linux.git/drivers/net/macsec.c, branch v4.8-rc2

macsec: fix negative refcnt on parent link

2016-07-31T04:11:08+00:00

When creation of a macsec device fails because an identical device
already exists on this link, the current code decrements the refcnt on
the parent link (in ->destructor for the macsec device), but it had not
been incremented yet.

Move the dev_hold(parent_link) call earlier during macsec device
creation.

Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Sabrina Dubroca 
Signed-off-by: David S. Miller

macsec: RXSAs don't need to hold a reference on RXSCs

2016-07-31T04:11:08+00:00

Following the previous patch, RXSCs are held and properly refcounted in
the RX path (instead of being implicitly held by their SA), so the SA
doesn't need to hold a reference on its parent RXSC.

This also avoids panics on module unload caused by the double layer of
RCU callbacks (call_rcu frees the RXSA, which puts the final reference
on the RXSC and allows to free it in its own call_rcu) that commit
b196c22af5c3 ("macsec: add rcu_barrier() on module exit") didn't
protect against.
There were also some refcounting bugs in macsec_add_rxsa where I didn't
put the reference on the RXSC on the error paths, which would lead to
memory leaks.

Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Sabrina Dubroca 
Signed-off-by: David S. Miller

macsec: fix reference counting on RXSC in macsec_handle_frame

2016-07-31T04:11:08+00:00

Currently, we lookup the RXSC without taking a reference on it.  The
RXSA holds a reference on the RXSC, but the SA and SC could still both
disappear before we take a reference on the SA.

Take a reference on the RXSC in macsec_handle_frame.

Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Sabrina Dubroca 
Signed-off-by: David S. Miller

macsec: ensure rx_sa is set when validation is disabled

2016-07-26T21:27:48+00:00

macsec_decrypt() is not called when validation is disabled and so
macsec_skb_cb(skb)->rx_sa is not set; but it is used later in
macsec_post_decrypt(), ensure that it's always initialized.

Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Beniamino Galvani 
Acked-by: Sabrina Dubroca 
Signed-off-by: David S. Miller

macsec: validate ICV length on link creation

2016-07-25T17:55:39+00:00

Test the cipher suite initialization in case ICV length has a value
different than its default. If this test fails, creation of a new macsec
link will also fail. This avoids situations where further security
associations can't be added due to failures of crypto_aead_setauthsize(),
caused by unsupported user-provided values of the ICV length.

Signed-off-by: Davide Caratti 
Signed-off-by: David S. Miller

macsec: fix error codes when a SA is created

2016-07-25T17:55:39+00:00

preserve the return value of AEAD functions that are called when a SA is
created, to avoid inappropriate display of "RTNETLINK answers: Cannot
allocate memory" message.

Signed-off-by: Davide Caratti 
Signed-off-by: David S. Miller

macsec: limit ICV length to 16 octets

2016-07-25T17:55:39+00:00

IEEE 802.1AE-2006 standard recommends that the ICV element in a MACsec
frame should not exceed 16 octets: add MACSEC_STD_ICV_LEN in uapi
definitions accordingly, and avoid accepting configurations where the ICV
length exceeds the standard value. Leave definition of MACSEC_MAX_ICV_LEN
unchanged for backwards compatibility with userspace programs.

Fixes: dece8d2b78d1 ("uapi: add MACsec bits")
Signed-off-by: Davide Caratti 
Signed-off-by: David S. Miller

macsec: enable GRO and RPS on macsec devices

2016-07-22T04:50:41+00:00

Use gro_gells to trigger GRO and allow RPS on macsec traffic
after decryption.
Also, be sure to avoid clearing software offload features in
macsec_fix_features().
Overall this increase TCP tput by 30% on recent h/w.

Signed-off-by: Paolo Abeni 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

macsec: set actual real device for xmit when !protect_frames

2016-07-01T20:35:56+00:00

Avoid recursions of dev_queue_xmit() to the wrong net device when
frames are unprotected, since at that time skb->dev still points to
our own macsec dev and unlike macsec_encrypt_finish() dev pointer
doesn't get updated to real underlying device.

Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Daniel Borkmann 
Acked-by: Sabrina Dubroca 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

macsec: fix SA initialization

2016-06-15T21:47:46+00:00

The ASYNC flag prevents initialization on some physical machines.

Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Sabrina Dubroca 
Signed-off-by: David S. Miller