Re: [PATCH main v2 1/1] macsec: Fix Macsec replay protection

[Jiri Pirko <jiri@resnulli.us>]

But iproute2 into the subject []'s so it is clear where this patch is targeted.

Tue, Jan 10, 2023 at 03:49:01PM CET, ehakim@nvidia.com wrote:
>From: Emeel Hakim <ehakim@nvidia.com>
>
>Currently when configuring macsec with replay protection,
>replay protection and window gets a default value of -1,
>the above is leading to passing replay protection and
>replay window attributes to the kernel while replay is
>explicitly set to off, leading for an invalid argument
>error when configured with extended packet number (XPN).
>since the default window value which is 0xFFFFFFFF is
>passed to the kernel and while XPN is configured the above
>value is an invalid window value.
>
>Example:
>ip link add link eth2 macsec0 type macsec sci 1 cipher
>gcm-aes-xpn-128 replay off
>
>RTNETLINK answers: Invalid argument
>
>Fix by passing the window attribute to the kernel only if replay is on
>
>Fixes: b26fc590ce62 ("ip: add MACsec support")
>Signed-off-by: Emeel Hakim <ehakim@nvidia.com>
>---
>V1 -> V2: - Dont use boolean variable for replay protect since it will
>            silently break disabling replay protection on an existing device.
>          - Update commit message.
> ip/ipmacsec.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/ip/ipmacsec.c b/ip/ipmacsec.c
>index 6dd73827..d96d69f1 100644
>--- a/ip/ipmacsec.c
>+++ b/ip/ipmacsec.c
>@@ -1517,7 +1517,8 @@ static int macsec_parse_opt(struct link_util *lu, int argc, char **argv,
> 			  &cipher.icv_len, sizeof(cipher.icv_len));
> 
> 	if (replay_protect != -1) {
>-		addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window);
>+		if (replay_protect)
>+			addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window);
> 		addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_REPLAY_PROTECT,
> 			 replay_protect);
> 	}
>-- 
>2.21.3
>