281 lines
11 KiB
C
281 lines
11 KiB
C
/* ipmacsec.h - MACsec Private header file */
|
|
/*
|
|
* Copyright (c) 2010 Wind River Systems, Inc.
|
|
*
|
|
* The right to copy, distribute, modify, or otherwise make use
|
|
* of this software may be licensed only pursuant to the terms
|
|
* of an applicable Wind River license agreement.
|
|
*
|
|
*/
|
|
|
|
/*
|
|
modification history
|
|
--------------------
|
|
01a,09feb10,mry Created
|
|
*/
|
|
#ifndef IPMACSEC_H_H
|
|
#define IPMACSEC_H_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* This header file is to be included by internal ipmacsec modules. */
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include <ipcom_type.h>
|
|
#include <ipcom_cstyle.h>
|
|
|
|
#include "ipnet_eth.h"
|
|
#include "ipmacsec.h"
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* IPMACSEC_PRIVATE is used to differentiate functions that should ONLY be used
|
|
* by other IPMACSEC module functions and not by any external modules.
|
|
*/
|
|
#define IPMACSEC_PRIVATE IP_GLOBAL
|
|
|
|
/* Current MACsec Protocol Version number */
|
|
#define IPMACSEC_VERSION_NUMBER 0
|
|
|
|
/* Macros for manipulating the Controlled and Uncontrolled Port statistics */
|
|
#define IPMACSEC_UCP_STATS(xvar) netif->uncontrolled_port->stats.xvar
|
|
|
|
#ifdef IPMACSEC_USE_STATS
|
|
#define IPMACSEC_CP_STATS(xvar) netif->controlled_port->stats.xvar
|
|
#define IPMACSEC_CP_STATS_SET(xvar,val) netif->controlled_port->stats.xvar = val
|
|
#define IPMACSEC_CP_STATS_INC(xvar,inc) netif->controlled_port->stats.xvar +=(inc)
|
|
#define IPMACSEC_SECY_STATS(xvar) secy->stats.xvar
|
|
#define IPMACSEC_SECY_STAT_VAL(xvar) secy->stats.xvar
|
|
#define IPMACSEC_SECY_STATS_INC(xvar,inc) secy->stats.xvar+=(inc)
|
|
#define IPMACSEC_SC_STATS(xvar) sc->stats.xvar
|
|
#define IPMACSEC_SC_STAT_VAL(xvar) sc->stats.xvar
|
|
#define IPMACSEC_SC_STATS_INC(xvar,inc) sc->stats.xvar+=(inc)
|
|
#define IPMACSEC_SA_STATS(xvar) sa->stats.xvar
|
|
#define IPMACSEC_SA_STAT_VAL(xvar) sa->stats.xvar
|
|
#define IPMACSEC_SA_STATS_INC(xvar,inc) sa->stats.xvar+=(inc)
|
|
#else
|
|
#define IPMACSEC_CP_STATS(xvar) IP_NOOP
|
|
#define IPMACSEC_CP_STATS_SET(xvar,val) IP_NOOP
|
|
#define IPMACSEC_CP_STATS_INC(xvar,inc) IP_NOOP
|
|
#define IPMACSEC_SECY_STATS(xvar) IP_NOOP
|
|
#define IPMACSEC_SECY_STAT_VAL(xvar) 0
|
|
#define IPMACSEC_SECY_STATS_INC(xvar,inc) IP_NOOP
|
|
#define IPMACSEC_SC_STATS(xvar) IP_NOOP
|
|
#define IPMACSEC_SC_STAT_VAL(xvar) 0
|
|
#define IPMACSEC_SC_STATS_INC(xvar,inc) IP_NOOP
|
|
#define IPMACSEC_SA_STATS(xvar) IP_NOOP
|
|
#define IPMACSEC_SA_STAT_VAL(xvar) 0
|
|
#define IPMACSEC_SA_STATS_INC(xvar,inc) IP_NOOP
|
|
#endif
|
|
|
|
/* Common Length definitions */
|
|
#define IPMACSEC_MACADDRS_LEN (2*IPNET_ETH_ADDR_SIZE)
|
|
#define IPMACSEC_PN_LEN 4 /* # of octets in the PN field */
|
|
#define IPMACSEC_SECTAG_LEN sizeof(Ipnet_sectag)
|
|
#define IPMACSEC_SECTAG_NOSCI_LEN (sizeof(Ipnet_sectag)-IPMACSEC_SCI_LEN)
|
|
|
|
#define IPMACSEC_MIN_ICV_LEN 8
|
|
#define IPMACSEC_MIN_MPDU_LEN (IPMACSEC_SECTAG_NOSCI_LEN+1+IPMACSEC_MIN_ICV_LEN)
|
|
#define IPMACSEC_0SL_MIN_MSDU_LEN 48 /* Minimum MSDU length when SL == 0 */
|
|
#define IPMACSEC_0CBIT_ICV_LEN 16 /* ICV length when C bit == 0 */
|
|
|
|
/* Default threshold value for PN near exhaustion notification */
|
|
#define IPMACSEC_SECY_DEFAULT_PN_THRESHOLD 0xFFFF0000
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
#include "ipcom_align16.h"
|
|
/* Actual SecTAG header struct */
|
|
typedef IP_PACKED1 struct Ipnet_sectag_struct {
|
|
Ip_u16 ethType; /* Ethernet Type. Should be IPNET_ETHFRAME_MACSEC */
|
|
Ip_u8 tci_an; /* Tag Control Information (bits8-3) + Association Number (bits2-1) */
|
|
Ip_u8 sl; /* Short Length */
|
|
Ip_u32 pn; /* Packet Number */
|
|
Ip_u8 sci[IPMACSEC_SCI_LEN]; /* Secure Channel Identifier (optionally encoded) */
|
|
}
|
|
IP_PACKED2 Ipnet_sectag;
|
|
#include "ipcom_align16.h"
|
|
|
|
#include "ipcom_align16.h"
|
|
/* MACsec's Header overlay structure */
|
|
typedef IP_PACKED1 struct Ipnet_pkt_macsec_struct {
|
|
Ip_u8 dst[IPNET_ETH_ADDR_SIZE]; /* Destination address of the frame */
|
|
Ip_u8 src[IPNET_ETH_ADDR_SIZE]; /* Source address of the fram */
|
|
union {
|
|
Ip_u16 ethType;
|
|
Ipnet_sectag sectag;
|
|
} d;
|
|
}
|
|
IP_PACKED2 Ipnet_pkt_macsec;
|
|
#include "ipcom_align16.h"
|
|
|
|
/* MACsec's SecTAG representation */
|
|
typedef struct Ipmacsec_sectag_struct {
|
|
Ip_u16 ethType; /* Ethernet Type. Should be IPNET_ETHFRAME_MACSEC */
|
|
Ip_u8 tci; /* Tag Control Information value */
|
|
Ip_u8 version; /* Version value */
|
|
Ip_bool es_bit; /* End Station bit */
|
|
Ip_bool sc_bit; /* Secure Connection bit */
|
|
Ip_bool scb_bit; /* Single Copy Broadcast bit */
|
|
Ip_bool e_bit; /* Encryption bit */
|
|
Ip_bool c_bit; /* Changed text bit */
|
|
Ip_u32 pn; /* Packet Number (host order) */
|
|
Ip_u8 sl; /* Short Length */
|
|
Ip_u8 an; /* Association Number value */
|
|
Ip_u8 sci[IPMACSEC_SCI_LEN]; /* Secure Channel Identifier (if sc_bit is TRUE) */
|
|
Ip_u8 length; /* actual length of the SecTAG field */
|
|
} Ipmacsec_sectag;
|
|
|
|
/* SAK container */
|
|
typedef struct Ipmacsec_secy_sak_struct {
|
|
Ip_u8 *buf; /* buffer contaning the SAK binary octets */
|
|
Ip_u32 num_octets; /* size of the SAK buffer (# of octets) */
|
|
} Ipmacsec_secy_sak;
|
|
|
|
/* Key structure used to convey the SAK */
|
|
typedef struct Ipmacsec_secy_key_struct {
|
|
Ipmacsec_secy_key_id key_id; /* Set by KaY. */
|
|
Ipmacsec_secy_sak sak;
|
|
Ip_bool inUse; /* tracks if key is already in use by an SA */
|
|
Ip_bool transmits; /* Read ONLY value */
|
|
Ip_bool receives; /* Read ONLY value */
|
|
Ipmacsec_time createdTime; /* Read ONLY value */
|
|
} Ipmacsec_secy_key;
|
|
|
|
/* Struct used for TX and RX SAs */
|
|
typedef struct Ipmacsec_secy_sa_struct {
|
|
Ip_u32 an; /* a value <= IPMACSEC_AN_MAX_VAL */
|
|
Ip_bool inUse;
|
|
Ip_u32 nextPN;
|
|
Ip_u32 lowestPN; /* Applies for Rx SA only */
|
|
Ipmacsec_secy_key *key;
|
|
struct Ipmacsec_secy_sc_struct *sc; /* pointer back to SC parent of this SA. If not set, then SA is invalid */
|
|
Ipmacsec_time createdTime, startedTime, stoppedTime;
|
|
Ipmacsec_secy_sa_ref ref; /* A mgmt provided reference (10.7.13; 10.7.21) */
|
|
Ipmacsec_secy_sa_ctrl ctrl; /* Set via LMI */
|
|
Ip_bool confidentiality; /* Enable encryption (10.7.21) */
|
|
Ip_u32 pn_threshold; /* Threshold used for sending notificationfor PN near exhaustion */
|
|
Ip_bool pn_near_exhaust_notify; /* Flag used to track if notification was sent for PN near exhaustion */
|
|
#ifdef IPMACSEC_USE_STATS
|
|
Ipmacsec_secy_sa_stats stats;
|
|
#endif
|
|
} Ipmacsec_secy_sa; /* section 10.7 of 802.1AE */
|
|
|
|
/* Struct used for TX and RX SCs */
|
|
typedef struct Ipmacsec_secy_sc_struct {
|
|
Ip_bool enabled; /* set to TRUE when SC is enabled, otherwise non of the following fields have valid values */
|
|
union {
|
|
Ip_bool transmitting; /* Set by SecY when a tx SC is transmitting. READ only by external entities */
|
|
Ip_bool receiving;/* Set by SecY when a rx SC is receiving. READ only by external entities */
|
|
} oper;
|
|
Ip_u32 encodingSA; /* a value <= IPMACSEC_AN_MAX_VAL. Used by Tx SC ONLY. (10.5.1) */
|
|
Ip_u32 encipheringSA; /* a value <= IPMACSEC_AN_MAX_VAL. Used by Tx SC ONLY. (10.5.4) */
|
|
Ipmacsec_dir dir; /* Indicates whether it is a TX or RX SC */
|
|
Ipmacsec_time createdTime, startedTime, stoppedTime;
|
|
Ip_u8 sci[IPMACSEC_SCI_LEN]; /* Set by KaY or management interface */
|
|
Ipmacsec_secy_sa sa[IPMACSEC_MAX_SA];
|
|
Ip_u32 numActiveRxSAs; /* Current # of active Rx SAs, i.e. SAs enabled for reception (must be <= maxRxKeys).
|
|
* Used for internal tracking ONLY */
|
|
#ifdef IPMACSEC_USE_STATS
|
|
Ipmacsec_secy_sc_stats stats; /* Note that the "aggr" part of the stats stores only aggregate stats for deleted SAs,
|
|
otherwise needs to be added to existing SA stats to determine latest SC stats (10.7.9; 10.7.18)*/
|
|
#endif
|
|
Ip_u32 oldAN, newAN; /* ANs for tracking interleaved SAs */
|
|
Ip_u32 interleave_time; /* Time of reception of 1st interleaved frame in ms */
|
|
struct Ipmacsec_crypto_if_struct *crypto; /* per SC crypto if */
|
|
} Ipmacsec_secy_sc; /* section 10.7 of 802.1AE */
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_secy_enable
|
|
*===========================================================================
|
|
* Description: Enable a SecY instance.
|
|
* Parameters: secy - SecY instance pointer
|
|
* Returns: 0 upon success, < 0 upon failure.
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE int
|
|
ipmacsec_secy_enable(struct Ipnet_secy_struct *secy);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_secy_disable
|
|
*===========================================================================
|
|
* Description: Disable a SecY instance.
|
|
* Parameters: secy - SecY instance pointer
|
|
* Returns: 0 upon success, < 0 upon failure.
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE int
|
|
ipmacsec_secy_disable(struct Ipnet_secy_struct *secy);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_sak_copy
|
|
*===========================================================================
|
|
* Description: Create a copy of an SAK content
|
|
* Parameters: to_sak - Valid pointer to SAK to copy to
|
|
* from_sak - Valid pointer to SAK to copy from
|
|
* Returns: 0 upon success, < 0 upon failure.
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE int
|
|
ipmacsec_sak_copy(Ipmacsec_secy_sak *to_sak, IP_CONST Ipmacsec_secy_sak *from_sak);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipmacsec_sak_delete
|
|
*===========================================================================
|
|
* Description: SAK destructor
|
|
* Parameters: sak - Valid pointer to SAK to delete
|
|
* Returns: 0 upon success, < 0 upon failure.
|
|
*
|
|
*/
|
|
IPMACSEC_PRIVATE int
|
|
ipmacsec_sak_delete(Ipmacsec_secy_sak *sak);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|