xref: /dpdk/lib/security/rte_security.h (revision 515cd4a488b6a0c6e40d20e6b10d8e89657dc23f)
1 /* SPDX-License-Identifier: BSD-3-Clause
2  * Copyright 2017,2019-2020 NXP
3  * Copyright(c) 2017-2020 Intel Corporation.
4  */
5 
6 #ifndef _RTE_SECURITY_H_
7 #define _RTE_SECURITY_H_
8 
9 /**
10  * @file rte_security.h
11  *
12  * RTE Security Common Definitions
13  *
14  */
15 
16 #ifdef __cplusplus
17 extern "C" {
18 #endif
19 
20 #include <sys/types.h>
21 
22 #include <rte_compat.h>
23 #include <rte_common.h>
24 #include <rte_crypto.h>
25 #include <rte_ip.h>
26 #include <rte_mbuf_dyn.h>
27 
28 /** IPSec protocol mode */
29 enum rte_security_ipsec_sa_mode {
30 	RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT = 1,
31 	/**< IPSec Transport mode */
32 	RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
33 	/**< IPSec Tunnel mode */
34 };
35 
36 /** IPSec Protocol */
37 enum rte_security_ipsec_sa_protocol {
38 	RTE_SECURITY_IPSEC_SA_PROTO_AH = 1,
39 	/**< AH protocol */
40 	RTE_SECURITY_IPSEC_SA_PROTO_ESP,
41 	/**< ESP protocol */
42 };
43 
44 /** IPSEC tunnel type */
45 enum rte_security_ipsec_tunnel_type {
46 	RTE_SECURITY_IPSEC_TUNNEL_IPV4 = 1,
47 	/**< Outer header is IPv4 */
48 	RTE_SECURITY_IPSEC_TUNNEL_IPV6,
49 	/**< Outer header is IPv6 */
50 };
51 
52 /**
53  * IPSEC tunnel header verification mode
54  *
55  * Controls how outer IP header is verified in inbound.
56  */
57 #define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR     0x1
58 #define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR 0x2
59 
60 /**
61  * Security context for crypto/eth devices
62  *
63  * Security instance for each driver to register security operations.
64  * The application can get the security context from the crypto/eth device id
65  * using the APIs rte_cryptodev_get_sec_ctx()/rte_eth_dev_get_sec_ctx()
66  * This structure is used to identify the device(crypto/eth) for which the
67  * security operations need to be performed.
68  */
69 struct rte_security_ctx {
70 	void *device;
71 	/**< Crypto/ethernet device attached */
72 	const struct rte_security_ops *ops;
73 	/**< Pointer to security ops for the device */
74 	uint16_t sess_cnt;
75 	/**< Number of sessions attached to this context */
76 	uint16_t macsec_sc_cnt;
77 	/**< Number of MACsec SC attached to this context */
78 	uint16_t macsec_sa_cnt;
79 	/**< Number of MACsec SA attached to this context */
80 	uint32_t flags;
81 	/**< Flags for security context */
82 };
83 
84 #define RTE_SEC_CTX_F_FAST_SET_MDATA 0x00000001
85 /**< Driver uses fast metadata update without using driver specific callback.
86  * For fast mdata, mbuf dynamic field would be registered by driver
87  * via rte_security_dynfield_register().
88  */
89 
90 /**
91  * IPSEC tunnel parameters
92  *
93  * These parameters are used to build outbound tunnel headers.
94  */
95 struct rte_security_ipsec_tunnel_param {
96 	enum rte_security_ipsec_tunnel_type type;
97 	/**< Tunnel type: IPv4 or IPv6 */
98 	RTE_STD_C11
99 	union {
100 		struct {
101 			struct in_addr src_ip;
102 			/**< IPv4 source address */
103 			struct in_addr dst_ip;
104 			/**< IPv4 destination address */
105 			uint8_t dscp;
106 			/**< IPv4 Differentiated Services Code Point */
107 			uint8_t df;
108 			/**< IPv4 Don't Fragment bit */
109 			uint8_t ttl;
110 			/**< IPv4 Time To Live */
111 		} ipv4;
112 		/**< IPv4 header parameters */
113 		struct {
114 			struct in6_addr src_addr;
115 			/**< IPv6 source address */
116 			struct in6_addr dst_addr;
117 			/**< IPv6 destination address */
118 			uint8_t dscp;
119 			/**< IPv6 Differentiated Services Code Point */
120 			uint32_t flabel;
121 			/**< IPv6 flow label */
122 			uint8_t hlimit;
123 			/**< IPv6 hop limit */
124 		} ipv6;
125 		/**< IPv6 header parameters */
126 	};
127 };
128 
129 struct rte_security_ipsec_udp_param {
130 	uint16_t sport;
131 	uint16_t dport;
132 };
133 
134 /**
135  * IPsec Security Association option flags
136  */
137 struct rte_security_ipsec_sa_options {
138 	/** Extended Sequence Numbers (ESN)
139 	 *
140 	 * * 1: Use extended (64 bit) sequence numbers
141 	 * * 0: Use normal sequence numbers
142 	 */
143 	uint32_t esn : 1;
144 
145 	/** UDP encapsulation
146 	 *
147 	 * * 1: Do UDP encapsulation/decapsulation so that IPSEC packets can
148 	 *      traverse through NAT boxes.
149 	 * * 0: No UDP encapsulation
150 	 */
151 	uint32_t udp_encap : 1;
152 
153 	/** Copy DSCP bits
154 	 *
155 	 * * 1: Copy IPv4 or IPv6 DSCP bits from inner IP header to
156 	 *      the outer IP header in encapsulation, and vice versa in
157 	 *      decapsulation.
158 	 * * 0: Do not change DSCP field.
159 	 */
160 	uint32_t copy_dscp : 1;
161 
162 	/** Copy IPv6 Flow Label
163 	 *
164 	 * * 1: Copy IPv6 flow label from inner IPv6 header to the
165 	 *      outer IPv6 header.
166 	 * * 0: Outer header is not modified.
167 	 */
168 	uint32_t copy_flabel : 1;
169 
170 	/** Copy IPv4 Don't Fragment bit
171 	 *
172 	 * * 1: Copy the DF bit from the inner IPv4 header to the outer
173 	 *      IPv4 header.
174 	 * * 0: Outer header is not modified.
175 	 */
176 	uint32_t copy_df : 1;
177 
178 	/** Decrement inner packet Time To Live (TTL) field
179 	 *
180 	 * * 1: In tunnel mode, decrement inner packet IPv4 TTL or
181 	 *      IPv6 Hop Limit after tunnel decapsulation, or before tunnel
182 	 *      encapsulation.
183 	 * * 0: Inner packet is not modified.
184 	 */
185 	uint32_t dec_ttl : 1;
186 
187 	/** Explicit Congestion Notification (ECN)
188 	 *
189 	 * * 1: In tunnel mode, enable outer header ECN Field copied from
190 	 *      inner header in tunnel encapsulation, or inner header ECN
191 	 *      field construction in decapsulation.
192 	 * * 0: Inner/outer header are not modified.
193 	 */
194 	uint32_t ecn : 1;
195 
196 	/** Security statistics
197 	 *
198 	 * * 1: Enable per session security statistics collection for
199 	 *      this SA, if supported by the driver.
200 	 * * 0: Disable per session security statistics collection for this SA.
201 	 */
202 	uint32_t stats : 1;
203 
204 	/** Disable IV generation in PMD
205 	 *
206 	 * * 1: Disable IV generation in PMD. When disabled, IV provided in
207 	 *      rte_crypto_op will be used by the PMD.
208 	 *
209 	 * * 0: Enable IV generation in PMD. When enabled, PMD generated random
210 	 *      value would be used and application is not required to provide
211 	 *      IV.
212 	 *
213 	 * Note: For inline cases, IV generation would always need to be handled
214 	 * by the PMD.
215 	 */
216 	uint32_t iv_gen_disable : 1;
217 
218 	/** Verify tunnel header in inbound
219 	 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR``: Verify destination
220 	 *   IP address.
221 	 *
222 	 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR``: Verify both
223 	 *   source and destination IP addresses.
224 	 */
225 	uint32_t tunnel_hdr_verify : 2;
226 
227 	/** Verify UDP encapsulation ports in inbound
228 	 *
229 	 * * 1: Match UDP source and destination ports
230 	 * * 0: Do not match UDP ports
231 	 */
232 	uint32_t udp_ports_verify : 1;
233 
234 	/** Compute/verify inner packet IPv4 header checksum in tunnel mode
235 	 *
236 	 * * 1: For outbound, compute inner packet IPv4 header checksum
237 	 *      before tunnel encapsulation and for inbound, verify after
238 	 *      tunnel decapsulation.
239 	 * * 0: Inner packet IP header checksum is not computed/verified.
240 	 *
241 	 * The checksum verification status would be set in mbuf using
242 	 * RTE_MBUF_F_RX_IP_CKSUM_xxx flags.
243 	 *
244 	 * Inner IP checksum computation can also be enabled(per operation)
245 	 * by setting the flag RTE_MBUF_F_TX_IP_CKSUM in mbuf.
246 	 */
247 	uint32_t ip_csum_enable : 1;
248 
249 	/** Compute/verify inner packet L4 checksum in tunnel mode
250 	 *
251 	 * * 1: For outbound, compute inner packet L4 checksum before
252 	 *      tunnel encapsulation and for inbound, verify after
253 	 *      tunnel decapsulation.
254 	 * * 0: Inner packet L4 checksum is not computed/verified.
255 	 *
256 	 * The checksum verification status would be set in mbuf using
257 	 * RTE_MBUF_F_RX_L4_CKSUM_xxx flags.
258 	 *
259 	 * Inner L4 checksum computation can also be enabled(per operation)
260 	 * by setting the flags RTE_MBUF_F_TX_TCP_CKSUM or RTE_MBUF_F_TX_SCTP_CKSUM or
261 	 * RTE_MBUF_F_TX_UDP_CKSUM or RTE_MBUF_F_TX_L4_MASK in mbuf.
262 	 */
263 	uint32_t l4_csum_enable : 1;
264 
265 	/** Enable IP reassembly on inline inbound packets.
266 	 *
267 	 * * 1: Enable driver to try reassembly of encrypted IP packets for
268 	 *      this SA, if supported by the driver. This feature will work
269 	 *      only if user has successfully set IP reassembly config params
270 	 *      using rte_eth_ip_reassembly_conf_set() for the inline Ethernet
271 	 *      device. PMD need to register mbuf dynamic fields using
272 	 *      rte_eth_ip_reassembly_dynfield_register() and security session
273 	 *      creation would fail if dynfield is not registered successfully.
274 	 * * 0: Disable IP reassembly of packets (default).
275 	 */
276 	uint32_t ip_reassembly_en : 1;
277 
278 	/** Reserved bit fields for future extension
279 	 *
280 	 * User should ensure reserved_opts is cleared as it may change in
281 	 * subsequent releases to support new options.
282 	 *
283 	 * Note: Reduce number of bits in reserved_opts for every new option.
284 	 */
285 	uint32_t reserved_opts : 17;
286 };
287 
288 /** IPSec security association direction */
289 enum rte_security_ipsec_sa_direction {
290 	RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
291 	/**< Encrypt and generate digest */
292 	RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
293 	/**< Verify digest and decrypt */
294 };
295 
296 /**
297  * Configure soft and hard lifetime of an IPsec SA
298  *
299  * Lifetime of an IPsec SA would specify the maximum number of packets or bytes
300  * that can be processed. IPsec operations would start failing once any hard
301  * limit is reached.
302  *
303  * Soft limits can be specified to generate notification when the SA is
304  * approaching hard limits for lifetime. For inline operations, reaching soft
305  * expiry limit would result in raising an eth event for the same. For lookaside
306  * operations, this would result in a warning returned in
307  * ``rte_crypto_op.aux_flags``.
308  */
309 struct rte_security_ipsec_lifetime {
310 	uint64_t packets_soft_limit;
311 	/**< Soft expiry limit in number of packets */
312 	uint64_t bytes_soft_limit;
313 	/**< Soft expiry limit in bytes */
314 	uint64_t packets_hard_limit;
315 	/**< Hard expiry limit in number of packets */
316 	uint64_t bytes_hard_limit;
317 	/**< Hard expiry limit in bytes */
318 };
319 
320 /**
321  * IPsec security association configuration data.
322  *
323  * This structure contains data required to create an IPsec SA security session.
324  */
325 struct rte_security_ipsec_xform {
326 	uint32_t spi;
327 	/**< SA security parameter index */
328 	uint32_t salt;
329 	/**< SA salt */
330 	struct rte_security_ipsec_sa_options options;
331 	/**< various SA options */
332 	enum rte_security_ipsec_sa_direction direction;
333 	/**< IPSec SA Direction - Egress/Ingress */
334 	enum rte_security_ipsec_sa_protocol proto;
335 	/**< IPsec SA Protocol - AH/ESP */
336 	enum rte_security_ipsec_sa_mode mode;
337 	/**< IPsec SA Mode - transport/tunnel */
338 	struct rte_security_ipsec_tunnel_param tunnel;
339 	/**< Tunnel parameters, NULL for transport mode */
340 	struct rte_security_ipsec_lifetime life;
341 	/**< IPsec SA lifetime */
342 	uint32_t replay_win_sz;
343 	/**< Anti replay window size to enable sequence replay attack handling.
344 	 * replay checking is disabled if the window size is 0.
345 	 */
346 	union {
347 		uint64_t value;
348 		struct {
349 			uint32_t low;
350 			uint32_t hi;
351 		};
352 	} esn;
353 	/**< Extended Sequence Number */
354 	struct rte_security_ipsec_udp_param udp;
355 	/**< UDP parameters, ignored when udp_encap option not specified */
356 };
357 
358 /**
359  * MACSec packet flow direction
360  */
361 enum rte_security_macsec_direction {
362 	/** Generate SecTag and encrypt/authenticate */
363 	RTE_SECURITY_MACSEC_DIR_TX,
364 	/** Remove SecTag and decrypt/verify */
365 	RTE_SECURITY_MACSEC_DIR_RX,
366 };
367 
368 /** Maximum number of association numbers for a secure channel. */
369 #define RTE_SECURITY_MACSEC_NUM_AN	4
370 /** Salt length for MACsec SA. */
371 #define RTE_SECURITY_MACSEC_SALT_LEN	12
372 
373 /**
374  * MACsec secure association (SA) configuration structure.
375  */
376 struct rte_security_macsec_sa {
377 	/** Direction of SA */
378 	enum rte_security_macsec_direction dir;
379 	/** MACsec SA key for AES-GCM 128/256 */
380 	struct {
381 		const uint8_t *data;	/**< pointer to key data */
382 		uint16_t length;	/**< key length in bytes */
383 	} key;
384 	/** 96-bit value distributed by key agreement protocol */
385 	uint8_t salt[RTE_SECURITY_MACSEC_SALT_LEN];
386 	/** Association number to be used */
387 	uint8_t an : 2;
388 	/** Short Secure Channel Identifier, to be used for XPN cases */
389 	uint32_t ssci;
390 	/** Extended packet number */
391 	uint32_t xpn;
392 	/** Packet number expected/ to be used for next packet of this SA */
393 	uint32_t next_pn;
394 };
395 
396 /**
397  * MACsec Secure Channel configuration parameters.
398  */
399 struct rte_security_macsec_sc {
400 	/** Direction of SC */
401 	enum rte_security_macsec_direction dir;
402 	union {
403 		struct {
404 			/** SAs for each association number */
405 			uint16_t sa_id[RTE_SECURITY_MACSEC_NUM_AN];
406 			/** flag to denote which all SAs are in use for each association number */
407 			uint8_t sa_in_use[RTE_SECURITY_MACSEC_NUM_AN];
408 			/** Channel is active */
409 			uint8_t active : 1;
410 			/** Reserved bitfields for future */
411 			uint8_t reserved : 7;
412 		} sc_rx;
413 		struct {
414 			uint16_t sa_id; /**< SA ID to be used for encryption */
415 			uint16_t sa_id_rekey; /**< Rekeying SA ID to be used for encryption */
416 			uint64_t sci; /**< SCI value to be used if send_sci is set */
417 			uint8_t active : 1; /**< Channel is active */
418 			uint8_t re_key_en : 1; /**< Enable Rekeying */
419 			/** Reserved bitfields for future */
420 			uint8_t reserved : 6;
421 		} sc_tx;
422 	};
423 };
424 
425 /**
426  * MACsec Supported Algorithm list as per IEEE Std 802.1AE.
427  */
428 enum rte_security_macsec_alg {
429 	RTE_SECURITY_MACSEC_ALG_GCM_128, /**< AES-GCM 128 bit block cipher */
430 	RTE_SECURITY_MACSEC_ALG_GCM_256, /**< AES-GCM 256 bit block cipher */
431 	RTE_SECURITY_MACSEC_ALG_GCM_XPN_128, /**< AES-GCM 128 bit block cipher with unique SSCI */
432 	RTE_SECURITY_MACSEC_ALG_GCM_XPN_256, /**< AES-GCM 256 bit block cipher with unique SSCI */
433 };
434 
435 /** Disable Validation of MACsec frame. */
436 #define RTE_SECURITY_MACSEC_VALIDATE_DISABLE	0
437 /** Validate MACsec frame but do not discard invalid frame. */
438 #define RTE_SECURITY_MACSEC_VALIDATE_NO_DISCARD	1
439 /** Validate MACsec frame and discart invalid frame. */
440 #define RTE_SECURITY_MACSEC_VALIDATE_STRICT	2
441 /** Do not perform any MACsec operation. */
442 #define RTE_SECURITY_MACSEC_VALIDATE_NO_OP	3
443 
444 /**
445  * MACsec security session configuration
446  */
447 struct rte_security_macsec_xform {
448 	/** Direction of flow/secure channel */
449 	enum rte_security_macsec_direction dir;
450 	/** MACsec algorithm to be used */
451 	enum rte_security_macsec_alg alg;
452 	/** Cipher offset from start of Ethernet header */
453 	uint8_t cipher_off;
454 	/**
455 	 * SCI to be used for RX flow identification or
456 	 * to set SCI in packet for TX when send_sci is set
457 	 */
458 	uint64_t sci;
459 	/** Receive/transmit secure channel ID created by *rte_security_macsec_sc_create* */
460 	uint16_t sc_id;
461 	union {
462 		struct {
463 			/** MTU for transmit frame (valid for inline processing) */
464 			uint16_t mtu;
465 			/**
466 			 * Offset to insert sectag from start of ethernet header or
467 			 * from a matching VLAN tag
468 			 */
469 			uint8_t sectag_off;
470 			/** Enable MACsec protection of frames */
471 			uint16_t protect_frames : 1;
472 			/**
473 			 * Sectag insertion mode
474 			 * If 1, Sectag is inserted at fixed sectag_off set above.
475 			 * If 0, Sectag is inserted at relative sectag_off from a matching
476 			 * VLAN tag set.
477 			 */
478 			uint16_t sectag_insert_mode : 1;
479 			/** ICV includes source and destination MAC addresses */
480 			uint16_t icv_include_da_sa : 1;
481 			/** Control port is enabled */
482 			uint16_t ctrl_port_enable : 1;
483 			/** Version of MACsec header. Should be 0 */
484 			uint16_t sectag_version : 1;
485 			/** Enable end station. SCI is not valid */
486 			uint16_t end_station : 1;
487 			/** Send SCI along with sectag */
488 			uint16_t send_sci : 1;
489 			/** enable secure channel support EPON - single copy broadcast */
490 			uint16_t scb : 1;
491 			/**
492 			 * Enable packet encryption and set RTE_MACSEC_TCI_C and
493 			 * RTE_MACSEC_TCI_E in sectag
494 			 */
495 			uint16_t encrypt : 1;
496 			/** Reserved bitfields for future */
497 			uint16_t reserved : 7;
498 		} tx_secy;
499 		struct {
500 			/** Replay Window size to be supported */
501 			uint32_t replay_win_sz;
502 			/** Set bits as per RTE_SECURITY_MACSEC_VALIDATE_* */
503 			uint16_t validate_frames : 2;
504 			/** ICV includes source and destination MAC addresses */
505 			uint16_t icv_include_da_sa : 1;
506 			/** Control port is enabled */
507 			uint16_t ctrl_port_enable : 1;
508 			/** Do not strip SecTAG after processing */
509 			uint16_t preserve_sectag : 1;
510 			/** Do not strip ICV from the packet after processing */
511 			uint16_t preserve_icv : 1;
512 			/** Enable anti-replay protection */
513 			uint16_t replay_protect : 1;
514 			/** Reserved bitfields for future */
515 			uint16_t reserved : 9;
516 		} rx_secy;
517 	};
518 };
519 
520 /**
521  * PDCP Mode of session
522  */
523 enum rte_security_pdcp_domain {
524 	RTE_SECURITY_PDCP_MODE_CONTROL,	/**< PDCP control plane */
525 	RTE_SECURITY_PDCP_MODE_DATA,	/**< PDCP data plane */
526 	RTE_SECURITY_PDCP_MODE_SHORT_MAC,	/**< PDCP short mac */
527 };
528 
529 /** PDCP Frame direction */
530 enum rte_security_pdcp_direction {
531 	RTE_SECURITY_PDCP_UPLINK,	/**< Uplink */
532 	RTE_SECURITY_PDCP_DOWNLINK,	/**< Downlink */
533 };
534 
535 /** PDCP Sequence Number Size selectors */
536 enum rte_security_pdcp_sn_size {
537 	/** PDCP_SN_SIZE_5: 5bit sequence number */
538 	RTE_SECURITY_PDCP_SN_SIZE_5 = 5,
539 	/** PDCP_SN_SIZE_7: 7bit sequence number */
540 	RTE_SECURITY_PDCP_SN_SIZE_7 = 7,
541 	/** PDCP_SN_SIZE_12: 12bit sequence number */
542 	RTE_SECURITY_PDCP_SN_SIZE_12 = 12,
543 	/** PDCP_SN_SIZE_15: 15bit sequence number */
544 	RTE_SECURITY_PDCP_SN_SIZE_15 = 15,
545 	/** PDCP_SN_SIZE_18: 18bit sequence number */
546 	RTE_SECURITY_PDCP_SN_SIZE_18 = 18
547 };
548 
549 /**
550  * PDCP security association configuration data.
551  *
552  * This structure contains data required to create a PDCP security session.
553  */
554 struct rte_security_pdcp_xform {
555 	int8_t bearer;	/**< PDCP bearer ID */
556 	/** Enable in order delivery, this field shall be set only if
557 	 * driver/HW is capable. See RTE_SECURITY_PDCP_ORDERING_CAP.
558 	 */
559 	uint8_t en_ordering;
560 	/** Notify driver/HW to detect and remove duplicate packets.
561 	 * This field should be set only when driver/hw is capable.
562 	 * See RTE_SECURITY_PDCP_DUP_DETECT_CAP.
563 	 */
564 	uint8_t remove_duplicates;
565 	/** PDCP mode of operation: Control or data */
566 	enum rte_security_pdcp_domain domain;
567 	/** PDCP Frame Direction 0:UL 1:DL */
568 	enum rte_security_pdcp_direction pkt_dir;
569 	/** Sequence number size, 5/7/12/15/18 */
570 	enum rte_security_pdcp_sn_size sn_size;
571 	/** Starting Hyper Frame Number to be used together with the SN
572 	 * from the PDCP frames
573 	 */
574 	uint32_t hfn;
575 	/** HFN Threshold for key renegotiation */
576 	uint32_t hfn_threshold;
577 	/** HFN can be given as a per packet value also.
578 	 * As we do not have IV in case of PDCP, and HFN is
579 	 * used to generate IV. IV field can be used to get the
580 	 * per packet HFN while enq/deq.
581 	 * If hfn_ovrd field is set, user is expected to set the
582 	 * per packet HFN in place of IV. PMDs will extract the HFN
583 	 * and perform operations accordingly.
584 	 */
585 	uint8_t hfn_ovrd;
586 	/** In case of 5G NR, a new protocol (SDAP) header may be set
587 	 * inside PDCP payload which should be authenticated but not
588 	 * encrypted. Hence, driver should be notified if SDAP is
589 	 * enabled or not, so that SDAP header is not encrypted.
590 	 */
591 	uint8_t sdap_enabled;
592 	/** Reserved for future */
593 	uint16_t reserved;
594 };
595 
596 /** DOCSIS direction */
597 enum rte_security_docsis_direction {
598 	RTE_SECURITY_DOCSIS_UPLINK,
599 	/**< Uplink
600 	 * - Decryption, followed by CRC Verification
601 	 */
602 	RTE_SECURITY_DOCSIS_DOWNLINK,
603 	/**< Downlink
604 	 * - CRC Generation, followed by Encryption
605 	 */
606 };
607 
608 /**
609  * DOCSIS security session configuration.
610  *
611  * This structure contains data required to create a DOCSIS security session.
612  */
613 struct rte_security_docsis_xform {
614 	enum rte_security_docsis_direction direction;
615 	/**< DOCSIS direction */
616 };
617 
618 /**
619  * Security session action type.
620  */
621 enum rte_security_session_action_type {
622 	RTE_SECURITY_ACTION_TYPE_NONE,
623 	/**< No security actions */
624 	RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,
625 	/**< Crypto processing for security protocol is processed inline
626 	 * during transmission
627 	 */
628 	RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
629 	/**< All security protocol processing is performed inline during
630 	 * transmission
631 	 */
632 	RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,
633 	/**< All security protocol processing including crypto is performed
634 	 * on a lookaside accelerator
635 	 */
636 	RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO
637 	/**< Similar to ACTION_TYPE_NONE but crypto processing for security
638 	 * protocol is processed synchronously by a CPU.
639 	 */
640 };
641 
642 /** Security session protocol definition */
643 enum rte_security_session_protocol {
644 	RTE_SECURITY_PROTOCOL_IPSEC = 1,
645 	/**< IPsec Protocol */
646 	RTE_SECURITY_PROTOCOL_MACSEC,
647 	/**< MACSec Protocol */
648 	RTE_SECURITY_PROTOCOL_PDCP,
649 	/**< PDCP Protocol */
650 	RTE_SECURITY_PROTOCOL_DOCSIS,
651 	/**< DOCSIS Protocol */
652 };
653 
654 /**
655  * Security session configuration
656  */
657 struct rte_security_session_conf {
658 	enum rte_security_session_action_type action_type;
659 	/**< Type of action to be performed on the session */
660 	enum rte_security_session_protocol protocol;
661 	/**< Security protocol to be configured */
662 	RTE_STD_C11
663 	union {
664 		struct rte_security_ipsec_xform ipsec;
665 		struct rte_security_macsec_xform macsec;
666 		struct rte_security_pdcp_xform pdcp;
667 		struct rte_security_docsis_xform docsis;
668 	};
669 	/**< Configuration parameters for security session */
670 	struct rte_crypto_sym_xform *crypto_xform;
671 	/**< Security Session Crypto Transformations. NULL in case of MACsec. */
672 	void *userdata;
673 	/**< Application specific userdata to be saved with session */
674 };
675 
676 struct rte_security_session {
677 	void *sess_private_data;
678 	/**< Private session material */
679 	uint64_t opaque_data;
680 	/**< Opaque user defined data */
681 };
682 
683 /**
684  * Create security session as specified by the session configuration
685  *
686  * @param   instance	security instance
687  * @param   conf	session configuration parameters
688  * @param   mp		mempool to allocate session objects from
689  * @param   priv_mp	mempool to allocate session private data objects from
690  * @return
691  *  - On success, pointer to session
692  *  - On failure, NULL
693  */
694 struct rte_security_session *
695 rte_security_session_create(struct rte_security_ctx *instance,
696 			    struct rte_security_session_conf *conf,
697 			    struct rte_mempool *mp,
698 			    struct rte_mempool *priv_mp);
699 
700 /**
701  * Update security session as specified by the session configuration
702  *
703  * @param   instance	security instance
704  * @param   sess	session to update parameters
705  * @param   conf	update configuration parameters
706  * @return
707  *  - On success returns 0
708  *  - On failure returns a negative errno value.
709  */
710 __rte_experimental
711 int
712 rte_security_session_update(struct rte_security_ctx *instance,
713 			    struct rte_security_session *sess,
714 			    struct rte_security_session_conf *conf);
715 
716 /**
717  * Get the size of the security session data for a device.
718  *
719  * @param   instance	security instance.
720  *
721  * @return
722  *   - Size of the private data, if successful
723  *   - 0 if device is invalid or does not support the operation.
724  */
725 unsigned int
726 rte_security_session_get_size(struct rte_security_ctx *instance);
727 
728 /**
729  * Free security session header and the session private data and
730  * return it to its original mempool.
731  *
732  * @param   instance	security instance
733  * @param   sess	security session to be freed
734  *
735  * @return
736  *  - 0 if successful.
737  *  - -EINVAL if session or context instance is NULL.
738  *  - -EBUSY if not all device private data has been freed.
739  *  - -ENOTSUP if destroying private data is not supported.
740  *  - other negative values in case of freeing private data errors.
741  */
742 int
743 rte_security_session_destroy(struct rte_security_ctx *instance,
744 			     struct rte_security_session *sess);
745 
746 /**
747  * @warning
748  * @b EXPERIMENTAL: this API may change without prior notice
749  *
750  * Create MACsec security channel (SC).
751  *
752  * @param   instance	security instance
753  * @param   conf	MACsec SC configuration params
754  * @return
755  *  - secure channel ID if successful.
756  *  - -EINVAL if configuration params are invalid of instance is NULL.
757  *  - -ENOTSUP if device does not support MACsec.
758  *  - -ENOMEM if PMD is not capable to create more SC.
759  *  - other negative value for other errors.
760  */
761 __rte_experimental
762 int
763 rte_security_macsec_sc_create(struct rte_security_ctx *instance,
764 			      struct rte_security_macsec_sc *conf);
765 
766 /**
767  * @warning
768  * @b EXPERIMENTAL: this API may change without prior notice
769  *
770  * Destroy MACsec security channel (SC).
771  *
772  * @param   instance	security instance
773  * @param   sc_id	SC ID to be destroyed
774  * @return
775  *  - 0 if successful.
776  *  - -EINVAL if sc_id is invalid or instance is NULL.
777  *  - -EBUSY if sc is being used by some session.
778  */
779 __rte_experimental
780 int
781 rte_security_macsec_sc_destroy(struct rte_security_ctx *instance, uint16_t sc_id);
782 
783 /**
784  * @warning
785  * @b EXPERIMENTAL: this API may change without prior notice
786  *
787  * Create MACsec security association (SA).
788  *
789  * @param   instance	security instance
790  * @param   conf	MACsec SA configuration params
791  * @return
792  *  - positive SA ID if successful.
793  *  - -EINVAL if configuration params are invalid of instance is NULL.
794  *  - -ENOTSUP if device does not support MACsec.
795  *  - -ENOMEM if PMD is not capable to create more SAs.
796  *  - other negative value for other errors.
797  */
798 __rte_experimental
799 int
800 rte_security_macsec_sa_create(struct rte_security_ctx *instance,
801 			      struct rte_security_macsec_sa *conf);
802 
803 /**
804  * @warning
805  * @b EXPERIMENTAL: this API may change without prior notice
806  *
807  * Destroy MACsec security association (SA).
808  *
809  * @param   instance	security instance
810  * @param   sa_id	SA ID to be destroyed
811  * @return
812  *  - 0 if successful.
813  *  - -EINVAL if sa_id is invalid or instance is NULL.
814  *  - -EBUSY if sa is being used by some session.
815  */
816 __rte_experimental
817 int
818 rte_security_macsec_sa_destroy(struct rte_security_ctx *instance, uint16_t sa_id);
819 
820 /** Device-specific metadata field type */
821 typedef uint64_t rte_security_dynfield_t;
822 /** Dynamic mbuf field for device-specific metadata */
823 extern int rte_security_dynfield_offset;
824 
825 /**
826  * @warning
827  * @b EXPERIMENTAL: this API may change without prior notice
828  *
829  * Get pointer to mbuf field for device-specific metadata.
830  *
831  * For performance reason, no check is done,
832  * the dynamic field may not be registered.
833  * @see rte_security_dynfield_is_registered
834  *
835  * @param	mbuf	packet to access
836  * @return pointer to mbuf field
837  */
838 __rte_experimental
839 static inline rte_security_dynfield_t *
840 rte_security_dynfield(struct rte_mbuf *mbuf)
841 {
842 	return RTE_MBUF_DYNFIELD(mbuf,
843 		rte_security_dynfield_offset,
844 		rte_security_dynfield_t *);
845 }
846 
847 /**
848  * @warning
849  * @b EXPERIMENTAL: this API may change without prior notice
850  *
851  * Check whether the dynamic field is registered.
852  *
853  * @return true if rte_security_dynfield_register() has been called.
854  */
855 __rte_experimental
856 static inline bool rte_security_dynfield_is_registered(void)
857 {
858 	return rte_security_dynfield_offset >= 0;
859 }
860 
861 /** Function to call PMD specific function pointer set_pkt_metadata() */
862 __rte_experimental
863 extern int __rte_security_set_pkt_metadata(struct rte_security_ctx *instance,
864 					   struct rte_security_session *sess,
865 					   struct rte_mbuf *m, void *params);
866 
867 /**
868  *  Updates the buffer with device-specific defined metadata
869  *
870  * @param	instance	security instance
871  * @param	sess		security session
872  * @param	mb		packet mbuf to set metadata on.
873  * @param	params		device-specific defined parameters
874  *				required for metadata
875  *
876  * @return
877  *  - On success, zero.
878  *  - On failure, a negative value.
879  */
880 static inline int
881 rte_security_set_pkt_metadata(struct rte_security_ctx *instance,
882 			      struct rte_security_session *sess,
883 			      struct rte_mbuf *mb, void *params)
884 {
885 	/* Fast Path */
886 	if (instance->flags & RTE_SEC_CTX_F_FAST_SET_MDATA) {
887 		*rte_security_dynfield(mb) =
888 			(rte_security_dynfield_t)(sess->sess_private_data);
889 		return 0;
890 	}
891 
892 	/* Jump to PMD specific function pointer */
893 	return __rte_security_set_pkt_metadata(instance, sess, mb, params);
894 }
895 
896 /**
897  * Attach a session to a symmetric crypto operation
898  *
899  * @param	sym_op	crypto operation
900  * @param	sess	security session
901  */
902 static inline int
903 __rte_security_attach_session(struct rte_crypto_sym_op *sym_op,
904 			      struct rte_security_session *sess)
905 {
906 	sym_op->sec_session = sess;
907 
908 	return 0;
909 }
910 
911 static inline void *
912 get_sec_session_private_data(const struct rte_security_session *sess)
913 {
914 	return sess->sess_private_data;
915 }
916 
917 static inline void
918 set_sec_session_private_data(struct rte_security_session *sess,
919 			     void *private_data)
920 {
921 	sess->sess_private_data = private_data;
922 }
923 
924 /**
925  * Attach a session to a crypto operation.
926  * This API is needed only in case of RTE_SECURITY_SESS_CRYPTO_PROTO_OFFLOAD
927  * For other rte_security_session_action_type, ol_flags in rte_mbuf may be
928  * defined to perform security operations.
929  *
930  * @param	op	crypto operation
931  * @param	sess	security session
932  */
933 static inline int
934 rte_security_attach_session(struct rte_crypto_op *op,
935 			    struct rte_security_session *sess)
936 {
937 	if (unlikely(op->type != RTE_CRYPTO_OP_TYPE_SYMMETRIC))
938 		return -EINVAL;
939 
940 	op->sess_type =  RTE_CRYPTO_OP_SECURITY_SESSION;
941 
942 	return __rte_security_attach_session(op->sym, sess);
943 }
944 
945 struct rte_security_macsec_secy_stats {
946 	uint64_t ctl_pkt_bcast_cnt;
947 	uint64_t ctl_pkt_mcast_cnt;
948 	uint64_t ctl_pkt_ucast_cnt;
949 	uint64_t ctl_octet_cnt;
950 	uint64_t unctl_pkt_bcast_cnt;
951 	uint64_t unctl_pkt_mcast_cnt;
952 	uint64_t unctl_pkt_ucast_cnt;
953 	uint64_t unctl_octet_cnt;
954 	/* Valid only for Rx */
955 	uint64_t octet_decrypted_cnt;
956 	uint64_t octet_validated_cnt;
957 	uint64_t pkt_port_disabled_cnt;
958 	uint64_t pkt_badtag_cnt;
959 	uint64_t pkt_nosa_cnt;
960 	uint64_t pkt_nosaerror_cnt;
961 	uint64_t pkt_tagged_ctl_cnt;
962 	uint64_t pkt_untaged_cnt;
963 	uint64_t pkt_ctl_cnt;
964 	uint64_t pkt_notag_cnt;
965 	/* Valid only for Tx */
966 	uint64_t octet_encrypted_cnt;
967 	uint64_t octet_protected_cnt;
968 	uint64_t pkt_noactivesa_cnt;
969 	uint64_t pkt_toolong_cnt;
970 	uint64_t pkt_untagged_cnt;
971 };
972 
973 struct rte_security_macsec_sc_stats {
974 	/* Rx */
975 	uint64_t hit_cnt;
976 	uint64_t pkt_invalid_cnt;
977 	uint64_t pkt_late_cnt;
978 	uint64_t pkt_notvalid_cnt;
979 	uint64_t pkt_unchecked_cnt;
980 	uint64_t pkt_delay_cnt;
981 	uint64_t pkt_ok_cnt;
982 	uint64_t octet_decrypt_cnt;
983 	uint64_t octet_validate_cnt;
984 	/* Tx */
985 	uint64_t pkt_encrypt_cnt;
986 	uint64_t pkt_protected_cnt;
987 	uint64_t octet_encrypt_cnt;
988 	uint64_t octet_protected_cnt;
989 };
990 
991 struct rte_security_macsec_sa_stats {
992 	/* Rx */
993 	uint64_t pkt_invalid_cnt;
994 	uint64_t pkt_nosaerror_cnt;
995 	uint64_t pkt_notvalid_cnt;
996 	uint64_t pkt_ok_cnt;
997 	uint64_t pkt_nosa_cnt;
998 	/* Tx */
999 	uint64_t pkt_encrypt_cnt;
1000 	uint64_t pkt_protected_cnt;
1001 };
1002 
1003 struct rte_security_ipsec_stats {
1004 	uint64_t ipackets;  /**< Successfully received IPsec packets. */
1005 	uint64_t opackets;  /**< Successfully transmitted IPsec packets.*/
1006 	uint64_t ibytes;    /**< Successfully received IPsec bytes. */
1007 	uint64_t obytes;    /**< Successfully transmitted IPsec bytes. */
1008 	uint64_t ierrors;   /**< IPsec packets receive/decrypt errors. */
1009 	uint64_t oerrors;   /**< IPsec packets transmit/encrypt errors. */
1010 	uint64_t reserved1; /**< Reserved for future use. */
1011 	uint64_t reserved2; /**< Reserved for future use. */
1012 };
1013 
1014 struct rte_security_pdcp_stats {
1015 	uint64_t reserved;
1016 };
1017 
1018 struct rte_security_docsis_stats {
1019 	uint64_t reserved;
1020 };
1021 
1022 struct rte_security_stats {
1023 	enum rte_security_session_protocol protocol;
1024 	/**< Security protocol to be configured */
1025 
1026 	RTE_STD_C11
1027 	union {
1028 		struct rte_security_macsec_secy_stats macsec;
1029 		struct rte_security_ipsec_stats ipsec;
1030 		struct rte_security_pdcp_stats pdcp;
1031 		struct rte_security_docsis_stats docsis;
1032 	};
1033 };
1034 
1035 /**
1036  * Get security session statistics
1037  *
1038  * @param	instance	security instance
1039  * @param	sess		security session
1040  * If security session is NULL then global (per security instance) statistics
1041  * will be retrieved, if supported. Global statistics collection is not
1042  * dependent on the per session statistics configuration.
1043  * @param	stats		statistics
1044  * @return
1045  *  - On success, return 0
1046  *  - On failure, a negative value
1047  */
1048 __rte_experimental
1049 int
1050 rte_security_session_stats_get(struct rte_security_ctx *instance,
1051 			       struct rte_security_session *sess,
1052 			       struct rte_security_stats *stats);
1053 
1054 /**
1055  * @warning
1056  * @b EXPERIMENTAL: this API may change without prior notice
1057  *
1058  * Get MACsec SA statistics.
1059  *
1060  * @param	instance	security instance
1061  * @param	sa_id		SA ID for which stats are needed
1062  * @param	stats		statistics
1063  * @return
1064  *  - On success, return 0.
1065  *  - On failure, a negative value.
1066  */
1067 __rte_experimental
1068 int
1069 rte_security_macsec_sa_stats_get(struct rte_security_ctx *instance,
1070 				 uint16_t sa_id,
1071 				 struct rte_security_macsec_sa_stats *stats);
1072 
1073 /**
1074  * @warning
1075  * @b EXPERIMENTAL: this API may change without prior notice
1076  *
1077  * Get MACsec SC statistics.
1078  *
1079  * @param	instance	security instance
1080  * @param	sc_id		SC ID for which stats are needed
1081  * @param	stats		SC statistics
1082  * @return
1083  *  - On success, return 0.
1084  *  - On failure, a negative value.
1085  */
1086 __rte_experimental
1087 int
1088 rte_security_macsec_sc_stats_get(struct rte_security_ctx *instance,
1089 				 uint16_t sc_id,
1090 				 struct rte_security_macsec_sc_stats *stats);
1091 
1092 /**
1093  * Security capability definition
1094  */
1095 struct rte_security_capability {
1096 	enum rte_security_session_action_type action;
1097 	/**< Security action type*/
1098 	enum rte_security_session_protocol protocol;
1099 	/**< Security protocol */
1100 	RTE_STD_C11
1101 	union {
1102 		struct {
1103 			enum rte_security_ipsec_sa_protocol proto;
1104 			/**< IPsec SA protocol */
1105 			enum rte_security_ipsec_sa_mode mode;
1106 			/**< IPsec SA mode */
1107 			enum rte_security_ipsec_sa_direction direction;
1108 			/**< IPsec SA direction */
1109 			struct rte_security_ipsec_sa_options options;
1110 			/**< IPsec SA supported options */
1111 			uint32_t replay_win_sz_max;
1112 			/**< IPsec Anti Replay Window Size. A '0' value
1113 			 * indicates that Anti Replay is not supported.
1114 			 */
1115 		} ipsec;
1116 		/**< IPsec capability */
1117 		struct {
1118 			/** MTU supported for inline TX */
1119 			uint16_t mtu;
1120 			/** MACsec algorithm to be used */
1121 			enum rte_security_macsec_alg alg;
1122 			/** Maximum number of secure channels supported */
1123 			uint16_t max_nb_sc;
1124 			/** Maximum number of SAs supported */
1125 			uint16_t max_nb_sa;
1126 			/** Maximum number of SAs supported */
1127 			uint16_t max_nb_sess;
1128 			/** MACsec anti replay window size */
1129 			uint32_t replay_win_sz;
1130 			/** Support Sectag insertion at relative offset */
1131 			uint16_t relative_sectag_insert : 1;
1132 			/** Support Sectag insertion at fixed offset */
1133 			uint16_t fixed_sectag_insert : 1;
1134 			/** ICV includes source and destination MAC addresses */
1135 			uint16_t icv_include_da_sa : 1;
1136 			/** Control port traffic is supported */
1137 			uint16_t ctrl_port_enable : 1;
1138 			/** Do not strip SecTAG after processing */
1139 			uint16_t preserve_sectag : 1;
1140 			/** Do not strip ICV from the packet after processing */
1141 			uint16_t preserve_icv : 1;
1142 			/** Support frame validation as per RTE_SECURITY_MACSEC_VALIDATE_* */
1143 			uint16_t validate_frames : 1;
1144 			/** support re-keying on SA expiry */
1145 			uint16_t re_key : 1;
1146 			/** support anti replay */
1147 			uint16_t anti_replay : 1;
1148 			/** Reserved bitfields for future capabilities */
1149 			uint16_t reserved : 7;
1150 		} macsec;
1151 		/**< MACsec capability */
1152 		struct {
1153 			enum rte_security_pdcp_domain domain;
1154 			/**< PDCP mode of operation: Control or data */
1155 			uint32_t capa_flags;
1156 			/**< Capability flags, see RTE_SECURITY_PDCP_* */
1157 		} pdcp;
1158 		/**< PDCP capability */
1159 		struct {
1160 			enum rte_security_docsis_direction direction;
1161 			/**< DOCSIS direction */
1162 		} docsis;
1163 		/**< DOCSIS capability */
1164 	};
1165 
1166 	const struct rte_cryptodev_capabilities *crypto_capabilities;
1167 	/**< Corresponding crypto capabilities for security capability  */
1168 
1169 	uint32_t ol_flags;
1170 	/**< Device offload flags */
1171 };
1172 
1173 /** Underlying Hardware/driver which support PDCP may or may not support
1174  * packet ordering. Set RTE_SECURITY_PDCP_ORDERING_CAP if it support.
1175  * If it is not set, driver/HW assumes packets received are in order
1176  * and it will be application's responsibility to maintain ordering.
1177  */
1178 #define RTE_SECURITY_PDCP_ORDERING_CAP		0x00000001
1179 
1180 /** Underlying Hardware/driver which support PDCP may or may not detect
1181  * duplicate packet. Set RTE_SECURITY_PDCP_DUP_DETECT_CAP if it support.
1182  * If it is not set, driver/HW assumes there is no duplicate packet received.
1183  */
1184 #define RTE_SECURITY_PDCP_DUP_DETECT_CAP	0x00000002
1185 
1186 #define RTE_SECURITY_TX_OLOAD_NEED_MDATA	0x00000001
1187 /**< HW needs metadata update, see rte_security_set_pkt_metadata().
1188  */
1189 
1190 #define RTE_SECURITY_TX_HW_TRAILER_OFFLOAD	0x00000002
1191 /**< HW constructs trailer of packets
1192  * Transmitted packets will have the trailer added to them
1193  * by hardware. The next protocol field will be based on
1194  * the mbuf->inner_esp_next_proto field.
1195  */
1196 #define RTE_SECURITY_RX_HW_TRAILER_OFFLOAD	0x00010000
1197 /**< HW removes trailer of packets
1198  * Received packets have no trailer, the next protocol field
1199  * is supplied in the mbuf->inner_esp_next_proto field.
1200  * Inner packet is not modified.
1201  */
1202 
1203 /**
1204  * Security capability index used to query a security instance for a specific
1205  * security capability
1206  */
1207 struct rte_security_capability_idx {
1208 	enum rte_security_session_action_type action;
1209 	enum rte_security_session_protocol protocol;
1210 
1211 	RTE_STD_C11
1212 	union {
1213 		struct {
1214 			enum rte_security_ipsec_sa_protocol proto;
1215 			enum rte_security_ipsec_sa_mode mode;
1216 			enum rte_security_ipsec_sa_direction direction;
1217 		} ipsec;
1218 		struct {
1219 			enum rte_security_pdcp_domain domain;
1220 			uint32_t capa_flags;
1221 		} pdcp;
1222 		struct {
1223 			enum rte_security_docsis_direction direction;
1224 		} docsis;
1225 	};
1226 };
1227 
1228 /**
1229  *  Returns array of security instance capabilities
1230  *
1231  * @param	instance	Security instance.
1232  *
1233  * @return
1234  *   - Returns array of security capabilities.
1235  *   - Return NULL if no capabilities available.
1236  */
1237 const struct rte_security_capability *
1238 rte_security_capabilities_get(struct rte_security_ctx *instance);
1239 
1240 /**
1241  * Query if a specific capability is available on security instance
1242  *
1243  * @param	instance	security instance.
1244  * @param	idx		security capability index to match against
1245  *
1246  * @return
1247  *   - Returns pointer to security capability on match of capability
1248  *     index criteria.
1249  *   - Return NULL if the capability not matched on security instance.
1250  */
1251 const struct rte_security_capability *
1252 rte_security_capability_get(struct rte_security_ctx *instance,
1253 			    struct rte_security_capability_idx *idx);
1254 
1255 #ifdef __cplusplus
1256 }
1257 #endif
1258 
1259 #endif /* _RTE_SECURITY_H_ */
1260