2fc0675683
The purpose of the Lowest Acceptable PN (lpn) parameters in the MACsec SAK Use parameter set is to enforce delay protection. Per IEEE Std 802.1X-2010, Clause 9, "Each SecY uses MKA to communicate the lowest PN used for transmission with the SAK within the last two seconds, allowing receivers to bound transmission delays." When encoding the SAK Use parameter set the KaY should set llpn and olpn to the lowest PN transmitted by the latest SAK and oldest SAK (if active) within the last two seconds. Because MKPDUs are transmitted every 2 seconds (MKA_HELLO_TIME), the solution implemented here calculates lpn based on the txsc->next_pn read during the previous MKPDU transmit. Upon receiving and decoding a SAK Use parameter set with delay protection enabled, the KaY will update the SecY's lpn if the delay protect lpn is greater than the SecY's current lpn (which is a product of last PN received and replay protection and window size). Signed-off-by: Michael Siedzik <msiedzik@extremenetworks.com>
62 lines
2.6 KiB
C
62 lines
2.6 KiB
C
/*
|
|
* SecY Operations
|
|
* Copyright (c) 2013, Qualcomm Atheros, Inc.
|
|
*
|
|
* This software may be distributed under the terms of the BSD license.
|
|
* See README for more details.
|
|
*/
|
|
|
|
#ifndef IEEE802_1X_SECY_OPS_H
|
|
#define IEEE802_1X_SECY_OPS_H
|
|
|
|
#include "common/defs.h"
|
|
#include "common/ieee802_1x_defs.h"
|
|
|
|
struct ieee802_1x_kay_conf;
|
|
|
|
int secy_init_macsec(struct ieee802_1x_kay *kay);
|
|
int secy_deinit_macsec(struct ieee802_1x_kay *kay);
|
|
|
|
/****** CP -> SecY ******/
|
|
int secy_cp_control_validate_frames(struct ieee802_1x_kay *kay,
|
|
enum validate_frames vf);
|
|
int secy_cp_control_protect_frames(struct ieee802_1x_kay *kay, Boolean flag);
|
|
int secy_cp_control_encrypt(struct ieee802_1x_kay *kay, Boolean enabled);
|
|
int secy_cp_control_replay(struct ieee802_1x_kay *kay, Boolean flag, u32 win);
|
|
int secy_cp_control_current_cipher_suite(struct ieee802_1x_kay *kay, u64 cs);
|
|
int secy_cp_control_confidentiality_offset(struct ieee802_1x_kay *kay,
|
|
enum confidentiality_offset co);
|
|
int secy_cp_control_enable_port(struct ieee802_1x_kay *kay, Boolean flag);
|
|
|
|
/****** KaY -> SecY *******/
|
|
int secy_get_capability(struct ieee802_1x_kay *kay, enum macsec_cap *cap);
|
|
int secy_get_receive_lowest_pn(struct ieee802_1x_kay *kay,
|
|
struct receive_sa *rxsa);
|
|
int secy_get_transmit_next_pn(struct ieee802_1x_kay *kay,
|
|
struct transmit_sa *txsa);
|
|
int secy_set_transmit_next_pn(struct ieee802_1x_kay *kay,
|
|
struct transmit_sa *txsa);
|
|
int secy_set_receive_lowest_pn(struct ieee802_1x_kay *kay,
|
|
struct receive_sa *txsa);
|
|
int secy_create_receive_sc(struct ieee802_1x_kay *kay, struct receive_sc *rxsc);
|
|
int secy_delete_receive_sc(struct ieee802_1x_kay *kay, struct receive_sc *rxsc);
|
|
int secy_create_receive_sa(struct ieee802_1x_kay *kay, struct receive_sa *rxsa);
|
|
int secy_delete_receive_sa(struct ieee802_1x_kay *kay, struct receive_sa *rxsa);
|
|
int secy_enable_receive_sa(struct ieee802_1x_kay *kay, struct receive_sa *rxsa);
|
|
int secy_disable_receive_sa(struct ieee802_1x_kay *kay,
|
|
struct receive_sa *rxsa);
|
|
|
|
int secy_create_transmit_sc(struct ieee802_1x_kay *kay,
|
|
struct transmit_sc *txsc);
|
|
int secy_delete_transmit_sc(struct ieee802_1x_kay *kay,
|
|
struct transmit_sc *txsc);
|
|
int secy_create_transmit_sa(struct ieee802_1x_kay *kay,
|
|
struct transmit_sa *txsa);
|
|
int secy_delete_transmit_sa(struct ieee802_1x_kay *kay,
|
|
struct transmit_sa *txsa);
|
|
int secy_enable_transmit_sa(struct ieee802_1x_kay *kay,
|
|
struct transmit_sa *txsa);
|
|
int secy_disable_transmit_sa(struct ieee802_1x_kay *kay,
|
|
struct transmit_sa *txsa);
|
|
|
|
#endif /* IEEE802_1X_SECY_OPS_H */
|