DPDK patches and discussions
 help / color / mirror / Atom feed
* [dpdk-dev] [PATCH 00/11] introduce security offload library
@ 2017-09-14  8:26 Akhil Goyal
  2017-09-14  8:26 ` [dpdk-dev] [PATCH 01/11] lib/rte_security: add security library Akhil Goyal
                   ` (11 more replies)
  0 siblings, 12 replies; 195+ messages in thread
From: Akhil Goyal @ 2017-09-14  8:26 UTC (permalink / raw)
  To: dev
  Cc: declan.doherty, pablo.de.lara.guarch, hemant.agrawal,
	radu.nicolau, borisp, aviadye, thomas, sandeep.malik,
	jerin.jacob

This patchset introduce the rte_security library in DPDK.
This also includes the sample implementation of drivers and
changes in ipsec gateway application to demonstrate its usage.


rte_security library is implemented on the idea proposed earlier [1],[2],[3]
to support IPsec Inline and look aside crypto offload. Though
the current focus is only on IPsec protocol, but the library is
not limited to IPsec, it can be extended to other security
protocols e.g. MACSEC, PDCP or DTLS.

In this library, crypto/ethernet devices can register itself to
the security library to support security offload.

The library support 3 modes of operation
1. full protocol offload using crypto devices.
   (RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL)
2. inline ipsec using ethernet devices to perform crypto operations
   (RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO)
3. full protocol offload using ethernet devices.
   (RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL)

The details for each mode is documented in the patchset in
doc/guides/prog_guide/rte_security.rst

The modification in the application ipsec-secgw is also doocumented in
doc/guides/sample_app_ug/ipsec_secgw.rst

This patchset is also available at:
git://dpdk.org/draft/dpdk-draft-ipsec
branch: integration

To Do:
1. update documentation for rte_flow
2. unregister device to security library is incomplete
3. test application support

Future enhancements:
1. for full protocol offload - error handling and notification cases
2. add more security protocols

Reference:
[1] http://dpdk.org/ml/archives/dev/2017-July/070793.html
[2] http://dpdk.org/ml/archives/dev/2017-July/071893.html
[3] http://dpdk.org/ml/archives/dev/2017-August/072900.html

Akhil Goyal (6):
  lib/rte_security: add security library
  doc: add details of rte security
  cryptodev: extend cryptodev to support security APIs
  mk: add rte security into build system
  crypto/dpaa2_sec: add support for protocol offload ipsec
  examples/ipsec-secgw: add support for security offload

Boris Pismenny (3):
  lib/librte_net: add ESP header to generic flow steering
  lib/librte_mbuf: add security crypto flags and mbuf fields
  ethdev: add rte flow action for crypto

Declan Doherty (1):
  ethdev: extend ethdev to support security APIs

Radu Nicolau (1):
  net/ixgbe: enable inline ipsec

 MAINTAINERS                                    |   6 +
 config/common_base                             |   7 +
 doc/api/doxy-api-index.md                      |   4 +-
 doc/api/doxy-api.conf                          |   1 +
 doc/guides/cryptodevs/features/default.ini     |   1 +
 doc/guides/cryptodevs/features/dpaa2_sec.ini   |   1 +
 doc/guides/prog_guide/index.rst                |   1 +
 doc/guides/prog_guide/rte_security.rst         | 552 +++++++++++++++++
 doc/guides/sample_app_ug/ipsec_secgw.rst       |  52 +-
 drivers/crypto/Makefile                        |   2 +-
 drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c    | 402 +++++++++++-
 drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h      |  62 ++
 drivers/net/Makefile                           |   2 +-
 drivers/net/ixgbe/Makefile                     |   4 +-
 drivers/net/ixgbe/ixgbe_ethdev.c               |  13 +
 drivers/net/ixgbe/ixgbe_ethdev.h               |  10 +-
 drivers/net/ixgbe/ixgbe_flow.c                 |  27 +
 drivers/net/ixgbe/ixgbe_ipsec.c                | 815 +++++++++++++++++++++++++
 drivers/net/ixgbe/ixgbe_ipsec.h                | 145 +++++
 drivers/net/ixgbe/ixgbe_rxtx.c                 |  63 +-
 drivers/net/ixgbe/ixgbe_rxtx.h                 |   4 +
 drivers/net/ixgbe/ixgbe_rxtx_vec_sse.c         |  44 ++
 examples/ipsec-secgw/esp.c                     | 101 ++-
 examples/ipsec-secgw/esp.h                     |  10 -
 examples/ipsec-secgw/ipsec-secgw.c             |   5 +
 examples/ipsec-secgw/ipsec.c                   | 275 +++++++--
 examples/ipsec-secgw/ipsec.h                   |  32 +-
 examples/ipsec-secgw/sa.c                      | 151 +++--
 lib/Makefile                                   |   5 +
 lib/librte_cryptodev/rte_crypto.h              |   3 +-
 lib/librte_cryptodev/rte_crypto_sym.h          |   2 +
 lib/librte_cryptodev/rte_cryptodev.c           |  10 +
 lib/librte_cryptodev/rte_cryptodev.h           |   8 +-
 lib/librte_cryptodev/rte_cryptodev_version.map |   7 +
 lib/librte_ether/rte_ethdev.c                  |  11 +
 lib/librte_ether/rte_ethdev.h                  |  22 +-
 lib/librte_ether/rte_ethdev_version.map        |   7 +
 lib/librte_ether/rte_flow.h                    |  56 ++
 lib/librte_mbuf/rte_mbuf.c                     |   6 +
 lib/librte_mbuf/rte_mbuf.h                     |  32 +-
 lib/librte_net/Makefile                        |   2 +-
 lib/librte_net/rte_esp.h                       |  60 ++
 lib/librte_security/Makefile                   |  53 ++
 lib/librte_security/rte_security.c             | 252 ++++++++
 lib/librte_security/rte_security.h             | 494 +++++++++++++++
 lib/librte_security/rte_security_driver.h      | 181 ++++++
 lib/librte_security/rte_security_version.map   |  13 +
 mk/rte.app.mk                                  |   1 +
 48 files changed, 3862 insertions(+), 155 deletions(-)
 create mode 100644 doc/guides/prog_guide/rte_security.rst
 create mode 100644 drivers/net/ixgbe/ixgbe_ipsec.c
 create mode 100644 drivers/net/ixgbe/ixgbe_ipsec.h
 create mode 100644 lib/librte_net/rte_esp.h
 create mode 100644 lib/librte_security/Makefile
 create mode 100644 lib/librte_security/rte_security.c
 create mode 100644 lib/librte_security/rte_security.h
 create mode 100644 lib/librte_security/rte_security_driver.h
 create mode 100644 lib/librte_security/rte_security_version.map

-- 
2.9.3

^ permalink raw reply	[flat|nested] 195+ messages in thread

end of thread, other threads:[~2017-11-01 20:10 UTC | newest]

Thread overview: 195+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-09-14  8:26 [dpdk-dev] [PATCH 00/11] introduce security offload library Akhil Goyal
2017-09-14  8:26 ` [dpdk-dev] [PATCH 01/11] lib/rte_security: add security library Akhil Goyal
2017-09-15  5:32   ` Hemant Agrawal
2017-09-17 13:31     ` Boris Pismenny
2017-09-20 11:35     ` Akhil Goyal
2017-09-18 13:13   ` Jerin Jacob
2017-09-22 11:55     ` Radu Nicolau
2017-09-14  8:26 ` [dpdk-dev] [PATCH 02/11] doc: add details of rte security Akhil Goyal
2017-09-18 11:13   ` Jerin Jacob
2017-09-20 10:59     ` Akhil Goyal
2017-09-18 15:38   ` Mcnamara, John
2017-09-20 11:00     ` Akhil Goyal
2017-09-14  8:26 ` [dpdk-dev] [PATCH 03/11] cryptodev: extend cryptodev to support security APIs Akhil Goyal
2017-09-14  8:26 ` [dpdk-dev] [PATCH 04/11] lib/librte_net: add ESP header to generic flow steering Akhil Goyal
2017-09-15  4:51   ` Hemant Agrawal
2017-09-17  7:19     ` Boris Pismenny
2017-09-14  8:26 ` [dpdk-dev] [PATCH 05/11] lib/librte_mbuf: add security crypto flags and mbuf fields Akhil Goyal
2017-09-18  7:54   ` Boris Pismenny
2017-09-20  9:43     ` Olivier MATZ
2017-09-26 10:19       ` Boris Pismenny
2017-09-14  8:26 ` [dpdk-dev] [PATCH 06/11] ethdev: extend ethdev to support security APIs Akhil Goyal
2017-09-17 13:45   ` Shahaf Shuler
2017-09-22 11:42     ` Radu Nicolau
2017-09-18  7:57   ` Jerin Jacob
2017-09-22 11:49     ` Radu Nicolau
2017-09-14  8:26 ` [dpdk-dev] [PATCH 07/11] ethdev: add rte flow action for crypto Akhil Goyal
2017-09-21  9:16   ` Jerin Jacob
2017-09-21 16:53     ` Boris Pismenny
2017-09-14  8:26 ` [dpdk-dev] [PATCH 08/11] mk: add rte security into build system Akhil Goyal
2017-09-14  8:26 ` [dpdk-dev] [PATCH 09/11] net/ixgbe: enable inline ipsec Akhil Goyal
2017-09-15  4:48   ` Hemant Agrawal
2017-09-15 13:14     ` Doherty, Declan
2017-09-14  8:26 ` [dpdk-dev] [PATCH 10/11] crypto/dpaa2_sec: add support for protocol offload ipsec Akhil Goyal
2017-09-14  8:26 ` [dpdk-dev] [PATCH 11/11] examples/ipsec-secgw: add support for security offload Akhil Goyal
2017-10-03 13:14 ` [dpdk-dev] [PATCH v2 00/12] introduce security offload library Akhil Goyal
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 01/12] lib/rte_security: add security library Akhil Goyal
2017-10-05 15:32     ` De Lara Guarch, Pablo
2017-10-05 16:30     ` Ananyev, Konstantin
2017-10-06 18:11       ` Akhil Goyal
2017-10-09 13:42         ` Ananyev, Konstantin
2017-10-10 12:17           ` Akhil Goyal
2017-10-11  9:02             ` Ananyev, Konstantin
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 02/12] doc: add details of rte security Akhil Goyal
2017-10-03 15:56     ` Mcnamara, John
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 03/12] cryptodev: extend cryptodev to support security APIs Akhil Goyal
2017-10-05  8:49     ` De Lara Guarch, Pablo
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 04/12] lib/librte_net: add ESP header to generic flow steering Akhil Goyal
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 05/12] lib/librte_mbuf: add security crypto flags and mbuf fields Akhil Goyal
2017-10-05  8:54     ` De Lara Guarch, Pablo
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 06/12] ethdev: extend ethdev to support security APIs Akhil Goyal
2017-10-04 10:52     ` Shahaf Shuler
2017-10-06 16:31       ` Radu Nicolau
2017-10-05 18:01     ` Ananyev, Konstantin
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 07/12] ethdev: add rte flow action for crypto Akhil Goyal
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 08/12] doc: add details of rte_flow security actions Akhil Goyal
2017-10-03 15:38     ` Mcnamara, John
2017-10-03 15:39       ` Mcnamara, John
2017-10-05 15:34     ` De Lara Guarch, Pablo
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 09/12] mk: add rte security into build system Akhil Goyal
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 10/12] net/ixgbe: enable inline ipsec Akhil Goyal
2017-10-05 17:55     ` Ananyev, Konstantin
2017-10-06  9:17       ` Radu Nicolau
2017-10-06 18:33         ` Ananyev, Konstantin
2017-10-10 16:10           ` Radu Nicolau
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 11/12] crypto/dpaa2_sec: add support for protocol offload ipsec Akhil Goyal
2017-10-05  9:13     ` De Lara Guarch, Pablo
2017-10-03 13:14   ` [dpdk-dev] [PATCH v2 12/12] examples/ipsec-secgw: add support for security offload Akhil Goyal
2017-10-06 18:11   ` [dpdk-dev] [PATCH v3 00/12] introduce security offload library Akhil Goyal
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 01/12] lib/rte_security: add security library Akhil Goyal
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 02/12] doc: add details of rte security Akhil Goyal
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 03/12] cryptodev: support security APIs Akhil Goyal
2017-10-10 13:43       ` De Lara Guarch, Pablo
2017-10-21 15:22         ` Akhil Goyal
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 04/12] net: add ESP header to generic flow steering Akhil Goyal
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 05/12] mbuf: add security crypto flags and mbuf fields Akhil Goyal
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 06/12] ethdev: support security APIs Akhil Goyal
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 07/12] ethdev: add rte flow action for crypto Akhil Goyal
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 08/12] doc: add details of rte_flow security actions Akhil Goyal
2017-10-12 13:41       ` Mcnamara, John
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 09/12] mk: add rte security into build system Akhil Goyal
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 10/12] net/ixgbe: enable inline ipsec Akhil Goyal
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 11/12] crypto/dpaa2_sec: add support for protocol offload ipsec Akhil Goyal
2017-10-06 18:11     ` [dpdk-dev] [PATCH v3 12/12] examples/ipsec-secgw: add support for security offload Akhil Goyal
2017-10-09 13:49     ` [dpdk-dev] [PATCH v3 00/12] introduce security offload library Ananyev, Konstantin
2017-10-10 12:22       ` Akhil Goyal
2017-10-14 22:17     ` [dpdk-dev] [PATCH v4 " Akhil Goyal
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 01/12] lib/rte_security: add security library Akhil Goyal
2017-10-15 12:47         ` Aviad Yehezkel
2017-10-19  9:30         ` Ananyev, Konstantin
2017-10-21 15:54           ` Akhil Goyal
2017-10-20  9:37         ` Thomas Monjalon
2017-10-20  9:39           ` Thomas Monjalon
2017-10-21 19:46             ` Akhil Goyal
2017-10-21 19:45           ` Akhil Goyal
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 02/12] doc: add details of rte security Akhil Goyal
2017-10-15 12:47         ` Aviad Yehezkel
2017-10-20  9:41         ` Thomas Monjalon
2017-10-21 19:48           ` Akhil Goyal
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 03/12] cryptodev: support security APIs Akhil Goyal
2017-10-15 12:48         ` Aviad Yehezkel
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 04/12] net: add ESP header to generic flow steering Akhil Goyal
2017-10-15 12:48         ` Aviad Yehezkel
2017-10-20 10:15         ` Thomas Monjalon
2017-10-21 19:49           ` Akhil Goyal
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 05/12] mbuf: add security crypto flags and mbuf fields Akhil Goyal
2017-10-15 12:49         ` Aviad Yehezkel
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 06/12] ethdev: support security APIs Akhil Goyal
2017-10-15 12:49         ` Aviad Yehezkel
2017-10-15 13:13         ` Shahaf Shuler
2017-10-16  8:46           ` Nicolau, Radu
2017-10-19  9:23         ` Ananyev, Konstantin
2017-10-21 16:00           ` Akhil Goyal
2017-10-23  9:56             ` Ananyev, Konstantin
2017-10-23 13:08               ` Nicolau, Radu
2017-10-20 10:58         ` Thomas Monjalon
2017-10-21 19:50           ` Akhil Goyal
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 07/12] ethdev: add rte flow action for crypto Akhil Goyal
2017-10-15 12:49         ` Aviad Yehezkel
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 08/12] doc: add details of rte_flow security actions Akhil Goyal
2017-10-15 12:50         ` Aviad Yehezkel
2017-10-16 19:17         ` Mcnamara, John
2017-10-20 11:00         ` Thomas Monjalon
2017-10-21 19:50           ` Akhil Goyal
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 09/12] mk: add rte security into build system Akhil Goyal
2017-10-15 12:50         ` Aviad Yehezkel
2017-10-20 11:06         ` Thomas Monjalon
2017-10-21 19:44           ` Akhil Goyal
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 10/12] net/ixgbe: enable inline ipsec Akhil Goyal
2017-10-15 12:51         ` Aviad Yehezkel
2017-10-16 10:41           ` Thomas Monjalon
2017-10-18 21:29         ` Ananyev, Konstantin
2017-10-19 10:51           ` Radu Nicolau
2017-10-19 11:04             ` Ananyev, Konstantin
2017-10-19 11:57               ` Nicolau, Radu
2017-10-19 12:16                 ` Ananyev, Konstantin
2017-10-19 12:29                   ` Ananyev, Konstantin
2017-10-19 13:14                     ` Radu Nicolau
2017-10-19 13:22                       ` Ananyev, Konstantin
2017-10-19 14:19                         ` Nicolau, Radu
2017-10-19 14:36                           ` Ananyev, Konstantin
2017-10-19 13:09                   ` Radu Nicolau
2017-10-19  9:04         ` Ananyev, Konstantin
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 11/12] crypto/dpaa2_sec: add support for protocol offload ipsec Akhil Goyal
2017-10-14 22:17       ` [dpdk-dev] [PATCH v4 12/12] examples/ipsec-secgw: add support for security offload Akhil Goyal
2017-10-15 12:51         ` Aviad Yehezkel
2017-10-16 10:44       ` [dpdk-dev] [PATCH v4 00/12] introduce security offload library Thomas Monjalon
2017-10-20  9:32         ` Thomas Monjalon
2017-10-21 16:13           ` Akhil Goyal
2017-10-22 20:37             ` Akhil Goyal
2017-10-22 20:59               ` Thomas Monjalon
2017-10-23 11:44                 ` Aviad Yehezkel
2017-10-24  9:41                 ` Akhil Goyal
2017-10-24  9:52                   ` Thomas Monjalon
2017-10-24 14:27                     ` Akhil Goyal
2017-10-24 14:15       ` [dpdk-dev] [PATCH v5 00/11] " Akhil Goyal
2017-10-24 14:15         ` [dpdk-dev] [PATCH v5 01/11] lib/rte_security: add security library Akhil Goyal
2017-10-24 15:15           ` De Lara Guarch, Pablo
2017-10-25 11:06             ` Akhil Goyal
2017-10-24 20:47           ` Thomas Monjalon
2017-10-25 11:08             ` Akhil Goyal
2017-10-25  5:13           ` Hemant Agrawal
2017-10-24 14:15         ` [dpdk-dev] [PATCH v5 02/11] doc: add details of rte security Akhil Goyal
2017-10-24 14:15         ` [dpdk-dev] [PATCH v5 03/11] cryptodev: support security APIs Akhil Goyal
2017-10-24 14:15         ` [dpdk-dev] [PATCH v5 04/11] net: add ESP header to generic flow steering Akhil Goyal
2017-10-24 14:15         ` [dpdk-dev] [PATCH v5 05/11] mbuf: add security crypto flags and mbuf fields Akhil Goyal
2017-10-25  9:38           ` Olivier MATZ
2017-10-25 12:05             ` Akhil Goyal
2017-10-24 14:15         ` [dpdk-dev] [PATCH v5 06/11] ethdev: support security APIs Akhil Goyal
2017-10-25  5:05           ` Hemant Agrawal
2017-10-25  7:01           ` Shahaf Shuler
2017-10-25 12:35             ` Aviad Yehezkel
2017-10-24 14:15         ` [dpdk-dev] [PATCH v5 07/11] ethdev: add rte flow action for crypto Akhil Goyal
2017-10-24 14:15         ` [dpdk-dev] [PATCH v5 08/11] mk: add rte security into build system Akhil Goyal
2017-10-24 20:48           ` Thomas Monjalon
2017-10-25 11:12             ` Akhil Goyal
2017-10-25  5:04           ` Hemant Agrawal
2017-10-24 14:15         ` [dpdk-dev] [PATCH v5 09/11] net/ixgbe: enable inline ipsec Akhil Goyal
2017-10-24 14:15         ` [dpdk-dev] [PATCH v5 10/11] crypto/dpaa2_sec: add support for protocol offload ipsec Akhil Goyal
2017-10-24 14:15         ` [dpdk-dev] [PATCH v5 11/11] examples/ipsec-secgw: add support for security offload Akhil Goyal
2017-10-25 15:07         ` [dpdk-dev] [PATCH v6 00/10] introduce security offload library Akhil Goyal
2017-10-25 15:07           ` [dpdk-dev] [PATCH v6 01/10] cryptodev: support security APIs Akhil Goyal
2017-10-25 15:07           ` [dpdk-dev] [PATCH v6 02/10] net: add ESP header to generic flow steering Akhil Goyal
2017-10-25 15:07           ` [dpdk-dev] [PATCH v6 03/10] mbuf: add security crypto flags and mbuf fields Akhil Goyal
2017-10-25 15:07           ` [dpdk-dev] [PATCH v6 04/10] ethdev: support security APIs Akhil Goyal
2017-10-25 15:07           ` [dpdk-dev] [PATCH v6 05/10] ethdev: add rte flow action for crypto Akhil Goyal
2017-10-25 15:07           ` [dpdk-dev] [PATCH v6 06/10] security: introduce security API and framework Akhil Goyal
2017-10-25 15:07           ` [dpdk-dev] [PATCH v6 07/10] doc: add details of rte security Akhil Goyal
2017-10-25 15:07           ` [dpdk-dev] [PATCH v6 08/10] net/ixgbe: enable inline ipsec Akhil Goyal
2017-10-26  7:09             ` David Marchand
2017-10-26  7:19               ` David Marchand
2017-11-01 19:58             ` Thomas Monjalon
2017-11-01 20:10               ` Ferruh Yigit
2017-10-25 15:07           ` [dpdk-dev] [PATCH v6 09/10] crypto/dpaa2_sec: add support for protocol offload ipsec Akhil Goyal
2017-10-25 15:07           ` [dpdk-dev] [PATCH v6 10/10] examples/ipsec-secgw: add support for security offload Akhil Goyal
2017-10-26  1:16           ` [dpdk-dev] [PATCH v6 00/10] introduce security offload library Thomas Monjalon

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).