diff options
Diffstat (limited to 'src/devices/nm-device-macsec.c')
| -rw-r--r-- | src/devices/nm-device-macsec.c | 1009 |
1 files changed, 1009 insertions, 0 deletions
diff --git a/src/devices/nm-device-macsec.c b/src/devices/nm-device-macsec.c new file mode 100644 index 00000000..c511a0e7 --- /dev/null +++ b/src/devices/nm-device-macsec.c @@ -0,0 +1,1009 @@ +/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */ +/* NetworkManager -- Network link manager + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Copyright 2017 Red Hat, Inc. + */ + +#include "nm-default.h" + +#include "nm-device-macsec.h" + +#include "nm-act-request.h" +#include "nm-device-private.h" +#include "platform/nm-platform.h" +#include "nm-device-factory.h" +#include "nm-manager.h" +#include "nm-setting-macsec.h" +#include "nm-core-internal.h" +#include "supplicant/nm-supplicant-manager.h" +#include "supplicant/nm-supplicant-interface.h" +#include "supplicant/nm-supplicant-config.h" + +#include "introspection/org.freedesktop.NetworkManager.Device.Macsec.h" + +#include "nm-device-logging.h" +_LOG_DECLARE_SELF(NMDeviceMacsec); + +/*****************************************************************************/ + +typedef struct Supplicant { + NMSupplicantManager *mgr; + NMSupplicantInterface *iface; + + /* signal handler ids */ + gulong iface_error_id; + gulong iface_state_id; + + /* Timeouts and idles */ + guint con_timeout_id; +} Supplicant; + +NM_GOBJECT_PROPERTIES_DEFINE (NMDeviceMacsec, + PROP_SCI, + PROP_CIPHER_SUITE, + PROP_ICV_LENGTH, + PROP_WINDOW, + PROP_ENCODING_SA, + PROP_ENCRYPT, + PROP_PROTECT, + PROP_INCLUDE_SCI, + PROP_ES, + PROP_SCB, + PROP_REPLAY_PROTECT, + PROP_VALIDATION, +); + +typedef struct { + NMPlatformLnkMacsec props; + gulong parent_state_id; + Supplicant supplicant; + guint supplicant_timeout_id; + NMActRequestGetSecretsCallId macsec_secrets_id; +} NMDeviceMacsecPrivate; + +struct _NMDeviceMacsec { + NMDevice parent; + NMDeviceMacsecPrivate _priv; +}; + +struct _NMDeviceMacsecClass { + NMDeviceClass parent; +}; + +G_DEFINE_TYPE (NMDeviceMacsec, nm_device_macsec, NM_TYPE_DEVICE) + +#define NM_DEVICE_MACSEC_GET_PRIVATE(self) _NM_GET_PRIVATE (self, NMDeviceMacsec, NM_IS_DEVICE_MACSEC) + +/******************************************************************/ + +#define MACSEC_SECRETS_TRIES "macsec-secrets-tries" + +static void macsec_secrets_cancel (NMDeviceMacsec *self); + +/******************************************************************/ + +NM_UTILS_LOOKUP_STR_DEFINE_STATIC (validation_mode_to_string, guint8, + NM_UTILS_LOOKUP_DEFAULT_WARN ("<unknown>"), + NM_UTILS_LOOKUP_STR_ITEM (0, "disable"), + NM_UTILS_LOOKUP_STR_ITEM (1, "check"), + NM_UTILS_LOOKUP_STR_ITEM (2, "strict"), +); + +static void +parent_state_changed (NMDevice *parent, + NMDeviceState new_state, + NMDeviceState old_state, + NMDeviceStateReason reason, + gpointer user_data) +{ + NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data); + + /* We'll react to our own carrier state notifications. Ignore the parent's. */ + if (reason == NM_DEVICE_STATE_REASON_CARRIER) + return; + + nm_device_set_unmanaged_by_flags (NM_DEVICE (self), NM_UNMANAGED_PARENT, !nm_device_get_managed (parent, FALSE), reason); +} + +static void +parent_changed_notify (NMDevice *device, + int old_ifindex, + NMDevice *old_parent, + int new_ifindex, + NMDevice *new_parent) +{ + NMDeviceMacsec *self = NM_DEVICE_MACSEC (device); + NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + + NM_DEVICE_CLASS (nm_device_macsec_parent_class)->parent_changed_notify (device, + old_ifindex, + old_parent, + new_ifindex, + new_parent); + + /* note that @self doesn't have to clear @parent_state_id on dispose, + * because NMDevice's dispose() will unset the parent, which in turn calls + * parent_changed_notify(). */ + nm_clear_g_signal_handler (old_parent, &priv->parent_state_id); + + if (new_parent) { + priv->parent_state_id = g_signal_connect (new_parent, + NM_DEVICE_STATE_CHANGED, + G_CALLBACK (parent_state_changed), + device); + + /* Set parent-dependent unmanaged flag */ + nm_device_set_unmanaged_by_flags (device, + NM_UNMANAGED_PARENT, + !nm_device_get_managed (new_parent, FALSE), + NM_DEVICE_STATE_REASON_PARENT_MANAGED_CHANGED); + } + + /* Recheck availability now that the parent has changed */ + if (new_ifindex > 0) { + nm_device_queue_recheck_available (device, + NM_DEVICE_STATE_REASON_PARENT_CHANGED, + NM_DEVICE_STATE_REASON_PARENT_CHANGED); + } +} + +static void +update_properties (NMDevice *device) +{ + NMDeviceMacsec *self; + NMDeviceMacsecPrivate *priv; + const NMPlatformLink *plink = NULL; + const NMPlatformLnkMacsec *props = NULL; + int ifindex; + + g_return_if_fail (NM_IS_DEVICE_MACSEC (device)); + self = NM_DEVICE_MACSEC (device); + priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + + ifindex = nm_device_get_ifindex (device); + g_return_if_fail (ifindex > 0); + props = nm_platform_link_get_lnk_macsec (NM_PLATFORM_GET, ifindex, &plink); + + if (!props) { + _LOGW (LOGD_PLATFORM, "could not get macsec properties"); + return; + } + + g_object_freeze_notify ((GObject *) device); + + if (priv->props.parent_ifindex != props->parent_ifindex) + nm_device_parent_set_ifindex (device, props->parent_ifindex); + +#define CHECK_PROPERTY_CHANGED(field, prop) \ + if (props->field != priv->props.field) \ + _notify (self, prop) + + CHECK_PROPERTY_CHANGED (sci, PROP_SCI); + CHECK_PROPERTY_CHANGED (cipher_suite, PROP_CIPHER_SUITE); + CHECK_PROPERTY_CHANGED (window, PROP_WINDOW); + CHECK_PROPERTY_CHANGED (icv_length, PROP_ICV_LENGTH); + CHECK_PROPERTY_CHANGED (encoding_sa, PROP_ENCODING_SA); + CHECK_PROPERTY_CHANGED (validation, PROP_VALIDATION); + CHECK_PROPERTY_CHANGED (encrypt, PROP_ENCRYPT); + CHECK_PROPERTY_CHANGED (protect, PROP_PROTECT); + CHECK_PROPERTY_CHANGED (include_sci, PROP_INCLUDE_SCI); + CHECK_PROPERTY_CHANGED (es, PROP_ES); + CHECK_PROPERTY_CHANGED (scb, PROP_SCB); + CHECK_PROPERTY_CHANGED (replay_protect, PROP_REPLAY_PROTECT); + + priv->props = *props; + g_object_thaw_notify ((GObject *) device); +} + +static NMSupplicantConfig * +build_supplicant_config (NMDeviceMacsec *self, GError **error) +{ + NMSupplicantConfig *config = NULL; + NMSettingMacsec *s_macsec; + NMSetting8021x *s_8021x; + NMConnection *connection; + const char *con_uuid; + guint32 mtu; + + connection = nm_device_get_applied_connection (NM_DEVICE (self)); + g_assert (connection); + con_uuid = nm_connection_get_uuid (connection); + mtu = nm_platform_link_get_mtu (NM_PLATFORM_GET, + nm_device_get_ifindex (NM_DEVICE (self))); + + config = nm_supplicant_config_new (); + + s_macsec = (NMSettingMacsec *) + nm_device_get_applied_setting (NM_DEVICE (self), NM_TYPE_SETTING_MACSEC); + + if (!nm_supplicant_config_add_setting_macsec (config, s_macsec, error)) { + g_prefix_error (error, "macsec-setting: "); + g_object_unref (config); + return NULL; + } + + if (nm_setting_macsec_get_mode (s_macsec) == NM_SETTING_MACSEC_MODE_EAP) { + s_8021x = nm_connection_get_setting_802_1x (connection); + if (!nm_supplicant_config_add_setting_8021x (config, s_8021x, con_uuid, mtu, TRUE, error)) { + g_prefix_error (error, "802-1x-setting: "); + g_clear_object (&config); + } + } + + return config; +} + +static void +supplicant_interface_clear_handlers (NMDeviceMacsec *self) +{ + NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + + nm_clear_g_source (&priv->supplicant_timeout_id); + nm_clear_g_source (&priv->supplicant.con_timeout_id); + nm_clear_g_signal_handler (priv->supplicant.iface, &priv->supplicant.iface_error_id); +} + +static void +supplicant_interface_release (NMDeviceMacsec *self) +{ + NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + + supplicant_interface_clear_handlers (self); + + nm_clear_g_signal_handler (priv->supplicant.iface, &priv->supplicant.iface_state_id); + + if (priv->supplicant.iface) { + nm_supplicant_interface_disconnect (priv->supplicant.iface); + g_clear_object (&priv->supplicant.iface); + } +} + +static void +supplicant_iface_connection_error_cb (NMSupplicantInterface *iface, + const char *name, + const char *message, + gpointer user_data) +{ + NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data); + + _LOGW (LOGD_DEVICE, + "Activation: association request to the supplicant failed: %s - %s", + name, message); + + supplicant_interface_release (self); + nm_device_queue_state (NM_DEVICE (self), + NM_DEVICE_STATE_FAILED, + NM_DEVICE_STATE_REASON_SUPPLICANT_CONFIG_FAILED); +} + +static void +macsec_secrets_cb (NMActRequest *req, + NMActRequestGetSecretsCallId call_id, + NMSettingsConnection *connection, + GError *error, + gpointer user_data) +{ + NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data); + NMDevice *device = NM_DEVICE (self); + NMDeviceMacsecPrivate *priv; + + g_return_if_fail (NM_IS_DEVICE_MACSEC (self)); + g_return_if_fail (NM_IS_ACT_REQUEST (req)); + + priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + + g_return_if_fail (priv->macsec_secrets_id == call_id); + + priv->macsec_secrets_id = NULL; + + if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED)) + return; + + g_return_if_fail (req == nm_device_get_act_request (device)); + g_return_if_fail (nm_device_get_state (device) == NM_DEVICE_STATE_NEED_AUTH); + g_return_if_fail (nm_act_request_get_settings_connection (req) == connection); + + if (error) { + _LOGW (LOGD_ETHER, "%s", error->message); + nm_device_state_changed (device, + NM_DEVICE_STATE_FAILED, + NM_DEVICE_STATE_REASON_NO_SECRETS); + } else + nm_device_activate_schedule_stage1_device_prepare (device); +} + +static void +macsec_secrets_cancel (NMDeviceMacsec *self) +{ + NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + + if (priv->macsec_secrets_id) + nm_act_request_cancel_secrets (NULL, priv->macsec_secrets_id); + nm_assert (!priv->macsec_secrets_id); +} + +static void +macsec_secrets_get_secrets (NMDeviceMacsec *self, + const char *setting_name, + NMSecretAgentGetSecretsFlags flags) +{ + NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + NMActRequest *req; + + macsec_secrets_cancel (self); + + req = nm_device_get_act_request (NM_DEVICE (self)); + g_return_if_fail (NM_IS_ACT_REQUEST (req)); + + priv->macsec_secrets_id = nm_act_request_get_secrets (req, + TRUE, + setting_name, + flags, + NULL, + macsec_secrets_cb, + self); + g_return_if_fail (priv->macsec_secrets_id); +} + +static gboolean +link_timeout_cb (gpointer user_data) +{ + NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data); + NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + NMDevice *dev = NM_DEVICE (self); + NMActRequest *req; + NMConnection *applied_connection; + const char *setting_name; + + priv->supplicant_timeout_id = 0; + + req = nm_device_get_act_request (dev); + + if (nm_device_get_state (dev) == NM_DEVICE_STATE_ACTIVATED) { + nm_device_state_changed (dev, + NM_DEVICE_STATE_FAILED, + NM_DEVICE_STATE_REASON_SUPPLICANT_TIMEOUT); + return FALSE; + } + + /* Disconnect event during initial authentication and credentials + * ARE checked - we are likely to have wrong key. Ask the user for + * another one. + */ + if (nm_device_get_state (dev) != NM_DEVICE_STATE_CONFIG) + goto time_out; + + nm_active_connection_clear_secrets (NM_ACTIVE_CONNECTION (req)); + + applied_connection = nm_act_request_get_applied_connection (req); + setting_name = nm_connection_need_secrets (applied_connection, NULL); + if (!setting_name) + goto time_out; + + _LOGI (LOGD_DEVICE | LOGD_ETHER, + "Activation: disconnected during authentication, asking for new key."); + supplicant_interface_release (self); + + nm_device_state_changed (dev, NM_DEVICE_STATE_NEED_AUTH, NM_DEVICE_STATE_REASON_SUPPLICANT_DISCONNECT); + macsec_secrets_get_secrets (self, setting_name, NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW); + + return FALSE; + +time_out: + _LOGW (LOGD_DEVICE | LOGD_ETHER, "link timed out."); + nm_device_state_changed (dev, NM_DEVICE_STATE_FAILED, NM_DEVICE_STATE_REASON_SUPPLICANT_DISCONNECT); + + return FALSE; +} + +static void +supplicant_iface_state_cb (NMSupplicantInterface *iface, + guint32 new_state, + guint32 old_state, + int disconnect_reason, + gpointer user_data) +{ + NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data); + NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + NMDevice *device = NM_DEVICE (self); + NMSupplicantConfig *config; + gboolean success = FALSE; + NMDeviceState devstate; + GError *error = NULL; + + if (new_state == old_state) + return; + + _LOGI (LOGD_DEVICE, "supplicant interface state: %s -> %s", + nm_supplicant_interface_state_to_string (old_state), + nm_supplicant_interface_state_to_string (new_state)); + + devstate = nm_device_get_state (device); + + switch (new_state) { + case NM_SUPPLICANT_INTERFACE_STATE_READY: + config = build_supplicant_config (self, &error); + if (config) { + success = nm_supplicant_interface_set_config (priv->supplicant.iface, config, &error); + g_object_unref (config); + + if (!success) { + _LOGE (LOGD_DEVICE, + "Activation: couldn't send security configuration to the supplicant: %s", + error->message); + g_clear_error (&error); + } + } else { + _LOGE (LOGD_DEVICE, + "Activation: couldn't build security configuration: %s", + error->message); + g_clear_error (&error); + } + + if (!success) { + nm_device_state_changed (device, + NM_DEVICE_STATE_FAILED, + NM_DEVICE_STATE_REASON_SUPPLICANT_CONFIG_FAILED); + } + break; + case NM_SUPPLICANT_INTERFACE_STATE_COMPLETED: + supplicant_interface_clear_handlers (self); + nm_device_bring_up (device, TRUE, NULL); + + /* If this is the initial association during device activation, + * schedule the next activation stage. + */ + if (devstate == NM_DEVICE_STATE_CONFIG) { + _LOGI (LOGD_DEVICE, + "Activation: Stage 2 of 5 (Device Configure) successful."); + nm_device_activate_schedule_stage3_ip_config_start (device); + } + break; + case NM_SUPPLICANT_INTERFACE_STATE_DISCONNECTED: + if ((devstate == NM_DEVICE_STATE_ACTIVATED) || nm_device_is_activating (device)) { + /* Start the link timeout so we allow some time for reauthentication */ + if (!priv->supplicant_timeout_id) + priv->supplicant_timeout_id = g_timeout_add_seconds (15, link_timeout_cb, device); + } + break; + case NM_SUPPLICANT_INTERFACE_STATE_DOWN: + supplicant_interface_release (self); + + if ((devstate == NM_DEVICE_STATE_ACTIVATED) || nm_device_is_activating (device)) { + nm_device_state_changed (device, + NM_DEVICE_STATE_FAILED, + NM_DEVICE_STATE_REASON_SUPPLICANT_FAILED); + } + break; + default: + ; + } +} + +static NMActStageReturn +handle_auth_or_fail (NMDeviceMacsec *self, + NMActRequest *req, + gboolean new_secrets) +{ + const char *setting_name; + guint32 tries; + NMConnection *applied_connection; + + applied_connection = nm_act_request_get_applied_connection (req); + + tries = GPOINTER_TO_UINT (g_object_get_data (G_OBJECT (applied_connection), MACSEC_SECRETS_TRIES)); + if (tries > 3) + return NM_ACT_STAGE_RETURN_FAILURE; + + nm_device_state_changed (NM_DEVICE (self), NM_DEVICE_STATE_NEED_AUTH, NM_DEVICE_STATE_REASON_NONE); + + nm_active_connection_clear_secrets (NM_ACTIVE_CONNECTION (req)); + + setting_name = nm_connection_need_secrets (applied_connection, NULL); + if (setting_name) { + macsec_secrets_get_secrets (self, setting_name, + NM_SECRET_AGENT_GET_SECRETS_FLAG_ALLOW_INTERACTION + | (new_secrets ? NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW : 0)); + g_object_set_data (G_OBJECT (applied_connection), MACSEC_SECRETS_TRIES, GUINT_TO_POINTER (++tries)); + } else + _LOGI (LOGD_DEVICE, "Cleared secrets, but setting didn't need any secrets."); + + return NM_ACT_STAGE_RETURN_POSTPONE; +} + +static gboolean +supplicant_connection_timeout_cb (gpointer user_data) +{ + NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data); + NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + NMDevice *device = NM_DEVICE (self); + NMActRequest *req; + NMSettingsConnection *connection; + guint64 timestamp = 0; + gboolean new_secrets = TRUE; + + priv->supplicant.con_timeout_id = 0; + + /* Authentication failed; either driver problems, the encryption key is + * wrong, the passwords or certificates were wrong or the Ethernet switch's + * port is not configured for 802.1x. */ + _LOGW (LOGD_DEVICE, + "Activation: (macsec) association took too long."); + + supplicant_interface_release (self); + req = nm_device_get_act_request (device); + g_assert (req); + + connection = nm_act_request_get_settings_connection (req); + g_assert (connection); + + /* Ask for new secrets only if we've never activated this connection + * before. If we've connected before, don't bother the user with dialogs, + * just retry or fail, and if we never connect the user can fix the + * password somewhere else. */ + if (nm_settings_connection_get_timestamp (connection, ×tamp)) + new_secrets = !timestamp; + + if (handle_auth_or_fail (self, req, new_secrets) == NM_ACT_STAGE_RETURN_POSTPONE) + _LOGW (LOGD_DEVICE, "Activation: (macsec) asking for new secrets"); + else + nm_device_state_changed (device, NM_DEVICE_STATE_FAILED, NM_DEVICE_STATE_REASON_NO_SECRETS); + + return FALSE; +} + +static gboolean +supplicant_interface_init (NMDeviceMacsec *self) +{ + NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + NMDevice *parent; + + parent = nm_device_parent_get_device (NM_DEVICE (self)); + g_return_val_if_fail (parent, FALSE); + + supplicant_interface_release (self); + + priv->supplicant.iface = nm_supplicant_manager_create_interface (priv->supplicant.mgr, + nm_device_get_iface (parent), + NM_SUPPLICANT_DRIVER_MACSEC); + + if (!priv->supplicant.iface) { + _LOGE (LOGD_DEVICE, + "Couldn't initialize supplicant interface"); + return FALSE; + } + + /* Listen for its state signals */ + priv->supplicant.iface_state_id = g_signal_connect (priv->supplicant.iface, + NM_SUPPLICANT_INTERFACE_STATE, + G_CALLBACK (supplicant_iface_state_cb), + self); + + /* Hook up error signal handler to capture association errors */ + priv->supplicant.iface_error_id = g_signal_connect (priv->supplicant.iface, + NM_SUPPLICANT_INTERFACE_CONNECTION_ERROR, + G_CALLBACK (supplicant_iface_connection_error_cb), + self); + + /* Set up a timeout on the connection attempt to fail it after 25 seconds */ + priv->supplicant.con_timeout_id = g_timeout_add_seconds (25, supplicant_connection_timeout_cb, self); + + return TRUE; +} + +static NMActStageReturn +act_stage2_config (NMDevice *device, NMDeviceStateReason *reason) +{ + NMDeviceMacsec *self = NM_DEVICE_MACSEC (device); + NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + NMConnection *connection; + NMActStageReturn ret = NM_ACT_STAGE_RETURN_FAILURE; + const char *setting_name; + + connection = nm_device_get_applied_connection (NM_DEVICE (self)); + g_assert (connection); + + if (!priv->supplicant.mgr) + priv->supplicant.mgr = g_object_ref (nm_supplicant_manager_get ()); + + /* If we need secrets, get them */ + setting_name = nm_connection_need_secrets (connection, NULL); + if (setting_name) { + NMActRequest *req = nm_device_get_act_request (NM_DEVICE (self)); + + _LOGI (LOGD_DEVICE, + "Activation: connection '%s' has security, but secrets are required.", + nm_connection_get_id (connection)); + + ret = handle_auth_or_fail (self, req, FALSE); + if (ret != NM_ACT_STAGE_RETURN_POSTPONE) + *reason = NM_DEVICE_STATE_REASON_NO_SECRETS; + } else { + _LOGI (LOGD_DEVICE | LOGD_ETHER, + "Activation: connection '%s' requires no security. No secrets needed.", + nm_connection_get_id (connection)); + + if (supplicant_interface_init (self)) + ret = NM_ACT_STAGE_RETURN_POSTPONE; + else + *reason = NM_DEVICE_STATE_REASON_CONFIG_FAILED; + } + + return ret; +} + +static void +deactivate (NMDevice *device) +{ + NMDeviceMacsec *self = NM_DEVICE_MACSEC (device); + + supplicant_interface_release (self); +} + +static gboolean +check_connection_compatible (NMDevice *device, NMConnection *connection) +{ + NMSettingMacsec *s_macsec; + + if (!NM_DEVICE_CLASS (nm_device_macsec_parent_class)->check_connection_compatible (device, connection)) + return FALSE; + + s_macsec = nm_connection_get_setting_macsec (connection); + if (!s_macsec) + return FALSE; + + return TRUE; +} + +/******************************************************************/ + +static NMDeviceCapabilities +get_generic_capabilities (NMDevice *dev) +{ + /* We assume MACsec interfaces always support carrier detect */ + return NM_DEVICE_CAP_CARRIER_DETECT | NM_DEVICE_CAP_IS_SOFTWARE; +} + +/******************************************************************/ + +static gboolean +is_available (NMDevice *device, NMDeviceCheckDevAvailableFlags flags) +{ + if (!nm_device_parent_get_device (device)) + return FALSE; + return NM_DEVICE_CLASS (nm_device_macsec_parent_class)->is_available (device, flags); +} + +static gboolean +create_and_realize (NMDevice *device, + NMConnection *connection, + NMDevice *parent, + const NMPlatformLink **out_plink, + GError **error) +{ + const char *iface = nm_device_get_iface (device); + NMPlatformError plerr; + NMSettingMacsec *s_macsec; + NMPlatformLnkMacsec lnk = { }; + int parent_ifindex; + const char *hw_addr; + union { + struct { + guint8 mac[6]; + guint16 port; + } s; + guint64 u; + } sci; + + s_macsec = nm_connection_get_setting_macsec (connection); + g_assert (s_macsec); + + if (!parent) { + g_set_error (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_FAILED, + "MACsec devices can not be created without a parent interface"); + return FALSE; + } + + lnk.encrypt = nm_setting_macsec_get_encrypt (s_macsec); + + hw_addr = nm_device_get_hw_address (parent); + if (!hw_addr) { + g_set_error (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_FAILED, + "can't read parent MAC"); + return FALSE; + } + + nm_utils_hwaddr_aton (hw_addr, sci.s.mac, ETH_ALEN); + sci.s.port = htons (nm_setting_macsec_get_port (s_macsec)); + lnk.sci = be64toh (sci.u); + lnk.validation = nm_setting_macsec_get_validation (s_macsec); + + parent_ifindex = nm_device_get_ifindex (parent); + g_warn_if_fail (parent_ifindex > 0); + + plerr = nm_platform_link_macsec_add (NM_PLATFORM_GET, iface, parent_ifindex, &lnk, out_plink); + if (plerr != NM_PLATFORM_ERROR_SUCCESS) { + g_set_error (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_CREATION_FAILED, + "Failed to create macsec interface '%s' for '%s': %s", + iface, + nm_connection_get_id (connection), + nm_platform_error_to_string (plerr)); + return FALSE; + } + + nm_device_parent_set_ifindex (device, parent_ifindex); + + return TRUE; +} + +static void +link_changed (NMDevice *device, + const NMPlatformLink *pllink) +{ + NM_DEVICE_CLASS (nm_device_macsec_parent_class)->link_changed (device, pllink); + update_properties (device); +} + +static void +clear_secrets_tries (NMDevice *device) +{ + NMActRequest *req; + NMConnection *connection; + + req = nm_device_get_act_request (device); + if (req) { + connection = nm_act_request_get_applied_connection (req); + /* Clear macsec secrets tries on success, failure, or when deactivating */ + g_object_set_data (G_OBJECT (connection), MACSEC_SECRETS_TRIES, NULL); + } +} + +static void +device_state_changed (NMDevice *device, + NMDeviceState new_state, + NMDeviceState old_state, + NMDeviceStateReason reason) +{ + if (new_state > NM_DEVICE_STATE_ACTIVATED) + macsec_secrets_cancel (NM_DEVICE_MACSEC (device)); + + if ( new_state == NM_DEVICE_STATE_ACTIVATED + || new_state == NM_DEVICE_STATE_FAILED + || new_state == NM_DEVICE_STATE_DISCONNECTED) + clear_secrets_tries (device); +} + +/******************************************************************/ + +static void +get_property (GObject *object, guint prop_id, + GValue *value, GParamSpec *pspec) +{ + NMDeviceMacsec *self = NM_DEVICE_MACSEC (object); + NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self); + + switch (prop_id) { + case PROP_SCI: + g_value_set_uint64 (value, priv->props.sci); + break; + case PROP_CIPHER_SUITE: + g_value_set_uint64 (value, priv->props.cipher_suite); + break; + case PROP_ICV_LENGTH: + g_value_set_uchar (value, priv->props.icv_length); + break; + case PROP_WINDOW: + g_value_set_uint (value, priv->props.window); + break; + case PROP_ENCODING_SA: + g_value_set_uchar (value, priv->props.encoding_sa); + break; + case PROP_ENCRYPT: + g_value_set_boolean (value, priv->props.encrypt); + break; + case PROP_PROTECT: + g_value_set_boolean (value, priv->props.protect); + break; + case PROP_INCLUDE_SCI: + g_value_set_boolean (value, priv->props.include_sci); + break; + case PROP_ES: + g_value_set_boolean (value, priv->props.es); + break; + case PROP_SCB: + g_value_set_boolean (value, priv->props.scb); + break; + case PROP_REPLAY_PROTECT: + g_value_set_boolean (value, priv->props.replay_protect); + break; + case PROP_VALIDATION: + g_value_set_string (value, + validation_mode_to_string (priv->props.validation)); + break; + default: + G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); + break; + } +} + +static void +nm_device_macsec_init (NMDeviceMacsec * self) +{ +} + +static void +dispose (GObject *object) +{ + NMDeviceMacsec *self = NM_DEVICE_MACSEC (object); + + macsec_secrets_cancel (self); + supplicant_interface_release (self); + + G_OBJECT_CLASS (nm_device_macsec_parent_class)->dispose (object); +} + +static void +nm_device_macsec_class_init (NMDeviceMacsecClass *klass) +{ + GObjectClass *object_class = G_OBJECT_CLASS (klass); + NMDeviceClass *parent_class = NM_DEVICE_CLASS (klass); + + NM_DEVICE_CLASS_DECLARE_TYPES (klass, NULL, NM_LINK_TYPE_MACSEC) + + object_class->get_property = get_property; + object_class->dispose = dispose; + + parent_class->act_stage2_config = act_stage2_config; + parent_class->check_connection_compatible = check_connection_compatible; + parent_class->create_and_realize = create_and_realize; + parent_class->deactivate = deactivate; + parent_class->get_generic_capabilities = get_generic_capabilities; + parent_class->link_changed = link_changed; + parent_class->is_available = is_available; + parent_class->parent_changed_notify = parent_changed_notify; + parent_class->state_changed = device_state_changed; + parent_class->get_configured_mtu = nm_device_get_configured_mtu_for_wired; + + parent_class->connection_type = NM_SETTING_MACSEC_SETTING_NAME; + + obj_properties[PROP_SCI] = + g_param_spec_uint64 (NM_DEVICE_MACSEC_SCI, "", "", + 0, G_MAXUINT64, 0, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + obj_properties[PROP_CIPHER_SUITE] = + g_param_spec_uint64 (NM_DEVICE_MACSEC_CIPHER_SUITE, "", "", + 0, G_MAXUINT64, 0, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + obj_properties[PROP_ICV_LENGTH] = + g_param_spec_uchar (NM_DEVICE_MACSEC_ICV_LENGTH, "", "", + 0, G_MAXUINT8, 0, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + obj_properties[PROP_WINDOW] = + g_param_spec_uint (NM_DEVICE_MACSEC_WINDOW, "", "", + 0, G_MAXUINT32, 0, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + obj_properties[PROP_ENCODING_SA] = + g_param_spec_uchar (NM_DEVICE_MACSEC_ENCODING_SA, "", "", + 0, 3, 0, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + obj_properties[PROP_VALIDATION] = + g_param_spec_string (NM_DEVICE_MACSEC_VALIDATION, "", "", + NULL, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + obj_properties[PROP_ENCRYPT] = + g_param_spec_boolean (NM_DEVICE_MACSEC_ENCRYPT, "", "", + FALSE, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + obj_properties[PROP_PROTECT] = + g_param_spec_boolean (NM_DEVICE_MACSEC_PROTECT, "", "", + FALSE, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + obj_properties[PROP_INCLUDE_SCI] = + g_param_spec_boolean (NM_DEVICE_MACSEC_INCLUDE_SCI, "", "", + FALSE, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + obj_properties[PROP_ES] = + g_param_spec_boolean (NM_DEVICE_MACSEC_ES, "", "", + FALSE, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + obj_properties[PROP_SCB] = + g_param_spec_boolean (NM_DEVICE_MACSEC_SCB, "", "", + FALSE, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + obj_properties[PROP_REPLAY_PROTECT] = + g_param_spec_boolean (NM_DEVICE_MACSEC_REPLAY_PROTECT, "", "", + FALSE, + G_PARAM_READABLE | G_PARAM_STATIC_STRINGS); + + g_object_class_install_properties (object_class, _PROPERTY_ENUMS_LAST, obj_properties); + + nm_exported_object_class_add_interface (NM_EXPORTED_OBJECT_CLASS (klass), + NMDBUS_TYPE_DEVICE_MACSEC_SKELETON, + NULL); +} + +/*************************************************************/ + +#define NM_TYPE_MACSEC_DEVICE_FACTORY (nm_macsec_device_factory_get_type ()) +#define NM_MACSEC_DEVICE_FACTORY(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_MACSEC_DEVICE_FACTORY, NMMacsecDeviceFactory)) + +static NMDevice * +create_device (NMDeviceFactory *factory, + const char *iface, + const NMPlatformLink *plink, + NMConnection *connection, + gboolean *out_ignore) +{ + return (NMDevice *) g_object_new (NM_TYPE_DEVICE_MACSEC, + NM_DEVICE_IFACE, iface, + NM_DEVICE_TYPE_DESC, "Macsec", + NM_DEVICE_DEVICE_TYPE, NM_DEVICE_TYPE_MACSEC, + NM_DEVICE_LINK_TYPE, NM_LINK_TYPE_MACSEC, + NULL); +} + +static const char * +get_connection_parent (NMDeviceFactory *factory, NMConnection *connection) +{ + NMSettingMacsec *s_macsec; + NMSettingWired *s_wired; + const char *parent = NULL; + + g_return_val_if_fail (nm_connection_is_type (connection, NM_SETTING_MACSEC_SETTING_NAME), NULL); + + s_macsec = nm_connection_get_setting_macsec (connection); + g_assert (s_macsec); + + parent = nm_setting_macsec_get_parent (s_macsec); + if (parent) + return parent; + + /* Try the hardware address from the MACsec connection's hardware setting */ + s_wired = nm_connection_get_setting_wired (connection); + if (s_wired) + return nm_setting_wired_get_mac_address (s_wired); + + return NULL; +} + +static char * +get_connection_iface (NMDeviceFactory *factory, + NMConnection *connection, + const char *parent_iface) +{ + NMSettingMacsec *s_macsec; + const char *ifname; + + g_return_val_if_fail (nm_connection_is_type (connection, NM_SETTING_MACSEC_SETTING_NAME), NULL); + + s_macsec = nm_connection_get_setting_macsec (connection); + g_assert (s_macsec); + + if (!parent_iface) + return NULL; + + ifname = nm_connection_get_interface_name (connection); + return g_strdup (ifname); +} + +NM_DEVICE_FACTORY_DEFINE_INTERNAL (MACSEC, Macsec, macsec, + NM_DEVICE_FACTORY_DECLARE_LINK_TYPES (NM_LINK_TYPE_MACSEC) + NM_DEVICE_FACTORY_DECLARE_SETTING_TYPES (NM_SETTING_MACSEC_SETTING_NAME), + factory_class->create_device = create_device; + factory_class->get_connection_parent = get_connection_parent; + factory_class->get_connection_iface = get_connection_iface; +) |