[dpdk-dev] [RFC 1/5] security: MACSEC infrastructure data declarations

[dpdk-dev] [RFC 1/5] security: MACSEC infrastructure data declarations

[Igor Russkikh]

This RFC suggest possible API to implement generic MACSEC HW
offload in DPDK infrastructure.

Right now two PMDs implementing MACSEC hw offload via private
API: ixgbe (Intel) and atlantic (Aquantia).

During that private API discussion it was decided to go further
with well defined public API, based most probably on rte_security
infrastructure.

Here is that previous discussion:

http://inbox.dpdk.org/dev/20190416101145.nVecHKp3w14Ptd_hne-DqHhKyzbre88PwNI-OAowXJM@z/

Declaring macsec API via rte_security gives a good data-centric view on parameters
and operations macsec supports. Old, pure functional API (basically ixbe only API)
presented function calls with big argument lists which is hard to extend and analyse.

However, I'd like to note rte_security has to be used via explicitly created
mempools - this hardens abit the usage.
It also may be hard to extend the structures in the ABI compatible way.

One of the problems with MACSEC is that internally implementation and hardware
support could be either very simple, doing only endpoint encryption with a single
TX SC (Secure Connection), or quite complex, capable to do flexible filtering
and SC matching based on mac, vlan, ethertype and other.

Different macsec hardware supports some custom features and from our experience
users would like to configure these as well. Therefore there will probably be
needed a number of PMD specific macsec operators support.

Examples include: custom in-the-clear tag (matched by vlan id or mask),
configurable internal logic to allow both secure and unsecure traffic,
bypass filters on specific ethertypes.
To support such extensions, suggest use rte_security_macsec_op enum with
vendor specific operation codes.

In context of rte_security, MACSEC operations should normally be based on
security session create and update calls.

Session create is used to setup overall session. Thats equivalent of old
`macsec enable` operation.

Session update is used to update security connections and associations.
Here xform->op contains the required operation: rx/tx session/association
add/update/removal.

This RFC contains:
- patch 1 is rte_security data structures declaration
- patches 2-4 is a draft on how testpmd based invocations of rte_security
  API will look like
- patch 5 is a draft on how PMD driver will implement security infrastructure

To be done/decide:
- testpmd macsec command layout changes: encryption and repl protection
  are properties of SC, not the overall connection.
- add missing documentation and comments to all the structures
- full testpmd macsec API adoption
- ixgbe api adoptation
- atlantic api adiptation
- decide on how to declare SA (Security Associations) auto rollover and
  some other important features.
- interrupt event callback detalization of possible macsec events.
  Notice that it is not a part of rte_security, but a part of rte_ethdev.
- macsec statistics is now part of xstats list. Alternatively it could be
  moved to rte_security statistics. The hard thing is that stats are
  often available per SC/SA, a special API is required to fetch that.

Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
---
 lib/librte_security/meson.build    |   2 +-
 lib/librte_security/rte_security.h | 115 ++++++++++++++++++++++++++++-
 2 files changed, 113 insertions(+), 4 deletions(-)

diff --git a/lib/librte_security/meson.build b/lib/librte_security/meson.build
index a5130d2f6d1e..10877d3ae544 100644
--- a/lib/librte_security/meson.build
+++ b/lib/librte_security/meson.build
@@ -4,4 +4,4 @@
 version = 2
 sources = files('rte_security.c')
 headers = files('rte_security.h', 'rte_security_driver.h')
-deps += ['mempool', 'cryptodev']
+deps += ['mempool', 'cryptodev', 'net']
diff --git a/lib/librte_security/rte_security.h b/lib/librte_security/rte_security.h
index 76f54e0e05bb..a3a9204fb62d 100644
--- a/lib/librte_security/rte_security.h
+++ b/lib/librte_security/rte_security.h
@@ -29,6 +29,7 @@ extern "C" {
 #include <rte_mbuf.h>
 #include <rte_memory.h>
 #include <rte_mempool.h>
+#include <rte_ether.h>
 
 /** IPSec protocol mode */
 enum rte_security_ipsec_sa_mode {
@@ -197,12 +198,87 @@ struct rte_security_ipsec_xform {
 	/**< ESN for which the overflow event need to be raised */
 };
 
+/**
+ * MACSEC global configuration parameters
+ *
+ */
+struct rte_security_macsec_param {
+	uint8_t enabled;
+};
+
+/**
+ * MACSEC SC (Secure Connection) parameters
+ *
+ */
+struct rte_security_macsec_txsc_param {
+	struct ether_addr s_mac;
+	/**< local side mac address */
+	struct ether_addr d_mac;
+	/**< remote side mac address */
+	uint32_t sci;
+	uint32_t tci;
+	uint8_t encrypt;
+	uint8_t protect;
+};
+
+struct rte_security_macsec_rxsc_param {
+	struct ether_addr s_mac, d_mac;
+	/**< remote side mac address */
+	uint8_t replay_protection;
+	/**< replay protection */
+	uint32_t anti_replay_window;
+	/**< anti replay window */
+	uint16_t port_ident;
+	/**< remote side port identifier */
+	uint8_t auto_rollover_enabled;
+};
+
+struct rte_security_macsec_sa_param {
+	uint8_t sa_idx;
+	uint8_t an;
+	uint32_t packet_number;
+	uint8_t key_len;
+	uint8_t key[32];
+};
+
+/**
+ * Available operations over MACSEC instance
+ */
+enum rte_security_macsec_op {
+	RTE_SECURITY_MACSEC_OP_CONFIG,
+
+	RTE_SECURITY_MACSEC_OP_ADD_TXSC,
+	RTE_SECURITY_MACSEC_OP_DEL_TXSC,
+	RTE_SECURITY_MACSEC_OP_UPD_TXSC,
+
+	RTE_SECURITY_MACSEC_OP_ADD_RXSC,
+	RTE_SECURITY_MACSEC_OP_DEL_RXSC,
+	RTE_SECURITY_MACSEC_OP_UPD_RXSC,
+
+	RTE_SECURITY_MACSEC_OP_ADD_TXSA,
+	RTE_SECURITY_MACSEC_OP_DEL_TXSA,
+	RTE_SECURITY_MACSEC_OP_UPD_TXSA,
+
+	RTE_SECURITY_MACSEC_OP_ADD_RXSA,
+	RTE_SECURITY_MACSEC_OP_DEL_RXSA,
+	RTE_SECURITY_MACSEC_OP_UPD_RXSA,
+
+	RTE_SECURITY_MACSEC_OP_STATS,
+
+	RTE_SECURITY_MACSEC_OP_VENDOR = 0x100,
+};
+
 /**
  * MACsec security session configuration
  */
 struct rte_security_macsec_xform {
-	/** To be Filled */
-	int dummy;
+	enum rte_security_macsec_op op;
+	union {
+		struct rte_security_macsec_param config_options;
+		struct rte_security_macsec_txsc_param txsc_options;
+		struct rte_security_macsec_rxsc_param rxsc_options;
+		struct rte_security_macsec_sa_param sa_options;
+	};
 };
 
 /**
@@ -467,7 +543,40 @@ rte_security_attach_session(struct rte_crypto_op *op,
 }
 
 struct rte_security_macsec_stats {
-	uint64_t reserved;
+	/* Ingress Common Counters */
+	uint64_t in_ctl_pkts;
+	uint64_t in_tagged_miss_pkts;
+	uint64_t in_untagged_miss_pkts;
+	uint64_t in_notag_pkts;
+	uint64_t in_untagged_pkts;
+	uint64_t in_bad_tag_pkts;
+	uint64_t in_no_sci_pkts;
+	uint64_t in_unknown_sci_pkts;
+	/* Ingress SA Counters */
+	uint64_t in_untagged_hit_pkts;
+	uint64_t in_not_using_sa;
+	uint64_t in_unused_sa;
+	uint64_t in_not_valid_pkts;
+	uint64_t in_invalid_pkts;
+	uint64_t in_ok_pkts;
+	uint64_t in_unchecked_pkts;
+	uint64_t in_validated_octets;
+	uint64_t in_decrypted_octets;
+	/* Egress Common Counters */
+	uint64_t out_ctl_pkts;
+	uint64_t out_unknown_sa_pkts;
+	uint64_t out_untagged_pkts;
+	uint64_t out_too_long;
+	/* Egress SC Counters */
+	uint64_t out_sc_protected_pkts;
+	uint64_t out_sc_encrypted_pkts;
+	uint64_t out_sc_protected_octets;
+	uint64_t out_sc_encrypted_octets;
+	/* Egress SA Counters */
+	uint64_t out_sa_hit_drop_redirect;
+	uint64_t out_sa_protected2_pkts;
+	uint64_t out_sa_protected_pkts;
+	uint64_t out_sa_encrypted_pkts;
 };
 
 struct rte_security_ipsec_stats {
-- 
2.17.1

[dpdk-dev] [RFC 2/5] app/testpmd: macsec on command draft via security context

[Igor Russkikh]

Here we create/get security mempool, get sec_ctx, and then
request session creation with macsec specific session configuration.

encrypt and replay_protection parameters are really not a global macsec
attributes, they are related to tx and rx security connection properties.

But we keep testpmd commands structure the same for now and will redesign
it in later commits.

Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
---
 app/test-pmd/cmdline.c | 54 +++++++++++++++++++++++++++++++++++-------
 1 file changed, 46 insertions(+), 8 deletions(-)

diff --git a/app/test-pmd/cmdline.c b/app/test-pmd/cmdline.c
index c1042dd98214..dbee3d958c2e 100644
--- a/app/test-pmd/cmdline.c
+++ b/app/test-pmd/cmdline.c
@@ -46,6 +46,7 @@
 #include <rte_devargs.h>
 #include <rte_flow.h>
 #include <rte_gro.h>
+#include <rte_security.h>
 
 #include <cmdline_rdline.h>
 #include <cmdline_parse.h>
@@ -13991,6 +13992,12 @@ struct cmd_macsec_offload_on_result {
 	cmdline_fixed_string_t rp_on_off;
 };
 
+/* Temporary static storage until testpmd macsec commands get reformatted */
+int macsec_encrypt;
+int macsec_replay_protection;
+struct rte_security_session_conf macsec_conf;
+struct rte_security_session *macsec_session;
+
 /* Common CLI fields for MACsec offload disable */
 cmdline_parse_token_string_t cmd_macsec_offload_on_set =
 	TOKEN_STRING_INITIALIZER
@@ -14029,6 +14036,23 @@ cmdline_parse_token_string_t cmd_macsec_offload_on_rp_on_off =
 		(struct cmd_macsec_offload_on_result,
 		 rp_on_off, "on#off");
 
+static struct rte_mempool *get_security_pool()
+{
+	struct rte_mempool *pool = rte_mempool_lookup("testpmd_security_pool");
+	int session_size = 256;
+
+	if (!pool) {
+		pool = rte_mempool_create("testpmd_security_pool",
+				256,
+				session_size,
+				256,
+				0, NULL, NULL, NULL,
+				NULL, SOCKET_ID_ANY,
+				0);
+	}
+	return pool;
+}
+
 static void
 cmd_set_macsec_offload_on_parsed(
 	void *parsed_result,
@@ -14036,11 +14060,13 @@ cmd_set_macsec_offload_on_parsed(
 	__attribute__((unused)) void *data)
 {
 	struct cmd_macsec_offload_on_result *res = parsed_result;
-	int ret = -ENOTSUP;
+	int ret = 0;
+	struct rte_security_ctx *ctx;
 	portid_t port_id = res->port_id;
 	int en = (strcmp(res->en_on_off, "on") == 0) ? 1 : 0;
 	int rp = (strcmp(res->rp_on_off, "on") == 0) ? 1 : 0;
 	struct rte_eth_dev_info dev_info;
+	struct rte_security_session_conf macsec_conf;
 
 	if (port_id_is_invalid(port_id, ENABLED_WARN))
 		return;
@@ -14049,17 +14075,29 @@ cmd_set_macsec_offload_on_parsed(
 		return;
 	}
 
-	rte_eth_dev_info_get(port_id, &dev_info);
-	if (dev_info.tx_offload_capa & DEV_TX_OFFLOAD_MACSEC_INSERT) {
-#ifdef RTE_LIBRTE_IXGBE_PMD
-		ret = rte_pmd_ixgbe_macsec_enable(port_id, en, rp);
-#endif
+	ctx = rte_eth_dev_get_sec_ctx(port_id);
+	if (!ctx) {
+		ret = ENOTSUP;
+		goto done;
+	}
+
+	macsec_conf.action_type = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL;
+	macsec_conf.protocol = RTE_SECURITY_PROTOCOL_MACSEC;
+	/** should be moved to SC properties */
+	macsec_encrypt = en;
+	macsec_replay_protection = rp;
+
+	/* Use of the same mempool for session header and private data */
+	macsec_session = rte_security_session_create(ctx, &macsec_conf, get_security_pool());
+
+	if (macsec_session == NULL) {
+		ret = -ENOTSUP;
 	}
-	RTE_SET_USED(en);
-	RTE_SET_USED(rp);
 
+done:
 	switch (ret) {
 	case 0:
+		/* TBD: To delete? */
 		ports[port_id].dev_conf.txmode.offloads |=
 						DEV_TX_OFFLOAD_MACSEC_INSERT;
 		cmd_reconfig_device_queue(port_id, 1, 1);
-- 
2.17.1

[dpdk-dev] [RFC 3/5] app/testpmd: macsec off command

[Igor Russkikh]

draft on how macsec off command will looks like

Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
---
 app/test-pmd/cmdline.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/app/test-pmd/cmdline.c b/app/test-pmd/cmdline.c
index dbee3d958c2e..af7c2853fd2c 100644
--- a/app/test-pmd/cmdline.c
+++ b/app/test-pmd/cmdline.c
@@ -14173,6 +14173,8 @@ cmd_set_macsec_offload_off_parsed(
 	int ret = -ENOTSUP;
 	struct rte_eth_dev_info dev_info;
 	portid_t port_id = res->port_id;
+	struct rte_security_ctx *ctx;
+	struct rte_eth_dev_info dev_info;
 
 	if (port_id_is_invalid(port_id, ENABLED_WARN))
 		return;
@@ -14181,14 +14183,24 @@ cmd_set_macsec_offload_off_parsed(
 		return;
 	}
 
-	rte_eth_dev_info_get(port_id, &dev_info);
-	if (dev_info.tx_offload_capa & DEV_TX_OFFLOAD_MACSEC_INSERT) {
-#ifdef RTE_LIBRTE_IXGBE_PMD
-		ret = rte_pmd_ixgbe_macsec_disable(port_id);
-#endif
+	if (!macsec_session) {
+		printf("MACsec is not active\n", port_id);
+		return;
+	}
+
+	ctx = rte_eth_dev_get_sec_ctx(port_id);
+	if (!ctx) {
+		ret = -ENOTSUP;
+		goto done;
 	}
+
+	/* Use of the same mempool for session header and private data */
+	ret = rte_security_session_destroy(ctx, macsec_session);
+
+done:
 	switch (ret) {
 	case 0:
+		/* TBD: Remove this offload bit? */
 		ports[port_id].dev_conf.txmode.offloads &=
 						~DEV_TX_OFFLOAD_MACSEC_INSERT;
 		cmd_reconfig_device_queue(port_id, 1, 1);
-- 
2.17.1

[dpdk-dev] [RFC 4/5] app/testpmd: macsec: update set sc command with new interface

[Igor Russkikh]

---
 app/test-pmd/cmdline.c | 40 ++++++++++++++++++++++++++++++++--------
 1 file changed, 32 insertions(+), 8 deletions(-)

diff --git a/app/test-pmd/cmdline.c b/app/test-pmd/cmdline.c
index af7c2853fd2c..1bcf63e31ee3 100644
--- a/app/test-pmd/cmdline.c
+++ b/app/test-pmd/cmdline.c
@@ -14083,6 +14083,7 @@ cmd_set_macsec_offload_on_parsed(
 
 	macsec_conf.action_type = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL;
 	macsec_conf.protocol = RTE_SECURITY_PROTOCOL_MACSEC;
+	macsec_conf.macsec.
 	/** should be moved to SC properties */
 	macsec_encrypt = en;
 	macsec_replay_protection = rp;
@@ -14280,15 +14281,38 @@ cmd_set_macsec_sc_parsed(
 	struct cmd_macsec_sc_result *res = parsed_result;
 	int ret = -ENOTSUP;
 	int is_tx = (strcmp(res->tx_rx, "tx") == 0) ? 1 : 0;
+	struct rte_security_ctx *ctx;
+	struct rte_eth_dev_info dev_info;
+	struct rte_security_session_conf conf = {};
 
-#ifdef RTE_LIBRTE_IXGBE_PMD
-	ret = is_tx ?
-		rte_pmd_ixgbe_macsec_config_txsc(res->port_id,
-				res->mac.addr_bytes) :
-		rte_pmd_ixgbe_macsec_config_rxsc(res->port_id,
-				res->mac.addr_bytes, res->pi);
-#endif
-	RTE_SET_USED(is_tx);
+	ctx = rte_eth_dev_get_sec_ctx(port_id);
+	if (!ctx) {
+		ret = ENOTSUP;
+		goto done;
+	}
+
+	if (is_tx) {
+		conf.macsec.op = RTE_SECURITY_MACSEC_OP_ADD_TXSC;
+
+		rte_memcpy(&conf.macsec.txsc_options.s_mac, res->mac.addr_bytes,
+			sizeof(struct ether_addr));
+		conf.macsec.txsc_options.encrypt = macsec_encrypt;
+		conf.macsec.txsc_options.protect = 1;
+
+		ret = rte_security_session_update(ctx, macsec_session, &conf);
+	} else {
+		conf.macsec.op = RTE_SECURITY_MACSEC_OP_ADD_RXSC;
+
+		rte_memcpy(&conf.macsec.rxsc_options.s_mac, res->mac.addr_bytes,
+			sizeof(struct ether_addr));
+		/* Default */
+		conf.macsec.rxsc_options.anti_replay_window = 0;
+		conf.macsec.rxsc_options.replay_protection = macsec_replay_protection;
+		conf.macsec.rxsc_options.auto_rollover_enabled = true;
+
+		ret = rte_security_session_update(ctx, macsec_session, &conf);
+
+	}
 
 	switch (ret) {
 	case 0:
-- 
2.17.1

[dpdk-dev] [RFC 5/5] net/atlantic: macsec security context draft

[Igor Russkikh]

---
 drivers/net/atlantic/atl_ethdev.c | 116 ++++++++++++++++++++++++++++++
 drivers/net/atlantic/meson.build  |   1 +
 2 files changed, 117 insertions(+)

diff --git a/drivers/net/atlantic/atl_ethdev.c b/drivers/net/atlantic/atl_ethdev.c
index c9c1795a1639..b6fcf36f0f27 100644
--- a/drivers/net/atlantic/atl_ethdev.c
+++ b/drivers/net/atlantic/atl_ethdev.c
@@ -5,6 +5,9 @@
 #include <rte_string_fns.h>
 #include <rte_ethdev_pci.h>
 #include <rte_alarm.h>
+#include <rte_security.h>
+#include <rte_security_driver.h>
+#include <rte_cryptodev.h>
 
 #include "atl_ethdev.h"
 #include "atl_common.h"
@@ -122,6 +125,7 @@ static int eth_atl_pci_remove(struct rte_pci_device *pci_dev);
 
 static void atl_dev_info_get(struct rte_eth_dev *dev,
 				struct rte_eth_dev_info *dev_info);
+static int atl_macsec_ctx_create(struct rte_eth_dev *dev);
 
 int atl_logtype_init;
 int atl_logtype_driver;
@@ -412,6 +416,10 @@ eth_atl_dev_init(struct rte_eth_dev *eth_dev)
 
 	hw->aq_nic_cfg = &adapter->hw_cfg;
 
+	/* Initialize security_ctx only for primary process*/
+	if (atl_macsec_ctx_create(eth_dev))
+		return -ENOMEM;
+
 	/* disable interrupt */
 	atl_disable_intr(hw);
 
@@ -475,6 +483,8 @@ eth_atl_dev_uninit(struct rte_eth_dev *eth_dev)
 	rte_free(eth_dev->data->mac_addrs);
 	eth_dev->data->mac_addrs = NULL;
 
+	rte_free(eth_dev->security_ctx);
+
 	return 0;
 }
 
@@ -1872,6 +1882,112 @@ atl_rss_hash_conf_get(struct rte_eth_dev *dev,
 	return 0;
 }
 
+static const struct rte_security_capability *
+atl_crypto_capabilities_get(void *device __rte_unused)
+{
+	static const struct rte_cryptodev_capabilities
+	aes_gcm_gmac_crypto_capabilities[] = {
+		{	/* AES GMAC (128-bit) */
+			.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
+			{.sym = {
+				.xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
+				{.auth = {
+					.algo = RTE_CRYPTO_AUTH_AES_GMAC,
+					.block_size = 16,
+					.key_size = {
+						.min = 16,
+						.max = 16,
+						.increment = 0
+					},
+				}, }
+			}, }
+		},
+	};
+
+	static const struct rte_security_capability
+	alt_security_capabilities[] = {
+		{
+			.action = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
+			.protocol = RTE_SECURITY_PROTOCOL_MACSEC,
+			{.macsec = {
+				/*
+				.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+				.mode = RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT,
+				.options = { 0 }
+				*/
+			} },
+			.crypto_capabilities = aes_gcm_gmac_crypto_capabilities,
+			.ol_flags = 0
+		},
+		{
+			.action = RTE_SECURITY_ACTION_TYPE_NONE
+		}
+	};
+
+	return alt_security_capabilities;
+}
+
+static int atl_macsec_create_session(void *device,
+		struct rte_security_session_conf *conf,
+		struct rte_security_session *sess,
+		struct rte_mempool *mp)
+{
+
+}
+
+static int atl_macsec_update_session(void *device,
+		struct rte_security_session *sess,
+		struct rte_security_session_conf *conf)
+{
+	
+}
+
+static unsigned int atl_macsec_session_get_size(void *device)
+{
+
+}
+
+static int atl_macsec_destroy_session(void *device,
+		struct rte_security_session *sess)
+{
+
+}
+
+static const struct rte_security_capability *atl_macsec_capabilities_get(
+		void *device)
+{
+
+}
+
+static struct rte_security_ops atl_security_ops = {
+	.session_create = atl_macsec_create_session,
+	.session_update = atl_macsec_update_session,
+	.session_get_size = atl_macsec_session_get_size,
+	.session_stats_get = NULL,
+	.session_destroy = atl_macsec_destroy_session,
+	.set_pkt_metadata = NULL,
+	.capabilities_get = atl_macsec_capabilities_get,
+};
+
+static int
+atl_macsec_ctx_create(struct rte_eth_dev *dev)
+{
+	struct rte_security_ctx *ctx = NULL;
+
+	ctx = rte_malloc("rte_security_instances_ops",
+				sizeof(struct rte_security_ctx), 0);
+	if (ctx) {
+		ctx->device = (void *)dev;
+		ctx->ops = &atl_security_ops;
+		ctx->sess_cnt = 0;
+		dev->security_ctx = ctx;
+	} else {
+		return -ENOMEM;
+	}
+	return 0;
+}
+
+
 static bool
 is_device_supported(struct rte_eth_dev *dev, struct rte_pci_driver *drv)
 {
diff --git a/drivers/net/atlantic/meson.build b/drivers/net/atlantic/meson.build
index 60b84684ec0a..d14855bdb218 100644
--- a/drivers/net/atlantic/meson.build
+++ b/drivers/net/atlantic/meson.build
@@ -11,3 +11,4 @@ sources = files(
 	'hw_atl/hw_atl_utils.c',
 	'rte_pmd_atlantic.c',
 )
+deps += ['security']
\ No newline at end of file
-- 
2.17.1