From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <dev-bounces@dpdk.org>
Received: from dpdk.org (dpdk.org [92.243.14.124])
	by inbox.dpdk.org (Postfix) with ESMTP id 6067AA317C
	for <public@inbox.dpdk.org>; Thu, 17 Oct 2019 17:48:12 +0200 (CEST)
Received: from [92.243.14.124] (localhost [127.0.0.1])
	by dpdk.org (Postfix) with ESMTP id 0619B1E989;
	Thu, 17 Oct 2019 17:48:11 +0200 (CEST)
Received: from mga12.intel.com (mga12.intel.com [192.55.52.136])
 by dpdk.org (Postfix) with ESMTP id 2D2941E930
 for <dev@dpdk.org>; Thu, 17 Oct 2019 17:48:08 +0200 (CEST)
X-Amp-Result: SKIPPED(no attachment in message)
X-Amp-File-Uploaded: False
Received: from orsmga005.jf.intel.com ([10.7.209.41])
 by fmsmga106.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384;
 17 Oct 2019 08:48:08 -0700
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.67,308,1566889200"; d="scan'208";a="371174127"
Received: from silpixa00400072.ir.intel.com ([10.237.222.213])
 by orsmga005.jf.intel.com with ESMTP; 17 Oct 2019 08:48:06 -0700
From: Vladimir Medvedkin <vladimir.medvedkin@intel.com>
To: dev@dpdk.org
Cc: konstantin.ananyev@intel.com, bernard.iremonger@intel.com,
 akhil.goyal@nxp.com
Date: Thu, 17 Oct 2019 16:47:57 +0100
Message-Id: <cover.1571322982.git.vladimir.medvedkin@intel.com>
X-Mailer: git-send-email 2.7.4
MIME-Version: 1.0
In-Reply-To: <cover.1570725871.git.vladimir.medvedkin@intel.com>
References: <cover.1570725871.git.vladimir.medvedkin@intel.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Subject: [dpdk-dev] [PATCH v6 0/6] ipsec: add inbound SAD
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Sender: "dev" <dev-bounces@dpdk.org>

According to RFC 4301 IPSec implementation needs an inbound SA database (SAD).
For each incoming inbound IPSec-protected packet (ESP or AH) it has to
perform a lookup within it’s SAD.
Lookup should be performed by:
Security Parameters Index (SPI) + destination IP (DIP) + source IP (SIP)
  or SPI + DIP
  or SPI only
and an implementation has to return the “longest” existing match.
These series extend DPDK IPsec library with SAD table implementation that:
- conforms to the RFC requirements above
- can scale up to millions of entries
- supports fast lookups
- supports incremental updates

Initial series provide an API to create/destroy SAD, and to
add/delete/lookup entries within given SAD table.
Under the hood it uses three librte_hash tables each of which contains
an entries for a specific SA type (either it is addressed by SPI only
or SPI+DIP or SPI+DIP+SIP) Also this patch series introduce test-sad
application to measure performance of the library. According to our
measurements on SKX for 1M entries average lookup cost is ~80 cycles,
average add cost ~500 cycles.

v6:
- fix rte_ipsec_sad_lookup() comments regarding return value
- added parallel lookup feature to test-sad app
- added read/write concurrency support flag to test-sad app
- added programmer's guide
- updated release notes

v5:
- small fix in rte_ipsec_sad_create()
- add comments in rte_ipsec_sad.h

v4:
- fixes in test-sad app
- small fixes in rte_ipsec_sad_create()
- fixes in test_find_existing() from unittests

v3:
- fixes in rte_ipsec_sad_create() and rte_ipsec_sad_find_existing()
- fix typos
- updated commit messages
- added test_find_existing() in unittests

v2:
- various bugs fixed
- rte_ipsec_sad_free renamed to rte_ipsec_sad_destroy
- added const qualifier to rte_ipsec_sad_key *key for add/delete
- added more comments into the code
- added ipv6 support into the testsad app
- added <DEL> measurement into the testsad app
- random SPI values are generated without dups
- added support for configurable burst size in testsad app
- added verbose mode into the testsad app

Vladimir Medvedkin (6):
  ipsec: add inbound SAD API
  ipsec: add SAD create/destroy implementation
  ipsec: add SAD add/delete/lookup implementation
  test/ipsec: add ipsec SAD autotests
  app: add test-sad application
  doc/ipsec: update ipsec programmer's guide

 app/Makefile                           |   1 +
 app/meson.build                        |   3 +-
 app/test-sad/Makefile                  |  18 +
 app/test-sad/main.c                    | 668 +++++++++++++++++++++++++
 app/test-sad/meson.build               |   6 +
 app/test/Makefile                      |   1 +
 app/test/autotest_data.py              |   6 +
 app/test/meson.build                   |   1 +
 app/test/test_ipsec_sad.c              | 887 +++++++++++++++++++++++++++++++++
 doc/guides/prog_guide/ipsec_lib.rst    | 152 ++++++
 doc/guides/rel_notes/release_19_11.rst |   3 +
 lib/librte_ipsec/Makefile              |   4 +-
 lib/librte_ipsec/ipsec_sad.c           | 515 +++++++++++++++++++
 lib/librte_ipsec/meson.build           |   6 +-
 lib/librte_ipsec/rte_ipsec_sad.h       | 176 +++++++
 lib/librte_ipsec/rte_ipsec_version.map |   7 +
 16 files changed, 2449 insertions(+), 5 deletions(-)
 create mode 100644 app/test-sad/Makefile
 create mode 100644 app/test-sad/main.c
 create mode 100644 app/test-sad/meson.build
 create mode 100644 app/test/test_ipsec_sad.c
 create mode 100644 lib/librte_ipsec/ipsec_sad.c
 create mode 100644 lib/librte_ipsec/rte_ipsec_sad.h

-- 
2.7.4