From 3adce7927ae93c4b639654d846e5ffcfba5046d5 Mon Sep 17 00:00:00 2001 From: Dmitry Eremin-Solenikov Date: Wed, 27 Sep 2017 00:36:01 +0300 Subject: [PATCH 1/3] api: ipsec: rework ODP_IPSEC_SA_DISABLE into packet error According to the discussion on mailing list, most of implementations will not be able to support odp_ipsec_sa_disable() status event directly. Instead they will submit a dummy packet to that SA. Then after receiving this packet after odp_ipsec_result() will detect this packet and will report it as a packet with odp_ipsec_error_t->sa_disabled bit set. Signed-off-by: Dmitry Eremin-Solenikov Cc: Nikhil Agarwal Cc: Balasubramanian Manoharan --- include/odp/api/spec/ipsec.h | 44 ++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 24 deletions(-) diff --git a/include/odp/api/spec/ipsec.h b/include/odp/api/spec/ipsec.h index 26e852fca1d..b9ad282ced8 100644 --- a/include/odp/api/spec/ipsec.h +++ b/include/odp/api/spec/ipsec.h @@ -843,10 +843,12 @@ odp_ipsec_sa_t odp_ipsec_sa_create(const odp_ipsec_sa_param_t *param); * * When in synchronous operation mode, the call will return when it's possible * to destroy the SA. In asynchronous mode, the same is indicated by an - * ODP_EVENT_IPSEC_STATUS event sent to the queue specified for the SA. The - * status event is guaranteed to be the last event for the SA, i.e. all - * in-progress operations have completed and resulting events (including status - * events) have been enqueued before it. + * artificial packet event sent to the queue specified for the SA having + * sa_disabled error bit set in the odp_ipsec_packet_result_t returned by + * odp_ipsec_result(). The packet is guaranteed to be the last event for + * the SA, i.e. all in-progress operations have completed and resulting events + * (including status events) have been enqueued before it. No packets will come + * from SA after this one. * * @param sa IPSEC SA to be disabled * @@ -914,6 +916,12 @@ typedef struct odp_ipsec_error_t { /** Hard lifetime expired: packets */ uint32_t hard_exp_packets : 1; + + /** + * SA is disabled, all packets are processed, it is + * safe to destroy it now. + */ + uint32_t sa_disabled : 1; }; /** All error bits @@ -927,7 +935,13 @@ typedef struct odp_ipsec_error_t { } odp_ipsec_error_t; -/** IPSEC warnings */ +/** + * IPSEC warnings + * + * For outbound SAs in ODP_IPSEC_OP_MODE_INLINE mode warnings can be reported + * only as status events. In all other cases warnings are reported as a part of + * IPsec packet result metadata. + */ typedef struct odp_ipsec_warn_t { /** IPSEC warnings */ union { @@ -1133,15 +1147,6 @@ typedef struct odp_ipsec_packet_result_t { * IPSEC status ID */ typedef enum odp_ipsec_status_id_t { - /** Response to SA disable command - * - * Following status event (odp_ipsec_status_t) fields have valid - * content, other fields must be ignored: - * - sa: The SA that was requested to be disabled - * - result: Operation result - */ - ODP_IPSEC_STATUS_SA_DISABLE = 0, - /** Warning from inline IPSEC processing * * Following status event (odp_ipsec_status_t) fields have valid @@ -1152,7 +1157,7 @@ typedef enum odp_ipsec_status_id_t { * This status event is generated only for outbound SAs in * ODP_IPSEC_OP_MODE_INLINE mode. */ - ODP_IPSEC_STATUS_WARN + ODP_IPSEC_STATUS_WARN = 0 } odp_ipsec_status_id_t; @@ -1166,13 +1171,6 @@ typedef struct odp_ipsec_status_t { /** IPSEC SA that was target of the operation */ odp_ipsec_sa_t sa; - /** Result of the operation - * - * 0: Success - * <0: Failure - */ - int result; - /** Warnings of an ODP_IPSEC_STATUS_WARN status event */ odp_ipsec_warn_t warn; @@ -1469,8 +1467,6 @@ int odp_ipsec_result(odp_ipsec_packet_result_t *result, odp_packet_t packet); * * @retval 0 On success * @retval <0 On failure - * - * @see odp_ipsec_sa_disable() */ int odp_ipsec_status(odp_ipsec_status_t *status, odp_event_t event); From fced0fbda7264114a0336f6dd4b2e94f53902403 Mon Sep 17 00:00:00 2001 From: Dmitry Eremin-Solenikov Date: Tue, 24 Oct 2017 12:05:03 +0300 Subject: [PATCH 2/3] validation: ipsec: adapt to odp_ipsec_sa_disable() change Signed-off-by: Dmitry Eremin-Solenikov --- test/validation/api/ipsec/ipsec.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/test/validation/api/ipsec/ipsec.c b/test/validation/api/ipsec/ipsec.c index a8fdf2b1409..ea385d2aead 100644 --- a/test/validation/api/ipsec/ipsec.c +++ b/test/validation/api/ipsec/ipsec.c @@ -315,7 +315,9 @@ void ipsec_sa_param_fill(odp_ipsec_sa_param_t *param, void ipsec_sa_destroy(odp_ipsec_sa_t sa) { odp_event_t event; - odp_ipsec_status_t status; + odp_packet_t packet; + odp_ipsec_packet_result_t result; + odp_event_subtype_t subtype; CU_ASSERT_EQUAL(ODP_IPSEC_OK, odp_ipsec_sa_disable(sa)); @@ -324,14 +326,18 @@ void ipsec_sa_destroy(odp_ipsec_sa_t sa) event = odp_queue_deq(suite_context.queue); } while (event == ODP_EVENT_INVALID); - CU_ASSERT_EQUAL(ODP_EVENT_IPSEC_STATUS, odp_event_type(event)); + CU_ASSERT_EQUAL(ODP_EVENT_PACKET, + odp_event_types(event, &subtype)); + CU_ASSERT_EQUAL(ODP_EVENT_PACKET_IPSEC, + subtype); - CU_ASSERT_EQUAL(ODP_IPSEC_OK, odp_ipsec_status(&status, event)); + packet = odp_ipsec_packet_from_event(event); - CU_ASSERT_EQUAL(ODP_IPSEC_STATUS_SA_DISABLE, status.id); - CU_ASSERT_EQUAL(sa, status.sa); - CU_ASSERT_EQUAL(0, status.result); - CU_ASSERT_EQUAL(0, status.warn.all); + CU_ASSERT_EQUAL(0, odp_ipsec_result(&result, packet)); + + CU_ASSERT_EQUAL(sa, result.sa); + CU_ASSERT_EQUAL(1, result.status.error.sa_disabled); + CU_ASSERT_EQUAL(0, result.status.warn.all); odp_event_free(event); } From ace5751f9b3c89f6c57d70dfaa355a2c2a77406c Mon Sep 17 00:00:00 2001 From: Dmitry Eremin-Solenikov Date: Tue, 24 Oct 2017 13:08:07 +0300 Subject: [PATCH 3/3] linux-gen: implement odp_ipsec_sa_disable() changes Signed-off-by: Dmitry Eremin-Solenikov --- .../include/odp_ipsec_internal.h | 20 ++++++- platform/linux-generic/odp_ipsec.c | 18 +++---- platform/linux-generic/odp_ipsec_events.c | 54 ++++++++++++++++++- platform/linux-generic/odp_ipsec_sad.c | 16 ++---- 4 files changed, 84 insertions(+), 24 deletions(-) diff --git a/platform/linux-generic/include/odp_ipsec_internal.h b/platform/linux-generic/include/odp_ipsec_internal.h index 1340ca7bd4b..09a7ac12674 100644 --- a/platform/linux-generic/include/odp_ipsec_internal.h +++ b/platform/linux-generic/include/odp_ipsec_internal.h @@ -74,9 +74,20 @@ void _odp_ipsec_status_free(ipsec_status_t status); int _odp_ipsec_status_send(odp_queue_t queue, odp_ipsec_status_id_t id, odp_ipsec_sa_t sa, - int result, odp_ipsec_warn_t warn); +/** + * @internal Send SA_DISABLED event + * + * Sends the packet notifying application that SA finished all processing and + * is now disabled. + * + * @param queue destination queue + * @param sa SA respective to the operation + */ +int _odp_ipsec_sa_disabled_send(odp_queue_t queue, + odp_ipsec_sa_t sa); + #define IPSEC_MAX_IV_LEN 32 /**< Maximum IV length in bytes */ #define IPSEC_MAX_SALT_LEN 4 /**< Maximum salt length in bytes */ @@ -190,6 +201,13 @@ int _odp_ipsec_sa_update_stats(ipsec_sa_t *ipsec_sa, uint32_t len, */ int _odp_ipsec_try_inline(odp_packet_t pkt); +/** + * Return IPsec result instance connected to the IPsec packet + * + * @param packet packet of ODP_EVENT_PACKET_IPSEC subtype + */ +odp_ipsec_packet_result_t *_odp_ipsec_pkt_result(odp_packet_t packet); + /** * @} */ diff --git a/platform/linux-generic/odp_ipsec.c b/platform/linux-generic/odp_ipsec.c index e57736c2a79..e9bf88c17eb 100644 --- a/platform/linux-generic/odp_ipsec.c +++ b/platform/linux-generic/odp_ipsec.c @@ -93,7 +93,7 @@ int odp_ipsec_config(const odp_ipsec_config_t *config) return 0; } -static odp_ipsec_packet_result_t *ipsec_pkt_result(odp_packet_t packet) +odp_ipsec_packet_result_t *_odp_ipsec_pkt_result(odp_packet_t packet) { ODP_ASSERT(ODP_EVENT_PACKET_IPSEC == odp_event_subtype(odp_packet_to_event(packet))); @@ -902,7 +902,7 @@ int odp_ipsec_in(const odp_packet_t pkt_in[], int num_in, _odp_buffer_event_subtype_set(packet_to_buffer(pkt), ODP_EVENT_PACKET_IPSEC); - result = ipsec_pkt_result(pkt); + result = _odp_ipsec_pkt_result(pkt); memset(result, 0, sizeof(*result)); result->status = status; if (NULL != ipsec_sa) @@ -966,7 +966,7 @@ int odp_ipsec_out(const odp_packet_t pkt_in[], int num_in, _odp_buffer_event_subtype_set(packet_to_buffer(pkt), ODP_EVENT_PACKET_IPSEC); - result = ipsec_pkt_result(pkt); + result = _odp_ipsec_pkt_result(pkt); memset(result, 0, sizeof(*result)); result->status = status; result->sa = ipsec_sa->ipsec_sa_hdl; @@ -1014,7 +1014,7 @@ int odp_ipsec_in_enq(const odp_packet_t pkt_in[], int num_in, _odp_buffer_event_subtype_set(packet_to_buffer(pkt), ODP_EVENT_PACKET_IPSEC); - result = ipsec_pkt_result(pkt); + result = _odp_ipsec_pkt_result(pkt); memset(result, 0, sizeof(*result)); result->status = status; if (NULL != ipsec_sa) { @@ -1075,7 +1075,7 @@ int odp_ipsec_out_enq(const odp_packet_t pkt_in[], int num_in, _odp_buffer_event_subtype_set(packet_to_buffer(pkt), ODP_EVENT_PACKET_IPSEC); - result = ipsec_pkt_result(pkt); + result = _odp_ipsec_pkt_result(pkt); memset(result, 0, sizeof(*result)); result->status = status; result->sa = ipsec_sa->ipsec_sa_hdl; @@ -1115,7 +1115,7 @@ int _odp_ipsec_try_inline(odp_packet_t pkt) _odp_buffer_event_subtype_set(packet_to_buffer(pkt), ODP_EVENT_PACKET_IPSEC); - result = ipsec_pkt_result(pkt); + result = _odp_ipsec_pkt_result(pkt); memset(result, 0, sizeof(*result)); result->status = status; result->sa = ipsec_sa->ipsec_sa_hdl; @@ -1192,7 +1192,7 @@ int odp_ipsec_out_inline(const odp_packet_t pkt_in[], int num_in, _odp_buffer_event_subtype_set(packet_to_buffer(pkt), ODP_EVENT_PACKET_IPSEC); - result = ipsec_pkt_result(pkt); + result = _odp_ipsec_pkt_result(pkt); memset(result, 0, sizeof(*result)); result->sa = ipsec_sa->ipsec_sa_hdl; result->status = status; @@ -1217,7 +1217,7 @@ int odp_ipsec_out_inline(const odp_packet_t pkt_in[], int num_in, buf = packet_to_buffer(pkt); _odp_buffer_event_subtype_set(buf, ODP_EVENT_PACKET_IPSEC); - result = ipsec_pkt_result(pkt); + result = _odp_ipsec_pkt_result(pkt); memset(result, 0, sizeof(*result)); result->sa = ipsec_sa->ipsec_sa_hdl; result->status = status; @@ -1246,7 +1246,7 @@ int odp_ipsec_result(odp_ipsec_packet_result_t *result, odp_packet_t packet) ODP_ASSERT(result != NULL); - res = ipsec_pkt_result(packet); + res = _odp_ipsec_pkt_result(packet); /* FIXME: maybe postprocess here, setting alg error in case of crypto * error instead of processing packet fully in ipsec_in/out_single */ diff --git a/platform/linux-generic/odp_ipsec_events.c b/platform/linux-generic/odp_ipsec_events.c index 3a7ebd6e8b1..3a3a9f5f51b 100644 --- a/platform/linux-generic/odp_ipsec_events.c +++ b/platform/linux-generic/odp_ipsec_events.c @@ -6,6 +6,8 @@ #include "config.h" +#include + #include #include @@ -13,6 +15,8 @@ #include #include #include +#include +#include #include typedef struct { @@ -23,6 +27,7 @@ typedef struct { } ipsec_status_hdr_t; static odp_pool_t ipsec_status_pool = ODP_POOL_INVALID; +static odp_pool_t ipsec_sa_disabled_pool = ODP_POOL_INVALID; #define IPSEC_EVENTS_POOL_BUF_COUNT 1024 @@ -43,8 +48,24 @@ int _odp_ipsec_events_init_global(void) goto err_status; } + odp_pool_param_init(¶m); + + param.pkt.seg_len = 16; + param.pkt.len = 16; + param.pkt.num = ODP_CONFIG_IPSEC_SAS; + param.type = ODP_POOL_PACKET; + + ipsec_sa_disabled_pool = odp_pool_create("ipsec_sa_disabled_pool", + ¶m); + if (ODP_POOL_INVALID == ipsec_sa_disabled_pool) { + ODP_ERR("Error: sa_disabled pool create failed.\n"); + goto err_sa_disabled; + } + return 0; +err_sa_disabled: + odp_pool_destroy(ipsec_status_pool); err_status: return -1; } @@ -54,6 +75,12 @@ int _odp_ipsec_events_term_global(void) int ret = 0; int rc = 0; + ret = odp_pool_destroy(ipsec_sa_disabled_pool); + if (ret < 0) { + ODP_ERR("sa_disabled pool destroy failed"); + rc = -1; + } + ret = odp_pool_destroy(ipsec_status_pool); if (ret < 0) { ODP_ERR("status pool destroy failed"); @@ -112,7 +139,6 @@ void _odp_ipsec_status_free(ipsec_status_t status) int _odp_ipsec_status_send(odp_queue_t queue, odp_ipsec_status_id_t id, odp_ipsec_sa_t sa, - int result, odp_ipsec_warn_t warn) { ipsec_status_t ipsec_ev = odp_ipsec_status_alloc(); @@ -125,7 +151,6 @@ int _odp_ipsec_status_send(odp_queue_t queue, status_hdr->status.id = id; status_hdr->status.sa = sa; - status_hdr->status.result = result; status_hdr->status.warn = warn; if (odp_queue_enq(queue, ipsec_status_to_event(ipsec_ev))) { @@ -154,3 +179,28 @@ int odp_ipsec_status(odp_ipsec_status_t *status, odp_event_t event) return 0; } + +int _odp_ipsec_sa_disabled_send(odp_queue_t queue, + odp_ipsec_sa_t sa) +{ + odp_packet_t packet; + odp_ipsec_packet_result_t *result; + + ODP_ASSERT(ODP_POOL_INVALID != ipsec_sa_disabled_pool); + packet = odp_packet_alloc(ipsec_sa_disabled_pool, 0); + ODP_ASSERT(ODP_PACKET_INVALID != packet); + + _odp_buffer_event_subtype_set(packet_to_buffer(packet), + ODP_EVENT_PACKET_IPSEC); + result = _odp_ipsec_pkt_result(packet); + memset(result, 0, sizeof(*result)); + result->status.error.sa_disabled = 1; + result->sa = sa; + + if (odp_queue_enq(queue, odp_ipsec_packet_to_event(packet))) { + odp_packet_free(packet); + return -1; + } + + return 0; +} diff --git a/platform/linux-generic/odp_ipsec_sad.c b/platform/linux-generic/odp_ipsec_sad.c index f0b5b9e4afe..a1eff884913 100644 --- a/platform/linux-generic/odp_ipsec_sad.c +++ b/platform/linux-generic/odp_ipsec_sad.c @@ -171,7 +171,6 @@ void _odp_ipsec_sa_unuse(ipsec_sa_t *ipsec_sa) { odp_queue_t queue; odp_ipsec_sa_t sa; - odp_ipsec_warn_t warn = { .all = 0 }; ODP_ASSERT(NULL != ipsec_sa); @@ -179,9 +178,7 @@ void _odp_ipsec_sa_unuse(ipsec_sa_t *ipsec_sa) sa = ipsec_sa->ipsec_sa_hdl; if (ipsec_sa_unlock(ipsec_sa) && ODP_QUEUE_INVALID != queue) - _odp_ipsec_status_send(queue, - ODP_IPSEC_STATUS_SA_DISABLE, - sa, 0, warn); + _odp_ipsec_sa_disabled_send(queue, sa); } void odp_ipsec_sa_param_init(odp_ipsec_sa_param_t *param) @@ -370,17 +367,12 @@ int odp_ipsec_sa_disable(odp_ipsec_sa_t sa) } if (ODP_QUEUE_INVALID != ipsec_sa->queue) { - odp_ipsec_warn_t warn = { .all = 0 }; - /* - * If there were not active state when we disabled SA, - * send the event. + * If there was no active state when we disabled SA, send the + * event. Otherwise it will be sent by _odp_ipsec_sa_unuse(). */ if (0 == state) - _odp_ipsec_status_send(ipsec_sa->queue, - ODP_IPSEC_STATUS_SA_DISABLE, - ipsec_sa->ipsec_sa_hdl, - 0, warn); + _odp_ipsec_sa_disabled_send(ipsec_sa->queue, sa); return 0; }