From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 52023A09F6; Fri, 18 Dec 2020 10:45:15 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 60F0DCD37; Fri, 18 Dec 2020 10:35:31 +0100 (CET) Received: from smtpbgau2.qq.com (smtpbgau2.qq.com [54.206.34.216]) by dpdk.org (Postfix) with ESMTP id C1EDFCBEC for ; Fri, 18 Dec 2020 10:35:21 +0100 (CET) X-QQ-mid: bizesmtp28t1608284115t2qa5qoa Received: from localhost.localdomain.com (unknown [183.129.236.74]) by esmtp10.qq.com (ESMTP) with id ; Fri, 18 Dec 2020 17:35:15 +0800 (CST) X-QQ-SSF: 01400000002000C0D000B00A0000000 X-QQ-FEAT: Ry58bBY793t30rtTM+/sOXKyTm4P+xpRKqzHARMn5pp2nYOV5wuAEFlZ0Lq8D iqR7NzLPzhpYgbJLxlNo91lhJZY2vesZ0zN7O8ppZtopfNOV1tN/Ps63v/Mv6kbRocoGwke nkMcwBSQB+z5Sa5R9zq465s0thclitDVIeAe4OtWaMBMrQp4yrBKuXUlh8xfyWs1Kh96EYV qjBdUMyCIYeKsZoDlkq+NSHgMJHZ5Jy8LVahjrp2gEHBh5nM1e3vYJQQNtrcI5L7zF8NOoE zcosIXpIXa+XewM9JjUpElmdCON6TwhoDG2P+gPWWa2u1RNvH215cTrh8YspAZXSLRRD9Bp +oQhBilvfq24akILJLQp3tseWrq+w== X-QQ-GoodBg: 2 From: Jiawen Wu To: dev@dpdk.org Cc: Jiawen Wu Date: Fri, 18 Dec 2020 17:37:02 +0800 Message-Id: <20201218093702.3651867-34-jiawenwu@trustnetic.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20201218093702.3651867-1-jiawenwu@trustnetic.com> References: <20201218093702.3651867-1-jiawenwu@trustnetic.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-QQ-SENDSIZE: 520 Feedback-ID: bizesmtp:trustnetic.com:qybgforeign:qybgforeign6 X-QQ-Bgrelay: 1 Subject: [dpdk-dev] [PATCH v3 33/33] net/txgbe: add security type in flow action X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Add security type in flow action. Signed-off-by: Jiawen Wu --- drivers/net/txgbe/txgbe_flow.c | 52 +++++++++++++++++++++++++++++++++ drivers/net/txgbe/txgbe_ipsec.c | 30 +++++++++++++++++++ drivers/net/txgbe/txgbe_ipsec.h | 3 ++ 3 files changed, 85 insertions(+) diff --git a/drivers/net/txgbe/txgbe_flow.c b/drivers/net/txgbe/txgbe_flow.c index 488949c84..57a4f2e17 100644 --- a/drivers/net/txgbe/txgbe_flow.c +++ b/drivers/net/txgbe/txgbe_flow.c @@ -129,6 +129,9 @@ const struct rte_flow_action *next_no_void_action( * END * other members in mask and spec should set to 0x00. * item->last should be NULL. + * + * Special case for flow action type RTE_FLOW_ACTION_TYPE_SECURITY. + * */ static int cons_parse_ntuple_filter(const struct rte_flow_attr *attr, @@ -177,6 +180,43 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr, memset(ð_null, 0, sizeof(struct rte_flow_item_eth)); memset(&vlan_null, 0, sizeof(struct rte_flow_item_vlan)); +#ifdef RTE_LIB_SECURITY + /** + * Special case for flow action type RTE_FLOW_ACTION_TYPE_SECURITY + */ + act = next_no_void_action(actions, NULL); + if (act->type == RTE_FLOW_ACTION_TYPE_SECURITY) { + const void *conf = act->conf; + /* check if the next not void item is END */ + act = next_no_void_action(actions, act); + if (act->type != RTE_FLOW_ACTION_TYPE_END) { + memset(filter, 0, sizeof(struct rte_eth_ntuple_filter)); + rte_flow_error_set(error, EINVAL, + RTE_FLOW_ERROR_TYPE_ACTION, + act, "Not supported action."); + return -rte_errno; + } + + /* get the IP pattern*/ + item = next_no_void_pattern(pattern, NULL); + while (item->type != RTE_FLOW_ITEM_TYPE_IPV4 && + item->type != RTE_FLOW_ITEM_TYPE_IPV6) { + if (item->last || + item->type == RTE_FLOW_ITEM_TYPE_END) { + rte_flow_error_set(error, EINVAL, + RTE_FLOW_ERROR_TYPE_ITEM, + item, "IP pattern missing."); + return -rte_errno; + } + item = next_no_void_pattern(pattern, item); + } + + filter->proto = IPPROTO_ESP; + return txgbe_crypto_add_ingress_sa_from_flow(conf, item->spec, + item->type == RTE_FLOW_ITEM_TYPE_IPV6); + } +#endif + /* the first not void item can be MAC or IPv4 */ item = next_no_void_pattern(pattern, NULL); @@ -547,6 +587,12 @@ txgbe_parse_ntuple_filter(struct rte_eth_dev *dev, if (ret) return ret; +#ifdef RTE_LIB_SECURITY + /* ESP flow not really a flow */ + if (filter->proto == IPPROTO_ESP) + return 0; +#endif + /* txgbe doesn't support tcp flags */ if (filter->flags & RTE_NTUPLE_FLAGS_TCP_FLAG) { memset(filter, 0, sizeof(struct rte_eth_ntuple_filter)); @@ -2672,6 +2718,12 @@ txgbe_flow_create(struct rte_eth_dev *dev, ret = txgbe_parse_ntuple_filter(dev, attr, pattern, actions, &ntuple_filter, error); +#ifdef RTE_LIB_SECURITY + /* ESP flow not really a flow*/ + if (ntuple_filter.proto == IPPROTO_ESP) + return flow; +#endif + if (!ret) { ret = txgbe_add_del_ntuple_filter(dev, &ntuple_filter, TRUE); if (!ret) { diff --git a/drivers/net/txgbe/txgbe_ipsec.c b/drivers/net/txgbe/txgbe_ipsec.c index 6e6006f00..daa523b20 100644 --- a/drivers/net/txgbe/txgbe_ipsec.c +++ b/drivers/net/txgbe/txgbe_ipsec.c @@ -655,6 +655,36 @@ txgbe_crypto_enable_ipsec(struct rte_eth_dev *dev) return 0; } +int +txgbe_crypto_add_ingress_sa_from_flow(const void *sess, + const void *ip_spec, + uint8_t is_ipv6) +{ + struct txgbe_crypto_session *ic_session = + get_sec_session_private_data(sess); + + if (ic_session->op == TXGBE_OP_AUTHENTICATED_DECRYPTION) { + if (is_ipv6) { + const struct rte_flow_item_ipv6 *ipv6 = ip_spec; + ic_session->src_ip.type = IPv6; + ic_session->dst_ip.type = IPv6; + rte_memcpy(ic_session->src_ip.ipv6, + ipv6->hdr.src_addr, 16); + rte_memcpy(ic_session->dst_ip.ipv6, + ipv6->hdr.dst_addr, 16); + } else { + const struct rte_flow_item_ipv4 *ipv4 = ip_spec; + ic_session->src_ip.type = IPv4; + ic_session->dst_ip.type = IPv4; + ic_session->src_ip.ipv4 = ipv4->hdr.src_addr; + ic_session->dst_ip.ipv4 = ipv4->hdr.dst_addr; + } + return txgbe_crypto_add_sa(ic_session); + } + + return 0; +} + static struct rte_security_ops txgbe_security_ops = { .session_create = txgbe_crypto_create_session, .session_get_size = txgbe_crypto_session_get_size, diff --git a/drivers/net/txgbe/txgbe_ipsec.h b/drivers/net/txgbe/txgbe_ipsec.h index 58e18552d..5edd6b507 100644 --- a/drivers/net/txgbe/txgbe_ipsec.h +++ b/drivers/net/txgbe/txgbe_ipsec.h @@ -90,5 +90,8 @@ struct txgbe_ipsec { }; int txgbe_crypto_enable_ipsec(struct rte_eth_dev *dev); +int txgbe_crypto_add_ingress_sa_from_flow(const void *sess, + const void *ip_spec, + uint8_t is_ipv6); #endif /*TXGBE_IPSEC_H_*/ -- 2.18.2