Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/13397/?format=api
{ "id": 13397, "url": "http://patches.dpdk.org/api/patches/13397/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/patch/1465461770-42233-9-git-send-email-sergio.gonzalez.monroy@intel.com/", "project": { "id": 1, "url": "http://patches.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<1465461770-42233-9-git-send-email-sergio.gonzalez.monroy@intel.com>", "list_archive_url": "https://inbox.dpdk.org/dev/1465461770-42233-9-git-send-email-sergio.gonzalez.monroy@intel.com", "date": "2016-06-09T08:42:49", "name": "[dpdk-dev,v3,8/9] examples/ipsec-secgw: transport mode support", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": true, "hash": "bac2ef277c2d4ec7b4ff2af6b3cf88323c4c8b96", "submitter": { "id": 73, "url": "http://patches.dpdk.org/api/people/73/?format=api", "name": "Sergio Gonzalez Monroy", "email": "sergio.gonzalez.monroy@intel.com" }, "delegate": { "id": 1, "url": "http://patches.dpdk.org/api/users/1/?format=api", "username": "tmonjalo", "first_name": "Thomas", "last_name": "Monjalon", "email": "thomas@monjalon.net" }, "mbox": "http://patches.dpdk.org/project/dpdk/patch/1465461770-42233-9-git-send-email-sergio.gonzalez.monroy@intel.com/mbox/", "series": [], "comments": "http://patches.dpdk.org/api/patches/13397/comments/", "check": "pending", "checks": "http://patches.dpdk.org/api/patches/13397/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@dpdk.org", "Delivered-To": "patchwork@dpdk.org", "Received": [ "from [92.243.14.124] (localhost [IPv6:::1])\n\tby dpdk.org (Postfix) with ESMTP id 16F72C3A4;\n\tThu, 9 Jun 2016 10:43:09 +0200 (CEST)", "from mga11.intel.com (mga11.intel.com [192.55.52.93])\n\tby dpdk.org (Postfix) with ESMTP id 5027EC382\n\tfor <dev@dpdk.org>; Thu, 9 Jun 2016 10:43:06 +0200 (CEST)", "from orsmga003.jf.intel.com ([10.7.209.27])\n\tby fmsmga102.fm.intel.com with ESMTP; 09 Jun 2016 01:43:05 -0700", "from sie-lab-212-209.ir.intel.com (HELO\n\tsilpixa00377983.ir.intel.com) ([10.237.212.209])\n\tby orsmga003.jf.intel.com with ESMTP; 09 Jun 2016 01:43:04 -0700" ], "X-ExtLoop1": "1", "X-IronPort-AV": "E=Sophos;i=\"5.26,443,1459839600\"; d=\"scan'208\";a=\"824710915\"", "From": "Sergio Gonzalez Monroy <sergio.gonzalez.monroy@intel.com>", "To": "dev@dpdk.org", "Cc": "pablo.de.lara.guarch@intel.com,\n\tjohn.mcnamara@intel.com", "Date": "Thu, 9 Jun 2016 09:42:49 +0100", "Message-Id": "<1465461770-42233-9-git-send-email-sergio.gonzalez.monroy@intel.com>", "X-Mailer": "git-send-email 2.4.11", "In-Reply-To": "<1465461770-42233-1-git-send-email-sergio.gonzalez.monroy@intel.com>", "References": "<1463575330-8467-1-git-send-email-sergio.gonzalez.monroy@intel.com>\n\t<1465461770-42233-1-git-send-email-sergio.gonzalez.monroy@intel.com>", "Subject": "[dpdk-dev] [PATCH v3 8/9] examples/ipsec-secgw: transport mode\n\tsupport", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.15", "Precedence": "list", "List-Id": "patches and discussions about DPDK <dev.dpdk.org>", "List-Unsubscribe": "<http://dpdk.org/ml/options/dev>,\n\t<mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://dpdk.org/ml/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<http://dpdk.org/ml/listinfo/dev>,\n\t<mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org", "Sender": "\"dev\" <dev-bounces@dpdk.org>" }, "content": "IPSec transport mode support.\n\nSigned-off-by: Sergio Gonzalez Monroy <sergio.gonzalez.monroy@intel.com>\n---\n examples/ipsec-secgw/esp.c | 124 ++++++++++++++++++++++++++++++-------------\n examples/ipsec-secgw/ipsec.h | 1 +\n examples/ipsec-secgw/rt.c | 32 +++++++++++\n examples/ipsec-secgw/sa.c | 39 ++++++++++++++\n examples/ipsec-secgw/sp4.c | 40 ++++++++++++++\n examples/ipsec-secgw/sp6.c | 48 +++++++++++++++++\n 6 files changed, 248 insertions(+), 36 deletions(-)", "diff": "diff --git a/examples/ipsec-secgw/esp.c b/examples/ipsec-secgw/esp.c\nindex e1fde36..05caa77 100644\n--- a/examples/ipsec-secgw/esp.c\n+++ b/examples/ipsec-secgw/esp.c\n@@ -42,7 +42,6 @@\n #include <unistd.h>\n \n #include <rte_common.h>\n-#include <rte_memcpy.h>\n #include <rte_crypto.h>\n #include <rte_cryptodev.h>\n #include <rte_random.h>\n@@ -70,21 +69,24 @@ int\n esp_inbound(struct rte_mbuf *m, struct ipsec_sa *sa,\n \t\tstruct rte_crypto_op *cop)\n {\n-\tint32_t payload_len, ip_hdr_len;\n+\tstruct ip *ip4;\n \tstruct rte_crypto_sym_op *sym_cop;\n+\tint32_t payload_len, ip_hdr_len;\n \n \tRTE_ASSERT(m != NULL);\n \tRTE_ASSERT(sa != NULL);\n \tRTE_ASSERT(cop != NULL);\n \n-\tip_hdr_len = 0;\n-\tswitch (sa->flags) {\n-\tcase IP4_TUNNEL:\n-\t\tip_hdr_len = sizeof(struct ip);\n-\t\tbreak;\n-\tcase IP6_TUNNEL:\n+\tip4 = rte_pktmbuf_mtod(m, struct ip *);\n+\tif (likely(ip4->ip_v == IPVERSION))\n+\t\tip_hdr_len = ip4->ip_hl * 4;\n+\telse if (ip4->ip_v == IP6_VERSION)\n+\t\t/* XXX No option headers supported */\n \t\tip_hdr_len = sizeof(struct ip6_hdr);\n-\t\tbreak;\n+\telse {\n+\t\tRTE_LOG(ERR, IPSEC_ESP, \"invalid IP packet type %d\\n\",\n+\t\t\t\tip4->ip_v);\n+\t\treturn -EINVAL;\n \t}\n \n \tpayload_len = rte_pktmbuf_pkt_len(m) - ip_hdr_len -\n@@ -126,6 +128,8 @@ int\n esp_inbound_post(struct rte_mbuf *m, struct ipsec_sa *sa,\n \t\tstruct rte_crypto_op *cop)\n {\n+\tstruct ip *ip4, *ip;\n+\tstruct ip6_hdr *ip6;\n \tuint8_t *nexthdr, *pad_len;\n \tuint8_t *padding;\n \tuint16_t i;\n@@ -135,7 +139,7 @@ esp_inbound_post(struct rte_mbuf *m, struct ipsec_sa *sa,\n \tRTE_ASSERT(cop != NULL);\n \n \tif (cop->status != RTE_CRYPTO_OP_STATUS_SUCCESS) {\n-\t\tRTE_LOG(ERR, IPSEC_ESP, \"Failed crypto op\\n\");\n+\t\tRTE_LOG(ERR, IPSEC_ESP, \"failed crypto op\\n\");\n \t\treturn -1;\n \t}\n \n@@ -146,7 +150,7 @@ esp_inbound_post(struct rte_mbuf *m, struct ipsec_sa *sa,\n \tpadding = pad_len - *pad_len;\n \tfor (i = 0; i < *pad_len; i++) {\n \t\tif (padding[i] != i + 1) {\n-\t\t\tRTE_LOG(ERR, IPSEC_ESP, \"invalid pad_len field\\n\");\n+\t\t\tRTE_LOG(ERR, IPSEC_ESP, \"invalid padding\\n\");\n \t\t\treturn -EINVAL;\n \t\t}\n \t}\n@@ -157,7 +161,23 @@ esp_inbound_post(struct rte_mbuf *m, struct ipsec_sa *sa,\n \t\treturn -EINVAL;\n \t}\n \n-\tipip_inbound(m, sizeof(struct esp_hdr) + sa->iv_len);\n+\tif (unlikely(sa->flags == TRANSPORT)) {\n+\t\tip = rte_pktmbuf_mtod(m, struct ip *);\n+\t\tip4 = (struct ip *)rte_pktmbuf_adj(m,\n+\t\t\t\tsizeof(struct esp_hdr) + sa->iv_len);\n+\t\tif (likely(ip->ip_v == IPVERSION)) {\n+\t\t\tmemmove(ip4, ip, ip->ip_hl * 4);\n+\t\t\tip4->ip_p = *nexthdr;\n+\t\t\tip4->ip_len = htons(rte_pktmbuf_data_len(m));\n+\t\t} else {\n+\t\t\tip6 = (struct ip6_hdr *)ip4;\n+\t\t\t/* XXX No option headers supported */\n+\t\t\tmemmove(ip6, ip, sizeof(struct ip6_hdr));\n+\t\t\tip6->ip6_nxt = *nexthdr;\n+\t\t\tip6->ip6_plen = htons(rte_pktmbuf_data_len(m));\n+\t\t}\n+\t} else\n+\t\tipip_inbound(m, sizeof(struct esp_hdr) + sa->iv_len);\n \n \treturn 0;\n }\n@@ -166,31 +186,57 @@ int\n esp_outbound(struct rte_mbuf *m, struct ipsec_sa *sa,\n \t\tstruct rte_crypto_op *cop)\n {\n-\tuint16_t pad_payload_len, pad_len, ip_hdr_len;\n \tstruct ip *ip4;\n \tstruct ip6_hdr *ip6;\n-\tstruct esp_hdr *esp;\n-\tint32_t i;\n-\tchar *padding;\n+\tstruct esp_hdr *esp = NULL;\n+\tuint8_t *padding, *new_ip, nlp;\n \tstruct rte_crypto_sym_op *sym_cop;\n+\tint32_t i;\n+\tuint16_t pad_payload_len, pad_len, ip_hdr_len;\n \n \tRTE_ASSERT(m != NULL);\n \tRTE_ASSERT(sa != NULL);\n \tRTE_ASSERT(cop != NULL);\n \n-\t/* Payload length */\n-\tpad_payload_len = RTE_ALIGN_CEIL(rte_pktmbuf_pkt_len(m) + 2,\n-\t\t\tsa->block_size);\n-\tpad_len = pad_payload_len - rte_pktmbuf_pkt_len(m);\n-\n \tip_hdr_len = 0;\n-\tswitch (sa->flags) {\n-\tcase IP4_TUNNEL:\n+\n+\tip4 = rte_pktmbuf_mtod(m, struct ip *);\n+\tif (likely(ip4->ip_v == IPVERSION)) {\n+\t\tif (unlikely(sa->flags == TRANSPORT)) {\n+\t\t\tip_hdr_len = ip4->ip_hl * 4;\n+\t\t\tnlp = ip4->ip_p;\n+\t\t} else\n+\t\t\tnlp = IPPROTO_IPIP;\n+\t} else if (ip4->ip_v == IP6_VERSION) {\n+\t\tif (unlikely(sa->flags == TRANSPORT)) {\n+\t\t\t/* XXX No option headers supported */\n+\t\t\tip_hdr_len = sizeof(struct ip6_hdr);\n+\t\t\tip6 = (struct ip6_hdr *)ip4;\n+\t\t\tnlp = ip6->ip6_nxt;\n+\t\t} else\n+\t\t\tnlp = IPPROTO_IPV6;\n+\t} else {\n+\t\tRTE_LOG(ERR, IPSEC_ESP, \"invalid IP packet type %d\\n\",\n+\t\t\t\tip4->ip_v);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\t/* Padded payload length */\n+\tpad_payload_len = RTE_ALIGN_CEIL(rte_pktmbuf_pkt_len(m) -\n+\t\t\tip_hdr_len + 2, sa->block_size);\n+\tpad_len = pad_payload_len + ip_hdr_len - rte_pktmbuf_pkt_len(m);\n+\n+\tRTE_ASSERT(sa->flags == IP4_TUNNEL || sa->flags == IP6_TUNNEL ||\n+\t\t\tsa->flags == TRANSPORT);\n+\n+\tif (likely(sa->flags == IP4_TUNNEL))\n \t\tip_hdr_len = sizeof(struct ip);\n-\t\tbreak;\n-\tcase IP6_TUNNEL:\n+\telse if (sa->flags == IP6_TUNNEL)\n \t\tip_hdr_len = sizeof(struct ip6_hdr);\n-\t\tbreak;\n+\telse if (sa->flags != TRANSPORT) {\n+\t\tRTE_LOG(ERR, IPSEC_ESP, \"Unsupported SA flags: 0x%x\\n\",\n+\t\t\t\tsa->flags);\n+\t\treturn -EINVAL;\n \t}\n \n \t/* Check maximum packet size */\n@@ -200,7 +246,7 @@ esp_outbound(struct rte_mbuf *m, struct ipsec_sa *sa,\n \t\treturn -EINVAL;\n \t}\n \n-\tpadding = rte_pktmbuf_append(m, pad_len + sa->digest_len);\n+\tpadding = (uint8_t *)rte_pktmbuf_append(m, pad_len + sa->digest_len);\n \tif (unlikely(padding == NULL)) {\n \t\tRTE_LOG(ERR, IPSEC_ESP, \"not enough mbuf trailing space\\n\");\n \t\treturn -ENOSPC;\n@@ -218,10 +264,20 @@ esp_outbound(struct rte_mbuf *m, struct ipsec_sa *sa,\n \t\t\t\t&sa->src, &sa->dst);\n \t\tesp = (struct esp_hdr *)(ip6 + 1);\n \t\tbreak;\n-\tdefault:\n-\t\tRTE_LOG(ERR, IPSEC_ESP, \"Unsupported SA flags: 0x%x\\n\",\n-\t\t\t\tsa->flags);\n-\t\treturn -EINVAL;\n+\tcase TRANSPORT:\n+\t\tnew_ip = (uint8_t *)rte_pktmbuf_prepend(m,\n+\t\t\t\tsizeof(struct esp_hdr) + sa->iv_len);\n+\t\tmemmove(new_ip, ip4, ip_hdr_len);\n+\t\tesp = (struct esp_hdr *)(new_ip + ip_hdr_len);\n+\t\tif (likely(ip4->ip_v == IPVERSION)) {\n+\t\t\tip4 = (struct ip *)new_ip;\n+\t\t\tip4->ip_p = IPPROTO_ESP;\n+\t\t\tip4->ip_len = htons(rte_pktmbuf_data_len(m));\n+\t\t} else {\n+\t\t\tip6 = (struct ip6_hdr *)new_ip;\n+\t\t\tip6->ip6_nxt = IPPROTO_ESP;\n+\t\t\tip6->ip6_plen = htons(rte_pktmbuf_data_len(m));\n+\t\t}\n \t}\n \n \tsa->seq++;\n@@ -235,11 +291,7 @@ esp_outbound(struct rte_mbuf *m, struct ipsec_sa *sa,\n \tfor (i = 0; i < pad_len - 2; i++)\n \t\tpadding[i] = i + 1;\n \tpadding[pad_len - 2] = pad_len - 2;\n-\n-\tif (RTE_ETH_IS_IPV4_HDR(m->packet_type))\n-\t\tpadding[pad_len - 1] = IPPROTO_IPIP;\n-\telse\n-\t\tpadding[pad_len - 1] = IPPROTO_IPV6;\n+\tpadding[pad_len - 1] = nlp;\n \n \tsym_cop = (struct rte_crypto_sym_op *)(cop + 1);\n \ndiff --git a/examples/ipsec-secgw/ipsec.h b/examples/ipsec-secgw/ipsec.h\nindex 83d7b1c..0d2ee25 100644\n--- a/examples/ipsec-secgw/ipsec.h\n+++ b/examples/ipsec-secgw/ipsec.h\n@@ -103,6 +103,7 @@ struct ipsec_sa {\n \tuint16_t flags;\n #define IP4_TUNNEL (1 << 0)\n #define IP6_TUNNEL (1 << 1)\n+#define TRANSPORT (1 << 2)\n \tstruct ip_addr src;\n \tstruct ip_addr dst;\n \tstruct rte_crypto_sym_xform *xforms;\ndiff --git a/examples/ipsec-secgw/rt.c b/examples/ipsec-secgw/rt.c\nindex d46df49..fa5f042 100644\n--- a/examples/ipsec-secgw/rt.c\n+++ b/examples/ipsec-secgw/rt.c\n@@ -62,6 +62,9 @@ static struct ip4_route rt_ip4_ep0[] = {\n \t/* Tunnels */\n \t{ IPv4(172, 16, 2, 5), 32, 0 },\n \t{ IPv4(172, 16, 2, 6), 32, 1 },\n+\t/* Transport */\n+\t{ IPv4(192, 168, 175, 0), 24, 0 },\n+\t{ IPv4(192, 168, 176, 0), 24, 1 },\n \t/* Bypass */\n \t{ IPv4(192, 168, 240, 0), 24, 0 },\n \t{ IPv4(192, 168, 241, 0), 24, 1 },\n@@ -72,6 +75,9 @@ static struct ip4_route rt_ip4_ep0[] = {\n \t{ IPv4(192, 168, 116, 0), 24, 3 },\n \t{ IPv4(192, 168, 65, 0), 24, 2 },\n \t{ IPv4(192, 168, 66, 0), 24, 3 },\n+\t/* Transport */\n+\t{ IPv4(192, 168, 185, 0), 24, 2 },\n+\t{ IPv4(192, 168, 186, 0), 24, 3 },\n \t/* NULL */\n \t{ IPv4(192, 168, 210, 0), 24, 2 },\n \t{ IPv4(192, 168, 211, 0), 24, 3 },\n@@ -87,6 +93,11 @@ static struct ip6_route rt_ip6_ep0[] = {\n \t\t 0x22, 0x22, 0x22, 0x22, 0x22, 0x55, 0x55 }, 116, 0 },\n \t{ { 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,\n \t\t 0x22, 0x22, 0x22, 0x22, 0x22, 0x66, 0x66 }, 116, 1 },\n+\t/* Transport */\n+\t{ { 0x00, 0x00, 0x00, 0x00, 0x11, 0x11, 0x11, 0x11, 0x00,\n+\t\t 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 116, 0 },\n+\t{ { 0x00, 0x00, 0x00, 0x00, 0x11, 0x11, 0x11, 0x11, 0x11,\n+\t\t 0x11, 0x11, 0x11, 0x00, 0x00, 0x00, 0x00 }, 116, 1 },\n \t/* Inbound */\n \t/* Tunnels */\n \t{ { 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xaa,\n@@ -97,6 +108,11 @@ static struct ip6_route rt_ip6_ep0[] = {\n \t\t 0x55, 0x55, 0x55, 0x00, 0x00, 0x00, 0x00 }, 116, 2 },\n \t{ { 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x66,\n \t\t 0x66, 0x66, 0x66, 0x00, 0x00, 0x00, 0x00 }, 116, 3 },\n+\t/* Transport */\n+\t{ { 0xff, 0xff, 0x00, 0x00, 0x11, 0x11, 0x11, 0x11, 0x00,\n+\t\t 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 116, 2 },\n+\t{ { 0xff, 0xff, 0x00, 0x00, 0x11, 0x11, 0x11, 0x11, 0x11,\n+\t\t 0x11, 0x11, 0x11, 0x00, 0x00, 0x00, 0x00 }, 116, 3 },\n };\n \n static struct ip4_route rt_ip4_ep1[] = {\n@@ -104,6 +120,9 @@ static struct ip4_route rt_ip4_ep1[] = {\n \t/* Tunnels */\n \t{ IPv4(172, 16, 1, 5), 32, 0 },\n \t{ IPv4(172, 16, 1, 6), 32, 1 },\n+\t/* Transport */\n+\t{ IPv4(192, 168, 185, 0), 24, 0 },\n+\t{ IPv4(192, 168, 186, 0), 24, 1 },\n \t/* Bypass */\n \t{ IPv4(192, 168, 245, 0), 24, 0 },\n \t{ IPv4(192, 168, 246, 0), 24, 1 },\n@@ -114,6 +133,9 @@ static struct ip4_route rt_ip4_ep1[] = {\n \t{ IPv4(192, 168, 106, 0), 24, 3 },\n \t{ IPv4(192, 168, 55, 0), 24, 2 },\n \t{ IPv4(192, 168, 56, 0), 24, 3 },\n+\t/* Transport */\n+\t{ IPv4(192, 168, 175, 0), 24, 2 },\n+\t{ IPv4(192, 168, 176, 0), 24, 3 },\n \t/* NULL */\n \t{ IPv4(192, 168, 200, 0), 24, 2 },\n \t{ IPv4(192, 168, 201, 0), 24, 3 },\n@@ -129,6 +151,11 @@ static struct ip6_route rt_ip6_ep1[] = {\n \t\t 0x11, 0x11, 0x11, 0x11, 0x11, 0x55, 0x55 }, 116, 0 },\n \t{ { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,\n \t\t 0x11, 0x11, 0x11, 0x11, 0x11, 0x66, 0x66 }, 116, 1 },\n+\t/* Transport */\n+\t{ { 0xff, 0xff, 0x00, 0x00, 0x11, 0x11, 0x11, 0x11, 0x00,\n+\t\t 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 116, 0 },\n+\t{ { 0xff, 0xff, 0x00, 0x00, 0x11, 0x11, 0x11, 0x11, 0x11,\n+\t\t 0x11, 0x11, 0x11, 0x00, 0x00, 0x00, 0x00 }, 116, 1 },\n \n \t/* Inbound */\n \t/* Tunnels */\n@@ -140,6 +167,11 @@ static struct ip6_route rt_ip6_ep1[] = {\n \t\t 0x55, 0x55, 0x55, 0x00, 0x00, 0x00, 0x00 }, 116, 2 },\n \t{ { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x66,\n \t\t 0x66, 0x66, 0x66, 0x00, 0x00, 0x00, 0x00 }, 116, 3 },\n+\t/* Transport */\n+\t{ { 0x00, 0x00, 0x00, 0x00, 0x11, 0x11, 0x11, 0x11, 0x00,\n+\t\t 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 116, 2 },\n+\t{ { 0x00, 0x00, 0x00, 0x00, 0x11, 0x11, 0x11, 0x11, 0x11,\n+\t\t 0x11, 0x11, 0x11, 0x00, 0x00, 0x00, 0x00 }, 116, 3 },\n };\n \n void\ndiff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c\nindex 8b54beb..ab18b81 100644\n--- a/examples/ipsec-secgw/sa.c\n+++ b/examples/ipsec-secgw/sa.c\n@@ -74,6 +74,24 @@ const struct ipsec_sa sa_out[] = {\n \t.flags = IP4_TUNNEL\n \t},\n \t{\n+\t.spi = 10,\n+\t.cipher_algo = RTE_CRYPTO_CIPHER_AES_CBC,\n+\t.auth_algo = RTE_CRYPTO_AUTH_SHA1_HMAC,\n+\t.digest_len = 12,\n+\t.iv_len = 16,\n+\t.block_size = 16,\n+\t.flags = TRANSPORT\n+\t},\n+\t{\n+\t.spi = 11,\n+\t.cipher_algo = RTE_CRYPTO_CIPHER_AES_CBC,\n+\t.auth_algo = RTE_CRYPTO_AUTH_SHA1_HMAC,\n+\t.digest_len = 12,\n+\t.iv_len = 16,\n+\t.block_size = 16,\n+\t.flags = TRANSPORT\n+\t},\n+\t{\n \t.spi = 15,\n \t.src.ip4 = IPv4(172, 16, 1, 5),\n \t.dst.ip4 = IPv4(172, 16, 2, 5),\n@@ -148,6 +166,24 @@ const struct ipsec_sa sa_in[] = {\n \t.flags = IP4_TUNNEL\n \t},\n \t{\n+\t.spi = 110,\n+\t.cipher_algo = RTE_CRYPTO_CIPHER_AES_CBC,\n+\t.auth_algo = RTE_CRYPTO_AUTH_SHA1_HMAC,\n+\t.digest_len = 12,\n+\t.iv_len = 16,\n+\t.block_size = 16,\n+\t.flags = TRANSPORT\n+\t},\n+\t{\n+\t.spi = 111,\n+\t.cipher_algo = RTE_CRYPTO_CIPHER_AES_CBC,\n+\t.auth_algo = RTE_CRYPTO_AUTH_SHA1_HMAC,\n+\t.digest_len = 12,\n+\t.iv_len = 16,\n+\t.block_size = 16,\n+\t.flags = TRANSPORT\n+\t},\n+\t{\n \t.spi = 115,\n \t.src.ip4 = IPv4(172, 16, 2, 5),\n \t.dst.ip4 = IPv4(172, 16, 1, 5),\n@@ -447,6 +483,9 @@ single_inbound_lookup(struct ipsec_sa *sadb, struct rte_mbuf *pkt,\n \t\t\t\t!memcmp(&sa->src.ip6, src6_addr, 16) &&\n \t\t\t\t!memcmp(&sa->dst.ip6, src6_addr + 16, 16))\n \t\t\t*sa_ret = sa;\n+\t\tbreak;\n+\tcase TRANSPORT:\n+\t\t*sa_ret = sa;\n \t}\n }\n \ndiff --git a/examples/ipsec-secgw/sp4.c b/examples/ipsec-secgw/sp4.c\nindex 61720c8..9c4b256 100644\n--- a/examples/ipsec-secgw/sp4.c\n+++ b/examples/ipsec-secgw/sp4.c\n@@ -135,6 +135,26 @@ const struct acl4_rules acl4_rules_out[] = {\n \t.field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n \t},\n \t{\n+\t.data = {.userdata = PROTECT(10), .category_mask = 1, .priority = 1},\n+\t/* destination IPv4 */\n+\t.field[2] = {.value.u32 = IPv4(192, 168, 175, 0),\n+\t\t\t\t.mask_range.u32 = 24,},\n+\t/* source port */\n+\t.field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},\n+\t/* destination port */\n+\t.field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n+\t},\n+\t{\n+\t.data = {.userdata = PROTECT(11), .category_mask = 1, .priority = 1},\n+\t/* destination IPv4 */\n+\t.field[2] = {.value.u32 = IPv4(192, 168, 176, 0),\n+\t\t\t\t.mask_range.u32 = 24,},\n+\t/* source port */\n+\t.field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},\n+\t/* destination port */\n+\t.field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n+\t},\n+\t{\n \t.data = {.userdata = PROTECT(15), .category_mask = 1, .priority = 1},\n \t/* destination IPv4 */\n \t.field[2] = {.value.u32 = IPv4(192, 168, 200, 0),\n@@ -218,6 +238,26 @@ const struct acl4_rules acl4_rules_in[] = {\n \t.field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n \t},\n \t{\n+\t.data = {.userdata = PROTECT(110), .category_mask = 1, .priority = 1},\n+\t/* destination IPv4 */\n+\t.field[2] = {.value.u32 = IPv4(192, 168, 185, 0),\n+\t\t\t\t.mask_range.u32 = 24,},\n+\t/* source port */\n+\t.field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},\n+\t/* destination port */\n+\t.field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n+\t},\n+\t{\n+\t.data = {.userdata = PROTECT(111), .category_mask = 1, .priority = 1},\n+\t/* destination IPv4 */\n+\t.field[2] = {.value.u32 = IPv4(192, 168, 186, 0),\n+\t\t\t\t.mask_range.u32 = 24,},\n+\t/* source port */\n+\t.field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},\n+\t/* destination port */\n+\t.field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n+\t},\n+\t{\n \t.data = {.userdata = PROTECT(115), .category_mask = 1, .priority = 1},\n \t/* destination IPv4 */\n \t.field[2] = {.value.u32 = IPv4(192, 168, 210, 0),\ndiff --git a/examples/ipsec-secgw/sp6.c b/examples/ipsec-secgw/sp6.c\nindex c6fb851..1dda11a 100644\n--- a/examples/ipsec-secgw/sp6.c\n+++ b/examples/ipsec-secgw/sp6.c\n@@ -170,6 +170,30 @@ const struct acl6_rules acl6_rules_out[] = {\n \t.field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n \t},\n \t{\n+\t.data = {.userdata = PROTECT(10), .category_mask = 1, .priority = 1},\n+\t/* destination IPv6 */\n+\t.field[5] = {.value.u32 = 0x0, .mask_range.u32 = 32,},\n+\t.field[6] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},\n+\t.field[7] = {.value.u32 = 0x00000000, .mask_range.u32 = 32,},\n+\t.field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},\n+\t/* source port */\n+\t.field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},\n+\t/* destination port */\n+\t.field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n+\t},\n+\t{\n+\t.data = {.userdata = PROTECT(11), .category_mask = 1, .priority = 1},\n+\t/* destination IPv6 */\n+\t.field[5] = {.value.u32 = 0x0, .mask_range.u32 = 32,},\n+\t.field[6] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},\n+\t.field[7] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},\n+\t.field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},\n+\t/* source port */\n+\t.field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},\n+\t/* destination port */\n+\t.field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n+\t},\n+\t{\n \t.data = {.userdata = PROTECT(25), .category_mask = 1, .priority = 1},\n \t/* destination IPv6 */\n \t.field[5] = {.value.u32 = 0x0, .mask_range.u32 = 32,},\n@@ -221,6 +245,30 @@ const struct acl6_rules acl6_rules_in[] = {\n \t.field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n \t},\n \t{\n+\t.data = {.userdata = PROTECT(110), .category_mask = 1, .priority = 1},\n+\t/* destination IPv6 */\n+\t.field[5] = {.value.u32 = 0xffff0000, .mask_range.u32 = 32,},\n+\t.field[6] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},\n+\t.field[7] = {.value.u32 = 0x00000000, .mask_range.u32 = 32,},\n+\t.field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},\n+\t/* source port */\n+\t.field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},\n+\t/* destination port */\n+\t.field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n+\t},\n+\t{\n+\t.data = {.userdata = PROTECT(111), .category_mask = 1, .priority = 1},\n+\t/* destination IPv6 */\n+\t.field[5] = {.value.u32 = 0xffff0000, .mask_range.u32 = 32,},\n+\t.field[6] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},\n+\t.field[7] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},\n+\t.field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},\n+\t/* source port */\n+\t.field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},\n+\t/* destination port */\n+\t.field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}\n+\t},\n+\t{\n \t.data = {.userdata = PROTECT(125), .category_mask = 1, .priority = 1},\n \t/* destination IPv6 */\n \t.field[5] = {.value.u32 = 0xffff0000, .mask_range.u32 = 32,},\n", "prefixes": [ "dpdk-dev", "v3", "8/9" ] }