[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20250529124455.2761783-1-carlos.fernandez@technica-engineering.de>
Date: Thu, 29 May 2025 14:44:42 +0200
From: carlos.fernandez@...hnica-engineering.de
To: linux-kernel@...r.kernel.org
Cc: carlos.fernandez@...hnica-engineering.de,
Sabrina Dubroca <sd@...asysnail.net>,
Andrew Lunn <andrew+netdev@...n.ch>,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>,
netdev@...r.kernel.org
Subject: [PATCH net] macsec: MACsec SCI assignment for ES = 0
From: Carlos Fernandez <carlos.fernandez@...hnica-engineering.de>
According to 802.1AE standard, when ES and SC flags in TCI are zero, used
SCI should be the current active SC_RX but current code uses the header
MAC address.
Without this patch, when ES flag is 0 (using a bridge or switch), header
MAC will not be equal to the SCI and MACSec frames will be discarted.
Signed-off-by: Carlos Fernandez <carlos.fernandez@...hnica-engineering.de>
---
drivers/net/macsec.c | 25 ++++++++++++++++++++-----
1 file changed, 20 insertions(+), 5 deletions(-)
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 3d315e30ee47..9a743aee2cea 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -247,15 +247,29 @@ static sci_t make_sci(const u8 *addr, __be16 port)
return sci;
}
-static sci_t macsec_frame_sci(struct macsec_eth_header *hdr, bool sci_present)
+static sci_t macsec_frame_sci(struct macsec_eth_header *hdr, bool sci_present,
+ struct macsec_rxh_data *rxd)
{
- sci_t sci;
+ struct macsec_dev *macsec_device;
+ sci_t sci = 0;
- if (sci_present)
+ if (sci_present) {
memcpy(&sci, hdr->secure_channel_id,
sizeof(hdr->secure_channel_id));
- else
+ } else if (!(hdr->tci_an & (MACSEC_TCI_ES | MACSEC_TCI_SC))) {
+ list_for_each_entry_rcu(macsec_device, &rxd->secys, secys) {
+ struct macsec_secy *secy = &macsec_device->secy;
+ struct macsec_rx_sc *rx_sc;
+
+ for_each_rxsc(secy, rx_sc) {
+ rx_sc = rx_sc ? macsec_rxsc_get(rx_sc) : NULL;
+ if (rx_sc && rx_sc->active)
+ sci = rx_sc->sci;
+ }
+ }
+ } else {
sci = make_sci(hdr->eth.h_source, MACSEC_PORT_ES);
+ }
return sci;
}
@@ -1156,11 +1170,12 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
macsec_skb_cb(skb)->has_sci = !!(hdr->tci_an & MACSEC_TCI_SC);
macsec_skb_cb(skb)->assoc_num = hdr->tci_an & MACSEC_AN_MASK;
- sci = macsec_frame_sci(hdr, macsec_skb_cb(skb)->has_sci);
rcu_read_lock();
rxd = macsec_data_rcu(skb->dev);
+ sci = macsec_frame_sci(hdr, macsec_skb_cb(skb)->has_sci, rxd);
+
list_for_each_entry_rcu(macsec, &rxd->secys, secys) {
struct macsec_rx_sc *sc = find_rx_sc(&macsec->secy, sci);
--
2.43.0
Powered by blists - more mailing lists