[dpdk-dev] [PATCH v1 0/5] ipsec: add inbound SAD
Vladimir Medvedkin
vladimir.medvedkin at intel.com
Tue Sep 3 18:55:27 CEST 2019
According to RFC 4301 IPSec implementation needs an inbound SA database (SAD).
For each incoming inbound IPSec-protected packet (ESP or AH) it has to
perform a lookup within it’s SAD.
Lookup should be performed by:
Security Parameters Index (SPI) + destination IP (DIP) + source IP (SIP)
or SPI + DIP
or SPI only
and an implementation has to return the “longest” existing match.
These series extend DPDK IPsec library with SAD table implementation that:
- conforms to the RFC requirements above
- can scale up to millions of entries
- supports fast lookups
- supports incremental updates
Initial series provide an API to create/destroy SAD, and to
add/delete/lookup entries within given SAD table.
Under the hood it uses three librte_hash tables each of which contains
an entries for a specific SA type (either it is addressed by SPI only
or SPI+DIP or SPI+DIP+SIP) Also this patch series introduce test-sad
application to measure performance of the library. According to our
measurements on SKX for 1M entries average lookup cost is ~80 cycles,
average add cost ~500 cycles.
Next Steps:
- integration with ipsec-secgw
Vladimir Medvedkin (5):
ipsec: add inbound SAD API
ipsec: add SAD create/free API
ipsec: add SAD add/delete/lookup implementation
test/ipsec: add ipsec SAD autotests
app: add test-sad application
app/Makefile | 1 +
app/meson.build | 3 +-
app/test-sad/Makefile | 18 +
app/test-sad/main.c | 420 ++++++++++++++++
app/test-sad/meson.build | 6 +
app/test/Makefile | 1 +
app/test/autotest_data.py | 6 +
app/test/meson.build | 1 +
app/test/test_ipsec_sad.c | 874 +++++++++++++++++++++++++++++++++
lib/librte_ipsec/Makefile | 4 +-
lib/librte_ipsec/ipsec_sad.c | 478 ++++++++++++++++++
lib/librte_ipsec/meson.build | 6 +-
lib/librte_ipsec/rte_ipsec_sad.h | 174 +++++++
lib/librte_ipsec/rte_ipsec_version.map | 7 +
14 files changed, 1994 insertions(+), 5 deletions(-)
create mode 100644 app/test-sad/Makefile
create mode 100644 app/test-sad/main.c
create mode 100644 app/test-sad/meson.build
create mode 100644 app/test/test_ipsec_sad.c
create mode 100644 lib/librte_ipsec/ipsec_sad.c
create mode 100644 lib/librte_ipsec/rte_ipsec_sad.h
--
2.7.4
More information about the dev
mailing list