1 /* SPDX-License-Identifier: GPL-2.0+ */
3 * MACsec netdev header, used for h/w accelerated implementations.
5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
10 #include <linux/u64_stats_sync.h>
11 #include <uapi/linux/if_link.h>
12 #include <uapi/linux/if_macsec.h>
14 #define MACSEC_DEFAULT_PN_LEN 4
15 #define MACSEC_XPN_PN_LEN 8
17 #define MACSEC_NUM_AN 4 /* 2 bits for the association number */
19 #define MACSEC_SCI_LEN 8
20 #define MACSEC_PORT_ES (htons(0x0001))
22 #define MACSEC_TCI_VERSION 0x80
23 #define MACSEC_TCI_ES 0x40 /* end station */
24 #define MACSEC_TCI_SC 0x20 /* SCI present */
25 #define MACSEC_TCI_SCB 0x10 /* epon */
26 #define MACSEC_TCI_E 0x08 /* encryption */
27 #define MACSEC_TCI_C 0x04 /* changed text */
28 #define MACSEC_AN_MASK 0x03 /* association number */
29 #define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C)
31 #define MACSEC_DEFAULT_ICV_LEN 16
33 typedef u64 __bitwise sci_t;
34 typedef u32 __bitwise ssci_t;
43 u8 bytes[MACSEC_SALT_LEN];
48 #if defined(__LITTLE_ENDIAN_BITFIELD)
51 #elif defined(__BIG_ENDIAN_BITFIELD)
55 #error "Please fix <asm/byteorder.h>"
62 * struct macsec_key - SA key
63 * @id: user-provided key identifier
64 * @tfm: crypto struct, key storage
65 * @salt: salt used to generate IV in XPN cipher suites
68 u8 id[MACSEC_KEYID_LEN];
69 struct crypto_aead *tfm;
73 struct macsec_rx_sc_stats {
74 __u64 InOctetsValidated;
75 __u64 InOctetsDecrypted;
76 __u64 InPktsUnchecked;
82 __u64 InPktsNotUsingSA;
86 struct macsec_rx_sa_stats {
90 __u32 InPktsNotUsingSA;
94 struct macsec_tx_sa_stats {
95 __u32 OutPktsProtected;
96 __u32 OutPktsEncrypted;
99 struct macsec_tx_sc_stats {
100 __u64 OutPktsProtected;
101 __u64 OutPktsEncrypted;
102 __u64 OutOctetsProtected;
103 __u64 OutOctetsEncrypted;
106 struct macsec_dev_stats {
107 __u64 OutPktsUntagged;
108 __u64 InPktsUntagged;
109 __u64 OutPktsTooLong;
112 __u64 InPktsUnknownSCI;
118 * struct macsec_rx_sa - receive secure association
120 * @next_pn: packet number expected for the next packet
121 * @lock: protects next_pn manipulations
122 * @key: key structure
123 * @ssci: short secure channel identifier
124 * @stats: per-SA stats
126 struct macsec_rx_sa {
127 struct macsec_key key;
136 struct macsec_rx_sa_stats __percpu *stats;
137 struct macsec_rx_sc *sc;
141 struct pcpu_rx_sc_stats {
142 struct macsec_rx_sc_stats stats;
143 struct u64_stats_sync syncp;
146 struct pcpu_tx_sc_stats {
147 struct macsec_tx_sc_stats stats;
148 struct u64_stats_sync syncp;
152 * struct macsec_rx_sc - receive secure channel
153 * @sci: secure channel identifier for this SC
154 * @active: channel is active
155 * @sa: array of secure associations
156 * @stats: per-SC stats
158 struct macsec_rx_sc {
159 struct macsec_rx_sc __rcu *next;
162 struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN];
163 struct pcpu_rx_sc_stats __percpu *stats;
165 struct rcu_head rcu_head;
169 * struct macsec_tx_sa - transmit secure association
171 * @next_pn: packet number to use for the next packet
172 * @lock: protects next_pn manipulations
173 * @key: key structure
174 * @ssci: short secure channel identifier
175 * @stats: per-SA stats
177 struct macsec_tx_sa {
178 struct macsec_key key;
187 struct macsec_tx_sa_stats __percpu *stats;
192 * struct macsec_tx_sc - transmit secure channel
194 * @encoding_sa: association number of the SA currently in use
195 * @encrypt: encrypt packets on transmit, or authenticate only
196 * @send_sci: always include the SCI in the SecTAG
198 * @scb: single copy broadcast flag
199 * @sa: array of secure associations
200 * @stats: stats for this TXSC
201 * @md_dst: MACsec offload metadata dst
203 struct macsec_tx_sc {
210 struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN];
211 struct pcpu_tx_sc_stats __percpu *stats;
212 struct metadata_dst *md_dst;
216 * struct macsec_secy - MACsec Security Entity
217 * @netdev: netdevice for this SecY
218 * @n_rx_sc: number of receive secure channels configured on this SecY
219 * @sci: secure channel identifier used for tx
220 * @key_len: length of keys used by the cipher suite
221 * @icv_len: length of ICV used by the cipher suite
222 * @validate_frames: validation mode
223 * @xpn: enable XPN for this SecY
224 * @operational: MAC_Operational flag
225 * @protect_frames: enable protection for this SecY
226 * @replay_protect: enable packet number checks on receive
227 * @replay_window: size of the replay window
228 * @tx_sc: transmit secure channel
229 * @rx_sc: linked list of receive secure channels
232 struct net_device *netdev;
233 unsigned int n_rx_sc;
237 enum macsec_validation_type validate_frames;
243 struct macsec_tx_sc tx_sc;
244 struct macsec_rx_sc __rcu *rx_sc;
248 * struct macsec_context - MACsec context for hardware offloading
250 struct macsec_context {
252 struct net_device *netdev;
253 struct phy_device *phydev;
255 enum macsec_offload offload;
257 struct macsec_secy *secy;
258 struct macsec_rx_sc *rx_sc;
260 unsigned char assoc_num;
261 u8 key[MACSEC_MAX_KEY_LEN];
263 struct macsec_rx_sa *rx_sa;
264 struct macsec_tx_sa *tx_sa;
268 struct macsec_tx_sc_stats *tx_sc_stats;
269 struct macsec_tx_sa_stats *tx_sa_stats;
270 struct macsec_rx_sc_stats *rx_sc_stats;
271 struct macsec_rx_sa_stats *rx_sa_stats;
272 struct macsec_dev_stats *dev_stats;
277 * struct macsec_ops - MACsec offloading operations
281 int (*mdo_dev_open)(struct macsec_context *ctx);
282 int (*mdo_dev_stop)(struct macsec_context *ctx);
284 int (*mdo_add_secy)(struct macsec_context *ctx);
285 int (*mdo_upd_secy)(struct macsec_context *ctx);
286 int (*mdo_del_secy)(struct macsec_context *ctx);
287 /* Security channels */
288 int (*mdo_add_rxsc)(struct macsec_context *ctx);
289 int (*mdo_upd_rxsc)(struct macsec_context *ctx);
290 int (*mdo_del_rxsc)(struct macsec_context *ctx);
291 /* Security associations */
292 int (*mdo_add_rxsa)(struct macsec_context *ctx);
293 int (*mdo_upd_rxsa)(struct macsec_context *ctx);
294 int (*mdo_del_rxsa)(struct macsec_context *ctx);
295 int (*mdo_add_txsa)(struct macsec_context *ctx);
296 int (*mdo_upd_txsa)(struct macsec_context *ctx);
297 int (*mdo_del_txsa)(struct macsec_context *ctx);
299 int (*mdo_get_dev_stats)(struct macsec_context *ctx);
300 int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx);
301 int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx);
302 int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx);
303 int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx);
306 void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa);
307 static inline bool macsec_send_sci(const struct macsec_secy *secy)
309 const struct macsec_tx_sc *tx_sc = &secy->tx_sc;
311 return tx_sc->send_sci ||
312 (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb);
315 #endif /* _NET_MACSEC_H_ */