[RFC,3/3] cryptodev: add details of datapath handling of TLS records
Checks
Commit Message
TLS/DTLS record processing requires content type to be provided per
packet (for record write operation). Extend usage of
rte_crypto_op.aux_flags for the same purpose.
Signed-off-by: Akhil Goyal <gakhil@marvell.com>
Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Signed-off-by: Vidya Sagar Velumuri <vvelumuri@marvell.com>
---
doc/guides/prog_guide/rte_security.rst | 10 ++++++++++
lib/cryptodev/rte_crypto.h | 6 ++++++
2 files changed, 16 insertions(+)
Comments
> -----Original Message-----
> From: Anoob Joseph <anoobj@marvell.com>
> Sent: Friday, August 11, 2023 8:17 AM
> To: Thomas Monjalon <thomas@monjalon.net>; Akhil Goyal
> <gakhil@marvell.com>; Jerin Jacob <jerinj@marvell.com>; Konstantin Ananyev
> <konstantin.v.ananyev@yandex.ru>
> Cc: Hemant Agrawal <hemant.agrawal@nxp.com>; dev@dpdk.org; Matz,
> Olivier <olivier.matz@6wind.com>; Vidya Sagar Velumuri
> <vvelumuri@marvell.com>
> Subject: [RFC PATCH 3/3] cryptodev: add details of datapath handling of TLS
> records
>
> TLS/DTLS record processing requires content type to be provided per
> packet (for record write operation). Extend usage of
> rte_crypto_op.aux_flags for the same purpose.
I understand the goal to extend the usage of the aux_flags, but I do not understand
what data/structs/values I should use to set or error-check the aux-flags here.
>
> Signed-off-by: Akhil Goyal <gakhil@marvell.com>
> Signed-off-by: Anoob Joseph <anoobj@marvell.com>
> Signed-off-by: Vidya Sagar Velumuri <vvelumuri@marvell.com>
> ---
> doc/guides/prog_guide/rte_security.rst | 10 ++++++++++
> lib/cryptodev/rte_crypto.h | 6 ++++++
> 2 files changed, 16 insertions(+)
>
> diff --git a/doc/guides/prog_guide/rte_security.rst
> b/doc/guides/prog_guide/rte_security.rst
> index 7716d7239f..6cb69bc949 100644
> --- a/doc/guides/prog_guide/rte_security.rst
> +++ b/doc/guides/prog_guide/rte_security.rst
> @@ -451,6 +451,16 @@ Protocol. The TLS Record Protocol provides
> connection security that has two basi
> V V
> TLSCiphertext TLSPlaintext
>
> +TLS and DTLS header formation (in record write operation) would depend on
> the
> +type of content. It is a per packet variable and would need to be handled by
> +the same session. Application may pass this info to a cryptodev performing
> +lookaside protocol offload by passing the same in ``rte_crypto_op.aux_flags``.
> +
> +In record read operation, application is required to preserve any info it may
> +need from the TLS/DTLS header (such as content type and sequence number)
> as the
> +cryptodev would remove the header and padding as part of the lookaside
> protocol
> +processing.
> +
> Supported Versions
> ^^^^^^^^^^^^^^^^^^
>
> diff --git a/lib/cryptodev/rte_crypto.h b/lib/cryptodev/rte_crypto.h
> index 9b8d0331a4..7c12a2b705 100644
> --- a/lib/cryptodev/rte_crypto.h
> +++ b/lib/cryptodev/rte_crypto.h
> @@ -101,6 +101,12 @@ struct rte_crypto_op {
> /**< Operation specific auxiliary/additional flags.
> * These flags carry additional information from the
> * operation. Processing of the same is optional.
It says "processing is optional" here, but in TLS/DTLS, it is proposed that the
soft-error and hard-errors are returned to the user through this struct?
That is not optional, and failing to check that is a failure mode which can result
in IV-reuse, and hence decryption of payload by a malicious actor?
I see this part of the API as being critical to correct usage, and it does not seem
well defined or clear to me at this point. If I am mis-understanding, please clarify,
as likely other developers will likely mis-understand too. Example code snippets of
good hardened error-handling for soft-error and hard-error would help.
> + * With TLS record offload
> (RTE_SECURITY_PROTOCOL_TLS_RECORD),
> + * application would be required to provide the message
> + * type of the input provided. The 'aux_flags' field
> + * can be used for passing the same. Message types are
> + * listed as RTE_TLS_TYPE_* and RTE_DTLS_TYPE_*.
> */
Same comment as above the "aux_fields can be used" string does not explain to the user
*how* to use the field correctly. Examples (in rte_security.rst?) would help.
> uint8_t reserved[2];
> /**< Reserved bytes to fill 64 bits for
> --
> 2.25.1
@@ -451,6 +451,16 @@ Protocol. The TLS Record Protocol provides connection security that has two basi
V V
TLSCiphertext TLSPlaintext
+TLS and DTLS header formation (in record write operation) would depend on the
+type of content. It is a per packet variable and would need to be handled by
+the same session. Application may pass this info to a cryptodev performing
+lookaside protocol offload by passing the same in ``rte_crypto_op.aux_flags``.
+
+In record read operation, application is required to preserve any info it may
+need from the TLS/DTLS header (such as content type and sequence number) as the
+cryptodev would remove the header and padding as part of the lookaside protocol
+processing.
+
Supported Versions
^^^^^^^^^^^^^^^^^^
@@ -101,6 +101,12 @@ struct rte_crypto_op {
/**< Operation specific auxiliary/additional flags.
* These flags carry additional information from the
* operation. Processing of the same is optional.
+ *
+ * With TLS record offload (RTE_SECURITY_PROTOCOL_TLS_RECORD),
+ * application would be required to provide the message
+ * type of the input provided. The 'aux_flags' field
+ * can be used for passing the same. Message types are
+ * listed as RTE_TLS_TYPE_* and RTE_DTLS_TYPE_*.
*/
uint8_t reserved[2];
/**< Reserved bytes to fill 64 bits for