From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 4ACF9A054F; Mon, 15 Mar 2021 10:39:59 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 3A5502425FF; Mon, 15 Mar 2021 10:39:59 +0100 (CET) Received: from mx0b-0016f401.pphosted.com (mx0b-0016f401.pphosted.com [67.231.156.173]) by mails.dpdk.org (Postfix) with ESMTP id A446F242609 for ; Mon, 15 Mar 2021 10:39:57 +0100 (CET) Received: from pps.filterd (m0045851.ppops.net [127.0.0.1]) by mx0b-0016f401.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 12F9QpNE002529; Mon, 15 Mar 2021 02:39:57 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=pfpt0220; bh=PU0/krn4QjDI4uLKw6j4FsOH0XkXLJMgaaZRLQ1ngiw=; b=VTAOqBJAKiSBDadc4AVabfWyplCwOPrQHKrxoydNZMAV2wbuk3iCihCTOo0T9ASs+bvX mptSV/VEIHJN+9tnhjuMWjesU3tIFiTETdNizuTAXunn2oSN5ySlOO4ySiDkfHNsGfkZ 0H0GxdaWo+AV5HH59r3sOXyUt8qeLdQsEhgKswWP62y0J29JLrRhbbf/m7cKzo8eg+zc tRnKrnwov18Q2cF23udr+HQevYi/Xyfnx6dKX/yrk9YUJ7OdgaLwH9OBI8TLg1mz8Yaw StkVMS3Afm4yzVNUIfA3UUJpEmaDzRD6JGu05Nyj72TVoZ7JWyLQ1Bdv5jzlNmDxXkSw nA== Received: from dc6wp-exch01.marvell.com ([4.21.29.232]) by mx0b-0016f401.pphosted.com with ESMTP id 378wsqkuxy-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 15 Mar 2021 02:39:57 -0700 Received: from DC6WP-EXCH01.marvell.com (10.76.176.21) by DC6WP-EXCH01.marvell.com (10.76.176.21) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 15 Mar 2021 05:39:55 -0400 Received: from maili.marvell.com (10.76.176.51) by DC6WP-EXCH01.marvell.com (10.76.176.21) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Mon, 15 Mar 2021 05:39:55 -0400 Received: from hyd1554T5810.caveonetworks.com.com (unknown [10.29.57.11]) by maili.marvell.com (Postfix) with ESMTP id 3BF753F703F; Mon, 15 Mar 2021 02:39:53 -0700 (PDT) From: Tejasree Kondoj To: Akhil Goyal , Radu Nicolau CC: Tejasree Kondoj , Anoob Joseph , Ankur Dwivedi , Jerin Jacob , Date: Mon, 15 Mar 2021 16:06:15 +0530 Message-ID: <20210315103616.31364-3-ktejasree@marvell.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20210315103616.31364-1-ktejasree@marvell.com> References: <20210315103616.31364-1-ktejasree@marvell.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.369, 18.0.761 definitions=2021-03-15_03:2021-03-15, 2021-03-15 signatures=0 Subject: [dpdk-dev] [PATCH 2/3] examples/ipsec-secgw: add UDP encapsulation support X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Adding lookaside IPsec UDP encapsulation support for NAT traversal. Added --udp-encap option for application to specify if UDP encapsulation need to be enabled. Example secgw command with UDP encapsultation enabled: -c 0x1 -- -P -p 0x1 --config "(0,0,0)" -f ep0.cfg --udp-encap Signed-off-by: Tejasree Kondoj --- doc/guides/rel_notes/release_21_05.rst | 5 ++++ doc/guides/sample_app_ug/ipsec_secgw.rst | 5 +++- examples/ipsec-secgw/ipsec-secgw.c | 33 ++++++++++++++++++++++-- examples/ipsec-secgw/ipsec-secgw.h | 2 ++ examples/ipsec-secgw/ipsec.c | 1 + examples/ipsec-secgw/ipsec.h | 1 + examples/ipsec-secgw/sad.h | 5 +++- 7 files changed, 48 insertions(+), 4 deletions(-) diff --git a/doc/guides/rel_notes/release_21_05.rst b/doc/guides/rel_notes/release_21_05.rst index 66e28e21be..2e67038bfe 100644 --- a/doc/guides/rel_notes/release_21_05.rst +++ b/doc/guides/rel_notes/release_21_05.rst @@ -75,6 +75,11 @@ New Features * Added command to display Rx queue used descriptor count. ``show port (port_id) rxq (queue_id) desc used count`` +* **Updated ipsec-secgw sample application.** + + * Updated the ``ipsec-secgw`` sample application with UDP encapsulation + support for NAT Traversal. + Removed Items ------------- diff --git a/doc/guides/sample_app_ug/ipsec_secgw.rst b/doc/guides/sample_app_ug/ipsec_secgw.rst index 176e292d3f..099f499c18 100644 --- a/doc/guides/sample_app_ug/ipsec_secgw.rst +++ b/doc/guides/sample_app_ug/ipsec_secgw.rst @@ -139,6 +139,7 @@ The application has a number of command line options:: --reassemble NUM --mtu MTU --frag-ttl FRAG_TTL_NS + --udp-encap Where: @@ -234,6 +235,8 @@ Where: Should be lower for low number of reassembly buckets. Valid values: from 1 ns to 10 s. Default value: 10000000 (10 s). +* ``--udp-encap``: enables IPsec UDP Encapsulation for NAT Traversal. + The mapping of lcores to port/queues is similar to other l3fwd applications. @@ -1023,4 +1026,4 @@ Available options: * ``-h`` Show usage. If is specified, only tests for that mode will be invoked. For the -list of available modes please refer to run_test.sh. \ No newline at end of file +list of available modes please refer to run_test.sh. diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec-secgw/ipsec-secgw.c index 20d69ba813..57c8973e9d 100644 --- a/examples/ipsec-secgw/ipsec-secgw.c +++ b/examples/ipsec-secgw/ipsec-secgw.c @@ -115,6 +115,7 @@ struct flow_info flow_info_tbl[RTE_MAX_ETHPORTS]; #define CMD_LINE_OPT_REASSEMBLE "reassemble" #define CMD_LINE_OPT_MTU "mtu" #define CMD_LINE_OPT_FRAG_TTL "frag-ttl" +#define CMD_LINE_OPT_UDP_ENCAP "udp-encap" #define CMD_LINE_ARG_EVENT "event" #define CMD_LINE_ARG_POLL "poll" @@ -139,6 +140,7 @@ enum { CMD_LINE_OPT_REASSEMBLE_NUM, CMD_LINE_OPT_MTU_NUM, CMD_LINE_OPT_FRAG_TTL_NUM, + CMD_LINE_OPT_UDP_ENCAP_NUM, }; static const struct option lgopts[] = { @@ -152,6 +154,7 @@ static const struct option lgopts[] = { {CMD_LINE_OPT_REASSEMBLE, 1, 0, CMD_LINE_OPT_REASSEMBLE_NUM}, {CMD_LINE_OPT_MTU, 1, 0, CMD_LINE_OPT_MTU_NUM}, {CMD_LINE_OPT_FRAG_TTL, 1, 0, CMD_LINE_OPT_FRAG_TTL_NUM}, + {CMD_LINE_OPT_UDP_ENCAP, 0, 0, CMD_LINE_OPT_UDP_ENCAP_NUM}, {NULL, 0, 0, 0} }; @@ -360,6 +363,9 @@ prepare_one_packet(struct rte_mbuf *pkt, struct ipsec_traffic *t) const struct rte_ether_hdr *eth; const struct rte_ipv4_hdr *iph4; const struct rte_ipv6_hdr *iph6; + const struct rte_udp_hdr *udp; + uint16_t nat_port; + uint16_t ip4_hdr_len; eth = rte_pktmbuf_mtod(pkt, const struct rte_ether_hdr *); if (eth->ether_type == rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV4)) { @@ -368,9 +374,26 @@ prepare_one_packet(struct rte_mbuf *pkt, struct ipsec_traffic *t) RTE_ETHER_HDR_LEN); adjust_ipv4_pktlen(pkt, iph4, 0); - if (iph4->next_proto_id == IPPROTO_ESP) + switch (iph4->next_proto_id) { + case IPPROTO_ESP: t->ipsec.pkts[(t->ipsec.num)++] = pkt; - else { + break; + case IPPROTO_UDP: + if (app_sa_prm.udp_encap == 1) { + ip4_hdr_len = ((iph4->version_ihl & + RTE_IPV4_HDR_IHL_MASK) * + RTE_IPV4_IHL_MULTIPLIER); + udp = rte_pktmbuf_mtod_offset(pkt, + struct rte_udp_hdr *, ip4_hdr_len); + nat_port = rte_cpu_to_be_16(IPSEC_NAT_T_PORT); + if (udp->src_port == nat_port || + udp->dst_port == nat_port){ + t->ipsec.pkts[(t->ipsec.num)++] = pkt; + break; + } + } + /* Fall through */ + default: t->ip4.data[t->ip4.num] = &iph4->next_proto_id; t->ip4.pkts[(t->ip4.num)++] = pkt; } @@ -1378,6 +1401,7 @@ print_usage(const char *prgname) " [--" CMD_LINE_OPT_TX_OFFLOAD " TX_OFFLOAD_MASK]" " [--" CMD_LINE_OPT_REASSEMBLE " REASSEMBLE_TABLE_SIZE]" " [--" CMD_LINE_OPT_MTU " MTU]" + " [--" CMD_LINE_OPT_UDP_ENCAP "]" "\n\n" " -p PORTMASK: Hexadecimal bitmask of ports to configure\n" " -P : Enable promiscuous mode\n" @@ -1431,6 +1455,8 @@ print_usage(const char *prgname) " --" CMD_LINE_OPT_FRAG_TTL " FRAG_TTL_NS" ": fragments lifetime in nanoseconds, default\n" " and maximum value is 10.000.000.000 ns (10 s)\n" + " --" CMD_LINE_OPT_UDP_ENCAP + ": enables UDP Encapsulation for NAT Traversal\n" "\n", prgname); } @@ -1780,6 +1806,9 @@ parse_args(int32_t argc, char **argv, struct eh_conf *eh_conf) } frag_ttl_ns = ret; break; + case CMD_LINE_OPT_UDP_ENCAP_NUM: + app_sa_prm.udp_encap = 1; + break; default: print_usage(prgname); return -1; diff --git a/examples/ipsec-secgw/ipsec-secgw.h b/examples/ipsec-secgw/ipsec-secgw.h index f2281e73cf..6887d752ab 100644 --- a/examples/ipsec-secgw/ipsec-secgw.h +++ b/examples/ipsec-secgw/ipsec-secgw.h @@ -47,6 +47,8 @@ #define ETHADDR(a, b, c, d, e, f) (__BYTES_TO_UINT64(a, b, c, d, e, f, 0, 0)) +#define IPSEC_NAT_T_PORT 4500 + struct traffic_type { const uint8_t *data[MAX_PKT_BURST * 2]; struct rte_mbuf *pkts[MAX_PKT_BURST * 2]; diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c index 6baeeb342f..6e0caa198d 100644 --- a/examples/ipsec-secgw/ipsec.c +++ b/examples/ipsec-secgw/ipsec.c @@ -52,6 +52,7 @@ set_ipsec_conf(struct ipsec_sa *sa, struct rte_security_ipsec_xform *ipsec) ipsec->esn_soft_limit = IPSEC_OFFLOAD_ESN_SOFTLIMIT; ipsec->replay_win_sz = app_sa_prm.window_size; ipsec->options.esn = app_sa_prm.enable_esn; + ipsec->options.udp_encap = app_sa_prm.udp_encap; } int diff --git a/examples/ipsec-secgw/ipsec.h b/examples/ipsec-secgw/ipsec.h index 7031e28c46..430afea688 100644 --- a/examples/ipsec-secgw/ipsec.h +++ b/examples/ipsec-secgw/ipsec.h @@ -75,6 +75,7 @@ struct app_sa_prm { uint32_t window_size; /* replay window size */ uint32_t enable_esn; /* enable/disable ESN support */ uint32_t cache_sz; /* per lcore SA cache size */ + uint32_t udp_encap; /* enable/disable UDP Encapsulation */ uint64_t flags; /* rte_ipsec_sa_prm.flags */ }; diff --git a/examples/ipsec-secgw/sad.h b/examples/ipsec-secgw/sad.h index 473aaa938e..89b50488ec 100644 --- a/examples/ipsec-secgw/sad.h +++ b/examples/ipsec-secgw/sad.h @@ -77,6 +77,7 @@ sad_lookup(struct ipsec_sad *sad, struct rte_mbuf *pkts[], uint32_t spi, cache_idx; struct ipsec_sad_cache *cache; struct ipsec_sa *cached_sa; + uint16_t udp_hdr_len = 0; int is_ipv4; cache = &RTE_PER_LCORE(sad_cache); @@ -85,8 +86,10 @@ sad_lookup(struct ipsec_sad *sad, struct rte_mbuf *pkts[], for (i = 0; i < nb_pkts; i++) { ipv4 = rte_pktmbuf_mtod(pkts[i], struct rte_ipv4_hdr *); ipv6 = rte_pktmbuf_mtod(pkts[i], struct rte_ipv6_hdr *); + if (app_sa_prm.udp_encap == 1) + udp_hdr_len = sizeof(struct rte_udp_hdr); esp = rte_pktmbuf_mtod_offset(pkts[i], struct rte_esp_hdr *, - pkts[i]->l3_len); + pkts[i]->l3_len + udp_hdr_len); is_ipv4 = pkts[i]->packet_type & RTE_PTYPE_L3_IPV4; spi = rte_be_to_cpu_32(esp->spi); -- 2.27.0