1 | /* SPDX-License-Identifier: GPL-2.0+ */ |
2 | /* |
3 | * MACsec netdev header, used for h/w accelerated implementations. |
4 | * |
5 | * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net> |
6 | */ |
7 | #ifndef _NET_MACSEC_H_ |
8 | #define _NET_MACSEC_H_ |
9 | |
10 | #include <linux/u64_stats_sync.h> |
11 | #include <linux/if_vlan.h> |
12 | #include <uapi/linux/if_link.h> |
13 | #include <uapi/linux/if_macsec.h> |
14 | |
15 | #define MACSEC_DEFAULT_PN_LEN 4 |
16 | #define MACSEC_XPN_PN_LEN 8 |
17 | |
18 | #define MACSEC_NUM_AN 4 /* 2 bits for the association number */ |
19 | |
20 | #define MACSEC_SCI_LEN 8 |
21 | #define MACSEC_PORT_ES (htons(0x0001)) |
22 | |
23 | #define MACSEC_TCI_VERSION 0x80 |
24 | #define MACSEC_TCI_ES 0x40 /* end station */ |
25 | #define MACSEC_TCI_SC 0x20 /* SCI present */ |
26 | #define MACSEC_TCI_SCB 0x10 /* epon */ |
27 | #define MACSEC_TCI_E 0x08 /* encryption */ |
28 | #define MACSEC_TCI_C 0x04 /* changed text */ |
29 | #define MACSEC_AN_MASK 0x03 /* association number */ |
30 | #define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C) |
31 | |
32 | #define MACSEC_DEFAULT_ICV_LEN 16 |
33 | |
34 | typedef u64 __bitwise sci_t; |
35 | typedef u32 __bitwise ssci_t; |
36 | |
37 | struct metadata_dst; |
38 | |
39 | typedef union salt { |
40 | struct { |
41 | u32 ssci; |
42 | u64 pn; |
43 | } __packed; |
44 | u8 bytes[MACSEC_SALT_LEN]; |
45 | } __packed salt_t; |
46 | |
47 | typedef union pn { |
48 | struct { |
49 | #if defined(__LITTLE_ENDIAN_BITFIELD) |
50 | u32 lower; |
51 | u32 upper; |
52 | #elif defined(__BIG_ENDIAN_BITFIELD) |
53 | u32 upper; |
54 | u32 lower; |
55 | #else |
56 | #error "Please fix <asm/byteorder.h>" |
57 | #endif |
58 | }; |
59 | u64 full64; |
60 | } pn_t; |
61 | |
62 | /** |
63 | * struct macsec_key - SA key |
64 | * @id: user-provided key identifier |
65 | * @tfm: crypto struct, key storage |
66 | * @salt: salt used to generate IV in XPN cipher suites |
67 | */ |
68 | struct macsec_key { |
69 | u8 id[MACSEC_KEYID_LEN]; |
70 | struct crypto_aead *tfm; |
71 | salt_t salt; |
72 | }; |
73 | |
74 | struct macsec_rx_sc_stats { |
75 | __u64 InOctetsValidated; |
76 | __u64 InOctetsDecrypted; |
77 | __u64 InPktsUnchecked; |
78 | __u64 InPktsDelayed; |
79 | __u64 InPktsOK; |
80 | __u64 InPktsInvalid; |
81 | __u64 InPktsLate; |
82 | __u64 InPktsNotValid; |
83 | __u64 InPktsNotUsingSA; |
84 | __u64 InPktsUnusedSA; |
85 | }; |
86 | |
87 | struct macsec_rx_sa_stats { |
88 | __u32 InPktsOK; |
89 | __u32 InPktsInvalid; |
90 | __u32 InPktsNotValid; |
91 | __u32 InPktsNotUsingSA; |
92 | __u32 InPktsUnusedSA; |
93 | }; |
94 | |
95 | struct macsec_tx_sa_stats { |
96 | __u32 OutPktsProtected; |
97 | __u32 OutPktsEncrypted; |
98 | }; |
99 | |
100 | struct macsec_tx_sc_stats { |
101 | __u64 OutPktsProtected; |
102 | __u64 OutPktsEncrypted; |
103 | __u64 OutOctetsProtected; |
104 | __u64 OutOctetsEncrypted; |
105 | }; |
106 | |
107 | struct macsec_dev_stats { |
108 | __u64 OutPktsUntagged; |
109 | __u64 InPktsUntagged; |
110 | __u64 OutPktsTooLong; |
111 | __u64 InPktsNoTag; |
112 | __u64 InPktsBadTag; |
113 | __u64 InPktsUnknownSCI; |
114 | __u64 InPktsNoSCI; |
115 | __u64 InPktsOverrun; |
116 | }; |
117 | |
118 | /** |
119 | * struct macsec_rx_sa - receive secure association |
120 | * @active: |
121 | * @next_pn: packet number expected for the next packet |
122 | * @lock: protects next_pn manipulations |
123 | * @key: key structure |
124 | * @ssci: short secure channel identifier |
125 | * @stats: per-SA stats |
126 | */ |
127 | struct macsec_rx_sa { |
128 | struct macsec_key key; |
129 | ssci_t ssci; |
130 | spinlock_t lock; |
131 | union { |
132 | pn_t next_pn_halves; |
133 | u64 next_pn; |
134 | }; |
135 | refcount_t refcnt; |
136 | bool active; |
137 | struct macsec_rx_sa_stats __percpu *stats; |
138 | struct macsec_rx_sc *sc; |
139 | struct rcu_head rcu; |
140 | }; |
141 | |
142 | struct pcpu_rx_sc_stats { |
143 | struct macsec_rx_sc_stats stats; |
144 | struct u64_stats_sync syncp; |
145 | }; |
146 | |
147 | struct pcpu_tx_sc_stats { |
148 | struct macsec_tx_sc_stats stats; |
149 | struct u64_stats_sync syncp; |
150 | }; |
151 | |
152 | /** |
153 | * struct macsec_rx_sc - receive secure channel |
154 | * @sci: secure channel identifier for this SC |
155 | * @active: channel is active |
156 | * @sa: array of secure associations |
157 | * @stats: per-SC stats |
158 | */ |
159 | struct macsec_rx_sc { |
160 | struct macsec_rx_sc __rcu *next; |
161 | sci_t sci; |
162 | bool active; |
163 | struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN]; |
164 | struct pcpu_rx_sc_stats __percpu *stats; |
165 | refcount_t refcnt; |
166 | struct rcu_head rcu_head; |
167 | }; |
168 | |
169 | /** |
170 | * struct macsec_tx_sa - transmit secure association |
171 | * @active: |
172 | * @next_pn: packet number to use for the next packet |
173 | * @lock: protects next_pn manipulations |
174 | * @key: key structure |
175 | * @ssci: short secure channel identifier |
176 | * @stats: per-SA stats |
177 | */ |
178 | struct macsec_tx_sa { |
179 | struct macsec_key key; |
180 | ssci_t ssci; |
181 | spinlock_t lock; |
182 | union { |
183 | pn_t next_pn_halves; |
184 | u64 next_pn; |
185 | }; |
186 | refcount_t refcnt; |
187 | bool active; |
188 | struct macsec_tx_sa_stats __percpu *stats; |
189 | struct rcu_head rcu; |
190 | }; |
191 | |
192 | /** |
193 | * struct macsec_tx_sc - transmit secure channel |
194 | * @active: |
195 | * @encoding_sa: association number of the SA currently in use |
196 | * @encrypt: encrypt packets on transmit, or authenticate only |
197 | * @send_sci: always include the SCI in the SecTAG |
198 | * @end_station: |
199 | * @scb: single copy broadcast flag |
200 | * @sa: array of secure associations |
201 | * @stats: stats for this TXSC |
202 | * @md_dst: MACsec offload metadata dst |
203 | */ |
204 | struct macsec_tx_sc { |
205 | bool active; |
206 | u8 encoding_sa; |
207 | bool encrypt; |
208 | bool send_sci; |
209 | bool end_station; |
210 | bool scb; |
211 | struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN]; |
212 | struct pcpu_tx_sc_stats __percpu *stats; |
213 | struct metadata_dst *md_dst; |
214 | }; |
215 | |
216 | /** |
217 | * struct macsec_secy - MACsec Security Entity |
218 | * @netdev: netdevice for this SecY |
219 | * @n_rx_sc: number of receive secure channels configured on this SecY |
220 | * @sci: secure channel identifier used for tx |
221 | * @key_len: length of keys used by the cipher suite |
222 | * @icv_len: length of ICV used by the cipher suite |
223 | * @validate_frames: validation mode |
224 | * @xpn: enable XPN for this SecY |
225 | * @operational: MAC_Operational flag |
226 | * @protect_frames: enable protection for this SecY |
227 | * @replay_protect: enable packet number checks on receive |
228 | * @replay_window: size of the replay window |
229 | * @tx_sc: transmit secure channel |
230 | * @rx_sc: linked list of receive secure channels |
231 | */ |
232 | struct macsec_secy { |
233 | struct net_device *netdev; |
234 | unsigned int n_rx_sc; |
235 | sci_t sci; |
236 | u16 key_len; |
237 | u16 icv_len; |
238 | enum macsec_validation_type validate_frames; |
239 | bool xpn; |
240 | bool operational; |
241 | bool protect_frames; |
242 | bool replay_protect; |
243 | u32 replay_window; |
244 | struct macsec_tx_sc tx_sc; |
245 | struct macsec_rx_sc __rcu *rx_sc; |
246 | }; |
247 | |
248 | /** |
249 | * struct macsec_context - MACsec context for hardware offloading |
250 | */ |
251 | struct macsec_context { |
252 | union { |
253 | struct net_device *netdev; |
254 | struct phy_device *phydev; |
255 | }; |
256 | enum macsec_offload offload; |
257 | |
258 | struct macsec_secy *secy; |
259 | struct macsec_rx_sc *rx_sc; |
260 | struct { |
261 | bool update_pn; |
262 | unsigned char assoc_num; |
263 | u8 key[MACSEC_MAX_KEY_LEN]; |
264 | union { |
265 | struct macsec_rx_sa *rx_sa; |
266 | struct macsec_tx_sa *tx_sa; |
267 | }; |
268 | } sa; |
269 | union { |
270 | struct macsec_tx_sc_stats *tx_sc_stats; |
271 | struct macsec_tx_sa_stats *tx_sa_stats; |
272 | struct macsec_rx_sc_stats *rx_sc_stats; |
273 | struct macsec_rx_sa_stats *rx_sa_stats; |
274 | struct macsec_dev_stats *dev_stats; |
275 | } stats; |
276 | }; |
277 | |
278 | /** |
279 | * struct macsec_ops - MACsec offloading operations |
280 | */ |
281 | struct macsec_ops { |
282 | /* Device wide */ |
283 | int (*mdo_dev_open)(struct macsec_context *ctx); |
284 | int (*mdo_dev_stop)(struct macsec_context *ctx); |
285 | /* SecY */ |
286 | int (*mdo_add_secy)(struct macsec_context *ctx); |
287 | int (*mdo_upd_secy)(struct macsec_context *ctx); |
288 | int (*mdo_del_secy)(struct macsec_context *ctx); |
289 | /* Security channels */ |
290 | int (*mdo_add_rxsc)(struct macsec_context *ctx); |
291 | int (*mdo_upd_rxsc)(struct macsec_context *ctx); |
292 | int (*mdo_del_rxsc)(struct macsec_context *ctx); |
293 | /* Security associations */ |
294 | int (*mdo_add_rxsa)(struct macsec_context *ctx); |
295 | int (*mdo_upd_rxsa)(struct macsec_context *ctx); |
296 | int (*mdo_del_rxsa)(struct macsec_context *ctx); |
297 | int (*mdo_add_txsa)(struct macsec_context *ctx); |
298 | int (*mdo_upd_txsa)(struct macsec_context *ctx); |
299 | int (*mdo_del_txsa)(struct macsec_context *ctx); |
300 | /* Statistics */ |
301 | int (*mdo_get_dev_stats)(struct macsec_context *ctx); |
302 | int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx); |
303 | int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx); |
304 | int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx); |
305 | int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx); |
306 | }; |
307 | |
308 | void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa); |
309 | static inline bool macsec_send_sci(const struct macsec_secy *secy) |
310 | { |
311 | const struct macsec_tx_sc *tx_sc = &secy->tx_sc; |
312 | |
313 | return tx_sc->send_sci || |
314 | (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb); |
315 | } |
316 | struct net_device *macsec_get_real_dev(const struct net_device *dev); |
317 | bool macsec_netdev_is_offloaded(struct net_device *dev); |
318 | |
319 | static inline void *macsec_netdev_priv(const struct net_device *dev) |
320 | { |
321 | #if IS_ENABLED(CONFIG_VLAN_8021Q) |
322 | if (is_vlan_dev(dev)) |
323 | return netdev_priv(dev: vlan_dev_priv(dev)->real_dev); |
324 | #endif |
325 | return netdev_priv(dev); |
326 | } |
327 | |
328 | #endif /* _NET_MACSEC_H_ */ |
329 | |