From patchwork Mon Jul 5 12:30:07 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tejasree Kondoj X-Patchwork-Id: 95293 X-Patchwork-Delegate: gakhil@marvell.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id A1310A0A0F; Mon, 5 Jul 2021 13:35:16 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 6084F4068C; Mon, 5 Jul 2021 13:35:16 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by mails.dpdk.org (Postfix) with ESMTP id A1D664003C for ; Mon, 5 Jul 2021 13:35:14 +0200 (CEST) Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 165BQZq3012434; Mon, 5 Jul 2021 04:35:13 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding : content-type; s=pfpt0220; bh=N+3sqFzSUQT22FTlk8Bwwl3INTwGwpShprIq4J0uB8A=; b=Ub41zhcybEo7lEt/M4zxsIwq2xcO77qW9GKhFDe77o79m1IKqDa0rHgo0Qt1UCh/lW56 F25q7RUOPGfJ1Vt2fxwwFThK9ckvWXKbCl+Gf0tcM+67nXEZHs8e93uGVODjdSpXfDo7 gtyoL/6BHjNNfBgK3EIPvwutilmVc2Xz9jJisyzFvXPmsyGbkNFDhB4Z8QpHjuzt14cV ur1BvH1u+7KKroA5sH/E/8W/QRf+S4V8uagKSDvYRpH1ahL0lEWtlP3TAwBFDeQLkmmH 36nIL3V7H7OsJH2eZhfeEefBNAgOc7hVmkUObAlapHsCjdfPr2VpHK2Jbc9lnv1+FpI8 rg== Received: from dc5-exch01.marvell.com ([199.233.59.181]) by mx0a-0016f401.pphosted.com with ESMTP id 39kumns7w3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 05 Jul 2021 04:35:13 -0700 Received: from DC5-EXCH02.marvell.com (10.69.176.39) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Mon, 5 Jul 2021 04:35:12 -0700 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH02.marvell.com (10.69.176.39) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Mon, 5 Jul 2021 04:35:12 -0700 Received: from hyd1554T5810.caveonetworks.com.com (unknown [10.29.57.11]) by maili.marvell.com (Postfix) with ESMTP id A87D43F70CA; Mon, 5 Jul 2021 04:35:09 -0700 (PDT) From: Tejasree Kondoj To: Akhil Goyal , Radu Nicolau , Konstantin Ananyev , Hemant Agrawal , Fan Zhang CC: Tejasree Kondoj , Anoob Joseph , Jerin Jacob , Date: Mon, 5 Jul 2021 18:00:07 +0530 Message-ID: <20210705123007.19492-1-ktejasree@marvell.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 X-Proofpoint-GUID: khXWpMWJ3JnrBS8lD8zSBRo74JIXa5uh X-Proofpoint-ORIG-GUID: khXWpMWJ3JnrBS8lD8zSBRo74JIXa5uh X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.790 definitions=2021-07-05_05:2021-07-02, 2021-07-05 signatures=0 Subject: [dpdk-dev] [RFC] security: add option to configure tunnel header verification X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Add option to indicate whether outer header verification need to be done as part of inbound IPsec processing. With inline IPsec processing, SA lookup would be happening in the Rx path of rte_ethdev. When rte_flow is configured to support more than one SA, SPI would be used to lookup SA. In such cases, additional verification would be required to ensure duplicate SPIs are not getting processed in the inline path. For lookaside cases, the same option can be used by application to offload tunnel verification to the PMD. These verifications would help in averting possible DoS attacks. Signed-off-by: Tejasree Kondoj --- lib/security/rte_security.h | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h index 88d31de0a6..c67de78baf 100644 --- a/lib/security/rte_security.h +++ b/lib/security/rte_security.h @@ -55,6 +55,20 @@ enum rte_security_ipsec_tunnel_type { /**< Outer header is IPv6 */ }; +/** + * IPSEC tunnel header verification mode + * + * Controls how outer IP header is verified in inbound. + */ +enum rte_security_ipsec_tunnel_verify_mode { + RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DEFAULT = 0, + /**< Verify only SPI */ + RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR, + /**< Verify SPI and destination IP address */ + RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR, + /**< Verify SPI, source and destination IP addresses */ +}; + /** * Security context for crypto/eth devices * @@ -181,6 +195,9 @@ struct rte_security_ipsec_sa_options { * * 0: Disable per session security statistics collection for this SA. */ uint32_t stats : 1; + + /** Verify tunnel header in inbound */ + enum rte_security_ipsec_tunnel_verify_mode tunnel_hdr_verify; }; /** IPSec security association direction */