From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 19075A0577; Tue, 14 Apr 2020 09:33:54 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 210C81C112; Tue, 14 Apr 2020 09:33:53 +0200 (CEST) Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by dpdk.org (Postfix) with ESMTP id BD8C11C0BE for ; Tue, 14 Apr 2020 09:33:50 +0200 (CEST) IronPort-SDR: I8nCVm0BCgTX9xj5PU083UQPEgRlY+DCtk46c7JnL1b0Xigpxq0Ez+FlVc2QS03IXmYLToClo7 3o8CjA5VjZ0w== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Apr 2020 00:33:49 -0700 IronPort-SDR: 50rLVBD8b0IHUQ8l1FDGwuC+/ka9ykR9aK2gUnnKBMYLcg6AhzdyhQiQk3MLPaST8INVQfkjuQ fPWyWI5s4WQg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,381,1580803200"; d="scan'208";a="426973436" Received: from fmsmsx108.amr.corp.intel.com ([10.18.124.206]) by orsmga005.jf.intel.com with ESMTP; 14 Apr 2020 00:33:49 -0700 Received: from FMSEDG002.ED.cps.intel.com (10.1.192.134) by FMSMSX108.amr.corp.intel.com (10.18.124.206) with Microsoft SMTP Server (TLS) id 14.3.439.0; Tue, 14 Apr 2020 00:33:48 -0700 Received: from NAM12-DM6-obe.outbound.protection.outlook.com (104.47.59.169) by edgegateway.intel.com (192.55.55.69) with Microsoft SMTP Server (TLS) id 14.3.439.0; Tue, 14 Apr 2020 00:33:37 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Chyg79xOLEwmSwTbWb9bmhKKDid4Z8ewr9Sh0pVxrVTgJFPiJ1QjhRQ5fFgO+FnZnhmtRP3bLz5uOk5UPvoWaB3oGm2M9ia3JROEpRkmRyL9G9ASYJaHr/seD4kN2fMPTwtZeiogwOW2j7EMZSB2nEtiJm9PIhb37hv28Q/kzwwdItGeabCpApkJULfUaKeRR3GCG9IUQnaHFLmC5hEfSq5/XSZGiixhHvbhfLV3froFvQs8G/Hq73XzJGCCcRK37gCUZG2CGC5u/nj/t+geTwqim6GeLDSRdqbtA49izShSSbvY6HKv6c5mrhdnTfvcq9TaKpFXBmCmyJiQSNCaYw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YL84zBKa32g92mpCYU4k9n0TlJg7Rov5DI29Esg7QLA=; b=l6zr1ORy0ItlXVhfeSApZRHS4RK9s0wtnPodeMbh7C+4my5RdU/xModxyQUo/43Br5uYyhZcOpx1d2M5l3UDIQ5Vb+CSOsdCO7KASGE9UNFsiVQfz8QBY9j6ieBwsVsTEZrnXLLC9b9FHJYMQPvqmHvab911rw3M4tj5vKNucX8/4GRyTL2+KFjheaTQ+I5tqaEX2fS45fYTgFmkpfo8oPhoHdT5Kemjpu9c4P95It1Bt6BT9vSaw5N8q0/85z1uB3a61wtpQvQrhLmvdDhl4irTnXNEYwqolMTf+0WlmFkIVQgfQWr6HgYlKPMREfqFD2Cq134JbD7NEXt+OoKGEg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel.onmicrosoft.com; s=selector2-intel-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YL84zBKa32g92mpCYU4k9n0TlJg7Rov5DI29Esg7QLA=; b=WBLaTgenJXTDTQAV0dW8oqGshe0y9rxnWFDd/7InTOgB5jTWtAXqxCSh/46Ky/mBkJQ26ot6lgVN0pDVuNZtLNO2GPJtPg+ve3TWaDy/br86wcnJpualbs3QBGiY12Cgl+sQE7BAK3hsPXlMQlmgwvg0YKwu+HA+PWGEgsFWl+s= Received: from CY4PR1101MB2326.namprd11.prod.outlook.com (2603:10b6:903:b3::23) by CY4PR1101MB2120.namprd11.prod.outlook.com (2603:10b6:910:1e::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.26; Tue, 14 Apr 2020 07:33:35 +0000 Received: from CY4PR1101MB2326.namprd11.prod.outlook.com ([fe80::58c7:7df:1b11:9c56]) by CY4PR1101MB2326.namprd11.prod.outlook.com ([fe80::58c7:7df:1b11:9c56%4]) with mapi id 15.20.2900.028; Tue, 14 Apr 2020 07:33:35 +0000 From: "Shetty, Praveen" To: "dev@dpdk.org" , "Doherty, Declan" , "akhil.goyal@nxp.com" , "anoobj@marvell.com" CC: "Iremonger, Bernard" , "Ananyev, Konstantin" Thread-Topic: [dpdk-dev] [PATCH v5] examples/ipsec-secgw: support flow director feature Thread-Index: AQHWDlcjoyy7S14e0063le1W4oKprKh4JiqA Date: Tue, 14 Apr 2020 07:33:35 +0000 Message-ID: References: <20200408141342.29573-1-praveen.shetty@intel.com> <20200409100950.37292-1-praveen.shetty@intel.com> In-Reply-To: <20200409100950.37292-1-praveen.shetty@intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNWUyM2I4ZWMtMTA5MS00NTgxLWExNWItMTQ2NjA0ZDQ5MjY4IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiNms5WVEyZFR5N081WGxOYkpEbkhiVUc4WVpOaEttRnZCZXhjZ2liWkd3c3o5Wm0ySFdnUEFUcVRYTGk3ekV5bSJ9 dlp-product: dlpe-windows dlp-reaction: no-action dlp-version: 11.2.0.6 x-ctpclassification: CTP_NT authentication-results: spf=none (sender IP is ) smtp.mailfrom=praveen.shetty@intel.com; x-originating-ip: [192.55.79.101] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: eeb454a7-4c5e-4eca-b8b4-08d7e0462436 x-ms-traffictypediagnostic: CY4PR1101MB2120: x-ld-processed: 46c98d88-e344-4ed4-8496-4ed7712e255d,ExtAddr x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:497; x-forefront-prvs: 0373D94D15 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:5; SRV:; IPV:NLI; SFV:SPM; H:CY4PR1101MB2326.namprd11.prod.outlook.com; PTR:; CAT:OSPM; SFTY:; SFS:(10019020)(346002)(396003)(376002)(39860400002)(366004)(136003)(64756008)(8936002)(86362001)(33656002)(30864003)(5660300002)(186003)(81156014)(66446008)(7696005)(478600001)(2906002)(66556008)(316002)(52536014)(53546011)(6506007)(107886003)(71200400001)(26005)(55016002)(110136005)(4326008)(66476007)(66946007)(9686003)(54906003)(76116006)(18037945009); DIR:OUT; SFP:1501; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: VCsp32xqvZTND65E+jUqv4qvFuupiiDr60DPsy7bDEpEZtkEz8auudaUEyeQ+KNVn46BSyHCAQQAhShw8f3vnCX46HSz7zTPDt0JnSVvHgvO8C9QruXhViJHnhcKUfFqPVWF3oLpqB6UJg5TtLVb1a8pkRM6SIg8HTuk7I09P2bdqi8Y3hpq2MkOfWQXFkkmjZYwP3K/iDZPMoUrcMVL4+5Ci5BlRsaSlvKoLI2pxv5/SQNSIzZnnB/XlujuNzqx/JRzzErEGeVy+Jvi1X5kh6ty12r4dYp99Yeaz6/c4uwRyrcj1K+5dmuSzQffo3VTHiuISrjRubvNIkSaA++O4LJunlhtbKPJmwOEuSiYK+szvqHP+e+aSymrqq5t0UFinHRJuj/S1BMGj83DroDgkGznS/kBCPe2agzh7tAXwg1mdlu45xbhHD77CocMDi1asR3PO8tH7fDX8jNqlB9y6VNgm9DmKMaqUVQ+JIf2QSc2hJuJC41Zo/Cl95fSulCbYFW80J5lEBIrjM7tdyb7bhqBdMXZzkYqJLnXdqk/YyIbGxWBZfEDk9f+02FejaxnkPW5m7NQdMRHmUmvdhKOPaht05tErrZKTLprzK6sMVGaGlV8cVunLjk97bxctsqFu5d81D6AqZshqzacYiv1zyt3Ye4IVciat/yi0yfGJbe0SJFlAN4pXEZPZUUuv9Tz3xeV1jNiNiSVC86QsIzoVV97xIJs3IeLisGPuHJ14BoS4gHXlui+VXD8ZX4ekdwfUmf6/zTWd7yyxI7pTw7o5Q== x-ms-exchange-antispam-messagedata: 2/2dyloX2d8RgeqxNJ5KZrdMiY1uUc0GWhANUXBsrMh+fLWcaWTVuCNyE3PXH/2b9k9c12UVJ0PUclcO/bPZNZTyMZLRp69J4wmCNEkE3IyfCnQjbZy4OMn+J0OLEO9xNs8Imid32WvQ3+ty6x0aoA== Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: eeb454a7-4c5e-4eca-b8b4-08d7e0462436 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Apr 2020 07:33:35.4873 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: rCNCSkoufRvzeFdWw5FwBc92vj8VdD/xPUL3QlqAEC6dN/RDNGXxPoGHn1b2VbuzYNftgYqdA+7P1z13ofGKlBdtnlIVAVmxh0ZKhV9hWII= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1101MB2120 X-OriginatorOrg: intel.com Subject: Re: [dpdk-dev] [PATCH v5] examples/ipsec-secgw: support flow director feature X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi Akhil/Anoob Do you have any further review comments ? Regards, Praveen -----Original Message----- From: dev On Behalf Of Praveen Shetty Sent: Thursday, April 9, 2020 3:40 PM To: dev@dpdk.org; Doherty, Declan ; akhil.goyal@n= xp.com; anoobj@marvell.com Cc: Iremonger, Bernard ; Ananyev, Konstantin <= konstantin.ananyev@intel.com> Subject: [dpdk-dev] [PATCH v5] examples/ipsec-secgw: support flow director = feature Support load distribution in security gateway application using NIC load di= stribution feature(Flow Director). Flow Director is used to redirect the specified inbound ipsec flow to a spe= cified queue.This is achieved by extending the SA rule syntax to support sp= ecification by adding new action_type of to a specified . Signed-off-by: Praveen Shetty --- v5 changes: Small change in condtional handling in sa.c file. v4 changes: 1. Removed flow director configuration changes as they are not=20 required anymore. 2. Addressed all the review comments from Akhil and Anoob. 3. Included update to the ipsec-secgw user guide and update to release note= s. doc/guides/rel_notes/release_20_05.rst | 4 ++ doc/guides/sample_app_ug/ipsec_secgw.rst | 16 ++++++ examples/ipsec-secgw/ep0.cfg | 11 ++++ examples/ipsec-secgw/ipsec-secgw.c | 22 ++++++++ examples/ipsec-secgw/ipsec.c | 67 ++++++++++++++++++++++++ examples/ipsec-secgw/ipsec.h | 7 +++ examples/ipsec-secgw/sa.c | 63 ++++++++++++++++++++-- 7 files changed, 186 insertions(+), 4 deletions(-) diff --git a/doc/guides/rel_notes/release_20_05.rst b/doc/guides/rel_notes/= release_20_05.rst index 6b1a7c58c..a9ec163cf 100644 --- a/doc/guides/rel_notes/release_20_05.rst +++ b/doc/guides/rel_notes/release_20_05.rst @@ -81,6 +81,10 @@ New Features by making use of the event device capabilities. The event mode currently= supports only inline IPsec protocol offload. =20 +* **Updated ipsec-secgw application.** + + Added IPsec inbound load-distribution support for ipsec-secgw=20 + application using NIC load distribution feature(Flow Director). =20 Removed Items ------------- diff --git a/doc/guides/sample_app_ug/ipsec_secgw.rst b/doc/guides/sample_a= pp_ug/ipsec_secgw.rst index 038f593f4..12f921d76 100644 --- a/doc/guides/sample_app_ug/ipsec_secgw.rst +++ b/doc/guides/sample_app_ug/ipsec_secgw.rst @@ -506,6 +506,7 @@ The SA rule syntax is shown as follows: =20 sa + =20 where each options means: =20 @@ -698,6 +699,18 @@ where each options means: =20 * *fallback lookaside-none* =20 +```` + + * Action type is for redirecting the specific inbound ipsec-flow to + a specified queue. + + * Optional: Yes. + + * Available options: + + * *port_id*: Port ID of the NIC for which the SA is configured. + * *queue_id*: Queue ID to which traffic should be redirected. + Example SA rules: =20 .. code-block:: console @@ -727,6 +740,9 @@ Example SA rules: mode ipv4-tunnel src 172.16.2.5 dst 172.16.1.5 \ type inline-crypto-offload port_id 0 =20 + sa in 117 cipher_algo null auth_algo null mode ipv4-tunnel src 172.16.= 2.7 \ + dst 172.16.1.7 flow-direction 0 2 + Routing rule syntax ^^^^^^^^^^^^^^^^^^^ =20 diff --git a/examples/ipsec-secgw/ep0.cfg b/examples/ipsec-secgw/ep0.cfg in= dex dfd4aca7d..6f8d5aa53 100644 --- a/examples/ipsec-secgw/ep0.cfg +++ b/examples/ipsec-secgw/ep0.cfg @@ -29,6 +29,7 @@ sp ipv4 in esp protect 111 pri 1 dst 192.168.186.0/24 spo= rt 0:65535 dport 0:6553 sp ipv4 in esp protect 115 pri 1 dst 192.168.210.0= /24 sport 0:65535 dport 0:65535 sp ipv4 in esp protect 116 pri 1 dst 192.1= 68.211.0/24 sport 0:65535 dport 0:65535 sp ipv4 in esp protect 115 pri 1 d= st 192.168.210.0/24 sport 0:65535 dport 0:65535 +sp ipv4 in esp protect 117 pri 1 dst 192.168.212.0/24 sport 0:65535=20 +dport 0:65535 sp ipv4 in esp protect 125 pri 1 dst 192.168.65.0/24 sport 0:65535 dport 0= :65535 sp ipv4 in esp protect 125 pri 1 dst 192.168.65.0/24 sport 0:65535 = dport 0:65535 sp ipv4 in esp protect 126 pri 1 dst 192.168.66.0/24 sport 0= :65535 dport 0:65535 @@ -61,6 +62,8 @@ sp ipv6 in esp protect 125 pri 1 dst= ffff:0000:0000:0000:aaaa:aaaa:0000:0000/96 sport 0:65535 dport 0:65535 sp ipv6 in esp protect 126 pri 1 dst ffff:0000:0000:0000:bbbb:bbbb:0000:00= 00/96 \ sport 0:65535 dport 0:65535 +sp ipv6 in esp protect 127 pri 1 dst=20 +ffff:0000:0000:0000:cccc:dddd:0000:0000/96 \ sport 0:65535 dport=20 +0:65535 =20 #SA rules sa out 5 cipher_algo aes-128-cbc cipher_key 0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:= 0 \ @@ -118,6 +121,9 @@ dst 172.16.1.5 =20 sa in 116 cipher_algo null auth_algo null mode ipv4-tunnel src 172.16.2.6 = dst 172.16.1.6 =20 +sa in 117 cipher_algo null auth_algo null mode ipv4-tunnel src=20 +172.16.2.7 \ dst 172.16.1.7 flow-direction 0 2 + sa in 125 cipher_algo aes-128-cbc cipher_key c3:c3:c3:c3:c3:c3:c3:c3:c3:c3= :c3:\ c3:c3:c3:c3:c3 auth_algo sha1-hmac auth_key c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:= c3:\ c3:c3:c3:c3:c3:c3:c3:c3:c3 mode ipv6-tunnel \ @@ -130,6 +136,11 @@ sa in 1= 26 cipher_algo aes-128-cbc cipher_key 4d:4d:4d:4d:4d:4d:4d:4d:4d:4d:4d:\ src 2222:2222:2222:2222:2222:2222:2222:6666 \ dst 1111:1111:1111:1111:111= 1:1111:1111:6666 =20 +sa in 127 cipher_algo null auth_algo null mode ipv6-tunnel \ src=20 +2222:2222:2222:2222:2222:2222:2222:7777 \ dst=20 +1111:1111:1111:1111:1111:1111:1111:7777 \ flow-direction 0 3 + #Routing rules rt ipv4 dst 172.16.2.5/32 port 0 rt ipv4 dst 172.16.2.6/32 port 1 diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec-secgw/ipse= c-secgw.c index 5fde4f728..6d02341de 100644 --- a/examples/ipsec-secgw/ipsec-secgw.c +++ b/examples/ipsec-secgw/ipsec-secgw.c @@ -1183,6 +1183,28 @@ ipsec_poll_mode_worker(void) } } =20 +int +check_flow_params(uint16_t fdir_portid, uint8_t fdir_qid) { + uint16_t i; + uint16_t portid; + uint8_t queueid; + + for (i =3D 0; i < nb_lcore_params; ++i) { + portid =3D lcore_params_array[i].port_id; + if (portid =3D=3D fdir_portid) { + queueid =3D lcore_params_array[i].queue_id; + if (queueid =3D=3D fdir_qid) + break; + } + + if (i =3D=3D nb_lcore_params - 1) + return -1; + } + + return 1; +} + static int32_t check_poll_mode_params(struct eh_conf *eh_conf) { diff --git a/examples/i= psec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c index d40657102..461fae46= 1 100644 --- a/examples/ipsec-secgw/ipsec.c +++ b/examples/ipsec-secgw/ipsec.c @@ -418,6 +418,73 @@ create_inline_session(struct socket_ctx *skt_ctx, stru= ct ipsec_sa *sa, return 0; } =20 +int +create_ipsec_esp_flow(struct ipsec_sa *sa) { + int ret =3D 0; + struct rte_flow_error err; + if (sa->direction =3D=3D RTE_SECURITY_IPSEC_SA_DIR_EGRESS) { + RTE_LOG(ERR, IPSEC, + "No Flow director rule for Egress traffic\n"); + return -1; + } + if (sa->flags =3D=3D TRANSPORT) { + RTE_LOG(ERR, IPSEC, + "No Flow director rule for transport mode\n"); + return -1; + } + sa->action[0].type =3D RTE_FLOW_ACTION_TYPE_QUEUE; + sa->pattern[0].type =3D RTE_FLOW_ITEM_TYPE_ETH; + sa->action[0].conf =3D + &(struct rte_flow_action_queue){ + .index =3D sa->fdir_qid, + }; + sa->attr.egress =3D 0; + sa->attr.ingress =3D 1; + if (IS_IP6(sa->flags)) { + sa->pattern[1].mask =3D &rte_flow_item_ipv6_mask; + sa->pattern[1].type =3D RTE_FLOW_ITEM_TYPE_IPV6; + sa->pattern[1].spec =3D &sa->ipv6_spec; + memcpy(sa->ipv6_spec.hdr.dst_addr, + sa->dst.ip.ip6.ip6_b, sizeof(sa->dst.ip.ip6.ip6_b)); + memcpy(sa->ipv6_spec.hdr.src_addr, + sa->src.ip.ip6.ip6_b, sizeof(sa->src.ip.ip6.ip6_b)); + sa->pattern[2].type =3D RTE_FLOW_ITEM_TYPE_ESP; + sa->pattern[2].spec =3D &sa->esp_spec; + sa->pattern[2].mask =3D &rte_flow_item_esp_mask; + sa->esp_spec.hdr.spi =3D rte_cpu_to_be_32(sa->spi); + sa->pattern[3].type =3D RTE_FLOW_ITEM_TYPE_END; + } else if (IS_IP4(sa->flags)) { + sa->pattern[1].mask =3D &rte_flow_item_ipv4_mask; + sa->pattern[1].type =3D RTE_FLOW_ITEM_TYPE_IPV4; + sa->pattern[1].spec =3D &sa->ipv4_spec; + sa->ipv4_spec.hdr.dst_addr =3D sa->dst.ip.ip4; + sa->ipv4_spec.hdr.src_addr =3D sa->src.ip.ip4; + sa->pattern[2].type =3D RTE_FLOW_ITEM_TYPE_ESP; + sa->pattern[2].spec =3D &sa->esp_spec; + sa->pattern[2].mask =3D &rte_flow_item_esp_mask; + sa->esp_spec.hdr.spi =3D rte_cpu_to_be_32(sa->spi); + sa->pattern[3].type =3D RTE_FLOW_ITEM_TYPE_END; + } + sa->action[1].type =3D RTE_FLOW_ACTION_TYPE_END; + + ret =3D rte_flow_validate(sa->portid, &sa->attr, sa->pattern, sa->action, + &err); + if (ret < 0) { + RTE_LOG(ERR, IPSEC, "Flow validation failed %s\n", err.message); + return ret; + } + + sa->flow =3D rte_flow_create(sa->portid, &sa->attr, sa->pattern, + sa->action, &err); + if (!sa->flow) { + RTE_LOG(ERR, IPSEC, "Flow creation failed %s\n", err.message); + return -1; + } + + return 0; +} + /* * queue crypto-ops into PMD queue. */ diff --git a/examples/ipsec-secgw/ipsec.h b/examples/ipsec-secgw/ipsec.h in= dex f8f29f9b1..1790a93ca 100644 --- a/examples/ipsec-secgw/ipsec.h +++ b/examples/ipsec-secgw/ipsec.h @@ -144,6 +144,8 @@ struct ipsec_sa { }; enum rte_security_ipsec_sa_direction direction; uint16_t portid; + uint8_t fdir_qid; + uint8_t fdir_flag; =20 #define MAX_RTE_FLOW_PATTERN (4) #define MAX_RTE_FLOW_ACTIONS (3) @@ -408,5 +410,10 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, = struct ipsec_sa *sa, int create_inline_session(struct socket_ctx *skt_ctx= , struct ipsec_sa *sa, struct rte_ipsec_session *ips); +int +check_flow_params(uint16_t fdir_portid, uint8_t fdir_qid); + +int +create_ipsec_esp_flow(struct ipsec_sa *sa); =20 #endif /* __IPSEC_H__ */ diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c index a6= bf5e8b1..06bb25b3e 100644 --- a/examples/ipsec-secgw/sa.c +++ b/examples/ipsec-secgw/sa.c @@ -271,6 +271,7 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, uint32_t type_p =3D 0; uint32_t portid_p =3D 0; uint32_t fallback_p =3D 0; + int16_t status_p =3D 0; =20 if (strcmp(tokens[0], "in") =3D=3D 0) { ri =3D &nb_sa_in; @@ -295,6 +296,7 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, if (atoi(tokens[1]) =3D=3D INVALID_SPI) return; rule->spi =3D atoi(tokens[1]); + rule->portid =3D UINT16_MAX; ips =3D ipsec_get_primary_session(rule); =20 for (ti =3D 2; ti < n_tokens; ti++) { @@ -636,9 +638,14 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, INCREMENT_TOKEN_INDEX(ti, n_tokens, status); if (status->status < 0) return; - rule->portid =3D atoi(tokens[ti]); - if (status->status < 0) + if (rule->portid =3D=3D UINT16_MAX) + rule->portid =3D atoi(tokens[ti]); + else if (rule->portid !=3D atoi(tokens[ti])) { + APP_CHECK(0, status, "portid %s not matching " + "with already assigned portid %u", + tokens[ti], rule->portid); return; + } portid_p =3D 1; continue; } @@ -683,6 +690,44 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, fallback_p =3D 1; continue; } + if (strcmp(tokens[ti], "flow-direction") =3D=3D 0) { + if (ips->type =3D=3D + RTE_SECURITY_ACTION_TYPE_NONE || + ips->type =3D=3D + RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) { + rule->fdir_flag =3D 1; + INCREMENT_TOKEN_INDEX(ti, n_tokens, status); + if (status->status < 0) + return; + if (rule->portid =3D=3D UINT16_MAX) + rule->portid =3D atoi(tokens[ti]); + else if (rule->portid !=3D atoi(tokens[ti])) { + APP_CHECK(0, status, "portid %s " + "not matching with already " + "assigned portid %u", + tokens[ti], rule->portid); + return; + } + INCREMENT_TOKEN_INDEX(ti, n_tokens, status); + if (status->status < 0) + return; + rule->fdir_qid =3D atoi(tokens[ti]); + /* validating portid and queueid */ + status_p =3D check_flow_params(rule->portid, + rule->fdir_qid); + if (status_p < 0) { + printf("port id %u / queue id %u is " + "not valid\n", rule->portid, + rule->fdir_qid); + } + } else { + APP_CHECK(0, status, "flow director not " + "supported for security session " + "type:%d", ips->type); + return; + } + continue; + } =20 /* unrecognizeable input */ APP_CHECK(0, status, "unrecognized input \"%s\"", @@ -721,7 +766,6 @@ pa= rse_sa_tokens(char **tokens, uint32_t n_tokens, if (!type_p || (!portid_p && ips->type !=3D RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO)) { ips->type =3D RTE_SECURITY_ACTION_TYPE_NONE; - rule->portid =3D -1; } =20 *ri =3D *ri + 1; @@ -806,7 +850,7 @@ print_one_sa_rule(const struct ipsec_sa *sa, int inboun= d) printf("lookaside-protocol-offload "); break; case RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO: - printf("cpu-crypto-accelerated"); + printf("cpu-crypto-accelerated "); break; } =20 @@ -825,6 +869,10 @@ print_one_sa_rule(const struct ipsec_sa *sa, int inbou= nd) break; } } + if (sa->fdir_flag =3D=3D 1) + printf("flow-direction port %d queue %d", sa->portid, + sa->fdir_qid); + printf("\n"); } =20 @@ -1143,6 +1191,13 @@ sa_add_rules(struct sa_ctx *sa_ctx, const struct ips= ec_sa entries[], } } =20 + if (sa->fdir_flag && inbound) { + rc =3D create_ipsec_esp_flow(sa); + if (rc !=3D 0) + RTE_LOG(ERR, IPSEC_ESP, + "create_ipsec_esp_flow() failed %s\n", + strerror(rc)); + } print_one_sa_rule(sa, inbound); } =20 -- 2.17.1