aboutsummaryrefslogtreecommitdiffstats
path: root/src/vnet/ipsec/ipsec_format.c
diff options
context:
space:
mode:
authorNeale Ranns <nranns@cisco.com>2019-04-02 08:13:33 +0000
committerDamjan Marion <dmarion@me.com>2019-12-17 17:57:24 +0000
commitf62a8c013c6e22c012b9d7df2ef463a6370cf1ce (patch)
tree0448d4b53340b84e1a8aca87ec57133c503026da /src/vnet/ipsec/ipsec_format.c
parentf2bde7ac51123a0a46334b4ec55e2aceae031db7 (diff)
ipsec: bind an SA to a worker
the sequence number increment and the anti-replay window checks must be atomic. Given the vector nature of VPP we can't simply use atomic increments for sequence numbers, since a vector on thread 1 with lower sequence numbers could be 'overtaken' by packets on thread 2 with higher sequence numbers. The anti-replay logic requires a critical section, not just atomics, and we don't want that. So when the SA see the first packet it is bound to that worker all subsequent packets, that arrive on a different worker, are subject to a handoff. Type: feature Change-Id: Ia20a8645fb50622ea6235ab015a537f033d531a4 Signed-off-by: Neale Ranns <nranns@cisco.com>
Diffstat (limited to 'src/vnet/ipsec/ipsec_format.c')
-rw-r--r--src/vnet/ipsec/ipsec_format.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c
index e6e828931dd..8b9d8c40be1 100644
--- a/src/vnet/ipsec/ipsec_format.c
+++ b/src/vnet/ipsec/ipsec_format.c
@@ -292,6 +292,8 @@ format_ipsec_sa (u8 * s, va_list * args)
s = format (s, "\n locks %d", sa->node.fn_locks);
s = format (s, "\n salt 0x%x", clib_net_to_host_u32 (sa->salt));
+ s = format (s, "\n thread-indices [encrypt:%d decrypt:%d]",
+ sa->encrypt_thread_index, sa->decrypt_thread_index);
s = format (s, "\n seq %u seq-hi %u", sa->seq, sa->seq_hi);
s = format (s, "\n last-seq %u last-seq-hi %u window %U",
sa->last_seq, sa->last_seq_hi,