From patchwork Mon Feb 28 15:00:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Radu Nicolau X-Patchwork-Id: 108403 X-Patchwork-Delegate: qi.z.zhang@intel.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 907CAA0350; Mon, 28 Feb 2022 16:00:30 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 2F72F4068C; Mon, 28 Feb 2022 16:00:30 +0100 (CET) Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by mails.dpdk.org (Postfix) with ESMTP id 37E6540140; Mon, 28 Feb 2022 16:00:28 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1646060429; x=1677596429; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=wvpgs4vNqkbwrBBPKdDdwwnYAdHYaUV7c/io0xMxm5I=; b=iTUgf5Txw3PqhCmPXkySZaVab+9PKjPUY9lIJM3hskOwhBQjSvolA24v s7vpYNc3TgBO5M3ZhVF2VQ8zyLbZGnK6vg1Xq+dimioqALa+A63A6Rshl 3/IR6g8nG/Kj3iSY1jqemiRITBVJpiYLlnWpQemdOc+bgCp3Lc6XjXr2H 6Pfi798RFs6sGs5KTIRaSFujnd4lKrdH+XJNuxdX53DBqkHD66LWJxSOV 08/qbXouWEYE2gYdSo+uTTY8GmgDaH+q+dSDopqvA2aifj76WOCAr90JV trFgayaxBKG7WZaZgUt3+Dbb6AiryAz4U4fR9CKkdwAfu0Xn9FAuut/Wa A==; X-IronPort-AV: E=McAfee;i="6200,9189,10271"; a="233518738" X-IronPort-AV: E=Sophos;i="5.90,142,1643702400"; d="scan'208";a="233518738" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Feb 2022 07:00:26 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.90,142,1643702400"; d="scan'208";a="593246447" Received: from silpixa00400884.ir.intel.com ([10.243.22.82]) by fmsmga008.fm.intel.com with ESMTP; 28 Feb 2022 07:00:24 -0800 From: Radu Nicolau To: Jingjing Wu , Beilei Xing Cc: dev@dpdk.org, qi.z.zhang@intel.com, ferruh.yigit@intel.com, Radu Nicolau , stable@dpdk.org Subject: [PATCH v2] net/iavf: add NAT-T / UDP encapsulation support Date: Mon, 28 Feb 2022 15:00:22 +0000 Message-Id: <20220228150022.1845435-1-radu.nicolau@intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220224122729.1777159-1-radu.nicolau@intel.com> References: <20220224122729.1777159-1-radu.nicolau@intel.com> MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Add support for NAT-T / UDP encapsulated ESP. This fixes the inline crypto feature for iAVF which will not function properly without setting the UDP encapsulation options. Fixes: 6bc987ecb860 ("net/iavf: support IPsec inline crypto") Cc: stable@dpdk.org Signed-off-by: Radu Nicolau Reviewed-by: Qi Zhang --- drivers/common/iavf/virtchnl_inline_ipsec.h | 9 +++++++++ drivers/net/iavf/iavf_ipsec_crypto.c | 16 +++++++++++++--- drivers/net/iavf/iavf_ipsec_crypto.h | 4 +++- 3 files changed, 25 insertions(+), 4 deletions(-) diff --git a/drivers/common/iavf/virtchnl_inline_ipsec.h b/drivers/common/iavf/virtchnl_inline_ipsec.h index 1e9134501e..2f4bf15725 100644 --- a/drivers/common/iavf/virtchnl_inline_ipsec.h +++ b/drivers/common/iavf/virtchnl_inline_ipsec.h @@ -446,6 +446,15 @@ struct virtchnl_ipsec_sp_cfg { /* Set TC (congestion domain) if true. For future use. */ u8 set_tc; + + /* 0 for NAT-T unsupported, 1 for NAT-T supported */ + u8 is_udp; + + /* reserved */ + u8 reserved; + + /* NAT-T UDP port number. Only valid in case NAT-T supported */ + u16 udp_port; } __rte_packed; diff --git a/drivers/net/iavf/iavf_ipsec_crypto.c b/drivers/net/iavf/iavf_ipsec_crypto.c index a63e42f29a..d6875eb6aa 100644 --- a/drivers/net/iavf/iavf_ipsec_crypto.c +++ b/drivers/net/iavf/iavf_ipsec_crypto.c @@ -736,7 +736,9 @@ iavf_ipsec_crypto_inbound_security_policy_add(struct iavf_adapter *adapter, uint8_t is_v4, rte_be32_t v4_dst_addr, uint8_t *v6_dst_addr, - uint8_t drop) + uint8_t drop, + bool is_udp, + uint16_t udp_port) { struct inline_ipsec_msg *request = NULL, *response = NULL; size_t request_len, response_len; @@ -781,6 +783,8 @@ iavf_ipsec_crypto_inbound_security_policy_add(struct iavf_adapter *adapter, /** Traffic Class/Congestion Domain currently not support */ request->ipsec_data.sp_cfg->set_tc = 0; request->ipsec_data.sp_cfg->cgd = 0; + request->ipsec_data.sp_cfg->is_udp = is_udp; + request->ipsec_data.sp_cfg->udp_port = htons(udp_port); response_len = sizeof(struct inline_ipsec_msg) + sizeof(struct virtchnl_ipsec_sp_cfg_resp); @@ -1625,6 +1629,7 @@ struct iavf_ipsec_flow_item { struct rte_ipv6_hdr ipv6_hdr; }; struct rte_udp_hdr udp_hdr; + uint8_t is_udp; }; static void @@ -1737,6 +1742,7 @@ iavf_ipsec_flow_item_parse(struct rte_eth_dev *ethdev, parse_udp_item((const struct rte_flow_item_udp *) pattern[2].spec, &ipsec_flow->udp_hdr); + ipsec_flow->is_udp = true; ipsec_flow->spi = ((const struct rte_flow_item_esp *) pattern[3].spec)->hdr.spi; @@ -1806,7 +1812,9 @@ iavf_ipsec_flow_create(struct iavf_adapter *ad, 1, ipsec_flow->ipv4_hdr.dst_addr, NULL, - 0); + 0, + ipsec_flow->is_udp, + ipsec_flow->udp_hdr.dst_port); } else { ipsec_flow->id = iavf_ipsec_crypto_inbound_security_policy_add(ad, @@ -1814,7 +1822,9 @@ iavf_ipsec_flow_create(struct iavf_adapter *ad, 0, 0, ipsec_flow->ipv6_hdr.dst_addr, - 0); + 0, + ipsec_flow->is_udp, + ipsec_flow->udp_hdr.dst_port); } if (ipsec_flow->id < 1) { diff --git a/drivers/net/iavf/iavf_ipsec_crypto.h b/drivers/net/iavf/iavf_ipsec_crypto.h index 687541077a..8ea0f9540e 100644 --- a/drivers/net/iavf/iavf_ipsec_crypto.h +++ b/drivers/net/iavf/iavf_ipsec_crypto.h @@ -145,7 +145,9 @@ iavf_ipsec_crypto_inbound_security_policy_add(struct iavf_adapter *adapter, uint8_t is_v4, rte_be32_t v4_dst_addr, uint8_t *v6_dst_addr, - uint8_t drop); + uint8_t drop, + bool is_udp, + uint16_t udp_port); /** * Delete inbound security policy rule from hardware