[dpdk-dev] [PATCH v5 0/5] ipsec: add inbound SAD

[Akhil Goyal]

> -----Original Message-----
> From: Vladimir Medvedkin <vladimir.medvedkin at intel.com>
> Sent: Thursday, October 10, 2019 10:19 PM
> To: dev at dpdk.org
> Cc: konstantin.ananyev at intel.com; bernard.iremonger at intel.com; Akhil Goyal
> <akhil.goyal at nxp.com>
> Subject: [PATCH v5 0/5] ipsec: add inbound SAD
> 
> According to RFC 4301 IPSec implementation needs an inbound SA database
> (SAD).
> For each incoming inbound IPSec-protected packet (ESP or AH) it has to
> perform a lookup within it’s SAD.
> Lookup should be performed by:
> Security Parameters Index (SPI) + destination IP (DIP) + source IP (SIP)
>   or SPI + DIP
>   or SPI only
> and an implementation has to return the “longest” existing match.
> These series extend DPDK IPsec library with SAD table implementation that:
> - conforms to the RFC requirements above
> - can scale up to millions of entries
> - supports fast lookups
> - supports incremental updates
> 
> Initial series provide an API to create/destroy SAD, and to
> add/delete/lookup entries within given SAD table.
> Under the hood it uses three librte_hash tables each of which contains
> an entries for a specific SA type (either it is addressed by SPI only
> or SPI+DIP or SPI+DIP+SIP) Also this patch series introduce test-sad
> application to measure performance of the library. According to our
> measurements on SKX for 1M entries average lookup cost is ~80 cycles,
> average add cost ~500 cycles.
> 
> Next Steps:
> - integration with ipsec-secgw
> - documentation

I believe documentation should be part of this patchset combined with the patches
which introduce that API.
Apart from that, 0ne comment is there on the lookup API return value.

Integration with IPSec Application can be done separately. No issues with that.
With this series, I think we don’t need the changes done in 
http://patches.dpdk.org/user/todo/dpdk/?series=6499
If it is agreed, I will move it as Rejected.

With Above changes - Series 
Acked-by: Akhil Goyal <akhil.goyal at nxp.com>

Please send these changes so that I can merge this series.



> 
> v5:
> - small fix in rte_ipsec_sad_create()
> - add comments in rte_ipsec_sad.h
> 
> v4:
> - fixes in test-sad app
> - small fixes in rte_ipsec_sad_create()
> - fixes in test_find_existing() from unittests
> 
> v3:
> - fixes in rte_ipsec_sad_create() and rte_ipsec_sad_find_existing()
> - fix typos
> - updated commit messages
> - added test_find_existing() in unittests
> 
> v2:
> - various bugs fixed
> - rte_ipsec_sad_free renamed to rte_ipsec_sad_destroy
> - added const qualifier to rte_ipsec_sad_key *key for add/delete
> - added more comments into the code
> - added ipv6 support into the testsad app
> - added <DEL> measurement into the testsad app
> - random SPI values are generated without dups
> - added support for configurable burst size in testsad app
> - added verbose mode into the testsad app
> 
> 
> Vladimir Medvedkin (5):
>   ipsec: add inbound SAD API
>   ipsec: add SAD create/destroy implementation
>   ipsec: add SAD add/delete/lookup implementation
>   test/ipsec: add ipsec SAD autotests
>   app: add test-sad application
> 
>  app/Makefile                           |   1 +
>  app/meson.build                        |   3 +-
>  app/test-sad/Makefile                  |  18 +
>  app/test-sad/main.c                    | 644 ++++++++++++++++++++++++
>  app/test-sad/meson.build               |   6 +
>  app/test/Makefile                      |   1 +
>  app/test/autotest_data.py              |   6 +
>  app/test/meson.build                   |   1 +
>  app/test/test_ipsec_sad.c              | 887
> +++++++++++++++++++++++++++++++++
>  lib/librte_ipsec/Makefile              |   4 +-
>  lib/librte_ipsec/ipsec_sad.c           | 515 +++++++++++++++++++
>  lib/librte_ipsec/meson.build           |   6 +-
>  lib/librte_ipsec/rte_ipsec_sad.h       | 176 +++++++
>  lib/librte_ipsec/rte_ipsec_version.map |   7 +
>  14 files changed, 2270 insertions(+), 5 deletions(-)
>  create mode 100644 app/test-sad/Makefile
>  create mode 100644 app/test-sad/main.c
>  create mode 100644 app/test-sad/meson.build
>  create mode 100644 app/test/test_ipsec_sad.c
>  create mode 100644 lib/librte_ipsec/ipsec_sad.c
>  create mode 100644 lib/librte_ipsec/rte_ipsec_sad.h
> 
> --
> 2.7.4