rte_security: enabling IPsec hw acceleration

Transcription

1 rte_secrity: enabling IPsec hw acceleration Boris Pismenny (Mellanox) Declan Doherty (Intel) Hemant Agrawal (NXP) DPDK Smmit - San Jose 2017 #DPDKSmmit

2 Introdction Framework for management and provisioning of hardware acceleration of secrity protocols. Generic APIs to manage secrity sessions. Secrity acceleration fnctions are accessed throgh secrity instances which can instantiated on any device type, crrent spports secrity instances on Crypto and Ethernet devices. Rich capabilities discovery APIs Crrent only targets the spport of IP Secrity (IPsec) protocol. Cold spport a wide variety of protocols/applications Enterprise/SMB VPNs IPsec Wireless backhal IPsec, PDCP Data-center SSL WLAN backhal CAPWAP/DTLS Control-plane options for above PKCS, RNG Secrity Library Net PMD Crypto PMD 2

3 Commnity Collaboration Collaborative work between Intel, Mellanox and NXP with contribtions from: Hemant Agrawal, Declan Doherty, Akhil Goyal, Rad Nicola, Boris Pismenny, and Aviad Yehezkel. rte_secrity is now part of DPDK as *Experimenal* API 3

4 Inline Crypto Acceleration IO based acceleration performed on the physical interface as packet ingress/egress the system. No packet headers modifications on the hardware, only encryption/decryption and athentication operations are preformed. Hardware may spport extra featres like payload padding, setting of etc. SET INLINE METADATA [ inline crypto == Yes ] L3 SP/SA LOOKUP IPSec IPSEC PRECRYPTO HOST CRYPTO IPSEC POSTCRYPTO L3/L2 PMD INLINE OTHER CRYPTO FILTER PIPELINE STAGES EGRESS INLINE CRYPTO 4

5 Lookaside Protocol Acceleration Lookaside acceleration model where packet is given to an accelerator for processing and then retrned to the host after processing is complete. Secrity fnction is provided as an extension of a librte_cryptodev crypto PMD. Secrity session is sed in place of crypto session in crypto op when enqeing and deqeing packets to the crypto PMD. Spports fll protocol (IPsec) processing on the accelerator. Inclding: Add/remove protocol headers Handling SA state information 5

6 Library Featres Protocol agnostic session API for the management of protocol state on nderlying hardware. Definitions of spported protocols, crrently only IPsec, and the parameters for configring the options. For IPsec this incldes: Acceleration type inline crypto/lookaside protocol/inline protocol Defining secrity association (SA) parameters sch as Tnnel/Transport, ESP/AH, Ingress/Egress as well as associated crypto processing and key material Crypto operations are defined sing primitives defined in librte_cryptodev limit any redefinition of parameters within DPDK. Capabilities APIs to allow dynamic discovery of a instances featres. 6

7 Session Management Session APIs spport Create Session strct rte_secrity_session * rte_secrity_session_create(int16_t id, strct rte_secrity_session_conf *conf, strct rte_mempool *mp); Update Destroy Qery (Get Stats) /** secrity session configration parameters */ strct rte_secrity_session_conf config = {.action_type = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO, /**< Type of action to be performed on the session */.protocol = RTE_SECURITY_PROTOCOL_IPSEC, /**< Secrity protocol to be configred */.ipsec = {.spi = /**< Secrity Protocol Index */,.salt = /** Salt vale */,.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL }, /**< Configration parameters for secrity session */.crypto_xform = /** crypto transforms*/ /**< Secrity Session Crypto Transformations */ }; 7

8 Flow Action Programming (Inline Crypto) /** flow parameters */ attr->ingress = 1; /** attr->egress = 1 */ pattern[0].type = RTE_FLOW_ITEM_TYPE_ETH; pattern[1].type = RTE_FLOW_ITEM_TYPE_IPV4; pattern[2].type = RTE_FLOW_ITEM_TYPE_ESP; pattern[3].type = RTE_FLOW_ITEM_TYPE_END; Pattern[1] action[0].type = RTE_FLOW_ACTION_TYPE_SECURITY; action[0].conf = sa->sec_session; action[1].type = RTE_FLOW_ACTION_TYPE_ PASSTHRU; action[2].type = RTE_FLOW_ACTION_TYPE_END; Pattern[2] SW HW 8

9 Smmary Provides an abstraction for provisioning secrity hw accelerations, initially targeting IPsec. Can be sed with ethdev and cryptodev rte_secrity + rte_flow = powerfl control plane Agnostic API to allow applications to se different secrity accelerations. IPsec Secrity Gateway Sample application is available today sing rte_secrity to spport inline crypto (on Intel s IXGBE NET PMD) and lookaside protocol acceleration (on NXP s DPAA2 CRYPTO PMD). Go try it ot! 9

10 Ftre Work Frther IPsec enablement Frther encapslations LSO + checksm IPsec inline protocol offload Frther protocol enablement MACsec, PDCP, DTLS, etc wold fit nder this model. Software eqivalent enablement It cold be possible to offer software eqivalent processing nder this API, may or may not be desirable depending on protocol and it s processing overhead. 10

11 Boris Pismenny (Mellanox) Qestions? Declan Doherty (Intel) Hemant Agrawal (NXP)