From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 15075A0588; Thu, 16 Apr 2020 13:49:29 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id E0D011DBDE; Thu, 16 Apr 2020 13:49:28 +0200 (CEST) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by dpdk.org (Postfix) with ESMTP id E73021DB4F for ; Thu, 16 Apr 2020 13:49:25 +0200 (CEST) IronPort-SDR: wkubWY3gLJ88DuMm3EjRMXdKl8l0uAhCrPNRx1DMruo0PyBF9q0rWS/UGk4R+HiFE1f9XRM66Q 5SgdL1UiqjGg== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Apr 2020 04:49:24 -0700 IronPort-SDR: EKWLy+yJx5oWlipDEb6T6YsmNuQ2d8nVHbbEawT/rk/94cZ+I5WNH6HY9+MqzzEGp3VBRmX6Gg SFJCwXms1qNg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,390,1580803200"; d="scan'208";a="363975098" Received: from orsmsx101.amr.corp.intel.com ([10.22.225.128]) by fmsmga001.fm.intel.com with ESMTP; 16 Apr 2020 04:49:24 -0700 Received: from orsmsx601.amr.corp.intel.com (10.22.229.14) by ORSMSX101.amr.corp.intel.com (10.22.225.128) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 16 Apr 2020 04:49:23 -0700 Received: from orsmsx606.amr.corp.intel.com (10.22.229.19) by ORSMSX601.amr.corp.intel.com (10.22.229.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Thu, 16 Apr 2020 04:49:23 -0700 Received: from ORSEDG001.ED.cps.intel.com (10.7.248.4) by orsmsx606.amr.corp.intel.com (10.22.229.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.1.1713.5 via Frontend Transport; Thu, 16 Apr 2020 04:49:23 -0700 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (104.47.56.171) by edgegateway.intel.com (134.134.137.100) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 16 Apr 2020 04:49:23 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aTij8U5WxaovqYXJBmH4xUVI9Yec9QKwyrA7XTWATcQbgl9Fgpg/UxsOq42I0d5USxAyqECnlzENAykK0mGqnRTEi6SLJoZAYf3fA2B/3TlRfbAhq2HhI9b/3ZgKJcDoAIf3qb61hfcbLZDt7LNl4j6mhCcMIIXKtXJwBOffQ+ePpIqA0cLkM7c5QPLsEbLw8HOYuPDxfbXodL6FaJ8OqtksnVFVWTlcF97+eUsDyp9o0q9JlaNo4KGAL5HSqRfizvyQCMAPkPIeUmA/7LOUUZhhmmZkezYuJWKlrL3Ahhdl8jLkRmQPpSV7zn4ogro8HRoyUQRbNfBCuUmL5pAm7g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=w2LSBEpydm7z8SOGcR8DdWqht8hbF0QYlKGsu054nBg=; b=EtqrxGHiZ4g98WMd7dIF9kOC6I6ml6OoqBwIVZd8eAZXjJ/gtUjnhJRiFLG6qieckRQy97dIvY3p5rLRkiR5i3ME5bZOaVEYXswVEJe8fTKqtjeD7PvXQ0OpjHr4RtCe1t7wVYLLye/UFvi++4nrcTXbhU/04NCm2977KBPXf1aAJUZgcvQPBVTkq6tNzDsabecAHYSbNblvIYd6zQ0aJ2/EBXJObp5SZlbW52GISe2DhxkHRJz718geKsveibpefCQKq2zeD3hH7ygYgqGWRcNYFjQh17m+bzOeBnsilmwELRumvrC7UQu6C6IaGlmG68E944Agkl+t13fFSt1Oiw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel.onmicrosoft.com; s=selector2-intel-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=w2LSBEpydm7z8SOGcR8DdWqht8hbF0QYlKGsu054nBg=; b=T5/tc1+tBvViWeMoDNLaHb3rJauGeo9G7gCtYtpvU3X/Hb9Di4lQuLNe3ubRT7/6BUDwMVNk9pIF777ZfPm43+sqasQ3rEfCTBySp0gHnOl28bxdk+HlUKJai3uEAaj5KEhvQBk8W2L7a0PDUTXiDqciygrZX3jaFNZaVsPfLTc= Received: from CY4PR1101MB2326.namprd11.prod.outlook.com (2603:10b6:903:b3::23) by CY4PR1101MB2343.namprd11.prod.outlook.com (2603:10b6:903:ba::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2921.25; Thu, 16 Apr 2020 11:49:22 +0000 Received: from CY4PR1101MB2326.namprd11.prod.outlook.com ([fe80::58c7:7df:1b11:9c56]) by CY4PR1101MB2326.namprd11.prod.outlook.com ([fe80::58c7:7df:1b11:9c56%4]) with mapi id 15.20.2921.027; Thu, 16 Apr 2020 11:49:22 +0000 From: "Shetty, Praveen" To: Akhil Goyal , "dev@dpdk.org" , "Doherty, Declan" , "anoobj@marvell.com" CC: "Iremonger, Bernard" , "Ananyev, Konstantin" Thread-Topic: [PATCH v5] examples/ipsec-secgw: support flow director feature Thread-Index: AQHWE1gsBmPHGL0bS0GojsPFynv0w6h7Lh3w Date: Thu, 16 Apr 2020 11:49:21 +0000 Message-ID: References: <20200408141342.29573-1-praveen.shetty@intel.com> <20200409100950.37292-1-praveen.shetty@intel.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNDY3NjY5ZjQtYjRjMS00NWViLTkwYzItNmQ1NmNiOWYzMzMwIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiYmdkXC9janlzQ1kxaFAzZWN3MVU1MWFTQ2hkenp3V1pyZG50enkzWEtFdWE2dkN1cDlBdktWbUZZaG9saWExSGoifQ== dlp-product: dlpe-windows dlp-reaction: no-action dlp-version: 11.2.0.6 x-ctpclassification: CTP_NT authentication-results: spf=none (sender IP is ) smtp.mailfrom=praveen.shetty@intel.com; x-originating-ip: [192.55.79.96] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a0a53204-c187-42e8-b72b-08d7e1fc3443 x-ms-traffictypediagnostic: CY4PR1101MB2343: x-ld-processed: 46c98d88-e344-4ed4-8496-4ed7712e255d,ExtAddr x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:2000; x-forefront-prvs: 0375972289 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CY4PR1101MB2326.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(396003)(136003)(376002)(346002)(366004)(39860400002)(4326008)(9686003)(81156014)(86362001)(5660300002)(107886003)(8676002)(55016002)(478600001)(71200400001)(76116006)(7696005)(66946007)(6506007)(53546011)(316002)(110136005)(54906003)(8936002)(33656002)(52536014)(2906002)(66556008)(64756008)(66476007)(66446008)(186003)(26005)(30864003); DIR:OUT; SFP:1102; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: nfe3mlSXrutFZP7/lwKZHrXfbqWbR4x9fkCuxZWN+UblV2x3eoZP8SSOpStrCJ5rtwOckdHCRZjHYcSY2wWxko+76xRwVmnKSoGrDAWfRWb3GLpkOWYQlf8xvsejlekrzt2eN+QnDNWU77iF4ogXjcuqc9vGHWqhXxfYSxl93y9b/QmBp8vmX5YSHMoM8aUagGLT7kWlpX4/eCM6vaZZB1f2JC3iRgS2+x/oTqk8LFSosItVXpTkdEwO11ZLrv+Hhhzi9cSDnbVnWpHGc1d5ARdCkPUhre07ieJ9P+Ex8Hpb+1WYOEov2WxyH1f3Y++CdtrH4DLwIR+4aSIWvgo5S3l5trEV2Gu0b755s7a9O4VBKmAYlLhJuvDSBl//JsCvqdd7Msrc8cBKYs20q0jwF/2KfyQS5K9Oi2JqZMPA2gfnVlGElRlNyawpHeHTOqMX x-ms-exchange-antispam-messagedata: IqTyT0geTxlhQyPQ33Z3KaFQtgij9SgRx1h8gvGn/BtwbvyNeesDggp3Q8+Fa53R7BDMW3OcLoextA0WvPvWTrCKyfoq0+zfyrEvcKa1N39N2mVGW+nvUBrKIABf3UWaJuQGsoRM7OksQmmqFknU9A== Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: a0a53204-c187-42e8-b72b-08d7e1fc3443 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Apr 2020 11:49:22.0286 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: UO3+hgUhUaiI9wD9+8+xIlzetp1rTnnV+1U1njB39lBwaEtcV+S4jlxk73d4kqOAXqiRv8H9laVGWxNV5c3bCSs69rnXtSmHrkH8oZx9Y2A= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1101MB2343 X-OriginatorOrg: intel.com Subject: Re: [dpdk-dev] [PATCH v5] examples/ipsec-secgw: support flow director feature X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi Akhil, Thank you. Please see my response inline. -----Original Message----- From: Akhil Goyal =20 Sent: Thursday, April 16, 2020 12:30 AM To: Shetty, Praveen ; dev@dpdk.org; Doherty, Decl= an ; anoobj@marvell.com Cc: Iremonger, Bernard ; Ananyev, Konstantin <= konstantin.ananyev@intel.com> Subject: RE: [PATCH v5] examples/ipsec-secgw: support flow director feature Hi Praveen, >=20 > Support load distribution in security gateway application using NIC=20 > load distribution feature(Flow Director). > Flow Director is used to redirect the specified inbound ipsec flow to=20 > a specified queue.This is achieved by extending the SA rule syntax to=20 > support specification by adding new action_type of to=20 > a specified . >=20 > Signed-off-by: Praveen Shetty Please fix a few minor comments below. Apart from that, Acked-by: Akhil Goyal > --- > v5 changes: > Small change in condtional handling in sa.c file. >=20 > v4 changes: > 1. Removed flow director configuration changes as they are not > required anymore. > 2. Addressed all the review comments from Akhil and Anoob. > 3. Included update to the ipsec-secgw user guide and update to release no= tes. >=20 > doc/guides/rel_notes/release_20_05.rst | 4 ++ > doc/guides/sample_app_ug/ipsec_secgw.rst | 16 ++++++ > examples/ipsec-secgw/ep0.cfg | 11 ++++ > examples/ipsec-secgw/ipsec-secgw.c | 22 ++++++++ > examples/ipsec-secgw/ipsec.c | 67 ++++++++++++++++++++++++ > examples/ipsec-secgw/ipsec.h | 7 +++ > examples/ipsec-secgw/sa.c | 63 ++++++++++++++++++++-- > 7 files changed, 186 insertions(+), 4 deletions(-) >=20 > diff --git a/doc/guides/rel_notes/release_20_05.rst > b/doc/guides/rel_notes/release_20_05.rst > index 6b1a7c58c..a9ec163cf 100644 > --- a/doc/guides/rel_notes/release_20_05.rst > +++ b/doc/guides/rel_notes/release_20_05.rst > @@ -81,6 +81,10 @@ New Features > by making use of the event device capabilities. The event mode=20 > currently supports > only inline IPsec protocol offload. >=20 > +* **Updated ipsec-secgw application.** > + > + Added IPsec inbound load-distribution support for ipsec-secgw=20 > + application > using NIC > + load distribution feature(Flow Director). There is one more item in release notes for ipsec-secgw for event mode. You should add a bullet in that for this feature. [Praveen] okay. Will do it in v6. >=20 > Removed Items > ------------- > diff --git a/doc/guides/sample_app_ug/ipsec_secgw.rst > b/doc/guides/sample_app_ug/ipsec_secgw.rst > index 038f593f4..12f921d76 100644 > --- a/doc/guides/sample_app_ug/ipsec_secgw.rst > +++ b/doc/guides/sample_app_ug/ipsec_secgw.rst > @@ -506,6 +506,7 @@ The SA rule syntax is shown as follows: >=20 > sa > > + >=20 > where each options means: >=20 > @@ -698,6 +699,18 @@ where each options means: >=20 > * *fallback lookaside-none* >=20 > +```` > + > + * Action type is for redirecting the specific inbound ipsec-flow to > + a specified queue. Flow direction is not an action type. You can re-phrase it as Option for re= directing a specific inbound ipsec flow of a port to a specific queue of th= at port.=20 [Praveen] okay. Will update this in v6. > + > + * Optional: Yes. > + > + * Available options: > + > + * *port_id*: Port ID of the NIC for which the SA is configured. > + * *queue_id*: Queue ID to which traffic should be redirected. > + > Example SA rules: >=20 > .. code-block:: console > @@ -727,6 +740,9 @@ Example SA rules: > mode ipv4-tunnel src 172.16.2.5 dst 172.16.1.5 \ > type inline-crypto-offload port_id 0 >=20 > + sa in 117 cipher_algo null auth_algo null mode ipv4-tunnel src 172.1= 6.2.7 \ > + dst 172.16.1.7 flow-direction 0 2 > + > Routing rule syntax > ^^^^^^^^^^^^^^^^^^^ >=20 > diff --git a/examples/ipsec-secgw/ep0.cfg=20 > b/examples/ipsec-secgw/ep0.cfg index dfd4aca7d..6f8d5aa53 100644 > --- a/examples/ipsec-secgw/ep0.cfg > +++ b/examples/ipsec-secgw/ep0.cfg > @@ -29,6 +29,7 @@ sp ipv4 in esp protect 111 pri 1 dst=20 > 192.168.186.0/24 sport > 0:65535 dport 0:6553 > sp ipv4 in esp protect 115 pri 1 dst 192.168.210.0/24 sport 0:65535=20 > dport > 0:65535 > sp ipv4 in esp protect 116 pri 1 dst 192.168.211.0/24 sport 0:65535=20 > dport > 0:65535 > sp ipv4 in esp protect 115 pri 1 dst 192.168.210.0/24 sport 0:65535=20 > dport > 0:65535 > +sp ipv4 in esp protect 117 pri 1 dst 192.168.212.0/24 sport 0:65535=20 > +dport > 0:65535 > sp ipv4 in esp protect 125 pri 1 dst 192.168.65.0/24 sport 0:65535=20 > dport 0:65535 sp ipv4 in esp protect 125 pri 1 dst 192.168.65.0/24=20 > sport 0:65535 dport 0:65535 sp ipv4 in esp protect 126 pri 1 dst=20 > 192.168.66.0/24 sport 0:65535 dport 0:65535 @@ -61,6 +62,8 @@ sp ipv6=20 > in esp protect 125 pri 1 dst > ffff:0000:0000:0000:aaaa:aaaa:0000:0000/96 > sport 0:65535 dport 0:65535 > sp ipv6 in esp protect 126 pri 1 dst > ffff:0000:0000:0000:bbbb:bbbb:0000:0000/96 \ sport 0:65535 dport=20 > 0:65535 > +sp ipv6 in esp protect 127 pri 1 dst > ffff:0000:0000:0000:cccc:dddd:0000:0000/96 \ > +sport 0:65535 dport 0:65535 >=20 > #SA rules > sa out 5 cipher_algo aes-128-cbc cipher_key=20 > 0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0 \ @@ -118,6 +121,9 @@ dst 172.16.1.5 >=20 > sa in 116 cipher_algo null auth_algo null mode ipv4-tunnel src=20 > 172.16.2.6 dst > 172.16.1.6 >=20 > +sa in 117 cipher_algo null auth_algo null mode ipv4-tunnel src=20 > +172.16.2.7 \ dst 172.16.1.7 flow-direction 0 2 > + > sa in 125 cipher_algo aes-128-cbc cipher_key=20 > c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:\ > c3:c3:c3:c3:c3 auth_algo sha1-hmac auth_key=20 > c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:\ > c3:c3:c3:c3:c3:c3:c3:c3:c3 mode ipv6-tunnel \ @@ -130,6 +136,11 @@ sa=20 > in 126 cipher_algo aes-128-cbc cipher_key=20 > 4d:4d:4d:4d:4d:4d:4d:4d:4d:4d:4d:\ > src 2222:2222:2222:2222:2222:2222:2222:6666 \ dst=20 > 1111:1111:1111:1111:1111:1111:1111:6666 >=20 > +sa in 127 cipher_algo null auth_algo null mode ipv6-tunnel \ src=20 > +2222:2222:2222:2222:2222:2222:2222:7777 \ dst=20 > +1111:1111:1111:1111:1111:1111:1111:7777 \ flow-direction 0 3 > + > #Routing rules > rt ipv4 dst 172.16.2.5/32 port 0 > rt ipv4 dst 172.16.2.6/32 port 1 > diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec-=20 > secgw/ipsec-secgw.c index 5fde4f728..6d02341de 100644 > --- a/examples/ipsec-secgw/ipsec-secgw.c > +++ b/examples/ipsec-secgw/ipsec-secgw.c > @@ -1183,6 +1183,28 @@ ipsec_poll_mode_worker(void) > } > } >=20 > +int > +check_flow_params(uint16_t fdir_portid, uint8_t fdir_qid) { > + uint16_t i; > + uint16_t portid; > + uint8_t queueid; > + > + for (i =3D 0; i < nb_lcore_params; ++i) { > + portid =3D lcore_params_array[i].port_id; > + if (portid =3D=3D fdir_portid) { > + queueid =3D lcore_params_array[i].queue_id; > + if (queueid =3D=3D fdir_qid) > + break; > + } > + > + if (i =3D=3D nb_lcore_params - 1) > + return -1; > + } > + > + return 1; > +} > + > static int32_t > check_poll_mode_params(struct eh_conf *eh_conf) { diff --git=20 > a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c index=20 > d40657102..461fae461 100644 > --- a/examples/ipsec-secgw/ipsec.c > +++ b/examples/ipsec-secgw/ipsec.c > @@ -418,6 +418,73 @@ create_inline_session(struct socket_ctx *skt_ctx,=20 > struct ipsec_sa *sa, > return 0; > } >=20 > +int > +create_ipsec_esp_flow(struct ipsec_sa *sa) { > + int ret =3D 0; > + struct rte_flow_error err; > + if (sa->direction =3D=3D RTE_SECURITY_IPSEC_SA_DIR_EGRESS) { > + RTE_LOG(ERR, IPSEC, > + "No Flow director rule for Egress traffic\n"); > + return -1; > + } > + if (sa->flags =3D=3D TRANSPORT) { > + RTE_LOG(ERR, IPSEC, > + "No Flow director rule for transport mode\n"); > + return -1; > + } > + sa->action[0].type =3D RTE_FLOW_ACTION_TYPE_QUEUE; > + sa->pattern[0].type =3D RTE_FLOW_ITEM_TYPE_ETH; > + sa->action[0].conf =3D > + &(struct rte_flow_action_queue){ > + .index =3D sa->fdir_qid, > + }; Unnecessary line break, spacing before '{' [Praveen] will fix this in v6. > + sa->attr.egress =3D 0; > + sa->attr.ingress =3D 1; > + if (IS_IP6(sa->flags)) { > + sa->pattern[1].mask =3D &rte_flow_item_ipv6_mask; > + sa->pattern[1].type =3D RTE_FLOW_ITEM_TYPE_IPV6; > + sa->pattern[1].spec =3D &sa->ipv6_spec; > + memcpy(sa->ipv6_spec.hdr.dst_addr, > + sa->dst.ip.ip6.ip6_b, sizeof(sa->dst.ip.ip6.ip6_b)); > + memcpy(sa->ipv6_spec.hdr.src_addr, > + sa->src.ip.ip6.ip6_b, sizeof(sa->src.ip.ip6.ip6_b)); > + sa->pattern[2].type =3D RTE_FLOW_ITEM_TYPE_ESP; > + sa->pattern[2].spec =3D &sa->esp_spec; > + sa->pattern[2].mask =3D &rte_flow_item_esp_mask; > + sa->esp_spec.hdr.spi =3D rte_cpu_to_be_32(sa->spi); > + sa->pattern[3].type =3D RTE_FLOW_ITEM_TYPE_END; > + } else if (IS_IP4(sa->flags)) { > + sa->pattern[1].mask =3D &rte_flow_item_ipv4_mask; > + sa->pattern[1].type =3D RTE_FLOW_ITEM_TYPE_IPV4; > + sa->pattern[1].spec =3D &sa->ipv4_spec; > + sa->ipv4_spec.hdr.dst_addr =3D sa->dst.ip.ip4; > + sa->ipv4_spec.hdr.src_addr =3D sa->src.ip.ip4; > + sa->pattern[2].type =3D RTE_FLOW_ITEM_TYPE_ESP; > + sa->pattern[2].spec =3D &sa->esp_spec; > + sa->pattern[2].mask =3D &rte_flow_item_esp_mask; > + sa->esp_spec.hdr.spi =3D rte_cpu_to_be_32(sa->spi); > + sa->pattern[3].type =3D RTE_FLOW_ITEM_TYPE_END; > + } > + sa->action[1].type =3D RTE_FLOW_ACTION_TYPE_END; > + > + ret =3D rte_flow_validate(sa->portid, &sa->attr, sa->pattern, sa->actio= n, > + &err); > + if (ret < 0) { > + RTE_LOG(ERR, IPSEC, "Flow validation failed %s\n", > err.message); > + return ret; > + } > + > + sa->flow =3D rte_flow_create(sa->portid, &sa->attr, sa->pattern, > + sa->action, &err); > + if (!sa->flow) { > + RTE_LOG(ERR, IPSEC, "Flow creation failed %s\n", err.message); > + return -1; > + } > + > + return 0; > +} > + > /* > * queue crypto-ops into PMD queue. > */ > diff --git a/examples/ipsec-secgw/ipsec.h=20 > b/examples/ipsec-secgw/ipsec.h index f8f29f9b1..1790a93ca 100644 > --- a/examples/ipsec-secgw/ipsec.h > +++ b/examples/ipsec-secgw/ipsec.h > @@ -144,6 +144,8 @@ struct ipsec_sa { > }; > enum rte_security_ipsec_sa_direction direction; > uint16_t portid; > + uint8_t fdir_qid; > + uint8_t fdir_flag; >=20 > #define MAX_RTE_FLOW_PATTERN (4) > #define MAX_RTE_FLOW_ACTIONS (3) > @@ -408,5 +410,10 @@ create_lookaside_session(struct ipsec_ctx=20 > *ipsec_ctx, struct ipsec_sa *sa, int create_inline_session(struct=20 > socket_ctx *skt_ctx, struct ipsec_sa *sa, > struct rte_ipsec_session *ips); > +int > +check_flow_params(uint16_t fdir_portid, uint8_t fdir_qid); > + > +int > +create_ipsec_esp_flow(struct ipsec_sa *sa); >=20 > #endif /* __IPSEC_H__ */ > diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c=20 > index a6bf5e8b1..06bb25b3e 100644 > --- a/examples/ipsec-secgw/sa.c > +++ b/examples/ipsec-secgw/sa.c > @@ -271,6 +271,7 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > uint32_t type_p =3D 0; > uint32_t portid_p =3D 0; > uint32_t fallback_p =3D 0; > + int16_t status_p =3D 0; >=20 > if (strcmp(tokens[0], "in") =3D=3D 0) { > ri =3D &nb_sa_in; > @@ -295,6 +296,7 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > if (atoi(tokens[1]) =3D=3D INVALID_SPI) > return; > rule->spi =3D atoi(tokens[1]); > + rule->portid =3D UINT16_MAX; > ips =3D ipsec_get_primary_session(rule); >=20 > for (ti =3D 2; ti < n_tokens; ti++) { > @@ -636,9 +638,14 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > INCREMENT_TOKEN_INDEX(ti, n_tokens, status); > if (status->status < 0) > return; > - rule->portid =3D atoi(tokens[ti]); > - if (status->status < 0) > + if (rule->portid =3D=3D UINT16_MAX) > + rule->portid =3D atoi(tokens[ti]); > + else if (rule->portid !=3D atoi(tokens[ti])) { > + APP_CHECK(0, status, "portid %s not matching > " > + "with already assigned portid %u", > + tokens[ti], rule->portid); Please do not split strings which are printed as the output on console. It will make it difficult to grep while debugging. [Praveen] okay. Will fix this in v6. > return; > + } > portid_p =3D 1; > continue; > } > @@ -683,6 +690,44 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > fallback_p =3D 1; > continue; > } > + if (strcmp(tokens[ti], "flow-direction") =3D=3D 0) { > + if (ips->type =3D=3D > + RTE_SECURITY_ACTION_TYPE_NONE || > + ips->type =3D=3D > + RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) { The code is not readable here. Either a switch case or a separate function if the indentation it going bey= ond. [Praveen] okay. Will do this in v6. > + rule->fdir_flag =3D 1; > + INCREMENT_TOKEN_INDEX(ti, n_tokens, > status); > + if (status->status < 0) > + return; > + if (rule->portid =3D=3D UINT16_MAX) > + rule->portid =3D atoi(tokens[ti]); > + else if (rule->portid !=3D atoi(tokens[ti])) { > + APP_CHECK(0, status, "portid %s " > + "not matching with already " > + "assigned portid %u", > + tokens[ti], rule->portid); Same here, do not split strings which are printed. You should have the complete string on a separate line. Checkpatch will not= trouble for more than 80. [Praveen] Okay. Will do this in v6. > + return; > + } > + INCREMENT_TOKEN_INDEX(ti, n_tokens, > status); > + if (status->status < 0) > + return; > + rule->fdir_qid =3D atoi(tokens[ti]); > + /* validating portid and queueid */ > + status_p =3D check_flow_params(rule->portid, > + rule->fdir_qid); > + if (status_p < 0) { > + printf("port id %u / queue id %u is " > + "not valid\n", rule->portid, > + rule->fdir_qid); > + } > + } else { > + APP_CHECK(0, status, "flow director not " > + "supported for security session " > + "type:%d", ips->type); > + return; > + } > + continue; > + } >=20 > /* unrecognizeable input */ > APP_CHECK(0, status, "unrecognized input \"%s\"", @@ -721,7 +766,6=20 > @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > if (!type_p || (!portid_p && ips->type !=3D > RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO)) { > ips->type =3D RTE_SECURITY_ACTION_TYPE_NONE; > - rule->portid =3D -1; > } >=20 > *ri =3D *ri + 1; > @@ -806,7 +850,7 @@ print_one_sa_rule(const struct ipsec_sa *sa, int inbo= und) > printf("lookaside-protocol-offload "); > break; > case RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO: > - printf("cpu-crypto-accelerated"); > + printf("cpu-crypto-accelerated "); > break; > } >=20 > @@ -825,6 +869,10 @@ print_one_sa_rule(const struct ipsec_sa *sa, int > inbound) > break; > } > } > + if (sa->fdir_flag =3D=3D 1) > + printf("flow-direction port %d queue %d", sa->portid, > + sa->fdir_qid); > + > printf("\n"); > } >=20 > @@ -1143,6 +1191,13 @@ sa_add_rules(struct sa_ctx *sa_ctx, const=20 > struct ipsec_sa entries[], > } > } >=20 > + if (sa->fdir_flag && inbound) { > + rc =3D create_ipsec_esp_flow(sa); > + if (rc !=3D 0) > + RTE_LOG(ERR, IPSEC_ESP, > + "create_ipsec_esp_flow() failed %s\n", > + strerror(rc)); > + } > print_one_sa_rule(sa, inbound); > } >=20 > -- > 2.17.1 Regards, Praveen