1 /* SPDX-License-Identifier: GPL-2.0+ */ 2 /* 3 * MACsec netdev header, used for h/w accelerated implementations. 4 * 5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net> 6 */ 7 #ifndef _NET_MACSEC_H_ 8 #define _NET_MACSEC_H_ 9 10 #include <linux/u64_stats_sync.h> 11 #include <uapi/linux/if_link.h> 12 #include <uapi/linux/if_macsec.h> 13 14 #define MACSEC_DEFAULT_PN_LEN 4 15 #define MACSEC_XPN_PN_LEN 8 16 17 #define MACSEC_NUM_AN 4 /* 2 bits for the association number */ 18 19 typedef u64 __bitwise sci_t; 20 typedef u32 __bitwise ssci_t; 21 22 typedef union salt { 23 struct { 24 u32 ssci; 25 u64 pn; 26 } __packed; 27 u8 bytes[MACSEC_SALT_LEN]; 28 } __packed salt_t; 29 30 typedef union pn { 31 struct { 32 #if defined(__LITTLE_ENDIAN_BITFIELD) 33 u32 lower; 34 u32 upper; 35 #elif defined(__BIG_ENDIAN_BITFIELD) 36 u32 upper; 37 u32 lower; 38 #else 39 #error "Please fix <asm/byteorder.h>" 40 #endif 41 }; 42 u64 full64; 43 } pn_t; 44 45 /** 46 * struct macsec_key - SA key 47 * @id: user-provided key identifier 48 * @tfm: crypto struct, key storage 49 * @salt: salt used to generate IV in XPN cipher suites 50 */ 51 struct macsec_key { 52 u8 id[MACSEC_KEYID_LEN]; 53 struct crypto_aead *tfm; 54 salt_t salt; 55 }; 56 57 struct macsec_rx_sc_stats { 58 __u64 InOctetsValidated; 59 __u64 InOctetsDecrypted; 60 __u64 InPktsUnchecked; 61 __u64 InPktsDelayed; 62 __u64 InPktsOK; 63 __u64 InPktsInvalid; 64 __u64 InPktsLate; 65 __u64 InPktsNotValid; 66 __u64 InPktsNotUsingSA; 67 __u64 InPktsUnusedSA; 68 }; 69 70 struct macsec_rx_sa_stats { 71 __u32 InPktsOK; 72 __u32 InPktsInvalid; 73 __u32 InPktsNotValid; 74 __u32 InPktsNotUsingSA; 75 __u32 InPktsUnusedSA; 76 }; 77 78 struct macsec_tx_sa_stats { 79 __u32 OutPktsProtected; 80 __u32 OutPktsEncrypted; 81 }; 82 83 struct macsec_tx_sc_stats { 84 __u64 OutPktsProtected; 85 __u64 OutPktsEncrypted; 86 __u64 OutOctetsProtected; 87 __u64 OutOctetsEncrypted; 88 }; 89 90 struct macsec_dev_stats { 91 __u64 OutPktsUntagged; 92 __u64 InPktsUntagged; 93 __u64 OutPktsTooLong; 94 __u64 InPktsNoTag; 95 __u64 InPktsBadTag; 96 __u64 InPktsUnknownSCI; 97 __u64 InPktsNoSCI; 98 __u64 InPktsOverrun; 99 }; 100 101 /** 102 * struct macsec_rx_sa - receive secure association 103 * @active: 104 * @next_pn: packet number expected for the next packet 105 * @lock: protects next_pn manipulations 106 * @key: key structure 107 * @ssci: short secure channel identifier 108 * @stats: per-SA stats 109 */ 110 struct macsec_rx_sa { 111 struct macsec_key key; 112 ssci_t ssci; 113 spinlock_t lock; 114 union { 115 pn_t next_pn_halves; 116 u64 next_pn; 117 }; 118 refcount_t refcnt; 119 bool active; 120 struct macsec_rx_sa_stats __percpu *stats; 121 struct macsec_rx_sc *sc; 122 struct rcu_head rcu; 123 }; 124 125 struct pcpu_rx_sc_stats { 126 struct macsec_rx_sc_stats stats; 127 struct u64_stats_sync syncp; 128 }; 129 130 struct pcpu_tx_sc_stats { 131 struct macsec_tx_sc_stats stats; 132 struct u64_stats_sync syncp; 133 }; 134 135 /** 136 * struct macsec_rx_sc - receive secure channel 137 * @sci: secure channel identifier for this SC 138 * @active: channel is active 139 * @sa: array of secure associations 140 * @stats: per-SC stats 141 */ 142 struct macsec_rx_sc { 143 struct macsec_rx_sc __rcu *next; 144 sci_t sci; 145 bool active; 146 struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN]; 147 struct pcpu_rx_sc_stats __percpu *stats; 148 refcount_t refcnt; 149 struct rcu_head rcu_head; 150 }; 151 152 /** 153 * struct macsec_tx_sa - transmit secure association 154 * @active: 155 * @next_pn: packet number to use for the next packet 156 * @lock: protects next_pn manipulations 157 * @key: key structure 158 * @ssci: short secure channel identifier 159 * @stats: per-SA stats 160 */ 161 struct macsec_tx_sa { 162 struct macsec_key key; 163 ssci_t ssci; 164 spinlock_t lock; 165 union { 166 pn_t next_pn_halves; 167 u64 next_pn; 168 }; 169 refcount_t refcnt; 170 bool active; 171 struct macsec_tx_sa_stats __percpu *stats; 172 struct rcu_head rcu; 173 }; 174 175 /** 176 * struct macsec_tx_sc - transmit secure channel 177 * @active: 178 * @encoding_sa: association number of the SA currently in use 179 * @encrypt: encrypt packets on transmit, or authenticate only 180 * @send_sci: always include the SCI in the SecTAG 181 * @end_station: 182 * @scb: single copy broadcast flag 183 * @sa: array of secure associations 184 * @stats: stats for this TXSC 185 */ 186 struct macsec_tx_sc { 187 bool active; 188 u8 encoding_sa; 189 bool encrypt; 190 bool send_sci; 191 bool end_station; 192 bool scb; 193 struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN]; 194 struct pcpu_tx_sc_stats __percpu *stats; 195 }; 196 197 /** 198 * struct macsec_secy - MACsec Security Entity 199 * @netdev: netdevice for this SecY 200 * @n_rx_sc: number of receive secure channels configured on this SecY 201 * @sci: secure channel identifier used for tx 202 * @key_len: length of keys used by the cipher suite 203 * @icv_len: length of ICV used by the cipher suite 204 * @validate_frames: validation mode 205 * @xpn: enable XPN for this SecY 206 * @operational: MAC_Operational flag 207 * @protect_frames: enable protection for this SecY 208 * @replay_protect: enable packet number checks on receive 209 * @replay_window: size of the replay window 210 * @tx_sc: transmit secure channel 211 * @rx_sc: linked list of receive secure channels 212 */ 213 struct macsec_secy { 214 struct net_device *netdev; 215 unsigned int n_rx_sc; 216 sci_t sci; 217 u16 key_len; 218 u16 icv_len; 219 enum macsec_validation_type validate_frames; 220 bool xpn; 221 bool operational; 222 bool protect_frames; 223 bool replay_protect; 224 u32 replay_window; 225 struct macsec_tx_sc tx_sc; 226 struct macsec_rx_sc __rcu *rx_sc; 227 }; 228 229 /** 230 * struct macsec_context - MACsec context for hardware offloading 231 */ 232 struct macsec_context { 233 union { 234 struct net_device *netdev; 235 struct phy_device *phydev; 236 }; 237 enum macsec_offload offload; 238 239 struct macsec_secy *secy; 240 struct macsec_rx_sc *rx_sc; 241 struct { 242 unsigned char assoc_num; 243 u8 key[MACSEC_MAX_KEY_LEN]; 244 union { 245 struct macsec_rx_sa *rx_sa; 246 struct macsec_tx_sa *tx_sa; 247 }; 248 } sa; 249 union { 250 struct macsec_tx_sc_stats *tx_sc_stats; 251 struct macsec_tx_sa_stats *tx_sa_stats; 252 struct macsec_rx_sc_stats *rx_sc_stats; 253 struct macsec_rx_sa_stats *rx_sa_stats; 254 struct macsec_dev_stats *dev_stats; 255 } stats; 256 257 u8 prepare:1; 258 }; 259 260 /** 261 * struct macsec_ops - MACsec offloading operations 262 */ 263 struct macsec_ops { 264 /* Device wide */ 265 int (*mdo_dev_open)(struct macsec_context *ctx); 266 int (*mdo_dev_stop)(struct macsec_context *ctx); 267 /* SecY */ 268 int (*mdo_add_secy)(struct macsec_context *ctx); 269 int (*mdo_upd_secy)(struct macsec_context *ctx); 270 int (*mdo_del_secy)(struct macsec_context *ctx); 271 /* Security channels */ 272 int (*mdo_add_rxsc)(struct macsec_context *ctx); 273 int (*mdo_upd_rxsc)(struct macsec_context *ctx); 274 int (*mdo_del_rxsc)(struct macsec_context *ctx); 275 /* Security associations */ 276 int (*mdo_add_rxsa)(struct macsec_context *ctx); 277 int (*mdo_upd_rxsa)(struct macsec_context *ctx); 278 int (*mdo_del_rxsa)(struct macsec_context *ctx); 279 int (*mdo_add_txsa)(struct macsec_context *ctx); 280 int (*mdo_upd_txsa)(struct macsec_context *ctx); 281 int (*mdo_del_txsa)(struct macsec_context *ctx); 282 /* Statistics */ 283 int (*mdo_get_dev_stats)(struct macsec_context *ctx); 284 int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx); 285 int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx); 286 int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx); 287 int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx); 288 }; 289 290 void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa); 291 292 #endif /* _NET_MACSEC_H_ */ 293