From f62a8c013c6e22c012b9d7df2ef463a6370cf1ce Mon Sep 17 00:00:00 2001 From: Neale Ranns Date: Tue, 2 Apr 2019 08:13:33 +0000 Subject: ipsec: bind an SA to a worker the sequence number increment and the anti-replay window checks must be atomic. Given the vector nature of VPP we can't simply use atomic increments for sequence numbers, since a vector on thread 1 with lower sequence numbers could be 'overtaken' by packets on thread 2 with higher sequence numbers. The anti-replay logic requires a critical section, not just atomics, and we don't want that. So when the SA see the first packet it is bound to that worker all subsequent packets, that arrive on a different worker, are subject to a handoff. Type: feature Change-Id: Ia20a8645fb50622ea6235ab015a537f033d531a4 Signed-off-by: Neale Ranns --- src/vnet/ipsec/ipsec_sa.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'src/vnet/ipsec/ipsec_sa.h') diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h index 79971538646..e0d74e1309e 100644 --- a/src/vnet/ipsec/ipsec_sa.h +++ b/src/vnet/ipsec/ipsec_sa.h @@ -114,6 +114,8 @@ typedef struct u8 crypto_iv_size; u8 crypto_block_size; u8 integ_icv_size; + u32 encrypt_thread_index; + u32 decrypt_thread_index; u32 spi; u32 seq; u32 seq_hi; @@ -436,6 +438,18 @@ ipsec_sa_anti_replay_advance (ipsec_sa_t * sa, u32 seq) } } + +/* + * Makes choice for thread_id should be assigned. + * if input ~0, gets random worker_id based on unix_time_now_nsec +*/ +always_inline u32 +ipsec_sa_assign_thread (u32 thread_id) +{ + return ((thread_id) ? thread_id + : (unix_time_now_nsec () % vlib_num_workers ()) + 1); +} + #endif /* __IPSEC_SPD_SA_H__ */ /* -- cgit 1.2.3-korg