]> git.proxmox.com Git - mirror_iproute2.git/blob - ip/ipmacsec.c
projects / mirror_iproute2.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ip: macsec cleanup
[mirror_iproute2.git] / ip / ipmacsec.c
1 /*
2 * ipmacsec.c "ip macsec".
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version
7 * 2 of the License, or (at your option) any later version.
8 *
9 * Authors: Sabrina Dubroca <sd@queasysnail.net>
10 */
11
12 #include <stdio.h>
13 #include <stdlib.h>
14 #include <string.h>
15 #include <errno.h>
16 #include <linux/genetlink.h>
17 #include <linux/if_ether.h>
18 #include <linux/if_macsec.h>
19
20 #include "rt_names.h"
21 #include "utils.h"
22 #include "ip_common.h"
23 #include "ll_map.h"
24 #include "libgenl.h"
25
26 static const char * const values_on_off[] = { "off", "on" };
27
28 static const char * const validate_str[] = {
29 [MACSEC_VALIDATE_DISABLED] = "disabled",
30 [MACSEC_VALIDATE_CHECK] = "check",
31 [MACSEC_VALIDATE_STRICT] = "strict",
32 };
33
34 struct sci {
35 __u64 sci;
36 __u16 port;
37 char abuf[6];
38 };
39
40 struct sa_desc {
41 __u8 an;
42 __u32 pn;
43 __u8 key_id[MACSEC_KEYID_LEN];
44 __u32 key_len;
45 __u8 key[MACSEC_MAX_KEY_LEN];
46 __u8 active;
47 };
48
49 struct cipher_args {
50 __u64 id;
51 __u8 icv_len;
52 };
53
54 struct txsc_desc {
55 int ifindex;
56 __u64 sci;
57 __be16 port;
58 struct cipher_args cipher;
59 __u32 window;
60 enum macsec_validation_type validate;
61 __u8 encoding_sa;
62 };
63
64 struct rxsc_desc {
65 int ifindex;
66 __u64 sci;
67 __u8 active;
68 };
69
70 #define MACSEC_BUFLEN 1024
71
72
73 /* netlink socket */
74 static struct rtnl_handle genl_rth;
75 static int genl_family = -1;
76
77 #define MACSEC_GENL_REQ(_req, _bufsiz, _cmd, _flags) \
78 GENL_REQUEST(_req, _bufsiz, genl_family, 0, MACSEC_GENL_VERSION, \
79 _cmd, _flags)
80
81
82 static void ipmacsec_usage(void)
83 {
84 fprintf(stderr,
85 "Usage: ip macsec add DEV tx sa { 0..3 } [ OPTS ] key ID KEY\n"
86 " ip macsec set DEV tx sa { 0..3 } [ OPTS ]\n"
87 " ip macsec del DEV tx sa { 0..3 }\n"
88 " ip macsec add DEV rx SCI [ on | off ]\n"
89 " ip macsec set DEV rx SCI [ on | off ]\n"
90 " ip macsec del DEV rx SCI\n"
91 " ip macsec add DEV rx SCI sa { 0..3 } [ OPTS ] key ID KEY\n"
92 " ip macsec set DEV rx SCI sa { 0..3 } [ OPTS ]\n"
93 " ip macsec del DEV rx SCI sa { 0..3 }\n"
94 " ip macsec show\n"
95 " ip macsec show DEV\n"
96 "where OPTS := [ pn <u32> ] [ on | off ]\n"
97 " ID := 128-bit hex string\n"
98 " KEY := 128-bit hex string\n"
99 " SCI := { sci <u64> | port { 1..2^16-1 } address <lladdr> }\n");
100
101 exit(-1);
102 }
103
104 static int one_of(const char *msg, const char *realval, const char * const *list,
105 size_t len, int *index)
106 {
107 int i;
108
109 for (i = 0; i < len; i++) {
110 if (matches(realval, list[i]) == 0) {
111 *index = i;
112 return 0;
113 }
114 }
115
116 fprintf(stderr, "Error: argument of \"%s\" must be one of ", msg);
117 for (i = 0; i < len; i++)
118 fprintf(stderr, "\"%s\", ", list[i]);
119 fprintf(stderr, "not \"%s\"\n", realval);
120 return -1;
121 }
122
123 static int get_an(__u8 *val, const char *arg)
124 {
125 int ret = get_u8(val, arg, 0);
126
127 if (ret)
128 return ret;
129
130 if (*val > 3)
131 return -1;
132
133 return 0;
134 }
135
136 static int get_sci(__u64 *sci, const char *arg)
137 {
138 return get_be64(sci, arg, 16);
139 }
140
141 static int get_port(__be16 *port, const char *arg)
142 {
143 return get_be16(port, arg, 0);
144 }
145
146 #define _STR(a) #a
147 #define STR(a) _STR(a)
148
149 static void get_icvlen(__u8 *icvlen, char *arg)
150 {
151 int ret = get_u8(icvlen, arg, 10);
152
153 if (ret)
154 invarg("expected ICV length", arg);
155
156 if (*icvlen < MACSEC_MIN_ICV_LEN || *icvlen > MACSEC_STD_ICV_LEN)
157 invarg("ICV length must be in the range {"
158 STR(MACSEC_MIN_ICV_LEN) ".." STR(MACSEC_STD_ICV_LEN)
159 "}", arg);
160 }
161
162 static bool get_sa(int *argcp, char ***argvp, __u8 *an)
163 {
164 int argc = *argcp;
165 char **argv = *argvp;
166 int ret;
167
168 if (argc <= 0 || strcmp(*argv, "sa") != 0)
169 return false;
170
171 NEXT_ARG();
172 ret = get_an(an, *argv);
173 if (ret)
174 invarg("expected an { 0..3 }", *argv);
175 argc--; argv++;
176
177 *argvp = argv;
178 *argcp = argc;
179 return true;
180 }
181
182 static int parse_sa_args(int *argcp, char ***argvp, struct sa_desc *sa)
183 {
184 int argc = *argcp;
185 char **argv = *argvp;
186 int ret;
187 bool active_set = false;
188
189 while (argc > 0) {
190 if (strcmp(*argv, "pn") == 0) {
191 if (sa->pn != 0)
192 duparg2("pn", "pn");
193 NEXT_ARG();
194 ret = get_u32(&sa->pn, *argv, 0);
195 if (ret)
196 invarg("expected pn", *argv);
197 if (sa->pn == 0)
198 invarg("expected pn != 0", *argv);
199 } else if (strcmp(*argv, "key") == 0) {
200 unsigned int len;
201
202 NEXT_ARG();
203 if (!hexstring_a2n(*argv, sa->key_id, MACSEC_KEYID_LEN,
204 &len))
205 invarg("expected key id", *argv);
206 NEXT_ARG();
207 if (!hexstring_a2n(*argv, sa->key, MACSEC_MAX_KEY_LEN,
208 &sa->key_len))
209 invarg("expected key", *argv);
210 } else if (strcmp(*argv, "on") == 0) {
211 if (active_set)
212 duparg2("on/off", "on");
213 sa->active = true;
214 active_set = true;
215 } else if (strcmp(*argv, "off") == 0) {
216 if (active_set)
217 duparg2("on/off", "off");
218 sa->active = false;
219 active_set = true;
220 } else {
221 fprintf(stderr, "macsec: unknown command \"%s\"?\n",
222 *argv);
223 ipmacsec_usage();
224 }
225
226 argv++; argc--;
227 }
228
229 *argvp = argv;
230 *argcp = argc;
231 return 0;
232 }
233
234 static __u64 make_sci(char *addr, __be16 port)
235 {
236 __u64 sci;
237
238 memcpy(&sci, addr, ETH_ALEN);
239 memcpy(((char *)&sci) + ETH_ALEN, &port, sizeof(port));
240
241 return sci;
242 }
243
244 static bool sci_complete(bool sci, bool port, bool addr, bool port_only)
245 {
246 return sci || (port && (addr || port_only));
247 }
248
249 static int get_sci_portaddr(struct sci *sci, int *argcp, char ***argvp,
250 bool port_only, bool optional)
251 {
252 int argc = *argcp;
253 char **argv = *argvp;
254 int ret;
255 bool p = false, a = false, s = false;
256
257 while (argc > 0) {
258 if (strcmp(*argv, "sci") == 0) {
259 if (p)
260 invarg("expected address", *argv);
261 if (a)
262 invarg("expected port", *argv);
263 NEXT_ARG();
264 ret = get_sci(&sci->sci, *argv);
265 if (ret)
266 invarg("expected sci", *argv);
267 s = true;
268 } else if (strcmp(*argv, "port") == 0) {
269 NEXT_ARG();
270 ret = get_port(&sci->port, *argv);
271 if (ret)
272 invarg("expected port", *argv);
273 if (sci->port == 0)
274 invarg("expected port != 0", *argv);
275 p = true;
276 } else if (strcmp(*argv, "address") == 0) {
277 NEXT_ARG();
278 ret = ll_addr_a2n(sci->abuf, sizeof(sci->abuf), *argv);
279 if (ret < 0)
280 invarg("expected lladdr", *argv);
281 a = true;
282 } else if (optional) {
283 break;
284 } else {
285 invarg("expected sci, port, or address", *argv);
286 }
287
288 argv++; argc--;
289
290 if (sci_complete(s, p, a, port_only))
291 break;
292 }
293
294 if (!optional && !sci_complete(s, p, a, port_only))
295 return -1;
296
297 if (p && a)
298 sci->sci = make_sci(sci->abuf, sci->port);
299
300 *argvp = argv;
301 *argcp = argc;
302
303 return p || a || s;
304 }
305
306 static bool parse_rxsci(int *argcp, char ***argvp, struct rxsc_desc *rxsc,
307 struct sa_desc *rxsa)
308 {
309 struct sci sci = { 0 };
310
311 if (*argcp == 0 ||
312 get_sci_portaddr(&sci, argcp, argvp, false, false) < 0) {
313 fprintf(stderr, "expected sci\n");
314 ipmacsec_usage();
315 }
316
317 rxsc->sci = sci.sci;
318
319 return get_sa(argcp, argvp, &rxsa->an);
320 }
321
322 static int parse_rxsci_args(int *argcp, char ***argvp, struct rxsc_desc *rxsc)
323 {
324 int argc = *argcp;
325 char **argv = *argvp;
326 bool active_set = false;
327
328 while (argc > 0) {
329 if (strcmp(*argv, "on") == 0) {
330 if (active_set)
331 duparg2("on/off", "on");
332 rxsc->active = true;
333 active_set = true;
334 } else if (strcmp(*argv, "off") == 0) {
335 if (active_set)
336 duparg2("on/off", "off");
337 rxsc->active = false;
338 active_set = true;
339 } else {
340 fprintf(stderr, "macsec: unknown command \"%s\"?\n",
341 *argv);
342 ipmacsec_usage();
343 }
344
345 argv++; argc--;
346 }
347
348 *argvp = argv;
349 *argcp = argc;
350 return 0;
351 }
352
353 enum cmd {
354 CMD_ADD,
355 CMD_DEL,
356 CMD_UPD,
357 __CMD_MAX
358 };
359
360 static const enum macsec_nl_commands macsec_commands[__CMD_MAX][2][2] = {
361 [CMD_ADD] = {
362 [0] = {-1, MACSEC_CMD_ADD_RXSC},
363 [1] = {MACSEC_CMD_ADD_TXSA, MACSEC_CMD_ADD_RXSA},
364 },
365 [CMD_UPD] = {
366 [0] = {-1, MACSEC_CMD_UPD_RXSC},
367 [1] = {MACSEC_CMD_UPD_TXSA, MACSEC_CMD_UPD_RXSA},
368 },
369 [CMD_DEL] = {
370 [0] = {-1, MACSEC_CMD_DEL_RXSC},
371 [1] = {MACSEC_CMD_DEL_TXSA, MACSEC_CMD_DEL_RXSA},
372 },
373 };
374
375 static int do_modify_nl(enum cmd c, enum macsec_nl_commands cmd, int ifindex,
376 struct rxsc_desc *rxsc, struct sa_desc *sa)
377 {
378 struct rtattr *attr_sa;
379
380 MACSEC_GENL_REQ(req, MACSEC_BUFLEN, cmd, NLM_F_REQUEST);
381
382 addattr32(&req.n, MACSEC_BUFLEN, MACSEC_ATTR_IFINDEX, ifindex);
383 if (rxsc) {
384 struct rtattr *attr_rxsc;
385
386 attr_rxsc = addattr_nest(&req.n, MACSEC_BUFLEN,
387 MACSEC_ATTR_RXSC_CONFIG);
388 addattr64(&req.n, MACSEC_BUFLEN,
389 MACSEC_RXSC_ATTR_SCI, rxsc->sci);
390 if (c != CMD_DEL && rxsc->active != 0xff)
391 addattr8(&req.n, MACSEC_BUFLEN,
392 MACSEC_RXSC_ATTR_ACTIVE, rxsc->active);
393
394 addattr_nest_end(&req.n, attr_rxsc);
395 }
396
397 if (sa->an == 0xff)
398 goto talk;
399
400 attr_sa = addattr_nest(&req.n, MACSEC_BUFLEN, MACSEC_ATTR_SA_CONFIG);
401
402 addattr8(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_AN, sa->an);
403
404 if (c != CMD_DEL) {
405 if (sa->pn)
406 addattr32(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_PN,
407 sa->pn);
408
409 if (sa->key_len) {
410 addattr_l(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_KEYID,
411 sa->key_id, MACSEC_KEYID_LEN);
412 addattr_l(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_KEY,
413 sa->key, sa->key_len);
414 }
415
416 if (sa->active != 0xff) {
417 addattr8(&req.n, MACSEC_BUFLEN,
418 MACSEC_SA_ATTR_ACTIVE, sa->active);
419 }
420 }
421
422 addattr_nest_end(&req.n, attr_sa);
423
424 talk:
425 if (rtnl_talk(&genl_rth, &req.n, NULL) < 0)
426 return -2;
427
428 return 0;
429 }
430
431 static bool check_sa_args(enum cmd c, struct sa_desc *sa)
432 {
433 if (c == CMD_ADD) {
434 if (!sa->key_len) {
435 fprintf(stderr, "cannot create SA without key\n");
436 return -1;
437 }
438
439 if (sa->pn == 0) {
440 fprintf(stderr, "must specify a packet number != 0\n");
441 return -1;
442 }
443 } else if (c == CMD_UPD) {
444 if (sa->key_len) {
445 fprintf(stderr, "cannot change key on SA\n");
446 return -1;
447 }
448 }
449
450 return 0;
451 }
452
453 static int do_modify_txsa(enum cmd c, int argc, char **argv, int ifindex)
454 {
455 struct sa_desc txsa = {0};
456 enum macsec_nl_commands cmd;
457
458 txsa.an = 0xff;
459 txsa.active = 0xff;
460
461 if (argc == 0 || !get_sa(&argc, &argv, &txsa.an))
462 ipmacsec_usage();
463
464 if (c == CMD_DEL)
465 goto modify;
466
467 if (parse_sa_args(&argc, &argv, &txsa))
468 return -1;
469
470 if (check_sa_args(c, &txsa))
471 return -1;
472
473 modify:
474 cmd = macsec_commands[c][1][0];
475 return do_modify_nl(c, cmd, ifindex, NULL, &txsa);
476 }
477
478 static int do_modify_rxsci(enum cmd c, int argc, char **argv, int ifindex)
479 {
480 struct rxsc_desc rxsc = {0};
481 struct sa_desc rxsa = {0};
482 bool sa_set;
483 enum macsec_nl_commands cmd;
484
485 rxsc.ifindex = ifindex;
486 rxsc.active = 0xff;
487 rxsa.an = 0xff;
488 rxsa.active = 0xff;
489
490 sa_set = parse_rxsci(&argc, &argv, &rxsc, &rxsa);
491
492 if (c == CMD_DEL)
493 goto modify;
494
495 if (sa_set && (parse_sa_args(&argc, &argv, &rxsa) ||
496 check_sa_args(c, &rxsa)))
497 return -1;
498 if (!sa_set && parse_rxsci_args(&argc, &argv, &rxsc))
499 return -1;
500
501 modify:
502 cmd = macsec_commands[c][sa_set][1];
503 return do_modify_nl(c, cmd, rxsc.ifindex, &rxsc, &rxsa);
504 }
505
506 static int do_modify(enum cmd c, int argc, char **argv)
507 {
508 int ifindex;
509
510 if (argc == 0)
511 ipmacsec_usage();
512
513 ifindex = ll_name_to_index(*argv);
514 if (!ifindex) {
515 fprintf(stderr, "Device \"%s\" does not exist.\n", *argv);
516 return -1;
517 }
518 argc--; argv++;
519
520 if (argc == 0)
521 ipmacsec_usage();
522
523 if (strcmp(*argv, "tx") == 0)
524 return do_modify_txsa(c, argc-1, argv+1, ifindex);
525 if (strcmp(*argv, "rx") == 0)
526 return do_modify_rxsci(c, argc-1, argv+1, ifindex);
527
528 ipmacsec_usage();
529 return -1;
530 }
531
532 /* dump/show */
533 static struct {
534 int ifindex;
535 __u64 sci;
536 } filter;
537
538 static int validate_dump(struct rtattr **attrs)
539 {
540 return attrs[MACSEC_ATTR_IFINDEX] && attrs[MACSEC_ATTR_SECY] &&
541 attrs[MACSEC_ATTR_TXSA_LIST] && attrs[MACSEC_ATTR_RXSC_LIST] &&
542 attrs[MACSEC_ATTR_TXSC_STATS] && attrs[MACSEC_ATTR_SECY_STATS];
543
544 }
545
546 static int validate_secy_dump(struct rtattr **attrs)
547 {
548 return attrs[MACSEC_SECY_ATTR_SCI] &&
549 attrs[MACSEC_SECY_ATTR_ENCODING_SA] &&
550 attrs[MACSEC_SECY_ATTR_CIPHER_SUITE] &&
551 attrs[MACSEC_SECY_ATTR_ICV_LEN] &&
552 attrs[MACSEC_SECY_ATTR_PROTECT] &&
553 attrs[MACSEC_SECY_ATTR_REPLAY] &&
554 attrs[MACSEC_SECY_ATTR_OPER] &&
555 attrs[MACSEC_SECY_ATTR_VALIDATE] &&
556 attrs[MACSEC_SECY_ATTR_ENCRYPT] &&
557 attrs[MACSEC_SECY_ATTR_INC_SCI] &&
558 attrs[MACSEC_SECY_ATTR_ES] &&
559 attrs[MACSEC_SECY_ATTR_SCB];
560 }
561
562 static void print_flag(FILE *f, struct rtattr *attrs[], const char *desc,
563 int field)
564 {
565 if (attrs[field]) {
566 const char *v = values_on_off[!!rta_getattr_u8(attrs[field])];
567
568 if (is_json_context())
569 print_string(PRINT_JSON, desc, NULL, v);
570 else
571 fprintf(f, "%s %s ", desc, v);
572 }
573 }
574
575 #define DEFAULT_CIPHER_NAME "GCM-AES-128"
576
577 static const char *cs_id_to_name(__u64 cid)
578 {
579 switch (cid) {
580 case MACSEC_DEFAULT_CIPHER_ID:
581 case MACSEC_DEFAULT_CIPHER_ALT:
582 return DEFAULT_CIPHER_NAME;
583 default:
584 return "(unknown)";
585 }
586 }
587
588 static void print_cipher_suite(const char *prefix, __u64 cid, __u8 icv_len)
589 {
590 printf("%scipher suite: %s, using ICV length %d\n", prefix,
591 cs_id_to_name(cid), icv_len);
592 }
593
594 static void print_attrs(const char *prefix, struct rtattr *attrs[])
595 {
596 print_flag(stdout, attrs, "protect", MACSEC_SECY_ATTR_PROTECT);
597
598 if (attrs[MACSEC_SECY_ATTR_VALIDATE]) {
599 __u8 val = rta_getattr_u8(attrs[MACSEC_SECY_ATTR_VALIDATE]);
600
601 printf("validate %s ", validate_str[val]);
602 }
603
604 print_flag(stdout, attrs, "sc", MACSEC_RXSC_ATTR_ACTIVE);
605 print_flag(stdout, attrs, "sa", MACSEC_SA_ATTR_ACTIVE);
606 print_flag(stdout, attrs, "encrypt", MACSEC_SECY_ATTR_ENCRYPT);
607 print_flag(stdout, attrs, "send_sci", MACSEC_SECY_ATTR_INC_SCI);
608 print_flag(stdout, attrs, "end_station", MACSEC_SECY_ATTR_ES);
609 print_flag(stdout, attrs, "scb", MACSEC_SECY_ATTR_SCB);
610
611 print_flag(stdout, attrs, "replay", MACSEC_SECY_ATTR_REPLAY);
612 if (attrs[MACSEC_SECY_ATTR_WINDOW]) {
613 printf("window %d ",
614 rta_getattr_u32(attrs[MACSEC_SECY_ATTR_WINDOW]));
615 }
616
617 if (attrs[MACSEC_SECY_ATTR_CIPHER_SUITE] &&
618 attrs[MACSEC_SECY_ATTR_ICV_LEN]) {
619 printf("\n");
620 print_cipher_suite(prefix,
621 rta_getattr_u64(attrs[MACSEC_SECY_ATTR_CIPHER_SUITE]),
622 rta_getattr_u8(attrs[MACSEC_SECY_ATTR_ICV_LEN]));
623 }
624
625 }
626
627 static void print_one_stat(const char **names, struct rtattr **attr, int idx,
628 bool long_stat)
629 {
630 int pad = strlen(names[idx]) + 1;
631
632 if (attr[idx]) {
633 if (long_stat)
634 printf("%*llu", pad, rta_getattr_u64(attr[idx]));
635 else
636 printf("%*u", pad, rta_getattr_u32(attr[idx]));
637 } else {
638 printf("%*c", pad, '-');
639 }
640 }
641
642 static const char *txsc_stats_names[NUM_MACSEC_TXSC_STATS_ATTR] = {
643 [MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED] = "OutPktsProtected",
644 [MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED] = "OutPktsEncrypted",
645 [MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED] = "OutOctetsProtected",
646 [MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED] = "OutOctetsEncrypted",
647 };
648
649 static void print_txsc_stats(const char *prefix, struct rtattr *attr)
650 {
651 struct rtattr *stats[MACSEC_TXSC_STATS_ATTR_MAX + 1];
652 int i;
653
654 if (!attr || show_stats == 0)
655 return;
656
657 parse_rtattr_nested(stats, MACSEC_TXSC_STATS_ATTR_MAX + 1, attr);
658 printf("%sstats:", prefix);
659
660 for (i = 1; i < NUM_MACSEC_TXSC_STATS_ATTR; i++) {
661 if (!txsc_stats_names[i])
662 continue;
663 printf(" %s", txsc_stats_names[i]);
664 }
665
666 printf("\n%s ", prefix);
667
668 for (i = 1; i < NUM_MACSEC_TXSC_STATS_ATTR; i++) {
669 if (!txsc_stats_names[i])
670 continue;
671 print_one_stat(txsc_stats_names, stats, i, true);
672 }
673
674 printf("\n");
675 }
676
677 static const char *secy_stats_names[NUM_MACSEC_SECY_STATS_ATTR] = {
678 [MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED] = "OutPktsUntagged",
679 [MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED] = "InPktsUntagged",
680 [MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG] = "OutPktsTooLong",
681 [MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG] = "InPktsNoTag",
682 [MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG] = "InPktsBadTag",
683 [MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI] = "InPktsUnknownSCI",
684 [MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI] = "InPktsNoSCI",
685 [MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN] = "InPktsOverrun",
686 };
687
688 static void print_secy_stats(const char *prefix, struct rtattr *attr)
689 {
690 struct rtattr *stats[MACSEC_SECY_STATS_ATTR_MAX + 1];
691 int i;
692
693 if (!attr || show_stats == 0)
694 return;
695
696 parse_rtattr_nested(stats, MACSEC_SECY_STATS_ATTR_MAX + 1, attr);
697 printf("%sstats:", prefix);
698
699 for (i = 1; i < NUM_MACSEC_SECY_STATS_ATTR; i++) {
700 if (!secy_stats_names[i])
701 continue;
702 printf(" %s", secy_stats_names[i]);
703 }
704
705 printf("\n%s ", prefix);
706
707 for (i = 1; i < NUM_MACSEC_SECY_STATS_ATTR; i++) {
708 if (!secy_stats_names[i])
709 continue;
710 print_one_stat(secy_stats_names, stats, i, true);
711 }
712
713 printf("\n");
714 }
715
716 static const char *rxsa_stats_names[NUM_MACSEC_SA_STATS_ATTR] = {
717 [MACSEC_SA_STATS_ATTR_IN_PKTS_OK] = "InPktsOK",
718 [MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID] = "InPktsInvalid",
719 [MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID] = "InPktsNotValid",
720 [MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA] = "InPktsNotUsingSA",
721 [MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA] = "InPktsUnusedSA",
722 };
723
724 static void print_rxsa_stats(const char *prefix, struct rtattr *attr)
725 {
726 struct rtattr *stats[MACSEC_SA_STATS_ATTR_MAX + 1];
727 int i;
728
729 if (!attr || show_stats == 0)
730 return;
731
732 parse_rtattr_nested(stats, MACSEC_SA_STATS_ATTR_MAX + 1, attr);
733 printf("%s%s ", prefix, prefix);
734
735 for (i = 1; i < NUM_MACSEC_SA_STATS_ATTR; i++) {
736 if (!rxsa_stats_names[i])
737 continue;
738 printf(" %s", rxsa_stats_names[i]);
739 }
740
741 printf("\n%s%s ", prefix, prefix);
742
743 for (i = 1; i < NUM_MACSEC_SA_STATS_ATTR; i++) {
744 if (!rxsa_stats_names[i])
745 continue;
746 print_one_stat(rxsa_stats_names, stats, i, false);
747 }
748
749 printf("\n");
750 }
751
752 static const char *txsa_stats_names[NUM_MACSEC_SA_STATS_ATTR] = {
753 [MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED] = "OutPktsProtected",
754 [MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED] = "OutPktsEncrypted",
755 };
756
757 static void print_txsa_stats(const char *prefix, struct rtattr *attr)
758 {
759 struct rtattr *stats[MACSEC_SA_STATS_ATTR_MAX + 1];
760
761 if (!attr || show_stats == 0)
762 return;
763
764 parse_rtattr_nested(stats, MACSEC_SA_STATS_ATTR_MAX + 1, attr);
765 printf("%s%s %s %s\n", prefix, prefix,
766 txsa_stats_names[MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED],
767 txsa_stats_names[MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED]);
768 printf("%s%s ", prefix, prefix);
769
770 print_one_stat(txsa_stats_names, stats,
771 MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED, false);
772 print_one_stat(txsa_stats_names, stats,
773 MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED, false);
774 printf("\n");
775 }
776
777 static void print_tx_sc(const char *prefix, __u64 sci, __u8 encoding_sa,
778 struct rtattr *txsc_stats, struct rtattr *secy_stats,
779 struct rtattr *sa)
780 {
781 struct rtattr *sa_attr[MACSEC_SA_ATTR_MAX + 1];
782 struct rtattr *a;
783 int rem;
784
785 printf("%sTXSC: %016llx on SA %d\n", prefix, ntohll(sci), encoding_sa);
786 print_secy_stats(prefix, secy_stats);
787 print_txsc_stats(prefix, txsc_stats);
788
789 rem = RTA_PAYLOAD(sa);
790 for (a = RTA_DATA(sa); RTA_OK(a, rem); a = RTA_NEXT(a, rem)) {
791 SPRINT_BUF(keyid);
792 bool state;
793
794 parse_rtattr_nested(sa_attr, MACSEC_SA_ATTR_MAX + 1, a);
795 state = rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_ACTIVE]);
796 printf("%s%s%d: PN %u, state %s, key %s\n", prefix, prefix,
797 rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_AN]),
798 rta_getattr_u32(sa_attr[MACSEC_SA_ATTR_PN]),
799 values_on_off[state],
800 hexstring_n2a(RTA_DATA(sa_attr[MACSEC_SA_ATTR_KEYID]),
801 RTA_PAYLOAD(sa_attr[MACSEC_SA_ATTR_KEYID]),
802 keyid, sizeof(keyid)));
803 print_txsa_stats(prefix, sa_attr[MACSEC_SA_ATTR_STATS]);
804 }
805 }
806
807 static const char *rxsc_stats_names[NUM_MACSEC_RXSC_STATS_ATTR] = {
808 [MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED] = "InOctetsValidated",
809 [MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED] = "InOctetsDecrypted",
810 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED] = "InPktsUnchecked",
811 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED] = "InPktsDelayed",
812 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK] = "InPktsOK",
813 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID] = "InPktsInvalid",
814 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE] = "InPktsLate",
815 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID] = "InPktsNotValid",
816 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA] = "InPktsNotUsingSA",
817 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA] = "InPktsUnusedSA",
818 };
819
820 static void print_rxsc_stats(const char *prefix, struct rtattr *attr)
821 {
822 struct rtattr *stats[MACSEC_RXSC_STATS_ATTR_MAX + 1];
823 int i;
824
825 if (!attr || show_stats == 0)
826 return;
827
828 parse_rtattr_nested(stats, MACSEC_RXSC_STATS_ATTR_MAX + 1, attr);
829 printf("%sstats:", prefix);
830 for (i = 1; i < NUM_MACSEC_RXSC_STATS_ATTR; i++) {
831 if (!rxsc_stats_names[i])
832 continue;
833 printf(" %s", rxsc_stats_names[i]);
834 }
835
836 printf("\n%s ", prefix);
837
838 for (i = 1; i < NUM_MACSEC_RXSC_STATS_ATTR; i++) {
839 if (!rxsc_stats_names[i])
840 continue;
841 print_one_stat(rxsc_stats_names, stats, i, true);
842 }
843
844 printf("\n");
845 }
846
847 static void print_rx_sc(const char *prefix, __u64 sci, __u8 active,
848 struct rtattr *rxsc_stats, struct rtattr *sa)
849 {
850 struct rtattr *sa_attr[MACSEC_SA_ATTR_MAX + 1];
851 struct rtattr *a;
852 int rem;
853
854 printf("%sRXSC: %016llx, state %s\n", prefix, ntohll(sci),
855 values_on_off[!!active]);
856 print_rxsc_stats(prefix, rxsc_stats);
857
858 rem = RTA_PAYLOAD(sa);
859 for (a = RTA_DATA(sa); RTA_OK(a, rem); a = RTA_NEXT(a, rem)) {
860 SPRINT_BUF(keyid);
861 bool state;
862
863 parse_rtattr_nested(sa_attr, MACSEC_SA_ATTR_MAX + 1, a);
864 state = rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_ACTIVE]);
865 printf("%s%s%d: PN %u, state %s, key %s\n", prefix, prefix,
866 rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_AN]),
867 rta_getattr_u32(sa_attr[MACSEC_SA_ATTR_PN]),
868 values_on_off[state],
869 hexstring_n2a(RTA_DATA(sa_attr[MACSEC_SA_ATTR_KEYID]),
870 RTA_PAYLOAD(sa_attr[MACSEC_SA_ATTR_KEYID]),
871 keyid, sizeof(keyid)));
872 print_rxsa_stats(prefix, sa_attr[MACSEC_SA_ATTR_STATS]);
873 }
874 }
875
876 static int process(const struct sockaddr_nl *who, struct nlmsghdr *n,
877 void *arg)
878 {
879 struct genlmsghdr *ghdr;
880 struct rtattr *attrs[MACSEC_ATTR_MAX + 1], *sc, *c;
881 struct rtattr *attrs_secy[MACSEC_SECY_ATTR_MAX + 1];
882 int len = n->nlmsg_len;
883 int ifindex;
884 __u64 sci;
885 __u8 encoding_sa;
886 int rem;
887
888 if (n->nlmsg_type != genl_family)
889 return -1;
890
891 len -= NLMSG_LENGTH(GENL_HDRLEN);
892 if (len < 0)
893 return -1;
894
895 ghdr = NLMSG_DATA(n);
896 if (ghdr->cmd != MACSEC_CMD_GET_TXSC)
897 return 0;
898
899 parse_rtattr(attrs, MACSEC_ATTR_MAX, (void *) ghdr + GENL_HDRLEN, len);
900 if (!validate_dump(attrs)) {
901 printf("incomplete dump message\n");
902 return -1;
903 }
904
905 ifindex = rta_getattr_u32(attrs[MACSEC_ATTR_IFINDEX]);
906 parse_rtattr_nested(attrs_secy, MACSEC_SECY_ATTR_MAX + 1,
907 attrs[MACSEC_ATTR_SECY]);
908
909 if (!validate_secy_dump(attrs_secy)) {
910 printf("incomplete dump message\n");
911 return -1;
912 }
913
914 sci = rta_getattr_u64(attrs_secy[MACSEC_SECY_ATTR_SCI]);
915 encoding_sa = rta_getattr_u8(attrs_secy[MACSEC_SECY_ATTR_ENCODING_SA]);
916
917 if (filter.ifindex && ifindex != filter.ifindex)
918 return 0;
919
920 if (filter.sci && sci != filter.sci)
921 return 0;
922
923 printf("%d: %s: ", ifindex, ll_index_to_name(ifindex));
924 print_attrs(" ", attrs_secy);
925
926 print_tx_sc(" ", sci, encoding_sa,
927 attrs[MACSEC_ATTR_TXSC_STATS],
928 attrs[MACSEC_ATTR_SECY_STATS],
929 attrs[MACSEC_ATTR_TXSA_LIST]);
930
931 if (!attrs[MACSEC_ATTR_RXSC_LIST])
932 return 0;
933
934 sc = attrs[MACSEC_ATTR_RXSC_LIST];
935 rem = RTA_PAYLOAD(sc);
936 for (c = RTA_DATA(sc); RTA_OK(c, rem); c = RTA_NEXT(c, rem)) {
937 struct rtattr *sc_attr[MACSEC_RXSC_ATTR_MAX + 1];
938
939 parse_rtattr_nested(sc_attr, MACSEC_RXSC_ATTR_MAX + 1, c);
940 print_rx_sc(" ",
941 rta_getattr_u64(sc_attr[MACSEC_RXSC_ATTR_SCI]),
942 rta_getattr_u32(sc_attr[MACSEC_RXSC_ATTR_ACTIVE]),
943 sc_attr[MACSEC_RXSC_ATTR_STATS],
944 sc_attr[MACSEC_RXSC_ATTR_SA_LIST]);
945 }
946
947 return 0;
948 }
949
950 static int do_dump(int ifindex)
951 {
952 MACSEC_GENL_REQ(req, MACSEC_BUFLEN, MACSEC_CMD_GET_TXSC,
953 NLM_F_REQUEST | NLM_F_DUMP);
954
955 memset(&filter, 0, sizeof(filter));
956 filter.ifindex = ifindex;
957
958 req.n.nlmsg_seq = genl_rth.dump = ++genl_rth.seq;
959 if (rtnl_send(&genl_rth, &req, req.n.nlmsg_len) < 0) {
960 perror("Failed to send dump request");
961 exit(1);
962 }
963
964 if (rtnl_dump_filter(&genl_rth, process, stdout) < 0) {
965 fprintf(stderr, "Dump terminated\n");
966 exit(1);
967 }
968
969 return 0;
970 }
971
972 static int do_show(int argc, char **argv)
973 {
974 int ifindex;
975
976 if (argc == 0)
977 return do_dump(0);
978
979 ifindex = ll_name_to_index(*argv);
980 if (ifindex == 0) {
981 fprintf(stderr, "Device \"%s\" does not exist.\n", *argv);
982 return -1;
983 }
984
985 argc--, argv++;
986 if (argc == 0)
987 return do_dump(ifindex);
988
989 ipmacsec_usage();
990 return -1;
991 }
992
993 int do_ipmacsec(int argc, char **argv)
994 {
995 if (argc < 1)
996 ipmacsec_usage();
997
998 if (matches(*argv, "help") == 0)
999 ipmacsec_usage();
1000
1001 if (genl_init_handle(&genl_rth, MACSEC_GENL_NAME, &genl_family))
1002 exit(1);
1003
1004 if (matches(*argv, "show") == 0)
1005 return do_show(argc-1, argv+1);
1006
1007 if (matches(*argv, "add") == 0)
1008 return do_modify(CMD_ADD, argc-1, argv+1);
1009 if (matches(*argv, "set") == 0)
1010 return do_modify(CMD_UPD, argc-1, argv+1);
1011 if (matches(*argv, "delete") == 0)
1012 return do_modify(CMD_DEL, argc-1, argv+1);
1013
1014 fprintf(stderr, "Command \"%s\" is unknown, try \"ip macsec help\".\n",
1015 *argv);
1016 exit(-1);
1017 }
1018
1019 /* device creation */
1020 static void macsec_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
1021 {
1022 if (!tb)
1023 return;
1024
1025 if (tb[IFLA_MACSEC_SCI]) {
1026 if (is_json_context()) {
1027 SPRINT_BUF(b1);
1028
1029 snprintf(b1, sizeof(b1), "%016llx",
1030 ntohll(rta_getattr_u64(tb[IFLA_MACSEC_SCI])));
1031 print_string(PRINT_JSON, "sci", NULL, b1);
1032 } else {
1033 fprintf(f, "sci %016llx ",
1034 ntohll(rta_getattr_u64(tb[IFLA_MACSEC_SCI])));
1035 }
1036 }
1037
1038 print_flag(f, tb, "protect", IFLA_MACSEC_PROTECT);
1039
1040 if (tb[IFLA_MACSEC_CIPHER_SUITE]) {
1041 __u64 csid = rta_getattr_u64(tb[IFLA_MACSEC_CIPHER_SUITE]);
1042
1043 print_string(PRINT_ANY,
1044 "cipher_suite",
1045 "cipher %s ",
1046 cs_id_to_name(csid));
1047 }
1048
1049 if (tb[IFLA_MACSEC_ICV_LEN]) {
1050 if (is_json_context()) {
1051 char b2[4];
1052
1053 snprintf(b2, sizeof(b2), "%hhu",
1054 rta_getattr_u8(tb[IFLA_MACSEC_ICV_LEN]));
1055 print_uint(PRINT_JSON, "icv_len", NULL, atoi(b2));
1056 } else {
1057 fprintf(f, "icvlen %hhu ",
1058 rta_getattr_u8(tb[IFLA_MACSEC_ICV_LEN]));
1059 }
1060 }
1061
1062 if (tb[IFLA_MACSEC_ENCODING_SA]) {
1063 if (is_json_context()) {
1064 char b2[4];
1065
1066 snprintf(b2, sizeof(b2), "%hhu",
1067 rta_getattr_u8(tb[IFLA_MACSEC_ENCODING_SA]));
1068 print_uint(PRINT_JSON, "encoding_sa", NULL, atoi(b2));
1069 } else {
1070 fprintf(f, "encodingsa %hhu ",
1071 rta_getattr_u8(tb[IFLA_MACSEC_ENCODING_SA]));
1072 }
1073 }
1074
1075 if (tb[IFLA_MACSEC_VALIDATION]) {
1076 __u8 val = rta_getattr_u8(tb[IFLA_MACSEC_VALIDATION]);
1077
1078 print_string(PRINT_ANY,
1079 "validation",
1080 "validate %s ",
1081 validate_str[val]);
1082 }
1083
1084 const char *inc_sci, *es, *replay;
1085
1086 if (is_json_context()) {
1087 inc_sci = "inc_sci";
1088 replay = "replay_protect";
1089 es = "es";
1090 } else {
1091 inc_sci = "send_sci";
1092 es = "end_station";
1093 replay = "replay";
1094 }
1095
1096 print_flag(f, tb, "encrypt", IFLA_MACSEC_ENCRYPT);
1097 print_flag(f, tb, inc_sci, IFLA_MACSEC_INC_SCI);
1098 print_flag(f, tb, es, IFLA_MACSEC_ES);
1099 print_flag(f, tb, "scb", IFLA_MACSEC_SCB);
1100 print_flag(f, tb, replay, IFLA_MACSEC_REPLAY_PROTECT);
1101
1102 if (tb[IFLA_MACSEC_WINDOW])
1103 print_int(PRINT_ANY,
1104 "window",
1105 "window %d ",
1106 rta_getattr_u32(tb[IFLA_MACSEC_WINDOW]));
1107 }
1108
1109 static bool check_txsc_flags(bool es, bool scb, bool sci)
1110 {
1111 if (sci && (es || scb))
1112 return false;
1113 if (es && scb)
1114 return false;
1115 return true;
1116 }
1117
1118 static void usage(FILE *f)
1119 {
1120 fprintf(f,
1121 "Usage: ... macsec [ [ address <lladdr> ] port { 1..2^16-1 } | sci <u64> ]\n"
1122 " [ cipher { default | gcm-aes-128 } ]\n"
1123 " [ icvlen { 8..16 } ]\n"
1124 " [ encrypt { on | off } ]\n"
1125 " [ send_sci { on | off } ]\n"
1126 " [ end_station { on | off } ]\n"
1127 " [ scb { on | off } ]\n"
1128 " [ protect { on | off } ]\n"
1129 " [ replay { on | off} window { 0..2^32-1 } ]\n"
1130 " [ validate { strict | check | disabled } ]\n"
1131 " [ encodingsa { 0..3 } ]\n"
1132 );
1133 }
1134
1135 static int macsec_parse_opt(struct link_util *lu, int argc, char **argv,
1136 struct nlmsghdr *n)
1137 {
1138 int ret;
1139 __u8 encoding_sa = 0xff;
1140 __u32 window = -1;
1141 struct cipher_args cipher = {0};
1142 enum macsec_validation_type validate;
1143 bool es = false, scb = false, send_sci = false;
1144 int replay_protect = -1;
1145 struct sci sci = { 0 };
1146
1147 ret = get_sci_portaddr(&sci, &argc, &argv, true, true);
1148 if (ret < 0) {
1149 fprintf(stderr, "expected sci\n");
1150 return -1;
1151 }
1152
1153 if (ret > 0) {
1154 if (sci.sci)
1155 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_SCI,
1156 &sci.sci, sizeof(sci.sci));
1157 else
1158 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_PORT,
1159 &sci.port, sizeof(sci.port));
1160 }
1161
1162 while (argc > 0) {
1163 if (strcmp(*argv, "cipher") == 0) {
1164 NEXT_ARG();
1165 if (cipher.id)
1166 duparg("cipher", *argv);
1167 if (strcmp(*argv, "default") == 0 ||
1168 strcmp(*argv, "gcm-aes-128") == 0 ||
1169 strcmp(*argv, "GCM-AES-128") == 0)
1170 cipher.id = MACSEC_DEFAULT_CIPHER_ID;
1171 else
1172 invarg("expected: default or gcm-aes-128",
1173 *argv);
1174 } else if (strcmp(*argv, "icvlen") == 0) {
1175 NEXT_ARG();
1176 if (cipher.icv_len)
1177 duparg("icvlen", *argv);
1178 get_icvlen(&cipher.icv_len, *argv);
1179 } else if (strcmp(*argv, "encrypt") == 0) {
1180 NEXT_ARG();
1181 int i;
1182
1183 ret = one_of("encrypt", *argv, values_on_off,
1184 ARRAY_SIZE(values_on_off), &i);
1185 if (ret != 0)
1186 return ret;
1187 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_ENCRYPT, i);
1188 } else if (strcmp(*argv, "send_sci") == 0) {
1189 NEXT_ARG();
1190 int i;
1191
1192 ret = one_of("send_sci", *argv, values_on_off,
1193 ARRAY_SIZE(values_on_off), &i);
1194 if (ret != 0)
1195 return ret;
1196 send_sci = i;
1197 addattr8(n, MACSEC_BUFLEN,
1198 IFLA_MACSEC_INC_SCI, send_sci);
1199 } else if (strcmp(*argv, "end_station") == 0) {
1200 NEXT_ARG();
1201 int i;
1202
1203 ret = one_of("end_station", *argv, values_on_off,
1204 ARRAY_SIZE(values_on_off), &i);
1205 if (ret != 0)
1206 return ret;
1207 es = i;
1208 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_ES, es);
1209 } else if (strcmp(*argv, "scb") == 0) {
1210 NEXT_ARG();
1211 int i;
1212
1213 ret = one_of("scb", *argv, values_on_off,
1214 ARRAY_SIZE(values_on_off), &i);
1215 if (ret != 0)
1216 return ret;
1217 scb = i;
1218 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_SCB, scb);
1219 } else if (strcmp(*argv, "protect") == 0) {
1220 NEXT_ARG();
1221 int i;
1222
1223 ret = one_of("protect", *argv, values_on_off,
1224 ARRAY_SIZE(values_on_off), &i);
1225 if (ret != 0)
1226 return ret;
1227 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_PROTECT, i);
1228 } else if (strcmp(*argv, "replay") == 0) {
1229 NEXT_ARG();
1230 int i;
1231
1232 ret = one_of("replay", *argv, values_on_off,
1233 ARRAY_SIZE(values_on_off), &i);
1234 if (ret != 0)
1235 return ret;
1236 replay_protect = !!i;
1237 } else if (strcmp(*argv, "window") == 0) {
1238 NEXT_ARG();
1239 ret = get_u32(&window, *argv, 0);
1240 if (ret)
1241 invarg("expected replay window size", *argv);
1242 } else if (strcmp(*argv, "validate") == 0) {
1243 NEXT_ARG();
1244 ret = one_of("validate", *argv,
1245 validate_str, ARRAY_SIZE(validate_str),
1246 (int *)&validate);
1247 if (ret != 0)
1248 return ret;
1249 addattr8(n, MACSEC_BUFLEN,
1250 IFLA_MACSEC_VALIDATION, validate);
1251 } else if (strcmp(*argv, "encodingsa") == 0) {
1252 if (encoding_sa != 0xff)
1253 duparg2("encodingsa", "encodingsa");
1254 NEXT_ARG();
1255 ret = get_an(&encoding_sa, *argv);
1256 if (ret)
1257 invarg("expected an { 0..3 }", *argv);
1258 } else {
1259 fprintf(stderr, "macsec: unknown command \"%s\"?\n",
1260 *argv);
1261 usage(stderr);
1262 return -1;
1263 }
1264
1265 argv++; argc--;
1266 }
1267
1268 if (!check_txsc_flags(es, scb, send_sci)) {
1269 fprintf(stderr,
1270 "invalid combination of send_sci/end_station/scb\n");
1271 return -1;
1272 }
1273
1274 if (window != -1 && replay_protect == -1) {
1275 fprintf(stderr,
1276 "replay window set, but replay protection not enabled. did you mean 'replay on window %u'?\n",
1277 window);
1278 return -1;
1279 } else if (window == -1 && replay_protect == 1) {
1280 fprintf(stderr,
1281 "replay protection enabled, but no window set. did you mean 'replay on window VALUE'?\n");
1282 return -1;
1283 }
1284
1285 if (cipher.id)
1286 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_CIPHER_SUITE,
1287 &cipher.id, sizeof(cipher.id));
1288 if (cipher.icv_len)
1289 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_ICV_LEN,
1290 &cipher.icv_len, sizeof(cipher.icv_len));
1291
1292 if (replay_protect != -1) {
1293 addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window);
1294 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_REPLAY_PROTECT,
1295 replay_protect);
1296 }
1297
1298 if (encoding_sa != 0xff) {
1299 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_ENCODING_SA,
1300 &encoding_sa, sizeof(encoding_sa));
1301 }
1302
1303 return 0;
1304 }
1305
1306 static void macsec_print_help(struct link_util *lu, int argc, char **argv,
1307 FILE *f)
1308 {
1309 usage(f);
1310 }
1311
1312 struct link_util macsec_link_util = {
1313 .id = "macsec",
1314 .maxattr = IFLA_MACSEC_MAX,
1315 .parse_opt = macsec_parse_opt,
1316 .print_help = macsec_print_help,
1317 .print_opt = macsec_print_opt,
1318 };
Upstream mirror of iproute2