2975 MACSEC_SECY_STATS_ATTR_PAD
))
2981 static int nla_put_secy(struct macsec_secy
*secy
, struct sk_buff
*skb
)
2983 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
2984 struct nlattr
*secy_nest
= nla_nest_start_noflag(skb
,
2991 switch (secy
->key_len
) {
2992 case MACSEC_GCM_AES_128_SAK_LEN
:
2993 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_128
: MACSEC_DEFAULT_CIPHER_ID
;
2995 case MACSEC_GCM_AES_256_SAK_LEN
:
2996 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_256
: MACSEC_CIPHER_ID_GCM_AES_256
;
3002 if (nla_put_sci(skb
, MACSEC_SECY_ATTR_SCI
, secy
->sci
,
3003 MACSEC_SECY_ATTR_PAD
) ||
3004 nla_put_u64_64bit(skb
, MACSEC_SECY_ATTR_CIPHER_SUITE
,
3005 csid
, MACSEC_SECY_ATTR_PAD
) ||
3006 nla_put_u8(skb
, MACSEC_SECY_ATTR_ICV_LEN
, secy
->icv_len
) ||
3007 nla_put_u8(skb
, MACSEC_SECY_ATTR_OPER
, secy
->operational
) ||
3008 nla_put_u8(skb
, MACSEC_SECY_ATTR_PROTECT
, secy
->protect_frames
) ||
3009 nla_put_u8(skb
, MACSEC_SECY_ATTR_REPLAY
, secy
->replay_protect
) ||
3010 nla_put_u8(skb
, MACSEC_SECY_ATTR_VALIDATE
, secy
->validate_frames
) ||
3011 nla_put_u8(skb
, MACSEC_SECY_ATTR_ENCRYPT
, tx_sc
->encrypt
) ||
3012 nla_put_u8(skb
, MACSEC_SECY_ATTR_INC_SCI
, tx_sc
->send_sci
) ||
3013 nla_put_u8(skb
, MACSEC_SECY_ATTR_ES
, tx_sc
->end_station
) ||
3014 nla_put_u8(skb
, MACSEC_SECY_ATTR_SCB
, tx_sc
->scb
) ||
3015 nla_put_u8(skb
, MACSEC_SECY_ATTR_ENCODING_SA
, tx_sc
->encoding_sa
))
3018 if (secy
->replay_protect
) {
3019 if (nla_put_u32(skb
, MACSEC_SECY_ATTR_WINDOW
, secy
->replay_window
))
3023 nla_nest_end(skb
, secy_nest
);
3027 nla_nest_cancel(skb
, secy_nest
);
3031 static noinline_for_stack
int
3032 dump_secy(struct macsec_secy
*secy
, struct net_device
*dev
,
3033 struct sk_buff
*skb
, struct netlink_callback
*cb
)
3035 struct macsec_tx_sc_stats tx_sc_stats
= {0, };
3036 struct macsec_tx_sa_stats tx_sa_stats
= {0, };
3037 struct macsec_rx_sc_stats rx_sc_stats
= {0, };
3038 struct macsec_rx_sa_stats rx_sa_stats
= {0, };
3039 struct macsec_dev
*macsec
= netdev_priv(dev
);
3040 struct macsec_dev_stats dev_stats
= {0, };
3041 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
3042 struct nlattr
*txsa_list
, *rxsc_list
;
3043 struct macsec_rx_sc
*rx_sc
;
3044 struct nlattr
*attr
;
3048 hdr
= genlmsg_put(skb
, NETLINK_CB(cb
->skb
).portid
, cb
->nlh
->nlmsg_seq
,
3049 &macsec_fam
, NLM_F_MULTI
, MACSEC_CMD_GET_TXSC
);
3053 genl_dump_check_consistent(cb
, hdr
);
3055 if (nla_put_u32(skb
, MACSEC_ATTR_IFINDEX
, dev
->ifindex
))
3056 goto nla_put_failure
;
3058 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_OFFLOAD
);
3060 goto nla_put_failure
;
3061 if (nla_put_u8(skb
, MACSEC_OFFLOAD_ATTR_TYPE
, macsec
->offload
))
3062 goto nla_put_failure
;
3063 nla_nest_end(skb
, attr
);
3065 if (nla_put_secy(secy
, skb
))
3066 goto nla_put_failure
;
3068 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_TXSC_STATS
);
3070 goto nla_put_failure
;
3072 get_tx_sc_stats(dev
, &tx_sc_stats
);
3073 if (copy_tx_sc_stats(skb
, &tx_sc_stats
)) {
3074 nla_nest_cancel(skb
, attr
);
3075 goto nla_put_failure
;
3077 nla_nest_end(skb
, attr
);
3079 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_SECY_STATS
);
3081 goto nla_put_failure
;
3082 get_secy_stats(dev
, &dev_stats
);
3083 if (copy_secy_stats(skb
, &dev_stats
)) {
3084 nla_nest_cancel(skb
, attr
);
3085 goto nla_put_failure
;
3087 nla_nest_end(skb
, attr
);
3089 txsa_list
= nla_nest_start_noflag(skb
, MACSEC_ATTR_TXSA_LIST
);
3091 goto nla_put_failure
;
3092 for (i
= 0, j
= 1; i
< MACSEC_NUM_AN
; i
++) {
3093 struct macsec_tx_sa
*tx_sa
= rtnl_dereference(tx_sc
->sa
[i
]);
3094 struct nlattr
*txsa_nest
;
3101 txsa_nest
= nla_nest_start_noflag(skb
, j
++);
3103 nla_nest_cancel(skb
, txsa_list
);
3104 goto nla_put_failure
;
3107 attr
= nla_nest_start_noflag(skb
, MACSEC_SA_ATTR_STATS
);
3109 nla_nest_cancel(skb
, txsa_nest
);
3110 nla_nest_cancel(skb
, txsa_list
);
3111 goto nla_put_failure
;
3113 memset(&tx_sa_stats
, 0, sizeof(tx_sa_stats
));
3114 get_tx_sa_stats(dev
, i
, tx_sa
, &tx_sa_stats
);
3115 if (copy_tx_sa_stats(skb
, &tx_sa_stats
)) {
3116 nla_nest_cancel(skb
, attr
);
3117 nla_nest_cancel(skb
, txsa_nest
);
3118 nla_nest_cancel(skb
, txsa_list
);
3119 goto nla_put_failure
;
3121 nla_nest_end(skb
, attr
);
3124 pn
= tx_sa
->next_pn
;
3125 pn_len
= MACSEC_XPN_PN_LEN
;
3127 pn
= tx_sa
->next_pn_halves
.lower
;
3128 pn_len
= MACSEC_DEFAULT_PN_LEN
;
3131 if (nla_put_u8(skb
, MACSEC_SA_ATTR_AN
, i
) ||
3132 nla_put(skb
, MACSEC_SA_ATTR_PN
, pn_len
, &pn
) ||
3133 nla_put(skb
, MACSEC_SA_ATTR_KEYID
, MACSEC_KEYID_LEN
, tx_sa
->key
.id
) ||
3134 (secy
->xpn
&& nla_put_ssci(skb
, MACSEC_SA_ATTR_SSCI
, tx_sa
->ssci
)) ||
3135 nla_put_u8(skb
, MACSEC_SA_ATTR_ACTIVE
, tx_sa
->active
)) {
3136 nla_nest_cancel(skb
, txsa_nest
);
3137 nla_nest_cancel(skb
, txsa_list
);
3138 goto nla_put_failure
;
3141 nla_nest_end(skb
, txsa_nest
);
3143 nla_nest_end(skb
, txsa_list
);
3145 rxsc_list
= nla_nest_start_noflag(skb
, MACSEC_ATTR_RXSC_LIST
);
3147 goto nla_put_failure
;
3150 for_each_rxsc_rtnl(secy
, rx_sc
) {
3152 struct nlattr
*rxsa_list
;
3153 struct nlattr
*rxsc_nest
= nla_nest_start_noflag(skb
, j
++);
3156 nla_nest_cancel(skb
, rxsc_list
);
3157 goto nla_put_failure
;
3160 if (nla_put_u8(skb
, MACSEC_RXSC_ATTR_ACTIVE
, rx_sc
->active
) ||
3161 nla_put_sci(skb
, MACSEC_RXSC_ATTR_SCI
, rx_sc
->sci
,
3162 MACSEC_RXSC_ATTR_PAD
)) {
3163 nla_nest_cancel(skb
, rxsc_nest
);
3164 nla_nest_cancel(skb
, rxsc_list
);
3165 goto nla_put_failure
;
3168 attr
= nla_nest_start_noflag(skb
, MACSEC_RXSC_ATTR_STATS
);
3170 nla_nest_cancel(skb
, rxsc_nest
);
3171 nla_nest_cancel(skb
, rxsc_list
);
3172 goto nla_put_failure
;
3174 memset(&rx_sc_stats
, 0, sizeof(rx_sc_stats
));
3175 get_rx_sc_stats(dev
, rx_sc
, &rx_sc_stats
);
3176 if (copy_rx_sc_stats(skb
, &rx_sc_stats
)) {
3177 nla_nest_cancel(skb
, attr
);
3178 nla_nest_cancel(skb
, rxsc_nest
);
3179 nla_nest_cancel(skb
, rxsc_list
);
3180 goto nla_put_failure
;
3182 nla_nest_end(skb
, attr
);
3184 rxsa_list
= nla_nest_start_noflag(skb
,
3185 MACSEC_RXSC_ATTR_SA_LIST
);
3187 nla_nest_cancel(skb
, rxsc_nest
);
3188 nla_nest_cancel(skb
, rxsc_list
);
3189 goto nla_put_failure
;
3192 for (i
= 0, k
= 1; i
< MACSEC_NUM_AN
; i
++) {
3193 struct macsec_rx_sa
*rx_sa
= rtnl_dereference(rx_sc
->sa
[i
]);
3194 struct nlattr
*rxsa_nest
;
3201 rxsa_nest
= nla_nest_start_noflag(skb
, k
++);
3203 nla_nest_cancel(skb
, rxsa_list
);
3204 nla_nest_cancel(skb
, rxsc_nest
);
3205 nla_nest_cancel(skb
, rxsc_list
);
3206 goto nla_put_failure
;
3209 attr
= nla_nest_start_noflag(skb
,
3210 MACSEC_SA_ATTR_STATS
);
3212 nla_nest_cancel(skb
, rxsa_list
);
3213 nla_nest_cancel(skb
, rxsc_nest
);
3214 nla_nest_cancel(skb
, rxsc_list
);
3215 goto nla_put_failure
;
3217 memset(&rx_sa_stats
, 0, sizeof(rx_sa_stats
));
3218 get_rx_sa_stats(dev
, rx_sc
, i
, rx_sa
, &rx_sa_stats
);
3219 if (copy_rx_sa_stats(skb
, &rx_sa_stats
)) {
3220 nla_nest_cancel(skb
, attr
);
3221 nla_nest_cancel(skb
, rxsa_list
);
3222 nla_nest_cancel(skb
, rxsc_nest
);
3223 nla_nest_cancel(skb
, rxsc_list
);
3224 goto nla_put_failure
;
3226 nla_nest_end(skb
, attr
);
3229 pn
= rx_sa
->next_pn
;
3230 pn_len
= MACSEC_XPN_PN_LEN
;
3232 pn
= rx_sa
->next_pn_halves
.lower
;
3233 pn_len
= MACSEC_DEFAULT_PN_LEN
;
3236 if (nla_put_u8(skb
, MACSEC_SA_ATTR_AN
, i
) ||
3237 nla_put(skb
, MACSEC_SA_ATTR_PN
, pn_len
, &pn
) ||
3238 nla_put(skb
, MACSEC_SA_ATTR_KEYID
, MACSEC_KEYID_LEN
, rx_sa
->key
.id
) ||
3239 (secy
->xpn
&& nla_put_ssci(skb
, MACSEC_SA_ATTR_SSCI
, rx_sa
->ssci
)) ||
3240 nla_put_u8(skb
, MACSEC_SA_ATTR_ACTIVE
, rx_sa
->active
)) {
3241 nla_nest_cancel(skb
, rxsa_nest
);
3242 nla_nest_cancel(skb
, rxsc_nest
);
3243 nla_nest_cancel(skb
, rxsc_list
);
3244 goto nla_put_failure
;
3246 nla_nest_end(skb
, rxsa_nest
);
3249 nla_nest_end(skb
, rxsa_list
);
3250 nla_nest_end(skb
, rxsc_nest
);
3253 nla_nest_end(skb
, rxsc_list
);
3255 genlmsg_end(skb
, hdr
);
3260 genlmsg_cancel(skb
, hdr
);
3264 static int macsec_generation
= 1; /* protected by RTNL */
3266 static int macsec_dump_txsc(struct sk_buff
*skb
, struct netlink_callback
*cb
)
3268 struct net
*net
= sock_net(skb
->sk
);
3269 struct net_device
*dev
;
3272 dev_idx
= cb
->args
[0];
3277 cb
->seq
= macsec_generation
;
3279 for_each_netdev(net
, dev
) {
3280 struct macsec_secy
*secy
;
3285 if (!netif_is_macsec(dev
))
3288 secy
= &macsec_priv(dev
)->secy
;
3289 if (dump_secy(secy
, dev
, skb
, cb
) < 0)
3301 static const struct genl_small_ops macsec_genl_ops
[] = {
3303 .cmd
= MACSEC_CMD_GET_TXSC
,
3304 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3305 .dumpit
= macsec_dump_txsc
,
3308 .cmd
= MACSEC_CMD_ADD_RXSC
,
3309 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3310 .doit
= macsec_add_rxsc
,
3311 .flags
= GENL_ADMIN_PERM
,
3314 .cmd
= MACSEC_CMD_DEL_RXSC
,
3315 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3316 .doit
= macsec_del_rxsc
,
3317 .flags
= GENL_ADMIN_PERM
,
3320 .cmd
= MACSEC_CMD_UPD_RXSC
,
3321 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3322 .doit
= macsec_upd_rxsc
,
3323 .flags
= GENL_ADMIN_PERM
,
3326 .cmd
= MACSEC_CMD_ADD_TXSA
,
3327 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3328 .doit
= macsec_add_txsa
,
3329 .flags
= GENL_ADMIN_PERM
,
3332 .cmd
= MACSEC_CMD_DEL_TXSA
,
3333 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3334 .doit
= macsec_del_txsa
,
3335 .flags
= GENL_ADMIN_PERM
,
3338 .cmd
= MACSEC_CMD_UPD_TXSA
,
3339 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3340 .doit
= macsec_upd_txsa
,
3341 .flags
= GENL_ADMIN_PERM
,
3344 .cmd
= MACSEC_CMD_ADD_RXSA
,
3345 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3346 .doit
= macsec_add_rxsa
,
3347 .flags
= GENL_ADMIN_PERM
,
3350 .cmd
= MACSEC_CMD_DEL_RXSA
,
3351 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3352 .doit
= macsec_del_rxsa
,
3353 .flags
= GENL_ADMIN_PERM
,
3356 .cmd
= MACSEC_CMD_UPD_RXSA
,
3357 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3358 .doit
= macsec_upd_rxsa
,
3359 .flags
= GENL_ADMIN_PERM
,
3362 .cmd
= MACSEC_CMD_UPD_OFFLOAD
,
3363 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3364 .doit
= macsec_upd_offload
,
3365 .flags
= GENL_ADMIN_PERM
,
3369 static struct genl_family macsec_fam __ro_after_init
= {
3370 .name
= MACSEC_GENL_NAME
,
3372 .version
= MACSEC_GENL_VERSION
,
3373 .maxattr
= MACSEC_ATTR_MAX
,
3374 .policy
= macsec_genl_policy
,
3376 .module
= THIS_MODULE
,
3377 .small_ops
= macsec_genl_ops
,
3378 .n_small_ops
= ARRAY_SIZE(macsec_genl_ops
),
3379 .resv_start_op
= MACSEC_CMD_UPD_OFFLOAD
+ 1,
3382 static netdev_tx_t
macsec_start_xmit(struct sk_buff
*skb
,
3383 struct net_device
*dev
)
3385 struct macsec_dev
*macsec
= netdev_priv(dev
);
3386 struct macsec_secy
*secy
= &macsec
->secy
;
3387 struct pcpu_secy_stats
*secy_stats
;
3390 if (macsec_is_offloaded(netdev_priv(dev
))) {
3391 struct metadata_dst
*md_dst
= secy
->tx_sc
.md_dst
;
3394 dst_hold(&md_dst
->dst
);
3395 skb_dst_set(skb
, &md_dst
->dst
);
3396 skb
->dev
= macsec
->real_dev
;
3397 return dev_queue_xmit(skb
);
3401 if (!secy
->protect_frames
) {
3402 secy_stats
= this_cpu_ptr(macsec
->stats
);
3403 u64_stats_update_begin(&secy_stats
->syncp
);
3404 secy_stats
->stats
.OutPktsUntagged
++;
3405 u64_stats_update_end(&secy_stats
->syncp
);
3406 skb
->dev
= macsec
->real_dev
;
3408 ret
= dev_queue_xmit(skb
);
3409 count_tx(dev
, ret
, len
);
3413 if (!secy
->operational
) {
3415 DEV_STATS_INC(dev
, tx_dropped
);
3416 return NETDEV_TX_OK
;
3420 skb
= macsec_encrypt(skb
, dev
);
3422 if (PTR_ERR(skb
) != -EINPROGRESS
)
3423 DEV_STATS_INC(dev
, tx_dropped
);
3424 return NETDEV_TX_OK
;
3427 macsec_count_tx(skb
, &macsec
->secy
.tx_sc
, macsec_skb_cb(skb
)->tx_sa
);
3429 macsec_encrypt_finish(skb
, dev
);
3430 ret
= dev_queue_xmit(skb
);
3431 count_tx(dev
, ret
, len
);
3435 #define MACSEC_FEATURES \
3436 (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
3438 static int macsec_dev_init(struct net_device
*dev
)
3440 struct macsec_dev
*macsec
= macsec_priv(dev
);
3441 struct net_device
*real_dev
= macsec
->real_dev
;
3444 dev
->tstats
= netdev_alloc_pcpu_stats(struct pcpu_sw_netstats
);
3448 err
= gro_cells_init(&macsec
->gro_cells
, dev
);
3450 free_percpu(dev
->tstats
);
3454 dev
->features
= real_dev
->features
& MACSEC_FEATURES
;
3455 dev
->features
|= NETIF_F_LLTX
| NETIF_F_GSO_SOFTWARE
;
3457 dev
->needed_headroom
= real_dev
->needed_headroom
+
3458 MACSEC_NEEDED_HEADROOM
;
3459 dev
->needed_tailroom
= real_dev
->needed_tailroom
+
3460 MACSEC_NEEDED_TAILROOM
;
3462 if (is_zero_ether_addr(dev
->dev_addr
))
3463 eth_hw_addr_inherit(dev
, real_dev
);
3464 if (is_zero_ether_addr(dev
->broadcast
))
3465 memcpy(dev
->broadcast
, real_dev
->broadcast
, dev
->addr_len
);
3467 /* Get macsec's reference to real_dev */
3468 netdev_hold(real_dev
, &macsec
->dev_tracker
, GFP_KERNEL
);
3473 static void macsec_dev_uninit(struct net_device
*dev
)
3475 struct macsec_dev
*macsec
= macsec_priv(dev
);
3477 gro_cells_destroy(&macsec
->gro_cells
);
3478 free_percpu(dev
->tstats
);
3481 static netdev_features_t
macsec_fix_features(struct net_device
*dev
,
3482 netdev_features_t features
)
3484 struct macsec_dev
*macsec
= macsec_priv(dev
);
3485 struct net_device
*real_dev
= macsec
->real_dev
;
3487 features
&= (real_dev
->features
& MACSEC_FEATURES
) |
3488 NETIF_F_GSO_SOFTWARE
| NETIF_F_SOFT_FEATURES
;
3489 features
|= NETIF_F_LLTX
;
3494 static int macsec_dev_open(struct net_device
*dev
)
3496 struct macsec_dev
*macsec
= macsec_priv(dev
);
3497 struct net_device
*real_dev
= macsec
->real_dev
;
3500 err
= dev_uc_add(real_dev
, dev
->dev_addr
);
3504 if (dev
->flags
& IFF_ALLMULTI
) {
3505 err
= dev_set_allmulti(real_dev
, 1);
3510 if (dev
->flags
& IFF_PROMISC
) {
3511 err
= dev_set_promiscuity(real_dev
, 1);
3513 goto clear_allmulti
;
3516 /* If h/w offloading is available, propagate to the device */
3517 if (macsec_is_offloaded(macsec
)) {
3518 const struct macsec_ops
*ops
;
3519 struct macsec_context ctx
;
3521 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3524 goto clear_allmulti
;
3527 ctx
.secy
= &macsec
->secy
;
3528 err
= macsec_offload(ops
->mdo_dev_open
, &ctx
);
3530 goto clear_allmulti
;
3533 if (netif_carrier_ok(real_dev
))
3534 netif_carrier_on(dev
);
3538 if (dev
->flags
& IFF_ALLMULTI
)
3539 dev_set_allmulti(real_dev
, -1);
3541 dev_uc_del(real_dev
, dev
->dev_addr
);
3542 netif_carrier_off(dev
);
3546 static int macsec_dev_stop(struct net_device
*dev
)
3548 struct macsec_dev
*macsec
= macsec_priv(dev
);
3549 struct net_device
*real_dev
= macsec
->real_dev
;
3551 netif_carrier_off(dev
);
3553 /* If h/w offloading is available, propagate to the device */
3554 if (macsec_is_offloaded(macsec
)) {
3555 const struct macsec_ops
*ops
;
3556 struct macsec_context ctx
;
3558 ops
= macsec_get_ops(macsec
, &ctx
);
3560 ctx
.secy
= &macsec
->secy
;
3561 macsec_offload(ops
->mdo_dev_stop
, &ctx
);
3565 dev_mc_unsync(real_dev
, dev
);
3566 dev_uc_unsync(real_dev
, dev
);
3568 if (dev
->flags
& IFF_ALLMULTI
)
3569 dev_set_allmulti(real_dev
, -1);
3571 if (dev
->flags
& IFF_PROMISC
)
3572 dev_set_promiscuity(real_dev
, -1);
3574 dev_uc_del(real_dev
, dev
->dev_addr
);
3579 static void macsec_dev_change_rx_flags(struct net_device
*dev
, int change
)
3581 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
3583 if (!(dev
->flags
& IFF_UP
))
3586 if (change
& IFF_ALLMULTI
)
3587 dev_set_allmulti(real_dev
, dev
->flags
& IFF_ALLMULTI
? 1 : -1);
3589 if (change
& IFF_PROMISC
)
3590 dev_set_promiscuity(real_dev
,
3591 dev
->flags
& IFF_PROMISC
? 1 : -1);
3594 static void macsec_dev_set_rx_mode(struct net_device
*dev
)
3596 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
3598 dev_mc_sync(real_dev
, dev
);
3599 dev_uc_sync(real_dev
, dev
);
3602 static int macsec_set_mac_address(struct net_device
*dev
, void *p
)
3604 struct macsec_dev
*macsec
= macsec_priv(dev
);
3605 struct net_device
*real_dev
= macsec
->real_dev
;
3606 struct sockaddr
*addr
= p
;
3609 if (!is_valid_ether_addr(addr
->sa_data
))
3610 return -EADDRNOTAVAIL
;
3612 if (!(dev
->flags
& IFF_UP
))
3615 err
= dev_uc_add(real_dev
, addr
->sa_data
);
3619 dev_uc_del(real_dev
, dev
->dev_addr
);
3622 eth_hw_addr_set(dev
, addr
->sa_data
);
3624 /* If h/w offloading is available, propagate to the device */
3625 if (macsec_is_offloaded(macsec
)) {
3626 const struct macsec_ops
*ops
;
3627 struct macsec_context ctx
;
3629 ops
= macsec_get_ops(macsec
, &ctx
);
3631 ctx
.secy
= &macsec
->secy
;
3632 macsec_offload(ops
->mdo_upd_secy
, &ctx
);
3639 static int macsec_change_mtu(struct net_device
*dev
, int new_mtu
)
3641 struct macsec_dev
*macsec
= macsec_priv(dev
);
3642 unsigned int extra
= macsec
->secy
.icv_len
+ macsec_extra_len(true);
3644 if (macsec
->real_dev
->mtu
- extra
< new_mtu
)
3652 static void macsec_get_stats64(struct net_device
*dev
,
3653 struct rtnl_link_stats64
*s
)
3658 dev_fetch_sw_netstats(s
, dev
->tstats
);
3660 s
->rx_dropped
= atomic_long_read(&dev
->stats
.__rx_dropped
);
3661 s
->tx_dropped
= atomic_long_read(&dev
->stats
.__tx_dropped
);
3662 s
->rx_errors
= atomic_long_read(&dev
->stats
.__rx_errors
);
3665 static int macsec_get_iflink(const struct net_device
*dev
)
3667 return macsec_priv(dev
)->real_dev
->ifindex
;
3670 static const struct net_device_ops macsec_netdev_ops
= {
3671 .ndo_init
= macsec_dev_init
,
3672 .ndo_uninit
= macsec_dev_uninit
,
3673 .ndo_open
= macsec_dev_open
,
3674 .ndo_stop
= macsec_dev_stop
,
3675 .ndo_fix_features
= macsec_fix_features
,
3676 .ndo_change_mtu
= macsec_change_mtu
,
3677 .ndo_set_rx_mode
= macsec_dev_set_rx_mode
,
3678 .ndo_change_rx_flags
= macsec_dev_change_rx_flags
,
3679 .ndo_set_mac_address
= macsec_set_mac_address
,
3680 .ndo_start_xmit
= macsec_start_xmit
,
3681 .ndo_get_stats64
= macsec_get_stats64
,
3682 .ndo_get_iflink
= macsec_get_iflink
,
3685 static const struct device_type macsec_type
= {
3689 static const struct nla_policy macsec_rtnl_policy
[IFLA_MACSEC_MAX
+ 1] = {
3690 [IFLA_MACSEC_SCI
] = { .type
= NLA_U64
},
3691 [IFLA_MACSEC_PORT
] = { .type
= NLA_U16
},
3692 [IFLA_MACSEC_ICV_LEN
] = { .type
= NLA_U8
},
3693 [IFLA_MACSEC_CIPHER_SUITE
] = { .type
= NLA_U64
},
3694 [IFLA_MACSEC_WINDOW
] = { .type
= NLA_U32
},
3695 [IFLA_MACSEC_ENCODING_SA
] = { .type
= NLA_U8
},
3696 [IFLA_MACSEC_ENCRYPT
] = { .type
= NLA_U8
},
3697 [IFLA_MACSEC_PROTECT
] = { .type
= NLA_U8
},
3698 [IFLA_MACSEC_INC_SCI
] = { .type
= NLA_U8
},
3699 [IFLA_MACSEC_ES
] = { .type
= NLA_U8
},
3700 [IFLA_MACSEC_SCB
] = { .type
= NLA_U8
},
3701 [IFLA_MACSEC_REPLAY_PROTECT
] = { .type
= NLA_U8
},
3702 [IFLA_MACSEC_VALIDATION
] = { .type
= NLA_U8
},
3703 [IFLA_MACSEC_OFFLOAD
] = { .type
= NLA_U8
},
3706 static void macsec_free_netdev(struct net_device
*dev
)
3708 struct macsec_dev
*macsec
= macsec_priv(dev
);
3710 if (macsec
->secy
.tx_sc
.md_dst
)
3711 metadata_dst_free(macsec
->secy
.tx_sc
.md_dst
);
3712 free_percpu(macsec
->stats
);
3713 free_percpu(macsec
->secy
.tx_sc
.stats
);
3715 /* Get rid of the macsec's reference to real_dev */
3716 netdev_put(macsec
->real_dev
, &macsec
->dev_tracker
);
3719 static void macsec_setup(struct net_device
*dev
)
3723 dev
->max_mtu
= ETH_MAX_MTU
;
3724 dev
->priv_flags
|= IFF_NO_QUEUE
;
3725 dev
->netdev_ops
= &macsec_netdev_ops
;
3726 dev
->needs_free_netdev
= true;
3727 dev
->priv_destructor
= macsec_free_netdev
;
3728 SET_NETDEV_DEVTYPE(dev
, &macsec_type
);
3730 eth_zero_addr(dev
->broadcast
);
3733 static int macsec_changelink_common(struct net_device
*dev
,
3734 struct nlattr
*data
[])
3736 struct macsec_secy
*secy
;
3737 struct macsec_tx_sc
*tx_sc
;
3739 secy
= &macsec_priv(dev
)->secy
;
3740 tx_sc
= &secy
->tx_sc
;
3742 if (data
[IFLA_MACSEC_ENCODING_SA
]) {
3743 struct macsec_tx_sa
*tx_sa
;
3745 tx_sc
->encoding_sa
= nla_get_u8(data
[IFLA_MACSEC_ENCODING_SA
]);
3746 tx_sa
= rtnl_dereference(tx_sc
->sa
[tx_sc
->encoding_sa
]);
3748 secy
->operational
= tx_sa
&& tx_sa
->active
;
3751 if (data
[IFLA_MACSEC_ENCRYPT
])
3752 tx_sc
->encrypt
= !!nla_get_u8(data
[IFLA_MACSEC_ENCRYPT
]);
3754 if (data
[IFLA_MACSEC_PROTECT
])
3755 secy
->protect_frames
= !!nla_get_u8(data
[IFLA_MACSEC_PROTECT
]);
3757 if (data
[IFLA_MACSEC_INC_SCI
])
3758 tx_sc
->send_sci
= !!nla_get_u8(data
[IFLA_MACSEC_INC_SCI
]);
3760 if (data
[IFLA_MACSEC_ES
])
3761 tx_sc
->end_station
= !!nla_get_u8(data
[IFLA_MACSEC_ES
]);
3763 if (data
[IFLA_MACSEC_SCB
])
3764 tx_sc
->scb
= !!nla_get_u8(data
[IFLA_MACSEC_SCB
]);
3766 if (data
[IFLA_MACSEC_REPLAY_PROTECT
])
3767 secy
->replay_protect
= !!nla_get_u8(data
[IFLA_MACSEC_REPLAY_PROTECT
]);
3769 if (data
[IFLA_MACSEC_VALIDATION
])
3770 secy
->validate_frames
= nla_get_u8(data
[IFLA_MACSEC_VALIDATION
]);
3772 if (data
[IFLA_MACSEC_CIPHER_SUITE
]) {
3773 switch (nla_get_u64(data
[IFLA_MACSEC_CIPHER_SUITE
])) {
3774 case MACSEC_CIPHER_ID_GCM_AES_128
:
3775 case MACSEC_DEFAULT_CIPHER_ID
:
3776 secy
->key_len
= MACSEC_GCM_AES_128_SAK_LEN
;
3779 case MACSEC_CIPHER_ID_GCM_AES_256
:
3780 secy
->key_len
= MACSEC_GCM_AES_256_SAK_LEN
;
3783 case MACSEC_CIPHER_ID_GCM_AES_XPN_128
:
3784 secy
->key_len
= MACSEC_GCM_AES_128_SAK_LEN
;
3787 case MACSEC_CIPHER_ID_GCM_AES_XPN_256
:
3788 secy
->key_len
= MACSEC_GCM_AES_256_SAK_LEN
;
3796 if (data
[IFLA_MACSEC_WINDOW
]) {
3797 secy
->replay_window
= nla_get_u32(data
[IFLA_MACSEC_WINDOW
]);
3799 /* IEEE 802.1AEbw-2013 10.7.8 - maximum replay window
3800 * for XPN cipher suites */
3802 secy
->replay_window
> MACSEC_XPN_MAX_REPLAY_WINDOW
)
3809 static int macsec_changelink(struct net_device
*dev
, struct nlattr
*tb
[],
3810 struct nlattr
*data
[],
3811 struct netlink_ext_ack
*extack
)
3813 struct macsec_dev
*macsec
= macsec_priv(dev
);
3814 bool macsec_offload_state_change
= false;
3815 enum macsec_offload offload
;
3816 struct macsec_tx_sc tx_sc
;
3817 struct macsec_secy secy
;
3823 if (data
[IFLA_MACSEC_CIPHER_SUITE
] ||
3824 data
[IFLA_MACSEC_ICV_LEN
] ||
3825 data
[IFLA_MACSEC_SCI
] ||
3826 data
[IFLA_MACSEC_PORT
])
3829 /* Keep a copy of unmodified secy and tx_sc, in case the offload
3830 * propagation fails, to revert macsec_changelink_common.
3832 memcpy(&secy
, &macsec
->secy
, sizeof(secy
));
3833 memcpy(&tx_sc
, &macsec
->secy
.tx_sc
, sizeof(tx_sc
));
3835 ret
= macsec_changelink_common(dev
, data
);
3839 if (data
[IFLA_MACSEC_OFFLOAD
]) {
3840 offload
= nla_get_u8(data
[IFLA_MACSEC_OFFLOAD
]);
3841 if (macsec
->offload
!= offload
) {
3842 macsec_offload_state_change
= true;
3843 ret
= macsec_update_offload(dev
, offload
);
3849 /* If h/w offloading is available, propagate to the device */
3850 if (!macsec_offload_state_change
&& macsec_is_offloaded(macsec
)) {
3851 const struct macsec_ops
*ops
;
3852 struct macsec_context ctx
;
3854 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3860 ctx
.secy
= &macsec
->secy
;
3861 ret
= macsec_offload(ops
->mdo_upd_secy
, &ctx
);
3869 memcpy(&macsec
->secy
.tx_sc
, &tx_sc
, sizeof(tx_sc
));
3870 memcpy(&macsec
->secy
, &secy
, sizeof(secy
));
3875 static void macsec_del_dev(struct macsec_dev
*macsec
)
3879 while (macsec
->secy
.rx_sc
) {
3880 struct macsec_rx_sc
*rx_sc
= rtnl_dereference(macsec
->secy
.rx_sc
);
3882 rcu_assign_pointer(macsec
->secy
.rx_sc
, rx_sc
->next
);
3886 for (i
= 0; i
< MACSEC_NUM_AN
; i
++) {
3887 struct macsec_tx_sa
*sa
= rtnl_dereference(macsec
->secy
.tx_sc
.sa
[i
]);
3890 RCU_INIT_POINTER(macsec
->secy
.tx_sc
.sa
[i
], NULL
);
3896 static void macsec_common_dellink(struct net_device
*dev
, struct list_head
*head
)
3898 struct macsec_dev
*macsec
= macsec_priv(dev
);
3899 struct net_device
*real_dev
= macsec
->real_dev
;
3901 /* If h/w offloading is available, propagate to the device */
3902 if (macsec_is_offloaded(macsec
)) {
3903 const struct macsec_ops
*ops
;
3904 struct macsec_context ctx
;
3906 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3908 ctx
.secy
= &macsec
->secy
;
3909 macsec_offload(ops
->mdo_del_secy
, &ctx
);
3913 unregister_netdevice_queue(dev
, head
);
3914 list_del_rcu(&macsec
->secys
);
3915 macsec_del_dev(macsec
);
3916 netdev_upper_dev_unlink(real_dev
, dev
);
3918 macsec_generation
++;
3921 static void macsec_dellink(struct net_device
*dev
, struct list_head
*head
)
3923 struct macsec_dev
*macsec
= macsec_priv(dev
);
3924 struct net_device
*real_dev
= macsec
->real_dev
;
3925 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
3927 macsec_common_dellink(dev
, head
);
3929 if (list_empty(&rxd
->secys
)) {
3930 netdev_rx_handler_unregister(real_dev
);
3935 static int register_macsec_dev(struct net_device
*real_dev
,
3936 struct net_device
*dev
)
3938 struct macsec_dev
*macsec
= macsec_priv(dev
);
3939 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
3944 rxd
= kmalloc(sizeof(*rxd
), GFP_KERNEL
);
3948 INIT_LIST_HEAD(&rxd
->secys
);
3950 err
= netdev_rx_handler_register(real_dev
, macsec_handle_frame
,
3958 list_add_tail_rcu(&macsec
->secys
, &rxd
->secys
);
3962 static bool sci_exists(struct net_device
*dev
, sci_t sci
)
3964 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(dev
);
3965 struct macsec_dev
*macsec
;
3967 list_for_each_entry(macsec
, &rxd
->secys
, secys
) {
3968 if (macsec
->secy
.sci
== sci
)
3975 static sci_t
dev_to_sci(struct net_device
*dev
, __be16 port
)
3977 return make_sci(dev
->dev_addr
, port
);
3980 static int macsec_add_dev(struct net_device
*dev
, sci_t sci
, u8 icv_len
)
3982 struct macsec_dev
*macsec
= macsec_priv(dev
);
3983 struct macsec_secy
*secy
= &macsec
->secy
;
3985 macsec
->stats
= netdev_alloc_pcpu_stats(struct pcpu_secy_stats
);
3989 secy
->tx_sc
.stats
= netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats
);
3990 if (!secy
->tx_sc
.stats
)
3993 secy
->tx_sc
.md_dst
= metadata_dst_alloc(0, METADATA_MACSEC
, GFP_KERNEL
);
3994 if (!secy
->tx_sc
.md_dst
)
3995 /* macsec and secy percpu stats will be freed when unregistering
3996 * net_device in macsec_free_netdev()
4000 if (sci
== MACSEC_UNDEF_SCI
)
4001 sci
= dev_to_sci(dev
, MACSEC_PORT_ES
);
4004 secy
->operational
= true;
4005 secy
->key_len
= DEFAULT_SAK_LEN
;
4006 secy
->icv_len
= icv_len
;
4007 secy
->validate_frames
= MACSEC_VALIDATE_DEFAULT
;
4008 secy
->protect_frames
= true;
4009 secy
->replay_protect
= false;
4010 secy
->xpn
= DEFAULT_XPN
;
4013 secy
->tx_sc
.md_dst
->u
.macsec_info
.sci
= sci
;
4014 secy
->tx_sc
.active
= true;
4015 secy
->tx_sc
.encoding_sa
= DEFAULT_ENCODING_SA
;
4016 secy
->tx_sc
.encrypt
= DEFAULT_ENCRYPT
;
4017 secy
->tx_sc
.send_sci
= DEFAULT_SEND_SCI
;
4018 secy
->tx_sc
.end_station
= false;
4019 secy
->tx_sc
.scb
= false;
4024 static struct lock_class_key macsec_netdev_addr_lock_key
;
4026 static int macsec_newlink(struct net
*net
, struct net_device
*dev
,
4027 struct nlattr
*tb
[], struct nlattr
*data
[],
4028 struct netlink_ext_ack
*extack
)
4030 struct macsec_dev
*macsec
= macsec_priv(dev
);
4031 rx_handler_func_t
*rx_handler
;
4032 u8 icv_len
= MACSEC_DEFAULT_ICV_LEN
;
4033 struct net_device
*real_dev
;
4039 real_dev
= __dev_get_by_index(net
, nla_get_u32(tb
[IFLA_LINK
]));
4042 if (real_dev
->type
!= ARPHRD_ETHER
)
4045 dev
->priv_flags
|= IFF_MACSEC
;
4047 macsec
->real_dev
= real_dev
;
4049 if (data
&& data
[IFLA_MACSEC_OFFLOAD
])
4050 macsec
->offload
= nla_get_offload(data
[IFLA_MACSEC_OFFLOAD
]);
4052 /* MACsec offloading is off by default */
4053 macsec
->offload
= MACSEC_OFFLOAD_OFF
;
4055 /* Check if the offloading mode is supported by the underlying layers */
4056 if (macsec
->offload
!= MACSEC_OFFLOAD_OFF
&&
4057 !macsec_check_offload(macsec
->offload
, macsec
))
4060 /* send_sci must be set to true when transmit sci explicitly is set */
4061 if ((data
&& data
[IFLA_MACSEC_SCI
]) &&
4062 (data
&& data
[IFLA_MACSEC_INC_SCI
])) {
4063 u8 send_sci
= !!nla_get_u8(data
[IFLA_MACSEC_INC_SCI
]);
4069 if (data
&& data
[IFLA_MACSEC_ICV_LEN
])
4070 icv_len
= nla_get_u8(data
[IFLA_MACSEC_ICV_LEN
]);
4071 mtu
= real_dev
->mtu
- icv_len
- macsec_extra_len(true);
4077 rx_handler
= rtnl_dereference(real_dev
->rx_handler
);
4078 if (rx_handler
&& rx_handler
!= macsec_handle_frame
)
4081 err
= register_netdevice(dev
);
4085 netdev_lockdep_set_classes(dev
);
4086 lockdep_set_class(&dev
->addr_list_lock
,
4087 &macsec_netdev_addr_lock_key
);
4089 err
= netdev_upper_dev_link(real_dev
, dev
, extack
);
4093 /* need to be already registered so that ->init has run and
4094 * the MAC addr is set
4096 if (data
&& data
[IFLA_MACSEC_SCI
])
4097 sci
= nla_get_sci(data
[IFLA_MACSEC_SCI
]);
4098 else if (data
&& data
[IFLA_MACSEC_PORT
])
4099 sci
= dev_to_sci(dev
, nla_get_be16(data
[IFLA_MACSEC_PORT
]));
4101 sci
= dev_to_sci(dev
, MACSEC_PORT_ES
);
4103 if (rx_handler
&& sci_exists(real_dev
, sci
)) {
4108 err
= macsec_add_dev(dev
, sci
, icv_len
);
4113 err
= macsec_changelink_common(dev
, data
);
4118 /* If h/w offloading is available, propagate to the device */
4119 if (macsec_is_offloaded(macsec
)) {
4120 const struct macsec_ops
*ops
;
4121 struct macsec_context ctx
;
4123 ops
= macsec_get_ops(macsec
, &ctx
);
4125 ctx
.secy
= &macsec
->secy
;
4126 err
= macsec_offload(ops
->mdo_add_secy
, &ctx
);
4132 err
= register_macsec_dev(real_dev
, dev
);
4136 netif_stacked_transfer_operstate(real_dev
, dev
);
4137 linkwatch_fire_event(dev
);
4139 macsec_generation
++;
4144 macsec_del_dev(macsec
);
4146 netdev_upper_dev_unlink(real_dev
, dev
);
4148 unregister_netdevice(dev
);
4152 static int macsec_validate_attr(struct nlattr
*tb
[], struct nlattr
*data
[],
4153 struct netlink_ext_ack
*extack
)
4155 u64 csid
= MACSEC_DEFAULT_CIPHER_ID
;
4156 u8 icv_len
= MACSEC_DEFAULT_ICV_LEN
;
4163 if (data
[IFLA_MACSEC_CIPHER_SUITE
])
4164 csid
= nla_get_u64(data
[IFLA_MACSEC_CIPHER_SUITE
]);
4166 if (data
[IFLA_MACSEC_ICV_LEN
]) {
4167 icv_len
= nla_get_u8(data
[IFLA_MACSEC_ICV_LEN
]);
4168 if (icv_len
!= MACSEC_DEFAULT_ICV_LEN
) {
4169 char dummy_key
[DEFAULT_SAK_LEN
] = { 0 };
4170 struct crypto_aead
*dummy_tfm
;
4172 dummy_tfm
= macsec_alloc_tfm(dummy_key
,
4175 if (IS_ERR(dummy_tfm
))
4176 return PTR_ERR(dummy_tfm
);
4177 crypto_free_aead(dummy_tfm
);
4182 case MACSEC_CIPHER_ID_GCM_AES_128
:
4183 case MACSEC_CIPHER_ID_GCM_AES_256
:
4184 case MACSEC_CIPHER_ID_GCM_AES_XPN_128
:
4185 case MACSEC_CIPHER_ID_GCM_AES_XPN_256
:
4186 case MACSEC_DEFAULT_CIPHER_ID
:
4187 if (icv_len
< MACSEC_MIN_ICV_LEN
||
4188 icv_len
> MACSEC_STD_ICV_LEN
)
4195 if (data
[IFLA_MACSEC_ENCODING_SA
]) {
4196 if (nla_get_u8(data
[IFLA_MACSEC_ENCODING_SA
]) >= MACSEC_NUM_AN
)
4200 for (flag
= IFLA_MACSEC_ENCODING_SA
+ 1;
4201 flag
< IFLA_MACSEC_VALIDATION
;
4204 if (nla_get_u8(data
[flag
]) > 1)
4209 es
= data
[IFLA_MACSEC_ES
] ? nla_get_u8(data
[IFLA_MACSEC_ES
]) : false;
4210 sci
= data
[IFLA_MACSEC_INC_SCI
] ? nla_get_u8(data
[IFLA_MACSEC_INC_SCI
]) : false;
4211 scb
= data
[IFLA_MACSEC_SCB
] ? nla_get_u8(data
[IFLA_MACSEC_SCB
]) : false;
4213 if ((sci
&& (scb
|| es
)) || (scb
&& es
))
4216 if (data
[IFLA_MACSEC_VALIDATION
] &&
4217 nla_get_u8(data
[IFLA_MACSEC_VALIDATION
]) > MACSEC_VALIDATE_MAX
)
4220 if ((data
[IFLA_MACSEC_REPLAY_PROTECT
] &&
4221 nla_get_u8(data
[IFLA_MACSEC_REPLAY_PROTECT
])) &&
4222 !data
[IFLA_MACSEC_WINDOW
])
4228 static struct net
*macsec_get_link_net(const struct net_device
*dev
)
4230 return dev_net(macsec_priv(dev
)->real_dev
);
4233 struct net_device
*macsec_get_real_dev(const struct net_device
*dev
)
4235 return macsec_priv(dev
)->real_dev
;
4237 EXPORT_SYMBOL_GPL(macsec_get_real_dev
);
4239 bool macsec_netdev_is_offloaded(struct net_device
*dev
)
4241 return macsec_is_offloaded(macsec_priv(dev
));
4243 EXPORT_SYMBOL_GPL(macsec_netdev_is_offloaded
);
4245 static size_t macsec_get_size(const struct net_device
*dev
)
4247 return nla_total_size_64bit(8) + /* IFLA_MACSEC_SCI */
4248 nla_total_size(1) + /* IFLA_MACSEC_ICV_LEN */
4249 nla_total_size_64bit(8) + /* IFLA_MACSEC_CIPHER_SUITE */
4250 nla_total_size(4) + /* IFLA_MACSEC_WINDOW */
4251 nla_total_size(1) + /* IFLA_MACSEC_ENCODING_SA */
4252 nla_total_size(1) + /* IFLA_MACSEC_ENCRYPT */
4253 nla_total_size(1) + /* IFLA_MACSEC_PROTECT */
4254 nla_total_size(1) + /* IFLA_MACSEC_INC_SCI */
4255 nla_total_size(1) + /* IFLA_MACSEC_ES */
4256 nla_total_size(1) + /* IFLA_MACSEC_SCB */
4257 nla_total_size(1) + /* IFLA_MACSEC_REPLAY_PROTECT */
4258 nla_total_size(1) + /* IFLA_MACSEC_VALIDATION */
4259 nla_total_size(1) + /* IFLA_MACSEC_OFFLOAD */
4263 static int macsec_fill_info(struct sk_buff
*skb
,
4264 const struct net_device
*dev
)
4266 struct macsec_tx_sc
*tx_sc
;
4267 struct macsec_dev
*macsec
;
4268 struct macsec_secy
*secy
;
4271 macsec
= macsec_priv(dev
);
4272 secy
= &macsec
->secy
;
4273 tx_sc
= &secy
->tx_sc
;
4275 switch (secy
->key_len
) {
4276 case MACSEC_GCM_AES_128_SAK_LEN
:
4277 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_128
: MACSEC_DEFAULT_CIPHER_ID
;
4279 case MACSEC_GCM_AES_256_SAK_LEN
:
4280 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_256
: MACSEC_CIPHER_ID_GCM_AES_256
;
4283 goto nla_put_failure
;
4286 if (nla_put_sci(skb
, IFLA_MACSEC_SCI
, secy
->sci
,
4288 nla_put_u8(skb
, IFLA_MACSEC_ICV_LEN
, secy
->icv_len
) ||
4289 nla_put_u64_64bit(skb
, IFLA_MACSEC_CIPHER_SUITE
,
4290 csid
, IFLA_MACSEC_PAD
) ||
4291 nla_put_u8(skb
, IFLA_MACSEC_ENCODING_SA
, tx_sc
->encoding_sa
) ||
4292 nla_put_u8(skb
, IFLA_MACSEC_ENCRYPT
, tx_sc
->encrypt
) ||
4293 nla_put_u8(skb
, IFLA_MACSEC_PROTECT
, secy
->protect_frames
) ||
4294 nla_put_u8(skb
, IFLA_MACSEC_INC_SCI
, tx_sc
->send_sci
) ||
4295 nla_put_u8(skb
, IFLA_MACSEC_ES
, tx_sc
->end_station
) ||
4296 nla_put_u8(skb
, IFLA_MACSEC_SCB
, tx_sc
->scb
) ||
4297 nla_put_u8(skb
, IFLA_MACSEC_REPLAY_PROTECT
, secy
->replay_protect
) ||
4298 nla_put_u8(skb
, IFLA_MACSEC_VALIDATION
, secy
->validate_frames
) ||
4299 nla_put_u8(skb
, IFLA_MACSEC_OFFLOAD
, macsec
->offload
) ||
4301 goto nla_put_failure
;
4303 if (secy
->replay_protect
) {
4304 if (nla_put_u32(skb
, IFLA_MACSEC_WINDOW
, secy
->replay_window
))
4305 goto nla_put_failure
;
4314 static struct rtnl_link_ops macsec_link_ops __read_mostly
= {
4316 .priv_size
= sizeof(struct macsec_dev
),
4317 .maxtype
= IFLA_MACSEC_MAX
,
4318 .policy
= macsec_rtnl_policy
,
4319 .setup
= macsec_setup
,
4320 .validate
= macsec_validate_attr
,
4321 .newlink
= macsec_newlink
,
4322 .changelink
= macsec_changelink
,
4323 .dellink
= macsec_dellink
,
4324 .get_size
= macsec_get_size
,
4325 .fill_info
= macsec_fill_info
,
4326 .get_link_net
= macsec_get_link_net
,
4329 static bool is_macsec_master(struct net_device
*dev
)
4331 return rcu_access_pointer(dev
->rx_handler
) == macsec_handle_frame
;
4334 static int macsec_notify(struct notifier_block
*this, unsigned long event
,
4337 struct net_device
*real_dev
= netdev_notifier_info_to_dev(ptr
);
4340 if (!is_macsec_master(real_dev
))
4346 case NETDEV_CHANGE
: {
4347 struct macsec_dev
*m
, *n
;
4348 struct macsec_rxh_data
*rxd
;
4350 rxd
= macsec_data_rtnl(real_dev
);
4351 list_for_each_entry_safe(m
, n
, &rxd
->secys
, secys
) {
4352 struct net_device
*dev
= m
->secy
.netdev
;
4354 netif_stacked_transfer_operstate(real_dev
, dev
);
4358 case NETDEV_UNREGISTER
: {
4359 struct macsec_dev
*m
, *n
;
4360 struct macsec_rxh_data
*rxd
;
4362 rxd
= macsec_data_rtnl(real_dev
);
4363 list_for_each_entry_safe(m
, n
, &rxd
->secys
, secys
) {
4364 macsec_common_dellink(m
->secy
.netdev
, &head
);
4367 netdev_rx_handler_unregister(real_dev
);
4370 unregister_netdevice_many(&head
);
4373 case NETDEV_CHANGEMTU
: {
4374 struct macsec_dev
*m
;
4375 struct macsec_rxh_data
*rxd
;
4377 rxd
= macsec_data_rtnl(real_dev
);
4378 list_for_each_entry(m
, &rxd
->secys
, secys
) {
4379 struct net_device
*dev
= m
->secy
.netdev
;
4380 unsigned int mtu
= real_dev
->mtu
- (m
->secy
.icv_len
+
4381 macsec_extra_len(true));
4384 dev_set_mtu(dev
, mtu
);
4392 static struct notifier_block macsec_notifier
= {
4393 .notifier_call
= macsec_notify
,
4396 static int __init
macsec_init(void)
4400 pr_info("MACsec IEEE 802.1AE\n");
4401 err
= register_netdevice_notifier(&macsec_notifier
);
4405 err
= rtnl_link_register(&macsec_link_ops
);
4409 err
= genl_register_family(&macsec_fam
);
4416 rtnl_link_unregister(&macsec_link_ops
);
4418 unregister_netdevice_notifier(&macsec_notifier
);
4422 static void __exit
macsec_exit(void)
4424 genl_unregister_family(&macsec_fam
);
4425 rtnl_link_unregister(&macsec_link_ops
);
4426 unregister_netdevice_notifier(&macsec_notifier
);
4430 module_init(macsec_init
);
4431 module_exit(macsec_exit
);
4433 MODULE_ALIAS_RTNL_LINK("macsec");
4434 MODULE_ALIAS_GENL_FAMILY("macsec");
4436 MODULE_DESCRIPTION("MACsec IEEE 802.1AE");
4437 MODULE_LICENSE("GPL v2");