From patchwork Thu Sep 3 06:42:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tejasree Kondoj X-Patchwork-Id: 76353 X-Patchwork-Delegate: gakhil@marvell.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id A86EEA04D7; Thu, 3 Sep 2020 07:48:39 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 3B2501C0B2; Thu, 3 Sep 2020 07:48:39 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by dpdk.org (Postfix) with ESMTP id 465DF1C0AE for ; Thu, 3 Sep 2020 07:48:38 +0200 (CEST) Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 0835kHKZ031330; Wed, 2 Sep 2020 22:48:37 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding : content-type; s=pfpt0220; bh=GXTZ9Qu6c5Oh++Pz/tcPeRJ6oRm0kUf64PjOsHgMSHc=; b=M0DUVoJGni2qViG2TVRDpVkZeCB9421bk/I+2EIzHKnO72gH9z/bBKHVddcjB0IkMzNv xOZa7jyZySjEzeFftU+e07m5/gfqwYRzgAeEbnR36ek3UKmdX80iKjZD7P35XFaeOMKt NoTWKciSVBB5sfMIpevPQBEP3/cDebFcc3ZJbaARX+Ehb4khpq0UrSX4ku45D9KbdV8p QrEAIJzkdcUpUTGk6a1z6q58+X7MHsbf3fTQQfEJdVJdjASHEpPQm+1bhv68h/uMjY4R 3QeFTKyHXkhKIg8cH6kfrFfNW0JlKjRudeHIXIgoD+J5ab7I5OADR6qppOONQo+QrenA hw== Received: from sc-exch01.marvell.com ([199.233.58.181]) by mx0a-0016f401.pphosted.com with ESMTP id 337mcqjru5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 02 Sep 2020 22:48:37 -0700 Received: from DC5-EXCH02.marvell.com (10.69.176.39) by SC-EXCH01.marvell.com (10.93.176.81) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 2 Sep 2020 22:48:36 -0700 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH02.marvell.com (10.69.176.39) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Wed, 2 Sep 2020 22:48:36 -0700 Received: from hyd1554T5810.caveonetworks.com.com (unknown [10.29.57.11]) by maili.marvell.com (Postfix) with ESMTP id 19E593F703F; Wed, 2 Sep 2020 22:48:33 -0700 (PDT) From: Tejasree Kondoj To: Akhil Goyal , Radu Nicolau CC: Tejasree Kondoj , Narayana Prasad , Anoob Joseph , Date: Thu, 3 Sep 2020 12:12:06 +0530 Message-ID: <20200903064206.16208-1-ktejasree@marvell.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-09-03_03:2020-09-02, 2020-09-03 signatures=0 Subject: [dpdk-dev] [PATCH] security: allow application to specify UDP ports to PMD X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Add UDP source and destination ports in ipsec_xform to allow application to specify ports to be used for IPsec UDP encapsulation as they are dynamically changed by NAT in between. Also adding an extra flag to indicate whether PMD needs to perform encapsulation header verification in case of inbound. In case of inline IPsec implementation, verification of outer IP headers and UDP encapsulation headers need to be handled in the PMD. For lookaside IPsec, application can optionally offload this to the PMD. Signed-off-by: Tejasree Kondoj --- lib/librte_security/rte_security.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/lib/librte_security/rte_security.h b/lib/librte_security/rte_security.h index 16839e539..670bdeb6b 100644 --- a/lib/librte_security/rte_security.h +++ b/lib/librte_security/rte_security.h @@ -130,6 +130,13 @@ struct rte_security_ipsec_sa_options { */ uint32_t udp_encap : 1; + /** Verify tunnel header and UDP encapsulation ports in inbound + * + * * 1: Match outer header source, destination addresses and UDP ports + * * 0: Do not match outer IP addresses and UDP ports + */ + uint32_t encap_hdr_verify : 1; + /** Copy DSCP bits * * * 1: Copy IPv4 or IPv6 DSCP bits from inner IP header to @@ -190,6 +197,16 @@ enum rte_security_ipsec_sa_direction { /**< Verify digest and decrypt */ }; +/** + * UDP encapsulation ports + */ +struct rte_security_ipsec_udp_encapsulation { + uint16_t src_port; + /**< UDP source port */ + uint16_t dst_port; + /**< UDP destination port */ +}; + /** * IPsec security association configuration data. * @@ -216,6 +233,8 @@ struct rte_security_ipsec_xform { /**< Anti replay window size to enable sequence replay attack handling. * replay checking is disabled if the window size is 0. */ + struct rte_security_ipsec_udp_encapsulation udp_encap; + /**< UDP encapsulation ports */ }; /**