diff options
| author |   Neale Ranns <nranns@cisco.com> | 2019-04-02 08:13:33 +0000 |
|---|---|---|
| committer |   Damjan Marion <dmarion@me.com> | 2019-12-17 17:57:24 +0000 |
| commit | f62a8c013c6e22c012b9d7df2ef463a6370cf1ce (patch) | |
| tree | 0448d4b53340b84e1a8aca87ec57133c503026da /src/vnet/ipsec/ipsec.h | |
| parent | f2bde7ac51123a0a46334b4ec55e2aceae031db7 (diff) | |
ipsec: bind an SA to a worker
the sequence number increment and the anti-replay window
checks must be atomic. Given the vector nature of VPP we
can't simply use atomic increments for sequence numbers,
since a vector on thread 1 with lower sequence numbers could
be 'overtaken' by packets on thread 2 with higher sequence
numbers.
The anti-replay logic requires a critical section, not just
atomics, and we don't want that.
So when the SA see the first packet it is bound to that worker
all subsequent packets, that arrive on a different worker,
are subject to a handoff.
Type: feature
Change-Id: Ia20a8645fb50622ea6235ab015a537f033d531a4
Signed-off-by: Neale Ranns <nranns@cisco.com>
Diffstat (limited to 'src/vnet/ipsec/ipsec.h')
| -rw-r--r-- | src/vnet/ipsec/ipsec.h | 27 |
1 files changed, 23 insertions, 4 deletions
diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h index 975ebc63a48..af758418322 100644 --- a/src/vnet/ipsec/ipsec.h +++ b/src/vnet/ipsec/ipsec.h @@ -163,6 +163,21 @@ typedef struct /* per-thread data */ ipsec_per_thread_data_t *ptd; + + /** Worker handoff */ + u32 ah4_enc_fq_index; + u32 ah4_dec_fq_index; + u32 ah6_enc_fq_index; + u32 ah6_dec_fq_index; + + u32 esp4_enc_fq_index; + u32 esp4_dec_fq_index; + u32 esp6_enc_fq_index; + u32 esp6_dec_fq_index; + u32 esp4_enc_tun_fq_index; + u32 esp6_enc_tun_fq_index; + u32 esp4_dec_tun_fq_index; + u32 esp6_dec_tun_fq_index; } ipsec_main_t; typedef enum ipsec_format_flags_t_ @@ -179,14 +194,18 @@ clib_error_t *ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index, clib_error_t *ipsec_check_support_cb (ipsec_main_t * im, ipsec_sa_t * sa); -extern vlib_node_registration_t esp4_encrypt_node; -extern vlib_node_registration_t esp4_decrypt_node; extern vlib_node_registration_t ah4_encrypt_node; extern vlib_node_registration_t ah4_decrypt_node; -extern vlib_node_registration_t esp6_encrypt_node; -extern vlib_node_registration_t esp6_decrypt_node; extern vlib_node_registration_t ah6_encrypt_node; extern vlib_node_registration_t ah6_decrypt_node; +extern vlib_node_registration_t esp4_encrypt_node; +extern vlib_node_registration_t esp4_decrypt_node; +extern vlib_node_registration_t esp6_encrypt_node; +extern vlib_node_registration_t esp6_decrypt_node; +extern vlib_node_registration_t esp4_encrypt_tun_node; +extern vlib_node_registration_t esp6_encrypt_tun_node; +extern vlib_node_registration_t esp4_decrypt_tun_node; +extern vlib_node_registration_t esp6_decrypt_tun_node; extern vlib_node_registration_t ipsec4_if_input_node; extern vlib_node_registration_t ipsec6_if_input_node; |