[v5,0/5] ipsec: add inbound SAD

  According to RFC 4301 IPSec implementation needs an inbound SA database (SAD).
For each incoming inbound IPSec-protected packet (ESP or AH) it has to
perform a lookup within it’s SAD.
Lookup should be performed by:
Security Parameters Index (SPI) + destination IP (DIP) + source IP (SIP)
  or SPI + DIP
  or SPI only
and an implementation has to return the “longest” existing match.
These series extend DPDK IPsec library with SAD table implementation that:
- conforms to the RFC requirements above
- can scale up to millions of entries
- supports fast lookups
- supports incremental updates

Initial series provide an API to create/destroy SAD, and to
add/delete/lookup entries within given SAD table.
Under the hood it uses three librte_hash tables each of which contains
an entries for a specific SA type (either it is addressed by SPI only
or SPI+DIP or SPI+DIP+SIP) Also this patch series introduce test-sad
application to measure performance of the library. According to our
measurements on SKX for 1M entries average lookup cost is ~80 cycles,
average add cost ~500 cycles.

Next Steps:
- integration with ipsec-secgw
- documentation

v5:
- small fix in rte_ipsec_sad_create()
- add comments in rte_ipsec_sad.h

v4:
- fixes in test-sad app
- small fixes in rte_ipsec_sad_create()
- fixes in test_find_existing() from unittests

v3:
- fixes in rte_ipsec_sad_create() and rte_ipsec_sad_find_existing()
- fix typos
- updated commit messages
- added test_find_existing() in unittests

v2:
- various bugs fixed
- rte_ipsec_sad_free renamed to rte_ipsec_sad_destroy
- added const qualifier to rte_ipsec_sad_key *key for add/delete
- added more comments into the code
- added ipv6 support into the testsad app
- added <DEL> measurement into the testsad app
- random SPI values are generated without dups
- added support for configurable burst size in testsad app
- added verbose mode into the testsad app


Vladimir Medvedkin (5):
  ipsec: add inbound SAD API
  ipsec: add SAD create/destroy implementation
  ipsec: add SAD add/delete/lookup implementation
  test/ipsec: add ipsec SAD autotests
  app: add test-sad application

 app/Makefile                           |   1 +
 app/meson.build                        |   3 +-
 app/test-sad/Makefile                  |  18 +
 app/test-sad/main.c                    | 644 ++++++++++++++++++++++++
 app/test-sad/meson.build               |   6 +
 app/test/Makefile                      |   1 +
 app/test/autotest_data.py              |   6 +
 app/test/meson.build                   |   1 +
 app/test/test_ipsec_sad.c              | 887 +++++++++++++++++++++++++++++++++
 lib/librte_ipsec/Makefile              |   4 +-
 lib/librte_ipsec/ipsec_sad.c           | 515 +++++++++++++++++++
 lib/librte_ipsec/meson.build           |   6 +-
 lib/librte_ipsec/rte_ipsec_sad.h       | 176 +++++++
 lib/librte_ipsec/rte_ipsec_version.map |   7 +
 14 files changed, 2270 insertions(+), 5 deletions(-)
 create mode 100644 app/test-sad/Makefile
 create mode 100644 app/test-sad/main.c
 create mode 100644 app/test-sad/meson.build
 create mode 100644 app/test/test_ipsec_sad.c
 create mode 100644 lib/librte_ipsec/ipsec_sad.c
 create mode 100644 lib/librte_ipsec/rte_ipsec_sad.h
  

> -----Original Message-----
> From: Vladimir Medvedkin <vladimir.medvedkin@intel.com>
> Sent: Thursday, October 10, 2019 10:19 PM
> To: dev@dpdk.org
> Cc: konstantin.ananyev@intel.com; bernard.iremonger@intel.com; Akhil Goyal
> <akhil.goyal@nxp.com>
> Subject: [PATCH v5 0/5] ipsec: add inbound SAD
> 
> According to RFC 4301 IPSec implementation needs an inbound SA database
> (SAD).
> For each incoming inbound IPSec-protected packet (ESP or AH) it has to
> perform a lookup within it’s SAD.
> Lookup should be performed by:
> Security Parameters Index (SPI) + destination IP (DIP) + source IP (SIP)
>   or SPI + DIP
>   or SPI only
> and an implementation has to return the “longest” existing match.
> These series extend DPDK IPsec library with SAD table implementation that:
> - conforms to the RFC requirements above
> - can scale up to millions of entries
> - supports fast lookups
> - supports incremental updates
> 
> Initial series provide an API to create/destroy SAD, and to
> add/delete/lookup entries within given SAD table.
> Under the hood it uses three librte_hash tables each of which contains
> an entries for a specific SA type (either it is addressed by SPI only
> or SPI+DIP or SPI+DIP+SIP) Also this patch series introduce test-sad
> application to measure performance of the library. According to our
> measurements on SKX for 1M entries average lookup cost is ~80 cycles,
> average add cost ~500 cycles.
> 
> Next Steps:
> - integration with ipsec-secgw
> - documentation

I believe documentation should be part of this patchset combined with the patches
which introduce that API.
Apart from that, 0ne comment is there on the lookup API return value.

Integration with IPSec Application can be done separately. No issues with that.
With this series, I think we don’t need the changes done in 
http://patches.dpdk.org/user/todo/dpdk/?series=6499
If it is agreed, I will move it as Rejected.

With Above changes - Series 
Acked-by: Akhil Goyal <akhil.goyal@nxp.com>

Please send these changes so that I can merge this series.



> 
> v5:
> - small fix in rte_ipsec_sad_create()
> - add comments in rte_ipsec_sad.h
> 
> v4:
> - fixes in test-sad app
> - small fixes in rte_ipsec_sad_create()
> - fixes in test_find_existing() from unittests
> 
> v3:
> - fixes in rte_ipsec_sad_create() and rte_ipsec_sad_find_existing()
> - fix typos
> - updated commit messages
> - added test_find_existing() in unittests
> 
> v2:
> - various bugs fixed
> - rte_ipsec_sad_free renamed to rte_ipsec_sad_destroy
> - added const qualifier to rte_ipsec_sad_key *key for add/delete
> - added more comments into the code
> - added ipv6 support into the testsad app
> - added <DEL> measurement into the testsad app
> - random SPI values are generated without dups
> - added support for configurable burst size in testsad app
> - added verbose mode into the testsad app
> 
> 
> Vladimir Medvedkin (5):
>   ipsec: add inbound SAD API
>   ipsec: add SAD create/destroy implementation
>   ipsec: add SAD add/delete/lookup implementation
>   test/ipsec: add ipsec SAD autotests
>   app: add test-sad application
> 
>  app/Makefile                           |   1 +
>  app/meson.build                        |   3 +-
>  app/test-sad/Makefile                  |  18 +
>  app/test-sad/main.c                    | 644 ++++++++++++++++++++++++
>  app/test-sad/meson.build               |   6 +
>  app/test/Makefile                      |   1 +
>  app/test/autotest_data.py              |   6 +
>  app/test/meson.build                   |   1 +
>  app/test/test_ipsec_sad.c              | 887
> +++++++++++++++++++++++++++++++++
>  lib/librte_ipsec/Makefile              |   4 +-
>  lib/librte_ipsec/ipsec_sad.c           | 515 +++++++++++++++++++
>  lib/librte_ipsec/meson.build           |   6 +-
>  lib/librte_ipsec/rte_ipsec_sad.h       | 176 +++++++
>  lib/librte_ipsec/rte_ipsec_version.map |   7 +
>  14 files changed, 2270 insertions(+), 5 deletions(-)
>  create mode 100644 app/test-sad/Makefile
>  create mode 100644 app/test-sad/main.c
>  create mode 100644 app/test-sad/meson.build
>  create mode 100644 app/test/test_ipsec_sad.c
>  create mode 100644 lib/librte_ipsec/ipsec_sad.c
>  create mode 100644 lib/librte_ipsec/rte_ipsec_sad.h
> 
> --
> 2.7.4