From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id AC798A0C56; Wed, 8 Sep 2021 09:28:00 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id CEC844112E; Wed, 8 Sep 2021 09:27:58 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by mails.dpdk.org (Postfix) with ESMTP id B92ED41124 for ; Wed, 8 Sep 2021 09:27:57 +0200 (CEST) Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18838Kc3016089; Wed, 8 Sep 2021 00:27:56 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=pfpt0220; bh=M0Z25k8MCdE8K5Eybb0OJ4AbNPuxuQLnGUapc09u6P8=; b=YBMHKonP8C34KpMwwU80de2ymvtS2hP99+gXtBX4Hu+W3ZgNzwaLQSwLnPMU2y6jp/V8 o5FTQiU64ClbFXp1U88vGGgxkPakpr1gbjw9Na7aJyxvwmC2OtS24zz6rEfqcI/DjXUp tvAcdDWEaaY4De3XSvWtsnmWiLJEvyfxJc1r8YY3z/5QnifGlqAOeS0KuWY3PzeGIG8W 4N/tPYlVcsFCaFW3HslUIeYdCInQwSLn9/4bowU7ZAhtzp8Zm6UJfS5HbKthGeqCsjsR 1ygxOfe3bvh7BqB18dR0GHJKHYD2D2Ju+/hPtqWFsXtOLs8istog3r58NU/Wrc3CpxGk nA== Received: from dc5-exch01.marvell.com ([199.233.59.181]) by mx0a-0016f401.pphosted.com with ESMTP id 3axcm7tfep-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 08 Sep 2021 00:27:56 -0700 Received: from DC5-EXCH02.marvell.com (10.69.176.39) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Wed, 8 Sep 2021 00:27:55 -0700 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH02.marvell.com (10.69.176.39) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Wed, 8 Sep 2021 00:27:55 -0700 Received: from hyd1554T5810.caveonetworks.com.com (unknown [10.29.57.11]) by maili.marvell.com (Postfix) with ESMTP id 161903F705E; Wed, 8 Sep 2021 00:27:50 -0700 (PDT) From: Tejasree Kondoj To: Akhil Goyal , Radu Nicolau , Declan Doherty CC: Tejasree Kondoj , Anoob Joseph , Ankur Dwivedi , Jerin Jacob , Konstantin Ananyev , Ciara Power , Hemant Agrawal , Gagandeep Singh , Fan Zhang , Archana Muniganti , Date: Wed, 8 Sep 2021 13:51:09 +0530 Message-ID: <20210908082111.27396-2-ktejasree@marvell.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20210908082111.27396-1-ktejasree@marvell.com> References: <20210908082111.27396-1-ktejasree@marvell.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Proofpoint-GUID: zA1ILF365Qwewz5t7zBQJzNwnVrMLRS5 X-Proofpoint-ORIG-GUID: zA1ILF365Qwewz5t7zBQJzNwnVrMLRS5 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.790,Hydra:6.0.391,FMLib:17.0.607.475 definitions=2021-09-08_02,2021-09-07_02,2020-04-07_01 Subject: [dpdk-dev] [PATCH 1/3] security: add option to configure tunnel header verification X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Add option to indicate whether outer header verification need to be done as part of inbound IPsec processing. With inline IPsec processing, SA lookup would be happening in the Rx path of rte_ethdev. When rte_flow is configured to support more than one SA, SPI would be used to lookup SA. In such cases, additional verification would be required to ensure duplicate SPIs are not getting processed in the inline path. For lookaside cases, the same option can be used by application to offload tunnel verification to the PMD. These verifications would help in averting possible DoS attacks. Signed-off-by: Tejasree Kondoj --- doc/guides/rel_notes/release_21_11.rst | 5 +++++ lib/security/rte_security.h | 17 +++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst index 0e3ed28378..b0606cb542 100644 --- a/doc/guides/rel_notes/release_21_11.rst +++ b/doc/guides/rel_notes/release_21_11.rst @@ -136,6 +136,11 @@ ABI Changes soft and hard SA expiry limits. Limits can be either in units of packets or bytes. +* security: add IPsec SA option to configure tunnel header verification + + * Added SA option to indicate whether outer header verification need to be + done as part of inbound IPsec processing. + Known Issues ------------ diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h index 95c169d6cf..2a61cad885 100644 --- a/lib/security/rte_security.h +++ b/lib/security/rte_security.h @@ -55,6 +55,14 @@ enum rte_security_ipsec_tunnel_type { /**< Outer header is IPv6 */ }; +/** + * IPSEC tunnel header verification mode + * + * Controls how outer IP header is verified in inbound. + */ +#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR 0x1 +#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR 0x2 + /** * Security context for crypto/eth devices * @@ -195,6 +203,15 @@ struct rte_security_ipsec_sa_options { * by the PMD. */ uint32_t iv_gen_disable : 1; + + /** Verify tunnel header in inbound + * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR``: Verify destination + * IP address. + * + * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR``: Verify both + * source and destination IP addresses. + */ + uint32_t tunnel_hdr_verify : 2; }; /** IPSec security association direction */ -- 2.27.0