ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec: perf improvement of ipsec4_input_node using flow cache

Browse Source 
Adding flow cache support to improve inbound IPv4/IPSec Security Policy
Database (SPD) lookup performance. By enabling the flow cache in startup
conf, this replaces a linear O(N) SPD search, with an O(1) hash table
search.

This patch is the ipsec4_input_node counterpart to
https://gerrit.fd.io/r/c/vpp/+/31694, and shares much of the same code,
theory and mechanism of action.

Details about the flow cache:
  Mechanism:
  1. First packet of a flow will undergo linear search in SPD
     table. Once a policy match is found, a new entry will be added
     into the flow cache. From 2nd packet onwards, the policy lookup
     will happen in flow cache.
  2. The flow cache is implemented using a hash table without collision
     handling. This will avoid the logic to age out or recycle the old
     flows in flow cache. Whenever a collision occurs, the old entry
     will be overwritten by the new entry. Worst case is when all the
     256 packets in a batch result in collision, falling back to linear
     search. Average and best case will be O(1).
  3. The size of flow cache is fixed and decided based on the number
     of flows to be supported. The default is set to 1 million flows,
     but is configurable by a startup.conf option.
  4. Whenever a SPD rule is added/deleted by the control plane, all
     current flow cache entries will be invalidated. As the SPD API is
     not mp-safe, the data plane will wait for the control plane
     operation to complete.
     Cache invalidation is via an epoch counter that is incremented on
     policy add/del and stored with each entry in the flow cache. If the
     epoch counter in the flow cache does not match the current count,
     the entry is considered stale, and we fall back to linear search.

  The following configurable options are available through startup
  conf under the ipsec{} entry:
  1. ipv4-inbound-spd-flow-cache on/off - enable SPD flow cache
     (default off)
  2. ipv4-inbound-spd-hash-buckets %d - set number of hash buckets
     (default 4,194,304: ~1 million flows with 25% load factor)

  Performance with 1 core, 1 ESP Tunnel, null-decrypt then bypass,
  94B (null encrypted packet) for different SPD policy matching indices:

  SPD Policy index    : 2          10         100        1000
  Throughput          : Mbps/Mbps  Mbps/Mbps  Mbps/Mbps  Mbps/Mbps
  (Baseline/Optimized)
  ARM TX2             : 300/290    230/290    70/290     8.5/290

Type: improvement
Signed-off-by: Zachary Leaf <zachary.leaf@arm.com>
Signed-off-by: mgovind <govindarajan.Mohandoss@arm.com>
Tested-by: Jieqiang Wang <jieqiang.wang@arm.com>
Change-Id: I8be2ad4715accbb335c38cd933904119db75827b
This commit is contained in:
Zachary Leaf
2021-06-25 08:11:15 -05:00
committed by Fan Zhang
parent e1fd3903ef
commit 7cd35f5d68
11 changed files with 1011 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/vnet/ipsec/ipsec.c
+31 -4
View File
@@ -31,6 +31,10 @@
*/
#define IPSEC4_OUT_SPD_DEFAULT_HASH_NUM_BUCKETS (1 << 22)
/* Flow cache is sized for 1 million flows with a load factor of .25.
*/
#define IPSEC4_SPD_DEFAULT_HASH_NUM_BUCKETS (1 << 22)
ipsec_main_t ipsec_main;
esp_async_post_next_t esp_encrypt_async_next;
esp_async_post_next_t esp_decrypt_async_next;
@@ -554,12 +558,18 @@ ipsec_init (vlib_main_t * vm)
crypto_engine_backend_register_post_node (vm);
im->ipsec4_out_spd_hash_tbl = NULL;
im->flow_cache_flag = 0;
im->output_flow_cache_flag = 0;
im->ipsec4_out_spd_flow_cache_entries = 0;
im->epoch_count = 0;
im->ipsec4_out_spd_hash_num_buckets =
IPSEC4_OUT_SPD_DEFAULT_HASH_NUM_BUCKETS;
im->ipsec4_in_spd_hash_tbl = NULL;
im->input_flow_cache_flag = 0;
im->ipsec4_in_spd_flow_cache_entries = 0;
im->input_epoch_count = 0;
im->ipsec4_in_spd_hash_num_buckets = IPSEC4_SPD_DEFAULT_HASH_NUM_BUCKETS;
return 0;
}
@@ -570,14 +580,16 @@ ipsec_config (vlib_main_t *vm, unformat_input_t *input)
{
ipsec_main_t *im = &ipsec_main;
unformat_input_t sub_input;
u32 ipsec4_out_spd_hash_num_buckets;
u32 ipsec4_in_spd_hash_num_buckets;
while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
{
if (unformat (input, "ipv4-outbound-spd-flow-cache on"))
im->flow_cache_flag = 1;
im->output_flow_cache_flag = 1;
else if (unformat (input, "ipv4-outbound-spd-flow-cache off"))
im->flow_cache_flag = 0;
im->output_flow_cache_flag = 0;
else if (unformat (input, "ipv4-outbound-spd-hash-buckets %d",
&ipsec4_out_spd_hash_num_buckets))
{
@@ -585,6 +597,16 @@ ipsec_config (vlib_main_t *vm, unformat_input_t *input)
im->ipsec4_out_spd_hash_num_buckets =
1ULL << max_log2 (ipsec4_out_spd_hash_num_buckets);
}
else if (unformat (input, "ipv4-inbound-spd-flow-cache on"))
im->input_flow_cache_flag = 1;
else if (unformat (input, "ipv4-inbound-spd-flow-cache off"))
im->input_flow_cache_flag = 0;
else if (unformat (input, "ipv4-inbound-spd-hash-buckets %d",
&ipsec4_in_spd_hash_num_buckets))
{
im->ipsec4_in_spd_hash_num_buckets =
1ULL << max_log2 (ipsec4_in_spd_hash_num_buckets);
}
else if (unformat (input, "ip4 %U", unformat_vlib_cli_sub_input,
&sub_input))
{
@@ -623,11 +645,16 @@ ipsec_config (vlib_main_t *vm, unformat_input_t *input)
return clib_error_return (0, "unknown input `%U'",
format_unformat_error, input);
}
if (im->flow_cache_flag)
if (im->output_flow_cache_flag)
{
vec_add2 (im->ipsec4_out_spd_hash_tbl, im->ipsec4_out_spd_hash_tbl,
im->ipsec4_out_spd_hash_num_buckets);
}
if (im->input_flow_cache_flag)
{
vec_add2 (im->ipsec4_in_spd_hash_tbl, im->ipsec4_in_spd_hash_tbl,
im->ipsec4_in_spd_hash_num_buckets);
}
return 0;
}
src/vnet/ipsec/ipsec.h
+21 -2
View File
@@ -36,7 +36,7 @@ typedef clib_error_t *(*enable_disable_cb_t) (int is_enable);
typedef struct
{
u64 key[2];
u64 key[2]; // 16 bytes
u64 value;
i32 bucket_lock;
u32 un_used;
@@ -54,6 +54,18 @@ typedef union
ipsec4_hash_kv_16_8_t kv_16_8;
} ipsec4_spd_5tuple_t;
typedef union
{
struct
{
ip4_address_t ip4_src_addr;
ip4_address_t ip4_dest_addr;
ipsec_spd_policy_type_t policy_type;
u8 pad[4];
}; // 16 bytes total
ipsec4_hash_kv_16_8_t kv_16_8;
} ipsec4_inbound_spd_tuple_t;
typedef struct
{
u8 *name;
@@ -151,6 +163,7 @@ typedef struct
uword *ipsec_if_by_sw_if_index;
ipsec4_hash_kv_16_8_t *ipsec4_out_spd_hash_tbl;
ipsec4_hash_kv_16_8_t *ipsec4_in_spd_hash_tbl;
clib_bihash_8_16_t tun4_protect_by_key;
clib_bihash_24_16_t tun6_protect_by_key;
@@ -223,9 +236,15 @@ typedef struct
u32 ipsec4_out_spd_hash_num_buckets;
u32 ipsec4_out_spd_flow_cache_entries;
u32 epoch_count;
u8 output_flow_cache_flag;
u32 ipsec4_in_spd_hash_num_buckets;
u32 ipsec4_in_spd_flow_cache_entries;
u32 input_epoch_count;
u8 input_flow_cache_flag;
u8 async_mode;
u16 msg_id_base;
u8 flow_cache_flag;
} ipsec_main_t;
typedef enum ipsec_format_flags_t_
src/vnet/ipsec/ipsec_cli.c
+6 -2
View File
@@ -428,9 +428,13 @@ ipsec_spd_show_all (vlib_main_t * vm, ipsec_main_t * im)
vlib_cli_output(vm, "%U", format_ipsec_spd, spdi);
}
if (im->flow_cache_flag)
if (im->output_flow_cache_flag)
{
vlib_cli_output (vm, "%U", format_ipsec_spd_flow_cache);
vlib_cli_output (vm, "%U", format_ipsec_out_spd_flow_cache);
}
if (im->input_flow_cache_flag)
{
vlib_cli_output (vm, "%U", format_ipsec_in_spd_flow_cache);
}
/* *INDENT-ON* */
}
src/vnet/ipsec/ipsec_format.c
+13 -2
View File
@@ -232,16 +232,27 @@ done:
}
u8 *
format_ipsec_spd_flow_cache (u8 *s, va_list *args)
format_ipsec_out_spd_flow_cache (u8 *s, va_list *args)
{
ipsec_main_t *im = &ipsec_main;
s = format (s, "\nip4-outbound-spd-flow-cache-entries: %u",
s = format (s, "\nipv4-outbound-spd-flow-cache-entries: %u",
im->ipsec4_out_spd_flow_cache_entries);
return (s);
}
u8 *
format_ipsec_in_spd_flow_cache (u8 *s, va_list *args)
{
ipsec_main_t *im = &ipsec_main;
s = format (s, "\nipv4-inbound-spd-flow-cache-entries: %u",
im->ipsec4_in_spd_flow_cache_entries);
return (s);
}
u8 *
format_ipsec_key (u8 * s, va_list * args)
{
src/vnet/ipsec/ipsec_input.c
+211 -41
View File
File diff suppressed because it is too large Load Diff
src/vnet/ipsec/ipsec_output.c
+1 -1
View File
@@ -278,7 +278,7 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
ipsec_spd_t *spd0 = 0;
int bogus;
u64 nc_protect = 0, nc_bypass = 0, nc_discard = 0, nc_nomatch = 0;
u8 flow_cache_enabled = im->flow_cache_flag;
u8 flow_cache_enabled = im->output_flow_cache_flag;
from = vlib_frame_vector_args (from_frame);
n_left_from = from_frame->n_vectors;
src/vnet/ipsec/ipsec_spd.h
+2 -1
View File
@@ -64,7 +64,8 @@ extern int ipsec_set_interface_spd (vlib_main_t * vm,
extern u8 *format_ipsec_spd (u8 * s, va_list * args);
extern u8 *format_ipsec_spd_flow_cache (u8 *s, va_list *args);
extern u8 *format_ipsec_out_spd_flow_cache (u8 *s, va_list *args);
extern u8 *format_ipsec_in_spd_flow_cache (u8 *s, va_list *args);
#endif /* __IPSEC_SPD_H__ */
src/vnet/ipsec/ipsec_spd_policy.c
+26 -1
View File
@@ -156,7 +156,7 @@ ipsec_add_del_policy (vlib_main_t * vm,
if (!spd)
return VNET_API_ERROR_SYSCALL_ERROR_1;
if (im->flow_cache_flag && !policy->is_ipv6 &&
if (im->output_flow_cache_flag && !policy->is_ipv6 &&
policy->type == IPSEC_SPD_POLICY_IP4_OUTBOUND)
{
/*
@@ -179,6 +179,31 @@ ipsec_add_del_policy (vlib_main_t * vm,
clib_atomic_store_relax_n (&im->ipsec4_out_spd_flow_cache_entries, 0);
}
if ((policy->type == IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT ||
policy->type == IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS ||
policy->type == IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD) &&
im->input_flow_cache_flag && !policy->is_ipv6)
{
/*
* Flow cache entry is valid only when input_epoch_count value in control
* plane and data plane match. Otherwise, flow cache entry is considered
* stale. To avoid the race condition of using old input_epoch_count
* value in data plane after the roll over of input_epoch_count in
* control plane, entire flow cache is reset.
*/
if (im->input_epoch_count == 0xFFFFFFFF)
{
/* Reset all the entries in flow cache */
clib_memset_u8 (im->ipsec4_in_spd_hash_tbl, 0,
im->ipsec4_in_spd_hash_num_buckets *
(sizeof (*(im->ipsec4_in_spd_hash_tbl))));
}
/* Increment epoch counter by 1 */
clib_atomic_fetch_add_relax (&im->input_epoch_count, 1);
/* Reset spd flow cache counter since all old entries are stale */
im->ipsec4_in_spd_flow_cache_entries = 0;
}
if (is_add)
{
u32 policy_index;
test/template_ipsec.py
+17 -6
View File
@@ -1785,15 +1785,21 @@ class SpdFlowCacheTemplate(IPSecIPv4Fwd):
def tearDown(self):
super(SpdFlowCacheTemplate, self).tearDown()
def get_spd_flow_cache_entries(self):
def get_spd_flow_cache_entries(self, outbound):
""" 'show ipsec spd' output:
ip4-outbound-spd-flow-cache-entries: 0
ipv4-inbound-spd-flow-cache-entries: 0
ipv4-outbound-spd-flow-cache-entries: 0
"""
show_ipsec_reply = self.vapi.cli("show ipsec spd")
# match the relevant section of 'show ipsec spd' output
regex_match = re.search(
'ip4-outbound-spd-flow-cache-entries: (.*)',
show_ipsec_reply, re.DOTALL)
if(outbound):
regex_match = re.search(
'ipv4-outbound-spd-flow-cache-entries: (.*)',
show_ipsec_reply, re.DOTALL)
else:
regex_match = re.search(
'ipv4-inbound-spd-flow-cache-entries: (.*)',
show_ipsec_reply, re.DOTALL)
if regex_match is None:
raise Exception("Unable to find spd flow cache entries \
in \'show ipsec spd\' CLI output - regex failed to match")
@@ -1807,7 +1813,12 @@ class SpdFlowCacheTemplate(IPSecIPv4Fwd):
return num_entries
def verify_num_outbound_flow_cache_entries(self, expected_elements):
self.assertEqual(self.get_spd_flow_cache_entries(), expected_elements)
self.assertEqual(self.get_spd_flow_cache_entries(outbound=True),
expected_elements)
def verify_num_inbound_flow_cache_entries(self, expected_elements):
self.assertEqual(self.get_spd_flow_cache_entries(outbound=False),
expected_elements)
def crc32_supported(self):
# lscpu is part of util-linux package, available on all Linux Distros
test/test_ipsec_spd_flow_cache_input.py
+683
View File
File diff suppressed because it is too large Load Diff
test/test_ipsec_spd_flow_cache.py → test/test_ipsec_spd_flow_cache_output.py
View File