mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-08 21:22:09 -04:00
macsec: Support XPN frame handling - IEEE 802.1AEbw
Support extended packet number cipher suites (802.1AEbw) frames handling.
This does not include the needed netlink patches.
* Added xpn boolean field to `struct macsec_secy`.
* Added ssci field to `struct_macsec_tx_sa` (802.1AE figure 10-5).
* Added ssci field to `struct_macsec_rx_sa` (802.1AE figure 10-5).
* Added salt field to `struct macsec_key` (802.1AE 10.7 NOTE 1).
* Created pn_t type for easy access to lower and upper halves.
* Created salt_t type for easy access to the "ssci" and "pn" parts.
* Created `macsec_fill_iv_xpn` function to create IV in XPN mode.
* Support in PN recovery and preliminary replay check in XPN mode.
In addition, according to IEEE 802.1AEbw figure 10-5, the PN of incoming
frame can be 0 when XPN cipher suite is used, so fixed the function
`macsec_validate_skb` to fail on PN=0 only if XPN is off.
Change-Id: I2558cd6ecfbfac3a183095278bcaafc6e8b19f23
Signed-off-by: Era Mayflower <mayflowerera@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: a21ecf0e033807b976967286e6c392f48ee2049f
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Karthik Rudrapatna <quic_krudrapa@quicinc.com>
This commit is contained in:
Era Mayflower
Gerrit - the friendly Code Review server
parent
64e3a0682c
commit
db4d38d32f
2 changed files with 136 additions and 39 deletions
|
|
@ -20,6 +20,7 @@
|
|||
#include <net/macsec.h>
|
||||
#include <linux/if_arp.h>
|
||||
#include <linux/phy.h>
|
||||
#include <linux/byteorder/generic.h>
|
||||
|
||||
#include <uapi/linux/if_macsec.h>
|
||||
|
||||
|
|
@ -69,6 +70,16 @@ struct macsec_eth_header {
|
|||
sc; \
|
||||
sc = rtnl_dereference(sc->next))
|
||||
|
||||
#define pn_same_half(pn1, pn2) (!(((pn1) >> 31) ^ ((pn2) >> 31)))
|
||||
|
||||
struct gcm_iv_xpn {
|
||||
union {
|
||||
u8 short_secure_channel_id[4];
|
||||
ssci_t ssci;
|
||||
};
|
||||
__be64 pn;
|
||||
} __packed;
|
||||
|
||||
struct gcm_iv {
|
||||
union {
|
||||
u8 secure_channel_id[8];
|
||||
|
|
@ -373,8 +384,8 @@ static const struct macsec_ops *macsec_get_ops(struct macsec_dev *macsec,
|
|||
return __macsec_get_ops(macsec->offload, macsec, ctx);
|
||||
}
|
||||
|
||||
/* validate MACsec packet according to IEEE 802.1AE-2006 9.12 */
|
||||
static bool macsec_validate_skb(struct sk_buff *skb, u16 icv_len)
|
||||
/* validate MACsec packet according to IEEE 802.1AE-2018 9.12 */
|
||||
static bool macsec_validate_skb(struct sk_buff *skb, u16 icv_len, bool xpn)
|
||||
{
|
||||
struct macsec_eth_header *h = (struct macsec_eth_header *)skb->data;
|
||||
int len = skb->len - 2 * ETH_ALEN;
|
||||
|
|
@ -399,8 +410,8 @@ static bool macsec_validate_skb(struct sk_buff *skb, u16 icv_len)
|
|||
if (h->unused)
|
||||
return false;
|
||||
|
||||
/* rx.pn != 0 (figure 10-5) */
|
||||
if (!h->packet_number)
|
||||
/* rx.pn != 0 if not XPN (figure 10-5 with 802.11AEbw-2013 amendment) */
|
||||
if (!h->packet_number && !xpn)
|
||||
return false;
|
||||
|
||||
/* length check, f) g) h) i) */
|
||||
|
|
@ -412,6 +423,15 @@ static bool macsec_validate_skb(struct sk_buff *skb, u16 icv_len)
|
|||
#define MACSEC_NEEDED_HEADROOM (macsec_extra_len(true))
|
||||
#define MACSEC_NEEDED_TAILROOM MACSEC_STD_ICV_LEN
|
||||
|
||||
static void macsec_fill_iv_xpn(unsigned char *iv, ssci_t ssci, u64 pn,
|
||||
salt_t salt)
|
||||
{
|
||||
struct gcm_iv_xpn *gcm_iv = (struct gcm_iv_xpn *)iv;
|
||||
|
||||
gcm_iv->ssci = ssci ^ salt.ssci;
|
||||
gcm_iv->pn = cpu_to_be64(pn) ^ salt.pn;
|
||||
}
|
||||
|
||||
static void macsec_fill_iv(unsigned char *iv, sci_t sci, u32 pn)
|
||||
{
|
||||
struct gcm_iv *gcm_iv = (struct gcm_iv *)iv;
|
||||
|
|
@ -442,14 +462,19 @@ void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa)
|
|||
}
|
||||
EXPORT_SYMBOL_GPL(macsec_pn_wrapped);
|
||||
|
||||
static u32 tx_sa_update_pn(struct macsec_tx_sa *tx_sa, struct macsec_secy *secy)
|
||||
static pn_t tx_sa_update_pn(struct macsec_tx_sa *tx_sa,
|
||||
struct macsec_secy *secy)
|
||||
{
|
||||
u32 pn;
|
||||
pn_t pn;
|
||||
|
||||
spin_lock_bh(&tx_sa->lock);
|
||||
pn = tx_sa->next_pn;
|
||||
|
||||
tx_sa->next_pn++;
|
||||
pn = tx_sa->next_pn_halves;
|
||||
if (secy->xpn)
|
||||
tx_sa->next_pn++;
|
||||
else
|
||||
tx_sa->next_pn_halves.lower++;
|
||||
|
||||
if (tx_sa->next_pn == 0)
|
||||
__macsec_pn_wrapped(secy, tx_sa);
|
||||
spin_unlock_bh(&tx_sa->lock);
|
||||
|
|
@ -564,7 +589,7 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
|
|||
struct macsec_tx_sa *tx_sa;
|
||||
struct macsec_dev *macsec = macsec_priv(dev);
|
||||
bool sci_present;
|
||||
u32 pn;
|
||||
pn_t pn;
|
||||
|
||||
secy = &macsec->secy;
|
||||
tx_sc = &secy->tx_sc;
|
||||
|
|
@ -606,12 +631,12 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
|
|||
memmove(hh, eth, 2 * ETH_ALEN);
|
||||
|
||||
pn = tx_sa_update_pn(tx_sa, secy);
|
||||
if (pn == 0) {
|
||||
if (pn.full64 == 0) {
|
||||
macsec_txsa_put(tx_sa);
|
||||
kfree_skb(skb);
|
||||
return ERR_PTR(-ENOLINK);
|
||||
}
|
||||
macsec_fill_sectag(hh, secy, pn, sci_present);
|
||||
macsec_fill_sectag(hh, secy, pn.lower, sci_present);
|
||||
macsec_set_shortlen(hh, unprotected_len - 2 * ETH_ALEN);
|
||||
|
||||
skb_put(skb, secy->icv_len);
|
||||
|
|
@ -642,7 +667,10 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
|
|||
return ERR_PTR(-ENOMEM);
|
||||
}
|
||||
|
||||
macsec_fill_iv(iv, secy->sci, pn);
|
||||
if (secy->xpn)
|
||||
macsec_fill_iv_xpn(iv, tx_sa->ssci, pn.full64, tx_sa->key.salt);
|
||||
else
|
||||
macsec_fill_iv(iv, secy->sci, pn.lower);
|
||||
|
||||
sg_init_table(sg, ret);
|
||||
ret = skb_to_sgvec(skb, sg, 0, skb->len);
|
||||
|
|
@ -694,13 +722,14 @@ static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u
|
|||
u32 lowest_pn = 0;
|
||||
|
||||
spin_lock(&rx_sa->lock);
|
||||
if (rx_sa->next_pn >= secy->replay_window)
|
||||
lowest_pn = rx_sa->next_pn - secy->replay_window;
|
||||
if (rx_sa->next_pn_halves.lower >= secy->replay_window)
|
||||
lowest_pn = rx_sa->next_pn_halves.lower - secy->replay_window;
|
||||
|
||||
/* Now perform replay protection check again
|
||||
* (see IEEE 802.1AE-2006 figure 10-5)
|
||||
*/
|
||||
if (secy->replay_protect && pn < lowest_pn) {
|
||||
if (secy->replay_protect && pn < lowest_pn &&
|
||||
(!secy->xpn || pn_same_half(pn, lowest_pn))) {
|
||||
spin_unlock(&rx_sa->lock);
|
||||
u64_stats_update_begin(&rxsc_stats->syncp);
|
||||
rxsc_stats->stats.InPktsLate++;
|
||||
|
|
@ -749,8 +778,15 @@ static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u
|
|||
}
|
||||
u64_stats_update_end(&rxsc_stats->syncp);
|
||||
|
||||
if (pn >= rx_sa->next_pn)
|
||||
rx_sa->next_pn = pn + 1;
|
||||
// Instead of "pn >=" - to support pn overflow in xpn
|
||||
if (pn + 1 > rx_sa->next_pn_halves.lower) {
|
||||
rx_sa->next_pn_halves.lower = pn + 1;
|
||||
} else if (secy->xpn &&
|
||||
!pn_same_half(pn, rx_sa->next_pn_halves.lower)) {
|
||||
rx_sa->next_pn_halves.upper++;
|
||||
rx_sa->next_pn_halves.lower = pn + 1;
|
||||
}
|
||||
|
||||
spin_unlock(&rx_sa->lock);
|
||||
}
|
||||
|
||||
|
|
@ -837,6 +873,7 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
|
|||
unsigned char *iv;
|
||||
struct aead_request *req;
|
||||
struct macsec_eth_header *hdr;
|
||||
u32 hdr_pn;
|
||||
u16 icv_len = secy->icv_len;
|
||||
|
||||
macsec_skb_cb(skb)->valid = false;
|
||||
|
|
@ -856,7 +893,21 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
|
|||
}
|
||||
|
||||
hdr = (struct macsec_eth_header *)skb->data;
|
||||
macsec_fill_iv(iv, sci, ntohl(hdr->packet_number));
|
||||
hdr_pn = ntohl(hdr->packet_number);
|
||||
|
||||
if (secy->xpn) {
|
||||
pn_t recovered_pn = rx_sa->next_pn_halves;
|
||||
|
||||
recovered_pn.lower = hdr_pn;
|
||||
if (hdr_pn < rx_sa->next_pn_halves.lower &&
|
||||
!pn_same_half(hdr_pn, rx_sa->next_pn_halves.lower))
|
||||
recovered_pn.upper++;
|
||||
|
||||
macsec_fill_iv_xpn(iv, rx_sa->ssci, recovered_pn.full64,
|
||||
rx_sa->key.salt);
|
||||
} else {
|
||||
macsec_fill_iv(iv, sci, hdr_pn);
|
||||
}
|
||||
|
||||
sg_init_table(sg, ret);
|
||||
ret = skb_to_sgvec(skb, sg, 0, skb->len);
|
||||
|
|
@ -998,7 +1049,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
|
|||
struct macsec_dev *macsec;
|
||||
unsigned int len;
|
||||
sci_t sci;
|
||||
u32 pn;
|
||||
u32 hdr_pn;
|
||||
bool cbit;
|
||||
struct pcpu_rx_sc_stats *rxsc_stats;
|
||||
struct pcpu_secy_stats *secy_stats;
|
||||
|
|
@ -1069,7 +1120,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
|
|||
secy_stats = this_cpu_ptr(macsec->stats);
|
||||
rxsc_stats = this_cpu_ptr(rx_sc->stats);
|
||||
|
||||
if (!macsec_validate_skb(skb, secy->icv_len)) {
|
||||
if (!macsec_validate_skb(skb, secy->icv_len, secy->xpn)) {
|
||||
u64_stats_update_begin(&secy_stats->syncp);
|
||||
secy_stats->stats.InPktsBadTag++;
|
||||
u64_stats_update_end(&secy_stats->syncp);
|
||||
|
|
@ -1101,13 +1152,16 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
|
|||
}
|
||||
|
||||
/* First, PN check to avoid decrypting obviously wrong packets */
|
||||
pn = ntohl(hdr->packet_number);
|
||||
hdr_pn = ntohl(hdr->packet_number);
|
||||
if (secy->replay_protect) {
|
||||
bool late;
|
||||
|
||||
spin_lock(&rx_sa->lock);
|
||||
late = rx_sa->next_pn >= secy->replay_window &&
|
||||
pn < (rx_sa->next_pn - secy->replay_window);
|
||||
late = rx_sa->next_pn_halves.lower >= secy->replay_window &&
|
||||
hdr_pn < (rx_sa->next_pn_halves.lower - secy->replay_window);
|
||||
|
||||
if (secy->xpn)
|
||||
late = late && pn_same_half(rx_sa->next_pn_halves.lower, hdr_pn);
|
||||
spin_unlock(&rx_sa->lock);
|
||||
|
||||
if (late) {
|
||||
|
|
@ -1136,7 +1190,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
|
|||
return RX_HANDLER_CONSUMED;
|
||||
}
|
||||
|
||||
if (!macsec_post_decrypt(skb, secy, pn))
|
||||
if (!macsec_post_decrypt(skb, secy, hdr_pn))
|
||||
goto drop;
|
||||
|
||||
deliver:
|
||||
|
|
@ -1665,7 +1719,7 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
|
|||
|
||||
if (tb_sa[MACSEC_SA_ATTR_PN]) {
|
||||
spin_lock_bh(&rx_sa->lock);
|
||||
rx_sa->next_pn = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
|
||||
rx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
|
||||
spin_unlock_bh(&rx_sa->lock);
|
||||
}
|
||||
|
||||
|
|
@ -1872,7 +1926,7 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
|
|||
}
|
||||
|
||||
spin_lock_bh(&tx_sa->lock);
|
||||
tx_sa->next_pn = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
|
||||
tx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
|
||||
spin_unlock_bh(&tx_sa->lock);
|
||||
|
||||
if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
|
||||
|
|
@ -2136,9 +2190,11 @@ static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info)
|
|||
u8 assoc_num;
|
||||
struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
|
||||
bool was_operational, was_active;
|
||||
u32 prev_pn = 0;
|
||||
pn_t prev_pn;
|
||||
int ret = 0;
|
||||
|
||||
prev_pn.full64 = 0;
|
||||
|
||||
if (!attrs[MACSEC_ATTR_IFINDEX])
|
||||
return -EINVAL;
|
||||
|
||||
|
|
@ -2158,8 +2214,8 @@ static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info)
|
|||
|
||||
if (tb_sa[MACSEC_SA_ATTR_PN]) {
|
||||
spin_lock_bh(&tx_sa->lock);
|
||||
prev_pn = tx_sa->next_pn;
|
||||
tx_sa->next_pn = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
|
||||
prev_pn = tx_sa->next_pn_halves;
|
||||
tx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
|
||||
spin_unlock_bh(&tx_sa->lock);
|
||||
}
|
||||
|
||||
|
|
@ -2197,7 +2253,7 @@ static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info)
|
|||
cleanup:
|
||||
if (tb_sa[MACSEC_SA_ATTR_PN]) {
|
||||
spin_lock_bh(&tx_sa->lock);
|
||||
tx_sa->next_pn = prev_pn;
|
||||
tx_sa->next_pn_halves = prev_pn;
|
||||
spin_unlock_bh(&tx_sa->lock);
|
||||
}
|
||||
tx_sa->active = was_active;
|
||||
|
|
@ -2217,9 +2273,11 @@ static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info)
|
|||
struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
|
||||
struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
|
||||
bool was_active;
|
||||
u32 prev_pn = 0;
|
||||
pn_t prev_pn;
|
||||
int ret = 0;
|
||||
|
||||
prev_pn.full64 = 0;
|
||||
|
||||
if (!attrs[MACSEC_ATTR_IFINDEX])
|
||||
return -EINVAL;
|
||||
|
||||
|
|
@ -2242,8 +2300,8 @@ static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info)
|
|||
|
||||
if (tb_sa[MACSEC_SA_ATTR_PN]) {
|
||||
spin_lock_bh(&rx_sa->lock);
|
||||
prev_pn = rx_sa->next_pn;
|
||||
rx_sa->next_pn = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
|
||||
prev_pn = rx_sa->next_pn_halves;
|
||||
rx_sa->next_pn_halves.lower = nla_get_u32(tb_sa[MACSEC_SA_ATTR_PN]);
|
||||
spin_unlock_bh(&rx_sa->lock);
|
||||
}
|
||||
|
||||
|
|
@ -2276,7 +2334,7 @@ static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info)
|
|||
cleanup:
|
||||
if (tb_sa[MACSEC_SA_ATTR_PN]) {
|
||||
spin_lock_bh(&rx_sa->lock);
|
||||
rx_sa->next_pn = prev_pn;
|
||||
rx_sa->next_pn_halves = prev_pn;
|
||||
spin_unlock_bh(&rx_sa->lock);
|
||||
}
|
||||
rx_sa->active = was_active;
|
||||
|
|
@ -2795,7 +2853,7 @@ dump_secy(struct macsec_secy *secy, struct net_device *dev,
|
|||
}
|
||||
|
||||
if (nla_put_u8(skb, MACSEC_SA_ATTR_AN, i) ||
|
||||
nla_put_u32(skb, MACSEC_SA_ATTR_PN, tx_sa->next_pn) ||
|
||||
nla_put_u32(skb, MACSEC_SA_ATTR_PN, tx_sa->next_pn_halves.lower) ||
|
||||
nla_put(skb, MACSEC_SA_ATTR_KEYID, MACSEC_KEYID_LEN, tx_sa->key.id) ||
|
||||
nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, tx_sa->active)) {
|
||||
nla_nest_cancel(skb, txsa_nest);
|
||||
|
|
@ -2899,7 +2957,7 @@ dump_secy(struct macsec_secy *secy, struct net_device *dev,
|
|||
nla_nest_end(skb, attr);
|
||||
|
||||
if (nla_put_u8(skb, MACSEC_SA_ATTR_AN, i) ||
|
||||
nla_put_u32(skb, MACSEC_SA_ATTR_PN, rx_sa->next_pn) ||
|
||||
nla_put_u32(skb, MACSEC_SA_ATTR_PN, rx_sa->next_pn_halves.lower) ||
|
||||
nla_put(skb, MACSEC_SA_ATTR_KEYID, MACSEC_KEYID_LEN, rx_sa->key.id) ||
|
||||
nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, rx_sa->active)) {
|
||||
nla_nest_cancel(skb, rxsa_nest);
|
||||
|
|
|
|||
|
|
@ -11,18 +11,45 @@
|
|||
#include <uapi/linux/if_link.h>
|
||||
#include <uapi/linux/if_macsec.h>
|
||||
|
||||
typedef u64 __bitwise sci_t;
|
||||
|
||||
#define MACSEC_SALT_LEN 12
|
||||
#define MACSEC_NUM_AN 4 /* 2 bits for the association number */
|
||||
|
||||
typedef u64 __bitwise sci_t;
|
||||
typedef u32 __bitwise ssci_t;
|
||||
|
||||
typedef union salt {
|
||||
struct {
|
||||
u32 ssci;
|
||||
u64 pn;
|
||||
} __packed;
|
||||
u8 bytes[MACSEC_SALT_LEN];
|
||||
} __packed salt_t;
|
||||
|
||||
typedef union pn {
|
||||
struct {
|
||||
#if defined(__LITTLE_ENDIAN_BITFIELD)
|
||||
u32 lower;
|
||||
u32 upper;
|
||||
#elif defined(__BIG_ENDIAN_BITFIELD)
|
||||
u32 upper;
|
||||
u32 lower;
|
||||
#else
|
||||
#error "Please fix <asm/byteorder.h>"
|
||||
#endif
|
||||
};
|
||||
u64 full64;
|
||||
} pn_t;
|
||||
|
||||
/**
|
||||
* struct macsec_key - SA key
|
||||
* @id: user-provided key identifier
|
||||
* @tfm: crypto struct, key storage
|
||||
* @salt: salt used to generate IV in XPN cipher suites
|
||||
*/
|
||||
struct macsec_key {
|
||||
u8 id[MACSEC_KEYID_LEN];
|
||||
struct crypto_aead *tfm;
|
||||
salt_t salt;
|
||||
};
|
||||
|
||||
struct macsec_rx_sc_stats {
|
||||
|
|
@ -64,12 +91,17 @@ struct macsec_tx_sc_stats {
|
|||
* @next_pn: packet number expected for the next packet
|
||||
* @lock: protects next_pn manipulations
|
||||
* @key: key structure
|
||||
* @ssci: short secure channel identifier
|
||||
* @stats: per-SA stats
|
||||
*/
|
||||
struct macsec_rx_sa {
|
||||
struct macsec_key key;
|
||||
ssci_t ssci;
|
||||
spinlock_t lock;
|
||||
u32 next_pn;
|
||||
union {
|
||||
pn_t next_pn_halves;
|
||||
u64 next_pn;
|
||||
};
|
||||
refcount_t refcnt;
|
||||
bool active;
|
||||
struct macsec_rx_sa_stats __percpu *stats;
|
||||
|
|
@ -110,12 +142,17 @@ struct macsec_rx_sc {
|
|||
* @next_pn: packet number to use for the next packet
|
||||
* @lock: protects next_pn manipulations
|
||||
* @key: key structure
|
||||
* @ssci: short secure channel identifier
|
||||
* @stats: per-SA stats
|
||||
*/
|
||||
struct macsec_tx_sa {
|
||||
struct macsec_key key;
|
||||
ssci_t ssci;
|
||||
spinlock_t lock;
|
||||
u32 next_pn;
|
||||
union {
|
||||
pn_t next_pn_halves;
|
||||
u64 next_pn;
|
||||
};
|
||||
refcount_t refcnt;
|
||||
bool active;
|
||||
struct macsec_tx_sa_stats __percpu *stats;
|
||||
|
|
@ -152,6 +189,7 @@ struct macsec_tx_sc {
|
|||
* @key_len: length of keys used by the cipher suite
|
||||
* @icv_len: length of ICV used by the cipher suite
|
||||
* @validate_frames: validation mode
|
||||
* @xpn: enable XPN for this SecY
|
||||
* @operational: MAC_Operational flag
|
||||
* @protect_frames: enable protection for this SecY
|
||||
* @replay_protect: enable packet number checks on receive
|
||||
|
|
@ -166,6 +204,7 @@ struct macsec_secy {
|
|||
u16 key_len;
|
||||
u16 icv_len;
|
||||
enum macsec_validation_type validate_frames;
|
||||
bool xpn;
|
||||
bool operational;
|
||||
bool protect_frames;
|
||||
bool replay_protect;
|
||||
|
|
|
|||
Loading…
Reference in a new issue