[Openswan Users] Fwd: How openswan work with ocf and ixp4xx hardware acceleration?

David McCullough David_Mccullough at securecomputing.com
Wed Jan 27 07:05:51 EST 2010


Jivin mix.kao lays it down ...
> Hello David,
> 
> Before i start openswan, i do
> 
> insmod ocf.ko
> insmod cryptodev.ko
> insmod ixp4xx.ko
> insmod ipsec.ko
> 
> or
> 
> insmod ocf.ko
> insmod ixp4xx.ko
> insmod cryptodev.ko
> insmod ipsec.ko
> 
> then ipsec setup start
> 
> the same result of lsmod below
> 
>  >> Module                  Size  Used by
>  >> ecb                     1152  0
>  >> cbc                     1696  0
>  >> md5                     3872  0
>  >> cryptomgr              71408  0
>  >> crypto_blkcipher        6468  3 ecb,cbc,cryptomgr
>  >> aead                    3200  1 cryptomgr
>  >> des_generic            16128  0
>  >> crypto_algapi           7680  7
>  >> ecb,cbc,md5,cryptomgr,crypto_blkcipher,aead,des_generic
>  >> ipsec                 337716  2
>  >> ixp4xx                  6992  0
>  >> cryptodev               9732  0
>  >> ocf                    15304  2 ixp4xx,cryptodev
>  >> nfnetlink_log           5064  0
>  >> nfnetlink               1528  1 nfnetlink_log
>  >> iptable_filter           896  0
>  >> ip_tables               8080  1 iptable_filter
>  >> ebtable_filter           768  1
>  >> ebtables               13504  1 ebtable_filter
>  >> ipt_ULOG                3780  0
>  >> nf_nat_ftp              1216  0
>  >> nf_conntrack_ftp        4512  1 nf_nat_ftp
>  >> nf_nat                  9582  1 nf_nat_ftp
>  >> xt_recent               4920  0
>  >> x_tables                7044  4 ip_tables,ebtables,ipt_ULOG,xt_recent
>  >> ixp400_eth             16368  1
>  >> ixp400_oslinux        196804  2 ixp4xx,ixp400_eth
>  >> loop                    8908  2

Thats fine.

> i manually remove modules below:
> rmmod ecb cbc md5 cryptomgr crypto_blkcipher aead des_generic crypto_algapi

You do not need to do this.

> then built the tunnel between two box use point to point tunnel mode
> 
> one of config likes below
> 
> ipsec.conf
> 
> version 2.0
> 
> config setup
>          interfaces="ipsec1=eth2"
>          protostack=klips
>          klipsdebug=verbose
>          #plutodebug=verbose
>          #uniqueids=yes
>          #plutostderrlog="/tmp/pluto.log"
> 
> conn mix
>          ike=des
>          esp=aes
>          authby=secret
>          pfs=no
>          auto=add
>          keyingtries=3
>          rekey=no
>          ikelifetime=8h
>          keylife=1h
>          type=tunnel
>          left=10.2.3.156
>          right=10.30.17.95
> 
> 
> ipsec.secrets
> 
> 10.2.3.156 10.30.17.95 : PSK "12345"
> 
> 
> then two box can ping each other, capture the packet will get ESP
> 
> after manually remove kernel cryptoapi related modules
> 
> Module                  Size  Used by
> ipsec                 337716  2
> cryptodev               9732  0
> ixp4xx                  6992  0
> ocf                    15304  2 cryptodev,ixp4xx
> nfnetlink_log           5064  0
> nfnetlink               1528  1 nfnetlink_log
> iptable_filter           896  0
> ip_tables               8080  1 iptable_filter
> ebtable_filter           768  1
> ebtables               13504  1 ebtable_filter
> ipt_ULOG                3780  0
> nf_nat_ftp              1216  0
> nf_conntrack_ftp        4512  1 nf_nat_ftp
> nf_nat                  9582  1 nf_nat_ftp
> xt_recent               4920  0
> x_tables                7044  4 ip_tables,ebtables,ipt_ULOG,xt_recent
> ixp400_eth             16368  1
> ixp400_oslinux        196804  2 ixp4xx,ixp400_eth
> loop                    8908  2
> 
> 
> Can i say now the crypto is calculated by hardware?

You can be sure that OCF acceleration is active  a couple of ways.
You can enable klips debug (klipsdebug --all) and look for ocf callbacks etc
in the kernel trace when you do a ping.

The easier way is just enable debug in the ixp4xx driver:

	echo 1 > /sys/modules/ixp4xx/parameters/ixp_debug

Send some pings and check for ixp4xx kernel debug.  You can turn it off then
with:

	echo 0 > /sys/modules/ixp4xx/parameters/ixp_debug

Cheers,
Davidm

> On 01/27/2010 06:43 PM, David McCullough wrote:
> >
> > Jivin mix.kao lays it down ...
> >> Hi Paul,
> >>
> >> I have set the HAVE_OCF?=true in openswan Makefile.inc
> >>
> >> When i start the openswan with command ipsec setup start, i noticed the
> >> _startklips script always do modprobe to load crypto modules like md5,
> >> des, cbc, twofish....
> >>
> >>
> >> # first load any crypto modules we might need for acceleration
> >>           modprobe -q padlock 2>/dev/null
> >>           modprobe -q padlock-aes 2>/dev/null
> >>           modprobe -q padlock-sha 2>/dev/null
> >>           # load the most common ciphers/algo's
> >>           # aes-x86_64 has higher priority in via crypto api
> >>           for crypto in aes-x86_64 aes aes_generic des sha512 sha256 md5
> >> cbc xcbc ecb twofish blowfish serpent ccm
> >>                   do
> >>                           echo -n "$crypto "
> >>                           modprobe -q $crypto 2>  /dev/null
> >> done
> >>
> >>
> >> And i can see the current modules by lsmodAnd i can see the current
> >> modules by lsmod
> >>
> >> Is the module status ok to have the OCF support?
> >> Or i still don't get OCF support?
> >
> >
> > To get OCF support on an IXP you need to load the modules in the following
> > order early in the boot before starting pluto/ipsec etc:
> >
> > 	modprobe ocf
> > 	modprobe ixp4xx
> > 	modprobe cryptodev
> > 	modprobe ipsec
> >
> > You need to have OCF/ixp4xx loaded before klips so that the ALG support is
> > detected fully.
> >
> > The KLIPS config should look something like like:
> >
> > 	CONFIG_KLIPS=m
> > 	# KLIPS options
> > 	CONFIG_KLIPS_ESP=y
> > 	CONFIG_KLIPS_AH=y
> > 	# CONFIG_KLIPS_AUTH_HMAC_MD5 is not set
> > 	# CONFIG_KLIPS_AUTH_HMAC_SHA1 is not set
> > 	# CONFIG_KLIPS_ALG is not set
> > 	# CONFIG_KLIPS_ENC_3DES is not set
> > 	CONFIG_KLIPS_IPCOMP=y
> > 	CONFIG_KLIPS_OCF=y
> > 	CONFIG_KLIPS_DEBUG=y
> > 	CONFIG_KLIPS_IF_MAX=4
> >
> > Cheers,
> > Davidm
> >
> > 	
> >>
> >> Module                  Size  Used by
> >> ecb                     1152  0
> >> cbc                     1696  0
> >> md5                     3872  0
> >> cryptomgr              71408  0
> >> crypto_blkcipher        6468  3 ecb,cbc,cryptomgr
> >> aead                    3200  1 cryptomgr
> >> des_generic            16128  0
> >> crypto_algapi           7680  7
> >> ecb,cbc,md5,cryptomgr,crypto_blkcipher,aead,des_generic
> >> ipsec                 337716  2
> >> ixp4xx                  6992  0
> >> cryptodev               9732  0
> >> ocf                    15304  2 ixp4xx,cryptodev
> >> nfnetlink_log           5064  0
> >> nfnetlink               1528  1 nfnetlink_log
> >> iptable_filter           896  0
> >> ip_tables               8080  1 iptable_filter
> >> ebtable_filter           768  1
> >> ebtables               13504  1 ebtable_filter
> >> ipt_ULOG                3780  0
> >> nf_nat_ftp              1216  0
> >> nf_conntrack_ftp        4512  1 nf_nat_ftp
> >> nf_nat                  9582  1 nf_nat_ftp
> >> xt_recent               4920  0
> >> x_tables                7044  4 ip_tables,ebtables,ipt_ULOG,xt_recent
> >> ixp400_eth             16368  1
> >> ixp400_oslinux        196804  2 ixp4xx,ixp400_eth
> >> loop                    8908  2
> >> _______________________________________________
> >> Users at openswan.org
> >> http://lists.openswan.org/mailman/listinfo/users
> >> Building and Integrating Virtual Private Networks with Openswan:
> >> http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155
> >>
> >>
> >
> 
> 
> 

-- 
David McCullough,  david_mccullough at securecomputing.com,  Ph:+61 734352815
McAfee - SnapGear  http://www.snapgear.com                http://www.uCdot.org


More information about the Users mailing list