[dpdk-dev] [PATCH v2 1/2] examples/ipsec-secgw: fix SAD selection logic

[Akhil Goyal]

Hi Mariusz,


> -----Original Message-----
> From: Mariusz Drost <mariuszx.drost at intel.com>
> Sent: Tuesday, September 24, 2019 4:06 PM
> To: radu.nicolau at intel.com; Akhil Goyal <akhil.goyal at nxp.com>;
> konstantin.ananyev at intel.com
> Cc: dev at dpdk.org; Mariusz Drost <mariuszx.drost at intel.com>; Lukasz Bartosik
> <lbartosik at marvell.com>
> Subject: [PATCH v2 1/2] examples/ipsec-secgw: fix SAD selection logic
> 
> Ipsec-secgw example application fails to initialize when using default
> configuration file (ep0.cfg) in library mode (librte_ipsec enabled).
> 
> The reason is that two of SP rules in ep0.cfg, one for IPv4 and one
> for IPv6, are using the same SPI number. When SA rules are initialized,
> their SPI number is checked against SPIs stored in SPD. For library
> mode, it is not allowed for the same SA to handle both IPv4 and IPv6.
> 
> Solution is to split SAD into two separate parts - one for IPv4 and one
> for IPv6. Usage of SAs stays the same. Only change is to pass correct
> SAD (IPv4 or IPv6) in places where previously combined database was
> passed.

Can we have 2 different SAs with same SPI value and with different IPv4 addresses?

Will the IPSec library be able to handle this case. With Setkey it is possible in linux.
Now that we have IPSEC library we should be compatible with what linux can do.

So splitting the SADB with IPv4 and IPv6 will just avoid the issue for IPv4 and IPv6 but the
Issue will still be there. I believe this should be fixed in library rather than application maintaining
Two different databases. Library's intent is to reduce the application overhead for maintaining
IPSec specific stuff.

> 
> Split of SA entries is done at initialization stage. Most of given SA
> entries are checked against SPD. If matching entry is in IPv4 SPD, SA
> rule is added to IPv4 SAD (respectively for IPv6). Different splitting
> method is used only when SA entry is for tunnel in inbound direction.
> In that case if IPv4 tunnel should be used, SA entry is added to IPv4
> SAD (respectively for IPv6). Reasoning is that inner IP version can
> be different than outer IP version for tunneled traffic.
> 
> Bugzilla ID: 239
> Fixes: 5a032a71c6d3 ("examples/ipsec-secgw: make app to use IPsec library")
> 
> Reported-by: Lukasz Bartosik <lbartosik at marvell.com>
> Signed-off-by: Mariusz Drost <mariuszx.drost at intel.com>
> ---
>  examples/ipsec-secgw/ipsec-secgw.c |  48 ++--
>  examples/ipsec-secgw/ipsec.c       |   5 +-
>  examples/ipsec-secgw/ipsec.h       |  21 +-
>  examples/ipsec-secgw/sa.c          | 396 ++++++++++++++++++++---------
>  4 files changed, 312 insertions(+), 158 deletions(-)
>