DPDK  20.11.0
rte_security.h
Go to the documentation of this file.
1 /* SPDX-License-Identifier: BSD-3-Clause
2  * Copyright 2017,2019-2020 NXP
3  * Copyright(c) 2017-2020 Intel Corporation.
4  */
5 
6 #ifndef _RTE_SECURITY_H_
7 #define _RTE_SECURITY_H_
8 
16 #ifdef __cplusplus
17 extern "C" {
18 #endif
19 
20 #include <sys/types.h>
21 
22 #include <netinet/in.h>
23 #include <netinet/ip.h>
24 #include <netinet/ip6.h>
25 
26 #include <rte_compat.h>
27 #include <rte_common.h>
28 #include <rte_crypto.h>
29 #include <rte_mbuf.h>
30 #include <rte_mbuf_dyn.h>
31 #include <rte_memory.h>
32 #include <rte_mempool.h>
33 
40 };
41 
48 };
49 
56 };
57 
68  void *device;
70  const struct rte_security_ops *ops;
72  uint16_t sess_cnt;
74 };
75 
85  union {
86  struct {
87  struct in_addr src_ip;
89  struct in_addr dst_ip;
91  uint8_t dscp;
93  uint8_t df;
95  uint8_t ttl;
97  } ipv4;
99  struct {
100  struct in6_addr src_addr;
102  struct in6_addr dst_addr;
104  uint8_t dscp;
106  uint32_t flabel;
108  uint8_t hlimit;
110  } ipv6;
112  };
113 };
114 
124  uint32_t esn : 1;
125 
132  uint32_t udp_encap : 1;
133 
141  uint32_t copy_dscp : 1;
142 
149  uint32_t copy_flabel : 1;
150 
157  uint32_t copy_df : 1;
158 
166  uint32_t dec_ttl : 1;
167 
175  uint32_t ecn : 1;
176 
183  uint32_t stats : 1;
184 };
185 
192 };
193 
200  uint32_t spi;
202  uint32_t salt;
214  uint64_t esn_soft_limit;
216  uint32_t replay_win_sz;
220 };
221 
227  int dummy;
228 };
229 
236 };
237 
242 };
243 
256 };
257 
264  int8_t bearer;
268  uint8_t en_ordering;
283  uint32_t hfn;
285  uint32_t hfn_threshold;
294  uint8_t hfn_ovrd;
300  uint8_t sdap_enabled;
302  uint16_t reserved;
303 };
304 
315 };
316 
325 };
326 
349 };
350 
361 };
362 
372  union {
373  struct rte_security_ipsec_xform ipsec;
374  struct rte_security_macsec_xform macsec;
375  struct rte_security_pdcp_xform pdcp;
376  struct rte_security_docsis_xform docsis;
377  };
381  void *userdata;
383 };
384 
385 struct rte_security_session {
386  void *sess_private_data;
388  uint64_t opaque_data;
390 };
391 
403 struct rte_security_session *
405  struct rte_security_session_conf *conf,
406  struct rte_mempool *mp,
407  struct rte_mempool *priv_mp);
408 
419 __rte_experimental
420 int
422  struct rte_security_session *sess,
423  struct rte_security_session_conf *conf);
424 
434 unsigned int
436 
451 int
453  struct rte_security_session *sess);
454 
456 typedef uint64_t rte_security_dynfield_t;
459 
473 __rte_experimental
474 static inline rte_security_dynfield_t *
476 {
477  return RTE_MBUF_DYNFIELD(mbuf,
480 }
481 
490 __rte_experimental
491 static inline bool rte_security_dynfield_is_registered(void)
492 {
493  return rte_security_dynfield_offset >= 0;
494 }
495 
509 int
511  struct rte_security_session *sess,
512  struct rte_mbuf *mb, void *params);
513 
531 __rte_experimental
532 void *
533 rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md);
534 
541 static inline int
543  struct rte_security_session *sess)
544 {
545  sym_op->sec_session = sess;
546 
547  return 0;
548 }
549 
550 static inline void *
551 get_sec_session_private_data(const struct rte_security_session *sess)
552 {
553  return sess->sess_private_data;
554 }
555 
556 static inline void
557 set_sec_session_private_data(struct rte_security_session *sess,
558  void *private_data)
559 {
560  sess->sess_private_data = private_data;
561 }
562 
572 static inline int
574  struct rte_security_session *sess)
575 {
577  return -EINVAL;
578 
580 
581  return __rte_security_attach_session(op->sym, sess);
582 }
583 
584 struct rte_security_macsec_stats {
585  uint64_t reserved;
586 };
587 
588 struct rte_security_ipsec_stats {
589  uint64_t ipackets;
590  uint64_t opackets;
591  uint64_t ibytes;
592  uint64_t obytes;
593  uint64_t ierrors;
594  uint64_t oerrors;
595  uint64_t reserved1;
596  uint64_t reserved2;
597 };
598 
599 struct rte_security_pdcp_stats {
600  uint64_t reserved;
601 };
602 
603 struct rte_security_docsis_stats {
604  uint64_t reserved;
605 };
606 
607 struct rte_security_stats {
608  enum rte_security_session_protocol protocol;
612  union {
613  struct rte_security_macsec_stats macsec;
614  struct rte_security_ipsec_stats ipsec;
615  struct rte_security_pdcp_stats pdcp;
616  struct rte_security_docsis_stats docsis;
617  };
618 };
619 
633 __rte_experimental
634 int
636  struct rte_security_session *sess,
637  struct rte_security_stats *stats);
638 
648  union {
649  struct {
662  } ipsec;
664  struct {
665  /* To be Filled */
666  int dummy;
667  } macsec;
669  struct {
672  uint32_t capa_flags;
674  } pdcp;
676  struct {
679  } docsis;
681  };
682 
686  uint32_t ol_flags;
688 };
689 
695 #define RTE_SECURITY_PDCP_ORDERING_CAP 0x00000001
696 
701 #define RTE_SECURITY_PDCP_DUP_DETECT_CAP 0x00000002
702 
703 #define RTE_SECURITY_TX_OLOAD_NEED_MDATA 0x00000001
704 
707 #define RTE_SECURITY_TX_HW_TRAILER_OFFLOAD 0x00000002
708 
713 #define RTE_SECURITY_RX_HW_TRAILER_OFFLOAD 0x00010000
714 
726  enum rte_security_session_protocol protocol;
727 
729  union {
730  struct {
732  enum rte_security_ipsec_sa_mode mode;
733  enum rte_security_ipsec_sa_direction direction;
734  } ipsec;
735  struct {
736  enum rte_security_pdcp_domain domain;
737  uint32_t capa_flags;
738  } pdcp;
739  struct {
740  enum rte_security_docsis_direction direction;
741  } docsis;
742  };
743 };
744 
754 const struct rte_security_capability *
756 
768 const struct rte_security_capability *
770  struct rte_security_capability_idx *idx);
771 
772 #ifdef __cplusplus
773 }
774 #endif
775 
776 #endif /* _RTE_SECURITY_H_ */
rte_security_pdcp_direction
rte_security_pdcp_direction
Definition: rte_security.h:239
rte_security_ctx::device
void * device
Definition: rte_security.h:68
RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO
@ RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO
Definition: rte_security.h:345
rte_security_ipsec_tunnel_param::hlimit
uint8_t hlimit
Definition: rte_security.h:108
rte_security_pdcp_xform::sdap_enabled
uint8_t sdap_enabled
Definition: rte_security.h:300
RTE_SECURITY_IPSEC_SA_DIR_INGRESS
@ RTE_SECURITY_IPSEC_SA_DIR_INGRESS
Definition: rte_security.h:190
RTE_CRYPTO_OP_SECURITY_SESSION
@ RTE_CRYPTO_OP_SECURITY_SESSION
Definition: rte_crypto.h:65
RTE_SECURITY_DOCSIS_DOWNLINK
@ RTE_SECURITY_DOCSIS_DOWNLINK
Definition: rte_security.h:311
rte_security_capability
Definition: rte_security.h:642
rte_security_session_protocol
rte_security_session_protocol
Definition: rte_security.h:352
rte_security_capability::replay_win_sz_max
uint32_t replay_win_sz_max
Definition: rte_security.h:658
rte_security_ipsec_sa_options::stats
uint32_t stats
Definition: rte_security.h:183
rte_security_capabilities_get
const struct rte_security_capability * rte_security_capabilities_get(struct rte_security_ctx *instance)
rte_security_ipsec_sa_options::copy_dscp
uint32_t copy_dscp
Definition: rte_security.h:141
rte_security_pdcp_xform::bearer
int8_t bearer
Definition: rte_security.h:264
rte_security_pdcp_xform::hfn
uint32_t hfn
Definition: rte_security.h:283
RTE_SECURITY_PROTOCOL_PDCP
@ RTE_SECURITY_PROTOCOL_PDCP
Definition: rte_security.h:357
rte_memory.h
rte_security_macsec_xform::dummy
int dummy
Definition: rte_security.h:227
rte_security_capability::ol_flags
uint32_t ol_flags
Definition: rte_security.h:686
rte_security_session_action_type
rte_security_session_action_type
Definition: rte_security.h:330
rte_cryptodev_capabilities
Definition: rte_cryptodev.h:178
rte_security_ipsec_sa_options::dec_ttl
uint32_t dec_ttl
Definition: rte_security.h:166
RTE_SECURITY_IPSEC_SA_DIR_EGRESS
@ RTE_SECURITY_IPSEC_SA_DIR_EGRESS
Definition: rte_security.h:188
unlikely
#define unlikely(x)
Definition: rte_branch_prediction.h:38
RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL
@ RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL
Definition: rte_security.h:337
rte_security_ipsec_tunnel_param::src_addr
struct in6_addr src_addr
Definition: rte_security.h:100
rte_crypto.h
rte_security_set_pkt_metadata
int rte_security_set_pkt_metadata(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_mbuf *mb, void *params)
rte_security_macsec_xform
Definition: rte_security.h:225
RTE_SECURITY_PDCP_SN_SIZE_12
@ RTE_SECURITY_PDCP_SN_SIZE_12
Definition: rte_security.h:251
rte_security_ipsec_sa_direction
rte_security_ipsec_sa_direction
Definition: rte_security.h:187
rte_security_pdcp_sn_size
rte_security_pdcp_sn_size
Definition: rte_security.h:245
rte_security_capability::ipsec
struct rte_security_capability::@315::@317 ipsec
rte_security_pdcp_xform::pkt_dir
enum rte_security_pdcp_direction pkt_dir
Definition: rte_security.h:277
rte_security_ipsec_tunnel_param
Definition: rte_security.h:81
rte_security_ipsec_sa_options
Definition: rte_security.h:118
RTE_SECURITY_PDCP_MODE_CONTROL
@ RTE_SECURITY_PDCP_MODE_CONTROL
Definition: rte_security.h:234
rte_security_ipsec_xform::mode
enum rte_security_ipsec_sa_mode mode
Definition: rte_security.h:210
rte_security_ctx
Definition: rte_security.h:67
rte_security_capability::docsis
struct rte_security_capability::@315::@320 docsis
RTE_SECURITY_IPSEC_SA_MODE_TUNNEL
@ RTE_SECURITY_IPSEC_SA_MODE_TUNNEL
Definition: rte_security.h:38
rte_security_get_userdata
__rte_experimental void * rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md)
rte_security_session_destroy
int rte_security_session_destroy(struct rte_security_ctx *instance, struct rte_security_session *sess)
rte_security_session_update
__rte_experimental int rte_security_session_update(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_security_session_conf *conf)
rte_security_capability::pdcp
struct rte_security_capability::@315::@319 pdcp
RTE_SECURITY_IPSEC_SA_PROTO_AH
@ RTE_SECURITY_IPSEC_SA_PROTO_AH
Definition: rte_security.h:44
rte_security_dynfield
static __rte_experimental rte_security_dynfield_t * rte_security_dynfield(struct rte_mbuf *mbuf)
Definition: rte_security.h:475
rte_security_session_conf::crypto_xform
struct rte_crypto_sym_xform * crypto_xform
Definition: rte_security.h:379
rte_security_ipsec_tunnel_param::ttl
uint8_t ttl
Definition: rte_security.h:95
rte_mbuf
Definition: rte_mbuf_core.h:473
RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO
@ RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO
Definition: rte_security.h:333
rte_security_pdcp_xform::en_ordering
uint8_t en_ordering
Definition: rte_security.h:268
rte_security_session_conf::userdata
void * userdata
Definition: rte_security.h:381
rte_security_ipsec_sa_mode
rte_security_ipsec_sa_mode
Definition: rte_security.h:35
rte_security_ipsec_xform::spi
uint32_t spi
Definition: rte_security.h:200
rte_security_pdcp_xform::hfn_ovrd
uint8_t hfn_ovrd
Definition: rte_security.h:294
rte_crypto_op
Definition: rte_crypto.h:78
rte_security_dynfield_offset
int rte_security_dynfield_offset
rte_security_ipsec_sa_options::copy_df
uint32_t copy_df
Definition: rte_security.h:157
RTE_SECURITY_DOCSIS_UPLINK
@ RTE_SECURITY_DOCSIS_UPLINK
Definition: rte_security.h:307
rte_mbuf_dyn.h
rte_security_ipsec_tunnel_type
rte_security_ipsec_tunnel_type
Definition: rte_security.h:51
RTE_SECURITY_IPSEC_TUNNEL_IPV4
@ RTE_SECURITY_IPSEC_TUNNEL_IPV4
Definition: rte_security.h:52
rte_security_ipsec_sa_options::udp_encap
uint32_t udp_encap
Definition: rte_security.h:132
rte_security_capability::capa_flags
uint32_t capa_flags
Definition: rte_security.h:672
rte_security_ipsec_tunnel_param::src_ip
struct in_addr src_ip
Definition: rte_security.h:87
rte_security_ipsec_xform::salt
uint32_t salt
Definition: rte_security.h:202
rte_security_session_create
struct rte_security_session * rte_security_session_create(struct rte_security_ctx *instance, struct rte_security_session_conf *conf, struct rte_mempool *mp, struct rte_mempool *priv_mp)
rte_security_session_conf::action_type
enum rte_security_session_action_type action_type
Definition: rte_security.h:367
rte_security_capability::crypto_capabilities
const struct rte_cryptodev_capabilities * crypto_capabilities
Definition: rte_security.h:683
rte_security_pdcp_xform::sn_size
enum rte_security_pdcp_sn_size sn_size
Definition: rte_security.h:279
rte_security_capability::action
enum rte_security_session_action_type action
Definition: rte_security.h:643
__rte_security_attach_session
static int __rte_security_attach_session(struct rte_crypto_sym_op *sym_op, struct rte_security_session *sess)
Definition: rte_security.h:542
rte_crypto_op::sym
struct rte_crypto_sym_op sym[0]
Definition: rte_crypto.h:118
rte_security_ipsec_sa_options::copy_flabel
uint32_t copy_flabel
Definition: rte_security.h:149
rte_security_ops
Definition: rte_security_driver.h:139
rte_security_ctx::sess_cnt
uint16_t sess_cnt
Definition: rte_security.h:72
rte_security_capability::options
struct rte_security_ipsec_sa_options options
Definition: rte_security.h:656
rte_security_capability_idx
Definition: rte_security.h:724
RTE_SECURITY_PDCP_UPLINK
@ RTE_SECURITY_PDCP_UPLINK
Definition: rte_security.h:240
rte_security_ipsec_sa_options::ecn
uint32_t ecn
Definition: rte_security.h:175
RTE_SECURITY_PDCP_SN_SIZE_18
@ RTE_SECURITY_PDCP_SN_SIZE_18
Definition: rte_security.h:255
rte_security_ipsec_xform::esn_soft_limit
uint64_t esn_soft_limit
Definition: rte_security.h:214
rte_security_pdcp_xform::reserved
uint16_t reserved
Definition: rte_security.h:302
rte_crypto_sym_op::sec_session
struct rte_security_session * sec_session
Definition: rte_crypto_sym.h:601
rte_security_session_stats_get
__rte_experimental int rte_security_session_stats_get(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_security_stats *stats)
RTE_SECURITY_PDCP_DOWNLINK
@ RTE_SECURITY_PDCP_DOWNLINK
Definition: rte_security.h:241
rte_security_ipsec_sa_options::esn
uint32_t esn
Definition: rte_security.h:124
rte_security_capability::macsec
struct rte_security_capability::@315::@318 macsec
rte_common.h
rte_security_ipsec_tunnel_param::dscp
uint8_t dscp
Definition: rte_security.h:91
RTE_SECURITY_PROTOCOL_MACSEC
@ RTE_SECURITY_PROTOCOL_MACSEC
Definition: rte_security.h:355
RTE_SECURITY_PDCP_SN_SIZE_15
@ RTE_SECURITY_PDCP_SN_SIZE_15
Definition: rte_security.h:253
rte_security_ipsec_tunnel_param::ipv6
struct rte_security_ipsec_tunnel_param::@307::@310 ipv6
rte_security_session_conf::protocol
enum rte_security_session_protocol protocol
Definition: rte_security.h:369
rte_security_capability::mode
enum rte_security_ipsec_sa_mode mode
Definition: rte_security.h:652
rte_security_docsis_direction
rte_security_docsis_direction
Definition: rte_security.h:306
rte_security_ipsec_tunnel_param::type
enum rte_security_ipsec_tunnel_type type
Definition: rte_security.h:82
RTE_SECURITY_IPSEC_TUNNEL_IPV6
@ RTE_SECURITY_IPSEC_TUNNEL_IPV6
Definition: rte_security.h:54
rte_security_ipsec_xform::direction
enum rte_security_ipsec_sa_direction direction
Definition: rte_security.h:206
rte_security_dynfield_is_registered
static __rte_experimental bool rte_security_dynfield_is_registered(void)
Definition: rte_security.h:491
rte_crypto_sym_xform
Definition: rte_crypto_sym.h:543
rte_mempool
Definition: rte_mempool.h:207
rte_security_docsis_xform
Definition: rte_security.h:322
rte_security_capability::domain
enum rte_security_pdcp_domain domain
Definition: rte_security.h:670
rte_security_pdcp_xform
Definition: rte_security.h:263
rte_security_ipsec_xform::options
struct rte_security_ipsec_sa_options options
Definition: rte_security.h:204
RTE_CRYPTO_OP_TYPE_SYMMETRIC
@ RTE_CRYPTO_OP_TYPE_SYMMETRIC
Definition: rte_crypto.h:32
rte_security_ipsec_xform::replay_win_sz
uint32_t replay_win_sz
Definition: rte_security.h:216
RTE_STD_C11
#define RTE_STD_C11
Definition: rte_common.h:40
RTE_SECURITY_PDCP_SN_SIZE_5
@ RTE_SECURITY_PDCP_SN_SIZE_5
Definition: rte_security.h:247
rte_security_docsis_xform::direction
enum rte_security_docsis_direction direction
Definition: rte_security.h:323
rte_security_capability::protocol
enum rte_security_session_protocol protocol
Definition: rte_security.h:645
rte_mempool.h
RTE_SECURITY_PROTOCOL_IPSEC
@ RTE_SECURITY_PROTOCOL_IPSEC
Definition: rte_security.h:353
rte_crypto_op::sess_type
uint8_t sess_type
Definition: rte_crypto.h:94
rte_security_ipsec_tunnel_param::flabel
uint32_t flabel
Definition: rte_security.h:106
RTE_SECURITY_IPSEC_SA_PROTO_ESP
@ RTE_SECURITY_IPSEC_SA_PROTO_ESP
Definition: rte_security.h:46
RTE_MBUF_DYNFIELD
#define RTE_MBUF_DYNFIELD(m, offset, type)
Definition: rte_mbuf_dyn.h:226
rte_security_pdcp_xform::domain
enum rte_security_pdcp_domain domain
Definition: rte_security.h:275
rte_mbuf.h
RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL
@ RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL
Definition: rte_security.h:341
RTE_SECURITY_PDCP_MODE_DATA
@ RTE_SECURITY_PDCP_MODE_DATA
Definition: rte_security.h:235
rte_security_ctx::ops
const struct rte_security_ops * ops
Definition: rte_security.h:70
rte_security_ipsec_xform::proto
enum rte_security_ipsec_sa_protocol proto
Definition: rte_security.h:208
rte_security_ipsec_tunnel_param::dst_addr
struct in6_addr dst_addr
Definition: rte_security.h:102
rte_security_dynfield_t
uint64_t rte_security_dynfield_t
Definition: rte_security.h:456
rte_security_ipsec_xform::tunnel
struct rte_security_ipsec_tunnel_param tunnel
Definition: rte_security.h:212
rte_security_ipsec_tunnel_param::ipv4
struct rte_security_ipsec_tunnel_param::@307::@309 ipv4
rte_crypto_op::type
uint8_t type
Definition: rte_crypto.h:84
rte_security_session_conf
Definition: rte_security.h:366
RTE_SECURITY_PDCP_SN_SIZE_7
@ RTE_SECURITY_PDCP_SN_SIZE_7
Definition: rte_security.h:249
RTE_SECURITY_PROTOCOL_DOCSIS
@ RTE_SECURITY_PROTOCOL_DOCSIS
Definition: rte_security.h:359
rte_security_capability::direction
enum rte_security_ipsec_sa_direction direction
Definition: rte_security.h:654
rte_security_pdcp_xform::hfn_threshold
uint32_t hfn_threshold
Definition: rte_security.h:285
rte_security_pdcp_xform::remove_duplicates
uint8_t remove_duplicates
Definition: rte_security.h:273
rte_security_capability::proto
enum rte_security_ipsec_sa_protocol proto
Definition: rte_security.h:650
rte_security_ipsec_sa_protocol
rte_security_ipsec_sa_protocol
Definition: rte_security.h:43
rte_security_pdcp_domain
rte_security_pdcp_domain
Definition: rte_security.h:233
rte_security_ipsec_tunnel_param::df
uint8_t df
Definition: rte_security.h:93
rte_crypto_sym_op
Definition: rte_crypto_sym.h:591
rte_security_capability_get
const struct rte_security_capability * rte_security_capability_get(struct rte_security_ctx *instance, struct rte_security_capability_idx *idx)
rte_security_session_get_size
unsigned int rte_security_session_get_size(struct rte_security_ctx *instance)
rte_security_ipsec_xform
Definition: rte_security.h:199
RTE_SECURITY_ACTION_TYPE_NONE
@ RTE_SECURITY_ACTION_TYPE_NONE
Definition: rte_security.h:331
RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT
@ RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT
Definition: rte_security.h:36
rte_security_attach_session
static int rte_security_attach_session(struct rte_crypto_op *op, struct rte_security_session *sess)
Definition: rte_security.h:573
rte_security_ipsec_tunnel_param::dst_ip
struct in_addr dst_ip
Definition: rte_security.h:89