From patchwork Tue Dec 12 08:32:25 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anoob Joseph X-Patchwork-Id: 32106 X-Patchwork-Delegate: pablo.de.lara.guarch@intel.com Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id C9F472B99; Tue, 12 Dec 2017 09:32:58 +0100 (CET) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0059.outbound.protection.outlook.com [104.47.33.59]) by dpdk.org (Postfix) with ESMTP id 40F58271 for ; Tue, 12 Dec 2017 09:32:57 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=CAVIUMNETWORKS.onmicrosoft.com; s=selector1-cavium-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=cLzqU7BWw7U3NrZcrgUz9YAqHIlJ3TH9jgPpEMDGFXE=; b=Wb1RY4p+ii9qdV5NNYesjFgvlRDQkYcIbq7VSL/kGPeUi6P7fM8T1FW19ds91lQx8VBLHlCp8ZFUnA+utA1HOoSaoPz05l6SXVFqqv6WIHC2B6Jd846Mp+xhXwidQHJIgUKDPMu1lyHEz5adrh242tOIFBtKhbyu0lDmBOtox6k= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Anoob.Joseph@cavium.com; Received: from ajoseph83.caveonetworks.com (115.113.156.2) by DM5PR0701MB3640.namprd07.prod.outlook.com (2603:10b6:4:7e::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.302.9; Tue, 12 Dec 2017 08:32:52 +0000 From: Anoob Joseph To: Akhil Goyal , Declan Doherty , Sergio Gonzalez Monroy , Radu Nicolau Cc: Anoob Joseph , Narayana Prasad , Jerin Jacob , dev@dpdk.org Date: Tue, 12 Dec 2017 08:32:25 +0000 Message-Id: <1513067545-19311-1-git-send-email-anoob.joseph@caviumnetworks.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1513006557-14898-1-git-send-email-anoob.joseph@caviumnetworks.com> References: <1513006557-14898-1-git-send-email-anoob.joseph@caviumnetworks.com> MIME-Version: 1.0 X-Originating-IP: [115.113.156.2] X-ClientProxiedBy: CY4PR2201CA0020.namprd22.prod.outlook.com (2603:10b6:910:5f::30) To DM5PR0701MB3640.namprd07.prod.outlook.com (2603:10b6:4:7e::12) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 67424b61-f15d-4529-9dea-08d5413af0c8 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(4534020)(4602075)(7168020)(4627115)(201703031133081)(201702281549075)(5600026)(4604075)(2017052603307); SRVR:DM5PR0701MB3640; X-Microsoft-Exchange-Diagnostics: 1; DM5PR0701MB3640; 3:reVRwx53DE/ai/ibVqTWIa8MWjSmVJVRgztoYJZw0EdN+oSrjeHhObZTDHF3kz1peLRIJO8cRrKAgf7GXmq2iD3xXgbdIKBjtwWJ5d1lp2JdRYU5sE5ZAy6mLbzbrP4rw/TRLdLDejnG01n7YAqbo/d+dZ4xlEMHrSgoFgUty/I9V6r0fZeoQvPKbF7lHa+YPW31f0AkmUUzduo/rf3ABE5RlGkKzUSoSlIA7MgNRHrLwTNzJ9hd7Fu70Gd6yQt1; 25:BVhpzbtEp1x/Qv4oVY6VWJ3xUzjxlidlre6z9MKvnxxL3NWsNMk2S2KS+pekN7d+94mnXFP7nRTnvBUHgjLbj4AfcsDXmmCkgcyLVGwqPZCBcnhYhMGPg9vNDBF/wR4UhXsoTt+NnMTzDW4kNEaQht5eUGIsRsjokoAZYvp3PPSB/XSWqyirtj3664NtbGysXCKE1GiaVKGzx7RF2xBJn2x4rEYBpOxjdBtP2zZcL8c+Cxr1BjKMbeZi/YoPr/WUkAcNL1UodPF8N6p0+Ln5UBpRnWCMa2aeja2uDpFeJ65ucUyC8Q2S7HNRmfPSvbRuWrCvt4WcRXpNtGlvpzHRRw==; 31:TioP43FPOVqGS7YDpYHjkx6OF3KPG/Rtx/rps057PD2tM5tGDpUThlkG/Ceg1c2+K3GldhQAQOC/0aM/kYpVlS/jnjlgzUKFMzbt89QlQz68kBIAQXDWr0j4G+alCay9RemYfqEnulbbL1n3ICIFgGfI1gDzwrGOlWGfSFp0QpTAX2tRZ7EqHe8YPMn4CHv9kWSQZWTPcBlF9NFFlhfJdbGa6sL8FS0EuHmYR7mUoig= X-MS-TrafficTypeDiagnostic: DM5PR0701MB3640: X-Microsoft-Exchange-Diagnostics: 1; DM5PR0701MB3640; 20:uBHG1EJ/w4pAZCaWaSvkRzmrGxiR/ethGlr+YjaTo/DQ5CCSGxvSDqK3Af+2gwX04pW5CsD8jEUMBGXnywUWykdx1usTWVTHiBg/3o+5+lAVfGdeDetj+rau8klJCRpgKL/brpX+71JzjiN6Vo/ks9I52M0OYGfWKMlgjojFbzRqIF+Npfl+cwUQpL7YagH2Xwtcarov2h3MlZvlgu+MXh0ySfAHtLASNA9kb0aNbuBjJ8Ojf9PZHWuj22oSmeeBBNYocREAcZbqtjUygn2qvQqPeNVH6skyrpasfImmolZGxbRrcseDqqjMY5ivX5laLiQ1DZYXO/pWeWwPSaYILyo7bbLD7+xY6J/yBtTxc8SCBpIq0p6KKjI3x7MJvv3Oc6W+Nq1BrhGlSJQnsVzF4YjJEfXNX2kvLegjvWhg3l59QK3XneJFPxVbl9W1ZBKzIjbuPRkj7cL/MXvdnfyEaRppPIn3MOcZTKC99zyy9LVL71Ow7+MHAdQhDm7u+LRdQhGGKnZAWT5UWzu1h9EpwA7PDn8x3KSM/YNSS+I3mXTVgg8R159R1Q5DZFLqCIcu2j06ztUKA3Ak0U+QO1p79CeBq4Cy2ol2oXhXecsbNt0= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(185117386973197); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(8121501046)(5005006)(93006095)(3002001)(3231023)(10201501046)(6041248)(20161123558100)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(20161123555025)(20161123564025)(6072148)(201708071742011); SRVR:DM5PR0701MB3640; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:DM5PR0701MB3640; X-Microsoft-Exchange-Diagnostics: 1; DM5PR0701MB3640; 4:xpVm3mmxuHLMsayPVFmbCw+bU44R228Lp1LP1dSGxaO4LhfuiVk8aeMgjBZFabQKtHUhdo5mUq4QELUXpmAl954JC5CVZO/xmzc99/E1iLS4esmnIyjQzkjOuS6Y3eG7G1Nl7D27onQfOAj77jz0IeaCnj1jWmt69v64GwRXCCaMWfLnZoKPwXmXK/sxDQWz596RiYYOSTZmGITRsVMhHAcrPiLvyb1YDhosAFl5TRNqAYmxfiwQrCXcRuiDidqOXv15nK64CHKU5IN3EQAZdQhHU9/l9XwRo/zVEWmDr9eYbnK/2QPtMhPY2HBe+wnLlUOH9OvoPbqBgNVMFdB7q/pU6kTk+skzOJNk6Hmi/IY= X-Forefront-PRVS: 051900244E X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(376002)(346002)(366004)(199004)(189003)(2950100002)(42882006)(6512007)(48376002)(50466002)(53416004)(105586002)(5660300001)(59450400001)(6666003)(6116002)(25786009)(3846002)(55236003)(51416003)(4326008)(52116002)(97736004)(76176011)(66066001)(47776003)(36756003)(478600001)(16526018)(2906002)(8676002)(7736002)(69596002)(54906003)(68736007)(316002)(110136005)(106356001)(50226002)(6506006)(8656006)(305945005)(53936002)(72206003)(81156014)(81166006)(8936002)(16586007)(6486002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR0701MB3640; H:ajoseph83.caveonetworks.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Received-SPF: None (protection.outlook.com: cavium.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; DM5PR0701MB3640; 23:9ERhaioM6aGWe6uyE81UtIYVk0T4+Qns9LM4GNu?= EF6iJwvOznTE72OWaBbG9xWCTN579s9gch5p3LXGXNjHt1dgPA+84nPBQeC1fNT9HxBHyzlOcprGGLQUi9AlQJ62K2OZ6xNRGxfnl0n56Oihk5bCko6XR25O7CjKk9ll1xPs3Pni47mhvhtAel1jklcv3vG08SInPNYLQ+VaWQuPuVJeHX5+5VmlfBITgtR+Rx8OSiO1U0jJbCXhr3NBMzQOfYy60i07U7kh0FVW+LCf/f6EzWB8Bx/TjP7s0o032qIPGycW3pvppbnlKrGZ4uufGEhh9oCpifqMFRSAMueDRgdSn7Ymo76YZohIgX2OFyR76b5WURmyPM6pzPVz4fvEI8o/7T2R1Okors0q7aXXWEGJcuTApWeBKWL5HPlp4WWWR1Vlx/dQfPD00Rtg+NiMtFAP+CBIQvq96ZxaL8+h935nu62I/dysQrHZ2XnC2+CbT2ncUBucLH45FzbFHnzGA4RtcLGou1wdRrus1U1/4/KUzjkVzR3NAhRJnqLxi94vAhdykrsm9lgJa076Yu4LH7tAGcREi23/j5B39f1tuTbOWmMOYogM313eC+jnTiMzN/LPtPqgidR+lmXt6c9NvpF4vd/K9uo6k/0hFuYlS88XSOsefs6w3nblVYIvCla2p7u6UOSxs6cinT+V/7UPmG05YPRy9/sxqOyqzYvnJ17QHstekxWmrsvgfHZ57v/85H07QwRl0j/S3AAJxV6TmzLBfFBebFpx9l18EP6DK4JkDJKNxPrIx187QpFL7RZ56KYavUmppehWEidzbTd2GwWTw3PftQLP+f2+qDYPMeWbGjurlaQqr3Z4xheosDP8MIRmHvQD03C43qcp70Q3/fiy4vyochTDftFe7jjTBvOqK4DscTtBxirkJPh8Iiuecv9/9rsoT0Fk3/QhO0dy3D/FQekhQHu6aVbPb1PDAd9XqVJnppCR17+oaDKZfnUPxSjb/+QSzVokR9xgLAKbjEa+FD4J+v4CAaUZ9f+CoSXB3JZ2G/YO7E9NSiSd1iVrNr8wQa77K6/TkAeeMReAKXT2Cys/2SMzaK4SPj+ZpR5fFcBeWhbit6xKeq2ToQl0FS0vW97KmjLIIP+MM20mR X-Microsoft-Exchange-Diagnostics: 1; DM5PR0701MB3640; 6:WggLDnhyk1spme/OdJLrV+iZM0PXMv9wJNC7x5F83n7QMxRJA7xUpICt8PzMa5yROLZlBZsSC29k/WJnzFwpSnHZZ1bD5+INfhZvnkeUz/qC0JBjeUi+kIQLHypCt7biGo9FwLu1Urg3KN/+d+3pFHFPpldtmiCNR4T4sIqP0J1etCbPp6RH/stuVkfOuZ1NXhhQkIXcXkMdZ6CZelmzKmf5tMuEzd4BkPZ+k5CAyUxyeLIjTMIrc8pSrKbFpoLRJiiTFgodzA65ZoWpR6qHNtDVICg1dRdId831WTcMrCudf81d8zktUHymVacqkFOklvf9GbqMZgh+5MtVn5Y+lCxhhXt17kfxrIp2yxmXjbw=; 5:HCUWg3hyJDhUNFKcwn1LJaqfSpBISP9ocBdWYkl8/oHop1Oi0Wxan0T6sPI50KISqSnV8dXX97p0AzSuzhYsCMxylRj6RH4iZYkxoaEb0F/8CDSBHcEs6mnrmIDdWGjdPmr+xWXCzNtvNChKhWDvyNxPIchBsNNRbDJSu0UOyCA=; 24:yXNIObURWM8AP4/ttY4pbkF/e3eQ+43P33MCAcryDbHjVI6DGKWz16ptFPBtrC+68LA1IQ8ku8dKsL1FMmQ60+Lq9FAR7ZCP60dHy6AmEhk=; 7:NE/Cq0kis2Pb5JMvaavQaR8NORoYoV2ec3rUgk2usbtJYEppgY8k/kFSivdyaec89ozzJihWOha0bzZG8G2Z7BiunjCLhrrYVmXq1YbFciUiELTEMQdB0Gyd9wJTsgQCTyGXJPVATH1qvhtNXSDy757mH2FaaHdj08cjkfZQWOZ/szMD8Jprm/aZ6Q6Ljv7QdKxLKS2Ib90SNZQKqpRiJKcH9BE5dZO1Hm8OlMId7+FQn4TSY34Y3coZHBEus0lQ SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: caviumnetworks.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Dec 2017 08:32:52.0599 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 67424b61-f15d-4529-9dea-08d5413af0c8 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 711e4ccf-2e9b-4bcf-a551-4094005b6194 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR0701MB3640 Subject: [dpdk-dev] [PATCH v5] examples/ipsec-secgw: fix usage of incorrect port X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" When security offload is enabled, the packet should be forwarded on the port configured in the SA. Security session will be configured on that port only, and sending the packet on other ports could result in unencrypted packets being sent out. This would have performance improvements too, as the per packet LPM lookup would be avoided for IPsec packets, in inline mode. Fixes: ec17993a145a ("examples/ipsec-secgw: support security offload") Signed-off-by: Anoob Joseph Acked-by: Akhil Goyal Acked-by: Radu Nicolau --- v5 * Updated comments as suggested by Akhil v4 * Made get_hop_for_offload_pkt() be aware of the packet type (ipv4/ipv6) and return success/error values accordingly v3 * Bug fix (fixed a wrong if condition) * Minor changes in documentation v2: * Updated documentation with the change in behavior for outbound inline offloaded packets. doc/guides/sample_app_ug/ipsec_secgw.rst | 10 ++- examples/ipsec-secgw/ipsec-secgw.c | 101 ++++++++++++++++++++++++++----- 2 files changed, 96 insertions(+), 15 deletions(-) diff --git a/doc/guides/sample_app_ug/ipsec_secgw.rst b/doc/guides/sample_app_ug/ipsec_secgw.rst index d6cfdbf..ae18acd 100644 --- a/doc/guides/sample_app_ug/ipsec_secgw.rst +++ b/doc/guides/sample_app_ug/ipsec_secgw.rst @@ -61,6 +61,12 @@ In case of complete protocol offload, the processing of headers(ESP and outer IP header) is done by the hardware and the application does not need to add/remove them during outbound/inbound processing. +For inline offloaded outbound traffic, the application will not do the LPM +lookup for routing, as the port on which the packet has to be forwarded will be +part of the SA. Security parameters will be configured on that port only, and +sending the packet on other ports could result in unencrypted packets being +sent out. + The Path for IPsec Inbound traffic is: * Read packets from the port. @@ -543,7 +549,9 @@ where each options means: ```` * Port/device ID of the ethernet/crypto accelerator for which the SA is - configured. This option is used when *type* is NOT *no-offload* + configured. For *inline-crypto-offload* and *inline-protocol-offload*, this + port will be used for routing. The routing table will not be referred in + this case. * Optional: No, if *type* is not *no-offload* diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec-secgw/ipsec-secgw.c index c98454a..2a406ab 100644 --- a/examples/ipsec-secgw/ipsec-secgw.c +++ b/examples/ipsec-secgw/ipsec-secgw.c @@ -585,31 +585,81 @@ process_pkts_outbound_nosp(struct ipsec_ctx *ipsec_ctx, traffic->ip6.num = nb_pkts_out; } +static inline int32_t +get_hop_for_offload_pkt(struct rte_mbuf *pkt, int is_ipv6) +{ + struct ipsec_mbuf_metadata *priv; + struct ipsec_sa *sa; + + priv = get_priv(pkt); + + sa = priv->sa; + if (unlikely(sa == NULL)) { + RTE_LOG(ERR, IPSEC, "SA not saved in private data\n"); + goto fail; + } + + if (is_ipv6) + return sa->portid; + + /* else */ + return (sa->portid | RTE_LPM_LOOKUP_SUCCESS); + +fail: + if (is_ipv6) + return -1; + + /* else */ + return 0; +} + static inline void route4_pkts(struct rt_ctx *rt_ctx, struct rte_mbuf *pkts[], uint8_t nb_pkts) { uint32_t hop[MAX_PKT_BURST * 2]; uint32_t dst_ip[MAX_PKT_BURST * 2]; + int32_t pkt_hop = 0; uint16_t i, offset; + uint16_t lpm_pkts = 0; if (nb_pkts == 0) return; + /* Need to do an LPM lookup for non-inline packets. Inline packets will + * have port ID in the SA + */ + for (i = 0; i < nb_pkts; i++) { - offset = offsetof(struct ip, ip_dst); - dst_ip[i] = *rte_pktmbuf_mtod_offset(pkts[i], - uint32_t *, offset); - dst_ip[i] = rte_be_to_cpu_32(dst_ip[i]); + if (!(pkts[i]->ol_flags & PKT_TX_SEC_OFFLOAD)) { + /* Security offload not enabled. So an LPM lookup is + * required to get the hop + */ + offset = offsetof(struct ip, ip_dst); + dst_ip[lpm_pkts] = *rte_pktmbuf_mtod_offset(pkts[i], + uint32_t *, offset); + dst_ip[lpm_pkts] = rte_be_to_cpu_32(dst_ip[lpm_pkts]); + lpm_pkts++; + } } - rte_lpm_lookup_bulk((struct rte_lpm *)rt_ctx, dst_ip, hop, nb_pkts); + rte_lpm_lookup_bulk((struct rte_lpm *)rt_ctx, dst_ip, hop, lpm_pkts); + + lpm_pkts = 0; for (i = 0; i < nb_pkts; i++) { - if ((hop[i] & RTE_LPM_LOOKUP_SUCCESS) == 0) { + if (pkts[i]->ol_flags & PKT_TX_SEC_OFFLOAD) { + /* Read hop from the SA */ + pkt_hop = get_hop_for_offload_pkt(pkts[i], 0); + } else { + /* Need to use hop returned by lookup */ + pkt_hop = hop[lpm_pkts++]; + } + + if ((pkt_hop & RTE_LPM_LOOKUP_SUCCESS) == 0) { rte_pktmbuf_free(pkts[i]); continue; } - send_single_packet(pkts[i], hop[i] & 0xff); + send_single_packet(pkts[i], pkt_hop & 0xff); } } @@ -619,26 +669,49 @@ route6_pkts(struct rt_ctx *rt_ctx, struct rte_mbuf *pkts[], uint8_t nb_pkts) int32_t hop[MAX_PKT_BURST * 2]; uint8_t dst_ip[MAX_PKT_BURST * 2][16]; uint8_t *ip6_dst; + int32_t pkt_hop = 0; uint16_t i, offset; + uint16_t lpm_pkts = 0; if (nb_pkts == 0) return; + /* Need to do an LPM lookup for non-inline packets. Inline packets will + * have port ID in the SA + */ + for (i = 0; i < nb_pkts; i++) { - offset = offsetof(struct ip6_hdr, ip6_dst); - ip6_dst = rte_pktmbuf_mtod_offset(pkts[i], uint8_t *, offset); - memcpy(&dst_ip[i][0], ip6_dst, 16); + if (!(pkts[i]->ol_flags & PKT_TX_SEC_OFFLOAD)) { + /* Security offload not enabled. So an LPM lookup is + * required to get the hop + */ + offset = offsetof(struct ip6_hdr, ip6_dst); + ip6_dst = rte_pktmbuf_mtod_offset(pkts[i], uint8_t *, + offset); + memcpy(&dst_ip[lpm_pkts][0], ip6_dst, 16); + lpm_pkts++; + } } - rte_lpm6_lookup_bulk_func((struct rte_lpm6 *)rt_ctx, dst_ip, - hop, nb_pkts); + rte_lpm6_lookup_bulk_func((struct rte_lpm6 *)rt_ctx, dst_ip, hop, + lpm_pkts); + + lpm_pkts = 0; for (i = 0; i < nb_pkts; i++) { - if (hop[i] == -1) { + if (pkts[i]->ol_flags & PKT_TX_SEC_OFFLOAD) { + /* Read hop from the SA */ + pkt_hop = get_hop_for_offload_pkt(pkts[i], 1); + } else { + /* Need to use hop returned by lookup */ + pkt_hop = hop[lpm_pkts++]; + } + + if (pkt_hop == -1) { rte_pktmbuf_free(pkts[i]); continue; } - send_single_packet(pkts[i], hop[i] & 0xff); + send_single_packet(pkts[i], pkt_hop & 0xff); } }