2022-02-01 10:28:51

by Raed Salem

Subject: [PATCH net] net: macsec: Verify that send_sci is on when setting Tx sci explicitly

From: Lior Nahmanson <[email protected]>

When setting Tx sci explicit, the Rx side is expected to use this
sci and not recalculate it from the packet.However, in case of Tx sci
is explicit and send_sci is off, the receiver is wrongly recalculate
the sci from the source MAC address which most likely be different
than the explicit sci.

Fix by preventing such configuration when macsec newlink is established
and return EINVAL error code on such cases.

Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Lior Nahmanson <[email protected]>
Reviewed-by: Raed Salem <[email protected]>
Signed-off-by: Raed Salem <[email protected]>
---
drivers/net/macsec.c | 9 +++++++++
1 file changed, 9 insertions(+)

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 33ff33c..3d08743 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -4018,6 +4018,15 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
!macsec_check_offload(macsec->offload, macsec))
return -EOPNOTSUPP;

+ /* send_sci must be set to true when transmit sci explicitly is set */
+ if ((data && data[IFLA_MACSEC_SCI]) &&
+ (data && data[IFLA_MACSEC_INC_SCI])) {
+ u8 send_sci = !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]);
+
+ if (!send_sci)
+ return -EINVAL;
+ }
+
if (data && data[IFLA_MACSEC_ICV_LEN])
icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]);
mtu = real_dev->mtu - icv_len - macsec_extra_len(true);
--
1.8.3.1

2022-02-02 15:05:39

by patchwork-bot+netdevbpf

Subject: Re: [PATCH net] net: macsec: Verify that send_sci is on when setting Tx sci explicitly

Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <[email protected]>:

On Sun, 30 Jan 2022 13:37:52 +0200 you wrote:
> From: Lior Nahmanson <[email protected]>
>
> When setting Tx sci explicit, the Rx side is expected to use this
> sci and not recalculate it from the packet.However, in case of Tx sci
> is explicit and send_sci is off, the receiver is wrongly recalculate
> the sci from the source MAC address which most likely be different
> than the explicit sci.
>
> [...]

Here is the summary with links:
- [net] net: macsec: Verify that send_sci is on when setting Tx sci explicitly
https://git.kernel.org/netdev/net/c/d0cfa548dbde

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html