From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 73F9FA04A2; Wed, 6 Nov 2019 08:00:38 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 41FD41BFBE; Wed, 6 Nov 2019 08:00:38 +0100 (CET) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40088.outbound.protection.outlook.com [40.107.4.88]) by dpdk.org (Postfix) with ESMTP id 560261BF4F for ; Wed, 6 Nov 2019 08:00:37 +0100 (CET) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mxe9yj7wXHvXOW+utfhgchJNBlMqVHbkGRIrwVwAiKxtRzFD3kIOx9BADP5Hqd6jbmLj8YulqH8FaAoe6vjAk0LEdxoqpRA6SpWBTM0UNlHzRxi/86PuDRxQorulQwMItUi8gQxa9simv5uUhoDPtiwVq2IbXRd1rGE4Ygwh6J4BI6/1qgutrDj9/nEBbIq1kn9ruNC1JxKjlL+JzApJ/Az8gAafP82COQzufHxhALpJJEz8wmtMGc6QTTQ7S+MMNgb88FERAx9qRy5F5fldCD+tWXcwV/1gG1kguPj731lzPF9rHDkB4tWXL4Ia0zQOvd4TpKASXCEDbt1Yl1lXXw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=92G9OPtaiyWz0UYFXM/wQbowzVgrEgTI42D6vRHc5Mc=; b=RqQp5VbwjWbQynkYowOwinTs2/PUeoZPIF6tMriwFsEPNWrNDhsnRQPBAqlutUTDu+5PDf65pcEuzLrCTMMIgwDtgdOykPjUDqlwR5ypXlX504fbZdmNSb/R7mnQ0OB2w2wlDGegJUuGWSl/ucBhaKmTy+tYEfJQ+nbzLhpL9hczitsTPoRlmAdCRLNjwOKOHVnJ7Za0cOlh6pcBH0yojouUT/KmENoQEWiYQ4z5+AdBicREDJj1ZqX0dKwgvXT3BkTwq/AnYMBWpSm1zXQglU+DeJcCbJlzqKLIZv1YVI0xgRl8ovxs5dvXRviNCkbYOu5pr8CHw+l18KUJ7HgABg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nxp.com; dmarc=pass action=none header.from=nxp.com; dkim=pass header.d=nxp.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nxp.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=92G9OPtaiyWz0UYFXM/wQbowzVgrEgTI42D6vRHc5Mc=; b=Fan6a8T0qdwOsd1Qkf77Nozhna/msiK1iJJ8zXInw8U6pyM0EUlPRnW4d8b/nMt9LmVGdA2PoTaCrAXpMB7q8qTx/1sCd5SiXmj6tTmFfqBDqr67VTj6yFk7xyZ/9VoMxguuc2w8hGqaKZ5MJIsCQyRR4bibbBQaov+7F/ONtOg= Received: from VE1PR04MB6639.eurprd04.prod.outlook.com (10.255.118.11) by VE1PR04MB6511.eurprd04.prod.outlook.com (20.179.233.161) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.20; Wed, 6 Nov 2019 07:00:36 +0000 Received: from VE1PR04MB6639.eurprd04.prod.outlook.com ([fe80::9dc:aa5c:2bb8:b561]) by VE1PR04MB6639.eurprd04.prod.outlook.com ([fe80::9dc:aa5c:2bb8:b561%6]) with mapi id 15.20.2408.025; Wed, 6 Nov 2019 07:00:36 +0000 From: Akhil Goyal To: Hemant Agrawal , "dev@dpdk.org" , "konstantin.ananyev@intel.com" CC: "anoobj@marvell.com" Thread-Topic: [PATCH v6 2/3] ipsec: remove redundant replay_win_sz Thread-Index: AQHVlG9xtT/ZqM3zQUKftRhp9vKDcad9tlvw Date: Wed, 6 Nov 2019 07:00:36 +0000 Message-ID: References: <20191031131502.12504-1-hemant.agrawal@nxp.com> <20191106065414.4311-1-hemant.agrawal@nxp.com> <20191106065414.4311-2-hemant.agrawal@nxp.com> In-Reply-To: <20191106065414.4311-2-hemant.agrawal@nxp.com> Accept-Language: en-IN, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=akhil.goyal@nxp.com; x-originating-ip: [92.120.1.65] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: ee2f2bf5-9b5e-4b9a-08b6-08d76287067c x-ms-traffictypediagnostic: VE1PR04MB6511:|VE1PR04MB6511: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:3276; x-forefront-prvs: 02135EB356 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(136003)(39860400002)(346002)(376002)(396003)(366004)(199004)(189003)(316002)(110136005)(6436002)(6246003)(2501003)(478600001)(186003)(14454004)(86362001)(71200400001)(11346002)(71190400001)(44832011)(8936002)(476003)(486006)(2201001)(74316002)(305945005)(8676002)(7736002)(446003)(81156014)(25786009)(81166006)(52536014)(7696005)(66556008)(6506007)(76116006)(5660300002)(76176011)(99286004)(26005)(14444005)(256004)(33656002)(6116002)(2906002)(3846002)(4326008)(66946007)(9686003)(64756008)(66446008)(229853002)(66476007)(66066001)(102836004)(55016002); DIR:OUT; SFP:1101; SCL:1; SRVR:VE1PR04MB6511; H:VE1PR04MB6639.eurprd04.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: nxp.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: GLMFJArrf7rJ1kN+EtPGYFABCvSnntkUELngJdbj+BMLGVnkhEbDcqj/GwCzMlLbavFDBkYAY8wAH1q+rxSdYQPlfYPChsLbdMc7T1pQvEtjQ0I+vcZxNzd2A795uRA7ODKYGZ6Pxp1f5NEezCtVarte0JkOluPT8BWKT/iWoDL4YZegaXMpil0K/dGOBtNvXdxkslBxDRShrnyMU2D82r0mQVskew8x1M+PsnLc8pQQnPQSewBOyU/Nq69xhCKMKFP6r9Ng1o6GZ/X5xdpLms79GmsXkzeZp84N57qKRom1QsKH/vjC5U9B51HBsX1ANeNNoj5udLcTIo3oaWj/0PMxJgO/kPaUVh3Xpl7RGtf3YGvSEDKyIWE5SEqJz6I8I++m5uamhsenVv0Hj9uoJtWOmds0uOQihzl03qz1wtahCitUVFiGXKCc0RWo34cI Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nxp.com X-MS-Exchange-CrossTenant-Network-Message-Id: ee2f2bf5-9b5e-4b9a-08b6-08d76287067c X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Nov 2019 07:00:36.3794 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: eW//044KURwYzTl5eloE0FTyJsnuT5iBzFc1dsq37C3T55kSWkINZMJkDR/MyB3T4HreM+WRFJAmRJw/PT2RhQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: VE1PR04MB6511 Subject: Re: [dpdk-dev] [PATCH v6 2/3] ipsec: remove redundant replay_win_sz X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi Konstantin, I had requested some changes in v5 which are there in this patch. Could you please review this again? I plan to merge it today. Thanks, Akhil > The rte_security lib has introduced replay_win_sz, > so it can be removed from the rte_ipsec lib. >=20 > The relaved tests,app are also update to reflect > the usages. >=20 > Note that esn and anti-replay fileds were earlier used > only for ipsec library, they were enabling the libipsec > by default. With this change esn and anti-replay setting > will not automatically enabled libipsec. >=20 > Signed-off-by: Hemant Agrawal > Acked-by: Konstantin Ananyev > --- > app/test/test_ipsec.c | 2 +- > doc/guides/rel_notes/release_19_11.rst | 7 +++++-- > examples/ipsec-secgw/ipsec-secgw.c | 5 ----- > examples/ipsec-secgw/ipsec.c | 4 ++++ > examples/ipsec-secgw/sa.c | 2 +- > lib/librte_ipsec/Makefile | 2 +- > lib/librte_ipsec/meson.build | 1 + > lib/librte_ipsec/rte_ipsec_sa.h | 6 ------ > lib/librte_ipsec/sa.c | 4 ++-- > 9 files changed, 15 insertions(+), 18 deletions(-) >=20 > diff --git a/app/test/test_ipsec.c b/app/test/test_ipsec.c > index 4007eff19..7dc83fee7 100644 > --- a/app/test/test_ipsec.c > +++ b/app/test/test_ipsec.c > @@ -689,11 +689,11 @@ fill_ipsec_param(uint32_t replay_win_sz, uint64_t > flags) >=20 > prm->userdata =3D 1; > prm->flags =3D flags; > - prm->replay_win_sz =3D replay_win_sz; >=20 > /* setup ipsec xform */ > prm->ipsec_xform =3D ut_params->ipsec_xform; > prm->ipsec_xform.salt =3D (uint32_t)rte_rand(); > + prm->ipsec_xform.replay_win_sz =3D replay_win_sz; >=20 > /* setup tunnel related fields */ > prm->tun.hdr_len =3D sizeof(ipv4_outer); > diff --git a/doc/guides/rel_notes/release_19_11.rst > b/doc/guides/rel_notes/release_19_11.rst > index dcae08002..0504a3443 100644 > --- a/doc/guides/rel_notes/release_19_11.rst > +++ b/doc/guides/rel_notes/release_19_11.rst > @@ -369,10 +369,13 @@ ABI Changes > align the Ethernet header on receive and all known encapsulations > preserve the alignment of the header. >=20 > -* security: A new field ''replay_win_sz'' has been added to the structur= e > +* security: The field ''replay_win_sz'' has been moved from ipsec librar= y > + based ''rte_ipsec_sa_prm'' structure to security library based structu= re > ``rte_security_ipsec_xform``, which specify the Anti replay window siz= e > to enable sequence replay attack handling. >=20 > +* ipsec: The field ''replay_win_sz'' has been removed from the structure > + ''rte_ipsec_sa_prm'' as it has been added to the security library. >=20 > Shared Library Versions > ----------------------- > @@ -415,7 +418,7 @@ The libraries prepended with a plus sign were > incremented in this version. > librte_gso.so.1 > librte_hash.so.2 > librte_ip_frag.so.1 > - librte_ipsec.so.1 > + + librte_ipsec.so.2 > librte_jobstats.so.1 > librte_kni.so.2 > librte_kvargs.so.1 > diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec- > secgw/ipsec-secgw.c > index b12936470..3b5aaf683 100644 > --- a/examples/ipsec-secgw/ipsec-secgw.c > +++ b/examples/ipsec-secgw/ipsec-secgw.c > @@ -1424,9 +1424,6 @@ print_app_sa_prm(const struct app_sa_prm *prm) > printf("librte_ipsec usage: %s\n", > (prm->enable =3D=3D 0) ? "disabled" : "enabled"); >=20 > - if (prm->enable =3D=3D 0) > - return; > - > printf("replay window size: %u\n", prm->window_size); > printf("ESN: %s\n", (prm->enable_esn =3D=3D 0) ? "disabled" : "enabled"= ); > printf("SA flags: %#" PRIx64 "\n", prm->flags); > @@ -1495,11 +1492,9 @@ parse_args(int32_t argc, char **argv) > app_sa_prm.enable =3D 1; > break; > case 'w': > - app_sa_prm.enable =3D 1; > app_sa_prm.window_size =3D parse_decimal(optarg); > break; > case 'e': > - app_sa_prm.enable =3D 1; > app_sa_prm.enable_esn =3D 1; > break; > case 'a': > diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c > index d7761e966..d4b57121a 100644 > --- a/examples/ipsec-secgw/ipsec.c > +++ b/examples/ipsec-secgw/ipsec.c > @@ -49,6 +49,8 @@ set_ipsec_conf(struct ipsec_sa *sa, struct > rte_security_ipsec_xform *ipsec) > /* TODO support for Transport */ > } > ipsec->esn_soft_limit =3D IPSEC_OFFLOAD_ESN_SOFTLIMIT; > + ipsec->replay_win_sz =3D app_sa_prm.window_size; > + ipsec->options.esn =3D app_sa_prm.enable_esn; > } >=20 > int > @@ -92,6 +94,7 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, > struct ipsec_sa *sa, > .spi =3D sa->spi, > .salt =3D sa->salt, > .options =3D { 0 }, > + .replay_win_sz =3D 0, > .direction =3D sa->direction, > .proto =3D RTE_SECURITY_IPSEC_SA_PROTO_ESP, > .mode =3D (IS_TUNNEL(sa->flags)) ? > @@ -151,6 +154,7 @@ create_inline_session(struct socket_ctx *skt_ctx, str= uct > ipsec_sa *sa, > .spi =3D sa->spi, > .salt =3D sa->salt, > .options =3D { 0 }, > + .replay_win_sz =3D 0, > .direction =3D sa->direction, > .proto =3D RTE_SECURITY_IPSEC_SA_PROTO_ESP, > .mode =3D (sa->flags =3D=3D IP4_TUNNEL || > diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c > index a8dee342e..4605a3a6c 100644 > --- a/examples/ipsec-secgw/sa.c > +++ b/examples/ipsec-secgw/sa.c > @@ -1115,7 +1115,7 @@ fill_ipsec_app_sa_prm(struct rte_ipsec_sa_prm *prm, >=20 > prm->flags =3D app_prm->flags; > prm->ipsec_xform.options.esn =3D app_prm->enable_esn; > - prm->replay_win_sz =3D app_prm->window_size; > + prm->ipsec_xform.replay_win_sz =3D app_prm->window_size; > } >=20 > static int > diff --git a/lib/librte_ipsec/Makefile b/lib/librte_ipsec/Makefile > index 81fb99980..161ea9e3d 100644 > --- a/lib/librte_ipsec/Makefile > +++ b/lib/librte_ipsec/Makefile > @@ -14,7 +14,7 @@ LDLIBS +=3D -lrte_cryptodev -lrte_security -lrte_hash >=20 > EXPORT_MAP :=3D rte_ipsec_version.map >=20 > -LIBABIVER :=3D 1 > +LIBABIVER :=3D 2 >=20 > # all source are stored in SRCS-y > SRCS-$(CONFIG_RTE_LIBRTE_IPSEC) +=3D esp_inb.c > diff --git a/lib/librte_ipsec/meson.build b/lib/librte_ipsec/meson.build > index 70358526b..e8604dadd 100644 > --- a/lib/librte_ipsec/meson.build > +++ b/lib/librte_ipsec/meson.build > @@ -1,6 +1,7 @@ > # SPDX-License-Identifier: BSD-3-Clause > # Copyright(c) 2018 Intel Corporation >=20 > +version =3D 2 > allow_experimental_apis =3D true >=20 > sources =3D files('esp_inb.c', 'esp_outb.c', 'sa.c', 'ses.c', 'ipsec_sad= .c') > diff --git a/lib/librte_ipsec/rte_ipsec_sa.h b/lib/librte_ipsec/rte_ipsec= _sa.h > index 47ce169d2..1cfde5874 100644 > --- a/lib/librte_ipsec/rte_ipsec_sa.h > +++ b/lib/librte_ipsec/rte_ipsec_sa.h > @@ -47,12 +47,6 @@ struct rte_ipsec_sa_prm { > uint8_t proto; /**< next header protocol */ > } trs; /**< transport mode related parameters */ > }; > - > - /** > - * window size to enable sequence replay attack handling. > - * replay checking is disabled if the window size is 0. > - */ > - uint32_t replay_win_sz; > }; >=20 > /** > diff --git a/lib/librte_ipsec/sa.c b/lib/librte_ipsec/sa.c > index 23d394b46..6f1d92c3c 100644 > --- a/lib/librte_ipsec/sa.c > +++ b/lib/librte_ipsec/sa.c > @@ -439,7 +439,7 @@ rte_ipsec_sa_size(const struct rte_ipsec_sa_prm *prm) > return rc; >=20 > /* determine required size */ > - wsz =3D prm->replay_win_sz; > + wsz =3D prm->ipsec_xform.replay_win_sz; > return ipsec_sa_size(type, &wsz, &nb); > } >=20 > @@ -461,7 +461,7 @@ rte_ipsec_sa_init(struct rte_ipsec_sa *sa, const stru= ct > rte_ipsec_sa_prm *prm, > return rc; >=20 > /* determine required size */ > - wsz =3D prm->replay_win_sz; > + wsz =3D prm->ipsec_xform.replay_win_sz; > sz =3D ipsec_sa_size(type, &wsz, &nb); > if (sz < 0) > return sz; > -- > 2.17.1