[PATCH iproute2 v3 1/1] macsec: Fix Macsec replay protection

[PATCH iproute2 v3 1/1] macsec: Fix Macsec replay protection

[ehakim]

From: Emeel Hakim <ehakim@nvidia.com>

Currently when configuring macsec with replay protection,
replay protection and window gets a default value of -1,
the above is leading to passing replay protection and
replay window attributes to the kernel while replay is
explicitly set to off, leading for an invalid argument
error when configured with extended packet number (XPN).
since the default window value which is 0xFFFFFFFF is
passed to the kernel and while XPN is configured the above
value is an invalid window value.

Example:
ip link add link eth2 macsec0 type macsec sci 1 cipher
gcm-aes-xpn-128 replay off

RTNETLINK answers: Invalid argument

Fix by passing the window attribute to the kernel only if replay is on

Fixes: b26fc590ce62 ("ip: add MACsec support")
Signed-off-by: Emeel Hakim <ehakim@nvidia.com>
---
V2 -> V3: - Add iproute2 to the subject to clarify where this patch is targeted.
V1 -> V2: - Dont use boolean variable for replay protect since it will
            silently break disabling replay protection on an existing device.
          - Update commit message.
 ip/ipmacsec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ip/ipmacsec.c b/ip/ipmacsec.c
index 6dd73827..d96d69f1 100644
--- a/ip/ipmacsec.c
+++ b/ip/ipmacsec.c
@@ -1517,7 +1517,8 @@ static int macsec_parse_opt(struct link_util *lu, int argc, char **argv,
 			  &cipher.icv_len, sizeof(cipher.icv_len));
 
 	if (replay_protect != -1) {
-		addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window);
+		if (replay_protect)
+			addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window);
 		addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_REPLAY_PROTECT,
 			 replay_protect);
 	}
-- 
2.21.3

Re: [PATCH iproute2 v3 1/1] macsec: Fix Macsec replay protection

[Sabrina Dubroca]

2023-01-11, 09:32:59 +0200, ehakim@nvidia.com wrote:
> From: Emeel Hakim <ehakim@nvidia.com>
> 
> Currently when configuring macsec with replay protection,
> replay protection and window gets a default value of -1,
> the above is leading to passing replay protection and
> replay window attributes to the kernel while replay is
> explicitly set to off, leading for an invalid argument
> error when configured with extended packet number (XPN).
> since the default window value which is 0xFFFFFFFF is
> passed to the kernel and while XPN is configured the above
> value is an invalid window value.
> 
> Example:
> ip link add link eth2 macsec0 type macsec sci 1 cipher
> gcm-aes-xpn-128 replay off
> 
> RTNETLINK answers: Invalid argument
> 
> Fix by passing the window attribute to the kernel only if replay is on
> 
> Fixes: b26fc590ce62 ("ip: add MACsec support")
> Signed-off-by: Emeel Hakim <ehakim@nvidia.com>

Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>

Thanks Emeel.

-- 
Sabrina

Re: [PATCH iproute2 v3 1/1] macsec: Fix Macsec replay protection

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to iproute2/iproute2.git (main)
by Stephen Hemminger <stephen@networkplumber.org>:

On Wed, 11 Jan 2023 09:32:59 +0200 you wrote:
> From: Emeel Hakim <ehakim@nvidia.com>
> 
> Currently when configuring macsec with replay protection,
> replay protection and window gets a default value of -1,
> the above is leading to passing replay protection and
> replay window attributes to the kernel while replay is
> explicitly set to off, leading for an invalid argument
> error when configured with extended packet number (XPN).
> since the default window value which is 0xFFFFFFFF is
> passed to the kernel and while XPN is configured the above
> value is an invalid window value.
> 
> [...]

Here is the summary with links:
  - [iproute2,v3,1/1] macsec: Fix Macsec replay protection
    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=16ed170abf4b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html