RE: [EXTERNAL] Re: [PATCH RFC v6 0/4] introduce IPsec Service in virtio-crypto

> On Thu, Apr 24, 2025 at 03:00:42PM +0530, Srujana Challa wrote:
> > This series enhances virtio-crypto by adding support for IPsec
> > services. These patches aim to extend the capabilities of
> > virtio-crypto, enabling it to handle IPsec operations efficiently. In
> > addition to standard crypto processing, the IPsec protocol processing
> > is also offloaded to the Crypto device as lookaside operation.
> >
> > It utilizes new virtio basic facilities, including capability and
> > resource objects. Below is a summary of the changes introduced:
> 
> please do submit a non RFC version before you ask for a vote.
Sure, will do.
> can you explain in a bit more detail how you envision this interacting with the
> virtio-net patches you also proposed?
There isn't a direct interaction between the virtio-net and virtio-crypto devices.
Instead, virtio-net leverages certain definitions and structures from virtio-crypto
to avoid redundancy. Here is a detailed breakdown,
1. Reuse of Resource Objects and capabilities Data Structures
Virtio-Net: Utilizes the resource object and capability data structures defined in the virtio-crypto patches.
Virtio-Crypto: Defines these resource objects and capabilities to support IPsec operations within its framework.
2. Crypto Algorithm Definition Macros
Virtio-Net: Reuses the cryptographic algorithm definition macros from virtio-crypto. This reuse helps maintain consistency in how cryptographic algorithms are defined and used across both frameworks.
Virtio-Crypto: Provides these macros to standardize the definition of cryptographic algorithms.
3. Command Type Values
Capability Command Type: The command type values for capabilities are different between virtio-net and virtio-crypto. This distinction ensures that each framework can manage its capabilities independently without conflicts.
Resource Object Command Type: Similarly, the command type values for resource objects are unique to each framework, allowing virtio-net and virtio-crypto to handle their respective resource objects separately.
> 
> 
> > Patch1:
> > This patch introduces the foundational support for IPsec services
> > within the virtio-crypto framework, outlining the necessary
> > capabilities for IPsec operations.
> >
> > Patch2:
> > This patch adds resource objects required for programming IPsec
> > Security Associations (SAs) for both encryption and decryption processes.
> >
> > Patch3:
> > This patch includes new opcodes specific to IPsec operations,
> > facilitating the handling of IPsec data requests within the
> > virtio-crypto driver.
> >
> > Patch4:
> > This patch specifies the requirements for both the device and the
> > driver to support IPsec operations.
> >
> > These enhancements are for providing support for IPsec within the
> > virtio-crypto device/driver, improving security and performance for
> > virtualized environments. We believe these additions will
> > significantly benefit users who rely on virtio-crypto for secure data
> transmission.
> >
> > v2:
> > - Addressed the review comments from Matias.
> > v3:
> > - Addressed the review comments from Parav Pandit.
> > v4:
> > - Introduced COPY_DF, ECN and SA LIFETIME to the SA options.
> > - Introduced SA lifetime to the SA resource object data structure.
> > - Set cipher and auth key arrays to fixed sizes.
> > v5:
> > - Addressed minor review comments from Parav Pandit.
> > v6:
> > - The esn field has been removed from the IPsec SA resource object.
> >
> > Srujana Challa (4):
> >   virtio-crypto: Add IPsec service operation and Capabilities
> >   virtio-crypto: Add resource objects for IPsec outbound and inbound SAs
> >   virtio-crypto: Add new IPsec opcodes to data request
> >   virtio-crypto: Add device and driver requirements for IPsec
> > operation
> >
> >  device-types/crypto/description.tex        | 510 ++++++++++++++++++++-
> >  device-types/crypto/device-conformance.tex |   1 +
> >  device-types/crypto/driver-conformance.tex |   1 +
> >  introduction.tex                           |  12 +
> >  4 files changed, 519 insertions(+), 5 deletions(-)
> >
> > --
> > 2.25.1
Thanks.