Question on wpa_supplicant setup for MKA

[Jaap Keuter]

Hi list,

To study MACsec and MKA I've been experimenting with a setup using the Linux
kernel, the macsec kernel module and wpa_supplicant. So far I've managed to
establish SA's between statically configured MACsec instances, so that works,
and now I'm working on getting wpa_supplicant setup to handle MKA (with CAK/CKN).

The problem is that working with the Linux macsec driver
(CONFIG_DRIVER_MACSEC_LINUX=y). I'm not getting the result I expect.
First I use a 'normal' wired interface (eth0). When I run wpa_supplicant on that
interface the MKPDU's don't make it out to the network. Then I stack a macsec
instance on top of eth0 (macsec0 at eth0) and run wpa_supplicant on that interface.
Now I'm getting an additional macsec instance on top of mine (macsec1 at macsec0).
But without SA's on macsec 0 that doesn't work either.

So the question is: how should wpa_supplicant be configured and started to make
this work? If you need more details, please don't hesitate to ask.

Thanks,
Jaap


PS: I'm using all relatively bleeding edge software:
Kernel 4.9, hostap HEAD, libnl 3.29

PPS: I'm using 'normal' wired interfaces, as in I use virtual Ethernet (veth)
interfaces to connect into two network namespaces where all the macsec and
wpa_supplicant instances live. These are connected to a (transparent) bridge.