security: add option to configure tunnel header verification

Add option to indicate whether outer header verification
need to be done as part of inbound IPsec processing.

With inline IPsec processing, SA lookup would be happening
in the Rx path of rte_ethdev. When rte_flow is configured to
support more than one SA, SPI would be used to lookup SA.
In such cases, additional verification would be required to
ensure duplicate SPIs are not getting processed in the inline path.

For lookaside cases, the same option can be used by application
to offload tunnel verification to the PMD.

These verifications would help in averting possible DoS attacks.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>

diff --git a/doc/guides/rel_notes/deprecation.rst b/doc/guides/rel_notes/deprecation.rst
index a1003251285a6e8ae457fdfacfd0c15d74a9b118..05fc2fdee700cf9cab47e5cfbae78664baf6be77 100644 (file)
--- a/doc/guides/rel_notes/deprecation.rst
+++ b/doc/guides/rel_notes/deprecation.rst
@@ -233,7 +233,7 @@ Deprecation Notices
 
 * security: The IPsec SA config options ``struct rte_security_ipsec_sa_options``
   will be updated with new fields to support new features like IPsec inner
-  checksum, tunnel header verification, TSO in case of protocol offload.
+  checksum, TSO in case of protocol offload.
 
 * ipsec: The structure ``rte_ipsec_sa_prm`` will be extended with a new field
   ``hdr_l3_len`` to configure tunnel L3 header length.

diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst
index afbe744ae52499d62ccf9604f99c4b1cb3c92851..22e5a06568338d88a92481c353b09961276adcdd 100644 (file)
--- a/doc/guides/rel_notes/release_21_11.rst
+++ b/doc/guides/rel_notes/release_21_11.rst
@@ -180,6 +180,10 @@ ABI Changes
   ``rte_security_ipsec_sa_options`` to disable IV generation inside PMD,
   so that application can provide its own IV and test known test vectors.
 
+* security: A new option ``tunnel_hdr_verify`` was added in structure
+  ``rte_security_ipsec_sa_options`` to indicate whether outer header
+  verification need to be done as part of inbound IPsec processing.
+
 * security: A new structure ``rte_security_ipsec_lifetime`` was added to
   replace ``esn_soft_limit`` in IPsec configuration structure
   ``rte_security_ipsec_xform`` to allow applications to configure SA soft

diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h
index 88147e1f572f62e2d2a8f72e20a515a14b73b15e..a10c9b5f0062cedfb3216868a10b33457c7180d5 100644 (file)
--- a/lib/security/rte_security.h
+++ b/lib/security/rte_security.h
@@ -55,6 +55,14 @@ enum rte_security_ipsec_tunnel_type {
        /**< Outer header is IPv6 */
 };
 
+/**
+ * IPSEC tunnel header verification mode
+ *
+ * Controls how outer IP header is verified in inbound.
+ */
+#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR     0x1
+#define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR 0x2
+
 /**
  * Security context for crypto/eth devices
  *
@@ -206,6 +214,15 @@ struct rte_security_ipsec_sa_options {
         * by the PMD.
         */
        uint32_t iv_gen_disable : 1;
+
+       /** Verify tunnel header in inbound
+        * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR``: Verify destination
+        *   IP address.
+        *
+        * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR``: Verify both
+        *   source and destination IP addresses.
+        */
+       uint32_t tunnel_hdr_verify : 2;
 };
 
 /** IPSec security association direction */