From: Emeel Hakim Date: Wed, 11 Jan 2023 07:32:59 +0000 (+0200) Subject: macsec: Fix Macsec replay protection X-Git-Tag: v6.2.0~11 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=16ed170abf4b38f6ddc590a01f3314a7aa3923b8;p=thirdparty%2Fiproute2.git macsec: Fix Macsec replay protection Currently when configuring macsec with replay protection, replay protection and window gets a default value of -1, the above is leading to passing replay protection and replay window attributes to the kernel while replay is explicitly set to off, leading for an invalid argument error when configured with extended packet number (XPN). since the default window value which is 0xFFFFFFFF is passed to the kernel and while XPN is configured the above value is an invalid window value. Example: ip link add link eth2 macsec0 type macsec sci 1 cipher gcm-aes-xpn-128 replay off RTNETLINK answers: Invalid argument Fix by passing the window attribute to the kernel only if replay is on Fixes: b26fc590ce62 ("ip: add MACsec support") Signed-off-by: Emeel Hakim Reviewed-by: Sabrina Dubroca Signed-off-by: Stephen Hemminger --- diff --git a/ip/ipmacsec.c b/ip/ipmacsec.c index f3b2e03bd..8da7c3d3d 100644 --- a/ip/ipmacsec.c +++ b/ip/ipmacsec.c @@ -1513,7 +1513,8 @@ static int macsec_parse_opt(struct link_util *lu, int argc, char **argv, &cipher.icv_len, sizeof(cipher.icv_len)); if (replay_protect != -1) { - addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window); + if (replay_protect) + addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window); addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_REPLAY_PROTECT, replay_protect); }