[11/14] examples/ipsec-secgw: add app processing code
Checks
Commit Message
From: Lukasz Bartosik <lbartosik@marvell.com>
Add IPsec application processing code for event mode.
Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Signed-off-by: Lukasz Bartosik <lbartosik@marvell.com>
---
examples/ipsec-secgw/ipsec-secgw.c | 124 ++++++------------
examples/ipsec-secgw/ipsec-secgw.h | 81 ++++++++++++
examples/ipsec-secgw/ipsec.h | 37 +++---
examples/ipsec-secgw/ipsec_worker.c | 242 ++++++++++++++++++++++++++++++++++--
examples/ipsec-secgw/ipsec_worker.h | 39 ++++++
examples/ipsec-secgw/sa.c | 11 --
6 files changed, 409 insertions(+), 125 deletions(-)
create mode 100644 examples/ipsec-secgw/ipsec-secgw.h
create mode 100644 examples/ipsec-secgw/ipsec_worker.h
Comments
>
> Add IPsec application processing code for event mode.
>
> Signed-off-by: Anoob Joseph <anoobj@marvell.com>
> Signed-off-by: Lukasz Bartosik <lbartosik@marvell.com>
> ---
> examples/ipsec-secgw/ipsec-secgw.c | 124 ++++++------------
> examples/ipsec-secgw/ipsec-secgw.h | 81 ++++++++++++
> examples/ipsec-secgw/ipsec.h | 37 +++---
> examples/ipsec-secgw/ipsec_worker.c | 242 ++++++++++++++++++++++++++++++++++--
> examples/ipsec-secgw/ipsec_worker.h | 39 ++++++
> examples/ipsec-secgw/sa.c | 11 --
> 6 files changed, 409 insertions(+), 125 deletions(-)
> create mode 100644 examples/ipsec-secgw/ipsec-secgw.h
> create mode 100644 examples/ipsec-secgw/ipsec_worker.h
>
> diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec-secgw/ipsec-secgw.c
> index c5d95b9..2e7d4d8 100644
> --- a/examples/ipsec-secgw/ipsec-secgw.c
> +++ b/examples/ipsec-secgw/ipsec-secgw.c
> @@ -50,12 +50,11 @@
>
> #include "event_helper.h"
> #include "ipsec.h"
> +#include "ipsec_worker.h"
> #include "parser.h"
>
> volatile bool force_quit;
>
> -#define RTE_LOGTYPE_IPSEC RTE_LOGTYPE_USER1
> -
> #define MAX_JUMBO_PKT_LEN 9600
>
> #define MEMPOOL_CACHE_SIZE 256
> @@ -70,8 +69,6 @@ volatile bool force_quit;
>
> #define BURST_TX_DRAIN_US 100 /* TX drain every ~100us */
>
> -#define NB_SOCKETS 4
> -
> /* Configure how many packets ahead to prefetch, when reading packets */
> #define PREFETCH_OFFSET 3
>
> @@ -79,8 +76,6 @@ volatile bool force_quit;
>
> #define MAX_LCORE_PARAMS 1024
>
> -#define UNPROTECTED_PORT(port) (unprotected_port_mask & (1 << portid))
> -
> /*
> * Configurable number of RX/TX ring descriptors
> */
> @@ -89,29 +84,6 @@ volatile bool force_quit;
> static uint16_t nb_rxd = IPSEC_SECGW_RX_DESC_DEFAULT;
> static uint16_t nb_txd = IPSEC_SECGW_TX_DESC_DEFAULT;
>
> -#if RTE_BYTE_ORDER != RTE_LITTLE_ENDIAN
> -#define __BYTES_TO_UINT64(a, b, c, d, e, f, g, h) \
> - (((uint64_t)((a) & 0xff) << 56) | \
> - ((uint64_t)((b) & 0xff) << 48) | \
> - ((uint64_t)((c) & 0xff) << 40) | \
> - ((uint64_t)((d) & 0xff) << 32) | \
> - ((uint64_t)((e) & 0xff) << 24) | \
> - ((uint64_t)((f) & 0xff) << 16) | \
> - ((uint64_t)((g) & 0xff) << 8) | \
> - ((uint64_t)(h) & 0xff))
> -#else
> -#define __BYTES_TO_UINT64(a, b, c, d, e, f, g, h) \
> - (((uint64_t)((h) & 0xff) << 56) | \
> - ((uint64_t)((g) & 0xff) << 48) | \
> - ((uint64_t)((f) & 0xff) << 40) | \
> - ((uint64_t)((e) & 0xff) << 32) | \
> - ((uint64_t)((d) & 0xff) << 24) | \
> - ((uint64_t)((c) & 0xff) << 16) | \
> - ((uint64_t)((b) & 0xff) << 8) | \
> - ((uint64_t)(a) & 0xff))
> -#endif
> -#define ETHADDR(a, b, c, d, e, f) (__BYTES_TO_UINT64(a, b, c, d, e, f, 0, 0))
> -
> #define ETHADDR_TO_UINT64(addr) __BYTES_TO_UINT64( \
> (addr)->addr_bytes[0], (addr)->addr_bytes[1], \
> (addr)->addr_bytes[2], (addr)->addr_bytes[3], \
> @@ -123,18 +95,6 @@ static uint16_t nb_txd = IPSEC_SECGW_TX_DESC_DEFAULT;
>
> #define MTU_TO_FRAMELEN(x) ((x) + RTE_ETHER_HDR_LEN + RTE_ETHER_CRC_LEN)
>
> -/* port/source ethernet addr and destination ethernet addr */
> -struct ethaddr_info {
> - uint64_t src, dst;
> -};
> -
> -struct ethaddr_info ethaddr_tbl[RTE_MAX_ETHPORTS] = {
> - { 0, ETHADDR(0x00, 0x16, 0x3e, 0x7e, 0x94, 0x9a) },
> - { 0, ETHADDR(0x00, 0x16, 0x3e, 0x22, 0xa1, 0xd9) },
> - { 0, ETHADDR(0x00, 0x16, 0x3e, 0x08, 0x69, 0x26) },
> - { 0, ETHADDR(0x00, 0x16, 0x3e, 0x49, 0x9e, 0xdd) }
> -};
> -
> struct flow_info flow_info_tbl[RTE_MAX_ETHPORTS];
>
> #define CMD_LINE_OPT_CONFIG "config"
> @@ -192,10 +152,16 @@ static const struct option lgopts[] = {
> {NULL, 0, 0, 0}
> };
>
> +struct ethaddr_info ethaddr_tbl[RTE_MAX_ETHPORTS] = {
> + { 0, ETHADDR(0x00, 0x16, 0x3e, 0x7e, 0x94, 0x9a) },
> + { 0, ETHADDR(0x00, 0x16, 0x3e, 0x22, 0xa1, 0xd9) },
> + { 0, ETHADDR(0x00, 0x16, 0x3e, 0x08, 0x69, 0x26) },
> + { 0, ETHADDR(0x00, 0x16, 0x3e, 0x49, 0x9e, 0xdd) }
> +};
> +
> /* mask of enabled ports */
> static uint32_t enabled_port_mask;
> static uint64_t enabled_cryptodev_mask = UINT64_MAX;
> -static uint32_t unprotected_port_mask;
> static int32_t promiscuous_on = 1;
> static int32_t numa_on = 1; /**< NUMA is enabled by default. */
> static uint32_t nb_lcores;
> @@ -283,8 +249,6 @@ static struct rte_eth_conf port_conf = {
> },
> };
>
> -static struct socket_ctx socket_ctx[NB_SOCKETS];
> -
> /*
> * Determine is multi-segment support required:
> * - either frame buffer size is smaller then mtu
> @@ -2828,47 +2792,10 @@ main(int32_t argc, char **argv)
>
> sa_check_offloads(portid, &req_rx_offloads, &req_tx_offloads);
> port_init(portid, req_rx_offloads, req_tx_offloads);
> - /* Create default ipsec flow for the ethernet device */
> - ret = create_default_ipsec_flow(portid, req_rx_offloads);
> - if (ret)
> - printf("Cannot create default flow, err=%d, port=%d\n",
> - ret, portid);
> }
>
> cryptodevs_init();
>
> - /* start ports */
> - RTE_ETH_FOREACH_DEV(portid) {
> - if ((enabled_port_mask & (1 << portid)) == 0)
> - continue;
> -
> - /*
> - * Start device
> - * note: device must be started before a flow rule
> - * can be installed.
> - */
> - ret = rte_eth_dev_start(portid);
> - if (ret < 0)
> - rte_exit(EXIT_FAILURE, "rte_eth_dev_start: "
> - "err=%d, port=%d\n", ret, portid);
> - /*
> - * If enabled, put device in promiscuous mode.
> - * This allows IO forwarding mode to forward packets
> - * to itself through 2 cross-connected ports of the
> - * target machine.
> - */
> - if (promiscuous_on) {
> - ret = rte_eth_promiscuous_enable(portid);
> - if (ret != 0)
> - rte_exit(EXIT_FAILURE,
> - "rte_eth_promiscuous_enable: err=%s, port=%d\n",
> - rte_strerror(-ret), portid);
> - }
> -
> - rte_eth_dev_callback_register(portid,
> - RTE_ETH_EVENT_IPSEC, inline_ipsec_event_callback, NULL);
> - }
> -
> /* fragment reassemble is enabled */
> if (frag_tbl_sz != 0) {
> ret = reassemble_init();
> @@ -2889,8 +2816,6 @@ main(int32_t argc, char **argv)
> }
> }
>
> - check_all_ports_link_status(enabled_port_mask);
> -
> /*
> * Set the enabled port mask in helper config for use by helper
> * sub-system. This will be used while intializing devices using
> @@ -2903,6 +2828,39 @@ main(int32_t argc, char **argv)
> if (ret < 0)
> rte_exit(EXIT_FAILURE, "eh_devs_init failed, err=%d\n", ret);
>
> + /* Create default ipsec flow for each port and start each port */
> + RTE_ETH_FOREACH_DEV(portid) {
> + if ((enabled_port_mask & (1 << portid)) == 0)
> + continue;
> +
> + ret = create_default_ipsec_flow(portid, req_rx_offloads);
That doesn't look right.
For more than one eth port in the system, req_rx_offloads will be overwritten by that moment.
> + if (ret)
> + printf("create_default_ipsec_flow failed, err=%d, "
> + "port=%d\n", ret, portid);
> + /*
> + * Start device
> + * note: device must be started before a flow rule
> + * can be installed.
> + */
> + ret = rte_eth_dev_start(portid);
Moving that piece of code (dev_start) after sa_init() breaks ixgbe inline-crypto support.
As I understand, because configured ipsec flows don't persist dev_start().
At least for ixgbe PMD.
Any reason why to move that code at all?
> + if (ret < 0)
> + rte_exit(EXIT_FAILURE, "rte_eth_dev_start: "
> + "err=%d, port=%d\n", ret, portid);
> + /*
> + * If enabled, put device in promiscuous mode.
> + * This allows IO forwarding mode to forward packets
> + * to itself through 2 cross-connected ports of the
> + * target machine.
> + */
> + if (promiscuous_on)
> + rte_eth_promiscuous_enable(portid);
> +
> + rte_eth_dev_callback_register(portid,
> + RTE_ETH_EVENT_IPSEC, inline_ipsec_event_callback, NULL);
> + }
> +
> + check_all_ports_link_status(enabled_port_mask);
> +
> /* launch per-lcore init on every lcore */
> rte_eal_mp_remote_launch(ipsec_launch_one_lcore, eh_conf, CALL_MASTER);
>
> --- a/examples/ipsec-secgw/ipsec_worker.c
> +++ b/examples/ipsec-secgw/ipsec_worker.c
> @@ -15,6 +15,7 @@
> #include <ctype.h>
> #include <stdbool.h>
>
> +#include <rte_acl.h>
> #include <rte_common.h>
> #include <rte_log.h>
> #include <rte_memcpy.h>
> @@ -29,12 +30,51 @@
> #include <rte_eventdev.h>
> #include <rte_malloc.h>
> #include <rte_mbuf.h>
> +#include <rte_lpm.h>
> +#include <rte_lpm6.h>
>
> #include "ipsec.h"
> +#include "ipsec_worker.h"
> #include "event_helper.h"
>
> extern volatile bool force_quit;
>
> +static inline enum pkt_type
> +process_ipsec_get_pkt_type(struct rte_mbuf *pkt, uint8_t **nlp)
> +{
> + struct rte_ether_hdr *eth;
> +
> + eth = rte_pktmbuf_mtod(pkt, struct rte_ether_hdr *);
> + if (eth->ether_type == rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV4)) {
> + *nlp = RTE_PTR_ADD(eth, RTE_ETHER_HDR_LEN +
> + offsetof(struct ip, ip_p));
> + if (**nlp == IPPROTO_ESP)
> + return PKT_TYPE_IPSEC_IPV4;
> + else
> + return PKT_TYPE_PLAIN_IPV4;
> + } else if (eth->ether_type == rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV6)) {
> + *nlp = RTE_PTR_ADD(eth, RTE_ETHER_HDR_LEN +
> + offsetof(struct ip6_hdr, ip6_nxt));
> + if (**nlp == IPPROTO_ESP)
> + return PKT_TYPE_IPSEC_IPV6;
> + else
> + return PKT_TYPE_PLAIN_IPV6;
> + }
> +
> + /* Unknown/Unsupported type */
> + return PKT_TYPE_INVALID;
> +}
Looking though that file, it seems like you choose to create your own set of
helper functions, instead of trying to reuse existing ones:
process_ipsec_get_pkt_type() VS prepare_one_packet()
update_mac_addrs() VS prepare_tx_pkt()
check_sp() VS inbound_sp_sa()
Obviously there is nothing good in code (and possible bugs) duplication.
Any reason why you can't reuse existing functions and need to reinvent your own?
> +
> +static inline void
> +update_mac_addrs(struct rte_mbuf *pkt, uint16_t portid)
> +{
> + struct rte_ether_hdr *ethhdr;
> +
> + ethhdr = rte_pktmbuf_mtod(pkt, struct rte_ether_hdr *);
> + memcpy(ðhdr->s_addr, ðaddr_tbl[portid].src, RTE_ETHER_ADDR_LEN);
> + memcpy(ðhdr->d_addr, ðaddr_tbl[portid].dst, RTE_ETHER_ADDR_LEN);
> +}
> +
> static inline void
> ipsec_event_pre_forward(struct rte_mbuf *m, unsigned int port_id)
> {
> @@ -45,6 +85,177 @@ ipsec_event_pre_forward(struct rte_mbuf *m, unsigned int port_id)
> rte_event_eth_tx_adapter_txq_set(m, 0);
> }
>
> +static inline int
> +check_sp(struct sp_ctx *sp, const uint8_t *nlp, uint32_t *sa_idx)
> +{
> + uint32_t res;
> +
> + if (unlikely(sp == NULL))
> + return 0;
> +
> + rte_acl_classify((struct rte_acl_ctx *)sp, &nlp, &res, 1,
> + DEFAULT_MAX_CATEGORIES);
> +
> + if (unlikely(res == 0)) {
> + /* No match */
> + return 0;
> + }
> +
> + if (res == DISCARD)
> + return 0;
> + else if (res == BYPASS) {
> + *sa_idx = 0;
> + return 1;
> + }
> +
> + *sa_idx = SPI2IDX(res);
> + if (*sa_idx < IPSEC_SA_MAX_ENTRIES)
> + return 1;
> +
> + /* Invalid SA IDX */
> + return 0;
> +}
> +
> +static inline uint16_t
> +route4_pkt(struct rte_mbuf *pkt, struct rt_ctx *rt_ctx)
> +{
> + uint32_t dst_ip;
> + uint16_t offset;
> + uint32_t hop;
> + int ret;
> +
> + offset = RTE_ETHER_HDR_LEN + offsetof(struct ip, ip_dst);
> + dst_ip = *rte_pktmbuf_mtod_offset(pkt, uint32_t *, offset);
> + dst_ip = rte_be_to_cpu_32(dst_ip);
> +
> + ret = rte_lpm_lookup((struct rte_lpm *)rt_ctx, dst_ip, &hop);
> +
> + if (ret == 0) {
> + /* We have a hit */
> + return hop;
> + }
> +
> + /* else */
> + return RTE_MAX_ETHPORTS;
> +}
> +
> +/* TODO: To be tested */
> +static inline uint16_t
> +route6_pkt(struct rte_mbuf *pkt, struct rt_ctx *rt_ctx)
> +{
> + uint8_t dst_ip[16];
> + uint8_t *ip6_dst;
> + uint16_t offset;
> + uint32_t hop;
> + int ret;
> +
> + offset = RTE_ETHER_HDR_LEN + offsetof(struct ip6_hdr, ip6_dst);
> + ip6_dst = rte_pktmbuf_mtod_offset(pkt, uint8_t *, offset);
> + memcpy(&dst_ip[0], ip6_dst, 16);
> +
> + ret = rte_lpm6_lookup((struct rte_lpm6 *)rt_ctx, dst_ip, &hop);
> +
> + if (ret == 0) {
> + /* We have a hit */
> + return hop;
> + }
> +
> + /* else */
> + return RTE_MAX_ETHPORTS;
> +}
> +
> +static inline uint16_t
> +get_route(struct rte_mbuf *pkt, struct route_table *rt, enum pkt_type type)
> +{
> + if (type == PKT_TYPE_PLAIN_IPV4 || type == PKT_TYPE_IPSEC_IPV4)
> + return route4_pkt(pkt, rt->rt4_ctx);
> + else if (type == PKT_TYPE_PLAIN_IPV6 || type == PKT_TYPE_IPSEC_IPV6)
> + return route6_pkt(pkt, rt->rt6_ctx);
> +
> + return RTE_MAX_ETHPORTS;
> +}
> +
> +static inline int
> +process_ipsec_ev_inbound(struct ipsec_ctx *ctx, struct route_table *rt,
> + struct rte_event *ev)
> +{
> + struct ipsec_sa *sa = NULL;
> + struct rte_mbuf *pkt;
> + uint16_t port_id = 0;
> + enum pkt_type type;
> + uint32_t sa_idx;
> + uint8_t *nlp;
> +
> + /* Get pkt from event */
> + pkt = ev->mbuf;
> +
> + /* Check the packet type */
> + type = process_ipsec_get_pkt_type(pkt, &nlp);
> +
> + switch (type) {
> + case PKT_TYPE_PLAIN_IPV4:
> + if (pkt->ol_flags & PKT_RX_SEC_OFFLOAD)
> + sa = (struct ipsec_sa *) pkt->udata64;
> +
> + /* Check if we have a match */
> + if (check_sp(ctx->sp4_ctx, nlp, &sa_idx) == 0) {
> + /* No valid match */
> + goto drop_pkt_and_exit;
> + }
> + break;
> +
> + case PKT_TYPE_PLAIN_IPV6:
> + if (pkt->ol_flags & PKT_RX_SEC_OFFLOAD)
> + sa = (struct ipsec_sa *) pkt->udata64;
> +
> + /* Check if we have a match */
> + if (check_sp(ctx->sp6_ctx, nlp, &sa_idx) == 0) {
> + /* No valid match */
> + goto drop_pkt_and_exit;
> + }
> + break;
> +
> + default:
> + RTE_LOG(ERR, IPSEC, "Unsupported packet type = %d\n", type);
> + goto drop_pkt_and_exit;
> + }
> +
> + /* Check if the packet has to be bypassed */
> + if (sa_idx == 0)
> + goto route_and_send_pkt;
> +
> + /* Else the packet has to be protected with SA */
> +
> + /* If the packet was IPsec processed, then SA pointer should be set */
> + if (sa == NULL)
> + goto drop_pkt_and_exit;
> +
> + /* SPI on the packet should match with the one in SA */
> + if (unlikely(sa->spi != sa_idx))
> + goto drop_pkt_and_exit;
> +
> +route_and_send_pkt:
> + port_id = get_route(pkt, rt, type);
> + if (unlikely(port_id == RTE_MAX_ETHPORTS)) {
> + /* no match */
> + goto drop_pkt_and_exit;
> + }
> + /* else, we have a matching route */
> +
> + /* Update mac addresses */
> + update_mac_addrs(pkt, port_id);
> +
> + /* Update the event with the dest port */
> + ipsec_event_pre_forward(pkt, port_id);
> + return 1;
> +
> +drop_pkt_and_exit:
> + RTE_LOG(ERR, IPSEC, "Inbound packet dropped\n");
> + rte_pktmbuf_free(pkt);
> + ev->mbuf = NULL;
> + return 0;
> +}
> +
> /*
> * Event mode exposes various operating modes depending on the
> * capabilities of the event device and the operating mode
> @@ -134,11 +345,11 @@ static void
> ipsec_wrkr_non_burst_int_port_app_mode_inb(struct eh_event_link_info *links,
> uint8_t nb_links)
> {
> + struct lcore_conf_ev_tx_int_port_wrkr lconf;
> unsigned int nb_rx = 0;
> - unsigned int port_id;
> - struct rte_mbuf *pkt;
> struct rte_event ev;
> uint32_t lcore_id;
> + int32_t socket_id;
>
> /* Check if we have links registered for this lcore */
> if (nb_links == 0) {
> @@ -151,6 +362,21 @@ ipsec_wrkr_non_burst_int_port_app_mode_inb(struct eh_event_link_info *links,
> /* Get core ID */
> lcore_id = rte_lcore_id();
>
> + /* Get socket ID */
> + socket_id = rte_lcore_to_socket_id(lcore_id);
> +
> + /* Save routing table */
> + lconf.rt.rt4_ctx = socket_ctx[socket_id].rt_ip4;
> + lconf.rt.rt6_ctx = socket_ctx[socket_id].rt_ip6;
> + lconf.inbound.sp4_ctx = socket_ctx[socket_id].sp_ip4_in;
> + lconf.inbound.sp6_ctx = socket_ctx[socket_id].sp_ip6_in;
> + lconf.inbound.sa_ctx = socket_ctx[socket_id].sa_in;
> + lconf.inbound.session_pool = socket_ctx[socket_id].session_pool;
> + lconf.outbound.sp4_ctx = socket_ctx[socket_id].sp_ip4_out;
> + lconf.outbound.sp6_ctx = socket_ctx[socket_id].sp_ip6_out;
> + lconf.outbound.sa_ctx = socket_ctx[socket_id].sa_out;
> + lconf.outbound.session_pool = socket_ctx[socket_id].session_pool;
> +
> RTE_LOG(INFO, IPSEC,
> "Launching event mode worker (non-burst - Tx internal port - "
> "app mode - inbound) on lcore %d\n", lcore_id);
> @@ -175,13 +401,11 @@ ipsec_wrkr_non_burst_int_port_app_mode_inb(struct eh_event_link_info *links,
> if (nb_rx == 0)
> continue;
>
> - port_id = ev.queue_id;
> - pkt = ev.mbuf;
> -
> - rte_prefetch0(rte_pktmbuf_mtod(pkt, void *));
> -
> - /* Process packet */
> - ipsec_event_pre_forward(pkt, port_id);
> + if (process_ipsec_ev_inbound(&lconf.inbound,
> + &lconf.rt, &ev) != 1) {
> + /* The pkt has been dropped */
> + continue;
> + }
>
> /*
> * Since tx internal port is available, events can be
> diff --git a/examples/ipsec-secgw/ipsec_worker.h b/examples/ipsec-secgw/ipsec_worker.h
> new file mode 100644
> index 0000000..fd18a2e
> --- /dev/null
> +++ b/examples/ipsec-secgw/ipsec_worker.h
> @@ -0,0 +1,39 @@
> +/* SPDX-License-Identifier: BSD-3-Clause
> + * Copyright(c) 2018 Cavium, Inc
> + */
> +#ifndef _IPSEC_WORKER_H_
> +#define _IPSEC_WORKER_H_
> +
> +#include "ipsec.h"
> +
> +enum pkt_type {
> + PKT_TYPE_PLAIN_IPV4 = 1,
> + PKT_TYPE_IPSEC_IPV4,
> + PKT_TYPE_PLAIN_IPV6,
> + PKT_TYPE_IPSEC_IPV6,
> + PKT_TYPE_INVALID
> +};
> +
> +struct route_table {
> + struct rt_ctx *rt4_ctx;
> + struct rt_ctx *rt6_ctx;
> +};
> +
> +/*
> + * Conf required by event mode worker with tx internal port
> + */
> +struct lcore_conf_ev_tx_int_port_wrkr {
> + struct ipsec_ctx inbound;
> + struct ipsec_ctx outbound;
> + struct route_table rt;
> +} __rte_cache_aligned;
> +
> +/* TODO
> + *
> + * Move this function to ipsec_worker.c
> + */
> +void ipsec_poll_mode_worker(void);
> +
> +int ipsec_launch_one_lcore(void *args);
> +
> +#endif /* _IPSEC_WORKER_H_ */
> diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c
> index 7f046e3..9e17ba0 100644
> --- a/examples/ipsec-secgw/sa.c
> +++ b/examples/ipsec-secgw/sa.c
> @@ -772,17 +772,6 @@ print_one_sa_rule(const struct ipsec_sa *sa, int inbound)
> printf("\n");
> }
>
> -struct sa_ctx {
> - void *satbl; /* pointer to array of rte_ipsec_sa objects*/
> - struct ipsec_sa sa[IPSEC_SA_MAX_ENTRIES];
> - union {
> - struct {
> - struct rte_crypto_sym_xform a;
> - struct rte_crypto_sym_xform b;
> - };
> - } xf[IPSEC_SA_MAX_ENTRIES];
> -};
> -
> static struct sa_ctx *
> sa_create(const char *name, int32_t socket_id)
> {
> --
> 2.7.4
> +static inline int
> +process_ipsec_ev_inbound(struct ipsec_ctx *ctx, struct route_table *rt,
> + struct rte_event *ev)
> +{
> + struct ipsec_sa *sa = NULL;
> + struct rte_mbuf *pkt;
> + uint16_t port_id = 0;
> + enum pkt_type type;
> + uint32_t sa_idx;
> + uint8_t *nlp;
> +
> + /* Get pkt from event */
> + pkt = ev->mbuf;
> +
> + /* Check the packet type */
> + type = process_ipsec_get_pkt_type(pkt, &nlp);
> +
> + switch (type) {
> + case PKT_TYPE_PLAIN_IPV4:
> + if (pkt->ol_flags & PKT_RX_SEC_OFFLOAD)
> + sa = (struct ipsec_sa *) pkt->udata64;
Shouldn't packets with PKT_RX_SEC_OFFLOAD_FAIL be handled somehow?
Another question - as I can see from the code, right now event mode
supports only inline-proto, correct?
If so, then probably an error should be reported at startup, if in config file
some other types of sessions were requested.
> +
> + /* Check if we have a match */
> + if (check_sp(ctx->sp4_ctx, nlp, &sa_idx) == 0) {
> + /* No valid match */
> + goto drop_pkt_and_exit;
> + }
> + break;
> +
> + case PKT_TYPE_PLAIN_IPV6:
> + if (pkt->ol_flags & PKT_RX_SEC_OFFLOAD)
> + sa = (struct ipsec_sa *) pkt->udata64;
> +
> + /* Check if we have a match */
> + if (check_sp(ctx->sp6_ctx, nlp, &sa_idx) == 0) {
> + /* No valid match */
> + goto drop_pkt_and_exit;
> + }
> + break;
> +
> + default:
> + RTE_LOG(ERR, IPSEC, "Unsupported packet type = %d\n", type);
> + goto drop_pkt_and_exit;
> + }
> +
> + /* Check if the packet has to be bypassed */
> + if (sa_idx == 0)
> + goto route_and_send_pkt;
> +
> + /* Else the packet has to be protected with SA */
> +
> + /* If the packet was IPsec processed, then SA pointer should be set */
> + if (sa == NULL)
> + goto drop_pkt_and_exit;
> +
> + /* SPI on the packet should match with the one in SA */
> + if (unlikely(sa->spi != sa_idx))
> + goto drop_pkt_and_exit;
> +
> +route_and_send_pkt:
> + port_id = get_route(pkt, rt, type);
> + if (unlikely(port_id == RTE_MAX_ETHPORTS)) {
> + /* no match */
> + goto drop_pkt_and_exit;
> + }
> + /* else, we have a matching route */
> +
> + /* Update mac addresses */
> + update_mac_addrs(pkt, port_id);
> +
> + /* Update the event with the dest port */
> + ipsec_event_pre_forward(pkt, port_id);
> + return 1;
> +
> +drop_pkt_and_exit:
> + RTE_LOG(ERR, IPSEC, "Inbound packet dropped\n");
> + rte_pktmbuf_free(pkt);
> + ev->mbuf = NULL;
> + return 0;
> +}
> +
Hi Konstantin,
Please see inline.
Thanks,
Anoob
> -----Original Message-----
> From: Ananyev, Konstantin <konstantin.ananyev@intel.com>
> Sent: Wednesday, December 25, 2019 8:49 PM
> To: Anoob Joseph <anoobj@marvell.com>; Akhil Goyal <akhil.goyal@nxp.com>;
> Nicolau, Radu <radu.nicolau@intel.com>; Thomas Monjalon
> <thomas@monjalon.net>
> Cc: Lukas Bartosik <lbartosik@marvell.com>; Jerin Jacob Kollanukkaran
> <jerinj@marvell.com>; Narayana Prasad Raju Athreya
> <pathreya@marvell.com>; Ankur Dwivedi <adwivedi@marvell.com>; Archana
> Muniganti <marchana@marvell.com>; Tejasree Kondoj
> <ktejasree@marvell.com>; Vamsi Krishna Attunuru <vattunuru@marvell.com>;
> dev@dpdk.org
> Subject: [EXT] RE: [PATCH 11/14] examples/ipsec-secgw: add app processing
> code
>
> External Email
>
> ----------------------------------------------------------------------
>
> > +static inline int
> > +process_ipsec_ev_inbound(struct ipsec_ctx *ctx, struct route_table *rt,
> > + struct rte_event *ev)
> > +{
> > + struct ipsec_sa *sa = NULL;
> > + struct rte_mbuf *pkt;
> > + uint16_t port_id = 0;
> > + enum pkt_type type;
> > + uint32_t sa_idx;
> > + uint8_t *nlp;
> > +
> > + /* Get pkt from event */
> > + pkt = ev->mbuf;
> > +
> > + /* Check the packet type */
> > + type = process_ipsec_get_pkt_type(pkt, &nlp);
> > +
> > + switch (type) {
> > + case PKT_TYPE_PLAIN_IPV4:
> > + if (pkt->ol_flags & PKT_RX_SEC_OFFLOAD)
> > + sa = (struct ipsec_sa *) pkt->udata64;
>
>
> Shouldn't packets with PKT_RX_SEC_OFFLOAD_FAIL be handled somehow?
[Anoob] Yes. Will fix this in v2.
> Another question - as I can see from the code, right now event mode supports
> only inline-proto, correct?
> If so, then probably an error should be reported at startup, if in config file
> some other types of sessions were requested.
[Anoob] Okay. Will add this in v2.
>
> > +
> > + /* Check if we have a match */
> > + if (check_sp(ctx->sp4_ctx, nlp, &sa_idx) == 0) {
> > + /* No valid match */
> > + goto drop_pkt_and_exit;
> > + }
> > + break;
> > +
> > + case PKT_TYPE_PLAIN_IPV6:
> > + if (pkt->ol_flags & PKT_RX_SEC_OFFLOAD)
> > + sa = (struct ipsec_sa *) pkt->udata64;
> > +
> > + /* Check if we have a match */
> > + if (check_sp(ctx->sp6_ctx, nlp, &sa_idx) == 0) {
> > + /* No valid match */
> > + goto drop_pkt_and_exit;
> > + }
> > + break;
> > +
> > + default:
> > + RTE_LOG(ERR, IPSEC, "Unsupported packet type = %d\n", type);
> > + goto drop_pkt_and_exit;
> > + }
> > +
> > + /* Check if the packet has to be bypassed */
> > + if (sa_idx == 0)
> > + goto route_and_send_pkt;
> > +
> > + /* Else the packet has to be protected with SA */
> > +
> > + /* If the packet was IPsec processed, then SA pointer should be set */
> > + if (sa == NULL)
> > + goto drop_pkt_and_exit;
> > +
> > + /* SPI on the packet should match with the one in SA */
> > + if (unlikely(sa->spi != sa_idx))
> > + goto drop_pkt_and_exit;
> > +
> > +route_and_send_pkt:
> > + port_id = get_route(pkt, rt, type);
> > + if (unlikely(port_id == RTE_MAX_ETHPORTS)) {
> > + /* no match */
> > + goto drop_pkt_and_exit;
> > + }
> > + /* else, we have a matching route */
> > +
> > + /* Update mac addresses */
> > + update_mac_addrs(pkt, port_id);
> > +
> > + /* Update the event with the dest port */
> > + ipsec_event_pre_forward(pkt, port_id);
> > + return 1;
> > +
> > +drop_pkt_and_exit:
> > + RTE_LOG(ERR, IPSEC, "Inbound packet dropped\n");
> > + rte_pktmbuf_free(pkt);
> > + ev->mbuf = NULL;
> > + return 0;
> > +}
> > +
Hi Konstantin,
Please see inline.
Thanks,
Lukasz
On 23.12.2019 17:49, Ananyev, Konstantin wrote:
> External Email
>
> ----------------------------------------------------------------------
>
>
>>
>> Add IPsec application processing code for event mode.
>>
>> Signed-off-by: Anoob Joseph <anoobj@marvell.com>
>> Signed-off-by: Lukasz Bartosik <lbartosik@marvell.com>
>> ---
>> examples/ipsec-secgw/ipsec-secgw.c | 124 ++++++------------
>> examples/ipsec-secgw/ipsec-secgw.h | 81 ++++++++++++
>> examples/ipsec-secgw/ipsec.h | 37 +++---
>> examples/ipsec-secgw/ipsec_worker.c | 242 ++++++++++++++++++++++++++++++++++--
>> examples/ipsec-secgw/ipsec_worker.h | 39 ++++++
>> examples/ipsec-secgw/sa.c | 11 --
>> 6 files changed, 409 insertions(+), 125 deletions(-)
>> create mode 100644 examples/ipsec-secgw/ipsec-secgw.h
>> create mode 100644 examples/ipsec-secgw/ipsec_worker.h
>>
>> diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec-secgw/ipsec-secgw.c
>> index c5d95b9..2e7d4d8 100644
>> --- a/examples/ipsec-secgw/ipsec-secgw.c
>> +++ b/examples/ipsec-secgw/ipsec-secgw.c
>> @@ -50,12 +50,11 @@
>>
>> #include "event_helper.h"
>> #include "ipsec.h"
>> +#include "ipsec_worker.h"
>> #include "parser.h"
>>
>> volatile bool force_quit;
>>
>> -#define RTE_LOGTYPE_IPSEC RTE_LOGTYPE_USER1
>> -
>> #define MAX_JUMBO_PKT_LEN 9600
>>
>> #define MEMPOOL_CACHE_SIZE 256
>> @@ -70,8 +69,6 @@ volatile bool force_quit;
>>
>> #define BURST_TX_DRAIN_US 100 /* TX drain every ~100us */
>>
>> -#define NB_SOCKETS 4
>> -
>> /* Configure how many packets ahead to prefetch, when reading packets */
>> #define PREFETCH_OFFSET 3
>>
>> @@ -79,8 +76,6 @@ volatile bool force_quit;
>>
>> #define MAX_LCORE_PARAMS 1024
>>
>> -#define UNPROTECTED_PORT(port) (unprotected_port_mask & (1 << portid))
>> -
>> /*
>> * Configurable number of RX/TX ring descriptors
>> */
>> @@ -89,29 +84,6 @@ volatile bool force_quit;
>> static uint16_t nb_rxd = IPSEC_SECGW_RX_DESC_DEFAULT;
>> static uint16_t nb_txd = IPSEC_SECGW_TX_DESC_DEFAULT;
>>
>> -#if RTE_BYTE_ORDER != RTE_LITTLE_ENDIAN
>> -#define __BYTES_TO_UINT64(a, b, c, d, e, f, g, h) \
>> - (((uint64_t)((a) & 0xff) << 56) | \
>> - ((uint64_t)((b) & 0xff) << 48) | \
>> - ((uint64_t)((c) & 0xff) << 40) | \
>> - ((uint64_t)((d) & 0xff) << 32) | \
>> - ((uint64_t)((e) & 0xff) << 24) | \
>> - ((uint64_t)((f) & 0xff) << 16) | \
>> - ((uint64_t)((g) & 0xff) << 8) | \
>> - ((uint64_t)(h) & 0xff))
>> -#else
>> -#define __BYTES_TO_UINT64(a, b, c, d, e, f, g, h) \
>> - (((uint64_t)((h) & 0xff) << 56) | \
>> - ((uint64_t)((g) & 0xff) << 48) | \
>> - ((uint64_t)((f) & 0xff) << 40) | \
>> - ((uint64_t)((e) & 0xff) << 32) | \
>> - ((uint64_t)((d) & 0xff) << 24) | \
>> - ((uint64_t)((c) & 0xff) << 16) | \
>> - ((uint64_t)((b) & 0xff) << 8) | \
>> - ((uint64_t)(a) & 0xff))
>> -#endif
>> -#define ETHADDR(a, b, c, d, e, f) (__BYTES_TO_UINT64(a, b, c, d, e, f, 0, 0))
>> -
>> #define ETHADDR_TO_UINT64(addr) __BYTES_TO_UINT64( \
>> (addr)->addr_bytes[0], (addr)->addr_bytes[1], \
>> (addr)->addr_bytes[2], (addr)->addr_bytes[3], \
>> @@ -123,18 +95,6 @@ static uint16_t nb_txd = IPSEC_SECGW_TX_DESC_DEFAULT;
>>
>> #define MTU_TO_FRAMELEN(x) ((x) + RTE_ETHER_HDR_LEN + RTE_ETHER_CRC_LEN)
>>
>> -/* port/source ethernet addr and destination ethernet addr */
>> -struct ethaddr_info {
>> - uint64_t src, dst;
>> -};
>> -
>> -struct ethaddr_info ethaddr_tbl[RTE_MAX_ETHPORTS] = {
>> - { 0, ETHADDR(0x00, 0x16, 0x3e, 0x7e, 0x94, 0x9a) },
>> - { 0, ETHADDR(0x00, 0x16, 0x3e, 0x22, 0xa1, 0xd9) },
>> - { 0, ETHADDR(0x00, 0x16, 0x3e, 0x08, 0x69, 0x26) },
>> - { 0, ETHADDR(0x00, 0x16, 0x3e, 0x49, 0x9e, 0xdd) }
>> -};
>> -
>> struct flow_info flow_info_tbl[RTE_MAX_ETHPORTS];
>>
>> #define CMD_LINE_OPT_CONFIG "config"
>> @@ -192,10 +152,16 @@ static const struct option lgopts[] = {
>> {NULL, 0, 0, 0}
>> };
>>
>> +struct ethaddr_info ethaddr_tbl[RTE_MAX_ETHPORTS] = {
>> + { 0, ETHADDR(0x00, 0x16, 0x3e, 0x7e, 0x94, 0x9a) },
>> + { 0, ETHADDR(0x00, 0x16, 0x3e, 0x22, 0xa1, 0xd9) },
>> + { 0, ETHADDR(0x00, 0x16, 0x3e, 0x08, 0x69, 0x26) },
>> + { 0, ETHADDR(0x00, 0x16, 0x3e, 0x49, 0x9e, 0xdd) }
>> +};
>> +
>> /* mask of enabled ports */
>> static uint32_t enabled_port_mask;
>> static uint64_t enabled_cryptodev_mask = UINT64_MAX;
>> -static uint32_t unprotected_port_mask;
>> static int32_t promiscuous_on = 1;
>> static int32_t numa_on = 1; /**< NUMA is enabled by default. */
>> static uint32_t nb_lcores;
>> @@ -283,8 +249,6 @@ static struct rte_eth_conf port_conf = {
>> },
>> };
>>
>> -static struct socket_ctx socket_ctx[NB_SOCKETS];
>> -
>> /*
>> * Determine is multi-segment support required:
>> * - either frame buffer size is smaller then mtu
>> @@ -2828,47 +2792,10 @@ main(int32_t argc, char **argv)
>>
>> sa_check_offloads(portid, &req_rx_offloads, &req_tx_offloads);
>> port_init(portid, req_rx_offloads, req_tx_offloads);
>> - /* Create default ipsec flow for the ethernet device */
>> - ret = create_default_ipsec_flow(portid, req_rx_offloads);
>> - if (ret)
>> - printf("Cannot create default flow, err=%d, port=%d\n",
>> - ret, portid);
>> }
>>
>> cryptodevs_init();
>>
>> - /* start ports */
>> - RTE_ETH_FOREACH_DEV(portid) {
>> - if ((enabled_port_mask & (1 << portid)) == 0)
>> - continue;
>> -
>> - /*
>> - * Start device
>> - * note: device must be started before a flow rule
>> - * can be installed.
>> - */
>> - ret = rte_eth_dev_start(portid);
>> - if (ret < 0)
>> - rte_exit(EXIT_FAILURE, "rte_eth_dev_start: "
>> - "err=%d, port=%d\n", ret, portid);
>> - /*
>> - * If enabled, put device in promiscuous mode.
>> - * This allows IO forwarding mode to forward packets
>> - * to itself through 2 cross-connected ports of the
>> - * target machine.
>> - */
>> - if (promiscuous_on) {
>> - ret = rte_eth_promiscuous_enable(portid);
>> - if (ret != 0)
>> - rte_exit(EXIT_FAILURE,
>> - "rte_eth_promiscuous_enable: err=%s, port=%d\n",
>> - rte_strerror(-ret), portid);
>> - }
>> -
>> - rte_eth_dev_callback_register(portid,
>> - RTE_ETH_EVENT_IPSEC, inline_ipsec_event_callback, NULL);
>> - }
>> -
>> /* fragment reassemble is enabled */
>> if (frag_tbl_sz != 0) {
>> ret = reassemble_init();
>> @@ -2889,8 +2816,6 @@ main(int32_t argc, char **argv)
>> }
>> }
>>
>> - check_all_ports_link_status(enabled_port_mask);
>> -
>> /*
>> * Set the enabled port mask in helper config for use by helper
>> * sub-system. This will be used while intializing devices using
>> @@ -2903,6 +2828,39 @@ main(int32_t argc, char **argv)
>> if (ret < 0)
>> rte_exit(EXIT_FAILURE, "eh_devs_init failed, err=%d\n", ret);
>>
>> + /* Create default ipsec flow for each port and start each port */
>> + RTE_ETH_FOREACH_DEV(portid) {
>> + if ((enabled_port_mask & (1 << portid)) == 0)
>> + continue;
>> +
>> + ret = create_default_ipsec_flow(portid, req_rx_offloads);
>
> That doesn't look right.
> For more than one eth port in the system, req_rx_offloads will be overwritten by that moment.
[Lukasz] You're right. I will fix it in v2.
>
>> + if (ret)
>> + printf("create_default_ipsec_flow failed, err=%d, "
>> + "port=%d\n", ret, portid);
>> + /*
>> + * Start device
>> + * note: device must be started before a flow rule
>> + * can be installed.
>> + */
>> + ret = rte_eth_dev_start(portid);
>
> Moving that piece of code (dev_start) after sa_init() breaks ixgbe inline-crypto support.
> As I understand, because configured ipsec flows don't persist dev_start().
> At least for ixgbe PMD.
> Any reason why to move that code at all?
[Lukasz] We moved starting eth port after creation of default ipsec flow in order to stop packets from temporary omitting inline (after eth port is started but before flow is created)
. This happens if traffic is flowing and ipsec-secgw app is started.
However moving eth_dev_start after sa_init is not necessary. I will revert this change to start eth ports before sa_init.
>> + if (ret < 0)
>> + rte_exit(EXIT_FAILURE, "rte_eth_dev_start: "
>> + "err=%d, port=%d\n", ret, portid);
>> + /*
>> + * If enabled, put device in promiscuous mode.
>> + * This allows IO forwarding mode to forward packets
>> + * to itself through 2 cross-connected ports of the
>> + * target machine.
>> + */
>> + if (promiscuous_on)
>> + rte_eth_promiscuous_enable(portid);
>> +
>> + rte_eth_dev_callback_register(portid,
>> + RTE_ETH_EVENT_IPSEC, inline_ipsec_event_callback, NULL);
>> + }
>> +
>> + check_all_ports_link_status(enabled_port_mask);
>> +
>> /* launch per-lcore init on every lcore */
>> rte_eal_mp_remote_launch(ipsec_launch_one_lcore, eh_conf, CALL_MASTER);
>>
Hi Konstantin,
Please see inline.
Thanks,
Lukasz
On 24.12.2019 14:13, Ananyev, Konstantin wrote:
> External Email
>
> ----------------------------------------------------------------------
>
>> --- a/examples/ipsec-secgw/ipsec_worker.c
>> +++ b/examples/ipsec-secgw/ipsec_worker.c
>> @@ -15,6 +15,7 @@
>> #include <ctype.h>
>> #include <stdbool.h>
>>
>> +#include <rte_acl.h>
>> #include <rte_common.h>
>> #include <rte_log.h>
>> #include <rte_memcpy.h>
>> @@ -29,12 +30,51 @@
>> #include <rte_eventdev.h>
>> #include <rte_malloc.h>
>> #include <rte_mbuf.h>
>> +#include <rte_lpm.h>
>> +#include <rte_lpm6.h>
>>
>> #include "ipsec.h"
>> +#include "ipsec_worker.h"
>> #include "event_helper.h"
>>
>> extern volatile bool force_quit;
>>
>> +static inline enum pkt_type
>> +process_ipsec_get_pkt_type(struct rte_mbuf *pkt, uint8_t **nlp)
>> +{
>> + struct rte_ether_hdr *eth;
>> +
>> + eth = rte_pktmbuf_mtod(pkt, struct rte_ether_hdr *);
>> + if (eth->ether_type == rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV4)) {
>> + *nlp = RTE_PTR_ADD(eth, RTE_ETHER_HDR_LEN +
>> + offsetof(struct ip, ip_p));
>> + if (**nlp == IPPROTO_ESP)
>> + return PKT_TYPE_IPSEC_IPV4;
>> + else
>> + return PKT_TYPE_PLAIN_IPV4;
>> + } else if (eth->ether_type == rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV6)) {
>> + *nlp = RTE_PTR_ADD(eth, RTE_ETHER_HDR_LEN +
>> + offsetof(struct ip6_hdr, ip6_nxt));
>> + if (**nlp == IPPROTO_ESP)
>> + return PKT_TYPE_IPSEC_IPV6;
>> + else
>> + return PKT_TYPE_PLAIN_IPV6;
>> + }
>> +
>> + /* Unknown/Unsupported type */
>> + return PKT_TYPE_INVALID;
>> +}
>
> Looking though that file, it seems like you choose to create your own set of
> helper functions, instead of trying to reuse existing ones:
>
> process_ipsec_get_pkt_type() VS prepare_one_packet()
> update_mac_addrs() VS prepare_tx_pkt()
> check_sp() VS inbound_sp_sa()
>
> Obviously there is nothing good in code (and possible bugs) duplication.
> Any reason why you can't reuse existing functions and need to reinvent your own?
[Lukasz] The prepare_one_packet() and prepare_tx_pkt() do much more than we need and for performance reasons
we crafted new functions. For example process_ipsec_get_pkt_type function returns nlp and whether
packet type is plain or IPsec. That's all. Prepare_one_packet() process packets in chunks and does much more -
it adjusts mbuf and ipv4 lengths then it demultiplex packet into plan and IPsec flows and finally does
inline checks. This is similar for update_mac_addrs() vs prepare_tx_pkt() and check_sp() vs inbound_sp_sa()
that prepare_tx_pkt() and inbound_sp_sa() do more that we need in event mode.
>
>> +
>> +static inline void
>> +update_mac_addrs(struct rte_mbuf *pkt, uint16_t portid)
>> +{
>> + struct rte_ether_hdr *ethhdr;
>> +
>> + ethhdr = rte_pktmbuf_mtod(pkt, struct rte_ether_hdr *);
>> + memcpy(ðhdr->s_addr, ðaddr_tbl[portid].src, RTE_ETHER_ADDR_LEN);
>> + memcpy(ðhdr->d_addr, ðaddr_tbl[portid].dst, RTE_ETHER_ADDR_LEN);
>> +}
>> +
>> static inline void
>> ipsec_event_pre_forward(struct rte_mbuf *m, unsigned int port_id)
>> {
>> @@ -45,6 +85,177 @@ ipsec_event_pre_forward(struct rte_mbuf *m, unsigned int port_id)
>> rte_event_eth_tx_adapter_txq_set(m, 0);
>> }
>>
>> +static inline int
>> +check_sp(struct sp_ctx *sp, const uint8_t *nlp, uint32_t *sa_idx)
>> +{
>> + uint32_t res;
>> +
>> + if (unlikely(sp == NULL))
>> + return 0;
>> +
>> + rte_acl_classify((struct rte_acl_ctx *)sp, &nlp, &res, 1,
>> + DEFAULT_MAX_CATEGORIES);
>> +
>> + if (unlikely(res == 0)) {
>> + /* No match */
>> + return 0;
>> + }
>> +
>> + if (res == DISCARD)
>> + return 0;
>> + else if (res == BYPASS) {
>> + *sa_idx = 0;
>> + return 1;
>> + }
>> +
>> + *sa_idx = SPI2IDX(res);
>> + if (*sa_idx < IPSEC_SA_MAX_ENTRIES)
>> + return 1;
>> +
>> + /* Invalid SA IDX */
>> + return 0;
>> +}
>> +
>> +static inline uint16_t
>> +route4_pkt(struct rte_mbuf *pkt, struct rt_ctx *rt_ctx)
>> +{
>> + uint32_t dst_ip;
>> + uint16_t offset;
>> + uint32_t hop;
>> + int ret;
>> +
>> + offset = RTE_ETHER_HDR_LEN + offsetof(struct ip, ip_dst);
>> + dst_ip = *rte_pktmbuf_mtod_offset(pkt, uint32_t *, offset);
>> + dst_ip = rte_be_to_cpu_32(dst_ip);
>> +
>> + ret = rte_lpm_lookup((struct rte_lpm *)rt_ctx, dst_ip, &hop);
>> +
>> + if (ret == 0) {
>> + /* We have a hit */
>> + return hop;
>> + }
>> +
>> + /* else */
>> + return RTE_MAX_ETHPORTS;
>> +}
>> +
>> +/* TODO: To be tested */
>> +static inline uint16_t
>> +route6_pkt(struct rte_mbuf *pkt, struct rt_ctx *rt_ctx)
>> +{
>> + uint8_t dst_ip[16];
>> + uint8_t *ip6_dst;
>> + uint16_t offset;
>> + uint32_t hop;
>> + int ret;
>> +
>> + offset = RTE_ETHER_HDR_LEN + offsetof(struct ip6_hdr, ip6_dst);
>> + ip6_dst = rte_pktmbuf_mtod_offset(pkt, uint8_t *, offset);
>> + memcpy(&dst_ip[0], ip6_dst, 16);
>> +
>> + ret = rte_lpm6_lookup((struct rte_lpm6 *)rt_ctx, dst_ip, &hop);
>> +
>> + if (ret == 0) {
>> + /* We have a hit */
>> + return hop;
>> + }
>> +
>> + /* else */
>> + return RTE_MAX_ETHPORTS;
>> +}
>> +
>> +static inline uint16_t
>> +get_route(struct rte_mbuf *pkt, struct route_table *rt, enum pkt_type type)
>> +{
>> + if (type == PKT_TYPE_PLAIN_IPV4 || type == PKT_TYPE_IPSEC_IPV4)
>> + return route4_pkt(pkt, rt->rt4_ctx);
>> + else if (type == PKT_TYPE_PLAIN_IPV6 || type == PKT_TYPE_IPSEC_IPV6)
>> + return route6_pkt(pkt, rt->rt6_ctx);
>> +
>> + return RTE_MAX_ETHPORTS;
>> +}
>> +
>> +static inline int
>> +process_ipsec_ev_inbound(struct ipsec_ctx *ctx, struct route_table *rt,
>> + struct rte_event *ev)
>> +{
>> + struct ipsec_sa *sa = NULL;
>> + struct rte_mbuf *pkt;
>> + uint16_t port_id = 0;
>> + enum pkt_type type;
>> + uint32_t sa_idx;
>> + uint8_t *nlp;
>> +
>> + /* Get pkt from event */
>> + pkt = ev->mbuf;
>> +
>> + /* Check the packet type */
>> + type = process_ipsec_get_pkt_type(pkt, &nlp);
>> +
>> + switch (type) {
>> + case PKT_TYPE_PLAIN_IPV4:
>> + if (pkt->ol_flags & PKT_RX_SEC_OFFLOAD)
>> + sa = (struct ipsec_sa *) pkt->udata64;
>> +
>> + /* Check if we have a match */
>> + if (check_sp(ctx->sp4_ctx, nlp, &sa_idx) == 0) {
>> + /* No valid match */
>> + goto drop_pkt_and_exit;
>> + }
>> + break;
>> +
>> + case PKT_TYPE_PLAIN_IPV6:
>> + if (pkt->ol_flags & PKT_RX_SEC_OFFLOAD)
>> + sa = (struct ipsec_sa *) pkt->udata64;
>> +
>> + /* Check if we have a match */
>> + if (check_sp(ctx->sp6_ctx, nlp, &sa_idx) == 0) {
>> + /* No valid match */
>> + goto drop_pkt_and_exit;
>> + }
>> + break;
>> +
>> + default:
>> + RTE_LOG(ERR, IPSEC, "Unsupported packet type = %d\n", type);
>> + goto drop_pkt_and_exit;
>> + }
>> +
>> + /* Check if the packet has to be bypassed */
>> + if (sa_idx == 0)
>> + goto route_and_send_pkt;
>> +
>> + /* Else the packet has to be protected with SA */
>> +
>> + /* If the packet was IPsec processed, then SA pointer should be set */
>> + if (sa == NULL)
>> + goto drop_pkt_and_exit;
>> +
>> + /* SPI on the packet should match with the one in SA */
>> + if (unlikely(sa->spi != sa_idx))
>> + goto drop_pkt_and_exit;
>> +
>> +route_and_send_pkt:
>> + port_id = get_route(pkt, rt, type);
>> + if (unlikely(port_id == RTE_MAX_ETHPORTS)) {
>> + /* no match */
>> + goto drop_pkt_and_exit;
>> + }
>> + /* else, we have a matching route */
>> +
>> + /* Update mac addresses */
>> + update_mac_addrs(pkt, port_id);
>> +
>> + /* Update the event with the dest port */
>> + ipsec_event_pre_forward(pkt, port_id);
>> + return 1;
>> +
>> +drop_pkt_and_exit:
>> + RTE_LOG(ERR, IPSEC, "Inbound packet dropped\n");
>> + rte_pktmbuf_free(pkt);
>> + ev->mbuf = NULL;
>> + return 0;
>> +}
>> +
>> /*
>> * Event mode exposes various operating modes depending on the
>> * capabilities of the event device and the operating mode
>> @@ -134,11 +345,11 @@ static void
>> ipsec_wrkr_non_burst_int_port_app_mode_inb(struct eh_event_link_info *links,
>> uint8_t nb_links)
>> {
>> + struct lcore_conf_ev_tx_int_port_wrkr lconf;
>> unsigned int nb_rx = 0;
>> - unsigned int port_id;
>> - struct rte_mbuf *pkt;
>> struct rte_event ev;
>> uint32_t lcore_id;
>> + int32_t socket_id;
>>
>> /* Check if we have links registered for this lcore */
>> if (nb_links == 0) {
>> @@ -151,6 +362,21 @@ ipsec_wrkr_non_burst_int_port_app_mode_inb(struct eh_event_link_info *links,
>> /* Get core ID */
>> lcore_id = rte_lcore_id();
>>
>> + /* Get socket ID */
>> + socket_id = rte_lcore_to_socket_id(lcore_id);
>> +
>> + /* Save routing table */
>> + lconf.rt.rt4_ctx = socket_ctx[socket_id].rt_ip4;
>> + lconf.rt.rt6_ctx = socket_ctx[socket_id].rt_ip6;
>> + lconf.inbound.sp4_ctx = socket_ctx[socket_id].sp_ip4_in;
>> + lconf.inbound.sp6_ctx = socket_ctx[socket_id].sp_ip6_in;
>> + lconf.inbound.sa_ctx = socket_ctx[socket_id].sa_in;
>> + lconf.inbound.session_pool = socket_ctx[socket_id].session_pool;
>> + lconf.outbound.sp4_ctx = socket_ctx[socket_id].sp_ip4_out;
>> + lconf.outbound.sp6_ctx = socket_ctx[socket_id].sp_ip6_out;
>> + lconf.outbound.sa_ctx = socket_ctx[socket_id].sa_out;
>> + lconf.outbound.session_pool = socket_ctx[socket_id].session_pool;
>> +
>> RTE_LOG(INFO, IPSEC,
>> "Launching event mode worker (non-burst - Tx internal port - "
>> "app mode - inbound) on lcore %d\n", lcore_id);
>> @@ -175,13 +401,11 @@ ipsec_wrkr_non_burst_int_port_app_mode_inb(struct eh_event_link_info *links,
>> if (nb_rx == 0)
>> continue;
>>
>> - port_id = ev.queue_id;
>> - pkt = ev.mbuf;
>> -
>> - rte_prefetch0(rte_pktmbuf_mtod(pkt, void *));
>> -
>> - /* Process packet */
>> - ipsec_event_pre_forward(pkt, port_id);
>> + if (process_ipsec_ev_inbound(&lconf.inbound,
>> + &lconf.rt, &ev) != 1) {
>> + /* The pkt has been dropped */
>> + continue;
>> + }
>>
>> /*
>> * Since tx internal port is available, events can be
>> diff --git a/examples/ipsec-secgw/ipsec_worker.h b/examples/ipsec-secgw/ipsec_worker.h
>> new file mode 100644
>> index 0000000..fd18a2e
>> --- /dev/null
>> +++ b/examples/ipsec-secgw/ipsec_worker.h
>> @@ -0,0 +1,39 @@
>> +/* SPDX-License-Identifier: BSD-3-Clause
>> + * Copyright(c) 2018 Cavium, Inc
>> + */
>> +#ifndef _IPSEC_WORKER_H_
>> +#define _IPSEC_WORKER_H_
>> +
>> +#include "ipsec.h"
>> +
>> +enum pkt_type {
>> + PKT_TYPE_PLAIN_IPV4 = 1,
>> + PKT_TYPE_IPSEC_IPV4,
>> + PKT_TYPE_PLAIN_IPV6,
>> + PKT_TYPE_IPSEC_IPV6,
>> + PKT_TYPE_INVALID
>> +};
>> +
>> +struct route_table {
>> + struct rt_ctx *rt4_ctx;
>> + struct rt_ctx *rt6_ctx;
>> +};
>> +
>> +/*
>> + * Conf required by event mode worker with tx internal port
>> + */
>> +struct lcore_conf_ev_tx_int_port_wrkr {
>> + struct ipsec_ctx inbound;
>> + struct ipsec_ctx outbound;
>> + struct route_table rt;
>> +} __rte_cache_aligned;
>> +
>> +/* TODO
>> + *
>> + * Move this function to ipsec_worker.c
>> + */
>> +void ipsec_poll_mode_worker(void);
>> +
>> +int ipsec_launch_one_lcore(void *args);
>> +
>> +#endif /* _IPSEC_WORKER_H_ */
>> diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c
>> index 7f046e3..9e17ba0 100644
>> --- a/examples/ipsec-secgw/sa.c
>> +++ b/examples/ipsec-secgw/sa.c
>> @@ -772,17 +772,6 @@ print_one_sa_rule(const struct ipsec_sa *sa, int inbound)
>> printf("\n");
>> }
>>
>> -struct sa_ctx {
>> - void *satbl; /* pointer to array of rte_ipsec_sa objects*/
>> - struct ipsec_sa sa[IPSEC_SA_MAX_ENTRIES];
>> - union {
>> - struct {
>> - struct rte_crypto_sym_xform a;
>> - struct rte_crypto_sym_xform b;
>> - };
>> - } xf[IPSEC_SA_MAX_ENTRIES];
>> -};
>> -
>> static struct sa_ctx *
>> sa_create(const char *name, int32_t socket_id)
>> {
>> --
>> 2.7.4
>
@@ -50,12 +50,11 @@
#include "event_helper.h"
#include "ipsec.h"
+#include "ipsec_worker.h"
#include "parser.h"
volatile bool force_quit;
-#define RTE_LOGTYPE_IPSEC RTE_LOGTYPE_USER1
-
#define MAX_JUMBO_PKT_LEN 9600
#define MEMPOOL_CACHE_SIZE 256
@@ -70,8 +69,6 @@ volatile bool force_quit;
#define BURST_TX_DRAIN_US 100 /* TX drain every ~100us */
-#define NB_SOCKETS 4
-
/* Configure how many packets ahead to prefetch, when reading packets */
#define PREFETCH_OFFSET 3
@@ -79,8 +76,6 @@ volatile bool force_quit;
#define MAX_LCORE_PARAMS 1024
-#define UNPROTECTED_PORT(port) (unprotected_port_mask & (1 << portid))
-
/*
* Configurable number of RX/TX ring descriptors
*/
@@ -89,29 +84,6 @@ volatile bool force_quit;
static uint16_t nb_rxd = IPSEC_SECGW_RX_DESC_DEFAULT;
static uint16_t nb_txd = IPSEC_SECGW_TX_DESC_DEFAULT;
-#if RTE_BYTE_ORDER != RTE_LITTLE_ENDIAN
-#define __BYTES_TO_UINT64(a, b, c, d, e, f, g, h) \
- (((uint64_t)((a) & 0xff) << 56) | \
- ((uint64_t)((b) & 0xff) << 48) | \
- ((uint64_t)((c) & 0xff) << 40) | \
- ((uint64_t)((d) & 0xff) << 32) | \
- ((uint64_t)((e) & 0xff) << 24) | \
- ((uint64_t)((f) & 0xff) << 16) | \
- ((uint64_t)((g) & 0xff) << 8) | \
- ((uint64_t)(h) & 0xff))
-#else
-#define __BYTES_TO_UINT64(a, b, c, d, e, f, g, h) \
- (((uint64_t)((h) & 0xff) << 56) | \
- ((uint64_t)((g) & 0xff) << 48) | \
- ((uint64_t)((f) & 0xff) << 40) | \
- ((uint64_t)((e) & 0xff) << 32) | \
- ((uint64_t)((d) & 0xff) << 24) | \
- ((uint64_t)((c) & 0xff) << 16) | \
- ((uint64_t)((b) & 0xff) << 8) | \
- ((uint64_t)(a) & 0xff))
-#endif
-#define ETHADDR(a, b, c, d, e, f) (__BYTES_TO_UINT64(a, b, c, d, e, f, 0, 0))
-
#define ETHADDR_TO_UINT64(addr) __BYTES_TO_UINT64( \
(addr)->addr_bytes[0], (addr)->addr_bytes[1], \
(addr)->addr_bytes[2], (addr)->addr_bytes[3], \
@@ -123,18 +95,6 @@ static uint16_t nb_txd = IPSEC_SECGW_TX_DESC_DEFAULT;
#define MTU_TO_FRAMELEN(x) ((x) + RTE_ETHER_HDR_LEN + RTE_ETHER_CRC_LEN)
-/* port/source ethernet addr and destination ethernet addr */
-struct ethaddr_info {
- uint64_t src, dst;
-};
-
-struct ethaddr_info ethaddr_tbl[RTE_MAX_ETHPORTS] = {
- { 0, ETHADDR(0x00, 0x16, 0x3e, 0x7e, 0x94, 0x9a) },
- { 0, ETHADDR(0x00, 0x16, 0x3e, 0x22, 0xa1, 0xd9) },
- { 0, ETHADDR(0x00, 0x16, 0x3e, 0x08, 0x69, 0x26) },
- { 0, ETHADDR(0x00, 0x16, 0x3e, 0x49, 0x9e, 0xdd) }
-};
-
struct flow_info flow_info_tbl[RTE_MAX_ETHPORTS];
#define CMD_LINE_OPT_CONFIG "config"
@@ -192,10 +152,16 @@ static const struct option lgopts[] = {
{NULL, 0, 0, 0}
};
+struct ethaddr_info ethaddr_tbl[RTE_MAX_ETHPORTS] = {
+ { 0, ETHADDR(0x00, 0x16, 0x3e, 0x7e, 0x94, 0x9a) },
+ { 0, ETHADDR(0x00, 0x16, 0x3e, 0x22, 0xa1, 0xd9) },
+ { 0, ETHADDR(0x00, 0x16, 0x3e, 0x08, 0x69, 0x26) },
+ { 0, ETHADDR(0x00, 0x16, 0x3e, 0x49, 0x9e, 0xdd) }
+};
+
/* mask of enabled ports */
static uint32_t enabled_port_mask;
static uint64_t enabled_cryptodev_mask = UINT64_MAX;
-static uint32_t unprotected_port_mask;
static int32_t promiscuous_on = 1;
static int32_t numa_on = 1; /**< NUMA is enabled by default. */
static uint32_t nb_lcores;
@@ -283,8 +249,6 @@ static struct rte_eth_conf port_conf = {
},
};
-static struct socket_ctx socket_ctx[NB_SOCKETS];
-
/*
* Determine is multi-segment support required:
* - either frame buffer size is smaller then mtu
@@ -2828,47 +2792,10 @@ main(int32_t argc, char **argv)
sa_check_offloads(portid, &req_rx_offloads, &req_tx_offloads);
port_init(portid, req_rx_offloads, req_tx_offloads);
- /* Create default ipsec flow for the ethernet device */
- ret = create_default_ipsec_flow(portid, req_rx_offloads);
- if (ret)
- printf("Cannot create default flow, err=%d, port=%d\n",
- ret, portid);
}
cryptodevs_init();
- /* start ports */
- RTE_ETH_FOREACH_DEV(portid) {
- if ((enabled_port_mask & (1 << portid)) == 0)
- continue;
-
- /*
- * Start device
- * note: device must be started before a flow rule
- * can be installed.
- */
- ret = rte_eth_dev_start(portid);
- if (ret < 0)
- rte_exit(EXIT_FAILURE, "rte_eth_dev_start: "
- "err=%d, port=%d\n", ret, portid);
- /*
- * If enabled, put device in promiscuous mode.
- * This allows IO forwarding mode to forward packets
- * to itself through 2 cross-connected ports of the
- * target machine.
- */
- if (promiscuous_on) {
- ret = rte_eth_promiscuous_enable(portid);
- if (ret != 0)
- rte_exit(EXIT_FAILURE,
- "rte_eth_promiscuous_enable: err=%s, port=%d\n",
- rte_strerror(-ret), portid);
- }
-
- rte_eth_dev_callback_register(portid,
- RTE_ETH_EVENT_IPSEC, inline_ipsec_event_callback, NULL);
- }
-
/* fragment reassemble is enabled */
if (frag_tbl_sz != 0) {
ret = reassemble_init();
@@ -2889,8 +2816,6 @@ main(int32_t argc, char **argv)
}
}
- check_all_ports_link_status(enabled_port_mask);
-
/*
* Set the enabled port mask in helper config for use by helper
* sub-system. This will be used while intializing devices using
@@ -2903,6 +2828,39 @@ main(int32_t argc, char **argv)
if (ret < 0)
rte_exit(EXIT_FAILURE, "eh_devs_init failed, err=%d\n", ret);
+ /* Create default ipsec flow for each port and start each port */
+ RTE_ETH_FOREACH_DEV(portid) {
+ if ((enabled_port_mask & (1 << portid)) == 0)
+ continue;
+
+ ret = create_default_ipsec_flow(portid, req_rx_offloads);
+ if (ret)
+ printf("create_default_ipsec_flow failed, err=%d, "
+ "port=%d\n", ret, portid);
+ /*
+ * Start device
+ * note: device must be started before a flow rule
+ * can be installed.
+ */
+ ret = rte_eth_dev_start(portid);
+ if (ret < 0)
+ rte_exit(EXIT_FAILURE, "rte_eth_dev_start: "
+ "err=%d, port=%d\n", ret, portid);
+ /*
+ * If enabled, put device in promiscuous mode.
+ * This allows IO forwarding mode to forward packets
+ * to itself through 2 cross-connected ports of the
+ * target machine.
+ */
+ if (promiscuous_on)
+ rte_eth_promiscuous_enable(portid);
+
+ rte_eth_dev_callback_register(portid,
+ RTE_ETH_EVENT_IPSEC, inline_ipsec_event_callback, NULL);
+ }
+
+ check_all_ports_link_status(enabled_port_mask);
+
/* launch per-lcore init on every lcore */
rte_eal_mp_remote_launch(ipsec_launch_one_lcore, eh_conf, CALL_MASTER);
new file mode 100644
@@ -0,0 +1,81 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ * Copyright(c) 2018 Cavium, Inc
+ */
+#ifndef _IPSEC_SECGW_H_
+#define _IPSEC_SECGW_H_
+
+#include <rte_hash.h>
+
+#define MAX_PKT_BURST 32
+
+#define RTE_LOGTYPE_IPSEC RTE_LOGTYPE_USER1
+
+#define NB_SOCKETS 4
+
+#define UNPROTECTED_PORT(port) (unprotected_port_mask & (1 << portid))
+
+#if RTE_BYTE_ORDER != RTE_LITTLE_ENDIAN
+#define __BYTES_TO_UINT64(a, b, c, d, e, f, g, h) \
+ (((uint64_t)((a) & 0xff) << 56) | \
+ ((uint64_t)((b) & 0xff) << 48) | \
+ ((uint64_t)((c) & 0xff) << 40) | \
+ ((uint64_t)((d) & 0xff) << 32) | \
+ ((uint64_t)((e) & 0xff) << 24) | \
+ ((uint64_t)((f) & 0xff) << 16) | \
+ ((uint64_t)((g) & 0xff) << 8) | \
+ ((uint64_t)(h) & 0xff))
+#else
+#define __BYTES_TO_UINT64(a, b, c, d, e, f, g, h) \
+ (((uint64_t)((h) & 0xff) << 56) | \
+ ((uint64_t)((g) & 0xff) << 48) | \
+ ((uint64_t)((f) & 0xff) << 40) | \
+ ((uint64_t)((e) & 0xff) << 32) | \
+ ((uint64_t)((d) & 0xff) << 24) | \
+ ((uint64_t)((c) & 0xff) << 16) | \
+ ((uint64_t)((b) & 0xff) << 8) | \
+ ((uint64_t)(a) & 0xff))
+#endif
+
+#define ETHADDR(a, b, c, d, e, f) (__BYTES_TO_UINT64(a, b, c, d, e, f, 0, 0))
+
+struct traffic_type {
+ const uint8_t *data[MAX_PKT_BURST * 2];
+ struct rte_mbuf *pkts[MAX_PKT_BURST * 2];
+ void *saptr[MAX_PKT_BURST * 2];
+ uint32_t res[MAX_PKT_BURST * 2];
+ uint32_t num;
+};
+
+struct ipsec_traffic {
+ struct traffic_type ipsec;
+ struct traffic_type ip4;
+ struct traffic_type ip6;
+};
+
+/* Fields optimized for devices without burst */
+struct traffic_type_nb {
+ const uint8_t *data;
+ struct rte_mbuf *pkt;
+ uint32_t res;
+ uint32_t num;
+};
+
+struct ipsec_traffic_nb {
+ struct traffic_type_nb ipsec;
+ struct traffic_type_nb ip4;
+ struct traffic_type_nb ip6;
+};
+
+/* port/source ethernet addr and destination ethernet addr */
+struct ethaddr_info {
+ uint64_t src, dst;
+};
+
+struct ethaddr_info ethaddr_tbl[RTE_MAX_ETHPORTS];
+
+/* TODO: All var definitions need to be part of a .c file */
+
+/* Port mask to identify the unprotected ports */
+uint32_t unprotected_port_mask;
+
+#endif /* _IPSEC_SECGW_H_ */
@@ -13,11 +13,11 @@
#include <rte_flow.h>
#include <rte_ipsec.h>
-#define RTE_LOGTYPE_IPSEC RTE_LOGTYPE_USER1
+#include "ipsec-secgw.h"
+
#define RTE_LOGTYPE_IPSEC_ESP RTE_LOGTYPE_USER2
#define RTE_LOGTYPE_IPSEC_IPIP RTE_LOGTYPE_USER3
-#define MAX_PKT_BURST 32
#define MAX_INFLIGHT 128
#define MAX_QP_PER_LCORE 256
@@ -153,6 +153,17 @@ struct ipsec_sa {
struct rte_security_session_conf sess_conf;
} __rte_cache_aligned;
+struct sa_ctx {
+ void *satbl; /* pointer to array of rte_ipsec_sa objects*/
+ struct ipsec_sa sa[IPSEC_SA_MAX_ENTRIES];
+ union {
+ struct {
+ struct rte_crypto_sym_xform a;
+ struct rte_crypto_sym_xform b;
+ };
+ } xf[IPSEC_SA_MAX_ENTRIES];
+};
+
struct ipsec_mbuf_metadata {
struct ipsec_sa *sa;
struct rte_crypto_op cop;
@@ -233,26 +244,8 @@ struct cnt_blk {
uint32_t cnt;
} __attribute__((packed));
-struct traffic_type {
- const uint8_t *data[MAX_PKT_BURST * 2];
- struct rte_mbuf *pkts[MAX_PKT_BURST * 2];
- void *saptr[MAX_PKT_BURST * 2];
- uint32_t res[MAX_PKT_BURST * 2];
- uint32_t num;
-};
-
-struct ipsec_traffic {
- struct traffic_type ipsec;
- struct traffic_type ip4;
- struct traffic_type ip6;
-};
-
-
-void
-ipsec_poll_mode_worker(void);
-
-int
-ipsec_launch_one_lcore(void *args);
+/* Socket ctx */
+struct socket_ctx socket_ctx[NB_SOCKETS];
uint16_t
ipsec_inbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[],
@@ -15,6 +15,7 @@
#include <ctype.h>
#include <stdbool.h>
+#include <rte_acl.h>
#include <rte_common.h>
#include <rte_log.h>
#include <rte_memcpy.h>
@@ -29,12 +30,51 @@
#include <rte_eventdev.h>
#include <rte_malloc.h>
#include <rte_mbuf.h>
+#include <rte_lpm.h>
+#include <rte_lpm6.h>
#include "ipsec.h"
+#include "ipsec_worker.h"
#include "event_helper.h"
extern volatile bool force_quit;
+static inline enum pkt_type
+process_ipsec_get_pkt_type(struct rte_mbuf *pkt, uint8_t **nlp)
+{
+ struct rte_ether_hdr *eth;
+
+ eth = rte_pktmbuf_mtod(pkt, struct rte_ether_hdr *);
+ if (eth->ether_type == rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV4)) {
+ *nlp = RTE_PTR_ADD(eth, RTE_ETHER_HDR_LEN +
+ offsetof(struct ip, ip_p));
+ if (**nlp == IPPROTO_ESP)
+ return PKT_TYPE_IPSEC_IPV4;
+ else
+ return PKT_TYPE_PLAIN_IPV4;
+ } else if (eth->ether_type == rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV6)) {
+ *nlp = RTE_PTR_ADD(eth, RTE_ETHER_HDR_LEN +
+ offsetof(struct ip6_hdr, ip6_nxt));
+ if (**nlp == IPPROTO_ESP)
+ return PKT_TYPE_IPSEC_IPV6;
+ else
+ return PKT_TYPE_PLAIN_IPV6;
+ }
+
+ /* Unknown/Unsupported type */
+ return PKT_TYPE_INVALID;
+}
+
+static inline void
+update_mac_addrs(struct rte_mbuf *pkt, uint16_t portid)
+{
+ struct rte_ether_hdr *ethhdr;
+
+ ethhdr = rte_pktmbuf_mtod(pkt, struct rte_ether_hdr *);
+ memcpy(ðhdr->s_addr, ðaddr_tbl[portid].src, RTE_ETHER_ADDR_LEN);
+ memcpy(ðhdr->d_addr, ðaddr_tbl[portid].dst, RTE_ETHER_ADDR_LEN);
+}
+
static inline void
ipsec_event_pre_forward(struct rte_mbuf *m, unsigned int port_id)
{
@@ -45,6 +85,177 @@ ipsec_event_pre_forward(struct rte_mbuf *m, unsigned int port_id)
rte_event_eth_tx_adapter_txq_set(m, 0);
}
+static inline int
+check_sp(struct sp_ctx *sp, const uint8_t *nlp, uint32_t *sa_idx)
+{
+ uint32_t res;
+
+ if (unlikely(sp == NULL))
+ return 0;
+
+ rte_acl_classify((struct rte_acl_ctx *)sp, &nlp, &res, 1,
+ DEFAULT_MAX_CATEGORIES);
+
+ if (unlikely(res == 0)) {
+ /* No match */
+ return 0;
+ }
+
+ if (res == DISCARD)
+ return 0;
+ else if (res == BYPASS) {
+ *sa_idx = 0;
+ return 1;
+ }
+
+ *sa_idx = SPI2IDX(res);
+ if (*sa_idx < IPSEC_SA_MAX_ENTRIES)
+ return 1;
+
+ /* Invalid SA IDX */
+ return 0;
+}
+
+static inline uint16_t
+route4_pkt(struct rte_mbuf *pkt, struct rt_ctx *rt_ctx)
+{
+ uint32_t dst_ip;
+ uint16_t offset;
+ uint32_t hop;
+ int ret;
+
+ offset = RTE_ETHER_HDR_LEN + offsetof(struct ip, ip_dst);
+ dst_ip = *rte_pktmbuf_mtod_offset(pkt, uint32_t *, offset);
+ dst_ip = rte_be_to_cpu_32(dst_ip);
+
+ ret = rte_lpm_lookup((struct rte_lpm *)rt_ctx, dst_ip, &hop);
+
+ if (ret == 0) {
+ /* We have a hit */
+ return hop;
+ }
+
+ /* else */
+ return RTE_MAX_ETHPORTS;
+}
+
+/* TODO: To be tested */
+static inline uint16_t
+route6_pkt(struct rte_mbuf *pkt, struct rt_ctx *rt_ctx)
+{
+ uint8_t dst_ip[16];
+ uint8_t *ip6_dst;
+ uint16_t offset;
+ uint32_t hop;
+ int ret;
+
+ offset = RTE_ETHER_HDR_LEN + offsetof(struct ip6_hdr, ip6_dst);
+ ip6_dst = rte_pktmbuf_mtod_offset(pkt, uint8_t *, offset);
+ memcpy(&dst_ip[0], ip6_dst, 16);
+
+ ret = rte_lpm6_lookup((struct rte_lpm6 *)rt_ctx, dst_ip, &hop);
+
+ if (ret == 0) {
+ /* We have a hit */
+ return hop;
+ }
+
+ /* else */
+ return RTE_MAX_ETHPORTS;
+}
+
+static inline uint16_t
+get_route(struct rte_mbuf *pkt, struct route_table *rt, enum pkt_type type)
+{
+ if (type == PKT_TYPE_PLAIN_IPV4 || type == PKT_TYPE_IPSEC_IPV4)
+ return route4_pkt(pkt, rt->rt4_ctx);
+ else if (type == PKT_TYPE_PLAIN_IPV6 || type == PKT_TYPE_IPSEC_IPV6)
+ return route6_pkt(pkt, rt->rt6_ctx);
+
+ return RTE_MAX_ETHPORTS;
+}
+
+static inline int
+process_ipsec_ev_inbound(struct ipsec_ctx *ctx, struct route_table *rt,
+ struct rte_event *ev)
+{
+ struct ipsec_sa *sa = NULL;
+ struct rte_mbuf *pkt;
+ uint16_t port_id = 0;
+ enum pkt_type type;
+ uint32_t sa_idx;
+ uint8_t *nlp;
+
+ /* Get pkt from event */
+ pkt = ev->mbuf;
+
+ /* Check the packet type */
+ type = process_ipsec_get_pkt_type(pkt, &nlp);
+
+ switch (type) {
+ case PKT_TYPE_PLAIN_IPV4:
+ if (pkt->ol_flags & PKT_RX_SEC_OFFLOAD)
+ sa = (struct ipsec_sa *) pkt->udata64;
+
+ /* Check if we have a match */
+ if (check_sp(ctx->sp4_ctx, nlp, &sa_idx) == 0) {
+ /* No valid match */
+ goto drop_pkt_and_exit;
+ }
+ break;
+
+ case PKT_TYPE_PLAIN_IPV6:
+ if (pkt->ol_flags & PKT_RX_SEC_OFFLOAD)
+ sa = (struct ipsec_sa *) pkt->udata64;
+
+ /* Check if we have a match */
+ if (check_sp(ctx->sp6_ctx, nlp, &sa_idx) == 0) {
+ /* No valid match */
+ goto drop_pkt_and_exit;
+ }
+ break;
+
+ default:
+ RTE_LOG(ERR, IPSEC, "Unsupported packet type = %d\n", type);
+ goto drop_pkt_and_exit;
+ }
+
+ /* Check if the packet has to be bypassed */
+ if (sa_idx == 0)
+ goto route_and_send_pkt;
+
+ /* Else the packet has to be protected with SA */
+
+ /* If the packet was IPsec processed, then SA pointer should be set */
+ if (sa == NULL)
+ goto drop_pkt_and_exit;
+
+ /* SPI on the packet should match with the one in SA */
+ if (unlikely(sa->spi != sa_idx))
+ goto drop_pkt_and_exit;
+
+route_and_send_pkt:
+ port_id = get_route(pkt, rt, type);
+ if (unlikely(port_id == RTE_MAX_ETHPORTS)) {
+ /* no match */
+ goto drop_pkt_and_exit;
+ }
+ /* else, we have a matching route */
+
+ /* Update mac addresses */
+ update_mac_addrs(pkt, port_id);
+
+ /* Update the event with the dest port */
+ ipsec_event_pre_forward(pkt, port_id);
+ return 1;
+
+drop_pkt_and_exit:
+ RTE_LOG(ERR, IPSEC, "Inbound packet dropped\n");
+ rte_pktmbuf_free(pkt);
+ ev->mbuf = NULL;
+ return 0;
+}
+
/*
* Event mode exposes various operating modes depending on the
* capabilities of the event device and the operating mode
@@ -134,11 +345,11 @@ static void
ipsec_wrkr_non_burst_int_port_app_mode_inb(struct eh_event_link_info *links,
uint8_t nb_links)
{
+ struct lcore_conf_ev_tx_int_port_wrkr lconf;
unsigned int nb_rx = 0;
- unsigned int port_id;
- struct rte_mbuf *pkt;
struct rte_event ev;
uint32_t lcore_id;
+ int32_t socket_id;
/* Check if we have links registered for this lcore */
if (nb_links == 0) {
@@ -151,6 +362,21 @@ ipsec_wrkr_non_burst_int_port_app_mode_inb(struct eh_event_link_info *links,
/* Get core ID */
lcore_id = rte_lcore_id();
+ /* Get socket ID */
+ socket_id = rte_lcore_to_socket_id(lcore_id);
+
+ /* Save routing table */
+ lconf.rt.rt4_ctx = socket_ctx[socket_id].rt_ip4;
+ lconf.rt.rt6_ctx = socket_ctx[socket_id].rt_ip6;
+ lconf.inbound.sp4_ctx = socket_ctx[socket_id].sp_ip4_in;
+ lconf.inbound.sp6_ctx = socket_ctx[socket_id].sp_ip6_in;
+ lconf.inbound.sa_ctx = socket_ctx[socket_id].sa_in;
+ lconf.inbound.session_pool = socket_ctx[socket_id].session_pool;
+ lconf.outbound.sp4_ctx = socket_ctx[socket_id].sp_ip4_out;
+ lconf.outbound.sp6_ctx = socket_ctx[socket_id].sp_ip6_out;
+ lconf.outbound.sa_ctx = socket_ctx[socket_id].sa_out;
+ lconf.outbound.session_pool = socket_ctx[socket_id].session_pool;
+
RTE_LOG(INFO, IPSEC,
"Launching event mode worker (non-burst - Tx internal port - "
"app mode - inbound) on lcore %d\n", lcore_id);
@@ -175,13 +401,11 @@ ipsec_wrkr_non_burst_int_port_app_mode_inb(struct eh_event_link_info *links,
if (nb_rx == 0)
continue;
- port_id = ev.queue_id;
- pkt = ev.mbuf;
-
- rte_prefetch0(rte_pktmbuf_mtod(pkt, void *));
-
- /* Process packet */
- ipsec_event_pre_forward(pkt, port_id);
+ if (process_ipsec_ev_inbound(&lconf.inbound,
+ &lconf.rt, &ev) != 1) {
+ /* The pkt has been dropped */
+ continue;
+ }
/*
* Since tx internal port is available, events can be
new file mode 100644
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ * Copyright(c) 2018 Cavium, Inc
+ */
+#ifndef _IPSEC_WORKER_H_
+#define _IPSEC_WORKER_H_
+
+#include "ipsec.h"
+
+enum pkt_type {
+ PKT_TYPE_PLAIN_IPV4 = 1,
+ PKT_TYPE_IPSEC_IPV4,
+ PKT_TYPE_PLAIN_IPV6,
+ PKT_TYPE_IPSEC_IPV6,
+ PKT_TYPE_INVALID
+};
+
+struct route_table {
+ struct rt_ctx *rt4_ctx;
+ struct rt_ctx *rt6_ctx;
+};
+
+/*
+ * Conf required by event mode worker with tx internal port
+ */
+struct lcore_conf_ev_tx_int_port_wrkr {
+ struct ipsec_ctx inbound;
+ struct ipsec_ctx outbound;
+ struct route_table rt;
+} __rte_cache_aligned;
+
+/* TODO
+ *
+ * Move this function to ipsec_worker.c
+ */
+void ipsec_poll_mode_worker(void);
+
+int ipsec_launch_one_lcore(void *args);
+
+#endif /* _IPSEC_WORKER_H_ */
@@ -772,17 +772,6 @@ print_one_sa_rule(const struct ipsec_sa *sa, int inbound)
printf("\n");
}
-struct sa_ctx {
- void *satbl; /* pointer to array of rte_ipsec_sa objects*/
- struct ipsec_sa sa[IPSEC_SA_MAX_ENTRIES];
- union {
- struct {
- struct rte_crypto_sym_xform a;
- struct rte_crypto_sym_xform b;
- };
- } xf[IPSEC_SA_MAX_ENTRIES];
-};
-
static struct sa_ctx *
sa_create(const char *name, int32_t socket_id)
{