ieee802_1x_kay.h

Go to the documentation of this file.

#ifndef IEEE802_1X_KAY_H
#define IEEE802_1X_KAY_H

#include "utils/list.h"
#include "common/defs.h"
#include "common/ieee802_1x_defs.h"

struct macsec_init_params;
struct ieee802_1x_cp_conf;

#define MI_LEN                  12
#define MAX_KEY_LEN             32  /* 32 bytes, 256 bits */
#define MAX_CKN_LEN             32  /* 32 bytes, 256 bits */

/* MKA timer, unit: millisecond */
#define MKA_HELLO_TIME          2000
#define MKA_LIFE_TIME           6000
#define MKA_SAK_RETIRE_TIME     3000

struct ieee802_1x_mka_ki {
        u8 mi[MI_LEN];
        u32 kn;
};

struct ieee802_1x_mka_sci {
        u8 addr[ETH_ALEN];
        u16 port;
};

struct mka_key {
        u8 key[MAX_KEY_LEN];
        size_t len;
};

struct mka_key_name {
        u8 name[MAX_CKN_LEN];
        size_t len;
};

enum mka_created_mode {
        PSK,
        EAP_EXCHANGE,
        DISTRIBUTED,
        CACHED,
};

struct ieee802_1x_kay_ctx {
        /* pointer to arbitrary upper level context */
        void *ctx;

        /* abstract wpa driver interface */
        int (*macsec_init)(void *ctx, struct macsec_init_params *params);
        int (*macsec_deinit)(void *ctx);
        int (*enable_protect_frames)(void *ctx, Boolean enabled);
        int (*set_replay_protect)(void *ctx, Boolean enabled, u32 window);
        int (*set_current_cipher_suite)(void *ctx, const u8 *cs, size_t cs_len);
        int (*enable_controlled_port)(void *ctx, Boolean enabled);
        int (*get_receive_lowest_pn)(void *ctx, u32 channel, u8 an,
                                     u32 *lowest_pn);
        int (*get_transmit_next_pn)(void *ctx, u32 channel, u8 an,
                                    u32 *next_pn);
        int (*set_transmit_next_pn)(void *ctx, u32 channel, u8 an, u32 next_pn);
        int (*get_available_receive_sc)(void *ctx, u32 *channel);
        int (*create_receive_sc)(void *ctx, u32 channel,
                                 struct ieee802_1x_mka_sci *sci,
                                 enum validate_frames vf,
                                 enum confidentiality_offset co);
        int (*delete_receive_sc)(void *ctx, u32 channel);
        int (*create_receive_sa)(void *ctx, u32 channel, u8 an, u32 lowest_pn,
                                 const u8 *sak);
        int (*enable_receive_sa)(void *ctx, u32 channel, u8 an);
        int (*disable_receive_sa)(void *ctx, u32 channel, u8 an);
        int (*get_available_transmit_sc)(void *ctx, u32 *channel);
        int (*create_transmit_sc)(void *ctx, u32 channel,
                                  const struct ieee802_1x_mka_sci *sci,
                                  enum confidentiality_offset co);
        int (*delete_transmit_sc)(void *ctx, u32 channel);
        int (*create_transmit_sa)(void *ctx, u32 channel, u8 an, u32 next_pn,
                                  Boolean confidentiality, const u8 *sak);
        int (*enable_transmit_sa)(void *ctx, u32 channel, u8 an);
        int (*disable_transmit_sa)(void *ctx, u32 channel, u8 an);
};

struct ieee802_1x_kay {
        Boolean enable;
        Boolean active;

        Boolean authenticated;
        Boolean secured;
        Boolean failed;

        struct ieee802_1x_mka_sci actor_sci;
        u8 actor_priority;
        struct ieee802_1x_mka_sci key_server_sci;
        u8 key_server_priority;

        enum macsec_cap macsec_capable;
        Boolean macsec_desired;
        Boolean macsec_protect;
        Boolean macsec_replay_protect;
        u32 macsec_replay_window;
        enum validate_frames macsec_validate;
        enum confidentiality_offset macsec_confidentiality;

        u32 ltx_kn;
        u8 ltx_an;
        u32 lrx_kn;
        u8 lrx_an;

        u32 otx_kn;
        u8 otx_an;
        u32 orx_kn;
        u8 orx_an;

        /* not defined in IEEE802.1X */
        struct ieee802_1x_kay_ctx *ctx;
        Boolean is_key_server;
        Boolean is_obliged_key_server;
        char if_name[IFNAMSIZ];

        int macsec_csindex;  /*  MACsec cipher suite table index */
        int mka_algindex;  /* MKA alg table index */

        u32 dist_kn;
        u8 dist_an;
        time_t dist_time;

        u8 mka_version;
        u8 algo_agility[4];
        u32 sc_ch;

        u32 pn_exhaustion;
        Boolean port_enable;
        Boolean rx_enable;
        Boolean tx_enable;

        struct dl_list participant_list;
        enum macsec_policy policy;

        struct ieee802_1x_cp_sm *cp;

        struct l2_packet_data *l2_mka;

        enum validate_frames vf;
        enum confidentiality_offset co;
};


struct ieee802_1x_kay *
ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
                    const char *ifname, const u8 *addr);
void ieee802_1x_kay_deinit(struct ieee802_1x_kay *kay);

struct ieee802_1x_mka_participant *
ieee802_1x_kay_create_mka(struct ieee802_1x_kay *kay,
                          struct mka_key_name *ckn, struct mka_key *cak,
                          u32 life, enum mka_created_mode mode,
                          Boolean is_authenticator);
void ieee802_1x_kay_delete_mka(struct ieee802_1x_kay *kay,
                               struct mka_key_name *ckn);
void ieee802_1x_kay_mka_participate(struct ieee802_1x_kay *kay,
                                    struct mka_key_name *ckn,
                                    Boolean status);
int ieee802_1x_kay_new_sak(struct ieee802_1x_kay *kay);
int ieee802_1x_kay_change_cipher_suite(struct ieee802_1x_kay *kay,
                                       int cs_index);

int ieee802_1x_kay_set_latest_sa_attr(struct ieee802_1x_kay *kay,
                                      struct ieee802_1x_mka_ki *lki, u8 lan,
                                      Boolean ltx, Boolean lrx);
int ieee802_1x_kay_set_old_sa_attr(struct ieee802_1x_kay *kay,
                                   struct ieee802_1x_mka_ki *oki,
                                   u8 oan, Boolean otx, Boolean orx);
int ieee802_1x_kay_create_sas(struct ieee802_1x_kay *kay,
                              struct ieee802_1x_mka_ki *lki);
int ieee802_1x_kay_delete_sas(struct ieee802_1x_kay *kay,
                              struct ieee802_1x_mka_ki *ki);
int ieee802_1x_kay_enable_tx_sas(struct ieee802_1x_kay *kay,
                                 struct ieee802_1x_mka_ki *lki);
int ieee802_1x_kay_enable_rx_sas(struct ieee802_1x_kay *kay,
                                 struct ieee802_1x_mka_ki *lki);
int ieee802_1x_kay_enable_new_info(struct ieee802_1x_kay *kay);
int ieee802_1x_kay_cp_conf(struct ieee802_1x_kay *kay,
                           struct ieee802_1x_cp_conf *pconf);

#endif /* IEEE802_1X_KAY_H */