DPDK-dev Archive on lore.kernel.org
 help / color / Atom feed
From: Ori Kam <orika@mellanox.com>
To: Anoob Joseph <anoobj@marvell.com>,
	"Medvedkin, Vladimir" <vladimir.medvedkin@intel.com>,
	"Ananyev, Konstantin" <konstantin.ananyev@intel.com>,
	Akhil Goyal <akhil.goyal@nxp.com>,
	Adrien Mazarguil <adrien.mazarguil@6wind.com>,
	"Doherty, Declan" <declan.doherty@intel.com>,
	"Yigit, Ferruh" <ferruh.yigit@intel.com>,
	Jerin Jacob Kollanukkaran <jerinj@marvell.com>,
	Thomas Monjalon <thomas@monjalon.net>
Cc: Ankur Dwivedi <adwivedi@marvell.com>,
	Hemant Agrawal <hemant.agrawal@nxp.com>,
	Matan Azrad <matan@mellanox.com>,
	"Nicolau, Radu" <radu.nicolau@intel.com>,
	Shahaf Shuler <shahafs@mellanox.com>,
	Narayana Prasad Raju Athreya <pathreya@marvell.com>,
	"dev@dpdk.org" <dev@dpdk.org>
Subject: Re: [dpdk-dev] [EXT] Re: [PATCH] ethdev: allow multiple security sessions to use one rte flow
Date: Thu, 16 Jan 2020 13:37:39 +0000
Message-ID: <AM5PR0501MB2579B15FB8401BF57393B428DB360@AM5PR0501MB2579.eurprd05.prod.outlook.com> (raw)
In-Reply-To: <MN2PR18MB287731F4ABD614FC6B701F73DF360@MN2PR18MB2877.namprd18.prod.outlook.com>

Just one more question inline.

> -----Original Message-----
> From: dev <dev-bounces@dpdk.org> On Behalf Of Anoob Joseph
> Sent: Thursday, January 16, 2020 2:03 PM
> To: Ori Kam <orika@mellanox.com>; Medvedkin, Vladimir
> <vladimir.medvedkin@intel.com>; Ananyev, Konstantin
> <konstantin.ananyev@intel.com>; Akhil Goyal <akhil.goyal@nxp.com>;
> Adrien Mazarguil <adrien.mazarguil@6wind.com>; Doherty, Declan
> <declan.doherty@intel.com>; Yigit, Ferruh <ferruh.yigit@intel.com>; Jerin
> Jacob Kollanukkaran <jerinj@marvell.com>; Thomas Monjalon
> <thomas@monjalon.net>
> Cc: Ankur Dwivedi <adwivedi@marvell.com>; Hemant Agrawal
> <hemant.agrawal@nxp.com>; Matan Azrad <matan@mellanox.com>;
> Nicolau, Radu <radu.nicolau@intel.com>; Shahaf Shuler
> <shahafs@mellanox.com>; Narayana Prasad Raju Athreya
> <pathreya@marvell.com>; dev@dpdk.org
> Subject: Re: [dpdk-dev] [EXT] Re: [PATCH] ethdev: allow multiple security
> sessions to use one rte flow
> 
> Hi Ori,
> 
> Please see inline.
> 
> Thanks,
> Anoob
> 
> > -----Original Message-----
> > From: dev <dev-bounces@dpdk.org> On Behalf Of Ori Kam
> > Sent: Thursday, January 16, 2020 5:06 PM
> > To: Anoob Joseph <anoobj@marvell.com>; Medvedkin, Vladimir
> > <vladimir.medvedkin@intel.com>; Ananyev, Konstantin
> > <konstantin.ananyev@intel.com>; Akhil Goyal <akhil.goyal@nxp.com>;
> Adrien
> > Mazarguil <adrien.mazarguil@6wind.com>; Doherty, Declan
> > <declan.doherty@intel.com>; Yigit, Ferruh <ferruh.yigit@intel.com>; Jerin
> Jacob
> > Kollanukkaran <jerinj@marvell.com>; Thomas Monjalon
> > <thomas@monjalon.net>
> > Cc: Ankur Dwivedi <adwivedi@marvell.com>; Hemant Agrawal
> > <hemant.agrawal@nxp.com>; Matan Azrad <matan@mellanox.com>;
> Nicolau,
> > Radu <radu.nicolau@intel.com>; Shahaf Shuler <shahafs@mellanox.com>;
> > Narayana Prasad Raju Athreya <pathreya@marvell.com>; dev@dpdk.org
> > Subject: Re: [dpdk-dev] [EXT] Re: [PATCH] ethdev: allow multiple security
> > sessions to use one rte flow
> >
> >
> >
> > > -----Original Message-----
> > > From: dev <dev-bounces@dpdk.org> On Behalf Of Anoob Joseph
> > > Sent: Tuesday, January 14, 2020 11:28 AM
> > > To: Ori Kam <orika@mellanox.com>; Medvedkin, Vladimir
> > > <vladimir.medvedkin@intel.com>; Ananyev, Konstantin
> > > <konstantin.ananyev@intel.com>; Akhil Goyal <akhil.goyal@nxp.com>;
> > > Adrien Mazarguil <adrien.mazarguil@6wind.com>; Doherty, Declan
> > > <declan.doherty@intel.com>; Yigit, Ferruh <ferruh.yigit@intel.com>;
> > > Jerin Jacob Kollanukkaran <jerinj@marvell.com>; Thomas Monjalon
> > > <thomas@monjalon.net>
> > > Cc: Ankur Dwivedi <adwivedi@marvell.com>; Hemant Agrawal
> > > <hemant.agrawal@nxp.com>; Matan Azrad <matan@mellanox.com>;
> > Nicolau,
> > > Radu <radu.nicolau@intel.com>; Shahaf Shuler
> <shahafs@mellanox.com>;
> > > Narayana Prasad Raju Athreya <pathreya@marvell.com>; dev@dpdk.org
> > > Subject: Re: [dpdk-dev] [EXT] Re: [PATCH] ethdev: allow multiple
> > > security sessions to use one rte flow
> > >
> > > Hi Ori,
> > >
> > > Please see inline.
> > >
> > > Thanks,
> > > Anoob
> > >
> > > > -----Original Message-----
> > > > From: Ori Kam <orika@mellanox.com>
> > > > Sent: Thursday, January 9, 2020 1:06 PM
> > > > To: Medvedkin, Vladimir <vladimir.medvedkin@intel.com>; Ananyev,
> > > > Konstantin <konstantin.ananyev@intel.com>; Anoob Joseph
> > > > <anoobj@marvell.com>; Akhil Goyal <akhil.goyal@nxp.com>; Adrien
> > > > Mazarguil <adrien.mazarguil@6wind.com>; Doherty, Declan
> > > > <declan.doherty@intel.com>; Yigit, Ferruh <ferruh.yigit@intel.com>;
> > > > Jerin Jacob Kollanukkaran <jerinj@marvell.com>; Thomas Monjalon
> > > > <thomas@monjalon.net>
> > > > Cc: Ankur Dwivedi <adwivedi@marvell.com>; Hemant Agrawal
> > > > <hemant.agrawal@nxp.com>; Matan Azrad <matan@mellanox.com>;
> > Nicolau,
> > > > Radu <radu.nicolau@intel.com>; Shahaf Shuler
> <shahafs@mellanox.com>;
> > > > Narayana Prasad Raju Athreya <pathreya@marvell.com>;
> dev@dpdk.org
> > > > Subject: RE: [dpdk-dev] [EXT] Re: [PATCH] ethdev: allow multiple
> > > > security sessions to use one rte flow
> > > >
> > > > Hi
> > > > sorry for jumping in late.
> > > >
> > > >
> > > > > -----Original Message-----
> > > > > From: dev <dev-bounces@dpdk.org> On Behalf Of Medvedkin,
> Vladimir
> > > > > Sent: Wednesday, January 8, 2020 4:30 PM
> > > > > To: Ananyev, Konstantin <konstantin.ananyev@intel.com>; Anoob
> > > Joseph
> > > > > <anoobj@marvell.com>; Akhil Goyal <akhil.goyal@nxp.com>; Adrien
> > > > > Mazarguil <adrien.mazarguil@6wind.com>; Doherty, Declan
> > > > > <declan.doherty@intel.com>; Yigit, Ferruh
> > > > > <ferruh.yigit@intel.com>;
> > > Jerin
> > > > > Jacob Kollanukkaran <jerinj@marvell.com>; Thomas Monjalon
> > > > > <thomas@monjalon.net>
> > > > > Cc: Ankur Dwivedi <adwivedi@marvell.com>; Hemant Agrawal
> > > > > <hemant.agrawal@nxp.com>; Matan Azrad
> <matan@mellanox.com>;
> > > > > Nicolau, Radu <radu.nicolau@intel.com>; Shahaf Shuler
> > > > > <shahafs@mellanox.com>; Narayana Prasad Raju Athreya
> > > > > <pathreya@marvell.com>; dev@dpdk.org
> > > > > Subject: Re: [dpdk-dev] [EXT] Re: [PATCH] ethdev: allow multiple
> > > > > security sessions to use one rte flow
> > > > >
> > > > > Hi Anoob,
> > > > >
> > > > > On 23/12/2019 13:34, Ananyev, Konstantin wrote:
> > > > > >
> > > > > >>>>>>>>>>>>>> The rte_security API which enables inline
> > > > protocol/crypto
> > > > > >>>>>>>>>>>>>> feature mandates that for every security session
> an
> > > > > rte_flow
> > > > > >>>>>>>>>>>>>> is
> > > > > >>>>> created.
> > > > > >>>>>>>>>>>>>> This would internally translate to a rule in the
> > > hardware
> > > > > >>>>>>>>>>>>>> which would do packet classification.
> > > > > >>>>>>>>>>>>>>
> > > > > >>>>>>>>>>>>>> In rte_securty, one SA would be one security
> session.
> > > > And
> > > > > if
> > > > > >>>>>>>>>>>>>> an rte_flow need to be created for every session,
> > > > > >>>>>>>>>>>>>> the
> > > > > number
> > > > > >>>>>>>>>>>>>> of SAs supported by an inline implementation
> would
> > > be
> > > > > >>>>>>>>>>>>>> limited by the number of rte_flows the PMD
> would be
> > > > > able to
> > > > > >>> support.
> > > > > >>>>>>>>>>>>>> If the fields SPI & IP addresses are allowed to be
> > > > > >>>>>>>>>>>>>> a
> > > > range,
> > > > > >>>>>>>>>>>>>> then this limitation can be overcome. Multiple
> > > > > >>>>>>>>>>>>>> flows
> > > will
> > > > > be
> > > > > >>>>>>>>>>>>>> able to use one rule for SECURITY processing. In
> > > > > >>>>>>>>>>>>>> this
> > > > case,
> > > > > >>>>>>>>>>>>>> the security session provided as conf would be
> NULL.
> > > >
> > > > Why is that?
> > > > If the rte flow can have a range then this means that we need one
> > > > security_session for the entire range, Am I missing something? As it
> > > > is stated in the rte_fow.h  security_session
> > > can
> > > > be used for multiple flows.
> > >
> > > [Anoob] One SA would mean one security_session. So if we have one
> > > security_session for the entire range, then it will be like having
> > > single SA for a range of IP & SPI. Do you think we should allow that?
> > >
> > [Ori] I'm less familiar with security, but this is what I understand you are
> trying to
> > do right?
> 
> [Anoob] Not exactly. In our implementation, h/w can index into a table which
> would hold security_sessions. So we can have one rte_flow rule, which will
> enable the packet steering in the hardware. Which session need to be used
> will be determined by the SPI.
> 
> >
> > > Also, the intent of the patch is to minimize the number of rte_flow
> > > rules required for inline ipsec processing. Since the security session
> > > is per SA, and if we need multiple SPIs to use same rte_flow rule,
> > > then the security_session field in the rte_flow rule need to be NULL.
> > > Having a non-zero security_session when SPI is a range would be
> incorrect.
> > >
> > [Ori] I'm all in favor decreasing number of flows.
> > Sorry for the basic question, what is the security_session /SA dependent
> on?
> 
> [Anoob] No prob! In case of unicast IPsec, every SA would have a unique SPI.
> So we cannot have multiple SPI's referring to the same SA. And one SA would
> mean one security_session.
> 
> > Can one SA include number of different SPI?
> 
> [Anoob] No.
> 
> May be we need to reimagine this.
> 
> Currently, an rte_flow with SECURITY enables ipsec processing with a specific
> security_session on the packet. This is enabled on a specific IP/SPI specified
> in the rule.
> 
> My proposal: an rte_flow with SECURITY (and session = NULL), would enable
> ipsec processing on a range and SPI from the packet can be used by the h/w
> to further figure out the security_session.

O.K. so SPI can't be shared between SA (Security_session) while IP can right?
Other why to ask my question is what is allowed to be in range to allow the same 
security_session?

<Snip>

      reply index

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-12-08 10:41 [dpdk-dev] " Anoob Joseph
2019-12-09  7:37 ` Jerin Jacob
2019-12-10 20:47   ` Ori Kam
2019-12-09 13:18 ` Ananyev, Konstantin
2019-12-09 13:57   ` Anoob Joseph
2019-12-11 11:06     ` Ananyev, Konstantin
2019-12-11 17:33       ` Anoob Joseph
2019-12-13 11:55         ` Ananyev, Konstantin
2019-12-15  6:07           ` Anoob Joseph
2019-12-16 12:54             ` Ananyev, Konstantin
2019-12-16 15:37               ` Anoob Joseph
2019-12-16 15:58         ` Medvedkin, Vladimir
2019-12-16 16:16           ` [dpdk-dev] [EXT] " Anoob Joseph
2019-12-17 11:21             ` Medvedkin, Vladimir
2019-12-17 14:24               ` Anoob Joseph
2019-12-17 17:44                 ` Medvedkin, Vladimir
2019-12-18  3:54                   ` Anoob Joseph
2019-12-18 13:52                     ` Medvedkin, Vladimir
2019-12-19  4:37                       ` Anoob Joseph
2019-12-19 17:45                         ` Medvedkin, Vladimir
2019-12-23 13:34                         ` Ananyev, Konstantin
2020-01-08 14:29                           ` Medvedkin, Vladimir
2020-01-09  7:35                             ` Ori Kam
2020-01-14  9:27                               ` Anoob Joseph
2020-01-16 11:36                                 ` Ori Kam
2020-01-16 12:03                                   ` Anoob Joseph
2020-01-16 13:37                                     ` Ori Kam [this message]

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=AM5PR0501MB2579B15FB8401BF57393B428DB360@AM5PR0501MB2579.eurprd05.prod.outlook.com \
    --to=orika@mellanox.com \
    --cc=adrien.mazarguil@6wind.com \
    --cc=adwivedi@marvell.com \
    --cc=akhil.goyal@nxp.com \
    --cc=anoobj@marvell.com \
    --cc=declan.doherty@intel.com \
    --cc=dev@dpdk.org \
    --cc=ferruh.yigit@intel.com \
    --cc=hemant.agrawal@nxp.com \
    --cc=jerinj@marvell.com \
    --cc=konstantin.ananyev@intel.com \
    --cc=matan@mellanox.com \
    --cc=pathreya@marvell.com \
    --cc=radu.nicolau@intel.com \
    --cc=shahafs@mellanox.com \
    --cc=thomas@monjalon.net \
    --cc=vladimir.medvedkin@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

DPDK-dev Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/dpdk-dev/0 dpdk-dev/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 dpdk-dev dpdk-dev/ https://lore.kernel.org/dpdk-dev \
		dev@dpdk.org
	public-inbox-index dpdk-dev

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.dpdk.dev


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git