|
 |
4aca6e |
From 2dbe403fcb0dac676d4f57125238630812342b9b Mon Sep 17 00:00:00 2001
|
|
|
4aca6e |
From: Phil Sutter <psutter@redhat.com>
|
|
|
4aca6e |
Date: Tue, 21 Feb 2017 22:09:56 +0100
|
|
|
4aca6e |
Subject: [PATCH] macsec: fix input range of 'icvlen' parameter
|
|
|
4aca6e |
|
|
|
4aca6e |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1373121
|
|
|
4aca6e |
Upstream Status: iproute2.git commit f20f5f79909fd
|
|
|
4aca6e |
Conflicts:
|
|
|
4aca6e |
* Added missing MACSEC_STD_ICV_LEN define to linux headers.
|
|
|
4aca6e |
|
|
|
4aca6e |
commit f20f5f79909fdc6327fcd015a3850645a236729d
|
|
|
4aca6e |
Author: Davide Caratti <dcaratti@redhat.com>
|
|
|
4aca6e |
Date: Fri Sep 9 16:02:22 2016 +0200
|
|
|
4aca6e |
|
|
|
4aca6e |
macsec: fix input range of 'icvlen' parameter
|
|
|
4aca6e |
|
|
|
4aca6e |
the maximum possible ICV length in a MACsec frame is 16 octects, not 32:
|
|
|
4aca6e |
fix get_icvlen() accordingly, so that a proper error message is displayed
|
|
|
4aca6e |
in case input 'icvlen' is greater than 16.
|
|
|
4aca6e |
|
|
|
4aca6e |
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
|
|
|
4aca6e |
Acked-by: Phil Sutter <phil@nwl.cc>
|
|
|
4aca6e |
Acked-by: Sabrina Dubroca <sd@queasysnail.net>
|
|
|
4aca6e |
---
|
|
|
4aca6e |
include/linux/if_macsec.h | 2 ++
|
|
|
4aca6e |
ip/ipmacsec.c | 4 ++--
|
|
|
4aca6e |
2 files changed, 4 insertions(+), 2 deletions(-)
|
|
|
4aca6e |
|
|
|
4aca6e |
diff --git a/include/linux/if_macsec.h b/include/linux/if_macsec.h
|
|
|
4aca6e |
index cbd4faa..22939a3 100644
|
|
|
4aca6e |
--- a/include/linux/if_macsec.h
|
|
|
4aca6e |
+++ b/include/linux/if_macsec.h
|
|
|
4aca6e |
@@ -26,6 +26,8 @@
|
|
|
4aca6e |
|
|
|
4aca6e |
#define MACSEC_MIN_ICV_LEN 8
|
|
|
4aca6e |
#define MACSEC_MAX_ICV_LEN 32
|
|
|
4aca6e |
+/* upper limit for ICV length as recommended by IEEE802.1AE-2006 */
|
|
|
4aca6e |
+#define MACSEC_STD_ICV_LEN 16
|
|
|
4aca6e |
|
|
|
4aca6e |
enum macsec_attrs {
|
|
|
4aca6e |
MACSEC_ATTR_UNSPEC,
|
|
|
4aca6e |
diff --git a/ip/ipmacsec.c b/ip/ipmacsec.c
|
|
|
4aca6e |
index 596594f..0c51bfc 100644
|
|
|
4aca6e |
--- a/ip/ipmacsec.c
|
|
|
4aca6e |
+++ b/ip/ipmacsec.c
|
|
|
4aca6e |
@@ -167,9 +167,9 @@ static void get_icvlen(__u8 *icvlen, char *arg)
|
|
|
4aca6e |
if (ret)
|
|
|
4aca6e |
invarg("expected ICV length", arg);
|
|
|
4aca6e |
|
|
|
4aca6e |
- if (*icvlen < MACSEC_MIN_ICV_LEN || *icvlen > MACSEC_MAX_ICV_LEN)
|
|
|
4aca6e |
+ if (*icvlen < MACSEC_MIN_ICV_LEN || *icvlen > MACSEC_STD_ICV_LEN)
|
|
|
4aca6e |
invarg("ICV length must be in the range {"
|
|
|
4aca6e |
- STR(MACSEC_MIN_ICV_LEN) ".." STR(MACSEC_MAX_ICV_LEN)
|
|
|
4aca6e |
+ STR(MACSEC_MIN_ICV_LEN) ".." STR(MACSEC_STD_ICV_LEN)
|
|
|
4aca6e |
"}", arg);
|
|
|
4aca6e |
}
|
|
|
4aca6e |
|
|
|
4aca6e |
--
|
|
|
4aca6e |
1.8.3.1
|
|
|
4aca6e |
|