Changes in sp6.c

7be78d02 - fix spelling in comments and strings

Mon, 29 Nov 2021 16:08:02 +0000

fix spelling in comments and stringsThe tool comes from https://github.com/jsorefSigned-off-by: Josh Soref Signed-off-by: Thomas Monjalon List of files: /dpdk/examples/ipsec-secgw/sp6.c

b0806375 - examples/ipsec-secgw: get rid of maximum SP limitation

Fri, 31 Jan 2020 17:39:42 +0000

examples/ipsec-secgw: get rid of maximum SP limitationGet rid of maximum SP limitation.Keep parsed SP's into the sorted by SPI value array.Use binary search in the sorted SP array to find appropriate SPfor a given SPI.Signed-off-by: Vladimir Medvedkin Acked-by: Konstantin Ananyev Acked-by: Akhil Goyal Acked-by: Anoob Joseph List of files: /dpdk/examples/ipsec-secgw/sp6.c

df3e1d94 - examples/ipsec-secgw: integrate inbound SAD

Fri, 31 Jan 2020 17:39:40 +0000

examples/ipsec-secgw: integrate inbound SADIntegrate ipsec SAD support into secgw app:1. Use SAD library for inbound SA lookup2. Changes in struct sa_ctx: - sa array allocates dynamically depending on number of configured sa - All SA's are kept one by one without using SPI2IDX3. SP's userdata now contain index of SA in sa_ctx instead of SPI4. Get rid of SPI2IDX macroSigned-off-by: Vladimir Medvedkin Acked-by: Konstantin Ananyev Acked-by: Akhil Goyal Acked-by: Anoob Joseph List of files: /dpdk/examples/ipsec-secgw/sp6.c

b1a3ac78 - examples/ipsec-secgw: fix inline modes

Wed, 26 Jun 2019 13:26:17 +0000

examples/ipsec-secgw: fix inline modesApplication ipsec-secgw is not working for IPv4 transport mode and forIPv6 both transport and tunnel mode.IPv6 tunnel mode is not working due to wrongly assigned fields ofsecurity association patterns, as it was IPv4, during creation ofinline crypto session.IPv6 and IPv4 transport mode is iterating through security capabilitiesuntil it reaches tunnel, which causes session to be created as tunnel,instead of transport. Another issue, is that config file does notprovide source and destination ip addresses for transport mode, whichare required by NIC to perform inline crypto. It uses default addressesstored in security association (all zeroes), which causes droppedpackages.To fix that, reorganization of code in create_session() is needed,to behave appropriately to given protocol (IPv6/IPv4). Change initeration through security capabilities is also required, to checkfor expected mode (not only tunnel).For lack of addresses issue, some resolving mechanism is needed.Approach is to store addresses in security association, as it isfor tunnel mode. Difference is that they are obtained from sp rules,instead of config file. To do that, sp[4/6]_spi_present() functionis used to find addresses based on spi value, and then stored incorresponding sa rule. This approach assumes, that every sp rulefor inline crypto have valid addresses, as well as range of addressesis not supported.New flags for ipsec_sa structure are required to distinguish betweenIPv4 and IPv6 transport modes. Because of that, there is need tochange all checks done on these flags, so they work as expected.Fixes: ec17993a145a ("examples/ipsec-secgw: support security offload")Fixes: 9a0752f498d2 ("net/ixgbe: enable inline IPsec")Cc: stable@dpdk.orgSigned-off-by: Mariusz Drost Acked-by: Konstantin Ananyev Acked-by: Akhil Goyal Tested-by: Konstantin Ananyev List of files: /dpdk/examples/ipsec-secgw/sp6.c

49757b68 - examples/ipsec-secgw: fix SPD no-match case

Thu, 04 Apr 2019 12:13:26 +0000

examples/ipsec-secgw: fix SPD no-match caseacl_classify() returns zero value when no matching rule was found.Currently ipsec-secgw treats it as a valid SPI value, though it hasto discard such packets.Error could be easily observed by sending outbound unmatched packets,user will see something like that in the log:IPSEC: No cryptodev: core 7, cipher_algo 0, auth_algo 0, aead_algo 0To fix it we need to treat packets with zero result from acl_classify()as invalid ones. Also we can change DISCARD and BYPASS values tosimplify checks and save some extra space for valid SPI values.To summarize the approach:1. have special SPI values for DISCARD and BYPASS.2. store in SPD full SPI value.3. after acl_classify(), first check SPI value for DISCARD and BYPASS, then convert it in SA index.4. add check at initilisation time that for each SPD rule there is a corresponding SA entry (with the same SPI).Also marked few global variables as *static*.Fixes: 906257e965b7 ("examples/ipsec-secgw: support IPv6")Fixes: 2a5106af132b ("examples/ipsec-secgw: fix corner case for SPI value")Cc: stable@dpdk.orgSigned-off-by: Konstantin Ananyev Acked-by: Fan Zhang Acked-by: Akhil Goyal List of files: /dpdk/examples/ipsec-secgw/sp6.c

5a032a71 - examples/ipsec-secgw: make app to use IPsec library

Thu, 10 Jan 2019 21:09:10 +0000

examples/ipsec-secgw: make app to use IPsec libraryChanges to make ipsec-secgw to utilize librte_ipsec library.That patch provides: - changes in the related data structures. - changes in the initialization code. - new command-line parameters to enable librte_ipsec codepath and related features.Note that right now by default current (non-librte_ipsec) code-path willbe used. User has to run application with new command-line option ('-l')to enable new codepath.The main reason for that: - current librte_ipsec doesn't support all ipsec algorithms and features that the app does. - allow users to run both versions in parallel for some time to figure out any functional or performance degradation with the new code.It is planned to deprecate and remove non-librte_ipsec code pathin future releases.Signed-off-by: Mohammad Abdul Awal Signed-off-by: Bernard Iremonger Signed-off-by: Konstantin Ananyev Acked-by: Radu Nicolau Acked-by: Akhil Goyal List of files: /dpdk/examples/ipsec-secgw/sp6.c

d92fc70e - examples/ipsec-secgw: make local variables static

Thu, 10 Jan 2019 21:09:08 +0000

examples/ipsec-secgw: make local variables staticin sp4.c and sp6.c there are few globals that used only locally.Define them as static ones.Cc: stable@dpdk.orgSigned-off-by: Konstantin Ananyev Acked-by: Radu Nicolau Acked-by: Akhil Goyal List of files: /dpdk/examples/ipsec-secgw/sp6.c

3998e2a0 - examples: use SPDX tag for Intel copyright files

Tue, 19 Dec 2017 15:49:02 +0000

examples: use SPDX tag for Intel copyright filesReplace the BSD license header with the SPDX tag for fileswith only an Intel copyright on them.Signed-off-by: Bruce Richardson List of files: /dpdk/examples/ipsec-secgw/sp6.c

0d547ed0 - examples/ipsec-secgw: support configuration file

Wed, 21 Sep 2016 12:05:18 +0000

examples/ipsec-secgw: support configuration fileThis patch adds the configuration file support to ipsec_secgwsample application. Instead of hard-coded rules, the users canspecify their own SP, SA, and routing rules in the configurationfile. A command line option "-f" is added to pass theconfiguration file location to the application.Configuration item formats:SP rule format:sp esp \ SA rule format:sa \ Routing rule format:rt Signed-off-by: Fan Zhang Acked-by: Sergio Gonzalez Monroy List of files: /dpdk/examples/ipsec-secgw/sp6.c

f159e70b - examples/ipsec-secgw: support transport mode

Thu, 09 Jun 2016 08:42:49 +0000

examples/ipsec-secgw: support transport modeIPSec transport mode support.Signed-off-by: Sergio Gonzalez Monroy Acked-by: Pablo de Lara List of files: /dpdk/examples/ipsec-secgw/sp6.c

906257e9 - examples/ipsec-secgw: support IPv6

Thu, 09 Jun 2016 08:42:48 +0000

examples/ipsec-secgw: support IPv6Support IPSec IPv6 allowing IPv4/IPv6 traffic in IPv4 or IPv6 tunnel.We need separate Routing (LPM) and SP (ACL) tables for IPv4 and IPv6,but a common SA table.Signed-off-by: Sergio Gonzalez Monroy Acked-by: Pablo de Lara List of files: /dpdk/examples/ipsec-secgw/sp6.c