Message ID | cover.1570725871.git.vladimir.medvedkin@intel.com (mailing list archive) |
---|---|
Headers |
Return-Path: <dev-bounces@dpdk.org> X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 88FE21E9D1; Thu, 10 Oct 2019 18:49:37 +0200 (CEST) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) by dpdk.org (Postfix) with ESMTP id 922461E969 for <dev@dpdk.org>; Thu, 10 Oct 2019 18:49:35 +0200 (CEST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 10 Oct 2019 09:49:32 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.67,280,1566889200"; d="scan'208";a="188024705" Received: from silpixa00400072.ir.intel.com ([10.237.222.213]) by orsmga008.jf.intel.com with ESMTP; 10 Oct 2019 09:49:28 -0700 From: Vladimir Medvedkin <vladimir.medvedkin@intel.com> To: dev@dpdk.org Cc: konstantin.ananyev@intel.com, bernard.iremonger@intel.com, akhil.goyal@nxp.com Date: Thu, 10 Oct 2019 17:49:21 +0100 Message-Id: <cover.1570725871.git.vladimir.medvedkin@intel.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 In-Reply-To: <cover.1570553345.git.vladimir.medvedkin@intel.com> References: <cover.1570553345.git.vladimir.medvedkin@intel.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [dpdk-dev] [PATCH v5 0/5] ipsec: add inbound SAD X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions <dev.dpdk.org> List-Unsubscribe: <https://mails.dpdk.org/options/dev>, <mailto:dev-request@dpdk.org?subject=unsubscribe> List-Archive: <http://mails.dpdk.org/archives/dev/> List-Post: <mailto:dev@dpdk.org> List-Help: <mailto:dev-request@dpdk.org?subject=help> List-Subscribe: <https://mails.dpdk.org/listinfo/dev>, <mailto:dev-request@dpdk.org?subject=subscribe> Errors-To: dev-bounces@dpdk.org Sender: "dev" <dev-bounces@dpdk.org> |
Series | ipsec: add inbound SAD | |
Message
Vladimir Medvedkin
Oct. 10, 2019, 4:49 p.m. UTC
According to RFC 4301 IPSec implementation needs an inbound SA database (SAD). For each incoming inbound IPSec-protected packet (ESP or AH) it has to perform a lookup within it’s SAD. Lookup should be performed by: Security Parameters Index (SPI) + destination IP (DIP) + source IP (SIP) or SPI + DIP or SPI only and an implementation has to return the “longest” existing match. These series extend DPDK IPsec library with SAD table implementation that: - conforms to the RFC requirements above - can scale up to millions of entries - supports fast lookups - supports incremental updates Initial series provide an API to create/destroy SAD, and to add/delete/lookup entries within given SAD table. Under the hood it uses three librte_hash tables each of which contains an entries for a specific SA type (either it is addressed by SPI only or SPI+DIP or SPI+DIP+SIP) Also this patch series introduce test-sad application to measure performance of the library. According to our measurements on SKX for 1M entries average lookup cost is ~80 cycles, average add cost ~500 cycles. Next Steps: - integration with ipsec-secgw - documentation v5: - small fix in rte_ipsec_sad_create() - add comments in rte_ipsec_sad.h v4: - fixes in test-sad app - small fixes in rte_ipsec_sad_create() - fixes in test_find_existing() from unittests v3: - fixes in rte_ipsec_sad_create() and rte_ipsec_sad_find_existing() - fix typos - updated commit messages - added test_find_existing() in unittests v2: - various bugs fixed - rte_ipsec_sad_free renamed to rte_ipsec_sad_destroy - added const qualifier to rte_ipsec_sad_key *key for add/delete - added more comments into the code - added ipv6 support into the testsad app - added <DEL> measurement into the testsad app - random SPI values are generated without dups - added support for configurable burst size in testsad app - added verbose mode into the testsad app Vladimir Medvedkin (5): ipsec: add inbound SAD API ipsec: add SAD create/destroy implementation ipsec: add SAD add/delete/lookup implementation test/ipsec: add ipsec SAD autotests app: add test-sad application app/Makefile | 1 + app/meson.build | 3 +- app/test-sad/Makefile | 18 + app/test-sad/main.c | 644 ++++++++++++++++++++++++ app/test-sad/meson.build | 6 + app/test/Makefile | 1 + app/test/autotest_data.py | 6 + app/test/meson.build | 1 + app/test/test_ipsec_sad.c | 887 +++++++++++++++++++++++++++++++++ lib/librte_ipsec/Makefile | 4 +- lib/librte_ipsec/ipsec_sad.c | 515 +++++++++++++++++++ lib/librte_ipsec/meson.build | 6 +- lib/librte_ipsec/rte_ipsec_sad.h | 176 +++++++ lib/librte_ipsec/rte_ipsec_version.map | 7 + 14 files changed, 2270 insertions(+), 5 deletions(-) create mode 100644 app/test-sad/Makefile create mode 100644 app/test-sad/main.c create mode 100644 app/test-sad/meson.build create mode 100644 app/test/test_ipsec_sad.c create mode 100644 lib/librte_ipsec/ipsec_sad.c create mode 100644 lib/librte_ipsec/rte_ipsec_sad.h
Comments
> -----Original Message----- > From: Vladimir Medvedkin <vladimir.medvedkin@intel.com> > Sent: Thursday, October 10, 2019 10:19 PM > To: dev@dpdk.org > Cc: konstantin.ananyev@intel.com; bernard.iremonger@intel.com; Akhil Goyal > <akhil.goyal@nxp.com> > Subject: [PATCH v5 0/5] ipsec: add inbound SAD > > According to RFC 4301 IPSec implementation needs an inbound SA database > (SAD). > For each incoming inbound IPSec-protected packet (ESP or AH) it has to > perform a lookup within it’s SAD. > Lookup should be performed by: > Security Parameters Index (SPI) + destination IP (DIP) + source IP (SIP) > or SPI + DIP > or SPI only > and an implementation has to return the “longest” existing match. > These series extend DPDK IPsec library with SAD table implementation that: > - conforms to the RFC requirements above > - can scale up to millions of entries > - supports fast lookups > - supports incremental updates > > Initial series provide an API to create/destroy SAD, and to > add/delete/lookup entries within given SAD table. > Under the hood it uses three librte_hash tables each of which contains > an entries for a specific SA type (either it is addressed by SPI only > or SPI+DIP or SPI+DIP+SIP) Also this patch series introduce test-sad > application to measure performance of the library. According to our > measurements on SKX for 1M entries average lookup cost is ~80 cycles, > average add cost ~500 cycles. > > Next Steps: > - integration with ipsec-secgw > - documentation I believe documentation should be part of this patchset combined with the patches which introduce that API. Apart from that, 0ne comment is there on the lookup API return value. Integration with IPSec Application can be done separately. No issues with that. With this series, I think we don’t need the changes done in http://patches.dpdk.org/user/todo/dpdk/?series=6499 If it is agreed, I will move it as Rejected. With Above changes - Series Acked-by: Akhil Goyal <akhil.goyal@nxp.com> Please send these changes so that I can merge this series. > > v5: > - small fix in rte_ipsec_sad_create() > - add comments in rte_ipsec_sad.h > > v4: > - fixes in test-sad app > - small fixes in rte_ipsec_sad_create() > - fixes in test_find_existing() from unittests > > v3: > - fixes in rte_ipsec_sad_create() and rte_ipsec_sad_find_existing() > - fix typos > - updated commit messages > - added test_find_existing() in unittests > > v2: > - various bugs fixed > - rte_ipsec_sad_free renamed to rte_ipsec_sad_destroy > - added const qualifier to rte_ipsec_sad_key *key for add/delete > - added more comments into the code > - added ipv6 support into the testsad app > - added <DEL> measurement into the testsad app > - random SPI values are generated without dups > - added support for configurable burst size in testsad app > - added verbose mode into the testsad app > > > Vladimir Medvedkin (5): > ipsec: add inbound SAD API > ipsec: add SAD create/destroy implementation > ipsec: add SAD add/delete/lookup implementation > test/ipsec: add ipsec SAD autotests > app: add test-sad application > > app/Makefile | 1 + > app/meson.build | 3 +- > app/test-sad/Makefile | 18 + > app/test-sad/main.c | 644 ++++++++++++++++++++++++ > app/test-sad/meson.build | 6 + > app/test/Makefile | 1 + > app/test/autotest_data.py | 6 + > app/test/meson.build | 1 + > app/test/test_ipsec_sad.c | 887 > +++++++++++++++++++++++++++++++++ > lib/librte_ipsec/Makefile | 4 +- > lib/librte_ipsec/ipsec_sad.c | 515 +++++++++++++++++++ > lib/librte_ipsec/meson.build | 6 +- > lib/librte_ipsec/rte_ipsec_sad.h | 176 +++++++ > lib/librte_ipsec/rte_ipsec_version.map | 7 + > 14 files changed, 2270 insertions(+), 5 deletions(-) > create mode 100644 app/test-sad/Makefile > create mode 100644 app/test-sad/main.c > create mode 100644 app/test-sad/meson.build > create mode 100644 app/test/test_ipsec_sad.c > create mode 100644 lib/librte_ipsec/ipsec_sad.c > create mode 100644 lib/librte_ipsec/rte_ipsec_sad.h > > -- > 2.7.4