MACsec IEEE 802.1AE implementation
Subsystems (3)
Sabrina Dubroca
maintainerv2 cover MACsec IEEE 802.1AE implementation
MACsec (IEEE 802.1AE [0]) is a protocol that provides security for wired ethernet LANs. MACsec offers two protection modes:
authentication only, or authenticated encryption.
MACsec defines "secure channels" that allow transmission from one node to one or more others. Communication on a channel is done over a succession of "secure associations", that each use a specific key. Secure associations are identified by their "association number" in the range 0..3. A secure association is retired when its 32-bit packet number would wrap, and the same association number can later be reused with a new key and packet number.
The standard mode of encryption is GCM AES with 128 bits keys, although an extension allows 256 bits keys [1] (not implemented in this submission).
When using MACsec, an extra header, called "SecTAG", is added between the ethernet header and the original payload:
+---------------------------------+----------------+----------------+ | (MACsec ethertype) | TCI_AN | SL | +---------------------------------+----------------+----------------+ | Packet Number | +-------------------------------------------------------------------+ | Secure Channel Identifier | | (optional) | +-------------------------------------------------------------------+
TCI_AN:
version
end_station
sci_present
scb
encrypted
changed_text
association_number (2 bits)
SL:
short_length (6 bits)
unused (2 bits)
The ethertype for the packet is set to 0x88E5, and the original ethertype becomes part of the secure payload, which may be encrypted. The ethernet header and the SecTAG are always transmitted in the clear, but are integrity-protected.
MACsec supports optional replay protection with a configurable replay window.
MACsec is designed to be used with the MKA extension to 802.1X (MACsec Key Agreement protocol) [2], which provides channel attribution and key distribution to the nodes, but can also be used with static keys getting fed manually by an administrator.
Optional (not supported yet) features:
- confidentiality offset: in encryption mode, part of the payload may be left unencrypted.
- choice of cipher suite: GCM AES with 256 bits has been standardised [1].
Implementation
A netdevice is created on top of a real device for each TX secure channel, like we do for VLANs. Multiple TX channels can be created on top of the same underlying device.
Several other approaches were considered for the RX path:
- dev_add_pack: doesn't work, because we want to filter out unprotected packets
- transparent mode: MACsec would be enabled directly on the real netdevice. For this, we cannot use a rx_handler directly because MACsec must be available for underlying devices enslaved in a bridge or in a bond, so we need a hook directly in __netif_receive_skb_core. This approach makes it harder to filter non-encrypted packets on RX without forcing the user to setup some rules, so the "transparent" mode is not so transparent after all. It also makes TX more complex than with a dedicated netdevice.
One issue with the proposed implementation is that the qdisc layer for the real device operates on already encrypted packets.
Netlink API
This is currently a mix of rtnetlink (to create the device and set up the TX channel) and genl (for RX channels, secure associations and their keys). genl provides clean demultiplexing of the {TX,RX}{SC,SA} commands.
Use cases
The normal use case is wired LANs, including veth and slave devices for bonding/teaming or bridges.
MACsec can also be used on any device that makes a full ethernet header visible, for example VXLAN.
The VXLAN+MACsec setup would be:
hypervisor | virtual machine
<real_dev>---<VXLAN>---|---<dev>---<macsec_dev>
And the packets would look like this:
| eth | IP | UDP | VXLAN | eth | MACsec | IP | ... | MACsec ICV |
One benefit on this approach to encryption in the cloud is that the payload is encrypted by the tenant, not by the tunnel provider, thus the tenant has full control over the keys.
Changes from v1:
- rework netlink API after discussion with Johannes Berg
- nest attributes, rename
- export stats as separate attributes
- add some comments
- misc small fixes (rcu, constants, struct organization)
Changes from RFCv2:
- fix ENCODING_SA param validation
- add parent link to netlink ifdumps
Changes from RFCv1:
- addressed comments from Florian and Paolo + kbuild robot
- also perform post-decrypt handling after crypto callback
- fixed ->dellink behavior
Future plans:
- offload to hardware, on nics that support it
- implement optional features
[0] http://standards.ieee.org/getieee802/download/802.1AE-2006.pdf
[1] http://standards.ieee.org/getieee802/download/802.1AEbn-2011.pdf
[2] http://standards.ieee.org/getieee802/download/802.1X-2010.pdf
[3] RFCv1: http://www.spinics.net/lists/netdev/msg358151.html
[4] RFCv2: http://www.spinics.net/lists/netdev/msg362389.html
[5] v1: http://www.spinics.net/lists/netdev/msg367959.html
Sabrina Dubroca (3):
uapi: add MACsec bits
net: add MACsec netdevice priv_flags and helper
macsec: introduce IEEE 802.1AE driver
drivers/net/Kconfig | 7 + drivers/net/Makefile | 1 + drivers/net/macsec.c | 3297 ++++++++++++++++++++++++++++++++++++++++ include/linux/netdevice.h | 8 + include/uapi/linux/Kbuild | 1 + include/uapi/linux/if_ether.h | 1 + include/uapi/linux/if_link.h | 29 + include/uapi/linux/if_macsec.h | 161 ++ 8 files changed, 3505 insertions(+) create mode 100644 drivers/net/macsec.c create mode 100644 include/uapi/linux/if_macsec.h
Signature · 1 line
2.7.2
Sabrina Dubroca
maintainerPATCH v2 1/3 uapi: add MACsec bits
---
v2:
- put MACSEC_VALIDATE_MAX inside enum
- remove unnecessary string
- nest attributes, rename
- export stats as separate attributes
- add some documentation to uapi
v1:
- rebase
RFCv2:
- add include, detected by the kbuild robot
- split off the attributes for RXSC and SA from enum macsec_attrs
--- include/uapi/linux/Kbuild | 1 + include/uapi/linux/if_ether.h | 1 + include/uapi/linux/if_link.h | 29 ++++++++ include/uapi/linux/if_macsec.h | 161 +++++++++++++++++++++++++++++++++++++++++ 4 files changed, 192 insertions(+) create mode 100644 include/uapi/linux/if_macsec.h
include/uapi/linux/Kbuild +1 -0
@@ -173,6 +173,7 @@ header-y += if_hippi.h header-y += if_infiniband.h header-y += if_link.h header-y += if_ltalk.h +header-y += if_macsec.h header-y += if_packet.h header-y += if_phonet.h header-y += if_plip.h
include/uapi/linux/if_ether.h +1 -0
@@ -83,6 +83,7 @@#define ETH_P_8021AD 0x88A8/* 802.1ad Service VLAN */ #define ETH_P_802_EX1 0x88B5/* 802.1 Local Experimental 1. */ #define ETH_P_TIPC 0x88CA/* TIPC */ +#define ETH_P_MACSEC 0x88E5/* 802.1ae MACsec */ #define ETH_P_8021AH 0x88E7/* 802.1ah Backbone Service Tag */ #define ETH_P_MVRP 0x88F5/* 802.1Q MVRP */ #define ETH_P_1588 0x88F7/* IEEE 1588 Timesync */
include/uapi/linux/if_link.h +29 -0
@@ -413,6 +413,35 @@ enum {#define IFLA_VRF_PORT_MAX (__IFLA_VRF_PORT_MAX - 1) +/* MACSEC section */ +enum { +IFLA_MACSEC_UNSPEC , +IFLA_MACSEC_SCI , +IFLA_MACSEC_PORT , +IFLA_MACSEC_ICV_LEN , +IFLA_MACSEC_CIPHER_SUITE , +IFLA_MACSEC_WINDOW , +IFLA_MACSEC_ENCODING_SA , +IFLA_MACSEC_ENCRYPT , +IFLA_MACSEC_PROTECT , +IFLA_MACSEC_INC_SCI , +IFLA_MACSEC_ES , +IFLA_MACSEC_SCB , +IFLA_MACSEC_REPLAY_PROTECT , +IFLA_MACSEC_VALIDATION , + __IFLA_MACSEC_MAX, +}; + +#define IFLA_MACSEC_MAX (__IFLA_MACSEC_MAX - 1) + +enum macsec_validation_type { +MACSEC_VALIDATE_DISABLED =0 , +MACSEC_VALIDATE_CHECK =1 , +MACSEC_VALIDATE_STRICT =2 , + __MACSEC_VALIDATE_END, +MACSEC_VALIDATE_MAX = __MACSEC_VALIDATE_END -1 , +}; +/* IPVLAN section */ enum {IFLA_IPVLAN_UNSPEC ,
include/uapi/linux/if_macsec.h new file +161 -0
161 lines not on this page · raw message
Signature · 1 line
2.7.2
Sabrina Dubroca
maintainerPATCH v2 2/3 net: add MACsec netdevice priv_flags and helper
In reply to Sabrina Dubroca---
v2: no change
v1: rebase
RFCv2: add kerneldoc comment, detected by kbuild robot
--- include/linux/netdevice.h | 8 ++++++++ 1 file changed, 8 insertions(+)
include/linux/netdevice.h +8 -0
@@ -1328,6 +1328,7 @@ struct net_device_ops {* @IFF_RXFH_CONFIGURED: device has had Rx Flow indirection table configured * @IFF_PHONY_HEADROOM: the headroom value is controlled by an external * entity (i.e. the master device for bridged veth) +* @IFF_MACSEC: device is a MACsec device */ enum netdev_priv_flags {IFF_802_1Q_VLAN =1 <<0 ,
@@ -1357,6 +1358,7 @@ enum netdev_priv_flags {IFF_TEAM =1 <<24 ,IFF_RXFH_CONFIGURED =1 <<25 ,IFF_PHONY_HEADROOM =1 <<26 , + IFF_MACSEC = 1<<27, };#define IFF_802_1Q_VLAN IFF_802_1Q_VLAN
@@ -1385,6 +1387,7 @@ enum netdev_priv_flags {#define IFF_L3MDEV_SLAVE IFF_L3MDEV_SLAVE#define IFF_TEAM IFF_TEAM#define IFF_RXFH_CONFIGURED IFF_RXFH_CONFIGURED +#define IFF_MACSEC IFF_MACSEC/** * struct net_device - The DEVICE structure.
@@ -4045,6 +4048,11 @@ static inline void skb_gso_error_unwind(struct sk_buff *skb, __be16 protocol, skb->mac_len = mac_len; } +static inline bool netif_is_macsec (const struct net_device *dev) +{ +return dev->priv_flags &IFF_MACSEC ; +} +static inline bool netif_is_macvlan (const struct net_device *dev) {return dev->priv_flags &IFF_MACVLAN ;
Signature · 1 line
2.7.2
Sabrina Dubroca
maintainerPATCH v2 3/3 macsec: introduce IEEE 802.1AE driver
In reply to Sabrina DubrocaThis is an implementation of MACsec/IEEE 802.1AE. This driver provides authentication and encryption of traffic in a LAN, typically with GCM-AES-128, and optional replay protection.
http://standards.ieee.org/getieee802/download/802.1AE-2006.pdf
---
v2:
- misc fixes (bool, rcu_read_lock on RX, typo, kerneldoc style, constants for shortlen and AN) suggested by David and Johannes
- reorganize SA structs to remove some padding suggested by Johannes
- refactor dump_secy
- match the uapi rework (nesting, renames, export stats as separate attributes) suggested by Johannes
v1:
- fix ENCODING_SA param validation
- add parent link to netlink ifdumps
RFCv2:
- rcu fixes pointed out by Florian
- get rid of magic numbers in shortlength field validation, use a nice helper function instead
- extract post-decrypt handling from macsec_handle_frame to reuse it in the decrypt callback
- needed headroom shouldn't include hard_header len, pointed out by Paolo
- added refcounting on macsec_rx_sc
- fixed ->dellink behavior
--- drivers/net/Kconfig | 7 + drivers/net/Makefile | 1 + drivers/net/macsec.c | 3297 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 3305 insertions(+) create mode 100644 drivers/net/macsec.c
drivers/net/Kconfig +7 -0
@@ -193,6 +193,13 @@ config GENEVE To compile this driver as a module, choose M here: the module will be called geneve. +config MACSEC + tristate "IEEE 802.1AE MAC-level encryption (MACsec)" + select CRYPTO_AES + select CRYPTO_GCM + ---help--- + MACsec is an encryption standard for Ethernet. + config NETCONSOLE tristate "Network console logging support" ---help---
drivers/net/Makefile +1 -0
@@ -10,6 +10,7 @@ obj-$(CONFIG_IPVLAN) += ipvlan/ obj-$(CONFIG_DUMMY) += dummy.o obj-$(CONFIG_EQUALIZER) += eql.o obj-$(CONFIG_IFB) += ifb.o +obj-$(CONFIG_MACSEC) += macsec.o obj-$(CONFIG_MACVLAN) += macvlan.o obj-$(CONFIG_MACVTAP) += macvtap.o obj-$(CONFIG_MII) += mii.o
drivers/net/macsec.c new file +3297 -0
2,980 lines not on this page · raw message
The rest of this diff is not shown. View the raw message.
Signature · 1 line
2.7.2
Part of the diff is not shown here. View the raw message.
Re: [PATCH net-next v2 3/3] macsec: introduce IEEE 802.1AE driver
Hi,
drivers/net/macsec.c line 116
Quoted 12 lines
drivers/net/macsec.c new file +12
-0+struct macsec_rx_sa_stats { +__u32 InPktsOK; +__u32 InPktsInvalid; +__u32 InPktsNotValid; +__u32 InPktsNotUsingSA; +__u32 InPktsUnusedSA; +}; + +struct macsec_tx_sa_stats { +__u32 OutPktsProtected; +__u32 OutPktsEncrypted; +};
Just noticed this: is there a particular reason for using only __u32 here? The others all seem to use __u64.
Quoted 20 lines
+static int
macsec_dump_txsc(struct sk_buff *skb, struct netlink_callback *cb)drivers/net/macsec.c new file +18
-0+{ +struct net *net =sock_net (skb->sk); +struct net_device *dev; +int dev_idx, d; + + dev_idx = cb->args[0 ]; + + d =0 ; +for_each_netdev (net, dev) { +struct macsec_secy *secy; + +if (d < dev_idx) + goto next; + +if (!netif_is_macsec (dev)) + goto next; + + secy = &macsec_priv (dev)->secy;
drivers/net/macsec.c line 2472
Quoted 10 lines
drivers/net/macsec.c new file +10
-0+if (dump_secy (secy, dev, skb, cb) <0 ) + goto done; +next: + d++; + } + +done: + cb->args[0 ] = d; +return skb->len; +}
Maybe you should consider adding genl_dump_check_consistent() support here, so userspace can figure out if the dump was really consistent, if necessary.
To do this, you have to keep a global generation counter that changes whenever this list changes (adding/removing macsec interfaces, I think) and then set
cb->seq = macsec_generation_counter;
at the beginning of this function, and call genl_dump_check_consistent() for each message in the loop.
Btw, aren't you missing locking here for for_each_netdev()?
johannes
Sabrina Dubroca
maintainerRe: [PATCH net-next v2 3/3] macsec: introduce IEEE 802.1AE driver
Hello,
Quoted 17 lines · Johannes Berg
Hi,
drivers/net/macsec.c line 116
Quoted 12 lines
drivers/net/macsec.c new file +12
-0+struct macsec_rx_sa_stats { +__u32 InPktsOK; +__u32 InPktsInvalid; +__u32 InPktsNotValid; +__u32 InPktsNotUsingSA; +__u32 InPktsUnusedSA; +}; + +struct macsec_tx_sa_stats { +__u32 OutPktsProtected; +__u32 OutPktsEncrypted; +};Just noticed this: is there a particular reason for using only
__u32here? The others all seem to use__u64.
The standard defines them this way (Counter32 for the SA stats, Counter64 for the SC/SecY stats).
Quoted 35 lines
Quoted 20 lines
+static int
macsec_dump_txsc(struct sk_buff *skb, struct netlink_callback *cb)drivers/net/macsec.c new file +18
-0+{ +struct net *net =sock_net (skb->sk); +struct net_device *dev; +int dev_idx, d; + + dev_idx = cb->args[0 ]; + + d =0 ; +for_each_netdev (net, dev) { +struct macsec_secy *secy; + +if (d < dev_idx) + goto next; + +if (!netif_is_macsec (dev)) + goto next; + + secy = &macsec_priv (dev)->secy;drivers/net/macsec.c line 2472
Quoted 10 lines
drivers/net/macsec.c new file +10
-0+if (dump_secy (secy, dev, skb, cb) <0 ) + goto done; +next: + d++; + } + +done: + cb->args[0 ] = d; +return skb->len; +}Maybe you should consider adding genl_dump_check_consistent() support here, so userspace can figure out if the dump was really consistent, if necessary.
Quoted 8 lines
To do this, you have to keep a global generation counter that changes whenever this list changes (adding/removing macsec interfaces, I think) and then set
cb->seq = macsec_generation_counter;at the beginning of this function, and call
genl_dump_check_consistent()for each message in the loop.
Thanks, I'll have a look at this.
Quoted 1 line
Btw, aren't you missing locking here for for_each_netdev()?
Oops, yeah.
Signature · 1 line
Sabrina
David Miller
maintainerFrom: Sabrina Dubroca <[email protected]>
Date: Fri, 11 Mar 2016 18:07:30 +0100
Quoted 3 lines
MACsec (IEEE 802.1AE [0]) is a protocol that provides security for wired ethernet LANs. MACsec offers two protection modes:
authentication only, or authenticated encryption.
...
Quoted 1 line
Implementation
...
Quoted 1 line
Netlink API
...
Quoted 1 line
Use cases
...
Probably one of the best cover letters for a new feature written in quite a while, nice work.
Series applied, thanks!