From: "Nicolau, Radu" <radu.nicolau@intel.com>
To: "Drost, MariuszX" <mariuszx.drost@intel.com>,
"akhil.goyal@nxp.com" <akhil.goyal@nxp.com>,
"Ananyev, Konstantin" <konstantin.ananyev@intel.com>
Cc: "dev@dpdk.org" <dev@dpdk.org>, Lukasz Bartosik <lbartosik@marvell.com>
Subject: Re: [dpdk-dev] [PATCH v2 1/2] examples/ipsec-secgw: fix SAD selection logic
Date: Wed, 2 Oct 2019 16:43:30 +0100 [thread overview]
Message-ID: <d19e69b0-282a-082f-71b6-d3ffdeb15e7a@intel.com> (raw)
In-Reply-To: <20190924103539.12052-2-mariuszx.drost@intel.com>
On 9/24/2019 11:35 AM, Drost, MariuszX wrote:
> Ipsec-secgw example application fails to initialize when using default
> configuration file (ep0.cfg) in library mode (librte_ipsec enabled).
>
> The reason is that two of SP rules in ep0.cfg, one for IPv4 and one
> for IPv6, are using the same SPI number. When SA rules are initialized,
> their SPI number is checked against SPIs stored in SPD. For library
> mode, it is not allowed for the same SA to handle both IPv4 and IPv6.
>
> Solution is to split SAD into two separate parts - one for IPv4 and one
> for IPv6. Usage of SAs stays the same. Only change is to pass correct
> SAD (IPv4 or IPv6) in places where previously combined database was
> passed.
>
> Split of SA entries is done at initialization stage. Most of given SA
> entries are checked against SPD. If matching entry is in IPv4 SPD, SA
> rule is added to IPv4 SAD (respectively for IPv6). Different splitting
> method is used only when SA entry is for tunnel in inbound direction.
> In that case if IPv4 tunnel should be used, SA entry is added to IPv4
> SAD (respectively for IPv6). Reasoning is that inner IP version can
> be different than outer IP version for tunneled traffic.
>
> Bugzilla ID: 239
> Fixes: 5a032a71c6d3 ("examples/ipsec-secgw: make app to use IPsec library")
>
> Reported-by: Lukasz Bartosik <lbartosik@marvell.com>
> Signed-off-by: Mariusz Drost <mariuszx.drost@intel.com>
> ---
Acked-by: Radu Nicolau <radu.nicolau@intel.com>
next prev parent reply other threads:[~2019-10-02 15:43 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-05 12:35 [dpdk-dev] [PATCH 0/2] fix SAD selection logic Mariusz Drost
2019-09-05 12:35 ` [dpdk-dev] [PATCH 1/2] examples/ipsec-secgw: " Mariusz Drost
2019-09-05 12:35 ` [dpdk-dev] [PATCH 2/2] examples/ipsec-secgw: tests for split SAD Mariusz Drost
2019-09-24 10:35 ` [dpdk-dev] [PATCH v2 0/2] fix SAD selection logic Mariusz Drost
2019-09-24 10:35 ` [dpdk-dev] [PATCH v2 1/2] examples/ipsec-secgw: " Mariusz Drost
2019-09-24 12:18 ` Ananyev, Konstantin
2019-10-02 15:43 ` Nicolau, Radu [this message]
2019-10-10 13:43 ` Akhil Goyal
2019-10-11 13:24 ` Ananyev, Konstantin
2019-10-11 14:02 ` Akhil Goyal
2019-10-11 16:38 ` Ananyev, Konstantin
2019-10-15 13:53 ` Akhil Goyal
2019-10-16 10:20 ` Ananyev, Konstantin
2019-09-24 10:35 ` [dpdk-dev] [PATCH v2 2/2] examples/ipsec-secgw: tests for split SAD Mariusz Drost
2019-09-24 12:47 ` Ananyev, Konstantin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d19e69b0-282a-082f-71b6-d3ffdeb15e7a@intel.com \
--to=radu.nicolau@intel.com \
--cc=akhil.goyal@nxp.com \
--cc=dev@dpdk.org \
--cc=konstantin.ananyev@intel.com \
--cc=lbartosik@marvell.com \
--cc=mariuszx.drost@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).