macsec: Fix Macsec replay protection

Currently when configuring macsec with replay protection,
replay protection and window gets a default value of -1,
the above is leading to passing replay protection and
replay window attributes to the kernel while replay is
explicitly set to off, leading for an invalid argument
error when configured with extended packet number (XPN).
since the default window value which is 0xFFFFFFFF is
passed to the kernel and while XPN is configured the above
value is an invalid window value.

Example:
ip link add link eth2 macsec0 type macsec sci 1 cipher
gcm-aes-xpn-128 replay off

RTNETLINK answers: Invalid argument

Fix by passing the window attribute to the kernel only if replay is on

Fixes: b26fc590ce62 ("ip: add MACsec support")
Signed-off-by: Emeel Hakim <ehakim@nvidia.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>

diff --git a/ip/ipmacsec.c b/ip/ipmacsec.c
index f3b2e03bdaebcd3e22f920773777ef80b0c098d0..8da7c3d3d1d6b3973853dd840dae19e11ddbad52 100644 (file)
--- a/ip/ipmacsec.c
+++ b/ip/ipmacsec.c
@@ -1513,7 +1513,8 @@ static int macsec_parse_opt(struct link_util *lu, int argc, char **argv,
                          &cipher.icv_len, sizeof(cipher.icv_len));
 
        if (replay_protect != -1) {
-               addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window);
+               if (replay_protect)
+                       addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window);
                addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_REPLAY_PROTECT,
                         replay_protect);
        }