Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/99901/?format=api
{ "id": 99901, "url": "http://patchwork.dpdk.org/api/patches/99901/?format=api", "web_url": "http://patchwork.dpdk.org/project/dpdk/patch/20210928120741.16674-2-ktejasree@marvell.com/", "project": { "id": 1, "url": "http://patchwork.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<20210928120741.16674-2-ktejasree@marvell.com>", "list_archive_url": "https://inbox.dpdk.org/dev/20210928120741.16674-2-ktejasree@marvell.com", "date": "2021-09-28T12:07:39", "name": "[v2,1/3] security: add option to configure tunnel header verification", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": true, "hash": "93e2580f06c869a31500398e8ec507317d1d8f1c", "submitter": { "id": 1789, "url": "http://patchwork.dpdk.org/api/people/1789/?format=api", "name": "Tejasree Kondoj", "email": "ktejasree@marvell.com" }, "delegate": { "id": 6690, "url": "http://patchwork.dpdk.org/api/users/6690/?format=api", "username": "akhil", "first_name": "akhil", "last_name": "goyal", "email": "gakhil@marvell.com" }, "mbox": "http://patchwork.dpdk.org/project/dpdk/patch/20210928120741.16674-2-ktejasree@marvell.com/mbox/", "series": [ { "id": 19226, "url": "http://patchwork.dpdk.org/api/series/19226/?format=api", "web_url": "http://patchwork.dpdk.org/project/dpdk/list/?series=19226", "date": "2021-09-28T12:07:38", "name": "add option to configure tunnel header verification", "version": 2, "mbox": "http://patchwork.dpdk.org/series/19226/mbox/" } ], "comments": "http://patchwork.dpdk.org/api/patches/99901/comments/", "check": "warning", "checks": "http://patchwork.dpdk.org/api/patches/99901/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@inbox.dpdk.org", "Delivered-To": "patchwork@inbox.dpdk.org", "Received": [ "from mails.dpdk.org (mails.dpdk.org [217.70.189.124])\n\tby inbox.dpdk.org (Postfix) with ESMTP id A30B1A0032;\n\tTue, 28 Sep 2021 13:14:14 +0200 (CEST)", "from [217.70.189.124] (localhost [127.0.0.1])\n\tby mails.dpdk.org (Postfix) with ESMTP id 5D229410F4;\n\tTue, 28 Sep 2021 13:14:13 +0200 (CEST)", "from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com\n [67.231.148.174])\n by mails.dpdk.org (Postfix) with ESMTP id 9DE44410EF\n for <dev@dpdk.org>; Tue, 28 Sep 2021 13:14:08 +0200 (CEST)", "from pps.filterd (m0045849.ppops.net [127.0.0.1])\n by mx0a-0016f401.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id\n 18SAIJVD020820;\n Tue, 28 Sep 2021 04:14:07 -0700", "from dc5-exch01.marvell.com ([199.233.59.181])\n by mx0a-0016f401.pphosted.com with ESMTP id 3bc16205vp-1\n (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT);\n Tue, 28 Sep 2021 04:14:07 -0700", "from DC5-EXCH01.marvell.com (10.69.176.38) by DC5-EXCH01.marvell.com\n (10.69.176.38) with Microsoft SMTP Server (TLS) id 15.0.1497.18;\n Tue, 28 Sep 2021 04:14:06 -0700", "from maili.marvell.com (10.69.176.80) by DC5-EXCH01.marvell.com\n (10.69.176.38) with Microsoft SMTP Server id 15.0.1497.18 via Frontend\n Transport; Tue, 28 Sep 2021 04:14:06 -0700", "from hyd1554T5810.caveonetworks.com.com (unknown [10.29.57.11])\n by maili.marvell.com (Postfix) with ESMTP id 7B2973F70BC;\n Tue, 28 Sep 2021 04:14:02 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com;\n h=from : to : cc :\n subject : date : message-id : in-reply-to : references : mime-version :\n content-transfer-encoding : content-type; s=pfpt0220;\n bh=EGvcVk+ezziEkWI/agKM8ykGXRy9K0u9cFzLks7XGlo=;\n b=J8Eph9+haCl+eJ9YNaJyIBHlKoeP0FuZI8IkIA23gzToRvpscZkP9Og/HGYtEBZGgMWm\n A0QmQ4ypf+jUfc//xrToNGDY9rrOvAfABDIknKmleMsJxG5k2oaXkbnC2bM3e913PZ0c\n qBS2Gq5teVYn7EILRACMqoyj2awVjlW8lolmbZWBK/YMv3pbSNpKK09/9dvXru8skYO+\n 4aWE8hucuH/irZChJlHIXbCPJQgBrIvH+0Pnozj56ShkxN9QcllkhTHyF4c0FQQLv7KC\n pnUfy4DT0JGvuqhRgU2cUPFsU0YSiBxK+LWHt4N4wu1Mi7HE6EElmkQGE4NqpIE9m439 Yg==", "From": "Tejasree Kondoj <ktejasree@marvell.com>", "To": "Akhil Goyal <gakhil@marvell.com>, Radu Nicolau <radu.nicolau@intel.com>,\n Declan Doherty <declan.doherty@intel.com>", "CC": "Tejasree Kondoj <ktejasree@marvell.com>,\n Anoob Joseph <anoobj@marvell.com>,\n Ankur Dwivedi <adwivedi@marvell.com>, Jerin Jacob <jerinj@marvell.com>,\n Konstantin Ananyev <konstantin.ananyev@intel.com>,\n Ciara Power <ciara.power@intel.com>,\n Hemant Agrawal <hemant.agrawal@nxp.com>,\n Gagandeep Singh <g.singh@nxp.com>, Fan Zhang <roy.fan.zhang@intel.com>,\n Archana Muniganti <marchana@marvell.com>, <dev@dpdk.org>", "Date": "Tue, 28 Sep 2021 17:37:39 +0530", "Message-ID": "<20210928120741.16674-2-ktejasree@marvell.com>", "X-Mailer": "git-send-email 2.27.0", "In-Reply-To": "<20210928120741.16674-1-ktejasree@marvell.com>", "References": "<20210928120741.16674-1-ktejasree@marvell.com>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Content-Type": "text/plain", "X-Proofpoint-ORIG-GUID": "qNn4B_GkKpOVorJqh4MEtDZD8zW6xyy6", "X-Proofpoint-GUID": "qNn4B_GkKpOVorJqh4MEtDZD8zW6xyy6", "X-Proofpoint-Virus-Version": "vendor=baseguard\n engine=ICAP:2.0.182.1,Aquarius:18.0.790,Hydra:6.0.391,FMLib:17.0.607.475\n definitions=2021-09-28_05,2021-09-28_01,2020-04-07_01", "Subject": "[dpdk-dev] [PATCH v2 1/3] security: add option to configure tunnel\n header verification", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n <mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n <mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org", "Sender": "\"dev\" <dev-bounces@dpdk.org>" }, "content": "Add option to indicate whether outer header verification\nneed to be done as part of inbound IPsec processing.\n\nWith inline IPsec processing, SA lookup would be happening\nin the Rx path of rte_ethdev. When rte_flow is configured to\nsupport more than one SA, SPI would be used to lookup SA.\nIn such cases, additional verification would be required to\nensure duplicate SPIs are not getting processed in the inline path.\n\nFor lookaside cases, the same option can be used by application\nto offload tunnel verification to the PMD.\n\nThese verifications would help in averting possible DoS attacks.\n\nSigned-off-by: Tejasree Kondoj <ktejasree@marvell.com>\nAcked-by: Akhil Goyal <gakhil@marvell.com>\n---\n doc/guides/rel_notes/deprecation.rst | 2 +-\n doc/guides/rel_notes/release_21_11.rst | 5 +++++\n lib/security/rte_security.h | 17 +++++++++++++++++\n 3 files changed, 23 insertions(+), 1 deletion(-)", "diff": "diff --git a/doc/guides/rel_notes/deprecation.rst b/doc/guides/rel_notes/deprecation.rst\nindex 69fbde0c70..80ae9a6372 100644\n--- a/doc/guides/rel_notes/deprecation.rst\n+++ b/doc/guides/rel_notes/deprecation.rst\n@@ -238,7 +238,7 @@ Deprecation Notices\n \n * security: The IPsec SA config options ``struct rte_security_ipsec_sa_options``\n will be updated with new fields to support new features like IPsec inner\n- checksum, tunnel header verification, TSO in case of protocol offload.\n+ checksum, TSO in case of protocol offload.\n \n * ipsec: The structure ``rte_ipsec_sa_prm`` will be extended with a new field\n ``hdr_l3_len`` to configure tunnel L3 header length.\ndiff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst\nindex 0b7ffa5e50..623b52d9c9 100644\n--- a/doc/guides/rel_notes/release_21_11.rst\n+++ b/doc/guides/rel_notes/release_21_11.rst\n@@ -181,6 +181,11 @@ ABI Changes\n soft and hard SA expiry limits. Limits can be either in units of packets or\n bytes.\n \n+* security: add IPsec SA option to configure tunnel header verification\n+\n+ * Added SA option to indicate whether outer header verification need to be\n+ done as part of inbound IPsec processing.\n+\n \n Known Issues\n ------------\ndiff --git a/lib/security/rte_security.h b/lib/security/rte_security.h\nindex 88147e1f57..a10c9b5f00 100644\n--- a/lib/security/rte_security.h\n+++ b/lib/security/rte_security.h\n@@ -55,6 +55,14 @@ enum rte_security_ipsec_tunnel_type {\n \t/**< Outer header is IPv6 */\n };\n \n+/**\n+ * IPSEC tunnel header verification mode\n+ *\n+ * Controls how outer IP header is verified in inbound.\n+ */\n+#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR 0x1\n+#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR 0x2\n+\n /**\n * Security context for crypto/eth devices\n *\n@@ -206,6 +214,15 @@ struct rte_security_ipsec_sa_options {\n \t * by the PMD.\n \t */\n \tuint32_t iv_gen_disable : 1;\n+\n+\t/** Verify tunnel header in inbound\n+\t * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR``: Verify destination\n+\t * IP address.\n+\t *\n+\t * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR``: Verify both\n+\t * source and destination IP addresses.\n+\t */\n+\tuint32_t tunnel_hdr_verify : 2;\n };\n \n /** IPSec security association direction */\n", "prefixes": [ "v2", "1/3" ] }