From patchwork Tue Oct 8 09:40:08 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Vladimir Medvedkin X-Patchwork-Id: 60688 Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 2088B1C0D4; Tue, 8 Oct 2019 11:40:21 +0200 (CEST) Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by dpdk.org (Postfix) with ESMTP id 5ECE11C037 for ; Tue, 8 Oct 2019 11:40:19 +0200 (CEST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Oct 2019 02:40:18 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.67,270,1566889200"; d="scan'208";a="187249336" Received: from silpixa00400072.ir.intel.com ([10.237.222.213]) by orsmga008.jf.intel.com with ESMTP; 08 Oct 2019 02:40:16 -0700 From: Vladimir Medvedkin To: dev@dpdk.org Cc: konstantin.ananyev@intel.com, bernard.iremonger@intel.com, akhil.goyal@nxp.com Date: Tue, 8 Oct 2019 10:40:08 +0100 Message-Id: X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 In-Reply-To: References: Subject: [dpdk-dev] [PATCH v3 0/5] ipsec: add inbound SAD X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" According to RFC 4301 IPSec implementation needs an inbound SA database (SAD). For each incoming inbound IPSec-protected packet (ESP or AH) it has to perform a lookup within it’s SAD. Lookup should be performed by: Security Parameters Index (SPI) + destination IP (DIP) + source IP (SIP) or SPI + DIP or SPI only and an implementation has to return the “longest” existing match. These series extend DPDK IPsec library with SAD table implementation that: - conforms to the RFC requirements above - can scale up to millions of entries - supports fast lookups - supports incremental updates Initial series provide an API to create/destroy SAD, and to add/delete/lookup entries within given SAD table. Under the hood it uses three librte_hash tables each of which contains an entries for a specific SA type (either it is addressed by SPI only or SPI+DIP or SPI+DIP+SIP) Also this patch series introduce test-sad application to measure performance of the library. According to our measurements on SKX for 1M entries average lookup cost is ~80 cycles, average add cost ~500 cycles. Next Steps: - integration with ipsec-secgw - documentation v3: - fixes in rte_ipsec_sad_create() and rte_ipsec_sad_find_existing() - fix typos - updated commit messages v2: - various bugs fixed - rte_ipsec_sad_free renamed to rte_ipsec_sad_destroy - added const qualifier to rte_ipsec_sad_key *key for add/delete - added more comments into the code - added ipv6 support into the testsad app - added measurement into the testsad app - random SPI values are generated without dups - added support for configurable burst size in testsad app - added verbose mode into the testsad app Vladimir Medvedkin (5): ipsec: add inbound SAD API ipsec: add SAD create/destroy implementation ipsec: add SAD add/delete/lookup implementation test/ipsec: add ipsec SAD autotests app: add test-sad application app/Makefile | 1 + app/meson.build | 3 +- app/test-sad/Makefile | 18 + app/test-sad/main.c | 662 ++++++++++++++++++++++++ app/test-sad/meson.build | 6 + app/test/Makefile | 1 + app/test/autotest_data.py | 6 + app/test/meson.build | 1 + app/test/test_ipsec_sad.c | 885 +++++++++++++++++++++++++++++++++ lib/librte_ipsec/Makefile | 4 +- lib/librte_ipsec/ipsec_sad.c | 520 +++++++++++++++++++ lib/librte_ipsec/meson.build | 6 +- lib/librte_ipsec/rte_ipsec.h | 1 + lib/librte_ipsec/rte_ipsec_sad.h | 175 +++++++ lib/librte_ipsec/rte_ipsec_version.map | 7 + 15 files changed, 2291 insertions(+), 5 deletions(-) create mode 100644 app/test-sad/Makefile create mode 100644 app/test-sad/main.c create mode 100644 app/test-sad/meson.build create mode 100644 app/test/test_ipsec_sad.c create mode 100644 lib/librte_ipsec/ipsec_sad.c create mode 100644 lib/librte_ipsec/rte_ipsec_sad.h