1 /* SPDX-License-Identifier: GPL-2.0+ */ 2 /* 3 * MACsec netdev header, used for h/w accelerated implementations. 4 * 5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net> 6 */ 7 #ifndef _NET_MACSEC_H_ 8 #define _NET_MACSEC_H_ 9 10 #include <linux/u64_stats_sync.h> 11 #include <linux/if_vlan.h> 12 #include <uapi/linux/if_link.h> 13 #include <uapi/linux/if_macsec.h> 14 15 #define MACSEC_DEFAULT_PN_LEN 4 16 #define MACSEC_XPN_PN_LEN 8 17 18 #define MACSEC_NUM_AN 4 /* 2 bits for the association number */ 19 20 #define MACSEC_SCI_LEN 8 21 #define MACSEC_PORT_ES (htons(0x0001)) 22 23 #define MACSEC_TCI_VERSION 0x80 24 #define MACSEC_TCI_ES 0x40 /* end station */ 25 #define MACSEC_TCI_SC 0x20 /* SCI present */ 26 #define MACSEC_TCI_SCB 0x10 /* epon */ 27 #define MACSEC_TCI_E 0x08 /* encryption */ 28 #define MACSEC_TCI_C 0x04 /* changed text */ 29 #define MACSEC_AN_MASK 0x03 /* association number */ 30 #define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C) 31 32 #define MACSEC_DEFAULT_ICV_LEN 16 33 34 typedef u64 __bitwise sci_t; 35 typedef u32 __bitwise ssci_t; 36 37 struct metadata_dst; 38 39 typedef union salt { 40 struct { 41 u32 ssci; 42 u64 pn; 43 } __packed; 44 u8 bytes[MACSEC_SALT_LEN]; 45 } __packed salt_t; 46 47 typedef union pn { 48 struct { 49 #if defined(__LITTLE_ENDIAN_BITFIELD) 50 u32 lower; 51 u32 upper; 52 #elif defined(__BIG_ENDIAN_BITFIELD) 53 u32 upper; 54 u32 lower; 55 #else 56 #error "Please fix <asm/byteorder.h>" 57 #endif 58 }; 59 u64 full64; 60 } pn_t; 61 62 /** 63 * struct macsec_key - SA key 64 * @id: user-provided key identifier 65 * @tfm: crypto struct, key storage 66 * @salt: salt used to generate IV in XPN cipher suites 67 */ 68 struct macsec_key { 69 u8 id[MACSEC_KEYID_LEN]; 70 struct crypto_aead *tfm; 71 salt_t salt; 72 }; 73 74 struct macsec_rx_sc_stats { 75 __u64 InOctetsValidated; 76 __u64 InOctetsDecrypted; 77 __u64 InPktsUnchecked; 78 __u64 InPktsDelayed; 79 __u64 InPktsOK; 80 __u64 InPktsInvalid; 81 __u64 InPktsLate; 82 __u64 InPktsNotValid; 83 __u64 InPktsNotUsingSA; 84 __u64 InPktsUnusedSA; 85 }; 86 87 struct macsec_rx_sa_stats { 88 __u32 InPktsOK; 89 __u32 InPktsInvalid; 90 __u32 InPktsNotValid; 91 __u32 InPktsNotUsingSA; 92 __u32 InPktsUnusedSA; 93 }; 94 95 struct macsec_tx_sa_stats { 96 __u32 OutPktsProtected; 97 __u32 OutPktsEncrypted; 98 }; 99 100 struct macsec_tx_sc_stats { 101 __u64 OutPktsProtected; 102 __u64 OutPktsEncrypted; 103 __u64 OutOctetsProtected; 104 __u64 OutOctetsEncrypted; 105 }; 106 107 struct macsec_dev_stats { 108 __u64 OutPktsUntagged; 109 __u64 InPktsUntagged; 110 __u64 OutPktsTooLong; 111 __u64 InPktsNoTag; 112 __u64 InPktsBadTag; 113 __u64 InPktsUnknownSCI; 114 __u64 InPktsNoSCI; 115 __u64 InPktsOverrun; 116 }; 117 118 /** 119 * struct macsec_rx_sa - receive secure association 120 * @active: 121 * @next_pn: packet number expected for the next packet 122 * @lock: protects next_pn manipulations 123 * @key: key structure 124 * @ssci: short secure channel identifier 125 * @stats: per-SA stats 126 */ 127 struct macsec_rx_sa { 128 struct macsec_key key; 129 ssci_t ssci; 130 spinlock_t lock; 131 union { 132 pn_t next_pn_halves; 133 u64 next_pn; 134 }; 135 refcount_t refcnt; 136 bool active; 137 struct macsec_rx_sa_stats __percpu *stats; 138 struct macsec_rx_sc *sc; 139 struct rcu_head rcu; 140 }; 141 142 struct pcpu_rx_sc_stats { 143 struct macsec_rx_sc_stats stats; 144 struct u64_stats_sync syncp; 145 }; 146 147 struct pcpu_tx_sc_stats { 148 struct macsec_tx_sc_stats stats; 149 struct u64_stats_sync syncp; 150 }; 151 152 /** 153 * struct macsec_rx_sc - receive secure channel 154 * @sci: secure channel identifier for this SC 155 * @active: channel is active 156 * @sa: array of secure associations 157 * @stats: per-SC stats 158 */ 159 struct macsec_rx_sc { 160 struct macsec_rx_sc __rcu *next; 161 sci_t sci; 162 bool active; 163 struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN]; 164 struct pcpu_rx_sc_stats __percpu *stats; 165 refcount_t refcnt; 166 struct rcu_head rcu_head; 167 }; 168 169 /** 170 * struct macsec_tx_sa - transmit secure association 171 * @active: 172 * @next_pn: packet number to use for the next packet 173 * @lock: protects next_pn manipulations 174 * @key: key structure 175 * @ssci: short secure channel identifier 176 * @stats: per-SA stats 177 */ 178 struct macsec_tx_sa { 179 struct macsec_key key; 180 ssci_t ssci; 181 spinlock_t lock; 182 union { 183 pn_t next_pn_halves; 184 u64 next_pn; 185 }; 186 refcount_t refcnt; 187 bool active; 188 struct macsec_tx_sa_stats __percpu *stats; 189 struct rcu_head rcu; 190 }; 191 192 /** 193 * struct macsec_tx_sc - transmit secure channel 194 * @active: 195 * @encoding_sa: association number of the SA currently in use 196 * @encrypt: encrypt packets on transmit, or authenticate only 197 * @send_sci: always include the SCI in the SecTAG 198 * @end_station: 199 * @scb: single copy broadcast flag 200 * @sa: array of secure associations 201 * @stats: stats for this TXSC 202 * @md_dst: MACsec offload metadata dst 203 */ 204 struct macsec_tx_sc { 205 bool active; 206 u8 encoding_sa; 207 bool encrypt; 208 bool send_sci; 209 bool end_station; 210 bool scb; 211 struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN]; 212 struct pcpu_tx_sc_stats __percpu *stats; 213 struct metadata_dst *md_dst; 214 }; 215 216 /** 217 * struct macsec_secy - MACsec Security Entity 218 * @netdev: netdevice for this SecY 219 * @n_rx_sc: number of receive secure channels configured on this SecY 220 * @sci: secure channel identifier used for tx 221 * @key_len: length of keys used by the cipher suite 222 * @icv_len: length of ICV used by the cipher suite 223 * @validate_frames: validation mode 224 * @xpn: enable XPN for this SecY 225 * @operational: MAC_Operational flag 226 * @protect_frames: enable protection for this SecY 227 * @replay_protect: enable packet number checks on receive 228 * @replay_window: size of the replay window 229 * @tx_sc: transmit secure channel 230 * @rx_sc: linked list of receive secure channels 231 */ 232 struct macsec_secy { 233 struct net_device *netdev; 234 unsigned int n_rx_sc; 235 sci_t sci; 236 u16 key_len; 237 u16 icv_len; 238 enum macsec_validation_type validate_frames; 239 bool xpn; 240 bool operational; 241 bool protect_frames; 242 bool replay_protect; 243 u32 replay_window; 244 struct macsec_tx_sc tx_sc; 245 struct macsec_rx_sc __rcu *rx_sc; 246 }; 247 248 /** 249 * struct macsec_context - MACsec context for hardware offloading 250 */ 251 struct macsec_context { 252 union { 253 struct net_device *netdev; 254 struct phy_device *phydev; 255 }; 256 enum macsec_offload offload; 257 258 struct macsec_secy *secy; 259 struct macsec_rx_sc *rx_sc; 260 struct { 261 unsigned char assoc_num; 262 u8 key[MACSEC_MAX_KEY_LEN]; 263 union { 264 struct macsec_rx_sa *rx_sa; 265 struct macsec_tx_sa *tx_sa; 266 }; 267 } sa; 268 union { 269 struct macsec_tx_sc_stats *tx_sc_stats; 270 struct macsec_tx_sa_stats *tx_sa_stats; 271 struct macsec_rx_sc_stats *rx_sc_stats; 272 struct macsec_rx_sa_stats *rx_sa_stats; 273 struct macsec_dev_stats *dev_stats; 274 } stats; 275 }; 276 277 /** 278 * struct macsec_ops - MACsec offloading operations 279 */ 280 struct macsec_ops { 281 /* Device wide */ 282 int (*mdo_dev_open)(struct macsec_context *ctx); 283 int (*mdo_dev_stop)(struct macsec_context *ctx); 284 /* SecY */ 285 int (*mdo_add_secy)(struct macsec_context *ctx); 286 int (*mdo_upd_secy)(struct macsec_context *ctx); 287 int (*mdo_del_secy)(struct macsec_context *ctx); 288 /* Security channels */ 289 int (*mdo_add_rxsc)(struct macsec_context *ctx); 290 int (*mdo_upd_rxsc)(struct macsec_context *ctx); 291 int (*mdo_del_rxsc)(struct macsec_context *ctx); 292 /* Security associations */ 293 int (*mdo_add_rxsa)(struct macsec_context *ctx); 294 int (*mdo_upd_rxsa)(struct macsec_context *ctx); 295 int (*mdo_del_rxsa)(struct macsec_context *ctx); 296 int (*mdo_add_txsa)(struct macsec_context *ctx); 297 int (*mdo_upd_txsa)(struct macsec_context *ctx); 298 int (*mdo_del_txsa)(struct macsec_context *ctx); 299 /* Statistics */ 300 int (*mdo_get_dev_stats)(struct macsec_context *ctx); 301 int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx); 302 int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx); 303 int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx); 304 int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx); 305 }; 306 307 void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa); 308 static inline bool macsec_send_sci(const struct macsec_secy *secy) 309 { 310 const struct macsec_tx_sc *tx_sc = &secy->tx_sc; 311 312 return tx_sc->send_sci || 313 (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb); 314 } 315 316 static inline void *macsec_netdev_priv(const struct net_device *dev) 317 { 318 #if IS_ENABLED(CONFIG_VLAN_8021Q) 319 if (is_vlan_dev(dev)) 320 return netdev_priv(vlan_dev_priv(dev)->real_dev); 321 #endif 322 return netdev_priv(dev); 323 } 324 325 #endif /* _NET_MACSEC_H_ */ 326