From f62a8c013c6e22c012b9d7df2ef463a6370cf1ce Mon Sep 17 00:00:00 2001 From: Neale Ranns Date: Tue, 2 Apr 2019 08:13:33 +0000 Subject: ipsec: bind an SA to a worker the sequence number increment and the anti-replay window checks must be atomic. Given the vector nature of VPP we can't simply use atomic increments for sequence numbers, since a vector on thread 1 with lower sequence numbers could be 'overtaken' by packets on thread 2 with higher sequence numbers. The anti-replay logic requires a critical section, not just atomics, and we don't want that. So when the SA see the first packet it is bound to that worker all subsequent packets, that arrive on a different worker, are subject to a handoff. Type: feature Change-Id: Ia20a8645fb50622ea6235ab015a537f033d531a4 Signed-off-by: Neale Ranns --- src/vnet/ipsec/ah_encrypt.c | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) (limited to 'src/vnet/ipsec/ah_encrypt.c') diff --git a/src/vnet/ipsec/ah_encrypt.c b/src/vnet/ipsec/ah_encrypt.c index 75294a23102..80b3fcca6ea 100644 --- a/src/vnet/ipsec/ah_encrypt.c +++ b/src/vnet/ipsec/ah_encrypt.c @@ -24,9 +24,8 @@ #include #define foreach_ah_encrypt_next \ - _ (DROP, "error-drop") \ - _ (IP4_LOOKUP, "ip4-lookup") \ - _ (IP6_LOOKUP, "ip6-lookup") \ + _ (DROP, "error-drop") \ + _ (HANDOFF, "handoff") \ _ (INTERFACE_OUTPUT, "interface-output") @@ -183,6 +182,21 @@ ah_encrypt_inline (vlib_main_t * vm, pd->sa_index = current_sa_index; next[0] = AH_ENCRYPT_NEXT_DROP; + if (PREDICT_FALSE (~0 == sa0->encrypt_thread_index)) + { + /* this is the first packet to use this SA, claim the SA + * for this thread. this could happen simultaneously on + * another thread */ + clib_atomic_cmp_and_swap (&sa0->encrypt_thread_index, ~0, + ipsec_sa_assign_thread (thread_index)); + } + + if (PREDICT_TRUE (thread_index != sa0->encrypt_thread_index)) + { + next[0] = AH_ENCRYPT_NEXT_HANDOFF; + goto next; + } + if (PREDICT_FALSE (esp_seq_advance (sa0))) { b[0]->error = node->errors[AH_ENCRYPT_ERROR_SEQ_CYCLED]; @@ -420,9 +434,9 @@ VLIB_REGISTER_NODE (ah4_encrypt_node) = { .n_next_nodes = AH_ENCRYPT_N_NEXT, .next_nodes = { -#define _(s,n) [AH_ENCRYPT_NEXT_##s] = n, - foreach_ah_encrypt_next -#undef _ + [AH_ENCRYPT_NEXT_DROP] = "ip4-drop", + [AH_ENCRYPT_NEXT_HANDOFF] = "ah4-encrypt-handoff", + [AH_ENCRYPT_NEXT_INTERFACE_OUTPUT] = "interface-output", }, }; /* *INDENT-ON* */ @@ -446,9 +460,9 @@ VLIB_REGISTER_NODE (ah6_encrypt_node) = { .n_next_nodes = AH_ENCRYPT_N_NEXT, .next_nodes = { -#define _(s,n) [AH_ENCRYPT_NEXT_##s] = n, - foreach_ah_encrypt_next -#undef _ + [AH_ENCRYPT_NEXT_DROP] = "ip6-drop", + [AH_ENCRYPT_NEXT_HANDOFF] = "ah6-encrypt-handoff", + [AH_ENCRYPT_NEXT_INTERFACE_OUTPUT] = "interface-output", }, }; /* *INDENT-ON* */ -- cgit 1.2.3-korg