1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * drivers/net/macsec.c - MACsec device
4 *
5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
6 */
7
8 #include <linux/types.h>
9 #include <linux/skbuff.h>
10 #include <linux/socket.h>
11 #include <linux/module.h>
12 #include <crypto/aead.h>
13 #include <linux/etherdevice.h>
14 #include <linux/netdevice.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/refcount.h>
17 #include <net/genetlink.h>
18 #include <net/sock.h>
19 #include <net/gro_cells.h>
20 #include <net/macsec.h>
21 #include <net/dst_metadata.h>
22 #include <linux/phy.h>
23 #include <linux/byteorder/generic.h>
24 #include <linux/if_arp.h>
25
26 #include <uapi/linux/if_macsec.h>
27
28 /* SecTAG length = macsec_eth_header without the optional SCI */
29 #define MACSEC_TAG_LEN 6
30
31 struct macsec_eth_header {
32 struct ethhdr eth;
33 /* SecTAG */
34 u8 tci_an;
35 #if defined(__LITTLE_ENDIAN_BITFIELD)
36 u8 short_length:6,
37 unused:2;
38 #elif defined(__BIG_ENDIAN_BITFIELD)
39 u8 unused:2,
40 short_length:6;
41 #else
42 #error "Please fix <asm/byteorder.h>"
43 #endif
44 __be32 packet_number;
45 u8 secure_channel_id[8]; /* optional */
46 } __packed;
47
48 /* minimum secure data length deemed "not short", see IEEE 802.1AE-2006 9.7 */
49 #define MIN_NON_SHORT_LEN 48
50
51 #define GCM_AES_IV_LEN 12
52
53 #define for_each_rxsc(secy, sc) \
54 for (sc = rcu_dereference_bh(secy->rx_sc); \
55 sc; \
56 sc = rcu_dereference_bh(sc->next))
57 #define for_each_rxsc_rtnl(secy, sc) \
58 for (sc = rtnl_dereference(secy->rx_sc); \
59 sc; \
60 sc = rtnl_dereference(sc->next))
61
62 #define pn_same_half(pn1, pn2) (!(((pn1) >> 31) ^ ((pn2) >> 31)))
63
64 struct gcm_iv_xpn {
65 union {
66 u8 short_secure_channel_id[4];
67 ssci_t ssci;
68 };
69 __be64 pn;
70 } __packed;
71
72 struct gcm_iv {
73 union {
74 u8 secure_channel_id[8];
75 sci_t sci;
76 };
77 __be32 pn;
78 };
79
80 #define MACSEC_VALIDATE_DEFAULT MACSEC_VALIDATE_STRICT
81
82 struct pcpu_secy_stats {
83 struct macsec_dev_stats stats;
84 struct u64_stats_sync syncp;
85 };
86
87 /**
88 * struct macsec_dev - private data
89 * @secy: SecY config
90 * @real_dev: pointer to underlying netdevice
91 * @dev_tracker: refcount tracker for @real_dev reference
92 * @stats: MACsec device stats
93 * @secys: linked list of SecY's on the underlying device
94 * @gro_cells: pointer to the Generic Receive Offload cell
95 * @offload: status of offloading on the MACsec device
96 */
97 struct macsec_dev {
98 struct macsec_secy secy;
99 struct net_device *real_dev;
100 netdevice_tracker dev_tracker;
101 struct pcpu_secy_stats __percpu *stats;
102 struct list_head secys;
103 struct gro_cells gro_cells;
104 enum macsec_offload offload;
105 };
106
107 /**
108 * struct macsec_rxh_data - rx_handler private argument
109 * @secys: linked list of SecY's on this underlying device
110 */
111 struct macsec_rxh_data {
112 struct list_head secys;
113 };
114
macsec_priv(const struct net_device * dev)115 static struct macsec_dev *macsec_priv(const struct net_device *dev)
116 {
117 return (struct macsec_dev *)netdev_priv(dev);
118 }
119
macsec_data_rcu(const struct net_device * dev)120 static struct macsec_rxh_data *macsec_data_rcu(const struct net_device *dev)
121 {
122 return rcu_dereference_bh(dev->rx_handler_data);
123 }
124
macsec_data_rtnl(const struct net_device * dev)125 static struct macsec_rxh_data *macsec_data_rtnl(const struct net_device *dev)
126 {
127 return rtnl_dereference(dev->rx_handler_data);
128 }
129
130 struct macsec_cb {
131 struct aead_request *req;
132 union {
133 struct macsec_tx_sa *tx_sa;
134 struct macsec_rx_sa *rx_sa;
135 };
136 u8 assoc_num;
137 bool valid;
138 bool has_sci;
139 };
140
macsec_rxsa_get(struct macsec_rx_sa __rcu * ptr)141 static struct macsec_rx_sa *macsec_rxsa_get(struct macsec_rx_sa __rcu *ptr)
142 {
143 struct macsec_rx_sa *sa = rcu_dereference_bh(ptr);
144
145 if (!sa || !sa->active)
146 return NULL;
147
148 if (!refcount_inc_not_zero(&sa->refcnt))
149 return NULL;
150
151 return sa;
152 }
153
macsec_active_rxsa_get(struct macsec_rx_sc * rx_sc)154 static struct macsec_rx_sa *macsec_active_rxsa_get(struct macsec_rx_sc *rx_sc)
155 {
156 struct macsec_rx_sa *sa = NULL;
157 int an;
158
159 for (an = 0; an < MACSEC_NUM_AN; an++) {
160 sa = macsec_rxsa_get(rx_sc->sa[an]);
161 if (sa)
162 break;
163 }
164 return sa;
165 }
166
free_rx_sc_rcu(struct rcu_head * head)167 static void free_rx_sc_rcu(struct rcu_head *head)
168 {
169 struct macsec_rx_sc *rx_sc = container_of(head, struct macsec_rx_sc, rcu_head);
170
171 free_percpu(rx_sc->stats);
172 kfree(rx_sc);
173 }
174
macsec_rxsc_get(struct macsec_rx_sc * sc)175 static struct macsec_rx_sc *macsec_rxsc_get(struct macsec_rx_sc *sc)
176 {
177 return refcount_inc_not_zero(&sc->refcnt) ? sc : NULL;
178 }
179
macsec_rxsc_put(struct macsec_rx_sc * sc)180 static void macsec_rxsc_put(struct macsec_rx_sc *sc)
181 {
182 if (refcount_dec_and_test(&sc->refcnt))
183 call_rcu(&sc->rcu_head, free_rx_sc_rcu);
184 }
185
free_rxsa(struct rcu_head * head)186 static void free_rxsa(struct rcu_head *head)
187 {
188 struct macsec_rx_sa *sa = container_of(head, struct macsec_rx_sa, rcu);
189
190 crypto_free_aead(sa->key.tfm);
191 free_percpu(sa->stats);
192 kfree(sa);
193 }
194
macsec_rxsa_put(struct macsec_rx_sa * sa)195 static void macsec_rxsa_put(struct macsec_rx_sa *sa)
196 {
197 if (refcount_dec_and_test(&sa->refcnt))
198 call_rcu(&sa->rcu, free_rxsa);
199 }
200
macsec_txsa_get(struct macsec_tx_sa __rcu * ptr)201 static struct macsec_tx_sa *macsec_txsa_get(struct macsec_tx_sa __rcu *ptr)
202 {
203 struct macsec_tx_sa *sa = rcu_dereference_bh(ptr);
204
205 if (!sa || !sa->active)
206 return NULL;
207
208 if (!refcount_inc_not_zero(&sa->refcnt))
209 return NULL;
210
211 return sa;
212 }
213
free_txsa(struct rcu_head * head)214 static void free_txsa(struct rcu_head *head)
215 {
216 struct macsec_tx_sa *sa = container_of(head, struct macsec_tx_sa, rcu);
217
218 crypto_free_aead(sa->key.tfm);
219 free_percpu(sa->stats);
220 kfree(sa);
221 }
222
macsec_txsa_put(struct macsec_tx_sa * sa)223 static void macsec_txsa_put(struct macsec_tx_sa *sa)
224 {
225 if (refcount_dec_and_test(&sa->refcnt))
226 call_rcu(&sa->rcu, free_txsa);
227 }
228
macsec_skb_cb(struct sk_buff * skb)229 static struct macsec_cb *macsec_skb_cb(struct sk_buff *skb)
230 {
231 BUILD_BUG_ON(sizeof(struct macsec_cb) > sizeof(skb->cb));
232 return (struct macsec_cb *)skb->cb;
233 }
234
235 #define MACSEC_PORT_SCB (0x0000)
236 #define MACSEC_UNDEF_SCI ((__force sci_t)0xffffffffffffffffULL)
237 #define MACSEC_UNDEF_SSCI ((__force ssci_t)0xffffffff)
238
239 #define MACSEC_GCM_AES_128_SAK_LEN 16
240 #define MACSEC_GCM_AES_256_SAK_LEN 32
241
242 #define DEFAULT_SAK_LEN MACSEC_GCM_AES_128_SAK_LEN
243 #define DEFAULT_XPN false
244 #define DEFAULT_SEND_SCI true
245 #define DEFAULT_ENCRYPT false
246 #define DEFAULT_ENCODING_SA 0
247 #define MACSEC_XPN_MAX_REPLAY_WINDOW (((1 << 30) - 1))
248
make_sci(const u8 * addr,__be16 port)249 static sci_t make_sci(const u8 *addr, __be16 port)
250 {
251 sci_t sci;
252
253 memcpy(&sci, addr, ETH_ALEN);
254 memcpy(((char *)&sci) + ETH_ALEN, &port, sizeof(port));
255
256 return sci;
257 }
258
macsec_frame_sci(struct macsec_eth_header * hdr,bool sci_present)259 static sci_t macsec_frame_sci(struct macsec_eth_header *hdr, bool sci_present)
260 {
261 sci_t sci;
262
263 if (sci_present)
264 memcpy(&sci, hdr->secure_channel_id,
265 sizeof(hdr->secure_channel_id));
266 else
267 sci = make_sci(hdr->eth.h_source, MACSEC_PORT_ES);
268
269 return sci;
270 }
271
macsec_sectag_len(bool sci_present)272 static unsigned int macsec_sectag_len(bool sci_present)
273 {
274 return MACSEC_TAG_LEN + (sci_present ? MACSEC_SCI_LEN : 0);
275 }
276
macsec_hdr_len(bool sci_present)277 static unsigned int macsec_hdr_len(bool sci_present)
278 {
279 return macsec_sectag_len(sci_present) + ETH_HLEN;
280 }
281
macsec_extra_len(bool sci_present)282 static unsigned int macsec_extra_len(bool sci_present)
283 {
284 return macsec_sectag_len(sci_present) + sizeof(__be16);
285 }
286
287 /* Fill SecTAG according to IEEE 802.1AE-2006 10.5.3 */
macsec_fill_sectag(struct macsec_eth_header * h,const struct macsec_secy * secy,u32 pn,bool sci_present)288 static void macsec_fill_sectag(struct macsec_eth_header *h,
289 const struct macsec_secy *secy, u32 pn,
290 bool sci_present)
291 {
292 const struct macsec_tx_sc *tx_sc = &secy->tx_sc;
293
294 memset(&h->tci_an, 0, macsec_sectag_len(sci_present));
295 h->eth.h_proto = htons(ETH_P_MACSEC);
296
297 if (sci_present) {
298 h->tci_an |= MACSEC_TCI_SC;
299 memcpy(&h->secure_channel_id, &secy->sci,
300 sizeof(h->secure_channel_id));
301 } else {
302 if (tx_sc->end_station)
303 h->tci_an |= MACSEC_TCI_ES;
304 if (tx_sc->scb)
305 h->tci_an |= MACSEC_TCI_SCB;
306 }
307
308 h->packet_number = htonl(pn);
309
310 /* with GCM, C/E clear for !encrypt, both set for encrypt */
311 if (tx_sc->encrypt)
312 h->tci_an |= MACSEC_TCI_CONFID;
313 else if (secy->icv_len != MACSEC_DEFAULT_ICV_LEN)
314 h->tci_an |= MACSEC_TCI_C;
315
316 h->tci_an |= tx_sc->encoding_sa;
317 }
318
macsec_set_shortlen(struct macsec_eth_header * h,size_t data_len)319 static void macsec_set_shortlen(struct macsec_eth_header *h, size_t data_len)
320 {
321 if (data_len < MIN_NON_SHORT_LEN)
322 h->short_length = data_len;
323 }
324
325 /* Checks if a MACsec interface is being offloaded to an hardware engine */
macsec_is_offloaded(struct macsec_dev * macsec)326 static bool macsec_is_offloaded(struct macsec_dev *macsec)
327 {
328 if (macsec->offload == MACSEC_OFFLOAD_MAC ||
329 macsec->offload == MACSEC_OFFLOAD_PHY)
330 return true;
331
332 return false;
333 }
334
335 /* Checks if underlying layers implement MACsec offloading functions. */
macsec_check_offload(enum macsec_offload offload,struct macsec_dev * macsec)336 static bool macsec_check_offload(enum macsec_offload offload,
337 struct macsec_dev *macsec)
338 {
339 if (!macsec || !macsec->real_dev)
340 return false;
341
342 if (offload == MACSEC_OFFLOAD_PHY)
343 return macsec->real_dev->phydev &&
344 macsec->real_dev->phydev->macsec_ops;
345 else if (offload == MACSEC_OFFLOAD_MAC)
346 return macsec->real_dev->features & NETIF_F_HW_MACSEC &&
347 macsec->real_dev->macsec_ops;
348
349 return false;
350 }
351
__macsec_get_ops(enum macsec_offload offload,struct macsec_dev * macsec,struct macsec_context * ctx)352 static const struct macsec_ops *__macsec_get_ops(enum macsec_offload offload,
353 struct macsec_dev *macsec,
354 struct macsec_context *ctx)
355 {
356 if (ctx) {
357 memset(ctx, 0, sizeof(*ctx));
358 ctx->offload = offload;
359
360 if (offload == MACSEC_OFFLOAD_PHY)
361 ctx->phydev = macsec->real_dev->phydev;
362 else if (offload == MACSEC_OFFLOAD_MAC)
363 ctx->netdev = macsec->real_dev;
364 }
365
366 if (offload == MACSEC_OFFLOAD_PHY)
367 return macsec->real_dev->phydev->macsec_ops;
368 else
369 return macsec->real_dev->macsec_ops;
370 }
371
372 /* Returns a pointer to the MACsec ops struct if any and updates the MACsec
373 * context device reference if provided.
374 */
macsec_get_ops(struct macsec_dev * macsec,struct macsec_context * ctx)375 static const struct macsec_ops *macsec_get_ops(struct macsec_dev *macsec,
376 struct macsec_context *ctx)
377 {
378 if (!macsec_check_offload(macsec->offload, macsec))
379 return NULL;
380
381 return __macsec_get_ops(macsec->offload, macsec, ctx);
382 }
383
384 /* validate MACsec packet according to IEEE 802.1AE-2018 9.12 */
macsec_validate_skb(struct sk_buff * skb,u16 icv_len,bool xpn)385 static bool macsec_validate_skb(struct sk_buff *skb, u16 icv_len, bool xpn)
386 {
387 struct macsec_eth_header *h = (struct macsec_eth_header *)skb->data;
388 int len = skb->len - 2 * ETH_ALEN;
389 int extra_len = macsec_extra_len(!!(h->tci_an & MACSEC_TCI_SC)) + icv_len;
390
391 /* a) It comprises at least 17 octets */
392 if (skb->len <= 16)
393 return false;
394
395 /* b) MACsec EtherType: already checked */
396
397 /* c) V bit is clear */
398 if (h->tci_an & MACSEC_TCI_VERSION)
399 return false;
400
401 /* d) ES or SCB => !SC */
402 if ((h->tci_an & MACSEC_TCI_ES || h->tci_an & MACSEC_TCI_SCB) &&
403 (h->tci_an & MACSEC_TCI_SC))
404 return false;
405
406 /* e) Bits 7 and 8 of octet 4 of the SecTAG are clear */
407 if (h->unused)
408 return false;
409
410 /* rx.pn != 0 if not XPN (figure 10-5 with 802.11AEbw-2013 amendment) */
411 if (!h->packet_number && !xpn)
412 return false;
413
414 /* length check, f) g) h) i) */
415 if (h->short_length)
416 return len == extra_len + h->short_length;
417 return len >= extra_len + MIN_NON_SHORT_LEN;
418 }
419
420 #define MACSEC_NEEDED_HEADROOM (macsec_extra_len(true))
421 #define MACSEC_NEEDED_TAILROOM MACSEC_STD_ICV_LEN
422
macsec_fill_iv_xpn(unsigned char * iv,ssci_t ssci,u64 pn,salt_t salt)423 static void macsec_fill_iv_xpn(unsigned char *iv, ssci_t ssci, u64 pn,
424 salt_t salt)
425 {
426 struct gcm_iv_xpn *gcm_iv = (struct gcm_iv_xpn *)iv;
427
428 gcm_iv->ssci = ssci ^ salt.ssci;
429 gcm_iv->pn = cpu_to_be64(pn) ^ salt.pn;
430 }
431
macsec_fill_iv(unsigned char * iv,sci_t sci,u32 pn)432 static void macsec_fill_iv(unsigned char *iv, sci_t sci, u32 pn)
433 {
434 struct gcm_iv *gcm_iv = (struct gcm_iv *)iv;
435
436 gcm_iv->sci = sci;
437 gcm_iv->pn = htonl(pn);
438 }
439
macsec_ethhdr(struct sk_buff * skb)440 static struct macsec_eth_header *macsec_ethhdr(struct sk_buff *skb)
441 {
442 return (struct macsec_eth_header *)skb_mac_header(skb);
443 }
444
__macsec_pn_wrapped(struct macsec_secy * secy,struct macsec_tx_sa * tx_sa)445 static void __macsec_pn_wrapped(struct macsec_secy *secy,
446 struct macsec_tx_sa *tx_sa)
447 {
448 pr_debug("PN wrapped, transitioning to !oper\n");
449 tx_sa->active = false;
450 if (secy->protect_frames)
451 secy->operational = false;
452 }
453
macsec_pn_wrapped(struct macsec_secy * secy,struct macsec_tx_sa * tx_sa)454 void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa)
455 {
456 spin_lock_bh(&tx_sa->lock);
457 __macsec_pn_wrapped(secy, tx_sa);
458 spin_unlock_bh(&tx_sa->lock);
459 }
460 EXPORT_SYMBOL_GPL(macsec_pn_wrapped);
461
tx_sa_update_pn(struct macsec_tx_sa * tx_sa,struct macsec_secy * secy)462 static pn_t tx_sa_update_pn(struct macsec_tx_sa *tx_sa,
463 struct macsec_secy *secy)
464 {
465 pn_t pn;
466
467 spin_lock_bh(&tx_sa->lock);
468
469 pn = tx_sa->next_pn_halves;
470 if (secy->xpn)
471 tx_sa->next_pn++;
472 else
473 tx_sa->next_pn_halves.lower++;
474
475 if (tx_sa->next_pn == 0)
476 __macsec_pn_wrapped(secy, tx_sa);
477 spin_unlock_bh(&tx_sa->lock);
478
479 return pn;
480 }
481
macsec_encrypt_finish(struct sk_buff * skb,struct net_device * dev)482 static void macsec_encrypt_finish(struct sk_buff *skb, struct net_device *dev)
483 {
484 struct macsec_dev *macsec = netdev_priv(dev);
485
486 skb->dev = macsec->real_dev;
487 skb_reset_mac_header(skb);
488 skb->protocol = eth_hdr(skb)->h_proto;
489 }
490
macsec_msdu_len(struct sk_buff * skb)491 static unsigned int macsec_msdu_len(struct sk_buff *skb)
492 {
493 struct macsec_dev *macsec = macsec_priv(skb->dev);
494 struct macsec_secy *secy = &macsec->secy;
495 bool sci_present = macsec_skb_cb(skb)->has_sci;
496
497 return skb->len - macsec_hdr_len(sci_present) - secy->icv_len;
498 }
499
macsec_count_tx(struct sk_buff * skb,struct macsec_tx_sc * tx_sc,struct macsec_tx_sa * tx_sa)500 static void macsec_count_tx(struct sk_buff *skb, struct macsec_tx_sc *tx_sc,
501 struct macsec_tx_sa *tx_sa)
502 {
503 unsigned int msdu_len = macsec_msdu_len(skb);
504 struct pcpu_tx_sc_stats *txsc_stats = this_cpu_ptr(tx_sc->stats);
505
506 u64_stats_update_begin(&txsc_stats->syncp);
507 if (tx_sc->encrypt) {
508 txsc_stats->stats.OutOctetsEncrypted += msdu_len;
509 txsc_stats->stats.OutPktsEncrypted++;
510 this_cpu_inc(tx_sa->stats->OutPktsEncrypted);
511 } else {
512 txsc_stats->stats.OutOctetsProtected += msdu_len;
513 txsc_stats->stats.OutPktsProtected++;
514 this_cpu_inc(tx_sa->stats->OutPktsProtected);
515 }
516 u64_stats_update_end(&txsc_stats->syncp);
517 }
518
count_tx(struct net_device * dev,int ret,int len)519 static void count_tx(struct net_device *dev, int ret, int len)
520 {
521 if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN))
522 dev_sw_netstats_tx_add(dev, 1, len);
523 }
524
macsec_encrypt_done(void * data,int err)525 static void macsec_encrypt_done(void *data, int err)
526 {
527 struct sk_buff *skb = data;
528 struct net_device *dev = skb->dev;
529 struct macsec_dev *macsec = macsec_priv(dev);
530 struct macsec_tx_sa *sa = macsec_skb_cb(skb)->tx_sa;
531 int len, ret;
532
533 aead_request_free(macsec_skb_cb(skb)->req);
534
535 rcu_read_lock_bh();
536 macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa);
537 /* packet is encrypted/protected so tx_bytes must be calculated */
538 len = macsec_msdu_len(skb) + 2 * ETH_ALEN;
539 macsec_encrypt_finish(skb, dev);
540 ret = dev_queue_xmit(skb);
541 count_tx(dev, ret, len);
542 rcu_read_unlock_bh();
543
544 macsec_txsa_put(sa);
545 dev_put(dev);
546 }
547
macsec_alloc_req(struct crypto_aead * tfm,unsigned char ** iv,struct scatterlist ** sg,int num_frags)548 static struct aead_request *macsec_alloc_req(struct crypto_aead *tfm,
549 unsigned char **iv,
550 struct scatterlist **sg,
551 int num_frags)
552 {
553 size_t size, iv_offset, sg_offset;
554 struct aead_request *req;
555 void *tmp;
556
557 size = sizeof(struct aead_request) + crypto_aead_reqsize(tfm);
558 iv_offset = size;
559 size += GCM_AES_IV_LEN;
560
561 size = ALIGN(size, __alignof__(struct scatterlist));
562 sg_offset = size;
563 size += sizeof(struct scatterlist) * num_frags;
564
565 tmp = kmalloc(size, GFP_ATOMIC);
566 if (!tmp)
567 return NULL;
568
569 *iv = (unsigned char *)(tmp + iv_offset);
570 *sg = (struct scatterlist *)(tmp + sg_offset);
571 req = tmp;
572
573 aead_request_set_tfm(req, tfm);
574
575 return req;
576 }
577
macsec_encrypt(struct sk_buff * skb,struct net_device * dev)578 static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
579 struct net_device *dev)
580 {
581 int ret;
582 struct scatterlist *sg;
583 struct sk_buff *trailer;
584 unsigned char *iv;
585 struct ethhdr *eth;
586 struct macsec_eth_header *hh;
587 size_t unprotected_len;
588 struct aead_request *req;
589 struct macsec_secy *secy;
590 struct macsec_tx_sc *tx_sc;
591 struct macsec_tx_sa *tx_sa;
592 struct macsec_dev *macsec = macsec_priv(dev);
593 bool sci_present;
594 pn_t pn;
595
596 secy = &macsec->secy;
597 tx_sc = &secy->tx_sc;
598
599 /* 10.5.1 TX SA assignment */
600 tx_sa = macsec_txsa_get(tx_sc->sa[tx_sc->encoding_sa]);
601 if (!tx_sa) {
602 secy->operational = false;
603 kfree_skb(skb);
604 return ERR_PTR(-EINVAL);
605 }
606
607 if (unlikely(skb_headroom(skb) < MACSEC_NEEDED_HEADROOM ||
608 skb_tailroom(skb) < MACSEC_NEEDED_TAILROOM)) {
609 struct sk_buff *nskb = skb_copy_expand(skb,
610 MACSEC_NEEDED_HEADROOM,
611 MACSEC_NEEDED_TAILROOM,
612 GFP_ATOMIC);
613 if (likely(nskb)) {
614 consume_skb(skb);
615 skb = nskb;
616 } else {
617 macsec_txsa_put(tx_sa);
618 kfree_skb(skb);
619 return ERR_PTR(-ENOMEM);
620 }
621 } else {
622 skb = skb_unshare(skb, GFP_ATOMIC);
623 if (!skb) {
624 macsec_txsa_put(tx_sa);
625 return ERR_PTR(-ENOMEM);
626 }
627 }
628
629 unprotected_len = skb->len;
630 eth = eth_hdr(skb);
631 sci_present = macsec_send_sci(secy);
632 hh = skb_push(skb, macsec_extra_len(sci_present));
633 memmove(hh, eth, 2 * ETH_ALEN);
634
635 pn = tx_sa_update_pn(tx_sa, secy);
636 if (pn.full64 == 0) {
637 macsec_txsa_put(tx_sa);
638 kfree_skb(skb);
639 return ERR_PTR(-ENOLINK);
640 }
641 macsec_fill_sectag(hh, secy, pn.lower, sci_present);
642 macsec_set_shortlen(hh, unprotected_len - 2 * ETH_ALEN);
643
644 skb_put(skb, secy->icv_len);
645
646 if (skb->len - ETH_HLEN > macsec_priv(dev)->real_dev->mtu) {
647 struct pcpu_secy_stats *secy_stats = this_cpu_ptr(macsec->stats);
648
649 u64_stats_update_begin(&secy_stats->syncp);
650 secy_stats->stats.OutPktsTooLong++;
651 u64_stats_update_end(&secy_stats->syncp);
652
653 macsec_txsa_put(tx_sa);
654 kfree_skb(skb);
655 return ERR_PTR(-EINVAL);
656 }
657
658 ret = skb_cow_data(skb, 0, &trailer);
659 if (unlikely(ret < 0)) {
660 macsec_txsa_put(tx_sa);
661 kfree_skb(skb);
662 return ERR_PTR(ret);
663 }
664
665 req = macsec_alloc_req(tx_sa->key.tfm, &iv, &sg, ret);
666 if (!req) {
667 macsec_txsa_put(tx_sa);
668 kfree_skb(skb);
669 return ERR_PTR(-ENOMEM);
670 }
671
672 if (secy->xpn)
673 macsec_fill_iv_xpn(iv, tx_sa->ssci, pn.full64, tx_sa->key.salt);
674 else
675 macsec_fill_iv(iv, secy->sci, pn.lower);
676
677 sg_init_table(sg, ret);
678 ret = skb_to_sgvec(skb, sg, 0, skb->len);
679 if (unlikely(ret < 0)) {
680 aead_request_free(req);
681 macsec_txsa_put(tx_sa);
682 kfree_skb(skb);
683 return ERR_PTR(ret);
684 }
685
686 if (tx_sc->encrypt) {
687 int len = skb->len - macsec_hdr_len(sci_present) -
688 secy->icv_len;
689 aead_request_set_crypt(req, sg, sg, len, iv);
690 aead_request_set_ad(req, macsec_hdr_len(sci_present));
691 } else {
692 aead_request_set_crypt(req, sg, sg, 0, iv);
693 aead_request_set_ad(req, skb->len - secy->icv_len);
694 }
695
696 macsec_skb_cb(skb)->req = req;
697 macsec_skb_cb(skb)->tx_sa = tx_sa;
698 macsec_skb_cb(skb)->has_sci = sci_present;
699 aead_request_set_callback(req, 0, macsec_encrypt_done, skb);
700
701 dev_hold(skb->dev);
702 ret = crypto_aead_encrypt(req);
703 if (ret == -EINPROGRESS) {
704 return ERR_PTR(ret);
705 } else if (ret != 0) {
706 dev_put(skb->dev);
707 kfree_skb(skb);
708 aead_request_free(req);
709 macsec_txsa_put(tx_sa);
710 return ERR_PTR(-EINVAL);
711 }
712
713 dev_put(skb->dev);
714 aead_request_free(req);
715 macsec_txsa_put(tx_sa);
716
717 return skb;
718 }
719
macsec_post_decrypt(struct sk_buff * skb,struct macsec_secy * secy,u32 pn)720 static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u32 pn)
721 {
722 struct macsec_rx_sa *rx_sa = macsec_skb_cb(skb)->rx_sa;
723 struct pcpu_rx_sc_stats *rxsc_stats = this_cpu_ptr(rx_sa->sc->stats);
724 struct macsec_eth_header *hdr = macsec_ethhdr(skb);
725 u32 lowest_pn = 0;
726
727 spin_lock(&rx_sa->lock);
728 if (rx_sa->next_pn_halves.lower >= secy->replay_window)
729 lowest_pn = rx_sa->next_pn_halves.lower - secy->replay_window;
730
731 /* Now perform replay protection check again
732 * (see IEEE 802.1AE-2006 figure 10-5)
733 */
734 if (secy->replay_protect && pn < lowest_pn &&
735 (!secy->xpn || pn_same_half(pn, lowest_pn))) {
736 spin_unlock(&rx_sa->lock);
737 u64_stats_update_begin(&rxsc_stats->syncp);
738 rxsc_stats->stats.InPktsLate++;
739 u64_stats_update_end(&rxsc_stats->syncp);
740 DEV_STATS_INC(secy->netdev, rx_dropped);
741 return false;
742 }
743
744 if (secy->validate_frames != MACSEC_VALIDATE_DISABLED) {
745 unsigned int msdu_len = macsec_msdu_len(skb);
746 u64_stats_update_begin(&rxsc_stats->syncp);
747 if (hdr->tci_an & MACSEC_TCI_E)
748 rxsc_stats->stats.InOctetsDecrypted += msdu_len;
749 else
750 rxsc_stats->stats.InOctetsValidated += msdu_len;
751 u64_stats_update_end(&rxsc_stats->syncp);
752 }
753
754 if (!macsec_skb_cb(skb)->valid) {
755 spin_unlock(&rx_sa->lock);
756
757 /* 10.6.5 */
758 if (hdr->tci_an & MACSEC_TCI_C ||
759 secy->validate_frames == MACSEC_VALIDATE_STRICT) {
760 u64_stats_update_begin(&rxsc_stats->syncp);
761 rxsc_stats->stats.InPktsNotValid++;
762 u64_stats_update_end(&rxsc_stats->syncp);
763 this_cpu_inc(rx_sa->stats->InPktsNotValid);
764 DEV_STATS_INC(secy->netdev, rx_errors);
765 return false;
766 }
767
768 u64_stats_update_begin(&rxsc_stats->syncp);
769 if (secy->validate_frames == MACSEC_VALIDATE_CHECK) {
770 rxsc_stats->stats.InPktsInvalid++;
771 this_cpu_inc(rx_sa->stats->InPktsInvalid);
772 } else if (pn < lowest_pn) {
773 rxsc_stats->stats.InPktsDelayed++;
774 } else {
775 rxsc_stats->stats.InPktsUnchecked++;
776 }
777 u64_stats_update_end(&rxsc_stats->syncp);
778 } else {
779 u64_stats_update_begin(&rxsc_stats->syncp);
780 if (pn < lowest_pn) {
781 rxsc_stats->stats.InPktsDelayed++;
782 } else {
783 rxsc_stats->stats.InPktsOK++;
784 this_cpu_inc(rx_sa->stats->InPktsOK);
785 }
786 u64_stats_update_end(&rxsc_stats->syncp);
787
788 // Instead of "pn >=" - to support pn overflow in xpn
789 if (pn + 1 > rx_sa->next_pn_halves.lower) {
790 rx_sa->next_pn_halves.lower = pn + 1;
791 } else if (secy->xpn &&
792 !pn_same_half(pn, rx_sa->next_pn_halves.lower)) {
793 rx_sa->next_pn_halves.upper++;
794 rx_sa->next_pn_halves.lower = pn + 1;
795 }
796
797 spin_unlock(&rx_sa->lock);
798 }
799
800 return true;
801 }
802
macsec_reset_skb(struct sk_buff * skb,struct net_device * dev)803 static void macsec_reset_skb(struct sk_buff *skb, struct net_device *dev)
804 {
805 skb->pkt_type = PACKET_HOST;
806 skb->protocol = eth_type_trans(skb, dev);
807
808 skb_reset_network_header(skb);
809 if (!skb_transport_header_was_set(skb))
810 skb_reset_transport_header(skb);
811 skb_reset_mac_len(skb);
812 }
813
macsec_finalize_skb(struct sk_buff * skb,u8 icv_len,u8 hdr_len)814 static void macsec_finalize_skb(struct sk_buff *skb, u8 icv_len, u8 hdr_len)
815 {
816 skb->ip_summed = CHECKSUM_NONE;
817 memmove(skb->data + hdr_len, skb->data, 2 * ETH_ALEN);
818 skb_pull(skb, hdr_len);
819 pskb_trim_unique(skb, skb->len - icv_len);
820 }
821
count_rx(struct net_device * dev,int len)822 static void count_rx(struct net_device *dev, int len)
823 {
824 dev_sw_netstats_rx_add(dev, len);
825 }
826
macsec_decrypt_done(void * data,int err)827 static void macsec_decrypt_done(void *data, int err)
828 {
829 struct sk_buff *skb = data;
830 struct net_device *dev = skb->dev;
831 struct macsec_dev *macsec = macsec_priv(dev);
832 struct macsec_rx_sa *rx_sa = macsec_skb_cb(skb)->rx_sa;
833 struct macsec_rx_sc *rx_sc = rx_sa->sc;
834 int len;
835 u32 pn;
836
837 aead_request_free(macsec_skb_cb(skb)->req);
838
839 if (!err)
840 macsec_skb_cb(skb)->valid = true;
841
842 rcu_read_lock_bh();
843 pn = ntohl(macsec_ethhdr(skb)->packet_number);
844 if (!macsec_post_decrypt(skb, &macsec->secy, pn)) {
845 rcu_read_unlock_bh();
846 kfree_skb(skb);
847 goto out;
848 }
849
850 macsec_finalize_skb(skb, macsec->secy.icv_len,
851 macsec_extra_len(macsec_skb_cb(skb)->has_sci));
852 len = skb->len;
853 macsec_reset_skb(skb, macsec->secy.netdev);
854
855 if (gro_cells_receive(&macsec->gro_cells, skb) == NET_RX_SUCCESS)
856 count_rx(dev, len);
857
858 rcu_read_unlock_bh();
859
860 out:
861 macsec_rxsa_put(rx_sa);
862 macsec_rxsc_put(rx_sc);
863 dev_put(dev);
864 }
865
macsec_decrypt(struct sk_buff * skb,struct net_device * dev,struct macsec_rx_sa * rx_sa,sci_t sci,struct macsec_secy * secy)866 static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
867 struct net_device *dev,
868 struct macsec_rx_sa *rx_sa,
869 sci_t sci,
870 struct macsec_secy *secy)
871 {
872 int ret;
873 struct scatterlist *sg;
874 struct sk_buff *trailer;
875 unsigned char *iv;
876 struct aead_request *req;
877 struct macsec_eth_header *hdr;
878 u32 hdr_pn;
879 u16 icv_len = secy->icv_len;
880
881 macsec_skb_cb(skb)->valid = false;
882 skb = skb_share_check(skb, GFP_ATOMIC);
883 if (!skb)
884 return ERR_PTR(-ENOMEM);
885
886 ret = skb_cow_data(skb, 0, &trailer);
887 if (unlikely(ret < 0)) {
888 kfree_skb(skb);
889 return ERR_PTR(ret);
890 }
891 req = macsec_alloc_req(rx_sa->key.tfm, &iv, &sg, ret);
892 if (!req) {
893 kfree_skb(skb);
894 return ERR_PTR(-ENOMEM);
895 }
896
897 hdr = (struct macsec_eth_header *)skb->data;
898 hdr_pn = ntohl(hdr->packet_number);
899
900 if (secy->xpn) {
901 pn_t recovered_pn = rx_sa->next_pn_halves;
902
903 recovered_pn.lower = hdr_pn;
904 if (hdr_pn < rx_sa->next_pn_halves.lower &&
905 !pn_same_half(hdr_pn, rx_sa->next_pn_halves.lower))
906 recovered_pn.upper++;
907
908 macsec_fill_iv_xpn(iv, rx_sa->ssci, recovered_pn.full64,
909 rx_sa->key.salt);
910 } else {
911 macsec_fill_iv(iv, sci, hdr_pn);
912 }
913
914 sg_init_table(sg, ret);
915 ret = skb_to_sgvec(skb, sg, 0, skb->len);
916 if (unlikely(ret < 0)) {
917 aead_request_free(req);
918 kfree_skb(skb);
919 return ERR_PTR(ret);
920 }
921
922 if (hdr->tci_an & MACSEC_TCI_E) {
923 /* confidentiality: ethernet + macsec header
924 * authenticated, encrypted payload
925 */
926 int len = skb->len - macsec_hdr_len(macsec_skb_cb(skb)->has_sci);
927
928 aead_request_set_crypt(req, sg, sg, len, iv);
929 aead_request_set_ad(req, macsec_hdr_len(macsec_skb_cb(skb)->has_sci));
930 skb = skb_unshare(skb, GFP_ATOMIC);
931 if (!skb) {
932 aead_request_free(req);
933 return ERR_PTR(-ENOMEM);
934 }
935 } else {
936 /* integrity only: all headers + data authenticated */
937 aead_request_set_crypt(req, sg, sg, icv_len, iv);
938 aead_request_set_ad(req, skb->len - icv_len);
939 }
940
941 macsec_skb_cb(skb)->req = req;
942 skb->dev = dev;
943 aead_request_set_callback(req, 0, macsec_decrypt_done, skb);
944
945 dev_hold(dev);
946 ret = crypto_aead_decrypt(req);
947 if (ret == -EINPROGRESS) {
948 return ERR_PTR(ret);
949 } else if (ret != 0) {
950 /* decryption/authentication failed
951 * 10.6 if validateFrames is disabled, deliver anyway
952 */
953 if (ret != -EBADMSG) {
954 kfree_skb(skb);
955 skb = ERR_PTR(ret);
956 }
957 } else {
958 macsec_skb_cb(skb)->valid = true;
959 }
960 dev_put(dev);
961
962 aead_request_free(req);
963
964 return skb;
965 }
966
find_rx_sc(struct macsec_secy * secy,sci_t sci)967 static struct macsec_rx_sc *find_rx_sc(struct macsec_secy *secy, sci_t sci)
968 {
969 struct macsec_rx_sc *rx_sc;
970
971 for_each_rxsc(secy, rx_sc) {
972 if (rx_sc->sci == sci)
973 return rx_sc;
974 }
975
976 return NULL;
977 }
978
find_rx_sc_rtnl(struct macsec_secy * secy,sci_t sci)979 static struct macsec_rx_sc *find_rx_sc_rtnl(struct macsec_secy *secy, sci_t sci)
980 {
981 struct macsec_rx_sc *rx_sc;
982
983 for_each_rxsc_rtnl(secy, rx_sc) {
984 if (rx_sc->sci == sci)
985 return rx_sc;
986 }
987
988 return NULL;
989 }
990
handle_not_macsec(struct sk_buff * skb)991 static enum rx_handler_result handle_not_macsec(struct sk_buff *skb)
992 {
993 /* Deliver to the uncontrolled port by default */
994 enum rx_handler_result ret = RX_HANDLER_PASS;
995 struct ethhdr *hdr = eth_hdr(skb);
996 struct metadata_dst *md_dst;
997 struct macsec_rxh_data *rxd;
998 struct macsec_dev *macsec;
999 bool is_macsec_md_dst;
1000
1001 rcu_read_lock();
1002 rxd = macsec_data_rcu(skb->dev);
1003 md_dst = skb_metadata_dst(skb);
1004 is_macsec_md_dst = md_dst && md_dst->type == METADATA_MACSEC;
1005
1006 list_for_each_entry_rcu(macsec, &rxd->secys, secys) {
1007 struct sk_buff *nskb;
1008 struct pcpu_secy_stats *secy_stats = this_cpu_ptr(macsec->stats);
1009 struct net_device *ndev = macsec->secy.netdev;
1010
1011 /* If h/w offloading is enabled, HW decodes frames and strips
1012 * the SecTAG, so we have to deduce which port to deliver to.
1013 */
1014 if (macsec_is_offloaded(macsec) && netif_running(ndev)) {
1015 const struct macsec_ops *ops;
1016
1017 ops = macsec_get_ops(macsec, NULL);
1018
1019 if (ops->rx_uses_md_dst && !is_macsec_md_dst)
1020 continue;
1021
1022 if (is_macsec_md_dst) {
1023 struct macsec_rx_sc *rx_sc;
1024
1025 /* All drivers that implement MACsec offload
1026 * support using skb metadata destinations must
1027 * indicate that they do so.
1028 */
1029 DEBUG_NET_WARN_ON_ONCE(!ops->rx_uses_md_dst);
1030 rx_sc = find_rx_sc(&macsec->secy,
1031 md_dst->u.macsec_info.sci);
1032 if (!rx_sc)
1033 continue;
1034 /* device indicated macsec offload occurred */
1035 skb->dev = ndev;
1036 skb->pkt_type = PACKET_HOST;
1037 eth_skb_pkt_type(skb, ndev);
1038 ret = RX_HANDLER_ANOTHER;
1039 goto out;
1040 }
1041
1042 /* This datapath is insecure because it is unable to
1043 * enforce isolation of broadcast/multicast traffic and
1044 * unicast traffic with promiscuous mode on the macsec
1045 * netdev. Since the core stack has no mechanism to
1046 * check that the hardware did indeed receive MACsec
1047 * traffic, it is possible that the response handling
1048 * done by the MACsec port was to a plaintext packet.
1049 * This violates the MACsec protocol standard.
1050 */
1051 if (ether_addr_equal_64bits(hdr->h_dest,
1052 ndev->dev_addr)) {
1053 /* exact match, divert skb to this port */
1054 skb->dev = ndev;
1055 skb->pkt_type = PACKET_HOST;
1056 ret = RX_HANDLER_ANOTHER;
1057 goto out;
1058 } else if (is_multicast_ether_addr_64bits(
1059 hdr->h_dest)) {
1060 /* multicast frame, deliver on this port too */
1061 nskb = skb_clone(skb, GFP_ATOMIC);
1062 if (!nskb)
1063 break;
1064
1065 nskb->dev = ndev;
1066 eth_skb_pkt_type(nskb, ndev);
1067
1068 __netif_rx(nskb);
1069 } else if (ndev->flags & IFF_PROMISC) {
1070 skb->dev = ndev;
1071 skb->pkt_type = PACKET_HOST;
1072 ret = RX_HANDLER_ANOTHER;
1073 goto out;
1074 }
1075
1076 continue;
1077 }
1078
1079 /* 10.6 If the management control validateFrames is not
1080 * Strict, frames without a SecTAG are received, counted, and
1081 * delivered to the Controlled Port
1082 */
1083 if (macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {
1084 u64_stats_update_begin(&secy_stats->syncp);
1085 secy_stats->stats.InPktsNoTag++;
1086 u64_stats_update_end(&secy_stats->syncp);
1087 DEV_STATS_INC(macsec->secy.netdev, rx_dropped);
1088 continue;
1089 }
1090
1091 /* deliver on this port */
1092 nskb = skb_clone(skb, GFP_ATOMIC);
1093 if (!nskb)
1094 break;
1095
1096 nskb->dev = ndev;
1097
1098 if (__netif_rx(nskb) == NET_RX_SUCCESS) {
1099 u64_stats_update_begin(&secy_stats->syncp);
1100 secy_stats->stats.InPktsUntagged++;
1101 u64_stats_update_end(&secy_stats->syncp);
1102 }
1103 }
1104
1105 out:
1106 rcu_read_unlock();
1107 return ret;
1108 }
1109
macsec_handle_frame(struct sk_buff ** pskb)1110 static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
1111 {
1112 struct sk_buff *skb = *pskb;
1113 struct net_device *dev = skb->dev;
1114 struct macsec_eth_header *hdr;
1115 struct macsec_secy *secy = NULL;
1116 struct macsec_rx_sc *rx_sc;
1117 struct macsec_rx_sa *rx_sa;
1118 struct macsec_rxh_data *rxd;
1119 struct macsec_dev *macsec;
1120 unsigned int len;
1121 sci_t sci;
1122 u32 hdr_pn;
1123 bool cbit;
1124 struct pcpu_rx_sc_stats *rxsc_stats;
1125 struct pcpu_secy_stats *secy_stats;
1126 bool pulled_sci;
1127 int ret;
1128
1129 if (skb_headroom(skb) < ETH_HLEN)
1130 goto drop_direct;
1131
1132 hdr = macsec_ethhdr(skb);
1133 if (hdr->eth.h_proto != htons(ETH_P_MACSEC))
1134 return handle_not_macsec(skb);
1135
1136 skb = skb_unshare(skb, GFP_ATOMIC);
1137 *pskb = skb;
1138 if (!skb)
1139 return RX_HANDLER_CONSUMED;
1140
1141 pulled_sci = pskb_may_pull(skb, macsec_extra_len(true));
1142 if (!pulled_sci) {
1143 if (!pskb_may_pull(skb, macsec_extra_len(false)))
1144 goto drop_direct;
1145 }
1146
1147 hdr = macsec_ethhdr(skb);
1148
1149 /* Frames with a SecTAG that has the TCI E bit set but the C
1150 * bit clear are discarded, as this reserved encoding is used
1151 * to identify frames with a SecTAG that are not to be
1152 * delivered to the Controlled Port.
1153 */
1154 if ((hdr->tci_an & (MACSEC_TCI_C | MACSEC_TCI_E)) == MACSEC_TCI_E)
1155 return RX_HANDLER_PASS;
1156
1157 /* now, pull the extra length */
1158 if (hdr->tci_an & MACSEC_TCI_SC) {
1159 if (!pulled_sci)
1160 goto drop_direct;
1161 }
1162
1163 /* ethernet header is part of crypto processing */
1164 skb_push(skb, ETH_HLEN);
1165
1166 macsec_skb_cb(skb)->has_sci = !!(hdr->tci_an & MACSEC_TCI_SC);
1167 macsec_skb_cb(skb)->assoc_num = hdr->tci_an & MACSEC_AN_MASK;
1168 sci = macsec_frame_sci(hdr, macsec_skb_cb(skb)->has_sci);
1169
1170 rcu_read_lock();
1171 rxd = macsec_data_rcu(skb->dev);
1172
1173 list_for_each_entry_rcu(macsec, &rxd->secys, secys) {
1174 struct macsec_rx_sc *sc = find_rx_sc(&macsec->secy, sci);
1175
1176 sc = sc ? macsec_rxsc_get(sc) : NULL;
1177
1178 if (sc) {
1179 secy = &macsec->secy;
1180 rx_sc = sc;
1181 break;
1182 }
1183 }
1184
1185 if (!secy)
1186 goto nosci;
1187
1188 dev = secy->netdev;
1189 macsec = macsec_priv(dev);
1190 secy_stats = this_cpu_ptr(macsec->stats);
1191 rxsc_stats = this_cpu_ptr(rx_sc->stats);
1192
1193 if (!macsec_validate_skb(skb, secy->icv_len, secy->xpn)) {
1194 u64_stats_update_begin(&secy_stats->syncp);
1195 secy_stats->stats.InPktsBadTag++;
1196 u64_stats_update_end(&secy_stats->syncp);
1197 DEV_STATS_INC(secy->netdev, rx_errors);
1198 goto drop_nosa;
1199 }
1200
1201 rx_sa = macsec_rxsa_get(rx_sc->sa[macsec_skb_cb(skb)->assoc_num]);
1202 if (!rx_sa) {
1203 /* 10.6.1 if the SA is not in use */
1204
1205 /* If validateFrames is Strict or the C bit in the
1206 * SecTAG is set, discard
1207 */
1208 struct macsec_rx_sa *active_rx_sa = macsec_active_rxsa_get(rx_sc);
1209 if (hdr->tci_an & MACSEC_TCI_C ||
1210 secy->validate_frames == MACSEC_VALIDATE_STRICT) {
1211 u64_stats_update_begin(&rxsc_stats->syncp);
1212 rxsc_stats->stats.InPktsNotUsingSA++;
1213 u64_stats_update_end(&rxsc_stats->syncp);
1214 DEV_STATS_INC(secy->netdev, rx_errors);
1215 if (active_rx_sa)
1216 this_cpu_inc(active_rx_sa->stats->InPktsNotUsingSA);
1217 goto drop_nosa;
1218 }
1219
1220 /* not Strict, the frame (with the SecTAG and ICV
1221 * removed) is delivered to the Controlled Port.
1222 */
1223 u64_stats_update_begin(&rxsc_stats->syncp);
1224 rxsc_stats->stats.InPktsUnusedSA++;
1225 u64_stats_update_end(&rxsc_stats->syncp);
1226 if (active_rx_sa)
1227 this_cpu_inc(active_rx_sa->stats->InPktsUnusedSA);
1228 goto deliver;
1229 }
1230
1231 /* First, PN check to avoid decrypting obviously wrong packets */
1232 hdr_pn = ntohl(hdr->packet_number);
1233 if (secy->replay_protect) {
1234 bool late;
1235
1236 spin_lock(&rx_sa->lock);
1237 late = rx_sa->next_pn_halves.lower >= secy->replay_window &&
1238 hdr_pn < (rx_sa->next_pn_halves.lower - secy->replay_window);
1239
1240 if (secy->xpn)
1241 late = late && pn_same_half(rx_sa->next_pn_halves.lower, hdr_pn);
1242 spin_unlock(&rx_sa->lock);
1243
1244 if (late) {
1245 u64_stats_update_begin(&rxsc_stats->syncp);
1246 rxsc_stats->stats.InPktsLate++;
1247 u64_stats_update_end(&rxsc_stats->syncp);
1248 DEV_STATS_INC(macsec->secy.netdev, rx_dropped);
1249 goto drop;
1250 }
1251 }
1252
1253 macsec_skb_cb(skb)->rx_sa = rx_sa;
1254
1255 /* Disabled && !changed text => skip validation */
1256 if (hdr->tci_an & MACSEC_TCI_C ||
1257 secy->validate_frames != MACSEC_VALIDATE_DISABLED)
1258 skb = macsec_decrypt(skb, dev, rx_sa, sci, secy);
1259
1260 if (IS_ERR(skb)) {
1261 /* the decrypt callback needs the reference */
1262 if (PTR_ERR(skb) != -EINPROGRESS) {
1263 macsec_rxsa_put(rx_sa);
1264 macsec_rxsc_put(rx_sc);
1265 }
1266 rcu_read_unlock();
1267 *pskb = NULL;
1268 return RX_HANDLER_CONSUMED;
1269 }
1270
1271 if (!macsec_post_decrypt(skb, secy, hdr_pn))
1272 goto drop;
1273
1274 deliver:
1275 macsec_finalize_skb(skb, secy->icv_len,
1276 macsec_extra_len(macsec_skb_cb(skb)->has_sci));
1277 len = skb->len;
1278 macsec_reset_skb(skb, secy->netdev);
1279
1280 if (rx_sa)
1281 macsec_rxsa_put(rx_sa);
1282 macsec_rxsc_put(rx_sc);
1283
1284 skb_orphan(skb);
1285 ret = gro_cells_receive(&macsec->gro_cells, skb);
1286 if (ret == NET_RX_SUCCESS)
1287 count_rx(dev, len);
1288 else
1289 DEV_STATS_INC(macsec->secy.netdev, rx_dropped);
1290
1291 rcu_read_unlock();
1292
1293 *pskb = NULL;
1294 return RX_HANDLER_CONSUMED;
1295
1296 drop:
1297 macsec_rxsa_put(rx_sa);
1298 drop_nosa:
1299 macsec_rxsc_put(rx_sc);
1300 rcu_read_unlock();
1301 drop_direct:
1302 kfree_skb(skb);
1303 *pskb = NULL;
1304 return RX_HANDLER_CONSUMED;
1305
1306 nosci:
1307 /* 10.6.1 if the SC is not found */
1308 cbit = !!(hdr->tci_an & MACSEC_TCI_C);
1309 if (!cbit)
1310 macsec_finalize_skb(skb, MACSEC_DEFAULT_ICV_LEN,
1311 macsec_extra_len(macsec_skb_cb(skb)->has_sci));
1312
1313 list_for_each_entry_rcu(macsec, &rxd->secys, secys) {
1314 struct sk_buff *nskb;
1315
1316 secy_stats = this_cpu_ptr(macsec->stats);
1317
1318 /* If validateFrames is Strict or the C bit in the
1319 * SecTAG is set, discard
1320 */
1321 if (cbit ||
1322 macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {
1323 u64_stats_update_begin(&secy_stats->syncp);
1324 secy_stats->stats.InPktsNoSCI++;
1325 u64_stats_update_end(&secy_stats->syncp);
1326 DEV_STATS_INC(macsec->secy.netdev, rx_errors);
1327 continue;
1328 }
1329
1330 /* not strict, the frame (with the SecTAG and ICV
1331 * removed) is delivered to the Controlled Port.
1332 */
1333 nskb = skb_clone(skb, GFP_ATOMIC);
1334 if (!nskb)
1335 break;
1336
1337 macsec_reset_skb(nskb, macsec->secy.netdev);
1338
1339 ret = __netif_rx(nskb);
1340 if (ret == NET_RX_SUCCESS) {
1341 u64_stats_update_begin(&secy_stats->syncp);
1342 secy_stats->stats.InPktsUnknownSCI++;
1343 u64_stats_update_end(&secy_stats->syncp);
1344 } else {
1345 DEV_STATS_INC(macsec->secy.netdev, rx_dropped);
1346 }
1347 }
1348
1349 rcu_read_unlock();
1350 *pskb = skb;
1351 return RX_HANDLER_PASS;
1352 }
1353
macsec_alloc_tfm(char * key,int key_len,int icv_len)1354 static struct crypto_aead *macsec_alloc_tfm(char *key, int key_len, int icv_len)
1355 {
1356 struct crypto_aead *tfm;
1357 int ret;
1358
1359 tfm = crypto_alloc_aead("gcm(aes)", 0, 0);
1360
1361 if (IS_ERR(tfm))
1362 return tfm;
1363
1364 ret = crypto_aead_setkey(tfm, key, key_len);
1365 if (ret < 0)
1366 goto fail;
1367
1368 ret = crypto_aead_setauthsize(tfm, icv_len);
1369 if (ret < 0)
1370 goto fail;
1371
1372 return tfm;
1373 fail:
1374 crypto_free_aead(tfm);
1375 return ERR_PTR(ret);
1376 }
1377
init_rx_sa(struct macsec_rx_sa * rx_sa,char * sak,int key_len,int icv_len)1378 static int init_rx_sa(struct macsec_rx_sa *rx_sa, char *sak, int key_len,
1379 int icv_len)
1380 {
1381 rx_sa->stats = alloc_percpu(struct macsec_rx_sa_stats);
1382 if (!rx_sa->stats)
1383 return -ENOMEM;
1384
1385 rx_sa->key.tfm = macsec_alloc_tfm(sak, key_len, icv_len);
1386 if (IS_ERR(rx_sa->key.tfm)) {
1387 free_percpu(rx_sa->stats);
1388 return PTR_ERR(rx_sa->key.tfm);
1389 }
1390
1391 rx_sa->ssci = MACSEC_UNDEF_SSCI;
1392 rx_sa->active = false;
1393 rx_sa->next_pn = 1;
1394 refcount_set(&rx_sa->refcnt, 1);
1395 spin_lock_init(&rx_sa->lock);
1396
1397 return 0;
1398 }
1399
clear_rx_sa(struct macsec_rx_sa * rx_sa)1400 static void clear_rx_sa(struct macsec_rx_sa *rx_sa)
1401 {
1402 rx_sa->active = false;
1403
1404 macsec_rxsa_put(rx_sa);
1405 }
1406
free_rx_sc(struct macsec_rx_sc * rx_sc)1407 static void free_rx_sc(struct macsec_rx_sc *rx_sc)
1408 {
1409 int i;
1410
1411 for (i = 0; i < MACSEC_NUM_AN; i++) {
1412 struct macsec_rx_sa *sa = rtnl_dereference(rx_sc->sa[i]);
1413
1414 RCU_INIT_POINTER(rx_sc->sa[i], NULL);
1415 if (sa)
1416 clear_rx_sa(sa);
1417 }
1418
1419 macsec_rxsc_put(rx_sc);
1420 }
1421
del_rx_sc(struct macsec_secy * secy,sci_t sci)1422 static struct macsec_rx_sc *del_rx_sc(struct macsec_secy *secy, sci_t sci)
1423 {
1424 struct macsec_rx_sc *rx_sc, __rcu **rx_scp;
1425
1426 for (rx_scp = &secy->rx_sc, rx_sc = rtnl_dereference(*rx_scp);
1427 rx_sc;
1428 rx_scp = &rx_sc->next, rx_sc = rtnl_dereference(*rx_scp)) {
1429 if (rx_sc->sci == sci) {
1430 if (rx_sc->active)
1431 secy->n_rx_sc--;
1432 rcu_assign_pointer(*rx_scp, rx_sc->next);
1433 return rx_sc;
1434 }
1435 }
1436
1437 return NULL;
1438 }
1439
create_rx_sc(struct net_device * dev,sci_t sci,bool active)1440 static struct macsec_rx_sc *create_rx_sc(struct net_device *dev, sci_t sci,
1441 bool active)
1442 {
1443 struct macsec_rx_sc *rx_sc;
1444 struct macsec_dev *macsec;
1445 struct net_device *real_dev = macsec_priv(dev)->real_dev;
1446 struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev);
1447 struct macsec_secy *secy;
1448
1449 list_for_each_entry(macsec, &rxd->secys, secys) {
1450 if (find_rx_sc_rtnl(&macsec->secy, sci))
1451 return ERR_PTR(-EEXIST);
1452 }
1453
1454 rx_sc = kzalloc(sizeof(*rx_sc), GFP_KERNEL);
1455 if (!rx_sc)
1456 return ERR_PTR(-ENOMEM);
1457
1458 rx_sc->stats = netdev_alloc_pcpu_stats(struct pcpu_rx_sc_stats);
1459 if (!rx_sc->stats) {
1460 kfree(rx_sc);
1461 return ERR_PTR(-ENOMEM);
1462 }
1463
1464 rx_sc->sci = sci;
1465 rx_sc->active = active;
1466 refcount_set(&rx_sc->refcnt, 1);
1467
1468 secy = &macsec_priv(dev)->secy;
1469 rcu_assign_pointer(rx_sc->next, secy->rx_sc);
1470 rcu_assign_pointer(secy->rx_sc, rx_sc);
1471
1472 if (rx_sc->active)
1473 secy->n_rx_sc++;
1474
1475 return rx_sc;
1476 }
1477
init_tx_sa(struct macsec_tx_sa * tx_sa,char * sak,int key_len,int icv_len)1478 static int init_tx_sa(struct macsec_tx_sa *tx_sa, char *sak, int key_len,
1479 int icv_len)
1480 {
1481 tx_sa->stats = alloc_percpu(struct macsec_tx_sa_stats);
1482 if (!tx_sa->stats)
1483 return -ENOMEM;
1484
1485 tx_sa->key.tfm = macsec_alloc_tfm(sak, key_len, icv_len);
1486 if (IS_ERR(tx_sa->key.tfm)) {
1487 free_percpu(tx_sa->stats);
1488 return PTR_ERR(tx_sa->key.tfm);
1489 }
1490
1491 tx_sa->ssci = MACSEC_UNDEF_SSCI;
1492 tx_sa->active = false;
1493 refcount_set(&tx_sa->refcnt, 1);
1494 spin_lock_init(&tx_sa->lock);
1495
1496 return 0;
1497 }
1498
clear_tx_sa(struct macsec_tx_sa * tx_sa)1499 static void clear_tx_sa(struct macsec_tx_sa *tx_sa)
1500 {
1501 tx_sa->active = false;
1502
1503 macsec_txsa_put(tx_sa);
1504 }
1505
1506 static struct genl_family macsec_fam;
1507
get_dev_from_nl(struct net * net,struct nlattr ** attrs)1508 static struct net_device *get_dev_from_nl(struct net *net,
1509 struct nlattr **attrs)
1510 {
1511 int ifindex = nla_get_u32(attrs[MACSEC_ATTR_IFINDEX]);
1512 struct net_device *dev;
1513
1514 dev = __dev_get_by_index(net, ifindex);
1515 if (!dev)
1516 return ERR_PTR(-ENODEV);
1517
1518 if (!netif_is_macsec(dev))
1519 return ERR_PTR(-ENODEV);
1520
1521 return dev;
1522 }
1523
nla_get_offload(const struct nlattr * nla)1524 static enum macsec_offload nla_get_offload(const struct nlattr *nla)
1525 {
1526 return (__force enum macsec_offload)nla_get_u8(nla);
1527 }
1528
nla_get_sci(const struct nlattr * nla)1529 static sci_t nla_get_sci(const struct nlattr *nla)
1530 {
1531 return (__force sci_t)nla_get_u64(nla);
1532 }
1533
nla_put_sci(struct sk_buff * skb,int attrtype,sci_t value,int padattr)1534 static int nla_put_sci(struct sk_buff *skb, int attrtype, sci_t value,
1535 int padattr)
1536 {
1537 return nla_put_u64_64bit(skb, attrtype, (__force u64)value, padattr);
1538 }
1539
nla_get_ssci(const struct nlattr * nla)1540 static ssci_t nla_get_ssci(const struct nlattr *nla)
1541 {
1542 return (__force ssci_t)nla_get_u32(nla);
1543 }
1544
nla_put_ssci(struct sk_buff * skb,int attrtype,ssci_t value)1545 static int nla_put_ssci(struct sk_buff *skb, int attrtype, ssci_t value)
1546 {
1547 return nla_put_u32(skb, attrtype, (__force u64)value);
1548 }
1549
get_txsa_from_nl(struct net * net,struct nlattr ** attrs,struct nlattr ** tb_sa,struct net_device ** devp,struct macsec_secy ** secyp,struct macsec_tx_sc ** scp,u8 * assoc_num)1550 static struct macsec_tx_sa *get_txsa_from_nl(struct net *net,
1551 struct nlattr **attrs,
1552 struct nlattr **tb_sa,
1553 struct net_device **devp,
1554 struct macsec_secy **secyp,
1555 struct macsec_tx_sc **scp,
1556 u8 *assoc_num)
1557 {
1558 struct net_device *dev;
1559 struct macsec_secy *secy;
1560 struct macsec_tx_sc *tx_sc;
1561 struct macsec_tx_sa *tx_sa;
1562
1563 if (!tb_sa[MACSEC_SA_ATTR_AN])
1564 return ERR_PTR(-EINVAL);
1565
1566 *assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]);
1567
1568 dev = get_dev_from_nl(net, attrs);
1569 if (IS_ERR(dev))
1570 return ERR_CAST(dev);
1571
1572 if (*assoc_num >= MACSEC_NUM_AN)
1573 return ERR_PTR(-EINVAL);
1574
1575 secy = &macsec_priv(dev)->secy;
1576 tx_sc = &secy->tx_sc;
1577
1578 tx_sa = rtnl_dereference(tx_sc->sa[*assoc_num]);
1579 if (!tx_sa)
1580 return ERR_PTR(-ENODEV);
1581
1582 *devp = dev;
1583 *scp = tx_sc;
1584 *secyp = secy;
1585 return tx_sa;
1586 }
1587
get_rxsc_from_nl(struct net * net,struct nlattr ** attrs,struct nlattr ** tb_rxsc,struct net_device ** devp,struct macsec_secy ** secyp)1588 static struct macsec_rx_sc *get_rxsc_from_nl(struct net *net,
1589 struct nlattr **attrs,
1590 struct nlattr **tb_rxsc,
1591 struct net_device **devp,
1592 struct macsec_secy **secyp)
1593 {
1594 struct net_device *dev;
1595 struct macsec_secy *secy;
1596 struct macsec_rx_sc *rx_sc;
1597 sci_t sci;
1598
1599 dev = get_dev_from_nl(net, attrs);
1600 if (IS_ERR(dev))
1601 return ERR_CAST(dev);
1602
1603 secy = &macsec_priv(dev)->secy;
1604
1605 if (!tb_rxsc[MACSEC_RXSC_ATTR_SCI])
1606 return ERR_PTR(-EINVAL);
1607
1608 sci = nla_get_sci(tb_rxsc[MACSEC_RXSC_ATTR_SCI]);
1609 rx_sc = find_rx_sc_rtnl(secy, sci);
1610 if (!rx_sc)
1611 return ERR_PTR(-ENODEV);
1612
1613 *secyp = secy;
1614 *devp = dev;
1615
1616 return rx_sc;
1617 }
1618
get_rxsa_from_nl(struct net * net,struct nlattr ** attrs,struct nlattr ** tb_rxsc,struct nlattr ** tb_sa,struct net_device ** devp,struct macsec_secy ** secyp,struct macsec_rx_sc ** scp,u8 * assoc_num)1619 static struct macsec_rx_sa *get_rxsa_from_nl(struct net *net,
1620 struct nlattr **attrs,
1621 struct nlattr **tb_rxsc,
1622 struct nlattr **tb_sa,
1623 struct net_device **devp,
1624 struct macsec_secy **secyp,
1625 struct macsec_rx_sc **scp,
1626 u8 *assoc_num)
1627 {
1628 struct macsec_rx_sc *rx_sc;
1629 struct macsec_rx_sa *rx_sa;
1630
1631 if (!tb_sa[MACSEC_SA_ATTR_AN])
1632 return ERR_PTR(-EINVAL);
1633
1634 *assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]);
1635 if (*assoc_num >= MACSEC_NUM_AN)
1636 return ERR_PTR(-EINVAL);
1637
1638 rx_sc = get_rxsc_from_nl(net, attrs, tb_rxsc, devp, secyp);
1639 if (IS_ERR(rx_sc))
1640 return ERR_CAST(rx_sc);
1641
1642 rx_sa = rtnl_dereference(rx_sc->sa[*assoc_num]);
1643 if (!rx_sa)
1644 return ERR_PTR(-ENODEV);
1645
1646 *scp = rx_sc;
1647 return rx_sa;
1648 }
1649
1650 static const struct nla_policy macsec_genl_policy[NUM_MACSEC_ATTR] = {
1651 [MACSEC_ATTR_IFINDEX] = { .type = NLA_U32 },
1652 [MACSEC_ATTR_RXSC_CONFIG] = { .type = NLA_NESTED },
1653 [MACSEC_ATTR_SA_CONFIG] = { .type = NLA_NESTED },
1654 [MACSEC_ATTR_OFFLOAD] = { .type = NLA_NESTED },
1655 };
1656
1657 static const struct nla_policy macsec_genl_rxsc_policy[NUM_MACSEC_RXSC_ATTR] = {
1658 [MACSEC_RXSC_ATTR_SCI] = { .type = NLA_U64 },
1659 [MACSEC_RXSC_ATTR_ACTIVE] = { .type = NLA_U8 },
1660 };
1661
1662 static const struct nla_policy macsec_genl_sa_policy[NUM_MACSEC_SA_ATTR] = {
1663 [MACSEC_SA_ATTR_AN] = { .type = NLA_U8 },
1664 [MACSEC_SA_ATTR_ACTIVE] = { .type = NLA_U8 },
1665 [MACSEC_SA_ATTR_PN] = NLA_POLICY_MIN_LEN(4),
1666 [MACSEC_SA_ATTR_KEYID] = { .type = NLA_BINARY,
1667 .len = MACSEC_KEYID_LEN, },
1668 [MACSEC_SA_ATTR_KEY] = { .type = NLA_BINARY,
1669 .len = MACSEC_MAX_KEY_LEN, },
1670 [MACSEC_SA_ATTR_SSCI] = { .type = NLA_U32 },
1671 [MACSEC_SA_ATTR_SALT] = { .type = NLA_BINARY,
1672 .len = MACSEC_SALT_LEN, },
1673 };
1674
1675 static const struct nla_policy macsec_genl_offload_policy[NUM_MACSEC_OFFLOAD_ATTR] = {
1676 [MACSEC_OFFLOAD_ATTR_TYPE] = { .type = NLA_U8 },
1677 };
1678
1679 /* Offloads an operation to a device driver */
macsec_offload(int (* const func)(struct macsec_context *),struct macsec_context * ctx)1680 static int macsec_offload(int (* const func)(struct macsec_context *),
1681 struct macsec_context *ctx)
1682 {
1683 int ret;
1684
1685 if (unlikely(!func))
1686 return 0;
1687
1688 if (ctx->offload == MACSEC_OFFLOAD_PHY)
1689 mutex_lock(&ctx->phydev->lock);
1690
1691 ret = (*func)(ctx);
1692
1693 if (ctx->offload == MACSEC_OFFLOAD_PHY)
1694 mutex_unlock(&ctx->phydev->lock);
1695
1696 return ret;
1697 }
1698
parse_sa_config(struct nlattr ** attrs,struct nlattr ** tb_sa)1699 static int parse_sa_config(struct nlattr **attrs, struct nlattr **tb_sa)
1700 {
1701 if (!attrs[MACSEC_ATTR_SA_CONFIG])
1702 return -EINVAL;
1703
1704 if (nla_parse_nested_deprecated(tb_sa, MACSEC_SA_ATTR_MAX, attrs[MACSEC_ATTR_SA_CONFIG], macsec_genl_sa_policy, NULL))
1705 return -EINVAL;
1706
1707 return 0;
1708 }
1709
parse_rxsc_config(struct nlattr ** attrs,struct nlattr ** tb_rxsc)1710 static int parse_rxsc_config(struct nlattr **attrs, struct nlattr **tb_rxsc)
1711 {
1712 if (!attrs[MACSEC_ATTR_RXSC_CONFIG])
1713 return -EINVAL;
1714
1715 if (nla_parse_nested_deprecated(tb_rxsc, MACSEC_RXSC_ATTR_MAX, attrs[MACSEC_ATTR_RXSC_CONFIG], macsec_genl_rxsc_policy, NULL))
1716 return -EINVAL;
1717
1718 return 0;
1719 }
1720
validate_add_rxsa(struct nlattr ** attrs)1721 static bool validate_add_rxsa(struct nlattr **attrs)
1722 {
1723 if (!attrs[MACSEC_SA_ATTR_AN] ||
1724 !attrs[MACSEC_SA_ATTR_KEY] ||
1725 !attrs[MACSEC_SA_ATTR_KEYID])
1726 return false;
1727
1728 if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN)
1729 return false;
1730
1731 if (attrs[MACSEC_SA_ATTR_PN] &&
1732 nla_get_u64(attrs[MACSEC_SA_ATTR_PN]) == 0)
1733 return false;
1734
1735 if (attrs[MACSEC_SA_ATTR_ACTIVE]) {
1736 if (nla_get_u8(attrs[MACSEC_SA_ATTR_ACTIVE]) > 1)
1737 return false;
1738 }
1739
1740 if (nla_len(attrs[MACSEC_SA_ATTR_KEYID]) != MACSEC_KEYID_LEN)
1741 return false;
1742
1743 return true;
1744 }
1745
macsec_add_rxsa(struct sk_buff * skb,struct genl_info * info)1746 static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
1747 {
1748 struct net_device *dev;
1749 struct nlattr **attrs = info->attrs;
1750 struct macsec_secy *secy;
1751 struct macsec_rx_sc *rx_sc;
1752 struct macsec_rx_sa *rx_sa;
1753 unsigned char assoc_num;
1754 int pn_len;
1755 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
1756 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
1757 int err;
1758
1759 if (!attrs[MACSEC_ATTR_IFINDEX])
1760 return -EINVAL;
1761
1762 if (parse_sa_config(attrs, tb_sa))
1763 return -EINVAL;
1764
1765 if (parse_rxsc_config(attrs, tb_rxsc))
1766 return -EINVAL;
1767
1768 if (!validate_add_rxsa(tb_sa))
1769 return -EINVAL;
1770
1771 rtnl_lock();
1772 rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);
1773 if (IS_ERR(rx_sc)) {
1774 rtnl_unlock();
1775 return PTR_ERR(rx_sc);
1776 }
1777
1778 assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]);
1779
1780 if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) {
1781 pr_notice("macsec: nl: add_rxsa: bad key length: %d != %d\n",
1782 nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len);
1783 rtnl_unlock();
1784 return -EINVAL;
1785 }
1786
1787 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
1788 if (tb_sa[MACSEC_SA_ATTR_PN] &&
1789 nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
1790 pr_notice("macsec: nl: add_rxsa: bad pn length: %d != %d\n",
1791 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
1792 rtnl_unlock();
1793 return -EINVAL;
1794 }
1795
1796 if (secy->xpn) {
1797 if (!tb_sa[MACSEC_SA_ATTR_SSCI] || !tb_sa[MACSEC_SA_ATTR_SALT]) {
1798 rtnl_unlock();
1799 return -EINVAL;
1800 }
1801
1802 if (nla_len(tb_sa[MACSEC_SA_ATTR_SALT]) != MACSEC_SALT_LEN) {
1803 pr_notice("macsec: nl: add_rxsa: bad salt length: %d != %d\n",
1804 nla_len(tb_sa[MACSEC_SA_ATTR_SALT]),
1805 MACSEC_SALT_LEN);
1806 rtnl_unlock();
1807 return -EINVAL;
1808 }
1809 }
1810
1811 rx_sa = rtnl_dereference(rx_sc->sa[assoc_num]);
1812 if (rx_sa) {
1813 rtnl_unlock();
1814 return -EBUSY;
1815 }
1816
1817 rx_sa = kmalloc(sizeof(*rx_sa), GFP_KERNEL);
1818 if (!rx_sa) {
1819 rtnl_unlock();
1820 return -ENOMEM;
1821 }
1822
1823 err = init_rx_sa(rx_sa, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]),
1824 secy->key_len, secy->icv_len);
1825 if (err < 0) {
1826 kfree(rx_sa);
1827 rtnl_unlock();
1828 return err;
1829 }
1830
1831 if (tb_sa[MACSEC_SA_ATTR_PN]) {
1832 spin_lock_bh(&rx_sa->lock);
1833 rx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
1834 spin_unlock_bh(&rx_sa->lock);
1835 }
1836
1837 if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
1838 rx_sa->active = !!nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]);
1839
1840 rx_sa->sc = rx_sc;
1841
1842 if (secy->xpn) {
1843 rx_sa->ssci = nla_get_ssci(tb_sa[MACSEC_SA_ATTR_SSCI]);
1844 nla_memcpy(rx_sa->key.salt.bytes, tb_sa[MACSEC_SA_ATTR_SALT],
1845 MACSEC_SALT_LEN);
1846 }
1847
1848 /* If h/w offloading is available, propagate to the device */
1849 if (macsec_is_offloaded(netdev_priv(dev))) {
1850 const struct macsec_ops *ops;
1851 struct macsec_context ctx;
1852
1853 ops = macsec_get_ops(netdev_priv(dev), &ctx);
1854 if (!ops) {
1855 err = -EOPNOTSUPP;
1856 goto cleanup;
1857 }
1858
1859 ctx.sa.assoc_num = assoc_num;
1860 ctx.sa.rx_sa = rx_sa;
1861 ctx.secy = secy;
1862 memcpy(ctx.sa.key, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]),
1863 secy->key_len);
1864
1865 err = macsec_offload(ops->mdo_add_rxsa, &ctx);
1866 memzero_explicit(ctx.sa.key, secy->key_len);
1867 if (err)
1868 goto cleanup;
1869 }
1870
1871 nla_memcpy(rx_sa->key.id, tb_sa[MACSEC_SA_ATTR_KEYID], MACSEC_KEYID_LEN);
1872 rcu_assign_pointer(rx_sc->sa[assoc_num], rx_sa);
1873
1874 rtnl_unlock();
1875
1876 return 0;
1877
1878 cleanup:
1879 macsec_rxsa_put(rx_sa);
1880 rtnl_unlock();
1881 return err;
1882 }
1883
validate_add_rxsc(struct nlattr ** attrs)1884 static bool validate_add_rxsc(struct nlattr **attrs)
1885 {
1886 if (!attrs[MACSEC_RXSC_ATTR_SCI])
1887 return false;
1888
1889 if (attrs[MACSEC_RXSC_ATTR_ACTIVE]) {
1890 if (nla_get_u8(attrs[MACSEC_RXSC_ATTR_ACTIVE]) > 1)
1891 return false;
1892 }
1893
1894 return true;
1895 }
1896
macsec_add_rxsc(struct sk_buff * skb,struct genl_info * info)1897 static int macsec_add_rxsc(struct sk_buff *skb, struct genl_info *info)
1898 {
1899 struct net_device *dev;
1900 sci_t sci = MACSEC_UNDEF_SCI;
1901 struct nlattr **attrs = info->attrs;
1902 struct macsec_rx_sc *rx_sc;
1903 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
1904 struct macsec_secy *secy;
1905 bool active = true;
1906 int ret;
1907
1908 if (!attrs[MACSEC_ATTR_IFINDEX])
1909 return -EINVAL;
1910
1911 if (parse_rxsc_config(attrs, tb_rxsc))
1912 return -EINVAL;
1913
1914 if (!validate_add_rxsc(tb_rxsc))
1915 return -EINVAL;
1916
1917 rtnl_lock();
1918 dev = get_dev_from_nl(genl_info_net(info), attrs);
1919 if (IS_ERR(dev)) {
1920 rtnl_unlock();
1921 return PTR_ERR(dev);
1922 }
1923
1924 secy = &macsec_priv(dev)->secy;
1925 sci = nla_get_sci(tb_rxsc[MACSEC_RXSC_ATTR_SCI]);
1926
1927 if (tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE])
1928 active = nla_get_u8(tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]);
1929
1930 rx_sc = create_rx_sc(dev, sci, active);
1931 if (IS_ERR(rx_sc)) {
1932 rtnl_unlock();
1933 return PTR_ERR(rx_sc);
1934 }
1935
1936 if (macsec_is_offloaded(netdev_priv(dev))) {
1937 const struct macsec_ops *ops;
1938 struct macsec_context ctx;
1939
1940 ops = macsec_get_ops(netdev_priv(dev), &ctx);
1941 if (!ops) {
1942 ret = -EOPNOTSUPP;
1943 goto cleanup;
1944 }
1945
1946 ctx.rx_sc = rx_sc;
1947 ctx.secy = secy;
1948
1949 ret = macsec_offload(ops->mdo_add_rxsc, &ctx);
1950 if (ret)
1951 goto cleanup;
1952 }
1953
1954 rtnl_unlock();
1955
1956 return 0;
1957
1958 cleanup:
1959 del_rx_sc(secy, sci);
1960 free_rx_sc(rx_sc);
1961 rtnl_unlock();
1962 return ret;
1963 }
1964
validate_add_txsa(struct nlattr ** attrs)1965 static bool validate_add_txsa(struct nlattr **attrs)
1966 {
1967 if (!attrs[MACSEC_SA_ATTR_AN] ||
1968 !attrs[MACSEC_SA_ATTR_PN] ||
1969 !attrs[MACSEC_SA_ATTR_KEY] ||
1970 !attrs[MACSEC_SA_ATTR_KEYID])
1971 return false;
1972
1973 if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN)
1974 return false;
1975
1976 if (nla_get_u64(attrs[MACSEC_SA_ATTR_PN]) == 0)
1977 return false;
1978
1979 if (attrs[MACSEC_SA_ATTR_ACTIVE]) {
1980 if (nla_get_u8(attrs[MACSEC_SA_ATTR_ACTIVE]) > 1)
1981 return false;
1982 }
1983
1984 if (nla_len(attrs[MACSEC_SA_ATTR_KEYID]) != MACSEC_KEYID_LEN)
1985 return false;
1986
1987 return true;
1988 }
1989
macsec_add_txsa(struct sk_buff * skb,struct genl_info * info)1990 static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
1991 {
1992 struct net_device *dev;
1993 struct nlattr **attrs = info->attrs;
1994 struct macsec_secy *secy;
1995 struct macsec_tx_sc *tx_sc;
1996 struct macsec_tx_sa *tx_sa;
1997 unsigned char assoc_num;
1998 int pn_len;
1999 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
2000 bool was_operational;
2001 int err;
2002
2003 if (!attrs[MACSEC_ATTR_IFINDEX])
2004 return -EINVAL;
2005
2006 if (parse_sa_config(attrs, tb_sa))
2007 return -EINVAL;
2008
2009 if (!validate_add_txsa(tb_sa))
2010 return -EINVAL;
2011
2012 rtnl_lock();
2013 dev = get_dev_from_nl(genl_info_net(info), attrs);
2014 if (IS_ERR(dev)) {
2015 rtnl_unlock();
2016 return PTR_ERR(dev);
2017 }
2018
2019 secy = &macsec_priv(dev)->secy;
2020 tx_sc = &secy->tx_sc;
2021
2022 assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]);
2023
2024 if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) {
2025 pr_notice("macsec: nl: add_txsa: bad key length: %d != %d\n",
2026 nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len);
2027 rtnl_unlock();
2028 return -EINVAL;
2029 }
2030
2031 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
2032 if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
2033 pr_notice("macsec: nl: add_txsa: bad pn length: %d != %d\n",
2034 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
2035 rtnl_unlock();
2036 return -EINVAL;
2037 }
2038
2039 if (secy->xpn) {
2040 if (!tb_sa[MACSEC_SA_ATTR_SSCI] || !tb_sa[MACSEC_SA_ATTR_SALT]) {
2041 rtnl_unlock();
2042 return -EINVAL;
2043 }
2044
2045 if (nla_len(tb_sa[MACSEC_SA_ATTR_SALT]) != MACSEC_SALT_LEN) {
2046 pr_notice("macsec: nl: add_txsa: bad salt length: %d != %d\n",
2047 nla_len(tb_sa[MACSEC_SA_ATTR_SALT]),
2048 MACSEC_SALT_LEN);
2049 rtnl_unlock();
2050 return -EINVAL;
2051 }
2052 }
2053
2054 tx_sa = rtnl_dereference(tx_sc->sa[assoc_num]);
2055 if (tx_sa) {
2056 rtnl_unlock();
2057 return -EBUSY;
2058 }
2059
2060 tx_sa = kmalloc(sizeof(*tx_sa), GFP_KERNEL);
2061 if (!tx_sa) {
2062 rtnl_unlock();
2063 return -ENOMEM;
2064 }
2065
2066 err = init_tx_sa(tx_sa, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]),
2067 secy->key_len, secy->icv_len);
2068 if (err < 0) {
2069 kfree(tx_sa);
2070 rtnl_unlock();
2071 return err;
2072 }
2073
2074 spin_lock_bh(&tx_sa->lock);
2075 tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
2076 spin_unlock_bh(&tx_sa->lock);
2077
2078 if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
2079 tx_sa->active = !!nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]);
2080
2081 was_operational = secy->operational;
2082 if (assoc_num == tx_sc->encoding_sa && tx_sa->active)
2083 secy->operational = true;
2084
2085 if (secy->xpn) {
2086 tx_sa->ssci = nla_get_ssci(tb_sa[MACSEC_SA_ATTR_SSCI]);
2087 nla_memcpy(tx_sa->key.salt.bytes, tb_sa[MACSEC_SA_ATTR_SALT],
2088 MACSEC_SALT_LEN);
2089 }
2090
2091 /* If h/w offloading is available, propagate to the device */
2092 if (macsec_is_offloaded(netdev_priv(dev))) {
2093 const struct macsec_ops *ops;
2094 struct macsec_context ctx;
2095
2096 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2097 if (!ops) {
2098 err = -EOPNOTSUPP;
2099 goto cleanup;
2100 }
2101
2102 ctx.sa.assoc_num = assoc_num;
2103 ctx.sa.tx_sa = tx_sa;
2104 ctx.secy = secy;
2105 memcpy(ctx.sa.key, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]),
2106 secy->key_len);
2107
2108 err = macsec_offload(ops->mdo_add_txsa, &ctx);
2109 memzero_explicit(ctx.sa.key, secy->key_len);
2110 if (err)
2111 goto cleanup;
2112 }
2113
2114 nla_memcpy(tx_sa->key.id, tb_sa[MACSEC_SA_ATTR_KEYID], MACSEC_KEYID_LEN);
2115 rcu_assign_pointer(tx_sc->sa[assoc_num], tx_sa);
2116
2117 rtnl_unlock();
2118
2119 return 0;
2120
2121 cleanup:
2122 secy->operational = was_operational;
2123 macsec_txsa_put(tx_sa);
2124 rtnl_unlock();
2125 return err;
2126 }
2127
macsec_del_rxsa(struct sk_buff * skb,struct genl_info * info)2128 static int macsec_del_rxsa(struct sk_buff *skb, struct genl_info *info)
2129 {
2130 struct nlattr **attrs = info->attrs;
2131 struct net_device *dev;
2132 struct macsec_secy *secy;
2133 struct macsec_rx_sc *rx_sc;
2134 struct macsec_rx_sa *rx_sa;
2135 u8 assoc_num;
2136 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
2137 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
2138 int ret;
2139
2140 if (!attrs[MACSEC_ATTR_IFINDEX])
2141 return -EINVAL;
2142
2143 if (parse_sa_config(attrs, tb_sa))
2144 return -EINVAL;
2145
2146 if (parse_rxsc_config(attrs, tb_rxsc))
2147 return -EINVAL;
2148
2149 rtnl_lock();
2150 rx_sa = get_rxsa_from_nl(genl_info_net(info), attrs, tb_rxsc, tb_sa,
2151 &dev, &secy, &rx_sc, &assoc_num);
2152 if (IS_ERR(rx_sa)) {
2153 rtnl_unlock();
2154 return PTR_ERR(rx_sa);
2155 }
2156
2157 if (rx_sa->active) {
2158 rtnl_unlock();
2159 return -EBUSY;
2160 }
2161
2162 /* If h/w offloading is available, propagate to the device */
2163 if (macsec_is_offloaded(netdev_priv(dev))) {
2164 const struct macsec_ops *ops;
2165 struct macsec_context ctx;
2166
2167 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2168 if (!ops) {
2169 ret = -EOPNOTSUPP;
2170 goto cleanup;
2171 }
2172
2173 ctx.sa.assoc_num = assoc_num;
2174 ctx.sa.rx_sa = rx_sa;
2175 ctx.secy = secy;
2176
2177 ret = macsec_offload(ops->mdo_del_rxsa, &ctx);
2178 if (ret)
2179 goto cleanup;
2180 }
2181
2182 RCU_INIT_POINTER(rx_sc->sa[assoc_num], NULL);
2183 clear_rx_sa(rx_sa);
2184
2185 rtnl_unlock();
2186
2187 return 0;
2188
2189 cleanup:
2190 rtnl_unlock();
2191 return ret;
2192 }
2193
macsec_del_rxsc(struct sk_buff * skb,struct genl_info * info)2194 static int macsec_del_rxsc(struct sk_buff *skb, struct genl_info *info)
2195 {
2196 struct nlattr **attrs = info->attrs;
2197 struct net_device *dev;
2198 struct macsec_secy *secy;
2199 struct macsec_rx_sc *rx_sc;
2200 sci_t sci;
2201 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
2202 int ret;
2203
2204 if (!attrs[MACSEC_ATTR_IFINDEX])
2205 return -EINVAL;
2206
2207 if (parse_rxsc_config(attrs, tb_rxsc))
2208 return -EINVAL;
2209
2210 if (!tb_rxsc[MACSEC_RXSC_ATTR_SCI])
2211 return -EINVAL;
2212
2213 rtnl_lock();
2214 dev = get_dev_from_nl(genl_info_net(info), info->attrs);
2215 if (IS_ERR(dev)) {
2216 rtnl_unlock();
2217 return PTR_ERR(dev);
2218 }
2219
2220 secy = &macsec_priv(dev)->secy;
2221 sci = nla_get_sci(tb_rxsc[MACSEC_RXSC_ATTR_SCI]);
2222
2223 rx_sc = del_rx_sc(secy, sci);
2224 if (!rx_sc) {
2225 rtnl_unlock();
2226 return -ENODEV;
2227 }
2228
2229 /* If h/w offloading is available, propagate to the device */
2230 if (macsec_is_offloaded(netdev_priv(dev))) {
2231 const struct macsec_ops *ops;
2232 struct macsec_context ctx;
2233
2234 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2235 if (!ops) {
2236 ret = -EOPNOTSUPP;
2237 goto cleanup;
2238 }
2239
2240 ctx.rx_sc = rx_sc;
2241 ctx.secy = secy;
2242 ret = macsec_offload(ops->mdo_del_rxsc, &ctx);
2243 if (ret)
2244 goto cleanup;
2245 }
2246
2247 free_rx_sc(rx_sc);
2248 rtnl_unlock();
2249
2250 return 0;
2251
2252 cleanup:
2253 rtnl_unlock();
2254 return ret;
2255 }
2256
macsec_del_txsa(struct sk_buff * skb,struct genl_info * info)2257 static int macsec_del_txsa(struct sk_buff *skb, struct genl_info *info)
2258 {
2259 struct nlattr **attrs = info->attrs;
2260 struct net_device *dev;
2261 struct macsec_secy *secy;
2262 struct macsec_tx_sc *tx_sc;
2263 struct macsec_tx_sa *tx_sa;
2264 u8 assoc_num;
2265 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
2266 int ret;
2267
2268 if (!attrs[MACSEC_ATTR_IFINDEX])
2269 return -EINVAL;
2270
2271 if (parse_sa_config(attrs, tb_sa))
2272 return -EINVAL;
2273
2274 rtnl_lock();
2275 tx_sa = get_txsa_from_nl(genl_info_net(info), attrs, tb_sa,
2276 &dev, &secy, &tx_sc, &assoc_num);
2277 if (IS_ERR(tx_sa)) {
2278 rtnl_unlock();
2279 return PTR_ERR(tx_sa);
2280 }
2281
2282 if (tx_sa->active) {
2283 rtnl_unlock();
2284 return -EBUSY;
2285 }
2286
2287 /* If h/w offloading is available, propagate to the device */
2288 if (macsec_is_offloaded(netdev_priv(dev))) {
2289 const struct macsec_ops *ops;
2290 struct macsec_context ctx;
2291
2292 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2293 if (!ops) {
2294 ret = -EOPNOTSUPP;
2295 goto cleanup;
2296 }
2297
2298 ctx.sa.assoc_num = assoc_num;
2299 ctx.sa.tx_sa = tx_sa;
2300 ctx.secy = secy;
2301
2302 ret = macsec_offload(ops->mdo_del_txsa, &ctx);
2303 if (ret)
2304 goto cleanup;
2305 }
2306
2307 RCU_INIT_POINTER(tx_sc->sa[assoc_num], NULL);
2308 clear_tx_sa(tx_sa);
2309
2310 rtnl_unlock();
2311
2312 return 0;
2313
2314 cleanup:
2315 rtnl_unlock();
2316 return ret;
2317 }
2318
validate_upd_sa(struct nlattr ** attrs)2319 static bool validate_upd_sa(struct nlattr **attrs)
2320 {
2321 if (!attrs[MACSEC_SA_ATTR_AN] ||
2322 attrs[MACSEC_SA_ATTR_KEY] ||
2323 attrs[MACSEC_SA_ATTR_KEYID] ||
2324 attrs[MACSEC_SA_ATTR_SSCI] ||
2325 attrs[MACSEC_SA_ATTR_SALT])
2326 return false;
2327
2328 if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN)
2329 return false;
2330
2331 if (attrs[MACSEC_SA_ATTR_PN] && nla_get_u64(attrs[MACSEC_SA_ATTR_PN]) == 0)
2332 return false;
2333
2334 if (attrs[MACSEC_SA_ATTR_ACTIVE]) {
2335 if (nla_get_u8(attrs[MACSEC_SA_ATTR_ACTIVE]) > 1)
2336 return false;
2337 }
2338
2339 return true;
2340 }
2341
macsec_upd_txsa(struct sk_buff * skb,struct genl_info * info)2342 static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info)
2343 {
2344 struct nlattr **attrs = info->attrs;
2345 struct net_device *dev;
2346 struct macsec_secy *secy;
2347 struct macsec_tx_sc *tx_sc;
2348 struct macsec_tx_sa *tx_sa;
2349 u8 assoc_num;
2350 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
2351 bool was_operational, was_active;
2352 pn_t prev_pn;
2353 int ret = 0;
2354
2355 prev_pn.full64 = 0;
2356
2357 if (!attrs[MACSEC_ATTR_IFINDEX])
2358 return -EINVAL;
2359
2360 if (parse_sa_config(attrs, tb_sa))
2361 return -EINVAL;
2362
2363 if (!validate_upd_sa(tb_sa))
2364 return -EINVAL;
2365
2366 rtnl_lock();
2367 tx_sa = get_txsa_from_nl(genl_info_net(info), attrs, tb_sa,
2368 &dev, &secy, &tx_sc, &assoc_num);
2369 if (IS_ERR(tx_sa)) {
2370 rtnl_unlock();
2371 return PTR_ERR(tx_sa);
2372 }
2373
2374 if (tb_sa[MACSEC_SA_ATTR_PN]) {
2375 int pn_len;
2376
2377 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
2378 if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
2379 pr_notice("macsec: nl: upd_txsa: bad pn length: %d != %d\n",
2380 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
2381 rtnl_unlock();
2382 return -EINVAL;
2383 }
2384
2385 spin_lock_bh(&tx_sa->lock);
2386 prev_pn = tx_sa->next_pn_halves;
2387 tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
2388 spin_unlock_bh(&tx_sa->lock);
2389 }
2390
2391 was_active = tx_sa->active;
2392 if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
2393 tx_sa->active = nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]);
2394
2395 was_operational = secy->operational;
2396 if (assoc_num == tx_sc->encoding_sa)
2397 secy->operational = tx_sa->active;
2398
2399 /* If h/w offloading is available, propagate to the device */
2400 if (macsec_is_offloaded(netdev_priv(dev))) {
2401 const struct macsec_ops *ops;
2402 struct macsec_context ctx;
2403
2404 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2405 if (!ops) {
2406 ret = -EOPNOTSUPP;
2407 goto cleanup;
2408 }
2409
2410 ctx.sa.assoc_num = assoc_num;
2411 ctx.sa.tx_sa = tx_sa;
2412 ctx.sa.update_pn = !!prev_pn.full64;
2413 ctx.secy = secy;
2414
2415 ret = macsec_offload(ops->mdo_upd_txsa, &ctx);
2416 if (ret)
2417 goto cleanup;
2418 }
2419
2420 rtnl_unlock();
2421
2422 return 0;
2423
2424 cleanup:
2425 if (tb_sa[MACSEC_SA_ATTR_PN]) {
2426 spin_lock_bh(&tx_sa->lock);
2427 tx_sa->next_pn_halves = prev_pn;
2428 spin_unlock_bh(&tx_sa->lock);
2429 }
2430 tx_sa->active = was_active;
2431 secy->operational = was_operational;
2432 rtnl_unlock();
2433 return ret;
2434 }
2435
macsec_upd_rxsa(struct sk_buff * skb,struct genl_info * info)2436 static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info)
2437 {
2438 struct nlattr **attrs = info->attrs;
2439 struct net_device *dev;
2440 struct macsec_secy *secy;
2441 struct macsec_rx_sc *rx_sc;
2442 struct macsec_rx_sa *rx_sa;
2443 u8 assoc_num;
2444 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
2445 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
2446 bool was_active;
2447 pn_t prev_pn;
2448 int ret = 0;
2449
2450 prev_pn.full64 = 0;
2451
2452 if (!attrs[MACSEC_ATTR_IFINDEX])
2453 return -EINVAL;
2454
2455 if (parse_rxsc_config(attrs, tb_rxsc))
2456 return -EINVAL;
2457
2458 if (parse_sa_config(attrs, tb_sa))
2459 return -EINVAL;
2460
2461 if (!validate_upd_sa(tb_sa))
2462 return -EINVAL;
2463
2464 rtnl_lock();
2465 rx_sa = get_rxsa_from_nl(genl_info_net(info), attrs, tb_rxsc, tb_sa,
2466 &dev, &secy, &rx_sc, &assoc_num);
2467 if (IS_ERR(rx_sa)) {
2468 rtnl_unlock();
2469 return PTR_ERR(rx_sa);
2470 }
2471
2472 if (tb_sa[MACSEC_SA_ATTR_PN]) {
2473 int pn_len;
2474
2475 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
2476 if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
2477 pr_notice("macsec: nl: upd_rxsa: bad pn length: %d != %d\n",
2478 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
2479 rtnl_unlock();
2480 return -EINVAL;
2481 }
2482
2483 spin_lock_bh(&rx_sa->lock);
2484 prev_pn = rx_sa->next_pn_halves;
2485 rx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
2486 spin_unlock_bh(&rx_sa->lock);
2487 }
2488
2489 was_active = rx_sa->active;
2490 if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
2491 rx_sa->active = nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]);
2492
2493 /* If h/w offloading is available, propagate to the device */
2494 if (macsec_is_offloaded(netdev_priv(dev))) {
2495 const struct macsec_ops *ops;
2496 struct macsec_context ctx;
2497
2498 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2499 if (!ops) {
2500 ret = -EOPNOTSUPP;
2501 goto cleanup;
2502 }
2503
2504 ctx.sa.assoc_num = assoc_num;
2505 ctx.sa.rx_sa = rx_sa;
2506 ctx.sa.update_pn = !!prev_pn.full64;
2507 ctx.secy = secy;
2508
2509 ret = macsec_offload(ops->mdo_upd_rxsa, &ctx);
2510 if (ret)
2511 goto cleanup;
2512 }
2513
2514 rtnl_unlock();
2515 return 0;
2516
2517 cleanup:
2518 if (tb_sa[MACSEC_SA_ATTR_PN]) {
2519 spin_lock_bh(&rx_sa->lock);
2520 rx_sa->next_pn_halves = prev_pn;
2521 spin_unlock_bh(&rx_sa->lock);
2522 }
2523 rx_sa->active = was_active;
2524 rtnl_unlock();
2525 return ret;
2526 }
2527
macsec_upd_rxsc(struct sk_buff * skb,struct genl_info * info)2528 static int macsec_upd_rxsc(struct sk_buff *skb, struct genl_info *info)
2529 {
2530 struct nlattr **attrs = info->attrs;
2531 struct net_device *dev;
2532 struct macsec_secy *secy;
2533 struct macsec_rx_sc *rx_sc;
2534 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
2535 unsigned int prev_n_rx_sc;
2536 bool was_active;
2537 int ret;
2538
2539 if (!attrs[MACSEC_ATTR_IFINDEX])
2540 return -EINVAL;
2541
2542 if (parse_rxsc_config(attrs, tb_rxsc))
2543 return -EINVAL;
2544
2545 if (!validate_add_rxsc(tb_rxsc))
2546 return -EINVAL;
2547
2548 rtnl_lock();
2549 rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);
2550 if (IS_ERR(rx_sc)) {
2551 rtnl_unlock();
2552 return PTR_ERR(rx_sc);
2553 }
2554
2555 was_active = rx_sc->active;
2556 prev_n_rx_sc = secy->n_rx_sc;
2557 if (tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]) {
2558 bool new = !!nla_get_u8(tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]);
2559
2560 if (rx_sc->active != new)
2561 secy->n_rx_sc += new ? 1 : -1;
2562
2563 rx_sc->active = new;
2564 }
2565
2566 /* If h/w offloading is available, propagate to the device */
2567 if (macsec_is_offloaded(netdev_priv(dev))) {
2568 const struct macsec_ops *ops;
2569 struct macsec_context ctx;
2570
2571 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2572 if (!ops) {
2573 ret = -EOPNOTSUPP;
2574 goto cleanup;
2575 }
2576
2577 ctx.rx_sc = rx_sc;
2578 ctx.secy = secy;
2579
2580 ret = macsec_offload(ops->mdo_upd_rxsc, &ctx);
2581 if (ret)
2582 goto cleanup;
2583 }
2584
2585 rtnl_unlock();
2586
2587 return 0;
2588
2589 cleanup:
2590 secy->n_rx_sc = prev_n_rx_sc;
2591 rx_sc->active = was_active;
2592 rtnl_unlock();
2593 return ret;
2594 }
2595
macsec_is_configured(struct macsec_dev * macsec)2596 static bool macsec_is_configured(struct macsec_dev *macsec)
2597 {
2598 struct macsec_secy *secy = &macsec->secy;
2599 struct macsec_tx_sc *tx_sc = &secy->tx_sc;
2600 int i;
2601
2602 if (secy->rx_sc)
2603 return true;
2604
2605 for (i = 0; i < MACSEC_NUM_AN; i++)
2606 if (tx_sc->sa[i])
2607 return true;
2608
2609 return false;
2610 }
2611
macsec_update_offload(struct net_device * dev,enum macsec_offload offload)2612 static int macsec_update_offload(struct net_device *dev, enum macsec_offload offload)
2613 {
2614 enum macsec_offload prev_offload;
2615 const struct macsec_ops *ops;
2616 struct macsec_context ctx;
2617 struct macsec_dev *macsec;
2618 int ret = 0;
2619
2620 macsec = macsec_priv(dev);
2621
2622 /* Check if the offloading mode is supported by the underlying layers */
2623 if (offload != MACSEC_OFFLOAD_OFF &&
2624 !macsec_check_offload(offload, macsec))
2625 return -EOPNOTSUPP;
2626
2627 /* Check if the net device is busy. */
2628 if (netif_running(dev))
2629 return -EBUSY;
2630
2631 /* Check if the device already has rules configured: we do not support
2632 * rules migration.
2633 */
2634 if (macsec_is_configured(macsec))
2635 return -EBUSY;
2636
2637 prev_offload = macsec->offload;
2638
2639 ops = __macsec_get_ops(offload == MACSEC_OFFLOAD_OFF ? prev_offload : offload,
2640 macsec, &ctx);
2641 if (!ops)
2642 return -EOPNOTSUPP;
2643
2644 macsec->offload = offload;
2645
2646 ctx.secy = &macsec->secy;
2647 ret = offload == MACSEC_OFFLOAD_OFF ? macsec_offload(ops->mdo_del_secy, &ctx)
2648 : macsec_offload(ops->mdo_add_secy, &ctx);
2649 if (ret)
2650 macsec->offload = prev_offload;
2651
2652 return ret;
2653 }
2654
macsec_upd_offload(struct sk_buff * skb,struct genl_info * info)2655 static int macsec_upd_offload(struct sk_buff *skb, struct genl_info *info)
2656 {
2657 struct nlattr *tb_offload[MACSEC_OFFLOAD_ATTR_MAX + 1];
2658 struct nlattr **attrs = info->attrs;
2659 enum macsec_offload offload;
2660 struct macsec_dev *macsec;
2661 struct net_device *dev;
2662 int ret = 0;
2663
2664 if (!attrs[MACSEC_ATTR_IFINDEX])
2665 return -EINVAL;
2666
2667 if (!attrs[MACSEC_ATTR_OFFLOAD])
2668 return -EINVAL;
2669
2670 if (nla_parse_nested_deprecated(tb_offload, MACSEC_OFFLOAD_ATTR_MAX,
2671 attrs[MACSEC_ATTR_OFFLOAD],
2672 macsec_genl_offload_policy, NULL))
2673 return -EINVAL;
2674
2675 rtnl_lock();
2676
2677 dev = get_dev_from_nl(genl_info_net(info), attrs);
2678 if (IS_ERR(dev)) {
2679 ret = PTR_ERR(dev);
2680 goto out;
2681 }
2682 macsec = macsec_priv(dev);
2683
2684 if (!tb_offload[MACSEC_OFFLOAD_ATTR_TYPE]) {
2685 ret = -EINVAL;
2686 goto out;
2687 }
2688
2689 offload = nla_get_u8(tb_offload[MACSEC_OFFLOAD_ATTR_TYPE]);
2690
2691 if (macsec->offload != offload)
2692 ret = macsec_update_offload(dev, offload);
2693 out:
2694 rtnl_unlock();
2695 return ret;
2696 }
2697
get_tx_sa_stats(struct net_device * dev,int an,struct macsec_tx_sa * tx_sa,struct macsec_tx_sa_stats * sum)2698 static void get_tx_sa_stats(struct net_device *dev, int an,
2699 struct macsec_tx_sa *tx_sa,
2700 struct macsec_tx_sa_stats *sum)
2701 {
2702 struct macsec_dev *macsec = macsec_priv(dev);
2703 int cpu;
2704
2705 /* If h/w offloading is available, propagate to the device */
2706 if (macsec_is_offloaded(macsec)) {
2707 const struct macsec_ops *ops;
2708 struct macsec_context ctx;
2709
2710 ops = macsec_get_ops(macsec, &ctx);
2711 if (ops) {
2712 ctx.sa.assoc_num = an;
2713 ctx.sa.tx_sa = tx_sa;
2714 ctx.stats.tx_sa_stats = sum;
2715 ctx.secy = &macsec_priv(dev)->secy;
2716 macsec_offload(ops->mdo_get_tx_sa_stats, &ctx);
2717 }
2718 return;
2719 }
2720
2721 for_each_possible_cpu(cpu) {
2722 const struct macsec_tx_sa_stats *stats =
2723 per_cpu_ptr(tx_sa->stats, cpu);
2724
2725 sum->OutPktsProtected += stats->OutPktsProtected;
2726 sum->OutPktsEncrypted += stats->OutPktsEncrypted;
2727 }
2728 }
2729
copy_tx_sa_stats(struct sk_buff * skb,struct macsec_tx_sa_stats * sum)2730 static int copy_tx_sa_stats(struct sk_buff *skb, struct macsec_tx_sa_stats *sum)
2731 {
2732 if (nla_put_u32(skb, MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED,
2733 sum->OutPktsProtected) ||
2734 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED,
2735 sum->OutPktsEncrypted))
2736 return -EMSGSIZE;
2737
2738 return 0;
2739 }
2740
get_rx_sa_stats(struct net_device * dev,struct macsec_rx_sc * rx_sc,int an,struct macsec_rx_sa * rx_sa,struct macsec_rx_sa_stats * sum)2741 static void get_rx_sa_stats(struct net_device *dev,
2742 struct macsec_rx_sc *rx_sc, int an,
2743 struct macsec_rx_sa *rx_sa,
2744 struct macsec_rx_sa_stats *sum)
2745 {
2746 struct macsec_dev *macsec = macsec_priv(dev);
2747 int cpu;
2748
2749 /* If h/w offloading is available, propagate to the device */
2750 if (macsec_is_offloaded(macsec)) {
2751 const struct macsec_ops *ops;
2752 struct macsec_context ctx;
2753
2754 ops = macsec_get_ops(macsec, &ctx);
2755 if (ops) {
2756 ctx.sa.assoc_num = an;
2757 ctx.sa.rx_sa = rx_sa;
2758 ctx.stats.rx_sa_stats = sum;
2759 ctx.secy = &macsec_priv(dev)->secy;
2760 ctx.rx_sc = rx_sc;
2761 macsec_offload(ops->mdo_get_rx_sa_stats, &ctx);
2762 }
2763 return;
2764 }
2765
2766 for_each_possible_cpu(cpu) {
2767 const struct macsec_rx_sa_stats *stats =
2768 per_cpu_ptr(rx_sa->stats, cpu);
2769
2770 sum->InPktsOK += stats->InPktsOK;
2771 sum->InPktsInvalid += stats->InPktsInvalid;
2772 sum->InPktsNotValid += stats->InPktsNotValid;
2773 sum->InPktsNotUsingSA += stats->InPktsNotUsingSA;
2774 sum->InPktsUnusedSA += stats->InPktsUnusedSA;
2775 }
2776 }
2777
copy_rx_sa_stats(struct sk_buff * skb,struct macsec_rx_sa_stats * sum)2778 static int copy_rx_sa_stats(struct sk_buff *skb,
2779 struct macsec_rx_sa_stats *sum)
2780 {
2781 if (nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_OK, sum->InPktsOK) ||
2782 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID,
2783 sum->InPktsInvalid) ||
2784 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID,
2785 sum->InPktsNotValid) ||
2786 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA,
2787 sum->InPktsNotUsingSA) ||
2788 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA,
2789 sum->InPktsUnusedSA))
2790 return -EMSGSIZE;
2791
2792 return 0;
2793 }
2794
get_rx_sc_stats(struct net_device * dev,struct macsec_rx_sc * rx_sc,struct macsec_rx_sc_stats * sum)2795 static void get_rx_sc_stats(struct net_device *dev,
2796 struct macsec_rx_sc *rx_sc,
2797 struct macsec_rx_sc_stats *sum)
2798 {
2799 struct macsec_dev *macsec = macsec_priv(dev);
2800 int cpu;
2801
2802 /* If h/w offloading is available, propagate to the device */
2803 if (macsec_is_offloaded(macsec)) {
2804 const struct macsec_ops *ops;
2805 struct macsec_context ctx;
2806
2807 ops = macsec_get_ops(macsec, &ctx);
2808 if (ops) {
2809 ctx.stats.rx_sc_stats = sum;
2810 ctx.secy = &macsec_priv(dev)->secy;
2811 ctx.rx_sc = rx_sc;
2812 macsec_offload(ops->mdo_get_rx_sc_stats, &ctx);
2813 }
2814 return;
2815 }
2816
2817 for_each_possible_cpu(cpu) {
2818 const struct pcpu_rx_sc_stats *stats;
2819 struct macsec_rx_sc_stats tmp;
2820 unsigned int start;
2821
2822 stats = per_cpu_ptr(rx_sc->stats, cpu);
2823 do {
2824 start = u64_stats_fetch_begin(&stats->syncp);
2825 memcpy(&tmp, &stats->stats, sizeof(tmp));
2826 } while (u64_stats_fetch_retry(&stats->syncp, start));
2827
2828 sum->InOctetsValidated += tmp.InOctetsValidated;
2829 sum->InOctetsDecrypted += tmp.InOctetsDecrypted;
2830 sum->InPktsUnchecked += tmp.InPktsUnchecked;
2831 sum->InPktsDelayed += tmp.InPktsDelayed;
2832 sum->InPktsOK += tmp.InPktsOK;
2833 sum->InPktsInvalid += tmp.InPktsInvalid;
2834 sum->InPktsLate += tmp.InPktsLate;
2835 sum->InPktsNotValid += tmp.InPktsNotValid;
2836 sum->InPktsNotUsingSA += tmp.InPktsNotUsingSA;
2837 sum->InPktsUnusedSA += tmp.InPktsUnusedSA;
2838 }
2839 }
2840
copy_rx_sc_stats(struct sk_buff * skb,struct macsec_rx_sc_stats * sum)2841 static int copy_rx_sc_stats(struct sk_buff *skb, struct macsec_rx_sc_stats *sum)
2842 {
2843 if (nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED,
2844 sum->InOctetsValidated,
2845 MACSEC_RXSC_STATS_ATTR_PAD) ||
2846 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED,
2847 sum->InOctetsDecrypted,
2848 MACSEC_RXSC_STATS_ATTR_PAD) ||
2849 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED,
2850 sum->InPktsUnchecked,
2851 MACSEC_RXSC_STATS_ATTR_PAD) ||
2852 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED,
2853 sum->InPktsDelayed,
2854 MACSEC_RXSC_STATS_ATTR_PAD) ||
2855 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK,
2856 sum->InPktsOK,
2857 MACSEC_RXSC_STATS_ATTR_PAD) ||
2858 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID,
2859 sum->InPktsInvalid,
2860 MACSEC_RXSC_STATS_ATTR_PAD) ||
2861 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE,
2862 sum->InPktsLate,
2863 MACSEC_RXSC_STATS_ATTR_PAD) ||
2864 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID,
2865 sum->InPktsNotValid,
2866 MACSEC_RXSC_STATS_ATTR_PAD) ||
2867 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA,
2868 sum->InPktsNotUsingSA,
2869 MACSEC_RXSC_STATS_ATTR_PAD) ||
2870 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA,
2871 sum->InPktsUnusedSA,
2872 MACSEC_RXSC_STATS_ATTR_PAD))
2873 return -EMSGSIZE;
2874
2875 return 0;
2876 }
2877
get_tx_sc_stats(struct net_device * dev,struct macsec_tx_sc_stats * sum)2878 static void get_tx_sc_stats(struct net_device *dev,
2879 struct macsec_tx_sc_stats *sum)
2880 {
2881 struct macsec_dev *macsec = macsec_priv(dev);
2882 int cpu;
2883
2884 /* If h/w offloading is available, propagate to the device */
2885 if (macsec_is_offloaded(macsec)) {
2886 const struct macsec_ops *ops;
2887 struct macsec_context ctx;
2888
2889 ops = macsec_get_ops(macsec, &ctx);
2890 if (ops) {
2891 ctx.stats.tx_sc_stats = sum;
2892 ctx.secy = &macsec_priv(dev)->secy;
2893 macsec_offload(ops->mdo_get_tx_sc_stats, &ctx);
2894 }
2895 return;
2896 }
2897
2898 for_each_possible_cpu(cpu) {
2899 const struct pcpu_tx_sc_stats *stats;
2900 struct macsec_tx_sc_stats tmp;
2901 unsigned int start;
2902
2903 stats = per_cpu_ptr(macsec_priv(dev)->secy.tx_sc.stats, cpu);
2904 do {
2905 start = u64_stats_fetch_begin(&stats->syncp);
2906 memcpy(&tmp, &stats->stats, sizeof(tmp));
2907 } while (u64_stats_fetch_retry(&stats->syncp, start));
2908
2909 sum->OutPktsProtected += tmp.OutPktsProtected;
2910 sum->OutPktsEncrypted += tmp.OutPktsEncrypted;
2911 sum->OutOctetsProtected += tmp.OutOctetsProtected;
2912 sum->OutOctetsEncrypted += tmp.OutOctetsEncrypted;
2913 }
2914 }
2915
copy_tx_sc_stats(struct sk_buff * skb,struct macsec_tx_sc_stats * sum)2916 static int copy_tx_sc_stats(struct sk_buff *skb, struct macsec_tx_sc_stats *sum)
2917 {
2918 if (nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED,
2919 sum->OutPktsProtected,
2920 MACSEC_TXSC_STATS_ATTR_PAD) ||
2921 nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED,
2922 sum->OutPktsEncrypted,
2923 MACSEC_TXSC_STATS_ATTR_PAD) ||
2924 nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED,
2925 sum->OutOctetsProtected,
2926 MACSEC_TXSC_STATS_ATTR_PAD) ||
2927 nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED,
2928 sum->OutOctetsEncrypted,
2929 MACSEC_TXSC_STATS_ATTR_PAD))
2930 return -EMSGSIZE;
2931
2932 return 0;
2933 }
2934
get_secy_stats(struct net_device * dev,struct macsec_dev_stats * sum)2935 static void get_secy_stats(struct net_device *dev, struct macsec_dev_stats *sum)
2936 {
2937 struct macsec_dev *macsec = macsec_priv(dev);
2938 int cpu;
2939
2940 /* If h/w offloading is available, propagate to the device */
2941 if (macsec_is_offloaded(macsec)) {
2942 const struct macsec_ops *ops;
2943 struct macsec_context ctx;
2944
2945 ops = macsec_get_ops(macsec, &ctx);
2946 if (ops) {
2947 ctx.stats.dev_stats = sum;
2948 ctx.secy = &macsec_priv(dev)->secy;
2949 macsec_offload(ops->mdo_get_dev_stats, &ctx);
2950 }
2951 return;
2952 }
2953
2954 for_each_possible_cpu(cpu) {
2955 const struct pcpu_secy_stats *stats;
2956 struct macsec_dev_stats tmp;
2957 unsigned int start;
2958
2959 stats = per_cpu_ptr(macsec_priv(dev)->stats, cpu);
2960 do {
2961 start = u64_stats_fetch_begin(&stats->syncp);
2962 memcpy(&tmp, &stats->stats, sizeof(tmp));
2963 } while (u64_stats_fetch_retry(&stats->syncp, start));
2964
2965 sum->OutPktsUntagged += tmp.OutPktsUntagged;
2966 sum->InPktsUntagged += tmp.InPktsUntagged;
2967 sum->OutPktsTooLong += tmp.OutPktsTooLong;
2968 sum->InPktsNoTag += tmp.InPktsNoTag;
2969 sum->InPktsBadTag += tmp.InPktsBadTag;
2970 sum->InPktsUnknownSCI += tmp.InPktsUnknownSCI;
2971 sum->InPktsNoSCI += tmp.InPktsNoSCI;
2972 sum->InPktsOverrun += tmp.InPktsOverrun;
2973 }
2974 }
2975
copy_secy_stats(struct sk_buff * skb,struct macsec_dev_stats * sum)2976 static int copy_secy_stats(struct sk_buff *skb, struct macsec_dev_stats *sum)
2977 {
2978 if (nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED,
2979 sum->OutPktsUntagged,
2980 MACSEC_SECY_STATS_ATTR_PAD) ||
2981 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED,
2982 sum->InPktsUntagged,
2983 MACSEC_SECY_STATS_ATTR_PAD) ||
2984 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG,
2985 sum->OutPktsTooLong,
2986 MACSEC_SECY_STATS_ATTR_PAD) ||
2987 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG,
2988 sum->InPktsNoTag,
2989 MACSEC_SECY_STATS_ATTR_PAD) ||
2990 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG,
2991 sum->InPktsBadTag,
2992 MACSEC_SECY_STATS_ATTR_PAD) ||
2993 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI,
2994 sum->InPktsUnknownSCI,
2995 MACSEC_SECY_STATS_ATTR_PAD) ||
2996 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI,
2997 sum->InPktsNoSCI,
2998 MACSEC_SECY_STATS_ATTR_PAD) ||
2999 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN,
3000 sum->InPktsOverrun,
3001 MACSEC_SECY_STATS_ATTR_PAD))
3002 return -EMSGSIZE;
3003
3004 return 0;
3005 }
3006
nla_put_secy(struct macsec_secy * secy,struct sk_buff * skb)3007 static int nla_put_secy(struct macsec_secy *secy, struct sk_buff *skb)
3008 {
3009 struct macsec_tx_sc *tx_sc = &secy->tx_sc;
3010 struct nlattr *secy_nest = nla_nest_start_noflag(skb,
3011 MACSEC_ATTR_SECY);
3012 u64 csid;
3013
3014 if (!secy_nest)
3015 return 1;
3016
3017 switch (secy->key_len) {
3018 case MACSEC_GCM_AES_128_SAK_LEN:
3019 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID;
3020 break;
3021 case MACSEC_GCM_AES_256_SAK_LEN:
3022 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256;
3023 break;
3024 default:
3025 goto cancel;
3026 }
3027
3028 if (nla_put_sci(skb, MACSEC_SECY_ATTR_SCI, secy->sci,
3029 MACSEC_SECY_ATTR_PAD) ||
3030 nla_put_u64_64bit(skb, MACSEC_SECY_ATTR_CIPHER_SUITE,
3031 csid, MACSEC_SECY_ATTR_PAD) ||
3032 nla_put_u8(skb, MACSEC_SECY_ATTR_ICV_LEN, secy->icv_len) ||
3033 nla_put_u8(skb, MACSEC_SECY_ATTR_OPER, secy->operational) ||
3034 nla_put_u8(skb, MACSEC_SECY_ATTR_PROTECT, secy->protect_frames) ||
3035 nla_put_u8(skb, MACSEC_SECY_ATTR_REPLAY, secy->replay_protect) ||
3036 nla_put_u8(skb, MACSEC_SECY_ATTR_VALIDATE, secy->validate_frames) ||
3037 nla_put_u8(skb, MACSEC_SECY_ATTR_ENCRYPT, tx_sc->encrypt) ||
3038 nla_put_u8(skb, MACSEC_SECY_ATTR_INC_SCI, tx_sc->send_sci) ||
3039 nla_put_u8(skb, MACSEC_SECY_ATTR_ES, tx_sc->end_station) ||
3040 nla_put_u8(skb, MACSEC_SECY_ATTR_SCB, tx_sc->scb) ||
3041 nla_put_u8(skb, MACSEC_SECY_ATTR_ENCODING_SA, tx_sc->encoding_sa))
3042 goto cancel;
3043
3044 if (secy->replay_protect) {
3045 if (nla_put_u32(skb, MACSEC_SECY_ATTR_WINDOW, secy->replay_window))
3046 goto cancel;
3047 }
3048
3049 nla_nest_end(skb, secy_nest);
3050 return 0;
3051
3052 cancel:
3053 nla_nest_cancel(skb, secy_nest);
3054 return 1;
3055 }
3056
3057 static noinline_for_stack int
dump_secy(struct macsec_secy * secy,struct net_device * dev,struct sk_buff * skb,struct netlink_callback * cb)3058 dump_secy(struct macsec_secy *secy, struct net_device *dev,
3059 struct sk_buff *skb, struct netlink_callback *cb)
3060 {
3061 struct macsec_tx_sc_stats tx_sc_stats = {0, };
3062 struct macsec_tx_sa_stats tx_sa_stats = {0, };
3063 struct macsec_rx_sc_stats rx_sc_stats = {0, };
3064 struct macsec_rx_sa_stats rx_sa_stats = {0, };
3065 struct macsec_dev *macsec = netdev_priv(dev);
3066 struct macsec_dev_stats dev_stats = {0, };
3067 struct macsec_tx_sc *tx_sc = &secy->tx_sc;
3068 struct nlattr *txsa_list, *rxsc_list;
3069 struct macsec_rx_sc *rx_sc;
3070 struct nlattr *attr;
3071 void *hdr;
3072 int i, j;
3073
3074 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
3075 &macsec_fam, NLM_F_MULTI, MACSEC_CMD_GET_TXSC);
3076 if (!hdr)
3077 return -EMSGSIZE;
3078
3079 genl_dump_check_consistent(cb, hdr);
3080
3081 if (nla_put_u32(skb, MACSEC_ATTR_IFINDEX, dev->ifindex))
3082 goto nla_put_failure;
3083
3084 attr = nla_nest_start_noflag(skb, MACSEC_ATTR_OFFLOAD);
3085 if (!attr)
3086 goto nla_put_failure;
3087 if (nla_put_u8(skb, MACSEC_OFFLOAD_ATTR_TYPE, macsec->offload))
3088 goto nla_put_failure;
3089 nla_nest_end(skb, attr);
3090
3091 if (nla_put_secy(secy, skb))
3092 goto nla_put_failure;
3093
3094 attr = nla_nest_start_noflag(skb, MACSEC_ATTR_TXSC_STATS);
3095 if (!attr)
3096 goto nla_put_failure;
3097
3098 get_tx_sc_stats(dev, &tx_sc_stats);
3099 if (copy_tx_sc_stats(skb, &tx_sc_stats)) {
3100 nla_nest_cancel(skb, attr);
3101 goto nla_put_failure;
3102 }
3103 nla_nest_end(skb, attr);
3104
3105 attr = nla_nest_start_noflag(skb, MACSEC_ATTR_SECY_STATS);
3106 if (!attr)
3107 goto nla_put_failure;
3108 get_secy_stats(dev, &dev_stats);
3109 if (copy_secy_stats(skb, &dev_stats)) {
3110 nla_nest_cancel(skb, attr);
3111 goto nla_put_failure;
3112 }
3113 nla_nest_end(skb, attr);
3114
3115 txsa_list = nla_nest_start_noflag(skb, MACSEC_ATTR_TXSA_LIST);
3116 if (!txsa_list)
3117 goto nla_put_failure;
3118 for (i = 0, j = 1; i < MACSEC_NUM_AN; i++) {
3119 struct macsec_tx_sa *tx_sa = rtnl_dereference(tx_sc->sa[i]);
3120 struct nlattr *txsa_nest;
3121 u64 pn;
3122 int pn_len;
3123
3124 if (!tx_sa)
3125 continue;
3126
3127 txsa_nest = nla_nest_start_noflag(skb, j++);
3128 if (!txsa_nest) {
3129 nla_nest_cancel(skb, txsa_list);
3130 goto nla_put_failure;
3131 }
3132
3133 attr = nla_nest_start_noflag(skb, MACSEC_SA_ATTR_STATS);
3134 if (!attr) {
3135 nla_nest_cancel(skb, txsa_nest);
3136 nla_nest_cancel(skb, txsa_list);
3137 goto nla_put_failure;
3138 }
3139 memset(&tx_sa_stats, 0, sizeof(tx_sa_stats));
3140 get_tx_sa_stats(dev, i, tx_sa, &tx_sa_stats);
3141 if (copy_tx_sa_stats(skb, &tx_sa_stats)) {
3142 nla_nest_cancel(skb, attr);
3143 nla_nest_cancel(skb, txsa_nest);
3144 nla_nest_cancel(skb, txsa_list);
3145 goto nla_put_failure;
3146 }
3147 nla_nest_end(skb, attr);
3148
3149 if (secy->xpn) {
3150 pn = tx_sa->next_pn;
3151 pn_len = MACSEC_XPN_PN_LEN;
3152 } else {
3153 pn = tx_sa->next_pn_halves.lower;
3154 pn_len = MACSEC_DEFAULT_PN_LEN;
3155 }
3156
3157 if (nla_put_u8(skb, MACSEC_SA_ATTR_AN, i) ||
3158 nla_put(skb, MACSEC_SA_ATTR_PN, pn_len, &pn) ||
3159 nla_put(skb, MACSEC_SA_ATTR_KEYID, MACSEC_KEYID_LEN, tx_sa->key.id) ||
3160 (secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, tx_sa->ssci)) ||
3161 nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, tx_sa->active)) {
3162 nla_nest_cancel(skb, txsa_nest);
3163 nla_nest_cancel(skb, txsa_list);
3164 goto nla_put_failure;
3165 }
3166
3167 nla_nest_end(skb, txsa_nest);
3168 }
3169 nla_nest_end(skb, txsa_list);
3170
3171 rxsc_list = nla_nest_start_noflag(skb, MACSEC_ATTR_RXSC_LIST);
3172 if (!rxsc_list)
3173 goto nla_put_failure;
3174
3175 j = 1;
3176 for_each_rxsc_rtnl(secy, rx_sc) {
3177 int k;
3178 struct nlattr *rxsa_list;
3179 struct nlattr *rxsc_nest = nla_nest_start_noflag(skb, j++);
3180
3181 if (!rxsc_nest) {
3182 nla_nest_cancel(skb, rxsc_list);
3183 goto nla_put_failure;
3184 }
3185
3186 if (nla_put_u8(skb, MACSEC_RXSC_ATTR_ACTIVE, rx_sc->active) ||
3187 nla_put_sci(skb, MACSEC_RXSC_ATTR_SCI, rx_sc->sci,
3188 MACSEC_RXSC_ATTR_PAD)) {
3189 nla_nest_cancel(skb, rxsc_nest);
3190 nla_nest_cancel(skb, rxsc_list);
3191 goto nla_put_failure;
3192 }
3193
3194 attr = nla_nest_start_noflag(skb, MACSEC_RXSC_ATTR_STATS);
3195 if (!attr) {
3196 nla_nest_cancel(skb, rxsc_nest);
3197 nla_nest_cancel(skb, rxsc_list);
3198 goto nla_put_failure;
3199 }
3200 memset(&rx_sc_stats, 0, sizeof(rx_sc_stats));
3201 get_rx_sc_stats(dev, rx_sc, &rx_sc_stats);
3202 if (copy_rx_sc_stats(skb, &rx_sc_stats)) {
3203 nla_nest_cancel(skb, attr);
3204 nla_nest_cancel(skb, rxsc_nest);
3205 nla_nest_cancel(skb, rxsc_list);
3206 goto nla_put_failure;
3207 }
3208 nla_nest_end(skb, attr);
3209
3210 rxsa_list = nla_nest_start_noflag(skb,
3211 MACSEC_RXSC_ATTR_SA_LIST);
3212 if (!rxsa_list) {
3213 nla_nest_cancel(skb, rxsc_nest);
3214 nla_nest_cancel(skb, rxsc_list);
3215 goto nla_put_failure;
3216 }
3217
3218 for (i = 0, k = 1; i < MACSEC_NUM_AN; i++) {
3219 struct macsec_rx_sa *rx_sa = rtnl_dereference(rx_sc->sa[i]);
3220 struct nlattr *rxsa_nest;
3221 u64 pn;
3222 int pn_len;
3223
3224 if (!rx_sa)
3225 continue;
3226
3227 rxsa_nest = nla_nest_start_noflag(skb, k++);
3228 if (!rxsa_nest) {
3229 nla_nest_cancel(skb, rxsa_list);
3230 nla_nest_cancel(skb, rxsc_nest);
3231 nla_nest_cancel(skb, rxsc_list);
3232 goto nla_put_failure;
3233 }
3234
3235 attr = nla_nest_start_noflag(skb,
3236 MACSEC_SA_ATTR_STATS);
3237 if (!attr) {
3238 nla_nest_cancel(skb, rxsa_list);
3239 nla_nest_cancel(skb, rxsc_nest);
3240 nla_nest_cancel(skb, rxsc_list);
3241 goto nla_put_failure;
3242 }
3243 memset(&rx_sa_stats, 0, sizeof(rx_sa_stats));
3244 get_rx_sa_stats(dev, rx_sc, i, rx_sa, &rx_sa_stats);
3245 if (copy_rx_sa_stats(skb, &rx_sa_stats)) {
3246 nla_nest_cancel(skb, attr);
3247 nla_nest_cancel(skb, rxsa_list);
3248 nla_nest_cancel(skb, rxsc_nest);
3249 nla_nest_cancel(skb, rxsc_list);
3250 goto nla_put_failure;
3251 }
3252 nla_nest_end(skb, attr);
3253
3254 if (secy->xpn) {
3255 pn = rx_sa->next_pn;
3256 pn_len = MACSEC_XPN_PN_LEN;
3257 } else {
3258 pn = rx_sa->next_pn_halves.lower;
3259 pn_len = MACSEC_DEFAULT_PN_LEN;
3260 }
3261
3262 if (nla_put_u8(skb, MACSEC_SA_ATTR_AN, i) ||
3263 nla_put(skb, MACSEC_SA_ATTR_PN, pn_len, &pn) ||
3264 nla_put(skb, MACSEC_SA_ATTR_KEYID, MACSEC_KEYID_LEN, rx_sa->key.id) ||
3265 (secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, rx_sa->ssci)) ||
3266 nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, rx_sa->active)) {
3267 nla_nest_cancel(skb, rxsa_nest);
3268 nla_nest_cancel(skb, rxsc_nest);
3269 nla_nest_cancel(skb, rxsc_list);
3270 goto nla_put_failure;
3271 }
3272 nla_nest_end(skb, rxsa_nest);
3273 }
3274
3275 nla_nest_end(skb, rxsa_list);
3276 nla_nest_end(skb, rxsc_nest);
3277 }
3278
3279 nla_nest_end(skb, rxsc_list);
3280
3281 genlmsg_end(skb, hdr);
3282
3283 return 0;
3284
3285 nla_put_failure:
3286 genlmsg_cancel(skb, hdr);
3287 return -EMSGSIZE;
3288 }
3289
3290 static int macsec_generation = 1; /* protected by RTNL */
3291
macsec_dump_txsc(struct sk_buff * skb,struct netlink_callback * cb)3292 static int macsec_dump_txsc(struct sk_buff *skb, struct netlink_callback *cb)
3293 {
3294 struct net *net = sock_net(skb->sk);
3295 struct net_device *dev;
3296 int dev_idx, d;
3297
3298 dev_idx = cb->args[0];
3299
3300 d = 0;
3301 rtnl_lock();
3302
3303 cb->seq = macsec_generation;
3304
3305 for_each_netdev(net, dev) {
3306 struct macsec_secy *secy;
3307
3308 if (d < dev_idx)
3309 goto next;
3310
3311 if (!netif_is_macsec(dev))
3312 goto next;
3313
3314 secy = &macsec_priv(dev)->secy;
3315 if (dump_secy(secy, dev, skb, cb) < 0)
3316 goto done;
3317 next:
3318 d++;
3319 }
3320
3321 done:
3322 rtnl_unlock();
3323 cb->args[0] = d;
3324 return skb->len;
3325 }
3326
3327 static const struct genl_small_ops macsec_genl_ops[] = {
3328 {
3329 .cmd = MACSEC_CMD_GET_TXSC,
3330 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3331 .dumpit = macsec_dump_txsc,
3332 },
3333 {
3334 .cmd = MACSEC_CMD_ADD_RXSC,
3335 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3336 .doit = macsec_add_rxsc,
3337 .flags = GENL_ADMIN_PERM,
3338 },
3339 {
3340 .cmd = MACSEC_CMD_DEL_RXSC,
3341 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3342 .doit = macsec_del_rxsc,
3343 .flags = GENL_ADMIN_PERM,
3344 },
3345 {
3346 .cmd = MACSEC_CMD_UPD_RXSC,
3347 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3348 .doit = macsec_upd_rxsc,
3349 .flags = GENL_ADMIN_PERM,
3350 },
3351 {
3352 .cmd = MACSEC_CMD_ADD_TXSA,
3353 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3354 .doit = macsec_add_txsa,
3355 .flags = GENL_ADMIN_PERM,
3356 },
3357 {
3358 .cmd = MACSEC_CMD_DEL_TXSA,
3359 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3360 .doit = macsec_del_txsa,
3361 .flags = GENL_ADMIN_PERM,
3362 },
3363 {
3364 .cmd = MACSEC_CMD_UPD_TXSA,
3365 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3366 .doit = macsec_upd_txsa,
3367 .flags = GENL_ADMIN_PERM,
3368 },
3369 {
3370 .cmd = MACSEC_CMD_ADD_RXSA,
3371 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3372 .doit = macsec_add_rxsa,
3373 .flags = GENL_ADMIN_PERM,
3374 },
3375 {
3376 .cmd = MACSEC_CMD_DEL_RXSA,
3377 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3378 .doit = macsec_del_rxsa,
3379 .flags = GENL_ADMIN_PERM,
3380 },
3381 {
3382 .cmd = MACSEC_CMD_UPD_RXSA,
3383 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3384 .doit = macsec_upd_rxsa,
3385 .flags = GENL_ADMIN_PERM,
3386 },
3387 {
3388 .cmd = MACSEC_CMD_UPD_OFFLOAD,
3389 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3390 .doit = macsec_upd_offload,
3391 .flags = GENL_ADMIN_PERM,
3392 },
3393 };
3394
3395 static struct genl_family macsec_fam __ro_after_init = {
3396 .name = MACSEC_GENL_NAME,
3397 .hdrsize = 0,
3398 .version = MACSEC_GENL_VERSION,
3399 .maxattr = MACSEC_ATTR_MAX,
3400 .policy = macsec_genl_policy,
3401 .netnsok = true,
3402 .module = THIS_MODULE,
3403 .small_ops = macsec_genl_ops,
3404 .n_small_ops = ARRAY_SIZE(macsec_genl_ops),
3405 .resv_start_op = MACSEC_CMD_UPD_OFFLOAD + 1,
3406 };
3407
macsec_start_xmit(struct sk_buff * skb,struct net_device * dev)3408 static netdev_tx_t macsec_start_xmit(struct sk_buff *skb,
3409 struct net_device *dev)
3410 {
3411 struct macsec_dev *macsec = netdev_priv(dev);
3412 struct macsec_secy *secy = &macsec->secy;
3413 struct pcpu_secy_stats *secy_stats;
3414 int ret, len;
3415
3416 if (macsec_is_offloaded(netdev_priv(dev))) {
3417 struct metadata_dst *md_dst = secy->tx_sc.md_dst;
3418
3419 skb_dst_drop(skb);
3420 dst_hold(&md_dst->dst);
3421 skb_dst_set(skb, &md_dst->dst);
3422 skb->dev = macsec->real_dev;
3423 return dev_queue_xmit(skb);
3424 }
3425
3426 /* 10.5 */
3427 if (!secy->protect_frames) {
3428 secy_stats = this_cpu_ptr(macsec->stats);
3429 u64_stats_update_begin(&secy_stats->syncp);
3430 secy_stats->stats.OutPktsUntagged++;
3431 u64_stats_update_end(&secy_stats->syncp);
3432 skb->dev = macsec->real_dev;
3433 len = skb->len;
3434 ret = dev_queue_xmit(skb);
3435 count_tx(dev, ret, len);
3436 return ret;
3437 }
3438
3439 if (!secy->operational) {
3440 kfree_skb(skb);
3441 DEV_STATS_INC(dev, tx_dropped);
3442 return NETDEV_TX_OK;
3443 }
3444
3445 len = skb->len;
3446 skb = macsec_encrypt(skb, dev);
3447 if (IS_ERR(skb)) {
3448 if (PTR_ERR(skb) != -EINPROGRESS)
3449 DEV_STATS_INC(dev, tx_dropped);
3450 return NETDEV_TX_OK;
3451 }
3452
3453 macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa);
3454
3455 macsec_encrypt_finish(skb, dev);
3456 ret = dev_queue_xmit(skb);
3457 count_tx(dev, ret, len);
3458 return ret;
3459 }
3460
3461 #define MACSEC_FEATURES \
3462 (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
3463
macsec_dev_init(struct net_device * dev)3464 static int macsec_dev_init(struct net_device *dev)
3465 {
3466 struct macsec_dev *macsec = macsec_priv(dev);
3467 struct net_device *real_dev = macsec->real_dev;
3468 int err;
3469
3470 dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
3471 if (!dev->tstats)
3472 return -ENOMEM;
3473
3474 err = gro_cells_init(&macsec->gro_cells, dev);
3475 if (err) {
3476 free_percpu(dev->tstats);
3477 return err;
3478 }
3479
3480 dev->features = real_dev->features & MACSEC_FEATURES;
3481 dev->features |= NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE;
3482
3483 dev->needed_headroom = real_dev->needed_headroom +
3484 MACSEC_NEEDED_HEADROOM;
3485 dev->needed_tailroom = real_dev->needed_tailroom +
3486 MACSEC_NEEDED_TAILROOM;
3487
3488 if (is_zero_ether_addr(dev->dev_addr))
3489 eth_hw_addr_inherit(dev, real_dev);
3490 if (is_zero_ether_addr(dev->broadcast))
3491 memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len);
3492
3493 /* Get macsec's reference to real_dev */
3494 netdev_hold(real_dev, &macsec->dev_tracker, GFP_KERNEL);
3495
3496 return 0;
3497 }
3498
macsec_dev_uninit(struct net_device * dev)3499 static void macsec_dev_uninit(struct net_device *dev)
3500 {
3501 struct macsec_dev *macsec = macsec_priv(dev);
3502
3503 gro_cells_destroy(&macsec->gro_cells);
3504 free_percpu(dev->tstats);
3505 }
3506
macsec_fix_features(struct net_device * dev,netdev_features_t features)3507 static netdev_features_t macsec_fix_features(struct net_device *dev,
3508 netdev_features_t features)
3509 {
3510 struct macsec_dev *macsec = macsec_priv(dev);
3511 struct net_device *real_dev = macsec->real_dev;
3512
3513 features &= (real_dev->features & MACSEC_FEATURES) |
3514 NETIF_F_GSO_SOFTWARE | NETIF_F_SOFT_FEATURES;
3515 features |= NETIF_F_LLTX;
3516
3517 return features;
3518 }
3519
macsec_dev_open(struct net_device * dev)3520 static int macsec_dev_open(struct net_device *dev)
3521 {
3522 struct macsec_dev *macsec = macsec_priv(dev);
3523 struct net_device *real_dev = macsec->real_dev;
3524 int err;
3525
3526 err = dev_uc_add(real_dev, dev->dev_addr);
3527 if (err < 0)
3528 return err;
3529
3530 if (dev->flags & IFF_ALLMULTI) {
3531 err = dev_set_allmulti(real_dev, 1);
3532 if (err < 0)
3533 goto del_unicast;
3534 }
3535
3536 if (dev->flags & IFF_PROMISC) {
3537 err = dev_set_promiscuity(real_dev, 1);
3538 if (err < 0)
3539 goto clear_allmulti;
3540 }
3541
3542 /* If h/w offloading is available, propagate to the device */
3543 if (macsec_is_offloaded(macsec)) {
3544 const struct macsec_ops *ops;
3545 struct macsec_context ctx;
3546
3547 ops = macsec_get_ops(netdev_priv(dev), &ctx);
3548 if (!ops) {
3549 err = -EOPNOTSUPP;
3550 goto clear_allmulti;
3551 }
3552
3553 ctx.secy = &macsec->secy;
3554 err = macsec_offload(ops->mdo_dev_open, &ctx);
3555 if (err)
3556 goto clear_allmulti;
3557 }
3558
3559 if (netif_carrier_ok(real_dev))
3560 netif_carrier_on(dev);
3561
3562 return 0;
3563 clear_allmulti:
3564 if (dev->flags & IFF_ALLMULTI)
3565 dev_set_allmulti(real_dev, -1);
3566 del_unicast:
3567 dev_uc_del(real_dev, dev->dev_addr);
3568 netif_carrier_off(dev);
3569 return err;
3570 }
3571
macsec_dev_stop(struct net_device * dev)3572 static int macsec_dev_stop(struct net_device *dev)
3573 {
3574 struct macsec_dev *macsec = macsec_priv(dev);
3575 struct net_device *real_dev = macsec->real_dev;
3576
3577 netif_carrier_off(dev);
3578
3579 /* If h/w offloading is available, propagate to the device */
3580 if (macsec_is_offloaded(macsec)) {
3581 const struct macsec_ops *ops;
3582 struct macsec_context ctx;
3583
3584 ops = macsec_get_ops(macsec, &ctx);
3585 if (ops) {
3586 ctx.secy = &macsec->secy;
3587 macsec_offload(ops->mdo_dev_stop, &ctx);
3588 }
3589 }
3590
3591 dev_mc_unsync(real_dev, dev);
3592 dev_uc_unsync(real_dev, dev);
3593
3594 if (dev->flags & IFF_ALLMULTI)
3595 dev_set_allmulti(real_dev, -1);
3596
3597 if (dev->flags & IFF_PROMISC)
3598 dev_set_promiscuity(real_dev, -1);
3599
3600 dev_uc_del(real_dev, dev->dev_addr);
3601
3602 return 0;
3603 }
3604
macsec_dev_change_rx_flags(struct net_device * dev,int change)3605 static void macsec_dev_change_rx_flags(struct net_device *dev, int change)
3606 {
3607 struct net_device *real_dev = macsec_priv(dev)->real_dev;
3608
3609 if (!(dev->flags & IFF_UP))
3610 return;
3611
3612 if (change & IFF_ALLMULTI)
3613 dev_set_allmulti(real_dev, dev->flags & IFF_ALLMULTI ? 1 : -1);
3614
3615 if (change & IFF_PROMISC)
3616 dev_set_promiscuity(real_dev,
3617 dev->flags & IFF_PROMISC ? 1 : -1);
3618 }
3619
macsec_dev_set_rx_mode(struct net_device * dev)3620 static void macsec_dev_set_rx_mode(struct net_device *dev)
3621 {
3622 struct net_device *real_dev = macsec_priv(dev)->real_dev;
3623
3624 dev_mc_sync(real_dev, dev);
3625 dev_uc_sync(real_dev, dev);
3626 }
3627
macsec_set_mac_address(struct net_device * dev,void * p)3628 static int macsec_set_mac_address(struct net_device *dev, void *p)
3629 {
3630 struct macsec_dev *macsec = macsec_priv(dev);
3631 struct net_device *real_dev = macsec->real_dev;
3632 struct sockaddr *addr = p;
3633 int err;
3634
3635 if (!is_valid_ether_addr(addr->sa_data))
3636 return -EADDRNOTAVAIL;
3637
3638 if (!(dev->flags & IFF_UP))
3639 goto out;
3640
3641 err = dev_uc_add(real_dev, addr->sa_data);
3642 if (err < 0)
3643 return err;
3644
3645 dev_uc_del(real_dev, dev->dev_addr);
3646
3647 out:
3648 eth_hw_addr_set(dev, addr->sa_data);
3649
3650 /* If h/w offloading is available, propagate to the device */
3651 if (macsec_is_offloaded(macsec)) {
3652 const struct macsec_ops *ops;
3653 struct macsec_context ctx;
3654
3655 ops = macsec_get_ops(macsec, &ctx);
3656 if (ops) {
3657 ctx.secy = &macsec->secy;
3658 macsec_offload(ops->mdo_upd_secy, &ctx);
3659 }
3660 }
3661
3662 return 0;
3663 }
3664
macsec_change_mtu(struct net_device * dev,int new_mtu)3665 static int macsec_change_mtu(struct net_device *dev, int new_mtu)
3666 {
3667 struct macsec_dev *macsec = macsec_priv(dev);
3668 unsigned int extra = macsec->secy.icv_len + macsec_extra_len(true);
3669
3670 if (macsec->real_dev->mtu - extra < new_mtu)
3671 return -ERANGE;
3672
3673 dev->mtu = new_mtu;
3674
3675 return 0;
3676 }
3677
macsec_get_stats64(struct net_device * dev,struct rtnl_link_stats64 * s)3678 static void macsec_get_stats64(struct net_device *dev,
3679 struct rtnl_link_stats64 *s)
3680 {
3681 if (!dev->tstats)
3682 return;
3683
3684 dev_fetch_sw_netstats(s, dev->tstats);
3685
3686 s->rx_dropped = DEV_STATS_READ(dev, rx_dropped);
3687 s->tx_dropped = DEV_STATS_READ(dev, tx_dropped);
3688 s->rx_errors = DEV_STATS_READ(dev, rx_errors);
3689 }
3690
macsec_get_iflink(const struct net_device * dev)3691 static int macsec_get_iflink(const struct net_device *dev)
3692 {
3693 return macsec_priv(dev)->real_dev->ifindex;
3694 }
3695
3696 static const struct net_device_ops macsec_netdev_ops = {
3697 .ndo_init = macsec_dev_init,
3698 .ndo_uninit = macsec_dev_uninit,
3699 .ndo_open = macsec_dev_open,
3700 .ndo_stop = macsec_dev_stop,
3701 .ndo_fix_features = macsec_fix_features,
3702 .ndo_change_mtu = macsec_change_mtu,
3703 .ndo_set_rx_mode = macsec_dev_set_rx_mode,
3704 .ndo_change_rx_flags = macsec_dev_change_rx_flags,
3705 .ndo_set_mac_address = macsec_set_mac_address,
3706 .ndo_start_xmit = macsec_start_xmit,
3707 .ndo_get_stats64 = macsec_get_stats64,
3708 .ndo_get_iflink = macsec_get_iflink,
3709 };
3710
3711 static const struct device_type macsec_type = {
3712 .name = "macsec",
3713 };
3714
3715 static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = {
3716 [IFLA_MACSEC_SCI] = { .type = NLA_U64 },
3717 [IFLA_MACSEC_PORT] = { .type = NLA_U16 },
3718 [IFLA_MACSEC_ICV_LEN] = { .type = NLA_U8 },
3719 [IFLA_MACSEC_CIPHER_SUITE] = { .type = NLA_U64 },
3720 [IFLA_MACSEC_WINDOW] = { .type = NLA_U32 },
3721 [IFLA_MACSEC_ENCODING_SA] = { .type = NLA_U8 },
3722 [IFLA_MACSEC_ENCRYPT] = { .type = NLA_U8 },
3723 [IFLA_MACSEC_PROTECT] = { .type = NLA_U8 },
3724 [IFLA_MACSEC_INC_SCI] = { .type = NLA_U8 },
3725 [IFLA_MACSEC_ES] = { .type = NLA_U8 },
3726 [IFLA_MACSEC_SCB] = { .type = NLA_U8 },
3727 [IFLA_MACSEC_REPLAY_PROTECT] = { .type = NLA_U8 },
3728 [IFLA_MACSEC_VALIDATION] = { .type = NLA_U8 },
3729 [IFLA_MACSEC_OFFLOAD] = { .type = NLA_U8 },
3730 };
3731
macsec_free_netdev(struct net_device * dev)3732 static void macsec_free_netdev(struct net_device *dev)
3733 {
3734 struct macsec_dev *macsec = macsec_priv(dev);
3735
3736 if (macsec->secy.tx_sc.md_dst)
3737 metadata_dst_free(macsec->secy.tx_sc.md_dst);
3738 free_percpu(macsec->stats);
3739 free_percpu(macsec->secy.tx_sc.stats);
3740
3741 /* Get rid of the macsec's reference to real_dev */
3742 netdev_put(macsec->real_dev, &macsec->dev_tracker);
3743 }
3744
macsec_setup(struct net_device * dev)3745 static void macsec_setup(struct net_device *dev)
3746 {
3747 ether_setup(dev);
3748 dev->min_mtu = 0;
3749 dev->max_mtu = ETH_MAX_MTU;
3750 dev->priv_flags |= IFF_NO_QUEUE;
3751 dev->netdev_ops = &macsec_netdev_ops;
3752 dev->needs_free_netdev = true;
3753 dev->priv_destructor = macsec_free_netdev;
3754 SET_NETDEV_DEVTYPE(dev, &macsec_type);
3755
3756 eth_zero_addr(dev->broadcast);
3757 }
3758
macsec_changelink_common(struct net_device * dev,struct nlattr * data[])3759 static int macsec_changelink_common(struct net_device *dev,
3760 struct nlattr *data[])
3761 {
3762 struct macsec_secy *secy;
3763 struct macsec_tx_sc *tx_sc;
3764
3765 secy = &macsec_priv(dev)->secy;
3766 tx_sc = &secy->tx_sc;
3767
3768 if (data[IFLA_MACSEC_ENCODING_SA]) {
3769 struct macsec_tx_sa *tx_sa;
3770
3771 tx_sc->encoding_sa = nla_get_u8(data[IFLA_MACSEC_ENCODING_SA]);
3772 tx_sa = rtnl_dereference(tx_sc->sa[tx_sc->encoding_sa]);
3773
3774 secy->operational = tx_sa && tx_sa->active;
3775 }
3776
3777 if (data[IFLA_MACSEC_ENCRYPT])
3778 tx_sc->encrypt = !!nla_get_u8(data[IFLA_MACSEC_ENCRYPT]);
3779
3780 if (data[IFLA_MACSEC_PROTECT])
3781 secy->protect_frames = !!nla_get_u8(data[IFLA_MACSEC_PROTECT]);
3782
3783 if (data[IFLA_MACSEC_INC_SCI])
3784 tx_sc->send_sci = !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]);
3785
3786 if (data[IFLA_MACSEC_ES])
3787 tx_sc->end_station = !!nla_get_u8(data[IFLA_MACSEC_ES]);
3788
3789 if (data[IFLA_MACSEC_SCB])
3790 tx_sc->scb = !!nla_get_u8(data[IFLA_MACSEC_SCB]);
3791
3792 if (data[IFLA_MACSEC_REPLAY_PROTECT])
3793 secy->replay_protect = !!nla_get_u8(data[IFLA_MACSEC_REPLAY_PROTECT]);
3794
3795 if (data[IFLA_MACSEC_VALIDATION])
3796 secy->validate_frames = nla_get_u8(data[IFLA_MACSEC_VALIDATION]);
3797
3798 if (data[IFLA_MACSEC_CIPHER_SUITE]) {
3799 switch (nla_get_u64(data[IFLA_MACSEC_CIPHER_SUITE])) {
3800 case MACSEC_CIPHER_ID_GCM_AES_128:
3801 case MACSEC_DEFAULT_CIPHER_ID:
3802 secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;
3803 secy->xpn = false;
3804 break;
3805 case MACSEC_CIPHER_ID_GCM_AES_256:
3806 secy->key_len = MACSEC_GCM_AES_256_SAK_LEN;
3807 secy->xpn = false;
3808 break;
3809 case MACSEC_CIPHER_ID_GCM_AES_XPN_128:
3810 secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;
3811 secy->xpn = true;
3812 break;
3813 case MACSEC_CIPHER_ID_GCM_AES_XPN_256:
3814 secy->key_len = MACSEC_GCM_AES_256_SAK_LEN;
3815 secy->xpn = true;
3816 break;
3817 default:
3818 return -EINVAL;
3819 }
3820 }
3821
3822 if (data[IFLA_MACSEC_WINDOW]) {
3823 secy->replay_window = nla_get_u32(data[IFLA_MACSEC_WINDOW]);
3824
3825 /* IEEE 802.1AEbw-2013 10.7.8 - maximum replay window
3826 * for XPN cipher suites */
3827 if (secy->xpn &&
3828 secy->replay_window > MACSEC_XPN_MAX_REPLAY_WINDOW)
3829 return -EINVAL;
3830 }
3831
3832 return 0;
3833 }
3834
macsec_changelink(struct net_device * dev,struct nlattr * tb[],struct nlattr * data[],struct netlink_ext_ack * extack)3835 static int macsec_changelink(struct net_device *dev, struct nlattr *tb[],
3836 struct nlattr *data[],
3837 struct netlink_ext_ack *extack)
3838 {
3839 struct macsec_dev *macsec = macsec_priv(dev);
3840 bool macsec_offload_state_change = false;
3841 enum macsec_offload offload;
3842 struct macsec_tx_sc tx_sc;
3843 struct macsec_secy secy;
3844 int ret;
3845
3846 if (!data)
3847 return 0;
3848
3849 if (data[IFLA_MACSEC_CIPHER_SUITE] ||
3850 data[IFLA_MACSEC_ICV_LEN] ||
3851 data[IFLA_MACSEC_SCI] ||
3852 data[IFLA_MACSEC_PORT])
3853 return -EINVAL;
3854
3855 /* Keep a copy of unmodified secy and tx_sc, in case the offload
3856 * propagation fails, to revert macsec_changelink_common.
3857 */
3858 memcpy(&secy, &macsec->secy, sizeof(secy));
3859 memcpy(&tx_sc, &macsec->secy.tx_sc, sizeof(tx_sc));
3860
3861 ret = macsec_changelink_common(dev, data);
3862 if (ret)
3863 goto cleanup;
3864
3865 if (data[IFLA_MACSEC_OFFLOAD]) {
3866 offload = nla_get_u8(data[IFLA_MACSEC_OFFLOAD]);
3867 if (macsec->offload != offload) {
3868 macsec_offload_state_change = true;
3869 ret = macsec_update_offload(dev, offload);
3870 if (ret)
3871 goto cleanup;
3872 }
3873 }
3874
3875 /* If h/w offloading is available, propagate to the device */
3876 if (!macsec_offload_state_change && macsec_is_offloaded(macsec)) {
3877 const struct macsec_ops *ops;
3878 struct macsec_context ctx;
3879
3880 ops = macsec_get_ops(netdev_priv(dev), &ctx);
3881 if (!ops) {
3882 ret = -EOPNOTSUPP;
3883 goto cleanup;
3884 }
3885
3886 ctx.secy = &macsec->secy;
3887 ret = macsec_offload(ops->mdo_upd_secy, &ctx);
3888 if (ret)
3889 goto cleanup;
3890 }
3891
3892 return 0;
3893
3894 cleanup:
3895 memcpy(&macsec->secy.tx_sc, &tx_sc, sizeof(tx_sc));
3896 memcpy(&macsec->secy, &secy, sizeof(secy));
3897
3898 return ret;
3899 }
3900
macsec_del_dev(struct macsec_dev * macsec)3901 static void macsec_del_dev(struct macsec_dev *macsec)
3902 {
3903 int i;
3904
3905 while (macsec->secy.rx_sc) {
3906 struct macsec_rx_sc *rx_sc = rtnl_dereference(macsec->secy.rx_sc);
3907
3908 rcu_assign_pointer(macsec->secy.rx_sc, rx_sc->next);
3909 free_rx_sc(rx_sc);
3910 }
3911
3912 for (i = 0; i < MACSEC_NUM_AN; i++) {
3913 struct macsec_tx_sa *sa = rtnl_dereference(macsec->secy.tx_sc.sa[i]);
3914
3915 if (sa) {
3916 RCU_INIT_POINTER(macsec->secy.tx_sc.sa[i], NULL);
3917 clear_tx_sa(sa);
3918 }
3919 }
3920 }
3921
macsec_common_dellink(struct net_device * dev,struct list_head * head)3922 static void macsec_common_dellink(struct net_device *dev, struct list_head *head)
3923 {
3924 struct macsec_dev *macsec = macsec_priv(dev);
3925 struct net_device *real_dev = macsec->real_dev;
3926
3927 /* If h/w offloading is available, propagate to the device */
3928 if (macsec_is_offloaded(macsec)) {
3929 const struct macsec_ops *ops;
3930 struct macsec_context ctx;
3931
3932 ops = macsec_get_ops(netdev_priv(dev), &ctx);
3933 if (ops) {
3934 ctx.secy = &macsec->secy;
3935 macsec_offload(ops->mdo_del_secy, &ctx);
3936 }
3937 }
3938
3939 unregister_netdevice_queue(dev, head);
3940 list_del_rcu(&macsec->secys);
3941 macsec_del_dev(macsec);
3942 netdev_upper_dev_unlink(real_dev, dev);
3943
3944 macsec_generation++;
3945 }
3946
macsec_dellink(struct net_device * dev,struct list_head * head)3947 static void macsec_dellink(struct net_device *dev, struct list_head *head)
3948 {
3949 struct macsec_dev *macsec = macsec_priv(dev);
3950 struct net_device *real_dev = macsec->real_dev;
3951 struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev);
3952
3953 macsec_common_dellink(dev, head);
3954
3955 if (list_empty(&rxd->secys)) {
3956 netdev_rx_handler_unregister(real_dev);
3957 kfree(rxd);
3958 }
3959 }
3960
register_macsec_dev(struct net_device * real_dev,struct net_device * dev)3961 static int register_macsec_dev(struct net_device *real_dev,
3962 struct net_device *dev)
3963 {
3964 struct macsec_dev *macsec = macsec_priv(dev);
3965 struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev);
3966
3967 if (!rxd) {
3968 int err;
3969
3970 rxd = kmalloc(sizeof(*rxd), GFP_KERNEL);
3971 if (!rxd)
3972 return -ENOMEM;
3973
3974 INIT_LIST_HEAD(&rxd->secys);
3975
3976 err = netdev_rx_handler_register(real_dev, macsec_handle_frame,
3977 rxd);
3978 if (err < 0) {
3979 kfree(rxd);
3980 return err;
3981 }
3982 }
3983
3984 list_add_tail_rcu(&macsec->secys, &rxd->secys);
3985 return 0;
3986 }
3987
sci_exists(struct net_device * dev,sci_t sci)3988 static bool sci_exists(struct net_device *dev, sci_t sci)
3989 {
3990 struct macsec_rxh_data *rxd = macsec_data_rtnl(dev);
3991 struct macsec_dev *macsec;
3992
3993 list_for_each_entry(macsec, &rxd->secys, secys) {
3994 if (macsec->secy.sci == sci)
3995 return true;
3996 }
3997
3998 return false;
3999 }
4000
dev_to_sci(struct net_device * dev,__be16 port)4001 static sci_t dev_to_sci(struct net_device *dev, __be16 port)
4002 {
4003 return make_sci(dev->dev_addr, port);
4004 }
4005
macsec_add_dev(struct net_device * dev,sci_t sci,u8 icv_len)4006 static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len)
4007 {
4008 struct macsec_dev *macsec = macsec_priv(dev);
4009 struct macsec_secy *secy = &macsec->secy;
4010
4011 macsec->stats = netdev_alloc_pcpu_stats(struct pcpu_secy_stats);
4012 if (!macsec->stats)
4013 return -ENOMEM;
4014
4015 secy->tx_sc.stats = netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats);
4016 if (!secy->tx_sc.stats)
4017 return -ENOMEM;
4018
4019 secy->tx_sc.md_dst = metadata_dst_alloc(0, METADATA_MACSEC, GFP_KERNEL);
4020 if (!secy->tx_sc.md_dst)
4021 /* macsec and secy percpu stats will be freed when unregistering
4022 * net_device in macsec_free_netdev()
4023 */
4024 return -ENOMEM;
4025
4026 if (sci == MACSEC_UNDEF_SCI)
4027 sci = dev_to_sci(dev, MACSEC_PORT_ES);
4028
4029 secy->netdev = dev;
4030 secy->operational = true;
4031 secy->key_len = DEFAULT_SAK_LEN;
4032 secy->icv_len = icv_len;
4033 secy->validate_frames = MACSEC_VALIDATE_DEFAULT;
4034 secy->protect_frames = true;
4035 secy->replay_protect = false;
4036 secy->xpn = DEFAULT_XPN;
4037
4038 secy->sci = sci;
4039 secy->tx_sc.md_dst->u.macsec_info.sci = sci;
4040 secy->tx_sc.active = true;
4041 secy->tx_sc.encoding_sa = DEFAULT_ENCODING_SA;
4042 secy->tx_sc.encrypt = DEFAULT_ENCRYPT;
4043 secy->tx_sc.send_sci = DEFAULT_SEND_SCI;
4044 secy->tx_sc.end_station = false;
4045 secy->tx_sc.scb = false;
4046
4047 return 0;
4048 }
4049
4050 static struct lock_class_key macsec_netdev_addr_lock_key;
4051
macsec_newlink(struct net * net,struct net_device * dev,struct nlattr * tb[],struct nlattr * data[],struct netlink_ext_ack * extack)4052 static int macsec_newlink(struct net *net, struct net_device *dev,
4053 struct nlattr *tb[], struct nlattr *data[],
4054 struct netlink_ext_ack *extack)
4055 {
4056 struct macsec_dev *macsec = macsec_priv(dev);
4057 rx_handler_func_t *rx_handler;
4058 u8 icv_len = MACSEC_DEFAULT_ICV_LEN;
4059 struct net_device *real_dev;
4060 int err, mtu;
4061 sci_t sci;
4062
4063 if (!tb[IFLA_LINK])
4064 return -EINVAL;
4065 real_dev = __dev_get_by_index(net, nla_get_u32(tb[IFLA_LINK]));
4066 if (!real_dev)
4067 return -ENODEV;
4068 if (real_dev->type != ARPHRD_ETHER)
4069 return -EINVAL;
4070
4071 dev->priv_flags |= IFF_MACSEC;
4072
4073 macsec->real_dev = real_dev;
4074
4075 if (data && data[IFLA_MACSEC_OFFLOAD])
4076 macsec->offload = nla_get_offload(data[IFLA_MACSEC_OFFLOAD]);
4077 else
4078 /* MACsec offloading is off by default */
4079 macsec->offload = MACSEC_OFFLOAD_OFF;
4080
4081 /* Check if the offloading mode is supported by the underlying layers */
4082 if (macsec->offload != MACSEC_OFFLOAD_OFF &&
4083 !macsec_check_offload(macsec->offload, macsec))
4084 return -EOPNOTSUPP;
4085
4086 /* send_sci must be set to true when transmit sci explicitly is set */
4087 if ((data && data[IFLA_MACSEC_SCI]) &&
4088 (data && data[IFLA_MACSEC_INC_SCI])) {
4089 u8 send_sci = !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]);
4090
4091 if (!send_sci)
4092 return -EINVAL;
4093 }
4094
4095 if (data && data[IFLA_MACSEC_ICV_LEN])
4096 icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]);
4097 mtu = real_dev->mtu - icv_len - macsec_extra_len(true);
4098 if (mtu < 0)
4099 dev->mtu = 0;
4100 else
4101 dev->mtu = mtu;
4102
4103 rx_handler = rtnl_dereference(real_dev->rx_handler);
4104 if (rx_handler && rx_handler != macsec_handle_frame)
4105 return -EBUSY;
4106
4107 err = register_netdevice(dev);
4108 if (err < 0)
4109 return err;
4110
4111 netdev_lockdep_set_classes(dev);
4112 lockdep_set_class(&dev->addr_list_lock,
4113 &macsec_netdev_addr_lock_key);
4114
4115 err = netdev_upper_dev_link(real_dev, dev, extack);
4116 if (err < 0)
4117 goto unregister;
4118
4119 /* need to be already registered so that ->init has run and
4120 * the MAC addr is set
4121 */
4122 if (data && data[IFLA_MACSEC_SCI])
4123 sci = nla_get_sci(data[IFLA_MACSEC_SCI]);
4124 else if (data && data[IFLA_MACSEC_PORT])
4125 sci = dev_to_sci(dev, nla_get_be16(data[IFLA_MACSEC_PORT]));
4126 else
4127 sci = dev_to_sci(dev, MACSEC_PORT_ES);
4128
4129 if (rx_handler && sci_exists(real_dev, sci)) {
4130 err = -EBUSY;
4131 goto unlink;
4132 }
4133
4134 err = macsec_add_dev(dev, sci, icv_len);
4135 if (err)
4136 goto unlink;
4137
4138 if (data) {
4139 err = macsec_changelink_common(dev, data);
4140 if (err)
4141 goto del_dev;
4142 }
4143
4144 /* If h/w offloading is available, propagate to the device */
4145 if (macsec_is_offloaded(macsec)) {
4146 const struct macsec_ops *ops;
4147 struct macsec_context ctx;
4148
4149 ops = macsec_get_ops(macsec, &ctx);
4150 if (ops) {
4151 ctx.secy = &macsec->secy;
4152 err = macsec_offload(ops->mdo_add_secy, &ctx);
4153 if (err)
4154 goto del_dev;
4155 }
4156 }
4157
4158 err = register_macsec_dev(real_dev, dev);
4159 if (err < 0)
4160 goto del_dev;
4161
4162 netif_stacked_transfer_operstate(real_dev, dev);
4163 linkwatch_fire_event(dev);
4164
4165 macsec_generation++;
4166
4167 return 0;
4168
4169 del_dev:
4170 macsec_del_dev(macsec);
4171 unlink:
4172 netdev_upper_dev_unlink(real_dev, dev);
4173 unregister:
4174 unregister_netdevice(dev);
4175 return err;
4176 }
4177
macsec_validate_attr(struct nlattr * tb[],struct nlattr * data[],struct netlink_ext_ack * extack)4178 static int macsec_validate_attr(struct nlattr *tb[], struct nlattr *data[],
4179 struct netlink_ext_ack *extack)
4180 {
4181 u64 csid = MACSEC_DEFAULT_CIPHER_ID;
4182 u8 icv_len = MACSEC_DEFAULT_ICV_LEN;
4183 int flag;
4184 bool es, scb, sci;
4185
4186 if (!data)
4187 return 0;
4188
4189 if (data[IFLA_MACSEC_CIPHER_SUITE])
4190 csid = nla_get_u64(data[IFLA_MACSEC_CIPHER_SUITE]);
4191
4192 if (data[IFLA_MACSEC_ICV_LEN]) {
4193 icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]);
4194 if (icv_len != MACSEC_DEFAULT_ICV_LEN) {
4195 char dummy_key[DEFAULT_SAK_LEN] = { 0 };
4196 struct crypto_aead *dummy_tfm;
4197
4198 dummy_tfm = macsec_alloc_tfm(dummy_key,
4199 DEFAULT_SAK_LEN,
4200 icv_len);
4201 if (IS_ERR(dummy_tfm))
4202 return PTR_ERR(dummy_tfm);
4203 crypto_free_aead(dummy_tfm);
4204 }
4205 }
4206
4207 switch (csid) {
4208 case MACSEC_CIPHER_ID_GCM_AES_128:
4209 case MACSEC_CIPHER_ID_GCM_AES_256:
4210 case MACSEC_CIPHER_ID_GCM_AES_XPN_128:
4211 case MACSEC_CIPHER_ID_GCM_AES_XPN_256:
4212 case MACSEC_DEFAULT_CIPHER_ID:
4213 if (icv_len < MACSEC_MIN_ICV_LEN ||
4214 icv_len > MACSEC_STD_ICV_LEN)
4215 return -EINVAL;
4216 break;
4217 default:
4218 return -EINVAL;
4219 }
4220
4221 if (data[IFLA_MACSEC_ENCODING_SA]) {
4222 if (nla_get_u8(data[IFLA_MACSEC_ENCODING_SA]) >= MACSEC_NUM_AN)
4223 return -EINVAL;
4224 }
4225
4226 for (flag = IFLA_MACSEC_ENCODING_SA + 1;
4227 flag < IFLA_MACSEC_VALIDATION;
4228 flag++) {
4229 if (data[flag]) {
4230 if (nla_get_u8(data[flag]) > 1)
4231 return -EINVAL;
4232 }
4233 }
4234
4235 es = data[IFLA_MACSEC_ES] ? nla_get_u8(data[IFLA_MACSEC_ES]) : false;
4236 sci = data[IFLA_MACSEC_INC_SCI] ? nla_get_u8(data[IFLA_MACSEC_INC_SCI]) : false;
4237 scb = data[IFLA_MACSEC_SCB] ? nla_get_u8(data[IFLA_MACSEC_SCB]) : false;
4238
4239 if ((sci && (scb || es)) || (scb && es))
4240 return -EINVAL;
4241
4242 if (data[IFLA_MACSEC_VALIDATION] &&
4243 nla_get_u8(data[IFLA_MACSEC_VALIDATION]) > MACSEC_VALIDATE_MAX)
4244 return -EINVAL;
4245
4246 if ((data[IFLA_MACSEC_REPLAY_PROTECT] &&
4247 nla_get_u8(data[IFLA_MACSEC_REPLAY_PROTECT])) &&
4248 !data[IFLA_MACSEC_WINDOW])
4249 return -EINVAL;
4250
4251 return 0;
4252 }
4253
macsec_get_link_net(const struct net_device * dev)4254 static struct net *macsec_get_link_net(const struct net_device *dev)
4255 {
4256 return dev_net(macsec_priv(dev)->real_dev);
4257 }
4258
macsec_get_real_dev(const struct net_device * dev)4259 struct net_device *macsec_get_real_dev(const struct net_device *dev)
4260 {
4261 return macsec_priv(dev)->real_dev;
4262 }
4263 EXPORT_SYMBOL_GPL(macsec_get_real_dev);
4264
macsec_netdev_is_offloaded(struct net_device * dev)4265 bool macsec_netdev_is_offloaded(struct net_device *dev)
4266 {
4267 return macsec_is_offloaded(macsec_priv(dev));
4268 }
4269 EXPORT_SYMBOL_GPL(macsec_netdev_is_offloaded);
4270
macsec_get_size(const struct net_device * dev)4271 static size_t macsec_get_size(const struct net_device *dev)
4272 {
4273 return nla_total_size_64bit(8) + /* IFLA_MACSEC_SCI */
4274 nla_total_size(1) + /* IFLA_MACSEC_ICV_LEN */
4275 nla_total_size_64bit(8) + /* IFLA_MACSEC_CIPHER_SUITE */
4276 nla_total_size(4) + /* IFLA_MACSEC_WINDOW */
4277 nla_total_size(1) + /* IFLA_MACSEC_ENCODING_SA */
4278 nla_total_size(1) + /* IFLA_MACSEC_ENCRYPT */
4279 nla_total_size(1) + /* IFLA_MACSEC_PROTECT */
4280 nla_total_size(1) + /* IFLA_MACSEC_INC_SCI */
4281 nla_total_size(1) + /* IFLA_MACSEC_ES */
4282 nla_total_size(1) + /* IFLA_MACSEC_SCB */
4283 nla_total_size(1) + /* IFLA_MACSEC_REPLAY_PROTECT */
4284 nla_total_size(1) + /* IFLA_MACSEC_VALIDATION */
4285 nla_total_size(1) + /* IFLA_MACSEC_OFFLOAD */
4286 0;
4287 }
4288
macsec_fill_info(struct sk_buff * skb,const struct net_device * dev)4289 static int macsec_fill_info(struct sk_buff *skb,
4290 const struct net_device *dev)
4291 {
4292 struct macsec_tx_sc *tx_sc;
4293 struct macsec_dev *macsec;
4294 struct macsec_secy *secy;
4295 u64 csid;
4296
4297 macsec = macsec_priv(dev);
4298 secy = &macsec->secy;
4299 tx_sc = &secy->tx_sc;
4300
4301 switch (secy->key_len) {
4302 case MACSEC_GCM_AES_128_SAK_LEN:
4303 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID;
4304 break;
4305 case MACSEC_GCM_AES_256_SAK_LEN:
4306 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256;
4307 break;
4308 default:
4309 goto nla_put_failure;
4310 }
4311
4312 if (nla_put_sci(skb, IFLA_MACSEC_SCI, secy->sci,
4313 IFLA_MACSEC_PAD) ||
4314 nla_put_u8(skb, IFLA_MACSEC_ICV_LEN, secy->icv_len) ||
4315 nla_put_u64_64bit(skb, IFLA_MACSEC_CIPHER_SUITE,
4316 csid, IFLA_MACSEC_PAD) ||
4317 nla_put_u8(skb, IFLA_MACSEC_ENCODING_SA, tx_sc->encoding_sa) ||
4318 nla_put_u8(skb, IFLA_MACSEC_ENCRYPT, tx_sc->encrypt) ||
4319 nla_put_u8(skb, IFLA_MACSEC_PROTECT, secy->protect_frames) ||
4320 nla_put_u8(skb, IFLA_MACSEC_INC_SCI, tx_sc->send_sci) ||
4321 nla_put_u8(skb, IFLA_MACSEC_ES, tx_sc->end_station) ||
4322 nla_put_u8(skb, IFLA_MACSEC_SCB, tx_sc->scb) ||
4323 nla_put_u8(skb, IFLA_MACSEC_REPLAY_PROTECT, secy->replay_protect) ||
4324 nla_put_u8(skb, IFLA_MACSEC_VALIDATION, secy->validate_frames) ||
4325 nla_put_u8(skb, IFLA_MACSEC_OFFLOAD, macsec->offload) ||
4326 0)
4327 goto nla_put_failure;
4328
4329 if (secy->replay_protect) {
4330 if (nla_put_u32(skb, IFLA_MACSEC_WINDOW, secy->replay_window))
4331 goto nla_put_failure;
4332 }
4333
4334 return 0;
4335
4336 nla_put_failure:
4337 return -EMSGSIZE;
4338 }
4339
4340 static struct rtnl_link_ops macsec_link_ops __read_mostly = {
4341 .kind = "macsec",
4342 .priv_size = sizeof(struct macsec_dev),
4343 .maxtype = IFLA_MACSEC_MAX,
4344 .policy = macsec_rtnl_policy,
4345 .setup = macsec_setup,
4346 .validate = macsec_validate_attr,
4347 .newlink = macsec_newlink,
4348 .changelink = macsec_changelink,
4349 .dellink = macsec_dellink,
4350 .get_size = macsec_get_size,
4351 .fill_info = macsec_fill_info,
4352 .get_link_net = macsec_get_link_net,
4353 };
4354
is_macsec_master(struct net_device * dev)4355 static bool is_macsec_master(struct net_device *dev)
4356 {
4357 return rcu_access_pointer(dev->rx_handler) == macsec_handle_frame;
4358 }
4359
macsec_notify(struct notifier_block * this,unsigned long event,void * ptr)4360 static int macsec_notify(struct notifier_block *this, unsigned long event,
4361 void *ptr)
4362 {
4363 struct net_device *real_dev = netdev_notifier_info_to_dev(ptr);
4364 LIST_HEAD(head);
4365
4366 if (!is_macsec_master(real_dev))
4367 return NOTIFY_DONE;
4368
4369 switch (event) {
4370 case NETDEV_DOWN:
4371 case NETDEV_UP:
4372 case NETDEV_CHANGE: {
4373 struct macsec_dev *m, *n;
4374 struct macsec_rxh_data *rxd;
4375
4376 rxd = macsec_data_rtnl(real_dev);
4377 list_for_each_entry_safe(m, n, &rxd->secys, secys) {
4378 struct net_device *dev = m->secy.netdev;
4379
4380 netif_stacked_transfer_operstate(real_dev, dev);
4381 }
4382 break;
4383 }
4384 case NETDEV_UNREGISTER: {
4385 struct macsec_dev *m, *n;
4386 struct macsec_rxh_data *rxd;
4387
4388 rxd = macsec_data_rtnl(real_dev);
4389 list_for_each_entry_safe(m, n, &rxd->secys, secys) {
4390 macsec_common_dellink(m->secy.netdev, &head);
4391 }
4392
4393 netdev_rx_handler_unregister(real_dev);
4394 kfree(rxd);
4395
4396 unregister_netdevice_many(&head);
4397 break;
4398 }
4399 case NETDEV_CHANGEMTU: {
4400 struct macsec_dev *m;
4401 struct macsec_rxh_data *rxd;
4402
4403 rxd = macsec_data_rtnl(real_dev);
4404 list_for_each_entry(m, &rxd->secys, secys) {
4405 struct net_device *dev = m->secy.netdev;
4406 unsigned int mtu = real_dev->mtu - (m->secy.icv_len +
4407 macsec_extra_len(true));
4408
4409 if (dev->mtu > mtu)
4410 dev_set_mtu(dev, mtu);
4411 }
4412 }
4413 }
4414
4415 return NOTIFY_OK;
4416 }
4417
4418 static struct notifier_block macsec_notifier = {
4419 .notifier_call = macsec_notify,
4420 };
4421
macsec_init(void)4422 static int __init macsec_init(void)
4423 {
4424 int err;
4425
4426 pr_info("MACsec IEEE 802.1AE\n");
4427 err = register_netdevice_notifier(&macsec_notifier);
4428 if (err)
4429 return err;
4430
4431 err = rtnl_link_register(&macsec_link_ops);
4432 if (err)
4433 goto notifier;
4434
4435 err = genl_register_family(&macsec_fam);
4436 if (err)
4437 goto rtnl;
4438
4439 return 0;
4440
4441 rtnl:
4442 rtnl_link_unregister(&macsec_link_ops);
4443 notifier:
4444 unregister_netdevice_notifier(&macsec_notifier);
4445 return err;
4446 }
4447
macsec_exit(void)4448 static void __exit macsec_exit(void)
4449 {
4450 genl_unregister_family(&macsec_fam);
4451 rtnl_link_unregister(&macsec_link_ops);
4452 unregister_netdevice_notifier(&macsec_notifier);
4453 rcu_barrier();
4454 }
4455
4456 module_init(macsec_init);
4457 module_exit(macsec_exit);
4458
4459 MODULE_ALIAS_RTNL_LINK("macsec");
4460 MODULE_ALIAS_GENL_FAMILY("macsec");
4461
4462 MODULE_DESCRIPTION("MACsec IEEE 802.1AE");
4463 MODULE_LICENSE("GPL v2");
4464