/* ipmacsec_crypto_if.h - IPMACSEC Crypto Interface header file */ /* * Copyright (c) 2010 Wind River Systems, Inc. * * The right to copy, distribute, modify, or otherwise make use * of this software may be licensed only pursuant to the terms * of an applicable Wind River license agreement. * */ /* modification history -------------------- 01a,19feb10,mry Created */ #ifndef IPMACSEC_CRYPTO_IF_H #define IPMACSEC_CRYPTO_IF_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #include #include #ifdef IP_PORT_VWORKS #include #endif #include "ipmacsec_h.h" #include "ipmacsec.h" #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 DEFINES **************************************************************************** */ /* **************************************************************************** * 5 TYPES **************************************************************************** */ /* Crypto context passed to the crypto validate and protect fucntions */ typedef struct { Ip_u8 sci[IPMACSEC_SCI_LEN]; Ip_u8 *macsec_hdr; /* ptr to concatenated DA, SA and SecTAG fields */ Ip_u8 *userdata; /* Set to pointer to data to encrypt, or will return pointer to decrypted data */ Ip_u8 *securedata; /* Set to pointer to data to decrypt, or will return pointer to encrypted data */ Ip_u8 *icv; /* ICV value to validate, or ptr to buffer to copy generated ICV into */ Ip_u32 pn; /* Packet Number */ Ip_u8 macsec_hdr_len; /* aggregate size of DA, SA and SecTAG fields (in octets) */ Ip_u8 icv_len; /* in octets; size of ICV to validate, or size of buffer to copy generated ICV into */ Ip_u16 userdata_len; /* in octets; Set to len of data to encrypt, or will return len of decrypted data */ Ip_u16 securedata_len; /* in octets; Set to len of data to decrypt, or will return len of encrypted data */ Ip_u16 key_index; /* corresponds to tx/rx SA AN */ union { Ip_bool encrypt; /* Set to encrypt userdata in addition to ICV generation */ Ip_bool decrypt; /* Set to decrypt userdata in addition to ICV validation */ } oper; } Ipmacsec_crypto_ctx; /* Crypto interface structure definition * ===================================== * Usage: * ----- * - One crypto_if per SC is created using ipmacsec_crypto_create() when the SC is created and * destroyed with ipmacsec_crypto_delete() when the SC is deleted * - init_cipher() is called when an SA is created for the corresponding SC. * The AN for that SA is passed as a key_index and the corresponding SAK is also specified. * - destroy_cipher() is called when an SA is deleted for the corresponding SC. * The AN for that SA is passed as a key_index. * - protect() and validate() are called whenever a frames needs to be protected or validated for * the SC corresponding to this crypto_if. The Ipmacsec_crypto_ctx MUST be updated with the proper * fields, including the key_index which equals the AN for the SA that is processing the frame. * - Non private members of this structure are READ ONLY values for entities external to the crypto_if. * - Private members of this structure MUST NOT be ACCESSED by entities external to the crypto_if. */ typedef struct Ipmacsec_crypto_if_struct { Ip_bool valid; /* Set when Crypto If is properly instantiated */ Ip_bool cipher_set; /* Set when a cipher is selected */ Ip_u16 icvbits; /* ICV length (in bits) of selected cipher suite */ Ip_u16 gcmaes_accel_level; /* The AES-GCM acceleration level to use for this crypto if (when gcm-aes-128 is used) */ Ip_bool changesDataLength; /* selected cipher suite changes data length upon protection/validation */ Ip_u32 confidentialityOffset; /* # of octets to be used as offset for Confidentiality (default is 0)*/ int (* init_cipher)(struct Ipmacsec_crypto_if_struct *crypto, Ip_u8 key_index, Ipmacsec_secy_sak *sak); int (* destroy_cipher)(struct Ipmacsec_crypto_if_struct *crypto, Ip_u8 key_index); int (* protect)(struct Ipmacsec_crypto_if_struct *crypto, Ipmacsec_crypto_ctx *ctx); int (* validate)(struct Ipmacsec_crypto_if_struct *crypto, Ipmacsec_crypto_ctx *ctx, Ip_bool *valid); struct { Ipnet_secy *secy; /* backpointer to SecY */ struct Ipmacsec_crypto_cipher_struct IP_CONST *cipher; /* Cipher pointer */ void *cs_ctx[IPMACSEC_MAX_SA]; /* cipher specific context */ Ip_u8 *result_buf; /* buffer used to store temporary crypto results */ Ip_u32 result_buf_len; /* length of buffer used to store temporary crypto results */ Ipmacsec_secy_sak sak[IPMACSEC_MAX_SA]; /* SAKs to be used by this crypto i/f */ } priv; /* Private members */ } Ipmacsec_crypto_if; /* **************************************************************************** * 6 FUNCTIONS **************************************************************************** */ /* *=========================================================================== * ipmacsec_crypto_cipher_suite_supported *=========================================================================== * Description: Verify if a cipher suite is supported by our MACsec implementation * Parameters: cipher_suite_index - Cipher Suite index * Returns: IP_TRUE is the cipher suite is supported, IP_FALSE otherwise. * */ IPMACSEC_PRIVATE Ip_bool ipmacsec_crypto_cipher_suite_supported(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index); /* *=========================================================================== * ipmacsec_crypto_cipher_suite_get_info *=========================================================================== * Description: Retrieve detailed information about a supported cipher suite * Parameters: cipher_suite_index - Cipher Suite index * Returns: 0 if successful, < 0 otherwise * */ IPMACSEC_PRIVATE int ipmacsec_crypto_cipher_suite_get_info(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index, Ipmacsec_ciphersuite_descriptor *info); /* *=========================================================================== * ipmacsec_crypto_cipher_suite_id_resolve *=========================================================================== * Description: Resolve the Cipher Suite ID from a specified cipher_suite_index * Parameters: cipher_suite_index - cipher_suite_index value to resolve * cipher_suite_id - pointer to variable to hold the resolved * Cipher Suite ID * Returns: 0 upon success, <0 on error * */ IPMACSEC_PRIVATE int ipmacsec_crypto_cipher_suite_id_resolve(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index, Ip_u8 *cipher_suite_id) ; /* *=========================================================================== * ipmacsec_crypto_cipher_suite_name *=========================================================================== * Description: Return the name of the specified Cipher Suite * Parameters: cipher_suite_index - index of Cipher Suite whose name to return * Returns: Pointer to string containing the Cipher Suite name (never null). * */ IPMACSEC_PRIVATE IP_CONST char * ipmacsec_crypto_cipher_suite_name(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index); /* *=========================================================================== * ipmacsec_crypto_cipher_suite_index_resolve *=========================================================================== * Description: Resolve the Cipher Suite Index from a specified cipher_suite_id * Parameters: cipher_suite_id - Cipher Suite ID value to resolve * cipher_suite_index - pointer to variable to hold the resolved * cipher_suite_index * Returns: 0 upon success, <0 on error * */ IPMACSEC_PRIVATE int ipmacsec_crypto_cipher_suite_index_resolve(IP_CONST Ip_u8 *cipher_suite_id, Ipmacsec_cipher_suite_index *cipher_suite_index); /* *=========================================================================== * ipmacsec_crypto_get_icvbits *=========================================================================== * Description: Retrieve # of ICV bits for currently configured SecY cipher * Parameters: secy - SecY pointer * Returns: > 0 if successful, 0 otherwise. * */ IPMACSEC_PRIVATE Ip_u16 ipmacsec_crypto_get_icvbits(Ipnet_secy *secy); /* *=========================================================================== * ipmacsec_crypto_create *=========================================================================== * Description: Crypto Interface constructor * Parameters: secy - SecY pointer * Returns: Pointer to created crypto_if structure upon success, IP_NULL otherwise * */ IPMACSEC_PRIVATE Ipmacsec_crypto_if * ipmacsec_crypto_create(Ipnet_secy *secy); /* *=========================================================================== * ipmacsec_crypto_delete *=========================================================================== * Description: Crypto Interface desstructor * Parameters: secy - SecY pointer * crypto - pointer to crypto_if structure to delete * Returns: 0 upon success, <0 on error * */ IPMACSEC_PRIVATE int ipmacsec_crypto_delete(Ipnet_secy *secy, Ipmacsec_crypto_if *crypto); #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */