d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

security: add option to configure UDP ports verification

Browse Source 
Add option to indicate whether UDP encapsulation ports
verification need to be done as part of inbound
IPsec processing.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>
This commit is contained in:
Tejasree Kondoj 2021-09-29 08:55:12 +05:30 committed by Akhil Goyal
parent e0ae3db0c0
commit f7e3aa693d
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/guides/rel_notes/release_21_11.rst
View File

@ -238,6 +238,10 @@ ABI Changes
``rte_security_ipsec_sa_options`` to indicate whether outer header
verification need to be done as part of inbound IPsec processing.
* security: A new option ``udp_ports_verify`` was added in structure
``rte_security_ipsec_sa_options`` to indicate whether UDP ports
verification need to be done as part of inbound IPsec processing.
* security: A new structure ``rte_security_ipsec_lifetime`` was added to
replace ``esn_soft_limit`` in IPsec configuration structure
``rte_security_ipsec_xform`` to allow applications to configure SA soft

7
lib/security/rte_security.h
View File

@ -220,6 +220,13 @@ struct rte_security_ipsec_sa_options {
* source and destination IP addresses.
*/
uint32_t tunnel_hdr_verify : 2;
/** Verify UDP encapsulation ports in inbound
*
* * 1: Match UDP source and destination ports
* * 0: Do not match UDP ports
*/
uint32_t udp_ports_verify : 1;
};
/** IPSec security association direction */