From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 8CD33A32A3 for ; Fri, 25 Oct 2019 12:00:48 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 4959C1D40A; Fri, 25 Oct 2019 12:00:32 +0200 (CEST) Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) by dpdk.org (Postfix) with ESMTP id 471861D40A for ; Fri, 25 Oct 2019 12:00:31 +0200 (CEST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga002.jf.intel.com ([10.7.209.21]) by fmsmga104.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 25 Oct 2019 03:00:30 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,228,1569308400"; d="scan'208";a="210678584" Received: from irsmsx153.ger.corp.intel.com ([163.33.192.75]) by orsmga002.jf.intel.com with ESMTP; 25 Oct 2019 03:00:28 -0700 Received: from irsmsx104.ger.corp.intel.com ([169.254.5.252]) by IRSMSX153.ger.corp.intel.com ([169.254.9.119]) with mapi id 14.03.0439.000; Fri, 25 Oct 2019 11:00:28 +0100 From: "Ananyev, Konstantin" To: Hemant Agrawal , "dev@dpdk.org" , "akhil.goyal@nxp.com" , "Doherty, Declan" Thread-Topic: [dpdk-dev] [PATCH 1/2] security: add anti replay window size Thread-Index: AQHVivzP9+d/udUvpk6X7QoC0Xf4rqdrHmBg Date: Fri, 25 Oct 2019 10:00:27 +0000 Message-ID: <2601191342CEEE43887BDE71AB97725801A8C701D1@IRSMSX104.ger.corp.intel.com> References: <20191025062021.18052-1-hemant.agrawal@nxp.com> In-Reply-To: <20191025062021.18052-1-hemant.agrawal@nxp.com> Accept-Language: en-IE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiOWQ4Yzk3YzQtZjIwZi00YTFmLWE5YjQtMDJjYmQ0MzhhNDg4IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiSWFyaFlGRDVoTmN4Zklta0dzVWIyNHIxc2xaRDE3bzY5QVcwS09pQ3FMakFrdUtUSEtTdUhoQzU2M05XSmxldCJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [163.33.239.182] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [dpdk-dev] [PATCH 1/2] security: add anti replay window size X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi Hemant, >=20 > At present the ipsec xfrom is missing the important step > to configure the anti replay window size. > The newly added field will also help in to enable or disable > the anti replay checking, if available in offload by means > of non-zero or zero value. +1 for those changes. Though AFAIK, it will be an ABI breakage, right? So probably deserves changes in release notes. >=20 > Currently similar field is available in rte_ipsec lib for > software ipsec usage.=20 Yep, the only thing why it was put here - to avoid ABI breakage within rte_security. Having it in the rte_security_ipsec_xform makes much more sense.=20 >The newly introduced filed can replace > that field as well eventually. My suggestion would be to update librte_ipsec as part of these patch series. >=20 > Signed-off-by: Hemant Agrawal > --- > lib/librte_security/rte_security.h | 4 ++++ > 1 file changed, 4 insertions(+) >=20 > diff --git a/lib/librte_security/rte_security.h b/lib/librte_security/rte= _security.h > index aaafdfcd7..195ad5645 100644 > --- a/lib/librte_security/rte_security.h > +++ b/lib/librte_security/rte_security.h > @@ -212,6 +212,10 @@ struct rte_security_ipsec_xform { > /**< Tunnel parameters, NULL for transport mode */ > uint64_t esn_soft_limit; > /**< ESN for which the overflow event need to be raised */ > + uint32_t replay_win_sz; > + /**< Anti replay window size to enable sequence replay attack handling. > + * replay checking is disabled if the window size is 0. > + */ > };