2 * IEEE 802.1X-2010 Key Agree Protocol of PAE state machine
3 * Copyright (c) 2013, Qualcomm Atheros, Inc.
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
9 #ifndef IEEE802_1X_KAY_I_H
10 #define IEEE802_1X_KAY_I_H
12 #include "utils/list.h"
13 #include "common/defs.h"
14 #include "common/ieee802_1x_defs.h"
16 #define MKA_VERSION_ID 1
18 /* IEEE Std 802.1X-2010, 11.11.1, Table 11-7 */
19 enum mka_packet_type {
20 MKA_BASIC_PARAMETER_SET = MKA_VERSION_ID,
21 MKA_LIVE_PEER_LIST = 1,
22 MKA_POTENTIAL_PEER_LIST = 2,
24 MKA_DISTRIBUTED_SAK = 4,
25 MKA_DISTRIBUTED_CAK = 5,
28 MKA_ICV_INDICATOR = 255
31 #define ICV_LEN 16 /* 16 bytes */
32 #define SAK_WRAPPED_LEN 24
33 /* KN + Wrapper SAK */
34 #define DEFAULT_DIS_SAK_BODY_LENGTH (SAK_WRAPPED_LEN + 4)
35 #define MAX_RETRY_CNT 5
37 struct ieee802_1x_kay;
39 struct ieee802_1x_mka_peer_id {
44 struct ieee802_1x_kay_peer {
45 struct ieee802_1x_mka_sci sci;
49 Boolean is_key_server;
50 u8 key_server_priority;
51 Boolean macsec_desired;
52 enum macsec_cap macsec_capability;
60 struct ieee802_1x_mka_ki key_identifier;
61 enum confidentiality_offset confidentiality_offset;
65 struct os_time created_time;
68 /* not defined data */
72 int user; /* FIXME: to indicate if it can be delete safely */
77 /* TransmitSC in IEEE Std 802.1AE-2006, Figure 10-6 */
79 struct ieee802_1x_mka_sci sci; /* const SCI sci */
80 Boolean transmitting; /* bool transmitting (read only) */
82 struct os_time created_time; /* Time createdTime */
84 u8 encoding_sa; /* AN encodingSA (read only) */
85 u8 enciphering_sa; /* AN encipheringSA (read only) */
87 /* not defined data */
91 struct dl_list sa_list;
94 /* TransmitSA in IEEE Std 802.1AE-2006, Figure 10-6 */
96 Boolean in_use; /* bool inUse (read only) */
97 u32 next_pn; /* PN nextPN (read only) */
98 struct os_time created_time; /* Time createdTime */
100 Boolean enable_transmit; /* bool EnableTransmit */
103 Boolean confidentiality;
104 struct data_key *pkey;
106 struct transmit_sc *sc;
107 struct dl_list list; /* list entry in struct transmit_sc::sa_list */
110 /* ReceiveSC in IEEE Std 802.1AE-2006, Figure 10-6 */
112 struct ieee802_1x_mka_sci sci; /* const SCI sci */
113 Boolean receiving; /* bool receiving (read only) */
115 struct os_time created_time; /* Time createdTime */
117 unsigned int channel;
120 struct dl_list sa_list;
123 /* ReceiveSA in IEEE Std 802.1AE-2006, Figure 10-6 */
125 Boolean enable_receive; /* bool enableReceive */
126 Boolean in_use; /* bool inUse (read only) */
128 u32 next_pn; /* PN nextPN (read only) */
129 u32 lowest_pn; /* PN lowestPN (read only) */
131 struct os_time created_time;
133 struct data_key *pkey;
134 struct receive_sc *sc; /* list entry in struct receive_sc::sa_list */
139 struct macsec_ciphersuite {
142 enum macsec_cap capable;
143 int sak_len; /* unit: byte */
155 int (*cak_trfm)(const u8 *msk, const u8 *mac1, const u8 *mac2, u8 *cak);
156 int (*ckn_trfm)(const u8 *msk, const u8 *mac1, const u8 *mac2,
157 const u8 *sid, size_t sid_len, u8 *ckn);
158 int (*kek_trfm)(const u8 *cak, const u8 *ckn, size_t ckn_len, u8 *kek);
159 int (*ick_trfm)(const u8 *cak, const u8 *ckn, size_t ckn_len, u8 *ick);
160 int (*icv_hash)(const u8 *ick, const u8 *msg, size_t msg_len, u8 *icv);
162 int index; /* index for configuring */
165 #define DEFAULT_MKA_ALG_INDEX 0
167 /* See IEEE Std 802.1X-2010, 9.16 MKA management */
168 struct ieee802_1x_mka_participant {
169 /* used for active and potential participant */
170 struct mka_key_name ckn;
174 /* used by management to monitor and control activation */
179 enum { DEFAULT, DISABLED, ON_OPER_UP, ALWAYS } activate;
181 /* used for active participant */
183 struct dl_list live_peers;
184 struct dl_list potential_peers;
186 /* not defined in IEEE 802.1X */
192 struct ieee802_1x_mka_ki lki;
197 struct ieee802_1x_mka_ki oki;
202 Boolean is_key_server;
203 Boolean is_obliged_key_server;
204 Boolean can_be_key_server;
207 struct dl_list sak_list;
208 struct dl_list rxsc_list;
210 struct transmit_sc *txsc;
215 struct ieee802_1x_mka_peer_id current_peer_id;
216 struct ieee802_1x_mka_sci current_peer_sci;
223 Boolean advised_desired;
224 enum macsec_cap advised_capability;
226 struct data_key *new_key;
229 struct ieee802_1x_kay *kay;
232 struct ieee802_1x_mka_hdr {
238 #if __BYTE_ORDER == __LITTLE_ENDIAN
241 #elif __BYTE_ORDER == __BIG_ENDIAN
245 #error "Please fix <bits/endian.h>"
251 #define MKA_HDR_LEN sizeof(struct ieee802_1x_mka_hdr)
253 struct ieee802_1x_mka_basic_body {
259 #if __BYTE_ORDER == __LITTLE_ENDIAN
261 u8 macsec_capability:2;
264 #elif __BYTE_ORDER == __BIG_ENDIAN
267 u8 macsec_capability:2;
273 struct ieee802_1x_mka_sci actor_sci;
278 /* followed by CAK Name*/
282 struct ieee802_1x_mka_peer_body {
288 #if __BYTE_ORDER == __LITTLE_ENDIAN
291 #elif __BYTE_ORDER == __BIG_ENDIAN
299 /* followed by Peers */
302 struct ieee802_1x_mka_sak_use_body {
306 #if __BYTE_ORDER == __LITTLE_ENDIAN
313 #elif __BYTE_ORDER == __BIG_ENDIAN
323 #if __BYTE_ORDER == __LITTLE_ENDIAN
329 #elif __BYTE_ORDER == __BIG_ENDIAN
356 struct ieee802_1x_mka_dist_sak_body {
360 #if __BYTE_ORDER == __LITTLE_ENDIAN
364 #elif __BYTE_ORDER == __BIG_ENDIAN
370 #if __BYTE_ORDER == __LITTLE_ENDIAN
373 #elif __BYTE_ORDER == __BIG_ENDIAN
382 /* for GCM-AES-128: octet 9-32: SAK
383 * for other cipher suite: octet 9-16: cipher suite id, octet 17-: SAK
389 struct ieee802_1x_mka_icv_body {
395 #if __BYTE_ORDER == __LITTLE_ENDIAN
398 #elif __BYTE_ORDER == __BIG_ENDIAN
409 #endif /* IEEE802_1X_KAY_I_H */