netdev - Re: [RFC 06/18] net: macsec: invoke mdo_upd_secy callback when mac address changed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 21 Feb 2020 16:07:51 +0100
From:   Antoine Tenart <antoine.tenart@...tlin.com>
To:     Igor Russkikh <irusskikh@...vell.com>
Cc:     netdev@...r.kernel.org, "David S . Miller" <davem@...emloft.net>,
        Antoine Tenart <antoine.tenart@...tlin.com>,
        Mark Starovoytov <mstarovoitov@...vell.com>,
        Dmitry Bogdanov <dbogdanov@...vell.com>
Subject: Re: [RFC 06/18] net: macsec: invoke mdo_upd_secy callback when mac
 address changed

Hello,

On Fri, Feb 14, 2020 at 06:02:46PM +0300, Igor Russkikh wrote:
> From: Dmitry Bogdanov <dbogdanov@...vell.com>
> 
> Change SCI according to the new MAC address, because it must contain MAC
> in its first 6 octets.
> Also notify the offload engine about MAC address change to reconfigure it
> accordingly.

It seems you're making two different changes in a single commit, you
could split it.

Updating the SCI according to the new MAC address applies here to both
the s/w implementation and the offloaded ones: it looks like this is
fixing an issue when the MAC address is updated. If so, could you send
it accordingly (as a fix)?

Thanks!
Antoine

> Signed-off-by: Dmitry Bogdanov <dbogdanov@...vell.com>
> Signed-off-by: Mark Starovoytov <mstarovoitov@...vell.com>
> Signed-off-by: Igor Russkikh <irusskikh@...vell.com>
> ---
>  drivers/net/macsec.c | 25 ++++++++++++++++++++-----
>  1 file changed, 20 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
> index af41887d9a1e..973b09401099 100644
> --- a/drivers/net/macsec.c
> +++ b/drivers/net/macsec.c
> @@ -433,6 +433,11 @@ static struct macsec_eth_header *macsec_ethhdr(struct sk_buff *skb)
>  	return (struct macsec_eth_header *)skb_mac_header(skb);
>  }
>  
> +static sci_t dev_to_sci(struct net_device *dev, __be16 port)
> +{
> +	return make_sci(dev->dev_addr, port);
> +}
> +
>  static void __macsec_pn_wrapped(struct macsec_secy *secy,
>  				struct macsec_tx_sa *tx_sa)
>  {
> @@ -3291,6 +3296,21 @@ static int macsec_set_mac_address(struct net_device *dev, void *p)
>  
>  out:
>  	ether_addr_copy(dev->dev_addr, addr->sa_data);
> +
> +	macsec->secy.sci = dev_to_sci(dev, MACSEC_PORT_ES);
> +
> +	/* If h/w offloading is available, propagate to the device */
> +	if (macsec_is_offloaded(macsec)) {
> +		const struct macsec_ops *ops;
> +		struct macsec_context ctx;
> +
> +		ops = macsec_get_ops(macsec, &ctx);
> +		if (ops) {
> +			ctx.secy = &macsec->secy;
> +			macsec_offload(ops->mdo_upd_secy, &ctx);
> +		}
> +	}
> +
>  	return 0;
>  }
>  
> @@ -3615,11 +3635,6 @@ static bool sci_exists(struct net_device *dev, sci_t sci)
>  	return false;
>  }
>  
> -static sci_t dev_to_sci(struct net_device *dev, __be16 port)
> -{
> -	return make_sci(dev->dev_addr, port);
> -}
> -
>  static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len)
>  {
>  	struct macsec_dev *macsec = macsec_priv(dev);
> -- 
> 2.17.1
> 

-- 
Antoine Ténart, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com