From: Anoob Joseph Date: Sun, 8 Dec 2019 10:41:23 +0000 (+0530) Subject: ethdev: allow multiple security sessions to use flow rule X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=725e515ed1fa5eee84b809a1a2e2886a3448e5f8;p=dpdk.git ethdev: allow multiple security sessions to use flow rule The rte_security API which enables inline protocol/crypto feature mandates that for every security session an rte_flow is created. This would internally translate to a rule in the hardware which would do packet classification. In rte_security, one SA would be one security session. And if an rte_flow need to be created for every session, the number of SAs supported by an inline implementation would be limited by the number of rte_flows the PMD would be able to support. If the fields SPI & IP addresses are allowed to be a range, then this limitation can be overcome. Multiple flows will be able to use one rule for SECURITY processing. In this case, the security session provided as conf would be NULL. Application should do an rte_flow_validate() to make sure the flow is supported on the PMD. Signed-off-by: Anoob Joseph Reviewed-by: Jerin Jacob Acked-by: Ori Kam Acked-by: Konstantin Ananyev Acked-by: Vladimir Medvedkin --- diff --git a/lib/librte_ethdev/rte_flow.h b/lib/librte_ethdev/rte_flow.h index c531c6eb76..5625dc4917 100644 --- a/lib/librte_ethdev/rte_flow.h +++ b/lib/librte_ethdev/rte_flow.h @@ -2286,6 +2286,11 @@ struct rte_flow_action_meter { * direction. * * Multiple flows can be configured to use the same security session. + * + * The NULL value is allowed for security session. If security session is NULL, + * then SPI field in ESP flow item and IP addresses in flow items 'IPv4' and + * 'IPv6' will be allowed to be a range. The rule thus created can enable + * security processing on multiple flows. */ struct rte_flow_action_security { void *security_session; /**< Pointer to security session structure. */