RE: [PATCH RFC v5 2/4] virtio-crypto: Add resource objects for IPsec outbound and inbound SAs

> > From: Srujana Challa <[email protected]>
> > Sent: Tuesday, April 8, 2025 9:35 AM
> > To: [email protected]
> > Cc: [email protected]; [email protected]; [email protected];
> > [email protected]; Sebastian Mauritsson <[email protected]>;
> > [email protected]; [email protected]; [email protected];
> > [email protected]; [email protected]
> > Subject: [PATCH RFC v5 2/4] virtio-crypto: Add resource objects for
> > IPsec outbound and inbound SAs
> >
> > This commit introduces resource objects to enable the driver/device to
> > create IPsec Security Associations (SAs) for both inbound and outbound
> directions.
> >
> > The IPsec SA objects include essential parameters required for packet
> > outbound and inbound processing, such as SPI, tunnel headers, IPsec
> > mode, IPsec options and cipher/authentication specific data.
> >
> > Signed-off-by: Srujana Challa <[email protected]>
> > ---
> >  device-types/crypto/description.tex | 157
> > ++++++++++++++++++++++++++++
> >  1 file changed, 157 insertions(+)
> >
> > diff --git a/device-types/crypto/description.tex b/device-
> > types/crypto/description.tex index 1f2d336..15b1d1d 100644
> > --- a/device-types/crypto/description.tex
> > +++ b/device-types/crypto/description.tex
> > @@ -336,6 +336,20 @@ \subsection{Device and driver
> > capabilities}\label{sec:Device Types / Crypto Devi  \hline
> > \end{tabularx}
> >
> > +\subsection{Device resource objects}\label{sec:Device Types / Crypto
> > +Device / Device resource objects}
> > +
> > +The crypto device has the following resource objects.
> > +
> > +\begin{tabularx}{\textwidth}{ |l||l|X| } \hline type & Name &
> > +Description \\ \hline \hline
> > +0x0200 & \hyperref[par:Device Types / Crypto Device / Device
> > +Operation / IPsec Service Operation / Resource objects /
> > +VIRTIO-CRYPTO-RESOURCE-OBJ-IPSEC-OUTBOUND-
> > SA]{VIRTIO_CRYPTO_RESOURCE_OB
> > +J_IPSEC_OUTBOUND_SA} & IPsec outbound SA resource object \\ \hline
> > +0x0201 & \hyperref[par:Device Types / Crypto Device / Device
> > +Operation / IPsec Service Operation / Resource objects /
> > +VIRTIO-CRYPTO-RESOURCE-OBJ-IPSEC-INBOUND-
> > SA]{VIRTIO_CRYPTO_RESOURCE_OBJ
> > +_IPSEC_INBOUND_SA} & IPsec inbound SA resource object \\ \hline
> > +\end{tabularx}
> > +
> >  \subsection{Device Operation}\label{sec:Device Types / Crypto Device
> > / Device Operation}
> >
> >  The operation of a virtio crypto device is driven by requests placed
> > on the virtqueues.
> > @@ -2036,3 +2050,146 @@ \subsubsection{IPSEC Service
> > Operation}\label{sec:Device Types / Crypto Device /  \hline
> > \end{tabularx} \end{table}
> > +
> > +\paragraph{Resource objects}
> > +\label{par:Device Types / Crypto Device / Device Operation / IPsec
> > +Service Operation / Resource objects}
> > +
> >
> +\subparagraph{VIRTIO_CRYPTO_RESOURCE_OBJ_IPSEC_OUTBOUND_SA}\la
> be
> > l{par:D
> > +evice Types / Crypto Device / Device Operation / IPsec Service
> > +Operation / Resource objects /
> > +VIRTIO-CRYPTO-RESOURCE-OBJ-IPSEC-OUTBOUND-SA}
> > +
> > +A driver can have outbound SAs between 0 and \field{outb_sa_limit},
> > +as specified by the capability VIRTIO_CRYPTO_IPSEC_RESOURCE_CAP. For
> > +the IPsec outbound SA resource object
> > +\field{resource_obj_specific_data} is in the format \field{struct
> virtio_crypto_resource_obj_ipsec_sa_256b_key}.
> > +
> > +\begin{lstlisting}
> > +struct in_addr {
> > +        le32 s_addr;
> > +};
> > +
> > +struct in6_addr {
> > +        u8 s6_u8[16];
> > +};
> > +
> > +struct virtio_crypto_ipsec_tunnel_param {
> > +        /* Tunnel type: IPv4 or IPv6 */
> > +        u8 type;
> > +        u8 reserved[3];
> > +        union {
> > +                /* IPv4 tunnel header parameters */
> > +                struct {
> > +                        /* IPv4 source address */
> > +                        struct in_addr src_ip;
> > +                        /* IPv4 destination address */
> > +                        struct in_addr dst_ip;
> > +                        /* IPv4 Differentiated Services Code Point */
> > +                        u8 dscp;
> > +                        /* IPv4 Don't Fragment bit */
> > +                        u8 df;
> > +                        /* IPv4 Time To Live */
> > +                        u8 ttl;
> > +                        u8 reserved1;
> > +                } ipv4;
> > +                /* IPv6 tunnel header parameters */
> > +                struct {
> > +                        /* IPv6 source address */
> > +                        struct in6_addr src_addr;
> > +                        /* IPv6 destination address */
> > +                        struct in6_addr dst_addr;
> > +                        /* IPv6 flow label */
> > +                        le32 flabel;
> > +                        /* IPv6 hop limit */
> > +                        u8 hlimit;
> > +                        /* IPv6 Differentiated Services Code Point */
> > +                        u8 dscp;
> > +                        u8 reserved2[2];
> > +                } ipv6;
> > +        };
> > +};
> > +
> > +struct virtio_crypto_ipsec_lifetime {
> > +        le64 packets_soft_limit;
> > +        le64 bytes_soft_limit;
> > +        le64 packets_hard_limit;
> > +        le64 bytes_hard_limit;
> > +};
> > +
> > +struct virtio_crypto_resource_obj_ipsec_sa_256b_key {
> > +        u8 mode;
> > +        u8 direction;
> > +        u8 reserved[2];
> > +        le32 obj_id;
> > +        le32 spi;
> > +        le32 salt;
> > +        le64 options;
> > +        struct virtio_crypto_ipsec_tunnel_param param;
> > +        le64 esn;
> > +        le16 udp_sport;
> > +        le16 udp_dport;
> > +        le32 replay_win_sz;
> > +        le64 cipher_algo;
> > +        struct {
> > +            le16 length;
> > +            le16 reserved1;
> > +            u8 data[32];
> > +        } cipher_key;
> > +        le64 auth_algo;
> > +        struct {
> > +            le16 length;
> > +            le16 reserved2;
> > +            u8 data[32];
> > +        } auth_key;
> > +        struct virtio_crypto_ipsec_lifetime life; } \end{lstlisting}
> > +
> > +\field{mode} specifies the mode of the IPsec SA, see
> > +\ref{table:Device Types / Crypto Device / Device Operation / IPsec
> > +Service Operation / Device
> > and driver capabilities / VIRTIO-CRYPTO-IPSEC-SA-CAP / IPsec Modes}.
> > +
> > +\field{direction} specifies IPsec SA direction.
> > +\field{spi} is the Security Parameter Index(SPI) used to uniquely
> > +identify the
> > IPsec SA.
> > +\field{salt} is the 32 bit salt value used in the cryptographic operations.
> > +
> > +\field{options} specifies the Options for configuring the IPsec SA,
> > +see \ref{table:Device Types / Crypto Device / Device Operation /
> > +IPsec Service
> > Operation / Device and driver capabilities /
> > VIRTIO-CRYPTO-IPSEC-SA-CAP / IPsec Options}.
> > +
> > +\field{param} specifies the parameters for IPsec tunnel mode.
> > +\field{esn} is the starting sequence number.
> 
> The purpose of the "starting" sequence number is a bit confusing to me since
> according to the RFC the sequence number is always initialized to 0 after SA
> establishment.
> When this field was introduced in DPDK IPsec implementation it was for the
> purpose of debug and SA lifetime enforcement purposes, but is that needed
> and desirable here?
It was added for debug purpose only. We can remove it.
> 
> The explanations are a bit out of order as well.
> 
> > +\field{udp_sport} is the source port for UDP encapsulation.
> > +\field{udp_dport} is the destination port for UDP encapsulation.
> > +\field{replay_win_sz} is the anti-replay window size to enable
> > +sequence replay attack handling, replay checking is disabled if the window
> size is 0.
> > +
> > +\field{cipher_algo} is the cipher algorithm identifier see
> > +\ref{sec:Device Types / Crypto Device / Supported crypto services  /
> > +CIPHER services} \field{cipher_key} specifies the cipher key and its length.
> > +\field{auth_algo} is the Authentication algorithm identifier
> > +\field{auth_key} specifies the authentication key data and its length.
> > +\field{obj_id} specifies the object id of the SA that can be used to
> > +retrieve driver-defined data associated with the IPsec SA.
> > +\field{life} configures soft and hard lifetime of an IPsec SA. The
> > +Lifetime of an IPsec SA specifies the maximum number of packets or
> > +bytes that
> > can be processed.
> > +IPsec operations starts failing once any hard limit is reached. Soft
> > +limits generate a warning status when the SA is approaching its hard
> > +lifetime
> > limits.
> > +
> > +\begin{table}[H]
> > +\caption{IPsec Direction}
> > +\label{table:Device Types / Crypto Device / Device Operation / IPsec
> > +Service Operation / Device and driver capabilities /
> > +VIRTIO-CRYPTO-RESOURCE-OBJ-IPSEC-OUTBOUND-SA / IPsec Direction}
> > +\begin{tabularx}{\textwidth}{ |l|X|X| } \hline Type & Name &
> > +Description \\ \hline \hline
> > +0x0 & - & Reserved \\
> > +\hline
> > +0x1 & VIRTIO_CRYPTO_IPSEC_DIR_OUTBOUND & IPsec direction outbound
> \\
> > +\hline
> > +0x2 & VIRTIO_CRYPTO_IPSEC_DIR_INBOUND & IPsec direction inbound \\
> > +\hline \end{tabularx} \end{table}
> > +
> >
> +\subparagraph{VIRTIO_CRYPTO_RESOURCE_OBJ_IPSEC_INBOUND_SA}\labe
> l{
> > par:De
> > +vice Types / Crypto Device / Device Operation / IPsec Service
> > +Operation / Resource objects /
> > +VIRTIO-CRYPTO-RESOURCE-OBJ-IPSEC-INBOUND-SA}
> > +
> > +A driver can have inbound SAs between 0 and \field{inb_sa_limit}, as
> > +specified by the capability VIRTIO_CRYPTO_IPSEC_RESOURCE_CAP. For the
> > +IPsec inbound SA resource object \field{resource_obj_specific_data}
> > +is in the format \field{struct virtio_crypto_resource_obj_ipsec_sa}.
> > --
> > 2.25.1
Thanks.