Hey Akhil, I like the proposal of allowing the rte_secruity API to be
supported on both NIC and crypto devices as I think it allows us to
cover all the protocol offload scenarios in a consist manner.
The main concern I have is in regards to the device identification in a
consistent manner between device types, and I'm not exactly clear from
your description below on how you want to do that, as the dev_id and
port_id can overlap.
If we follow this model, I think it would a good time to introduce a
sudo UUID into each device in DPDK, not necessarily a 16 byte UUID but I
think a unit16_t or uint32_t would be more than sufficient for DPDK
needs. As we now have a common rte_device structure in all device types,
we can add the UUID here, and then allow common APIs like this to use
the UUID as the key. We could also then support some generic device APIs
such as:
uuid_t rte_device_get_uuid_by_name(char *dev_name);
uuid_t rte_ethdev_get_port_uuid(uint8_t pid);
uuid_t rte_cryptodev_get_device_uuid(uint8_t pid);
Which will allow easy retrieval handle to use in the rte_security APIs.
Also I don't know if we need all the semantic of the cryptodev API in
regards the way sessions are managed as I these security sessions are
implicitly linked to hardware there isn't any need to support moving
session between devices?
int rte_security_configure(uuid_t uuid, struct rte_mempool *mempool);
struct rte_security_session *sess
rte_security_session_create(uuid_t uuid,
struct rte_security_sess_conf *conf);
On 25/07/2017 12:21 PM, Akhil Goyal wrote:
Below is a counter proposal for the RFC sent by Boris.
If we find some consensus, we can have implementation for this proposal in a
few weeks.
The proposal is largely inline with the thoughts from Declan with a few
exceptions.
Here we are proposing a security framework which can be used both by crypto
drivers
and the hw offloaded NIC to showcase the protocol offload support as well as
inline
ipsec in hw offloaded NIC.
The placement of the rte_security.X can either be a separate library like
lib/librte_security/ or it can be taken as an extension to the
lib/librte_cryptodev/.
The reason for placing this in the cryptodev is that we are referring to some
crypto enums and the APIs look similar to that of cryptodev.
Here we propose that the application may be able to configure either NIC or
crypto PMD to perform IPSec and other security operations.
This is configured using the API
int
rte_security_configure(uint16_t dev_id, char *dev_name);
This API take dev_id and dev_name to identify which device needs to perform
security
operation. Once the device is enabled for Security operations, the application
can
create and initialize the session for the enabled device.
struct rte_security_session *
rte_security_session_create(struct rte_mempool *mempool);
int
rte_security_session_init(uint16_t dev_id, char *dev_name,
struct rte_security_session *sess,
struct rte_security_sess_conf *conf,
struct rte_mempool *mempool);
These two APIs are similar to the rte_cryptodev_sym_session_create and
rte_cryptodev_sym_session_init respectively, except that
rte_security_session_init
takes device name also to identify between the NIC(IPSEC inline or full offload)
or crypto(look aside protocol offload).
These sessions can be cleared and freed with the APIs
int
rte_security_session_clear(uint8_t dev_id, char *dev_name,
struct rte_security_session *sess);
int
rte_security_session_free(struct rte_security_session *sess);
The details for various structures used are mentioned in the below patch.
These are very similar to what Declan proposed with a few additions.
This can be updated further for other security protocols like MACSec and DTLS
Now, after the application configures the session using above APIs, it needs to
attach the session with the crypto_op in case the session is configured for
crypto look aside protocol offload. For IPSec inline/ full protocol offload
using NIC, the mbuf ol_flags can be set as per the RFC suggested by Boris.
Configuration path for both crypto and NIC can be illustrated as below
Configuration Path Configuration Path
for NIC for Crypto
| |
+--------|--------+ +--------|--------+
| Add/Remove | | Add/Remove |
| IPsec SA | | IPSec SA |
| | | | | |
|--------|--------| +--------|--------+
| |
+--------V--------+ |
| Flow API | |
+--------|--------+ |
| |
+--------V--------+ +--------V--------+
| | | |
| NIC PMD | | Crypto PMD |
| | | |
+--------|--------+ +--------|--------+
| |
+--------|--------+ +--------|--------+
| HW ACCELERATED | | HW Crypto |
| NIC | | Protocol Aware |
| | | Device |
+--------|--------+ +--------|--------+
Now the application(ipsec-secgw) have 4 paths to decide for the data path.
1. Non-protocol offload (currently implemented)
2. IPSec inline(only crypto operations using NIC)
3. full protocol offload(crypto operations along with all the IPsec header
and trailer processing using NIC)
4. look aside protocol offload(single-pass encryption and authentication with
additional levels of protocol processing offload using crypto device)
The application can decide using the below action types
enum rte_security_session_action_type {
RTE_SECURITY_SESS_ETH_INLINE_CRYPTO,
/**< Crypto operations are performed by Network interface */
RTE_SECURITY_SESS_ETH_PROTO_OFFLOAD,
/**< Crypto operations with protocol support are performed
* by Network/ethernet device.
*/
RTE_SECURITY_SESS_CRYPTO_PROTO_OFFLOAD,
/**< Crypto operations with protocol support are performed
* by Crypto device.
*/
RTE_SECURITY_SESS_NONE
/**< Non protocol offload. Application need to manage everything */
};
Egress Data Path
For ETH_INLINE_CRYPTO For CRYPTO_PROTO_OFFLOAD
| |
+--------|--------+ +-----------|-----------+
| egress IPsec | | Plain packet from NIC |
| | | | | |
| +------V------+ | | +--------V--------+ |
| | SABD lookup | | | | SA lookup | |
| +------|------+ | | +--------|--------+ |
| +------V------+ | | +--------V--------+ |
| | Tunnel | | | | session attach | |
| +------|------+ | | +--------|--------+ |
+------------+
| +------V------+ | | +--------V--------+ | | Hw crypto
|
| | ESP | | | |Enqueue to crypto|------> Device |
<--- Headers are added by the HW device.
| | | | | | Device | | |
|
| +------|------+ | | +-----------------+ |
+-----|------+
+--------V--------+ | +-----------------+ | |
| | | Dequeue from |<-----------+
+--------V--------+ | | Crypto Device | |
| L2 Stack | | +--------|--------+ |
+--------|--------+ | +--------V--------+ |
| | | L2 Stack | |
+--------V--------+ | +--------|--------+ |
| | +-----------|-----------+
| NIC PMD | |
| | +-----------V-----------+
+--------|--------+ | NIC PMD |
| | (packet sent out) |
+--------|--------+ +-----------|-----------+
| HW ACCELERATED |
| NIC |
| |
+--------|--------+
Ingress Data Path
For ETH_INLINE_CRYPTO For CRYPTO_PROTO_OFFLOAD
| |
+--------|--------+ +-----------|-----------+
| Ingress ipsec | | Encap packet from NIC |
| | | | | |
| +------V------+ | | +--------V--------+ |
| | HW ACC NIC | | | | SA lookup | |
| +------|------+ | | +--------|--------+ |
| +------V------+ | | +--------V--------+ |
| |validate ESP | | | | session attach | |
| +------|------+ | | +--------|--------+ |
+------------+
| +------V------+ | | +--------V--------+ | | Hw crypto
|
| |Remove ESP | | | |Enqueue to crypto|------> Device |
<--- Headers are removed by the HW device.
| | and Tunnel | | | | Device | | |
|
| +------|------+ | | +-----------------+ |
+-----|------+
+--------V--------+ | +-----------------+ | |
| | | Dequeue from |<-----------+
+--------V----------+ | | Crypto Device | |
|Plain packet to App| | +--------|--------+ |
+--------|----------+ | +--------V--------+ |
| |Plain packet to | |
| | app | |
| +-----------------+ |
+-----------------------+
Akhil Goyal (1):
RFC: rte_security: proposal
lib/librte_security/rte_security.h | 405 +++++++++++++++++++++++++++++++++++++
1 file changed, 405 insertions(+)
create mode 100644 lib/librte_security/rte_security.h
