netdev - RE: [PATCH v1 3/3] macsec: add user manual description for extended packet number feature

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 1 Aug 2022 11:15:02 +0000
From:   Emeel Hakim <ehakim@...dia.com>
To:     "dsahern@...nel.org" <dsahern@...nel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     Raed Salem <raeds@...dia.com>, Tariq Toukan <tariqt@...dia.com>,
        "sd@...asysnail.net" <sd@...asysnail.net>
Subject: RE: [PATCH v1 3/3] macsec: add user manual description for extended
 packet number feature


-----Original Message-----
From: Emeel Hakim 
Sent: Monday, August 1, 2022 9:58 AM
To: dsahern@...nel.org; netdev@...r.kernel.org
Cc: Raed Salem <raeds@...dia.com>; Tariq Toukan <tariqt@...dia.com>
Subject: RE: [PATCH v1 3/3] macsec: add user manual description for extended packet number feature

Hi,
a kind reminder ,
also is there anything missing from my side?

Thanks,
Emeel

-----Original Message-----
From: Emeel Hakim <ehakim@...dia.com>
Sent: Monday, July 11, 2022 4:39 PM
To: dsahern@...nel.org; netdev@...r.kernel.org
Cc: Raed Salem <raeds@...dia.com>; Tariq Toukan <tariqt@...dia.com>; Emeel Hakim <ehakim@...dia.com>
Subject: [PATCH v1 3/3] macsec: add user manual description for extended packet number feature

From: Emeel Hakim <ehakim@...dia.com>

Update the user manual describing how to use extended packet number (XPN) feature for macsec. As part of configuring XPN, providing ssci and salt is required hence update user manual on  how to provide the above as part of the ip macsec command.

Signed-off-by: Emeel Hakim <ehakim@...dia.com>
---
 man/man8/ip-macsec.8 | 52 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/man/man8/ip-macsec.8 b/man/man8/ip-macsec.8 index bb816157..67bb2c23 100644
--- a/man/man8/ip-macsec.8
+++ b/man/man8/ip-macsec.8
@@ -24,6 +24,8 @@ ip-macsec \- MACsec device configuration  .BR validate " { " strict " | " check " | " disabled " } ] ["
 .BI encodingsa " SA"
 ] [
+.BI flag " FLAG"
+] [
 .BR offload " { " off " | " phy " | " mac " }"
 ]
 
@@ -64,8 +66,17 @@ ip-macsec \- MACsec device configuration  .IR OPTS " := [ "
 .BR pn " { "
 .IR 1..2^32-1 " } ] ["
+.BR xpn " { "
+.IR 1..2^64-1 " } ] ["
+.B salt
+.IR <u94> " ] ["
+.B ssci
+.IR <u32> " ] ["
 .BR on " | " off " ]"
 .br
+.IR FLAG " := "
+.BR xpn "
+.br
 .IR SCI " := { "
 .B sci
 .IR <u64> " | "
@@ -116,6 +127,29 @@ type.
 .nf
 # ip link add link eth0 macsec0 type macsec port 11 encrypt on offload mac
 
+.SH EXTENDED PACKET NUMBER EXAMPLES
+.PP
+.SS Create a MACsec device on link eth0 with enabled extended packet 
+number (offload is disabled by default) .nf # ip link add link eth0
+macsec0 type macsec port 11 encrypt on flag xpn .PP .SS Configure a 
+secure association on that device .nf # ip macsec add macsec0 tx sa 0 
+xpn 1024 salt 838383838383838383838383 on key 01
+81818181818181818181818181818181 .PP .SS Configure a receive channel 
+.nf # ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0 .PP 
+.SS Configure a receive association .nf # ip macsec add macsec0 rx port
+1234 address c6:19:52:8f:e6:a0 sa 0 xpn 1 salt 838383838383838383838383 
+on key 00 82828282828282828282828282828282 .PP .SS Display MACsec 
+configuration .nf # ip macsec show .PP
+
 .SH NOTES
 This tool can be used to configure the 802.1AE keys of the interface. Note that 802.1AE uses GCM-AES  with a initialization vector (IV) derived from the packet number. The same key must not be used @@ -125,6 +159,24 @@ that reconfigures the keys. It is wrong to just configure the keys statically an  indefinitely. The suggested and standardized way for key management is 802.1X-2010, which is implemented  by wpa_supplicant.
 
+.SH EXTENDED PACKET NUMBER NOTES
+Passing flag
+.B xpn
+to
+.B ip link add
+command using the
+.I macsec
+type requires using the keyword
+.B 'xpn'
+instead of
+.B 'pn'
+in addition to providing a salt using the .B 'salt'
+keyword when using the
+.B ip macsec
+command.
+
+
 .SH SEE ALSO
 .br
 .BR ip-link (8)
--
2.26.3