This patch adds the necessary functions to compute and check the HMAC signature of an SR-enabled packet. Two HMAC algorithms are supported: hmac(sha1) and hmac(sha256). In order to avoid dynamic memory allocation for each HMAC computation, a per-cpu ring buffer is allocated for this purpose. A new per-interface sysctl called seg6_require_hmac is added, allowing a user-defined policy for processing HMAC-signed SR-enabled packets. A value of -1 means that the HMAC field will always be ignored. A value of 0 means that if an HMAC field is present, its validity will be enforced (the packet is dropped is the signature is incorrect). Finally, a value of 1 means that any SR-enabled packet that does not contain an HMAC signature or whose signature is incorrect will be dropped.
Showing the changes to include/uapi/linux (2 of 10 files). Show all
Unified · Split
| @@ -180,6 +180,7 @@ enum { · 179 unmodified lines | |||
| 180 | DEVCONF_KEEP_ADDR_ON_DOWN, | 180 | DEVCONF_KEEP_ADDR_ON_DOWN, |
| 181 | DEVCONF_RTR_SOLICIT_MAX_INTERVAL, | 181 | DEVCONF_RTR_SOLICIT_MAX_INTERVAL, |
| 182 | DEVCONF_SEG6_ENABLED, | 182 | DEVCONF_SEG6_ENABLED, |
| 183 | DEVCONF_SEG6_REQUIRE_HMAC, | ||
| 183 | DEVCONF_MAX | 184 | DEVCONF_MAX |
| 184 | }; | 185 | }; |
| 185 | 186 | ||
| @@ -0,0 +1,21 @@ | |||
| 1 | #ifndef _UAPI_LINUX_SEG6_HMAC_H | ||
| 2 | #define _UAPI_LINUX_SEG6_HMAC_H | ||
| 3 | |||
| 4 | #include <linux/seg6.h> | ||
| 5 | |||
| 6 | #define SEG6_HMAC_SECRET_LEN 64 | ||
| 7 | #define SEG6_HMAC_FIELD_LEN 32 | ||
| 8 | |||
| 9 | struct sr6_tlv_hmac { | ||
| 10 | struct sr6_tlv tlvhdr; | ||
| 11 | __u16 reserved; | ||
| 12 | __be32 hmackeyid; | ||
| 13 | __u8 hmac[SEG6_HMAC_FIELD_LEN]; | ||
| 14 | }; | ||
| 15 | |||
| 16 | enum { | ||
| 17 | SEG6_HMAC_ALGO_SHA1 = 1, | ||
| 18 | SEG6_HMAC_ALGO_SHA256 = 2, | ||
| 19 | }; | ||
| 20 | |||
| 21 | #endif | ||