rte_security.h

Go to the documentation of this file.

/* SPDX-License-Identifier: BSD-3-Clause
 * Copyright 2017 NXP.
 * Copyright(c) 2017 Intel Corporation.
 */

#ifndef _RTE_SECURITY_H_
#define _RTE_SECURITY_H_

#ifdef __cplusplus
extern "C" {
#endif

#include <sys/types.h>

#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>

#include <rte_compat.h>
#include <rte_common.h>
#include <rte_crypto.h>
#include <rte_mbuf.h>
#include <rte_memory.h>
#include <rte_mempool.h>

enum rte_security_ipsec_sa_mode {
        RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT = 1,
        RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
};

enum rte_security_ipsec_sa_protocol {
        RTE_SECURITY_IPSEC_SA_PROTO_AH = 1,
        RTE_SECURITY_IPSEC_SA_PROTO_ESP,
};

enum rte_security_ipsec_tunnel_type {
        RTE_SECURITY_IPSEC_TUNNEL_IPV4 = 1,
        RTE_SECURITY_IPSEC_TUNNEL_IPV6,
};

struct rte_security_ctx {
        void *device;
        const struct rte_security_ops *ops;
        uint16_t sess_cnt;
};

struct rte_security_ipsec_tunnel_param {
        enum rte_security_ipsec_tunnel_type type;
        RTE_STD_C11
        union {
                struct {
                        struct in_addr src_ip;
                        struct in_addr dst_ip;
                        uint8_t dscp;
                        uint8_t df;
                        uint8_t ttl;
                } ipv4;
                struct {
                        struct in6_addr src_addr;
                        struct in6_addr dst_addr;
                        uint8_t dscp;
                        uint32_t flabel;
                        uint8_t hlimit;
                } ipv6;
        };
};

struct rte_security_ipsec_sa_options {
        uint32_t esn : 1;

        uint32_t udp_encap : 1;

        uint32_t copy_dscp : 1;

        uint32_t copy_flabel : 1;

        uint32_t copy_df : 1;

        uint32_t dec_ttl : 1;
};

enum rte_security_ipsec_sa_direction {
        RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
        RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
};

struct rte_security_ipsec_xform {
        uint32_t spi;
        uint32_t salt;
        struct rte_security_ipsec_sa_options options;
        enum rte_security_ipsec_sa_direction direction;
        enum rte_security_ipsec_sa_protocol proto;
        enum rte_security_ipsec_sa_mode mode;
        struct rte_security_ipsec_tunnel_param tunnel;
        uint64_t esn_soft_limit;
};

struct rte_security_macsec_xform {
        int dummy;
};

enum rte_security_pdcp_domain {
        RTE_SECURITY_PDCP_MODE_CONTROL, 
        RTE_SECURITY_PDCP_MODE_DATA,    
};

enum rte_security_pdcp_direction {
        RTE_SECURITY_PDCP_UPLINK,       
        RTE_SECURITY_PDCP_DOWNLINK,     
};

enum rte_security_pdcp_sn_size {
        RTE_SECURITY_PDCP_SN_SIZE_5 = 5,
        RTE_SECURITY_PDCP_SN_SIZE_7 = 7,
        RTE_SECURITY_PDCP_SN_SIZE_12 = 12,
        RTE_SECURITY_PDCP_SN_SIZE_15 = 15,
        RTE_SECURITY_PDCP_SN_SIZE_18 = 18
};

struct rte_security_pdcp_xform {
        int8_t bearer;  
        uint8_t en_ordering;
        uint8_t remove_duplicates;
        enum rte_security_pdcp_domain domain;
        enum rte_security_pdcp_direction pkt_dir;
        enum rte_security_pdcp_sn_size sn_size;
        uint32_t hfn;
        uint32_t hfn_threshold;
};

enum rte_security_session_action_type {
        RTE_SECURITY_ACTION_TYPE_NONE,
        RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,
        RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
        RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL
};

enum rte_security_session_protocol {
        RTE_SECURITY_PROTOCOL_IPSEC = 1,
        RTE_SECURITY_PROTOCOL_MACSEC,
        RTE_SECURITY_PROTOCOL_PDCP,
};

struct rte_security_session_conf {
        enum rte_security_session_action_type action_type;
        enum rte_security_session_protocol protocol;
        RTE_STD_C11
        union {
                struct rte_security_ipsec_xform ipsec;
                struct rte_security_macsec_xform macsec;
                struct rte_security_pdcp_xform pdcp;
        };
        struct rte_crypto_sym_xform *crypto_xform;
        void *userdata;
};

struct rte_security_session {
        void *sess_private_data;
        uint64_t opaque_data;
};

struct rte_security_session *
rte_security_session_create(struct rte_security_ctx *instance,
                            struct rte_security_session_conf *conf,
                            struct rte_mempool *mp);

int __rte_experimental
rte_security_session_update(struct rte_security_ctx *instance,
                            struct rte_security_session *sess,
                            struct rte_security_session_conf *conf);

unsigned int
rte_security_session_get_size(struct rte_security_ctx *instance);

int
rte_security_session_destroy(struct rte_security_ctx *instance,
                             struct rte_security_session *sess);

int
rte_security_set_pkt_metadata(struct rte_security_ctx *instance,
                              struct rte_security_session *sess,
                              struct rte_mbuf *mb, void *params);

void * __rte_experimental
rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md);

static inline int
__rte_security_attach_session(struct rte_crypto_sym_op *sym_op,
                              struct rte_security_session *sess)
{
        sym_op->sec_session = sess;

        return 0;
}

static inline void *
get_sec_session_private_data(const struct rte_security_session *sess)
{
        return sess->sess_private_data;
}

static inline void
set_sec_session_private_data(struct rte_security_session *sess,
                             void *private_data)
{
        sess->sess_private_data = private_data;
}

static inline int
rte_security_attach_session(struct rte_crypto_op *op,
                            struct rte_security_session *sess)
{
        if (unlikely(op->type != RTE_CRYPTO_OP_TYPE_SYMMETRIC))
                return -EINVAL;

        op->sess_type =  RTE_CRYPTO_OP_SECURITY_SESSION;

        return __rte_security_attach_session(op->sym, sess);
}

struct rte_security_macsec_stats {
        uint64_t reserved;
};

struct rte_security_ipsec_stats {
        uint64_t reserved;

};

struct rte_security_pdcp_stats {
        uint64_t reserved;
};

struct rte_security_stats {
        enum rte_security_session_protocol protocol;
        RTE_STD_C11
        union {
                struct rte_security_macsec_stats macsec;
                struct rte_security_ipsec_stats ipsec;
                struct rte_security_pdcp_stats pdcp;
        };
};

int __rte_experimental
rte_security_session_stats_get(struct rte_security_ctx *instance,
                               struct rte_security_session *sess,
                               struct rte_security_stats *stats);

struct rte_security_capability {
        enum rte_security_session_action_type action;
        enum rte_security_session_protocol protocol;
        RTE_STD_C11
        union {
                struct {
                        enum rte_security_ipsec_sa_protocol proto;
                        enum rte_security_ipsec_sa_mode mode;
                        enum rte_security_ipsec_sa_direction direction;
                        struct rte_security_ipsec_sa_options options;
                } ipsec;
                struct {
                        /* To be Filled */
                        int dummy;
                } macsec;
                struct {
                        enum rte_security_pdcp_domain domain;
                        uint32_t capa_flags;
                } pdcp;
        };

        const struct rte_cryptodev_capabilities *crypto_capabilities;
        uint32_t ol_flags;
};

#define RTE_SECURITY_PDCP_ORDERING_CAP          0x00000001

#define RTE_SECURITY_PDCP_DUP_DETECT_CAP        0x00000002

#define RTE_SECURITY_TX_OLOAD_NEED_MDATA        0x00000001

#define RTE_SECURITY_TX_HW_TRAILER_OFFLOAD      0x00000002

#define RTE_SECURITY_RX_HW_TRAILER_OFFLOAD      0x00010000

struct rte_security_capability_idx {
        enum rte_security_session_action_type action;
        enum rte_security_session_protocol protocol;

        RTE_STD_C11
        union {
                struct {
                        enum rte_security_ipsec_sa_protocol proto;
                        enum rte_security_ipsec_sa_mode mode;
                        enum rte_security_ipsec_sa_direction direction;
                } ipsec;
                struct {
                        enum rte_security_pdcp_domain domain;
                        uint32_t capa_flags;
                } pdcp;
        };
};

const struct rte_security_capability *
rte_security_capabilities_get(struct rte_security_ctx *instance);

const struct rte_security_capability *
rte_security_capability_get(struct rte_security_ctx *instance,
                            struct rte_security_capability_idx *idx);

#ifdef __cplusplus
}
#endif

#endif /* _RTE_SECURITY_H_ */