ip-macsec - MACsec device configuration

       Sabrina Dubroca <sd@queasysnail.net>

iproute                                            07 Mar 2016                                      IP-MACSEC(8)

       The ipmacsec commands are used to configure transmit secure associations and receive secure channels and
       their secure associations on a MACsec device created with the iplinkadd command using the macsec type.

CreateaMACsecdeviceonlinketh0(offloadisdisabledbydefault)
       # ip link add link eth0 macsec0 type macsec port 11 encrypt on

   Configureasecureassociationonthatdevice
       # ip macsec add macsec0 tx sa 0 pn 1024 on key 01 81818181818181818181818181818181

   Configureareceivechannel
       # ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0

   Configureareceiveassociation
       # ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0 sa 0 pn 1 on key 00 82828282828282828282828282828282

   DisplayMACsecconfiguration
       # ip macsec show

   Configureoffloadingonaninterface
       # ip macsec offload macsec0 phy

   ConfigureoffloadinguponMACsecdevicecreation
       # ip link add link eth0 macsec0 type macsec port 11 encrypt on offload mac

CreateaMACsecdeviceonlinketh0withenabledextendedpacketnumber(offloadisdisabledbydefault)
       # ip link add link eth0 macsec0 type macsec port 11 encrypt on cipher gcm-aes-xpn-128

   Configureasecureassociationonthatdevice
       # ip macsec add macsec0 tx sa 0 xpn 1024 on salt 838383838383838383838383 ssci 123 key 01 81818181818181818181818181818181

   Configureareceivechannel
       # ip macsec add macsec0 rx port 11 address c6:19:52:8f:e6:a0

   Configureareceiveassociation
       # ip macsec add macsec0 rx port 11 address c6:19:52:8f:e6:a0 sa 0 xpn 1 on salt 838383838383838383838383 ssci 123 key 00 82828282828282828282828282828282

   DisplayMACsecconfiguration
       # ip macsec show

       Passing cipher gcm-aes-xpn-128 or gcm-aes-xpn-256 to iplinkadd command using the macsec  type  requires
       using the keyword 'xpn' instead of 'pn' in addition to providing a salt using the 'salt' keyword and ssci
       using the 'ssci' keyword when using the ipmacsec command.

       ip-macsec - MACsec device configuration

       This tool can be used to configure the 802.1AE keys of the interface. Note that 802.1AE uses GCM-AES with
       a initialization vector (IV) derived from the packet number. The same key must not be used with the  same
       IV  more  than  once.  Instead,  keys  must be frequently regenerated and distributed.  This tool is thus
       mostly for debugging and testing, or in combination with a user-space application that  reconfigures  the
       keys.  It  is  wrong  to  just  configure  the  keys statically and assume them to work indefinitely. The
       suggested and standardized way for key management is 802.1X-2010, which is implemented by wpa_supplicant.

ip-link(8) wpa_supplicant(8)

iplinkaddlinkDEVICEnameNAMEtypemacsec [ [ address<lladdr> ] portPORT | sci<u64> ] [ cipher {
       default | gcm-aes-128 | gcm-aes-256 | gcm-aes-xpn-128 | gcm-aes-xpn-256 } ] [ icvlenICVLEN ] [ encrypt {
       on | off } ] [ send_sci { on | off } ] [ end_station { on | off } ] [ scb { on | off } ] [ protect { on |
       off } ] [ replay { on | off } ] [ windowWINDOW ] [ validate { strict | check | disabled } ] [ encodingsaSA ] [ offload { off | phy | mac } ]

       ipmacsecaddDEVtxsa { 0..3 } [ OPTS ] keyIDKEYipmacsecsetDEVtxsa { 0..3 } [ OPTS ]
       ipmacsecdelDEVtxsa { 0..3 }

       ipmacsecaddDEVrxSCI [ on | off ]
       ipmacsecsetDEVrxSCI [ on | off ]
       ipmacsecdelDEVrxSCIipmacsecaddDEVrxSCIsa { 0..3 } [ OPTS ] keyIDKEYipmacsecsetDEVrxSCIsa { 0..3 } [ OPTS ]
       ipmacsecdelDEVrxSCIsa { 0..3 }

       ipmacsecoffloadDEV { off | phy | mac }

       ipmacsecshow [ DEV ]

       OPTS := [ pn { 1..2^32-1 } | xpn { 1..2^64-1 } ] [ saltSALT ] [ ssci<u32> ] [ on | off ]
       SCI := { sci<u64> | portPORTaddress<lladdr> }
       PORT := { 1..2^16-1 }
       SALT := 96-bit hex string