☰

MACSEC フレームが正しくありません。

tag-icon • tag-icon linux networking cryptography
MACSEC フレームが正しくありません。

wpa_supplicantMACSECセキュア有線チャンネルの設定に使用しています。 Ubuntu x86システムではこれが可能です。しかし、Arm64 Alpineシステムでは、MKAは成功したように見え、インターフェイスは確立されていますが、MACSECリンクを通過するIP4トラフィックはありません。カウンターInPktsNotValidが上がります。ドライバのソースコードを見ると、これはフレームの処理中にメモリ割り当ての失敗または復号化の失敗を意味します。残念ながら、ドライバは実際のエラーを受け入れます。

wpa_supplicant構成ファイルは、関連するすべてのシステムで同じです。

$ cat test.config 
no_ctrl_interface=yes
eapol_version=3
ap_scan=0
fast_reauth=1

network={
    key_mgmt=NONE
    eapol_flags=0
    macsec_policy=1
    mka_cak=0123456789ABCDEF0123456789ABCDEF
    mka_ckn=6162636465666768696A6B6C6D6E6F707172737475767778797A303132333435
    mka_priority=128
}

私は次のようにwpa_supplicantを実行します。

sudo wpa_supplicant -ieth0 -Dmacsec_linux -ctest.config -d

以下は wpa_supplicant 出力の例です。

KaY: to enpacket and send the MKPDU
*** MKA Basic Parameter set ***
    Version.......: 1
    Priority......: 128
    KeySvr........: 1
    MACSecDesired.: 1
    MACSecCapable.: 2
    Body Length...: 60
    SCI MAC.......: d4:25:cc:b0:25:21
    SCI Port .....: 1
    Member Id.....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
    Message Number: 34069
    Algo Agility..: - hexdump(len=4): 00 80 c2 01
    CAK Name......: - hexdump_ascii(len=32):
     61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70   abcdefghijklmnop
     71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35   qrstuvwxyz012345
*** Live Peer List ***
    Body Length...: 16
    Member Id.....: - hexdump_ascii(len=12):
     9a fa 89 4d b4 3a 6b ac 2f b9 61 52               ___M_:k_/_aR    
    Message Number: 34451
macsec_linux: macsec_drv_get_receive_lowest_pn
macsec_linux: macsec_drv_get_receive_lowest_pn: result 1
*** MACsec SAK Use ***
    Latest Key AN....: 0
    Latest Key Tx....: Yes
    Latest Key Rx....: Yes
    Old Key AN....: 0
    Old Key Tx....: No
    Old Key Rx....: No
    Plain Key Tx....: No
    Plain Key Rx....: No
    Delay Protect....: No
    Body Length......: 40
    Key Server MI....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
    Key Number.......: 1
    Lowest PN........: 1
    Old Key Server MI....: - hexdump_ascii(len=12):
     00 00 00 00 00 00 00 00 00 00 00 00               ____________    
    Old Key Number.......: 0
    Old Lowest PN........: 1
l2_packet_receive: src=d4:25:cc:b0:79:81 len=152
eth0_bridge: RX EAPOL from d4:25:cc:b0:79:81
RX EAPOL - hexdump(len=152): 03 05 00 94 01 80 60 3c d4 25 cc b0 79 81 00 01 9a fa 89 4d b4 3a 6b ac 2f b9 61 52 00 00 86 94 00 80 c2 01 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 01 00 00 10 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 85 14 03 34 00 28 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff 00 00 10 f7 7c bc 50 24 8b bb af b0 c3 95 bc 29 ec 8c c5
eth0_bridge: Ignored received EAPOL frame since no key management is configured
l2_packet_receive: src=d4:25:cc:b0:79:81 len=166
RX EAPOL-MKA:  - hexdump(len=166): 01 68 76 68 76 68 d4 25 cc b0 79 81 5e ea 03 05 00 94 01 80 60 3c d4 25 cc b0 79 81 00 01 9a fa 89 4d b4 3a 6b ac 2f b9 61 52 00 00 86 94 00 80 c2 01 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 01 00 00 10 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 85 14 03 34 00 28 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff 00 00 10 f7 7c bc 50 24 8b bb af b0 c3 95 bc 29 ec 8c c5
*** MKA Basic Parameter set ***
    Version.......: 1
    Priority......: 128
    KeySvr........: 0
    MACSecDesired.: 1
    MACSecCapable.: 2
    Body Length...: 60
    SCI MAC.......: d4:25:cc:b0:79:81
    SCI Port .....: 1
    Member Id.....: - hexdump(len=12): 9a fa 89 4d b4 3a 6b ac 2f b9 61 52
    Message Number: 34452
    Algo Agility..: - hexdump(len=4): 00 80 c2 01
    CAK Name......: - hexdump_ascii(len=32):
     61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70   abcdefghijklmnop
     71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35   qrstuvwxyz012345
*** Live Peer List ***
    Body Length...: 16
    Member Id.....: - hexdump_ascii(len=12):
     ea fd 2f b9 9d f6 e2 17 38 0d d8 b1               __/_____8___    
    Message Number: 34068
*** MACsec SAK Use ***
    Latest Key AN....: 0
    Latest Key Tx....: Yes
    Latest Key Rx....: Yes
    Old Key AN....: 1
    Old Key Tx....: No
    Old Key Rx....: No
    Plain Key Tx....: No
    Plain Key Rx....: No
    Delay Protect....: No
    Body Length......: 40
    Key Server MI....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
    Key Number.......: 1
    Lowest PN........: 1
    Old Key Server MI....: - hexdump_ascii(len=12):
     00 00 00 00 00 00 00 00 00 00 00 00               ____________    
    Old Key Number.......: 0
    Old Lowest PN........: 1
macsec_drv_get_transmit_next_pn
macsec_linux: macsec_drv_get_transmit_next_pn: err 0 result 50789
KaY: to enpacket and send the MKPDU
*** MKA Basic Parameter set ***
    Version.......: 1
    Priority......: 128
    KeySvr........: 1
    MACSecDesired.: 1
    MACSecCapable.: 2
    Body Length...: 60
    SCI MAC.......: d4:25:cc:b0:25:21
    SCI Port .....: 1
    Member Id.....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
    Message Number: 34070
    Algo Agility..: - hexdump(len=4): 00 80 c2 01
    CAK Name......: - hexdump_ascii(len=32):
     61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70   abcdefghijklmnop
     71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35   qrstuvwxyz012345
*** Live Peer List ***
    Body Length...: 16
    Member Id.....: - hexdump_ascii(len=12):
     9a fa 89 4d b4 3a 6b ac 2f b9 61 52               ___M_:k_/_aR    
    Message Number: 34452
macsec_linux: macsec_drv_get_receive_lowest_pn
macsec_linux: macsec_drv_get_receive_lowest_pn: result 1
*** MACsec SAK Use ***
    Latest Key AN....: 0
    Latest Key Tx....: Yes
    Latest Key Rx....: Yes
    Old Key AN....: 0
    Old Key Tx....: No
    Old Key Rx....: No
    Plain Key Tx....: No
    Plain Key Rx....: No
    Delay Protect....: No
    Body Length......: 40
    Key Server MI....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
    Key Number.......: 1
    Lowest PN........: 1
    Old Key Server MI....: - hexdump_ascii(len=12):
     00 00 00 00 00 00 00 00 00 00 00 00               ____________    
    Old Key Number.......: 0
    Old Lowest PN........: 1
l2_packet_receive: src=d4:25:cc:b0:79:81 len=152
eth0_bridge: RX EAPOL from d4:25:cc:b0:79:81
RX EAPOL - hexdump(len=152): 03 05 00 94 01 80 60 3c d4 25 cc b0 79 81 00 01 9a fa 89 4d b4 3a 6b ac 2f b9 61 52 00 00 86 95 00 80 c2 01 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 01 00 00 10 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 85 15 03 34 00 28 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff 00 00 10 f4 41 37 ff d5 59 6f 95 c6 3f 16 5a 9a 21 c6 b4
eth0_bridge: Ignored received EAPOL frame since no key management is configured
l2_packet_receive: src=d4:25:cc:b0:79:81 len=166
RX EAPOL-MKA:  - hexdump(len=166): 01 68 76 68 76 68 d4 25 cc b0 79 81 5e ea 03 05 00 94 01 80 60 3c d4 25 cc b0 79 81 00 01 9a fa 89 4d b4 3a 6b ac 2f b9 61 52 00 00 86 95 00 80 c2 01 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 01 00 00 10 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 85 15 03 34 00 28 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff 00 00 10 f4 41 37 ff d5 59 6f 95 c6 3f 16 5a 9a 21 c6 b4
*** MKA Basic Parameter set ***
    Version.......: 1
    Priority......: 128
    KeySvr........: 0
    MACSecDesired.: 1
    MACSecCapable.: 2
    Body Length...: 60
    SCI MAC.......: d4:25:cc:b0:79:81
    SCI Port .....: 1
    Member Id.....: - hexdump(len=12): 9a fa 89 4d b4 3a 6b ac 2f b9 61 52
    Message Number: 34453
    Algo Agility..: - hexdump(len=4): 00 80 c2 01
    CAK Name......: - hexdump_ascii(len=32):
     61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70   abcdefghijklmnop
     71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35   qrstuvwxyz012345
*** Live Peer List ***
    Body Length...: 16
    Member Id.....: - hexdump_ascii(len=12):
     ea fd 2f b9 9d f6 e2 17 38 0d d8 b1               __/_____8___    
    Message Number: 34069
*** MACsec SAK Use ***
    Latest Key AN....: 0
    Latest Key Tx....: Yes
    Latest Key Rx....: Yes
    Old Key AN....: 1
    Old Key Tx....: No
    Old Key Rx....: No
    Plain Key Tx....: No
    Plain Key Rx....: No
    Delay Protect....: No
    Body Length......: 40
    Key Server MI....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
    Key Number.......: 1
    Lowest PN........: 1
    Old Key Server MI....: - hexdump_ascii(len=12):
     00 00 00 00 00 00 00 00 00 00 00 00               ____________    
    Old Key Number.......: 0
    Old Lowest PN........: 1
macsec_drv_get_transmit_next_pn
macsec_linux: macsec_drv_get_transmit_next_pn: err 0 result 50790

例は次のとおりですip -s macsec show。

$ ip -s macsec show macsec0
38: macsec0: protect on validate strict sc on sa on encrypt on send_sci on end_station off scb off replay off 
    cipher suite: GCM-AES-128, using ICV length 16
    TXSC: d425ccb079810001 on SA 1
    stats: OutPktsUntagged InPktsUntagged OutPktsTooLong InPktsNoTag InPktsBadTag InPktsUnknownSCI InPktsNoSCI InPktsOverrun
                         0              0              0        1112            0                0           2             0
    stats: OutPktsProtected OutPktsEncrypted OutOctetsProtected OutOctetsEncrypted
                          0                7                  0                962
        1: PN 8, state on, key 4c9085d6632af3e66b5ea34602000000
    stats: OutPktsProtected OutPktsEncrypted
                          0                7
    RXSC: d425ccb025210001, state on
    stats: InOctetsValidated InOctetsDecrypted InPktsUnchecked InPktsDelayed InPktsOK InPktsInvalid InPktsLate InPktsNotValid InPktsNotUsingSA InPktsUnusedSA
                           0             18722               0             0        0             0          0            253                0              0
        1: PN 1, state on, key 4c9085d6632af3e66b5ea34602000000
    stats: InPktsOK InPktsInvalid InPktsNotValid InPktsNotUsingSA InPktsUnusedSA
                  0             0              0                0              0

カーネルにはCONFIG_MACSEC=y、CONFIG_CRYPTO_GCM=yおよびが含まれますCONFIG_CRYPTO_AES=y。

また何が間違っている可能性がありますか？

答え1

これはLinux 4.9のバグで、着信コミットb3bdc3acbb44d74d0b7ba4d97169577a2b46dc88で4.10-rc9修正されました。 MACSECドライバが復号化されたフレームをブロックせずに復号化されたフレームを非同期的に受信すると、ドライバは復号化が成功した場合でも常にそのフレームを無効とマークします。

関連情報