[dpdk-dev] [PATCH] security: allow application to specify UDP ports to PMD

[Tejasree Kondoj]

Add UDP source and destination ports in ipsec_xform to allow application
to specify ports to be used for IPsec UDP encapsulation as they are
dynamically changed by NAT in between. Also adding an extra flag to
indicate whether PMD needs to perform encapsulation header verification
in case of inbound. In case of inline IPsec implementation, verification
of outer IP headers and UDP encapsulation headers need to be handled
in the PMD. For lookaside IPsec, application can optionally offload
this to the PMD.

Signed-off-by: Tejasree Kondoj <ktejasree at marvell.com>
---
 lib/librte_security/rte_security.h | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/lib/librte_security/rte_security.h b/lib/librte_security/rte_security.h
index 16839e539..670bdeb6b 100644
--- a/lib/librte_security/rte_security.h
+++ b/lib/librte_security/rte_security.h
@@ -130,6 +130,13 @@ struct rte_security_ipsec_sa_options {
 	 */
 	uint32_t udp_encap : 1;
 
+	/** Verify tunnel header and UDP encapsulation ports in inbound
+	 *
+	 * * 1: Match outer header source, destination addresses and UDP ports
+	 * * 0: Do not match outer IP addresses and UDP ports
+	 */
+	uint32_t encap_hdr_verify : 1;
+
 	/** Copy DSCP bits
 	 *
 	 * * 1: Copy IPv4 or IPv6 DSCP bits from inner IP header to
@@ -190,6 +197,16 @@ enum rte_security_ipsec_sa_direction {
 	/**< Verify digest and decrypt */
 };
 
+/**
+ * UDP encapsulation ports
+ */
+struct rte_security_ipsec_udp_encapsulation {
+	uint16_t src_port;
+	/**< UDP source port */
+	uint16_t dst_port;
+	/**< UDP destination port */
+};
+
 /**
  * IPsec security association configuration data.
  *
@@ -216,6 +233,8 @@ struct rte_security_ipsec_xform {
 	/**< Anti replay window size to enable sequence replay attack handling.
 	 * replay checking is disabled if the window size is 0.
 	 */
+	struct rte_security_ipsec_udp_encapsulation udp_encap;
+	/**< UDP encapsulation ports */
 };
 
 /**
-- 
2.27.0