mirror of
https://git.proxmox.com/git/mirror_iproute2
synced 2025-08-14 05:16:11 +00:00
ip: add MACsec support
Extend ip-link to create MACsec devices ip link add link <master> <macsec> type macsec [options] Add `ip macsec` command to configure receive-side secure channels and secure associations within a macsec netdevice. Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Acked-by: Phil Sutter <phil@nwl.cc>
This commit is contained in:
Sabrina Dubroca
Stephen Hemminger
parent
609640f5f0
commit
b26fc590ce
@ -7,7 +7,7 @@ IPOBJ=ip.o ipaddress.o ipaddrlabel.o iproute.o iprule.o ipnetns.o \
|
||||
iplink_vxlan.o tcp_metrics.o iplink_ipoib.o ipnetconf.o link_ip6tnl.o \
|
||||
link_iptnl.o link_gre6.o iplink_bond.o iplink_bond_slave.o iplink_hsr.o \
|
||||
iplink_bridge.o iplink_bridge_slave.o ipfou.o iplink_ipvlan.o \
|
||||
iplink_geneve.o iplink_vrf.o iproute_lwtunnel.o
|
||||
iplink_geneve.o iplink_vrf.o iproute_lwtunnel.o ipmacsec.o
|
||||
|
||||
RTMONOBJ=rtmon.o
|
||||
|
||||
|
||||
3
ip/ip.c
3
ip/ip.c
@ -51,7 +51,7 @@ static void usage(void)
|
||||
" ip [ -force ] -batch filename\n"
|
||||
"where OBJECT := { link | address | addrlabel | route | rule | neigh | ntable |\n"
|
||||
" tunnel | tuntap | maddress | mroute | mrule | monitor | xfrm |\n"
|
||||
" netns | l2tp | fou | tcp_metrics | token | netconf }\n"
|
||||
" netns | l2tp | fou | macsec | tcp_metrics | token | netconf }\n"
|
||||
" OPTIONS := { -V[ersion] | -s[tatistics] | -d[etails] | -r[esolve] |\n"
|
||||
" -h[uman-readable] | -iec |\n"
|
||||
" -f[amily] { inet | inet6 | ipx | dnet | mpls | bridge | link } |\n"
|
||||
@ -84,6 +84,7 @@ static const struct cmd {
|
||||
{ "link", do_iplink },
|
||||
{ "l2tp", do_ipl2tp },
|
||||
{ "fou", do_ipfou },
|
||||
{ "macsec", do_ipmacsec },
|
||||
{ "tunnel", do_iptunnel },
|
||||
{ "tunl", do_iptunnel },
|
||||
{ "tuntap", do_iptuntap },
|
||||
|
||||
@ -43,6 +43,7 @@ int do_iptunnel(int argc, char **argv);
|
||||
int do_ip6tunnel(int argc, char **argv);
|
||||
int do_iptuntap(int argc, char **argv);
|
||||
int do_iplink(int argc, char **argv);
|
||||
int do_ipmacsec(int argc, char **argv);
|
||||
int do_ipmonitor(int argc, char **argv);
|
||||
int do_multiaddr(int argc, char **argv);
|
||||
int do_multiroute(int argc, char **argv);
|
||||
|
||||
1301
ip/ipmacsec.c
Normal file
1301
ip/ipmacsec.c
Normal file
File diff suppressed because it is too large
Load Diff
@ -7,7 +7,7 @@ MAN8PAGES = $(TARGETS) ip.8 arpd.8 lnstat.8 routel.8 rtacct.8 rtmon.8 rtpr.8 ss.
|
||||
tc-mqprio.8 tc-netem.8 tc-pfifo.8 tc-pfifo_fast.8 tc-prio.8 tc-red.8 \
|
||||
tc-sfb.8 tc-sfq.8 tc-stab.8 tc-tbf.8 \
|
||||
bridge.8 rtstat.8 ctstat.8 nstat.8 routef.8 \
|
||||
ip-addrlabel.8 ip-fou.8 ip-gue.8 ip-l2tp.8 \
|
||||
ip-addrlabel.8 ip-fou.8 ip-gue.8 ip-l2tp.8 ip-macsec.8 \
|
||||
ip-maddress.8 ip-monitor.8 ip-mroute.8 ip-neighbour.8 \
|
||||
ip-netns.8 ip-ntable.8 ip-rule.8 ip-tunnel.8 ip-xfrm.8 \
|
||||
ip-tcp_metrics.8 ip-netconf.8 ip-token.8 \
|
||||
|
||||
@ -258,6 +258,9 @@ Link types:
|
||||
.sp
|
||||
.BR geneve
|
||||
- GEneric NEtwork Virtualization Encapsulation
|
||||
.sp
|
||||
.BR macsec
|
||||
- Interface for IEEE 802.1AE MAC Security (MACsec)
|
||||
.in -8
|
||||
|
||||
.TP
|
||||
@ -879,6 +882,88 @@ corresponds to the 2010 version of the HSR standard. Option "1" activates the
|
||||
2012 version.
|
||||
.in -8
|
||||
|
||||
.TP
|
||||
MACsec Type Support
|
||||
For a link of type
|
||||
.I MACsec
|
||||
the following additional arguments are supported:
|
||||
|
||||
.BI "ip link add link " DEVICE " name " NAME " type macsec"
|
||||
[
|
||||
.BI port " PORT"
|
||||
|
|
||||
.BI sci " SCI"
|
||||
] [
|
||||
.BI cipher " CIPHER_SUITE"
|
||||
] [
|
||||
.BR encrypt " {"
|
||||
.BR on " | " off " } ] [ "
|
||||
.BR send_sci " { " on " | " off " } ] ["
|
||||
.BR es " { " on " | " off " } ] ["
|
||||
.BR scb " { " on " | " off " } ] ["
|
||||
.BR protect " { " on " | " off " } ] ["
|
||||
.BR replay " { " on " | " off " }"
|
||||
.BR window " { "
|
||||
.IR 0..2^32-1 " } ] ["
|
||||
.BR validate " { " strict " | " check " | " disabled " } ] ["
|
||||
.BR encoding " { "
|
||||
.IR 0..3 " } ]"
|
||||
|
||||
.in +8
|
||||
.sp
|
||||
.BI port " PORT "
|
||||
- sets the port number for this MACsec device.
|
||||
|
||||
.sp
|
||||
.BI sci " SCI "
|
||||
- sets the SCI for this MACsec device.
|
||||
|
||||
.sp
|
||||
.BI cipher " CIPHER_SUITE "
|
||||
- defines the cipher suite to use.
|
||||
|
||||
.sp
|
||||
.BR "encrypt on " or " encrypt off"
|
||||
- switches between authenticated encryption, or authenticity mode only.
|
||||
|
||||
.sp
|
||||
.BR "send_sci on " or " send_sci off"
|
||||
- specifies whether the SCI is included in every packet, or only when it is necessary.
|
||||
|
||||
.sp
|
||||
.BR "es on " or " es off"
|
||||
- sets the End Station bit.
|
||||
|
||||
.sp
|
||||
.BR "scb on " or " scb off"
|
||||
- sets the Single Copy Broadcast bit.
|
||||
|
||||
.sp
|
||||
.BR "protect on " or " protect off"
|
||||
- enables MACsec protection on the device.
|
||||
|
||||
.sp
|
||||
.BR "replay on " or " replay off"
|
||||
- enables replay protection on the device.
|
||||
|
||||
.in +8
|
||||
|
||||
.sp
|
||||
.BI window " SIZE "
|
||||
- sets the size of the replay window.
|
||||
|
||||
.in -8
|
||||
|
||||
.sp
|
||||
.BR "validate strict " or " validate check " or " validate disabled"
|
||||
- sets the validation mode on the device.
|
||||
|
||||
.sp
|
||||
.BI encoding " AN "
|
||||
- sets the active secure association for transmission.
|
||||
|
||||
.in -8
|
||||
|
||||
.SS ip link delete - delete virtual link
|
||||
|
||||
.TP
|
||||
|
||||
98
man/man8/ip-macsec.8
Normal file
98
man/man8/ip-macsec.8
Normal file
@ -0,0 +1,98 @@
|
||||
.TH IP\-MACSEC 8 "07 Mar 2016" "iproute" "Linux"
|
||||
.SH NAME
|
||||
ip-macsec \- MACsec device configuration
|
||||
.SH "SYNOPSIS"
|
||||
.BI "ip link add link " DEVICE " name " NAME " type macsec "
|
||||
[ [
|
||||
.BR cipher " { " default " | " gcm-aes-128 " } ] "
|
||||
.BI icvlen " ICVLEN"
|
||||
] [ [
|
||||
.BR encrypt " { " on " | " off " } ] ["
|
||||
.BR send_sci " { " on " | " off " } ] ["
|
||||
.BR end_station " { " on " | " off " } ] ["
|
||||
.BR scb " { " on " | " off " } ] ["
|
||||
.BR protect " { " on " | " off " } ] ["
|
||||
.BR replay " { " on " | " off " } ] ["
|
||||
.BI window " WINDOW"
|
||||
] [
|
||||
.BI encodingsa " SA"
|
||||
]
|
||||
|
||||
.BI "ip macsec add " DEV " tx sa"
|
||||
.RI "{ " 0..3 " } [ " OPTS " ]"
|
||||
.BI key " ID KEY"
|
||||
.br
|
||||
.BI "ip macsec set " DEV " tx sa"
|
||||
.RI "{ " 0..3 " } [ " OPTS " ]"
|
||||
.br
|
||||
.BI "ip macsec del " DEV " tx sa"
|
||||
.RI "{ " 0..3 " }"
|
||||
|
||||
.BI "ip macsec add " DEV " rx " SCI
|
||||
.RB [ " on " | " off " ]
|
||||
.br
|
||||
.BI "ip macsec set " DEV " rx " SCI
|
||||
.RB [ " on " | " off " ]
|
||||
.br
|
||||
.BI "ip macsec del " DEV " rx " SCI
|
||||
|
||||
.BI "ip macsec add " DEV " rx " SCI " sa"
|
||||
.RI "{ " 0..3 " } [ " OPTS " ]"
|
||||
.BI key " ID KEY"
|
||||
.br
|
||||
.BI "ip macsec set " DEV " rx " SCI " sa"
|
||||
.RI "{ " 0..3 " } [ " OPTS " ]"
|
||||
.br
|
||||
.BI "ip macsec del " DEV " rx " SCI " sa"
|
||||
.RI "{ " 0..3 " }"
|
||||
|
||||
.B ip macsec show
|
||||
.RI [ " DEV " ]
|
||||
|
||||
.IR OPTS " := [ "
|
||||
.BR pn " { "
|
||||
.IR 1..2^32-1 " } ] ["
|
||||
.BR on " | " off " ]"
|
||||
.br
|
||||
.IR SCI " := { "
|
||||
.B sci
|
||||
.IR <u64> " | "
|
||||
.BI port " <u16> " address " <lladdr> "
|
||||
}
|
||||
|
||||
|
||||
.SH DESCRIPTION
|
||||
The
|
||||
.B ip macsec
|
||||
commands are used to configure transmit secure associations and receive secure channels and their secure associations on a MACsec device created with the
|
||||
.B ip link add
|
||||
command using the
|
||||
.I macsec
|
||||
type.
|
||||
|
||||
.SH EXAMPLES
|
||||
.PP
|
||||
.SS Create a MACsec device on link eth0
|
||||
.nf
|
||||
# ip link add device eth0 macsec0 type macsec port 11 encrypt on
|
||||
.PP
|
||||
.SS Configure a secure association on that device
|
||||
.nf
|
||||
# ip macsec add macsec0 tx sa 0 pn 1024 on key 01 81818181818181818181818181818181
|
||||
.PP
|
||||
.SS Configure a receive channel
|
||||
.nf
|
||||
# ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0
|
||||
.PP
|
||||
.SS Configure a receive association
|
||||
.nf
|
||||
# ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0 sa 0 pn 1 on key 00 82828282828282828282828282828282
|
||||
.PP
|
||||
.SS Display MACsec configuration
|
||||
.nf
|
||||
# ip macsec show
|
||||
.SH SEE ALSO
|
||||
.br
|
||||
.BR ip-link (8)
|
||||
.SH AUTHOR
|
||||
Sabrina Dubroca <sd@queasysnail.net>
|
||||
Loading…
Reference in New Issue
Block a user