1 | /* SPDX-License-Identifier: GPL-2.0+ */ |
2 | /* |
3 | * MACsec netdev header, used for h/w accelerated implementations. |
4 | * |
5 | * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net> |
6 | */ |
7 | #ifndef _NET_MACSEC_H_ |
8 | #define _NET_MACSEC_H_ |
9 | |
10 | #include <linux/u64_stats_sync.h> |
11 | #include <linux/if_vlan.h> |
12 | #include <uapi/linux/if_link.h> |
13 | #include <uapi/linux/if_macsec.h> |
14 | |
15 | #define MACSEC_DEFAULT_PN_LEN 4 |
16 | #define MACSEC_XPN_PN_LEN 8 |
17 | |
18 | #define MACSEC_NUM_AN 4 /* 2 bits for the association number */ |
19 | |
20 | #define MACSEC_SCI_LEN 8 |
21 | #define MACSEC_PORT_ES (htons(0x0001)) |
22 | |
23 | #define MACSEC_TCI_VERSION 0x80 |
24 | #define MACSEC_TCI_ES 0x40 /* end station */ |
25 | #define MACSEC_TCI_SC 0x20 /* SCI present */ |
26 | #define MACSEC_TCI_SCB 0x10 /* epon */ |
27 | #define MACSEC_TCI_E 0x08 /* encryption */ |
28 | #define MACSEC_TCI_C 0x04 /* changed text */ |
29 | #define MACSEC_AN_MASK 0x03 /* association number */ |
30 | #define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C) |
31 | |
32 | #define MACSEC_DEFAULT_ICV_LEN 16 |
33 | |
34 | typedef u64 __bitwise sci_t; |
35 | typedef u32 __bitwise ssci_t; |
36 | |
37 | struct metadata_dst; |
38 | |
39 | typedef union salt { |
40 | struct { |
41 | u32 ssci; |
42 | u64 pn; |
43 | } __packed; |
44 | u8 bytes[MACSEC_SALT_LEN]; |
45 | } __packed salt_t; |
46 | |
47 | typedef union pn { |
48 | struct { |
49 | #if defined(__LITTLE_ENDIAN_BITFIELD) |
50 | u32 lower; |
51 | u32 upper; |
52 | #elif defined(__BIG_ENDIAN_BITFIELD) |
53 | u32 upper; |
54 | u32 lower; |
55 | #else |
56 | #error "Please fix <asm/byteorder.h>" |
57 | #endif |
58 | }; |
59 | u64 full64; |
60 | } pn_t; |
61 | |
62 | /** |
63 | * struct macsec_key - SA key |
64 | * @id: user-provided key identifier |
65 | * @tfm: crypto struct, key storage |
66 | * @salt: salt used to generate IV in XPN cipher suites |
67 | */ |
68 | struct macsec_key { |
69 | u8 id[MACSEC_KEYID_LEN]; |
70 | struct crypto_aead *tfm; |
71 | salt_t salt; |
72 | }; |
73 | |
74 | struct macsec_rx_sc_stats { |
75 | __u64 InOctetsValidated; |
76 | __u64 InOctetsDecrypted; |
77 | __u64 InPktsUnchecked; |
78 | __u64 InPktsDelayed; |
79 | __u64 InPktsOK; |
80 | __u64 InPktsInvalid; |
81 | __u64 InPktsLate; |
82 | __u64 InPktsNotValid; |
83 | __u64 InPktsNotUsingSA; |
84 | __u64 InPktsUnusedSA; |
85 | }; |
86 | |
87 | struct macsec_rx_sa_stats { |
88 | __u32 InPktsOK; |
89 | __u32 InPktsInvalid; |
90 | __u32 InPktsNotValid; |
91 | __u32 InPktsNotUsingSA; |
92 | __u32 InPktsUnusedSA; |
93 | }; |
94 | |
95 | struct macsec_tx_sa_stats { |
96 | __u32 OutPktsProtected; |
97 | __u32 OutPktsEncrypted; |
98 | }; |
99 | |
100 | struct macsec_tx_sc_stats { |
101 | __u64 OutPktsProtected; |
102 | __u64 OutPktsEncrypted; |
103 | __u64 OutOctetsProtected; |
104 | __u64 OutOctetsEncrypted; |
105 | }; |
106 | |
107 | struct macsec_dev_stats { |
108 | __u64 OutPktsUntagged; |
109 | __u64 InPktsUntagged; |
110 | __u64 OutPktsTooLong; |
111 | __u64 InPktsNoTag; |
112 | __u64 InPktsBadTag; |
113 | __u64 InPktsUnknownSCI; |
114 | __u64 InPktsNoSCI; |
115 | __u64 InPktsOverrun; |
116 | }; |
117 | |
118 | /** |
119 | * struct macsec_rx_sa - receive secure association |
120 | * @active: |
121 | * @next_pn: packet number expected for the next packet |
122 | * @lock: protects next_pn manipulations |
123 | * @key: key structure |
124 | * @ssci: short secure channel identifier |
125 | * @stats: per-SA stats |
126 | */ |
127 | struct macsec_rx_sa { |
128 | struct macsec_key key; |
129 | ssci_t ssci; |
130 | spinlock_t lock; |
131 | union { |
132 | pn_t next_pn_halves; |
133 | u64 next_pn; |
134 | }; |
135 | refcount_t refcnt; |
136 | bool active; |
137 | struct macsec_rx_sa_stats __percpu *stats; |
138 | struct macsec_rx_sc *sc; |
139 | struct rcu_head rcu; |
140 | }; |
141 | |
142 | struct pcpu_rx_sc_stats { |
143 | struct macsec_rx_sc_stats stats; |
144 | struct u64_stats_sync syncp; |
145 | }; |
146 | |
147 | struct pcpu_tx_sc_stats { |
148 | struct macsec_tx_sc_stats stats; |
149 | struct u64_stats_sync syncp; |
150 | }; |
151 | |
152 | /** |
153 | * struct macsec_rx_sc - receive secure channel |
154 | * @sci: secure channel identifier for this SC |
155 | * @active: channel is active |
156 | * @sa: array of secure associations |
157 | * @stats: per-SC stats |
158 | */ |
159 | struct macsec_rx_sc { |
160 | struct macsec_rx_sc __rcu *next; |
161 | sci_t sci; |
162 | bool active; |
163 | struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN]; |
164 | struct pcpu_rx_sc_stats __percpu *stats; |
165 | refcount_t refcnt; |
166 | struct rcu_head rcu_head; |
167 | }; |
168 | |
169 | /** |
170 | * struct macsec_tx_sa - transmit secure association |
171 | * @active: |
172 | * @next_pn: packet number to use for the next packet |
173 | * @lock: protects next_pn manipulations |
174 | * @key: key structure |
175 | * @ssci: short secure channel identifier |
176 | * @stats: per-SA stats |
177 | */ |
178 | struct macsec_tx_sa { |
179 | struct macsec_key key; |
180 | ssci_t ssci; |
181 | spinlock_t lock; |
182 | union { |
183 | pn_t next_pn_halves; |
184 | u64 next_pn; |
185 | }; |
186 | refcount_t refcnt; |
187 | bool active; |
188 | struct macsec_tx_sa_stats __percpu *stats; |
189 | struct rcu_head rcu; |
190 | }; |
191 | |
192 | /** |
193 | * struct macsec_tx_sc - transmit secure channel |
194 | * @active: |
195 | * @encoding_sa: association number of the SA currently in use |
196 | * @encrypt: encrypt packets on transmit, or authenticate only |
197 | * @send_sci: always include the SCI in the SecTAG |
198 | * @end_station: |
199 | * @scb: single copy broadcast flag |
200 | * @sa: array of secure associations |
201 | * @stats: stats for this TXSC |
202 | * @md_dst: MACsec offload metadata dst |
203 | */ |
204 | struct macsec_tx_sc { |
205 | bool active; |
206 | u8 encoding_sa; |
207 | bool encrypt; |
208 | bool send_sci; |
209 | bool end_station; |
210 | bool scb; |
211 | struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN]; |
212 | struct pcpu_tx_sc_stats __percpu *stats; |
213 | struct metadata_dst *md_dst; |
214 | }; |
215 | |
216 | /** |
217 | * struct macsec_secy - MACsec Security Entity |
218 | * @netdev: netdevice for this SecY |
219 | * @n_rx_sc: number of receive secure channels configured on this SecY |
220 | * @sci: secure channel identifier used for tx |
221 | * @key_len: length of keys used by the cipher suite |
222 | * @icv_len: length of ICV used by the cipher suite |
223 | * @validate_frames: validation mode |
224 | * @xpn: enable XPN for this SecY |
225 | * @operational: MAC_Operational flag |
226 | * @protect_frames: enable protection for this SecY |
227 | * @replay_protect: enable packet number checks on receive |
228 | * @replay_window: size of the replay window |
229 | * @tx_sc: transmit secure channel |
230 | * @rx_sc: linked list of receive secure channels |
231 | */ |
232 | struct macsec_secy { |
233 | struct net_device *netdev; |
234 | unsigned int n_rx_sc; |
235 | sci_t sci; |
236 | u16 key_len; |
237 | u16 icv_len; |
238 | enum macsec_validation_type validate_frames; |
239 | bool xpn; |
240 | bool operational; |
241 | bool protect_frames; |
242 | bool replay_protect; |
243 | u32 replay_window; |
244 | struct macsec_tx_sc tx_sc; |
245 | struct macsec_rx_sc __rcu *rx_sc; |
246 | }; |
247 | |
248 | /** |
249 | * struct macsec_context - MACsec context for hardware offloading |
250 | * @netdev: a valid pointer to a struct net_device if @offload == |
251 | * MACSEC_OFFLOAD_MAC |
252 | * @phydev: a valid pointer to a struct phy_device if @offload == |
253 | * MACSEC_OFFLOAD_PHY |
254 | * @offload: MACsec offload status |
255 | * @secy: pointer to a MACsec SecY |
256 | * @rx_sc: pointer to a RX SC |
257 | * @update_pn: when updating the SA, update the next PN |
258 | * @assoc_num: association number of the target SA |
259 | * @key: key of the target SA |
260 | * @rx_sa: pointer to an RX SA if a RX SA is added/updated/removed |
261 | * @tx_sa: pointer to an TX SA if a TX SA is added/updated/removed |
262 | * @tx_sc_stats: pointer to TX SC stats structure |
263 | * @tx_sa_stats: pointer to TX SA stats structure |
264 | * @rx_sc_stats: pointer to RX SC stats structure |
265 | * @rx_sa_stats: pointer to RX SA stats structure |
266 | * @dev_stats: pointer to dev stats structure |
267 | */ |
268 | struct macsec_context { |
269 | union { |
270 | struct net_device *netdev; |
271 | struct phy_device *phydev; |
272 | }; |
273 | enum macsec_offload offload; |
274 | |
275 | struct macsec_secy *secy; |
276 | struct macsec_rx_sc *rx_sc; |
277 | struct { |
278 | bool update_pn; |
279 | unsigned char assoc_num; |
280 | u8 key[MACSEC_MAX_KEY_LEN]; |
281 | union { |
282 | struct macsec_rx_sa *rx_sa; |
283 | struct macsec_tx_sa *tx_sa; |
284 | }; |
285 | } sa; |
286 | union { |
287 | struct macsec_tx_sc_stats *tx_sc_stats; |
288 | struct macsec_tx_sa_stats *tx_sa_stats; |
289 | struct macsec_rx_sc_stats *rx_sc_stats; |
290 | struct macsec_rx_sa_stats *rx_sa_stats; |
291 | struct macsec_dev_stats *dev_stats; |
292 | } stats; |
293 | }; |
294 | |
295 | /** |
296 | * struct macsec_ops - MACsec offloading operations |
297 | * @mdo_dev_open: called when the MACsec interface transitions to the up state |
298 | * @mdo_dev_stop: called when the MACsec interface transitions to the down |
299 | * state |
300 | * @mdo_add_secy: called when a new SecY is added |
301 | * @mdo_upd_secy: called when the SecY flags are changed or the MAC address of |
302 | * the MACsec interface is changed |
303 | * @mdo_del_secy: called when the hw offload is disabled or the MACsec |
304 | * interface is removed |
305 | * @mdo_add_rxsc: called when a new RX SC is added |
306 | * @mdo_upd_rxsc: called when a certain RX SC is updated |
307 | * @mdo_del_rxsc: called when a certain RX SC is removed |
308 | * @mdo_add_rxsa: called when a new RX SA is added |
309 | * @mdo_upd_rxsa: called when a certain RX SA is updated |
310 | * @mdo_del_rxsa: called when a certain RX SA is removed |
311 | * @mdo_add_txsa: called when a new TX SA is added |
312 | * @mdo_upd_txsa: called when a certain TX SA is updated |
313 | * @mdo_del_txsa: called when a certain TX SA is removed |
314 | * @mdo_get_dev_stats: called when dev stats are read |
315 | * @mdo_get_tx_sc_stats: called when TX SC stats are read |
316 | * @mdo_get_tx_sa_stats: called when TX SA stats are read |
317 | * @mdo_get_rx_sc_stats: called when RX SC stats are read |
318 | * @mdo_get_rx_sa_stats: called when RX SA stats are read |
319 | * @mdo_insert_tx_tag: called to insert the TX tag |
320 | * @needed_headroom: number of bytes reserved at the beginning of the sk_buff |
321 | * for the TX tag |
322 | * @needed_tailroom: number of bytes reserved at the end of the sk_buff for the |
323 | * TX tag |
324 | */ |
325 | struct macsec_ops { |
326 | /* Device wide */ |
327 | int (*mdo_dev_open)(struct macsec_context *ctx); |
328 | int (*mdo_dev_stop)(struct macsec_context *ctx); |
329 | /* SecY */ |
330 | int (*mdo_add_secy)(struct macsec_context *ctx); |
331 | int (*mdo_upd_secy)(struct macsec_context *ctx); |
332 | int (*mdo_del_secy)(struct macsec_context *ctx); |
333 | /* Security channels */ |
334 | int (*mdo_add_rxsc)(struct macsec_context *ctx); |
335 | int (*mdo_upd_rxsc)(struct macsec_context *ctx); |
336 | int (*mdo_del_rxsc)(struct macsec_context *ctx); |
337 | /* Security associations */ |
338 | int (*mdo_add_rxsa)(struct macsec_context *ctx); |
339 | int (*mdo_upd_rxsa)(struct macsec_context *ctx); |
340 | int (*mdo_del_rxsa)(struct macsec_context *ctx); |
341 | int (*mdo_add_txsa)(struct macsec_context *ctx); |
342 | int (*mdo_upd_txsa)(struct macsec_context *ctx); |
343 | int (*mdo_del_txsa)(struct macsec_context *ctx); |
344 | /* Statistics */ |
345 | int (*mdo_get_dev_stats)(struct macsec_context *ctx); |
346 | int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx); |
347 | int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx); |
348 | int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx); |
349 | int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx); |
350 | /* Offload tag */ |
351 | int (*mdo_insert_tx_tag)(struct phy_device *phydev, |
352 | struct sk_buff *skb); |
353 | unsigned int needed_headroom; |
354 | unsigned int needed_tailroom; |
355 | }; |
356 | |
357 | void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa); |
358 | static inline bool macsec_send_sci(const struct macsec_secy *secy) |
359 | { |
360 | const struct macsec_tx_sc *tx_sc = &secy->tx_sc; |
361 | |
362 | return tx_sc->send_sci || |
363 | (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb); |
364 | } |
365 | struct net_device *macsec_get_real_dev(const struct net_device *dev); |
366 | bool macsec_netdev_is_offloaded(struct net_device *dev); |
367 | |
368 | static inline void *macsec_netdev_priv(const struct net_device *dev) |
369 | { |
370 | #if IS_ENABLED(CONFIG_VLAN_8021Q) |
371 | if (is_vlan_dev(dev)) |
372 | return netdev_priv(dev: vlan_dev_priv(dev)->real_dev); |
373 | #endif |
374 | return netdev_priv(dev); |
375 | } |
376 | |
377 | static inline u64 sci_to_cpu(sci_t sci) |
378 | { |
379 | return be64_to_cpu((__force __be64)sci); |
380 | } |
381 | |
382 | #endif /* _NET_MACSEC_H_ */ |
383 | |