MACsec Intel® FPGA IP User Guide

ID 736108
Date 6/26/2023
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents

5.3.1.4. PDU Validation

A received MPDU is valid if and only if it comprises a valid SecTAG, one or more octets of Secure Data, and an ICV. For example:

  1. It comprises at least 17 octets.
  2. Octets 1 and 2 compose the MACsec EtherType.
  3. The V bit in the TCI is clear.
  4. If the ES or the SCB bit in the TCI is set, then the SC bit is clear.
  5. Bits 7 and 8 of octet 4 of the SecTAG are clear.
  6. If the C and SC bits in the TCI are clear, the MPDU comprises 24 octets plus the number of octets indicated by the SL field if that is non-zero and at least 72 octets otherwise.
  7. If the C bit is clear and the SC bit is set, then the MPDU comprises 32 octets plus the number of octets indicated by the SL field if that is non-zero and at least 80 octets otherwise.
  8. If the C bit is set and the SC bit is clear, then the MPDU comprises 8 octets plus the minimum length of the ICV as determined by the Cipher Suite in use at the receiving SecY, plus the number of octets indicated by the SL field if that is non-zero and at least 48 additional octets otherwise.
  9. If the C and SC bits are both set, the frame comprises at least 16 octets plus the minimum length of the ICV as determined by the Cipher Suite in use at the receiving SecY, plus the number of octets indicated by the SL field if that is non-zero and at least 48 additional octets otherwise.

Items 1 and 6-9 do not have explicit logic implemented in the MACsec IP to check for these conditions. Instead when these conditions are violated, the ICV comparison fails and the IP drops the packet.

If the received frame is marked as invalid, and the validateFrames control is Strict or the C bit in the SecTAG is set, the frame is discarded and the InPktsNotValid counter is incremented. Otherwise, the frame is delivered to the Controlled port, and the appropriate counter is incremented as follows:
  1. If the frame is not valid and validateFrames is set to Check, InPktsInvalid; otherwise,
  2. If the received PN is less than the lowest acceptable PN (treating a 32-bit PN value of zero as 2^32 and a 64-bit PN value of zero as 2^64), InPktsDelayed; otherwise,
  3. If the frame is not valid, InPktsUnchecked; otherwise,
  4. InPktsOK