netdev - [PATCH main 1/1] macsec: Fix Macsec replay protection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 Jan 2023 10:02:19 +0200
From:   <ehakim@...dia.com>
To:     <sd@...asysnail.net>
CC:     <dsahern@...nel.org>, <netdev@...r.kernel.org>,
        Emeel Hakim <ehakim@...dia.com>, Raed Salem <raeds@...dia.com>
Subject: [PATCH main 1/1] macsec: Fix Macsec replay protection

From: Emeel Hakim <ehakim@...dia.com>

Currently when configuring macsec with replay protection,
replay protection and window gets a default value of -1,
the above is leading to passing replay protection and
replay window attributes to the kernel while replay is
explicitly set to off, leading for an invalid argument
error when configured with extended packet number (XPN).
since the default window value which is 0xFFFFFFFF is
passed to the kernel and while XPN is configured the above
value is an invalid window value.

Example:
ip link add link eth2 macsec0 type macsec sci 1 cipher
gcm-aes-xpn-128 replay off

RTNETLINK answers: Invalid argument

Fix by using a boolean variable for replay protect with a default value
of false.

Fixes: b26fc590ce62 ("ip: add MACsec support")
Signed-off-by: Emeel Hakim <ehakim@...dia.com>
Reviewed-by: Raed Salem <raeds@...dia.com>
---
 ip/ipmacsec.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/ip/ipmacsec.c b/ip/ipmacsec.c
index 6dd73827..e2809fd6 100644
--- a/ip/ipmacsec.c
+++ b/ip/ipmacsec.c
@@ -1356,8 +1356,7 @@ static int macsec_parse_opt(struct link_util *lu, int argc, char **argv,
 	enum macsec_offload offload;
 	struct cipher_args cipher = {0};
 	enum macsec_validation_type validate;
-	bool es = false, scb = false, send_sci = false;
-	int replay_protect = -1;
+	bool es = false, scb = false, send_sci = false, replay_protect = false;
 	struct sci sci = { 0 };
 
 	ret = get_sci_portaddr(&sci, &argc, &argv, true, true);
@@ -1453,7 +1452,7 @@ static int macsec_parse_opt(struct link_util *lu, int argc, char **argv,
 			i = parse_on_off("replay", *argv, &ret);
 			if (ret != 0)
 				return ret;
-			replay_protect = !!i;
+			replay_protect = i;
 		} else if (strcmp(*argv, "window") == 0) {
 			NEXT_ARG();
 			ret = get_u32(&window, *argv, 0);
@@ -1498,12 +1497,12 @@ static int macsec_parse_opt(struct link_util *lu, int argc, char **argv,
 		return -1;
 	}
 
-	if (window != -1 && replay_protect == -1) {
+	if (window != -1 && !replay_protect) {
 		fprintf(stderr,
 			"replay window set, but replay protection not enabled. did you mean 'replay on window %u'?\n",
 			window);
 		return -1;
-	} else if (window == -1 && replay_protect == 1) {
+	} else if (window == -1 && replay_protect) {
 		fprintf(stderr,
 			"replay protection enabled, but no window set. did you mean 'replay on window VALUE'?\n");
 		return -1;
@@ -1516,7 +1515,7 @@ static int macsec_parse_opt(struct link_util *lu, int argc, char **argv,
 		addattr_l(n, MACSEC_BUFLEN, IFLA_MACSEC_ICV_LEN,
 			  &cipher.icv_len, sizeof(cipher.icv_len));
 
-	if (replay_protect != -1) {
+	if (replay_protect) {
 		addattr32(n, MACSEC_BUFLEN, IFLA_MACSEC_WINDOW, window);
 		addattr8(n, MACSEC_BUFLEN, IFLA_MACSEC_REPLAY_PROTECT,
 			 replay_protect);
-- 
2.21.3