mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-21 01:51:18 +00:00
net: macsec: Verify that send_sci is on when setting Tx sci explicitly
commitd0cfa548db
upstream. When setting Tx sci explicit, the Rx side is expected to use this sci and not recalculate it from the packet.However, in case of Tx sci is explicit and send_sci is off, the receiver is wrongly recalculate the sci from the source MAC address which most likely be different than the explicit sci. Fix by preventing such configuration when macsec newlink is established and return EINVAL error code on such cases. Fixes:c09440f7dc
("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Lior Nahmanson <liorna@nvidia.com> Reviewed-by: Raed Salem <raeds@nvidia.com> Signed-off-by: Raed Salem <raeds@nvidia.com> Link: https://lore.kernel.org/r/1643542672-29403-1-git-send-email-raeds@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
e7a0b3a080
commit
0ced878998
1 changed files with 9 additions and 0 deletions
|
@ -4018,6 +4018,15 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
|
||||||
!macsec_check_offload(macsec->offload, macsec))
|
!macsec_check_offload(macsec->offload, macsec))
|
||||||
return -EOPNOTSUPP;
|
return -EOPNOTSUPP;
|
||||||
|
|
||||||
|
/* send_sci must be set to true when transmit sci explicitly is set */
|
||||||
|
if ((data && data[IFLA_MACSEC_SCI]) &&
|
||||||
|
(data && data[IFLA_MACSEC_INC_SCI])) {
|
||||||
|
u8 send_sci = !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]);
|
||||||
|
|
||||||
|
if (!send_sci)
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
if (data && data[IFLA_MACSEC_ICV_LEN])
|
if (data && data[IFLA_MACSEC_ICV_LEN])
|
||||||
icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]);
|
icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]);
|
||||||
mtu = real_dev->mtu - icv_len - macsec_extra_len(true);
|
mtu = real_dev->mtu - icv_len - macsec_extra_len(true);
|
||||||
|
|
Loading…
Reference in a new issue