netdev - Re: [PATCH iproute2-next v2 0/4] macsec: add offloading support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 4 Mar 2020 13:00:36 -0700
From:   David Ahern <dsahern@...il.com>
To:     Antoine Tenart <antoine.tenart@...tlin.com>, sd@...asysnail.net
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH iproute2-next v2 0/4] macsec: add offloading support

On 3/3/20 3:36 AM, Antoine Tenart wrote:
> Hello,
> 
> This series adds support for selecting and reporting the offloading mode
> of a MACsec interface. Available modes are for now 'off' and 'phy',
> 'off' being the default when an interface is created. Modes are not only
> 'off' and 'on' as the MACsec operations can be offloaded to multiple
> kinds of specialized hardware devices, at least to PHYs and Ethernet
> MACs. The later isn't currently supported in the kernel though.
> 
> The first patch adds support for reporting the offloading mode currently
> selected for a given MACsec interface through the `ip macsec show`
> command:
> 
>    # ip macsec show
>    18: macsec0: protect on validate strict sc off sa off encrypt on send_sci on end_station off scb off replay off
>        cipher suite: GCM-AES-128, using ICV length 16
>        TXSC: 3e5035b67c860001 on SA 0
>            0: PN 1, state on, key 00000000000000000000000000000000
>        RXSC: b4969112700f0001, state on
>            0: PN 1, state on, key 01000000000000000000000000000000
> ->     offload: phy
>    19: macsec1: protect on validate strict sc off sa off encrypt on send_sci on end_station off scb off replay off
>        cipher suite: GCM-AES-128, using ICV length 16
>        TXSC: 3e5035b67c880001 on SA 0
>            1: PN 1, state on, key 00000000000000000000000000000000
>        RXSC: b4969112700f0001, state on
>            1: PN 1, state on, key 01000000000000000000000000000000
> ->     offload: off
> 
> The second patch allows an user to change the offloading mode at runtime
> through a new subcommand, `ip macsec offload`:
> 
>   # ip macsec offload macsec0 phy
>   # ip macsec offload macsec0 off
> 
> If a mode isn't supported, `ip macsec offload` will report an issue
> (-EOPNOTSUPP).
> 
> Giving the offloading mode when a macsec interface is created was
> discussed; it is not implemented in this series. It could come later
> on, when needed, as we'll still want to support updating the offloading
> mode at runtime (what's implemented in this series).
> 

applied to iproute2-next. Thanks