xref: /linux/include/net/macsec.h (revision 3a07362fab1653d3aca31a9155c8cc776138fd02)
1 /* SPDX-License-Identifier: GPL-2.0+ */
2 /*
3  * MACsec netdev header, used for h/w accelerated implementations.
4  *
5  * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
6  */
7 #ifndef _NET_MACSEC_H_
8 #define _NET_MACSEC_H_
9 
10 #include <linux/u64_stats_sync.h>
11 #include <linux/if_vlan.h>
12 #include <uapi/linux/if_link.h>
13 #include <uapi/linux/if_macsec.h>
14 
15 #define MACSEC_DEFAULT_PN_LEN 4
16 #define MACSEC_XPN_PN_LEN 8
17 
18 #define MACSEC_NUM_AN 4 /* 2 bits for the association number */
19 
20 #define MACSEC_SCI_LEN 8
21 #define MACSEC_PORT_ES (htons(0x0001))
22 
23 #define MACSEC_TCI_VERSION 0x80
24 #define MACSEC_TCI_ES      0x40 /* end station */
25 #define MACSEC_TCI_SC      0x20 /* SCI present */
26 #define MACSEC_TCI_SCB     0x10 /* epon */
27 #define MACSEC_TCI_E       0x08 /* encryption */
28 #define MACSEC_TCI_C       0x04 /* changed text */
29 #define MACSEC_AN_MASK     0x03 /* association number */
30 #define MACSEC_TCI_CONFID  (MACSEC_TCI_E | MACSEC_TCI_C)
31 
32 #define MACSEC_DEFAULT_ICV_LEN 16
33 
34 typedef u64 __bitwise sci_t;
35 typedef u32 __bitwise ssci_t;
36 
37 struct metadata_dst;
38 
39 typedef union salt {
40 	struct {
41 		u32 ssci;
42 		u64 pn;
43 	} __packed;
44 	u8 bytes[MACSEC_SALT_LEN];
45 } __packed salt_t;
46 
47 typedef union pn {
48 	struct {
49 #if defined(__LITTLE_ENDIAN_BITFIELD)
50 		u32 lower;
51 		u32 upper;
52 #elif defined(__BIG_ENDIAN_BITFIELD)
53 		u32 upper;
54 		u32 lower;
55 #else
56 #error	"Please fix <asm/byteorder.h>"
57 #endif
58 	};
59 	u64 full64;
60 } pn_t;
61 
62 /**
63  * struct macsec_key - SA key
64  * @id: user-provided key identifier
65  * @tfm: crypto struct, key storage
66  * @salt: salt used to generate IV in XPN cipher suites
67  */
68 struct macsec_key {
69 	u8 id[MACSEC_KEYID_LEN];
70 	struct crypto_aead *tfm;
71 	salt_t salt;
72 };
73 
74 struct macsec_rx_sc_stats {
75 	__u64 InOctetsValidated;
76 	__u64 InOctetsDecrypted;
77 	__u64 InPktsUnchecked;
78 	__u64 InPktsDelayed;
79 	__u64 InPktsOK;
80 	__u64 InPktsInvalid;
81 	__u64 InPktsLate;
82 	__u64 InPktsNotValid;
83 	__u64 InPktsNotUsingSA;
84 	__u64 InPktsUnusedSA;
85 };
86 
87 struct macsec_rx_sa_stats {
88 	__u32 InPktsOK;
89 	__u32 InPktsInvalid;
90 	__u32 InPktsNotValid;
91 	__u32 InPktsNotUsingSA;
92 	__u32 InPktsUnusedSA;
93 };
94 
95 struct macsec_tx_sa_stats {
96 	__u32 OutPktsProtected;
97 	__u32 OutPktsEncrypted;
98 };
99 
100 struct macsec_tx_sc_stats {
101 	__u64 OutPktsProtected;
102 	__u64 OutPktsEncrypted;
103 	__u64 OutOctetsProtected;
104 	__u64 OutOctetsEncrypted;
105 };
106 
107 struct macsec_dev_stats {
108 	__u64 OutPktsUntagged;
109 	__u64 InPktsUntagged;
110 	__u64 OutPktsTooLong;
111 	__u64 InPktsNoTag;
112 	__u64 InPktsBadTag;
113 	__u64 InPktsUnknownSCI;
114 	__u64 InPktsNoSCI;
115 	__u64 InPktsOverrun;
116 };
117 
118 /**
119  * struct macsec_rx_sa - receive secure association
120  * @active:
121  * @next_pn: packet number expected for the next packet
122  * @lock: protects next_pn manipulations
123  * @key: key structure
124  * @ssci: short secure channel identifier
125  * @stats: per-SA stats
126  */
127 struct macsec_rx_sa {
128 	struct macsec_key key;
129 	ssci_t ssci;
130 	spinlock_t lock;
131 	union {
132 		pn_t next_pn_halves;
133 		u64 next_pn;
134 	};
135 	refcount_t refcnt;
136 	bool active;
137 	struct macsec_rx_sa_stats __percpu *stats;
138 	struct macsec_rx_sc *sc;
139 	struct rcu_head rcu;
140 };
141 
142 struct pcpu_rx_sc_stats {
143 	struct macsec_rx_sc_stats stats;
144 	struct u64_stats_sync syncp;
145 };
146 
147 struct pcpu_tx_sc_stats {
148 	struct macsec_tx_sc_stats stats;
149 	struct u64_stats_sync syncp;
150 };
151 
152 /**
153  * struct macsec_rx_sc - receive secure channel
154  * @sci: secure channel identifier for this SC
155  * @active: channel is active
156  * @sa: array of secure associations
157  * @stats: per-SC stats
158  */
159 struct macsec_rx_sc {
160 	struct macsec_rx_sc __rcu *next;
161 	sci_t sci;
162 	bool active;
163 	struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN];
164 	struct pcpu_rx_sc_stats __percpu *stats;
165 	refcount_t refcnt;
166 	struct rcu_head rcu_head;
167 };
168 
169 /**
170  * struct macsec_tx_sa - transmit secure association
171  * @active:
172  * @next_pn: packet number to use for the next packet
173  * @lock: protects next_pn manipulations
174  * @key: key structure
175  * @ssci: short secure channel identifier
176  * @stats: per-SA stats
177  */
178 struct macsec_tx_sa {
179 	struct macsec_key key;
180 	ssci_t ssci;
181 	spinlock_t lock;
182 	union {
183 		pn_t next_pn_halves;
184 		u64 next_pn;
185 	};
186 	refcount_t refcnt;
187 	bool active;
188 	struct macsec_tx_sa_stats __percpu *stats;
189 	struct rcu_head rcu;
190 };
191 
192 /**
193  * struct macsec_tx_sc - transmit secure channel
194  * @active:
195  * @encoding_sa: association number of the SA currently in use
196  * @encrypt: encrypt packets on transmit, or authenticate only
197  * @send_sci: always include the SCI in the SecTAG
198  * @end_station:
199  * @scb: single copy broadcast flag
200  * @sa: array of secure associations
201  * @stats: stats for this TXSC
202  * @md_dst: MACsec offload metadata dst
203  */
204 struct macsec_tx_sc {
205 	bool active;
206 	u8 encoding_sa;
207 	bool encrypt;
208 	bool send_sci;
209 	bool end_station;
210 	bool scb;
211 	struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN];
212 	struct pcpu_tx_sc_stats __percpu *stats;
213 	struct metadata_dst *md_dst;
214 };
215 
216 /**
217  * struct macsec_secy - MACsec Security Entity
218  * @netdev: netdevice for this SecY
219  * @n_rx_sc: number of receive secure channels configured on this SecY
220  * @sci: secure channel identifier used for tx
221  * @key_len: length of keys used by the cipher suite
222  * @icv_len: length of ICV used by the cipher suite
223  * @validate_frames: validation mode
224  * @xpn: enable XPN for this SecY
225  * @operational: MAC_Operational flag
226  * @protect_frames: enable protection for this SecY
227  * @replay_protect: enable packet number checks on receive
228  * @replay_window: size of the replay window
229  * @tx_sc: transmit secure channel
230  * @rx_sc: linked list of receive secure channels
231  */
232 struct macsec_secy {
233 	struct net_device *netdev;
234 	unsigned int n_rx_sc;
235 	sci_t sci;
236 	u16 key_len;
237 	u16 icv_len;
238 	enum macsec_validation_type validate_frames;
239 	bool xpn;
240 	bool operational;
241 	bool protect_frames;
242 	bool replay_protect;
243 	u32 replay_window;
244 	struct macsec_tx_sc tx_sc;
245 	struct macsec_rx_sc __rcu *rx_sc;
246 };
247 
248 /**
249  * struct macsec_context - MACsec context for hardware offloading
250  * @netdev: a valid pointer to a struct net_device if @offload ==
251  *	MACSEC_OFFLOAD_MAC
252  * @phydev: a valid pointer to a struct phy_device if @offload ==
253  *	MACSEC_OFFLOAD_PHY
254  * @offload: MACsec offload status
255  * @secy: pointer to a MACsec SecY
256  * @rx_sc: pointer to a RX SC
257  * @update_pn: when updating the SA, update the next PN
258  * @assoc_num: association number of the target SA
259  * @key: key of the target SA
260  * @rx_sa: pointer to an RX SA if a RX SA is added/updated/removed
261  * @tx_sa: pointer to an TX SA if a TX SA is added/updated/removed
262  * @tx_sc_stats: pointer to TX SC stats structure
263  * @tx_sa_stats: pointer to TX SA stats structure
264  * @rx_sc_stats: pointer to RX SC stats structure
265  * @rx_sa_stats: pointer to RX SA stats structure
266  * @dev_stats: pointer to dev stats structure
267  */
268 struct macsec_context {
269 	union {
270 		struct net_device *netdev;
271 		struct phy_device *phydev;
272 	};
273 	enum macsec_offload offload;
274 
275 	struct macsec_secy *secy;
276 	struct macsec_rx_sc *rx_sc;
277 	struct {
278 		bool update_pn;
279 		unsigned char assoc_num;
280 		u8 key[MACSEC_MAX_KEY_LEN];
281 		union {
282 			struct macsec_rx_sa *rx_sa;
283 			struct macsec_tx_sa *tx_sa;
284 		};
285 	} sa;
286 	union {
287 		struct macsec_tx_sc_stats *tx_sc_stats;
288 		struct macsec_tx_sa_stats *tx_sa_stats;
289 		struct macsec_rx_sc_stats *rx_sc_stats;
290 		struct macsec_rx_sa_stats *rx_sa_stats;
291 		struct macsec_dev_stats  *dev_stats;
292 	} stats;
293 };
294 
295 /**
296  * struct macsec_ops - MACsec offloading operations
297  * @mdo_dev_open: called when the MACsec interface transitions to the up state
298  * @mdo_dev_stop: called when the MACsec interface transitions to the down
299  *	state
300  * @mdo_add_secy: called when a new SecY is added
301  * @mdo_upd_secy: called when the SecY flags are changed or the MAC address of
302  *	the MACsec interface is changed
303  * @mdo_del_secy: called when the hw offload is disabled or the MACsec
304  *	interface is removed
305  * @mdo_add_rxsc: called when a new RX SC is added
306  * @mdo_upd_rxsc: called when a certain RX SC is updated
307  * @mdo_del_rxsc: called when a certain RX SC is removed
308  * @mdo_add_rxsa: called when a new RX SA is added
309  * @mdo_upd_rxsa: called when a certain RX SA is updated
310  * @mdo_del_rxsa: called when a certain RX SA is removed
311  * @mdo_add_txsa: called when a new TX SA is added
312  * @mdo_upd_txsa: called when a certain TX SA is updated
313  * @mdo_del_txsa: called when a certain TX SA is removed
314  * @mdo_get_dev_stats: called when dev stats are read
315  * @mdo_get_tx_sc_stats: called when TX SC stats are read
316  * @mdo_get_tx_sa_stats: called when TX SA stats are read
317  * @mdo_get_rx_sc_stats: called when RX SC stats are read
318  * @mdo_get_rx_sa_stats: called when RX SA stats are read
319  * @mdo_insert_tx_tag: called to insert the TX tag
320  * @needed_headroom: number of bytes reserved at the beginning of the sk_buff
321  *	for the TX tag
322  * @needed_tailroom: number of bytes reserved at the end of the sk_buff for the
323  *	TX tag
324  * @rx_uses_md_dst: whether MACsec device offload supports sk_buff md_dst
325  */
326 struct macsec_ops {
327 	/* Device wide */
328 	int (*mdo_dev_open)(struct macsec_context *ctx);
329 	int (*mdo_dev_stop)(struct macsec_context *ctx);
330 	/* SecY */
331 	int (*mdo_add_secy)(struct macsec_context *ctx);
332 	int (*mdo_upd_secy)(struct macsec_context *ctx);
333 	int (*mdo_del_secy)(struct macsec_context *ctx);
334 	/* Security channels */
335 	int (*mdo_add_rxsc)(struct macsec_context *ctx);
336 	int (*mdo_upd_rxsc)(struct macsec_context *ctx);
337 	int (*mdo_del_rxsc)(struct macsec_context *ctx);
338 	/* Security associations */
339 	int (*mdo_add_rxsa)(struct macsec_context *ctx);
340 	int (*mdo_upd_rxsa)(struct macsec_context *ctx);
341 	int (*mdo_del_rxsa)(struct macsec_context *ctx);
342 	int (*mdo_add_txsa)(struct macsec_context *ctx);
343 	int (*mdo_upd_txsa)(struct macsec_context *ctx);
344 	int (*mdo_del_txsa)(struct macsec_context *ctx);
345 	/* Statistics */
346 	int (*mdo_get_dev_stats)(struct macsec_context *ctx);
347 	int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx);
348 	int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx);
349 	int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx);
350 	int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx);
351 	/* Offload tag */
352 	int (*mdo_insert_tx_tag)(struct phy_device *phydev,
353 				 struct sk_buff *skb);
354 	unsigned int needed_headroom;
355 	unsigned int needed_tailroom;
356 	bool rx_uses_md_dst;
357 };
358 
359 void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa);
macsec_send_sci(const struct macsec_secy * secy)360 static inline bool macsec_send_sci(const struct macsec_secy *secy)
361 {
362 	const struct macsec_tx_sc *tx_sc = &secy->tx_sc;
363 
364 	return tx_sc->send_sci ||
365 		(secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb);
366 }
367 struct net_device *macsec_get_real_dev(const struct net_device *dev);
368 bool macsec_netdev_is_offloaded(struct net_device *dev);
369 
macsec_netdev_priv(const struct net_device * dev)370 static inline void *macsec_netdev_priv(const struct net_device *dev)
371 {
372 #if IS_ENABLED(CONFIG_VLAN_8021Q)
373 	if (is_vlan_dev(dev))
374 		return netdev_priv(vlan_dev_priv(dev)->real_dev);
375 #endif
376 	return netdev_priv(dev);
377 }
378 
sci_to_cpu(sci_t sci)379 static inline u64 sci_to_cpu(sci_t sci)
380 {
381 	return be64_to_cpu((__force __be64)sci);
382 }
383 
384 #endif /* _NET_MACSEC_H_ */
385