man/man8/ip-macsec.8

   1 .TH IP\-MACSEC 8 "07 Mar 2016" "iproute" "Linux"
   2 .SH NAME
   3 ip-macsec \- MACsec device configuration
   4 .SH "SYNOPSIS"
   5 .BI "ip link add link " DEVICE " name " NAME " type macsec "
   6 [ [
   7 .BI address " <lladdr>"
   8 ]
   9 .BI port " PORT"
  10 |
  11 .BI sci " <u64>"
  12 ] [
  13 .BR cipher " { " default " | " gcm-aes-128 " | "gcm-aes-256" } ] ["
  14 .BI icvlen " ICVLEN"
  15 ] [
  16 .BR encrypt " { " on " | " off " } ] ["
  17 .BR send_sci " { " on " | " off " } ] ["
  18 .BR end_station " { " on " | " off " } ] ["
  19 .BR scb " { " on " | " off " } ] ["
  20 .BR protect " { " on " | " off " } ] ["
  21 .BR replay " { " on " | " off " } ] ["
  22 .BI window " WINDOW"
  23 ] [
  24 .BR validate " { " strict " | " check " | " disabled " } ] ["
  25 .BI encodingsa " SA"
  26 ]
  27
  28 .BI "ip macsec add " DEV " tx sa"
  29 .RI "{ " 0..3 " } [ " OPTS " ]"
  30 .BI key " ID KEY"
  31 .br
  32 .BI "ip macsec set " DEV " tx sa"
  33 .RI "{ " 0..3 " } [ " OPTS " ]"
  34 .br
  35 .BI "ip macsec del " DEV " tx sa"
  36 .RI "{ " 0..3 " }"
  37
  38 .BI "ip macsec add " DEV " rx " SCI
  39 .RB [ " on " | " off " ]
  40 .br
  41 .BI "ip macsec set " DEV " rx " SCI
  42 .RB [ " on " | " off " ]
  43 .br
  44 .BI "ip macsec del " DEV " rx " SCI
  45
  46 .BI "ip macsec add " DEV " rx " SCI " sa"
  47 .RI "{ " 0..3 " } [ " OPTS " ]"
  48 .BI key " ID KEY"
  49 .br
  50 .BI "ip macsec set " DEV " rx " SCI " sa"
  51 .RI "{ " 0..3 " } [ " OPTS " ]"
  52 .br
  53 .BI "ip macsec del " DEV " rx " SCI " sa"
  54 .RI "{ " 0..3 " }"
  55
  56 .BI "ip macsec offload " DEV
  57 .RB "{ " off " | " phy " }"
  58
  59 .B ip macsec show
  60 .RI [ " DEV " ]
  61
  62 .IR OPTS " := [ "
  63 .BR pn " { "
  64 .IR 1..2^32-1 " } ] ["
  65 .BR on " | " off " ]"
  66 .br
  67 .IR SCI " := { "
  68 .B sci
  69 .IR <u64> " | "
  70 .BI port
  71 .IR PORT
  72 .BI address " <lladdr> "
  73 }
  74 .br
  75 .IR PORT " := { " 1..2^16-1 " } "
  76
  77
  78 .SH DESCRIPTION
  79 The
  80 .B ip macsec
  81 commands are used to configure transmit secure associations and receive secure channels and their secure associations on a MACsec device created with the
  82 .B ip link add
  83 command using the
  84 .I macsec
  85 type.
  86
  87 .SH EXAMPLES
  88 .PP
  89 .SS Create a MACsec device on link eth0
  90 .nf
  91 # ip link add link eth0 macsec0 type macsec port 11 encrypt on
  92 .PP
  93 .SS Configure a secure association on that device
  94 .nf
  95 # ip macsec add macsec0 tx sa 0 pn 1024 on key 01 81818181818181818181818181818181
  96 .PP
  97 .SS Configure a receive channel
  98 .nf
  99 # ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0
 100 .PP
 101 .SS Configure a receive association
 102 .nf
 103 # ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0 sa 0 pn 1 on key 00 82828282828282828282828282828282
 104 .PP
 105 .SS Display MACsec configuration
 106 .nf
 107 # ip macsec show
 108 .PP
 109 .SS Configure offloading on an interface
 110 .nf
 111 # ip macsec offload macsec0 phy
 112
 113 .SH NOTES
 114 This tool can be used to configure the 802.1AE keys of the interface. Note that 802.1AE uses GCM-AES
 115 with a initialization vector (IV) derived from the packet number. The same key must not be used
 116 with the same IV more than once. Instead, keys must be frequently regenerated and distibuted.
 117 This tool is thus mostly for debugging and testing, or in combination with a user-space application
 118 that reconfigures the keys. It is wrong to just configure the keys statically and assume them to work
 119 indefinitely. The suggested and standardized way for key management is 802.1X-2010, which is implemented
 120 by wpa_supplicant.
 121
 122 .SH SEE ALSO
 123 .br
 124 .BR ip-link (8)
 125 .BR wpa_supplicant (8)
 126 .SH AUTHOR
 127 Sabrina Dubroca <sd@queasysnail.net>