developer | 7e32f7e | 2022-05-18 21:10:08 +0800 | [diff] [blame] | 1 | From d0cfa548dbde354de986911d3913897b5448faad Mon Sep 17 00:00:00 2001 |
| 2 | From: Lior Nahmanson <liorna@nvidia.com> |
| 3 | Date: Sun, 30 Jan 2022 13:37:52 +0200 |
| 4 | Subject: net: macsec: Verify that send_sci is on when setting Tx sci |
| 5 | explicitly |
| 6 | |
| 7 | When setting Tx sci explicit, the Rx side is expected to use this |
| 8 | sci and not recalculate it from the packet.However, in case of Tx sci |
| 9 | is explicit and send_sci is off, the receiver is wrongly recalculate |
| 10 | the sci from the source MAC address which most likely be different |
| 11 | than the explicit sci. |
| 12 | |
| 13 | Fix by preventing such configuration when macsec newlink is established |
| 14 | and return EINVAL error code on such cases. |
| 15 | |
| 16 | Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") |
| 17 | Signed-off-by: Lior Nahmanson <liorna@nvidia.com> |
| 18 | Reviewed-by: Raed Salem <raeds@nvidia.com> |
| 19 | Signed-off-by: Raed Salem <raeds@nvidia.com> |
| 20 | Link: https://lore.kernel.org/r/1643542672-29403-1-git-send-email-raeds@nvidia.com |
| 21 | Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| 22 | --- |
| 23 | drivers/net/macsec.c | 9 +++++++++ |
| 24 | 1 file changed, 9 insertions(+) |
| 25 | |
| 26 | --- a/drivers/net/macsec.c |
| 27 | +++ b/drivers/net/macsec.c |
| 28 | @@ -4047,6 +4047,15 @@ static int macsec_newlink(struct net *ne |
| 29 | !macsec_check_offload(macsec->offload, macsec)) |
| 30 | return -EOPNOTSUPP; |
| 31 | |
| 32 | + /* send_sci must be set to true when transmit sci explicitly is set */ |
| 33 | + if ((data && data[IFLA_MACSEC_SCI]) && |
| 34 | + (data && data[IFLA_MACSEC_INC_SCI])) { |
| 35 | + u8 send_sci = !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]); |
| 36 | + |
| 37 | + if (!send_sci) |
| 38 | + return -EINVAL; |
| 39 | + } |
| 40 | + |
| 41 | if (data && data[IFLA_MACSEC_ICV_LEN]) |
| 42 | icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]); |
| 43 | mtu = real_dev->mtu - icv_len - macsec_extra_len(true); |