ipsec: introduce spd fast path types - vpp

diff options

author	Piotr Bronowski <piotrx.bronowski@intel.com>	2022-05-10 09:08:47 +0000
committer	Fan Zhang <roy.fan.zhang@intel.com>	2022-06-28 15:04:08 +0000
commit	d699a347c02c1b0c3825b7a97800cf6a467abea7 (patch)
tree	b5b57bd6fd05a5585392c6fc27283e86b82ebab7 /MAINTAINERS
parent	815c6a4fbcbb636ce3b4dc98446ad205a30670a6 (diff)

ipsec: introduce spd fast path types

This patch introdcues basic types supporting fast path lookup. Fast path performs policy matching with use of hash lookup (particularly bihash tries has been used for that purpose). Fast path lookup addresses situation where huge number of policies is created (~100k or more). In such scenario adding/removing a policy and policy matching is not efficient and poorly scales (for example adding 500k policies takes a few hours. Also lookup time increases significantly). With fast path adding and matching up to 1M flows scales up linearly (adding 1M of policies takes about 150s on the test machine vs many hours in case of original implementation, also matching time is significantly improved). Fast path will not deal well with a huge number of policies that are spanning large ip/port ranges. Large range will be masked out almost entirely leaving only a few bits for calculating the hash key. Such keys will tend to gather much more policies than other keys and hash will match most of the packets anihilating advantages of hashing. Having said that we also think that it is not the real life scenario. Type: feature Signed-off-by: Piotr Bronowski <piotrx.bronowski@intel.com> Change-Id: I600dae5111a37768ed4b23aa18426e66bbf7b529

Diffstat (limited to 'MAINTAINERS')

0 files changed, 0 insertions, 0 deletions

/* * Copyright (c) 2018 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #ifndef __GBP_INTERFACE_H__ #define __GBP_INTERFACE_H__ #include <vnet/l2/l2_input.h> #include <vnet/l2/l2_output.h> #define foreach_gdb_l3_feature \ _(LEARN_IP4, "gbp-learn-ip4", "ip4-unicast") \ _(LEARN_IP6, "gbp-learn-ip6", "ip6-unicast") typedef enum gbp_itf_l3_feat_pos_t_ { #define _(s,v,a) GBP_ITF_L3_FEAT_POS_##s, foreach_gdb_l3_feature #undef _ } gbp_itf_l3_feat_pos_t; typedef enum gbp_itf_l3_feat_t_ { GBP_ITF_L3_FEAT_NONE, #define _(s,v,a) GBP_ITF_L3_FEAT_##s = (1 << GBP_ITF_L3_FEAT_POS_##s), foreach_gdb_l3_feature #undef _ } gbp_itf_l3_feat_t; #define GBP_ITF_L3_FEAT_LEARN (GBP_ITF_L3_FEAT_LEARN_IP4|GBP_ITF_L3_FEAT_LEARN_IP6) typedef struct gbp_itf_hdl_t_ { union { struct { u32 gh_who; u32 gh_which; }; }; } gbp_itf_hdl_t; #define GBP_ITF_HDL_INIT {.gh_which = ~0} const static gbp_itf_hdl_t GBP_ITF_HDL_INVALID = GBP_ITF_HDL_INIT; extern void gbp_itf_hdl_reset (gbp_itf_hdl_t * gh); extern bool gbp_itf_hdl_is_valid (gbp_itf_hdl_t gh); typedef void (*gbp_itf_free_fn_t) (u32 sw_if_index); extern gbp_itf_hdl_t gbp_itf_l2_add_and_lock (u32 sw_if_index, u32 bd_index); extern gbp_itf_hdl_t gbp_itf_l3_add_and_lock (u32 sw_if_index, index_t gri); extern gbp_itf_hdl_t gbp_itf_l2_add_and_lock_w_free (u32 sw_if_index, u32 bd_index, gbp_itf_free_fn_t ff); extern gbp_itf_hdl_t gbp_itf_l3_add_and_lock_w_free (u32 sw_if_index, index_t gri, gbp_itf_free_fn_t ff); extern void gbp_itf_unlock (gbp_itf_hdl_t * hdl); extern void gbp_itf_lock (gbp_itf_hdl_t hdl); extern gbp_itf_hdl_t gbp_itf_clone_and_lock (gbp_itf_hdl_t hdl); extern u32 gbp_itf_get_sw_if_index (gbp_itf_hdl_t hdl); extern void gbp_itf_l2_set_input_feature (gbp_itf_hdl_t hdl, l2input_feat_masks_t feats); extern void gbp_itf_l2_set_output_feature (gbp_itf_hdl_t hdl, l2output_feat_masks_t feats); extern void gbp_itf_l3_set_input_feature (gbp_itf_hdl_t hdl, gbp_itf_l3_feat_t feats); extern u8 *format_gbp_itf_hdl (u8 * s, va_list * args); #endif /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */


context:
space:
mode: