From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0066.outbound.protection.outlook.com [104.47.33.66]) by dpdk.org (Postfix) with ESMTP id CBCF716E for ; Fri, 15 Dec 2017 11:04:29 +0100 (CET) Received: from BN6PR03CA0017.namprd03.prod.outlook.com (10.168.230.155) by DM5PR03MB2699.namprd03.prod.outlook.com (10.168.197.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.302.9; Fri, 15 Dec 2017 10:04:28 +0000 Received: from BL2FFO11FD023.protection.gbl (2a01:111:f400:7c09::117) by BN6PR03CA0017.outlook.office365.com (2603:10b6:404:23::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.302.9 via Frontend Transport; Fri, 15 Dec 2017 10:04:28 +0000 Authentication-Results: spf=fail (sender IP is 192.88.168.50) smtp.mailfrom=nxp.com; caviumnetworks.com; dkim=none (message not signed) header.d=none; caviumnetworks.com; dmarc=fail action=none header.from=nxp.com; Received-SPF: Fail (protection.outlook.com: domain of nxp.com does not designate 192.88.168.50 as permitted sender) receiver=protection.outlook.com; client-ip=192.88.168.50; helo=tx30smr01.am.freescale.net; Received: from tx30smr01.am.freescale.net (192.88.168.50) by BL2FFO11FD023.mail.protection.outlook.com (10.173.161.102) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_RSA_WITH_AES_256_CBC_SHA) id 15.20.302.6 via Frontend Transport; Fri, 15 Dec 2017 10:04:19 +0000 Received: from [10.232.134.49] ([10.232.134.49]) by tx30smr01.am.freescale.net (8.14.3/8.14.0) with ESMTP id vBFA4OeR024966; Fri, 15 Dec 2017 03:04:25 -0700 To: Anoob Joseph , Declan Doherty , Radu Nicolau , Sergio Gonzalez Monroy CC: Jerin Jacob , Narayana Prasad , References: <1513326606-21970-1-git-send-email-anoob.joseph@caviumnetworks.com> <1513327396-22178-1-git-send-email-anoob.joseph@caviumnetworks.com> <1513327396-22178-3-git-send-email-anoob.joseph@caviumnetworks.com> From: Akhil Goyal Message-ID: <408f66b2-b308-cbed-56fb-7d50f7f99724@nxp.com> Date: Fri, 15 Dec 2017 15:34:23 +0530 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: <1513327396-22178-3-git-send-email-anoob.joseph@caviumnetworks.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-EOPAttributedMessage: 0 X-Matching-Connectors: 131578058597182989; (91ab9b29-cfa4-454e-5278-08d120cd25b8); () X-Forefront-Antispam-Report: CIP:192.88.168.50; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10009020)(336005)(7966004)(346002)(39860400002)(396003)(376002)(39380400002)(2980300002)(1109001)(1110001)(339900001)(189003)(199004)(24454002)(77096006)(8936002)(356003)(305945005)(68736007)(81156014)(81166006)(2906002)(8676002)(36756003)(58126008)(316002)(64126003)(50466002)(31686004)(31696002)(47776003)(106466001)(105606002)(110136005)(86362001)(54906003)(229853002)(65956001)(65806001)(53936002)(67846002)(76176011)(2950100002)(2486003)(83506002)(5660300001)(498600001)(23676004)(85426001)(65826007)(4326008)(59450400001)(230700001)(53546011)(6246003)(97736004)(104016004); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR03MB2699; H:tx30smr01.am.freescale.net; FPR:; SPF:Fail; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11FD023; 1:MFzDywRiOVrc1CO+fio4df34Fw92wEM9iJ9ODRXe0JRfE401gVj3jQCXLBF5FYAVK9Q6lfyFY2IyDfXnlTKYzKezv4jGCs3tXq5ddooT5UNJVvCPpFiiB16rT2sA/EuN X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 514f37cb-5a25-4f39-ae0d-08d543a33562 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(5600026)(4604075)(4534020)(4628075)(201703131517081)(2017052603307); SRVR:DM5PR03MB2699; X-Microsoft-Exchange-Diagnostics: 1; DM5PR03MB2699; 3:Fss5ljtiTeSUr7u8iTmoTUyk2GXn52zg4PV6zt6+g7GDAIXjvFTe4GaQtmwqgY4mlXtbkZ5DtKhl871EeGGPf3fMK5lqyTzffcrimkojd6vpos8hr8DQIbxb/FL26/H71R0CNsEJ1R1OqIDMI5CvP6uynB73cwqrRwedTpA1yOrM663fNkHfavQvN6CWIvW1qKvR5oSQIr1HnivEGHgKvjmOh8mIN9hcAXkWtxLng1fowxWB/uj8TiCuAUcwFermHXtJ13GMr+l257TPvbRZ/WfXrnVImqjtsM15JJjEL47pZhYMdFFZzpsPFfHIa4j9HWhcyiHgYxVsuouTtk+/3w6SWgzYKyk5mi82p4T6sNs=; 25:0ekXij8Zkh+09STvt21p+7WPoSElDjvp1x+c7jT0o951o7GNHUxq4ArVB839pkcumiOPysrvQGT0m7W69NU/RYvBrtTJ6Mjq2R9NdGrzCe87+SJoeJcQ3sjazCGAdDRkpr/uBVs7e1f9k2BOer9h8/LUHV0pSq/cDJWorpJqQHHu1urFfDVYS7XncGAL9Se2zabsDTBadTo7fIqPoHyYwqcX6MrIPxSSWbPzkki8ifpDPKwcl8mT4wMB2zys2oScWgWLQBVzE5v8eVeg2DUPOtSMl6I51cs2XOXteVzZxGyJZKJK5etg8PXdIqW9oMHjBU4OZm/N1yCMrS/VikuU5Q== X-MS-TrafficTypeDiagnostic: DM5PR03MB2699: X-Microsoft-Exchange-Diagnostics: 1; DM5PR03MB2699; 31:Ca5+AveNEiUAIYE015aCXmXoXn2ghRIORsBOZqwQ/2NVbhr7iUBpZRS7DtN4MkpxRp4FtBOTrdMt3nlT8sZUsjYHBd1gsx7Kt/yarbDCZYFjMqgV15v4B9Mi9ryI4FT+yiRRexUbMSkS9VcKfAhBXHmO3NbgtktwWFq+pK1VDVx0QJ0m3OR7IWJKxbgakFvw8f7TiVC4RylItmHpTfdA3B0UJNWRZOrI24IEPnhazaM=; 4:yWnqBTWP8i6+WVo9j/OpD2azBhkhuwRS2aKGdXp1EgKrA7mRb6genCI3E1jMcFFuu/DaH9NvNOOnesFUi+con/y2WfjKb9SP/xC68rw09gRGpACe5YooIUSE7d1hai8I2LMgyEdJQFHE933GEdmrLI89ei+n25D0TvVOx5jptixDy1kq19LEdAAu9KRrb2KR5WXQG7ML6lAgJ3f9l3a8hn461BVPVPiFa8kc5TEt58auzMENPxeDsltvRapumtJKiMfQqTCYk6NDx7JT/FvZegBrMmaI8gyVPrprF/ihLsl+KzYGQA1X9CoahjdwVgOJ X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6095135)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231023)(3002001)(10201501046)(6055026)(6096035)(201703131430075)(201703131441075)(201703131448075)(201703131433075)(201703161259150)(20161123563025)(20161123561025)(20161123559100)(20161123556025)(20161123565025)(201708071742011); SRVR:DM5PR03MB2699; BCL:0; PCL:0; RULEID:(100000803101)(100110400095)(400006); SRVR:DM5PR03MB2699; X-Forefront-PRVS: 05220145DE X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtETTVQUjAzTUIyNjk5OzIzOndDRTBCdTF5cWRWVUc1aDZCWWtTMVVCdnpR?= =?utf-8?B?Y1NUV0N1aG1wMk1FeVlDNEVjRzNmUWozbkt6cmVjWWxORlZIQ3E3MzdDOE5i?= =?utf-8?B?VFdVVnV3b3ZESUxoQmk0Tm5MVmd3bU1WSzd6eFpEaGN0VndNRlpQVWZabVJS?= =?utf-8?B?aEJBeHZGeldYZ3lMS2d1ZnF5endzcUI1eVVPZkViSWxOMnFWRjN3MUZCYzhw?= =?utf-8?B?OWVyWHRvTmI5R1FSN2g3UjFzWGhEeFJITVhETVcrS2I2Z0JYMGtsSU1QakJD?= =?utf-8?B?THB0VERHTXhDb0NHbjBzNmErSm1HRy9ycFBZdm02REQ2RnJiQ2FEelZDbkZQ?= =?utf-8?B?aU83dk5rVkJMMTgvK3F0MXo4ZG9KaEJBYnFSNjZPSlV2YU9Bc1ZlRTJ3VU1H?= =?utf-8?B?NUVKaEI0WXpydXVSK1RWSG9EVHJXU3NQbXUwY1dSMXFlWHFhRzI1Mlh0bkNU?= =?utf-8?B?UEwrRFRsYkJYK3g4V09aTUlWNWtCOFA0YndoUUZhNG1OTStMVTVuSGVaY1Bi?= =?utf-8?B?K0N1bGFLTHBKN1dtYkRuNEJQTjY0RmJhWTRJcjJNZlIwT0NBLzlHeWx2bTBp?= =?utf-8?B?Y1hTWDRBdENnOVAwQlRYWDkyeVJWM1hHL0YzcFRtZnh1dEtQK0ZTUXljTlEz?= =?utf-8?B?MmlGK01GVUhod1UzYlpuNFlabzhFek1aaEo3WlpYSmtaZzcxYTBGUGQyalRt?= =?utf-8?B?WFpQUHJ2cy9ydXJmTzU1UmpmQWkxNjdrRGpPREpzYkN5UGtVSy9LaEdGcnFG?= =?utf-8?B?VjhkTC9OaVNnYW1qaExvQTZFL3BpcHEyZWlhMElZMTFmc1U0c3ZHWkdXbFMy?= =?utf-8?B?Mmk2REg4c1ZyUWVpMjJhdnNNK3M0UC9zczBKVmY3emVRUHF2VzdwY0FhSmtE?= =?utf-8?B?WU1OdlJOSVRxRG5FRzZtRitidE5TcktYY0NhWjhyakxLbHAwRTh4dE14TzJm?= =?utf-8?B?QlhCTTdoY1BKZk9jSUx2Z0FpU1U1TUkrRlpvRHpWcG9Ob0w3U0JIdThWaXlD?= =?utf-8?B?SXpHZ25oMnNxTndKUzFvR00yUHhrczlUWjhnL0xldllUbk8vcGVBTkZvbWFj?= =?utf-8?B?V1p4YWhNYVh6MGhabGFmU2x6a1dsQ1V0NmRHeFdEcjNCeTdHUEh3cm5VRzVF?= =?utf-8?B?eCtCWlREakFFbHE2VUpkSnZEVnJwSEdqS2owNHNZN0VxNmV4aFY2NVhlaWtk?= =?utf-8?B?VlJSN1NCelNFT0w3L2MwbzQ2QzcyalB1TjRqQzZmQ1ZoeWtvYWcwU2RjYXZE?= =?utf-8?B?VFhhMXdNK2g5RDZDbFllYTBqSmpGNW5pNEdzczhLbTkxakNhRmQ1alA0KzJL?= =?utf-8?B?c1BSSWdZeEdXZ0EyM1MxVlFzQ0xVbUwyRVdGUUFVMUx1WWNNaXlkbk9vOTZw?= =?utf-8?B?OXArU1YyUERtSHhLODAybkl5L2o5cUlwYVFwZUxCRERZQ0hOT2hucVVGSGp6?= =?utf-8?B?b0RFNVdDMTNPcysvaGlNbkpsVk5HbGliZ3o1a2VTOHl6VEJZNytsOWhFaGp1?= =?utf-8?B?cFZkTklEb21Ec3FreEJuKzZqUDUzNWxQK3dvaVNUUXAvZFYrQTB5aGNLTU9h?= =?utf-8?B?c3lhS2JPcWtZR1hPUTl5anVQNWI0ZGpOYWlVWXltdGtFc2oxMzhuNHVzaEIv?= =?utf-8?B?bDBVRHpDeVIyKzYrLzdoTDBEMGVZQWlPMWRIY0tIMWZZUm5qR09NN2FPWkk5?= =?utf-8?B?SmdBaTg0eTVPU05kREJ4c25rSXpuMGFzZnhIajlBSTVOMnBkNXkvd1A5em92?= =?utf-8?B?Ukd0OHI5OTk1cFQzVkVIWk9EZ2FlNGppRHpjWmE1c0ZPUGQwTlN4dDY0STNk?= =?utf-8?Q?YXIT8o963FS5s?= X-Microsoft-Exchange-Diagnostics: 1; DM5PR03MB2699; 6:Lpe73uTGE0kSWSgH89C3752qF92TqbbE/tovWCfVDpErzoPL/bCrSefKHOlK/kKfMj6Qh2puEM9Sh/hGQK8rhClYyTX+x+vjr1+sy2HnwxwOBcaZgLaCJrEAxzAaaFVE1ipo3D8VOuSVjRhcSZgqZEbk7Jtx2qGuA4CQZ9jh1sHEOkdmbko4QlQ/2ZJcp+NXRgMp+bQoaTZ0fl83hMIJjz/SvXeObH2C+sOwfvZN2bVzrzrAe0iMAhgsoTgyMpOYIgbsDRde1WeQVYxHIsY3pq0PLqymUGilCZt7jq2dap/Fx9voVYoxaiF9Rmwj8We0y4e51AcMFEOSUGGJ9iJGw5P5T4GHAawD1oUMOXYZv4I=; 5:23ZzKy7YHzvx/Y0risbgt8izIKWH75nrDN/KDKCz2joYIeZZOX59646EyRdg6+0J0DvdaImPqzCvTwFzgP/KtxQk9ffI8DIC7mGmK/YIJjDj6CiuW1pi1VDDmhJ1ybmJ0s4kRNxWRkuo6b78mqQ6W08jH9X6AbAfy2a8RU/3OsI=; 24:utU6i819f2YeEuW0d/lJmQ/aJFqO/dtfTvEuWG8eYw+EIlo3DLi7cf711+kJD3XxoHT+7jznHFumy2IzqP7lJIRZlGRMFW98kVW+hEbhbkg=; 7:qMQm7iJ1oD9Tl2j6B30Da0GMa6EnWZ17YZrCk4t8Gep/sOL0DzpYZP5PJxcD3Wgq+qWncUoTnm0mB6kHeOQ4jvDUj36uGFNgg2Ml8nH3MzhWpysoxJDq5rMVxPJb83D4dSwfMsu7tMoIQvpt6HwOI+7bDWI+Q3Kt+yO5QpqwwniFWGqSQK3aP2lsJ3/+SvQA5waa/dyFM3bZIRk1M0lkCQIEGFgfe7mu23C9TvtczeKCvgkM/zE8J55HLbtcG6VN SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Dec 2017 10:04:19.4843 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 514f37cb-5a25-4f39-ae0d-08d543a33562 X-MS-Exchange-CrossTenant-Id: 5afe0b00-7697-4969-b663-5eab37d5f47e X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5afe0b00-7697-4969-b663-5eab37d5f47e; Ip=[192.88.168.50]; Helo=[tx30smr01.am.freescale.net] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR03MB2699 Subject: Re: [dpdk-dev] [PATCH v5 2/2] examples/ipsec-secgw: add support for inline protocol X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Dec 2017 10:04:30 -0000 On 12/15/2017 2:13 PM, Anoob Joseph wrote: > Adding support for inline protocol processing > > In ingress side, application will receive regular IP packets, without > any IPsec related info. Application will do a selector check (SP-SA > check) by making use of the metadata from the packet. The > device-specific metadata in mbuf would aid in determing the security > session which processed the packet. > > In egress side, the plain packet would be submitted to the driver. The > packet will have optional metadata, which could be used to identify the > security session associated with the packet. > > Signed-off-by: Anoob Joseph > --- > v5: > * Fixed checkpatch reported warnings > > v4: > * Directly using rte_mbuf.udata64 as the metadata from the packet > * Removed usage of rte_security_get_pkt_metadata API > > v3: > * Using (void *)userdata instead of 64 bit metadata in conf > * Changes parallel to the change in API > > v2: > * Using get_pkt_metadata API instead of get_session & get_cookie APIs > > examples/ipsec-secgw/esp.c | 6 +- > examples/ipsec-secgw/ipsec-secgw.c | 42 ++++++++++++- > examples/ipsec-secgw/ipsec.c | 121 +++++++++++++++++++++++++++++++------ > 3 files changed, 147 insertions(+), 22 deletions(-) > > diff --git a/examples/ipsec-secgw/esp.c b/examples/ipsec-secgw/esp.c > index c3efe52..561f873 100644 > --- a/examples/ipsec-secgw/esp.c > +++ b/examples/ipsec-secgw/esp.c > @@ -178,7 +178,8 @@ esp_inbound_post(struct rte_mbuf *m, struct ipsec_sa *sa, > RTE_ASSERT(sa != NULL); > RTE_ASSERT(cop != NULL); > > - if (sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) { > + if ((sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) || > + (sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO)) { > if (m->ol_flags & PKT_RX_SEC_OFFLOAD) { > if (m->ol_flags & PKT_RX_SEC_OFFLOAD_FAILED) > cop->status = RTE_CRYPTO_OP_STATUS_ERROR; > @@ -474,7 +475,8 @@ esp_outbound_post(struct rte_mbuf *m, > RTE_ASSERT(m != NULL); > RTE_ASSERT(sa != NULL); > > - if (sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) { > + if ((sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) || > + (sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO)) { > m->ol_flags |= PKT_TX_SEC_OFFLOAD; > } else { > RTE_ASSERT(cop != NULL); > diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec-secgw/ipsec-secgw.c > index c98454a..8254056 100644 > --- a/examples/ipsec-secgw/ipsec-secgw.c > +++ b/examples/ipsec-secgw/ipsec-secgw.c > @@ -265,6 +265,40 @@ prepare_one_packet(struct rte_mbuf *pkt, struct ipsec_traffic *t) > RTE_LOG(ERR, IPSEC, "Unsupported packet type\n"); > rte_pktmbuf_free(pkt); > } > + > + /* Check if the packet has been processed inline. For inline protocol > + * processed packets, the metadata in the mbuf can be used to identify > + * the security processing done on the packet. The metadata will be > + * used to retrieve the application registered userdata associated > + * with the security session. > + */ > + > + if (pkt->ol_flags & PKT_RX_SEC_OFFLOAD) { > + struct ipsec_sa *sa; > + struct ipsec_mbuf_metadata *priv; > + struct rte_security_ctx *ctx = (struct rte_security_ctx *) > + rte_eth_dev_get_sec_ctx( > + pkt->port); > + > + /* Retrieve the userdata registered. Here, the userdata > + * registered is the SA pointer. > + */ > + > + sa = (struct ipsec_sa *) > + rte_security_get_userdata(ctx, pkt->udata64); > + > + if (sa == NULL) { > + /* userdata could not be retrieved */ Is it mandatory to get userdata for all devices which support PKT_RX_SEC_OFFLOAD? I believe not. So you cannot return from here if the device does not need userdata. > + return; > + } > + > + /* Save SA as priv member in mbuf. This will be used in the > + * IPsec selector(SP-SA) check. > + */ > + > + priv = get_priv(pkt); > + priv->sa = sa; > + } > } > > static inline void > @@ -401,11 +435,17 @@ inbound_sp_sa(struct sp_ctx *sp, struct sa_ctx *sa, struct traffic_type *ip, > ip->pkts[j++] = m; > continue; > } > - if (res & DISCARD || i < lim) { > + if (res & DISCARD) { > rte_pktmbuf_free(m); > continue; > } > + > /* Only check SPI match for processed IPSec packets */ > + if (i < lim && ((m->ol_flags & PKT_RX_SEC_OFFLOAD) == 0)) { > + rte_pktmbuf_free(m); > + continue; > + } > + > sa_idx = ip->res[i] & PROTECT_MASK; > if (sa_idx == 0 || !inbound_sa_check(sa, m, sa_idx)) { > rte_pktmbuf_free(m); > diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c > index 70ed227..bd68ec6 100644 > --- a/examples/ipsec-secgw/ipsec.c > +++ b/examples/ipsec-secgw/ipsec.c > @@ -46,6 +46,27 @@ > #include "ipsec.h" > #include "esp.h" > > +static inline void > +set_ipsec_conf(struct ipsec_sa *sa, struct rte_security_ipsec_xform *ipsec) > +{ > + if (ipsec->mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) { > + struct rte_security_ipsec_tunnel_param *tunnel = > + &ipsec->tunnel; > + if (sa->flags == IP4_TUNNEL) { > + tunnel->type = > + RTE_SECURITY_IPSEC_TUNNEL_IPV4; > + tunnel->ipv4.ttl = IPDEFTTL; > + > + memcpy((uint8_t *)&tunnel->ipv4.src_ip, > + (uint8_t *)&sa->src.ip.ip4, 4); > + > + memcpy((uint8_t *)&tunnel->ipv4.dst_ip, > + (uint8_t *)&sa->dst.ip.ip4, 4); > + } > + /* TODO support for Transport and IPV6 tunnel */ > + } > +} > + > static inline int > create_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) > { > @@ -95,7 +116,8 @@ create_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) > RTE_SECURITY_IPSEC_SA_MODE_TUNNEL : > RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT, > } }, > - .crypto_xform = sa->xforms > + .crypto_xform = sa->xforms, > + .userdata = NULL, > > }; > > @@ -104,23 +126,8 @@ create_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) > rte_cryptodev_get_sec_ctx( > ipsec_ctx->tbl[cdev_id_qp].id); > > - if (sess_conf.ipsec.mode == > - RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) { > - struct rte_security_ipsec_tunnel_param *tunnel = > - &sess_conf.ipsec.tunnel; > - if (sa->flags == IP4_TUNNEL) { > - tunnel->type = > - RTE_SECURITY_IPSEC_TUNNEL_IPV4; > - tunnel->ipv4.ttl = IPDEFTTL; > - > - memcpy((uint8_t *)&tunnel->ipv4.src_ip, > - (uint8_t *)&sa->src.ip.ip4, 4); > - > - memcpy((uint8_t *)&tunnel->ipv4.dst_ip, > - (uint8_t *)&sa->dst.ip.ip4, 4); > - } > - /* TODO support for Transport and IPV6 tunnel */ > - } > + /* Set IPsec parameters in conf */ > + set_ipsec_conf(sa, &(sess_conf.ipsec)); > > sa->sec_session = rte_security_session_create(ctx, > &sess_conf, ipsec_ctx->session_pool); > @@ -206,6 +213,70 @@ create_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) > err.message); > return -1; > } > + } else if (sa->type == > + RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) { > + struct rte_security_ctx *ctx = > + (struct rte_security_ctx *) > + rte_eth_dev_get_sec_ctx(sa->portid); > + const struct rte_security_capability *sec_cap; > + > + if (ctx == NULL) { > + RTE_LOG(ERR, IPSEC, > + "Ethernet device doesn't have security features registered\n"); > + return -1; > + } > + > + /* Set IPsec parameters in conf */ > + set_ipsec_conf(sa, &(sess_conf.ipsec)); > + > + /* Save SA as userdata for the security session. When > + * the packet is received, this userdata will be > + * retrieved using the metadata from the packet. > + * > + * This is required only for inbound SAs. > + */ > + > + if (sa->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) > + sess_conf.userdata = (void *) sa; > + > + sa->sec_session = rte_security_session_create(ctx, > + &sess_conf, ipsec_ctx->session_pool); > + if (sa->sec_session == NULL) { > + RTE_LOG(ERR, IPSEC, > + "SEC Session init failed: err: %d\n", ret); > + return -1; > + } > + > + sec_cap = rte_security_capabilities_get(ctx); > + > + if (sec_cap == NULL) { > + RTE_LOG(ERR, IPSEC, > + "No capabilities registered\n"); > + return -1; > + } > + > + /* iterate until ESP tunnel*/ > + while (sec_cap->action != > + RTE_SECURITY_ACTION_TYPE_NONE) { > + > + if (sec_cap->action == sa->type && > + sec_cap->protocol == > + RTE_SECURITY_PROTOCOL_IPSEC && > + sec_cap->ipsec.mode == > + RTE_SECURITY_IPSEC_SA_MODE_TUNNEL && > + sec_cap->ipsec.direction == sa->direction) > + break; > + sec_cap++; > + } > + > + if (sec_cap->action == RTE_SECURITY_ACTION_TYPE_NONE) { > + RTE_LOG(ERR, IPSEC, > + "No suitable security capability found\n"); > + return -1; > + } > + > + sa->ol_flags = sec_cap->ol_flags; > + sa->security_ctx = ctx; > } > } else { > sa->crypto_session = rte_cryptodev_sym_session_create( > @@ -323,7 +394,19 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, > } > break; > case RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL: > - break; > + if ((unlikely(sa->sec_session == NULL)) && > + create_session(ipsec_ctx, sa)) { > + rte_pktmbuf_free(pkts[i]); > + continue; > + } > + > + cqp = &ipsec_ctx->tbl[sa->cdev_id_qp]; > + cqp->ol_pkts[cqp->ol_pkts_cnt++] = pkts[i]; > + if (sa->ol_flags & RTE_SECURITY_TX_OLOAD_NEED_MDATA) > + rte_security_set_pkt_metadata( > + sa->security_ctx, > + sa->sec_session, pkts[i], NULL); > + continue; > case RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO: > priv->cop.type = RTE_CRYPTO_OP_TYPE_SYMMETRIC; > priv->cop.status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED; >