examples/ipsec-secgw: define initial ESN value

New option added to the SA configuration arguments that
allows setting an arbitrary start value for ESN.

For example in the SA below ESN will be enabled and first egress
IPsec packet will have the ESN value 10000:

sa out 15 cipher_algo null auth_algo null mode ipv4-tunnel \
src 172.16.1.5 dst 172.16.2.5 \
esn 10000

Signed-off-by: Declan Doherty <declan.doherty@intel.com>
Signed-off-by: Radu Nicolau <radu.nicolau@intel.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>

diff --git a/doc/guides/sample_app_ug/ipsec_secgw.rst b/doc/guides/sample_app_ug/ipsec_secgw.rst
index 13e09cba5c1860ed20b39eb1726a86753f60f3e7..299b22a8cb5d58056d861ac3f65284ace1404046 100644 (file)
--- a/doc/guides/sample_app_ug/ipsec_secgw.rst
+++ b/doc/guides/sample_app_ug/ipsec_secgw.rst
@@ -748,6 +748,16 @@ where each options means:
 
    * *telemetry*
 
+ ``<esn>``
+
+ * Enable ESN and set the initial ESN value.
+
+ * Optional: Yes, ESN not enabled by default
+
+ * Syntax:
+
+   * *esn N* N is the initial ESN value
+
 Example SA rules:
 
 .. code-block:: console

diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c
index 90d9e61e5b344df92995dfae140547225c3d8a0e..2d4a26c9623844e911e8e15701bc744b4d632683 100644 (file)
--- a/examples/ipsec-secgw/ipsec.c
+++ b/examples/ipsec-secgw/ipsec.c
@@ -227,6 +227,12 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
                sess_conf.ipsec.udp.dport = htons(sa->udp.dport);
        }
 
+       if (sa->esn > 0) {
+               sess_conf.ipsec.options.esn = 1;
+               sess_conf.ipsec.esn.value = sa->esn;
+       }
+
+
        RTE_LOG_DP(DEBUG, IPSEC, "Create session for SA spi %u on port %u\n",
                sa->spi, sa->portid);
 

diff --git a/examples/ipsec-secgw/ipsec.h b/examples/ipsec-secgw/ipsec.h
index b471360aff51efd2480079e4632db7a35f7ed183..0d7d5edb9ac312a4442d5e64c585e38b81c0152d 100644 (file)
--- a/examples/ipsec-secgw/ipsec.h
+++ b/examples/ipsec-secgw/ipsec.h
@@ -143,6 +143,7 @@ struct ipsec_sa {
        enum rte_security_ipsec_sa_direction direction;
        uint8_t udp_encap;
        uint16_t portid;
+       uint64_t esn;
        uint16_t mss;
        uint8_t fdir_qid;
        uint8_t fdir_flag;

diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c
index 4f0d20d14db510837ef4d8c5ddb2b8ca782613ea..9005e4e01d8c6426c6847b77e56a925159a229e1 100644 (file)
--- a/examples/ipsec-secgw/sa.c
+++ b/examples/ipsec-secgw/sa.c
@@ -694,6 +694,16 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens,
                        continue;
                }
 
+               if (strcmp(tokens[ti], "esn") == 0) {
+                       INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
+                       if (status->status < 0)
+                               return;
+                       rule->esn = atoll(tokens[ti]);
+                       if (status->status < 0)
+                               return;
+                       continue;
+               }
+
                if (strcmp(tokens[ti], "fallback") == 0) {
                        struct rte_ipsec_session *fb;