1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * drivers/net/macsec.c - MACsec device 4 * 5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net> 6 */ 7 8 #include <linux/types.h> 9 #include <linux/skbuff.h> 10 #include <linux/socket.h> 11 #include <linux/module.h> 12 #include <crypto/aead.h> 13 #include <linux/etherdevice.h> 14 #include <linux/netdevice.h> 15 #include <linux/rtnetlink.h> 16 #include <linux/refcount.h> 17 #include <net/genetlink.h> 18 #include <net/sock.h> 19 #include <net/gro_cells.h> 20 #include <net/macsec.h> 21 #include <linux/phy.h> 22 #include <linux/byteorder/generic.h> 23 #include <linux/if_arp.h> 24 25 #include <uapi/linux/if_macsec.h> 26 27 #define MACSEC_SCI_LEN 8 28 29 /* SecTAG length = macsec_eth_header without the optional SCI */ 30 #define MACSEC_TAG_LEN 6 31 32 struct macsec_eth_header { 33 struct ethhdr eth; 34 /* SecTAG */ 35 u8 tci_an; 36 #if defined(__LITTLE_ENDIAN_BITFIELD) 37 u8 short_length:6, 38 unused:2; 39 #elif defined(__BIG_ENDIAN_BITFIELD) 40 u8 unused:2, 41 short_length:6; 42 #else 43 #error "Please fix <asm/byteorder.h>" 44 #endif 45 __be32 packet_number; 46 u8 secure_channel_id[8]; /* optional */ 47 } __packed; 48 49 #define MACSEC_TCI_VERSION 0x80 50 #define MACSEC_TCI_ES 0x40 /* end station */ 51 #define MACSEC_TCI_SC 0x20 /* SCI present */ 52 #define MACSEC_TCI_SCB 0x10 /* epon */ 53 #define MACSEC_TCI_E 0x08 /* encryption */ 54 #define MACSEC_TCI_C 0x04 /* changed text */ 55 #define MACSEC_AN_MASK 0x03 /* association number */ 56 #define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C) 57 58 /* minimum secure data length deemed "not short", see IEEE 802.1AE-2006 9.7 */ 59 #define MIN_NON_SHORT_LEN 48 60 61 #define GCM_AES_IV_LEN 12 62 #define DEFAULT_ICV_LEN 16 63 64 #define for_each_rxsc(secy, sc) \ 65 for (sc = rcu_dereference_bh(secy->rx_sc); \ 66 sc; \ 67 sc = rcu_dereference_bh(sc->next)) 68 #define for_each_rxsc_rtnl(secy, sc) \ 69 for (sc = rtnl_dereference(secy->rx_sc); \ 70 sc; \ 71 sc = rtnl_dereference(sc->next)) 72 73 #define pn_same_half(pn1, pn2) (!(((pn1) >> 31) ^ ((pn2) >> 31))) 74 75 struct gcm_iv_xpn { 76 union { 77 u8 short_secure_channel_id[4]; 78 ssci_t ssci; 79 }; 80 __be64 pn; 81 } __packed; 82 83 struct gcm_iv { 84 union { 85 u8 secure_channel_id[8]; 86 sci_t sci; 87 }; 88 __be32 pn; 89 }; 90 91 #define MACSEC_VALIDATE_DEFAULT MACSEC_VALIDATE_STRICT 92 93 struct pcpu_secy_stats { 94 struct macsec_dev_stats stats; 95 struct u64_stats_sync syncp; 96 }; 97 98 /** 99 * struct macsec_dev - private data 100 * @secy: SecY config 101 * @real_dev: pointer to underlying netdevice 102 * @stats: MACsec device stats 103 * @secys: linked list of SecY's on the underlying device 104 * @offload: status of offloading on the MACsec device 105 */ 106 struct macsec_dev { 107 struct macsec_secy secy; 108 struct net_device *real_dev; 109 struct pcpu_secy_stats __percpu *stats; 110 struct list_head secys; 111 struct gro_cells gro_cells; 112 enum macsec_offload offload; 113 }; 114 115 /** 116 * struct macsec_rxh_data - rx_handler private argument 117 * @secys: linked list of SecY's on this underlying device 118 */ 119 struct macsec_rxh_data { 120 struct list_head secys; 121 }; 122 123 static struct macsec_dev *macsec_priv(const struct net_device *dev) 124 { 125 return (struct macsec_dev *)netdev_priv(dev); 126 } 127 128 static struct macsec_rxh_data *macsec_data_rcu(const struct net_device *dev) 129 { 130 return rcu_dereference_bh(dev->rx_handler_data); 131 } 132 133 static struct macsec_rxh_data *macsec_data_rtnl(const struct net_device *dev) 134 { 135 return rtnl_dereference(dev->rx_handler_data); 136 } 137 138 struct macsec_cb { 139 struct aead_request *req; 140 union { 141 struct macsec_tx_sa *tx_sa; 142 struct macsec_rx_sa *rx_sa; 143 }; 144 u8 assoc_num; 145 bool valid; 146 bool has_sci; 147 }; 148 149 static struct macsec_rx_sa *macsec_rxsa_get(struct macsec_rx_sa __rcu *ptr) 150 { 151 struct macsec_rx_sa *sa = rcu_dereference_bh(ptr); 152 153 if (!sa || !sa->active) 154 return NULL; 155 156 if (!refcount_inc_not_zero(&sa->refcnt)) 157 return NULL; 158 159 return sa; 160 } 161 162 static void free_rx_sc_rcu(struct rcu_head *head) 163 { 164 struct macsec_rx_sc *rx_sc = container_of(head, struct macsec_rx_sc, rcu_head); 165 166 free_percpu(rx_sc->stats); 167 kfree(rx_sc); 168 } 169 170 static struct macsec_rx_sc *macsec_rxsc_get(struct macsec_rx_sc *sc) 171 { 172 return refcount_inc_not_zero(&sc->refcnt) ? sc : NULL; 173 } 174 175 static void macsec_rxsc_put(struct macsec_rx_sc *sc) 176 { 177 if (refcount_dec_and_test(&sc->refcnt)) 178 call_rcu(&sc->rcu_head, free_rx_sc_rcu); 179 } 180 181 static void free_rxsa(struct rcu_head *head) 182 { 183 struct macsec_rx_sa *sa = container_of(head, struct macsec_rx_sa, rcu); 184 185 crypto_free_aead(sa->key.tfm); 186 free_percpu(sa->stats); 187 kfree(sa); 188 } 189 190 static void macsec_rxsa_put(struct macsec_rx_sa *sa) 191 { 192 if (refcount_dec_and_test(&sa->refcnt)) 193 call_rcu(&sa->rcu, free_rxsa); 194 } 195 196 static struct macsec_tx_sa *macsec_txsa_get(struct macsec_tx_sa __rcu *ptr) 197 { 198 struct macsec_tx_sa *sa = rcu_dereference_bh(ptr); 199 200 if (!sa || !sa->active) 201 return NULL; 202 203 if (!refcount_inc_not_zero(&sa->refcnt)) 204 return NULL; 205 206 return sa; 207 } 208 209 static void free_txsa(struct rcu_head *head) 210 { 211 struct macsec_tx_sa *sa = container_of(head, struct macsec_tx_sa, rcu); 212 213 crypto_free_aead(sa->key.tfm); 214 free_percpu(sa->stats); 215 kfree(sa); 216 } 217 218 static void macsec_txsa_put(struct macsec_tx_sa *sa) 219 { 220 if (refcount_dec_and_test(&sa->refcnt)) 221 call_rcu(&sa->rcu, free_txsa); 222 } 223 224 static struct macsec_cb *macsec_skb_cb(struct sk_buff *skb) 225 { 226 BUILD_BUG_ON(sizeof(struct macsec_cb) > sizeof(skb->cb)); 227 return (struct macsec_cb *)skb->cb; 228 } 229 230 #define MACSEC_PORT_ES (htons(0x0001)) 231 #define MACSEC_PORT_SCB (0x0000) 232 #define MACSEC_UNDEF_SCI ((__force sci_t)0xffffffffffffffffULL) 233 #define MACSEC_UNDEF_SSCI ((__force ssci_t)0xffffffff) 234 235 #define MACSEC_GCM_AES_128_SAK_LEN 16 236 #define MACSEC_GCM_AES_256_SAK_LEN 32 237 238 #define DEFAULT_SAK_LEN MACSEC_GCM_AES_128_SAK_LEN 239 #define DEFAULT_XPN false 240 #define DEFAULT_SEND_SCI true 241 #define DEFAULT_ENCRYPT false 242 #define DEFAULT_ENCODING_SA 0 243 244 static bool send_sci(const struct macsec_secy *secy) 245 { 246 const struct macsec_tx_sc *tx_sc = &secy->tx_sc; 247 248 return tx_sc->send_sci || 249 (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb); 250 } 251 252 static sci_t make_sci(u8 *addr, __be16 port) 253 { 254 sci_t sci; 255 256 memcpy(&sci, addr, ETH_ALEN); 257 memcpy(((char *)&sci) + ETH_ALEN, &port, sizeof(port)); 258 259 return sci; 260 } 261 262 static sci_t macsec_frame_sci(struct macsec_eth_header *hdr, bool sci_present) 263 { 264 sci_t sci; 265 266 if (sci_present) 267 memcpy(&sci, hdr->secure_channel_id, 268 sizeof(hdr->secure_channel_id)); 269 else 270 sci = make_sci(hdr->eth.h_source, MACSEC_PORT_ES); 271 272 return sci; 273 } 274 275 static unsigned int macsec_sectag_len(bool sci_present) 276 { 277 return MACSEC_TAG_LEN + (sci_present ? MACSEC_SCI_LEN : 0); 278 } 279 280 static unsigned int macsec_hdr_len(bool sci_present) 281 { 282 return macsec_sectag_len(sci_present) + ETH_HLEN; 283 } 284 285 static unsigned int macsec_extra_len(bool sci_present) 286 { 287 return macsec_sectag_len(sci_present) + sizeof(__be16); 288 } 289 290 /* Fill SecTAG according to IEEE 802.1AE-2006 10.5.3 */ 291 static void macsec_fill_sectag(struct macsec_eth_header *h, 292 const struct macsec_secy *secy, u32 pn, 293 bool sci_present) 294 { 295 const struct macsec_tx_sc *tx_sc = &secy->tx_sc; 296 297 memset(&h->tci_an, 0, macsec_sectag_len(sci_present)); 298 h->eth.h_proto = htons(ETH_P_MACSEC); 299 300 if (sci_present) { 301 h->tci_an |= MACSEC_TCI_SC; 302 memcpy(&h->secure_channel_id, &secy->sci, 303 sizeof(h->secure_channel_id)); 304 } else { 305 if (tx_sc->end_station) 306 h->tci_an |= MACSEC_TCI_ES; 307 if (tx_sc->scb) 308 h->tci_an |= MACSEC_TCI_SCB; 309 } 310 311 h->packet_number = htonl(pn); 312 313 /* with GCM, C/E clear for !encrypt, both set for encrypt */ 314 if (tx_sc->encrypt) 315 h->tci_an |= MACSEC_TCI_CONFID; 316 else if (secy->icv_len != DEFAULT_ICV_LEN) 317 h->tci_an |= MACSEC_TCI_C; 318 319 h->tci_an |= tx_sc->encoding_sa; 320 } 321 322 static void macsec_set_shortlen(struct macsec_eth_header *h, size_t data_len) 323 { 324 if (data_len < MIN_NON_SHORT_LEN) 325 h->short_length = data_len; 326 } 327 328 /* Checks if a MACsec interface is being offloaded to an hardware engine */ 329 static bool macsec_is_offloaded(struct macsec_dev *macsec) 330 { 331 if (macsec->offload == MACSEC_OFFLOAD_MAC || 332 macsec->offload == MACSEC_OFFLOAD_PHY) 333 return true; 334 335 return false; 336 } 337 338 /* Checks if underlying layers implement MACsec offloading functions. */ 339 static bool macsec_check_offload(enum macsec_offload offload, 340 struct macsec_dev *macsec) 341 { 342 if (!macsec || !macsec->real_dev) 343 return false; 344 345 if (offload == MACSEC_OFFLOAD_PHY) 346 return macsec->real_dev->phydev && 347 macsec->real_dev->phydev->macsec_ops; 348 else if (offload == MACSEC_OFFLOAD_MAC) 349 return macsec->real_dev->features & NETIF_F_HW_MACSEC && 350 macsec->real_dev->macsec_ops; 351 352 return false; 353 } 354 355 static const struct macsec_ops *__macsec_get_ops(enum macsec_offload offload, 356 struct macsec_dev *macsec, 357 struct macsec_context *ctx) 358 { 359 if (ctx) { 360 memset(ctx, 0, sizeof(*ctx)); 361 ctx->offload = offload; 362 363 if (offload == MACSEC_OFFLOAD_PHY) 364 ctx->phydev = macsec->real_dev->phydev; 365 else if (offload == MACSEC_OFFLOAD_MAC) 366 ctx->netdev = macsec->real_dev; 367 } 368 369 if (offload == MACSEC_OFFLOAD_PHY) 370 return macsec->real_dev->phydev->macsec_ops; 371 else 372 return macsec->real_dev->macsec_ops; 373 } 374 375 /* Returns a pointer to the MACsec ops struct if any and updates the MACsec 376 * context device reference if provided. 377 */ 378 static const struct macsec_ops *macsec_get_ops(struct macsec_dev *macsec, 379 struct macsec_context *ctx) 380 { 381 if (!macsec_check_offload(macsec->offload, macsec)) 382 return NULL; 383 384 return __macsec_get_ops(macsec->offload, macsec, ctx); 385 } 386 387 /* validate MACsec packet according to IEEE 802.1AE-2018 9.12 */ 388 static bool macsec_validate_skb(struct sk_buff *skb, u16 icv_len, bool xpn) 389 { 390 struct macsec_eth_header *h = (struct macsec_eth_header *)skb->data; 391 int len = skb->len - 2 * ETH_ALEN; 392 int extra_len = macsec_extra_len(!!(h->tci_an & MACSEC_TCI_SC)) + icv_len; 393 394 /* a) It comprises at least 17 octets */ 395 if (skb->len <= 16) 396 return false; 397 398 /* b) MACsec EtherType: already checked */ 399 400 /* c) V bit is clear */ 401 if (h->tci_an & MACSEC_TCI_VERSION) 402 return false; 403 404 /* d) ES or SCB => !SC */ 405 if ((h->tci_an & MACSEC_TCI_ES || h->tci_an & MACSEC_TCI_SCB) && 406 (h->tci_an & MACSEC_TCI_SC)) 407 return false; 408 409 /* e) Bits 7 and 8 of octet 4 of the SecTAG are clear */ 410 if (h->unused) 411 return false; 412 413 /* rx.pn != 0 if not XPN (figure 10-5 with 802.11AEbw-2013 amendment) */ 414 if (!h->packet_number && !xpn) 415 return false; 416 417 /* length check, f) g) h) i) */ 418 if (h->short_length) 419 return len == extra_len + h->short_length; 420 return len >= extra_len + MIN_NON_SHORT_LEN; 421 } 422 423 #define MACSEC_NEEDED_HEADROOM (macsec_extra_len(true)) 424 #define MACSEC_NEEDED_TAILROOM MACSEC_STD_ICV_LEN 425 426 static void macsec_fill_iv_xpn(unsigned char *iv, ssci_t ssci, u64 pn, 427 salt_t salt) 428 { 429 struct gcm_iv_xpn *gcm_iv = (struct gcm_iv_xpn *)iv; 430 431 gcm_iv->ssci = ssci ^ salt.ssci; 432 gcm_iv->pn = cpu_to_be64(pn) ^ salt.pn; 433 } 434 435 static void macsec_fill_iv(unsigned char *iv, sci_t sci, u32 pn) 436 { 437 struct gcm_iv *gcm_iv = (struct gcm_iv *)iv; 438 439 gcm_iv->sci = sci; 440 gcm_iv->pn = htonl(pn); 441 } 442 443 static struct macsec_eth_header *macsec_ethhdr(struct sk_buff *skb) 444 { 445 return (struct macsec_eth_header *)skb_mac_header(skb); 446 } 447 448 static sci_t dev_to_sci(struct net_device *dev, __be16 port) 449 { 450 return make_sci(dev->dev_addr, port); 451 } 452 453 static void __macsec_pn_wrapped(struct macsec_secy *secy, 454 struct macsec_tx_sa *tx_sa) 455 { 456 pr_debug("PN wrapped, transitioning to !oper\n"); 457 tx_sa->active = false; 458 if (secy->protect_frames) 459 secy->operational = false; 460 } 461 462 void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa) 463 { 464 spin_lock_bh(&tx_sa->lock); 465 __macsec_pn_wrapped(secy, tx_sa); 466 spin_unlock_bh(&tx_sa->lock); 467 } 468 EXPORT_SYMBOL_GPL(macsec_pn_wrapped); 469 470 static pn_t tx_sa_update_pn(struct macsec_tx_sa *tx_sa, 471 struct macsec_secy *secy) 472 { 473 pn_t pn; 474 475 spin_lock_bh(&tx_sa->lock); 476 477 pn = tx_sa->next_pn_halves; 478 if (secy->xpn) 479 tx_sa->next_pn++; 480 else 481 tx_sa->next_pn_halves.lower++; 482 483 if (tx_sa->next_pn == 0) 484 __macsec_pn_wrapped(secy, tx_sa); 485 spin_unlock_bh(&tx_sa->lock); 486 487 return pn; 488 } 489 490 static void macsec_encrypt_finish(struct sk_buff *skb, struct net_device *dev) 491 { 492 struct macsec_dev *macsec = netdev_priv(dev); 493 494 skb->dev = macsec->real_dev; 495 skb_reset_mac_header(skb); 496 skb->protocol = eth_hdr(skb)->h_proto; 497 } 498 499 static void macsec_count_tx(struct sk_buff *skb, struct macsec_tx_sc *tx_sc, 500 struct macsec_tx_sa *tx_sa) 501 { 502 struct pcpu_tx_sc_stats *txsc_stats = this_cpu_ptr(tx_sc->stats); 503 504 u64_stats_update_begin(&txsc_stats->syncp); 505 if (tx_sc->encrypt) { 506 txsc_stats->stats.OutOctetsEncrypted += skb->len; 507 txsc_stats->stats.OutPktsEncrypted++; 508 this_cpu_inc(tx_sa->stats->OutPktsEncrypted); 509 } else { 510 txsc_stats->stats.OutOctetsProtected += skb->len; 511 txsc_stats->stats.OutPktsProtected++; 512 this_cpu_inc(tx_sa->stats->OutPktsProtected); 513 } 514 u64_stats_update_end(&txsc_stats->syncp); 515 } 516 517 static void count_tx(struct net_device *dev, int ret, int len) 518 { 519 if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) { 520 struct pcpu_sw_netstats *stats = this_cpu_ptr(dev->tstats); 521 522 u64_stats_update_begin(&stats->syncp); 523 stats->tx_packets++; 524 stats->tx_bytes += len; 525 u64_stats_update_end(&stats->syncp); 526 } 527 } 528 529 static void macsec_encrypt_done(struct crypto_async_request *base, int err) 530 { 531 struct sk_buff *skb = base->data; 532 struct net_device *dev = skb->dev; 533 struct macsec_dev *macsec = macsec_priv(dev); 534 struct macsec_tx_sa *sa = macsec_skb_cb(skb)->tx_sa; 535 int len, ret; 536 537 aead_request_free(macsec_skb_cb(skb)->req); 538 539 rcu_read_lock_bh(); 540 macsec_encrypt_finish(skb, dev); 541 macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa); 542 len = skb->len; 543 ret = dev_queue_xmit(skb); 544 count_tx(dev, ret, len); 545 rcu_read_unlock_bh(); 546 547 macsec_txsa_put(sa); 548 dev_put(dev); 549 } 550 551 static struct aead_request *macsec_alloc_req(struct crypto_aead *tfm, 552 unsigned char **iv, 553 struct scatterlist **sg, 554 int num_frags) 555 { 556 size_t size, iv_offset, sg_offset; 557 struct aead_request *req; 558 void *tmp; 559 560 size = sizeof(struct aead_request) + crypto_aead_reqsize(tfm); 561 iv_offset = size; 562 size += GCM_AES_IV_LEN; 563 564 size = ALIGN(size, __alignof__(struct scatterlist)); 565 sg_offset = size; 566 size += sizeof(struct scatterlist) * num_frags; 567 568 tmp = kmalloc(size, GFP_ATOMIC); 569 if (!tmp) 570 return NULL; 571 572 *iv = (unsigned char *)(tmp + iv_offset); 573 *sg = (struct scatterlist *)(tmp + sg_offset); 574 req = tmp; 575 576 aead_request_set_tfm(req, tfm); 577 578 return req; 579 } 580 581 static struct sk_buff *macsec_encrypt(struct sk_buff *skb, 582 struct net_device *dev) 583 { 584 int ret; 585 struct scatterlist *sg; 586 struct sk_buff *trailer; 587 unsigned char *iv; 588 struct ethhdr *eth; 589 struct macsec_eth_header *hh; 590 size_t unprotected_len; 591 struct aead_request *req; 592 struct macsec_secy *secy; 593 struct macsec_tx_sc *tx_sc; 594 struct macsec_tx_sa *tx_sa; 595 struct macsec_dev *macsec = macsec_priv(dev); 596 bool sci_present; 597 pn_t pn; 598 599 secy = &macsec->secy; 600 tx_sc = &secy->tx_sc; 601 602 /* 10.5.1 TX SA assignment */ 603 tx_sa = macsec_txsa_get(tx_sc->sa[tx_sc->encoding_sa]); 604 if (!tx_sa) { 605 secy->operational = false; 606 kfree_skb(skb); 607 return ERR_PTR(-EINVAL); 608 } 609 610 if (unlikely(skb_headroom(skb) < MACSEC_NEEDED_HEADROOM || 611 skb_tailroom(skb) < MACSEC_NEEDED_TAILROOM)) { 612 struct sk_buff *nskb = skb_copy_expand(skb, 613 MACSEC_NEEDED_HEADROOM, 614 MACSEC_NEEDED_TAILROOM, 615 GFP_ATOMIC); 616 if (likely(nskb)) { 617 consume_skb(skb); 618 skb = nskb; 619 } else { 620 macsec_txsa_put(tx_sa); 621 kfree_skb(skb); 622 return ERR_PTR(-ENOMEM); 623 } 624 } else { 625 skb = skb_unshare(skb, GFP_ATOMIC); 626 if (!skb) { 627 macsec_txsa_put(tx_sa); 628 return ERR_PTR(-ENOMEM); 629 } 630 } 631 632 unprotected_len = skb->len; 633 eth = eth_hdr(skb); 634 sci_present = send_sci(secy); 635 hh = skb_push(skb, macsec_extra_len(sci_present)); 636 memmove(hh, eth, 2 * ETH_ALEN); 637 638 pn = tx_sa_update_pn(tx_sa, secy); 639 if (pn.full64 == 0) { 640 macsec_txsa_put(tx_sa); 641 kfree_skb(skb); 642 return ERR_PTR(-ENOLINK); 643 } 644 macsec_fill_sectag(hh, secy, pn.lower, sci_present); 645 macsec_set_shortlen(hh, unprotected_len - 2 * ETH_ALEN); 646 647 skb_put(skb, secy->icv_len); 648 649 if (skb->len - ETH_HLEN > macsec_priv(dev)->real_dev->mtu) { 650 struct pcpu_secy_stats *secy_stats = this_cpu_ptr(macsec->stats); 651 652 u64_stats_update_begin(&secy_stats->syncp); 653 secy_stats->stats.OutPktsTooLong++; 654 u64_stats_update_end(&secy_stats->syncp); 655 656 macsec_txsa_put(tx_sa); 657 kfree_skb(skb); 658 return ERR_PTR(-EINVAL); 659 } 660 661 ret = skb_cow_data(skb, 0, &trailer); 662 if (unlikely(ret < 0)) { 663 macsec_txsa_put(tx_sa); 664 kfree_skb(skb); 665 return ERR_PTR(ret); 666 } 667 668 req = macsec_alloc_req(tx_sa->key.tfm, &iv, &sg, ret); 669 if (!req) { 670 macsec_txsa_put(tx_sa); 671 kfree_skb(skb); 672 return ERR_PTR(-ENOMEM); 673 } 674 675 if (secy->xpn) 676 macsec_fill_iv_xpn(iv, tx_sa->ssci, pn.full64, tx_sa->key.salt); 677 else 678 macsec_fill_iv(iv, secy->sci, pn.lower); 679 680 sg_init_table(sg, ret); 681 ret = skb_to_sgvec(skb, sg, 0, skb->len); 682 if (unlikely(ret < 0)) { 683 aead_request_free(req); 684 macsec_txsa_put(tx_sa); 685 kfree_skb(skb); 686 return ERR_PTR(ret); 687 } 688 689 if (tx_sc->encrypt) { 690 int len = skb->len - macsec_hdr_len(sci_present) - 691 secy->icv_len; 692 aead_request_set_crypt(req, sg, sg, len, iv); 693 aead_request_set_ad(req, macsec_hdr_len(sci_present)); 694 } else { 695 aead_request_set_crypt(req, sg, sg, 0, iv); 696 aead_request_set_ad(req, skb->len - secy->icv_len); 697 } 698 699 macsec_skb_cb(skb)->req = req; 700 macsec_skb_cb(skb)->tx_sa = tx_sa; 701 aead_request_set_callback(req, 0, macsec_encrypt_done, skb); 702 703 dev_hold(skb->dev); 704 ret = crypto_aead_encrypt(req); 705 if (ret == -EINPROGRESS) { 706 return ERR_PTR(ret); 707 } else if (ret != 0) { 708 dev_put(skb->dev); 709 kfree_skb(skb); 710 aead_request_free(req); 711 macsec_txsa_put(tx_sa); 712 return ERR_PTR(-EINVAL); 713 } 714 715 dev_put(skb->dev); 716 aead_request_free(req); 717 macsec_txsa_put(tx_sa); 718 719 return skb; 720 } 721 722 static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u32 pn) 723 { 724 struct macsec_rx_sa *rx_sa = macsec_skb_cb(skb)->rx_sa; 725 struct pcpu_rx_sc_stats *rxsc_stats = this_cpu_ptr(rx_sa->sc->stats); 726 struct macsec_eth_header *hdr = macsec_ethhdr(skb); 727 u32 lowest_pn = 0; 728 729 spin_lock(&rx_sa->lock); 730 if (rx_sa->next_pn_halves.lower >= secy->replay_window) 731 lowest_pn = rx_sa->next_pn_halves.lower - secy->replay_window; 732 733 /* Now perform replay protection check again 734 * (see IEEE 802.1AE-2006 figure 10-5) 735 */ 736 if (secy->replay_protect && pn < lowest_pn && 737 (!secy->xpn || pn_same_half(pn, lowest_pn))) { 738 spin_unlock(&rx_sa->lock); 739 u64_stats_update_begin(&rxsc_stats->syncp); 740 rxsc_stats->stats.InPktsLate++; 741 u64_stats_update_end(&rxsc_stats->syncp); 742 return false; 743 } 744 745 if (secy->validate_frames != MACSEC_VALIDATE_DISABLED) { 746 u64_stats_update_begin(&rxsc_stats->syncp); 747 if (hdr->tci_an & MACSEC_TCI_E) 748 rxsc_stats->stats.InOctetsDecrypted += skb->len; 749 else 750 rxsc_stats->stats.InOctetsValidated += skb->len; 751 u64_stats_update_end(&rxsc_stats->syncp); 752 } 753 754 if (!macsec_skb_cb(skb)->valid) { 755 spin_unlock(&rx_sa->lock); 756 757 /* 10.6.5 */ 758 if (hdr->tci_an & MACSEC_TCI_C || 759 secy->validate_frames == MACSEC_VALIDATE_STRICT) { 760 u64_stats_update_begin(&rxsc_stats->syncp); 761 rxsc_stats->stats.InPktsNotValid++; 762 u64_stats_update_end(&rxsc_stats->syncp); 763 return false; 764 } 765 766 u64_stats_update_begin(&rxsc_stats->syncp); 767 if (secy->validate_frames == MACSEC_VALIDATE_CHECK) { 768 rxsc_stats->stats.InPktsInvalid++; 769 this_cpu_inc(rx_sa->stats->InPktsInvalid); 770 } else if (pn < lowest_pn) { 771 rxsc_stats->stats.InPktsDelayed++; 772 } else { 773 rxsc_stats->stats.InPktsUnchecked++; 774 } 775 u64_stats_update_end(&rxsc_stats->syncp); 776 } else { 777 u64_stats_update_begin(&rxsc_stats->syncp); 778 if (pn < lowest_pn) { 779 rxsc_stats->stats.InPktsDelayed++; 780 } else { 781 rxsc_stats->stats.InPktsOK++; 782 this_cpu_inc(rx_sa->stats->InPktsOK); 783 } 784 u64_stats_update_end(&rxsc_stats->syncp); 785 786 // Instead of "pn >=" - to support pn overflow in xpn 787 if (pn + 1 > rx_sa->next_pn_halves.lower) { 788 rx_sa->next_pn_halves.lower = pn + 1; 789 } else if (secy->xpn && 790 !pn_same_half(pn, rx_sa->next_pn_halves.lower)) { 791 rx_sa->next_pn_halves.upper++; 792 rx_sa->next_pn_halves.lower = pn + 1; 793 } 794 795 spin_unlock(&rx_sa->lock); 796 } 797 798 return true; 799 } 800 801 static void macsec_reset_skb(struct sk_buff *skb, struct net_device *dev) 802 { 803 skb->pkt_type = PACKET_HOST; 804 skb->protocol = eth_type_trans(skb, dev); 805 806 skb_reset_network_header(skb); 807 if (!skb_transport_header_was_set(skb)) 808 skb_reset_transport_header(skb); 809 skb_reset_mac_len(skb); 810 } 811 812 static void macsec_finalize_skb(struct sk_buff *skb, u8 icv_len, u8 hdr_len) 813 { 814 skb->ip_summed = CHECKSUM_NONE; 815 memmove(skb->data + hdr_len, skb->data, 2 * ETH_ALEN); 816 skb_pull(skb, hdr_len); 817 pskb_trim_unique(skb, skb->len - icv_len); 818 } 819 820 static void count_rx(struct net_device *dev, int len) 821 { 822 struct pcpu_sw_netstats *stats = this_cpu_ptr(dev->tstats); 823 824 u64_stats_update_begin(&stats->syncp); 825 stats->rx_packets++; 826 stats->rx_bytes += len; 827 u64_stats_update_end(&stats->syncp); 828 } 829 830 static void macsec_decrypt_done(struct crypto_async_request *base, int err) 831 { 832 struct sk_buff *skb = base->data; 833 struct net_device *dev = skb->dev; 834 struct macsec_dev *macsec = macsec_priv(dev); 835 struct macsec_rx_sa *rx_sa = macsec_skb_cb(skb)->rx_sa; 836 struct macsec_rx_sc *rx_sc = rx_sa->sc; 837 int len; 838 u32 pn; 839 840 aead_request_free(macsec_skb_cb(skb)->req); 841 842 if (!err) 843 macsec_skb_cb(skb)->valid = true; 844 845 rcu_read_lock_bh(); 846 pn = ntohl(macsec_ethhdr(skb)->packet_number); 847 if (!macsec_post_decrypt(skb, &macsec->secy, pn)) { 848 rcu_read_unlock_bh(); 849 kfree_skb(skb); 850 goto out; 851 } 852 853 macsec_finalize_skb(skb, macsec->secy.icv_len, 854 macsec_extra_len(macsec_skb_cb(skb)->has_sci)); 855 macsec_reset_skb(skb, macsec->secy.netdev); 856 857 len = skb->len; 858 if (gro_cells_receive(&macsec->gro_cells, skb) == NET_RX_SUCCESS) 859 count_rx(dev, len); 860 861 rcu_read_unlock_bh(); 862 863 out: 864 macsec_rxsa_put(rx_sa); 865 macsec_rxsc_put(rx_sc); 866 dev_put(dev); 867 } 868 869 static struct sk_buff *macsec_decrypt(struct sk_buff *skb, 870 struct net_device *dev, 871 struct macsec_rx_sa *rx_sa, 872 sci_t sci, 873 struct macsec_secy *secy) 874 { 875 int ret; 876 struct scatterlist *sg; 877 struct sk_buff *trailer; 878 unsigned char *iv; 879 struct aead_request *req; 880 struct macsec_eth_header *hdr; 881 u32 hdr_pn; 882 u16 icv_len = secy->icv_len; 883 884 macsec_skb_cb(skb)->valid = false; 885 skb = skb_share_check(skb, GFP_ATOMIC); 886 if (!skb) 887 return ERR_PTR(-ENOMEM); 888 889 ret = skb_cow_data(skb, 0, &trailer); 890 if (unlikely(ret < 0)) { 891 kfree_skb(skb); 892 return ERR_PTR(ret); 893 } 894 req = macsec_alloc_req(rx_sa->key.tfm, &iv, &sg, ret); 895 if (!req) { 896 kfree_skb(skb); 897 return ERR_PTR(-ENOMEM); 898 } 899 900 hdr = (struct macsec_eth_header *)skb->data; 901 hdr_pn = ntohl(hdr->packet_number); 902 903 if (secy->xpn) { 904 pn_t recovered_pn = rx_sa->next_pn_halves; 905 906 recovered_pn.lower = hdr_pn; 907 if (hdr_pn < rx_sa->next_pn_halves.lower && 908 !pn_same_half(hdr_pn, rx_sa->next_pn_halves.lower)) 909 recovered_pn.upper++; 910 911 macsec_fill_iv_xpn(iv, rx_sa->ssci, recovered_pn.full64, 912 rx_sa->key.salt); 913 } else { 914 macsec_fill_iv(iv, sci, hdr_pn); 915 } 916 917 sg_init_table(sg, ret); 918 ret = skb_to_sgvec(skb, sg, 0, skb->len); 919 if (unlikely(ret < 0)) { 920 aead_request_free(req); 921 kfree_skb(skb); 922 return ERR_PTR(ret); 923 } 924 925 if (hdr->tci_an & MACSEC_TCI_E) { 926 /* confidentiality: ethernet + macsec header 927 * authenticated, encrypted payload 928 */ 929 int len = skb->len - macsec_hdr_len(macsec_skb_cb(skb)->has_sci); 930 931 aead_request_set_crypt(req, sg, sg, len, iv); 932 aead_request_set_ad(req, macsec_hdr_len(macsec_skb_cb(skb)->has_sci)); 933 skb = skb_unshare(skb, GFP_ATOMIC); 934 if (!skb) { 935 aead_request_free(req); 936 return ERR_PTR(-ENOMEM); 937 } 938 } else { 939 /* integrity only: all headers + data authenticated */ 940 aead_request_set_crypt(req, sg, sg, icv_len, iv); 941 aead_request_set_ad(req, skb->len - icv_len); 942 } 943 944 macsec_skb_cb(skb)->req = req; 945 skb->dev = dev; 946 aead_request_set_callback(req, 0, macsec_decrypt_done, skb); 947 948 dev_hold(dev); 949 ret = crypto_aead_decrypt(req); 950 if (ret == -EINPROGRESS) { 951 return ERR_PTR(ret); 952 } else if (ret != 0) { 953 /* decryption/authentication failed 954 * 10.6 if validateFrames is disabled, deliver anyway 955 */ 956 if (ret != -EBADMSG) { 957 kfree_skb(skb); 958 skb = ERR_PTR(ret); 959 } 960 } else { 961 macsec_skb_cb(skb)->valid = true; 962 } 963 dev_put(dev); 964 965 aead_request_free(req); 966 967 return skb; 968 } 969 970 static struct macsec_rx_sc *find_rx_sc(struct macsec_secy *secy, sci_t sci) 971 { 972 struct macsec_rx_sc *rx_sc; 973 974 for_each_rxsc(secy, rx_sc) { 975 if (rx_sc->sci == sci) 976 return rx_sc; 977 } 978 979 return NULL; 980 } 981 982 static struct macsec_rx_sc *find_rx_sc_rtnl(struct macsec_secy *secy, sci_t sci) 983 { 984 struct macsec_rx_sc *rx_sc; 985 986 for_each_rxsc_rtnl(secy, rx_sc) { 987 if (rx_sc->sci == sci) 988 return rx_sc; 989 } 990 991 return NULL; 992 } 993 994 static enum rx_handler_result handle_not_macsec(struct sk_buff *skb) 995 { 996 /* Deliver to the uncontrolled port by default */ 997 enum rx_handler_result ret = RX_HANDLER_PASS; 998 struct ethhdr *hdr = eth_hdr(skb); 999 struct macsec_rxh_data *rxd; 1000 struct macsec_dev *macsec; 1001 1002 rcu_read_lock(); 1003 rxd = macsec_data_rcu(skb->dev); 1004 1005 list_for_each_entry_rcu(macsec, &rxd->secys, secys) { 1006 struct sk_buff *nskb; 1007 struct pcpu_secy_stats *secy_stats = this_cpu_ptr(macsec->stats); 1008 struct net_device *ndev = macsec->secy.netdev; 1009 1010 /* If h/w offloading is enabled, HW decodes frames and strips 1011 * the SecTAG, so we have to deduce which port to deliver to. 1012 */ 1013 if (macsec_is_offloaded(macsec) && netif_running(ndev)) { 1014 if (ether_addr_equal_64bits(hdr->h_dest, 1015 ndev->dev_addr)) { 1016 /* exact match, divert skb to this port */ 1017 skb->dev = ndev; 1018 skb->pkt_type = PACKET_HOST; 1019 ret = RX_HANDLER_ANOTHER; 1020 goto out; 1021 } else if (is_multicast_ether_addr_64bits( 1022 hdr->h_dest)) { 1023 /* multicast frame, deliver on this port too */ 1024 nskb = skb_clone(skb, GFP_ATOMIC); 1025 if (!nskb) 1026 break; 1027 1028 nskb->dev = ndev; 1029 if (ether_addr_equal_64bits(hdr->h_dest, 1030 ndev->broadcast)) 1031 nskb->pkt_type = PACKET_BROADCAST; 1032 else 1033 nskb->pkt_type = PACKET_MULTICAST; 1034 1035 netif_rx(nskb); 1036 } 1037 continue; 1038 } 1039 1040 /* 10.6 If the management control validateFrames is not 1041 * Strict, frames without a SecTAG are received, counted, and 1042 * delivered to the Controlled Port 1043 */ 1044 if (macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) { 1045 u64_stats_update_begin(&secy_stats->syncp); 1046 secy_stats->stats.InPktsNoTag++; 1047 u64_stats_update_end(&secy_stats->syncp); 1048 continue; 1049 } 1050 1051 /* deliver on this port */ 1052 nskb = skb_clone(skb, GFP_ATOMIC); 1053 if (!nskb) 1054 break; 1055 1056 nskb->dev = ndev; 1057 1058 if (netif_rx(nskb) == NET_RX_SUCCESS) { 1059 u64_stats_update_begin(&secy_stats->syncp); 1060 secy_stats->stats.InPktsUntagged++; 1061 u64_stats_update_end(&secy_stats->syncp); 1062 } 1063 } 1064 1065 out: 1066 rcu_read_unlock(); 1067 return ret; 1068 } 1069 1070 static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) 1071 { 1072 struct sk_buff *skb = *pskb; 1073 struct net_device *dev = skb->dev; 1074 struct macsec_eth_header *hdr; 1075 struct macsec_secy *secy = NULL; 1076 struct macsec_rx_sc *rx_sc; 1077 struct macsec_rx_sa *rx_sa; 1078 struct macsec_rxh_data *rxd; 1079 struct macsec_dev *macsec; 1080 sci_t sci; 1081 u32 hdr_pn; 1082 bool cbit; 1083 struct pcpu_rx_sc_stats *rxsc_stats; 1084 struct pcpu_secy_stats *secy_stats; 1085 bool pulled_sci; 1086 int ret; 1087 1088 if (skb_headroom(skb) < ETH_HLEN) 1089 goto drop_direct; 1090 1091 hdr = macsec_ethhdr(skb); 1092 if (hdr->eth.h_proto != htons(ETH_P_MACSEC)) 1093 return handle_not_macsec(skb); 1094 1095 skb = skb_unshare(skb, GFP_ATOMIC); 1096 *pskb = skb; 1097 if (!skb) 1098 return RX_HANDLER_CONSUMED; 1099 1100 pulled_sci = pskb_may_pull(skb, macsec_extra_len(true)); 1101 if (!pulled_sci) { 1102 if (!pskb_may_pull(skb, macsec_extra_len(false))) 1103 goto drop_direct; 1104 } 1105 1106 hdr = macsec_ethhdr(skb); 1107 1108 /* Frames with a SecTAG that has the TCI E bit set but the C 1109 * bit clear are discarded, as this reserved encoding is used 1110 * to identify frames with a SecTAG that are not to be 1111 * delivered to the Controlled Port. 1112 */ 1113 if ((hdr->tci_an & (MACSEC_TCI_C | MACSEC_TCI_E)) == MACSEC_TCI_E) 1114 return RX_HANDLER_PASS; 1115 1116 /* now, pull the extra length */ 1117 if (hdr->tci_an & MACSEC_TCI_SC) { 1118 if (!pulled_sci) 1119 goto drop_direct; 1120 } 1121 1122 /* ethernet header is part of crypto processing */ 1123 skb_push(skb, ETH_HLEN); 1124 1125 macsec_skb_cb(skb)->has_sci = !!(hdr->tci_an & MACSEC_TCI_SC); 1126 macsec_skb_cb(skb)->assoc_num = hdr->tci_an & MACSEC_AN_MASK; 1127 sci = macsec_frame_sci(hdr, macsec_skb_cb(skb)->has_sci); 1128 1129 rcu_read_lock(); 1130 rxd = macsec_data_rcu(skb->dev); 1131 1132 list_for_each_entry_rcu(macsec, &rxd->secys, secys) { 1133 struct macsec_rx_sc *sc = find_rx_sc(&macsec->secy, sci); 1134 1135 sc = sc ? macsec_rxsc_get(sc) : NULL; 1136 1137 if (sc) { 1138 secy = &macsec->secy; 1139 rx_sc = sc; 1140 break; 1141 } 1142 } 1143 1144 if (!secy) 1145 goto nosci; 1146 1147 dev = secy->netdev; 1148 macsec = macsec_priv(dev); 1149 secy_stats = this_cpu_ptr(macsec->stats); 1150 rxsc_stats = this_cpu_ptr(rx_sc->stats); 1151 1152 if (!macsec_validate_skb(skb, secy->icv_len, secy->xpn)) { 1153 u64_stats_update_begin(&secy_stats->syncp); 1154 secy_stats->stats.InPktsBadTag++; 1155 u64_stats_update_end(&secy_stats->syncp); 1156 goto drop_nosa; 1157 } 1158 1159 rx_sa = macsec_rxsa_get(rx_sc->sa[macsec_skb_cb(skb)->assoc_num]); 1160 if (!rx_sa) { 1161 /* 10.6.1 if the SA is not in use */ 1162 1163 /* If validateFrames is Strict or the C bit in the 1164 * SecTAG is set, discard 1165 */ 1166 if (hdr->tci_an & MACSEC_TCI_C || 1167 secy->validate_frames == MACSEC_VALIDATE_STRICT) { 1168 u64_stats_update_begin(&rxsc_stats->syncp); 1169 rxsc_stats->stats.InPktsNotUsingSA++; 1170 u64_stats_update_end(&rxsc_stats->syncp); 1171 goto drop_nosa; 1172 } 1173 1174 /* not Strict, the frame (with the SecTAG and ICV 1175 * removed) is delivered to the Controlled Port. 1176 */ 1177 u64_stats_update_begin(&rxsc_stats->syncp); 1178 rxsc_stats->stats.InPktsUnusedSA++; 1179 u64_stats_update_end(&rxsc_stats->syncp); 1180 goto deliver; 1181 } 1182 1183 /* First, PN check to avoid decrypting obviously wrong packets */ 1184 hdr_pn = ntohl(hdr->packet_number); 1185 if (secy->replay_protect) { 1186 bool late; 1187 1188 spin_lock(&rx_sa->lock); 1189 late = rx_sa->next_pn_halves.lower >= secy->replay_window && 1190 hdr_pn < (rx_sa->next_pn_halves.lower - secy->replay_window); 1191 1192 if (secy->xpn) 1193 late = late && pn_same_half(rx_sa->next_pn_halves.lower, hdr_pn); 1194 spin_unlock(&rx_sa->lock); 1195 1196 if (late) { 1197 u64_stats_update_begin(&rxsc_stats->syncp); 1198 rxsc_stats->stats.InPktsLate++; 1199 u64_stats_update_end(&rxsc_stats->syncp); 1200 goto drop; 1201 } 1202 } 1203 1204 macsec_skb_cb(skb)->rx_sa = rx_sa; 1205 1206 /* Disabled && !changed text => skip validation */ 1207 if (hdr->tci_an & MACSEC_TCI_C || 1208 secy->validate_frames != MACSEC_VALIDATE_DISABLED) 1209 skb = macsec_decrypt(skb, dev, rx_sa, sci, secy); 1210 1211 if (IS_ERR(skb)) { 1212 /* the decrypt callback needs the reference */ 1213 if (PTR_ERR(skb) != -EINPROGRESS) { 1214 macsec_rxsa_put(rx_sa); 1215 macsec_rxsc_put(rx_sc); 1216 } 1217 rcu_read_unlock(); 1218 *pskb = NULL; 1219 return RX_HANDLER_CONSUMED; 1220 } 1221 1222 if (!macsec_post_decrypt(skb, secy, hdr_pn)) 1223 goto drop; 1224 1225 deliver: 1226 macsec_finalize_skb(skb, secy->icv_len, 1227 macsec_extra_len(macsec_skb_cb(skb)->has_sci)); 1228 macsec_reset_skb(skb, secy->netdev); 1229 1230 if (rx_sa) 1231 macsec_rxsa_put(rx_sa); 1232 macsec_rxsc_put(rx_sc); 1233 1234 skb_orphan(skb); 1235 ret = gro_cells_receive(&macsec->gro_cells, skb); 1236 if (ret == NET_RX_SUCCESS) 1237 count_rx(dev, skb->len); 1238 else 1239 macsec->secy.netdev->stats.rx_dropped++; 1240 1241 rcu_read_unlock(); 1242 1243 *pskb = NULL; 1244 return RX_HANDLER_CONSUMED; 1245 1246 drop: 1247 macsec_rxsa_put(rx_sa); 1248 drop_nosa: 1249 macsec_rxsc_put(rx_sc); 1250 rcu_read_unlock(); 1251 drop_direct: 1252 kfree_skb(skb); 1253 *pskb = NULL; 1254 return RX_HANDLER_CONSUMED; 1255 1256 nosci: 1257 /* 10.6.1 if the SC is not found */ 1258 cbit = !!(hdr->tci_an & MACSEC_TCI_C); 1259 if (!cbit) 1260 macsec_finalize_skb(skb, DEFAULT_ICV_LEN, 1261 macsec_extra_len(macsec_skb_cb(skb)->has_sci)); 1262 1263 list_for_each_entry_rcu(macsec, &rxd->secys, secys) { 1264 struct sk_buff *nskb; 1265 1266 secy_stats = this_cpu_ptr(macsec->stats); 1267 1268 /* If validateFrames is Strict or the C bit in the 1269 * SecTAG is set, discard 1270 */ 1271 if (cbit || 1272 macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) { 1273 u64_stats_update_begin(&secy_stats->syncp); 1274 secy_stats->stats.InPktsNoSCI++; 1275 u64_stats_update_end(&secy_stats->syncp); 1276 continue; 1277 } 1278 1279 /* not strict, the frame (with the SecTAG and ICV 1280 * removed) is delivered to the Controlled Port. 1281 */ 1282 nskb = skb_clone(skb, GFP_ATOMIC); 1283 if (!nskb) 1284 break; 1285 1286 macsec_reset_skb(nskb, macsec->secy.netdev); 1287 1288 ret = netif_rx(nskb); 1289 if (ret == NET_RX_SUCCESS) { 1290 u64_stats_update_begin(&secy_stats->syncp); 1291 secy_stats->stats.InPktsUnknownSCI++; 1292 u64_stats_update_end(&secy_stats->syncp); 1293 } else { 1294 macsec->secy.netdev->stats.rx_dropped++; 1295 } 1296 } 1297 1298 rcu_read_unlock(); 1299 *pskb = skb; 1300 return RX_HANDLER_PASS; 1301 } 1302 1303 static struct crypto_aead *macsec_alloc_tfm(char *key, int key_len, int icv_len) 1304 { 1305 struct crypto_aead *tfm; 1306 int ret; 1307 1308 tfm = crypto_alloc_aead("gcm(aes)", 0, 0); 1309 1310 if (IS_ERR(tfm)) 1311 return tfm; 1312 1313 ret = crypto_aead_setkey(tfm, key, key_len); 1314 if (ret < 0) 1315 goto fail; 1316 1317 ret = crypto_aead_setauthsize(tfm, icv_len); 1318 if (ret < 0) 1319 goto fail; 1320 1321 return tfm; 1322 fail: 1323 crypto_free_aead(tfm); 1324 return ERR_PTR(ret); 1325 } 1326 1327 static int init_rx_sa(struct macsec_rx_sa *rx_sa, char *sak, int key_len, 1328 int icv_len) 1329 { 1330 rx_sa->stats = alloc_percpu(struct macsec_rx_sa_stats); 1331 if (!rx_sa->stats) 1332 return -ENOMEM; 1333 1334 rx_sa->key.tfm = macsec_alloc_tfm(sak, key_len, icv_len); 1335 if (IS_ERR(rx_sa->key.tfm)) { 1336 free_percpu(rx_sa->stats); 1337 return PTR_ERR(rx_sa->key.tfm); 1338 } 1339 1340 rx_sa->ssci = MACSEC_UNDEF_SSCI; 1341 rx_sa->active = false; 1342 rx_sa->next_pn = 1; 1343 refcount_set(&rx_sa->refcnt, 1); 1344 spin_lock_init(&rx_sa->lock); 1345 1346 return 0; 1347 } 1348 1349 static void clear_rx_sa(struct macsec_rx_sa *rx_sa) 1350 { 1351 rx_sa->active = false; 1352 1353 macsec_rxsa_put(rx_sa); 1354 } 1355 1356 static void free_rx_sc(struct macsec_rx_sc *rx_sc) 1357 { 1358 int i; 1359 1360 for (i = 0; i < MACSEC_NUM_AN; i++) { 1361 struct macsec_rx_sa *sa = rtnl_dereference(rx_sc->sa[i]); 1362 1363 RCU_INIT_POINTER(rx_sc->sa[i], NULL); 1364 if (sa) 1365 clear_rx_sa(sa); 1366 } 1367 1368 macsec_rxsc_put(rx_sc); 1369 } 1370 1371 static struct macsec_rx_sc *del_rx_sc(struct macsec_secy *secy, sci_t sci) 1372 { 1373 struct macsec_rx_sc *rx_sc, __rcu **rx_scp; 1374 1375 for (rx_scp = &secy->rx_sc, rx_sc = rtnl_dereference(*rx_scp); 1376 rx_sc; 1377 rx_scp = &rx_sc->next, rx_sc = rtnl_dereference(*rx_scp)) { 1378 if (rx_sc->sci == sci) { 1379 if (rx_sc->active) 1380 secy->n_rx_sc--; 1381 rcu_assign_pointer(*rx_scp, rx_sc->next); 1382 return rx_sc; 1383 } 1384 } 1385 1386 return NULL; 1387 } 1388 1389 static struct macsec_rx_sc *create_rx_sc(struct net_device *dev, sci_t sci) 1390 { 1391 struct macsec_rx_sc *rx_sc; 1392 struct macsec_dev *macsec; 1393 struct net_device *real_dev = macsec_priv(dev)->real_dev; 1394 struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev); 1395 struct macsec_secy *secy; 1396 1397 list_for_each_entry(macsec, &rxd->secys, secys) { 1398 if (find_rx_sc_rtnl(&macsec->secy, sci)) 1399 return ERR_PTR(-EEXIST); 1400 } 1401 1402 rx_sc = kzalloc(sizeof(*rx_sc), GFP_KERNEL); 1403 if (!rx_sc) 1404 return ERR_PTR(-ENOMEM); 1405 1406 rx_sc->stats = netdev_alloc_pcpu_stats(struct pcpu_rx_sc_stats); 1407 if (!rx_sc->stats) { 1408 kfree(rx_sc); 1409 return ERR_PTR(-ENOMEM); 1410 } 1411 1412 rx_sc->sci = sci; 1413 rx_sc->active = true; 1414 refcount_set(&rx_sc->refcnt, 1); 1415 1416 secy = &macsec_priv(dev)->secy; 1417 rcu_assign_pointer(rx_sc->next, secy->rx_sc); 1418 rcu_assign_pointer(secy->rx_sc, rx_sc); 1419 1420 if (rx_sc->active) 1421 secy->n_rx_sc++; 1422 1423 return rx_sc; 1424 } 1425 1426 static int init_tx_sa(struct macsec_tx_sa *tx_sa, char *sak, int key_len, 1427 int icv_len) 1428 { 1429 tx_sa->stats = alloc_percpu(struct macsec_tx_sa_stats); 1430 if (!tx_sa->stats) 1431 return -ENOMEM; 1432 1433 tx_sa->key.tfm = macsec_alloc_tfm(sak, key_len, icv_len); 1434 if (IS_ERR(tx_sa->key.tfm)) { 1435 free_percpu(tx_sa->stats); 1436 return PTR_ERR(tx_sa->key.tfm); 1437 } 1438 1439 tx_sa->ssci = MACSEC_UNDEF_SSCI; 1440 tx_sa->active = false; 1441 refcount_set(&tx_sa->refcnt, 1); 1442 spin_lock_init(&tx_sa->lock); 1443 1444 return 0; 1445 } 1446 1447 static void clear_tx_sa(struct macsec_tx_sa *tx_sa) 1448 { 1449 tx_sa->active = false; 1450 1451 macsec_txsa_put(tx_sa); 1452 } 1453 1454 static struct genl_family macsec_fam; 1455 1456 static struct net_device *get_dev_from_nl(struct net *net, 1457 struct nlattr **attrs) 1458 { 1459 int ifindex = nla_get_u32(attrs[MACSEC_ATTR_IFINDEX]); 1460 struct net_device *dev; 1461 1462 dev = __dev_get_by_index(net, ifindex); 1463 if (!dev) 1464 return ERR_PTR(-ENODEV); 1465 1466 if (!netif_is_macsec(dev)) 1467 return ERR_PTR(-ENODEV); 1468 1469 return dev; 1470 } 1471 1472 static enum macsec_offload nla_get_offload(const struct nlattr *nla) 1473 { 1474 return (__force enum macsec_offload)nla_get_u8(nla); 1475 } 1476 1477 static sci_t nla_get_sci(const struct nlattr *nla) 1478 { 1479 return (__force sci_t)nla_get_u64(nla); 1480 } 1481 1482 static int nla_put_sci(struct sk_buff *skb, int attrtype, sci_t value, 1483 int padattr) 1484 { 1485 return nla_put_u64_64bit(skb, attrtype, (__force u64)value, padattr); 1486 } 1487 1488 static ssci_t nla_get_ssci(const struct nlattr *nla) 1489 { 1490 return (__force ssci_t)nla_get_u32(nla); 1491 } 1492 1493 static int nla_put_ssci(struct sk_buff *skb, int attrtype, ssci_t value) 1494 { 1495 return nla_put_u32(skb, attrtype, (__force u64)value); 1496 } 1497 1498 static struct macsec_tx_sa *get_txsa_from_nl(struct net *net, 1499 struct nlattr **attrs, 1500 struct nlattr **tb_sa, 1501 struct net_device **devp, 1502 struct macsec_secy **secyp, 1503 struct macsec_tx_sc **scp, 1504 u8 *assoc_num) 1505 { 1506 struct net_device *dev; 1507 struct macsec_secy *secy; 1508 struct macsec_tx_sc *tx_sc; 1509 struct macsec_tx_sa *tx_sa; 1510 1511 if (!tb_sa[MACSEC_SA_ATTR_AN]) 1512 return ERR_PTR(-EINVAL); 1513 1514 *assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]); 1515 1516 dev = get_dev_from_nl(net, attrs); 1517 if (IS_ERR(dev)) 1518 return ERR_CAST(dev); 1519 1520 if (*assoc_num >= MACSEC_NUM_AN) 1521 return ERR_PTR(-EINVAL); 1522 1523 secy = &macsec_priv(dev)->secy; 1524 tx_sc = &secy->tx_sc; 1525 1526 tx_sa = rtnl_dereference(tx_sc->sa[*assoc_num]); 1527 if (!tx_sa) 1528 return ERR_PTR(-ENODEV); 1529 1530 *devp = dev; 1531 *scp = tx_sc; 1532 *secyp = secy; 1533 return tx_sa; 1534 } 1535 1536 static struct macsec_rx_sc *get_rxsc_from_nl(struct net *net, 1537 struct nlattr **attrs, 1538 struct nlattr **tb_rxsc, 1539 struct net_device **devp, 1540 struct macsec_secy **secyp) 1541 { 1542 struct net_device *dev; 1543 struct macsec_secy *secy; 1544 struct macsec_rx_sc *rx_sc; 1545 sci_t sci; 1546 1547 dev = get_dev_from_nl(net, attrs); 1548 if (IS_ERR(dev)) 1549 return ERR_CAST(dev); 1550 1551 secy = &macsec_priv(dev)->secy; 1552 1553 if (!tb_rxsc[MACSEC_RXSC_ATTR_SCI]) 1554 return ERR_PTR(-EINVAL); 1555 1556 sci = nla_get_sci(tb_rxsc[MACSEC_RXSC_ATTR_SCI]); 1557 rx_sc = find_rx_sc_rtnl(secy, sci); 1558 if (!rx_sc) 1559 return ERR_PTR(-ENODEV); 1560 1561 *secyp = secy; 1562 *devp = dev; 1563 1564 return rx_sc; 1565 } 1566 1567 static struct macsec_rx_sa *get_rxsa_from_nl(struct net *net, 1568 struct nlattr **attrs, 1569 struct nlattr **tb_rxsc, 1570 struct nlattr **tb_sa, 1571 struct net_device **devp, 1572 struct macsec_secy **secyp, 1573 struct macsec_rx_sc **scp, 1574 u8 *assoc_num) 1575 { 1576 struct macsec_rx_sc *rx_sc; 1577 struct macsec_rx_sa *rx_sa; 1578 1579 if (!tb_sa[MACSEC_SA_ATTR_AN]) 1580 return ERR_PTR(-EINVAL); 1581 1582 *assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]); 1583 if (*assoc_num >= MACSEC_NUM_AN) 1584 return ERR_PTR(-EINVAL); 1585 1586 rx_sc = get_rxsc_from_nl(net, attrs, tb_rxsc, devp, secyp); 1587 if (IS_ERR(rx_sc)) 1588 return ERR_CAST(rx_sc); 1589 1590 rx_sa = rtnl_dereference(rx_sc->sa[*assoc_num]); 1591 if (!rx_sa) 1592 return ERR_PTR(-ENODEV); 1593 1594 *scp = rx_sc; 1595 return rx_sa; 1596 } 1597 1598 static const struct nla_policy macsec_genl_policy[NUM_MACSEC_ATTR] = { 1599 [MACSEC_ATTR_IFINDEX] = { .type = NLA_U32 }, 1600 [MACSEC_ATTR_RXSC_CONFIG] = { .type = NLA_NESTED }, 1601 [MACSEC_ATTR_SA_CONFIG] = { .type = NLA_NESTED }, 1602 [MACSEC_ATTR_OFFLOAD] = { .type = NLA_NESTED }, 1603 }; 1604 1605 static const struct nla_policy macsec_genl_rxsc_policy[NUM_MACSEC_RXSC_ATTR] = { 1606 [MACSEC_RXSC_ATTR_SCI] = { .type = NLA_U64 }, 1607 [MACSEC_RXSC_ATTR_ACTIVE] = { .type = NLA_U8 }, 1608 }; 1609 1610 static const struct nla_policy macsec_genl_sa_policy[NUM_MACSEC_SA_ATTR] = { 1611 [MACSEC_SA_ATTR_AN] = { .type = NLA_U8 }, 1612 [MACSEC_SA_ATTR_ACTIVE] = { .type = NLA_U8 }, 1613 [MACSEC_SA_ATTR_PN] = { .type = NLA_MIN_LEN, .len = 4 }, 1614 [MACSEC_SA_ATTR_KEYID] = { .type = NLA_BINARY, 1615 .len = MACSEC_KEYID_LEN, }, 1616 [MACSEC_SA_ATTR_KEY] = { .type = NLA_BINARY, 1617 .len = MACSEC_MAX_KEY_LEN, }, 1618 [MACSEC_SA_ATTR_SSCI] = { .type = NLA_U32 }, 1619 [MACSEC_SA_ATTR_SALT] = { .type = NLA_BINARY, 1620 .len = MACSEC_SALT_LEN, }, 1621 }; 1622 1623 static const struct nla_policy macsec_genl_offload_policy[NUM_MACSEC_OFFLOAD_ATTR] = { 1624 [MACSEC_OFFLOAD_ATTR_TYPE] = { .type = NLA_U8 }, 1625 }; 1626 1627 /* Offloads an operation to a device driver */ 1628 static int macsec_offload(int (* const func)(struct macsec_context *), 1629 struct macsec_context *ctx) 1630 { 1631 int ret; 1632 1633 if (unlikely(!func)) 1634 return 0; 1635 1636 if (ctx->offload == MACSEC_OFFLOAD_PHY) 1637 mutex_lock(&ctx->phydev->lock); 1638 1639 /* Phase I: prepare. The drive should fail here if there are going to be 1640 * issues in the commit phase. 1641 */ 1642 ctx->prepare = true; 1643 ret = (*func)(ctx); 1644 if (ret) 1645 goto phy_unlock; 1646 1647 /* Phase II: commit. This step cannot fail. */ 1648 ctx->prepare = false; 1649 ret = (*func)(ctx); 1650 /* This should never happen: commit is not allowed to fail */ 1651 if (unlikely(ret)) 1652 WARN(1, "MACsec offloading commit failed (%d)\n", ret); 1653 1654 phy_unlock: 1655 if (ctx->offload == MACSEC_OFFLOAD_PHY) 1656 mutex_unlock(&ctx->phydev->lock); 1657 1658 return ret; 1659 } 1660 1661 static int parse_sa_config(struct nlattr **attrs, struct nlattr **tb_sa) 1662 { 1663 if (!attrs[MACSEC_ATTR_SA_CONFIG]) 1664 return -EINVAL; 1665 1666 if (nla_parse_nested_deprecated(tb_sa, MACSEC_SA_ATTR_MAX, attrs[MACSEC_ATTR_SA_CONFIG], macsec_genl_sa_policy, NULL)) 1667 return -EINVAL; 1668 1669 return 0; 1670 } 1671 1672 static int parse_rxsc_config(struct nlattr **attrs, struct nlattr **tb_rxsc) 1673 { 1674 if (!attrs[MACSEC_ATTR_RXSC_CONFIG]) 1675 return -EINVAL; 1676 1677 if (nla_parse_nested_deprecated(tb_rxsc, MACSEC_RXSC_ATTR_MAX, attrs[MACSEC_ATTR_RXSC_CONFIG], macsec_genl_rxsc_policy, NULL)) 1678 return -EINVAL; 1679 1680 return 0; 1681 } 1682 1683 static bool validate_add_rxsa(struct nlattr **attrs) 1684 { 1685 if (!attrs[MACSEC_SA_ATTR_AN] || 1686 !attrs[MACSEC_SA_ATTR_KEY] || 1687 !attrs[MACSEC_SA_ATTR_KEYID]) 1688 return false; 1689 1690 if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN) 1691 return false; 1692 1693 if (attrs[MACSEC_SA_ATTR_PN] && 1694 *(u64 *)nla_data(attrs[MACSEC_SA_ATTR_PN]) == 0) 1695 return false; 1696 1697 if (attrs[MACSEC_SA_ATTR_ACTIVE]) { 1698 if (nla_get_u8(attrs[MACSEC_SA_ATTR_ACTIVE]) > 1) 1699 return false; 1700 } 1701 1702 if (nla_len(attrs[MACSEC_SA_ATTR_KEYID]) != MACSEC_KEYID_LEN) 1703 return false; 1704 1705 return true; 1706 } 1707 1708 static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info) 1709 { 1710 struct net_device *dev; 1711 struct nlattr **attrs = info->attrs; 1712 struct macsec_secy *secy; 1713 struct macsec_rx_sc *rx_sc; 1714 struct macsec_rx_sa *rx_sa; 1715 unsigned char assoc_num; 1716 int pn_len; 1717 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1]; 1718 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1]; 1719 int err; 1720 1721 if (!attrs[MACSEC_ATTR_IFINDEX]) 1722 return -EINVAL; 1723 1724 if (parse_sa_config(attrs, tb_sa)) 1725 return -EINVAL; 1726 1727 if (parse_rxsc_config(attrs, tb_rxsc)) 1728 return -EINVAL; 1729 1730 if (!validate_add_rxsa(tb_sa)) 1731 return -EINVAL; 1732 1733 rtnl_lock(); 1734 rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy); 1735 if (IS_ERR(rx_sc)) { 1736 rtnl_unlock(); 1737 return PTR_ERR(rx_sc); 1738 } 1739 1740 assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]); 1741 1742 if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) { 1743 pr_notice("macsec: nl: add_rxsa: bad key length: %d != %d\n", 1744 nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len); 1745 rtnl_unlock(); 1746 return -EINVAL; 1747 } 1748 1749 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN; 1750 if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) { 1751 pr_notice("macsec: nl: add_rxsa: bad pn length: %d != %d\n", 1752 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len); 1753 rtnl_unlock(); 1754 return -EINVAL; 1755 } 1756 1757 if (secy->xpn) { 1758 if (!tb_sa[MACSEC_SA_ATTR_SSCI] || !tb_sa[MACSEC_SA_ATTR_SALT]) { 1759 rtnl_unlock(); 1760 return -EINVAL; 1761 } 1762 1763 if (nla_len(tb_sa[MACSEC_SA_ATTR_SALT]) != MACSEC_SALT_LEN) { 1764 pr_notice("macsec: nl: add_rxsa: bad salt length: %d != %d\n", 1765 nla_len(tb_sa[MACSEC_SA_ATTR_SALT]), 1766 MACSEC_SA_ATTR_SALT); 1767 rtnl_unlock(); 1768 return -EINVAL; 1769 } 1770 } 1771 1772 rx_sa = rtnl_dereference(rx_sc->sa[assoc_num]); 1773 if (rx_sa) { 1774 rtnl_unlock(); 1775 return -EBUSY; 1776 } 1777 1778 rx_sa = kmalloc(sizeof(*rx_sa), GFP_KERNEL); 1779 if (!rx_sa) { 1780 rtnl_unlock(); 1781 return -ENOMEM; 1782 } 1783 1784 err = init_rx_sa(rx_sa, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]), 1785 secy->key_len, secy->icv_len); 1786 if (err < 0) { 1787 kfree(rx_sa); 1788 rtnl_unlock(); 1789 return err; 1790 } 1791 1792 if (tb_sa[MACSEC_SA_ATTR_PN]) { 1793 spin_lock_bh(&rx_sa->lock); 1794 rx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]); 1795 spin_unlock_bh(&rx_sa->lock); 1796 } 1797 1798 if (tb_sa[MACSEC_SA_ATTR_ACTIVE]) 1799 rx_sa->active = !!nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]); 1800 1801 rx_sa->sc = rx_sc; 1802 1803 /* If h/w offloading is available, propagate to the device */ 1804 if (macsec_is_offloaded(netdev_priv(dev))) { 1805 const struct macsec_ops *ops; 1806 struct macsec_context ctx; 1807 1808 ops = macsec_get_ops(netdev_priv(dev), &ctx); 1809 if (!ops) { 1810 err = -EOPNOTSUPP; 1811 goto cleanup; 1812 } 1813 1814 ctx.sa.assoc_num = assoc_num; 1815 ctx.sa.rx_sa = rx_sa; 1816 ctx.secy = secy; 1817 memcpy(ctx.sa.key, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]), 1818 MACSEC_KEYID_LEN); 1819 1820 err = macsec_offload(ops->mdo_add_rxsa, &ctx); 1821 if (err) 1822 goto cleanup; 1823 } 1824 1825 if (secy->xpn) { 1826 rx_sa->ssci = nla_get_ssci(tb_sa[MACSEC_SA_ATTR_SSCI]); 1827 nla_memcpy(rx_sa->key.salt.bytes, tb_sa[MACSEC_SA_ATTR_SALT], 1828 MACSEC_SALT_LEN); 1829 } 1830 1831 nla_memcpy(rx_sa->key.id, tb_sa[MACSEC_SA_ATTR_KEYID], MACSEC_KEYID_LEN); 1832 rcu_assign_pointer(rx_sc->sa[assoc_num], rx_sa); 1833 1834 rtnl_unlock(); 1835 1836 return 0; 1837 1838 cleanup: 1839 kfree(rx_sa); 1840 rtnl_unlock(); 1841 return err; 1842 } 1843 1844 static bool validate_add_rxsc(struct nlattr **attrs) 1845 { 1846 if (!attrs[MACSEC_RXSC_ATTR_SCI]) 1847 return false; 1848 1849 if (attrs[MACSEC_RXSC_ATTR_ACTIVE]) { 1850 if (nla_get_u8(attrs[MACSEC_RXSC_ATTR_ACTIVE]) > 1) 1851 return false; 1852 } 1853 1854 return true; 1855 } 1856 1857 static int macsec_add_rxsc(struct sk_buff *skb, struct genl_info *info) 1858 { 1859 struct net_device *dev; 1860 sci_t sci = MACSEC_UNDEF_SCI; 1861 struct nlattr **attrs = info->attrs; 1862 struct macsec_rx_sc *rx_sc; 1863 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1]; 1864 struct macsec_secy *secy; 1865 bool was_active; 1866 int ret; 1867 1868 if (!attrs[MACSEC_ATTR_IFINDEX]) 1869 return -EINVAL; 1870 1871 if (parse_rxsc_config(attrs, tb_rxsc)) 1872 return -EINVAL; 1873 1874 if (!validate_add_rxsc(tb_rxsc)) 1875 return -EINVAL; 1876 1877 rtnl_lock(); 1878 dev = get_dev_from_nl(genl_info_net(info), attrs); 1879 if (IS_ERR(dev)) { 1880 rtnl_unlock(); 1881 return PTR_ERR(dev); 1882 } 1883 1884 secy = &macsec_priv(dev)->secy; 1885 sci = nla_get_sci(tb_rxsc[MACSEC_RXSC_ATTR_SCI]); 1886 1887 rx_sc = create_rx_sc(dev, sci); 1888 if (IS_ERR(rx_sc)) { 1889 rtnl_unlock(); 1890 return PTR_ERR(rx_sc); 1891 } 1892 1893 was_active = rx_sc->active; 1894 if (tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]) 1895 rx_sc->active = !!nla_get_u8(tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]); 1896 1897 if (macsec_is_offloaded(netdev_priv(dev))) { 1898 const struct macsec_ops *ops; 1899 struct macsec_context ctx; 1900 1901 ops = macsec_get_ops(netdev_priv(dev), &ctx); 1902 if (!ops) { 1903 ret = -EOPNOTSUPP; 1904 goto cleanup; 1905 } 1906 1907 ctx.rx_sc = rx_sc; 1908 ctx.secy = secy; 1909 1910 ret = macsec_offload(ops->mdo_add_rxsc, &ctx); 1911 if (ret) 1912 goto cleanup; 1913 } 1914 1915 rtnl_unlock(); 1916 1917 return 0; 1918 1919 cleanup: 1920 rx_sc->active = was_active; 1921 rtnl_unlock(); 1922 return ret; 1923 } 1924 1925 static bool validate_add_txsa(struct nlattr **attrs) 1926 { 1927 if (!attrs[MACSEC_SA_ATTR_AN] || 1928 !attrs[MACSEC_SA_ATTR_PN] || 1929 !attrs[MACSEC_SA_ATTR_KEY] || 1930 !attrs[MACSEC_SA_ATTR_KEYID]) 1931 return false; 1932 1933 if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN) 1934 return false; 1935 1936 if (nla_get_u32(attrs[MACSEC_SA_ATTR_PN]) == 0) 1937 return false; 1938 1939 if (attrs[MACSEC_SA_ATTR_ACTIVE]) { 1940 if (nla_get_u8(attrs[MACSEC_SA_ATTR_ACTIVE]) > 1) 1941 return false; 1942 } 1943 1944 if (nla_len(attrs[MACSEC_SA_ATTR_KEYID]) != MACSEC_KEYID_LEN) 1945 return false; 1946 1947 return true; 1948 } 1949 1950 static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info) 1951 { 1952 struct net_device *dev; 1953 struct nlattr **attrs = info->attrs; 1954 struct macsec_secy *secy; 1955 struct macsec_tx_sc *tx_sc; 1956 struct macsec_tx_sa *tx_sa; 1957 unsigned char assoc_num; 1958 int pn_len; 1959 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1]; 1960 bool was_operational; 1961 int err; 1962 1963 if (!attrs[MACSEC_ATTR_IFINDEX]) 1964 return -EINVAL; 1965 1966 if (parse_sa_config(attrs, tb_sa)) 1967 return -EINVAL; 1968 1969 if (!validate_add_txsa(tb_sa)) 1970 return -EINVAL; 1971 1972 rtnl_lock(); 1973 dev = get_dev_from_nl(genl_info_net(info), attrs); 1974 if (IS_ERR(dev)) { 1975 rtnl_unlock(); 1976 return PTR_ERR(dev); 1977 } 1978 1979 secy = &macsec_priv(dev)->secy; 1980 tx_sc = &secy->tx_sc; 1981 1982 assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]); 1983 1984 if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) { 1985 pr_notice("macsec: nl: add_txsa: bad key length: %d != %d\n", 1986 nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len); 1987 rtnl_unlock(); 1988 return -EINVAL; 1989 } 1990 1991 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN; 1992 if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) { 1993 pr_notice("macsec: nl: add_txsa: bad pn length: %d != %d\n", 1994 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len); 1995 rtnl_unlock(); 1996 return -EINVAL; 1997 } 1998 1999 if (secy->xpn) { 2000 if (!tb_sa[MACSEC_SA_ATTR_SSCI] || !tb_sa[MACSEC_SA_ATTR_SALT]) { 2001 rtnl_unlock(); 2002 return -EINVAL; 2003 } 2004 2005 if (nla_len(tb_sa[MACSEC_SA_ATTR_SALT]) != MACSEC_SALT_LEN) { 2006 pr_notice("macsec: nl: add_txsa: bad salt length: %d != %d\n", 2007 nla_len(tb_sa[MACSEC_SA_ATTR_SALT]), 2008 MACSEC_SA_ATTR_SALT); 2009 rtnl_unlock(); 2010 return -EINVAL; 2011 } 2012 } 2013 2014 tx_sa = rtnl_dereference(tx_sc->sa[assoc_num]); 2015 if (tx_sa) { 2016 rtnl_unlock(); 2017 return -EBUSY; 2018 } 2019 2020 tx_sa = kmalloc(sizeof(*tx_sa), GFP_KERNEL); 2021 if (!tx_sa) { 2022 rtnl_unlock(); 2023 return -ENOMEM; 2024 } 2025 2026 err = init_tx_sa(tx_sa, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]), 2027 secy->key_len, secy->icv_len); 2028 if (err < 0) { 2029 kfree(tx_sa); 2030 rtnl_unlock(); 2031 return err; 2032 } 2033 2034 spin_lock_bh(&tx_sa->lock); 2035 tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]); 2036 spin_unlock_bh(&tx_sa->lock); 2037 2038 if (tb_sa[MACSEC_SA_ATTR_ACTIVE]) 2039 tx_sa->active = !!nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]); 2040 2041 was_operational = secy->operational; 2042 if (assoc_num == tx_sc->encoding_sa && tx_sa->active) 2043 secy->operational = true; 2044 2045 /* If h/w offloading is available, propagate to the device */ 2046 if (macsec_is_offloaded(netdev_priv(dev))) { 2047 const struct macsec_ops *ops; 2048 struct macsec_context ctx; 2049 2050 ops = macsec_get_ops(netdev_priv(dev), &ctx); 2051 if (!ops) { 2052 err = -EOPNOTSUPP; 2053 goto cleanup; 2054 } 2055 2056 ctx.sa.assoc_num = assoc_num; 2057 ctx.sa.tx_sa = tx_sa; 2058 ctx.secy = secy; 2059 memcpy(ctx.sa.key, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]), 2060 MACSEC_KEYID_LEN); 2061 2062 err = macsec_offload(ops->mdo_add_txsa, &ctx); 2063 if (err) 2064 goto cleanup; 2065 } 2066 2067 if (secy->xpn) { 2068 tx_sa->ssci = nla_get_ssci(tb_sa[MACSEC_SA_ATTR_SSCI]); 2069 nla_memcpy(tx_sa->key.salt.bytes, tb_sa[MACSEC_SA_ATTR_SALT], 2070 MACSEC_SALT_LEN); 2071 } 2072 2073 nla_memcpy(tx_sa->key.id, tb_sa[MACSEC_SA_ATTR_KEYID], MACSEC_KEYID_LEN); 2074 rcu_assign_pointer(tx_sc->sa[assoc_num], tx_sa); 2075 2076 rtnl_unlock(); 2077 2078 return 0; 2079 2080 cleanup: 2081 secy->operational = was_operational; 2082 kfree(tx_sa); 2083 rtnl_unlock(); 2084 return err; 2085 } 2086 2087 static int macsec_del_rxsa(struct sk_buff *skb, struct genl_info *info) 2088 { 2089 struct nlattr **attrs = info->attrs; 2090 struct net_device *dev; 2091 struct macsec_secy *secy; 2092 struct macsec_rx_sc *rx_sc; 2093 struct macsec_rx_sa *rx_sa; 2094 u8 assoc_num; 2095 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1]; 2096 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1]; 2097 int ret; 2098 2099 if (!attrs[MACSEC_ATTR_IFINDEX]) 2100 return -EINVAL; 2101 2102 if (parse_sa_config(attrs, tb_sa)) 2103 return -EINVAL; 2104 2105 if (parse_rxsc_config(attrs, tb_rxsc)) 2106 return -EINVAL; 2107 2108 rtnl_lock(); 2109 rx_sa = get_rxsa_from_nl(genl_info_net(info), attrs, tb_rxsc, tb_sa, 2110 &dev, &secy, &rx_sc, &assoc_num); 2111 if (IS_ERR(rx_sa)) { 2112 rtnl_unlock(); 2113 return PTR_ERR(rx_sa); 2114 } 2115 2116 if (rx_sa->active) { 2117 rtnl_unlock(); 2118 return -EBUSY; 2119 } 2120 2121 /* If h/w offloading is available, propagate to the device */ 2122 if (macsec_is_offloaded(netdev_priv(dev))) { 2123 const struct macsec_ops *ops; 2124 struct macsec_context ctx; 2125 2126 ops = macsec_get_ops(netdev_priv(dev), &ctx); 2127 if (!ops) { 2128 ret = -EOPNOTSUPP; 2129 goto cleanup; 2130 } 2131 2132 ctx.sa.assoc_num = assoc_num; 2133 ctx.sa.rx_sa = rx_sa; 2134 ctx.secy = secy; 2135 2136 ret = macsec_offload(ops->mdo_del_rxsa, &ctx); 2137 if (ret) 2138 goto cleanup; 2139 } 2140 2141 RCU_INIT_POINTER(rx_sc->sa[assoc_num], NULL); 2142 clear_rx_sa(rx_sa); 2143 2144 rtnl_unlock(); 2145 2146 return 0; 2147 2148 cleanup: 2149 rtnl_unlock(); 2150 return ret; 2151 } 2152 2153 static int macsec_del_rxsc(struct sk_buff *skb, struct genl_info *info) 2154 { 2155 struct nlattr **attrs = info->attrs; 2156 struct net_device *dev; 2157 struct macsec_secy *secy; 2158 struct macsec_rx_sc *rx_sc; 2159 sci_t sci; 2160 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1]; 2161 int ret; 2162 2163 if (!attrs[MACSEC_ATTR_IFINDEX]) 2164 return -EINVAL; 2165 2166 if (parse_rxsc_config(attrs, tb_rxsc)) 2167 return -EINVAL; 2168 2169 if (!tb_rxsc[MACSEC_RXSC_ATTR_SCI]) 2170 return -EINVAL; 2171 2172 rtnl_lock(); 2173 dev = get_dev_from_nl(genl_info_net(info), info->attrs); 2174 if (IS_ERR(dev)) { 2175 rtnl_unlock(); 2176 return PTR_ERR(dev); 2177 } 2178 2179 secy = &macsec_priv(dev)->secy; 2180 sci = nla_get_sci(tb_rxsc[MACSEC_RXSC_ATTR_SCI]); 2181 2182 rx_sc = del_rx_sc(secy, sci); 2183 if (!rx_sc) { 2184 rtnl_unlock(); 2185 return -ENODEV; 2186 } 2187 2188 /* If h/w offloading is available, propagate to the device */ 2189 if (macsec_is_offloaded(netdev_priv(dev))) { 2190 const struct macsec_ops *ops; 2191 struct macsec_context ctx; 2192 2193 ops = macsec_get_ops(netdev_priv(dev), &ctx); 2194 if (!ops) { 2195 ret = -EOPNOTSUPP; 2196 goto cleanup; 2197 } 2198 2199 ctx.rx_sc = rx_sc; 2200 ctx.secy = secy; 2201 ret = macsec_offload(ops->mdo_del_rxsc, &ctx); 2202 if (ret) 2203 goto cleanup; 2204 } 2205 2206 free_rx_sc(rx_sc); 2207 rtnl_unlock(); 2208 2209 return 0; 2210 2211 cleanup: 2212 rtnl_unlock(); 2213 return ret; 2214 } 2215 2216 static int macsec_del_txsa(struct sk_buff *skb, struct genl_info *info) 2217 { 2218 struct nlattr **attrs = info->attrs; 2219 struct net_device *dev; 2220 struct macsec_secy *secy; 2221 struct macsec_tx_sc *tx_sc; 2222 struct macsec_tx_sa *tx_sa; 2223 u8 assoc_num; 2224 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1]; 2225 int ret; 2226 2227 if (!attrs[MACSEC_ATTR_IFINDEX]) 2228 return -EINVAL; 2229 2230 if (parse_sa_config(attrs, tb_sa)) 2231 return -EINVAL; 2232 2233 rtnl_lock(); 2234 tx_sa = get_txsa_from_nl(genl_info_net(info), attrs, tb_sa, 2235 &dev, &secy, &tx_sc, &assoc_num); 2236 if (IS_ERR(tx_sa)) { 2237 rtnl_unlock(); 2238 return PTR_ERR(tx_sa); 2239 } 2240 2241 if (tx_sa->active) { 2242 rtnl_unlock(); 2243 return -EBUSY; 2244 } 2245 2246 /* If h/w offloading is available, propagate to the device */ 2247 if (macsec_is_offloaded(netdev_priv(dev))) { 2248 const struct macsec_ops *ops; 2249 struct macsec_context ctx; 2250 2251 ops = macsec_get_ops(netdev_priv(dev), &ctx); 2252 if (!ops) { 2253 ret = -EOPNOTSUPP; 2254 goto cleanup; 2255 } 2256 2257 ctx.sa.assoc_num = assoc_num; 2258 ctx.sa.tx_sa = tx_sa; 2259 ctx.secy = secy; 2260 2261 ret = macsec_offload(ops->mdo_del_txsa, &ctx); 2262 if (ret) 2263 goto cleanup; 2264 } 2265 2266 RCU_INIT_POINTER(tx_sc->sa[assoc_num], NULL); 2267 clear_tx_sa(tx_sa); 2268 2269 rtnl_unlock(); 2270 2271 return 0; 2272 2273 cleanup: 2274 rtnl_unlock(); 2275 return ret; 2276 } 2277 2278 static bool validate_upd_sa(struct nlattr **attrs) 2279 { 2280 if (!attrs[MACSEC_SA_ATTR_AN] || 2281 attrs[MACSEC_SA_ATTR_KEY] || 2282 attrs[MACSEC_SA_ATTR_KEYID] || 2283 attrs[MACSEC_SA_ATTR_SSCI] || 2284 attrs[MACSEC_SA_ATTR_SALT]) 2285 return false; 2286 2287 if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN) 2288 return false; 2289 2290 if (attrs[MACSEC_SA_ATTR_PN] && nla_get_u32(attrs[MACSEC_SA_ATTR_PN]) == 0) 2291 return false; 2292 2293 if (attrs[MACSEC_SA_ATTR_ACTIVE]) { 2294 if (nla_get_u8(attrs[MACSEC_SA_ATTR_ACTIVE]) > 1) 2295 return false; 2296 } 2297 2298 return true; 2299 } 2300 2301 static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info) 2302 { 2303 struct nlattr **attrs = info->attrs; 2304 struct net_device *dev; 2305 struct macsec_secy *secy; 2306 struct macsec_tx_sc *tx_sc; 2307 struct macsec_tx_sa *tx_sa; 2308 u8 assoc_num; 2309 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1]; 2310 bool was_operational, was_active; 2311 pn_t prev_pn; 2312 int ret = 0; 2313 2314 prev_pn.full64 = 0; 2315 2316 if (!attrs[MACSEC_ATTR_IFINDEX]) 2317 return -EINVAL; 2318 2319 if (parse_sa_config(attrs, tb_sa)) 2320 return -EINVAL; 2321 2322 if (!validate_upd_sa(tb_sa)) 2323 return -EINVAL; 2324 2325 rtnl_lock(); 2326 tx_sa = get_txsa_from_nl(genl_info_net(info), attrs, tb_sa, 2327 &dev, &secy, &tx_sc, &assoc_num); 2328 if (IS_ERR(tx_sa)) { 2329 rtnl_unlock(); 2330 return PTR_ERR(tx_sa); 2331 } 2332 2333 if (tb_sa[MACSEC_SA_ATTR_PN]) { 2334 int pn_len; 2335 2336 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN; 2337 if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) { 2338 pr_notice("macsec: nl: upd_txsa: bad pn length: %d != %d\n", 2339 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len); 2340 rtnl_unlock(); 2341 return -EINVAL; 2342 } 2343 2344 spin_lock_bh(&tx_sa->lock); 2345 prev_pn = tx_sa->next_pn_halves; 2346 tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]); 2347 spin_unlock_bh(&tx_sa->lock); 2348 } 2349 2350 was_active = tx_sa->active; 2351 if (tb_sa[MACSEC_SA_ATTR_ACTIVE]) 2352 tx_sa->active = nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]); 2353 2354 was_operational = secy->operational; 2355 if (assoc_num == tx_sc->encoding_sa) 2356 secy->operational = tx_sa->active; 2357 2358 /* If h/w offloading is available, propagate to the device */ 2359 if (macsec_is_offloaded(netdev_priv(dev))) { 2360 const struct macsec_ops *ops; 2361 struct macsec_context ctx; 2362 2363 ops = macsec_get_ops(netdev_priv(dev), &ctx); 2364 if (!ops) { 2365 ret = -EOPNOTSUPP; 2366 goto cleanup; 2367 } 2368 2369 ctx.sa.assoc_num = assoc_num; 2370 ctx.sa.tx_sa = tx_sa; 2371 ctx.secy = secy; 2372 2373 ret = macsec_offload(ops->mdo_upd_txsa, &ctx); 2374 if (ret) 2375 goto cleanup; 2376 } 2377 2378 rtnl_unlock(); 2379 2380 return 0; 2381 2382 cleanup: 2383 if (tb_sa[MACSEC_SA_ATTR_PN]) { 2384 spin_lock_bh(&tx_sa->lock); 2385 tx_sa->next_pn_halves = prev_pn; 2386 spin_unlock_bh(&tx_sa->lock); 2387 } 2388 tx_sa->active = was_active; 2389 secy->operational = was_operational; 2390 rtnl_unlock(); 2391 return ret; 2392 } 2393 2394 static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info) 2395 { 2396 struct nlattr **attrs = info->attrs; 2397 struct net_device *dev; 2398 struct macsec_secy *secy; 2399 struct macsec_rx_sc *rx_sc; 2400 struct macsec_rx_sa *rx_sa; 2401 u8 assoc_num; 2402 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1]; 2403 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1]; 2404 bool was_active; 2405 pn_t prev_pn; 2406 int ret = 0; 2407 2408 prev_pn.full64 = 0; 2409 2410 if (!attrs[MACSEC_ATTR_IFINDEX]) 2411 return -EINVAL; 2412 2413 if (parse_rxsc_config(attrs, tb_rxsc)) 2414 return -EINVAL; 2415 2416 if (parse_sa_config(attrs, tb_sa)) 2417 return -EINVAL; 2418 2419 if (!validate_upd_sa(tb_sa)) 2420 return -EINVAL; 2421 2422 rtnl_lock(); 2423 rx_sa = get_rxsa_from_nl(genl_info_net(info), attrs, tb_rxsc, tb_sa, 2424 &dev, &secy, &rx_sc, &assoc_num); 2425 if (IS_ERR(rx_sa)) { 2426 rtnl_unlock(); 2427 return PTR_ERR(rx_sa); 2428 } 2429 2430 if (tb_sa[MACSEC_SA_ATTR_PN]) { 2431 int pn_len; 2432 2433 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN; 2434 if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) { 2435 pr_notice("macsec: nl: upd_rxsa: bad pn length: %d != %d\n", 2436 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len); 2437 rtnl_unlock(); 2438 return -EINVAL; 2439 } 2440 2441 spin_lock_bh(&rx_sa->lock); 2442 prev_pn = rx_sa->next_pn_halves; 2443 rx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]); 2444 spin_unlock_bh(&rx_sa->lock); 2445 } 2446 2447 was_active = rx_sa->active; 2448 if (tb_sa[MACSEC_SA_ATTR_ACTIVE]) 2449 rx_sa->active = nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]); 2450 2451 /* If h/w offloading is available, propagate to the device */ 2452 if (macsec_is_offloaded(netdev_priv(dev))) { 2453 const struct macsec_ops *ops; 2454 struct macsec_context ctx; 2455 2456 ops = macsec_get_ops(netdev_priv(dev), &ctx); 2457 if (!ops) { 2458 ret = -EOPNOTSUPP; 2459 goto cleanup; 2460 } 2461 2462 ctx.sa.assoc_num = assoc_num; 2463 ctx.sa.rx_sa = rx_sa; 2464 ctx.secy = secy; 2465 2466 ret = macsec_offload(ops->mdo_upd_rxsa, &ctx); 2467 if (ret) 2468 goto cleanup; 2469 } 2470 2471 rtnl_unlock(); 2472 return 0; 2473 2474 cleanup: 2475 if (tb_sa[MACSEC_SA_ATTR_PN]) { 2476 spin_lock_bh(&rx_sa->lock); 2477 rx_sa->next_pn_halves = prev_pn; 2478 spin_unlock_bh(&rx_sa->lock); 2479 } 2480 rx_sa->active = was_active; 2481 rtnl_unlock(); 2482 return ret; 2483 } 2484 2485 static int macsec_upd_rxsc(struct sk_buff *skb, struct genl_info *info) 2486 { 2487 struct nlattr **attrs = info->attrs; 2488 struct net_device *dev; 2489 struct macsec_secy *secy; 2490 struct macsec_rx_sc *rx_sc; 2491 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1]; 2492 unsigned int prev_n_rx_sc; 2493 bool was_active; 2494 int ret; 2495 2496 if (!attrs[MACSEC_ATTR_IFINDEX]) 2497 return -EINVAL; 2498 2499 if (parse_rxsc_config(attrs, tb_rxsc)) 2500 return -EINVAL; 2501 2502 if (!validate_add_rxsc(tb_rxsc)) 2503 return -EINVAL; 2504 2505 rtnl_lock(); 2506 rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy); 2507 if (IS_ERR(rx_sc)) { 2508 rtnl_unlock(); 2509 return PTR_ERR(rx_sc); 2510 } 2511 2512 was_active = rx_sc->active; 2513 prev_n_rx_sc = secy->n_rx_sc; 2514 if (tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]) { 2515 bool new = !!nla_get_u8(tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]); 2516 2517 if (rx_sc->active != new) 2518 secy->n_rx_sc += new ? 1 : -1; 2519 2520 rx_sc->active = new; 2521 } 2522 2523 /* If h/w offloading is available, propagate to the device */ 2524 if (macsec_is_offloaded(netdev_priv(dev))) { 2525 const struct macsec_ops *ops; 2526 struct macsec_context ctx; 2527 2528 ops = macsec_get_ops(netdev_priv(dev), &ctx); 2529 if (!ops) { 2530 ret = -EOPNOTSUPP; 2531 goto cleanup; 2532 } 2533 2534 ctx.rx_sc = rx_sc; 2535 ctx.secy = secy; 2536 2537 ret = macsec_offload(ops->mdo_upd_rxsc, &ctx); 2538 if (ret) 2539 goto cleanup; 2540 } 2541 2542 rtnl_unlock(); 2543 2544 return 0; 2545 2546 cleanup: 2547 secy->n_rx_sc = prev_n_rx_sc; 2548 rx_sc->active = was_active; 2549 rtnl_unlock(); 2550 return ret; 2551 } 2552 2553 static bool macsec_is_configured(struct macsec_dev *macsec) 2554 { 2555 struct macsec_secy *secy = &macsec->secy; 2556 struct macsec_tx_sc *tx_sc = &secy->tx_sc; 2557 int i; 2558 2559 if (secy->n_rx_sc > 0) 2560 return true; 2561 2562 for (i = 0; i < MACSEC_NUM_AN; i++) 2563 if (tx_sc->sa[i]) 2564 return true; 2565 2566 return false; 2567 } 2568 2569 static int macsec_upd_offload(struct sk_buff *skb, struct genl_info *info) 2570 { 2571 struct nlattr *tb_offload[MACSEC_OFFLOAD_ATTR_MAX + 1]; 2572 enum macsec_offload offload, prev_offload; 2573 int (*func)(struct macsec_context *ctx); 2574 struct nlattr **attrs = info->attrs; 2575 struct net_device *dev; 2576 const struct macsec_ops *ops; 2577 struct macsec_context ctx; 2578 struct macsec_dev *macsec; 2579 int ret; 2580 2581 if (!attrs[MACSEC_ATTR_IFINDEX]) 2582 return -EINVAL; 2583 2584 if (!attrs[MACSEC_ATTR_OFFLOAD]) 2585 return -EINVAL; 2586 2587 if (nla_parse_nested_deprecated(tb_offload, MACSEC_OFFLOAD_ATTR_MAX, 2588 attrs[MACSEC_ATTR_OFFLOAD], 2589 macsec_genl_offload_policy, NULL)) 2590 return -EINVAL; 2591 2592 dev = get_dev_from_nl(genl_info_net(info), attrs); 2593 if (IS_ERR(dev)) 2594 return PTR_ERR(dev); 2595 macsec = macsec_priv(dev); 2596 2597 if (!tb_offload[MACSEC_OFFLOAD_ATTR_TYPE]) 2598 return -EINVAL; 2599 2600 offload = nla_get_u8(tb_offload[MACSEC_OFFLOAD_ATTR_TYPE]); 2601 if (macsec->offload == offload) 2602 return 0; 2603 2604 /* Check if the offloading mode is supported by the underlying layers */ 2605 if (offload != MACSEC_OFFLOAD_OFF && 2606 !macsec_check_offload(offload, macsec)) 2607 return -EOPNOTSUPP; 2608 2609 /* Check if the net device is busy. */ 2610 if (netif_running(dev)) 2611 return -EBUSY; 2612 2613 rtnl_lock(); 2614 2615 prev_offload = macsec->offload; 2616 macsec->offload = offload; 2617 2618 /* Check if the device already has rules configured: we do not support 2619 * rules migration. 2620 */ 2621 if (macsec_is_configured(macsec)) { 2622 ret = -EBUSY; 2623 goto rollback; 2624 } 2625 2626 ops = __macsec_get_ops(offload == MACSEC_OFFLOAD_OFF ? prev_offload : offload, 2627 macsec, &ctx); 2628 if (!ops) { 2629 ret = -EOPNOTSUPP; 2630 goto rollback; 2631 } 2632 2633 if (prev_offload == MACSEC_OFFLOAD_OFF) 2634 func = ops->mdo_add_secy; 2635 else 2636 func = ops->mdo_del_secy; 2637 2638 ctx.secy = &macsec->secy; 2639 ret = macsec_offload(func, &ctx); 2640 if (ret) 2641 goto rollback; 2642 2643 rtnl_unlock(); 2644 /* Force features update, since they are different for SW MACSec and 2645 * HW offloading cases. 2646 */ 2647 netdev_update_features(dev); 2648 return 0; 2649 2650 rollback: 2651 macsec->offload = prev_offload; 2652 2653 rtnl_unlock(); 2654 return ret; 2655 } 2656 2657 static void get_tx_sa_stats(struct net_device *dev, int an, 2658 struct macsec_tx_sa *tx_sa, 2659 struct macsec_tx_sa_stats *sum) 2660 { 2661 struct macsec_dev *macsec = macsec_priv(dev); 2662 int cpu; 2663 2664 /* If h/w offloading is available, propagate to the device */ 2665 if (macsec_is_offloaded(macsec)) { 2666 const struct macsec_ops *ops; 2667 struct macsec_context ctx; 2668 2669 ops = macsec_get_ops(macsec, &ctx); 2670 if (ops) { 2671 ctx.sa.assoc_num = an; 2672 ctx.sa.tx_sa = tx_sa; 2673 ctx.stats.tx_sa_stats = sum; 2674 ctx.secy = &macsec_priv(dev)->secy; 2675 macsec_offload(ops->mdo_get_tx_sa_stats, &ctx); 2676 } 2677 return; 2678 } 2679 2680 for_each_possible_cpu(cpu) { 2681 const struct macsec_tx_sa_stats *stats = 2682 per_cpu_ptr(tx_sa->stats, cpu); 2683 2684 sum->OutPktsProtected += stats->OutPktsProtected; 2685 sum->OutPktsEncrypted += stats->OutPktsEncrypted; 2686 } 2687 } 2688 2689 static int copy_tx_sa_stats(struct sk_buff *skb, struct macsec_tx_sa_stats *sum) 2690 { 2691 if (nla_put_u32(skb, MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED, 2692 sum->OutPktsProtected) || 2693 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED, 2694 sum->OutPktsEncrypted)) 2695 return -EMSGSIZE; 2696 2697 return 0; 2698 } 2699 2700 static void get_rx_sa_stats(struct net_device *dev, 2701 struct macsec_rx_sc *rx_sc, int an, 2702 struct macsec_rx_sa *rx_sa, 2703 struct macsec_rx_sa_stats *sum) 2704 { 2705 struct macsec_dev *macsec = macsec_priv(dev); 2706 int cpu; 2707 2708 /* If h/w offloading is available, propagate to the device */ 2709 if (macsec_is_offloaded(macsec)) { 2710 const struct macsec_ops *ops; 2711 struct macsec_context ctx; 2712 2713 ops = macsec_get_ops(macsec, &ctx); 2714 if (ops) { 2715 ctx.sa.assoc_num = an; 2716 ctx.sa.rx_sa = rx_sa; 2717 ctx.stats.rx_sa_stats = sum; 2718 ctx.secy = &macsec_priv(dev)->secy; 2719 ctx.rx_sc = rx_sc; 2720 macsec_offload(ops->mdo_get_rx_sa_stats, &ctx); 2721 } 2722 return; 2723 } 2724 2725 for_each_possible_cpu(cpu) { 2726 const struct macsec_rx_sa_stats *stats = 2727 per_cpu_ptr(rx_sa->stats, cpu); 2728 2729 sum->InPktsOK += stats->InPktsOK; 2730 sum->InPktsInvalid += stats->InPktsInvalid; 2731 sum->InPktsNotValid += stats->InPktsNotValid; 2732 sum->InPktsNotUsingSA += stats->InPktsNotUsingSA; 2733 sum->InPktsUnusedSA += stats->InPktsUnusedSA; 2734 } 2735 } 2736 2737 static int copy_rx_sa_stats(struct sk_buff *skb, 2738 struct macsec_rx_sa_stats *sum) 2739 { 2740 if (nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_OK, sum->InPktsOK) || 2741 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID, 2742 sum->InPktsInvalid) || 2743 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID, 2744 sum->InPktsNotValid) || 2745 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA, 2746 sum->InPktsNotUsingSA) || 2747 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA, 2748 sum->InPktsUnusedSA)) 2749 return -EMSGSIZE; 2750 2751 return 0; 2752 } 2753 2754 static void get_rx_sc_stats(struct net_device *dev, 2755 struct macsec_rx_sc *rx_sc, 2756 struct macsec_rx_sc_stats *sum) 2757 { 2758 struct macsec_dev *macsec = macsec_priv(dev); 2759 int cpu; 2760 2761 /* If h/w offloading is available, propagate to the device */ 2762 if (macsec_is_offloaded(macsec)) { 2763 const struct macsec_ops *ops; 2764 struct macsec_context ctx; 2765 2766 ops = macsec_get_ops(macsec, &ctx); 2767 if (ops) { 2768 ctx.stats.rx_sc_stats = sum; 2769 ctx.secy = &macsec_priv(dev)->secy; 2770 ctx.rx_sc = rx_sc; 2771 macsec_offload(ops->mdo_get_rx_sc_stats, &ctx); 2772 } 2773 return; 2774 } 2775 2776 for_each_possible_cpu(cpu) { 2777 const struct pcpu_rx_sc_stats *stats; 2778 struct macsec_rx_sc_stats tmp; 2779 unsigned int start; 2780 2781 stats = per_cpu_ptr(rx_sc->stats, cpu); 2782 do { 2783 start = u64_stats_fetch_begin_irq(&stats->syncp); 2784 memcpy(&tmp, &stats->stats, sizeof(tmp)); 2785 } while (u64_stats_fetch_retry_irq(&stats->syncp, start)); 2786 2787 sum->InOctetsValidated += tmp.InOctetsValidated; 2788 sum->InOctetsDecrypted += tmp.InOctetsDecrypted; 2789 sum->InPktsUnchecked += tmp.InPktsUnchecked; 2790 sum->InPktsDelayed += tmp.InPktsDelayed; 2791 sum->InPktsOK += tmp.InPktsOK; 2792 sum->InPktsInvalid += tmp.InPktsInvalid; 2793 sum->InPktsLate += tmp.InPktsLate; 2794 sum->InPktsNotValid += tmp.InPktsNotValid; 2795 sum->InPktsNotUsingSA += tmp.InPktsNotUsingSA; 2796 sum->InPktsUnusedSA += tmp.InPktsUnusedSA; 2797 } 2798 } 2799 2800 static int copy_rx_sc_stats(struct sk_buff *skb, struct macsec_rx_sc_stats *sum) 2801 { 2802 if (nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED, 2803 sum->InOctetsValidated, 2804 MACSEC_RXSC_STATS_ATTR_PAD) || 2805 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED, 2806 sum->InOctetsDecrypted, 2807 MACSEC_RXSC_STATS_ATTR_PAD) || 2808 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED, 2809 sum->InPktsUnchecked, 2810 MACSEC_RXSC_STATS_ATTR_PAD) || 2811 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED, 2812 sum->InPktsDelayed, 2813 MACSEC_RXSC_STATS_ATTR_PAD) || 2814 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK, 2815 sum->InPktsOK, 2816 MACSEC_RXSC_STATS_ATTR_PAD) || 2817 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID, 2818 sum->InPktsInvalid, 2819 MACSEC_RXSC_STATS_ATTR_PAD) || 2820 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE, 2821 sum->InPktsLate, 2822 MACSEC_RXSC_STATS_ATTR_PAD) || 2823 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID, 2824 sum->InPktsNotValid, 2825 MACSEC_RXSC_STATS_ATTR_PAD) || 2826 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA, 2827 sum->InPktsNotUsingSA, 2828 MACSEC_RXSC_STATS_ATTR_PAD) || 2829 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA, 2830 sum->InPktsUnusedSA, 2831 MACSEC_RXSC_STATS_ATTR_PAD)) 2832 return -EMSGSIZE; 2833 2834 return 0; 2835 } 2836 2837 static void get_tx_sc_stats(struct net_device *dev, 2838 struct macsec_tx_sc_stats *sum) 2839 { 2840 struct macsec_dev *macsec = macsec_priv(dev); 2841 int cpu; 2842 2843 /* If h/w offloading is available, propagate to the device */ 2844 if (macsec_is_offloaded(macsec)) { 2845 const struct macsec_ops *ops; 2846 struct macsec_context ctx; 2847 2848 ops = macsec_get_ops(macsec, &ctx); 2849 if (ops) { 2850 ctx.stats.tx_sc_stats = sum; 2851 ctx.secy = &macsec_priv(dev)->secy; 2852 macsec_offload(ops->mdo_get_tx_sc_stats, &ctx); 2853 } 2854 return; 2855 } 2856 2857 for_each_possible_cpu(cpu) { 2858 const struct pcpu_tx_sc_stats *stats; 2859 struct macsec_tx_sc_stats tmp; 2860 unsigned int start; 2861 2862 stats = per_cpu_ptr(macsec_priv(dev)->secy.tx_sc.stats, cpu); 2863 do { 2864 start = u64_stats_fetch_begin_irq(&stats->syncp); 2865 memcpy(&tmp, &stats->stats, sizeof(tmp)); 2866 } while (u64_stats_fetch_retry_irq(&stats->syncp, start)); 2867 2868 sum->OutPktsProtected += tmp.OutPktsProtected; 2869 sum->OutPktsEncrypted += tmp.OutPktsEncrypted; 2870 sum->OutOctetsProtected += tmp.OutOctetsProtected; 2871 sum->OutOctetsEncrypted += tmp.OutOctetsEncrypted; 2872 } 2873 } 2874 2875 static int copy_tx_sc_stats(struct sk_buff *skb, struct macsec_tx_sc_stats *sum) 2876 { 2877 if (nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED, 2878 sum->OutPktsProtected, 2879 MACSEC_TXSC_STATS_ATTR_PAD) || 2880 nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED, 2881 sum->OutPktsEncrypted, 2882 MACSEC_TXSC_STATS_ATTR_PAD) || 2883 nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED, 2884 sum->OutOctetsProtected, 2885 MACSEC_TXSC_STATS_ATTR_PAD) || 2886 nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED, 2887 sum->OutOctetsEncrypted, 2888 MACSEC_TXSC_STATS_ATTR_PAD)) 2889 return -EMSGSIZE; 2890 2891 return 0; 2892 } 2893 2894 static void get_secy_stats(struct net_device *dev, struct macsec_dev_stats *sum) 2895 { 2896 struct macsec_dev *macsec = macsec_priv(dev); 2897 int cpu; 2898 2899 /* If h/w offloading is available, propagate to the device */ 2900 if (macsec_is_offloaded(macsec)) { 2901 const struct macsec_ops *ops; 2902 struct macsec_context ctx; 2903 2904 ops = macsec_get_ops(macsec, &ctx); 2905 if (ops) { 2906 ctx.stats.dev_stats = sum; 2907 ctx.secy = &macsec_priv(dev)->secy; 2908 macsec_offload(ops->mdo_get_dev_stats, &ctx); 2909 } 2910 return; 2911 } 2912 2913 for_each_possible_cpu(cpu) { 2914 const struct pcpu_secy_stats *stats; 2915 struct macsec_dev_stats tmp; 2916 unsigned int start; 2917 2918 stats = per_cpu_ptr(macsec_priv(dev)->stats, cpu); 2919 do { 2920 start = u64_stats_fetch_begin_irq(&stats->syncp); 2921 memcpy(&tmp, &stats->stats, sizeof(tmp)); 2922 } while (u64_stats_fetch_retry_irq(&stats->syncp, start)); 2923 2924 sum->OutPktsUntagged += tmp.OutPktsUntagged; 2925 sum->InPktsUntagged += tmp.InPktsUntagged; 2926 sum->OutPktsTooLong += tmp.OutPktsTooLong; 2927 sum->InPktsNoTag += tmp.InPktsNoTag; 2928 sum->InPktsBadTag += tmp.InPktsBadTag; 2929 sum->InPktsUnknownSCI += tmp.InPktsUnknownSCI; 2930 sum->InPktsNoSCI += tmp.InPktsNoSCI; 2931 sum->InPktsOverrun += tmp.InPktsOverrun; 2932 } 2933 } 2934 2935 static int copy_secy_stats(struct sk_buff *skb, struct macsec_dev_stats *sum) 2936 { 2937 if (nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED, 2938 sum->OutPktsUntagged, 2939 MACSEC_SECY_STATS_ATTR_PAD) || 2940 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED, 2941 sum->InPktsUntagged, 2942 MACSEC_SECY_STATS_ATTR_PAD) || 2943 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG, 2944 sum->OutPktsTooLong, 2945 MACSEC_SECY_STATS_ATTR_PAD) || 2946 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG, 2947 sum->InPktsNoTag, 2948 MACSEC_SECY_STATS_ATTR_PAD) || 2949 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG, 2950 sum->InPktsBadTag, 2951 MACSEC_SECY_STATS_ATTR_PAD) || 2952 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI, 2953 sum->InPktsUnknownSCI, 2954 MACSEC_SECY_STATS_ATTR_PAD) || 2955 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI, 2956 sum->InPktsNoSCI, 2957 MACSEC_SECY_STATS_ATTR_PAD) || 2958 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN, 2959 sum->InPktsOverrun, 2960 MACSEC_SECY_STATS_ATTR_PAD)) 2961 return -EMSGSIZE; 2962 2963 return 0; 2964 } 2965 2966 static int nla_put_secy(struct macsec_secy *secy, struct sk_buff *skb) 2967 { 2968 struct macsec_tx_sc *tx_sc = &secy->tx_sc; 2969 struct nlattr *secy_nest = nla_nest_start_noflag(skb, 2970 MACSEC_ATTR_SECY); 2971 u64 csid; 2972 2973 if (!secy_nest) 2974 return 1; 2975 2976 switch (secy->key_len) { 2977 case MACSEC_GCM_AES_128_SAK_LEN: 2978 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID; 2979 break; 2980 case MACSEC_GCM_AES_256_SAK_LEN: 2981 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256; 2982 break; 2983 default: 2984 goto cancel; 2985 } 2986 2987 if (nla_put_sci(skb, MACSEC_SECY_ATTR_SCI, secy->sci, 2988 MACSEC_SECY_ATTR_PAD) || 2989 nla_put_u64_64bit(skb, MACSEC_SECY_ATTR_CIPHER_SUITE, 2990 csid, MACSEC_SECY_ATTR_PAD) || 2991 nla_put_u8(skb, MACSEC_SECY_ATTR_ICV_LEN, secy->icv_len) || 2992 nla_put_u8(skb, MACSEC_SECY_ATTR_OPER, secy->operational) || 2993 nla_put_u8(skb, MACSEC_SECY_ATTR_PROTECT, secy->protect_frames) || 2994 nla_put_u8(skb, MACSEC_SECY_ATTR_REPLAY, secy->replay_protect) || 2995 nla_put_u8(skb, MACSEC_SECY_ATTR_VALIDATE, secy->validate_frames) || 2996 nla_put_u8(skb, MACSEC_SECY_ATTR_ENCRYPT, tx_sc->encrypt) || 2997 nla_put_u8(skb, MACSEC_SECY_ATTR_INC_SCI, tx_sc->send_sci) || 2998 nla_put_u8(skb, MACSEC_SECY_ATTR_ES, tx_sc->end_station) || 2999 nla_put_u8(skb, MACSEC_SECY_ATTR_SCB, tx_sc->scb) || 3000 nla_put_u8(skb, MACSEC_SECY_ATTR_ENCODING_SA, tx_sc->encoding_sa)) 3001 goto cancel; 3002 3003 if (secy->replay_protect) { 3004 if (nla_put_u32(skb, MACSEC_SECY_ATTR_WINDOW, secy->replay_window)) 3005 goto cancel; 3006 } 3007 3008 nla_nest_end(skb, secy_nest); 3009 return 0; 3010 3011 cancel: 3012 nla_nest_cancel(skb, secy_nest); 3013 return 1; 3014 } 3015 3016 static noinline_for_stack int 3017 dump_secy(struct macsec_secy *secy, struct net_device *dev, 3018 struct sk_buff *skb, struct netlink_callback *cb) 3019 { 3020 struct macsec_tx_sc_stats tx_sc_stats = {0, }; 3021 struct macsec_tx_sa_stats tx_sa_stats = {0, }; 3022 struct macsec_rx_sc_stats rx_sc_stats = {0, }; 3023 struct macsec_rx_sa_stats rx_sa_stats = {0, }; 3024 struct macsec_dev *macsec = netdev_priv(dev); 3025 struct macsec_dev_stats dev_stats = {0, }; 3026 struct macsec_tx_sc *tx_sc = &secy->tx_sc; 3027 struct nlattr *txsa_list, *rxsc_list; 3028 struct macsec_rx_sc *rx_sc; 3029 struct nlattr *attr; 3030 void *hdr; 3031 int i, j; 3032 3033 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, 3034 &macsec_fam, NLM_F_MULTI, MACSEC_CMD_GET_TXSC); 3035 if (!hdr) 3036 return -EMSGSIZE; 3037 3038 genl_dump_check_consistent(cb, hdr); 3039 3040 if (nla_put_u32(skb, MACSEC_ATTR_IFINDEX, dev->ifindex)) 3041 goto nla_put_failure; 3042 3043 attr = nla_nest_start_noflag(skb, MACSEC_ATTR_OFFLOAD); 3044 if (!attr) 3045 goto nla_put_failure; 3046 if (nla_put_u8(skb, MACSEC_OFFLOAD_ATTR_TYPE, macsec->offload)) 3047 goto nla_put_failure; 3048 nla_nest_end(skb, attr); 3049 3050 if (nla_put_secy(secy, skb)) 3051 goto nla_put_failure; 3052 3053 attr = nla_nest_start_noflag(skb, MACSEC_ATTR_TXSC_STATS); 3054 if (!attr) 3055 goto nla_put_failure; 3056 3057 get_tx_sc_stats(dev, &tx_sc_stats); 3058 if (copy_tx_sc_stats(skb, &tx_sc_stats)) { 3059 nla_nest_cancel(skb, attr); 3060 goto nla_put_failure; 3061 } 3062 nla_nest_end(skb, attr); 3063 3064 attr = nla_nest_start_noflag(skb, MACSEC_ATTR_SECY_STATS); 3065 if (!attr) 3066 goto nla_put_failure; 3067 get_secy_stats(dev, &dev_stats); 3068 if (copy_secy_stats(skb, &dev_stats)) { 3069 nla_nest_cancel(skb, attr); 3070 goto nla_put_failure; 3071 } 3072 nla_nest_end(skb, attr); 3073 3074 txsa_list = nla_nest_start_noflag(skb, MACSEC_ATTR_TXSA_LIST); 3075 if (!txsa_list) 3076 goto nla_put_failure; 3077 for (i = 0, j = 1; i < MACSEC_NUM_AN; i++) { 3078 struct macsec_tx_sa *tx_sa = rtnl_dereference(tx_sc->sa[i]); 3079 struct nlattr *txsa_nest; 3080 u64 pn; 3081 int pn_len; 3082 3083 if (!tx_sa) 3084 continue; 3085 3086 txsa_nest = nla_nest_start_noflag(skb, j++); 3087 if (!txsa_nest) { 3088 nla_nest_cancel(skb, txsa_list); 3089 goto nla_put_failure; 3090 } 3091 3092 attr = nla_nest_start_noflag(skb, MACSEC_SA_ATTR_STATS); 3093 if (!attr) { 3094 nla_nest_cancel(skb, txsa_nest); 3095 nla_nest_cancel(skb, txsa_list); 3096 goto nla_put_failure; 3097 } 3098 memset(&tx_sa_stats, 0, sizeof(tx_sa_stats)); 3099 get_tx_sa_stats(dev, i, tx_sa, &tx_sa_stats); 3100 if (copy_tx_sa_stats(skb, &tx_sa_stats)) { 3101 nla_nest_cancel(skb, attr); 3102 nla_nest_cancel(skb, txsa_nest); 3103 nla_nest_cancel(skb, txsa_list); 3104 goto nla_put_failure; 3105 } 3106 nla_nest_end(skb, attr); 3107 3108 if (secy->xpn) { 3109 pn = tx_sa->next_pn; 3110 pn_len = MACSEC_XPN_PN_LEN; 3111 } else { 3112 pn = tx_sa->next_pn_halves.lower; 3113 pn_len = MACSEC_DEFAULT_PN_LEN; 3114 } 3115 3116 if (nla_put_u8(skb, MACSEC_SA_ATTR_AN, i) || 3117 nla_put(skb, MACSEC_SA_ATTR_PN, pn_len, &pn) || 3118 nla_put(skb, MACSEC_SA_ATTR_KEYID, MACSEC_KEYID_LEN, tx_sa->key.id) || 3119 (secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, tx_sa->ssci)) || 3120 nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, tx_sa->active)) { 3121 nla_nest_cancel(skb, txsa_nest); 3122 nla_nest_cancel(skb, txsa_list); 3123 goto nla_put_failure; 3124 } 3125 3126 nla_nest_end(skb, txsa_nest); 3127 } 3128 nla_nest_end(skb, txsa_list); 3129 3130 rxsc_list = nla_nest_start_noflag(skb, MACSEC_ATTR_RXSC_LIST); 3131 if (!rxsc_list) 3132 goto nla_put_failure; 3133 3134 j = 1; 3135 for_each_rxsc_rtnl(secy, rx_sc) { 3136 int k; 3137 struct nlattr *rxsa_list; 3138 struct nlattr *rxsc_nest = nla_nest_start_noflag(skb, j++); 3139 3140 if (!rxsc_nest) { 3141 nla_nest_cancel(skb, rxsc_list); 3142 goto nla_put_failure; 3143 } 3144 3145 if (nla_put_u8(skb, MACSEC_RXSC_ATTR_ACTIVE, rx_sc->active) || 3146 nla_put_sci(skb, MACSEC_RXSC_ATTR_SCI, rx_sc->sci, 3147 MACSEC_RXSC_ATTR_PAD)) { 3148 nla_nest_cancel(skb, rxsc_nest); 3149 nla_nest_cancel(skb, rxsc_list); 3150 goto nla_put_failure; 3151 } 3152 3153 attr = nla_nest_start_noflag(skb, MACSEC_RXSC_ATTR_STATS); 3154 if (!attr) { 3155 nla_nest_cancel(skb, rxsc_nest); 3156 nla_nest_cancel(skb, rxsc_list); 3157 goto nla_put_failure; 3158 } 3159 memset(&rx_sc_stats, 0, sizeof(rx_sc_stats)); 3160 get_rx_sc_stats(dev, rx_sc, &rx_sc_stats); 3161 if (copy_rx_sc_stats(skb, &rx_sc_stats)) { 3162 nla_nest_cancel(skb, attr); 3163 nla_nest_cancel(skb, rxsc_nest); 3164 nla_nest_cancel(skb, rxsc_list); 3165 goto nla_put_failure; 3166 } 3167 nla_nest_end(skb, attr); 3168 3169 rxsa_list = nla_nest_start_noflag(skb, 3170 MACSEC_RXSC_ATTR_SA_LIST); 3171 if (!rxsa_list) { 3172 nla_nest_cancel(skb, rxsc_nest); 3173 nla_nest_cancel(skb, rxsc_list); 3174 goto nla_put_failure; 3175 } 3176 3177 for (i = 0, k = 1; i < MACSEC_NUM_AN; i++) { 3178 struct macsec_rx_sa *rx_sa = rtnl_dereference(rx_sc->sa[i]); 3179 struct nlattr *rxsa_nest; 3180 u64 pn; 3181 int pn_len; 3182 3183 if (!rx_sa) 3184 continue; 3185 3186 rxsa_nest = nla_nest_start_noflag(skb, k++); 3187 if (!rxsa_nest) { 3188 nla_nest_cancel(skb, rxsa_list); 3189 nla_nest_cancel(skb, rxsc_nest); 3190 nla_nest_cancel(skb, rxsc_list); 3191 goto nla_put_failure; 3192 } 3193 3194 attr = nla_nest_start_noflag(skb, 3195 MACSEC_SA_ATTR_STATS); 3196 if (!attr) { 3197 nla_nest_cancel(skb, rxsa_list); 3198 nla_nest_cancel(skb, rxsc_nest); 3199 nla_nest_cancel(skb, rxsc_list); 3200 goto nla_put_failure; 3201 } 3202 memset(&rx_sa_stats, 0, sizeof(rx_sa_stats)); 3203 get_rx_sa_stats(dev, rx_sc, i, rx_sa, &rx_sa_stats); 3204 if (copy_rx_sa_stats(skb, &rx_sa_stats)) { 3205 nla_nest_cancel(skb, attr); 3206 nla_nest_cancel(skb, rxsa_list); 3207 nla_nest_cancel(skb, rxsc_nest); 3208 nla_nest_cancel(skb, rxsc_list); 3209 goto nla_put_failure; 3210 } 3211 nla_nest_end(skb, attr); 3212 3213 if (secy->xpn) { 3214 pn = rx_sa->next_pn; 3215 pn_len = MACSEC_XPN_PN_LEN; 3216 } else { 3217 pn = rx_sa->next_pn_halves.lower; 3218 pn_len = MACSEC_DEFAULT_PN_LEN; 3219 } 3220 3221 if (nla_put_u8(skb, MACSEC_SA_ATTR_AN, i) || 3222 nla_put(skb, MACSEC_SA_ATTR_PN, pn_len, &pn) || 3223 nla_put(skb, MACSEC_SA_ATTR_KEYID, MACSEC_KEYID_LEN, rx_sa->key.id) || 3224 (secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, rx_sa->ssci)) || 3225 nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, rx_sa->active)) { 3226 nla_nest_cancel(skb, rxsa_nest); 3227 nla_nest_cancel(skb, rxsc_nest); 3228 nla_nest_cancel(skb, rxsc_list); 3229 goto nla_put_failure; 3230 } 3231 nla_nest_end(skb, rxsa_nest); 3232 } 3233 3234 nla_nest_end(skb, rxsa_list); 3235 nla_nest_end(skb, rxsc_nest); 3236 } 3237 3238 nla_nest_end(skb, rxsc_list); 3239 3240 genlmsg_end(skb, hdr); 3241 3242 return 0; 3243 3244 nla_put_failure: 3245 genlmsg_cancel(skb, hdr); 3246 return -EMSGSIZE; 3247 } 3248 3249 static int macsec_generation = 1; /* protected by RTNL */ 3250 3251 static int macsec_dump_txsc(struct sk_buff *skb, struct netlink_callback *cb) 3252 { 3253 struct net *net = sock_net(skb->sk); 3254 struct net_device *dev; 3255 int dev_idx, d; 3256 3257 dev_idx = cb->args[0]; 3258 3259 d = 0; 3260 rtnl_lock(); 3261 3262 cb->seq = macsec_generation; 3263 3264 for_each_netdev(net, dev) { 3265 struct macsec_secy *secy; 3266 3267 if (d < dev_idx) 3268 goto next; 3269 3270 if (!netif_is_macsec(dev)) 3271 goto next; 3272 3273 secy = &macsec_priv(dev)->secy; 3274 if (dump_secy(secy, dev, skb, cb) < 0) 3275 goto done; 3276 next: 3277 d++; 3278 } 3279 3280 done: 3281 rtnl_unlock(); 3282 cb->args[0] = d; 3283 return skb->len; 3284 } 3285 3286 static const struct genl_ops macsec_genl_ops[] = { 3287 { 3288 .cmd = MACSEC_CMD_GET_TXSC, 3289 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 3290 .dumpit = macsec_dump_txsc, 3291 }, 3292 { 3293 .cmd = MACSEC_CMD_ADD_RXSC, 3294 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 3295 .doit = macsec_add_rxsc, 3296 .flags = GENL_ADMIN_PERM, 3297 }, 3298 { 3299 .cmd = MACSEC_CMD_DEL_RXSC, 3300 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 3301 .doit = macsec_del_rxsc, 3302 .flags = GENL_ADMIN_PERM, 3303 }, 3304 { 3305 .cmd = MACSEC_CMD_UPD_RXSC, 3306 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 3307 .doit = macsec_upd_rxsc, 3308 .flags = GENL_ADMIN_PERM, 3309 }, 3310 { 3311 .cmd = MACSEC_CMD_ADD_TXSA, 3312 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 3313 .doit = macsec_add_txsa, 3314 .flags = GENL_ADMIN_PERM, 3315 }, 3316 { 3317 .cmd = MACSEC_CMD_DEL_TXSA, 3318 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 3319 .doit = macsec_del_txsa, 3320 .flags = GENL_ADMIN_PERM, 3321 }, 3322 { 3323 .cmd = MACSEC_CMD_UPD_TXSA, 3324 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 3325 .doit = macsec_upd_txsa, 3326 .flags = GENL_ADMIN_PERM, 3327 }, 3328 { 3329 .cmd = MACSEC_CMD_ADD_RXSA, 3330 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 3331 .doit = macsec_add_rxsa, 3332 .flags = GENL_ADMIN_PERM, 3333 }, 3334 { 3335 .cmd = MACSEC_CMD_DEL_RXSA, 3336 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 3337 .doit = macsec_del_rxsa, 3338 .flags = GENL_ADMIN_PERM, 3339 }, 3340 { 3341 .cmd = MACSEC_CMD_UPD_RXSA, 3342 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 3343 .doit = macsec_upd_rxsa, 3344 .flags = GENL_ADMIN_PERM, 3345 }, 3346 { 3347 .cmd = MACSEC_CMD_UPD_OFFLOAD, 3348 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 3349 .doit = macsec_upd_offload, 3350 .flags = GENL_ADMIN_PERM, 3351 }, 3352 }; 3353 3354 static struct genl_family macsec_fam __ro_after_init = { 3355 .name = MACSEC_GENL_NAME, 3356 .hdrsize = 0, 3357 .version = MACSEC_GENL_VERSION, 3358 .maxattr = MACSEC_ATTR_MAX, 3359 .policy = macsec_genl_policy, 3360 .netnsok = true, 3361 .module = THIS_MODULE, 3362 .ops = macsec_genl_ops, 3363 .n_ops = ARRAY_SIZE(macsec_genl_ops), 3364 }; 3365 3366 static netdev_tx_t macsec_start_xmit(struct sk_buff *skb, 3367 struct net_device *dev) 3368 { 3369 struct macsec_dev *macsec = netdev_priv(dev); 3370 struct macsec_secy *secy = &macsec->secy; 3371 struct pcpu_secy_stats *secy_stats; 3372 int ret, len; 3373 3374 if (macsec_is_offloaded(netdev_priv(dev))) { 3375 skb->dev = macsec->real_dev; 3376 return dev_queue_xmit(skb); 3377 } 3378 3379 /* 10.5 */ 3380 if (!secy->protect_frames) { 3381 secy_stats = this_cpu_ptr(macsec->stats); 3382 u64_stats_update_begin(&secy_stats->syncp); 3383 secy_stats->stats.OutPktsUntagged++; 3384 u64_stats_update_end(&secy_stats->syncp); 3385 skb->dev = macsec->real_dev; 3386 len = skb->len; 3387 ret = dev_queue_xmit(skb); 3388 count_tx(dev, ret, len); 3389 return ret; 3390 } 3391 3392 if (!secy->operational) { 3393 kfree_skb(skb); 3394 dev->stats.tx_dropped++; 3395 return NETDEV_TX_OK; 3396 } 3397 3398 skb = macsec_encrypt(skb, dev); 3399 if (IS_ERR(skb)) { 3400 if (PTR_ERR(skb) != -EINPROGRESS) 3401 dev->stats.tx_dropped++; 3402 return NETDEV_TX_OK; 3403 } 3404 3405 macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa); 3406 3407 macsec_encrypt_finish(skb, dev); 3408 len = skb->len; 3409 ret = dev_queue_xmit(skb); 3410 count_tx(dev, ret, len); 3411 return ret; 3412 } 3413 3414 #define SW_MACSEC_FEATURES \ 3415 (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST) 3416 3417 /* If h/w offloading is enabled, use real device features save for 3418 * VLAN_FEATURES - they require additional ops 3419 * HW_MACSEC - no reason to report it 3420 */ 3421 #define REAL_DEV_FEATURES(dev) \ 3422 ((dev)->features & ~(NETIF_F_VLAN_FEATURES | NETIF_F_HW_MACSEC)) 3423 3424 static int macsec_dev_init(struct net_device *dev) 3425 { 3426 struct macsec_dev *macsec = macsec_priv(dev); 3427 struct net_device *real_dev = macsec->real_dev; 3428 int err; 3429 3430 dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); 3431 if (!dev->tstats) 3432 return -ENOMEM; 3433 3434 err = gro_cells_init(&macsec->gro_cells, dev); 3435 if (err) { 3436 free_percpu(dev->tstats); 3437 return err; 3438 } 3439 3440 if (macsec_is_offloaded(macsec)) { 3441 dev->features = REAL_DEV_FEATURES(real_dev); 3442 } else { 3443 dev->features = real_dev->features & SW_MACSEC_FEATURES; 3444 dev->features |= NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE; 3445 } 3446 3447 dev->needed_headroom = real_dev->needed_headroom + 3448 MACSEC_NEEDED_HEADROOM; 3449 dev->needed_tailroom = real_dev->needed_tailroom + 3450 MACSEC_NEEDED_TAILROOM; 3451 3452 if (is_zero_ether_addr(dev->dev_addr)) 3453 eth_hw_addr_inherit(dev, real_dev); 3454 if (is_zero_ether_addr(dev->broadcast)) 3455 memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len); 3456 3457 return 0; 3458 } 3459 3460 static void macsec_dev_uninit(struct net_device *dev) 3461 { 3462 struct macsec_dev *macsec = macsec_priv(dev); 3463 3464 gro_cells_destroy(&macsec->gro_cells); 3465 free_percpu(dev->tstats); 3466 } 3467 3468 static netdev_features_t macsec_fix_features(struct net_device *dev, 3469 netdev_features_t features) 3470 { 3471 struct macsec_dev *macsec = macsec_priv(dev); 3472 struct net_device *real_dev = macsec->real_dev; 3473 3474 if (macsec_is_offloaded(macsec)) 3475 return REAL_DEV_FEATURES(real_dev); 3476 3477 features &= (real_dev->features & SW_MACSEC_FEATURES) | 3478 NETIF_F_GSO_SOFTWARE | NETIF_F_SOFT_FEATURES; 3479 features |= NETIF_F_LLTX; 3480 3481 return features; 3482 } 3483 3484 static int macsec_dev_open(struct net_device *dev) 3485 { 3486 struct macsec_dev *macsec = macsec_priv(dev); 3487 struct net_device *real_dev = macsec->real_dev; 3488 int err; 3489 3490 err = dev_uc_add(real_dev, dev->dev_addr); 3491 if (err < 0) 3492 return err; 3493 3494 if (dev->flags & IFF_ALLMULTI) { 3495 err = dev_set_allmulti(real_dev, 1); 3496 if (err < 0) 3497 goto del_unicast; 3498 } 3499 3500 if (dev->flags & IFF_PROMISC) { 3501 err = dev_set_promiscuity(real_dev, 1); 3502 if (err < 0) 3503 goto clear_allmulti; 3504 } 3505 3506 /* If h/w offloading is available, propagate to the device */ 3507 if (macsec_is_offloaded(macsec)) { 3508 const struct macsec_ops *ops; 3509 struct macsec_context ctx; 3510 3511 ops = macsec_get_ops(netdev_priv(dev), &ctx); 3512 if (!ops) { 3513 err = -EOPNOTSUPP; 3514 goto clear_allmulti; 3515 } 3516 3517 ctx.secy = &macsec->secy; 3518 err = macsec_offload(ops->mdo_dev_open, &ctx); 3519 if (err) 3520 goto clear_allmulti; 3521 } 3522 3523 if (netif_carrier_ok(real_dev)) 3524 netif_carrier_on(dev); 3525 3526 return 0; 3527 clear_allmulti: 3528 if (dev->flags & IFF_ALLMULTI) 3529 dev_set_allmulti(real_dev, -1); 3530 del_unicast: 3531 dev_uc_del(real_dev, dev->dev_addr); 3532 netif_carrier_off(dev); 3533 return err; 3534 } 3535 3536 static int macsec_dev_stop(struct net_device *dev) 3537 { 3538 struct macsec_dev *macsec = macsec_priv(dev); 3539 struct net_device *real_dev = macsec->real_dev; 3540 3541 netif_carrier_off(dev); 3542 3543 /* If h/w offloading is available, propagate to the device */ 3544 if (macsec_is_offloaded(macsec)) { 3545 const struct macsec_ops *ops; 3546 struct macsec_context ctx; 3547 3548 ops = macsec_get_ops(macsec, &ctx); 3549 if (ops) { 3550 ctx.secy = &macsec->secy; 3551 macsec_offload(ops->mdo_dev_stop, &ctx); 3552 } 3553 } 3554 3555 dev_mc_unsync(real_dev, dev); 3556 dev_uc_unsync(real_dev, dev); 3557 3558 if (dev->flags & IFF_ALLMULTI) 3559 dev_set_allmulti(real_dev, -1); 3560 3561 if (dev->flags & IFF_PROMISC) 3562 dev_set_promiscuity(real_dev, -1); 3563 3564 dev_uc_del(real_dev, dev->dev_addr); 3565 3566 return 0; 3567 } 3568 3569 static void macsec_dev_change_rx_flags(struct net_device *dev, int change) 3570 { 3571 struct net_device *real_dev = macsec_priv(dev)->real_dev; 3572 3573 if (!(dev->flags & IFF_UP)) 3574 return; 3575 3576 if (change & IFF_ALLMULTI) 3577 dev_set_allmulti(real_dev, dev->flags & IFF_ALLMULTI ? 1 : -1); 3578 3579 if (change & IFF_PROMISC) 3580 dev_set_promiscuity(real_dev, 3581 dev->flags & IFF_PROMISC ? 1 : -1); 3582 } 3583 3584 static void macsec_dev_set_rx_mode(struct net_device *dev) 3585 { 3586 struct net_device *real_dev = macsec_priv(dev)->real_dev; 3587 3588 dev_mc_sync(real_dev, dev); 3589 dev_uc_sync(real_dev, dev); 3590 } 3591 3592 static int macsec_set_mac_address(struct net_device *dev, void *p) 3593 { 3594 struct macsec_dev *macsec = macsec_priv(dev); 3595 struct net_device *real_dev = macsec->real_dev; 3596 struct sockaddr *addr = p; 3597 int err; 3598 3599 if (!is_valid_ether_addr(addr->sa_data)) 3600 return -EADDRNOTAVAIL; 3601 3602 if (!(dev->flags & IFF_UP)) 3603 goto out; 3604 3605 err = dev_uc_add(real_dev, addr->sa_data); 3606 if (err < 0) 3607 return err; 3608 3609 dev_uc_del(real_dev, dev->dev_addr); 3610 3611 out: 3612 ether_addr_copy(dev->dev_addr, addr->sa_data); 3613 macsec->secy.sci = dev_to_sci(dev, MACSEC_PORT_ES); 3614 3615 /* If h/w offloading is available, propagate to the device */ 3616 if (macsec_is_offloaded(macsec)) { 3617 const struct macsec_ops *ops; 3618 struct macsec_context ctx; 3619 3620 ops = macsec_get_ops(macsec, &ctx); 3621 if (ops) { 3622 ctx.secy = &macsec->secy; 3623 macsec_offload(ops->mdo_upd_secy, &ctx); 3624 } 3625 } 3626 3627 return 0; 3628 } 3629 3630 static int macsec_change_mtu(struct net_device *dev, int new_mtu) 3631 { 3632 struct macsec_dev *macsec = macsec_priv(dev); 3633 unsigned int extra = macsec->secy.icv_len + macsec_extra_len(true); 3634 3635 if (macsec->real_dev->mtu - extra < new_mtu) 3636 return -ERANGE; 3637 3638 dev->mtu = new_mtu; 3639 3640 return 0; 3641 } 3642 3643 static void macsec_get_stats64(struct net_device *dev, 3644 struct rtnl_link_stats64 *s) 3645 { 3646 int cpu; 3647 3648 if (!dev->tstats) 3649 return; 3650 3651 for_each_possible_cpu(cpu) { 3652 struct pcpu_sw_netstats *stats; 3653 struct pcpu_sw_netstats tmp; 3654 int start; 3655 3656 stats = per_cpu_ptr(dev->tstats, cpu); 3657 do { 3658 start = u64_stats_fetch_begin_irq(&stats->syncp); 3659 tmp.rx_packets = stats->rx_packets; 3660 tmp.rx_bytes = stats->rx_bytes; 3661 tmp.tx_packets = stats->tx_packets; 3662 tmp.tx_bytes = stats->tx_bytes; 3663 } while (u64_stats_fetch_retry_irq(&stats->syncp, start)); 3664 3665 s->rx_packets += tmp.rx_packets; 3666 s->rx_bytes += tmp.rx_bytes; 3667 s->tx_packets += tmp.tx_packets; 3668 s->tx_bytes += tmp.tx_bytes; 3669 } 3670 3671 s->rx_dropped = dev->stats.rx_dropped; 3672 s->tx_dropped = dev->stats.tx_dropped; 3673 } 3674 3675 static int macsec_get_iflink(const struct net_device *dev) 3676 { 3677 return macsec_priv(dev)->real_dev->ifindex; 3678 } 3679 3680 static const struct net_device_ops macsec_netdev_ops = { 3681 .ndo_init = macsec_dev_init, 3682 .ndo_uninit = macsec_dev_uninit, 3683 .ndo_open = macsec_dev_open, 3684 .ndo_stop = macsec_dev_stop, 3685 .ndo_fix_features = macsec_fix_features, 3686 .ndo_change_mtu = macsec_change_mtu, 3687 .ndo_set_rx_mode = macsec_dev_set_rx_mode, 3688 .ndo_change_rx_flags = macsec_dev_change_rx_flags, 3689 .ndo_set_mac_address = macsec_set_mac_address, 3690 .ndo_start_xmit = macsec_start_xmit, 3691 .ndo_get_stats64 = macsec_get_stats64, 3692 .ndo_get_iflink = macsec_get_iflink, 3693 }; 3694 3695 static const struct device_type macsec_type = { 3696 .name = "macsec", 3697 }; 3698 3699 static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = { 3700 [IFLA_MACSEC_SCI] = { .type = NLA_U64 }, 3701 [IFLA_MACSEC_PORT] = { .type = NLA_U16 }, 3702 [IFLA_MACSEC_ICV_LEN] = { .type = NLA_U8 }, 3703 [IFLA_MACSEC_CIPHER_SUITE] = { .type = NLA_U64 }, 3704 [IFLA_MACSEC_WINDOW] = { .type = NLA_U32 }, 3705 [IFLA_MACSEC_ENCODING_SA] = { .type = NLA_U8 }, 3706 [IFLA_MACSEC_ENCRYPT] = { .type = NLA_U8 }, 3707 [IFLA_MACSEC_PROTECT] = { .type = NLA_U8 }, 3708 [IFLA_MACSEC_INC_SCI] = { .type = NLA_U8 }, 3709 [IFLA_MACSEC_ES] = { .type = NLA_U8 }, 3710 [IFLA_MACSEC_SCB] = { .type = NLA_U8 }, 3711 [IFLA_MACSEC_REPLAY_PROTECT] = { .type = NLA_U8 }, 3712 [IFLA_MACSEC_VALIDATION] = { .type = NLA_U8 }, 3713 }; 3714 3715 static void macsec_free_netdev(struct net_device *dev) 3716 { 3717 struct macsec_dev *macsec = macsec_priv(dev); 3718 3719 free_percpu(macsec->stats); 3720 free_percpu(macsec->secy.tx_sc.stats); 3721 3722 } 3723 3724 static void macsec_setup(struct net_device *dev) 3725 { 3726 ether_setup(dev); 3727 dev->min_mtu = 0; 3728 dev->max_mtu = ETH_MAX_MTU; 3729 dev->priv_flags |= IFF_NO_QUEUE; 3730 dev->netdev_ops = &macsec_netdev_ops; 3731 dev->needs_free_netdev = true; 3732 dev->priv_destructor = macsec_free_netdev; 3733 SET_NETDEV_DEVTYPE(dev, &macsec_type); 3734 3735 eth_zero_addr(dev->broadcast); 3736 } 3737 3738 static int macsec_changelink_common(struct net_device *dev, 3739 struct nlattr *data[]) 3740 { 3741 struct macsec_secy *secy; 3742 struct macsec_tx_sc *tx_sc; 3743 3744 secy = &macsec_priv(dev)->secy; 3745 tx_sc = &secy->tx_sc; 3746 3747 if (data[IFLA_MACSEC_ENCODING_SA]) { 3748 struct macsec_tx_sa *tx_sa; 3749 3750 tx_sc->encoding_sa = nla_get_u8(data[IFLA_MACSEC_ENCODING_SA]); 3751 tx_sa = rtnl_dereference(tx_sc->sa[tx_sc->encoding_sa]); 3752 3753 secy->operational = tx_sa && tx_sa->active; 3754 } 3755 3756 if (data[IFLA_MACSEC_WINDOW]) 3757 secy->replay_window = nla_get_u32(data[IFLA_MACSEC_WINDOW]); 3758 3759 if (data[IFLA_MACSEC_ENCRYPT]) 3760 tx_sc->encrypt = !!nla_get_u8(data[IFLA_MACSEC_ENCRYPT]); 3761 3762 if (data[IFLA_MACSEC_PROTECT]) 3763 secy->protect_frames = !!nla_get_u8(data[IFLA_MACSEC_PROTECT]); 3764 3765 if (data[IFLA_MACSEC_INC_SCI]) 3766 tx_sc->send_sci = !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]); 3767 3768 if (data[IFLA_MACSEC_ES]) 3769 tx_sc->end_station = !!nla_get_u8(data[IFLA_MACSEC_ES]); 3770 3771 if (data[IFLA_MACSEC_SCB]) 3772 tx_sc->scb = !!nla_get_u8(data[IFLA_MACSEC_SCB]); 3773 3774 if (data[IFLA_MACSEC_REPLAY_PROTECT]) 3775 secy->replay_protect = !!nla_get_u8(data[IFLA_MACSEC_REPLAY_PROTECT]); 3776 3777 if (data[IFLA_MACSEC_VALIDATION]) 3778 secy->validate_frames = nla_get_u8(data[IFLA_MACSEC_VALIDATION]); 3779 3780 if (data[IFLA_MACSEC_CIPHER_SUITE]) { 3781 switch (nla_get_u64(data[IFLA_MACSEC_CIPHER_SUITE])) { 3782 case MACSEC_CIPHER_ID_GCM_AES_128: 3783 case MACSEC_DEFAULT_CIPHER_ID: 3784 secy->key_len = MACSEC_GCM_AES_128_SAK_LEN; 3785 secy->xpn = false; 3786 break; 3787 case MACSEC_CIPHER_ID_GCM_AES_256: 3788 secy->key_len = MACSEC_GCM_AES_256_SAK_LEN; 3789 secy->xpn = false; 3790 break; 3791 case MACSEC_CIPHER_ID_GCM_AES_XPN_128: 3792 secy->key_len = MACSEC_GCM_AES_128_SAK_LEN; 3793 secy->xpn = true; 3794 break; 3795 case MACSEC_CIPHER_ID_GCM_AES_XPN_256: 3796 secy->key_len = MACSEC_GCM_AES_256_SAK_LEN; 3797 secy->xpn = true; 3798 break; 3799 default: 3800 return -EINVAL; 3801 } 3802 } 3803 3804 return 0; 3805 } 3806 3807 static int macsec_changelink(struct net_device *dev, struct nlattr *tb[], 3808 struct nlattr *data[], 3809 struct netlink_ext_ack *extack) 3810 { 3811 struct macsec_dev *macsec = macsec_priv(dev); 3812 struct macsec_tx_sa tx_sc; 3813 struct macsec_secy secy; 3814 int ret; 3815 3816 if (!data) 3817 return 0; 3818 3819 if (data[IFLA_MACSEC_CIPHER_SUITE] || 3820 data[IFLA_MACSEC_ICV_LEN] || 3821 data[IFLA_MACSEC_SCI] || 3822 data[IFLA_MACSEC_PORT]) 3823 return -EINVAL; 3824 3825 /* Keep a copy of unmodified secy and tx_sc, in case the offload 3826 * propagation fails, to revert macsec_changelink_common. 3827 */ 3828 memcpy(&secy, &macsec->secy, sizeof(secy)); 3829 memcpy(&tx_sc, &macsec->secy.tx_sc, sizeof(tx_sc)); 3830 3831 ret = macsec_changelink_common(dev, data); 3832 if (ret) 3833 return ret; 3834 3835 /* If h/w offloading is available, propagate to the device */ 3836 if (macsec_is_offloaded(macsec)) { 3837 const struct macsec_ops *ops; 3838 struct macsec_context ctx; 3839 int ret; 3840 3841 ops = macsec_get_ops(netdev_priv(dev), &ctx); 3842 if (!ops) { 3843 ret = -EOPNOTSUPP; 3844 goto cleanup; 3845 } 3846 3847 ctx.secy = &macsec->secy; 3848 ret = macsec_offload(ops->mdo_upd_secy, &ctx); 3849 if (ret) 3850 goto cleanup; 3851 } 3852 3853 return 0; 3854 3855 cleanup: 3856 memcpy(&macsec->secy.tx_sc, &tx_sc, sizeof(tx_sc)); 3857 memcpy(&macsec->secy, &secy, sizeof(secy)); 3858 3859 return ret; 3860 } 3861 3862 static void macsec_del_dev(struct macsec_dev *macsec) 3863 { 3864 int i; 3865 3866 while (macsec->secy.rx_sc) { 3867 struct macsec_rx_sc *rx_sc = rtnl_dereference(macsec->secy.rx_sc); 3868 3869 rcu_assign_pointer(macsec->secy.rx_sc, rx_sc->next); 3870 free_rx_sc(rx_sc); 3871 } 3872 3873 for (i = 0; i < MACSEC_NUM_AN; i++) { 3874 struct macsec_tx_sa *sa = rtnl_dereference(macsec->secy.tx_sc.sa[i]); 3875 3876 if (sa) { 3877 RCU_INIT_POINTER(macsec->secy.tx_sc.sa[i], NULL); 3878 clear_tx_sa(sa); 3879 } 3880 } 3881 } 3882 3883 static void macsec_common_dellink(struct net_device *dev, struct list_head *head) 3884 { 3885 struct macsec_dev *macsec = macsec_priv(dev); 3886 struct net_device *real_dev = macsec->real_dev; 3887 3888 unregister_netdevice_queue(dev, head); 3889 list_del_rcu(&macsec->secys); 3890 macsec_del_dev(macsec); 3891 netdev_upper_dev_unlink(real_dev, dev); 3892 3893 macsec_generation++; 3894 } 3895 3896 static void macsec_dellink(struct net_device *dev, struct list_head *head) 3897 { 3898 struct macsec_dev *macsec = macsec_priv(dev); 3899 struct net_device *real_dev = macsec->real_dev; 3900 struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev); 3901 3902 /* If h/w offloading is available, propagate to the device */ 3903 if (macsec_is_offloaded(macsec)) { 3904 const struct macsec_ops *ops; 3905 struct macsec_context ctx; 3906 3907 ops = macsec_get_ops(netdev_priv(dev), &ctx); 3908 if (ops) { 3909 ctx.secy = &macsec->secy; 3910 macsec_offload(ops->mdo_del_secy, &ctx); 3911 } 3912 } 3913 3914 macsec_common_dellink(dev, head); 3915 3916 if (list_empty(&rxd->secys)) { 3917 netdev_rx_handler_unregister(real_dev); 3918 kfree(rxd); 3919 } 3920 } 3921 3922 static int register_macsec_dev(struct net_device *real_dev, 3923 struct net_device *dev) 3924 { 3925 struct macsec_dev *macsec = macsec_priv(dev); 3926 struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev); 3927 3928 if (!rxd) { 3929 int err; 3930 3931 rxd = kmalloc(sizeof(*rxd), GFP_KERNEL); 3932 if (!rxd) 3933 return -ENOMEM; 3934 3935 INIT_LIST_HEAD(&rxd->secys); 3936 3937 err = netdev_rx_handler_register(real_dev, macsec_handle_frame, 3938 rxd); 3939 if (err < 0) { 3940 kfree(rxd); 3941 return err; 3942 } 3943 } 3944 3945 list_add_tail_rcu(&macsec->secys, &rxd->secys); 3946 return 0; 3947 } 3948 3949 static bool sci_exists(struct net_device *dev, sci_t sci) 3950 { 3951 struct macsec_rxh_data *rxd = macsec_data_rtnl(dev); 3952 struct macsec_dev *macsec; 3953 3954 list_for_each_entry(macsec, &rxd->secys, secys) { 3955 if (macsec->secy.sci == sci) 3956 return true; 3957 } 3958 3959 return false; 3960 } 3961 3962 static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len) 3963 { 3964 struct macsec_dev *macsec = macsec_priv(dev); 3965 struct macsec_secy *secy = &macsec->secy; 3966 3967 macsec->stats = netdev_alloc_pcpu_stats(struct pcpu_secy_stats); 3968 if (!macsec->stats) 3969 return -ENOMEM; 3970 3971 secy->tx_sc.stats = netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats); 3972 if (!secy->tx_sc.stats) { 3973 free_percpu(macsec->stats); 3974 return -ENOMEM; 3975 } 3976 3977 if (sci == MACSEC_UNDEF_SCI) 3978 sci = dev_to_sci(dev, MACSEC_PORT_ES); 3979 3980 secy->netdev = dev; 3981 secy->operational = true; 3982 secy->key_len = DEFAULT_SAK_LEN; 3983 secy->icv_len = icv_len; 3984 secy->validate_frames = MACSEC_VALIDATE_DEFAULT; 3985 secy->protect_frames = true; 3986 secy->replay_protect = false; 3987 secy->xpn = DEFAULT_XPN; 3988 3989 secy->sci = sci; 3990 secy->tx_sc.active = true; 3991 secy->tx_sc.encoding_sa = DEFAULT_ENCODING_SA; 3992 secy->tx_sc.encrypt = DEFAULT_ENCRYPT; 3993 secy->tx_sc.send_sci = DEFAULT_SEND_SCI; 3994 secy->tx_sc.end_station = false; 3995 secy->tx_sc.scb = false; 3996 3997 return 0; 3998 } 3999 4000 static int macsec_newlink(struct net *net, struct net_device *dev, 4001 struct nlattr *tb[], struct nlattr *data[], 4002 struct netlink_ext_ack *extack) 4003 { 4004 struct macsec_dev *macsec = macsec_priv(dev); 4005 struct net_device *real_dev; 4006 int err; 4007 sci_t sci; 4008 u8 icv_len = DEFAULT_ICV_LEN; 4009 rx_handler_func_t *rx_handler; 4010 4011 if (!tb[IFLA_LINK]) 4012 return -EINVAL; 4013 real_dev = __dev_get_by_index(net, nla_get_u32(tb[IFLA_LINK])); 4014 if (!real_dev) 4015 return -ENODEV; 4016 if (real_dev->type != ARPHRD_ETHER) 4017 return -EINVAL; 4018 4019 dev->priv_flags |= IFF_MACSEC; 4020 4021 macsec->real_dev = real_dev; 4022 4023 if (data && data[IFLA_MACSEC_OFFLOAD]) 4024 macsec->offload = nla_get_offload(data[IFLA_MACSEC_OFFLOAD]); 4025 else 4026 /* MACsec offloading is off by default */ 4027 macsec->offload = MACSEC_OFFLOAD_OFF; 4028 4029 /* Check if the offloading mode is supported by the underlying layers */ 4030 if (macsec->offload != MACSEC_OFFLOAD_OFF && 4031 !macsec_check_offload(macsec->offload, macsec)) 4032 return -EOPNOTSUPP; 4033 4034 if (data && data[IFLA_MACSEC_ICV_LEN]) 4035 icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]); 4036 dev->mtu = real_dev->mtu - icv_len - macsec_extra_len(true); 4037 4038 rx_handler = rtnl_dereference(real_dev->rx_handler); 4039 if (rx_handler && rx_handler != macsec_handle_frame) 4040 return -EBUSY; 4041 4042 err = register_netdevice(dev); 4043 if (err < 0) 4044 return err; 4045 4046 err = netdev_upper_dev_link(real_dev, dev, extack); 4047 if (err < 0) 4048 goto unregister; 4049 4050 /* need to be already registered so that ->init has run and 4051 * the MAC addr is set 4052 */ 4053 if (data && data[IFLA_MACSEC_SCI]) 4054 sci = nla_get_sci(data[IFLA_MACSEC_SCI]); 4055 else if (data && data[IFLA_MACSEC_PORT]) 4056 sci = dev_to_sci(dev, nla_get_be16(data[IFLA_MACSEC_PORT])); 4057 else 4058 sci = dev_to_sci(dev, MACSEC_PORT_ES); 4059 4060 if (rx_handler && sci_exists(real_dev, sci)) { 4061 err = -EBUSY; 4062 goto unlink; 4063 } 4064 4065 err = macsec_add_dev(dev, sci, icv_len); 4066 if (err) 4067 goto unlink; 4068 4069 if (data) { 4070 err = macsec_changelink_common(dev, data); 4071 if (err) 4072 goto del_dev; 4073 } 4074 4075 /* If h/w offloading is available, propagate to the device */ 4076 if (macsec_is_offloaded(macsec)) { 4077 const struct macsec_ops *ops; 4078 struct macsec_context ctx; 4079 4080 ops = macsec_get_ops(macsec, &ctx); 4081 if (ops) { 4082 ctx.secy = &macsec->secy; 4083 err = macsec_offload(ops->mdo_add_secy, &ctx); 4084 if (err) 4085 goto del_dev; 4086 } 4087 } 4088 4089 err = register_macsec_dev(real_dev, dev); 4090 if (err < 0) 4091 goto del_dev; 4092 4093 netif_stacked_transfer_operstate(real_dev, dev); 4094 linkwatch_fire_event(dev); 4095 4096 macsec_generation++; 4097 4098 return 0; 4099 4100 del_dev: 4101 macsec_del_dev(macsec); 4102 unlink: 4103 netdev_upper_dev_unlink(real_dev, dev); 4104 unregister: 4105 unregister_netdevice(dev); 4106 return err; 4107 } 4108 4109 static int macsec_validate_attr(struct nlattr *tb[], struct nlattr *data[], 4110 struct netlink_ext_ack *extack) 4111 { 4112 u64 csid = MACSEC_DEFAULT_CIPHER_ID; 4113 u8 icv_len = DEFAULT_ICV_LEN; 4114 int flag; 4115 bool es, scb, sci; 4116 4117 if (!data) 4118 return 0; 4119 4120 if (data[IFLA_MACSEC_CIPHER_SUITE]) 4121 csid = nla_get_u64(data[IFLA_MACSEC_CIPHER_SUITE]); 4122 4123 if (data[IFLA_MACSEC_ICV_LEN]) { 4124 icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]); 4125 if (icv_len != DEFAULT_ICV_LEN) { 4126 char dummy_key[DEFAULT_SAK_LEN] = { 0 }; 4127 struct crypto_aead *dummy_tfm; 4128 4129 dummy_tfm = macsec_alloc_tfm(dummy_key, 4130 DEFAULT_SAK_LEN, 4131 icv_len); 4132 if (IS_ERR(dummy_tfm)) 4133 return PTR_ERR(dummy_tfm); 4134 crypto_free_aead(dummy_tfm); 4135 } 4136 } 4137 4138 switch (csid) { 4139 case MACSEC_CIPHER_ID_GCM_AES_128: 4140 case MACSEC_CIPHER_ID_GCM_AES_256: 4141 case MACSEC_CIPHER_ID_GCM_AES_XPN_128: 4142 case MACSEC_CIPHER_ID_GCM_AES_XPN_256: 4143 case MACSEC_DEFAULT_CIPHER_ID: 4144 if (icv_len < MACSEC_MIN_ICV_LEN || 4145 icv_len > MACSEC_STD_ICV_LEN) 4146 return -EINVAL; 4147 break; 4148 default: 4149 return -EINVAL; 4150 } 4151 4152 if (data[IFLA_MACSEC_ENCODING_SA]) { 4153 if (nla_get_u8(data[IFLA_MACSEC_ENCODING_SA]) >= MACSEC_NUM_AN) 4154 return -EINVAL; 4155 } 4156 4157 for (flag = IFLA_MACSEC_ENCODING_SA + 1; 4158 flag < IFLA_MACSEC_VALIDATION; 4159 flag++) { 4160 if (data[flag]) { 4161 if (nla_get_u8(data[flag]) > 1) 4162 return -EINVAL; 4163 } 4164 } 4165 4166 es = data[IFLA_MACSEC_ES] ? nla_get_u8(data[IFLA_MACSEC_ES]) : false; 4167 sci = data[IFLA_MACSEC_INC_SCI] ? nla_get_u8(data[IFLA_MACSEC_INC_SCI]) : false; 4168 scb = data[IFLA_MACSEC_SCB] ? nla_get_u8(data[IFLA_MACSEC_SCB]) : false; 4169 4170 if ((sci && (scb || es)) || (scb && es)) 4171 return -EINVAL; 4172 4173 if (data[IFLA_MACSEC_VALIDATION] && 4174 nla_get_u8(data[IFLA_MACSEC_VALIDATION]) > MACSEC_VALIDATE_MAX) 4175 return -EINVAL; 4176 4177 if ((data[IFLA_MACSEC_REPLAY_PROTECT] && 4178 nla_get_u8(data[IFLA_MACSEC_REPLAY_PROTECT])) && 4179 !data[IFLA_MACSEC_WINDOW]) 4180 return -EINVAL; 4181 4182 return 0; 4183 } 4184 4185 static struct net *macsec_get_link_net(const struct net_device *dev) 4186 { 4187 return dev_net(macsec_priv(dev)->real_dev); 4188 } 4189 4190 static size_t macsec_get_size(const struct net_device *dev) 4191 { 4192 return nla_total_size_64bit(8) + /* IFLA_MACSEC_SCI */ 4193 nla_total_size(1) + /* IFLA_MACSEC_ICV_LEN */ 4194 nla_total_size_64bit(8) + /* IFLA_MACSEC_CIPHER_SUITE */ 4195 nla_total_size(4) + /* IFLA_MACSEC_WINDOW */ 4196 nla_total_size(1) + /* IFLA_MACSEC_ENCODING_SA */ 4197 nla_total_size(1) + /* IFLA_MACSEC_ENCRYPT */ 4198 nla_total_size(1) + /* IFLA_MACSEC_PROTECT */ 4199 nla_total_size(1) + /* IFLA_MACSEC_INC_SCI */ 4200 nla_total_size(1) + /* IFLA_MACSEC_ES */ 4201 nla_total_size(1) + /* IFLA_MACSEC_SCB */ 4202 nla_total_size(1) + /* IFLA_MACSEC_REPLAY_PROTECT */ 4203 nla_total_size(1) + /* IFLA_MACSEC_VALIDATION */ 4204 0; 4205 } 4206 4207 static int macsec_fill_info(struct sk_buff *skb, 4208 const struct net_device *dev) 4209 { 4210 struct macsec_secy *secy = &macsec_priv(dev)->secy; 4211 struct macsec_tx_sc *tx_sc = &secy->tx_sc; 4212 u64 csid; 4213 4214 switch (secy->key_len) { 4215 case MACSEC_GCM_AES_128_SAK_LEN: 4216 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID; 4217 break; 4218 case MACSEC_GCM_AES_256_SAK_LEN: 4219 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256; 4220 break; 4221 default: 4222 goto nla_put_failure; 4223 } 4224 4225 if (nla_put_sci(skb, IFLA_MACSEC_SCI, secy->sci, 4226 IFLA_MACSEC_PAD) || 4227 nla_put_u8(skb, IFLA_MACSEC_ICV_LEN, secy->icv_len) || 4228 nla_put_u64_64bit(skb, IFLA_MACSEC_CIPHER_SUITE, 4229 csid, IFLA_MACSEC_PAD) || 4230 nla_put_u8(skb, IFLA_MACSEC_ENCODING_SA, tx_sc->encoding_sa) || 4231 nla_put_u8(skb, IFLA_MACSEC_ENCRYPT, tx_sc->encrypt) || 4232 nla_put_u8(skb, IFLA_MACSEC_PROTECT, secy->protect_frames) || 4233 nla_put_u8(skb, IFLA_MACSEC_INC_SCI, tx_sc->send_sci) || 4234 nla_put_u8(skb, IFLA_MACSEC_ES, tx_sc->end_station) || 4235 nla_put_u8(skb, IFLA_MACSEC_SCB, tx_sc->scb) || 4236 nla_put_u8(skb, IFLA_MACSEC_REPLAY_PROTECT, secy->replay_protect) || 4237 nla_put_u8(skb, IFLA_MACSEC_VALIDATION, secy->validate_frames) || 4238 0) 4239 goto nla_put_failure; 4240 4241 if (secy->replay_protect) { 4242 if (nla_put_u32(skb, IFLA_MACSEC_WINDOW, secy->replay_window)) 4243 goto nla_put_failure; 4244 } 4245 4246 return 0; 4247 4248 nla_put_failure: 4249 return -EMSGSIZE; 4250 } 4251 4252 static struct rtnl_link_ops macsec_link_ops __read_mostly = { 4253 .kind = "macsec", 4254 .priv_size = sizeof(struct macsec_dev), 4255 .maxtype = IFLA_MACSEC_MAX, 4256 .policy = macsec_rtnl_policy, 4257 .setup = macsec_setup, 4258 .validate = macsec_validate_attr, 4259 .newlink = macsec_newlink, 4260 .changelink = macsec_changelink, 4261 .dellink = macsec_dellink, 4262 .get_size = macsec_get_size, 4263 .fill_info = macsec_fill_info, 4264 .get_link_net = macsec_get_link_net, 4265 }; 4266 4267 static bool is_macsec_master(struct net_device *dev) 4268 { 4269 return rcu_access_pointer(dev->rx_handler) == macsec_handle_frame; 4270 } 4271 4272 static int macsec_notify(struct notifier_block *this, unsigned long event, 4273 void *ptr) 4274 { 4275 struct net_device *real_dev = netdev_notifier_info_to_dev(ptr); 4276 LIST_HEAD(head); 4277 4278 if (!is_macsec_master(real_dev)) 4279 return NOTIFY_DONE; 4280 4281 switch (event) { 4282 case NETDEV_DOWN: 4283 case NETDEV_UP: 4284 case NETDEV_CHANGE: { 4285 struct macsec_dev *m, *n; 4286 struct macsec_rxh_data *rxd; 4287 4288 rxd = macsec_data_rtnl(real_dev); 4289 list_for_each_entry_safe(m, n, &rxd->secys, secys) { 4290 struct net_device *dev = m->secy.netdev; 4291 4292 netif_stacked_transfer_operstate(real_dev, dev); 4293 } 4294 break; 4295 } 4296 case NETDEV_UNREGISTER: { 4297 struct macsec_dev *m, *n; 4298 struct macsec_rxh_data *rxd; 4299 4300 rxd = macsec_data_rtnl(real_dev); 4301 list_for_each_entry_safe(m, n, &rxd->secys, secys) { 4302 macsec_common_dellink(m->secy.netdev, &head); 4303 } 4304 4305 netdev_rx_handler_unregister(real_dev); 4306 kfree(rxd); 4307 4308 unregister_netdevice_many(&head); 4309 break; 4310 } 4311 case NETDEV_CHANGEMTU: { 4312 struct macsec_dev *m; 4313 struct macsec_rxh_data *rxd; 4314 4315 rxd = macsec_data_rtnl(real_dev); 4316 list_for_each_entry(m, &rxd->secys, secys) { 4317 struct net_device *dev = m->secy.netdev; 4318 unsigned int mtu = real_dev->mtu - (m->secy.icv_len + 4319 macsec_extra_len(true)); 4320 4321 if (dev->mtu > mtu) 4322 dev_set_mtu(dev, mtu); 4323 } 4324 } 4325 } 4326 4327 return NOTIFY_OK; 4328 } 4329 4330 static struct notifier_block macsec_notifier = { 4331 .notifier_call = macsec_notify, 4332 }; 4333 4334 static int __init macsec_init(void) 4335 { 4336 int err; 4337 4338 pr_info("MACsec IEEE 802.1AE\n"); 4339 err = register_netdevice_notifier(&macsec_notifier); 4340 if (err) 4341 return err; 4342 4343 err = rtnl_link_register(&macsec_link_ops); 4344 if (err) 4345 goto notifier; 4346 4347 err = genl_register_family(&macsec_fam); 4348 if (err) 4349 goto rtnl; 4350 4351 return 0; 4352 4353 rtnl: 4354 rtnl_link_unregister(&macsec_link_ops); 4355 notifier: 4356 unregister_netdevice_notifier(&macsec_notifier); 4357 return err; 4358 } 4359 4360 static void __exit macsec_exit(void) 4361 { 4362 genl_unregister_family(&macsec_fam); 4363 rtnl_link_unregister(&macsec_link_ops); 4364 unregister_netdevice_notifier(&macsec_notifier); 4365 rcu_barrier(); 4366 } 4367 4368 module_init(macsec_init); 4369 module_exit(macsec_exit); 4370 4371 MODULE_ALIAS_RTNL_LINK("macsec"); 4372 MODULE_ALIAS_GENL_FAMILY("macsec"); 4373 4374 MODULE_DESCRIPTION("MACsec IEEE 802.1AE"); 4375 MODULE_LICENSE("GPL v2"); 4376