2 * Copyright (c) 2018 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 #include <vnet/ipsec/ipsec.h>
17 #include <vnet/ipsec/ipsec_sa.h>
18 #include <vnet/ipsec/ipsec_output.h>
21 test_ipsec_command_fn (vlib_main_t * vm,
22 unformat_input_t * input, vlib_cli_command_t * cmd)
30 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
32 if (unformat (input, "sa %d", &sa_id))
34 else if (unformat (input, "seq 0x%llx", &seq_num))
45 sa_index = ipsec_sa_find_and_lock (sa_id);
46 sa = ipsec_sa_get (sa_index);
48 sa->seq = seq_num & 0xffffffff;
49 sa->seq_hi = seq_num >> 32;
51 ipsec_sa_unlock (sa_index);
55 return clib_error_return (0, "unknown SA `%U'",
56 format_unformat_error, input);
63 test_ipsec_spd_outbound_perf_command_fn (vlib_main_t *vm,
64 unformat_input_t *input,
65 vlib_cli_command_t *cmd)
67 clib_error_t *err = 0;
68 ipsec_crypto_alg_t crypto_alg = IPSEC_CRYPTO_ALG_AES_GCM_128;
69 ipsec_integ_alg_t integ_alg = IPSEC_INTEG_ALG_NONE;
70 ipsec_protocol_t proto = IPSEC_PROTOCOL_ESP;
71 ipsec_sa_flags_t sa_flags = IPSEC_SA_FLAG_NONE;
72 ipsec_key_t ck = { 0 };
73 u8 key_data[] = { 31, 32, 33, 34, 35, 36, 37, 38,
74 39, 30, 31, 32, 33, 34, 35, 36 };
75 ipsec_mk_key (&ck, key_data, 16);
76 ipsec_key_t ik = { 0 };
77 u32 sa_id = 123456, spi = 654321, salt = 1234, sai;
78 u16 udp_src = IPSEC_UDP_PORT_NONE, udp_dst = IPSEC_UDP_PORT_NONE;
82 ipsec_main_t *im = &ipsec_main;
83 ipsec_policy_t *p0 = NULL;
86 u32 stat_index, spd_idx, spd_id = 1;
89 ipsec_policy_t *p_vec = NULL;
99 u8 flow_cache_enabled = im->output_flow_cache_flag;
100 u32 count_cached = 0;
101 u32 count_slow_path = 0;
102 u32 seed = random_default_seed ();
103 u32 *rand_val = NULL;
105 #define BURST_MAX_SIZE 256
106 ipsec_policy_t *policies[BURST_MAX_SIZE];
107 ipsec4_spd_5tuple_t ip4_5tuples[BURST_MAX_SIZE];
109 int burst_enabled = 0;
110 u64 t0 = clib_cpu_time_now ();
113 u64 burst_counter = 0;
115 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
117 if (unformat (input, "flows %d", &flows))
119 else if (unformat (input, "burst %d", &burst_size))
126 burst_size = clib_min (burst_size, BURST_MAX_SIZE);
133 vlib_cli_output (vm, "Create env:");
134 /* creating a new SA */
135 rv = ipsec_sa_add_and_lock (sa_id, spi, proto, crypto_alg, &ck, integ_alg,
136 &ik, sa_flags, clib_host_to_net_u32 (salt),
137 udp_src, udp_dst, &tun, &sai);
140 err = clib_error_return (0, "create sa failure");
144 vlib_cli_output (vm, "\tAdd a new SA");
146 /* creating a new SPD */
147 rv = ipsec_add_del_spd (vm, spd_id, is_add);
150 err = clib_error_return (0, "create spd failure");
154 vlib_cli_output (vm, "\tAdd a new SPD");
156 /* vector for spd_policy */
157 vec_validate (p_vec, flows + 1);
158 vec_validate (rand_val, flows + 1);
160 /* fill spd policy */
161 for (i = 0; i < flows; i++)
163 rand_val[i] = random_u32 (&seed) % flows;
165 p_vec[i].type = IPSEC_SPD_POLICY_IP4_OUTBOUND;
166 p_vec[i].priority = flows - i;
167 p_vec[i].policy = IPSEC_POLICY_ACTION_PROTECT;
168 p_vec[i].id = spd_id;
169 p_vec[i].sa_id = sa_id;
170 p_vec[i].protocol = IP_PROTOCOL_UDP;
171 p_vec[i].lport.start = 1;
172 p_vec[i].lport.stop = 1;
173 p_vec[i].rport.start = 1;
174 p_vec[i].rport.stop = 1;
175 /* address: 1.0.0.0 as u32 */
176 ip4_start = 16777216;
177 p_vec[i].laddr.start.ip4.data_u32 =
178 clib_host_to_net_u32 (ip4_start + i * 32);
179 p_vec[i].laddr.stop.ip4.data_u32 =
180 clib_host_to_net_u32 (ip4_start + i * 32);
181 p_vec[i].raddr.start.ip4.data_u32 =
182 clib_host_to_net_u32 (ip4_start + i * 32);
183 p_vec[i].raddr.stop.ip4.data_u32 =
184 clib_host_to_net_u32 (ip4_start + i * 32);
187 vlib_cli_output (vm, "Add SPD Policy");
188 t_add_0 = clib_cpu_time_now ();
189 for (i = 0; i < flows; i++)
191 rv = ipsec_add_del_policy (vm, &p_vec[i], is_add, &stat_index);
194 clib_warning ("No add SPD Policy: %u", stat_index);
195 err = clib_error_return (0, "add SPD Policy failure");
199 t_add_1 = clib_cpu_time_now ();
201 pp = hash_get (im->spd_index_by_spd_id, spd_id);
203 spd0 = pool_elt_at_index (im->spds, spd_idx);
205 vlib_cli_output (vm, "Lookup SPD Policy");
207 u64 n_lookup = 1000 * 1000;
208 t_look_0 = clib_cpu_time_now ();
209 for (i = 0; i < n_lookup; i++)
215 if (flow_cache_enabled)
217 p0 = ipsec4_out_spd_find_flow_cache_entry (
219 clib_net_to_host_u32 (ip4_start +
220 ((flows - 1) - rand_val[j]) * 32),
221 clib_net_to_host_u32 (ip4_start +
222 ((flows - 1) - rand_val[j]) * 32),
223 clib_net_to_host_u16 (1), clib_net_to_host_u16 (1));
231 u32 src_addr = (ip4_start + ((flows - 1) - rand_val[j]) * 32);
232 u32 dst_addr = (ip4_start + ((flows - 1) - rand_val[j]) * 32);
233 ipsec4_spd_5tuple_t ip4_5tuple = {
234 .ip4_addr = { (ip4_address_t) src_addr,
235 (ip4_address_t) dst_addr },
237 .proto = IP_PROTOCOL_UDP
243 clib_memset (policies, 0,
244 burst_size * sizeof (ipsec_policy_t *));
245 burst_counter += ipsec_output_policy_match_n (
246 spd0, ip4_5tuples, policies, burst_size,
248 for (m = 0; m < burst_size; m++)
250 ASSERT (policies[m] != 0);
254 clib_memcpy (ip4_5tuples + k, &ip4_5tuple,
255 sizeof (ipsec4_spd_5tuple_t));
261 p0 = ipsec_output_policy_match (
262 spd0, IP_PROTOCOL_UDP,
263 (ip4_start + ((flows - 1) - rand_val[j]) * 32),
264 (ip4_start + ((flows - 1) - rand_val[j]) * 32), 1, 1,
275 if (burst_enabled && k > 0)
277 clib_memset (policies, 0, k * sizeof (ipsec_policy_t *));
278 burst_counter += ipsec_output_policy_match_n (
279 spd0, ip4_5tuples, policies, k, flow_cache_enabled);
280 for (m = 0; m < k; m++)
282 ASSERT (policies[m] != 0);
285 t_look_1 = clib_cpu_time_now ();
287 t_add = (t_add_1 - t_add_0);
288 t_look = (t_look_1 - t_look_0);
290 vlib_cli_output (vm, "Results Outbound:");
291 vlib_cli_output (vm, "Time to add %u flows: \t\t%12.10f s", flows,
292 (t_add / vm->clib_time.clocks_per_second));
293 vlib_cli_output (vm, "Average time to add 1 flow: \t\t%12.10f s",
294 ((t_add / flows) / vm->clib_time.clocks_per_second));
295 vlib_cli_output (vm, "Time to lookup %u flows: \t\t%12.10f s", flows,
296 (t_look / vm->clib_time.clocks_per_second));
297 vlib_cli_output (vm, "Average time to lookup 1 flow: \t\t%12.10f s",
298 ((t_look / n_lookup) / vm->clib_time.clocks_per_second));
300 vlib_cli_output (vm, " ");
302 vlib_cli_output (vm, "Cycle CPU to add %u flows: \t\t%32lu cycles", flows,
304 vlib_cli_output (vm, "Average cycle CPU to add 1 flow: \t%32lu cycles",
306 vlib_cli_output (vm, "Cycle CPU to lookup %u flows: \t%32lu cycles", flows,
308 vlib_cli_output (vm, "Average cycle CPU to lookup 1 flow: \t%32lu cycles",
311 if (count_slow_path || count_cached)
313 vm, "flow cache hit rate: \t\t%12.10f\n cached: \t%d\n slow_path: \t%d",
314 ((float) count_cached) / ((float) count_cached + count_slow_path),
315 count_cached, count_slow_path);
318 vlib_cli_output (vm, "Total number of packets matched in bursts: \t\t%d\n",
322 vlib_cli_output (vm, "Cleaning:");
323 /* delete SPD policy */
325 for (i = 0; i < flows; i++)
327 rv = ipsec_add_del_policy (vm, &p_vec[i], is_add, &stat_index);
330 clib_warning ("No delete SPD Policy: %u", i);
331 err = clib_error_return (0, "delete SPD Policy failure");
334 vlib_cli_output (vm, "\tDelete all SPD Policy");
337 rv = ipsec_add_del_spd (vm, spd_id, is_add);
340 err = clib_error_return (0, "delete spd failure");
343 vlib_cli_output (vm, "\tDelete SPD");
346 rv = ipsec_sa_unlock_id (sa_id);
349 err = clib_error_return (0, "delete sa failure");
352 vlib_cli_output (vm, "\tDelete SA");
354 t1 = clib_cpu_time_now ();
355 vlib_cli_output (vm, "Time for test: \t%12.10f s",
356 ((t1 - t0) / vm->clib_time.clocks_per_second));
359 vlib_cli_output (vm, "End");
364 VLIB_CLI_COMMAND (test_ipsec_spd_perf_command, static) = {
365 .path = "test ipsec_spd_outbound_perf",
366 .short_help = "test ipsec_spd_outbound_perf flows <n_flows>",
367 .function = test_ipsec_spd_outbound_perf_command_fn,
371 VLIB_CLI_COMMAND (test_ipsec_command, static) =
373 .path = "test ipsec",
374 .short_help = "test ipsec sa <ID> seq-num <VALUE>",
375 .function = test_ipsec_command_fn,
380 * fd.io coding-style-patch-verification: ON
383 * eval: (c-set-style "gnu")