From patchwork Fri May 31 16:14:44 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Igor Russkikh X-Patchwork-Id: 53963 X-Patchwork-Delegate: gakhil@marvell.com Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id B92D01B997; Fri, 31 May 2019 18:14:49 +0200 (CEST) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-eopbgr780041.outbound.protection.outlook.com [40.107.78.41]) by dpdk.org (Postfix) with ESMTP id 9F7E91B957 for ; Fri, 31 May 2019 18:14:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=AQUANTIA1COM.onmicrosoft.com; s=selector1-AQUANTIA1COM-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yJf5+83cts6XcFT6Uu6ok+FtrxTz5ahmGfrPl+50Ui4=; b=AHq3kI7XxU4H9ZH9PEY+6kA3owDDJR3fVdbbPLq5/gWxHucFkwriAmwdv/90VhoGkeCdBxbXkucdV88xRE1/eD3vPIiSotrEhowT+oEsI8R2d0S4KfslvBsqQxf9oXV2Y85gwfmfv7XdjYqkiT5psB7l7S4yVpVr/FGc0vQnJnI= Received: from MWHPR11MB1968.namprd11.prod.outlook.com (10.175.54.143) by MWHPR11MB1262.namprd11.prod.outlook.com (10.169.236.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1922.23; Fri, 31 May 2019 16:14:45 +0000 Received: from MWHPR11MB1968.namprd11.prod.outlook.com ([fe80::fd20:d79e:4027:a437]) by MWHPR11MB1968.namprd11.prod.outlook.com ([fe80::fd20:d79e:4027:a437%3]) with mapi id 15.20.1943.016; Fri, 31 May 2019 16:14:44 +0000 From: Igor Russkikh To: "dev@dpdk.org" CC: "ferruh.yigit@intel.com" , Pavel Belous , John McNamara , Konstantin Ananyev , Thomas Monjalon , Akhil Goyal , Declan Doherty , Igor Russkikh Thread-Topic: [RFC 1/5] security: MACSEC infrastructure data declarations Thread-Index: AQHVF8v1jmuO5D5LP0mOLcTsnd3wtQ== Date: Fri, 31 May 2019 16:14:44 +0000 Message-ID: <4595add642bf8ca1114488657d12a973b966e8f5.1559319237.git.igor.russkikh@aquantia.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: HE1PR0401CA0056.eurprd04.prod.outlook.com (2603:10a6:3:19::24) To MWHPR11MB1968.namprd11.prod.outlook.com (2603:10b6:300:111::15) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Igor.Russkikh@aquantia.com; x-ms-exchange-messagesentrepresentingtype: 1 x-mailer: git-send-email 2.17.1 x-originating-ip: [95.79.108.179] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9239e69a-6fdb-4f24-6f16-08d6e5e31785 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MWHPR11MB1262; x-ms-traffictypediagnostic: MWHPR11MB1262: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5797; x-forefront-prvs: 00540983E2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(136003)(39850400004)(366004)(346002)(376002)(189003)(199004)(256004)(14444005)(5024004)(50226002)(66946007)(81166006)(8676002)(44832011)(81156014)(14454004)(7736002)(478600001)(72206003)(5660300002)(1730700003)(476003)(2351001)(2616005)(26005)(66446008)(71200400001)(186003)(7110500001)(73956011)(71190400001)(68736007)(966005)(66556008)(15650500001)(66476007)(64756008)(118296001)(2420400007)(2501003)(25786009)(99286004)(6916009)(305945005)(6116002)(6436002)(4326008)(5640700003)(6512007)(3846002)(6306002)(102836004)(52116002)(36756003)(2906002)(8936002)(86362001)(6506007)(54906003)(316002)(107886003)(66066001)(386003)(53936002)(6486002)(486006); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1262; H:MWHPR11MB1968.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: aquantia.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: ERngUgjTDXyfUWQRdUHPf5yP3o29zYr+vuLz17eFDC6BYp9lip7vTOXi4Olqh2JDsMP9/PExHVkfLT8YFuRCSP6bo1E+85CwHS4Dm15Sb38dBtAHxTjq0xt+4b/mlGC+xJ4Xl7VedAXTXmfgeXTDhq4JVgJzCKIp6ing26lBbEdW4B4lvML3bR+znwz1tnfYxx3dXJumGoxZEl282Z9MZiEsEn9pyn5a/1DVBUY05rMuu1ZefIKla0WnvIouLohy+K1uqx21v1GUzLRkOkVg3wAoEJb9/QE26m06VDMdpX7ybyEcLiIEPYRu5CGSO0POGnjf36+K76WZrKN0nEguWiFjCLiGI6uodtQNCpSux3hwv4uGxwYE01+X9jPANCBxxqFjyMzEdhLYotMVH65geJAxmJUjHW9sW55njlJh1LE= MIME-Version: 1.0 X-OriginatorOrg: aquantia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9239e69a-6fdb-4f24-6f16-08d6e5e31785 X-MS-Exchange-CrossTenant-originalarrivaltime: 31 May 2019 16:14:44.7912 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 83e2e134-991c-4ede-8ced-34d47e38e6b1 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: irusski@aquantia.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1262 Subject: [dpdk-dev] [RFC 1/5] security: MACSEC infrastructure data declarations X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" This RFC suggest possible API to implement generic MACSEC HW offload in DPDK infrastructure. Right now two PMDs implementing MACSEC hw offload via private API: ixgbe (Intel) and atlantic (Aquantia). During that private API discussion it was decided to go further with well defined public API, based most probably on rte_security infrastructure. Here is that previous discussion: http://inbox.dpdk.org/dev/20190416101145.nVecHKp3w14Ptd_hne-DqHhKyzbre88PwNI-OAowXJM@z/ Declaring macsec API via rte_security gives a good data-centric view on parameters and operations macsec supports. Old, pure functional API (basically ixbe only API) presented function calls with big argument lists which is hard to extend and analyse. However, I'd like to note rte_security has to be used via explicitly created mempools - this hardens abit the usage. It also may be hard to extend the structures in the ABI compatible way. One of the problems with MACSEC is that internally implementation and hardware support could be either very simple, doing only endpoint encryption with a single TX SC (Secure Connection), or quite complex, capable to do flexible filtering and SC matching based on mac, vlan, ethertype and other. Different macsec hardware supports some custom features and from our experience users would like to configure these as well. Therefore there will probably be needed a number of PMD specific macsec operators support. Examples include: custom in-the-clear tag (matched by vlan id or mask), configurable internal logic to allow both secure and unsecure traffic, bypass filters on specific ethertypes. To support such extensions, suggest use rte_security_macsec_op enum with vendor specific operation codes. In context of rte_security, MACSEC operations should normally be based on security session create and update calls. Session create is used to setup overall session. Thats equivalent of old `macsec enable` operation. Session update is used to update security connections and associations. Here xform->op contains the required operation: rx/tx session/association add/update/removal. This RFC contains: - patch 1 is rte_security data structures declaration - patches 2-4 is a draft on how testpmd based invocations of rte_security API will look like - patch 5 is a draft on how PMD driver will implement security infrastructure To be done/decide: - testpmd macsec command layout changes: encryption and repl protection are properties of SC, not the overall connection. - add missing documentation and comments to all the structures - full testpmd macsec API adoption - ixgbe api adoptation - atlantic api adiptation - decide on how to declare SA (Security Associations) auto rollover and some other important features. - interrupt event callback detalization of possible macsec events. Notice that it is not a part of rte_security, but a part of rte_ethdev. - macsec statistics is now part of xstats list. Alternatively it could be moved to rte_security statistics. The hard thing is that stats are often available per SC/SA, a special API is required to fetch that. Signed-off-by: Igor Russkikh --- lib/librte_security/meson.build | 2 +- lib/librte_security/rte_security.h | 115 ++++++++++++++++++++++++++++- 2 files changed, 113 insertions(+), 4 deletions(-) diff --git a/lib/librte_security/meson.build b/lib/librte_security/meson.build index a5130d2f6d1e..10877d3ae544 100644 --- a/lib/librte_security/meson.build +++ b/lib/librte_security/meson.build @@ -4,4 +4,4 @@ version = 2 sources = files('rte_security.c') headers = files('rte_security.h', 'rte_security_driver.h') -deps += ['mempool', 'cryptodev'] +deps += ['mempool', 'cryptodev', 'net'] diff --git a/lib/librte_security/rte_security.h b/lib/librte_security/rte_security.h index 76f54e0e05bb..a3a9204fb62d 100644 --- a/lib/librte_security/rte_security.h +++ b/lib/librte_security/rte_security.h @@ -29,6 +29,7 @@ extern "C" { #include #include #include +#include /** IPSec protocol mode */ enum rte_security_ipsec_sa_mode { @@ -197,12 +198,87 @@ struct rte_security_ipsec_xform { /**< ESN for which the overflow event need to be raised */ }; +/** + * MACSEC global configuration parameters + * + */ +struct rte_security_macsec_param { + uint8_t enabled; +}; + +/** + * MACSEC SC (Secure Connection) parameters + * + */ +struct rte_security_macsec_txsc_param { + struct ether_addr s_mac; + /**< local side mac address */ + struct ether_addr d_mac; + /**< remote side mac address */ + uint32_t sci; + uint32_t tci; + uint8_t encrypt; + uint8_t protect; +}; + +struct rte_security_macsec_rxsc_param { + struct ether_addr s_mac, d_mac; + /**< remote side mac address */ + uint8_t replay_protection; + /**< replay protection */ + uint32_t anti_replay_window; + /**< anti replay window */ + uint16_t port_ident; + /**< remote side port identifier */ + uint8_t auto_rollover_enabled; +}; + +struct rte_security_macsec_sa_param { + uint8_t sa_idx; + uint8_t an; + uint32_t packet_number; + uint8_t key_len; + uint8_t key[32]; +}; + +/** + * Available operations over MACSEC instance + */ +enum rte_security_macsec_op { + RTE_SECURITY_MACSEC_OP_CONFIG, + + RTE_SECURITY_MACSEC_OP_ADD_TXSC, + RTE_SECURITY_MACSEC_OP_DEL_TXSC, + RTE_SECURITY_MACSEC_OP_UPD_TXSC, + + RTE_SECURITY_MACSEC_OP_ADD_RXSC, + RTE_SECURITY_MACSEC_OP_DEL_RXSC, + RTE_SECURITY_MACSEC_OP_UPD_RXSC, + + RTE_SECURITY_MACSEC_OP_ADD_TXSA, + RTE_SECURITY_MACSEC_OP_DEL_TXSA, + RTE_SECURITY_MACSEC_OP_UPD_TXSA, + + RTE_SECURITY_MACSEC_OP_ADD_RXSA, + RTE_SECURITY_MACSEC_OP_DEL_RXSA, + RTE_SECURITY_MACSEC_OP_UPD_RXSA, + + RTE_SECURITY_MACSEC_OP_STATS, + + RTE_SECURITY_MACSEC_OP_VENDOR = 0x100, +}; + /** * MACsec security session configuration */ struct rte_security_macsec_xform { - /** To be Filled */ - int dummy; + enum rte_security_macsec_op op; + union { + struct rte_security_macsec_param config_options; + struct rte_security_macsec_txsc_param txsc_options; + struct rte_security_macsec_rxsc_param rxsc_options; + struct rte_security_macsec_sa_param sa_options; + }; }; /** @@ -467,7 +543,40 @@ rte_security_attach_session(struct rte_crypto_op *op, } struct rte_security_macsec_stats { - uint64_t reserved; + /* Ingress Common Counters */ + uint64_t in_ctl_pkts; + uint64_t in_tagged_miss_pkts; + uint64_t in_untagged_miss_pkts; + uint64_t in_notag_pkts; + uint64_t in_untagged_pkts; + uint64_t in_bad_tag_pkts; + uint64_t in_no_sci_pkts; + uint64_t in_unknown_sci_pkts; + /* Ingress SA Counters */ + uint64_t in_untagged_hit_pkts; + uint64_t in_not_using_sa; + uint64_t in_unused_sa; + uint64_t in_not_valid_pkts; + uint64_t in_invalid_pkts; + uint64_t in_ok_pkts; + uint64_t in_unchecked_pkts; + uint64_t in_validated_octets; + uint64_t in_decrypted_octets; + /* Egress Common Counters */ + uint64_t out_ctl_pkts; + uint64_t out_unknown_sa_pkts; + uint64_t out_untagged_pkts; + uint64_t out_too_long; + /* Egress SC Counters */ + uint64_t out_sc_protected_pkts; + uint64_t out_sc_encrypted_pkts; + uint64_t out_sc_protected_octets; + uint64_t out_sc_encrypted_octets; + /* Egress SA Counters */ + uint64_t out_sa_hit_drop_redirect; + uint64_t out_sa_protected2_pkts; + uint64_t out_sa_protected_pkts; + uint64_t out_sa_encrypted_pkts; }; struct rte_security_ipsec_stats {