[mirror_ubuntu-jammy-kernel.git] / include / net / macsec.h

/* SPDX-License-Identifier: GPL-2.0+ */
/*
 * MACsec netdev header, used for h/w accelerated implementations.
 *
 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
 */
#ifndef _NET_MACSEC_H_
#define _NET_MACSEC_H_

#include <linux/u64_stats_sync.h>
#include <uapi/linux/if_link.h>
#include <uapi/linux/if_macsec.h>

#define MACSEC_DEFAULT_PN_LEN 4
#define MACSEC_XPN_PN_LEN 8

#define MACSEC_SALT_LEN 12
#define MACSEC_NUM_AN 4 /* 2 bits for the association number */

typedef u64 __bitwise sci_t;
typedef u32 __bitwise ssci_t;

typedef union salt {
	struct {
		u32 ssci;
		u64 pn;
	} __packed;
	u8 bytes[MACSEC_SALT_LEN];
} __packed salt_t;

typedef union pn {
	struct {
#if defined(__LITTLE_ENDIAN_BITFIELD)
		u32 lower;
		u32 upper;
#elif defined(__BIG_ENDIAN_BITFIELD)
		u32 upper;
		u32 lower;
#else
#error	"Please fix <asm/byteorder.h>"
#endif
	};
	u64 full64;
} pn_t;

/**
 * struct macsec_key - SA key
 * @id: user-provided key identifier
 * @tfm: crypto struct, key storage
 * @salt: salt used to generate IV in XPN cipher suites
 */
struct macsec_key {
	u8 id[MACSEC_KEYID_LEN];
	struct crypto_aead *tfm;
	salt_t salt;
};

struct macsec_rx_sc_stats {
	__u64 InOctetsValidated;
	__u64 InOctetsDecrypted;
	__u64 InPktsUnchecked;
	__u64 InPktsDelayed;
	__u64 InPktsOK;
	__u64 InPktsInvalid;
	__u64 InPktsLate;
	__u64 InPktsNotValid;
	__u64 InPktsNotUsingSA;
	__u64 InPktsUnusedSA;
};

struct macsec_rx_sa_stats {
	__u32 InPktsOK;
	__u32 InPktsInvalid;
	__u32 InPktsNotValid;
	__u32 InPktsNotUsingSA;
	__u32 InPktsUnusedSA;
};

struct macsec_tx_sa_stats {
	__u32 OutPktsProtected;
	__u32 OutPktsEncrypted;
};

struct macsec_tx_sc_stats {
	__u64 OutPktsProtected;
	__u64 OutPktsEncrypted;
	__u64 OutOctetsProtected;
	__u64 OutOctetsEncrypted;
};

struct macsec_dev_stats {
	__u64 OutPktsUntagged;
	__u64 InPktsUntagged;
	__u64 OutPktsTooLong;
	__u64 InPktsNoTag;
	__u64 InPktsBadTag;
	__u64 InPktsUnknownSCI;
	__u64 InPktsNoSCI;
	__u64 InPktsOverrun;
};

/**
 * struct macsec_rx_sa - receive secure association
 * @active:
 * @next_pn: packet number expected for the next packet
 * @lock: protects next_pn manipulations
 * @key: key structure
 * @ssci: short secure channel identifier
 * @stats: per-SA stats
 */
struct macsec_rx_sa {
	struct macsec_key key;
	ssci_t ssci;
	spinlock_t lock;
	union {
		pn_t next_pn_halves;
		u64 next_pn;
	};
	refcount_t refcnt;
	bool active;
	struct macsec_rx_sa_stats __percpu *stats;
	struct macsec_rx_sc *sc;
	struct rcu_head rcu;
};

struct pcpu_rx_sc_stats {
	struct macsec_rx_sc_stats stats;
	struct u64_stats_sync syncp;
};

struct pcpu_tx_sc_stats {
	struct macsec_tx_sc_stats stats;
	struct u64_stats_sync syncp;
};

/**
 * struct macsec_rx_sc - receive secure channel
 * @sci: secure channel identifier for this SC
 * @active: channel is active
 * @sa: array of secure associations
 * @stats: per-SC stats
 */
struct macsec_rx_sc {
	struct macsec_rx_sc __rcu *next;
	sci_t sci;
	bool active;
	struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN];
	struct pcpu_rx_sc_stats __percpu *stats;
	refcount_t refcnt;
	struct rcu_head rcu_head;
};

/**
 * struct macsec_tx_sa - transmit secure association
 * @active:
 * @next_pn: packet number to use for the next packet
 * @lock: protects next_pn manipulations
 * @key: key structure
 * @ssci: short secure channel identifier
 * @stats: per-SA stats
 */
struct macsec_tx_sa {
	struct macsec_key key;
	ssci_t ssci;
	spinlock_t lock;
	union {
		pn_t next_pn_halves;
		u64 next_pn;
	};
	refcount_t refcnt;
	bool active;
	struct macsec_tx_sa_stats __percpu *stats;
	struct rcu_head rcu;
};

/**
 * struct macsec_tx_sc - transmit secure channel
 * @active:
 * @encoding_sa: association number of the SA currently in use
 * @encrypt: encrypt packets on transmit, or authenticate only
 * @send_sci: always include the SCI in the SecTAG
 * @end_station:
 * @scb: single copy broadcast flag
 * @sa: array of secure associations
 * @stats: stats for this TXSC
 */
struct macsec_tx_sc {
	bool active;
	u8 encoding_sa;
	bool encrypt;
	bool send_sci;
	bool end_station;
	bool scb;
	struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN];
	struct pcpu_tx_sc_stats __percpu *stats;
};

/**
 * struct macsec_secy - MACsec Security Entity
 * @netdev: netdevice for this SecY
 * @n_rx_sc: number of receive secure channels configured on this SecY
 * @sci: secure channel identifier used for tx
 * @key_len: length of keys used by the cipher suite
 * @icv_len: length of ICV used by the cipher suite
 * @validate_frames: validation mode
 * @xpn: enable XPN for this SecY
 * @operational: MAC_Operational flag
 * @protect_frames: enable protection for this SecY
 * @replay_protect: enable packet number checks on receive
 * @replay_window: size of the replay window
 * @tx_sc: transmit secure channel
 * @rx_sc: linked list of receive secure channels
 */
struct macsec_secy {
	struct net_device *netdev;
	unsigned int n_rx_sc;
	sci_t sci;
	u16 key_len;
	u16 icv_len;
	enum macsec_validation_type validate_frames;
	bool xpn;
	bool operational;
	bool protect_frames;
	bool replay_protect;
	u32 replay_window;
	struct macsec_tx_sc tx_sc;
	struct macsec_rx_sc __rcu *rx_sc;
};

/**
 * struct macsec_context - MACsec context for hardware offloading
 */
struct macsec_context {
	union {
		struct net_device *netdev;
		struct phy_device *phydev;
	};
	enum macsec_offload offload;

	struct macsec_secy *secy;
	struct macsec_rx_sc *rx_sc;
	struct {
		unsigned char assoc_num;
		u8 key[MACSEC_MAX_KEY_LEN];
		union {
			struct macsec_rx_sa *rx_sa;
			struct macsec_tx_sa *tx_sa;
		};
	} sa;
	union {
		struct macsec_tx_sc_stats *tx_sc_stats;
		struct macsec_tx_sa_stats *tx_sa_stats;
		struct macsec_rx_sc_stats *rx_sc_stats;
		struct macsec_rx_sa_stats *rx_sa_stats;
		struct macsec_dev_stats  *dev_stats;
	} stats;

	u8 prepare:1;
};

/**
 * struct macsec_ops - MACsec offloading operations
 */
struct macsec_ops {
	/* Device wide */
	int (*mdo_dev_open)(struct macsec_context *ctx);
	int (*mdo_dev_stop)(struct macsec_context *ctx);
	/* SecY */
	int (*mdo_add_secy)(struct macsec_context *ctx);
	int (*mdo_upd_secy)(struct macsec_context *ctx);
	int (*mdo_del_secy)(struct macsec_context *ctx);
	/* Security channels */
	int (*mdo_add_rxsc)(struct macsec_context *ctx);
	int (*mdo_upd_rxsc)(struct macsec_context *ctx);
	int (*mdo_del_rxsc)(struct macsec_context *ctx);
	/* Security associations */
	int (*mdo_add_rxsa)(struct macsec_context *ctx);
	int (*mdo_upd_rxsa)(struct macsec_context *ctx);
	int (*mdo_del_rxsa)(struct macsec_context *ctx);
	int (*mdo_add_txsa)(struct macsec_context *ctx);
	int (*mdo_upd_txsa)(struct macsec_context *ctx);
	int (*mdo_del_txsa)(struct macsec_context *ctx);
	/* Statistics */
	int (*mdo_get_dev_stats)(struct macsec_context *ctx);
	int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx);
	int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx);
	int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx);
	int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx);
};

void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa);

#endif /* _NET_MACSEC_H_ */
Commit	Line	Data
c0e4eadf AT	1	/* SPDX-License-Identifier: GPL-2.0+ */
	2	/*
	3	* MACsec netdev header, used for h/w accelerated implementations.
	4	*
	5	* Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
	6	*/
	7	#ifndef _NET_MACSEC_H_
	8	#define _NET_MACSEC_H_
	9
	10	#include <linux/u64_stats_sync.h>
	11	#include <uapi/linux/if_link.h>
	12	#include <uapi/linux/if_macsec.h>
	13
48ef50fa EM	14	#define MACSEC_DEFAULT_PN_LEN 4
	15	#define MACSEC_XPN_PN_LEN 8
	16
a21ecf0e EM	17	#define MACSEC_SALT_LEN 12
	18	#define MACSEC_NUM_AN 4 /* 2 bits for the association number */
	19
c0e4eadf	20	typedef u64 __bitwise sci_t;
a21ecf0e	21	typedef u32 __bitwise ssci_t;
c0e4eadf	22
a21ecf0e EM	23	typedef union salt {
	24	struct {
	25	u32 ssci;
	26	u64 pn;
	27	} __packed;
	28	u8 bytes[MACSEC_SALT_LEN];
	29	} __packed salt_t;
	30
	31	typedef union pn {
	32	struct {
	33	#if defined(__LITTLE_ENDIAN_BITFIELD)
	34	u32 lower;
	35	u32 upper;
	36	#elif defined(__BIG_ENDIAN_BITFIELD)
	37	u32 upper;
	38	u32 lower;
	39	#else
	40	#error "Please fix <asm/byteorder.h>"
	41	#endif
	42	};
	43	u64 full64;
	44	} pn_t;
c0e4eadf AT	45
	46	/**
	47	* struct macsec_key - SA key
	48	* @id: user-provided key identifier
	49	* @tfm: crypto struct, key storage
a21ecf0e	50	* @salt: salt used to generate IV in XPN cipher suites
c0e4eadf AT	51	*/
	52	struct macsec_key {
	53	u8 id[MACSEC_KEYID_LEN];
	54	struct crypto_aead *tfm;
a21ecf0e	55	salt_t salt;
c0e4eadf AT	56	};
	57
	58	struct macsec_rx_sc_stats {
	59	__u64 InOctetsValidated;
	60	__u64 InOctetsDecrypted;
	61	__u64 InPktsUnchecked;
	62	__u64 InPktsDelayed;
	63	__u64 InPktsOK;
	64	__u64 InPktsInvalid;
	65	__u64 InPktsLate;
	66	__u64 InPktsNotValid;
	67	__u64 InPktsNotUsingSA;
	68	__u64 InPktsUnusedSA;
	69	};
	70
	71	struct macsec_rx_sa_stats {
	72	__u32 InPktsOK;
	73	__u32 InPktsInvalid;
	74	__u32 InPktsNotValid;
	75	__u32 InPktsNotUsingSA;
	76	__u32 InPktsUnusedSA;
	77	};
	78
	79	struct macsec_tx_sa_stats {
	80	__u32 OutPktsProtected;
	81	__u32 OutPktsEncrypted;
	82	};
	83
	84	struct macsec_tx_sc_stats {
	85	__u64 OutPktsProtected;
	86	__u64 OutPktsEncrypted;
	87	__u64 OutOctetsProtected;
	88	__u64 OutOctetsEncrypted;
	89	};
	90
b62c3624 DB	91	struct macsec_dev_stats {
	92	__u64 OutPktsUntagged;
	93	__u64 InPktsUntagged;
	94	__u64 OutPktsTooLong;
	95	__u64 InPktsNoTag;
	96	__u64 InPktsBadTag;
	97	__u64 InPktsUnknownSCI;
	98	__u64 InPktsNoSCI;
	99	__u64 InPktsOverrun;
	100	};
	101
c0e4eadf AT	102	/**
	103	* struct macsec_rx_sa - receive secure association
	104	* @active:
	105	* @next_pn: packet number expected for the next packet
	106	* @lock: protects next_pn manipulations
	107	* @key: key structure
a21ecf0e	108	* @ssci: short secure channel identifier
c0e4eadf AT	109	* @stats: per-SA stats
	110	*/
	111	struct macsec_rx_sa {
	112	struct macsec_key key;
a21ecf0e	113	ssci_t ssci;
c0e4eadf	114	spinlock_t lock;
a21ecf0e EM	115	union {
	116	pn_t next_pn_halves;
	117	u64 next_pn;
	118	};
c0e4eadf AT	119	refcount_t refcnt;
	120	bool active;
	121	struct macsec_rx_sa_stats __percpu *stats;
	122	struct macsec_rx_sc *sc;
	123	struct rcu_head rcu;
	124	};
	125
	126	struct pcpu_rx_sc_stats {
	127	struct macsec_rx_sc_stats stats;
	128	struct u64_stats_sync syncp;
	129	};
	130
	131	struct pcpu_tx_sc_stats {
	132	struct macsec_tx_sc_stats stats;
	133	struct u64_stats_sync syncp;
	134	};
	135
	136	/**
	137	* struct macsec_rx_sc - receive secure channel
	138	* @sci: secure channel identifier for this SC
	139	* @active: channel is active
	140	* @sa: array of secure associations
	141	* @stats: per-SC stats
	142	*/
	143	struct macsec_rx_sc {
	144	struct macsec_rx_sc __rcu *next;
	145	sci_t sci;
	146	bool active;
	147	struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN];
	148	struct pcpu_rx_sc_stats __percpu *stats;
	149	refcount_t refcnt;
	150	struct rcu_head rcu_head;
	151	};
	152
	153	/**
	154	* struct macsec_tx_sa - transmit secure association
	155	* @active:
	156	* @next_pn: packet number to use for the next packet
	157	* @lock: protects next_pn manipulations
	158	* @key: key structure
a21ecf0e	159	* @ssci: short secure channel identifier
c0e4eadf AT	160	* @stats: per-SA stats
	161	*/
	162	struct macsec_tx_sa {
	163	struct macsec_key key;
a21ecf0e	164	ssci_t ssci;
c0e4eadf	165	spinlock_t lock;
a21ecf0e EM	166	union {
	167	pn_t next_pn_halves;
	168	u64 next_pn;
	169	};
c0e4eadf AT	170	refcount_t refcnt;
	171	bool active;
	172	struct macsec_tx_sa_stats __percpu *stats;
	173	struct rcu_head rcu;
	174	};
	175
	176	/**
	177	* struct macsec_tx_sc - transmit secure channel
	178	* @active:
	179	* @encoding_sa: association number of the SA currently in use
	180	* @encrypt: encrypt packets on transmit, or authenticate only
	181	* @send_sci: always include the SCI in the SecTAG
	182	* @end_station:
	183	* @scb: single copy broadcast flag
	184	* @sa: array of secure associations
	185	* @stats: stats for this TXSC
	186	*/
	187	struct macsec_tx_sc {
	188	bool active;
	189	u8 encoding_sa;
	190	bool encrypt;
	191	bool send_sci;
	192	bool end_station;
	193	bool scb;
	194	struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN];
	195	struct pcpu_tx_sc_stats __percpu *stats;
	196	};
	197
	198	/**
	199	* struct macsec_secy - MACsec Security Entity
	200	* @netdev: netdevice for this SecY
	201	* @n_rx_sc: number of receive secure channels configured on this SecY
	202	* @sci: secure channel identifier used for tx
	203	* @key_len: length of keys used by the cipher suite
	204	* @icv_len: length of ICV used by the cipher suite
	205	* @validate_frames: validation mode
a21ecf0e	206	* @xpn: enable XPN for this SecY
c0e4eadf AT	207	* @operational: MAC_Operational flag
	208	* @protect_frames: enable protection for this SecY
	209	* @replay_protect: enable packet number checks on receive
	210	* @replay_window: size of the replay window
	211	* @tx_sc: transmit secure channel
	212	* @rx_sc: linked list of receive secure channels
	213	*/
	214	struct macsec_secy {
	215	struct net_device *netdev;
	216	unsigned int n_rx_sc;
	217	sci_t sci;
	218	u16 key_len;
	219	u16 icv_len;
	220	enum macsec_validation_type validate_frames;
a21ecf0e	221	bool xpn;
c0e4eadf AT	222	bool operational;
	223	bool protect_frames;
	224	bool replay_protect;
	225	u32 replay_window;
	226	struct macsec_tx_sc tx_sc;
	227	struct macsec_rx_sc __rcu *rx_sc;
	228	};
	229
76564261 AT	230	/**
	231	* struct macsec_context - MACsec context for hardware offloading
	232	*/
	233	struct macsec_context {
8fa91371 AT	234	union {
	235	struct net_device *netdev;
	236	struct phy_device *phydev;
	237	};
76564261 AT	238	enum macsec_offload offload;
	239
	240	struct macsec_secy *secy;
	241	struct macsec_rx_sc *rx_sc;
	242	struct {
	243	unsigned char assoc_num;
1f7fe512	244	u8 key[MACSEC_MAX_KEY_LEN];
76564261 AT	245	union {
	246	struct macsec_rx_sa *rx_sa;
	247	struct macsec_tx_sa *tx_sa;
	248	};
	249	} sa;
b62c3624 DB	250	union {
	251	struct macsec_tx_sc_stats *tx_sc_stats;
	252	struct macsec_tx_sa_stats *tx_sa_stats;
	253	struct macsec_rx_sc_stats *rx_sc_stats;
	254	struct macsec_rx_sa_stats *rx_sa_stats;
	255	struct macsec_dev_stats *dev_stats;
	256	} stats;
76564261 AT	257
	258	u8 prepare:1;
	259	};
	260
0830e20b AT	261	/**
	262	* struct macsec_ops - MACsec offloading operations
	263	*/
	264	struct macsec_ops {
	265	/* Device wide */
	266	int (mdo_dev_open)(struct macsec_context ctx);
	267	int (mdo_dev_stop)(struct macsec_context ctx);
	268	/* SecY */
	269	int (mdo_add_secy)(struct macsec_context ctx);
	270	int (mdo_upd_secy)(struct macsec_context ctx);
	271	int (mdo_del_secy)(struct macsec_context ctx);
	272	/* Security channels */
	273	int (mdo_add_rxsc)(struct macsec_context ctx);
	274	int (mdo_upd_rxsc)(struct macsec_context ctx);
	275	int (mdo_del_rxsc)(struct macsec_context ctx);
	276	/* Security associations */
	277	int (mdo_add_rxsa)(struct macsec_context ctx);
	278	int (mdo_upd_rxsa)(struct macsec_context ctx);
	279	int (mdo_del_rxsa)(struct macsec_context ctx);
	280	int (mdo_add_txsa)(struct macsec_context ctx);
	281	int (mdo_upd_txsa)(struct macsec_context ctx);
	282	int (mdo_del_txsa)(struct macsec_context ctx);
b62c3624 DB	283	/* Statistics */
	284	int (mdo_get_dev_stats)(struct macsec_context ctx);
	285	int (mdo_get_tx_sc_stats)(struct macsec_context ctx);
	286	int (mdo_get_tx_sa_stats)(struct macsec_context ctx);
	287	int (mdo_get_rx_sc_stats)(struct macsec_context ctx);
	288	int (mdo_get_rx_sa_stats)(struct macsec_context ctx);
0830e20b AT	289	};
0830e20b AT	290
5c937de7 AT	291	void macsec_pn_wrapped(struct macsec_secy secy, struct macsec_tx_sa tx_sa);
5c937de7 AT	292
c0e4eadf	293	#endif /* _NET_MACSEC_H_ */