projects/linux·blob master · refs

387 lines · 10.8 KiB

1/* SPDX-License-Identifier: GPL-2.0+ */
2/*
3 * MACsec netdev header, used for h/w accelerated implementations.
4 *
5 * Copyright (c) 2015 Sabrina Dubroca <[email protected]>
6 */
7#ifndef _NET_MACSEC_H_
8#define _NET_MACSEC_H_
9
10#include <linux/u64_stats_sync.h>
11#include <linux/if_vlan.h>
12#include <linux/workqueue.h>
13#include <uapi/linux/if_link.h>
14#include <uapi/linux/if_macsec.h>
15
16#define MACSEC_DEFAULT_PN_LEN 4
17#define MACSEC_XPN_PN_LEN 8
18
19#define MACSEC_NUM_AN 4 /* 2 bits for the association number */
20
21#define MACSEC_SCI_LEN 8
22#define MACSEC_PORT_ES (htons(0x0001))
23
24#define MACSEC_TCI_VERSION 0x80
25#define MACSEC_TCI_ES 0x40 /* end station */
26#define MACSEC_TCI_SC 0x20 /* SCI present */
27#define MACSEC_TCI_SCB 0x10 /* epon */
28#define MACSEC_TCI_E 0x08 /* encryption */
29#define MACSEC_TCI_C 0x04 /* changed text */
30#define MACSEC_AN_MASK 0x03 /* association number */
31#define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C)
32
33#define MACSEC_DEFAULT_ICV_LEN 16
34
35typedef u64 __bitwise sci_t;
36typedef u32 __bitwise ssci_t;
37
38struct metadata_dst;
39
40typedef union salt {
41 struct {
42 ssci_t ssci;
43 __be64 pn;
44 } __packed;
45 u8 bytes[MACSEC_SALT_LEN];
46} __packed salt_t;
47
48typedef union pn {
49 struct {
50#if defined(__LITTLE_ENDIAN_BITFIELD)
51 u32 lower;
52 u32 upper;
53#elif defined(__BIG_ENDIAN_BITFIELD)
54 u32 upper;
55 u32 lower;
56#else
57#error "Please fix <asm/byteorder.h>"
58#endif
59 };
60 u64 full64;
61} pn_t;
62
63/**
64 * struct macsec_key - SA key
65 * @id: user-provided key identifier
66 * @tfm: crypto struct, key storage
67 * @salt: salt used to generate IV in XPN cipher suites
68 */
69struct macsec_key {
70 u8 id[MACSEC_KEYID_LEN];
71 struct crypto_aead *tfm;
72 salt_t salt;
73};
74
75struct macsec_rx_sc_stats {
76 __u64 InOctetsValidated;
77 __u64 InOctetsDecrypted;
78 __u64 InPktsUnchecked;
79 __u64 InPktsDelayed;
80 __u64 InPktsOK;
81 __u64 InPktsInvalid;
82 __u64 InPktsLate;
83 __u64 InPktsNotValid;
84 __u64 InPktsNotUsingSA;
85 __u64 InPktsUnusedSA;
86};
87
88struct macsec_rx_sa_stats {
89 __u32 InPktsOK;
90 __u32 InPktsInvalid;
91 __u32 InPktsNotValid;
92 __u32 InPktsNotUsingSA;
93 __u32 InPktsUnusedSA;
94};
95
96struct macsec_tx_sa_stats {
97 __u32 OutPktsProtected;
98 __u32 OutPktsEncrypted;
99};
100
101struct macsec_tx_sc_stats {
102 __u64 OutPktsProtected;
103 __u64 OutPktsEncrypted;
104 __u64 OutOctetsProtected;
105 __u64 OutOctetsEncrypted;
106};
107
108struct macsec_dev_stats {
109 __u64 OutPktsUntagged;
110 __u64 InPktsUntagged;
111 __u64 OutPktsTooLong;
112 __u64 InPktsNoTag;
113 __u64 InPktsBadTag;
114 __u64 InPktsUnknownSCI;
115 __u64 InPktsNoSCI;
116 __u64 InPktsOverrun;
117};
118
119/**
120 * struct macsec_rx_sa - receive secure association
121 * @active:
122 * @next_pn: packet number expected for the next packet
123 * @lock: protects next_pn manipulations
124 * @key: key structure
125 * @ssci: short secure channel identifier
126 * @stats: per-SA stats
127 * @destroy_work: deferred work to free the SA in process context after RCU grace period
128 */
129struct macsec_rx_sa {
130 struct macsec_key key;
131 ssci_t ssci;
132 spinlock_t lock;
133 union {
134 pn_t next_pn_halves;
135 u64 next_pn;
136 };
137 refcount_t refcnt;
138 bool active;
139 struct macsec_rx_sa_stats __percpu *stats;
140 struct macsec_rx_sc *sc;
141 struct rcu_work destroy_work;
142};
143
144struct pcpu_rx_sc_stats {
145 struct macsec_rx_sc_stats stats;
146 struct u64_stats_sync syncp;
147};
148
149struct pcpu_tx_sc_stats {
150 struct macsec_tx_sc_stats stats;
151 struct u64_stats_sync syncp;
152};
153
154/**
155 * struct macsec_rx_sc - receive secure channel
156 * @sci: secure channel identifier for this SC
157 * @active: channel is active
158 * @sa: array of secure associations
159 * @stats: per-SC stats
160 */
161struct macsec_rx_sc {
162 struct macsec_rx_sc __rcu *next;
163 sci_t sci;
164 bool active;
165 struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN];
166 struct pcpu_rx_sc_stats __percpu *stats;
167 refcount_t refcnt;
168 struct rcu_head rcu_head;
169};
170
171/**
172 * struct macsec_tx_sa - transmit secure association
173 * @active:
174 * @next_pn: packet number to use for the next packet
175 * @lock: protects next_pn manipulations
176 * @key: key structure
177 * @ssci: short secure channel identifier
178 * @stats: per-SA stats
179 * @destroy_work: deferred work to free the SA in process context after RCU grace period
180 */
181struct macsec_tx_sa {
182 struct macsec_key key;
183 ssci_t ssci;
184 spinlock_t lock;
185 union {
186 pn_t next_pn_halves;
187 u64 next_pn;
188 };
189 refcount_t refcnt;
190 bool active;
191 struct macsec_tx_sa_stats __percpu *stats;
192 struct rcu_work destroy_work;
193};
194
195/**
196 * struct macsec_tx_sc - transmit secure channel
197 * @active:
198 * @encoding_sa: association number of the SA currently in use
199 * @encrypt: encrypt packets on transmit, or authenticate only
200 * @send_sci: always include the SCI in the SecTAG
201 * @end_station:
202 * @scb: single copy broadcast flag
203 * @sa: array of secure associations
204 * @stats: stats for this TXSC
205 * @md_dst: MACsec offload metadata dst
206 */
207struct macsec_tx_sc {
208 bool active;
209 u8 encoding_sa;
210 bool encrypt;
211 bool send_sci;
212 bool end_station;
213 bool scb;
214 struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN];
215 struct pcpu_tx_sc_stats __percpu *stats;
216 struct metadata_dst *md_dst;
217};
218
219/**
220 * struct macsec_secy - MACsec Security Entity
221 * @netdev: netdevice for this SecY
222 * @n_rx_sc: number of receive secure channels configured on this SecY
223 * @sci: secure channel identifier used for tx
224 * @key_len: length of keys used by the cipher suite
225 * @icv_len: length of ICV used by the cipher suite
226 * @validate_frames: validation mode
227 * @xpn: enable XPN for this SecY
228 * @operational: MAC_Operational flag
229 * @protect_frames: enable protection for this SecY
230 * @replay_protect: enable packet number checks on receive
231 * @replay_window: size of the replay window
232 * @tx_sc: transmit secure channel
233 * @rx_sc: linked list of receive secure channels
234 */
235struct macsec_secy {
236 struct net_device *netdev;
237 unsigned int n_rx_sc;
238 sci_t sci;
239 u16 key_len;
240 u16 icv_len;
241 enum macsec_validation_type validate_frames;
242 bool xpn;
243 bool operational;
244 bool protect_frames;
245 bool replay_protect;
246 u32 replay_window;
247 struct macsec_tx_sc tx_sc;
248 struct macsec_rx_sc __rcu *rx_sc;
249};
250
251/**
252 * struct macsec_context - MACsec context for hardware offloading
253 * @netdev: a valid pointer to a struct net_device if @offload ==
254 * MACSEC_OFFLOAD_MAC
255 * @phydev: a valid pointer to a struct phy_device if @offload ==
256 * MACSEC_OFFLOAD_PHY
257 * @offload: MACsec offload status
258 * @secy: pointer to a MACsec SecY
259 * @rx_sc: pointer to a RX SC
260 * @update_pn: when updating the SA, update the next PN
261 * @assoc_num: association number of the target SA
262 * @key: key of the target SA
263 * @rx_sa: pointer to an RX SA if a RX SA is added/updated/removed
264 * @tx_sa: pointer to an TX SA if a TX SA is added/updated/removed
265 * @tx_sc_stats: pointer to TX SC stats structure
266 * @tx_sa_stats: pointer to TX SA stats structure
267 * @rx_sc_stats: pointer to RX SC stats structure
268 * @rx_sa_stats: pointer to RX SA stats structure
269 * @dev_stats: pointer to dev stats structure
270 */
271struct macsec_context {
272 union {
273 struct net_device *netdev;
274 struct phy_device *phydev;
275 };
276 enum macsec_offload offload;
277
278 struct macsec_secy *secy;
279 struct macsec_rx_sc *rx_sc;
280 struct {
281 bool update_pn;
282 unsigned char assoc_num;
283 u8 key[MACSEC_MAX_KEY_LEN];
284 union {
285 struct macsec_rx_sa *rx_sa;
286 struct macsec_tx_sa *tx_sa;
287 };
288 } sa;
289 union {
290 struct macsec_tx_sc_stats *tx_sc_stats;
291 struct macsec_tx_sa_stats *tx_sa_stats;
292 struct macsec_rx_sc_stats *rx_sc_stats;
293 struct macsec_rx_sa_stats *rx_sa_stats;
294 struct macsec_dev_stats *dev_stats;
295 } stats;
296};
297
298/**
299 * struct macsec_ops - MACsec offloading operations
300 * @mdo_dev_open: called when the MACsec interface transitions to the up state
301 * @mdo_dev_stop: called when the MACsec interface transitions to the down
302 * state
303 * @mdo_add_secy: called when a new SecY is added
304 * @mdo_upd_secy: called when the SecY flags are changed or the MAC address of
305 * the MACsec interface is changed
306 * @mdo_del_secy: called when the hw offload is disabled or the MACsec
307 * interface is removed
308 * @mdo_add_rxsc: called when a new RX SC is added
309 * @mdo_upd_rxsc: called when a certain RX SC is updated
310 * @mdo_del_rxsc: called when a certain RX SC is removed
311 * @mdo_add_rxsa: called when a new RX SA is added
312 * @mdo_upd_rxsa: called when a certain RX SA is updated
313 * @mdo_del_rxsa: called when a certain RX SA is removed
314 * @mdo_add_txsa: called when a new TX SA is added
315 * @mdo_upd_txsa: called when a certain TX SA is updated
316 * @mdo_del_txsa: called when a certain TX SA is removed
317 * @mdo_get_dev_stats: called when dev stats are read
318 * @mdo_get_tx_sc_stats: called when TX SC stats are read
319 * @mdo_get_tx_sa_stats: called when TX SA stats are read
320 * @mdo_get_rx_sc_stats: called when RX SC stats are read
321 * @mdo_get_rx_sa_stats: called when RX SA stats are read
322 * @mdo_insert_tx_tag: called to insert the TX tag
323 * @needed_headroom: number of bytes reserved at the beginning of the sk_buff
324 * for the TX tag
325 * @needed_tailroom: number of bytes reserved at the end of the sk_buff for the
326 * TX tag
327 * @rx_uses_md_dst: whether MACsec device offload supports sk_buff md_dst
328 */
329struct macsec_ops {
330 /* Device wide */
331 int (*mdo_dev_open)(struct macsec_context *ctx);
332 int (*mdo_dev_stop)(struct macsec_context *ctx);
333 /* SecY */
334 int (*mdo_add_secy)(struct macsec_context *ctx);
335 int (*mdo_upd_secy)(struct macsec_context *ctx);
336 int (*mdo_del_secy)(struct macsec_context *ctx);
337 /* Security channels */
338 int (*mdo_add_rxsc)(struct macsec_context *ctx);
339 int (*mdo_upd_rxsc)(struct macsec_context *ctx);
340 int (*mdo_del_rxsc)(struct macsec_context *ctx);
341 /* Security associations */
342 int (*mdo_add_rxsa)(struct macsec_context *ctx);
343 int (*mdo_upd_rxsa)(struct macsec_context *ctx);
344 int (*mdo_del_rxsa)(struct macsec_context *ctx);
345 int (*mdo_add_txsa)(struct macsec_context *ctx);
346 int (*mdo_upd_txsa)(struct macsec_context *ctx);
347 int (*mdo_del_txsa)(struct macsec_context *ctx);
348 /* Statistics */
349 int (*mdo_get_dev_stats)(struct macsec_context *ctx);
350 int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx);
351 int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx);
352 int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx);
353 int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx);
354 /* Offload tag */
355 int (*mdo_insert_tx_tag)(struct phy_device *phydev,
356 struct sk_buff *skb);
357 unsigned int needed_headroom;
358 unsigned int needed_tailroom;
359 bool rx_uses_md_dst;
360};
361
362void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa);
363static inline bool macsec_send_sci(const struct macsec_secy *secy)
364{
365 const struct macsec_tx_sc *tx_sc = &secy->tx_sc;
366
367 return tx_sc->send_sci ||
368 (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb);
369}
370struct net_device *macsec_get_real_dev(const struct net_device *dev);
371bool macsec_netdev_is_offloaded(struct net_device *dev);
372
373static inline void *macsec_netdev_priv(const struct net_device *dev)
374{
375#if IS_ENABLED(CONFIG_VLAN_8021Q)
376 if (is_vlan_dev(dev))
377 return netdev_priv(vlan_dev_priv(dev)->real_dev);
378#endif
379 return netdev_priv(dev);
380}
381
382static inline u64 sci_to_cpu(sci_t sci)
383{
384 return be64_to_cpu((__force __be64)sci);
385}
386
387#endif /* _NET_MACSEC_H_ */