| 165bb658 | 10-Oct-2023 |
Anoob Joseph <anoobj@marvell.com> |
security: add fallback security processing and Rx inject
Add alternate datapath API for security processing which would do Rx
injection (similar to loopback) after successful security processing.
W
security: add fallback security processing and Rx inject
Add alternate datapath API for security processing which would do Rx
injection (similar to loopback) after successful security processing.
With inline protocol offload, variable part of the session context
(AR windows, lifetime etc in case of IPsec), is not accessible to the
application. If packets are not getting processed in the inline path
due to non security reasons (such as outer fragmentation or rte_flow
packet steering limitations), then the packet cannot be security
processed as the session context is private to the PMD and security
library doesn't provide alternate APIs to make use of the same session.
Introduce new API and Rx injection as fallback mechanism to security
processing failures due to non-security reasons. For example, when there
is outer fragmentation and PMD doesn't support reassembly of outer
fragments, application would receive fragments which it can then
reassemble. Post successful reassembly, packet can be submitted for
security processing and Rx inject. The packets can be then received in
the application as normal inline protocol processed packets.
Same API can be leveraged in lookaside protocol offload mode to inject
packet to Rx. This would help in using rte_flow based packet parsing
after security processing. For example, with IPsec, this will help in
flow splitting after IPsec processing is done.
In both inline protocol capable ethdevs and lookaside protocol capable
cryptodevs, the packet would be received back in eth port & queue based
on rte_flow rules and packet parsing after security processing. The API
would behave like a loopback but with the additional security
processing.
Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Signed-off-by: Vidya Sagar Velumuri <vvelumuri@marvell.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>
show more ...
|
| 1447ec84 | 03-Oct-2023 |
Vidya Sagar Velumuri <vvelumuri@marvell.com> |
security: support TLS record lifetime notification
Supported TLS record lifetime notification. TLS record sessions may need
to be renegotiated after a specific number of records are processed.
For d
security: support TLS record lifetime notification
Supported TLS record lifetime notification. TLS record sessions may need
to be renegotiated after a specific number of records are processed.
For devices that are capable of tracking lifetime, application may request
to do so by configuring the lifetime parameters in session. Upon soft
expiry, PMD will set the notification in `rte_crypto_op.aux_flags` field.
Hard expiry of the session would mean any subsequent crypto
operation would fail.
Extended `rte_crypto_op.aux_flags` to support all sessions that may have a
lifetime notification and include TLS record lifetime under the same.
Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Signed-off-by: Vidya Sagar Velumuri <vvelumuri@marvell.com>
Acked-by: Harry van Haaren <harry.van.haaren@intel.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>
show more ...
|
| f495824b | 03-Oct-2023 |
Anoob Joseph <anoobj@marvell.com> |
security: support extra padding with TLS
In TLS record write protocol (encrypt), application may request for
extra padding in addition to the default padding which ensures that
crypto payload is ali
security: support extra padding with TLS
In TLS record write protocol (encrypt), application may request for
extra padding in addition to the default padding which ensures that
crypto payload is aligned to block size. This is required to hide
the size of the traffic from an observer.
Extend the usage of ``rte_crypto_op.aux_flags`` to allow users to
provide extra padding in units of 8B. It is an optional feature and any
device that supports the same can declare so by making use of
corresponding capability.
Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Signed-off-by: Vidya Sagar Velumuri <vvelumuri@marvell.com>
Acked-by: Harry van Haaren <harry.van.haaren@intel.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>
show more ...
|
| 40e37a2b | 08-Jun-2023 |
Akhil Goyal <gakhil@marvell.com> |
security: add MACsec packet number threshold
Added Packet number threshold parameter in MACsec SC
configuration to identify the maximum allowed threshold
for packet number field in the packet.
A fie
security: add MACsec packet number threshold
Added Packet number threshold parameter in MACsec SC
configuration to identify the maximum allowed threshold
for packet number field in the packet.
A field is_xpn is also added to identify if the SAs are
configured for extended packet number or not so that
packet number threshold can be configured accordingly.
Signed-off-by: Akhil Goyal <gakhil@marvell.com>
show more ...
|