From patchwork Tue Nov 3 10:08:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiawen Wu X-Patchwork-Id: 83557 X-Patchwork-Delegate: ferruh.yigit@amd.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 87FECA0521; Tue, 3 Nov 2020 11:19:57 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id B4DA9CADE; Tue, 3 Nov 2020 11:08:00 +0100 (CET) Received: from smtpproxy21.qq.com (smtpbg704.qq.com [203.205.195.105]) by dpdk.org (Postfix) with ESMTP id 284BCC9B8 for ; Tue, 3 Nov 2020 11:07:41 +0100 (CET) X-QQ-mid: bizesmtp26t1604398057tccx58y5 Received: from localhost.localdomain.com (unknown [183.129.236.74]) by esmtp10.qq.com (ESMTP) with id ; Tue, 03 Nov 2020 18:07:36 +0800 (CST) X-QQ-SSF: 01400000002000C0C000B00A0000000 X-QQ-FEAT: N/s2IhZC2kBFTtErlqgn1dEz21PIBU0fXdsGS0YHIg0QLuzGlSg7EUssut5vG ORIyBxZF3QHJsLw46D5C7BUbscu35+CIvNtTCp4EYOPp7qTkRO88tEAm1PqsMvkV5r+1+6q jPUaL6pvo2GQzwZ12dnefVyAkW/GnK+6dOEfjkXAAJApY6DwtqQdv5sUe7uHYofLvfTgM0R WjwwEMU7drxu948mCASWxCHxexmQwJ46UyVtCBUhx5JBc8D+m2/ISw09fPbU8sGRLXDjpl3 7D5bXHEnTLygWGnMvag3077xvSeyLy7Wa8T4k8AGI4yZ86CDdJDRunUuDFGmD8WSRyow98j 40iCmuh/cdqEFxS4JuwWDsPzuUPcQ== X-QQ-GoodBg: 2 From: Jiawen Wu To: dev@dpdk.org Cc: Jiawen Wu Date: Tue, 3 Nov 2020 18:08:18 +0800 Message-Id: <20201103100818.311881-38-jiawenwu@trustnetic.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20201103100818.311881-1-jiawenwu@trustnetic.com> References: <20201103100818.311881-1-jiawenwu@trustnetic.com> X-QQ-SENDSIZE: 520 Feedback-ID: bizesmtp:trustnetic.com:qybgforeign:qybgforeign5 X-QQ-Bgrelay: 1 Subject: [dpdk-dev] [PATCH 37/37] net/txgbe: add security type in flow action X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Add security type in flow action. Signed-off-by: Jiawen Wu --- drivers/net/txgbe/txgbe_flow.c | 52 +++++++++++++++++++++++++++++++++ drivers/net/txgbe/txgbe_ipsec.c | 30 +++++++++++++++++++ drivers/net/txgbe/txgbe_ipsec.h | 3 ++ 3 files changed, 85 insertions(+) diff --git a/drivers/net/txgbe/txgbe_flow.c b/drivers/net/txgbe/txgbe_flow.c index b5f4073e2..5ca89d619 100644 --- a/drivers/net/txgbe/txgbe_flow.c +++ b/drivers/net/txgbe/txgbe_flow.c @@ -145,6 +145,9 @@ const struct rte_flow_action *next_no_void_action( * END * other members in mask and spec should set to 0x00. * item->last should be NULL. + * + * Special case for flow action type RTE_FLOW_ACTION_TYPE_SECURITY. + * */ static int cons_parse_ntuple_filter(const struct rte_flow_attr *attr, @@ -193,6 +196,43 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr, memset(ð_null, 0, sizeof(struct rte_flow_item_eth)); memset(&vlan_null, 0, sizeof(struct rte_flow_item_vlan)); +#ifdef RTE_LIB_SECURITY + /** + * Special case for flow action type RTE_FLOW_ACTION_TYPE_SECURITY + */ + act = next_no_void_action(actions, NULL); + if (act->type == RTE_FLOW_ACTION_TYPE_SECURITY) { + const void *conf = act->conf; + /* check if the next not void item is END */ + act = next_no_void_action(actions, act); + if (act->type != RTE_FLOW_ACTION_TYPE_END) { + memset(filter, 0, sizeof(struct rte_eth_ntuple_filter)); + rte_flow_error_set(error, EINVAL, + RTE_FLOW_ERROR_TYPE_ACTION, + act, "Not supported action."); + return -rte_errno; + } + + /* get the IP pattern*/ + item = next_no_void_pattern(pattern, NULL); + while (item->type != RTE_FLOW_ITEM_TYPE_IPV4 && + item->type != RTE_FLOW_ITEM_TYPE_IPV6) { + if (item->last || + item->type == RTE_FLOW_ITEM_TYPE_END) { + rte_flow_error_set(error, EINVAL, + RTE_FLOW_ERROR_TYPE_ITEM, + item, "IP pattern missing."); + return -rte_errno; + } + item = next_no_void_pattern(pattern, item); + } + + filter->proto = IPPROTO_ESP; + return txgbe_crypto_add_ingress_sa_from_flow(conf, item->spec, + item->type == RTE_FLOW_ITEM_TYPE_IPV6); + } +#endif + /* the first not void item can be MAC or IPv4 */ item = next_no_void_pattern(pattern, NULL); @@ -563,6 +603,12 @@ txgbe_parse_ntuple_filter(struct rte_eth_dev *dev, if (ret) return ret; +#ifdef RTE_LIB_SECURITY + /* ESP flow not really a flow */ + if (filter->proto == IPPROTO_ESP) + return 0; +#endif + /* txgbe doesn't support tcp flags */ if (filter->flags & RTE_NTUPLE_FLAGS_TCP_FLAG) { memset(filter, 0, sizeof(struct rte_eth_ntuple_filter)); @@ -2690,6 +2736,12 @@ txgbe_flow_create(struct rte_eth_dev *dev, ret = txgbe_parse_ntuple_filter(dev, attr, pattern, actions, &ntuple_filter, error); +#ifdef RTE_LIB_SECURITY + /* ESP flow not really a flow*/ + if (ntuple_filter.proto == IPPROTO_ESP) + return flow; +#endif + if (!ret) { ret = txgbe_add_del_ntuple_filter(dev, &ntuple_filter, TRUE); if (!ret) { diff --git a/drivers/net/txgbe/txgbe_ipsec.c b/drivers/net/txgbe/txgbe_ipsec.c index f8c54f3d4..d0543ce0b 100644 --- a/drivers/net/txgbe/txgbe_ipsec.c +++ b/drivers/net/txgbe/txgbe_ipsec.c @@ -658,6 +658,36 @@ txgbe_crypto_enable_ipsec(struct rte_eth_dev *dev) return 0; } +int +txgbe_crypto_add_ingress_sa_from_flow(const void *sess, + const void *ip_spec, + uint8_t is_ipv6) +{ + struct txgbe_crypto_session *ic_session = + get_sec_session_private_data(sess); + + if (ic_session->op == TXGBE_OP_AUTHENTICATED_DECRYPTION) { + if (is_ipv6) { + const struct rte_flow_item_ipv6 *ipv6 = ip_spec; + ic_session->src_ip.type = IPv6; + ic_session->dst_ip.type = IPv6; + rte_memcpy(ic_session->src_ip.ipv6, + ipv6->hdr.src_addr, 16); + rte_memcpy(ic_session->dst_ip.ipv6, + ipv6->hdr.dst_addr, 16); + } else { + const struct rte_flow_item_ipv4 *ipv4 = ip_spec; + ic_session->src_ip.type = IPv4; + ic_session->dst_ip.type = IPv4; + ic_session->src_ip.ipv4 = ipv4->hdr.src_addr; + ic_session->dst_ip.ipv4 = ipv4->hdr.dst_addr; + } + return txgbe_crypto_add_sa(ic_session); + } + + return 0; +} + static struct rte_security_ops txgbe_security_ops = { .session_create = txgbe_crypto_create_session, .session_get_size = txgbe_crypto_session_get_size, diff --git a/drivers/net/txgbe/txgbe_ipsec.h b/drivers/net/txgbe/txgbe_ipsec.h index 54c27d8ce..1e5678437 100644 --- a/drivers/net/txgbe/txgbe_ipsec.h +++ b/drivers/net/txgbe/txgbe_ipsec.h @@ -91,5 +91,8 @@ struct txgbe_ipsec { int txgbe_ipsec_ctx_create(struct rte_eth_dev *dev); int txgbe_crypto_enable_ipsec(struct rte_eth_dev *dev); +int txgbe_crypto_add_ingress_sa_from_flow(const void *sess, + const void *ip_spec, + uint8_t is_ipv6); #endif /*TXGBE_IPSEC_H_*/