/* ipmacsec.h - MACsec Private header file */ /* * Copyright (c) 2010 Wind River Systems, Inc. * * The right to copy, distribute, modify, or otherwise make use * of this software may be licensed only pursuant to the terms * of an applicable Wind River license agreement. * */ /* modification history -------------------- 01a,09feb10,mry Created */ #ifndef IPMACSEC_H_H #define IPMACSEC_H_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* This header file is to be included by internal ipmacsec modules. */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #include #include #include "ipnet_eth.h" #include "ipmacsec.h" #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 DEFINES **************************************************************************** */ /* IPMACSEC_PRIVATE is used to differentiate functions that should ONLY be used * by other IPMACSEC module functions and not by any external modules. */ #define IPMACSEC_PRIVATE IP_GLOBAL /* Current MACsec Protocol Version number */ #define IPMACSEC_VERSION_NUMBER 0 /* Macros for manipulating the Controlled and Uncontrolled Port statistics */ #define IPMACSEC_UCP_STATS(xvar) netif->uncontrolled_port->stats.xvar #ifdef IPMACSEC_USE_STATS #define IPMACSEC_CP_STATS(xvar) netif->controlled_port->stats.xvar #define IPMACSEC_CP_STATS_SET(xvar,val) netif->controlled_port->stats.xvar = val #define IPMACSEC_CP_STATS_INC(xvar,inc) netif->controlled_port->stats.xvar +=(inc) #define IPMACSEC_SECY_STATS(xvar) secy->stats.xvar #define IPMACSEC_SECY_STAT_VAL(xvar) secy->stats.xvar #define IPMACSEC_SECY_STATS_INC(xvar,inc) secy->stats.xvar+=(inc) #define IPMACSEC_SC_STATS(xvar) sc->stats.xvar #define IPMACSEC_SC_STAT_VAL(xvar) sc->stats.xvar #define IPMACSEC_SC_STATS_INC(xvar,inc) sc->stats.xvar+=(inc) #define IPMACSEC_SA_STATS(xvar) sa->stats.xvar #define IPMACSEC_SA_STAT_VAL(xvar) sa->stats.xvar #define IPMACSEC_SA_STATS_INC(xvar,inc) sa->stats.xvar+=(inc) #else #define IPMACSEC_CP_STATS(xvar) IP_NOOP #define IPMACSEC_CP_STATS_SET(xvar,val) IP_NOOP #define IPMACSEC_CP_STATS_INC(xvar,inc) IP_NOOP #define IPMACSEC_SECY_STATS(xvar) IP_NOOP #define IPMACSEC_SECY_STAT_VAL(xvar) 0 #define IPMACSEC_SECY_STATS_INC(xvar,inc) IP_NOOP #define IPMACSEC_SC_STATS(xvar) IP_NOOP #define IPMACSEC_SC_STAT_VAL(xvar) 0 #define IPMACSEC_SC_STATS_INC(xvar,inc) IP_NOOP #define IPMACSEC_SA_STATS(xvar) IP_NOOP #define IPMACSEC_SA_STAT_VAL(xvar) 0 #define IPMACSEC_SA_STATS_INC(xvar,inc) IP_NOOP #endif /* Common Length definitions */ #define IPMACSEC_MACADDRS_LEN (2*IPNET_ETH_ADDR_SIZE) #define IPMACSEC_PN_LEN 4 /* # of octets in the PN field */ #define IPMACSEC_SECTAG_LEN sizeof(Ipnet_sectag) #define IPMACSEC_SECTAG_NOSCI_LEN (sizeof(Ipnet_sectag)-IPMACSEC_SCI_LEN) #define IPMACSEC_MIN_ICV_LEN 8 #define IPMACSEC_MIN_MPDU_LEN (IPMACSEC_SECTAG_NOSCI_LEN+1+IPMACSEC_MIN_ICV_LEN) #define IPMACSEC_0SL_MIN_MSDU_LEN 48 /* Minimum MSDU length when SL == 0 */ #define IPMACSEC_0CBIT_ICV_LEN 16 /* ICV length when C bit == 0 */ /* Default threshold value for PN near exhaustion notification */ #define IPMACSEC_SECY_DEFAULT_PN_THRESHOLD 0xFFFF0000 /* **************************************************************************** * 5 TYPES **************************************************************************** */ #include "ipcom_align16.h" /* Actual SecTAG header struct */ typedef IP_PACKED1 struct Ipnet_sectag_struct { Ip_u16 ethType; /* Ethernet Type. Should be IPNET_ETHFRAME_MACSEC */ Ip_u8 tci_an; /* Tag Control Information (bits8-3) + Association Number (bits2-1) */ Ip_u8 sl; /* Short Length */ Ip_u32 pn; /* Packet Number */ Ip_u8 sci[IPMACSEC_SCI_LEN]; /* Secure Channel Identifier (optionally encoded) */ } IP_PACKED2 Ipnet_sectag; #include "ipcom_align16.h" #include "ipcom_align16.h" /* MACsec's Header overlay structure */ typedef IP_PACKED1 struct Ipnet_pkt_macsec_struct { Ip_u8 dst[IPNET_ETH_ADDR_SIZE]; /* Destination address of the frame */ Ip_u8 src[IPNET_ETH_ADDR_SIZE]; /* Source address of the fram */ union { Ip_u16 ethType; Ipnet_sectag sectag; } d; } IP_PACKED2 Ipnet_pkt_macsec; #include "ipcom_align16.h" /* MACsec's SecTAG representation */ typedef struct Ipmacsec_sectag_struct { Ip_u16 ethType; /* Ethernet Type. Should be IPNET_ETHFRAME_MACSEC */ Ip_u8 tci; /* Tag Control Information value */ Ip_u8 version; /* Version value */ Ip_bool es_bit; /* End Station bit */ Ip_bool sc_bit; /* Secure Connection bit */ Ip_bool scb_bit; /* Single Copy Broadcast bit */ Ip_bool e_bit; /* Encryption bit */ Ip_bool c_bit; /* Changed text bit */ Ip_u32 pn; /* Packet Number (host order) */ Ip_u8 sl; /* Short Length */ Ip_u8 an; /* Association Number value */ Ip_u8 sci[IPMACSEC_SCI_LEN]; /* Secure Channel Identifier (if sc_bit is TRUE) */ Ip_u8 length; /* actual length of the SecTAG field */ } Ipmacsec_sectag; /* SAK container */ typedef struct Ipmacsec_secy_sak_struct { Ip_u8 *buf; /* buffer contaning the SAK binary octets */ Ip_u32 num_octets; /* size of the SAK buffer (# of octets) */ } Ipmacsec_secy_sak; /* Key structure used to convey the SAK */ typedef struct Ipmacsec_secy_key_struct { Ipmacsec_secy_key_id key_id; /* Set by KaY. */ Ipmacsec_secy_sak sak; Ip_bool inUse; /* tracks if key is already in use by an SA */ Ip_bool transmits; /* Read ONLY value */ Ip_bool receives; /* Read ONLY value */ Ipmacsec_time createdTime; /* Read ONLY value */ } Ipmacsec_secy_key; /* Struct used for TX and RX SAs */ typedef struct Ipmacsec_secy_sa_struct { Ip_u32 an; /* a value <= IPMACSEC_AN_MAX_VAL */ Ip_bool inUse; Ip_u32 nextPN; Ip_u32 lowestPN; /* Applies for Rx SA only */ Ipmacsec_secy_key *key; struct Ipmacsec_secy_sc_struct *sc; /* pointer back to SC parent of this SA. If not set, then SA is invalid */ Ipmacsec_time createdTime, startedTime, stoppedTime; Ipmacsec_secy_sa_ref ref; /* A mgmt provided reference (10.7.13; 10.7.21) */ Ipmacsec_secy_sa_ctrl ctrl; /* Set via LMI */ Ip_bool confidentiality; /* Enable encryption (10.7.21) */ Ip_u32 pn_threshold; /* Threshold used for sending notificationfor PN near exhaustion */ Ip_bool pn_near_exhaust_notify; /* Flag used to track if notification was sent for PN near exhaustion */ #ifdef IPMACSEC_USE_STATS Ipmacsec_secy_sa_stats stats; #endif } Ipmacsec_secy_sa; /* section 10.7 of 802.1AE */ /* Struct used for TX and RX SCs */ typedef struct Ipmacsec_secy_sc_struct { Ip_bool enabled; /* set to TRUE when SC is enabled, otherwise non of the following fields have valid values */ union { Ip_bool transmitting; /* Set by SecY when a tx SC is transmitting. READ only by external entities */ Ip_bool receiving;/* Set by SecY when a rx SC is receiving. READ only by external entities */ } oper; Ip_u32 encodingSA; /* a value <= IPMACSEC_AN_MAX_VAL. Used by Tx SC ONLY. (10.5.1) */ Ip_u32 encipheringSA; /* a value <= IPMACSEC_AN_MAX_VAL. Used by Tx SC ONLY. (10.5.4) */ Ipmacsec_dir dir; /* Indicates whether it is a TX or RX SC */ Ipmacsec_time createdTime, startedTime, stoppedTime; Ip_u8 sci[IPMACSEC_SCI_LEN]; /* Set by KaY or management interface */ Ipmacsec_secy_sa sa[IPMACSEC_MAX_SA]; Ip_u32 numActiveRxSAs; /* Current # of active Rx SAs, i.e. SAs enabled for reception (must be <= maxRxKeys). * Used for internal tracking ONLY */ #ifdef IPMACSEC_USE_STATS Ipmacsec_secy_sc_stats stats; /* Note that the "aggr" part of the stats stores only aggregate stats for deleted SAs, otherwise needs to be added to existing SA stats to determine latest SC stats (10.7.9; 10.7.18)*/ #endif Ip_u32 oldAN, newAN; /* ANs for tracking interleaved SAs */ Ip_u32 interleave_time; /* Time of reception of 1st interleaved frame in ms */ struct Ipmacsec_crypto_if_struct *crypto; /* per SC crypto if */ } Ipmacsec_secy_sc; /* section 10.7 of 802.1AE */ /* **************************************************************************** * 6 FUNCTIONS **************************************************************************** */ /* *=========================================================================== * ipmacsec_secy_enable *=========================================================================== * Description: Enable a SecY instance. * Parameters: secy - SecY instance pointer * Returns: 0 upon success, < 0 upon failure. * */ IPMACSEC_PRIVATE int ipmacsec_secy_enable(struct Ipnet_secy_struct *secy); /* *=========================================================================== * ipmacsec_secy_disable *=========================================================================== * Description: Disable a SecY instance. * Parameters: secy - SecY instance pointer * Returns: 0 upon success, < 0 upon failure. * */ IPMACSEC_PRIVATE int ipmacsec_secy_disable(struct Ipnet_secy_struct *secy); /* *=========================================================================== * ipmacsec_sak_copy *=========================================================================== * Description: Create a copy of an SAK content * Parameters: to_sak - Valid pointer to SAK to copy to * from_sak - Valid pointer to SAK to copy from * Returns: 0 upon success, < 0 upon failure. * */ IPMACSEC_PRIVATE int ipmacsec_sak_copy(Ipmacsec_secy_sak *to_sak, IP_CONST Ipmacsec_secy_sak *from_sak); /* *=========================================================================== * ipmacsec_sak_delete *=========================================================================== * Description: SAK destructor * Parameters: sak - Valid pointer to SAK to delete * Returns: 0 upon success, < 0 upon failure. * */ IPMACSEC_PRIVATE int ipmacsec_sak_delete(Ipmacsec_secy_sak *sak); #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */