diff mbox series

[1/3] security: add option to configure tunnel header verification

Message ID 20210908082111.27396-2-ktejasree@marvell.com (mailing list archive)
State Superseded, archived
Delegated to: akhil goyal
Headers
Series add option to configure tunnel header verification |

Checks

Context Check Description
ci/checkpatch warning coding style issues
ci/iol-testing warning apply patch failure

Commit Message

Tejasree Kondoj Sept. 8, 2021, 8:21 a.m. UTC 
  Add option to indicate whether outer header verification
need to be done as part of inbound IPsec processing.

With inline IPsec processing, SA lookup would be happening
in the Rx path of rte_ethdev. When rte_flow is configured to
support more than one SA, SPI would be used to lookup SA.
In such cases, additional verification would be required to
ensure duplicate SPIs are not getting processed in the inline path.

For lookaside cases, the same option can be used by application
to offload tunnel verification to the PMD.

These verifications would help in averting possible DoS attacks.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 doc/guides/rel_notes/release_21_11.rst |  5 +++++
 lib/security/rte_security.h            | 17 +++++++++++++++++
 2 files changed, 22 insertions(+)

Comments

Hemant Agrawal Sept. 8, 2021, 7:46 a.m. UTC | #1 
On 9/8/2021 1:51 PM, Tejasree Kondoj wrote:
> Add option to indicate whether outer header verification
> need to be done as part of inbound IPsec processing.
>
> With inline IPsec processing, SA lookup would be happening
> in the Rx path of rte_ethdev. When rte_flow is configured to
> support more than one SA, SPI would be used to lookup SA.
> In such cases, additional verification would be required to
> ensure duplicate SPIs are not getting processed in the inline path.
>
> For lookaside cases, the same option can be used by application
> to offload tunnel verification to the PMD.
>
> These verifications would help in averting possible DoS attacks.
>
> Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
> ---
>   doc/guides/rel_notes/release_21_11.rst |  5 +++++
>   lib/security/rte_security.h            | 17 +++++++++++++++++
>   2 files changed, 22 insertions(+)
>
> diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst
> index 0e3ed28378..b0606cb542 100644
> --- a/doc/guides/rel_notes/release_21_11.rst
> +++ b/doc/guides/rel_notes/release_21_11.rst
> @@ -136,6 +136,11 @@ ABI Changes
>       soft and hard SA expiry limits. Limits can be either in units of packets or
>       bytes.
>   
> +* security: add IPsec SA option to configure tunnel header verification
> +
> +  * Added SA option to indicate whether outer header verification need to be
> +    done as part of inbound IPsec processing.
> +
>   
>   Known Issues
>   ------------
> diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h
> index 95c169d6cf..2a61cad885 100644
> --- a/lib/security/rte_security.h
> +++ b/lib/security/rte_security.h
> @@ -55,6 +55,14 @@ enum rte_security_ipsec_tunnel_type {
>   	/**< Outer header is IPv6 */
>   };
>   
> +/**
> + * IPSEC tunnel header verification mode
> + *
> + * Controls how outer IP header is verified in inbound.
> + */
> +#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR     0x1
> +#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR 0x2
> +
>   /**
>    * Security context for crypto/eth devices
>    *
> @@ -195,6 +203,15 @@ struct rte_security_ipsec_sa_options {
>   	 * by the PMD.
>   	 */
>   	uint32_t iv_gen_disable : 1;
> +
> +	/** Verify tunnel header in inbound
> +	 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR``: Verify destination
> +	 *   IP address.
> +	 *
> +	 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR``: Verify both
> +	 *   source and destination IP addresses.
> +	 */
> +	uint32_t tunnel_hdr_verify : 2;
>   };
>   
>   /** IPSec security association direction */
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Akhil Goyal Sept. 8, 2021, 10:42 a.m. UTC | #2 
> Add option to indicate whether outer header verification
> need to be done as part of inbound IPsec processing.
> 
> With inline IPsec processing, SA lookup would be happening
> in the Rx path of rte_ethdev. When rte_flow is configured to
> support more than one SA, SPI would be used to lookup SA.
> In such cases, additional verification would be required to
> ensure duplicate SPIs are not getting processed in the inline path.
> 
> For lookaside cases, the same option can be used by application
> to offload tunnel verification to the PMD.
> 
> These verifications would help in averting possible DoS attacks.
> 
> Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
> ---
>  doc/guides/rel_notes/release_21_11.rst |  5 +++++

Deprecation notice should also be removed for this feature addition/
ABI breakage.

Other than that
Acked-by: Akhil Goyal <gakhil@marvell.com>

>  lib/security/rte_security.h            | 17 +++++++++++++++++
>  2 files changed, 22 insertions(+)
> 
> diff --git a/doc/guides/rel_notes/release_21_11.rst
> b/doc/guides/rel_notes/release_21_11.rst
> index 0e3ed28378..b0606cb542 100644
> --- a/doc/guides/rel_notes/release_21_11.rst
> +++ b/doc/guides/rel_notes/release_21_11.rst
> @@ -136,6 +136,11 @@ ABI Changes
>      soft and hard SA expiry limits. Limits can be either in units of packets or
>      bytes.
> 
> +* security: add IPsec SA option to configure tunnel header verification
> +
> +  * Added SA option to indicate whether outer header verification need to
> be
> +    done as part of inbound IPsec processing.
> +
> 
>  Known Issues
>  ------------
> diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h
> index 95c169d6cf..2a61cad885 100644
> --- a/lib/security/rte_security.h
> +++ b/lib/security/rte_security.h
> @@ -55,6 +55,14 @@ enum rte_security_ipsec_tunnel_type {
>  	/**< Outer header is IPv6 */
>  };
> 
> +/**
> + * IPSEC tunnel header verification mode
> + *
> + * Controls how outer IP header is verified in inbound.
> + */
> +#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR     0x1
> +#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR 0x2
> +
>  /**
>   * Security context for crypto/eth devices
>   *
> @@ -195,6 +203,15 @@ struct rte_security_ipsec_sa_options {
>  	 * by the PMD.
>  	 */
>  	uint32_t iv_gen_disable : 1;
> +
> +	/** Verify tunnel header in inbound
> +	 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR``: Verify
> destination
> +	 *   IP address.
> +	 *
> +	 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR``: Verify
> both
> +	 *   source and destination IP addresses.
> +	 */
> +	uint32_t tunnel_hdr_verify : 2;
>  };
> 
>  /** IPSec security association direction */
> --
> 2.27.0
diff mbox series

Patch

diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst
index 0e3ed28378..b0606cb542 100644
--- a/doc/guides/rel_notes/release_21_11.rst
+++ b/doc/guides/rel_notes/release_21_11.rst
@@ -136,6 +136,11 @@  ABI Changes
     soft and hard SA expiry limits. Limits can be either in units of packets or
     bytes.
 
+* security: add IPsec SA option to configure tunnel header verification
+
+  * Added SA option to indicate whether outer header verification need to be
+    done as part of inbound IPsec processing.
+
 
 Known Issues
 ------------
diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h
index 95c169d6cf..2a61cad885 100644
--- a/lib/security/rte_security.h
+++ b/lib/security/rte_security.h
@@ -55,6 +55,14 @@  enum rte_security_ipsec_tunnel_type {
 	/**< Outer header is IPv6 */
 };
 
+/**
+ * IPSEC tunnel header verification mode
+ *
+ * Controls how outer IP header is verified in inbound.
+ */
+#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR     0x1
+#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR 0x2
+
 /**
  * Security context for crypto/eth devices
  *
@@ -195,6 +203,15 @@  struct rte_security_ipsec_sa_options {
 	 * by the PMD.
 	 */
 	uint32_t iv_gen_disable : 1;
+
+	/** Verify tunnel header in inbound
+	 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR``: Verify destination
+	 *   IP address.
+	 *
+	 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR``: Verify both
+	 *   source and destination IP addresses.
+	 */
+	uint32_t tunnel_hdr_verify : 2;
 };
 
 /** IPSec security association direction */