1 /* SPDX-License-Identifier: GPL-2.0+ */ 2 /* 3 * MACsec netdev header, used for h/w accelerated implementations. 4 * 5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net> 6 */ 7 #ifndef _NET_MACSEC_H_ 8 #define _NET_MACSEC_H_ 9 10 #include <linux/u64_stats_sync.h> 11 #include <linux/if_vlan.h> 12 #include <uapi/linux/if_link.h> 13 #include <uapi/linux/if_macsec.h> 14 15 #define MACSEC_DEFAULT_PN_LEN 4 16 #define MACSEC_XPN_PN_LEN 8 17 18 #define MACSEC_NUM_AN 4 /* 2 bits for the association number */ 19 20 #define MACSEC_SCI_LEN 8 21 #define MACSEC_PORT_ES (htons(0x0001)) 22 23 #define MACSEC_TCI_VERSION 0x80 24 #define MACSEC_TCI_ES 0x40 /* end station */ 25 #define MACSEC_TCI_SC 0x20 /* SCI present */ 26 #define MACSEC_TCI_SCB 0x10 /* epon */ 27 #define MACSEC_TCI_E 0x08 /* encryption */ 28 #define MACSEC_TCI_C 0x04 /* changed text */ 29 #define MACSEC_AN_MASK 0x03 /* association number */ 30 #define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C) 31 32 #define MACSEC_DEFAULT_ICV_LEN 16 33 34 typedef u64 __bitwise sci_t; 35 typedef u32 __bitwise ssci_t; 36 37 struct metadata_dst; 38 39 typedef union salt { 40 struct { 41 u32 ssci; 42 u64 pn; 43 } __packed; 44 u8 bytes[MACSEC_SALT_LEN]; 45 } __packed salt_t; 46 47 typedef union pn { 48 struct { 49 #if defined(__LITTLE_ENDIAN_BITFIELD) 50 u32 lower; 51 u32 upper; 52 #elif defined(__BIG_ENDIAN_BITFIELD) 53 u32 upper; 54 u32 lower; 55 #else 56 #error "Please fix <asm/byteorder.h>" 57 #endif 58 }; 59 u64 full64; 60 } pn_t; 61 62 /** 63 * struct macsec_key - SA key 64 * @id: user-provided key identifier 65 * @tfm: crypto struct, key storage 66 * @salt: salt used to generate IV in XPN cipher suites 67 */ 68 struct macsec_key { 69 u8 id[MACSEC_KEYID_LEN]; 70 struct crypto_aead *tfm; 71 salt_t salt; 72 }; 73 74 struct macsec_rx_sc_stats { 75 __u64 InOctetsValidated; 76 __u64 InOctetsDecrypted; 77 __u64 InPktsUnchecked; 78 __u64 InPktsDelayed; 79 __u64 InPktsOK; 80 __u64 InPktsInvalid; 81 __u64 InPktsLate; 82 __u64 InPktsNotValid; 83 __u64 InPktsNotUsingSA; 84 __u64 InPktsUnusedSA; 85 }; 86 87 struct macsec_rx_sa_stats { 88 __u32 InPktsOK; 89 __u32 InPktsInvalid; 90 __u32 InPktsNotValid; 91 __u32 InPktsNotUsingSA; 92 __u32 InPktsUnusedSA; 93 }; 94 95 struct macsec_tx_sa_stats { 96 __u32 OutPktsProtected; 97 __u32 OutPktsEncrypted; 98 }; 99 100 struct macsec_tx_sc_stats { 101 __u64 OutPktsProtected; 102 __u64 OutPktsEncrypted; 103 __u64 OutOctetsProtected; 104 __u64 OutOctetsEncrypted; 105 }; 106 107 struct macsec_dev_stats { 108 __u64 OutPktsUntagged; 109 __u64 InPktsUntagged; 110 __u64 OutPktsTooLong; 111 __u64 InPktsNoTag; 112 __u64 InPktsBadTag; 113 __u64 InPktsUnknownSCI; 114 __u64 InPktsNoSCI; 115 __u64 InPktsOverrun; 116 }; 117 118 /** 119 * struct macsec_rx_sa - receive secure association 120 * @active: 121 * @next_pn: packet number expected for the next packet 122 * @lock: protects next_pn manipulations 123 * @key: key structure 124 * @ssci: short secure channel identifier 125 * @stats: per-SA stats 126 */ 127 struct macsec_rx_sa { 128 struct macsec_key key; 129 ssci_t ssci; 130 spinlock_t lock; 131 union { 132 pn_t next_pn_halves; 133 u64 next_pn; 134 }; 135 refcount_t refcnt; 136 bool active; 137 struct macsec_rx_sa_stats __percpu *stats; 138 struct macsec_rx_sc *sc; 139 struct rcu_head rcu; 140 }; 141 142 struct pcpu_rx_sc_stats { 143 struct macsec_rx_sc_stats stats; 144 struct u64_stats_sync syncp; 145 }; 146 147 struct pcpu_tx_sc_stats { 148 struct macsec_tx_sc_stats stats; 149 struct u64_stats_sync syncp; 150 }; 151 152 /** 153 * struct macsec_rx_sc - receive secure channel 154 * @sci: secure channel identifier for this SC 155 * @active: channel is active 156 * @sa: array of secure associations 157 * @stats: per-SC stats 158 */ 159 struct macsec_rx_sc { 160 struct macsec_rx_sc __rcu *next; 161 sci_t sci; 162 bool active; 163 struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN]; 164 struct pcpu_rx_sc_stats __percpu *stats; 165 refcount_t refcnt; 166 struct rcu_head rcu_head; 167 }; 168 169 /** 170 * struct macsec_tx_sa - transmit secure association 171 * @active: 172 * @next_pn: packet number to use for the next packet 173 * @lock: protects next_pn manipulations 174 * @key: key structure 175 * @ssci: short secure channel identifier 176 * @stats: per-SA stats 177 */ 178 struct macsec_tx_sa { 179 struct macsec_key key; 180 ssci_t ssci; 181 spinlock_t lock; 182 union { 183 pn_t next_pn_halves; 184 u64 next_pn; 185 }; 186 refcount_t refcnt; 187 bool active; 188 struct macsec_tx_sa_stats __percpu *stats; 189 struct rcu_head rcu; 190 }; 191 192 /** 193 * struct macsec_tx_sc - transmit secure channel 194 * @active: 195 * @encoding_sa: association number of the SA currently in use 196 * @encrypt: encrypt packets on transmit, or authenticate only 197 * @send_sci: always include the SCI in the SecTAG 198 * @end_station: 199 * @scb: single copy broadcast flag 200 * @sa: array of secure associations 201 * @stats: stats for this TXSC 202 * @md_dst: MACsec offload metadata dst 203 */ 204 struct macsec_tx_sc { 205 bool active; 206 u8 encoding_sa; 207 bool encrypt; 208 bool send_sci; 209 bool end_station; 210 bool scb; 211 struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN]; 212 struct pcpu_tx_sc_stats __percpu *stats; 213 struct metadata_dst *md_dst; 214 }; 215 216 /** 217 * struct macsec_secy - MACsec Security Entity 218 * @netdev: netdevice for this SecY 219 * @n_rx_sc: number of receive secure channels configured on this SecY 220 * @sci: secure channel identifier used for tx 221 * @key_len: length of keys used by the cipher suite 222 * @icv_len: length of ICV used by the cipher suite 223 * @validate_frames: validation mode 224 * @xpn: enable XPN for this SecY 225 * @operational: MAC_Operational flag 226 * @protect_frames: enable protection for this SecY 227 * @replay_protect: enable packet number checks on receive 228 * @replay_window: size of the replay window 229 * @tx_sc: transmit secure channel 230 * @rx_sc: linked list of receive secure channels 231 */ 232 struct macsec_secy { 233 struct net_device *netdev; 234 unsigned int n_rx_sc; 235 sci_t sci; 236 u16 key_len; 237 u16 icv_len; 238 enum macsec_validation_type validate_frames; 239 bool xpn; 240 bool operational; 241 bool protect_frames; 242 bool replay_protect; 243 u32 replay_window; 244 struct macsec_tx_sc tx_sc; 245 struct macsec_rx_sc __rcu *rx_sc; 246 }; 247 248 /** 249 * struct macsec_context - MACsec context for hardware offloading 250 * @netdev: a valid pointer to a struct net_device if @offload == 251 * MACSEC_OFFLOAD_MAC 252 * @phydev: a valid pointer to a struct phy_device if @offload == 253 * MACSEC_OFFLOAD_PHY 254 * @offload: MACsec offload status 255 * @secy: pointer to a MACsec SecY 256 * @rx_sc: pointer to a RX SC 257 * @update_pn: when updating the SA, update the next PN 258 * @assoc_num: association number of the target SA 259 * @key: key of the target SA 260 * @rx_sa: pointer to an RX SA if a RX SA is added/updated/removed 261 * @tx_sa: pointer to an TX SA if a TX SA is added/updated/removed 262 * @tx_sc_stats: pointer to TX SC stats structure 263 * @tx_sa_stats: pointer to TX SA stats structure 264 * @rx_sc_stats: pointer to RX SC stats structure 265 * @rx_sa_stats: pointer to RX SA stats structure 266 * @dev_stats: pointer to dev stats structure 267 */ 268 struct macsec_context { 269 union { 270 struct net_device *netdev; 271 struct phy_device *phydev; 272 }; 273 enum macsec_offload offload; 274 275 struct macsec_secy *secy; 276 struct macsec_rx_sc *rx_sc; 277 struct { 278 bool update_pn; 279 unsigned char assoc_num; 280 u8 key[MACSEC_MAX_KEY_LEN]; 281 union { 282 struct macsec_rx_sa *rx_sa; 283 struct macsec_tx_sa *tx_sa; 284 }; 285 } sa; 286 union { 287 struct macsec_tx_sc_stats *tx_sc_stats; 288 struct macsec_tx_sa_stats *tx_sa_stats; 289 struct macsec_rx_sc_stats *rx_sc_stats; 290 struct macsec_rx_sa_stats *rx_sa_stats; 291 struct macsec_dev_stats *dev_stats; 292 } stats; 293 }; 294 295 /** 296 * struct macsec_ops - MACsec offloading operations 297 * @mdo_dev_open: called when the MACsec interface transitions to the up state 298 * @mdo_dev_stop: called when the MACsec interface transitions to the down 299 * state 300 * @mdo_add_secy: called when a new SecY is added 301 * @mdo_upd_secy: called when the SecY flags are changed or the MAC address of 302 * the MACsec interface is changed 303 * @mdo_del_secy: called when the hw offload is disabled or the MACsec 304 * interface is removed 305 * @mdo_add_rxsc: called when a new RX SC is added 306 * @mdo_upd_rxsc: called when a certain RX SC is updated 307 * @mdo_del_rxsc: called when a certain RX SC is removed 308 * @mdo_add_rxsa: called when a new RX SA is added 309 * @mdo_upd_rxsa: called when a certain RX SA is updated 310 * @mdo_del_rxsa: called when a certain RX SA is removed 311 * @mdo_add_txsa: called when a new TX SA is added 312 * @mdo_upd_txsa: called when a certain TX SA is updated 313 * @mdo_del_txsa: called when a certain TX SA is removed 314 * @mdo_get_dev_stats: called when dev stats are read 315 * @mdo_get_tx_sc_stats: called when TX SC stats are read 316 * @mdo_get_tx_sa_stats: called when TX SA stats are read 317 * @mdo_get_rx_sc_stats: called when RX SC stats are read 318 * @mdo_get_rx_sa_stats: called when RX SA stats are read 319 * @mdo_insert_tx_tag: called to insert the TX tag 320 * @needed_headroom: number of bytes reserved at the beginning of the sk_buff 321 * for the TX tag 322 * @needed_tailroom: number of bytes reserved at the end of the sk_buff for the 323 * TX tag 324 * @rx_uses_md_dst: whether MACsec device offload supports sk_buff md_dst 325 */ 326 struct macsec_ops { 327 /* Device wide */ 328 int (*mdo_dev_open)(struct macsec_context *ctx); 329 int (*mdo_dev_stop)(struct macsec_context *ctx); 330 /* SecY */ 331 int (*mdo_add_secy)(struct macsec_context *ctx); 332 int (*mdo_upd_secy)(struct macsec_context *ctx); 333 int (*mdo_del_secy)(struct macsec_context *ctx); 334 /* Security channels */ 335 int (*mdo_add_rxsc)(struct macsec_context *ctx); 336 int (*mdo_upd_rxsc)(struct macsec_context *ctx); 337 int (*mdo_del_rxsc)(struct macsec_context *ctx); 338 /* Security associations */ 339 int (*mdo_add_rxsa)(struct macsec_context *ctx); 340 int (*mdo_upd_rxsa)(struct macsec_context *ctx); 341 int (*mdo_del_rxsa)(struct macsec_context *ctx); 342 int (*mdo_add_txsa)(struct macsec_context *ctx); 343 int (*mdo_upd_txsa)(struct macsec_context *ctx); 344 int (*mdo_del_txsa)(struct macsec_context *ctx); 345 /* Statistics */ 346 int (*mdo_get_dev_stats)(struct macsec_context *ctx); 347 int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx); 348 int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx); 349 int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx); 350 int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx); 351 /* Offload tag */ 352 int (*mdo_insert_tx_tag)(struct phy_device *phydev, 353 struct sk_buff *skb); 354 unsigned int needed_headroom; 355 unsigned int needed_tailroom; 356 bool rx_uses_md_dst; 357 }; 358 359 void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa); macsec_send_sci(const struct macsec_secy * secy)360 static inline bool macsec_send_sci(const struct macsec_secy *secy) 361 { 362 const struct macsec_tx_sc *tx_sc = &secy->tx_sc; 363 364 return tx_sc->send_sci || 365 (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb); 366 } 367 struct net_device *macsec_get_real_dev(const struct net_device *dev); 368 bool macsec_netdev_is_offloaded(struct net_device *dev); 369 macsec_netdev_priv(const struct net_device * dev)370 static inline void *macsec_netdev_priv(const struct net_device *dev) 371 { 372 #if IS_ENABLED(CONFIG_VLAN_8021Q) 373 if (is_vlan_dev(dev)) 374 return netdev_priv(vlan_dev_priv(dev)->real_dev); 375 #endif 376 return netdev_priv(dev); 377 } 378 sci_to_cpu(sci_t sci)379 static inline u64 sci_to_cpu(sci_t sci) 380 { 381 return be64_to_cpu((__force __be64)sci); 382 } 383 384 #endif /* _NET_MACSEC_H_ */ 385