240 lines
10 KiB
C
240 lines
10 KiB
C
/* ipmacsec_crypto_if.h - IPMACSEC Crypto Interface header file */
|
|
/*
|
|
* Copyright (c) 2010 Wind River Systems, Inc.
|
|
*
|
|
* The right to copy, distribute, modify, or otherwise make use
|
|
* of this software may be licensed only pursuant to the terms
|
|
* of an applicable Wind River license agreement.
|
|
*
|
|
*/
|
|
|
|
/*
|
|
modification history
|
|
--------------------
|
|
01a,19feb10,mry Created
|
|
*/
|
|
#ifndef IPMACSEC_CRYPTO_IF_H
|
|
#define IPMACSEC_CRYPTO_IF_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include <ipcom_type.h>
|
|
#include <ipcom_cstyle.h>
|
|
#ifdef IP_PORT_VWORKS
|
|
#include <vsbConfig.h>
|
|
#endif
|
|
|
|
#include "ipmacsec_h.h"
|
|
#include "ipmacsec.h"
|
|
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* Crypto context passed to the crypto validate and protect fucntions */
|
|
typedef struct {
|
|
Ip_u8 sci[IPMACSEC_SCI_LEN];
|
|
Ip_u8 *macsec_hdr; /* ptr to concatenated DA, SA and SecTAG fields */
|
|
Ip_u8 *userdata; /* Set to pointer to data to encrypt, or will return pointer to decrypted data */
|
|
Ip_u8 *securedata; /* Set to pointer to data to decrypt, or will return pointer to encrypted data */
|
|
Ip_u8 *icv; /* ICV value to validate, or ptr to buffer to copy generated ICV into */
|
|
Ip_u32 pn; /* Packet Number */
|
|
Ip_u8 macsec_hdr_len; /* aggregate size of DA, SA and SecTAG fields (in octets) */
|
|
Ip_u8 icv_len; /* in octets; size of ICV to validate, or size of buffer to copy generated ICV into */
|
|
Ip_u16 userdata_len; /* in octets; Set to len of data to encrypt, or will return len of decrypted data */
|
|
Ip_u16 securedata_len; /* in octets; Set to len of data to decrypt, or will return len of encrypted data */
|
|
Ip_u16 key_index; /* corresponds to tx/rx SA AN */
|
|
union {
|
|
Ip_bool encrypt; /* Set to encrypt userdata in addition to ICV generation */
|
|
Ip_bool decrypt; /* Set to decrypt userdata in addition to ICV validation */
|
|
} oper;
|
|
} Ipmacsec_crypto_ctx;
|
|
|
|
/* Crypto interface structure definition
|
|
* =====================================
|
|
* Usage:
|
|
* -----
|
|
* - One crypto_if per SC is created using ipmacsec_crypto_create() when the SC is created and
|
|
* destroyed with ipmacsec_crypto_delete() when the SC is deleted
|
|
* - init_cipher() is called when an SA is created for the corresponding SC.
|
|
* The AN for that SA is passed as a key_index and the corresponding SAK is also specified.
|
|
* - destroy_cipher() is called when an SA is deleted for the corresponding SC.
|
|
* The AN for that SA is passed as a key_index.
|
|
* - protect() and validate() are called whenever a frames needs to be protected or validated for
|
|
* the SC corresponding to this crypto_if. The Ipmacsec_crypto_ctx MUST be updated with the proper
|
|
* fields, including the key_index which equals the AN for the SA that is processing the frame.
|
|
* - Non private members of this structure are READ ONLY values for entities external to the crypto_if.
|
|
* - Private members of this structure MUST NOT be ACCESSED by entities external to the crypto_if.
|
|
*/
|
|
typedef struct Ipmacsec_crypto_if_struct {
|
|
Ip_bool valid; /* Set when Crypto If is properly instantiated */
|
|
Ip_bool cipher_set; /* Set when a cipher is selected */
|
|
Ip_u16 icvbits; /* ICV length (in bits) of selected cipher suite */
|
|
Ip_u16 gcmaes_accel_level; /* The AES-GCM acceleration level to use for this crypto if (when gcm-aes-128 is used) */
|
|
Ip_bool changesDataLength; /* selected cipher suite changes data length upon protection/validation */
|
|
Ip_u32 confidentialityOffset; /* # of octets to be used as offset for Confidentiality (default is 0)*/
|
|
int (* init_cipher)(struct Ipmacsec_crypto_if_struct *crypto, Ip_u8 key_index, Ipmacsec_secy_sak *sak);
|
|
int (* destroy_cipher)(struct Ipmacsec_crypto_if_struct *crypto, Ip_u8 key_index);
|
|
int (* protect)(struct Ipmacsec_crypto_if_struct *crypto, Ipmacsec_crypto_ctx *ctx);
|
|
int (* validate)(struct Ipmacsec_crypto_if_struct *crypto, Ipmacsec_crypto_ctx *ctx, Ip_bool *valid);
|
|
struct {
|
|
Ipnet_secy *secy; /* backpointer to SecY */
|
|
struct Ipmacsec_crypto_cipher_struct IP_CONST *cipher; /* Cipher pointer */
|
|
void *cs_ctx[IPMACSEC_MAX_SA]; /* cipher specific context */
|
|
Ip_u8 *result_buf; /* buffer used to store temporary crypto results */
|
|
Ip_u32 result_buf_len; /* length of buffer used to store temporary crypto results */
|
|
Ipmacsec_secy_sak sak[IPMACSEC_MAX_SA]; /* SAKs to be used by this crypto i/f */
|
|
} priv; /* Private members */
|
|
} Ipmacsec_crypto_if;
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_crypto_cipher_suite_supported
|
|
*===========================================================================
|
|
* Description: Verify if a cipher suite is supported by our MACsec implementation
|
|
* Parameters: cipher_suite_index - Cipher Suite index
|
|
* Returns: IP_TRUE is the cipher suite is supported, IP_FALSE otherwise.
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE Ip_bool
|
|
ipmacsec_crypto_cipher_suite_supported(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_crypto_cipher_suite_get_info
|
|
*===========================================================================
|
|
* Description: Retrieve detailed information about a supported cipher suite
|
|
* Parameters: cipher_suite_index - Cipher Suite index
|
|
* Returns: 0 if successful, < 0 otherwise
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE int
|
|
ipmacsec_crypto_cipher_suite_get_info(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index, Ipmacsec_ciphersuite_descriptor *info);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_crypto_cipher_suite_id_resolve
|
|
*===========================================================================
|
|
* Description: Resolve the Cipher Suite ID from a specified cipher_suite_index
|
|
* Parameters: cipher_suite_index - cipher_suite_index value to resolve
|
|
* cipher_suite_id - pointer to variable to hold the resolved
|
|
* Cipher Suite ID
|
|
* Returns: 0 upon success, <0 on error
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE int
|
|
ipmacsec_crypto_cipher_suite_id_resolve(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index, Ip_u8 *cipher_suite_id) ;
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_crypto_cipher_suite_name
|
|
*===========================================================================
|
|
* Description: Return the name of the specified Cipher Suite
|
|
* Parameters: cipher_suite_index - index of Cipher Suite whose name to return
|
|
* Returns: Pointer to string containing the Cipher Suite name (never null).
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE IP_CONST char *
|
|
ipmacsec_crypto_cipher_suite_name(IP_CONST Ipmacsec_cipher_suite_index cipher_suite_index);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_crypto_cipher_suite_index_resolve
|
|
*===========================================================================
|
|
* Description: Resolve the Cipher Suite Index from a specified cipher_suite_id
|
|
* Parameters: cipher_suite_id - Cipher Suite ID value to resolve
|
|
* cipher_suite_index - pointer to variable to hold the resolved
|
|
* cipher_suite_index
|
|
* Returns: 0 upon success, <0 on error
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE int
|
|
ipmacsec_crypto_cipher_suite_index_resolve(IP_CONST Ip_u8 *cipher_suite_id, Ipmacsec_cipher_suite_index *cipher_suite_index);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_crypto_get_icvbits
|
|
*===========================================================================
|
|
* Description: Retrieve # of ICV bits for currently configured SecY cipher
|
|
* Parameters: secy - SecY pointer
|
|
* Returns: > 0 if successful, 0 otherwise.
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE Ip_u16
|
|
ipmacsec_crypto_get_icvbits(Ipnet_secy *secy);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_crypto_create
|
|
*===========================================================================
|
|
* Description: Crypto Interface constructor
|
|
* Parameters: secy - SecY pointer
|
|
* Returns: Pointer to created crypto_if structure upon success, IP_NULL otherwise
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE Ipmacsec_crypto_if *
|
|
ipmacsec_crypto_create(Ipnet_secy *secy);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_crypto_delete
|
|
*===========================================================================
|
|
* Description: Crypto Interface desstructor
|
|
* Parameters: secy - SecY pointer
|
|
* crypto - pointer to crypto_if structure to delete
|
|
* Returns: 0 upon success, <0 on error
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE int
|
|
ipmacsec_crypto_delete(Ipnet_secy *secy, Ipmacsec_crypto_if *crypto);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|