netdev - [PATCH iproute2-next 0/2] macsec: add offloading support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200120201823.887937-1-antoine.tenart@bootlin.com>
Date:   Mon, 20 Jan 2020 21:18:21 +0100
From:   Antoine Tenart <antoine.tenart@...tlin.com>
To:     dsahern@...il.com, sd@...asysnail.net
Cc:     Antoine Tenart <antoine.tenart@...tlin.com>, netdev@...r.kernel.org
Subject: [PATCH iproute2-next 0/2] macsec: add offloading support

Hello,

This series adds support for selecting and reporting the offloading mode
of a MACsec interface. Available modes are for now 'off' and 'phy',
'off' being the default when an interface is created. Modes are not only
'off' and 'on' as the MACsec operations can be offloaded to multiple
kinds of specialized hardware devices, at least to PHYs and Ethernet
MACs. The later isn't currently supported in the kernel though.

The first patch adds support for reporting the offloading mode currently
selected for a given MACsec interface through the `ip macsec show`
command:

   # ip macsec show
   18: macsec0: protect on validate strict sc off sa off encrypt on send_sci on end_station off scb off replay off
       cipher suite: GCM-AES-128, using ICV length 16
       TXSC: 3e5035b67c860001 on SA 0
           0: PN 1, state on, key 00000000000000000000000000000000
       RXSC: b4969112700f0001, state on
           0: PN 1, state on, key 01000000000000000000000000000000
->     offload: phy
   19: macsec1: protect on validate strict sc off sa off encrypt on send_sci on end_station off scb off replay off
       cipher suite: GCM-AES-128, using ICV length 16
       TXSC: 3e5035b67c880001 on SA 0
           1: PN 1, state on, key 00000000000000000000000000000000
       RXSC: b4969112700f0001, state on
           1: PN 1, state on, key 01000000000000000000000000000000
->     offload: off

The second patch allows an user to change the offloading mode at runtime
through a new subcommand, `ip macsec offload`:

  # ip macsec offload macsec0 phy
  # ip macsec offload macsec0 off

If a mode isn't supported, `ip macsec offload` will report an issue
(-EOPNOTSUPP).

One thing not supported in this series would be the ability to list all
supported modes (for now 'off' and 'phy') depending on the h/w interface
capabilities. This can come up in a later patch, as this is not critical
to get the feature used, but I would like this to be compatible with the
current series. I can think of 2 possibilities: either through
`ip macsec show` or through `ip macsec offload` (for example when no
argument is given). What are your thoughts on this?

Thanks!
Antoine

Antoine Tenart (2):
  macsec: report the offloading mode currently selected
  macsec: add support for changing the offloading mode

 ip/ipmacsec.c | 63 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)

-- 
2.24.1