From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0062.outbound.protection.outlook.com [104.47.37.62]) by dpdk.org (Postfix) with ESMTP id 4B7AA5A3E for ; Mon, 20 Nov 2017 11:36:34 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=CAVIUMNETWORKS.onmicrosoft.com; s=selector1-cavium-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Bes4f6C/KwM8hWEO2x7VKyjt8kxUUKEc1EIaE6dT6hw=; b=QZqQ5R5heiNePlfhFg9I12hcNsBj0ivYBcBLlXR/a4gQl0Fqsj95BtgnKA2GqS8F4xMiXaHMGTqU/bJd+c1hs5KAuFCKinwGu55v6XMFlxvFFlzI53NHbGTHZpYOW4a4YEnhxpBBKA3Wpgd2rJ3bnUdc8b/y/EycQmZVEht86Xo= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Anoob.Joseph@cavium.com; Received: from ajoseph83.caveonetworks.com (14.140.2.178) by MWHPR0701MB3642.namprd07.prod.outlook.com (2603:10b6:301:7d::35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.239.5; Mon, 20 Nov 2017 10:36:29 +0000 From: Anoob Joseph To: Akhil Goyal , Declan Doherty , Sergio Gonzalez Monroy , Radu Nicolau Cc: Narayana Prasad , Jerin Jacob , dev@dpdk.org Date: Mon, 20 Nov 2017 10:31:44 +0000 Message-Id: <1511173905-22117-2-git-send-email-anoob.joseph@caviumnetworks.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1511173905-22117-1-git-send-email-anoob.joseph@caviumnetworks.com> References: <1511173905-22117-1-git-send-email-anoob.joseph@caviumnetworks.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [14.140.2.178] X-ClientProxiedBy: CO2PR06CA0076.namprd06.prod.outlook.com (2603:10b6:104:3::34) To MWHPR0701MB3642.namprd07.prod.outlook.com (2603:10b6:301:7d::35) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: bb57fded-7701-4827-1033-08d5300290e7 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(4534020)(4602075)(7168020)(4627115)(201703031133081)(201702281549075)(2017052603199); SRVR:MWHPR0701MB3642; X-Microsoft-Exchange-Diagnostics: 1; MWHPR0701MB3642; 3:7je8O/db7/O4TXjFk/JUdJCw182AXsDUyRtGb5Q1A+BHxqES1JMtOmnFbALDGGx6Cp3cHiv+nVw3xfCMwYL3a//3Ik0n1oJMa3SOFLS+hSIvMJeTtuH+Plz+4sYUuWBIgS1oKJihYPtCow8wPtWsWRYRj+JRAMXCBeao8cQZijLLdcrlI1tP96tfPvQdmlhoYNRH749mmMnwveezB4gb+oF25+0pofMGIXwtf9PMypAI7AmhBVSXRSNlFH9f9Fbh; 25:Cp7qXk0cwnELYNtaTBV54dozhP39esTtTXu3hvFuv3TC8jHpYsSVr9xR0vthCaaRaFf4ydLaOGXFIbYprScyFO+ogiBM1pDZtyjfr+QngbOWhLPWK7gmiYdJBbI0HqjirfNee0LsSeo2Yb2FEffcYrhaUhxgeytLDdtL7onTDWbi/GZ0mTqsVv1T9kZ/YRVaTKSgP8RcMw02BuWkccODQiUhxzaLo0dbMl3ug7ASK07CwOd9/tJ5CDIq1JdRu7k4yrnQX3TMtC159K3sA2qSM4FDIwk0U3CxGpgb6lJU0ioBiMKpsjs3+7wOciYQ1NEASw+Cw15epM8SrHuSlUq0XRQSDl57jqmf13IFyzlo73M=; 31:dfMKsiv/SpbOnSe3mmUpQ+nuNgjRtV5X/uu8VaJl8mmcFSkNi0umzGpU6TcHeQbClCZPiJY2ntj/6shHSsG0rW3TlrNXWx/cJkZ986y0b1jmsi1htjBgw8K0Mnpa82cgJ4SRjoBEQTbR/nZua0nyXyhAGA7WfjPAV9GW/R8T9yWh1iDc0Gli3HZ1snrAYjpO88dOlJnQI3QA3dYixYZxxxDSwJ11zCfZ0GC7R/p8LzY= X-MS-TrafficTypeDiagnostic: MWHPR0701MB3642: X-Microsoft-Exchange-Diagnostics: 1; MWHPR0701MB3642; 20:4XyeBWWip4u4SmXWRk10uKr9d+YFx+jxr74pkAlcD+YXGP4HaeEOkUPfrIW3nCapkKWqr22sMr9AGAyhEJ8TN+/CHTnFPvPftAOynR6z+mumCLRw/8ZMmPF6mCmj+EmvU5Gx/5cjQcmfp50lRCjF3G++xezN7BVduHRehmX4bd18aqvdHz2na0sdciq7nsFB8mZhDZCbp4tHkA8T6nKKYNIIxgTr6OQlFcC9pCq9G3A9mRncjA2TaCe8d1WhvHFPqTns+LFegxrZZfwaA7AMynzzv+Qaqbwgf6aCSy/qp7IZxD1/ZK0ZSCSwNFllkhA/R8QbrZbd9DPMexPBqaBoHBjTzFosW689qWENbVYfdcOeVFzgospVUYN6erdqDQrLeQp3OhRqePV5mNZESmJb+a9sgqk+ZqrJDbhV9BfdO0BwVaYXKnexqWYrpnb8T4PMs5lYSwXs0EVcqHvAu+bytrsY7jyTGz+r3N5CpxRYExN+fvIdUx/NnjaTS5X8/+3ruQpK+mJbHf/CPyR2BjbUdMfjHQ+KqbrnbvCoW3alqbpAYdrg1UJuYHmzxtRUIqC2RYd2WbBj/zLsTZra6pUxkZ0fayjVrAdBzBF9c4F+2Cc=; 4:4o6XlDN+VIJqzEo8LZVG+zPZ2rfzXoc88+qgh82UkciKMbLE9XfbDqivqcPrXZVSniRsgEyQqSK9Yue86OS3e+7Tryyi1kbJPKDttBSHS9/rnvzY6yhC4LG31MMvY923Uw3SqIYxjdRG6fh1VZDnAdffqXx6z2gvdED3IDykMzrSEUycD5zPVJ4NPtmH9pU04ZgFLLdWEwcZzP/U3pIiRo6KnNTxWkLCv0LF8TnG1I74tXv0yOUqb7bNllPG+GVw3jCZAA7urAD5YL0dwQxiMb82xET3Ku/UP8k5wAkdtWADcBrhH6jM6aEEdmshje+W X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(3002001)(10201501046)(93006095)(3231022)(100000703101)(100105400095)(6041248)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123562025)(20161123558100)(20161123560025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:MWHPR0701MB3642; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:MWHPR0701MB3642; X-Forefront-PRVS: 04976078F0 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(6009001)(376002)(346002)(189002)(199003)(97736004)(48376002)(50466002)(6512007)(5660300001)(16526018)(8676002)(68736007)(36756003)(7736002)(42882006)(2950100002)(8936002)(6666003)(189998001)(50226002)(305945005)(81166006)(81156014)(5009440100003)(72206003)(478600001)(53416004)(15650500001)(106356001)(105586002)(8656006)(316002)(4326008)(53936002)(16586007)(55236003)(5003940100001)(33646002)(76176999)(110136005)(54906003)(25786009)(6486002)(2906002)(50986999)(6116002)(6506006)(69596002)(101416001)(66066001)(47776003)(3846002)(110426004); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR0701MB3642; H:ajoseph83.caveonetworks.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; Received-SPF: None (protection.outlook.com: cavium.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; MWHPR0701MB3642; 23:xfe/eN3r/EBsZE5S8Cz+Oo1pftCgOBzskuRiwSB?= =?us-ascii?Q?/neTdd369Jp3XJhCicSlA5XxJ2Do+QAk8f7e7SLzOrvQemwugiS+l8U4Hobp?= =?us-ascii?Q?Mvu5uyxWfym+AbekIW3YNi6dNHwJqTRbac12hx4MaBO8MMIl2rXdrWRX+cj0?= =?us-ascii?Q?gGXS2Ia5EVKKfDboIRFeslCxUE97GCanvXVv0G7x18EDPq7NTkMzSNiRwBYK?= =?us-ascii?Q?Y2CdH8/rFk/oGkXQ+60+FruccOkYnGYR5+O0ILuSiOCn+V5BQT2dVhttiZ4G?= =?us-ascii?Q?hrc523E+XtUrj2pcBocmtUuIAPB3HThPo/1qvmcWx9ar4AM93Kc+FXoaw/B+?= =?us-ascii?Q?X7zCNfWudfDFReAFXd+beW7osfXuKOA+Hxt8xa4tg/VDKWGI+JMYDqAS9wLl?= =?us-ascii?Q?hdUz19GHK/KBPU1yMQUGfgV73yTrfXXvEY1EOpkOz6qQXkoTMgjI8VfY4T/L?= =?us-ascii?Q?xus0ByFV74hCFnjoX9JsfPmM3ZavsQ8WlEsMeaTjUOGcc1/EHCbbrX/XtofI?= =?us-ascii?Q?6fhQ66eBZel4ZvBL+vmQFXISlxLrK6rwvPQ2oMD4ZL+dx9ajC5grh6JiuIxn?= =?us-ascii?Q?EOmr4/ffXe02AF02E9uiGgleBLpjrHRAMoSS7MuXRjNXuko4RSX3V2MwhTQa?= =?us-ascii?Q?OmiwWJl+50lVz+TO7NqPMFOlDxypt0cLYfufSoy5bC9OUyaGof82Q9k1llE2?= =?us-ascii?Q?Ti+xV6tUcHwV6uCyHhEKKNZvYEr9bb6WOiw30/jpiz2fOir8/B293Xu0yqyD?= =?us-ascii?Q?lnx+8DglDut6A4Y8oQWSqtFvGHnjYKGbET2ZDfxymMt+OdRUeTw/OaunIn1m?= =?us-ascii?Q?HZnD0IA4ysko1tTLUlOpjLXZvl9OfAD7hCIqzVq5QbzwiALVcLmCj8Mlti+f?= =?us-ascii?Q?87dWgYkB5oMOUcF+Xt64UjR9KO74YpBZgeLQp/QbMVorYD2pFDc6p7/RILMU?= =?us-ascii?Q?0vK5XmmTqGFD/gp9hNxnL1WI9Gqa5BKpvsZAn0CfnJaDsQNkIEZW4mLaDkek?= =?us-ascii?Q?3/CqS4jxmbUCvMtscxm/BqXJNxLtFtJwQsJmugadr0NyDeRts/bXEswiiKmw?= =?us-ascii?Q?0iZV/x4KvipnvGmhXp7xoCC76kBh38OBT+pKyeV/gKhvLgw4SxhLyjUXZppZ?= =?us-ascii?Q?e7DiM2VhbBCy+gq7oxTp6mBfyOW9/vS0QhQ9lKZdyflz3T1N1EwAu/L5A8jo?= =?us-ascii?Q?KWygpN/xkNSeoJR+3ZXL08GjayppxJfSoyOI9jVkzGd5F6xtWqRmDaop+4Si?= =?us-ascii?Q?m3G8gAoR+gY1NuTy7JCKlwFQmgyVG7cds8tp2sPO2?= X-Microsoft-Exchange-Diagnostics: 1; MWHPR0701MB3642; 6:nLTCMMdZp6BYhyr80K/gMe0zwltv3yLJAPVNhJD75/1qzbFvAOiAob6kKTzyST5fqSsU5Gf9Hua5vaZTwT9xK7Qlz6dwFwPyEYG9v7mzoXyOrlAfxfii5J79IM6Rhm18wDCpTDJcbeEOYo3YA6VbsudMMb9e3kwic1zXk0EHrnoT4bSFyaIiFhjc2k0lqODMqp+am9VEMHpIz+kwKjnItjVeebs5WMZq7Zknzge24ErNBj0aFN3zSJYN/TbH7wb5HX2ZjKFdBa/n2Nk30KuH6chZCvcvCx+HTgYLOz9Sk95kkDLK5CGZsJj+m2lbQnJ9RcVCjaMG4bIBzm+THC6n1BIyFOzSjdhIBajJT/22J08=; 5:SmEfNklSRen0db/BMz+FzWcJzheKw/d8I6e4iWHsSxMK5DXU3+zsyrK8EU3rTd90s+17GAJAFh7kWfalbSNlseOvVDlE/DeeOCRugWKBQs0tfL/J6LRM9j8l/zrFqpPWykWnaktUTghYUcQOzvIHAhvrMm8ifEqbcvhK15PAnwo=; 24:/1GCM7QC2q8iNIsZJ+PvMwujMkH9/MPs4AfcdbPIL+AxiiWNYf2+3d0SZ0t3VugRJ/VyW/gqJiKf5NsJ2c1+tXFSyA+9AK3lYQNjS3x0KvQ=; 7:3tocz+VpwBdqHJvsY0+rfk6nkrz6juZ+/v02Yztq3RMjzlZVxy+TiNc3lV81HbzsNy0/0JaWSC7QaYwuqgOtyexG2uxlRCmPZrLL33OF4t1vbx5Nkt8YjqMMjq6KqomQVPfi5vcjZMySq+b0RsNDSNYcEgismUayPqIkHyle1BTm2G0ejP1ykIrKCxaIDvvRwbUBxWG7kIdXvy0wC5n12VcB71XIEQtAh+GacGST/Li95jH0XO/lvUVnbxVcc7CN SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: caviumnetworks.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Nov 2017 10:36:29.4266 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: bb57fded-7701-4827-1033-08d5300290e7 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 711e4ccf-2e9b-4bcf-a551-4094005b6194 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR0701MB3642 Subject: [dpdk-dev] [PATCH 1/2] lib/security: add support for saving app cookie X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Nov 2017 10:36:34 -0000 In case of inline protocol processed ingress traffic, the packet may not have enough information to determine the security parameters with which the packet was processed. In such cases, the application could register a cookie, which will be saved in the the security session. As the ingress packets are received in the application, it will have some metadata set in the mbuf. Application can pass this metadata to "rte_security_session_get" API to retrieve the security session. Once the security session is determined, another driver call with the security session will give the application the cookie it had registered. The cookie will be registered while creating the security session. Without the cookie, the selector check (SP-SA check) for the incoming IPsec traffic won't be possible in the application. Application can choose what it should register as the cookie. It can register SPI or a pointer to SA. Signed-off-by: Anoob Joseph --- lib/librte_security/rte_security.c | 26 +++++++++++++++++++++++ lib/librte_security/rte_security.h | 30 +++++++++++++++++++++++++++ lib/librte_security/rte_security_driver.h | 34 +++++++++++++++++++++++++++++++ 3 files changed, 90 insertions(+) diff --git a/lib/librte_security/rte_security.c b/lib/librte_security/rte_security.c index 1227fca..1c706fe 100644 --- a/lib/librte_security/rte_security.c +++ b/lib/librte_security/rte_security.c @@ -98,6 +98,32 @@ rte_security_session_destroy(struct rte_security_ctx *instance, return ret; } +struct rte_security_session * +rte_security_session_get(struct rte_security_ctx *instance, + uint64_t mdata) +{ + struct rte_security_session *sess = NULL; + + RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->session_get, NULL); + if (instance->ops->session_get(instance->device, mdata, &sess)) + return NULL; + + return sess; +} + +uint64_t +rte_security_cookie_get(struct rte_security_ctx *instance, + struct rte_security_session *sess) +{ + uint64_t cookie = 0; + + RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->cookie_get, 0); + if (instance->ops->cookie_get(instance->device, sess, &cookie)) + return 0; + + return cookie; +} + int rte_security_set_pkt_metadata(struct rte_security_ctx *instance, struct rte_security_session *sess, diff --git a/lib/librte_security/rte_security.h b/lib/librte_security/rte_security.h index 7e687d2..95f81ee 100644 --- a/lib/librte_security/rte_security.h +++ b/lib/librte_security/rte_security.h @@ -273,6 +273,8 @@ struct rte_security_session_conf { /**< Configuration parameters for security session */ struct rte_crypto_sym_xform *crypto_xform; /**< Security Session Crypto Transformations */ + uint64_t cookie; + /**< Cookie registered by application */ }; struct rte_security_session { @@ -327,6 +329,34 @@ rte_security_session_destroy(struct rte_security_ctx *instance, struct rte_security_session *sess); /** + * Get the security session from the metadata set in mbuf. + * + * @param instance security instance + * @param mdata metadata set in mbuf during rx offload + * @return + * - On success, pointer to session + * - On failure, NULL + */ +struct rte_security_session * +rte_security_session_get(struct rte_security_ctx *instance, + uint64_t mdata); + +/** + * Get the cookie set by application while creating the session. This could be + * used to identify the SA associated with the session. + * + * @param instance security instance + * @param sess security session + * + * @return + * - On success, cookie + * - On failure, 0 + */ +uint64_t +rte_security_cookie_get(struct rte_security_ctx *instance, + struct rte_security_session *sess); + +/** * Updates the buffer with device-specific defined metadata * * @param instance security instance diff --git a/lib/librte_security/rte_security_driver.h b/lib/librte_security/rte_security_driver.h index 997fbe7..f503be6a 100644 --- a/lib/librte_security/rte_security_driver.h +++ b/lib/librte_security/rte_security_driver.h @@ -107,6 +107,36 @@ typedef int (*security_session_stats_get_t)(void *device, struct rte_security_stats *stats); /** + * Get the security session from the metadata set in mbuf. + * + * @param device Crypto/eth device pointer + * @param mdata Metadata set in mbuf during rx offload + * @param sess Pointer to return the security session retrieved + * + * @return + * - Returns 0 if the security session was successfully retrieved. + * - Returns -EINVAL if input parameters are invalid. + */ +typedef int (*security_session_get_t)(void *device, + uint64_t mdata, + struct rte_security_session **sess); + +/** + * Get the cookie associated with the security session. + * + * @param device Crypto/eth device pointer + * @param sess Security session + * @param cookie Cookie associated with the security session + * + * @return + * - Returns 0 if the cookie was successfully retrieved. + * - Returns -EINVAL if input parameters are invalid. + */ +typedef int (*security_cookie_get_t)(void *device, + struct rte_security_session *sess, + uint64_t *cookie); + +/** * Update the mbuf with provided metadata. * * @param sess Security session structure @@ -143,6 +173,10 @@ struct rte_security_ops { /**< Get security session statistics. */ security_session_destroy_t session_destroy; /**< Clear a security sessions private data. */ + security_session_get_t session_get; + /**< Get the security session associated with the metadata */ + security_cookie_get_t cookie_get; + /**< Get the cookie associated with the security session */ security_set_pkt_metadata_t set_pkt_metadata; /**< Update mbuf metadata. */ security_capabilities_get_t capabilities_get; -- 2.7.4