diff options
Diffstat (limited to 'lib/librte_security')
| -rw-r--r-- | lib/librte_security/Makefile | 32 | ||||
| -rw-r--r-- | lib/librte_security/meson.build | 7 | ||||
| -rw-r--r-- | lib/librte_security/rte_security.c | 37 | ||||
| -rw-r--r-- | lib/librte_security/rte_security.h | 67 | ||||
| -rw-r--r-- | lib/librte_security/rte_security_driver.h | 32 | ||||
| -rw-r--r-- | lib/librte_security/rte_security_version.map | 2 |
6 files changed, 123 insertions, 54 deletions
diff --git a/lib/librte_security/Makefile b/lib/librte_security/Makefile index bb93ec33..8daebea4 100644 --- a/lib/librte_security/Makefile +++ b/lib/librte_security/Makefile @@ -1,32 +1,5 @@ -# BSD LICENSE -# -# Copyright(c) 2017 Intel Corporation. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions -# are met: -# -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# * Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in -# the documentation and/or other materials provided with the -# distribution. -# * Neither the name of Intel Corporation nor the names of its -# contributors may be used to endorse or promote products derived -# from this software without specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# SPDX-License-Identifier: BSD-3-Clause +# Copyright(c) 2017 Intel Corporation include $(RTE_SDK)/mk/rte.vars.mk @@ -37,6 +10,7 @@ LIB = librte_security.a LIBABIVER := 1 # build flags +CFLAGS += -DALLOW_EXPERIMENTAL_API CFLAGS += -O3 CFLAGS += $(WERROR_FLAGS) LDLIBS += -lrte_eal -lrte_mempool diff --git a/lib/librte_security/meson.build b/lib/librte_security/meson.build new file mode 100644 index 00000000..4c85894c --- /dev/null +++ b/lib/librte_security/meson.build @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: BSD-3-Clause +# Copyright(c) 2017 Intel Corporation + +allow_experimental_apis = true +sources = files('rte_security.c') +headers = files('rte_security.h', 'rte_security_driver.h') +deps += ['mempool', 'cryptodev'] diff --git a/lib/librte_security/rte_security.c b/lib/librte_security/rte_security.c index 1227fca8..1e559c99 100644 --- a/lib/librte_security/rte_security.c +++ b/lib/librte_security/rte_security.c @@ -33,12 +33,12 @@ #include <rte_malloc.h> #include <rte_dev.h> - +#include "rte_compat.h" #include "rte_security.h" #include "rte_security_driver.h" struct rte_security_session * -rte_security_session_create(struct rte_security_ctx *instance, +__rte_experimental rte_security_session_create(struct rte_security_ctx *instance, struct rte_security_session_conf *conf, struct rte_mempool *mp) { @@ -49,7 +49,7 @@ rte_security_session_create(struct rte_security_ctx *instance, RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->session_create, NULL); - if (rte_mempool_get(mp, (void *)&sess)) + if (rte_mempool_get(mp, (void **)&sess)) return NULL; if (instance->ops->session_create(instance->device, conf, sess, mp)) { @@ -61,7 +61,7 @@ rte_security_session_create(struct rte_security_ctx *instance, return sess; } -int +int __rte_experimental rte_security_session_update(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_security_session_conf *conf) @@ -70,7 +70,14 @@ rte_security_session_update(struct rte_security_ctx *instance, return instance->ops->session_update(instance->device, sess, conf); } -int +unsigned int __rte_experimental +rte_security_session_get_size(struct rte_security_ctx *instance) +{ + RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->session_get_size, 0); + return instance->ops->session_get_size(instance->device); +} + +int __rte_experimental rte_security_session_stats_get(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_security_stats *stats) @@ -79,7 +86,7 @@ rte_security_session_stats_get(struct rte_security_ctx *instance, return instance->ops->session_stats_get(instance->device, sess, stats); } -int +int __rte_experimental rte_security_session_destroy(struct rte_security_ctx *instance, struct rte_security_session *sess) { @@ -98,7 +105,7 @@ rte_security_session_destroy(struct rte_security_ctx *instance, return ret; } -int +int __rte_experimental rte_security_set_pkt_metadata(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_mbuf *m, void *params) @@ -108,14 +115,26 @@ rte_security_set_pkt_metadata(struct rte_security_ctx *instance, sess, m, params); } -const struct rte_security_capability * +void * __rte_experimental +rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md) +{ + void *userdata = NULL; + + RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->get_userdata, NULL); + if (instance->ops->get_userdata(instance->device, md, &userdata)) + return NULL; + + return userdata; +} + +const struct rte_security_capability * __rte_experimental rte_security_capabilities_get(struct rte_security_ctx *instance) { RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->capabilities_get, NULL); return instance->ops->capabilities_get(instance->device); } -const struct rte_security_capability * +const struct rte_security_capability * __rte_experimental rte_security_capability_get(struct rte_security_ctx *instance, struct rte_security_capability_idx *idx) { diff --git a/lib/librte_security/rte_security.h b/lib/librte_security/rte_security.h index 653929b9..c75c1218 100644 --- a/lib/librte_security/rte_security.h +++ b/lib/librte_security/rte_security.h @@ -52,6 +52,7 @@ extern "C" { #include <netinet/ip.h> #include <netinet/ip6.h> +#include <rte_compat.h> #include <rte_common.h> #include <rte_crypto.h> #include <rte_mbuf.h> @@ -60,7 +61,7 @@ extern "C" { /** IPSec protocol mode */ enum rte_security_ipsec_sa_mode { - RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT, + RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT = 1, /**< IPSec Transport mode */ RTE_SECURITY_IPSEC_SA_MODE_TUNNEL, /**< IPSec Tunnel mode */ @@ -68,7 +69,7 @@ enum rte_security_ipsec_sa_mode { /** IPSec Protocol */ enum rte_security_ipsec_sa_protocol { - RTE_SECURITY_IPSEC_SA_PROTO_AH, + RTE_SECURITY_IPSEC_SA_PROTO_AH = 1, /**< AH protocol */ RTE_SECURITY_IPSEC_SA_PROTO_ESP, /**< ESP protocol */ @@ -76,7 +77,7 @@ enum rte_security_ipsec_sa_protocol { /** IPSEC tunnel type */ enum rte_security_ipsec_tunnel_type { - RTE_SECURITY_IPSEC_TUNNEL_IPV4, + RTE_SECURITY_IPSEC_TUNNEL_IPV4 = 1, /**< Outer header is IPv4 */ RTE_SECURITY_IPSEC_TUNNEL_IPV6, /**< Outer header is IPv6 */ @@ -94,7 +95,7 @@ enum rte_security_ipsec_tunnel_type { struct rte_security_ctx { void *device; /**< Crypto/ethernet device attached */ - struct rte_security_ops *ops; + const struct rte_security_ops *ops; /**< Pointer to security ops for the device */ uint16_t sess_cnt; /**< Number of sessions attached to this context */ @@ -228,6 +229,7 @@ struct rte_security_ipsec_xform { */ struct rte_security_macsec_xform { /** To be Filled */ + int dummy; }; /** @@ -252,7 +254,7 @@ enum rte_security_session_action_type { /** Security session protocol definition */ enum rte_security_session_protocol { - RTE_SECURITY_PROTOCOL_IPSEC, + RTE_SECURITY_PROTOCOL_IPSEC = 1, /**< IPsec Protocol */ RTE_SECURITY_PROTOCOL_MACSEC, /**< MACSec Protocol */ @@ -274,6 +276,8 @@ struct rte_security_session_conf { /**< Configuration parameters for security session */ struct rte_crypto_sym_xform *crypto_xform; /**< Security Session Crypto Transformations */ + void *userdata; + /**< Application specific userdata to be saved with session */ }; struct rte_security_session { @@ -291,7 +295,7 @@ struct rte_security_session { * - On success, pointer to session * - On failure, NULL */ -struct rte_security_session * +struct rte_security_session * __rte_experimental rte_security_session_create(struct rte_security_ctx *instance, struct rte_security_session_conf *conf, struct rte_mempool *mp); @@ -306,12 +310,24 @@ rte_security_session_create(struct rte_security_ctx *instance, * - On success returns 0 * - On failure return errno */ -int +int __rte_experimental rte_security_session_update(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_security_session_conf *conf); /** + * Get the size of the security session data for a device. + * + * @param instance security instance. + * + * @return + * - Size of the private data, if successful + * - 0 if device is invalid or does not support the operation. + */ +unsigned int __rte_experimental +rte_security_session_get_size(struct rte_security_ctx *instance); + +/** * Free security session header and the session private data and * return it to its original mempool. * @@ -323,7 +339,7 @@ rte_security_session_update(struct rte_security_ctx *instance, * - -EINVAL if session is NULL. * - -EBUSY if not all device private data has been freed. */ -int +int __rte_experimental rte_security_session_destroy(struct rte_security_ctx *instance, struct rte_security_session *sess); @@ -340,18 +356,36 @@ rte_security_session_destroy(struct rte_security_ctx *instance, * - On success, zero. * - On failure, a negative value. */ -int +int __rte_experimental rte_security_set_pkt_metadata(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_mbuf *mb, void *params); /** + * Get userdata associated with the security session which processed the + * packet. This userdata would be registered while creating the session, and + * application can use this to identify the SA etc. Device-specific metadata + * in the mbuf would be used for this. + * + * This is valid only for inline processed ingress packets. + * + * @param instance security instance + * @param md device-specific metadata set in mbuf + * + * @return + * - On success, userdata + * - On failure, NULL + */ +void * __rte_experimental +rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md); + +/** * Attach a session to a symmetric crypto operation * * @param sym_op crypto operation * @param sess security session */ -static inline int +static inline int __rte_experimental __rte_security_attach_session(struct rte_crypto_sym_op *sym_op, struct rte_security_session *sess) { @@ -360,13 +394,13 @@ __rte_security_attach_session(struct rte_crypto_sym_op *sym_op, return 0; } -static inline void * +static inline void * __rte_experimental get_sec_session_private_data(const struct rte_security_session *sess) { return sess->sess_private_data; } -static inline void +static inline void __rte_experimental set_sec_session_private_data(struct rte_security_session *sess, void *private_data) { @@ -382,7 +416,7 @@ set_sec_session_private_data(struct rte_security_session *sess, * @param op crypto operation * @param sess security session */ -static inline int +static inline int __rte_experimental rte_security_attach_session(struct rte_crypto_op *op, struct rte_security_session *sess) { @@ -424,7 +458,7 @@ struct rte_security_stats { * - On success return 0 * - On failure errno */ -int +int __rte_experimental rte_security_session_stats_get(struct rte_security_ctx *instance, struct rte_security_session *sess, struct rte_security_stats *stats); @@ -452,6 +486,7 @@ struct rte_security_capability { /**< IPsec capability */ struct { /* To be Filled */ + int dummy; } macsec; /**< MACsec capability */ }; @@ -507,7 +542,7 @@ struct rte_security_capability_idx { * - Returns array of security capabilities. * - Return NULL if no capabilities available. */ -const struct rte_security_capability * +const struct rte_security_capability * __rte_experimental rte_security_capabilities_get(struct rte_security_ctx *instance); /** @@ -521,7 +556,7 @@ rte_security_capabilities_get(struct rte_security_ctx *instance); * index criteria. * - Return NULL if the capability not matched on security instance. */ -const struct rte_security_capability * +const struct rte_security_capability * __rte_experimental rte_security_capability_get(struct rte_security_ctx *instance, struct rte_security_capability_idx *idx); diff --git a/lib/librte_security/rte_security_driver.h b/lib/librte_security/rte_security_driver.h index 997fbe79..46239049 100644 --- a/lib/librte_security/rte_security_driver.h +++ b/lib/librte_security/rte_security_driver.h @@ -91,6 +91,18 @@ typedef int (*security_session_destroy_t)(void *device, typedef int (*security_session_update_t)(void *device, struct rte_security_session *sess, struct rte_security_session_conf *conf); + +/** + * Get the size of a security session + * + * @param device Crypto/eth device pointer + * + * @return + * - On success returns the size of the session structure for device + * - On failure returns 0 + */ +typedef unsigned int (*security_session_get_size)(void *device); + /** * Get stats from the PMD. * @@ -122,6 +134,22 @@ typedef int (*security_set_pkt_metadata_t)(void *device, void *params); /** + * Get application specific userdata associated with the security session which + * processed the packet. This would be retrieved using the metadata obtained + * from packet. + * + * @param device Crypto/eth device pointer + * @param md Metadata + * @param userdata Pointer to receive userdata + * + * @return + * - Returns 0 if userdata is retrieved successfully. + * - Returns -ve value for errors. + */ +typedef int (*security_get_userdata_t)(void *device, + uint64_t md, void **userdata); + +/** * Get security capabilities of the device. * * @param device crypto/eth device pointer @@ -139,12 +167,16 @@ struct rte_security_ops { /**< Configure a security session. */ security_session_update_t session_update; /**< Update a security session. */ + security_session_get_size session_get_size; + /**< Return size of security session. */ security_session_stats_get_t session_stats_get; /**< Get security session statistics. */ security_session_destroy_t session_destroy; /**< Clear a security sessions private data. */ security_set_pkt_metadata_t set_pkt_metadata; /**< Update mbuf metadata. */ + security_get_userdata_t get_userdata; + /**< Get userdata associated with session which processed the packet. */ security_capabilities_get_t capabilities_get; /**< Get security capabilities. */ }; diff --git a/lib/librte_security/rte_security_version.map b/lib/librte_security/rte_security_version.map index e12c04b2..5a1c8ae3 100644 --- a/lib/librte_security/rte_security_version.map +++ b/lib/librte_security/rte_security_version.map @@ -4,8 +4,10 @@ EXPERIMENTAL { rte_security_attach_session; rte_security_capabilities_get; rte_security_capability_get; + rte_security_get_userdata; rte_security_session_create; rte_security_session_destroy; + rte_security_session_get_size; rte_security_session_stats_get; rte_security_session_update; rte_security_set_pkt_metadata; |