Re: [dpdk-dev] [PATCH 1/3] security: add option to configure tunnel header verification

[Akhil Goyal <gakhil@marvell.com>]

> Add option to indicate whether outer header verification
> need to be done as part of inbound IPsec processing.
> 
> With inline IPsec processing, SA lookup would be happening
> in the Rx path of rte_ethdev. When rte_flow is configured to
> support more than one SA, SPI would be used to lookup SA.
> In such cases, additional verification would be required to
> ensure duplicate SPIs are not getting processed in the inline path.
> 
> For lookaside cases, the same option can be used by application
> to offload tunnel verification to the PMD.
> 
> These verifications would help in averting possible DoS attacks.
> 
> Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
> ---
>  doc/guides/rel_notes/release_21_11.rst |  5 +++++

Deprecation notice should also be removed for this feature addition/
ABI breakage.

Other than that
Acked-by: Akhil Goyal <gakhil@marvell.com>

>  lib/security/rte_security.h            | 17 +++++++++++++++++
>  2 files changed, 22 insertions(+)
> 
> diff --git a/doc/guides/rel_notes/release_21_11.rst
> b/doc/guides/rel_notes/release_21_11.rst
> index 0e3ed28378..b0606cb542 100644
> --- a/doc/guides/rel_notes/release_21_11.rst
> +++ b/doc/guides/rel_notes/release_21_11.rst
> @@ -136,6 +136,11 @@ ABI Changes
>      soft and hard SA expiry limits. Limits can be either in units of packets or
>      bytes.
> 
> +* security: add IPsec SA option to configure tunnel header verification
> +
> +  * Added SA option to indicate whether outer header verification need to
> be
> +    done as part of inbound IPsec processing.
> +
> 
>  Known Issues
>  ------------
> diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h
> index 95c169d6cf..2a61cad885 100644
> --- a/lib/security/rte_security.h
> +++ b/lib/security/rte_security.h
> @@ -55,6 +55,14 @@ enum rte_security_ipsec_tunnel_type {
>  	/**< Outer header is IPv6 */
>  };
> 
> +/**
> + * IPSEC tunnel header verification mode
> + *
> + * Controls how outer IP header is verified in inbound.
> + */
> +#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR     0x1
> +#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR 0x2
> +
>  /**
>   * Security context for crypto/eth devices
>   *
> @@ -195,6 +203,15 @@ struct rte_security_ipsec_sa_options {
>  	 * by the PMD.
>  	 */
>  	uint32_t iv_gen_disable : 1;
> +
> +	/** Verify tunnel header in inbound
> +	 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR``: Verify
> destination
> +	 *   IP address.
> +	 *
> +	 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR``: Verify
> both
> +	 *   source and destination IP addresses.
> +	 */
> +	uint32_t tunnel_hdr_verify : 2;
>  };
> 
>  /** IPSec security association direction */
> --
> 2.27.0