[dpdk-dev] [RFC PATCH 0/1] IPSec Inline and look aside crypto offload

[Akhil Goyal <akhil.goyal@nxp.com>]

Below is a counter proposal for the RFC sent by Boris.
If we find some consensus, we can have implementation for this proposal in a few weeks.

The proposal is largely inline with the thoughts from Declan with a few exceptions.
Here we are proposing a security framework which can be used both by crypto drivers
and the hw offloaded NIC to showcase the protocol offload support as well as inline
ipsec in hw offloaded NIC.

The placement of the rte_security.X can either be a separate library like
lib/librte_security/ or it can be taken as an extension to the lib/librte_cryptodev/.
The reason for placing this in the cryptodev is that we are referring to some
crypto enums and the APIs look similar to that of cryptodev.

Here we propose that the application may be able to configure either NIC or
crypto PMD to perform IPSec and other security operations.
This is configured using the API

int
rte_security_configure(uint16_t dev_id, char *dev_name);

This API take dev_id and dev_name to identify which device needs to perform security
operation. Once the device is enabled for Security operations, the application can
create and initialize the session for the enabled device.

struct rte_security_session *
rte_security_session_create(struct rte_mempool *mempool);

int
rte_security_session_init(uint16_t dev_id, char *dev_name,
                          struct rte_security_session *sess,
                          struct rte_security_sess_conf *conf,
                          struct rte_mempool *mempool);

These two APIs are similar to the rte_cryptodev_sym_session_create and
rte_cryptodev_sym_session_init respectively, except that rte_security_session_init
takes device name also to identify between the NIC(IPSEC inline or full offload)
or crypto(look aside protocol offload).

These sessions can be cleared and freed with the APIs

int
rte_security_session_clear(uint8_t dev_id, char *dev_name,
                           struct rte_security_session *sess);
int
rte_security_session_free(struct rte_security_session *sess);

The details for various structures used are mentioned in the below patch.
These are very similar to what Declan proposed with a few additions.
This can be updated further for other security protocols like MACSec and DTLS

Now, after the application configures the session using above APIs, it needs to
attach the  session with the crypto_op in case the session is configured for
crypto look aside protocol offload. For IPSec inline/ full protocol offload
using NIC, the mbuf ol_flags can be set as per the RFC suggested by Boris.

Configuration path for both crypto and NIC can be illustrated as below

  Configuration Path                       Configuration Path
       for NIC                                  for Crypto
          |                                         |
 +--------|--------+                       +--------|--------+
 |    Add/Remove   |                       |   Add/Remove    |
 |     IPsec SA    |                       |    IPSec SA     |
 |        |        |                       |        |        |
 |--------|--------|                       +--------|--------+
          |                                         |
 +--------V--------+                                |
 |   Flow API      |                                |
 +--------|--------+                                |
          |                                         |
 +--------V--------+                       +--------V--------+
 |                 |                       |                 |
 |     NIC PMD     |                       |    Crypto PMD   |
 |                 |                       |                 |
 +--------|--------+                       +--------|--------+
          |                                         |
 +--------|--------+                       +--------|--------+
 |  HW ACCELERATED |                       |     HW Crypto   |
 |        NIC      |                       |  Protocol Aware |
 |                 |                       |     Device      |
 +--------|--------+                       +--------|--------+


Now the application(ipsec-secgw) have 4 paths to decide for the data path.
1. Non-protocol offload (currently implemented)
2. IPSec inline(only crypto operations using NIC)
3. full protocol offload(crypto operations along with all the IPsec header
   and trailer processing using NIC)
4. look aside protocol offload(single-pass encryption and authentication with
   additional levels of protocol processing offload using crypto device)

The application can decide using the below action types
enum rte_security_session_action_type {
        RTE_SECURITY_SESS_ETH_INLINE_CRYPTO,
        /**< Crypto operations are performed by Network interface */
        RTE_SECURITY_SESS_ETH_PROTO_OFFLOAD,
        /**< Crypto operations with protocol support are performed
         * by Network/ethernet device.
         */
        RTE_SECURITY_SESS_CRYPTO_PROTO_OFFLOAD,
        /**< Crypto operations with protocol support are performed
         * by Crypto device.
         */
        RTE_SECURITY_SESS_NONE
	/**< Non protocol offload. Application need to manage everything */
};


 Egress Data Path

For ETH_INLINE_CRYPTO                  For CRYPTO_PROTO_OFFLOAD
         |                                         |
+--------|--------+                    +-----------|-----------+
|  egress IPsec   |                    | Plain packet from NIC |
|        |        |                    |           |           |
| +------V------+ |                    |  +--------V--------+  |
| | SABD lookup | |                    |  |    SA lookup    |  |
| +------|------+ |                    |  +--------|--------+  |
| +------V------+ |                    |  +--------V--------+  |
| |   Tunnel    | |                    |  |  session attach |  |
| +------|------+ |                    |  +--------|--------+  |   +------------+
| +------V------+ |                    |  +--------V--------+  |   | Hw crypto  |
| |     ESP     | |                    |  |Enqueue to crypto|------>  Device    |      <--- Headers are added by the HW device.
| |             | |                    |  |     Device      |  |   |            |
| +------|------+ |                    |  +-----------------+  |   +-----|------+
+--------V--------+                    |  +-----------------+  |         |
         |                             |  |  Dequeue from   |<-----------+   
+--------V--------+                    |  |  Crypto Device  |  |
|    L2 Stack     |                    |  +--------|--------+  |
+--------|--------+                    |  +--------V--------+  |
         |                             |  |   L2 Stack      |  |
+--------V--------+                    |  +--------|--------+  |
|                 |                    +-----------|-----------+
|     NIC PMD     |                                |
|                 |                    +-----------V-----------+
+--------|--------+                    |        NIC PMD        |
         |                             |   (packet sent out)   |
+--------|--------+                    +-----------|-----------+
|  HW ACCELERATED |   
|        NIC      |          
|                 |
+--------|--------+

   Ingress Data Path

For ETH_INLINE_CRYPTO                  For CRYPTO_PROTO_OFFLOAD
         |                                         |
+--------|--------+                    +-----------|-----------+
|  Ingress ipsec  |                    | Encap packet from NIC |
|        |        |                    |           |           |
| +------V------+ |                    |  +--------V--------+  |
| | HW ACC NIC  | |                    |  |     SA lookup   |  |
| +------|------+ |                    |  +--------|--------+  |
| +------V------+ |                    |  +--------V--------+  |
| |validate ESP | |                    |  |  session attach |  |
| +------|------+ |                    |  +--------|--------+  |   +------------+
| +------V------+ |                    |  +--------V--------+  |   | Hw crypto  |
| |Remove  ESP  | |                    |  |Enqueue to crypto|------>  Device    |      <--- Headers are removed by the HW device.
| | and Tunnel  | |                    |  |     Device      |  |   |            |
| +------|------+ |                    |  +-----------------+  |   +-----|------+
+--------V--------+                    |  +-----------------+  |         |
         |                             |  |  Dequeue from   |<-----------+   
+--------V----------+                  |  |  Crypto Device  |  |
|Plain packet to App|                  |  +--------|--------+  |
+--------|----------+                  |  +--------V--------+  |
                                       |  |Plain packet to  |  |
                                       |  |    app          |  |
                                       |  +-----------------+  |
                                       +-----------------------+


Akhil Goyal (1):
  RFC: rte_security: proposal

 lib/librte_security/rte_security.h | 405 +++++++++++++++++++++++++++++++++++++
 1 file changed, 405 insertions(+)
 create mode 100644 lib/librte_security/rte_security.h

-- 
2.9.3