original files of m241
This commit is contained in:
neelimap
@@ -0,0 +1,181 @@
|
||||
/* 02comp_ipnet_macsec.cdf - IPNet MACsec configuration file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2010 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute or otherwise make use of this software
|
||||
* may be licensed only pursuant to the terms of an applicable Wind River
|
||||
* license agreement. No license to Wind River intellectual property rights
|
||||
* is granted herein. All rights not licensed by Wind River are reserved
|
||||
* by Wind River.
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
01a,09feb10,mry created.
|
||||
*/
|
||||
|
||||
#ifdef _WRS_CONFIG_COMPONENT_IPMACSEC
|
||||
Folder FOLDER_IPMACSEC {
|
||||
NAME MAC Security (MACsec) Components
|
||||
SYNOPSIS MACsec folder.
|
||||
_CHILDREN FOLDER_NET_L2_LINK
|
||||
}
|
||||
|
||||
/*---------------------------------------------------------------------------*/
|
||||
Component INCLUDE_IPMACSEC {
|
||||
NAME MAC Security (MACsec) support
|
||||
SYNOPSIS Include MAC Security (MACsec) support.
|
||||
CONFIGLETTES ipmacsec_config.c
|
||||
MODULES ipmacsec.o
|
||||
LINK_SYMS ipmacsec_secy_init
|
||||
REQUIRES INCLUDE_IPNET \
|
||||
INCLUDE_IPCOM_USE_ETHERNET \
|
||||
INCLUDE_IPCRYPTO \
|
||||
INCLUDE_IPNET_USE_NETLINKSOCK
|
||||
_CHILDREN FOLDER_IPMACSEC
|
||||
CFG_PARAMS IPMACSEC_SECY_ENABLE \
|
||||
IPMACSEC_SECY_INTERFACES \
|
||||
IPMACSEC_SECY_PROTECTFRAMES \
|
||||
IPMACSEC_SECY_ALWAYSINCSCI \
|
||||
IPMACSEC_SECY_USE_ES \
|
||||
IPMACSEC_SECY_USE_SCB \
|
||||
IPMACSEC_SECY_CONFIDENTIALITY \
|
||||
IPMACSEC_SECY_CONFIDENTIALITY_OFFSET \
|
||||
IPMACSEC_SECY_VALIDATEFRAMES \
|
||||
IPMACSEC_SECY_REPLAYPROTECT \
|
||||
IPMACSEC_SECY_REPLAYWINDOW \
|
||||
IPMACSEC_GCMAES_ACCEL_LEVEL \
|
||||
IPMACSEC_LOG_LEVEL
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_SECY_ENABLE {
|
||||
NAME Enable MAC Security Entity (SecY)
|
||||
SYNOPSIS Enable(1)/Disable(0) MACsec functionality on specified interfaces.
|
||||
TYPE char *
|
||||
DEFAULT "0"
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_SECY_INTERFACES {
|
||||
NAME SecY Interface(s)
|
||||
SYNOPSIS Specifies the interface(s) on which SecY will \
|
||||
be enabled (if IPMACSEC_ENABLE != 0). \
|
||||
Use "all" to enable MACsec on all Ethernet interfaces, \
|
||||
or specify a comma seperated list of interfaces. \
|
||||
e.g.: "fei1,eth1,eth2"
|
||||
TYPE char *
|
||||
DEFAULT ""
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_SECY_PROTECTFRAMES {
|
||||
NAME SecY "protectFrames"
|
||||
SYNOPSIS Specifies the default value for the SecY "protectFrames" control \
|
||||
Valid values: "0" for False, "1" for True.
|
||||
TYPE char *
|
||||
DEFAULT "1"
|
||||
}
|
||||
Parameter IPMACSEC_SECY_ALWAYSINCSCI {
|
||||
NAME SecY "alwayIncludeSCI"
|
||||
SYNOPSIS Specifies the default value for the SecY "alwayIncludeSCI" control \
|
||||
Valid values: "0" for False, "1" for True.
|
||||
TYPE char *
|
||||
DEFAULT "0"
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_SECY_USE_ES {
|
||||
NAME SecY "useES"
|
||||
SYNOPSIS Specifies the default value for the SecY "useES" control \
|
||||
Valid values: "0" for False, "1" for True.
|
||||
TYPE char *
|
||||
DEFAULT "0"
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_SECY_USE_SCB {
|
||||
NAME SecY "useSCB"
|
||||
SYNOPSIS Specifies the default value for the SecY "useSCB" control \
|
||||
Valid values: "0" for False, "1" for True.
|
||||
TYPE char *
|
||||
DEFAULT "0"
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_SECY_VALIDATEFRAMES {
|
||||
NAME SecY "validateFrames"
|
||||
SYNOPSIS Specifies the default value for the SecY "validateFrames" control \
|
||||
Valid values: "Disabled", "Check", "Strict".
|
||||
TYPE char *
|
||||
DEFAULT "Strict"
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_SECY_REPLAYPROTECT {
|
||||
NAME SecY "replayProtect"
|
||||
SYNOPSIS Specifies the default value for the SecY "replayProtect" control \
|
||||
Valid values: "0" for False, "1" for True.
|
||||
TYPE char *
|
||||
DEFAULT "1"
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_SECY_REPLAYWINDOW {
|
||||
NAME SecY "replayWindow"
|
||||
SYNOPSIS Specifies the default value for the SecY "replayWindow" control\
|
||||
Valid values: A string contaning an integer value \
|
||||
between 0 and 2^32-1 (inclusive).
|
||||
TYPE char *
|
||||
DEFAULT "0"
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_SECY_CONFIDENTIALITY {
|
||||
NAME SecY Confidentiality setting
|
||||
SYNOPSIS Specifies the default value for the Confidentiality setting \
|
||||
of newly created Tx SAs. This default can be overriden at \
|
||||
SA ceation time. \
|
||||
Valid values: "0" means only integrity is used on Tx SA, \
|
||||
"1" means both integrity and confidentiality are used.
|
||||
TYPE char *
|
||||
DEFAULT "0"
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_SECY_CONFIDENTIALITY_OFFSET {
|
||||
NAME SecY Confidentiality Offset value
|
||||
SYNOPSIS Specifies the default value of the Confidentiality Offset \
|
||||
for the selected cipher suite (if supported by the cipher suite). \
|
||||
It indicates the number of initial octets of each MSDU without \
|
||||
confidentiality protection. The confidentialityOffset applies to all \
|
||||
frames transmitted and received with confidentiality protection. \
|
||||
Valid values: "0", "30" or "50".
|
||||
TYPE char *
|
||||
DEFAULT "0"
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_LOG_LEVEL {
|
||||
NAME IPMACSEC Syslog Level
|
||||
SYNOPSIS Syslog Level for the IPMACSEC module. \
|
||||
One of: IPCOM_LOG_EMERG, IPCOM_LOG_CRIT, IPCOM_LOG_ERR, \
|
||||
IPCOM_LOG_WARNING, IPCOM_LOG_NOTICE, IPCOM_LOG_INFO, \
|
||||
IPCOM_LOG_DEBUG, IPCOM_LOG_DEBUG2
|
||||
TYPE int
|
||||
DEFAULT IPCOM_LOG_INFO
|
||||
}
|
||||
|
||||
Parameter IPMACSEC_GCMAES_ACCEL_LEVEL {
|
||||
NAME IPMACSEC GCM-AES Acceleration Level
|
||||
SYNOPSIS Acceleration Level for the GCM-AES cipher used by IPMACSEC. \
|
||||
This specifies the tradeoff between space and performance \
|
||||
(refer to "openssl/aes_gcm.h" for more details). \
|
||||
Valid values: "0" (off) , "1" (level 1) , "2" (level 2), \
|
||||
"3" (level 3), "4" (level 4).
|
||||
TYPE char *
|
||||
DEFAULT "4"
|
||||
}
|
||||
|
||||
/*---------------------------------------------------------------------------*/
|
||||
Component INCLUDE_IPMACSEC_CMD {
|
||||
NAME MACsec IPCOM Commands Component
|
||||
SYNOPSIS Include this component to get access to "macsec" commands \
|
||||
from the ipcom command shell.
|
||||
MODULES ipmacsec_cmd.o
|
||||
REQUIRES INCLUDE_IPCOM_SHELL_CMD
|
||||
_CHILDREN FOLDER_IPMACSEC
|
||||
}
|
||||
|
||||
#endif
|
||||
@@ -0,0 +1,13 @@
|
||||
# Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: common.vxconfig,v $ $Revision: 1.4 $
|
||||
# $Source: /home/interpeak/CVSRoot/ipmacsec/config/common.vxconfig,v $
|
||||
# $Author: myakan $
|
||||
# $State: Exp $ $Locker: $
|
||||
#
|
||||
# INTERPEAK_COPYRIGHT_STRING
|
||||
|
||||
#hidden option that enables IPMACSEC
|
||||
config SUPPORTS_MACSEC
|
||||
bool
|
||||
default y
|
||||
|
||||
|
||||
@@ -0,0 +1,156 @@
|
||||
/* ipmacsec_config.c - IPMACSEC vxWorks specific configuration applet */
|
||||
/*
|
||||
* Copyright (c) 2010 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
01a,08feb10,mry Created
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#include <ipcom_cstyle.h>
|
||||
#include <ipcom_clib.h>
|
||||
#include <ipcom_err.h>
|
||||
#include <ipcom_sysvar.h>
|
||||
#include <ipcom_syslog.h>
|
||||
|
||||
|
||||
#include "ipmacsec_sysvar.h"
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#if !defined(IPMACSEC_LOG_LEVEL) && !defined(IP_WB_BUILD)
|
||||
#define IPMACSEC_LOG_LEVEL IPCOM_LOG_ERR
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 EXTERN PROTOTYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#ifdef INCLUDE_IPMACSEC_CMD
|
||||
IP_GLOBAL Ip_err ipmacsec_cmd_init(void);
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 LOCAL PROTOTYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
IP_PUBLIC Ip_err ipmacsec_configure(void);
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 7 DATA
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/* MACsec sysvars and their default values assigned from the kernel configurator */
|
||||
IP_CONST Ipcom_sysvar ipmacsec_conf_sysvar[] =
|
||||
{
|
||||
#if defined(INCLUDE_IPMACSEC) || defined(IPMACSEC)
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_SECY_ENABLE, "0", IPMACSEC_SECY_ENABLE),
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_SECY_INTERFACES, "", IPMACSEC_SECY_INTERFACES),
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_SECY_PROTECTFRAMES, "1", IPMACSEC_SECY_PROTECTFRAMES),
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_SECY_ALWAYSINCSCI, "0", IPMACSEC_SECY_ALWAYSINCSCI),
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_SECY_USE_ES, "0", IPMACSEC_SECY_USE_ES),
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_SECY_USE_SCB, "0", IPMACSEC_SECY_USE_SCB),
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_SECY_CONFIDENTIALITY, "0", IPMACSEC_SECY_CONFIDENTIALITY),
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_SECY_CONFIDENTIALITYOFF,
|
||||
"0", IPMACSEC_SECY_CONFIDENTIALITY_OFFSET),
|
||||
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_SECY_VALIDATEFRAMES, "Strict", IPMACSEC_SECY_VALIDATEFRAMES),
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_SECY_REPLAYPROTECT, "1", IPMACSEC_SECY_REPLAYPROTECT),
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_SECY_REPLAYWINDOW, "0", IPMACSEC_SECY_REPLAYWINDOW),
|
||||
|
||||
IP_SYSVAR(IPMACSEC_SYSVAR_GCMAES_ACCEL_LEVEL, "4", IPMACSEC_GCMAES_ACCEL_LEVEL),
|
||||
#endif
|
||||
{ IP_NULL, IP_NULL}
|
||||
};
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 8 STATIC FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 9 GLOBAL FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 10 PUBLIC FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_configure
|
||||
*===========================================================================
|
||||
* Description: Configures the ipmacsec runtime syslog level and initializes
|
||||
* it sysvars. Also calls the function to register the macsec
|
||||
* commands if INCLUDE_IPMACSEC_CMD is selected.
|
||||
* Parameters:
|
||||
* Returns:
|
||||
*
|
||||
*/
|
||||
IP_PUBLIC Ip_err
|
||||
ipmacsec_configure(void)
|
||||
{
|
||||
Ip_err rc = IPCOM_SUCCESS;
|
||||
|
||||
(void)ipcom_sysvar_setv(ipmacsec_conf_sysvar, 0);
|
||||
|
||||
ipcom_openlog(IP_NULL, 0, IPCOM_LOG_IPMACSEC);
|
||||
(void)ipcom_setlogmask_on(IPMACSEC_LOG_LEVEL, IPCOM_LOG_IPMACSEC);
|
||||
|
||||
|
||||
#ifdef INCLUDE_IPMACSEC_CMD
|
||||
rc = ipmacsec_cmd_init();
|
||||
#endif
|
||||
|
||||
return rc;
|
||||
}
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
@@ -0,0 +1,91 @@
|
||||
/* ipmacsec_config.h - IPMACSEC Configuration header file */
|
||||
/*
|
||||
* Copyright (c) 2010 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
01a,08feb10,mry Created
|
||||
*/
|
||||
#ifndef IPMACSEC_CONFIG_H
|
||||
#define IPMACSEC_CONFIG_H
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
#ifdef IP_PORT_VXWORKS
|
||||
#include <vsbConfig.h>
|
||||
#endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#ifdef IPCOM_SYSLOG_PRIORITY
|
||||
#undef IPCOM_SYSLOG_PRIORITY
|
||||
#endif
|
||||
|
||||
#if defined(_WRS_CONFIG_IPMACSEC_SYSLOG_PRIORITY)
|
||||
#define IPCOM_SYSLOG_PRIORITY _WRS_CONFIG_IPMACSEC_SYSLOG_PRIORITY
|
||||
#else
|
||||
#define IPCOM_SYSLOG_PRIORITY IPCOM_LOG_ERR
|
||||
#endif
|
||||
|
||||
#ifdef IPCOM_SYSLOG_FACILITY
|
||||
#undef IPCOM_SYSLOG_FACILITY
|
||||
#endif
|
||||
#define IPCOM_SYSLOG_FACILITY IPCOM_LOG_IPMACSEC
|
||||
|
||||
|
||||
#ifndef _WRS_CONFIG_COMPONENT_IPMACSEC
|
||||
#warning VSB Config was not used to build IPMACSEC. Make sure you set the appropriate IPMACSEC_USE_xxx defines manually.
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/* Forward declarations */
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
@@ -0,0 +1,11 @@
|
||||
IPTARGETS := lib
|
||||
|
||||
ifneq ($(IPMAKEFILE),)
|
||||
include $(IPMAKEFILE)
|
||||
else
|
||||
include $(IPCOM_ROOT)/Makefile
|
||||
endif
|
||||
include ipmacsec.mk
|
||||
include $(IPCOM_ROOT)/gmake/ipcom_make.mk
|
||||
|
||||
lib: dirs $(IPLIBFILE)
|
||||
@@ -0,0 +1,93 @@
|
||||
#############################################################################
|
||||
# INTERPEAK DMAKE MAKEFILE
|
||||
#
|
||||
# Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipmacsec.mk,v $ $Revision: 1.4.12.1 $
|
||||
# $Source: /home/interpeak/CVSRoot/ipmacsec/gmake/ipmacsec.mk,v $
|
||||
# $Author: myakan $
|
||||
# $State: Exp $ $Locker: $
|
||||
#
|
||||
#############################################################################
|
||||
ifeq ($(IPPORT),vxworks)
|
||||
include $(TGT_DIR)/h/make/defs.library
|
||||
endif
|
||||
|
||||
#############################################################################
|
||||
# PRODUCT
|
||||
###########################################################################
|
||||
|
||||
IPPROD ?= ipmacsec
|
||||
|
||||
|
||||
#############################################################################
|
||||
# DEFINE
|
||||
#############################################################################
|
||||
|
||||
IPDEFINE += -DIPMACSEC
|
||||
|
||||
|
||||
#############################################################################
|
||||
# INCLUDE
|
||||
#############################################################################
|
||||
|
||||
IPINCLUDE += -I$(IPMACSEC_ROOT)/config
|
||||
IPINCLUDE += -I$(IPMACSEC_ROOT)/include
|
||||
|
||||
|
||||
#############################################################################
|
||||
# OBJECTS
|
||||
#############################################################################
|
||||
|
||||
# Configuration
|
||||
ifneq ($(IPPORT),las)
|
||||
IPLIBOBJECTS_C += ipmacsec_config.o
|
||||
endif
|
||||
|
||||
# Main
|
||||
IPLIBOBJECTS += ipmacsec.o
|
||||
IPLIBOBJECTS += ipmacsec_ioctl.o
|
||||
IPLIBOBJECTS += ipmacsec_lmi.o
|
||||
IPLIBOBJECTS += ipmacsec_crypto_if.o
|
||||
IPLIBOBJECTS += ipmacsec_secy_mgmt.o
|
||||
IPLIBOBJECTS += ipmacsec_netlink.o
|
||||
IPLIBOBJECTS += ipmacsec_cmd.o
|
||||
ifeq ($(_WRS_CONFIG_IPMACSEC_DEBUG),y)
|
||||
IPLIBOBJECTS += ipmacsec_debug.o
|
||||
else
|
||||
ifeq ($(IPPORT),unix)
|
||||
IPLIBOBJECTS += ipmacsec_debug.o
|
||||
endif
|
||||
endif
|
||||
|
||||
# Compiles the xxx_config.o if the $SKIP_CONFIG macro is either not defined
|
||||
# or set to anything other than true.
|
||||
ifneq ($(SKIP_CONFIG),true)
|
||||
IPLIBOBJECTS += $(IPLIBOBJECTS_C)
|
||||
endif
|
||||
|
||||
|
||||
#############################################################################
|
||||
# VPATH
|
||||
#############################################################################
|
||||
|
||||
# object root
|
||||
IPSRCDIRS += $(IPMACSEC_ROOT)/src $(IPMACSEC_ROOT)/config
|
||||
|
||||
|
||||
#############################################################################
|
||||
# LIB
|
||||
#############################################################################
|
||||
|
||||
IPLIBS += $(IPLIBROOT)/libipmacsec.a
|
||||
|
||||
|
||||
#############################################################################
|
||||
# BINARIES
|
||||
#############################################################################
|
||||
|
||||
ifeq ($(IPPORT),las)
|
||||
#error not supported
|
||||
endif
|
||||
#############################################################################
|
||||
# END OF IPMACSEC.MK
|
||||
#############################################################################
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,600 @@
|
||||
/* ipmacsec_netlink.h - IPMACSEC Netlink header file */
|
||||
/*
|
||||
* Copyright (c) 2010 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
01a,17mar10,mry Created
|
||||
*/
|
||||
#ifndef IPMACSEC_NETLINK_H
|
||||
#define IPMACSEC_NETLINK_H
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/* This header file is to be included by internal or external modules
|
||||
* that use Netlink to interface to the MACsec SecY management entity
|
||||
* (for control, configuration, notification, status/statistics retrieval)
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 CONFIGURATION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#include <ipcom_type.h>
|
||||
#include <ipcom_cstyle.h>
|
||||
#ifdef IP_PORT_VXWORKS
|
||||
#include <vsbConfig.h>
|
||||
#endif
|
||||
#include <ipcom_netlink.h>
|
||||
#include <ipcom_sock.h>
|
||||
|
||||
#include "ipmacsec_lmi.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
/* Buffer size for MACsec netlink messages */
|
||||
#define IPMACSEC_NETLINK_BUFSIZ (16*1024)
|
||||
|
||||
/* MACsec Netlink type validation macro */
|
||||
#define IPMACSEC_NLTYPE_IS_VALID(nltype) (((nltype) >= __IPMACSEC_NLTYPE_BASE) && ((nltype) < __IPMACSEC_NLTYPE_MAX))
|
||||
|
||||
/* MACsec Netlink Command and Notification messages macros */
|
||||
#define IPMACSEC_NLCMD_LENGTH(len) (IP_NLMSG_LENGTH(sizeof(Ipmacsec_nlcmd_hdr)+(len)))
|
||||
#define IPMACSEC_NLCMD_DATA(nlmsg) ((void*)(((Ip_u8 *)nlmsg) + IPMACSEC_NLCMD_LENGTH(0)))
|
||||
#define IPMACSEC_NLNOTE_LENGTH(len) (IP_NLMSG_LENGTH(sizeof(Ipmacsec_nlnote_hdr)+(len)))
|
||||
#define IPMACSEC_NLNOTE_DATA(nlmsg) ((void*)(((Ip_u8 *)nlmsg) + IPMACSEC_NLNOTE_LENGTH(0)))
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/* IPMACSEC netlink multicast groups */
|
||||
typedef enum {
|
||||
IPMACSEC_NLGRP_NONE = 0,
|
||||
IPMACSEC_NLGRP_RESERVED, /* RESERVED for netlink management. NOT USED BY APPLICATIONS */
|
||||
IPMACSEC_NLGRP_NOTIFY, /* Notification Group */
|
||||
|
||||
IPMACSEC_NLGRP_MONITOR, /* Monitor Group; Mainly used for debugging to monitor SecY events */
|
||||
/* Do not insert anything below this */
|
||||
__IPMACSEC_NLGRP_MAX
|
||||
} Ip_macsec_netlink_groups;
|
||||
|
||||
|
||||
/* IPMACSEC NETLINK TYPE DEFINITIONS */
|
||||
typedef enum {
|
||||
__IPMACSEC_NLTYPE_BASE = 16,
|
||||
IPMACSEC_NLTYPE_TEST = __IPMACSEC_NLTYPE_BASE, /* For debugging purposes only (produces no action other than an ACK)
|
||||
* Does not contain anything besides the netlink message header
|
||||
*/
|
||||
/*
|
||||
* Notification messages of the following types always contain an Ipmacsec_nlnote_hdr
|
||||
* after the netlink message header, in addition to any applicable parameters that follow.
|
||||
*/
|
||||
IPMACSEC_NLTYPE_NOTIFY, /* Notification events */
|
||||
|
||||
/*
|
||||
* Command messages of the following types always contain an Ipmacsec_nlcmd_hdr
|
||||
* after the netlink message header, in addition to any applicable parameters that follow.
|
||||
*/
|
||||
IPMACSEC_NLTYPE_SECY_COMMAND, /* SECY commands. */
|
||||
IPMACSEC_NLTYPE_CP_COMMAND, /* Controlled Port commands. */
|
||||
IPMACSEC_NLTYPE_UCP_COMMAND, /* Uncontrolled Port commands. */
|
||||
|
||||
|
||||
IPMACSEC_NLTYPE_SIG_EXIT, /* Netlink socket exit signal. FOR INTERNAL USE ONLY, not used directly by applications */
|
||||
/* Do not insert anything below this. MUST not exceed the maximum size of nlmsg_type in Ip_nlmsghdr */
|
||||
__IPMACSEC_NLTYPE_MAX
|
||||
} Ipmacsec_netlink_type;
|
||||
|
||||
|
||||
/* Header for all IPMACsec netlink messages containing a command (follows the netlink message header) */
|
||||
typedef struct Ipmacsec_nlcmd_hdr_struct {
|
||||
char ifname[IP_IFNAMSIZ]; /* Interface name for the corresponding command */
|
||||
Ipmacsec_lmi_command command; /* interpreted by the appropriate handler */
|
||||
Ip_bool get; /* TRUE for a get command, FALSE for a set command
|
||||
* Get commands have no request params,
|
||||
* Set commands have no reply params
|
||||
*/
|
||||
Ip_bool reply; /* TRUE for a reply (get commands only), FALSE for a request */
|
||||
Ip_u16 param_len; /* Command parameter(s) length */
|
||||
Ip_u16 param_off; /* Offset of next available parameter (used when removing params) */
|
||||
} Ipmacsec_nlcmd_hdr;
|
||||
|
||||
|
||||
/* Header for all IPMACsec netlink messages containing a notification (follows the netlink message header) */
|
||||
typedef struct Ipmacsec_nlnote_hdr_struct {
|
||||
char ifname[IP_IFNAMSIZ]; /* Interface name for the corresponding command */
|
||||
Ipmacsec_lmi_note note; /* interpreted by the appropriate handler */
|
||||
Ip_u16 param_len; /* Notification parameter(s) length */
|
||||
Ip_u16 param_off; /* Offset of next available parameter (used when removing params) */
|
||||
} Ipmacsec_nlnote_hdr;
|
||||
|
||||
|
||||
/* IPMACSEC netlink callback function signature */
|
||||
typedef int (* IPMACSEC_NL_CB)(struct Ip_nlmsghdr *nlmsg, int error);
|
||||
|
||||
/* IPMACSEC NETLINK HANDLE Structure:
|
||||
* =================================
|
||||
* Note that the members of this structure MUST not be manipulated directly by
|
||||
* applications. Instead the ipmacsec_netlink_open() and ipmacsec_netlink_register()
|
||||
* APIs should be used.
|
||||
*/
|
||||
typedef struct Ipmacsec_netlink_handle_struct
|
||||
{
|
||||
Ip_fd nlsock;
|
||||
struct Ip_sockaddr_nl local_nladdr;
|
||||
Ip_u32 sequence;
|
||||
char nlbuf[IPMACSEC_NETLINK_BUFSIZ];
|
||||
IPMACSEC_NL_CB callback;
|
||||
struct Ip_timeval nl_tmo;
|
||||
Ip_bool exit_loop_on_error;
|
||||
Ip_u32 dest_pid; /* RESERVED for MACsec Netlink operation. Not to be modified by applications. */
|
||||
Ip_u32 dest_groups; /* RESERVED for MACsec Netlink operation. Not to be modified by applications. */
|
||||
} Ipmacsec_netlink_handle;
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 GLOBAL FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_netlink_open
|
||||
*===========================================================================
|
||||
* Description: Allocates a MACsec netlink handles and opens and binds the
|
||||
netlink socket so you can send requests and receive responses.
|
||||
* Must call ipmacsec_netlink_register() if you want to receive notifications.
|
||||
* Parameters: groups - The netlink groups for this socket.
|
||||
* Returns: A handle pointer that can be passed to ipmacsec_netlink_register(),
|
||||
* ipmacsec_netlink_send_request() or ipmacsec_netlink_loop().
|
||||
* IP_NULL is returned upon error
|
||||
*/
|
||||
IP_GLOBAL Ipmacsec_netlink_handle *
|
||||
ipmacsec_netlink_open(Ip_macsec_netlink_groups groups);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_netlink_close
|
||||
*===========================================================================
|
||||
* Description: Closes a MACsec netlink socket and frees the handle
|
||||
* Parameters: nlhandle - Pointer to a MACsec netlink handle
|
||||
* Returns: 0 upon success.
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL int
|
||||
ipmacsec_netlink_close(Ipmacsec_netlink_handle *nlhandle);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_netlink_request
|
||||
*===========================================================================
|
||||
* Description: Sends a MACsec netlink request and pends for response
|
||||
* Parameters: nlhandle - netlink handle allocated with ipmacsec_netlink_open()
|
||||
* request - A non NULL netlink request buffer starting with
|
||||
* an Ip_nlmsghdr and optionally containing additional
|
||||
* netlink message(s)
|
||||
* response - If NULL, the caller does not care for the response and
|
||||
* will only process the return code.
|
||||
* If not NULL, it must point to a proper Ipmacsec_buffer
|
||||
* with enough buffer space to receive the response
|
||||
* (if there is not enough space, the response is truncated)
|
||||
* "response" contents are only valid if the return code is 0.
|
||||
* Returns: 0 if successful in sending and receives a positive ACK
|
||||
* < 0 if it fails, times out waiting for ACK, or receives a negative ACK
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL int
|
||||
ipmacsec_netlink_request(Ipmacsec_netlink_handle *nlhandle,
|
||||
struct Ip_nlmsghdr *request,
|
||||
Ipmacsec_buffer *response);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_netlink_register
|
||||
*===========================================================================
|
||||
* Description: Register for netlink notifications:
|
||||
* It Associates the callback routine with the handle so that when
|
||||
* ipmacsec_netlink_loop() is invoked, it will call the callback routine
|
||||
* for every received packet or upon timeouts/errors. It also sets supplied
|
||||
* parameters for the nlhandle.
|
||||
*
|
||||
* Note that ipmacsec_netlink_register() can be called again for the same
|
||||
* nlhandle (assuming mutual exclusions is provided or ipmacsec_netlink_loop()
|
||||
* is not currently invoked/running) to update the callback, nl_tmo
|
||||
* and/or exit_loop_on_error.
|
||||
* Parameters:
|
||||
* nlhandle - The MACsec netlink handler to register with.
|
||||
* MUST be allocated with ipmacsec_netlink_open() and
|
||||
* have a valid netlink socket.
|
||||
* callback - The callback function to register for this handle.
|
||||
* nl_tmo - Pointer to a timeout value to be used by the
|
||||
* ipmacsec_netlink_loop() when invoked.
|
||||
* A NULL nl_tmo or an nl_tmo containing a 0 value
|
||||
* means no timeout is set.
|
||||
* exit_loop_on_error - If set, indicates that ipmacsec_netlink_loop()
|
||||
* will exit upon an error condition, otherwise
|
||||
* the callback is invoked with an error condition
|
||||
* and ipmacsec_netlink_loop() will only exit if
|
||||
* the callback returns < 0.
|
||||
* Returns: 0 upon success
|
||||
* <0 upon failure
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL int
|
||||
ipmacsec_netlink_register(Ipmacsec_netlink_handle *nlhandle,
|
||||
IPMACSEC_NL_CB callback, struct Ip_timeval *nl_tmo,
|
||||
Ip_bool exit_loop_on_error);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_netlink_loop
|
||||
*===========================================================================
|
||||
* Description: Invoke a continuous loop that blocks on the netlink socket
|
||||
* (in the nlhandle).
|
||||
* The callback will be invoked under these conditions:
|
||||
* 1- For every successfully received message the nlhandle registred
|
||||
* callback will be invoked passing a pointer to the nlmsg
|
||||
* containing the received netlink message, and an error value of 0.
|
||||
* 2- It will be invoked upon timeouts, in which case a NULL nlmsg
|
||||
* pointer is provided and a positive error value is returned.
|
||||
* 3- It will be invoked if socket select/read errors occur
|
||||
* if the nlhandle exit_loop_on_error is not set. In this case,
|
||||
* a NULL nlmsg pointer is provided and a negative error value
|
||||
* is returned.
|
||||
* 4- It will be invoked when a MACsec netlink EXIT message is
|
||||
* received on the nlhandler netlink socket, in which case a
|
||||
* pointer to the the EXIT nlmsg is provided and a positive error
|
||||
* value is returned.
|
||||
*
|
||||
* The loop will only exit upon one of these conditions:
|
||||
* 1- An error occurs during its initialization.
|
||||
* 2- An error occurs during socket select/read and
|
||||
* the nlhandle exit_loop_on_error flag is set.
|
||||
* 3- The callback routine returns <0 after being invoked.
|
||||
* 4- A MACsec netlink EXIT message is received.
|
||||
* Note that if the loop is called with an nlhandle nl_tmo set to
|
||||
* 0, it may loop/block forever if none of the above conditions are met.
|
||||
* You can either set a nl_tmo to a certain reasonable value which
|
||||
* causes your callback to be invoked and it can return -1 to cause
|
||||
* the loop to exit. Or if nl_tmo is 0, you can use ipmacsec_netlink_loop_exit()
|
||||
* to send a netlink message to the netlink socket to cause an exit.
|
||||
*
|
||||
* Also note that when ipmacsec_netlink_loop() is invoked and while it has not
|
||||
* returned, the same nlhandle MUST not be passed to another invocation of
|
||||
* ipmacsec_netlink_request(), ipmacsec_netlink_loop() or ipmacsec_netlink_close()
|
||||
* unless the caller has provided mutual exclusion for the nlhanle before
|
||||
* invoking those routines in separate threads/contexts.
|
||||
*
|
||||
* Parameters: nlhandle - valid pointer to properly allocated and registered netlink handle
|
||||
* Returns: >= 0 upon successful exit (including timeout)
|
||||
* <0 upon exit due to errors
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL int
|
||||
ipmacsec_netlink_loop(Ipmacsec_netlink_handle *nlhandle);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_netlink_loop_exit
|
||||
*===========================================================================
|
||||
* Description: Causes a netlink EXIT message to be sent to the socket
|
||||
* associated with the specified nl_handle.
|
||||
* Parameters: nlhandle - Specifies the nlhandle whose socket will receive
|
||||
* the netlink EXIT message (based on nl_pid of the
|
||||
* nlhandler local_addr).
|
||||
* Returns: 0 upon success
|
||||
* <0 upon error
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL int
|
||||
ipmacsec_netlink_loop_exit(Ipmacsec_netlink_handle *nlhandle);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_netlink_type_name
|
||||
*===========================================================================
|
||||
* Description: Return a string describing the name of a MACsec netlink type
|
||||
* Parameters: nltype - netlink type to describe
|
||||
* Returns: String pointer (always != NULL)
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL IP_CONST char *
|
||||
ipmacsec_netlink_type_name(Ipmacsec_netlink_type nltype);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlmsg_alloc
|
||||
*===========================================================================
|
||||
* Description: Allocates a netlink message buffer using the buf container.
|
||||
* Parameters: buf - Pointer to a properly intialized or previously freed
|
||||
* buffer container.
|
||||
* Returns: Pointer to allocated and initialized buffer memory,
|
||||
* IP_NULL if allocation fails.
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL Ip_u8 *
|
||||
ipmacsec_nlmsg_alloc(Ipmacsec_buffer *buf);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlmsg_free
|
||||
*===========================================================================
|
||||
* Description: Frees a netlink message buffer.
|
||||
* Parameters: buf - Pointer to allocated buffer container.
|
||||
* Returns: 0
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL int
|
||||
ipmacsec_nlmsg_free(Ipmacsec_buffer *buf);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlcmd_add
|
||||
*===========================================================================
|
||||
* Description: Adds a netlink command message to a buffer and initializes the
|
||||
* Ipmacsec_nlcmd_hdr inside the nlmsg netlink message
|
||||
* updating both in the process along with the buffer container.
|
||||
* Parameters:
|
||||
* buf - Pointer to an allocated buffer container.
|
||||
* nltype - A valid MACsec netlink message type
|
||||
* cmd - The command type.
|
||||
* ifname - Valid pointer to an interface name NULL terminated string
|
||||
* getCmd - TRUE for a get command, FALSE for a set command
|
||||
* isReply - Indicates a reply (not set by apps)
|
||||
* Returns: Pointer to the initialized netlink message
|
||||
* NULL if failed (not enough space or other failure).
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL struct Ip_nlmsghdr *
|
||||
ipmacsec_nlcmd_add(Ipmacsec_buffer *buf, Ipmacsec_netlink_type nltype, Ipmacsec_lmi_command cmd,
|
||||
char *ifname, Ip_bool getCmd, Ip_bool isReply);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlcmd_get
|
||||
*===========================================================================
|
||||
* Description: Retrieves a pointer to an nlcmd from a netlink message
|
||||
* (only supports one command per message)
|
||||
* Parameters: nlmsg - Pointer to the netlink message containing the nlcmd
|
||||
* Returns: pointer to nlcmd_hdr if successful
|
||||
* IP_NULL if not enough space to contain an nlcmd_hdr or upon error
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL struct Ipmacsec_nlcmd_hdr_struct *
|
||||
ipmacsec_nlcmd_get(struct Ip_nlmsghdr *nlmsg);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlcmd_add_param
|
||||
*===========================================================================
|
||||
* Description: Adds a parameter to a MACsec netlink cmd msg and to the
|
||||
* associated buffer container, updating the buffer container,
|
||||
* the netlink header and Ipmacsec_nlcmd_hdr in the process.
|
||||
* May be called repeatedly for the same netlink cmd msg as long as
|
||||
* there is enough buffer space.
|
||||
* Parameters:
|
||||
* buf - Pointer to a valid buffer container.
|
||||
* nlmsg - Ptr to header for current netlink message being
|
||||
* manipulated in buffer
|
||||
* param - Pointer to param to add
|
||||
* param_size - size of param to add
|
||||
* Returns: number of octets added if adding a param was successful
|
||||
* <0 if error (space not available or other error)
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL int
|
||||
ipmacsec_nlcmd_add_param(Ipmacsec_buffer *buf, struct Ip_nlmsghdr *nlmsg,
|
||||
void *param, Ip_u32 param_size);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlcmd_retrieve_init
|
||||
*===========================================================================
|
||||
* Description: Initialize an nlcmd struct before retrieving params.
|
||||
* Parameters: nlmsg - Ptr to header for current netlink message being parsed
|
||||
* Returns: >0 is successful (= size of param field), <0 if error occurs
|
||||
*/
|
||||
IP_GLOBAL int
|
||||
ipmacsec_nlcmd_retrieve_init(struct Ip_nlmsghdr *nlmsg);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlcmd_retrieve_param
|
||||
*===========================================================================
|
||||
* Description: Retrieves a parameter from a MACsec netlink cmd msg
|
||||
* updating the Ipmacsec_nlcmd_hdr's param_offset in the process.
|
||||
* May be called repeatedly for the same netlink cmd msg as long as
|
||||
* there are remaining param bytes.
|
||||
* Make sure ipmacsec_nlcmd_retrieve_init() is called ONCE and ONLY ONCE
|
||||
* before subsequent ipmacsec_nlcmd_retrieve_param() calls.
|
||||
* Note that the paramter remains unchanged in the nlmsg
|
||||
* (e.g. for retransmission,forwarding, etc.).
|
||||
* Parameters:
|
||||
* nlmsg - Ptr to header for current netlink message
|
||||
* (Must be a valid MACsec netlink command message)
|
||||
* param - Pointer to data here to store removed param
|
||||
* If NULL, param is removed but no data copied.
|
||||
* param_size - size of param to retrieve
|
||||
* Returns: number of octets removed if a param was successfully removed
|
||||
* <0 if error (no param bytes or other error)
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL int
|
||||
ipmacsec_nlcmd_retrieve_param(struct Ip_nlmsghdr *nlmsg, void *param, Ip_u32 param_size);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlnote_get
|
||||
*===========================================================================
|
||||
* Description: Retrieves a pointer to an nlnote from a netlink message
|
||||
* (only supports one notification per message)
|
||||
* Parameters: nlmsg - Pointer to the netlink message containing the nlnote
|
||||
* Returns: pointer to nlnote_hdr if successful
|
||||
* IP_NULL if not enough space to contain an nlnote_hdr or upon error
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL struct Ipmacsec_nlnote_hdr_struct *
|
||||
ipmacsec_nlnote_get(struct Ip_nlmsghdr *nlmsg);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlnote_retrieve_init
|
||||
*===========================================================================
|
||||
* Description: Initialize an nlnote struct before retrieving params.
|
||||
* Parameters: nlmsg - Ptr to header for current netlink message being parsed
|
||||
* Returns: 0 is successful, <0 if error occurs
|
||||
*/
|
||||
IP_GLOBAL int
|
||||
ipmacsec_nlnote_retrieve_init(struct Ip_nlmsghdr *nlmsg);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlnote_retrieve_param
|
||||
*===========================================================================
|
||||
* Description: Retrieves a parameter from a MACsec netlink note msg
|
||||
* updating the Ipmacsec_nlnote_hdr's param_offset in the process.
|
||||
* May be called repeatedly for the same netlink note msg as long as
|
||||
* there are remaining param bytes.
|
||||
* Make sure ipmacsec_nlnote_retrieve_init() is called ONCE and ONLY ONCE
|
||||
* before subsequent ipmacsec_nlnote_retrieve_param() calls.
|
||||
* Note that the paramter remains unchanged in the nlmsg
|
||||
* (e.g. for retransmission,forwarding, etc.).
|
||||
* Parameters:
|
||||
* nlmsg - Ptr to header for current netlink message
|
||||
* (Must be a valid MACsec netlink notification message)
|
||||
* param - Pointer to data here to store removed param
|
||||
* If NULL, param is removed but no data copied.
|
||||
* param_size - size of param to retrieve
|
||||
* Returns: number of octets removed if a param was successfully removed
|
||||
* <0 if error (no param bytes or other error)
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL int
|
||||
ipmacsec_nlnote_retrieve_param(struct Ip_nlmsghdr *nlmsg, void *param, Ip_u32 param_size);
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 PRIVATE FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlcmd_response_add
|
||||
*===========================================================================
|
||||
* Description: Add a command response netlink message to a buffer.
|
||||
* Parameters: reply - buffer container to add response netlink command message to
|
||||
* nlmsg - request message being replied to
|
||||
* param - optional parameter pointer
|
||||
* param_size - size of optional param
|
||||
* src_pid - pid to respond to
|
||||
* Returns: Pointer to response message upon success, IP_NULL on failure
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE struct Ip_nlmsghdr *
|
||||
ipmacsec_nlcmd_response_add(Ipmacsec_buffer *reply, struct Ip_nlmsghdr *nlreq,
|
||||
void *param, Ip_u32 param_size, Ip_pid_t src_pid);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlnote_add
|
||||
*===========================================================================
|
||||
* Description: Adds a netlink notification message to a buffer and initializes the
|
||||
* Ipmacsec_nlnote_hdr inside the nlmsg netlink message
|
||||
* updating both in the process along with the buffer container.
|
||||
* Parameters:
|
||||
* buf - Pointer to an allocated buffer container.
|
||||
* nltype - A valid MACsec netlink message type
|
||||
* note - The notification type.
|
||||
* ifname - Valid pointer to an interface name NULL terminated string
|
||||
* Returns: Pointer to the initialized netlink message
|
||||
* NULL if failed (not enough space or other failure).
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE struct Ip_nlmsghdr *
|
||||
ipmacsec_nlnote_add(Ipmacsec_buffer *buf, Ipmacsec_netlink_type nltype, Ipmacsec_lmi_note note,
|
||||
char *ifname);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_nlnote_add_param
|
||||
*===========================================================================
|
||||
* Description: Adds a parameter to a MACsec netlink note msg and to the
|
||||
* associated buffer container, updating the buffer container,
|
||||
* the netlink header and Ipmacsec_nlnote_hdr in the process.
|
||||
* May be called repeatedly for the same netlink note msg as long as
|
||||
* there is enough buffer space.
|
||||
* Parameters:
|
||||
* buf - Pointer to a valid buffer container.
|
||||
* nlmsg - Ptr to header for current netlink message being
|
||||
* manipulated in buffer
|
||||
* param - Pointer to param to add
|
||||
* param_size - size of param to add
|
||||
* Returns: number of octets added if adding a param was successful
|
||||
* <0 if error (space not available or other error)
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_nlnote_add_param(Ipmacsec_buffer *buf, struct Ip_nlmsghdr *nlmsg,
|
||||
void *param, Ip_u32 param_size);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_netlink_broadcast
|
||||
*===========================================================================
|
||||
* Description: Broadcast a MACsec netlink message to specified groups
|
||||
* Parameters: secy - MACsec secy instance pointer
|
||||
* notification - Pointer to buffer containing the notification
|
||||
* netlink message payload.
|
||||
* size - size of notification buffer
|
||||
* nl_type - netlink message type
|
||||
* nl_flags - netlink message flags
|
||||
* msg_group - netlink groups to bcast message to
|
||||
* Returns: 0 upon success
|
||||
* <0 on error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_netlink_broadcast(Ipnet_secy *secy, Ip_u8 *notification, Ip_u32 size,
|
||||
Ipmacsec_netlink_type nl_type, Ip_u16 nl_flags,
|
||||
Ip_macsec_netlink_groups msg_group);
|
||||
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
@@ -0,0 +1,85 @@
|
||||
/* ipmacsec_sysvar.h - IPMACSEC Sysvar definition header file */
|
||||
/*
|
||||
* Copyright (c) 2010 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
01a,09Feb10,mry Created
|
||||
*/
|
||||
#ifndef IPMACSEC_SYSVAR_H
|
||||
#define IPMACSEC_SYSVAR_H
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* IPMACSEC SYSVARS
|
||||
*===========================================================================
|
||||
*
|
||||
*/
|
||||
|
||||
/* Global MACsec SecY enable Flag sysvar */
|
||||
#define IPMACSEC_SYSVAR_SECY_ENABLE "ipmacsec.secy.enable"
|
||||
|
||||
/* MACsec SecY enabled interface list sysvar (if IPMACSEC_SYSVAR_ENABLE is != 0)*/
|
||||
#define IPMACSEC_SYSVAR_SECY_INTERFACES "ipmacsec.secy.ifs"
|
||||
|
||||
/* sysvars for MACsec SecY default control values */
|
||||
#define IPMACSEC_SYSVAR_SECY_PROTECTFRAMES "ipmacsec.secy.protectFrames"
|
||||
#define IPMACSEC_SYSVAR_SECY_ALWAYSINCSCI "ipmacsec.secy.alwaysIncludeSCI"
|
||||
#define IPMACSEC_SYSVAR_SECY_USE_ES "ipmacsec.secy.useES"
|
||||
#define IPMACSEC_SYSVAR_SECY_USE_SCB "ipmacsec.secy.useSCB"
|
||||
#define IPMACSEC_SYSVAR_SECY_VALIDATEFRAMES "ipmacsec.secy.validateFrames"
|
||||
#define IPMACSEC_SYSVAR_SECY_REPLAYPROTECT "ipmacsec.secy.replayProtect"
|
||||
#define IPMACSEC_SYSVAR_SECY_REPLAYWINDOW "ipmacsec.secy.replayWindow"
|
||||
#define IPMACSEC_SYSVAR_SECY_CONFIDENTIALITY "ipmacsec.secy.confidentiality"
|
||||
#define IPMACSEC_SYSVAR_SECY_CONFIDENTIALITYOFF "ipmacsec.secy.confidentiality_offset"
|
||||
|
||||
/* sysvar for MACsec GCM-AES acceleration level */
|
||||
#define IPMACSEC_SYSVAR_GCMAES_ACCEL_LEVEL "ipmacsec.gcmaes_accel_level"
|
||||
|
||||
/* Valid sysvar values for the IPMACSEC_SYSVAR_SECY_VALIDATEFRAMES sysvar */
|
||||
#define IPMACSEC_SYSVARVAL_SECY_VALIDATEFRAMES_DISABLED "Disabled"
|
||||
#define IPMACSEC_SYSVARVAL_SECY_VALIDATEFRAMES_CHECK "Check"
|
||||
#define IPMACSEC_SYSVARVAL_SECY_VALIDATEFRAMES_STRICT "Strict"
|
||||
#define IPMACSEC_SYSVARVAL_SECY_VALIDATEFRAMES_DEFAULT IPMACSEC_SYSVARVAL_SECY_VALIDATEFRAMES_STRICT
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,239 @@
|
||||
/* ipmacsec_crypto_if.h - IPMACSEC Crypto Interface header file */
|
||||
/*
|
||||
* Copyright (c) 2010 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
01a,19feb10,mry Created
|
||||
*/
|
||||
#ifndef IPMACSEC_CRYPTO_IF_H
|
||||
#define IPMACSEC_CRYPTO_IF_H
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 CONFIGURATION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#include <ipcom_type.h>
|
||||
#include <ipcom_cstyle.h>
|
||||
#ifdef IP_PORT_VWORKS
|
||||
#include <vsbConfig.h>
|
||||
#endif
|
||||
|
||||
#include "ipmacsec_h.h"
|
||||
#include "ipmacsec.h"
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/* Crypto context passed to the crypto validate and protect fucntions */
|
||||
typedef struct {
|
||||
Ip_u8 sci[IPMACSEC_SCI_LEN];
|
||||
Ip_u8 *macsec_hdr; /* ptr to concatenated DA, SA and SecTAG fields */
|
||||
Ip_u8 *userdata; /* Set to pointer to data to encrypt, or will return pointer to decrypted data */
|
||||
Ip_u8 *securedata; /* Set to pointer to data to decrypt, or will return pointer to encrypted data */
|
||||
Ip_u8 *icv; /* ICV value to validate, or ptr to buffer to copy generated ICV into */
|
||||
Ip_u32 pn; /* Packet Number */
|
||||
Ip_u8 macsec_hdr_len; /* aggregate size of DA, SA and SecTAG fields (in octets) */
|
||||
Ip_u8 icv_len; /* in octets; size of ICV to validate, or size of buffer to copy generated ICV into */
|
||||
Ip_u16 userdata_len; /* in octets; Set to len of data to encrypt, or will return len of decrypted data */
|
||||
Ip_u16 securedata_len; /* in octets; Set to len of data to decrypt, or will return len of encrypted data */
|
||||
Ip_u16 key_index; /* corresponds to tx/rx SA AN */
|
||||
union {
|
||||
Ip_bool encrypt; /* Set to encrypt userdata in addition to ICV generation */
|
||||
Ip_bool decrypt; /* Set to decrypt userdata in addition to ICV validation */
|
||||
} oper;
|
||||
} Ipmacsec_crypto_ctx;
|
||||
|
||||
/* Crypto interface structure definition
|
||||
* =====================================
|
||||
* Usage:
|
||||
* -----
|
||||
* - One crypto_if per SC is created using ipmacsec_crypto_create() when the SC is created and
|
||||
* destroyed with ipmacsec_crypto_delete() when the SC is deleted
|
||||
* - init_cipher() is called when an SA is created for the corresponding SC.
|
||||
* The AN for that SA is passed as a key_index and the corresponding SAK is also specified.
|
||||
* - destroy_cipher() is called when an SA is deleted for the corresponding SC.
|
||||
* The AN for that SA is passed as a key_index.
|
||||
* - protect() and validate() are called whenever a frames needs to be protected or validated for
|
||||
* the SC corresponding to this crypto_if. The Ipmacsec_crypto_ctx MUST be updated with the proper
|
||||
* fields, including the key_index which equals the AN for the SA that is processing the frame.
|
||||
* - Non private members of this structure are READ ONLY values for entities external to the crypto_if.
|
||||
* - Private members of this structure MUST NOT be ACCESSED by entities external to the crypto_if.
|
||||
*/
|
||||
typedef struct Ipmacsec_crypto_if_struct {
|
||||
Ip_bool valid; /* Set when Crypto If is properly instantiated */
|
||||
Ip_bool cipher_set; /* Set when a cipher is selected */
|
||||
Ip_u16 icvbits; /* ICV length (in bits) of selected cipher suite */
|
||||
Ip_u16 gcmaes_accel_level; /* The AES-GCM acceleration level to use for this crypto if (when gcm-aes-128 is used) */
|
||||
Ip_bool changesDataLength; /* selected cipher suite changes data length upon protection/validation */
|
||||
Ip_u32 confidentialityOffset; /* # of octets to be used as offset for Confidentiality (default is 0)*/
|
||||
int (* init_cipher)(struct Ipmacsec_crypto_if_struct *crypto, Ip_u8 key_index, Ipmacsec_secy_sak *sak);
|
||||
int (* destroy_cipher)(struct Ipmacsec_crypto_if_struct *crypto, Ip_u8 key_index);
|
||||
int (* protect)(struct Ipmacsec_crypto_if_struct *crypto, Ipmacsec_crypto_ctx *ctx);
|
||||
int (* validate)(struct Ipmacsec_crypto_if_struct *crypto, Ipmacsec_crypto_ctx *ctx, Ip_bool *valid);
|
||||
struct {
|
||||
Ipnet_secy *secy; /* backpointer to SecY */
|
||||
struct Ipmacsec_crypto_cipher_struct IP_CONST *cipher; /* Cipher pointer */
|
||||
void *cs_ctx[IPMACSEC_MAX_SA]; /* cipher specific context */
|
||||
Ip_u8 *result_buf; /* buffer used to store temporary crypto results */
|
||||
Ip_u32 result_buf_len; /* length of buffer used to store temporary crypto results */
|
||||
Ipmacsec_secy_sak sak[IPMACSEC_MAX_SA]; /* SAKs to be used by this crypto i/f */
|
||||
} priv; /* Private members */
|
||||
} Ipmacsec_crypto_if;
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_crypto_cipher_suite_supported
|
||||
*===========================================================================
|
||||
* Description: Verify if a cipher suite is supported by our MACsec implementation
|
||||
* Parameters: cipher_suite_index - Cipher Suite index
|
||||
* Returns: IP_TRUE is the cipher suite is supported, IP_FALSE otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ip_bool
|
||||
ipmacsec_crypto_cipher_suite_supported(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_crypto_cipher_suite_get_info
|
||||
*===========================================================================
|
||||
* Description: Retrieve detailed information about a supported cipher suite
|
||||
* Parameters: cipher_suite_index - Cipher Suite index
|
||||
* Returns: 0 if successful, < 0 otherwise
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_crypto_cipher_suite_get_info(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index, Ipmacsec_ciphersuite_descriptor *info);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_crypto_cipher_suite_id_resolve
|
||||
*===========================================================================
|
||||
* Description: Resolve the Cipher Suite ID from a specified cipher_suite_index
|
||||
* Parameters: cipher_suite_index - cipher_suite_index value to resolve
|
||||
* cipher_suite_id - pointer to variable to hold the resolved
|
||||
* Cipher Suite ID
|
||||
* Returns: 0 upon success, <0 on error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_crypto_cipher_suite_id_resolve(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index, Ip_u8 *cipher_suite_id) ;
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_crypto_cipher_suite_name
|
||||
*===========================================================================
|
||||
* Description: Return the name of the specified Cipher Suite
|
||||
* Parameters: cipher_suite_index - index of Cipher Suite whose name to return
|
||||
* Returns: Pointer to string containing the Cipher Suite name (never null).
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE IP_CONST char *
|
||||
ipmacsec_crypto_cipher_suite_name(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_crypto_cipher_suite_index_resolve
|
||||
*===========================================================================
|
||||
* Description: Resolve the Cipher Suite Index from a specified cipher_suite_id
|
||||
* Parameters: cipher_suite_id - Cipher Suite ID value to resolve
|
||||
* cipher_suite_index - pointer to variable to hold the resolved
|
||||
* cipher_suite_index
|
||||
* Returns: 0 upon success, <0 on error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_crypto_cipher_suite_index_resolve(IP_CONST Ip_u8 *cipher_suite_id, Ipmacsec_cipher_suite_index *cipher_suite_index);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_crypto_get_icvbits
|
||||
*===========================================================================
|
||||
* Description: Retrieve # of ICV bits for currently configured SecY cipher
|
||||
* Parameters: secy - SecY pointer
|
||||
* Returns: > 0 if successful, 0 otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ip_u16
|
||||
ipmacsec_crypto_get_icvbits(Ipnet_secy *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_crypto_create
|
||||
*===========================================================================
|
||||
* Description: Crypto Interface constructor
|
||||
* Parameters: secy - SecY pointer
|
||||
* Returns: Pointer to created crypto_if structure upon success, IP_NULL otherwise
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_crypto_if *
|
||||
ipmacsec_crypto_create(Ipnet_secy *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_crypto_delete
|
||||
*===========================================================================
|
||||
* Description: Crypto Interface desstructor
|
||||
* Parameters: secy - SecY pointer
|
||||
* crypto - pointer to crypto_if structure to delete
|
||||
* Returns: 0 upon success, <0 on error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_crypto_delete(Ipnet_secy *secy, Ipmacsec_crypto_if *crypto);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,187 @@
|
||||
/* ipmacsec_debug.h - IPMACSEC DEBUG-ONLY header file */
|
||||
/*
|
||||
* Copyright (c) 2010 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
01a,09feb10,mry Created
|
||||
*/
|
||||
#ifndef IPMACSEC_DEBUG_H
|
||||
#define IPMACSEC_DEBUG_H
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/* This header file is to be included by internal modules for the purpose of
|
||||
* supporting DEBUG ONLY functionality.
|
||||
* The following APIs and definitions are to be used for debugging purposes ONLY.
|
||||
* They are not part of the official macsec APIs and are not intended for production systems.
|
||||
* Behavior when these APIs are invoked is not guaranteed to be valid
|
||||
* nor safe for normal operation and may have an impact on performance.
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 CONFIGURATION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#include <ipcom_type.h>
|
||||
#include <ipcom_cstyle.h>
|
||||
#ifdef IP_PORT_VWORKS
|
||||
#include <vsbConfig.h>
|
||||
#endif
|
||||
|
||||
#include "ipmacsec_h.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
#ifdef _WRS_CONFIG_IPMACSEC_DEBUG
|
||||
#ifndef IPMACSEC_DEBUG
|
||||
#define IPMACSEC_DEBUG
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#if defined(IP_DEBUG) || defined(IPMACSEC_DEBUG)
|
||||
#define IPMACSEC_USE_DUMP_PACKET
|
||||
#endif
|
||||
|
||||
#ifdef IPMACSEC_DEBUG
|
||||
/* Define/Undefine some/all of these do increase/reduce debug output */
|
||||
#undef IPMACSEC_DEBUG_SECY_INIT
|
||||
#undef IPMACSEC_DEBUG_SECY_CFG
|
||||
#undef IPMACSEC_DEBUG_SECY_CTRL
|
||||
#undef IPMACSEC_DEBUG_SECY_MGMT
|
||||
#undef IPMACSEC_DEBUG_SECY_MGMT_VERBOSE
|
||||
#undef IPMACSEC_DEBUG_SECY_IN_PROCESS
|
||||
#undef IPMACSEC_DEBUG_SECY_IN_PARSE
|
||||
#undef IPMACSEC_DEBUG_SECY_UCP_OUT
|
||||
#undef IPMACSEC_DEBUG_SECY_CP_OUT
|
||||
#undef IPMACSEC_DEBUG_SECY_OUT_PREP
|
||||
#undef IPMACSEC_DEBUG_IOCTL
|
||||
#undef IPMACSEC_DEBUG_CRYPTO
|
||||
#undef IPMACSEC_DEBUG_CRYPTO_PROTECT
|
||||
#undef IPMACSEC_DEBUG_CRYPTO_VALIDATE
|
||||
#undef IPMACSEC_DEBUG_CRYPTO_CIPH_GCMAES
|
||||
#undef IPMACSEC_DEBUG_CRYPTO_CIPH_GCMAES_DETAIL
|
||||
#undef IPMACSEC_DEBUG_NL
|
||||
#undef IPMACSEC_DEBUG_NL_VERBOSE
|
||||
#undef IPMACSEC_DEBUG_NL_BCAST
|
||||
#define IPMACSEC_DEBUG_CMD /* Recommend that this be kept on for debug builds */
|
||||
#undef IPMACSEC_DEBUG_CMD_PARSE
|
||||
|
||||
#undef IPMACSEC_DEBUG_DUMP_PKT
|
||||
|
||||
#else
|
||||
#undef IPMACSEC_DEBUG_SECY_INIT
|
||||
#undef IPMACSEC_DEBUG_SECY_CFG
|
||||
#undef IPMACSEC_DEBUG_SECY_CTRL
|
||||
#undef IPMACSEC_DEBUG_SECY_MGMT
|
||||
#undef IPMACSEC_DEBUG_SECY_MGMT_VERBOSE
|
||||
#undef IPMACSEC_DEBUG_SECY_IN_PROCESS
|
||||
#undef IPMACSEC_DEBUG_SECY_IN_PARSE
|
||||
#undef IPMACSEC_DEBUG_SECY_UCP_OUT
|
||||
#undef IPMACSEC_DEBUG_SECY_CP_OUT
|
||||
#undef IPMACSEC_DEBUG_SECY_OUT_PREP
|
||||
#undef IPMACSEC_DEBUG_IOCTL
|
||||
#undef IPMACSEC_DEBUG_CRYPTO
|
||||
#undef IPMACSEC_DEBUG_CRYPTO_PROTECT
|
||||
#undef IPMACSEC_DEBUG_CRYPTO_VALIDATE
|
||||
#undef IPMACSEC_DEBUG_CRYPTO_CIPH_GCMAES
|
||||
#undef IPMACSEC_DEBUG_CRYPTO_CIPH_GCMAES_DETAIL
|
||||
#undef IPMACSEC_DEBUG_NL
|
||||
#undef IPMACSEC_DEBUG_NL_VERBOSE
|
||||
#undef IPMACSEC_DEBUG_NL_BCAST
|
||||
#undef IPMACSEC_DEBUG_CMD
|
||||
#undef IPMACSEC_DEBUG_CMD_PARSE
|
||||
|
||||
#undef IPMACSEC_DEBUG_DUMP_PKT
|
||||
|
||||
#endif
|
||||
|
||||
|
||||
#ifdef IPMACSEC_DEBUG_DUMP_PKT
|
||||
#define IPMACSEC_DUMP_PKT ipmacsec_dump_packet
|
||||
#else
|
||||
#define IPMACSEC_DUMP_PKT(...) {}
|
||||
#endif
|
||||
|
||||
#ifdef IPMACSEC_UNIT_TEST
|
||||
#if !defined(_WRS_CONFIG_IPMACSEC_DEBUG) && !defined(IPMACSEC_DEBUG)
|
||||
#error Must Select IPMACSEC_DEBUG VSB component or define IPMACSEC_DEBUG to be able to enable IPMACSEC_UNIT_TEST
|
||||
#endif
|
||||
#warning IPMACSEC_UNIT_TEST SHOULD ONLY BE TURNED ON FOR UNIT TESTING
|
||||
#endif
|
||||
|
||||
#ifdef IPMACSEC_UNIT_TEST_INLINE_HARDCODED_CONFIG
|
||||
#ifndef IPMACSEC_UNIT_TEST
|
||||
#error IPMACSEC_UNIT_TEST must be defined before IPMACSEC_UNIT_TEST_INLINE_HARDCODED_CONFIG can be defined
|
||||
#endif
|
||||
#warning IPMACSEC_UNIT_TEST SHOULD ONLY BE TURNED ON FOR DEBUGGING PURPOSES ON NON_PRODUCTION SYSTEMS
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
IPMACSEC_PRIVATE void ipmacsec_dump_packet(char *desc, Ipcom_pkt *pkt);
|
||||
IPMACSEC_PRIVATE void ipmacsec_dump_buffer(IP_CONST char *desc, IP_CONST Ip_u8* buf, IP_CONST Ip_u32 len);
|
||||
|
||||
#ifdef IPMACSEC_UNIT_TEST
|
||||
IP_GLOBAL int ipmacsec_netlink_monitor_test(Ip_u32 timeout);
|
||||
IP_GLOBAL int ipmacsec_secy_monitor_test_start_daemon(char *ifname, Ip_u32 timeout);
|
||||
IP_GLOBAL int ipmacsec_netlink_test(void);
|
||||
IP_GLOBAL int ipmacsec_netlink_multi_test(char *ifname);
|
||||
IP_GLOBAL int ipmacsec_key_test(char *ifname);
|
||||
IP_GLOBAL int ipmacsec_ctrl_cmd_test(char *ifname);
|
||||
IP_GLOBAL int ipmacsec_sc_sa_test(char *ifname);
|
||||
IP_GLOBAL void ipmacsec_counter_format_test(void);
|
||||
IP_GLOBAL int ipmacsec_parse_sci_string_test(void);
|
||||
IP_GLOBAL int ipmacsec_secy_ucp_test(char *ifname, Ip_u32 num_expected_pkts, Ip_u32 timeout);
|
||||
IP_GLOBAL int ipmacsec_secy_ucp_test_start_daemon(char *ifname, Ip_u32 num_expected_pkts, Ip_u32 timeout);
|
||||
IP_GLOBAL Ip_u32 ipmacsec_secy_ucp_test_daemon_num_rcv_pkts(void);
|
||||
IP_GLOBAL Ipmacsec_lmi_error ipmacsec_lmi_secy_setup_ut_profile(char *ifname, Ip_u8 ut_profile_index);
|
||||
#endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
@@ -0,0 +1,280 @@
|
||||
/* ipmacsec.h - MACsec Private header file */
|
||||
/*
|
||||
* Copyright (c) 2010 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
01a,09feb10,mry Created
|
||||
*/
|
||||
#ifndef IPMACSEC_H_H
|
||||
#define IPMACSEC_H_H
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/* This header file is to be included by internal ipmacsec modules. */
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 CONFIGURATION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#include <ipcom_type.h>
|
||||
#include <ipcom_cstyle.h>
|
||||
|
||||
#include "ipnet_eth.h"
|
||||
#include "ipmacsec.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/* IPMACSEC_PRIVATE is used to differentiate functions that should ONLY be used
|
||||
* by other IPMACSEC module functions and not by any external modules.
|
||||
*/
|
||||
#define IPMACSEC_PRIVATE IP_GLOBAL
|
||||
|
||||
/* Current MACsec Protocol Version number */
|
||||
#define IPMACSEC_VERSION_NUMBER 0
|
||||
|
||||
/* Macros for manipulating the Controlled and Uncontrolled Port statistics */
|
||||
#define IPMACSEC_UCP_STATS(xvar) netif->uncontrolled_port->stats.xvar
|
||||
|
||||
#ifdef IPMACSEC_USE_STATS
|
||||
#define IPMACSEC_CP_STATS(xvar) netif->controlled_port->stats.xvar
|
||||
#define IPMACSEC_CP_STATS_SET(xvar,val) netif->controlled_port->stats.xvar = val
|
||||
#define IPMACSEC_CP_STATS_INC(xvar,inc) netif->controlled_port->stats.xvar +=(inc)
|
||||
#define IPMACSEC_SECY_STATS(xvar) secy->stats.xvar
|
||||
#define IPMACSEC_SECY_STAT_VAL(xvar) secy->stats.xvar
|
||||
#define IPMACSEC_SECY_STATS_INC(xvar,inc) secy->stats.xvar+=(inc)
|
||||
#define IPMACSEC_SC_STATS(xvar) sc->stats.xvar
|
||||
#define IPMACSEC_SC_STAT_VAL(xvar) sc->stats.xvar
|
||||
#define IPMACSEC_SC_STATS_INC(xvar,inc) sc->stats.xvar+=(inc)
|
||||
#define IPMACSEC_SA_STATS(xvar) sa->stats.xvar
|
||||
#define IPMACSEC_SA_STAT_VAL(xvar) sa->stats.xvar
|
||||
#define IPMACSEC_SA_STATS_INC(xvar,inc) sa->stats.xvar+=(inc)
|
||||
#else
|
||||
#define IPMACSEC_CP_STATS(xvar) IP_NOOP
|
||||
#define IPMACSEC_CP_STATS_SET(xvar,val) IP_NOOP
|
||||
#define IPMACSEC_CP_STATS_INC(xvar,inc) IP_NOOP
|
||||
#define IPMACSEC_SECY_STATS(xvar) IP_NOOP
|
||||
#define IPMACSEC_SECY_STAT_VAL(xvar) 0
|
||||
#define IPMACSEC_SECY_STATS_INC(xvar,inc) IP_NOOP
|
||||
#define IPMACSEC_SC_STATS(xvar) IP_NOOP
|
||||
#define IPMACSEC_SC_STAT_VAL(xvar) 0
|
||||
#define IPMACSEC_SC_STATS_INC(xvar,inc) IP_NOOP
|
||||
#define IPMACSEC_SA_STATS(xvar) IP_NOOP
|
||||
#define IPMACSEC_SA_STAT_VAL(xvar) 0
|
||||
#define IPMACSEC_SA_STATS_INC(xvar,inc) IP_NOOP
|
||||
#endif
|
||||
|
||||
/* Common Length definitions */
|
||||
#define IPMACSEC_MACADDRS_LEN (2*IPNET_ETH_ADDR_SIZE)
|
||||
#define IPMACSEC_PN_LEN 4 /* # of octets in the PN field */
|
||||
#define IPMACSEC_SECTAG_LEN sizeof(Ipnet_sectag)
|
||||
#define IPMACSEC_SECTAG_NOSCI_LEN (sizeof(Ipnet_sectag)-IPMACSEC_SCI_LEN)
|
||||
|
||||
#define IPMACSEC_MIN_ICV_LEN 8
|
||||
#define IPMACSEC_MIN_MPDU_LEN (IPMACSEC_SECTAG_NOSCI_LEN+1+IPMACSEC_MIN_ICV_LEN)
|
||||
#define IPMACSEC_0SL_MIN_MSDU_LEN 48 /* Minimum MSDU length when SL == 0 */
|
||||
#define IPMACSEC_0CBIT_ICV_LEN 16 /* ICV length when C bit == 0 */
|
||||
|
||||
/* Default threshold value for PN near exhaustion notification */
|
||||
#define IPMACSEC_SECY_DEFAULT_PN_THRESHOLD 0xFFFF0000
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
#include "ipcom_align16.h"
|
||||
/* Actual SecTAG header struct */
|
||||
typedef IP_PACKED1 struct Ipnet_sectag_struct {
|
||||
Ip_u16 ethType; /* Ethernet Type. Should be IPNET_ETHFRAME_MACSEC */
|
||||
Ip_u8 tci_an; /* Tag Control Information (bits8-3) + Association Number (bits2-1) */
|
||||
Ip_u8 sl; /* Short Length */
|
||||
Ip_u32 pn; /* Packet Number */
|
||||
Ip_u8 sci[IPMACSEC_SCI_LEN]; /* Secure Channel Identifier (optionally encoded) */
|
||||
}
|
||||
IP_PACKED2 Ipnet_sectag;
|
||||
#include "ipcom_align16.h"
|
||||
|
||||
#include "ipcom_align16.h"
|
||||
/* MACsec's Header overlay structure */
|
||||
typedef IP_PACKED1 struct Ipnet_pkt_macsec_struct {
|
||||
Ip_u8 dst[IPNET_ETH_ADDR_SIZE]; /* Destination address of the frame */
|
||||
Ip_u8 src[IPNET_ETH_ADDR_SIZE]; /* Source address of the fram */
|
||||
union {
|
||||
Ip_u16 ethType;
|
||||
Ipnet_sectag sectag;
|
||||
} d;
|
||||
}
|
||||
IP_PACKED2 Ipnet_pkt_macsec;
|
||||
#include "ipcom_align16.h"
|
||||
|
||||
/* MACsec's SecTAG representation */
|
||||
typedef struct Ipmacsec_sectag_struct {
|
||||
Ip_u16 ethType; /* Ethernet Type. Should be IPNET_ETHFRAME_MACSEC */
|
||||
Ip_u8 tci; /* Tag Control Information value */
|
||||
Ip_u8 version; /* Version value */
|
||||
Ip_bool es_bit; /* End Station bit */
|
||||
Ip_bool sc_bit; /* Secure Connection bit */
|
||||
Ip_bool scb_bit; /* Single Copy Broadcast bit */
|
||||
Ip_bool e_bit; /* Encryption bit */
|
||||
Ip_bool c_bit; /* Changed text bit */
|
||||
Ip_u32 pn; /* Packet Number (host order) */
|
||||
Ip_u8 sl; /* Short Length */
|
||||
Ip_u8 an; /* Association Number value */
|
||||
Ip_u8 sci[IPMACSEC_SCI_LEN]; /* Secure Channel Identifier (if sc_bit is TRUE) */
|
||||
Ip_u8 length; /* actual length of the SecTAG field */
|
||||
} Ipmacsec_sectag;
|
||||
|
||||
/* SAK container */
|
||||
typedef struct Ipmacsec_secy_sak_struct {
|
||||
Ip_u8 *buf; /* buffer contaning the SAK binary octets */
|
||||
Ip_u32 num_octets; /* size of the SAK buffer (# of octets) */
|
||||
} Ipmacsec_secy_sak;
|
||||
|
||||
/* Key structure used to convey the SAK */
|
||||
typedef struct Ipmacsec_secy_key_struct {
|
||||
Ipmacsec_secy_key_id key_id; /* Set by KaY. */
|
||||
Ipmacsec_secy_sak sak;
|
||||
Ip_bool inUse; /* tracks if key is already in use by an SA */
|
||||
Ip_bool transmits; /* Read ONLY value */
|
||||
Ip_bool receives; /* Read ONLY value */
|
||||
Ipmacsec_time createdTime; /* Read ONLY value */
|
||||
} Ipmacsec_secy_key;
|
||||
|
||||
/* Struct used for TX and RX SAs */
|
||||
typedef struct Ipmacsec_secy_sa_struct {
|
||||
Ip_u32 an; /* a value <= IPMACSEC_AN_MAX_VAL */
|
||||
Ip_bool inUse;
|
||||
Ip_u32 nextPN;
|
||||
Ip_u32 lowestPN; /* Applies for Rx SA only */
|
||||
Ipmacsec_secy_key *key;
|
||||
struct Ipmacsec_secy_sc_struct *sc; /* pointer back to SC parent of this SA. If not set, then SA is invalid */
|
||||
Ipmacsec_time createdTime, startedTime, stoppedTime;
|
||||
Ipmacsec_secy_sa_ref ref; /* A mgmt provided reference (10.7.13; 10.7.21) */
|
||||
Ipmacsec_secy_sa_ctrl ctrl; /* Set via LMI */
|
||||
Ip_bool confidentiality; /* Enable encryption (10.7.21) */
|
||||
Ip_u32 pn_threshold; /* Threshold used for sending notificationfor PN near exhaustion */
|
||||
Ip_bool pn_near_exhaust_notify; /* Flag used to track if notification was sent for PN near exhaustion */
|
||||
#ifdef IPMACSEC_USE_STATS
|
||||
Ipmacsec_secy_sa_stats stats;
|
||||
#endif
|
||||
} Ipmacsec_secy_sa; /* section 10.7 of 802.1AE */
|
||||
|
||||
/* Struct used for TX and RX SCs */
|
||||
typedef struct Ipmacsec_secy_sc_struct {
|
||||
Ip_bool enabled; /* set to TRUE when SC is enabled, otherwise non of the following fields have valid values */
|
||||
union {
|
||||
Ip_bool transmitting; /* Set by SecY when a tx SC is transmitting. READ only by external entities */
|
||||
Ip_bool receiving;/* Set by SecY when a rx SC is receiving. READ only by external entities */
|
||||
} oper;
|
||||
Ip_u32 encodingSA; /* a value <= IPMACSEC_AN_MAX_VAL. Used by Tx SC ONLY. (10.5.1) */
|
||||
Ip_u32 encipheringSA; /* a value <= IPMACSEC_AN_MAX_VAL. Used by Tx SC ONLY. (10.5.4) */
|
||||
Ipmacsec_dir dir; /* Indicates whether it is a TX or RX SC */
|
||||
Ipmacsec_time createdTime, startedTime, stoppedTime;
|
||||
Ip_u8 sci[IPMACSEC_SCI_LEN]; /* Set by KaY or management interface */
|
||||
Ipmacsec_secy_sa sa[IPMACSEC_MAX_SA];
|
||||
Ip_u32 numActiveRxSAs; /* Current # of active Rx SAs, i.e. SAs enabled for reception (must be <= maxRxKeys).
|
||||
* Used for internal tracking ONLY */
|
||||
#ifdef IPMACSEC_USE_STATS
|
||||
Ipmacsec_secy_sc_stats stats; /* Note that the "aggr" part of the stats stores only aggregate stats for deleted SAs,
|
||||
otherwise needs to be added to existing SA stats to determine latest SC stats (10.7.9; 10.7.18)*/
|
||||
#endif
|
||||
Ip_u32 oldAN, newAN; /* ANs for tracking interleaved SAs */
|
||||
Ip_u32 interleave_time; /* Time of reception of 1st interleaved frame in ms */
|
||||
struct Ipmacsec_crypto_if_struct *crypto; /* per SC crypto if */
|
||||
} Ipmacsec_secy_sc; /* section 10.7 of 802.1AE */
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_enable
|
||||
*===========================================================================
|
||||
* Description: Enable a SecY instance.
|
||||
* Parameters: secy - SecY instance pointer
|
||||
* Returns: 0 upon success, < 0 upon failure.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_enable(struct Ipnet_secy_struct *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_disable
|
||||
*===========================================================================
|
||||
* Description: Disable a SecY instance.
|
||||
* Parameters: secy - SecY instance pointer
|
||||
* Returns: 0 upon success, < 0 upon failure.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_disable(struct Ipnet_secy_struct *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_sak_copy
|
||||
*===========================================================================
|
||||
* Description: Create a copy of an SAK content
|
||||
* Parameters: to_sak - Valid pointer to SAK to copy to
|
||||
* from_sak - Valid pointer to SAK to copy from
|
||||
* Returns: 0 upon success, < 0 upon failure.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_sak_copy(Ipmacsec_secy_sak *to_sak, IP_CONST Ipmacsec_secy_sak *from_sak);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_sak_delete
|
||||
*===========================================================================
|
||||
* Description: SAK destructor
|
||||
* Parameters: sak - Valid pointer to SAK to delete
|
||||
* Returns: 0 upon success, < 0 upon failure.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_sak_delete(Ipmacsec_secy_sak *sak);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
@@ -0,0 +1,219 @@
|
||||
/* ipmacsec_ioctl.c - MACsec Ioctl implementation */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2010 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
01a,15feb10,mry Created
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
/*
|
||||
* Implements MACsec Ioctl handlers and interface fns.
|
||||
* This is provided for legacy reasons only. The main interface to MACsec
|
||||
* SecY is via Netlink.
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#define IPCOM_USE_CLIB_PROTO
|
||||
#include <ipcom_type.h>
|
||||
#include <ipcom_cstyle.h>
|
||||
#include <ipcom_clib.h>
|
||||
#include <ipcom_err.h>
|
||||
#include <ipcom_sock.h>
|
||||
#include <ipcom_syslog.h>
|
||||
#include <ipcom_sysvar.h>
|
||||
#include <ipcom_errno.h>
|
||||
#include <ipcom_err.h>
|
||||
#include <ipcom_os.h>
|
||||
#include <ipcom_ipd.h>
|
||||
#include <ipcom_os.h>
|
||||
#include <ipcom_sock.h>
|
||||
|
||||
#include "ipmacsec_debug.h"
|
||||
#include "ipmacsec_h.h"
|
||||
#include "ipmacsec.h"
|
||||
#include "ipmacsec_ioctl.h"
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 CONFIGURATION
|
||||
****************************************************************************
|
||||
*/
|
||||
#include "ipmacsec_config.h"
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 EXTERN PROTOTYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 7 LOCAL PROTOTYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
IP_GLOBAL int ipmacsec_ioctl(Ipnet_netif *netif, Ip_u32 request, void *data);
|
||||
|
||||
/*
|
||||
*
|
||||
****************************************************************************
|
||||
* 8 DATA
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 9 STATIC FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 10 PRIVATE FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_ioctl
|
||||
*===========================================================================
|
||||
* Description: MACsec Ioctl handler.
|
||||
* Only supports the SecY Enable/Disable operations
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, < 0 upon failure.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_ioctl(Ipnet_netif *netif, Ip_u32 request, void *data) {
|
||||
struct Ip_secyreq *secyreq;
|
||||
Ipmacsec_ioctl_cmd cmd;
|
||||
|
||||
ip_assert(netif);
|
||||
|
||||
if (request != IP_SIOCXSECY) {
|
||||
#ifdef IPMACSEC_DEBUG_IOCTL
|
||||
IPCOM_LOG1(ERR, "ipmacsec_ioctl :: request 0x%x != IP_SIOCXSECY ", request);
|
||||
#endif
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (!netif->secy) {
|
||||
#ifdef IPMACSEC_DEBUG_IOCTL
|
||||
IPCOM_LOG1(ERR, "ipmacsec_ioctl :: Null secy for interface %s", netif->ipcom.name);
|
||||
#endif
|
||||
return -1;
|
||||
}
|
||||
secyreq = (struct Ip_secyreq *)data;
|
||||
#ifdef IPMACSEC_DEBUG_IOCTL
|
||||
IPCOM_LOG6(DEBUG2, "MACSEC-IOCTL: interface %s, command %u, data %.2x %.2x %.2x %.2x",
|
||||
netif->ipcom.name, secyreq->command, secyreq->data[0], secyreq->data[1], secyreq->data[2], secyreq->data[3]);
|
||||
#endif
|
||||
cmd = (Ipmacsec_ioctl_cmd)secyreq->command;
|
||||
|
||||
switch (cmd) {
|
||||
case IPMACSEC_IOCTL_CMD_SECY_ENABLE:
|
||||
return ipmacsec_secy_enable(netif->secy);
|
||||
case IPMACSEC_IOCTL_CMD_SECY_DISABLE:
|
||||
return ipmacsec_secy_disable(netif->secy);
|
||||
default:
|
||||
#ifdef IPMACSEC_DEBUG_IOCTL
|
||||
IPCOM_LOG1(ERR, "ipmacsec_ioctl ::Unrecognized MACsec Ioctl cmd %u", cmd);
|
||||
#endif
|
||||
break;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 11 PUBLIC FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_send_ioctl
|
||||
*===========================================================================
|
||||
* Description: see "ipmacsec_ioctl.h"
|
||||
* Parameters:
|
||||
* Returns:
|
||||
*
|
||||
*/
|
||||
IP_PUBLIC int
|
||||
ipmacsec_send_ioctl(char *ifname, Ip_u32 command, Ip_u8 *data, Ip_u32 datalen) {
|
||||
int rc = 0, sock = IP_INVALID_SOCKET;
|
||||
struct Ip_secyreq secyreq;
|
||||
|
||||
if (data && (datalen > sizeof(secyreq.data))) {
|
||||
#ifdef IPMACSEC_DEBUG_IOCTL
|
||||
IPCOM_LOG2(ERR, "ipmacsec_send_ioctl :: datalen too large (%u > %u)\n", datalen, sizeof(secyreq.data));
|
||||
#endif
|
||||
return -1;
|
||||
}
|
||||
if (datalen && !data) {
|
||||
#ifdef IPMACSEC_DEBUG_IOCTL
|
||||
IPCOM_LOG0(ERR, "ipmacsec_send_ioctl :: Null data");
|
||||
#endif
|
||||
return -1;
|
||||
}
|
||||
|
||||
ipcom_memset(&secyreq, 0, sizeof(secyreq));
|
||||
|
||||
ipcom_strncpy(secyreq.if_name, ifname, IP_IFNAMSIZ);
|
||||
secyreq.if_name[IP_IFNAMSIZ-1] = '\0';
|
||||
secyreq.command = command;
|
||||
ipcom_memcpy(secyreq.data, data, datalen);
|
||||
sock = ipcom_socket(IP_PF_PACKET, IP_SOCK_RAW, 0);
|
||||
if (sock == IP_INVALID_SOCKET) {
|
||||
#ifdef IPMACSEC_DEBUG_IOCTL
|
||||
IPCOM_LOG1(ERR, "ipmacsec_send_ioctl :: ipcom_socket() failed, errno: %d\n", ipcom_errno);
|
||||
#endif
|
||||
return -1;
|
||||
}
|
||||
|
||||
if ((rc = ipcom_socketioctl(sock, IP_SIOCXSECY, &secyreq)) < 0) {
|
||||
#ifdef IPMACSEC_DEBUG_IOCTL
|
||||
int errno = *ipcom_errno_get();
|
||||
IPCOM_LOG2(ERR, "ipmacsec_send_ioctl :: ioctl(IP_SIOCXSECY) failed (%d: %s)",
|
||||
errno, ipcom_strerror(errno));
|
||||
#endif
|
||||
}
|
||||
|
||||
ipcom_socketclose(sock);
|
||||
return rc;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,99 @@
|
||||
/* ipmacsec_ioctl.h - IPMACSEC IOCTL header file */
|
||||
/*
|
||||
* Copyright (c) 2010 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
01a,15feb10,mry Created
|
||||
*/
|
||||
#ifndef IPMACSEC_IOCTL_H
|
||||
#define IPMACSEC_IOCTL_H
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 CONFIGURATION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#include <ipcom_type.h>
|
||||
#include <ipcom_cstyle.h>
|
||||
#ifdef IP_PORT_VWORKS
|
||||
#include <vsbConfig.h>
|
||||
#endif
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
typedef enum {
|
||||
IPMACSEC_IOCTL_CMD_SECY_DISABLE,
|
||||
IPMACSEC_IOCTL_CMD_SECY_ENABLE
|
||||
} Ipmacsec_ioctl_cmd;
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_send_ioctl
|
||||
*===========================================================================
|
||||
* Description: API used by SecY LMI to send MACsec SecY Ioctl commands
|
||||
* Parameters: ifname - Interface name
|
||||
* command - Ipmacsec_ioctl_cmd to send
|
||||
* data - Pointer to associated command data (if any)
|
||||
* datalen - Length of command data
|
||||
* Returns: 0 upon success, < 0 upon failure.
|
||||
*
|
||||
*/
|
||||
IP_PUBLIC int
|
||||
ipmacsec_send_ioctl(char *ifname, Ip_u32 command, Ip_u8 *data, Ip_u32 datalen);
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,554 @@
|
||||
/* ipmacsec_secy_mgmt.h - IPMACSEC SecY Management header file */
|
||||
/*
|
||||
* Copyright (c) 2010 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
01a,24feb10,mry Created
|
||||
*/
|
||||
#ifndef IPMACSEC_SECY_MGMT_H
|
||||
#define IPMACSEC_SECY_MGMT_H
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 CONFIGURATION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#include <ipcom_type.h>
|
||||
#include <ipcom_cstyle.h>
|
||||
#ifdef IP_PORT_VWORKS
|
||||
#include <vsbConfig.h>
|
||||
#endif
|
||||
|
||||
#include "ipmacsec_h.h"
|
||||
#include "ipmacsec_lmi.h"
|
||||
|
||||
#include "ipmacsec_debug.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
#define IPMACSEC_SECY_MAC_OPER_OFF IP_TRUE
|
||||
#define IPMACSEC_SECY_MAC_OPER_DEFAULT IP_FALSE
|
||||
|
||||
#ifndef IP_LOGICAL_XOR
|
||||
#define IP_LOGICAL_XOR(x,y) (((x) || (y)) && !((x) && (y)))
|
||||
#endif
|
||||
|
||||
/* Compare Controlled or Uncontrolled port status to that of Common Port to determine
|
||||
* if it may have changed.
|
||||
*/
|
||||
#define IPMACSEC_SECY_PORT_STATUS_CHANGED(secy, port) \
|
||||
(IP_LOGICAL_XOR(port.status.mac_enabled, IP_BIT_ISSET(secy->netif->ipcom.flags, IP_IFF_UP)) || \
|
||||
IP_LOGICAL_XOR(port.status.mac_oper, IP_BIT_ISSET(secy->netif->ipcom.flags, IP_IFF_RUNNING)))
|
||||
|
||||
|
||||
/* Convenience macro for when notification result is irrelevant and no params are being passed */
|
||||
#define IPMACSEC_SECY_STATUS_NOTIFY(secy,status) (void)ipmacsec_secy_status_notify((secy), (status), IP_NULL, IP_NULL)
|
||||
#define IPMACSEC_SECY_INFO_NOTIFY(secy, info) (void)ipmacsec_secy_info_notify((secy), (info), IP_NULL, IP_NULL)
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_keydb_init
|
||||
*===========================================================================
|
||||
* Description: Initialize the SecY Key database
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_keydb_init(Ipnet_secy *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_keydb_destroy
|
||||
*===========================================================================
|
||||
* Description: Destroy the SecY Key database
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_keydb_destroy(Ipnet_secy *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_ucp_update_status_ext
|
||||
*===========================================================================
|
||||
* Description: Externally registered API to update the Uncontrolled Port status
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_ucp_update_status_ext(struct Ipnet_netif_struct *netif);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_ucp_update_statistics
|
||||
*===========================================================================
|
||||
* Description: Update the Uncontrolled Port Statistics
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_ucp_update_statistics(struct Ipnet_netif_struct *netif);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_ucp_update_status
|
||||
*===========================================================================
|
||||
* Description: Update the Uncontrolled Port Status
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_ucp_update_status(Ipnet_secy *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_cp_update_status_ext
|
||||
*===========================================================================
|
||||
* Description: Externally registered API to update the Controlled Port Status
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_cp_update_status_ext(struct Ipnet_netif_struct *netif);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_cp_update_statistics
|
||||
*===========================================================================
|
||||
* Description: Update Controlled Port Statistics
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_cp_update_statistics(struct Ipnet_netif_struct *netif);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_cp_update_status
|
||||
*===========================================================================
|
||||
* Description: Update Controlled Port Status
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_cp_update_status(Ipnet_secy *secy, Ip_bool mac_oper_off);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_create_tx_sc
|
||||
*===========================================================================
|
||||
* Description: Create the TX SC
|
||||
* Parameters:
|
||||
* Returns: Pointer to the created SC if successful,
|
||||
* IP_NULL otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_sc *
|
||||
ipmacsec_secy_create_tx_sc(Ipnet_secy *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_delete_tx_sc
|
||||
*===========================================================================
|
||||
* Description: Delete the TX SC
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_delete_tx_sc(Ipnet_secy *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_create_tx_sa
|
||||
*===========================================================================
|
||||
* Description: Create a TX SA
|
||||
* Parameters:
|
||||
* Returns: Pointer to the created SA if successful,
|
||||
* IP_NULL otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_sa *
|
||||
ipmacsec_secy_create_tx_sa(Ipnet_secy *secy, Ip_u8 an, Ipmacsec_secy_sa_ref ref,
|
||||
Ip_u32 nextPN, Ipmacsec_confidentiality confidentiality,
|
||||
Ipmacsec_secy_key *key);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_delete_tx_sa
|
||||
*===========================================================================
|
||||
* Description: Delete a TX SA
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_delete_tx_sa(Ipnet_secy *secy, Ipmacsec_secy_sa *sa);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_enable_tx_sa
|
||||
*===========================================================================
|
||||
* Description: Enable/Disable Tx SA (set enableTransmit accordingly)
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_enable_tx_sa(Ipnet_secy *secy, Ipmacsec_secy_sa *sa, Ip_bool enableTransmit);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_create_rx_sc
|
||||
*===========================================================================
|
||||
* Description: Create an RX SC
|
||||
* Parameters:
|
||||
* Returns: Pointer to the created SC if successful,
|
||||
* IP_NULL otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_sc *
|
||||
ipmacsec_secy_create_rx_sc(Ipnet_secy *secy, IP_CONST Ip_u8 *sci);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_delete_rx_sc
|
||||
*===========================================================================
|
||||
* Description: Delete an RX SC
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_delete_rx_sc(Ipnet_secy *secy, Ipmacsec_secy_sc *sc);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_delete_rx_sc_all
|
||||
*===========================================================================
|
||||
* Description: Delete all RX SCs for this SecY
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_delete_rx_sc_all(Ipnet_secy *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_create_rx_sa
|
||||
*===========================================================================
|
||||
* Description: Create an RX SA
|
||||
* Parameters:
|
||||
* Returns: Pointer to the created SA if successful,
|
||||
* IP_NULL otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_sa *
|
||||
ipmacsec_secy_create_rx_sa(Ipnet_secy *secy, Ipmacsec_secy_sc *sc,
|
||||
Ip_u8 an, Ipmacsec_secy_sa_ref ref, Ip_u32 nextPN,
|
||||
Ip_u32 lowestPN, Ipmacsec_secy_key *key);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_delete_rx_sa
|
||||
*===========================================================================
|
||||
* Description: Delete an RX SA
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_delete_rx_sa(Ipnet_secy *secy, Ipmacsec_secy_sa *sa);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_enable_rx_sa
|
||||
*===========================================================================
|
||||
* Description: Enable/Disable Rx SA (according to enableReceive)
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_enable_rx_sa(Ipnet_secy *secy, Ipmacsec_secy_sa *sa, Ip_bool enableReceive);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_update_rx_sa
|
||||
*===========================================================================
|
||||
* Description: Update Rx SA nextPN and/or lowestPN based on provided values.
|
||||
* Invoked via LMI trigger.
|
||||
* Parameters: nextPN, lowestPN value of 0 means do not update
|
||||
* Returns: 0 upon success, <0 upon error.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_update_rx_sa(Ipnet_secy *secy, Ipmacsec_secy_sa *sa,
|
||||
Ip_u32 nextPN, Ip_u32 lowestPN);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_create_key
|
||||
*===========================================================================
|
||||
* Description: Create an SAK
|
||||
* Parameters:
|
||||
* Returns: Pointer to the created key upon success,
|
||||
* IP_NULL upon failure.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_key *
|
||||
ipmacsec_secy_create_key(Ipnet_secy *secy, Ipmacsec_secy_sak *sak,
|
||||
Ipmacsec_secy_key_id *key_id);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_delete_key
|
||||
*===========================================================================
|
||||
* Description: Delete an SAK
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_delete_key(Ipnet_secy *secy, Ipmacsec_secy_key *key);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_install_key
|
||||
*===========================================================================
|
||||
* Description: Install an SAK
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_install_key(Ipnet_secy *secy,
|
||||
Ipmacsec_secy_key *key, Ipmacsec_keytype keytype);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_remove_key
|
||||
*===========================================================================
|
||||
* Description: Remove an SAK
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_key *
|
||||
ipmacsec_secy_remove_key(Ipnet_secy *secy, Ipmacsec_secy_key_id *key_id);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_delete_all_keys
|
||||
*===========================================================================
|
||||
* Description: Delete all SAKs for this SecY
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_delete_all_keys(Ipnet_secy *secy, Ip_bool ignore_in_use);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_get_tx_sc
|
||||
*===========================================================================
|
||||
* Description: Retrieve the TX SC for this SecY
|
||||
* Parameters:
|
||||
* Returns: Pointer to the TX SC if successful,
|
||||
* IP_NULL otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_sc *
|
||||
ipmacsec_secy_get_tx_sc(Ipnet_secy *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_get_tx_sa
|
||||
*===========================================================================
|
||||
* Description: Retrieve the current transmit SA
|
||||
* Parameters:
|
||||
* Returns: Pointer to the SA if successful,
|
||||
* IP_NULL otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_sa *
|
||||
ipmacsec_secy_get_tx_sa(Ipnet_secy *secy);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_lookup_tx_sa
|
||||
*===========================================================================
|
||||
* Description: Lookup a transmit SA based on the specified AN
|
||||
* Parameters:
|
||||
* Returns: Pointer to the SA if successful,
|
||||
* IP_NULL otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_sa *
|
||||
ipmacsec_secy_lookup_tx_sa(Ipnet_secy *secy, IP_CONST Ip_u8 an);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_lookup_rx_sc
|
||||
*===========================================================================
|
||||
* Description: Lookup an RX SC based on the specified SCI
|
||||
* Parameters:
|
||||
* Returns: Pointer to the SC if successful,
|
||||
* IP_NULL otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_sc *
|
||||
ipmacsec_secy_lookup_rx_sc(Ipnet_secy *secy, IP_CONST Ip_u8 *sci);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_lookup_rx_sa
|
||||
*===========================================================================
|
||||
* Description: Lookup an RX SA based on the specified SC+AN
|
||||
* Parameters:
|
||||
* Returns: Pointer to the SA if successful,
|
||||
* IP_NULL otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_sa *
|
||||
ipmacsec_secy_lookup_rx_sa(Ipnet_secy *secy, Ipmacsec_secy_sc *sc, IP_CONST Ip_u8 an);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_lookup_rx_sa_sai
|
||||
*===========================================================================
|
||||
* Description: Lookup an RX SA based on the specified SAI=SCI+AN
|
||||
* Parameters:
|
||||
* Returns: Pointer to the SA if successful,
|
||||
* IP_NULL otherwise.
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE Ipmacsec_secy_sa *
|
||||
ipmacsec_secy_lookup_rx_sa_sai(Ipnet_secy *secy, IP_CONST Ip_u8 *sci, IP_CONST Ip_u8 an);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_check_rx_sa_interleave
|
||||
*===========================================================================
|
||||
* Description: Check whether interleaving is allowed on this RX SA (7.1.3)
|
||||
* Parameters:
|
||||
* Returns: 0 if frame should be accepted on this SA, < 0 if frame should be dropped
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_check_rx_sa_interleave(Ipnet_secy *secy, Ipmacsec_secy_sa *sa);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_cp_enable
|
||||
*===========================================================================
|
||||
* Description: Enable the SecY Controlled Port.
|
||||
* Called from LMI trigger
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_cp_enable(Ipnet_secy *secy, Ip_bool enable);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_cp_set_adminP2pMac
|
||||
*===========================================================================
|
||||
* Description: Set the SecY Controlled Port AdminPointToPointMAC.
|
||||
* Called from LMI trigger
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_cp_set_adminP2pMac(Ipnet_secy *secy, Ip_portif_admin_ptp_mac_val admin_p2p_mac);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_status_notify
|
||||
*===========================================================================
|
||||
* Description: Notify via LMI of SecY status changes.
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_status_notify(Ipnet_secy *secy, Ipmacsec_secy_status status, void *param, Ip_u32 param_size);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipmacsec_secy_info_notify
|
||||
*===========================================================================
|
||||
* Description: Notify via LMI of SecY informational events
|
||||
* (Only turned on during debugging).
|
||||
* Parameters:
|
||||
* Returns: 0 upon success, <0 upon error
|
||||
*
|
||||
*/
|
||||
IPMACSEC_PRIVATE int
|
||||
ipmacsec_secy_info_notify(Ipnet_secy *secy, Ipmacsec_secy_info info, void *param, Ip_u32 param_size);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
Reference in New Issue
Block a user