]> git.proxmox.com Git - mirror_iproute2.git/blame - ip/ipmacsec.c
projects / mirror_iproute2.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
rdma: Move resource QP logic to separate file
[mirror_iproute2.git] / ip / ipmacsec.c
CommitLineData
b26fc590
SD		 1/*
2 * ipmacsec.c "ip macsec".
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version
7 * 2 of the License, or (at your option) any later version.
8 *
9 * Authors: Sabrina Dubroca <sd@queasysnail.net>
10 */
11
12#include <stdio.h>
13#include <stdlib.h>
14#include <string.h>
15#include <errno.h>
16#include <linux/genetlink.h>
17#include <linux/if_ether.h>
18#include <linux/if_macsec.h>
19
20#include "rt_names.h"
21#include "utils.h"
22#include "ip_common.h"
23#include "ll_map.h"
24#include "libgenl.h"
25
c2f260f4 26static const char * const values_on_off[] = { "off", "on" };
b26fc590 27
c2f260f4 28static const char * const validate_str[] = {
b26fc590
SD		 29 [MACSEC_VALIDATE_DISABLED] = "disabled",
30 [MACSEC_VALIDATE_CHECK] = "check",
31 [MACSEC_VALIDATE_STRICT] = "strict",
32};
33
34struct sci {
35 __u64 sci;
36 __u16 port;
37 char abuf[6];
38};
39
40struct sa_desc {
41 __u8 an;
42 __u32 pn;
43 __u8 key_id[MACSEC_KEYID_LEN];
44 __u32 key_len;
45 __u8 key[MACSEC_MAX_KEY_LEN];
46 __u8 active;
47};
48
49struct cipher_args {
50 __u64 id;
51 __u8 icv_len;
52};
53
54struct txsc_desc {
55 int ifindex;
56 __u64 sci;
57 __be16 port;
58 struct cipher_args cipher;
59 __u32 window;
60 enum macsec_validation_type validate;
61 __u8 encoding_sa;
62};
63
64struct rxsc_desc {
65 int ifindex;
66 __u64 sci;
67 __u8 active;
68};
69
70#define MACSEC_BUFLEN 1024
71
72
73/* netlink socket */
74static struct rtnl_handle genl_rth;
75static int genl_family = -1;
76
77#define MACSEC_GENL_REQ(_req, _bufsiz, _cmd, _flags) \
78 GENL_REQUEST(_req, _bufsiz, genl_family, 0, MACSEC_GENL_VERSION, \
79 _cmd, _flags)
80
81
b26fc590
SD		 82static void ipmacsec_usage(void)
83{
c2f260f4
SH		 84 fprintf(stderr,
85 "Usage: ip macsec add DEV tx sa { 0..3 } [ OPTS ] key ID KEY\n"
86 " ip macsec set DEV tx sa { 0..3 } [ OPTS ]\n"
87 " ip macsec del DEV tx sa { 0..3 }\n"
88 " ip macsec add DEV rx SCI [ on | off ]\n"
89 " ip macsec set DEV rx SCI [ on | off ]\n"
90 " ip macsec del DEV rx SCI\n"
91 " ip macsec add DEV rx SCI sa { 0..3 } [ OPTS ] key ID KEY\n"
92 " ip macsec set DEV rx SCI sa { 0..3 } [ OPTS ]\n"
93 " ip macsec del DEV rx SCI sa { 0..3 }\n"
94 " ip macsec show\n"
95 " ip macsec show DEV\n"
96 "where OPTS := [ pn <u32> ] [ on | off ]\n"
97 " ID := 128-bit hex string\n"
98 " KEY := 128-bit hex string\n"
99 " SCI := { sci <u64> | port { 1..2^16-1 } address <lladdr> }\n");
b26fc590
SD		 100
101 exit(-1);
102}
103
c2f260f4 104static int one_of(const char *msg, const char *realval, const char * const *list,
b26fc590
SD		 105 size_t len, int *index)
106{
107 int i;
108
109 for (i = 0; i < len; i++) {
110 if (matches(realval, list[i]) == 0) {
111 *index = i;
112 return 0;
113 }
114 }
115
116 fprintf(stderr, "Error: argument of \"%s\" must be one of ", msg);
117 for (i = 0; i < len; i++)
118 fprintf(stderr, "\"%s\", ", list[i]);
119 fprintf(stderr, "not \"%s\"\n", realval);
120 return -1;
121}
122
123static int get_an(__u8 *val, const char *arg)
124{
125 int ret = get_u8(val, arg, 0);
126
127 if (ret)
128 return ret;
129
130 if (*val > 3)
131 return -1;
132
133 return 0;
134}
135
136static int get_sci(__u64 *sci, const char *arg)
137{
0330f49e 138 return get_be64(sci, arg, 16);
b26fc590
SD		 139}
140
141static int get_port(__be16 *port, const char *arg)
142{
5898bd66 143 return get_be16(port, arg, 0);
b26fc590
SD		 144}
145
146#define _STR(a) #a
147#define STR(a) _STR(a)
148
149static void get_icvlen(__u8 *icvlen, char *arg)
150{
151 int ret = get_u8(icvlen, arg, 10);
152
153 if (ret)
154 invarg("expected ICV length", arg);
155
f20f5f79 156 if (*icvlen < MACSEC_MIN_ICV_LEN || *icvlen > MACSEC_STD_ICV_LEN)
b26fc590 157 invarg("ICV length must be in the range {"
f20f5f79 158 STR(MACSEC_MIN_ICV_LEN) ".." STR(MACSEC_STD_ICV_LEN)
b26fc590
SD		 159 "}", arg);
160}
161
162static bool get_sa(int *argcp, char ***argvp, __u8 *an)
163{
164 int argc = *argcp;
165 char **argv = *argvp;
166 int ret;
167
168 if (argc <= 0 || strcmp(*argv, "sa") != 0)
169 return false;
170
171 NEXT_ARG();
172 ret = get_an(an, *argv);
173 if (ret)
174 invarg("expected an { 0..3 }", *argv);
175 argc--; argv++;
176
177 *argvp = argv;
178 *argcp = argc;
179 return true;
180}
181
182static int parse_sa_args(int *argcp, char ***argvp, struct sa_desc *sa)
183{
184 int argc = *argcp;
185 char **argv = *argvp;
186 int ret;
187 bool active_set = false;
188
189 while (argc > 0) {
190 if (strcmp(*argv, "pn") == 0) {
191 if (sa->pn != 0)
192 duparg2("pn", "pn");
193 NEXT_ARG();
194 ret = get_u32(&sa->pn, *argv, 0);
195 if (ret)
196 invarg("expected pn", *argv);
197 if (sa->pn == 0)
198 invarg("expected pn != 0", *argv);
199 } else if (strcmp(*argv, "key") == 0) {
200 unsigned int len;
201
202 NEXT_ARG();
203 if (!hexstring_a2n(*argv, sa->key_id, MACSEC_KEYID_LEN,
204 &len))
205 invarg("expected key id", *argv);
206 NEXT_ARG();
207 if (!hexstring_a2n(*argv, sa->key, MACSEC_MAX_KEY_LEN,
208 &sa->key_len))
209 invarg("expected key", *argv);
210 } else if (strcmp(*argv, "on") == 0) {
211 if (active_set)
212 duparg2("on/off", "on");
213 sa->active = true;
214 active_set = true;
215 } else if (strcmp(*argv, "off") == 0) {
216 if (active_set)
217 duparg2("on/off", "off");
218 sa->active = false;
219 active_set = true;
220 } else {
221 fprintf(stderr, "macsec: unknown command \"%s\"?\n",
222 *argv);
223 ipmacsec_usage();
224 }
225
226 argv++; argc--;
227 }
228
229 *argvp = argv;
230 *argcp = argc;
231 return 0;
232}
233
234static __u64 make_sci(char *addr, __be16 port)
235{
236 __u64 sci;
237
238 memcpy(&sci, addr, ETH_ALEN);
239 memcpy(((char *)&sci) + ETH_ALEN, &port, sizeof(port));
240
241 return sci;
242}
243
244static bool sci_complete(bool sci, bool port, bool addr, bool port_only)
245{
246 return sci || (port && (addr || port_only));
247}
248
249static int get_sci_portaddr(struct sci *sci, int *argcp, char ***argvp,
250 bool port_only, bool optional)
251{
252 int argc = *argcp;
253 char **argv = *argvp;
254 int ret;
255 bool p = false, a = false, s = false;
256
257 while (argc > 0) {
258 if (strcmp(*argv, "sci") == 0) {
259 if (p)
260 invarg("expected address", *argv);
261 if (a)
262 invarg("expected port", *argv);
263 NEXT_ARG();
264 ret = get_sci(&sci->sci, *argv);
265 if (ret)
266 invarg("expected sci", *argv);
267 s = true;
268 } else if (strcmp(*argv, "port") == 0) {
269 NEXT_ARG();
270 ret = get_port(&sci->port, *argv);
271 if (ret)
272 invarg("expected port", *argv);
273 if (sci->port == 0)
274 invarg("expected port != 0", *argv);
275 p = true;
276 } else if (strcmp(*argv, "address") == 0) {
277 NEXT_ARG();
278 ret = ll_addr_a2n(sci->abuf, sizeof(sci->abuf), *argv);
279 if (ret < 0)
280 invarg("expected lladdr", *argv);
281 a = true;
282 } else if (optional) {
283 break;
284 } else {
285 invarg("expected sci, port, or address", *argv);
286 }
287
288 argv++; argc--;
289
290 if (sci_complete(s, p, a, port_only))
291 break;
292 }
293
294 if (!optional && !sci_complete(s, p, a, port_only))
295 return -1;
296
297 if (p && a)
298 sci->sci = make_sci(sci->abuf, sci->port);
299
300 *argvp = argv;
301 *argcp = argc;
302
303 return p || a || s;
304}
305
306static bool parse_rxsci(int *argcp, char ***argvp, struct rxsc_desc *rxsc,
307 struct sa_desc *rxsa)
308{
309 struct sci sci = { 0 };
310
311 if (*argcp == 0 ||
312 get_sci_portaddr(&sci, argcp, argvp, false, false) < 0) {
313 fprintf(stderr, "expected sci\n");
314 ipmacsec_usage();
315 }
316
317 rxsc->sci = sci.sci;
318
319 return get_sa(argcp, argvp, &rxsa->an);
320}
321
322static int parse_rxsci_args(int *argcp, char ***argvp, struct rxsc_desc *rxsc)
323{
324 int argc = *argcp;
325 char **argv = *argvp;
326 bool active_set = false;
327
328 while (argc > 0) {
329 if (strcmp(*argv, "on") == 0) {
330 if (active_set)
331 duparg2("on/off", "on");
332 rxsc->active = true;
333 active_set = true;
334 } else if (strcmp(*argv, "off") == 0) {
335 if (active_set)
336 duparg2("on/off", "off");
337 rxsc->active = false;
338 active_set = true;
339 } else {
340 fprintf(stderr, "macsec: unknown command \"%s\"?\n",
341 *argv);
342 ipmacsec_usage();
343 }
344
345 argv++; argc--;
346 }
347
348 *argvp = argv;
349 *argcp = argc;
350 return 0;
351}
352
353enum cmd {
354 CMD_ADD,
355 CMD_DEL,
356 CMD_UPD,
357 __CMD_MAX
358};
359
360static const enum macsec_nl_commands macsec_commands[__CMD_MAX][2][2] = {
361 [CMD_ADD] = {
362 [0] = {-1, MACSEC_CMD_ADD_RXSC},
363 [1] = {MACSEC_CMD_ADD_TXSA, MACSEC_CMD_ADD_RXSA},
364 },
365 [CMD_UPD] = {
366 [0] = {-1, MACSEC_CMD_UPD_RXSC},
367 [1] = {MACSEC_CMD_UPD_TXSA, MACSEC_CMD_UPD_RXSA},
368 },
369 [CMD_DEL] = {
370 [0] = {-1, MACSEC_CMD_DEL_RXSC},
371 [1] = {MACSEC_CMD_DEL_TXSA, MACSEC_CMD_DEL_RXSA},
372 },
373};
374
375static int do_modify_nl(enum cmd c, enum macsec_nl_commands cmd, int ifindex,
376 struct rxsc_desc *rxsc, struct sa_desc *sa)
377{
378 struct rtattr *attr_sa;
379
380 MACSEC_GENL_REQ(req, MACSEC_BUFLEN, cmd, NLM_F_REQUEST);
381
382 addattr32(&req.n, MACSEC_BUFLEN, MACSEC_ATTR_IFINDEX, ifindex);
383 if (rxsc) {
384 struct rtattr *attr_rxsc;
385
386 attr_rxsc = addattr_nest(&req.n, MACSEC_BUFLEN,
387 MACSEC_ATTR_RXSC_CONFIG);
388 addattr64(&req.n, MACSEC_BUFLEN,
389 MACSEC_RXSC_ATTR_SCI, rxsc->sci);
390 if (c != CMD_DEL && rxsc->active != 0xff)
391 addattr8(&req.n, MACSEC_BUFLEN,
392 MACSEC_RXSC_ATTR_ACTIVE, rxsc->active);
393
394 addattr_nest_end(&req.n, attr_rxsc);
395 }
396
397 if (sa->an == 0xff)
398 goto talk;
399
400 attr_sa = addattr_nest(&req.n, MACSEC_BUFLEN, MACSEC_ATTR_SA_CONFIG);
401
402 addattr8(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_AN, sa->an);
403
404 if (c != CMD_DEL) {
405 if (sa->pn)
406 addattr32(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_PN,
407 sa->pn);
408
409 if (sa->key_len) {
410 addattr_l(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_KEYID,
411 sa->key_id, MACSEC_KEYID_LEN);
412 addattr_l(&req.n, MACSEC_BUFLEN, MACSEC_SA_ATTR_KEY,
413 sa->key, sa->key_len);
414 }
415
416 if (sa->active != 0xff) {
417 addattr8(&req.n, MACSEC_BUFLEN,
418 MACSEC_SA_ATTR_ACTIVE, sa->active);
419 }
420 }
421
422 addattr_nest_end(&req.n, attr_sa);
423
424talk:
86bf43c7 425 if (rtnl_talk(&genl_rth, &req.n, NULL) < 0)
b26fc590
SD		 426 return -2;
427
428 return 0;
429}
430
431static bool check_sa_args(enum cmd c, struct sa_desc *sa)
432{
433 if (c == CMD_ADD) {
434 if (!sa->key_len) {
435 fprintf(stderr, "cannot create SA without key\n");
436 return -1;
437 }
438
439 if (sa->pn == 0) {
440 fprintf(stderr, "must specify a packet number != 0\n");
441 return -1;
442 }
443 } else if (c == CMD_UPD) {
444 if (sa->key_len) {
445 fprintf(stderr, "cannot change key on SA\n");
446 return -1;
447 }
448 }
449
450 return 0;
451}
452
453static int do_modify_txsa(enum cmd c, int argc, char **argv, int ifindex)
454{
455 struct sa_desc txsa = {0};
456 enum macsec_nl_commands cmd;
457
458 txsa.an = 0xff;
459 txsa.active = 0xff;
460
461 if (argc == 0 || !get_sa(&argc, &argv, &txsa.an))
462 ipmacsec_usage();
463
464 if (c == CMD_DEL)
465 goto modify;
466
467 if (parse_sa_args(&argc, &argv, &txsa))
468 return -1;
469
470 if (check_sa_args(c, &txsa))
471 return -1;
472
473modify:
474 cmd = macsec_commands[c][1][0];
475 return do_modify_nl(c, cmd, ifindex, NULL, &txsa);
476}
477
478static int do_modify_rxsci(enum cmd c, int argc, char **argv, int ifindex)
479{
480 struct rxsc_desc rxsc = {0};
481 struct sa_desc rxsa = {0};
482 bool sa_set;
483 enum macsec_nl_commands cmd;
484
485 rxsc.ifindex = ifindex;
486 rxsc.active = 0xff;
487 rxsa.an = 0xff;
488 rxsa.active = 0xff;
489
490 sa_set = parse_rxsci(&argc, &argv, &rxsc, &rxsa);
491
492 if (c == CMD_DEL)
493 goto modify;
494
495 if (sa_set && (parse_sa_args(&argc, &argv, &rxsa) ||
496 check_sa_args(c, &rxsa)))
497 return -1;
498 if (!sa_set && parse_rxsci_args(&argc, &argv, &rxsc))
499 return -1;
500
501modify:
502 cmd = macsec_commands[c][sa_set][1];
503 return do_modify_nl(c, cmd, rxsc.ifindex, &rxsc, &rxsa);
504}
505
506static int do_modify(enum cmd c, int argc, char **argv)
507{
508 int ifindex;
509
510 if (argc == 0)
511 ipmacsec_usage();
512
513 ifindex = ll_name_to_index(*argv);
514 if (!ifindex) {
515 fprintf(stderr, "Device \"%s\" does not exist.\n", *argv);
516 return -1;
517 }
518 argc--; argv++;
519
520 if (argc == 0)
521 ipmacsec_usage();
522
523 if (strcmp(*argv, "tx") == 0)
524 return do_modify_txsa(c, argc-1, argv+1, ifindex);
525 if (strcmp(*argv, "rx") == 0)
526 return do_modify_rxsci(c, argc-1, argv+1, ifindex);
527
528 ipmacsec_usage();
529 return -1;
530}
531
532/* dump/show */
533static struct {
534 int ifindex;
535 __u64 sci;
536} filter;
537
538static int validate_dump(struct rtattr **attrs)
539{
540 return attrs[MACSEC_ATTR_IFINDEX] && attrs[MACSEC_ATTR_SECY] &&
541 attrs[MACSEC_ATTR_TXSA_LIST] && attrs[MACSEC_ATTR_RXSC_LIST] &&
542 attrs[MACSEC_ATTR_TXSC_STATS] && attrs[MACSEC_ATTR_SECY_STATS];
543
544}
545
546static int validate_secy_dump(struct rtattr **attrs)
547{
548 return attrs[MACSEC_SECY_ATTR_SCI] &&
549 attrs[MACSEC_SECY_ATTR_ENCODING_SA] &&
550 attrs[MACSEC_SECY_ATTR_CIPHER_SUITE] &&
551 attrs[MACSEC_SECY_ATTR_ICV_LEN] &&
552 attrs[MACSEC_SECY_ATTR_PROTECT] &&
553 attrs[MACSEC_SECY_ATTR_REPLAY] &&
554 attrs[MACSEC_SECY_ATTR_OPER] &&
555 attrs[MACSEC_SECY_ATTR_VALIDATE] &&
556 attrs[MACSEC_SECY_ATTR_ENCRYPT] &&
557 attrs[MACSEC_SECY_ATTR_INC_SCI] &&
558 attrs[MACSEC_SECY_ATTR_ES] &&
559 attrs[MACSEC_SECY_ATTR_SCB];
560}
561
c0b904de 562static void print_flag(struct rtattr *attrs[], const char *desc,
b26fc590
SD		 563 int field)
564{
c0b904de 565 __u8 flag;
c3398346 566
c0b904de
SH		 567 if (!attrs[field])
568 return;
569
570 flag = rta_getattr_u8(attrs[field]);
571 if (is_json_context())
572 print_bool(PRINT_JSON, desc, NULL, flag);
573 else {
574 print_string(PRINT_FP, NULL, "%s ", desc);
575 print_string(PRINT_FP, NULL, "%s ",
576 flag ? "on" : "off");
c3398346 577 }
b26fc590
SD		 578}
579
c0b904de
SH		 580static void print_key(struct rtattr *key)
581{
582 SPRINT_BUF(keyid);
583
584 print_string(PRINT_ANY, "key", " key %s\n",
585 hexstring_n2a(RTA_DATA(key), RTA_PAYLOAD(key),
586 keyid, sizeof(keyid)));
587}
588
b26fc590
SD		 589#define DEFAULT_CIPHER_NAME "GCM-AES-128"
590
591static const char *cs_id_to_name(__u64 cid)
592{
593 switch (cid) {
594 case MACSEC_DEFAULT_CIPHER_ID:
595 case MACSEC_DEFAULT_CIPHER_ALT:
596 return DEFAULT_CIPHER_NAME;
597 default:
598 return "(unknown)";
599 }
600}
601
c0b904de 602static void print_attrs(struct rtattr *attrs[])
b26fc590 603{
c0b904de 604 print_flag(attrs, "protect", MACSEC_SECY_ATTR_PROTECT);
b26fc590
SD		 605
606 if (attrs[MACSEC_SECY_ATTR_VALIDATE]) {
607 __u8 val = rta_getattr_u8(attrs[MACSEC_SECY_ATTR_VALIDATE]);
608
c0b904de
SH		 609 print_string(PRINT_ANY, "validate",
610 "validate %s ", validate_str[val]);
b26fc590
SD		 611 }
612
c0b904de
SH		 613 print_flag(attrs, "sc", MACSEC_RXSC_ATTR_ACTIVE);
614 print_flag(attrs, "sa", MACSEC_SA_ATTR_ACTIVE);
615 print_flag(attrs, "encrypt", MACSEC_SECY_ATTR_ENCRYPT);
616 print_flag(attrs, "send_sci", MACSEC_SECY_ATTR_INC_SCI);
617 print_flag(attrs, "end_station", MACSEC_SECY_ATTR_ES);
618 print_flag(attrs, "scb", MACSEC_SECY_ATTR_SCB);
619 print_flag(attrs, "replay", MACSEC_SECY_ATTR_REPLAY);
b26fc590 620
b26fc590 621 if (attrs[MACSEC_SECY_ATTR_WINDOW]) {
c0b904de
SH		 622 __u32 win = rta_getattr_u32(attrs[MACSEC_SECY_ATTR_WINDOW]);
623
624 print_uint(PRINT_ANY, "window", "window %u ", win);
b26fc590
SD		 625 }
626
c0b904de
SH		 627 if (attrs[MACSEC_SECY_ATTR_CIPHER_SUITE]) {
628 __u64 cid = rta_getattr_u64(attrs[MACSEC_SECY_ATTR_CIPHER_SUITE]);
629
b85076cd 630 print_nl();
c0b904de
SH		 631 print_string(PRINT_ANY, "cipher_suite",
632 " cipher suite: %s,", cs_id_to_name(cid));
b26fc590
SD		 633 }
634
c0b904de
SH		 635 if (attrs[MACSEC_SECY_ATTR_ICV_LEN]) {
636 __u8 icv_len = rta_getattr_u8(attrs[MACSEC_SECY_ATTR_ICV_LEN]);
637
638 print_uint(PRINT_ANY, "icv_length",
639 " using ICV length %u\n", icv_len);
640 }
b26fc590
SD		 641}
642
79940533 643static __u64 getattr_u64(const struct rtattr *stat)
d3418638 644{
79940533
SH		 645 size_t len = RTA_PAYLOAD(stat);
646
647 switch (len) {
d3418638
SH		 648 case sizeof(__u64):
649 return rta_getattr_u64(stat);
650 case sizeof(__u32):
651 return rta_getattr_u32(stat);
652 case sizeof(__u16):
653 return rta_getattr_u16(stat);
654 case sizeof(__u8):
655 return rta_getattr_u8(stat);
656 default:
79940533
SH		 657 fprintf(stderr, "invalid attribute length %zu\n",
658 len);
d3418638
SH		 659 exit(-1);
660 }
661}
662
c0b904de
SH		 663static void print_fp_stats(const char *prefix,
664 const char *names[], unsigned int num,
665 struct rtattr *stats[])
b26fc590 666{
d3418638
SH		 667 unsigned int i;
668 int pad;
b26fc590 669
d3418638
SH		 670 printf("%sstats:", prefix);
671
672 for (i = 1; i < num; i++) {
673 if (!names[i])
674 continue;
675 printf(" %s", names[i]);
676 }
677
678 printf("\n%s ", prefix);
679
680 for (i = 1; i < num; i++) {
681 if (!names[i])
682 continue;
683
684 pad = strlen(names[i]) + 1;
685 if (stats[i])
4db2ff0d 686 printf("%*llu", pad, getattr_u64(stats[i]));
b26fc590 687 else
d3418638 688 printf("%*c", pad, '-');
b26fc590 689 }
d3418638 690 printf("\n");
b26fc590
SD		 691}
692
c0b904de
SH		 693static void print_json_stats(const char *names[], unsigned int num,
694 struct rtattr *stats[])
695{
696 unsigned int i;
697
698 for (i = 1; i < num; i++) {
699 if (!names[i] || !stats[i])
700 continue;
701
4db2ff0d
THJ		 702 print_u64(PRINT_JSON, names[i],
703 NULL, getattr_u64(stats[i]));
c0b904de
SH		 704 }
705}
706
707static void print_stats(const char *prefix,
708 const char *names[], unsigned int num,
709 struct rtattr *stats[])
710{
711
712 if (is_json_context())
713 print_json_stats(names, num, stats);
714 else
715 print_fp_stats(prefix, names, num, stats);
716}
717
b26fc590 718static const char *txsc_stats_names[NUM_MACSEC_TXSC_STATS_ATTR] = {
3a4df039
DH		 719 [MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED] = "OutPktsProtected",
720 [MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED] = "OutPktsEncrypted",
721 [MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED] = "OutOctetsProtected",
722 [MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED] = "OutOctetsEncrypted",
b26fc590
SD		 723};
724
725static void print_txsc_stats(const char *prefix, struct rtattr *attr)
726{
727 struct rtattr *stats[MACSEC_TXSC_STATS_ATTR_MAX + 1];
b26fc590
SD		 728
729 if (!attr || show_stats == 0)
730 return;
731
9b45f8ec 732 parse_rtattr_nested(stats, MACSEC_TXSC_STATS_ATTR_MAX, attr);
b26fc590 733
d3418638
SH		 734 print_stats(prefix, txsc_stats_names, NUM_MACSEC_TXSC_STATS_ATTR,
735 stats);
b26fc590
SD		 736}
737
738static const char *secy_stats_names[NUM_MACSEC_SECY_STATS_ATTR] = {
739 [MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED] = "OutPktsUntagged",
740 [MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED] = "InPktsUntagged",
741 [MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG] = "OutPktsTooLong",
742 [MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG] = "InPktsNoTag",
743 [MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG] = "InPktsBadTag",
744 [MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI] = "InPktsUnknownSCI",
745 [MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI] = "InPktsNoSCI",
746 [MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN] = "InPktsOverrun",
747};
748
749static void print_secy_stats(const char *prefix, struct rtattr *attr)
750{
751 struct rtattr *stats[MACSEC_SECY_STATS_ATTR_MAX + 1];
b26fc590
SD		 752
753 if (!attr || show_stats == 0)
754 return;
755
9b45f8ec 756 parse_rtattr_nested(stats, MACSEC_SECY_STATS_ATTR_MAX, attr);
b26fc590 757
d3418638
SH		 758 print_stats(prefix, secy_stats_names,
759 NUM_MACSEC_SECY_STATS_ATTR, stats);
b26fc590
SD		 760}
761
762static const char *rxsa_stats_names[NUM_MACSEC_SA_STATS_ATTR] = {
763 [MACSEC_SA_STATS_ATTR_IN_PKTS_OK] = "InPktsOK",
764 [MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID] = "InPktsInvalid",
765 [MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID] = "InPktsNotValid",
766 [MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA] = "InPktsNotUsingSA",
767 [MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA] = "InPktsUnusedSA",
768};
769
770static void print_rxsa_stats(const char *prefix, struct rtattr *attr)
771{
772 struct rtattr *stats[MACSEC_SA_STATS_ATTR_MAX + 1];
b26fc590
SD		 773
774 if (!attr || show_stats == 0)
775 return;
776
9b45f8ec 777 parse_rtattr_nested(stats, MACSEC_SA_STATS_ATTR_MAX, attr);
b26fc590 778
d3418638 779 print_stats(prefix, rxsa_stats_names, NUM_MACSEC_SA_STATS_ATTR, stats);
b26fc590
SD		 780}
781
782static const char *txsa_stats_names[NUM_MACSEC_SA_STATS_ATTR] = {
783 [MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED] = "OutPktsProtected",
784 [MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED] = "OutPktsEncrypted",
785};
786
787static void print_txsa_stats(const char *prefix, struct rtattr *attr)
788{
789 struct rtattr *stats[MACSEC_SA_STATS_ATTR_MAX + 1];
790
791 if (!attr || show_stats == 0)
792 return;
793
9b45f8ec 794 parse_rtattr_nested(stats, MACSEC_SA_STATS_ATTR_MAX, attr);
d3418638
SH		 795
796 print_stats(prefix, txsa_stats_names, NUM_MACSEC_SA_STATS_ATTR, stats);
b26fc590
SD		 797}
798
799static void print_tx_sc(const char *prefix, __u64 sci, __u8 encoding_sa,
800 struct rtattr *txsc_stats, struct rtattr *secy_stats,
801 struct rtattr *sa)
802{
803 struct rtattr *sa_attr[MACSEC_SA_ATTR_MAX + 1];
804 struct rtattr *a;
805 int rem;
806
c0b904de
SH		 807 print_string(PRINT_FP, NULL, "%s", prefix);
808 print_0xhex(PRINT_ANY, "sci",
809 "TXSC: %016llx", ntohll(sci));
810 print_uint(PRINT_ANY, "encoding_sa",
811 " on SA %d\n", encoding_sa);
812
b26fc590
SD		 813 print_secy_stats(prefix, secy_stats);
814 print_txsc_stats(prefix, txsc_stats);
815
c0b904de 816 open_json_array(PRINT_JSON, "sa_list");
b26fc590
SD		 817 rem = RTA_PAYLOAD(sa);
818 for (a = RTA_DATA(sa); RTA_OK(a, rem); a = RTA_NEXT(a, rem)) {
b26fc590
SD		 819 bool state;
820
c0b904de 821 open_json_object(NULL);
9b45f8ec 822 parse_rtattr_nested(sa_attr, MACSEC_SA_ATTR_MAX, a);
b26fc590 823 state = rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_ACTIVE]);
c0b904de
SH		 824
825 print_string(PRINT_FP, NULL, "%s", prefix);
826 print_string(PRINT_FP, NULL, "%s", prefix);
827 print_uint(PRINT_ANY, "an", "%d:",
828 rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_AN]));
829 print_uint(PRINT_ANY, "pn", " PN %u,",
830 rta_getattr_u32(sa_attr[MACSEC_SA_ATTR_PN]));
831
832 print_bool(PRINT_JSON, "active", NULL, state);
833 print_string(PRINT_FP, NULL,
834 " state %s,", state ? "on" : "off");
835 print_key(sa_attr[MACSEC_SA_ATTR_KEYID]);
836
b26fc590 837 print_txsa_stats(prefix, sa_attr[MACSEC_SA_ATTR_STATS]);
c0b904de 838 close_json_object();
b26fc590 839 }
c0b904de 840 close_json_array(PRINT_JSON, NULL);
b26fc590
SD		 841}
842
843static const char *rxsc_stats_names[NUM_MACSEC_RXSC_STATS_ATTR] = {
844 [MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED] = "InOctetsValidated",
845 [MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED] = "InOctetsDecrypted",
846 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED] = "InPktsUnchecked",
847 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED] = "InPktsDelayed",
848 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK] = "InPktsOK",
849 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID] = "InPktsInvalid",
850 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE] = "InPktsLate",
851 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID] = "InPktsNotValid",
852 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA] = "InPktsNotUsingSA",
853 [MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA] = "InPktsUnusedSA",
854};
855
856static void print_rxsc_stats(const char *prefix, struct rtattr *attr)
857{
858 struct rtattr *stats[MACSEC_RXSC_STATS_ATTR_MAX + 1];
b26fc590
SD		 859
860 if (!attr || show_stats == 0)
861 return;
862
9b45f8ec 863 parse_rtattr_nested(stats, MACSEC_RXSC_STATS_ATTR_MAX, attr);
b26fc590 864
d3418638
SH		 865 print_stats(prefix, rxsc_stats_names,
866 NUM_MACSEC_RXSC_STATS_ATTR, stats);
b26fc590
SD		 867}
868
c0b904de 869static void print_rx_sc(const char *prefix, __be64 sci, __u8 active,
b26fc590
SD		 870 struct rtattr *rxsc_stats, struct rtattr *sa)
871{
872 struct rtattr *sa_attr[MACSEC_SA_ATTR_MAX + 1];
873 struct rtattr *a;
874 int rem;
875
c0b904de
SH		 876 print_string(PRINT_FP, NULL, "%s", prefix);
877 print_0xhex(PRINT_ANY, "sci",
878 "RXSC: %016llx,", ntohll(sci));
879 print_bool(PRINT_JSON, "active", NULL, active);
880 print_string(PRINT_FP, NULL,
881 " state %s\n", active ? "on" : "off");
b26fc590
SD		 882 print_rxsc_stats(prefix, rxsc_stats);
883
c0b904de 884 open_json_array(PRINT_JSON, "sa_list");
b26fc590
SD		 885 rem = RTA_PAYLOAD(sa);
886 for (a = RTA_DATA(sa); RTA_OK(a, rem); a = RTA_NEXT(a, rem)) {
b26fc590
SD		 887 bool state;
888
c0b904de 889 open_json_object(NULL);
9b45f8ec 890 parse_rtattr_nested(sa_attr, MACSEC_SA_ATTR_MAX, a);
b26fc590 891 state = rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_ACTIVE]);
c0b904de
SH		 892
893 print_string(PRINT_FP, NULL, "%s", prefix);
894 print_string(PRINT_FP, NULL, "%s", prefix);
895 print_uint(PRINT_ANY, "an", "%u:",
896 rta_getattr_u8(sa_attr[MACSEC_SA_ATTR_AN]));
897 print_uint(PRINT_ANY, "pn", " PN %u,",
898 rta_getattr_u32(sa_attr[MACSEC_SA_ATTR_PN]));
899
900 print_bool(PRINT_JSON, "active", NULL, state);
901 print_string(PRINT_FP, NULL, " state %s,",
902 state ? "on" : "off");
903
904 print_key(sa_attr[MACSEC_SA_ATTR_KEYID]);
905
b26fc590 906 print_rxsa_stats(prefix, sa_attr[MACSEC_SA_ATTR_STATS]);
c0b904de
SH		 907 close_json_object();
908 }
909 close_json_array(PRINT_JSON, NULL);
910}
911
912static void print_rxsc_list(struct rtattr *sc)
913{
914 int rem = RTA_PAYLOAD(sc);
915 struct rtattr *c;
916
917 open_json_array(PRINT_JSON, "rx_sc");
918 for (c = RTA_DATA(sc); RTA_OK(c, rem); c = RTA_NEXT(c, rem)) {
919 struct rtattr *sc_attr[MACSEC_RXSC_ATTR_MAX + 1];
920
921 open_json_object(NULL);
922
9b45f8ec 923 parse_rtattr_nested(sc_attr, MACSEC_RXSC_ATTR_MAX, c);
c0b904de
SH		 924 print_rx_sc(" ",
925 rta_getattr_u64(sc_attr[MACSEC_RXSC_ATTR_SCI]),
926 rta_getattr_u32(sc_attr[MACSEC_RXSC_ATTR_ACTIVE]),
927 sc_attr[MACSEC_RXSC_ATTR_STATS],
928 sc_attr[MACSEC_RXSC_ATTR_SA_LIST]);
929 close_json_object();
b26fc590 930 }
c0b904de 931 close_json_array(PRINT_JSON, NULL);
b26fc590
SD		 932}
933
cd554f2c 934static int process(struct nlmsghdr *n, void *arg)
b26fc590
SD		 935{
936 struct genlmsghdr *ghdr;
c0b904de 937 struct rtattr *attrs[MACSEC_ATTR_MAX + 1];
b26fc590
SD		 938 struct rtattr *attrs_secy[MACSEC_SECY_ATTR_MAX + 1];
939 int len = n->nlmsg_len;
940 int ifindex;
941 __u64 sci;
942 __u8 encoding_sa;
b26fc590
SD		 943
944 if (n->nlmsg_type != genl_family)
945 return -1;
946
947 len -= NLMSG_LENGTH(GENL_HDRLEN);
948 if (len < 0)
949 return -1;
950
951 ghdr = NLMSG_DATA(n);
952 if (ghdr->cmd != MACSEC_CMD_GET_TXSC)
953 return 0;
954
955 parse_rtattr(attrs, MACSEC_ATTR_MAX, (void *) ghdr + GENL_HDRLEN, len);
956 if (!validate_dump(attrs)) {
c0b904de 957 fprintf(stderr, "incomplete dump message\n");
b26fc590
SD		 958 return -1;
959 }
960
961 ifindex = rta_getattr_u32(attrs[MACSEC_ATTR_IFINDEX]);
9b45f8ec 962 parse_rtattr_nested(attrs_secy, MACSEC_SECY_ATTR_MAX,
b26fc590
SD		 963 attrs[MACSEC_ATTR_SECY]);
964
965 if (!validate_secy_dump(attrs_secy)) {
c0b904de 966 fprintf(stderr, "incomplete dump message\n");
b26fc590
SD		 967 return -1;
968 }
969
970 sci = rta_getattr_u64(attrs_secy[MACSEC_SECY_ATTR_SCI]);
971 encoding_sa = rta_getattr_u8(attrs_secy[MACSEC_SECY_ATTR_ENCODING_SA]);
972
973 if (filter.ifindex && ifindex != filter.ifindex)
974 return 0;
975
976 if (filter.sci && sci != filter.sci)
977 return 0;
978
c0b904de
SH		 979 open_json_object(NULL);
980 print_uint(PRINT_ANY, "ifindex", "%u: ", ifindex);
981 print_color_string(PRINT_ANY, COLOR_IFNAME, "ifname",
982 "%s: ", ll_index_to_name(ifindex));
983
984 print_attrs(attrs_secy);
b26fc590
SD		 985
986 print_tx_sc(" ", sci, encoding_sa,
987 attrs[MACSEC_ATTR_TXSC_STATS],
988 attrs[MACSEC_ATTR_SECY_STATS],
989 attrs[MACSEC_ATTR_TXSA_LIST]);
990
c0b904de
SH		 991 if (attrs[MACSEC_ATTR_RXSC_LIST])
992 print_rxsc_list(attrs[MACSEC_ATTR_RXSC_LIST]);
b26fc590 993
c0b904de 994 close_json_object();
b26fc590
SD		 995
996 return 0;
997}
998
999static int do_dump(int ifindex)
1000{
1001 MACSEC_GENL_REQ(req, MACSEC_BUFLEN, MACSEC_CMD_GET_TXSC,
1002 NLM_F_REQUEST | NLM_F_DUMP);
1003
1004 memset(&filter, 0, sizeof(filter));
1005 filter.ifindex = ifindex;
1006
1007 req.n.nlmsg_seq = genl_rth.dump = ++genl_rth.seq;
1008 if (rtnl_send(&genl_rth, &req, req.n.nlmsg_len) < 0) {
1009 perror("Failed to send dump request");
1010 exit(1);
1011 }
1012
c0b904de 1013 new_json_obj(json);
b26fc590 1014 if (rtnl_dump_filter(&genl_rth, process, stdout) < 0) {
c0b904de 1015 delete_json_obj();
b26fc590
SD		 1016 fprintf(stderr, "Dump terminated\n");
1017 exit(1);
1018 }
c0b904de 1019 delete_json_obj();
b26fc590
SD		 1020
1021 return 0;
1022}
1023
1024static int do_show(int argc, char **argv)
1025{
1026 int ifindex;
1027
1028 if (argc == 0)
1029 return do_dump(0);
1030
1031 ifindex = ll_name_to_index(*argv);
1032 if (ifindex == 0) {
1033 fprintf(stderr, "Device \"%s\" does not exist.\n", *argv);
1034 return -1;
1035 }
1036
1037 argc--, argv++;
1038 if (argc == 0)
1039 return do_dump(ifindex);
1040
1041 ipmacsec_usage();
1042 return -1;
1043}
1044
1045int do_ipmacsec(int argc, char **argv)
1046{
b26fc590
SD		 1047 if (argc < 1)
1048 ipmacsec_usage();
1049
1050 if (matches(*argv, "help") == 0)
1051 ipmacsec_usage();
1052
688f9aa4
SD		 1053 if (genl_init_handle(&genl_rth, MACSEC_GENL_NAME, &genl_family))
1054 exit(1);
1055
b26fc590
SD		 1056 if (matches(*argv, "show") == 0)
1057 return do_show(argc-1, argv+1);
1058
1059 if (matches(*argv, "add") == 0)
1060 return do_modify(CMD_ADD, argc-1, argv+1);
1061 if (matches(*argv, "set") == 0)
1062 return do_modify(CMD_UPD, argc-1, argv+1);
1063 if (matches(*argv, "delete") == 0)
1064 return do_modify(CMD_DEL, argc-1, argv+1);
1065
1066 fprintf(stderr, "Command \"%s\" is unknown, try \"ip macsec help\".\n",
1067 *argv);
1068 exit(-1);
1069}
1070
1071/* device creation */
1072static void macsec_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
1073{
1074 if (!tb)
1075 return;
1076
1077 if (tb[IFLA_MACSEC_SCI]) {
c3398346
JF		 1078 if (is_json_context()) {
1079 SPRINT_BUF(b1);
1080
1081 snprintf(b1, sizeof(b1), "%016llx",
1082 ntohll(rta_getattr_u64(tb[IFLA_MACSEC_SCI])));
1083 print_string(PRINT_JSON, "sci", NULL, b1);
1084 } else {
1085 fprintf(f, "sci %016llx ",
1086 ntohll(rta_getattr_u64(tb[IFLA_MACSEC_SCI])));
1087 }
b26fc590
SD		 1088 }
1089
c0b904de 1090 print_flag(tb, "protect", IFLA_MACSEC_PROTECT);
b26fc590
SD		 1091
1092 if (tb[IFLA_MACSEC_CIPHER_SUITE]) {
c0b904de
SH		 1093 __u64 csid
1094 = rta_getattr_u64(tb[IFLA_MACSEC_CIPHER_SUITE]);
b26fc590 1095
c3398346
JF		 1096 print_string(PRINT_ANY,
1097 "cipher_suite",
1098 "cipher %s ",
1099 cs_id_to_name(csid));
b26fc590
SD		 1100 }
1101
1102 if (tb[IFLA_MACSEC_ICV_LEN]) {
c3398346
JF		 1103 if (is_json_context()) {
1104 char b2[4];
1105
1106 snprintf(b2, sizeof(b2), "%hhu",
1107 rta_getattr_u8(tb[IFLA_MACSEC_ICV_LEN]));
1108 print_uint(PRINT_JSON, "icv_len", NULL, atoi(b2));
1109 } else {
1110 fprintf(f, "icvlen %hhu ",
1111 rta_getattr_u8(tb[IFLA_MACSEC_ICV_LEN]));
1112 }
b26fc590
SD		 1113 }
1114
1115 if (tb[IFLA_MACSEC_ENCODING_SA]) {
c3398346
JF		 1116 if (is_json_context()) {
1117 char b2[4];
1118
1119 snprintf(b2, sizeof(b2), "%hhu",
1120 rta_getattr_u8(tb[IFLA_MACSEC_ENCODING_SA]));
1121 print_uint(PRINT_JSON, "encoding_sa", NULL, atoi(b2));
1122 } else {
1123 fprintf(f, "encodingsa %hhu ",
1124 rta_getattr_u8(tb[IFLA_MACSEC_ENCODING_SA]));
1125 }
b26fc590
SD		 1126 }
1127
1128 if (tb[IFLA_MACSEC_VALIDATION]) {
1129 __u8 val = rta_getattr_u8(tb[IFLA_MACSEC_VALIDATION]);
1130
c3398346
JF		 1131 print_string(PRINT_ANY,
1132 "validation",
1133 "validate %s ",
c2f260f4 1134 validate_str[val]);
c3398346
JF		 1135 }
1136
1137 const char *inc_sci, *es, *replay;
1138
1139 if (is_json_context()) {
1140 inc_sci = "inc_sci";
1141 replay = "replay_protect";
1142 es = "es";
1143 } else {
1144 inc_sci = "send_sci";
1145 es = "end_station";
1146 replay = "replay";
b26fc590
SD		 1147 }
1148
c0b904de
SH		 1149 print_flag(tb, "encrypt", IFLA_MACSEC_ENCRYPT);
1150 print_flag(tb, inc_sci, IFLA_MACSEC_INC_SCI);
1151 print_flag(tb, es, IFLA_MACSEC_ES);
1152 print_flag(tb, "scb", IFLA_MACSEC_SCB);
1153 print_flag(tb, replay, IFLA_MACSEC_REPLAY_PROTECT);
b26fc590 1154
c3398346
JF		 1155 if (tb[IFLA_MACSEC_WINDOW])
1156 print_int(PRINT_ANY,
1157 "window",
1158 "window %d ",
1159 rta_getattr_u32(tb[IFLA_MACSEC_WINDOW]));
b26fc590
SD		 1160}
1161
b26fc590
SD		 1162static bool check_txsc_flags(bool es, bool scb, bool sci)
1163{
1164 if (sci && (es || scb))
1165 return false;
1166 if (es && scb)
1167 return false;
1168 return true;
1169}
1170
1171static void usage(FILE *f)
1172{
1173 fprintf(f,
5898bd66 1174 "Usage: ... macsec [ [ address <lladdr> ] port { 1..2^16-1 } | sci <u64> ]\n"
89bb6e67
DC		 1175 " [ cipher { default | gcm-aes-128 } ]\n"
1176 " [ icvlen { 8..16 } ]\n"
b26fc590
SD		 1177 " [ encrypt { on | off } ]\n"
1178 " [ send_sci { on | off } ]\n"
1179 " [ end_station { on | off } ]\n"
1180 " [ scb { on | off } ]\n"
1181 " [ protect { on | off } ]\n"
1182 " [ replay { on | off} window { 0..2^32-1 } ]\n"
1183 " [ validate { strict | check | disabled } ]\n"
1184 " [ encodingsa { 0..3 } ]\n"
1185 );
b26fc590
SD		 1186}
1187
1188static int macsec_parse_opt(struct link_util *lu, int argc, char **argv,
28254695 1189 struct nlmsghdr *n)
b26fc590
SD		 1190{
1191 int ret;
1192 __u8 encoding_sa = 0xff;
1193 __u32 window = -1;
1194 struct cipher_args cipher = {0};
1195 enum macsec_validation_type validate;
1196 bool es = false, scb = false, send_sci = false;
1197 int replay_protect = -1;
1198 struct sci sci = { 0 };
1199
1200 ret = get_sci_portaddr(&sci, &argc, &argv, true, true);
1201 if (ret < 0) {
1202 fprintf(stderr, "expected sci\n");
1203 return -1;
1204 }
1205
1206 if (ret > 0) {
1207 if (sci.sci)
28254695 1208 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_SCI,
b26fc590
SD		 1209 &sci.sci, sizeof(sci.sci));
1210 else
28254695 1211 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_PORT,
b26fc590
SD		 1212 &sci.port, sizeof(sci.port));
1213 }
1214
1215 while (argc > 0) {
1216 if (strcmp(*argv, "cipher") == 0) {
89bb6e67 1217 NEXT_ARG();
b26fc590 1218 if (cipher.id)
89bb6e67
DC		 1219 duparg("cipher", *argv);
1220 if (strcmp(*argv, "default") == 0 ||
1221 strcmp(*argv, "gcm-aes-128") == 0 ||
1222 strcmp(*argv, "GCM-AES-128") == 0)
1223 cipher.id = MACSEC_DEFAULT_CIPHER_ID;
1224 else
1225 invarg("expected: default or gcm-aes-128",
1226 *argv);
1227 } else if (strcmp(*argv, "icvlen") == 0) {
b26fc590 1228 NEXT_ARG();
89bb6e67
DC		 1229 if (cipher.icv_len)
1230 duparg("icvlen", *argv);
1231 get_icvlen(&cipher.icv_len, *argv);
b26fc590
SD		 1232 } else if (strcmp(*argv, "encrypt") == 0) {
1233 NEXT_ARG();
1234 int i;
1235
1236 ret = one_of("encrypt", *argv, values_on_off,
1237 ARRAY_SIZE(values_on_off), &i);
1238 if (ret != 0)
1239 return ret;
28254695 1240 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_ENCRYPT, i);
b26fc590
SD		 1241 } else if (strcmp(*argv, "send_sci") == 0) {
1242 NEXT_ARG();
1243 int i;
1244
1245 ret = one_of("send_sci", *argv, values_on_off,
1246 ARRAY_SIZE(values_on_off), &i);
1247 if (ret != 0)
1248 return ret;
1249 send_sci = i;
28254695 1250 addattr8(n, MACSEC_BUFLEN,
b26fc590
SD		 1251 IFLA_MACSEC_INC_SCI, send_sci);
1252 } else if (strcmp(*argv, "end_station") == 0) {
1253 NEXT_ARG();
1254 int i;
1255
1256 ret = one_of("end_station", *argv, values_on_off,
1257 ARRAY_SIZE(values_on_off), &i);
1258 if (ret != 0)
1259 return ret;
1260 es = i;
28254695 1261 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_ES, es);
b26fc590
SD		 1262 } else if (strcmp(*argv, "scb") == 0) {
1263 NEXT_ARG();
1264 int i;
1265
1266 ret = one_of("scb", *argv, values_on_off,
1267 ARRAY_SIZE(values_on_off), &i);
1268 if (ret != 0)
1269 return ret;
1270 scb = i;
28254695 1271 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_SCB, scb);
b26fc590
SD		 1272 } else if (strcmp(*argv, "protect") == 0) {
1273 NEXT_ARG();
1274 int i;
1275
1276 ret = one_of("protect", *argv, values_on_off,
1277 ARRAY_SIZE(values_on_off), &i);
1278 if (ret != 0)
1279 return ret;
28254695 1280 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_PROTECT, i);
b26fc590
SD		 1281 } else if (strcmp(*argv, "replay") == 0) {
1282 NEXT_ARG();
1283 int i;
1284
1285 ret = one_of("replay", *argv, values_on_off,
1286 ARRAY_SIZE(values_on_off), &i);
1287 if (ret != 0)
1288 return ret;
1289 replay_protect = !!i;
1290 } else if (strcmp(*argv, "window") == 0) {
1291 NEXT_ARG();
1292 ret = get_u32(&window, *argv, 0);
1293 if (ret)
1294 invarg("expected replay window size", *argv);
1295 } else if (strcmp(*argv, "validate") == 0) {
1296 NEXT_ARG();
1297 ret = one_of("validate", *argv,
c2f260f4 1298 validate_str, ARRAY_SIZE(validate_str),
b26fc590
SD		 1299 (int *)&validate);
1300 if (ret != 0)
1301 return ret;
28254695 1302 addattr8(n, MACSEC_BUFLEN,
b26fc590
SD		 1303 IFLA_MACSEC_VALIDATION, validate);
1304 } else if (strcmp(*argv, "encodingsa") == 0) {
1305 if (encoding_sa != 0xff)
1306 duparg2("encodingsa", "encodingsa");
1307 NEXT_ARG();
1308 ret = get_an(&encoding_sa, *argv);
1309 if (ret)
1310 invarg("expected an { 0..3 }", *argv);
1311 } else {
1312 fprintf(stderr, "macsec: unknown command \"%s\"?\n",
1313 *argv);
1314 usage(stderr);
1315 return -1;
1316 }
1317
1318 argv++; argc--;
1319 }
1320
1321 if (!check_txsc_flags(es, scb, send_sci)) {
c2f260f4
SH		 1322 fprintf(stderr,
1323 "invalid combination of send_sci/end_station/scb\n");
b26fc590
SD		 1324 return -1;
1325 }
1326
1327 if (window != -1 && replay_protect == -1) {
1328 fprintf(stderr,
1329 "replay window set, but replay protection not enabled. did you mean 'replay on window %u'?\n",
1330 window);
1331 return -1;
1332 } else if (window == -1 && replay_protect == 1) {
1333 fprintf(stderr,
1334 "replay protection enabled, but no window set. did you mean 'replay on window VALUE'?\n");
1335 return -1;
1336 }
1337
89bb6e67 1338 if (cipher.id)
28254695 1339 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_CIPHER_SUITE,
b26fc590 1340 &cipher.id, sizeof(cipher.id));
89bb6e67 1341 if (cipher.icv_len)
28254695 1342 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_ICV_LEN,
b26fc590 1343 &cipher.icv_len, sizeof(cipher.icv_len));
b26fc590
SD		 1344
1345 if (replay_protect != -1) {
28254695
SP		 1346 addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window);
1347 addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_REPLAY_PROTECT,
b26fc590
SD		 1348 replay_protect);
1349 }
1350
1351 if (encoding_sa != 0xff) {
28254695 1352 addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_ENCODING_SA,
b26fc590
SD		 1353 &encoding_sa, sizeof(encoding_sa));
1354 }
1355
1356 return 0;
1357}
1358
1359static void macsec_print_help(struct link_util *lu, int argc, char **argv,
1360 FILE *f)
1361{
1362 usage(f);
1363}
1364
1365struct link_util macsec_link_util = {
1366 .id = "macsec",
1367 .maxattr = IFLA_MACSEC_MAX,
1368 .parse_opt = macsec_parse_opt,
1369 .print_help = macsec_print_help,
1370 .print_opt = macsec_print_opt,
b26fc590 1371};
Upstream mirror of iproute2