d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

security: add SA config option for inner checksum

Browse Source 
Add inner packet IPv4 hdr and L4 checksum enable options
in conf. These will be used in case of protocol offload.
Per SA, application could specify whether the
checksum(compute/verify) can be offloaded to security device.

Signed-off-by: Archana Muniganti <marchana@marvell.com>
Acked-by: Konstantin Ananyev <konstantin.ananyev@intel.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>
This commit is contained in:
Archana Muniganti 2021-09-30 18:28:30 +05:30 committed by Akhil Goyal
parent e705d30552
commit 03ab51eafd
5 changed files with 41 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
doc/guides/cryptodevs/features/default.ini
View File

@ -33,6 +33,7 @@ Non-Byte aligned data =
Sym raw data path API =
Cipher multiple data units =
Cipher wrapped key =
Inner checksum =
;
; Supported crypto algorithms of a default crypto driver.

4
doc/guides/rel_notes/deprecation.rst
View File

@ -209,8 +209,8 @@ Deprecation Notices
IPsec payload MSS (Maximum Segment Size), and ESN (Extended Sequence Number).
* security: The IPsec SA config options ``struct rte_security_ipsec_sa_options``
will be updated with new fields to support new features like IPsec inner
checksum, TSO in case of protocol offload.
will be updated with new fields to support new features like TSO in case of
protocol offload.
* ipsec: The structure ``rte_ipsec_sa_prm`` will be extended with a new field
``hdr_l3_len`` to configure tunnel L3 header length.

5
doc/guides/rel_notes/release_21_11.rst
View File

@ -258,6 +258,11 @@ ABI Changes
``rte_security_ipsec_xform`` to allow applications to configure SA soft
and hard expiry limits. Limits can be either in number of packets or bytes.
* security: The new options ``ip_csum_enable`` and ``l4_csum_enable`` were added
in structure ``rte_security_ipsec_sa_options`` to indicate whether inner
packet IPv4 header checksum and L4 checksum need to be offloaded to
security device.
* bbdev: Added capability related to more comprehensive CRC options,
shifting values of the ``enum rte_bbdev_op_ldpcdec_flag_bitmasks``.

2
lib/cryptodev/rte_cryptodev.h
View File

@ -479,6 +479,8 @@ rte_cryptodev_asym_get_xform_enum(enum rte_crypto_asym_xform_type *xform_enum,
/**< Support operations on multiple data-units message */
#define RTE_CRYPTODEV_FF_CIPHER_WRAPPED_KEY (1ULL << 26)
/**< Support wrapped key in cipher xform */
#define RTE_CRYPTODEV_FF_SECURITY_INNER_CSUM (1ULL << 27)
/**< Support inner checksum computation/verification */
/**
* Get the name of a crypto device feature flag

31
lib/security/rte_security.h
View File

@ -227,6 +227,37 @@ struct rte_security_ipsec_sa_options {
* * 0: Do not match UDP ports
*/
uint32_t udp_ports_verify : 1;
/** Compute/verify inner packet IPv4 header checksum in tunnel mode
*
* * 1: For outbound, compute inner packet IPv4 header checksum
* before tunnel encapsulation and for inbound, verify after
* tunnel decapsulation.
* * 0: Inner packet IP header checksum is not computed/verified.
*
* The checksum verification status would be set in mbuf using
* PKT_RX_IP_CKSUM_xxx flags.
*
* Inner IP checksum computation can also be enabled(per operation)
* by setting the flag PKT_TX_IP_CKSUM in mbuf.
*/
uint32_t ip_csum_enable : 1;
/** Compute/verify inner packet L4 checksum in tunnel mode
*
* * 1: For outbound, compute inner packet L4 checksum before
* tunnel encapsulation and for inbound, verify after
* tunnel decapsulation.
* * 0: Inner packet L4 checksum is not computed/verified.
*
* The checksum verification status would be set in mbuf using
* PKT_RX_L4_CKSUM_xxx flags.
*
* Inner L4 checksum computation can also be enabled(per operation)
* by setting the flags PKT_TX_TCP_CKSUM or PKT_TX_SCTP_CKSUM or
* PKT_TX_UDP_CKSUM or PKT_TX_L4_MASK in mbuf.
*/
uint32_t l4_csum_enable : 1;
};
/** IPSec security association direction */