2 * ipmacsec.c "ip macsec".
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version
7 * 2 of the License, or (at your option) any later version.
9 * Authors: Sabrina Dubroca <sd@queasysnail.net>
16 #include <linux/genetlink.h>
17 #include <linux/if_ether.h>
18 #include <linux/if_macsec.h>
22 #include "ip_common.h"
26 static const char *values_on_off
[] = { "off", "on" };
28 static const char *VALIDATE_STR
[] = {
29 [MACSEC_VALIDATE_DISABLED
] = "disabled",
30 [MACSEC_VALIDATE_CHECK
] = "check",
31 [MACSEC_VALIDATE_STRICT
] = "strict",
43 __u8 key_id
[MACSEC_KEYID_LEN
];
45 __u8 key
[MACSEC_MAX_KEY_LEN
];
58 struct cipher_args cipher
;
60 enum macsec_validation_type validate
;
70 #define MACSEC_BUFLEN 1024
74 static struct rtnl_handle genl_rth
;
75 static int genl_family
= -1;
77 #define MACSEC_GENL_REQ(_req, _bufsiz, _cmd, _flags) \
78 GENL_REQUEST(_req, _bufsiz, genl_family, 0, MACSEC_GENL_VERSION, \
82 static void init_genl(void)
87 if (rtnl_open_byproto(&genl_rth
, 0, NETLINK_GENERIC
) < 0) {
88 fprintf(stderr
, "Cannot open generic netlink socket\n");
92 genl_family
= genl_resolve_family(&genl_rth
, MACSEC_GENL_NAME
);
97 static void ipmacsec_usage(void)
99 fprintf(stderr
, "Usage: ip macsec add DEV tx sa { 0..3 } [ OPTS ] key ID KEY\n");
100 fprintf(stderr
, " ip macsec set DEV tx sa { 0..3 } [ OPTS ]\n");
101 fprintf(stderr
, " ip macsec del DEV tx sa { 0..3 }\n");
102 fprintf(stderr
, " ip macsec add DEV rx SCI [ on | off ]\n");
103 fprintf(stderr
, " ip macsec set DEV rx SCI [ on | off ]\n");
104 fprintf(stderr
, " ip macsec del DEV rx SCI\n");
105 fprintf(stderr
, " ip macsec add DEV rx SCI sa { 0..3 } [ OPTS ] key ID KEY\n");
106 fprintf(stderr
, " ip macsec set DEV rx SCI sa { 0..3 } [ OPTS ]\n");
107 fprintf(stderr
, " ip macsec del DEV rx SCI sa { 0..3 }\n");
108 fprintf(stderr
, " ip macsec show\n");
109 fprintf(stderr
, " ip macsec show DEV\n");
110 fprintf(stderr
, "where OPTS := [ pn <u32> ] [ on | off ]\n");
111 fprintf(stderr
, " ID := 128-bit hex string\n");
112 fprintf(stderr
, " KEY := 128-bit hex string\n");
113 fprintf(stderr
, " SCI := { sci <u64> | port <u16> address <lladdr> }\n");
118 static int one_of(const char *msg
, const char *realval
, const char **list
,
119 size_t len
, int *index
)
123 for (i
= 0; i
< len
; i
++) {
124 if (matches(realval
, list
[i
]) == 0) {
130 fprintf(stderr
, "Error: argument of \"%s\" must be one of ", msg
);
131 for (i
= 0; i
< len
; i
++)
132 fprintf(stderr
, "\"%s\", ", list
[i
]);
133 fprintf(stderr
, "not \"%s\"\n", realval
);
137 static int get_an(__u8
*val
, const char *arg
)
139 int ret
= get_u8(val
, arg
, 0);
150 static int get_sci(__u64
*sci
, const char *arg
)
152 return get_u64(sci
, arg
, 16);
155 static int get_port(__be16
*port
, const char *arg
)
157 return get_be16(port
, arg
, 10);
161 #define STR(a) _STR(a)
163 static void get_icvlen(__u8
*icvlen
, char *arg
)
165 int ret
= get_u8(icvlen
, arg
, 10);
168 invarg("expected ICV length", arg
);
170 if (*icvlen
< MACSEC_MIN_ICV_LEN
|| *icvlen
> MACSEC_MAX_ICV_LEN
)
171 invarg("ICV length must be in the range {"
172 STR(MACSEC_MIN_ICV_LEN
) ".." STR(MACSEC_MAX_ICV_LEN
)
176 static bool get_sa(int *argcp
, char ***argvp
, __u8
*an
)
179 char **argv
= *argvp
;
182 if (argc
<= 0 || strcmp(*argv
, "sa") != 0)
186 ret
= get_an(an
, *argv
);
188 invarg("expected an { 0..3 }", *argv
);
196 static int parse_sa_args(int *argcp
, char ***argvp
, struct sa_desc
*sa
)
199 char **argv
= *argvp
;
201 bool active_set
= false;
204 if (strcmp(*argv
, "pn") == 0) {
208 ret
= get_u32(&sa
->pn
, *argv
, 0);
210 invarg("expected pn", *argv
);
212 invarg("expected pn != 0", *argv
);
213 } else if (strcmp(*argv
, "key") == 0) {
217 if (!hexstring_a2n(*argv
, sa
->key_id
, MACSEC_KEYID_LEN
,
219 invarg("expected key id", *argv
);
221 if (!hexstring_a2n(*argv
, sa
->key
, MACSEC_MAX_KEY_LEN
,
223 invarg("expected key", *argv
);
224 } else if (strcmp(*argv
, "on") == 0) {
226 duparg2("on/off", "on");
229 } else if (strcmp(*argv
, "off") == 0) {
231 duparg2("on/off", "off");
235 fprintf(stderr
, "macsec: unknown command \"%s\"?\n",
248 static __u64
make_sci(char *addr
, __be16 port
)
252 memcpy(&sci
, addr
, ETH_ALEN
);
253 memcpy(((char *)&sci
) + ETH_ALEN
, &port
, sizeof(port
));
258 static bool sci_complete(bool sci
, bool port
, bool addr
, bool port_only
)
260 return sci
|| (port
&& (addr
|| port_only
));
263 static int get_sci_portaddr(struct sci
*sci
, int *argcp
, char ***argvp
,
264 bool port_only
, bool optional
)
267 char **argv
= *argvp
;
269 bool p
= false, a
= false, s
= false;
272 if (strcmp(*argv
, "sci") == 0) {
274 invarg("expected address", *argv
);
276 invarg("expected port", *argv
);
278 ret
= get_sci(&sci
->sci
, *argv
);
280 invarg("expected sci", *argv
);
282 } else if (strcmp(*argv
, "port") == 0) {
284 ret
= get_port(&sci
->port
, *argv
);
286 invarg("expected port", *argv
);
288 invarg("expected port != 0", *argv
);
290 } else if (strcmp(*argv
, "address") == 0) {
292 ret
= ll_addr_a2n(sci
->abuf
, sizeof(sci
->abuf
), *argv
);
294 invarg("expected lladdr", *argv
);
296 } else if (optional
) {
299 invarg("expected sci, port, or address", *argv
);
304 if (sci_complete(s
, p
, a
, port_only
))
308 if (!optional
&& !sci_complete(s
, p
, a
, port_only
))
312 sci
->sci
= make_sci(sci
->abuf
, sci
->port
);
320 static bool parse_rxsci(int *argcp
, char ***argvp
, struct rxsc_desc
*rxsc
,
321 struct sa_desc
*rxsa
)
323 struct sci sci
= { 0 };
326 get_sci_portaddr(&sci
, argcp
, argvp
, false, false) < 0) {
327 fprintf(stderr
, "expected sci\n");
333 return get_sa(argcp
, argvp
, &rxsa
->an
);
336 static int parse_rxsci_args(int *argcp
, char ***argvp
, struct rxsc_desc
*rxsc
)
339 char **argv
= *argvp
;
340 bool active_set
= false;
343 if (strcmp(*argv
, "on") == 0) {
345 duparg2("on/off", "on");
348 } else if (strcmp(*argv
, "off") == 0) {
350 duparg2("on/off", "off");
351 rxsc
->active
= false;
354 fprintf(stderr
, "macsec: unknown command \"%s\"?\n",
374 static const enum macsec_nl_commands macsec_commands
[__CMD_MAX
][2][2] = {
376 [0] = {-1, MACSEC_CMD_ADD_RXSC
},
377 [1] = {MACSEC_CMD_ADD_TXSA
, MACSEC_CMD_ADD_RXSA
},
380 [0] = {-1, MACSEC_CMD_UPD_RXSC
},
381 [1] = {MACSEC_CMD_UPD_TXSA
, MACSEC_CMD_UPD_RXSA
},
384 [0] = {-1, MACSEC_CMD_DEL_RXSC
},
385 [1] = {MACSEC_CMD_DEL_TXSA
, MACSEC_CMD_DEL_RXSA
},
389 static int do_modify_nl(enum cmd c
, enum macsec_nl_commands cmd
, int ifindex
,
390 struct rxsc_desc
*rxsc
, struct sa_desc
*sa
)
392 struct rtattr
*attr_sa
;
394 MACSEC_GENL_REQ(req
, MACSEC_BUFLEN
, cmd
, NLM_F_REQUEST
);
396 addattr32(&req
.n
, MACSEC_BUFLEN
, MACSEC_ATTR_IFINDEX
, ifindex
);
398 struct rtattr
*attr_rxsc
;
400 attr_rxsc
= addattr_nest(&req
.n
, MACSEC_BUFLEN
,
401 MACSEC_ATTR_RXSC_CONFIG
);
402 addattr64(&req
.n
, MACSEC_BUFLEN
,
403 MACSEC_RXSC_ATTR_SCI
, rxsc
->sci
);
404 if (c
!= CMD_DEL
&& rxsc
->active
!= 0xff)
405 addattr8(&req
.n
, MACSEC_BUFLEN
,
406 MACSEC_RXSC_ATTR_ACTIVE
, rxsc
->active
);
408 addattr_nest_end(&req
.n
, attr_rxsc
);
414 attr_sa
= addattr_nest(&req
.n
, MACSEC_BUFLEN
, MACSEC_ATTR_SA_CONFIG
);
416 addattr8(&req
.n
, MACSEC_BUFLEN
, MACSEC_SA_ATTR_AN
, sa
->an
);
420 addattr32(&req
.n
, MACSEC_BUFLEN
, MACSEC_SA_ATTR_PN
,
424 addattr_l(&req
.n
, MACSEC_BUFLEN
, MACSEC_SA_ATTR_KEYID
,
425 sa
->key_id
, MACSEC_KEYID_LEN
);
426 addattr_l(&req
.n
, MACSEC_BUFLEN
, MACSEC_SA_ATTR_KEY
,
427 sa
->key
, sa
->key_len
);
430 if (sa
->active
!= 0xff) {
431 addattr8(&req
.n
, MACSEC_BUFLEN
,
432 MACSEC_SA_ATTR_ACTIVE
, sa
->active
);
436 addattr_nest_end(&req
.n
, attr_sa
);
439 if (rtnl_talk(&genl_rth
, &req
.n
, NULL
, 0) < 0)
445 static bool check_sa_args(enum cmd c
, struct sa_desc
*sa
)
449 fprintf(stderr
, "cannot create SA without key\n");
454 fprintf(stderr
, "must specify a packet number != 0\n");
457 } else if (c
== CMD_UPD
) {
459 fprintf(stderr
, "cannot change key on SA\n");
467 static int do_modify_txsa(enum cmd c
, int argc
, char **argv
, int ifindex
)
469 struct sa_desc txsa
= {0};
470 enum macsec_nl_commands cmd
;
475 if (argc
== 0 || !get_sa(&argc
, &argv
, &txsa
.an
))
481 if (parse_sa_args(&argc
, &argv
, &txsa
))
484 if (check_sa_args(c
, &txsa
))
488 cmd
= macsec_commands
[c
][1][0];
489 return do_modify_nl(c
, cmd
, ifindex
, NULL
, &txsa
);
492 static int do_modify_rxsci(enum cmd c
, int argc
, char **argv
, int ifindex
)
494 struct rxsc_desc rxsc
= {0};
495 struct sa_desc rxsa
= {0};
497 enum macsec_nl_commands cmd
;
499 rxsc
.ifindex
= ifindex
;
504 sa_set
= parse_rxsci(&argc
, &argv
, &rxsc
, &rxsa
);
509 if (sa_set
&& (parse_sa_args(&argc
, &argv
, &rxsa
) ||
510 check_sa_args(c
, &rxsa
)))
512 if (!sa_set
&& parse_rxsci_args(&argc
, &argv
, &rxsc
))
516 cmd
= macsec_commands
[c
][sa_set
][1];
517 return do_modify_nl(c
, cmd
, rxsc
.ifindex
, &rxsc
, &rxsa
);
520 static int do_modify(enum cmd c
, int argc
, char **argv
)
527 ifindex
= ll_name_to_index(*argv
);
529 fprintf(stderr
, "Device \"%s\" does not exist.\n", *argv
);
537 if (strcmp(*argv
, "tx") == 0)
538 return do_modify_txsa(c
, argc
-1, argv
+1, ifindex
);
539 if (strcmp(*argv
, "rx") == 0)
540 return do_modify_rxsci(c
, argc
-1, argv
+1, ifindex
);
552 static int validate_dump(struct rtattr
**attrs
)
554 return attrs
[MACSEC_ATTR_IFINDEX
] && attrs
[MACSEC_ATTR_SECY
] &&
555 attrs
[MACSEC_ATTR_TXSA_LIST
] && attrs
[MACSEC_ATTR_RXSC_LIST
] &&
556 attrs
[MACSEC_ATTR_TXSC_STATS
] && attrs
[MACSEC_ATTR_SECY_STATS
];
560 static int validate_secy_dump(struct rtattr
**attrs
)
562 return attrs
[MACSEC_SECY_ATTR_SCI
] &&
563 attrs
[MACSEC_SECY_ATTR_ENCODING_SA
] &&
564 attrs
[MACSEC_SECY_ATTR_CIPHER_SUITE
] &&
565 attrs
[MACSEC_SECY_ATTR_ICV_LEN
] &&
566 attrs
[MACSEC_SECY_ATTR_PROTECT
] &&
567 attrs
[MACSEC_SECY_ATTR_REPLAY
] &&
568 attrs
[MACSEC_SECY_ATTR_OPER
] &&
569 attrs
[MACSEC_SECY_ATTR_VALIDATE
] &&
570 attrs
[MACSEC_SECY_ATTR_ENCRYPT
] &&
571 attrs
[MACSEC_SECY_ATTR_INC_SCI
] &&
572 attrs
[MACSEC_SECY_ATTR_ES
] &&
573 attrs
[MACSEC_SECY_ATTR_SCB
];
576 static void print_flag(FILE *f
, struct rtattr
*attrs
[], const char *desc
,
580 fprintf(f
, "%s %s ", desc
,
581 values_on_off
[!!rta_getattr_u8(attrs
[field
])]);
584 #define DEFAULT_CIPHER_NAME "GCM-AES-128"
586 static const char *cs_id_to_name(__u64 cid
)
589 case MACSEC_DEFAULT_CIPHER_ID
:
590 case MACSEC_DEFAULT_CIPHER_ALT
:
591 return DEFAULT_CIPHER_NAME
;
597 static void print_cipher_suite(const char *prefix
, __u64 cid
, __u8 icv_len
)
599 printf("%scipher suite: %s, using ICV length %d\n", prefix
,
600 cs_id_to_name(cid
), icv_len
);
603 static void print_attrs(const char *prefix
, struct rtattr
*attrs
[])
605 print_flag(stdout
, attrs
, "protect", MACSEC_SECY_ATTR_PROTECT
);
607 if (attrs
[MACSEC_SECY_ATTR_VALIDATE
]) {
608 __u8 val
= rta_getattr_u8(attrs
[MACSEC_SECY_ATTR_VALIDATE
]);
610 printf("validate %s ", VALIDATE_STR
[val
]);
613 print_flag(stdout
, attrs
, "sc", MACSEC_RXSC_ATTR_ACTIVE
);
614 print_flag(stdout
, attrs
, "sa", MACSEC_SA_ATTR_ACTIVE
);
615 print_flag(stdout
, attrs
, "encrypt", MACSEC_SECY_ATTR_ENCRYPT
);
616 print_flag(stdout
, attrs
, "send_sci", MACSEC_SECY_ATTR_INC_SCI
);
617 print_flag(stdout
, attrs
, "end_station", MACSEC_SECY_ATTR_ES
);
618 print_flag(stdout
, attrs
, "scb", MACSEC_SECY_ATTR_SCB
);
620 print_flag(stdout
, attrs
, "replay", MACSEC_SECY_ATTR_REPLAY
);
621 if (attrs
[MACSEC_SECY_ATTR_WINDOW
]) {
623 rta_getattr_u32(attrs
[MACSEC_SECY_ATTR_WINDOW
]));
626 if (attrs
[MACSEC_SECY_ATTR_CIPHER_SUITE
] &&
627 attrs
[MACSEC_SECY_ATTR_ICV_LEN
]) {
629 print_cipher_suite(prefix
,
630 rta_getattr_u64(attrs
[MACSEC_SECY_ATTR_CIPHER_SUITE
]),
631 rta_getattr_u8(attrs
[MACSEC_SECY_ATTR_ICV_LEN
]));
636 static void print_one_stat(const char **names
, struct rtattr
**attr
, int idx
,
639 int pad
= strlen(names
[idx
]) + 1;
643 printf("%*llu", pad
, rta_getattr_u64(attr
[idx
]));
645 printf("%*u", pad
, rta_getattr_u32(attr
[idx
]));
647 printf("%*c", pad
, '-');
651 static const char *txsc_stats_names
[NUM_MACSEC_TXSC_STATS_ATTR
] = {
652 [MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED
] = "OutOctetsProtected",
653 [MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED
] = "OutOctetsEncrypted",
654 [MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED
] = "OutPktsProtected",
655 [MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED
] = "OutPktsEncrypted",
658 static void print_txsc_stats(const char *prefix
, struct rtattr
*attr
)
660 struct rtattr
*stats
[MACSEC_TXSC_STATS_ATTR_MAX
+ 1];
663 if (!attr
|| show_stats
== 0)
666 parse_rtattr_nested(stats
, MACSEC_TXSC_STATS_ATTR_MAX
+ 1, attr
);
667 printf("%sstats:", prefix
);
669 for (i
= 1; i
< NUM_MACSEC_TXSC_STATS_ATTR
; i
++) {
670 if (!txsc_stats_names
[i
])
672 printf(" %s", txsc_stats_names
[i
]);
675 printf("\n%s ", prefix
);
677 for (i
= 1; i
< NUM_MACSEC_TXSC_STATS_ATTR
; i
++) {
678 if (!txsc_stats_names
[i
])
680 print_one_stat(txsc_stats_names
, stats
, i
, true);
686 static const char *secy_stats_names
[NUM_MACSEC_SECY_STATS_ATTR
] = {
687 [MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED
] = "OutPktsUntagged",
688 [MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED
] = "InPktsUntagged",
689 [MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG
] = "OutPktsTooLong",
690 [MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG
] = "InPktsNoTag",
691 [MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG
] = "InPktsBadTag",
692 [MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI
] = "InPktsUnknownSCI",
693 [MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI
] = "InPktsNoSCI",
694 [MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN
] = "InPktsOverrun",
697 static void print_secy_stats(const char *prefix
, struct rtattr
*attr
)
699 struct rtattr
*stats
[MACSEC_SECY_STATS_ATTR_MAX
+ 1];
702 if (!attr
|| show_stats
== 0)
705 parse_rtattr_nested(stats
, MACSEC_SECY_STATS_ATTR_MAX
+ 1, attr
);
706 printf("%sstats:", prefix
);
708 for (i
= 1; i
< NUM_MACSEC_SECY_STATS_ATTR
; i
++) {
709 if (!secy_stats_names
[i
])
711 printf(" %s", secy_stats_names
[i
]);
714 printf("\n%s ", prefix
);
716 for (i
= 1; i
< NUM_MACSEC_SECY_STATS_ATTR
; i
++) {
717 if (!secy_stats_names
[i
])
719 print_one_stat(secy_stats_names
, stats
, i
, true);
725 static const char *rxsa_stats_names
[NUM_MACSEC_SA_STATS_ATTR
] = {
726 [MACSEC_SA_STATS_ATTR_IN_PKTS_OK
] = "InPktsOK",
727 [MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID
] = "InPktsInvalid",
728 [MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID
] = "InPktsNotValid",
729 [MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA
] = "InPktsNotUsingSA",
730 [MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA
] = "InPktsUnusedSA",
733 static void print_rxsa_stats(const char *prefix
, struct rtattr
*attr
)
735 struct rtattr
*stats
[MACSEC_SA_STATS_ATTR_MAX
+ 1];
738 if (!attr
|| show_stats
== 0)
741 parse_rtattr_nested(stats
, MACSEC_SA_STATS_ATTR_MAX
+ 1, attr
);
742 printf("%s%s ", prefix
, prefix
);
744 for (i
= 1; i
< NUM_MACSEC_SA_STATS_ATTR
; i
++) {
745 if (!rxsa_stats_names
[i
])
747 printf(" %s", rxsa_stats_names
[i
]);
750 printf("\n%s%s ", prefix
, prefix
);
752 for (i
= 1; i
< NUM_MACSEC_SA_STATS_ATTR
; i
++) {
753 if (!rxsa_stats_names
[i
])
755 print_one_stat(rxsa_stats_names
, stats
, i
, false);
761 static const char *txsa_stats_names
[NUM_MACSEC_SA_STATS_ATTR
] = {
762 [MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED
] = "OutPktsProtected",
763 [MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED
] = "OutPktsEncrypted",
766 static void print_txsa_stats(const char *prefix
, struct rtattr
*attr
)
768 struct rtattr
*stats
[MACSEC_SA_STATS_ATTR_MAX
+ 1];
770 if (!attr
|| show_stats
== 0)
773 parse_rtattr_nested(stats
, MACSEC_SA_STATS_ATTR_MAX
+ 1, attr
);
774 printf("%s%s %s %s\n", prefix
, prefix
,
775 txsa_stats_names
[MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED
],
776 txsa_stats_names
[MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED
]);
777 printf("%s%s ", prefix
, prefix
);
779 print_one_stat(txsa_stats_names
, stats
,
780 MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED
, false);
781 print_one_stat(txsa_stats_names
, stats
,
782 MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED
, false);
786 static void print_tx_sc(const char *prefix
, __u64 sci
, __u8 encoding_sa
,
787 struct rtattr
*txsc_stats
, struct rtattr
*secy_stats
,
790 struct rtattr
*sa_attr
[MACSEC_SA_ATTR_MAX
+ 1];
794 printf("%sTXSC: %016llx on SA %d\n", prefix
, sci
, encoding_sa
);
795 print_secy_stats(prefix
, secy_stats
);
796 print_txsc_stats(prefix
, txsc_stats
);
798 rem
= RTA_PAYLOAD(sa
);
799 for (a
= RTA_DATA(sa
); RTA_OK(a
, rem
); a
= RTA_NEXT(a
, rem
)) {
803 parse_rtattr_nested(sa_attr
, MACSEC_SA_ATTR_MAX
+ 1, a
);
804 state
= rta_getattr_u8(sa_attr
[MACSEC_SA_ATTR_ACTIVE
]);
805 printf("%s%s%d: PN %u, state %s, key %s\n", prefix
, prefix
,
806 rta_getattr_u8(sa_attr
[MACSEC_SA_ATTR_AN
]),
807 rta_getattr_u32(sa_attr
[MACSEC_SA_ATTR_PN
]),
808 values_on_off
[state
],
809 hexstring_n2a(RTA_DATA(sa_attr
[MACSEC_SA_ATTR_KEYID
]),
810 RTA_PAYLOAD(sa_attr
[MACSEC_SA_ATTR_KEYID
]),
811 keyid
, sizeof(keyid
)));
812 print_txsa_stats(prefix
, sa_attr
[MACSEC_SA_ATTR_STATS
]);
816 static const char *rxsc_stats_names
[NUM_MACSEC_RXSC_STATS_ATTR
] = {
817 [MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED
] = "InOctetsValidated",
818 [MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED
] = "InOctetsDecrypted",
819 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED
] = "InPktsUnchecked",
820 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED
] = "InPktsDelayed",
821 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK
] = "InPktsOK",
822 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID
] = "InPktsInvalid",
823 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE
] = "InPktsLate",
824 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID
] = "InPktsNotValid",
825 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA
] = "InPktsNotUsingSA",
826 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA
] = "InPktsUnusedSA",
829 static void print_rxsc_stats(const char *prefix
, struct rtattr
*attr
)
831 struct rtattr
*stats
[MACSEC_RXSC_STATS_ATTR_MAX
+ 1];
834 if (!attr
|| show_stats
== 0)
837 parse_rtattr_nested(stats
, MACSEC_RXSC_STATS_ATTR_MAX
+ 1, attr
);
838 printf("%sstats:", prefix
);
839 for (i
= 1; i
< NUM_MACSEC_RXSC_STATS_ATTR
; i
++) {
840 if (!rxsc_stats_names
[i
])
842 printf(" %s", rxsc_stats_names
[i
]);
845 printf("\n%s ", prefix
);
847 for (i
= 1; i
< NUM_MACSEC_RXSC_STATS_ATTR
; i
++) {
848 if (!rxsc_stats_names
[i
])
850 print_one_stat(rxsc_stats_names
, stats
, i
, true);
856 static void print_rx_sc(const char *prefix
, __u64 sci
, __u8 active
,
857 struct rtattr
*rxsc_stats
, struct rtattr
*sa
)
859 struct rtattr
*sa_attr
[MACSEC_SA_ATTR_MAX
+ 1];
863 printf("%sRXSC: %016llx, state %s\n", prefix
, sci
,
864 values_on_off
[!!active
]);
865 print_rxsc_stats(prefix
, rxsc_stats
);
867 rem
= RTA_PAYLOAD(sa
);
868 for (a
= RTA_DATA(sa
); RTA_OK(a
, rem
); a
= RTA_NEXT(a
, rem
)) {
872 parse_rtattr_nested(sa_attr
, MACSEC_SA_ATTR_MAX
+ 1, a
);
873 state
= rta_getattr_u8(sa_attr
[MACSEC_SA_ATTR_ACTIVE
]);
874 printf("%s%s%d: PN %u, state %s, key %s\n", prefix
, prefix
,
875 rta_getattr_u8(sa_attr
[MACSEC_SA_ATTR_AN
]),
876 rta_getattr_u32(sa_attr
[MACSEC_SA_ATTR_PN
]),
877 values_on_off
[state
],
878 hexstring_n2a(RTA_DATA(sa_attr
[MACSEC_SA_ATTR_KEYID
]),
879 RTA_PAYLOAD(sa_attr
[MACSEC_SA_ATTR_KEYID
]),
880 keyid
, sizeof(keyid
)));
881 print_rxsa_stats(prefix
, sa_attr
[MACSEC_SA_ATTR_STATS
]);
885 static int process(const struct sockaddr_nl
*who
, struct nlmsghdr
*n
,
888 struct genlmsghdr
*ghdr
;
889 struct rtattr
*attrs
[MACSEC_ATTR_MAX
+ 1], *sc
, *c
;
890 struct rtattr
*attrs_secy
[MACSEC_SECY_ATTR_MAX
+ 1];
891 int len
= n
->nlmsg_len
;
897 if (n
->nlmsg_type
!= genl_family
)
900 len
-= NLMSG_LENGTH(GENL_HDRLEN
);
904 ghdr
= NLMSG_DATA(n
);
905 if (ghdr
->cmd
!= MACSEC_CMD_GET_TXSC
)
908 parse_rtattr(attrs
, MACSEC_ATTR_MAX
, (void *) ghdr
+ GENL_HDRLEN
, len
);
909 if (!validate_dump(attrs
)) {
910 printf("incomplete dump message\n");
914 ifindex
= rta_getattr_u32(attrs
[MACSEC_ATTR_IFINDEX
]);
915 parse_rtattr_nested(attrs_secy
, MACSEC_SECY_ATTR_MAX
+ 1,
916 attrs
[MACSEC_ATTR_SECY
]);
918 if (!validate_secy_dump(attrs_secy
)) {
919 printf("incomplete dump message\n");
923 sci
= rta_getattr_u64(attrs_secy
[MACSEC_SECY_ATTR_SCI
]);
924 encoding_sa
= rta_getattr_u8(attrs_secy
[MACSEC_SECY_ATTR_ENCODING_SA
]);
926 if (filter
.ifindex
&& ifindex
!= filter
.ifindex
)
929 if (filter
.sci
&& sci
!= filter
.sci
)
932 printf("%d: %s: ", ifindex
, ll_index_to_name(ifindex
));
933 print_attrs(" ", attrs_secy
);
935 print_tx_sc(" ", sci
, encoding_sa
,
936 attrs
[MACSEC_ATTR_TXSC_STATS
],
937 attrs
[MACSEC_ATTR_SECY_STATS
],
938 attrs
[MACSEC_ATTR_TXSA_LIST
]);
940 if (!attrs
[MACSEC_ATTR_RXSC_LIST
])
943 sc
= attrs
[MACSEC_ATTR_RXSC_LIST
];
944 rem
= RTA_PAYLOAD(sc
);
945 for (c
= RTA_DATA(sc
); RTA_OK(c
, rem
); c
= RTA_NEXT(c
, rem
)) {
946 struct rtattr
*sc_attr
[MACSEC_RXSC_ATTR_MAX
+ 1];
948 parse_rtattr_nested(sc_attr
, MACSEC_RXSC_ATTR_MAX
+ 1, c
);
950 rta_getattr_u64(sc_attr
[MACSEC_RXSC_ATTR_SCI
]),
951 rta_getattr_u32(sc_attr
[MACSEC_RXSC_ATTR_ACTIVE
]),
952 sc_attr
[MACSEC_RXSC_ATTR_STATS
],
953 sc_attr
[MACSEC_RXSC_ATTR_SA_LIST
]);
959 static int do_dump(int ifindex
)
961 MACSEC_GENL_REQ(req
, MACSEC_BUFLEN
, MACSEC_CMD_GET_TXSC
,
962 NLM_F_REQUEST
| NLM_F_DUMP
);
964 memset(&filter
, 0, sizeof(filter
));
965 filter
.ifindex
= ifindex
;
967 req
.n
.nlmsg_seq
= genl_rth
.dump
= ++genl_rth
.seq
;
968 if (rtnl_send(&genl_rth
, &req
, req
.n
.nlmsg_len
) < 0) {
969 perror("Failed to send dump request");
973 if (rtnl_dump_filter(&genl_rth
, process
, stdout
) < 0) {
974 fprintf(stderr
, "Dump terminated\n");
981 static int do_show(int argc
, char **argv
)
988 ifindex
= ll_name_to_index(*argv
);
990 fprintf(stderr
, "Device \"%s\" does not exist.\n", *argv
);
996 return do_dump(ifindex
);
1002 int do_ipmacsec(int argc
, char **argv
)
1009 if (matches(*argv
, "help") == 0)
1012 if (matches(*argv
, "show") == 0)
1013 return do_show(argc
-1, argv
+1);
1015 if (matches(*argv
, "add") == 0)
1016 return do_modify(CMD_ADD
, argc
-1, argv
+1);
1017 if (matches(*argv
, "set") == 0)
1018 return do_modify(CMD_UPD
, argc
-1, argv
+1);
1019 if (matches(*argv
, "delete") == 0)
1020 return do_modify(CMD_DEL
, argc
-1, argv
+1);
1022 fprintf(stderr
, "Command \"%s\" is unknown, try \"ip macsec help\".\n",
1027 /* device creation */
1028 static void macsec_print_opt(struct link_util
*lu
, FILE *f
, struct rtattr
*tb
[])
1033 if (tb
[IFLA_MACSEC_SCI
]) {
1034 fprintf(f
, "sci %016llx ",
1035 rta_getattr_u64(tb
[IFLA_MACSEC_SCI
]));
1038 print_flag(f
, tb
, "protect", IFLA_MACSEC_PROTECT
);
1040 if (tb
[IFLA_MACSEC_CIPHER_SUITE
]) {
1041 __u64 csid
= rta_getattr_u64(tb
[IFLA_MACSEC_CIPHER_SUITE
]);
1043 fprintf(f
, "cipher %s ", cs_id_to_name(csid
));
1046 if (tb
[IFLA_MACSEC_ICV_LEN
]) {
1047 fprintf(f
, "icvlen %hhu ",
1048 rta_getattr_u8(tb
[IFLA_MACSEC_ICV_LEN
]));
1051 if (tb
[IFLA_MACSEC_ENCODING_SA
]) {
1052 fprintf(f
, "encodingsa %hhu ",
1053 rta_getattr_u8(tb
[IFLA_MACSEC_ENCODING_SA
]));
1056 if (tb
[IFLA_MACSEC_VALIDATION
]) {
1057 __u8 val
= rta_getattr_u8(tb
[IFLA_MACSEC_VALIDATION
]);
1059 fprintf(f
, "validate %s ", VALIDATE_STR
[val
]);
1062 print_flag(f
, tb
, "encrypt", IFLA_MACSEC_ENCRYPT
);
1063 print_flag(f
, tb
, "send_sci", IFLA_MACSEC_INC_SCI
);
1064 print_flag(f
, tb
, "end_station", IFLA_MACSEC_ES
);
1065 print_flag(f
, tb
, "scb", IFLA_MACSEC_SCB
);
1067 print_flag(f
, tb
, "replay", IFLA_MACSEC_REPLAY_PROTECT
);
1068 if (tb
[IFLA_MACSEC_WINDOW
]) {
1069 fprintf(f
, "window %d ",
1070 rta_getattr_u32(tb
[IFLA_MACSEC_WINDOW
]));
1075 static int do_cipher_suite(struct cipher_args
*cipher
, int *argcp
,
1078 char **argv
= *argvp
;
1084 if (strcmp(*argv
, "default") == 0 ||
1085 strcmp(*argv
, "gcm-aes-128") == 0 ||
1086 strcmp(*argv
, "GCM-AES-128") == 0)
1087 cipher
->id
= MACSEC_DEFAULT_CIPHER_ID
;
1090 if (strcmp(*argv
, "icvlen") == 0) {
1092 if (cipher
->icv_len
!= 0)
1093 duparg2("icvlen", "icvlen");
1094 get_icvlen(&cipher
->icv_len
, *argv
);
1102 static bool check_txsc_flags(bool es
, bool scb
, bool sci
)
1104 if (sci
&& (es
|| scb
))
1111 static void usage(FILE *f
)
1114 "Usage: ... macsec [ port PORT | sci SCI ]\n"
1115 " [ cipher CIPHER_SUITE ]\n"
1116 " [ encrypt { on | off } ]\n"
1117 " [ send_sci { on | off } ]\n"
1118 " [ end_station { on | off } ]\n"
1119 " [ scb { on | off } ]\n"
1120 " [ protect { on | off } ]\n"
1121 " [ replay { on | off} window { 0..2^32-1 } ]\n"
1122 " [ validate { strict | check | disabled } ]\n"
1123 " [ encodingsa { 0..3 } ]\n"
1125 fprintf(f
, "CIPHER_SUITE := [ default = gcm-aes-128 ] icvlen { 8..32 }\n");
1128 static int macsec_parse_opt(struct link_util
*lu
, int argc
, char **argv
,
1129 struct nlmsghdr
*hdr
)
1132 __u8 encoding_sa
= 0xff;
1134 struct cipher_args cipher
= {0};
1135 enum macsec_validation_type validate
;
1136 bool es
= false, scb
= false, send_sci
= false;
1137 int replay_protect
= -1;
1138 struct sci sci
= { 0 };
1140 ret
= get_sci_portaddr(&sci
, &argc
, &argv
, true, true);
1142 fprintf(stderr
, "expected sci\n");
1148 addattr_l(hdr
, MACSEC_BUFLEN
, IFLA_MACSEC_SCI
,
1149 &sci
.sci
, sizeof(sci
.sci
));
1151 addattr_l(hdr
, MACSEC_BUFLEN
, IFLA_MACSEC_PORT
,
1152 &sci
.port
, sizeof(sci
.port
));
1156 if (strcmp(*argv
, "cipher") == 0) {
1158 duparg2("cipher", "cipher");
1160 if (do_cipher_suite(&cipher
, &argc
, &argv
))
1162 } else if (strcmp(*argv
, "encrypt") == 0) {
1166 ret
= one_of("encrypt", *argv
, values_on_off
,
1167 ARRAY_SIZE(values_on_off
), &i
);
1170 addattr8(hdr
, MACSEC_BUFLEN
, IFLA_MACSEC_ENCRYPT
, i
);
1171 } else if (strcmp(*argv
, "send_sci") == 0) {
1175 ret
= one_of("send_sci", *argv
, values_on_off
,
1176 ARRAY_SIZE(values_on_off
), &i
);
1180 addattr8(hdr
, MACSEC_BUFLEN
,
1181 IFLA_MACSEC_INC_SCI
, send_sci
);
1182 } else if (strcmp(*argv
, "end_station") == 0) {
1186 ret
= one_of("end_station", *argv
, values_on_off
,
1187 ARRAY_SIZE(values_on_off
), &i
);
1191 addattr8(hdr
, MACSEC_BUFLEN
, IFLA_MACSEC_ES
, es
);
1192 } else if (strcmp(*argv
, "scb") == 0) {
1196 ret
= one_of("scb", *argv
, values_on_off
,
1197 ARRAY_SIZE(values_on_off
), &i
);
1201 addattr8(hdr
, MACSEC_BUFLEN
, IFLA_MACSEC_SCB
, scb
);
1202 } else if (strcmp(*argv
, "protect") == 0) {
1206 ret
= one_of("protect", *argv
, values_on_off
,
1207 ARRAY_SIZE(values_on_off
), &i
);
1210 addattr8(hdr
, MACSEC_BUFLEN
, IFLA_MACSEC_PROTECT
, i
);
1211 } else if (strcmp(*argv
, "replay") == 0) {
1215 ret
= one_of("replay", *argv
, values_on_off
,
1216 ARRAY_SIZE(values_on_off
), &i
);
1219 replay_protect
= !!i
;
1220 } else if (strcmp(*argv
, "window") == 0) {
1222 ret
= get_u32(&window
, *argv
, 0);
1224 invarg("expected replay window size", *argv
);
1225 } else if (strcmp(*argv
, "validate") == 0) {
1227 ret
= one_of("validate", *argv
,
1228 VALIDATE_STR
, ARRAY_SIZE(VALIDATE_STR
),
1232 addattr8(hdr
, MACSEC_BUFLEN
,
1233 IFLA_MACSEC_VALIDATION
, validate
);
1234 } else if (strcmp(*argv
, "encodingsa") == 0) {
1235 if (encoding_sa
!= 0xff)
1236 duparg2("encodingsa", "encodingsa");
1238 ret
= get_an(&encoding_sa
, *argv
);
1240 invarg("expected an { 0..3 }", *argv
);
1242 fprintf(stderr
, "macsec: unknown command \"%s\"?\n",
1251 if (!check_txsc_flags(es
, scb
, send_sci
)) {
1252 fprintf(stderr
, "invalid combination of send_sci/end_station/scb\n");
1256 if (window
!= -1 && replay_protect
== -1) {
1258 "replay window set, but replay protection not enabled. did you mean 'replay on window %u'?\n",
1261 } else if (window
== -1 && replay_protect
== 1) {
1263 "replay protection enabled, but no window set. did you mean 'replay on window VALUE'?\n");
1268 addattr_l(hdr
, MACSEC_BUFLEN
, IFLA_MACSEC_CIPHER_SUITE
,
1269 &cipher
.id
, sizeof(cipher
.id
));
1270 addattr_l(hdr
, MACSEC_BUFLEN
, IFLA_MACSEC_ICV_LEN
,
1271 &cipher
.icv_len
, sizeof(cipher
.icv_len
));
1274 if (replay_protect
!= -1) {
1275 addattr32(hdr
, MACSEC_BUFLEN
, IFLA_MACSEC_WINDOW
, window
);
1276 addattr8(hdr
, MACSEC_BUFLEN
, IFLA_MACSEC_REPLAY_PROTECT
,
1280 if (encoding_sa
!= 0xff) {
1281 addattr_l(hdr
, MACSEC_BUFLEN
, IFLA_MACSEC_ENCODING_SA
,
1282 &encoding_sa
, sizeof(encoding_sa
));
1288 static void macsec_print_help(struct link_util
*lu
, int argc
, char **argv
,
1294 struct link_util macsec_link_util
= {
1296 .maxattr
= IFLA_MACSEC_MAX
,
1297 .parse_opt
= macsec_parse_opt
,
1298 .print_help
= macsec_print_help
,
1299 .print_opt
= macsec_print_opt
,