Gitiles
Code Review Sign In
review.shift-gmbh.com / SHIFTPHONES / kernel / common / c0e4eadfb8daf2e9557c7450f9b237c08b404419 / . / include / net / macsec.h
blob: e7b41c1043f6f42586be4c0f8a4298cdc0a81b4f [file] [log] [blame]
Antoine Tenartc0e4ead2020-01-13 23:31:39 +0100[diff] [blame^]1/* SPDX-License-Identifier: GPL-2.0+ */
2/*
3 * MACsec netdev header, used for h/w accelerated implementations.
4 *
5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
6 */
7#ifndef _NET_MACSEC_H_
8#define _NET_MACSEC_H_
9
10#include <linux/u64_stats_sync.h>
11#include <uapi/linux/if_link.h>
12#include <uapi/linux/if_macsec.h>
13
14typedef u64 __bitwise sci_t;
15
16#define MACSEC_NUM_AN 4 /* 2 bits for the association number */
17
18/**
19 * struct macsec_key - SA key
20 * @id: user-provided key identifier
21 * @tfm: crypto struct, key storage
22 */
23struct macsec_key {
24 u8 id[MACSEC_KEYID_LEN];
25 struct crypto_aead *tfm;
26};
27
28struct macsec_rx_sc_stats {
29 __u64 InOctetsValidated;
30 __u64 InOctetsDecrypted;
31 __u64 InPktsUnchecked;
32 __u64 InPktsDelayed;
33 __u64 InPktsOK;
34 __u64 InPktsInvalid;
35 __u64 InPktsLate;
36 __u64 InPktsNotValid;
37 __u64 InPktsNotUsingSA;
38 __u64 InPktsUnusedSA;
39};
40
41struct macsec_rx_sa_stats {
42 __u32 InPktsOK;
43 __u32 InPktsInvalid;
44 __u32 InPktsNotValid;
45 __u32 InPktsNotUsingSA;
46 __u32 InPktsUnusedSA;
47};
48
49struct macsec_tx_sa_stats {
50 __u32 OutPktsProtected;
51 __u32 OutPktsEncrypted;
52};
53
54struct macsec_tx_sc_stats {
55 __u64 OutPktsProtected;
56 __u64 OutPktsEncrypted;
57 __u64 OutOctetsProtected;
58 __u64 OutOctetsEncrypted;
59};
60
61/**
62 * struct macsec_rx_sa - receive secure association
63 * @active:
64 * @next_pn: packet number expected for the next packet
65 * @lock: protects next_pn manipulations
66 * @key: key structure
67 * @stats: per-SA stats
68 */
69struct macsec_rx_sa {
70 struct macsec_key key;
71 spinlock_t lock;
72 u32 next_pn;
73 refcount_t refcnt;
74 bool active;
75 struct macsec_rx_sa_stats __percpu *stats;
76 struct macsec_rx_sc *sc;
77 struct rcu_head rcu;
78};
79
80struct pcpu_rx_sc_stats {
81 struct macsec_rx_sc_stats stats;
82 struct u64_stats_sync syncp;
83};
84
85struct pcpu_tx_sc_stats {
86 struct macsec_tx_sc_stats stats;
87 struct u64_stats_sync syncp;
88};
89
90/**
91 * struct macsec_rx_sc - receive secure channel
92 * @sci: secure channel identifier for this SC
93 * @active: channel is active
94 * @sa: array of secure associations
95 * @stats: per-SC stats
96 */
97struct macsec_rx_sc {
98 struct macsec_rx_sc __rcu *next;
99 sci_t sci;
100 bool active;
101 struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN];
102 struct pcpu_rx_sc_stats __percpu *stats;
103 refcount_t refcnt;
104 struct rcu_head rcu_head;
105};
106
107/**
108 * struct macsec_tx_sa - transmit secure association
109 * @active:
110 * @next_pn: packet number to use for the next packet
111 * @lock: protects next_pn manipulations
112 * @key: key structure
113 * @stats: per-SA stats
114 */
115struct macsec_tx_sa {
116 struct macsec_key key;
117 spinlock_t lock;
118 u32 next_pn;
119 refcount_t refcnt;
120 bool active;
121 struct macsec_tx_sa_stats __percpu *stats;
122 struct rcu_head rcu;
123};
124
125/**
126 * struct macsec_tx_sc - transmit secure channel
127 * @active:
128 * @encoding_sa: association number of the SA currently in use
129 * @encrypt: encrypt packets on transmit, or authenticate only
130 * @send_sci: always include the SCI in the SecTAG
131 * @end_station:
132 * @scb: single copy broadcast flag
133 * @sa: array of secure associations
134 * @stats: stats for this TXSC
135 */
136struct macsec_tx_sc {
137 bool active;
138 u8 encoding_sa;
139 bool encrypt;
140 bool send_sci;
141 bool end_station;
142 bool scb;
143 struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN];
144 struct pcpu_tx_sc_stats __percpu *stats;
145};
146
147/**
148 * struct macsec_secy - MACsec Security Entity
149 * @netdev: netdevice for this SecY
150 * @n_rx_sc: number of receive secure channels configured on this SecY
151 * @sci: secure channel identifier used for tx
152 * @key_len: length of keys used by the cipher suite
153 * @icv_len: length of ICV used by the cipher suite
154 * @validate_frames: validation mode
155 * @operational: MAC_Operational flag
156 * @protect_frames: enable protection for this SecY
157 * @replay_protect: enable packet number checks on receive
158 * @replay_window: size of the replay window
159 * @tx_sc: transmit secure channel
160 * @rx_sc: linked list of receive secure channels
161 */
162struct macsec_secy {
163 struct net_device *netdev;
164 unsigned int n_rx_sc;
165 sci_t sci;
166 u16 key_len;
167 u16 icv_len;
168 enum macsec_validation_type validate_frames;
169 bool operational;
170 bool protect_frames;
171 bool replay_protect;
172 u32 replay_window;
173 struct macsec_tx_sc tx_sc;
174 struct macsec_rx_sc __rcu *rx_sc;
175};
176
177#endif /* _NET_MACSEC_H_ */