diff mbox series

[3/3] examples/ipsec-secgw: refactor inline capability check

Message ID 20230216142442.3657742-3-gakhil@marvell.com (mailing list archive)
State Accepted, archived
Delegated to: akhil goyal
Headers
Series [1/3] examples/ipsec-secgw: fix auth IV length |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/loongarch-compilation success Compilation OK
ci/loongarch-unit-testing success Unit Testing PASS
ci/iol-mellanox-Performance success Performance Testing PASS
ci/iol-broadcom-Functional fail Functional Testing issues
ci/iol-broadcom-Performance success Performance Testing PASS
ci/iol-intel-Performance success Performance Testing PASS
ci/iol-intel-Functional fail Functional Testing issues
ci/github-robot: build success github build: passed
ci/iol-testing success Testing PASS
ci/iol-x86_64-unit-testing success Testing PASS
ci/Intel-compilation success Compilation OK
ci/intel-Testing success Testing PASS
ci/iol-x86_64-compile-testing success Testing PASS
ci/iol-abi-testing success Testing PASS
ci/iol-aarch64-unit-testing success Testing PASS

Commit Message

Akhil Goyal Feb. 16, 2023, 2:24 p.m. UTC 
  In cases of inline IPsec, the supported ol_flags are
retrieved from security capability of device.
Now that capability checks are added before creating the session,
ol_flags can be retrieved from the same function call.

Signed-off-by: Akhil Goyal <gakhil@marvell.com>
---
 examples/ipsec-secgw/ipsec.c | 65 ++++++------------------------------
 1 file changed, 10 insertions(+), 55 deletions(-)

Comments

Ji, Kai Feb. 21, 2023, 1:13 p.m. UTC | #1 
Acked-by: Kai Ji <kai.ji@intel.com>

> -----Original Message-----
> From: Akhil Goyal <gakhil@marvell.com>
> Sent: Thursday, February 16, 2023 2:25 PM
> To: dev@dpdk.org
> Cc: Nicolau, Radu <radu.nicolau@intel.com>; anoobj@marvell.com;
> g.singh@nxp.com; hemant.agrawal@nxp.com; Ji, Kai <kai.ji@intel.com>;
> ruifeng.wang@arm.com; sunilprakashrao.uttarwar@amd.com;
> rnagadheeraj@marvell.com; matan@nvidia.com; Akhil Goyal
> <gakhil@marvell.com>
> Subject: [PATCH 3/3] examples/ipsec-secgw: refactor inline capability
> check
> 
> In cases of inline IPsec, the supported ol_flags are retrieved from
> security capability of device.
> Now that capability checks are added before creating the session,
> ol_flags can be retrieved from the same function call.
> 
> Signed-off-by: Akhil Goyal <gakhil@marvell.com>
> ---
diff mbox series

Patch

diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c
index c51f1b7eb2..a5c2b524a7 100644
--- a/examples/ipsec-secgw/ipsec.c
+++ b/examples/ipsec-secgw/ipsec.c
@@ -208,7 +208,8 @@  verify_ipsec_capabilities(struct rte_security_ipsec_xform *ipsec_xform,
 
 static inline int
 verify_security_capabilities(struct rte_security_ctx *ctx,
-		struct rte_security_session_conf *sess_conf)
+		struct rte_security_session_conf *sess_conf,
+		uint32_t *ol_flags)
 {
 	struct rte_security_capability_idx sec_cap_idx;
 	const struct rte_security_capability *sec_cap;
@@ -230,6 +231,9 @@  verify_security_capabilities(struct rte_security_ctx *ctx,
 	if (verify_ipsec_capabilities(&sess_conf->ipsec, sec_cap))
 		return -ENOTSUP;
 
+	if (ol_flags != NULL)
+		*ol_flags = sec_cap->ol_flags;
+
 	return 0;
 }
 
@@ -332,7 +336,7 @@  create_lookaside_session(struct ipsec_ctx *ipsec_ctx_lcore[],
 			/* Set IPsec parameters in conf */
 			set_ipsec_conf(sa, &(sess_conf.ipsec));
 
-			if (verify_security_capabilities(ctx, &sess_conf)) {
+			if (verify_security_capabilities(ctx, &sess_conf, NULL)) {
 				RTE_LOG(ERR, IPSEC,
 					"Requested security session config not supported\n");
 				return -1;
@@ -486,7 +490,6 @@  create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 
 	if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) {
 		struct rte_flow_error err;
-		const struct rte_security_capability *sec_cap;
 		int ret = 0;
 
 		sec_ctx = (struct rte_security_ctx *)
@@ -498,7 +501,8 @@  create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 			return -1;
 		}
 
-		if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+		if (verify_security_capabilities(sec_ctx, &sess_conf,
+					&ips->security.ol_flags)) {
 			RTE_LOG(ERR, IPSEC,
 				"Requested security session config not supported\n");
 			return -1;
@@ -512,27 +516,6 @@  create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 			return -1;
 		}
 
-		sec_cap = rte_security_capabilities_get(sec_ctx);
-
-		/* iterate until ESP tunnel*/
-		while (sec_cap->action != RTE_SECURITY_ACTION_TYPE_NONE) {
-			if (sec_cap->action == ips->type &&
-			    sec_cap->protocol ==
-				RTE_SECURITY_PROTOCOL_IPSEC &&
-			    sec_cap->ipsec.mode ==
-				RTE_SECURITY_IPSEC_SA_MODE_TUNNEL &&
-			    sec_cap->ipsec.direction == sa->direction)
-				break;
-			sec_cap++;
-		}
-
-		if (sec_cap->action == RTE_SECURITY_ACTION_TYPE_NONE) {
-			RTE_LOG(ERR, IPSEC,
-				"No suitable security capability found\n");
-			return -1;
-		}
-
-		ips->security.ol_flags = sec_cap->ol_flags;
 		ips->security.ctx = sec_ctx;
 		sa->pattern[0].type = RTE_FLOW_ITEM_TYPE_ETH;
 
@@ -676,8 +659,6 @@  create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 			return -1;
 		}
 	} else if (ips->type ==	RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) {
-		const struct rte_security_capability *sec_cap;
-
 		sec_ctx = (struct rte_security_ctx *)
 				rte_eth_dev_get_sec_ctx(sa->portid);
 
@@ -703,7 +684,8 @@  create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 
 		sess_conf.userdata = (void *) sa;
 
-		if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+		if (verify_security_capabilities(sec_ctx, &sess_conf,
+					&ips->security.ol_flags)) {
 			RTE_LOG(ERR, IPSEC,
 				"Requested security session config not supported\n");
 			return -1;
@@ -717,33 +699,6 @@  create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 			return -1;
 		}
 
-		sec_cap = rte_security_capabilities_get(sec_ctx);
-		if (sec_cap == NULL) {
-			RTE_LOG(ERR, IPSEC,
-				"No capabilities registered\n");
-			return -1;
-		}
-
-		/* iterate until ESP tunnel*/
-		while (sec_cap->action !=
-				RTE_SECURITY_ACTION_TYPE_NONE) {
-			if (sec_cap->action == ips->type &&
-			    sec_cap->protocol ==
-				RTE_SECURITY_PROTOCOL_IPSEC &&
-			    sec_cap->ipsec.mode ==
-				sess_conf.ipsec.mode &&
-			    sec_cap->ipsec.direction == sa->direction)
-				break;
-			sec_cap++;
-		}
-
-		if (sec_cap->action == RTE_SECURITY_ACTION_TYPE_NONE) {
-			RTE_LOG(ERR, IPSEC,
-				"No suitable security capability found\n");
-			return -1;
-		}
-
-		ips->security.ol_flags = sec_cap->ol_flags;
 		ips->security.ctx = sec_ctx;
 	}