From f62a8c013c6e22c012b9d7df2ef463a6370cf1ce Mon Sep 17 00:00:00 2001 From: Neale Ranns Date: Tue, 2 Apr 2019 08:13:33 +0000 Subject: ipsec: bind an SA to a worker the sequence number increment and the anti-replay window checks must be atomic. Given the vector nature of VPP we can't simply use atomic increments for sequence numbers, since a vector on thread 1 with lower sequence numbers could be 'overtaken' by packets on thread 2 with higher sequence numbers. The anti-replay logic requires a critical section, not just atomics, and we don't want that. So when the SA see the first packet it is bound to that worker all subsequent packets, that arrive on a different worker, are subject to a handoff. Type: feature Change-Id: Ia20a8645fb50622ea6235ab015a537f033d531a4 Signed-off-by: Neale Ranns --- src/vnet/ipsec/ipsec.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) (limited to 'src/vnet/ipsec/ipsec.c') diff --git a/src/vnet/ipsec/ipsec.c b/src/vnet/ipsec/ipsec.c index c54b94a4799..0f4f2820349 100644 --- a/src/vnet/ipsec/ipsec.c +++ b/src/vnet/ipsec/ipsec.c @@ -405,6 +405,32 @@ ipsec_init (vlib_main_t * vm) vec_validate_aligned (im->ptd, vlib_num_workers (), CLIB_CACHE_LINE_BYTES); + im->ah4_enc_fq_index = + vlib_frame_queue_main_init (ah4_encrypt_node.index, 0); + im->ah4_dec_fq_index = + vlib_frame_queue_main_init (ah4_decrypt_node.index, 0); + im->ah6_enc_fq_index = + vlib_frame_queue_main_init (ah6_encrypt_node.index, 0); + im->ah6_dec_fq_index = + vlib_frame_queue_main_init (ah6_decrypt_node.index, 0); + + im->esp4_enc_fq_index = + vlib_frame_queue_main_init (esp4_encrypt_node.index, 0); + im->esp4_dec_fq_index = + vlib_frame_queue_main_init (esp4_decrypt_node.index, 0); + im->esp6_enc_fq_index = + vlib_frame_queue_main_init (esp6_encrypt_node.index, 0); + im->esp6_dec_fq_index = + vlib_frame_queue_main_init (esp6_decrypt_node.index, 0); + im->esp4_enc_tun_fq_index = + vlib_frame_queue_main_init (esp4_encrypt_tun_node.index, 0); + im->esp6_enc_tun_fq_index = + vlib_frame_queue_main_init (esp6_encrypt_tun_node.index, 0); + im->esp4_dec_tun_fq_index = + vlib_frame_queue_main_init (esp4_decrypt_tun_node.index, 0); + im->esp6_dec_tun_fq_index = + vlib_frame_queue_main_init (esp6_decrypt_tun_node.index, 0); + return 0; } -- cgit 1.2.3-korg