DPDK 21.11.2
Loading...
Searching...
No Matches
rte_security.h
Go to the documentation of this file.
1/* SPDX-License-Identifier: BSD-3-Clause
2 * Copyright 2017,2019-2020 NXP
3 * Copyright(c) 2017-2020 Intel Corporation.
4 */
5
6#ifndef _RTE_SECURITY_H_
7#define _RTE_SECURITY_H_
8
16#ifdef __cplusplus
17extern "C" {
18#endif
19
20#include <sys/types.h>
21
22#include <rte_compat.h>
23#include <rte_common.h>
24#include <rte_crypto.h>
25#include <rte_ip.h>
26#include <rte_mbuf.h>
27#include <rte_mbuf_dyn.h>
28#include <rte_memory.h>
29#include <rte_mempool.h>
30
37};
38
45};
46
53};
54
60#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR 0x1
61#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR 0x2
62
73 void *device;
75 const struct rte_security_ops *ops;
77 uint16_t sess_cnt;
79 uint32_t flags;
81};
82
83#define RTE_SEC_CTX_F_FAST_SET_MDATA 0x00000001
86#define RTE_SEC_CTX_F_FAST_GET_UDATA 0x00000002
101 union {
102 struct {
103 struct in_addr src_ip;
105 struct in_addr dst_ip;
107 uint8_t dscp;
109 uint8_t df;
111 uint8_t ttl;
113 } ipv4;
115 struct {
116 struct in6_addr src_addr;
118 struct in6_addr dst_addr;
120 uint8_t dscp;
122 uint32_t flabel;
124 uint8_t hlimit;
126 } ipv6;
128 };
129};
130
131struct rte_security_ipsec_udp_param {
132 uint16_t sport;
133 uint16_t dport;
134};
135
145 uint32_t esn : 1;
146
153 uint32_t udp_encap : 1;
154
162 uint32_t copy_dscp : 1;
163
170 uint32_t copy_flabel : 1;
171
178 uint32_t copy_df : 1;
179
187 uint32_t dec_ttl : 1;
188
196 uint32_t ecn : 1;
197
204 uint32_t stats : 1;
205
218 uint32_t iv_gen_disable : 1;
219
227 uint32_t tunnel_hdr_verify : 2;
228
234 uint32_t udp_ports_verify : 1;
235
249 uint32_t ip_csum_enable : 1;
250
265 uint32_t l4_csum_enable : 1;
266
274 uint32_t reserved_opts : 18;
275};
276
283};
284
307};
308
315 uint32_t spi;
317 uint32_t salt;
335 union {
336 uint64_t value;
337 struct {
338 uint32_t low;
339 uint32_t hi;
340 };
341 } esn;
343 struct rte_security_ipsec_udp_param udp;
345};
346
352 int dummy;
353};
354
362};
363
368};
369
383
390 int8_t bearer;
394 uint8_t en_ordering;
409 uint32_t hfn;
420 uint8_t hfn_ovrd;
428 uint16_t reserved;
429};
430
441};
442
451};
452
476
487};
488
498 union {
499 struct rte_security_ipsec_xform ipsec;
500 struct rte_security_macsec_xform macsec;
501 struct rte_security_pdcp_xform pdcp;
502 struct rte_security_docsis_xform docsis;
503 };
507 void *userdata;
509};
510
511struct rte_security_session {
512 void *sess_private_data;
514 uint64_t opaque_data;
516};
517
529struct rte_security_session *
531 struct rte_security_session_conf *conf,
532 struct rte_mempool *mp,
533 struct rte_mempool *priv_mp);
534
545__rte_experimental
546int
548 struct rte_security_session *sess,
549 struct rte_security_session_conf *conf);
550
560unsigned int
562
577int
579 struct rte_security_session *sess);
580
582typedef uint64_t rte_security_dynfield_t;
585
599__rte_experimental
600static inline rte_security_dynfield_t *
602{
603 return RTE_MBUF_DYNFIELD(mbuf,
606}
607
616__rte_experimental
618{
620}
621
623__rte_experimental
625 struct rte_security_session *sess,
626 struct rte_mbuf *m, void *params);
627
641static inline int
643 struct rte_security_session *sess,
644 struct rte_mbuf *mb, void *params)
645{
646 /* Fast Path */
647 if (instance->flags & RTE_SEC_CTX_F_FAST_SET_MDATA) {
649 (rte_security_dynfield_t)(sess->sess_private_data);
650 return 0;
651 }
652
653 /* Jump to PMD specific function pointer */
654 return __rte_security_set_pkt_metadata(instance, sess, mb, params);
655}
656
658__rte_experimental
659extern void *__rte_security_get_userdata(struct rte_security_ctx *instance,
660 uint64_t md);
661
679__rte_experimental
680static inline void *
681rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md)
682{
683 /* Fast Path */
684 if (instance->flags & RTE_SEC_CTX_F_FAST_GET_UDATA)
685 return (void *)(uintptr_t)md;
686
687 /* Jump to PMD specific function pointer */
688 return __rte_security_get_userdata(instance, md);
689}
690
697static inline int
699 struct rte_security_session *sess)
700{
701 sym_op->sec_session = sess;
702
703 return 0;
704}
705
706static inline void *
707get_sec_session_private_data(const struct rte_security_session *sess)
708{
709 return sess->sess_private_data;
710}
711
712static inline void
713set_sec_session_private_data(struct rte_security_session *sess,
714 void *private_data)
715{
716 sess->sess_private_data = private_data;
717}
718
728static inline int
730 struct rte_security_session *sess)
731{
733 return -EINVAL;
734
736
737 return __rte_security_attach_session(op->sym, sess);
738}
739
740struct rte_security_macsec_stats {
741 uint64_t reserved;
742};
743
744struct rte_security_ipsec_stats {
745 uint64_t ipackets;
746 uint64_t opackets;
747 uint64_t ibytes;
748 uint64_t obytes;
749 uint64_t ierrors;
750 uint64_t oerrors;
751 uint64_t reserved1;
752 uint64_t reserved2;
753};
754
755struct rte_security_pdcp_stats {
756 uint64_t reserved;
757};
758
759struct rte_security_docsis_stats {
760 uint64_t reserved;
761};
762
763struct rte_security_stats {
764 enum rte_security_session_protocol protocol;
768 union {
769 struct rte_security_macsec_stats macsec;
770 struct rte_security_ipsec_stats ipsec;
771 struct rte_security_pdcp_stats pdcp;
772 struct rte_security_docsis_stats docsis;
773 };
774};
775
789__rte_experimental
790int
792 struct rte_security_session *sess,
793 struct rte_security_stats *stats);
794
804 union {
805 struct {
818 } ipsec;
820 struct {
821 /* To be Filled */
822 int dummy;
823 } macsec;
825 struct {
828 uint32_t capa_flags;
830 } pdcp;
832 struct {
835 } docsis;
837 };
838
842 uint32_t ol_flags;
844};
845
851#define RTE_SECURITY_PDCP_ORDERING_CAP 0x00000001
852
857#define RTE_SECURITY_PDCP_DUP_DETECT_CAP 0x00000002
858
859#define RTE_SECURITY_TX_OLOAD_NEED_MDATA 0x00000001
863#define RTE_SECURITY_TX_HW_TRAILER_OFFLOAD 0x00000002
869#define RTE_SECURITY_RX_HW_TRAILER_OFFLOAD 0x00010000
882 enum rte_security_session_protocol protocol;
883
885 union {
886 struct {
889 enum rte_security_ipsec_sa_direction direction;
890 } ipsec;
891 struct {
892 enum rte_security_pdcp_domain domain;
893 uint32_t capa_flags;
894 } pdcp;
895 struct {
896 enum rte_security_docsis_direction direction;
897 } docsis;
898 };
899};
900
910const struct rte_security_capability *
912
924const struct rte_security_capability *
926 struct rte_security_capability_idx *idx);
927
928#ifdef __cplusplus
929}
930#endif
931
932#endif /* _RTE_SECURITY_H_ */
#define unlikely(x)
#define RTE_STD_C11
Definition: rte_common.h:42
@ RTE_CRYPTO_OP_SECURITY_SESSION
Definition: rte_crypto.h:65
@ RTE_CRYPTO_OP_TYPE_SYMMETRIC
Definition: rte_crypto.h:32
struct rte_ether_addr src_addr
Definition: rte_ether.h:1
struct rte_ether_addr dst_addr
Definition: rte_ether.h:0
#define RTE_MBUF_DYNFIELD(m, offset, type)
Definition: rte_mbuf_dyn.h:229
rte_security_session_protocol
Definition: rte_security.h:478
@ RTE_SECURITY_PROTOCOL_PDCP
Definition: rte_security.h:483
@ RTE_SECURITY_PROTOCOL_DOCSIS
Definition: rte_security.h:485
@ RTE_SECURITY_PROTOCOL_IPSEC
Definition: rte_security.h:479
@ RTE_SECURITY_PROTOCOL_MACSEC
Definition: rte_security.h:481
static int __rte_security_attach_session(struct rte_crypto_sym_op *sym_op, struct rte_security_session *sess)
Definition: rte_security.h:698
const struct rte_security_capability * rte_security_capability_get(struct rte_security_ctx *instance, struct rte_security_capability_idx *idx)
const struct rte_security_capability * rte_security_capabilities_get(struct rte_security_ctx *instance)
#define RTE_SEC_CTX_F_FAST_SET_MDATA
Definition: rte_security.h:83
#define RTE_SEC_CTX_F_FAST_GET_UDATA
Definition: rte_security.h:86
rte_security_pdcp_direction
Definition: rte_security.h:365
@ RTE_SECURITY_PDCP_UPLINK
Definition: rte_security.h:366
@ RTE_SECURITY_PDCP_DOWNLINK
Definition: rte_security.h:367
struct rte_security_session * rte_security_session_create(struct rte_security_ctx *instance, struct rte_security_session_conf *conf, struct rte_mempool *mp, struct rte_mempool *priv_mp)
rte_security_ipsec_sa_protocol
Definition: rte_security.h:40
@ RTE_SECURITY_IPSEC_SA_PROTO_AH
Definition: rte_security.h:41
@ RTE_SECURITY_IPSEC_SA_PROTO_ESP
Definition: rte_security.h:43
__rte_experimental int rte_security_session_update(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_security_session_conf *conf)
rte_security_session_action_type
Definition: rte_security.h:456
@ RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO
Definition: rte_security.h:471
@ RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL
Definition: rte_security.h:463
@ RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL
Definition: rte_security.h:467
@ RTE_SECURITY_ACTION_TYPE_NONE
Definition: rte_security.h:457
@ RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO
Definition: rte_security.h:459
__rte_experimental int rte_security_session_stats_get(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_security_stats *stats)
static __rte_experimental void * rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md)
Definition: rte_security.h:681
rte_security_ipsec_sa_direction
Definition: rte_security.h:278
@ RTE_SECURITY_IPSEC_SA_DIR_INGRESS
Definition: rte_security.h:281
@ RTE_SECURITY_IPSEC_SA_DIR_EGRESS
Definition: rte_security.h:279
int rte_security_session_destroy(struct rte_security_ctx *instance, struct rte_security_session *sess)
static int rte_security_set_pkt_metadata(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_mbuf *mb, void *params)
Definition: rte_security.h:642
rte_security_ipsec_sa_mode
Definition: rte_security.h:32
@ RTE_SECURITY_IPSEC_SA_MODE_TUNNEL
Definition: rte_security.h:35
@ RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT
Definition: rte_security.h:33
rte_security_pdcp_domain
Definition: rte_security.h:358
@ RTE_SECURITY_PDCP_MODE_CONTROL
Definition: rte_security.h:359
@ RTE_SECURITY_PDCP_MODE_SHORT_MAC
Definition: rte_security.h:361
@ RTE_SECURITY_PDCP_MODE_DATA
Definition: rte_security.h:360
static int rte_security_attach_session(struct rte_crypto_op *op, struct rte_security_session *sess)
Definition: rte_security.h:729
rte_security_docsis_direction
Definition: rte_security.h:432
@ RTE_SECURITY_DOCSIS_UPLINK
Definition: rte_security.h:433
@ RTE_SECURITY_DOCSIS_DOWNLINK
Definition: rte_security.h:437
unsigned int rte_security_session_get_size(struct rte_security_ctx *instance)
int rte_security_dynfield_offset
__rte_experimental int __rte_security_set_pkt_metadata(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_mbuf *m, void *params)
static __rte_experimental bool rte_security_dynfield_is_registered(void)
Definition: rte_security.h:617
uint64_t rte_security_dynfield_t
Definition: rte_security.h:582
__rte_experimental void * __rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md)
static __rte_experimental rte_security_dynfield_t * rte_security_dynfield(struct rte_mbuf *mbuf)
Definition: rte_security.h:601
rte_security_pdcp_sn_size
Definition: rte_security.h:371
@ RTE_SECURITY_PDCP_SN_SIZE_12
Definition: rte_security.h:377
@ RTE_SECURITY_PDCP_SN_SIZE_18
Definition: rte_security.h:381
@ RTE_SECURITY_PDCP_SN_SIZE_15
Definition: rte_security.h:379
@ RTE_SECURITY_PDCP_SN_SIZE_7
Definition: rte_security.h:375
@ RTE_SECURITY_PDCP_SN_SIZE_5
Definition: rte_security.h:373
rte_security_ipsec_tunnel_type
Definition: rte_security.h:48
@ RTE_SECURITY_IPSEC_TUNNEL_IPV6
Definition: rte_security.h:51
@ RTE_SECURITY_IPSEC_TUNNEL_IPV4
Definition: rte_security.h:49
uint8_t type
Definition: rte_crypto.h:89
struct rte_crypto_sym_op sym[0]
Definition: rte_crypto.h:135
uint8_t sess_type
Definition: rte_crypto.h:99
struct rte_security_session * sec_session
struct rte_security_capability::@375::@380 docsis
enum rte_security_ipsec_sa_protocol proto
Definition: rte_security.h:806
struct rte_security_capability::@375::@377 ipsec
enum rte_security_session_action_type action
Definition: rte_security.h:799
enum rte_security_ipsec_sa_direction direction
Definition: rte_security.h:810
struct rte_security_capability::@375::@379 pdcp
struct rte_security_ipsec_sa_options options
Definition: rte_security.h:812
enum rte_security_pdcp_domain domain
Definition: rte_security.h:826
enum rte_security_session_protocol protocol
Definition: rte_security.h:801
enum rte_security_ipsec_sa_mode mode
Definition: rte_security.h:808
enum rte_security_docsis_direction direction
Definition: rte_security.h:833
struct rte_security_capability::@375::@378 macsec
const struct rte_cryptodev_capabilities * crypto_capabilities
Definition: rte_security.h:839
uint16_t sess_cnt
Definition: rte_security.h:77
const struct rte_security_ops * ops
Definition: rte_security.h:75
enum rte_security_docsis_direction direction
Definition: rte_security.h:449
enum rte_security_ipsec_tunnel_type type
Definition: rte_security.h:98
struct rte_security_ipsec_tunnel_param::@364::@366 ipv4
struct rte_security_ipsec_tunnel_param::@364::@367 ipv6
struct rte_security_ipsec_lifetime life
Definition: rte_security.h:329
struct rte_security_ipsec_tunnel_param tunnel
Definition: rte_security.h:327
union rte_security_ipsec_xform::@368 esn
enum rte_security_ipsec_sa_protocol proto
Definition: rte_security.h:323
enum rte_security_ipsec_sa_direction direction
Definition: rte_security.h:321
struct rte_security_ipsec_sa_options options
Definition: rte_security.h:319
enum rte_security_ipsec_sa_mode mode
Definition: rte_security.h:325
struct rte_security_ipsec_udp_param udp
Definition: rte_security.h:343
enum rte_security_pdcp_sn_size sn_size
Definition: rte_security.h:405
enum rte_security_pdcp_direction pkt_dir
Definition: rte_security.h:403
enum rte_security_pdcp_domain domain
Definition: rte_security.h:401
struct rte_crypto_sym_xform * crypto_xform
Definition: rte_security.h:505
enum rte_security_session_action_type action_type
Definition: rte_security.h:493
enum rte_security_session_protocol protocol
Definition: rte_security.h:495