From: Akhil Goyal <gakhil@marvell.com>
To: <dev@dpdk.org>
Cc: <radu.nicolau@intel.com>, <anoobj@marvell.com>, <g.singh@nxp.com>,
<hemant.agrawal@nxp.com>, <kai.ji@intel.com>,
<ruifeng.wang@arm.com>, <sunilprakashrao.uttarwar@amd.com>,
<rnagadheeraj@marvell.com>, <matan@nvidia.com>,
Akhil Goyal <gakhil@marvell.com>
Subject: [PATCH 3/3] examples/ipsec-secgw: refactor inline capability check
Date: Thu, 16 Feb 2023 19:54:42 +0530 [thread overview]
Message-ID: <20230216142442.3657742-3-gakhil@marvell.com> (raw)
In-Reply-To: <20230216142442.3657742-1-gakhil@marvell.com>
In cases of inline IPsec, the supported ol_flags are
retrieved from security capability of device.
Now that capability checks are added before creating the session,
ol_flags can be retrieved from the same function call.
Signed-off-by: Akhil Goyal <gakhil@marvell.com>
---
examples/ipsec-secgw/ipsec.c | 65 ++++++------------------------------
1 file changed, 10 insertions(+), 55 deletions(-)
diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c
index c51f1b7eb2..a5c2b524a7 100644
--- a/examples/ipsec-secgw/ipsec.c
+++ b/examples/ipsec-secgw/ipsec.c
@@ -208,7 +208,8 @@ verify_ipsec_capabilities(struct rte_security_ipsec_xform *ipsec_xform,
static inline int
verify_security_capabilities(struct rte_security_ctx *ctx,
- struct rte_security_session_conf *sess_conf)
+ struct rte_security_session_conf *sess_conf,
+ uint32_t *ol_flags)
{
struct rte_security_capability_idx sec_cap_idx;
const struct rte_security_capability *sec_cap;
@@ -230,6 +231,9 @@ verify_security_capabilities(struct rte_security_ctx *ctx,
if (verify_ipsec_capabilities(&sess_conf->ipsec, sec_cap))
return -ENOTSUP;
+ if (ol_flags != NULL)
+ *ol_flags = sec_cap->ol_flags;
+
return 0;
}
@@ -332,7 +336,7 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx_lcore[],
/* Set IPsec parameters in conf */
set_ipsec_conf(sa, &(sess_conf.ipsec));
- if (verify_security_capabilities(ctx, &sess_conf)) {
+ if (verify_security_capabilities(ctx, &sess_conf, NULL)) {
RTE_LOG(ERR, IPSEC,
"Requested security session config not supported\n");
return -1;
@@ -486,7 +490,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) {
struct rte_flow_error err;
- const struct rte_security_capability *sec_cap;
int ret = 0;
sec_ctx = (struct rte_security_ctx *)
@@ -498,7 +501,8 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
return -1;
}
- if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+ if (verify_security_capabilities(sec_ctx, &sess_conf,
+ &ips->security.ol_flags)) {
RTE_LOG(ERR, IPSEC,
"Requested security session config not supported\n");
return -1;
@@ -512,27 +516,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
return -1;
}
- sec_cap = rte_security_capabilities_get(sec_ctx);
-
- /* iterate until ESP tunnel*/
- while (sec_cap->action != RTE_SECURITY_ACTION_TYPE_NONE) {
- if (sec_cap->action == ips->type &&
- sec_cap->protocol ==
- RTE_SECURITY_PROTOCOL_IPSEC &&
- sec_cap->ipsec.mode ==
- RTE_SECURITY_IPSEC_SA_MODE_TUNNEL &&
- sec_cap->ipsec.direction == sa->direction)
- break;
- sec_cap++;
- }
-
- if (sec_cap->action == RTE_SECURITY_ACTION_TYPE_NONE) {
- RTE_LOG(ERR, IPSEC,
- "No suitable security capability found\n");
- return -1;
- }
-
- ips->security.ol_flags = sec_cap->ol_flags;
ips->security.ctx = sec_ctx;
sa->pattern[0].type = RTE_FLOW_ITEM_TYPE_ETH;
@@ -676,8 +659,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
return -1;
}
} else if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) {
- const struct rte_security_capability *sec_cap;
-
sec_ctx = (struct rte_security_ctx *)
rte_eth_dev_get_sec_ctx(sa->portid);
@@ -703,7 +684,8 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
sess_conf.userdata = (void *) sa;
- if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+ if (verify_security_capabilities(sec_ctx, &sess_conf,
+ &ips->security.ol_flags)) {
RTE_LOG(ERR, IPSEC,
"Requested security session config not supported\n");
return -1;
@@ -717,33 +699,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
return -1;
}
- sec_cap = rte_security_capabilities_get(sec_ctx);
- if (sec_cap == NULL) {
- RTE_LOG(ERR, IPSEC,
- "No capabilities registered\n");
- return -1;
- }
-
- /* iterate until ESP tunnel*/
- while (sec_cap->action !=
- RTE_SECURITY_ACTION_TYPE_NONE) {
- if (sec_cap->action == ips->type &&
- sec_cap->protocol ==
- RTE_SECURITY_PROTOCOL_IPSEC &&
- sec_cap->ipsec.mode ==
- sess_conf.ipsec.mode &&
- sec_cap->ipsec.direction == sa->direction)
- break;
- sec_cap++;
- }
-
- if (sec_cap->action == RTE_SECURITY_ACTION_TYPE_NONE) {
- RTE_LOG(ERR, IPSEC,
- "No suitable security capability found\n");
- return -1;
- }
-
- ips->security.ol_flags = sec_cap->ol_flags;
ips->security.ctx = sec_ctx;
}
--
2.25.1
next prev parent reply other threads:[~2023-02-16 14:25 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-16 14:24 [PATCH 1/3] examples/ipsec-secgw: fix auth IV length Akhil Goyal
2023-02-16 14:24 ` [PATCH 2/3] examples/ipsec-secgw: check capabilities before session create Akhil Goyal
2023-02-21 13:13 ` Ji, Kai
2023-02-16 14:24 ` Akhil Goyal [this message]
2023-02-21 13:13 ` [PATCH 3/3] examples/ipsec-secgw: refactor inline capability check Ji, Kai
2023-02-21 13:13 ` [PATCH 1/3] examples/ipsec-secgw: fix auth IV length Ji, Kai
2023-02-27 17:34 ` Akhil Goyal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230216142442.3657742-3-gakhil@marvell.com \
--to=gakhil@marvell.com \
--cc=anoobj@marvell.com \
--cc=dev@dpdk.org \
--cc=g.singh@nxp.com \
--cc=hemant.agrawal@nxp.com \
--cc=kai.ji@intel.com \
--cc=matan@nvidia.com \
--cc=radu.nicolau@intel.com \
--cc=rnagadheeraj@marvell.com \
--cc=ruifeng.wang@arm.com \
--cc=sunilprakashrao.uttarwar@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).