This patch adds the necessary functions to compute and check the HMAC signature of an SR-enabled packet. Two HMAC algorithms are supported: hmac(sha1) and hmac(sha256). In order to avoid dynamic memory allocation for each HMAC computation, a per-cpu ring buffer is allocated for this purpose. A new per-interface sysctl called seg6_require_hmac is added, allowing a user-defined policy for processing HMAC-signed SR-enabled packets. A value of -1 means that the HMAC field will always be ignored. A value of 0 means that if an HMAC field is present, its validity will be enforced (the packet is dropped is the signature is incorrect). Finally, a value of 1 means that any SR-enabled packet that does not contain an HMAC signature or whose signature is incorrect will be dropped.
Showing the changes to include/uapi/linux (2 of 10 files). Show all
Unified · Split
| @@ -180,6 +180,7 @@ enum { · 179 unmodified lines | ||
| 180 | 180 | DEVCONF_KEEP_ADDR_ON_DOWN, |
| 181 | 181 | DEVCONF_RTR_SOLICIT_MAX_INTERVAL, |
| 182 | 182 | DEVCONF_SEG6_ENABLED, |
| 183 | + DEVCONF_SEG6_REQUIRE_HMAC, | |
| 183 | 184 | DEVCONF_MAX |
| 184 | 185 | }; |
| 185 | 186 | |
| @@ -0,0 +1,21 @@ | ||
| 1 | +#ifndef _UAPI_LINUX_SEG6_HMAC_H | |
| 2 | +#define _UAPI_LINUX_SEG6_HMAC_H | |
| 3 | + | |
| 4 | +#include <linux/seg6.h> | |
| 5 | + | |
| 6 | +#define SEG6_HMAC_SECRET_LEN 64 | |
| 7 | +#define SEG6_HMAC_FIELD_LEN 32 | |
| 8 | + | |
| 9 | +struct sr6_tlv_hmac { | |
| 10 | + struct sr6_tlv tlvhdr; | |
| 11 | + __u16 reserved; | |
| 12 | + __be32 hmackeyid; | |
| 13 | + __u8 hmac[SEG6_HMAC_FIELD_LEN]; | |
| 14 | +}; | |
| 15 | + | |
| 16 | +enum { | |
| 17 | + SEG6_HMAC_ALGO_SHA1 = 1, | |
| 18 | + SEG6_HMAC_ALGO_SHA256 = 2, | |
| 19 | +}; | |
| 20 | + | |
| 21 | +#endif | |