DPDK patches and discussions
 help / color / mirror / Atom feed
* [dpdk-dev] [RFC] security: add option to configure tunnel header verification
@ 2021-07-05 12:30 Tejasree Kondoj
  0 siblings, 0 replies; only message in thread
From: Tejasree Kondoj @ 2021-07-05 12:30 UTC (permalink / raw)
  To: Akhil Goyal, Radu Nicolau, Konstantin Ananyev, Hemant Agrawal, Fan Zhang
  Cc: Tejasree Kondoj, Anoob Joseph, Jerin Jacob, dev

Add option to indicate whether outer header verification
need to be done as part of inbound IPsec processing.

With inline IPsec processing, SA lookup would be happening
in the Rx path of rte_ethdev. When rte_flow is configured to
support more than one SA, SPI would be used to lookup SA.
In such cases, additional verification would be required to
ensure duplicate SPIs are not getting processed in the inline path.

For lookaside cases, the same option can be used by application
to offload tunnel verification to the PMD.

These verifications would help in averting possible DoS attacks.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 lib/security/rte_security.h | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h
index 88d31de0a6..c67de78baf 100644
--- a/lib/security/rte_security.h
+++ b/lib/security/rte_security.h
@@ -55,6 +55,20 @@ enum rte_security_ipsec_tunnel_type {
 	/**< Outer header is IPv6 */
 };
 
+/**
+ * IPSEC tunnel header verification mode
+ *
+ * Controls how outer IP header is verified in inbound.
+ */
+enum rte_security_ipsec_tunnel_verify_mode {
+	RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DEFAULT = 0,
+	/**< Verify only SPI */
+	RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR,
+	/**< Verify SPI and destination IP address */
+	RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR,
+	/**< Verify SPI, source and destination IP addresses */
+};
+
 /**
  * Security context for crypto/eth devices
  *
@@ -181,6 +195,9 @@ struct rte_security_ipsec_sa_options {
 	 * * 0: Disable per session security statistics collection for this SA.
 	 */
 	uint32_t stats : 1;
+
+	/** Verify tunnel header in inbound */
+	enum rte_security_ipsec_tunnel_verify_mode tunnel_hdr_verify;
 };
 
 /** IPSec security association direction */
-- 
2.27.0


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2021-07-05 11:35 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-05 12:30 [dpdk-dev] [RFC] security: add option to configure tunnel header verification Tejasree Kondoj

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).