xref: /freebsd/contrib/wpa/src/pae/ieee802_1x_kay.h (revision da5069e1f7daaef1e7157876d6044de6f3a08ce2)
1 /*
2  * IEEE 802.1X-2010 Key Agree Protocol of PAE state machine
3  * Copyright (c) 2013, Qualcomm Atheros, Inc.
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #ifndef IEEE802_1X_KAY_H
10 #define IEEE802_1X_KAY_H
11 
12 #include "utils/list.h"
13 #include "common/defs.h"
14 #include "common/ieee802_1x_defs.h"
15 
16 struct macsec_init_params;
17 
18 #define MI_LEN			12  /* 96-bit Member Identifier */
19 #define MAX_KEY_LEN		32  /* 32 bytes, 256 bits */
20 #define MAX_CKN_LEN		32  /* 32 bytes, 256 bits */
21 
22 /* MKA timer, unit: millisecond */
23 #define MKA_HELLO_TIME		2000
24 #define MKA_LIFE_TIME		6000
25 #define MKA_SAK_RETIRE_TIME	3000
26 
27 /**
28  * struct ieee802_1x_mka_ki - Key Identifier (KI)
29  * @mi: Key Server's Member Identifier
30  * @kn: Key Number, assigned by the Key Server
31  * IEEE 802.1X-2010 9.8 SAK generation, distribution, and selection
32  */
33 struct ieee802_1x_mka_ki {
34 	u8 mi[MI_LEN];
35 	u32 kn;
36 };
37 
38 struct ieee802_1x_mka_sci {
39 	u8 addr[ETH_ALEN];
40 	be16 port;
41 };
42 
43 struct mka_key {
44 	u8 key[MAX_KEY_LEN];
45 	size_t len;
46 };
47 
48 struct mka_key_name {
49 	u8 name[MAX_CKN_LEN];
50 	size_t len;
51 };
52 
53 enum mka_created_mode {
54 	PSK,
55 	EAP_EXCHANGE,
56 };
57 
58 struct data_key {
59 	u8 *key;
60 	int key_len;
61 	struct ieee802_1x_mka_ki key_identifier;
62 	enum confidentiality_offset confidentiality_offset;
63 	u8 an;
64 	Boolean transmits;
65 	Boolean receives;
66 	struct os_time created_time;
67 	u32 next_pn;
68 
69 	/* not defined data */
70 	Boolean rx_latest;
71 	Boolean tx_latest;
72 
73 	int user;
74 
75 	struct dl_list list;
76 };
77 
78 /* TransmitSC in IEEE Std 802.1AE-2006, Figure 10-6 */
79 struct transmit_sc {
80 	struct ieee802_1x_mka_sci sci; /* const SCI sci */
81 	Boolean transmitting; /* bool transmitting (read only) */
82 
83 	struct os_time created_time; /* Time createdTime */
84 
85 	u8 encoding_sa; /* AN encodingSA (read only) */
86 	u8 enciphering_sa; /* AN encipheringSA (read only) */
87 
88 	/* not defined data */
89 	struct dl_list list;
90 	struct dl_list sa_list;
91 };
92 
93 /* TransmitSA in IEEE Std 802.1AE-2006, Figure 10-6 */
94 struct transmit_sa {
95 	Boolean in_use; /* bool inUse (read only) */
96 	u32 next_pn; /* PN nextPN (read only) */
97 	struct os_time created_time; /* Time createdTime */
98 
99 	Boolean enable_transmit; /* bool EnableTransmit */
100 
101 	u8 an;
102 	Boolean confidentiality;
103 	struct data_key *pkey;
104 
105 	struct transmit_sc *sc;
106 	struct dl_list list; /* list entry in struct transmit_sc::sa_list */
107 };
108 
109 /* ReceiveSC in IEEE Std 802.1AE-2006, Figure 10-6 */
110 struct receive_sc {
111 	struct ieee802_1x_mka_sci sci; /* const SCI sci */
112 	Boolean receiving; /* bool receiving (read only) */
113 
114 	struct os_time created_time; /* Time createdTime */
115 
116 	struct dl_list list;
117 	struct dl_list sa_list;
118 };
119 
120 /* ReceiveSA in IEEE Std 802.1AE-2006, Figure 10-6 */
121 struct receive_sa {
122 	Boolean enable_receive; /* bool enableReceive */
123 	Boolean in_use; /* bool inUse (read only) */
124 
125 	u32 next_pn; /* PN nextPN (read only) */
126 	u32 lowest_pn; /* PN lowestPN (read only) */
127 	u8 an;
128 	struct os_time created_time;
129 
130 	struct data_key *pkey;
131 	struct receive_sc *sc; /* list entry in struct receive_sc::sa_list */
132 
133 	struct dl_list list;
134 };
135 
136 struct ieee802_1x_kay_ctx {
137 	/* pointer to arbitrary upper level context */
138 	void *ctx;
139 
140 	/* abstract wpa driver interface */
141 	int (*macsec_init)(void *ctx, struct macsec_init_params *params);
142 	int (*macsec_deinit)(void *ctx);
143 	int (*macsec_get_capability)(void *priv, enum macsec_cap *cap);
144 	int (*enable_protect_frames)(void *ctx, Boolean enabled);
145 	int (*enable_encrypt)(void *ctx, Boolean enabled);
146 	int (*set_replay_protect)(void *ctx, Boolean enabled, u32 window);
147 	int (*set_current_cipher_suite)(void *ctx, u64 cs);
148 	int (*enable_controlled_port)(void *ctx, Boolean enabled);
149 	int (*get_receive_lowest_pn)(void *ctx, struct receive_sa *sa);
150 	int (*get_transmit_next_pn)(void *ctx, struct transmit_sa *sa);
151 	int (*set_transmit_next_pn)(void *ctx, struct transmit_sa *sa);
152 	int (*create_receive_sc)(void *ctx, struct receive_sc *sc,
153 				 enum validate_frames vf,
154 				 enum confidentiality_offset co);
155 	int (*delete_receive_sc)(void *ctx, struct receive_sc *sc);
156 	int (*create_receive_sa)(void *ctx, struct receive_sa *sa);
157 	int (*delete_receive_sa)(void *ctx, struct receive_sa *sa);
158 	int (*enable_receive_sa)(void *ctx, struct receive_sa *sa);
159 	int (*disable_receive_sa)(void *ctx, struct receive_sa *sa);
160 	int (*create_transmit_sc)(void *ctx, struct transmit_sc *sc,
161 				  enum confidentiality_offset co);
162 	int (*delete_transmit_sc)(void *ctx, struct transmit_sc *sc);
163 	int (*create_transmit_sa)(void *ctx, struct transmit_sa *sa);
164 	int (*delete_transmit_sa)(void *ctx, struct transmit_sa *sa);
165 	int (*enable_transmit_sa)(void *ctx, struct transmit_sa *sa);
166 	int (*disable_transmit_sa)(void *ctx, struct transmit_sa *sa);
167 };
168 
169 struct ieee802_1x_kay {
170 	Boolean enable;
171 	Boolean active;
172 
173 	Boolean authenticated;
174 	Boolean secured;
175 	Boolean failed;
176 
177 	struct ieee802_1x_mka_sci actor_sci;
178 	u8 actor_priority;
179 	struct ieee802_1x_mka_sci key_server_sci;
180 	u8 key_server_priority;
181 
182 	enum macsec_cap macsec_capable;
183 	Boolean macsec_desired;
184 	Boolean macsec_protect;
185 	Boolean macsec_encrypt;
186 	Boolean macsec_replay_protect;
187 	u32 macsec_replay_window;
188 	enum validate_frames macsec_validate;
189 	enum confidentiality_offset macsec_confidentiality;
190 
191 	u32 ltx_kn;
192 	u8 ltx_an;
193 	u32 lrx_kn;
194 	u8 lrx_an;
195 
196 	u32 otx_kn;
197 	u8 otx_an;
198 	u32 orx_kn;
199 	u8 orx_an;
200 
201 	/* not defined in IEEE802.1X */
202 	struct ieee802_1x_kay_ctx *ctx;
203 	Boolean is_key_server;
204 	Boolean is_obliged_key_server;
205 	char if_name[IFNAMSIZ];
206 
207 	unsigned int macsec_csindex;  /* MACsec cipher suite table index */
208 	int mka_algindex;  /* MKA alg table index */
209 
210 	u32 dist_kn;
211 	u32 rcvd_keys;
212 	u8 dist_an;
213 	time_t dist_time;
214 
215 	u8 mka_version;
216 	u8 algo_agility[4];
217 
218 	u32 pn_exhaustion;
219 	Boolean port_enable;
220 	Boolean rx_enable;
221 	Boolean tx_enable;
222 
223 	struct dl_list participant_list;
224 	enum macsec_policy policy;
225 
226 	struct ieee802_1x_cp_sm *cp;
227 
228 	struct l2_packet_data *l2_mka;
229 
230 	enum validate_frames vf;
231 	enum confidentiality_offset co;
232 };
233 
234 
235 u64 mka_sci_u64(struct ieee802_1x_mka_sci *sci);
236 
237 struct ieee802_1x_kay *
238 ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
239 		    u16 port, u8 priority, const char *ifname, const u8 *addr);
240 void ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay);
241 
242 struct ieee802_1x_mka_participant *
243 ieee802_1x_kay_create_mka(struct ieee802_1x_kay *kay,
244 			  const struct mka_key_name *ckn,
245 			  const struct mka_key *cak,
246 			  u32 life, enum mka_created_mode mode,
247 			  Boolean is_authenticator);
248 void ieee802_1x_kay_delete_mka(struct ieee802_1x_kay *kay,
249 			       struct mka_key_name *ckn);
250 void ieee802_1x_kay_mka_participate(struct ieee802_1x_kay *kay,
251 				    struct mka_key_name *ckn,
252 				    Boolean status);
253 int ieee802_1x_kay_new_sak(struct ieee802_1x_kay *kay);
254 int ieee802_1x_kay_change_cipher_suite(struct ieee802_1x_kay *kay,
255 				       unsigned int cs_index);
256 
257 int ieee802_1x_kay_set_latest_sa_attr(struct ieee802_1x_kay *kay,
258 				      struct ieee802_1x_mka_ki *lki, u8 lan,
259 				      Boolean ltx, Boolean lrx);
260 int ieee802_1x_kay_set_old_sa_attr(struct ieee802_1x_kay *kay,
261 				   struct ieee802_1x_mka_ki *oki,
262 				   u8 oan, Boolean otx, Boolean orx);
263 int ieee802_1x_kay_create_sas(struct ieee802_1x_kay *kay,
264 			      struct ieee802_1x_mka_ki *lki);
265 int ieee802_1x_kay_delete_sas(struct ieee802_1x_kay *kay,
266 			      struct ieee802_1x_mka_ki *ki);
267 int ieee802_1x_kay_enable_tx_sas(struct ieee802_1x_kay *kay,
268 				 struct ieee802_1x_mka_ki *lki);
269 int ieee802_1x_kay_enable_rx_sas(struct ieee802_1x_kay *kay,
270 				 struct ieee802_1x_mka_ki *lki);
271 int ieee802_1x_kay_enable_new_info(struct ieee802_1x_kay *kay);
272 int ieee802_1x_kay_get_status(struct ieee802_1x_kay *kay, char *buf,
273 			      size_t buflen);
274 
275 #endif /* IEEE802_1X_KAY_H */
276