Hi Hemant,
> The rte_security lib has introduced replay_win_sz,
> so it can be removed from the rte_ipsec lib.
>
> Also, the relaved tests,app are also update to reflect
> the usages.
>
> Signed-off-by: Hemant Agrawal <hemant.agra...@nxp.com>
> ---
> v3: fix the compilation issue
>
> app/test/test_ipsec.c | 2 +-
> doc/guides/rel_notes/release_19_11.rst | 10 ++++++++--
> examples/ipsec-secgw/ipsec.c | 1 +
> examples/ipsec-secgw/sa.c | 2 +-
> lib/librte_ipsec/Makefile | 2 +-
> lib/librte_ipsec/meson.build | 1 +
> lib/librte_ipsec/rte_ipsec_sa.h | 6 ------
> lib/librte_ipsec/sa.c | 4 ++--
> 8 files changed, 15 insertions(+), 13 deletions(-)
>
> diff --git a/app/test/test_ipsec.c b/app/test/test_ipsec.c
> index 4007eff19..9e3dabd93 100644
> --- a/app/test/test_ipsec.c
> +++ b/app/test/test_ipsec.c
> @@ -689,7 +689,7 @@ fill_ipsec_param(uint32_t replay_win_sz, uint64_t flags)
>
> prm->userdata = 1;
> prm->flags = flags;
> - prm->replay_win_sz = replay_win_sz;
> + prm->ipsec_xform.replay_win_sz = replay_win_sz;
We need to do it later - as on the next line (see below),
we'll overwrite whole ipsec_xform.
>
> /* setup ipsec xform */
> prm->ipsec_xform = ut_params->ipsec_xform;
diff --git a/app/test/test_ipsec.c b/app/test/test_ipsec.c
index 9e3dabd93..7dc83fee7 100644
--- a/app/test/test_ipsec.c
+++ b/app/test/test_ipsec.c
@@ -689,11 +689,11 @@ fill_ipsec_param(uint32_t replay_win_sz, uint64_t flags)
prm->userdata = 1;
prm->flags = flags;
- prm->ipsec_xform.replay_win_sz = replay_win_sz;
/* setup ipsec xform */
prm->ipsec_xform = ut_params->ipsec_xform;
prm->ipsec_xform.salt = (uint32_t)rte_rand();
+ prm->ipsec_xform.replay_win_sz = replay_win_sz;
/* setup tunnel related fields */
prm->tun.hdr_len = sizeof(ipv4_outer);
> diff --git a/doc/guides/rel_notes/release_19_11.rst
> b/doc/guides/rel_notes/release_19_11.rst
> index ae8e7b2f0..aa16c8422 100644
> --- a/doc/guides/rel_notes/release_19_11.rst
> +++ b/doc/guides/rel_notes/release_19_11.rst
> @@ -365,6 +365,12 @@ ABI Changes
> align the Ethernet header on receive and all known encapsulations
> preserve the alignment of the header.
>
> +* security: A new field ''replay_win_sz'' has been added to the structure
> + ``rte_security_ipsec_xform``, which specify the Anti replay window size
> + to enable sequence replay attack handling.
> +
> +* ipsec: The field ''replay_win_sz'' has been removed from the structure
> + ''rte_ipsec_sa_prm'' as it has been added to the security library.
>
> Shared Library Versions
> -----------------------
> @@ -407,7 +413,7 @@ The libraries prepended with a plus sign were incremented
> in this version.
> librte_gso.so.1
> librte_hash.so.2
> librte_ip_frag.so.1
> - librte_ipsec.so.1
> + + librte_ipsec.so.2
> librte_jobstats.so.1
> librte_kni.so.2
> librte_kvargs.so.1
> @@ -437,7 +443,7 @@ The libraries prepended with a plus sign were incremented
> in this version.
> librte_reorder.so.1
> librte_ring.so.2
> + librte_sched.so.4
> - librte_security.so.2
> + + librte_security.so.3
> librte_stack.so.1
> librte_table.so.3
> librte_timer.so.1
> diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c
> index 51fb22e8a..159e81f99 100644
> --- a/examples/ipsec-secgw/ipsec.c
> +++ b/examples/ipsec-secgw/ipsec.c
> @@ -49,6 +49,7 @@ set_ipsec_conf(struct ipsec_sa *sa, struct
> rte_security_ipsec_xform *ipsec)
> /* TODO support for Transport */
> }
> ipsec->esn_soft_limit = IPSEC_OFFLOAD_ESN_SOFTLIMIT;
> + ipsec->replay_win_sz = app_sa_prm.window_size;
> }
>
> int
> diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c
> index 14ee94731..3d687c459 100644
> --- a/examples/ipsec-secgw/sa.c
> +++ b/examples/ipsec-secgw/sa.c
> @@ -1055,7 +1055,7 @@ fill_ipsec_app_sa_prm(struct rte_ipsec_sa_prm *prm,
>
> prm->flags = app_prm->flags;
> prm->ipsec_xform.options.esn = app_prm->enable_esn;
> - prm->replay_win_sz = app_prm->window_size;
> + prm->ipsec_xform.replay_win_sz = app_prm->window_size;
> }
>
> static int
> diff --git a/lib/librte_ipsec/Makefile b/lib/librte_ipsec/Makefile
> index 81fb99980..161ea9e3d 100644
> --- a/lib/librte_ipsec/Makefile
> +++ b/lib/librte_ipsec/Makefile
> @@ -14,7 +14,7 @@ LDLIBS += -lrte_cryptodev -lrte_security -lrte_hash
>
> EXPORT_MAP := rte_ipsec_version.map
>
> -LIBABIVER := 1
> +LIBABIVER := 2
>
> # all source are stored in SRCS-y
> SRCS-$(CONFIG_RTE_LIBRTE_IPSEC) += esp_inb.c
> diff --git a/lib/librte_ipsec/meson.build b/lib/librte_ipsec/meson.build
> index 70358526b..e8604dadd 100644
> --- a/lib/librte_ipsec/meson.build
> +++ b/lib/librte_ipsec/meson.build
> @@ -1,6 +1,7 @@
> # SPDX-License-Identifier: BSD-3-Clause
> # Copyright(c) 2018 Intel Corporation
>
> +version = 2
> allow_experimental_apis = true
>
> sources = files('esp_inb.c', 'esp_outb.c', 'sa.c', 'ses.c', 'ipsec_sad.c')
> diff --git a/lib/librte_ipsec/rte_ipsec_sa.h b/lib/librte_ipsec/rte_ipsec_sa.h
> index 47ce169d2..1cfde5874 100644
> --- a/lib/librte_ipsec/rte_ipsec_sa.h
> +++ b/lib/librte_ipsec/rte_ipsec_sa.h
> @@ -47,12 +47,6 @@ struct rte_ipsec_sa_prm {
> uint8_t proto; /**< next header protocol */
> } trs; /**< transport mode related parameters */
> };
> -
> - /**
> - * window size to enable sequence replay attack handling.
> - * replay checking is disabled if the window size is 0.
> - */
> - uint32_t replay_win_sz;
> };
>
> /**
> diff --git a/lib/librte_ipsec/sa.c b/lib/librte_ipsec/sa.c
> index 23d394b46..6f1d92c3c 100644
> --- a/lib/librte_ipsec/sa.c
> +++ b/lib/librte_ipsec/sa.c
> @@ -439,7 +439,7 @@ rte_ipsec_sa_size(const struct rte_ipsec_sa_prm *prm)
> return rc;
>
> /* determine required size */
> - wsz = prm->replay_win_sz;
> + wsz = prm->ipsec_xform.replay_win_sz;
> return ipsec_sa_size(type, &wsz, &nb);
> }
>
> @@ -461,7 +461,7 @@ rte_ipsec_sa_init(struct rte_ipsec_sa *sa, const struct
> rte_ipsec_sa_prm *prm,
> return rc;
>
> /* determine required size */
> - wsz = prm->replay_win_sz;
> + wsz = prm->ipsec_xform.replay_win_sz;
> sz = ipsec_sa_size(type, &wsz, &nb);
> if (sz < 0)
> return sz;
> --
> 2.17.1
