]> git.proxmox.com Git - mirror_iproute2.git/blob - ip/ipmacsec.c
projects / mirror_iproute2.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
devlink: Add devlink health auto_dump command support
[mirror_iproute2.git] / ip / ipmacsec.c
1 /*
2 * ipmacsec.c "ip macsec".
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version
7 * 2 of the License, or (at your option) any later version.
8 *
9 * Authors: Sabrina Dubroca <sd@queasysnail.net>
10 */
11
12 #include <stdio.h>
13 #include <stdlib.h>
14 #include <string.h>
15 #include <errno.h>
16 #include <linux/genetlink.h>
17 #include <linux/if_ether.h>
18 #include <linux/if_macsec.h>
19
20 #include "rt_names.h"
21 #include "utils.h"
22 #include "ip_common.h"
23 #include "ll_map.h"
24 #include "libgenl.h"
25
26 static const char * const values_on_off[] = { "off", "on" };
27
28 static const char * const validate_str[] = {
29 [MACSEC_VALIDATE_DISABLED] = "disabled",
30 [MACSEC_VALIDATE_CHECK] = "check",
31 [MACSEC_VALIDATE_STRICT] = "strict",
32 };
33
34 static const char * const offload_str[] = {
35 [MACSEC_OFFLOAD_OFF] = "off",
36 [MACSEC_OFFLOAD_PHY] = "phy",
37 };
38
39 struct sci {
40 __u64 sci;
41 __u16 port;
42 char abuf[6];
43 };
44
45 struct sa_desc {
46 __u8 an;
47 __u32 pn;
48 __u8 key_id[MACSEC_KEYID_LEN];
49 __u32 key_len;
50 __u8 key[MACSEC_MAX_KEY_LEN];
51 __u8 active;
52 };
53
54 struct cipher_args {
55 __u64 id;
56 __u8 icv_len;
57 };
58
59 struct txsc_desc {
60 int ifindex;
61 __u64 sci;
62 __be16 port;
63 struct cipher_args cipher;
64 __u32 window;
65 enum macsec_validation_type validate;
66 __u8 encoding_sa;
67 };
68
69 struct rxsc_desc {
70 int ifindex;
71 __u64 sci;
72 __u8 active;
73 };
74
75 #define MACSEC_BUFLEN 1024
76
77
78 /* netlink socket */
79 static struct rtnl_handle genl_rth;
80 static int genl_family = -1;
81
82 #define MACSEC_GENL_REQ(_req, _bufsiz, _cmd, _flags) \
83 GENL_REQUEST(_req, _bufsiz, genl_family, 0, MACSEC_GENL_VERSION, \
84 _cmd, _flags)
85
86
87 static void ipmacsec_usage(void)
88 {
89 fprintf(stderr,
90 "Usage: ip macsec add DEV tx sa { 0..3 } [ OPTS ] key ID KEY\n"
91 " ip macsec set DEV tx sa { 0..3 } [ OPTS ]\n"
92 " ip macsec del DEV tx sa { 0..3 }\n"
93 " ip macsec add DEV rx SCI [ on | off ]\n"
94 " ip macsec set DEV rx SCI [ on | off ]\n"
95 " ip macsec del DEV rx SCI\n"
96 " ip macsec add DEV rx SCI sa { 0..3 } [ OPTS ] key ID KEY\n"
97 " ip macsec set DEV rx SCI sa { 0..3 } [ OPTS ]\n"
98 " ip macsec del DEV rx SCI sa { 0..3 }\n"
99 " ip macsec show\n"
100 " ip macsec show DEV\n"
101 " ip macsec offload DEV [ off | phy ]\n"
102 "where OPTS := [ pn <u32> ] [ on | off ]\n"
103 " ID := 128-bit hex string\n"
104 " KEY := 128-bit or 256-bit hex string\n"
105 " SCI := { sci <u64> | port { 1..2^16-1 } address <lladdr> }\n");
106
107 exit(-1);
108 }
109
110 static int one_of(const char *msg, const char *realval, const char * const *list,
111 size_t len, int *index)
112 {
113 int i;
114
115 for (i = 0; i < len; i++) {
116 if (matches(realval, list[i]) == 0) {
117 *index = i;
118 return 0;
119 }
120 }
121
122 fprintf(stderr, "Error: argument of \"%s\" must be one of ", msg);
123 for (i = 0; i < len; i++)
124 fprintf(stderr, "\"%s\", ", list[i]);
125 fprintf(stderr, "not \"%s\"\n", realval);
126 return -1;
127 }
128
129 static int get_an(__u8 *val, const char *arg)
130 {
131 int ret = get_u8(val, arg, 0);
132
133 if (ret)
134 return ret;
135
136 if (*val > 3)
137 return -1;
138
139 return 0;
140 }
141
142 static int get_sci(__u64 *sci, const char *arg)
143 {
144 return get_be64(sci, arg, 16);
145 }
146
147 static int get_port(__be16 *port, const char *arg)
148 {
149 return get_be16(port, arg, 0);
150 }
151
152 #define _STR(a) #a
153 #define STR(a) _STR(a)
154
155 static void get_icvlen(__u8 *icvlen, char *arg)
156 {
157 int ret = get_u8(icvlen, arg, 10);
158
159 if (ret)
160 invarg("expected ICV length", arg);
161
162 if (*icvlen < MACSEC_MIN_ICV_LEN || *icvlen > MACSEC_STD_ICV_LEN)
163 invarg("ICV length must be in the range {"
164 STR(MACSEC_MIN_ICV_LEN) ".." STR(MACSEC_STD_ICV_LEN)
165 "}", arg);
166 }
167
168 static bool get_sa(int *argcp, char ***argvp, __u8 *an)
169 {
170 int argc = *argcp;
171 char **argv = *argvp;
172 int ret;
173
174 if (argc <= 0 || strcmp(*argv, "sa") != 0)
175 return false;
176
177 NEXT_ARG();
178 ret = get_an(an, *argv);
179 if (ret)
180 invarg("expected an { 0..3 }", *argv);
181 argc--; argv++;
182
183 *argvp = argv;
184 *argcp = argc;
185 return true;
186 }
187
188 static int parse_sa_args(int *argcp, char ***argvp, struct sa_desc *sa)
189 {
190 int argc = *argcp;
191 char **argv = *argvp;
192 int ret;
193 bool active_set = false;
194
195 while (argc > 0) {
196 if (strcmp(*argv, "pn") == 0) {
197 if (sa->pn != 0)
198 duparg2("pn", "pn");
199 NEXT_ARG();
200 ret = get_u32(&sa->pn, *argv, 0);
201 if (ret)
202 invarg("expected pn", *argv);
203 if (sa->pn == 0)
204 invarg("expected pn != 0", *argv);
205 } else if (strcmp(*argv, "key") == 0) {
206 unsigned int len;
207
208 NEXT_ARG();
209 if (!hexstring_a2n(*argv, sa->key_id, MACSEC_KEYID_LEN,
210 &len))
211 invarg("expected key id", *argv);
212 NEXT_ARG();
213 if (!hexstring_a2n(*argv, sa->key, MACSEC_MAX_KEY_LEN,
214 &sa->key_len))
215 invarg("expected key", *argv);
216 } else if (strcmp(*argv, "on") == 0) {
217 if (active_set)
218 duparg2("on/off", "on");
219 sa->active = true;
220 active_set = true;
221 } else if (strcmp(*argv, "off") == 0) {
222 if (active_set)
223 duparg2("on/off", "off");
224 sa->active = false;
225 active_set = true;
226 } else {
227 fprintf(stderr, "macsec: unknown command \"%s\"?\n",
228 *argv);
229 ipmacsec_usage();
230 }
231
232 argv++; argc--;
233 }
234
235 *argvp = argv;
236 *argcp = argc;
237 return 0;
238 }
239
240 static __u64 make_sci(char *addr, __be16 port)
241 {
242 __u64 sci;
243
244 memcpy(&sci, addr, ETH_ALEN);
245 memcpy(((char *)&sci) + ETH_ALEN, &port, sizeof(port));
246
247 return sci;
248 }
249
250 static bool sci_complete(bool sci, bool port, bool addr, bool port_only)
251 {
252 return sci || (port && (addr || port_only));
253 }
254
255 static int get_sci_portaddr(struct sci *sci, int *argcp, char ***argvp,
256 bool port_only, bool optional)
257 {
258 int argc = *argcp;
259 char **argv = *argvp;
260 int ret;
261 bool p = false, a = false, s = false;
262
263 while (argc > 0) {
264 if (strcmp(*argv, "sci") == 0) {
265 if (p)
266 invarg("expected address", *argv);
267 if (a)
268 invarg("expected port", *argv);
269 NEXT_ARG();
270 ret = get_sci(&sci->sci, *argv);
271 if (ret)
272 invarg("expected sci", *argv);
273 s = true;
274 } else if (strcmp(*argv, "port") == 0) {
275 NEXT_ARG();
276 ret = get_port(&sci->port, *argv);
277 if (ret)
278 invarg("expected port", *argv);
279 if (sci->port == 0)
280 invarg("expected port != 0", *argv);
281 p = true;
282 } else if (strcmp(*argv, "address") == 0) {
283 NEXT_ARG();
284 ret = ll_addr_a2n(sci->abuf, sizeof(sci->abuf), *argv);
285 if (ret < 0)
286 invarg("expected lladdr", *argv);
287 a = true;
288 } else if (optional) {
289 break;
290 } else {
291 invarg("expected sci, port, or address", *argv);
292 }
293
294 argv++; argc--;
295
296 if (sci_complete(s, p, a, port_only))
297 break;
298 }
299
300 if (!optional && !sci_complete(s, p, a, port_only))
301 return -1;
302
303 if (p && a)
304 sci->sci = make_sci(sci->abuf, sci->port);
305
306 *argvp = argv;
307 *argcp = argc;
308
309 return p || a || s;
310 }
311
312 static bool parse_rxsci(int *argcp, char ***argvp, struct rxsc_desc *rxsc,
313 struct sa_desc *rxsa)
314 {
315 struct sci sci = { 0 };
316
317 if (*argcp == 0 ||
318 get_sci_portaddr(&sci, argcp, argvp, false, false) < 0) {
319 fprintf(stderr, "expected sci\n");
320 ipmacsec_usage();
321 }
322
323 rxsc->sci = sci.sci;
324
325 return get_sa(argcp, argvp, &rxsa->an);
326 }
327
328 static int parse_rxsci_args(int *argcp, char ***argvp, struct rxsc_desc *rxsc)
329 {
330 int argc = *argcp;
331 char **argv = *argvp;
332 bool active_set = false;
333
334 while (argc > 0) {
335 if (strcmp(*argv, "on") == 0) {
336 if (active_set)
337 duparg2("on/off", "on");
338 rxsc->active = true;
339 active_set = true;
340 } else if (strcmp(*argv, "off") == 0) {
341 if (active_set)
342 duparg2("on/off", "off");
343 rxsc->active = false;
344 active_set = true;
345 } else {
346 fprintf(stderr, "macsec: unknown command \"%s\"?\n",
347 *argv);
348 ipmacsec_usage();
349 }
350
351 argv++; argc--;
352 }
353
354 *argvp = argv;
355 *argcp = argc;
356 return 0;
357 }
358
359 enum cmd {
360 CMD_ADD,
361 CMD_DEL,
362 CMD_UPD,
363 CMD_OFFLOAD,
364 __CMD_MAX
365 };
366
367 static const enum macsec_nl_commands macsec_commands[__CMD_MAX][2][2] = {
368 [CMD_ADD] = {
369 [0] = {-1, MACSEC_CMD_ADD_RXSC},
370 [1] = {MACSEC_CMD_ADD_TXSA, MACSEC_CMD_ADD_RXSA},
371 },
372 [CMD_UPD] = {
373 [0] = {-1, MACSEC_CMD_UPD_RXSC},
374 [1] = {MACSEC_CMD_UPD_TXSA, MACSEC_CMD_UPD_RXSA},
375 },
376 [CMD_DEL] = {
377 [0] = {-1, MACSEC_CMD_DEL_RXSC},
378 [1] = {MACSEC_CMD_DEL_TXSA, MACSEC_CMD_DEL_RXSA},
379 },
380 [CMD_OFFLOAD] = {
381 [0] = {-1, MACSEC_CMD_UPD_OFFLOAD },
382 },
383 };
384
385 static int do_modify_nl(enum cmd c, enum macsec_nl_commands cmd, int ifindex,
386 struct rxsc_desc *rxsc, struct sa_desc *sa)
387 {
388 struct rtattr *attr_sa;
389
390 MACSEC_GENL_REQ(req, MACSEC_BUFLEN, cmd, NLM_F_REQUEST);
391
392 addattr32(&req.n, MACSEC_BUFLEN, MACSEC_ATTR_IFINDEX, ifindex);
393 if (rxsc) {
394 struct rtattr *attr_rxsc;
395
396 attr_rxsc = addattr_nest(&req.n, MACSEC_BUFLEN,
397 MACSEC_ATTR_RXSC_CONFIG);
398 addattr64(&req.n, MACSEC_BUFLEN,
399 MACSEC_RXSC_ATTR_SCI, rxsc->sci);
400 if (c != CMD_DEL && rxsc->active != 0xff)
401 addattr8(&req.n, MACSEC_BUFLEN,
402 MACSEC_RXSC_ATTR_ACTIVE, rxsc->active);
403
404 addattr_nest_end(&req.n, attr_rxsc);
405 }
406
407 if (sa->an == 0xff)
408 goto talk;
409
410 attr_sa = addattr_nest(&req.n, MACSEC_BUFLEN, MACSEC_ATTR_SA_CONFIG);
411
412 addattr8(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_AN, sa->an);
413
414 if (c != CMD_DEL) {
415 if (sa->pn)
416 addattr32(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_PN,
417 sa->pn);
418
419 if (sa->key_len) {
420 addattr_l(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_KEYID,
421 sa->key_id, MACSEC_KEYID_LEN);
422 addattr_l(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_KEY,
423 sa->key, sa->key_len);
424 }
425
426 if (sa->active != 0xff) {
427 addattr8(&req.n, MACSEC_BUFLEN,
428 MACSEC_SA_ATTR_ACTIVE, sa->active);
429 }
430 }
431
432 addattr_nest_end(&req.n, attr_sa);
433
434 talk:
435 if (rtnl_talk(&genl_rth, &req.n, NULL) < 0)
436 return -2;
437
438 return 0;
439 }
440
441 static bool check_sa_args(enum cmd c, struct sa_desc *sa)
442 {
443 if (c == CMD_ADD) {
444 if (!sa->key_len) {
445 fprintf(stderr, "cannot create SA without key\n");
446 return -1;
447 }
448
449 if (sa->pn == 0) {
450 fprintf(stderr, "must specify a packet number != 0\n");
451 return -1;
452 }
453 } else if (c == CMD_UPD) {
454 if (sa->key_len) {
455 fprintf(stderr, "cannot change key on SA\n");
456 return -1;
457 }
458 }
459
460 return 0;
461 }
462
463 static int do_modify_txsa(enum cmd c, int argc, char **argv, int ifindex)
464 {
465 struct sa_desc txsa = {0};
466 enum macsec_nl_commands cmd;
467
468 txsa.an = 0xff;
469 txsa.active = 0xff;
470
471 if (argc == 0 || !get_sa(&argc, &argv, &txsa.an))
472 ipmacsec_usage();
473
474 if (c == CMD_DEL)
475 goto modify;
476
477 if (parse_sa_args(&argc, &argv, &txsa))
478 return -1;
479
480 if (check_sa_args(c, &txsa))
481 return -1;
482
483 modify:
484 cmd = macsec_commands[c][1][0];
485 return do_modify_nl(c, cmd, ifindex, NULL, &txsa);
486 }
487
488 static int do_modify_rxsci(enum cmd c, int argc, char **argv, int ifindex)
489 {
490 struct rxsc_desc rxsc = {0};
491 struct sa_desc rxsa = {0};
492 bool sa_set;
493 enum macsec_nl_commands cmd;
494
495 rxsc.ifindex = ifindex;
496 rxsc.active = 0xff;
497 rxsa.an = 0xff;
498 rxsa.active = 0xff;
499
500 sa_set = parse_rxsci(&argc, &argv, &rxsc, &rxsa);
501
502 if (c == CMD_DEL)
503 goto modify;
504
505 if (sa_set && (parse_sa_args(&argc, &argv, &rxsa) ||
506 check_sa_args(c, &rxsa)))
507 return -1;
508 if (!sa_set && parse_rxsci_args(&argc, &argv, &rxsc))
509 return -1;
510
511 modify:
512 cmd = macsec_commands[c][sa_set][1];
513 return do_modify_nl(c, cmd, rxsc.ifindex, &rxsc, &rxsa);
514 }
515
516 static int do_modify(enum cmd c, int argc, char **argv)
517 {
518 int ifindex;
519
520 if (argc == 0)
521 ipmacsec_usage();
522
523 ifindex = ll_name_to_index(*argv);
524 if (!ifindex) {
525 fprintf(stderr, "Device \"%s\" does not exist.\n", *argv);
526 return -1;
527 }
528 argc--; argv++;
529
530 if (argc == 0)
531 ipmacsec_usage();
532
533 if (strcmp(*argv, "tx") == 0)
534 return do_modify_txsa(c, argc-1, argv+1, ifindex);
535 if (strcmp(*argv, "rx") == 0)
536 return do_modify_rxsci(c, argc-1, argv+1, ifindex);
537
538 ipmacsec_usage();
539 return -1;
540 }
541
542 static int do_offload(enum cmd c, int argc, char **argv)
543 {
544 enum macsec_offload offload;
545 struct rtattr *attr;
546 int ifindex, ret;
547
548 if (argc == 0)
549 ipmacsec_usage();
550
551 ifindex = ll_name_to_index(*argv);
552 if (!ifindex) {
553 fprintf(stderr, "Device \"%s\" does not exist.\n", *argv);
554 return -1;
555 }
556 argc--; argv++;
557
558 if (argc == 0)
559 ipmacsec_usage();
560
561 ret = one_of("offload", *argv, offload_str, ARRAY_SIZE(offload_str),
562 (int *)&offload);
563 if (ret)
564 ipmacsec_usage();
565
566 MACSEC_GENL_REQ(req, MACSEC_BUFLEN, macsec_commands[c][0][1], NLM_F_REQUEST);
567
568 addattr32(&req.n, MACSEC_BUFLEN, MACSEC_ATTR_IFINDEX, ifindex);
569
570 attr = addattr_nest(&req.n, MACSEC_BUFLEN, MACSEC_ATTR_OFFLOAD);
571 addattr8(&req.n, MACSEC_BUFLEN, MACSEC_OFFLOAD_ATTR_TYPE, offload);
572 addattr_nest_end(&req.n, attr);
573
574 if (rtnl_talk(&genl_rth, &req.n, NULL) < 0)
575 return -2;
576
577 return 0;
578 }
579
580 /* dump/show */
581 static struct {
582 int ifindex;
583 __u64 sci;
584 } filter;
585
586 static int validate_dump(struct rtattr **attrs)
587 {
588 return attrs[MACSEC_ATTR_IFINDEX] && attrs[MACSEC_ATTR_SECY] &&
589 attrs[MACSEC_ATTR_TXSA_LIST] && attrs[MACSEC_ATTR_RXSC_LIST] &&
590 attrs[MACSEC_ATTR_TXSC_STATS] && attrs[MACSEC_ATTR_SECY_STATS];
591
592 }
593
594 static int validate_secy_dump(struct rtattr **attrs)
595 {
596 return attrs[MACSEC_SECY_ATTR_SCI] &&
597 attrs[MACSEC_SECY_ATTR_ENCODING_SA] &&
598 attrs[MACSEC_SECY_ATTR_CIPHER_SUITE] &&
599 attrs[MACSEC_SECY_ATTR_ICV_LEN] &&
600 attrs[MACSEC_SECY_ATTR_PROTECT] &&
601 attrs[MACSEC_SECY_ATTR_REPLAY] &&
602 attrs[MACSEC_SECY_ATTR_OPER] &&
603 attrs[MACSEC_SECY_ATTR_VALIDATE] &&
604 attrs[MACSEC_SECY_ATTR_ENCRYPT] &&
605 attrs[MACSEC_SECY_ATTR_INC_SCI] &&
606 attrs[MACSEC_SECY_ATTR_ES] &&
607 attrs[MACSEC_SECY_ATTR_SCB];
608 }
609
610 static void print_flag(struct rtattr *attrs[], const char *desc,
611 int field)
612 {
613 __u8 flag;
614
615 if (!attrs[field])
616 return;
617
618 flag = rta_getattr_u8(attrs[field]);
619 if (is_json_context())
620 print_bool(PRINT_JSON, desc, NULL, flag);
621 else {
622 print_string(PRINT_FP, NULL, "%s ", desc);
623 print_string(PRINT_FP, NULL, "%s ",
624 flag ? "on" : "off");
625 }
626 }
627
628 static void print_key(struct rtattr *key)
629 {
630 SPRINT_BUF(keyid);
631
632 print_string(PRINT_ANY, "key", " key %s\n",
633 hexstring_n2a(RTA_DATA(key), RTA_PAYLOAD(key),
634 keyid, sizeof(keyid)));
635 }
636
637 #define CIPHER_NAME_GCM_AES_128 "GCM-AES-128"
638 #define CIPHER_NAME_GCM_AES_256 "GCM-AES-256"
639 #define DEFAULT_CIPHER_NAME CIPHER_NAME_GCM_AES_128
640
641 static const char *cs_id_to_name(__u64 cid)
642 {
643 switch (cid) {
644 case MACSEC_DEFAULT_CIPHER_ID:
645 return DEFAULT_CIPHER_NAME;
646 case MACSEC_CIPHER_ID_GCM_AES_128:
647 /* MACSEC_DEFAULT_CIPHER_ALT: */
648 return CIPHER_NAME_GCM_AES_128;
649 case MACSEC_CIPHER_ID_GCM_AES_256:
650 return CIPHER_NAME_GCM_AES_256;
651 default:
652 return "(unknown)";
653 }
654 }
655
656 static const char *validate_to_str(__u8 validate)
657 {
658 if (validate >= ARRAY_SIZE(validate_str))
659 return "(unknown)";
660
661 return validate_str[validate];
662 }
663
664 static const char *offload_to_str(__u8 offload)
665 {
666 if (offload >= ARRAY_SIZE(offload_str))
667 return "(unknown)";
668
669 return offload_str[offload];
670 }
671
672 static void print_attrs(struct rtattr *attrs[])
673 {
674 print_flag(attrs, "protect", MACSEC_SECY_ATTR_PROTECT);
675
676 if (attrs[MACSEC_SECY_ATTR_VALIDATE]) {
677 __u8 val = rta_getattr_u8(attrs[MACSEC_SECY_ATTR_VALIDATE]);
678
679 print_string(PRINT_ANY, "validate",
680 "validate %s ", validate_to_str(val));
681 }
682
683 print_flag(attrs, "sc", MACSEC_RXSC_ATTR_ACTIVE);
684 print_flag(attrs, "sa", MACSEC_SA_ATTR_ACTIVE);
685 print_flag(attrs, "encrypt", MACSEC_SECY_ATTR_ENCRYPT);
686 print_flag(attrs, "send_sci", MACSEC_SECY_ATTR_INC_SCI);
687 print_flag(attrs, "end_station", MACSEC_SECY_ATTR_ES);
688 print_flag(attrs, "scb", MACSEC_SECY_ATTR_SCB);
689 print_flag(attrs, "replay", MACSEC_SECY_ATTR_REPLAY);
690
691 if (attrs[MACSEC_SECY_ATTR_WINDOW]) {
692 __u32 win = rta_getattr_u32(attrs[MACSEC_SECY_ATTR_WINDOW]);
693
694 print_uint(PRINT_ANY, "window", "window %u ", win);
695 }
696
697 if (attrs[MACSEC_SECY_ATTR_CIPHER_SUITE]) {
698 __u64 cid = rta_getattr_u64(attrs[MACSEC_SECY_ATTR_CIPHER_SUITE]);
699
700 print_nl();
701 print_string(PRINT_ANY, "cipher_suite",
702 " cipher suite: %s,", cs_id_to_name(cid));
703 }
704
705 if (attrs[MACSEC_SECY_ATTR_ICV_LEN]) {
706 __u8 icv_len = rta_getattr_u8(attrs[MACSEC_SECY_ATTR_ICV_LEN]);
707
708 print_uint(PRINT_ANY, "icv_length",
709 " using ICV length %u\n", icv_len);
710 }
711 }
712
713 static __u64 getattr_u64(const struct rtattr *stat)
714 {
715 size_t len = RTA_PAYLOAD(stat);
716
717 switch (len) {
718 case sizeof(__u64):
719 return rta_getattr_u64(stat);
720 case sizeof(__u32):
721 return rta_getattr_u32(stat);
722 case sizeof(__u16):
723 return rta_getattr_u16(stat);
724 case sizeof(__u8):
725 return rta_getattr_u8(stat);
726 default:
727 fprintf(stderr, "invalid attribute length %zu\n",
728 len);
729 exit(-1);
730 }
731 }
732
733 static void print_fp_stats(const char *prefix,
734 const char *names[], unsigned int num,
735 struct rtattr *stats[])
736 {
737 unsigned int i;
738 int pad;
739
740 printf("%sstats:", prefix);
741
742 for (i = 1; i < num; i++) {
743 if (!names[i])
744 continue;
745 printf(" %s", names[i]);
746 }
747
748 printf("\n%s ", prefix);
749
750 for (i = 1; i < num; i++) {
751 if (!names[i])
752 continue;
753
754 pad = strlen(names[i]) + 1;
755 if (stats[i])
756 printf("%*llu", pad, getattr_u64(stats[i]));
757 else
758 printf("%*c", pad, '-');
759 }
760 printf("\n");
761 }
762
763 static void print_json_stats(const char *names[], unsigned int num,
764 struct rtattr *stats[])
765 {
766 unsigned int i;
767
768 for (i = 1; i < num; i++) {
769 if (!names[i] || !stats[i])
770 continue;
771
772 print_u64(PRINT_JSON, names[i],
773 NULL, getattr_u64(stats[i]));
774 }
775 }
776
777 static void print_stats(const char *prefix,
778 const char *names[], unsigned int num,
779 struct rtattr *stats[])
780 {
781
782 if (is_json_context())
783 print_json_stats(names, num, stats);
784 else
785 print_fp_stats(prefix, names, num, stats);
786 }
787
788 static const char *txsc_stats_names[NUM_MACSEC_TXSC_STATS_ATTR] = {
789 [MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED] = "OutPktsProtected",
790 [MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED] = "OutPktsEncrypted",
791 [MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED] = "OutOctetsProtected",
792 [MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED] = "OutOctetsEncrypted",
793 };
794
795 static void print_txsc_stats(const char *prefix, struct rtattr *attr)
796 {
797 struct rtattr *stats[MACSEC_TXSC_STATS_ATTR_MAX + 1];
798
799 if (!attr || show_stats == 0)
800 return;
801
802 parse_rtattr_nested(stats, MACSEC_TXSC_STATS_ATTR_MAX, attr);
803
804 print_stats(prefix, txsc_stats_names, NUM_MACSEC_TXSC_STATS_ATTR,
805 stats);
806 }
807
808 static const char *secy_stats_names[NUM_MACSEC_SECY_STATS_ATTR] = {
809 [MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED] = "OutPktsUntagged",
810 [MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED] = "InPktsUntagged",
811 [MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG] = "OutPktsTooLong",
812 [MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG] = "InPktsNoTag",
813 [MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG] = "InPktsBadTag",
814 [MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI] = "InPktsUnknownSCI",
815 [MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI] = "InPktsNoSCI",
816 [MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN] = "InPktsOverrun",
817 };
818
819 static void print_secy_stats(const char *prefix, struct rtattr *attr)
820 {
821 struct rtattr *stats[MACSEC_SECY_STATS_ATTR_MAX + 1];
822
823 if (!attr || show_stats == 0)
824 return;
825
826 parse_rtattr_nested(stats, MACSEC_SECY_STATS_ATTR_MAX, attr);
827
828 print_stats(prefix, secy_stats_names,
829 NUM_MACSEC_SECY_STATS_ATTR, stats);
830 }
831
832 static const char *rxsa_stats_names[NUM_MACSEC_SA_STATS_ATTR] = {
833 [MACSEC_SA_STATS_ATTR_IN_PKTS_OK] = "InPktsOK",
834 [MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID] = "InPktsInvalid",
835 [MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID] = "InPktsNotValid",
836 [MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA] = "InPktsNotUsingSA",
837 [MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA] = "InPktsUnusedSA",
838 };
839
840 static void print_rxsa_stats(const char *prefix, struct rtattr *attr)
841 {
842 struct rtattr *stats[MACSEC_SA_STATS_ATTR_MAX + 1];
843
844 if (!attr || show_stats == 0)
845 return;
846
847 parse_rtattr_nested(stats, MACSEC_SA_STATS_ATTR_MAX, attr);
848
849 print_stats(prefix, rxsa_stats_names, NUM_MACSEC_SA_STATS_ATTR, stats);
850 }
851
852 static const char *txsa_stats_names[NUM_MACSEC_SA_STATS_ATTR] = {
853 [MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED] = "OutPktsProtected",
854 [MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED] = "OutPktsEncrypted",
855 };
856
857 static void print_txsa_stats(const char *prefix, struct rtattr *attr)
858 {
859 struct rtattr *stats[MACSEC_SA_STATS_ATTR_MAX + 1];
860
861 if (!attr || show_stats == 0)
862 return;
863
864 parse_rtattr_nested(stats, MACSEC_SA_STATS_ATTR_MAX, attr);
865
866 print_stats(prefix, txsa_stats_names, NUM_MACSEC_SA_STATS_ATTR, stats);
867 }
868
869 static void print_tx_sc(const char *prefix, __u64 sci, __u8 encoding_sa,
870 struct rtattr *txsc_stats, struct rtattr *secy_stats,
871 struct rtattr *sa)
872 {
873 struct rtattr *sa_attr[MACSEC_SA_ATTR_MAX + 1];
874 struct rtattr *a;
875 int rem;
876
877 print_string(PRINT_FP, NULL, "%s", prefix);
878 print_0xhex(PRINT_ANY, "sci",
879 "TXSC: %016llx", ntohll(sci));
880 print_uint(PRINT_ANY, "encoding_sa",
881 " on SA %d\n", encoding_sa);
882
883 print_secy_stats(prefix, secy_stats);
884 print_txsc_stats(prefix, txsc_stats);
885
886 open_json_array(PRINT_JSON, "sa_list");
887 rem = RTA_PAYLOAD(sa);
888 for (a = RTA_DATA(sa); RTA_OK(a, rem); a = RTA_NEXT(a, rem)) {
889 bool state;
890
891 open_json_object(NULL);
892 parse_rtattr_nested(sa_attr, MACSEC_SA_ATTR_MAX, a);
893 state = rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_ACTIVE]);
894
895 print_string(PRINT_FP, NULL, "%s", prefix);
896 print_string(PRINT_FP, NULL, "%s", prefix);
897 print_uint(PRINT_ANY, "an", "%d:",
898 rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_AN]));
899 print_uint(PRINT_ANY, "pn", " PN %u,",
900 rta_getattr_u32(sa_attr[MACSEC_SA_ATTR_PN]));
901
902 print_bool(PRINT_JSON, "active", NULL, state);
903 print_string(PRINT_FP, NULL,
904 " state %s,", state ? "on" : "off");
905 print_key(sa_attr[MACSEC_SA_ATTR_KEYID]);
906
907 print_txsa_stats(prefix, sa_attr[MACSEC_SA_ATTR_STATS]);
908 close_json_object();
909 }
910 close_json_array(PRINT_JSON, NULL);
911 }
912
913 static const char *rxsc_stats_names[NUM_MACSEC_RXSC_STATS_ATTR] = {
914 [MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED] = "InOctetsValidated",
915 [MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED] = "InOctetsDecrypted",
916 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED] = "InPktsUnchecked",
917 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED] = "InPktsDelayed",
918 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK] = "InPktsOK",
919 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID] = "InPktsInvalid",
920 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE] = "InPktsLate",
921 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID] = "InPktsNotValid",
922 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA] = "InPktsNotUsingSA",
923 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA] = "InPktsUnusedSA",
924 };
925
926 static void print_rxsc_stats(const char *prefix, struct rtattr *attr)
927 {
928 struct rtattr *stats[MACSEC_RXSC_STATS_ATTR_MAX + 1];
929
930 if (!attr || show_stats == 0)
931 return;
932
933 parse_rtattr_nested(stats, MACSEC_RXSC_STATS_ATTR_MAX, attr);
934
935 print_stats(prefix, rxsc_stats_names,
936 NUM_MACSEC_RXSC_STATS_ATTR, stats);
937 }
938
939 static void print_rx_sc(const char *prefix, __be64 sci, __u8 active,
940 struct rtattr *rxsc_stats, struct rtattr *sa)
941 {
942 struct rtattr *sa_attr[MACSEC_SA_ATTR_MAX + 1];
943 struct rtattr *a;
944 int rem;
945
946 print_string(PRINT_FP, NULL, "%s", prefix);
947 print_0xhex(PRINT_ANY, "sci",
948 "RXSC: %016llx,", ntohll(sci));
949 print_bool(PRINT_JSON, "active", NULL, active);
950 print_string(PRINT_FP, NULL,
951 " state %s\n", active ? "on" : "off");
952 print_rxsc_stats(prefix, rxsc_stats);
953
954 open_json_array(PRINT_JSON, "sa_list");
955 rem = RTA_PAYLOAD(sa);
956 for (a = RTA_DATA(sa); RTA_OK(a, rem); a = RTA_NEXT(a, rem)) {
957 bool state;
958
959 open_json_object(NULL);
960 parse_rtattr_nested(sa_attr, MACSEC_SA_ATTR_MAX, a);
961 state = rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_ACTIVE]);
962
963 print_string(PRINT_FP, NULL, "%s", prefix);
964 print_string(PRINT_FP, NULL, "%s", prefix);
965 print_uint(PRINT_ANY, "an", "%u:",
966 rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_AN]));
967 print_uint(PRINT_ANY, "pn", " PN %u,",
968 rta_getattr_u32(sa_attr[MACSEC_SA_ATTR_PN]));
969
970 print_bool(PRINT_JSON, "active", NULL, state);
971 print_string(PRINT_FP, NULL, " state %s,",
972 state ? "on" : "off");
973
974 print_key(sa_attr[MACSEC_SA_ATTR_KEYID]);
975
976 print_rxsa_stats(prefix, sa_attr[MACSEC_SA_ATTR_STATS]);
977 close_json_object();
978 }
979 close_json_array(PRINT_JSON, NULL);
980 }
981
982 static void print_rxsc_list(struct rtattr *sc)
983 {
984 int rem = RTA_PAYLOAD(sc);
985 struct rtattr *c;
986
987 open_json_array(PRINT_JSON, "rx_sc");
988 for (c = RTA_DATA(sc); RTA_OK(c, rem); c = RTA_NEXT(c, rem)) {
989 struct rtattr *sc_attr[MACSEC_RXSC_ATTR_MAX + 1];
990
991 open_json_object(NULL);
992
993 parse_rtattr_nested(sc_attr, MACSEC_RXSC_ATTR_MAX, c);
994 print_rx_sc(" ",
995 rta_getattr_u64(sc_attr[MACSEC_RXSC_ATTR_SCI]),
996 rta_getattr_u32(sc_attr[MACSEC_RXSC_ATTR_ACTIVE]),
997 sc_attr[MACSEC_RXSC_ATTR_STATS],
998 sc_attr[MACSEC_RXSC_ATTR_SA_LIST]);
999 close_json_object();
1000 }
1001 close_json_array(PRINT_JSON, NULL);
1002 }
1003
1004 static int process(struct nlmsghdr *n, void *arg)
1005 {
1006 struct genlmsghdr *ghdr;
1007 struct rtattr *attrs[MACSEC_ATTR_MAX + 1];
1008 struct rtattr *attrs_secy[MACSEC_SECY_ATTR_MAX + 1];
1009 int len = n->nlmsg_len;
1010 int ifindex;
1011 __u64 sci;
1012 __u8 encoding_sa;
1013
1014 if (n->nlmsg_type != genl_family)
1015 return -1;
1016
1017 len -= NLMSG_LENGTH(GENL_HDRLEN);
1018 if (len < 0)
1019 return -1;
1020
1021 ghdr = NLMSG_DATA(n);
1022 if (ghdr->cmd != MACSEC_CMD_GET_TXSC)
1023 return 0;
1024
1025 parse_rtattr(attrs, MACSEC_ATTR_MAX, (void *) ghdr + GENL_HDRLEN, len);
1026 if (!validate_dump(attrs)) {
1027 fprintf(stderr, "incomplete dump message\n");
1028 return -1;
1029 }
1030
1031 ifindex = rta_getattr_u32(attrs[MACSEC_ATTR_IFINDEX]);
1032 parse_rtattr_nested(attrs_secy, MACSEC_SECY_ATTR_MAX,
1033 attrs[MACSEC_ATTR_SECY]);
1034
1035 if (!validate_secy_dump(attrs_secy)) {
1036 fprintf(stderr, "incomplete dump message\n");
1037 return -1;
1038 }
1039
1040 sci = rta_getattr_u64(attrs_secy[MACSEC_SECY_ATTR_SCI]);
1041 encoding_sa = rta_getattr_u8(attrs_secy[MACSEC_SECY_ATTR_ENCODING_SA]);
1042
1043 if (filter.ifindex && ifindex != filter.ifindex)
1044 return 0;
1045
1046 if (filter.sci && sci != filter.sci)
1047 return 0;
1048
1049 open_json_object(NULL);
1050 print_uint(PRINT_ANY, "ifindex", "%u: ", ifindex);
1051 print_color_string(PRINT_ANY, COLOR_IFNAME, "ifname",
1052 "%s: ", ll_index_to_name(ifindex));
1053
1054 print_attrs(attrs_secy);
1055
1056 print_tx_sc(" ", sci, encoding_sa,
1057 attrs[MACSEC_ATTR_TXSC_STATS],
1058 attrs[MACSEC_ATTR_SECY_STATS],
1059 attrs[MACSEC_ATTR_TXSA_LIST]);
1060
1061 if (attrs[MACSEC_ATTR_RXSC_LIST])
1062 print_rxsc_list(attrs[MACSEC_ATTR_RXSC_LIST]);
1063
1064 if (attrs[MACSEC_ATTR_OFFLOAD]) {
1065 struct rtattr *attrs_offload[MACSEC_OFFLOAD_ATTR_MAX + 1];
1066 __u8 offload;
1067
1068 parse_rtattr_nested(attrs_offload, MACSEC_OFFLOAD_ATTR_MAX,
1069 attrs[MACSEC_ATTR_OFFLOAD]);
1070
1071 offload = rta_getattr_u8(attrs_offload[MACSEC_OFFLOAD_ATTR_TYPE]);
1072 print_string(PRINT_ANY, "offload",
1073 " offload: %s ", offload_to_str(offload));
1074 print_nl();
1075 }
1076
1077 close_json_object();
1078
1079 return 0;
1080 }
1081
1082 static int do_dump(int ifindex)
1083 {
1084 MACSEC_GENL_REQ(req, MACSEC_BUFLEN, MACSEC_CMD_GET_TXSC,
1085 NLM_F_REQUEST | NLM_F_DUMP);
1086
1087 memset(&filter, 0, sizeof(filter));
1088 filter.ifindex = ifindex;
1089
1090 req.n.nlmsg_seq = genl_rth.dump = ++genl_rth.seq;
1091 if (rtnl_send(&genl_rth, &req, req.n.nlmsg_len) < 0) {
1092 perror("Failed to send dump request");
1093 exit(1);
1094 }
1095
1096 new_json_obj(json);
1097 if (rtnl_dump_filter(&genl_rth, process, stdout) < 0) {
1098 delete_json_obj();
1099 fprintf(stderr, "Dump terminated\n");
1100 exit(1);
1101 }
1102 delete_json_obj();
1103
1104 return 0;
1105 }
1106
1107 static int do_show(int argc, char **argv)
1108 {
1109 int ifindex;
1110
1111 if (argc == 0)
1112 return do_dump(0);
1113
1114 ifindex = ll_name_to_index(*argv);
1115 if (ifindex == 0) {
1116 fprintf(stderr, "Device \"%s\" does not exist.\n", *argv);
1117 return -1;
1118 }
1119
1120 argc--, argv++;
1121 if (argc == 0)
1122 return do_dump(ifindex);
1123
1124 ipmacsec_usage();
1125 return -1;
1126 }
1127
1128 int do_ipmacsec(int argc, char **argv)
1129 {
1130 if (argc < 1)
1131 ipmacsec_usage();
1132
1133 if (matches(*argv, "help") == 0)
1134 ipmacsec_usage();
1135
1136 if (genl_init_handle(&genl_rth, MACSEC_GENL_NAME, &genl_family))
1137 exit(1);
1138
1139 if (matches(*argv, "show") == 0)
1140 return do_show(argc-1, argv+1);
1141
1142 if (matches(*argv, "add") == 0)
1143 return do_modify(CMD_ADD, argc-1, argv+1);
1144 if (matches(*argv, "set") == 0)
1145 return do_modify(CMD_UPD, argc-1, argv+1);
1146 if (matches(*argv, "delete") == 0)
1147 return do_modify(CMD_DEL, argc-1, argv+1);
1148 if (matches(*argv, "offload") == 0)
1149 return do_offload(CMD_OFFLOAD, argc-1, argv+1);
1150
1151 fprintf(stderr, "Command \"%s\" is unknown, try \"ip macsec help\".\n",
1152 *argv);
1153 exit(-1);
1154 }
1155
1156 /* device creation */
1157 static void macsec_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
1158 {
1159 if (!tb)
1160 return;
1161
1162 if (tb[IFLA_MACSEC_SCI]) {
1163 if (is_json_context()) {
1164 SPRINT_BUF(b1);
1165
1166 snprintf(b1, sizeof(b1), "%016llx",
1167 ntohll(rta_getattr_u64(tb[IFLA_MACSEC_SCI])));
1168 print_string(PRINT_JSON, "sci", NULL, b1);
1169 } else {
1170 fprintf(f, "sci %016llx ",
1171 ntohll(rta_getattr_u64(tb[IFLA_MACSEC_SCI])));
1172 }
1173 }
1174
1175 print_flag(tb, "protect", IFLA_MACSEC_PROTECT);
1176
1177 if (tb[IFLA_MACSEC_CIPHER_SUITE]) {
1178 __u64 csid
1179 = rta_getattr_u64(tb[IFLA_MACSEC_CIPHER_SUITE]);
1180
1181 print_string(PRINT_ANY,
1182 "cipher_suite",
1183 "cipher %s ",
1184 cs_id_to_name(csid));
1185 }
1186
1187 if (tb[IFLA_MACSEC_ICV_LEN]) {
1188 if (is_json_context()) {
1189 char b2[4];
1190
1191 snprintf(b2, sizeof(b2), "%hhu",
1192 rta_getattr_u8(tb[IFLA_MACSEC_ICV_LEN]));
1193 print_uint(PRINT_JSON, "icv_len", NULL, atoi(b2));
1194 } else {
1195 fprintf(f, "icvlen %hhu ",
1196 rta_getattr_u8(tb[IFLA_MACSEC_ICV_LEN]));
1197 }
1198 }
1199
1200 if (tb[IFLA_MACSEC_ENCODING_SA]) {
1201 if (is_json_context()) {
1202 char b2[4];
1203
1204 snprintf(b2, sizeof(b2), "%hhu",
1205 rta_getattr_u8(tb[IFLA_MACSEC_ENCODING_SA]));
1206 print_uint(PRINT_JSON, "encoding_sa", NULL, atoi(b2));
1207 } else {
1208 fprintf(f, "encodingsa %hhu ",
1209 rta_getattr_u8(tb[IFLA_MACSEC_ENCODING_SA]));
1210 }
1211 }
1212
1213 if (tb[IFLA_MACSEC_VALIDATION]) {
1214 __u8 val = rta_getattr_u8(tb[IFLA_MACSEC_VALIDATION]);
1215
1216 print_string(PRINT_ANY,
1217 "validation",
1218 "validate %s ",
1219 validate_to_str(val));
1220 }
1221
1222 const char *inc_sci, *es, *replay;
1223
1224 if (is_json_context()) {
1225 inc_sci = "inc_sci";
1226 replay = "replay_protect";
1227 es = "es";
1228 } else {
1229 inc_sci = "send_sci";
1230 es = "end_station";
1231 replay = "replay";
1232 }
1233
1234 print_flag(tb, "encrypt", IFLA_MACSEC_ENCRYPT);
1235 print_flag(tb, inc_sci, IFLA_MACSEC_INC_SCI);
1236 print_flag(tb, es, IFLA_MACSEC_ES);
1237 print_flag(tb, "scb", IFLA_MACSEC_SCB);
1238 print_flag(tb, replay, IFLA_MACSEC_REPLAY_PROTECT);
1239
1240 if (tb[IFLA_MACSEC_WINDOW])
1241 print_int(PRINT_ANY,
1242 "window",
1243 "window %d ",
1244 rta_getattr_u32(tb[IFLA_MACSEC_WINDOW]));
1245 }
1246
1247 static bool check_txsc_flags(bool es, bool scb, bool sci)
1248 {
1249 if (sci && (es || scb))
1250 return false;
1251 if (es && scb)
1252 return false;
1253 return true;
1254 }
1255
1256 static void usage(FILE *f)
1257 {
1258 fprintf(f,
1259 "Usage: ... macsec [ [ address <lladdr> ] port { 1..2^16-1 } | sci <u64> ]\n"
1260 " [ cipher { default | gcm-aes-128 | gcm-aes-256 } ]\n"
1261 " [ icvlen { 8..16 } ]\n"
1262 " [ encrypt { on | off } ]\n"
1263 " [ send_sci { on | off } ]\n"
1264 " [ end_station { on | off } ]\n"
1265 " [ scb { on | off } ]\n"
1266 " [ protect { on | off } ]\n"
1267 " [ replay { on | off} window { 0..2^32-1 } ]\n"
1268 " [ validate { strict | check | disabled } ]\n"
1269 " [ encodingsa { 0..3 } ]\n"
1270 );
1271 }
1272
1273 static int macsec_parse_opt(struct link_util *lu, int argc, char **argv,
1274 struct nlmsghdr *n)
1275 {
1276 int ret;
1277 __u8 encoding_sa = 0xff;
1278 __u32 window = -1;
1279 struct cipher_args cipher = {0};
1280 enum macsec_validation_type validate;
1281 bool es = false, scb = false, send_sci = false;
1282 int replay_protect = -1;
1283 struct sci sci = { 0 };
1284
1285 ret = get_sci_portaddr(&sci, &argc, &argv, true, true);
1286 if (ret < 0) {
1287 fprintf(stderr, "expected sci\n");
1288 return -1;
1289 }
1290
1291 if (ret > 0) {
1292 if (sci.sci)
1293 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_SCI,
1294 &sci.sci, sizeof(sci.sci));
1295 else
1296 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_PORT,
1297 &sci.port, sizeof(sci.port));
1298 }
1299
1300 while (argc > 0) {
1301 if (strcmp(*argv, "cipher") == 0) {
1302 NEXT_ARG();
1303 if (cipher.id)
1304 duparg("cipher", *argv);
1305 if (strcmp(*argv, "default") == 0)
1306 cipher.id = MACSEC_DEFAULT_CIPHER_ID;
1307 else if (strcmp(*argv, "gcm-aes-128") == 0 ||
1308 strcmp(*argv, "GCM-AES-128") == 0)
1309 cipher.id = MACSEC_CIPHER_ID_GCM_AES_128;
1310 else if (strcmp(*argv, "gcm-aes-256") == 0 ||
1311 strcmp(*argv, "GCM-AES-256") == 0)
1312 cipher.id = MACSEC_CIPHER_ID_GCM_AES_256;
1313 else
1314 invarg("expected: default, gcm-aes-128 or"
1315 " gcm-aes-256", *argv);
1316 } else if (strcmp(*argv, "icvlen") == 0) {
1317 NEXT_ARG();
1318 if (cipher.icv_len)
1319 duparg("icvlen", *argv);
1320 get_icvlen(&cipher.icv_len, *argv);
1321 } else if (strcmp(*argv, "encrypt") == 0) {
1322 NEXT_ARG();
1323 int i;
1324
1325 ret = one_of("encrypt", *argv, values_on_off,
1326 ARRAY_SIZE(values_on_off), &i);
1327 if (ret != 0)
1328 return ret;
1329 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_ENCRYPT, i);
1330 } else if (strcmp(*argv, "send_sci") == 0) {
1331 NEXT_ARG();
1332 int i;
1333
1334 ret = one_of("send_sci", *argv, values_on_off,
1335 ARRAY_SIZE(values_on_off), &i);
1336 if (ret != 0)
1337 return ret;
1338 send_sci = i;
1339 addattr8(n, MACSEC_BUFLEN,
1340 IFLA_MACSEC_INC_SCI, send_sci);
1341 } else if (strcmp(*argv, "end_station") == 0) {
1342 NEXT_ARG();
1343 int i;
1344
1345 ret = one_of("end_station", *argv, values_on_off,
1346 ARRAY_SIZE(values_on_off), &i);
1347 if (ret != 0)
1348 return ret;
1349 es = i;
1350 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_ES, es);
1351 } else if (strcmp(*argv, "scb") == 0) {
1352 NEXT_ARG();
1353 int i;
1354
1355 ret = one_of("scb", *argv, values_on_off,
1356 ARRAY_SIZE(values_on_off), &i);
1357 if (ret != 0)
1358 return ret;
1359 scb = i;
1360 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_SCB, scb);
1361 } else if (strcmp(*argv, "protect") == 0) {
1362 NEXT_ARG();
1363 int i;
1364
1365 ret = one_of("protect", *argv, values_on_off,
1366 ARRAY_SIZE(values_on_off), &i);
1367 if (ret != 0)
1368 return ret;
1369 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_PROTECT, i);
1370 } else if (strcmp(*argv, "replay") == 0) {
1371 NEXT_ARG();
1372 int i;
1373
1374 ret = one_of("replay", *argv, values_on_off,
1375 ARRAY_SIZE(values_on_off), &i);
1376 if (ret != 0)
1377 return ret;
1378 replay_protect = !!i;
1379 } else if (strcmp(*argv, "window") == 0) {
1380 NEXT_ARG();
1381 ret = get_u32(&window, *argv, 0);
1382 if (ret)
1383 invarg("expected replay window size", *argv);
1384 } else if (strcmp(*argv, "validate") == 0) {
1385 NEXT_ARG();
1386 ret = one_of("validate", *argv,
1387 validate_str, ARRAY_SIZE(validate_str),
1388 (int *)&validate);
1389 if (ret != 0)
1390 return ret;
1391 addattr8(n, MACSEC_BUFLEN,
1392 IFLA_MACSEC_VALIDATION, validate);
1393 } else if (strcmp(*argv, "encodingsa") == 0) {
1394 if (encoding_sa != 0xff)
1395 duparg2("encodingsa", "encodingsa");
1396 NEXT_ARG();
1397 ret = get_an(&encoding_sa, *argv);
1398 if (ret)
1399 invarg("expected an { 0..3 }", *argv);
1400 } else {
1401 fprintf(stderr, "macsec: unknown command \"%s\"?\n",
1402 *argv);
1403 usage(stderr);
1404 return -1;
1405 }
1406
1407 argv++; argc--;
1408 }
1409
1410 if (!check_txsc_flags(es, scb, send_sci)) {
1411 fprintf(stderr,
1412 "invalid combination of send_sci/end_station/scb\n");
1413 return -1;
1414 }
1415
1416 if (window != -1 && replay_protect == -1) {
1417 fprintf(stderr,
1418 "replay window set, but replay protection not enabled. did you mean 'replay on window %u'?\n",
1419 window);
1420 return -1;
1421 } else if (window == -1 && replay_protect == 1) {
1422 fprintf(stderr,
1423 "replay protection enabled, but no window set. did you mean 'replay on window VALUE'?\n");
1424 return -1;
1425 }
1426
1427 if (cipher.id)
1428 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_CIPHER_SUITE,
1429 &cipher.id, sizeof(cipher.id));
1430 if (cipher.icv_len)
1431 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_ICV_LEN,
1432 &cipher.icv_len, sizeof(cipher.icv_len));
1433
1434 if (replay_protect != -1) {
1435 addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window);
1436 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_REPLAY_PROTECT,
1437 replay_protect);
1438 }
1439
1440 if (encoding_sa != 0xff) {
1441 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_ENCODING_SA,
1442 &encoding_sa, sizeof(encoding_sa));
1443 }
1444
1445 return 0;
1446 }
1447
1448 static void macsec_print_help(struct link_util *lu, int argc, char **argv,
1449 FILE *f)
1450 {
1451 usage(f);
1452 }
1453
1454 struct link_util macsec_link_util = {
1455 .id = "macsec",
1456 .maxattr = IFLA_MACSEC_MAX,
1457 .parse_opt = macsec_parse_opt,
1458 .print_help = macsec_print_help,
1459 .print_opt = macsec_print_opt,
1460 };
Upstream mirror of iproute2