<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt"><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">Hi All,</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">I have modified the strongswan (5.0.4) code to write a new DH
using Octeon Core Crypto Library APIs. Using the load tester plugin of
strongswan (5.0.4), could able to achieve the 250k IPsec tunnels with 850+ tunnels
per second. However I found that, some of the tunnels (approximately 150-200) were
getting up. Upon debugging found that, two IKE initiators send the IKE_SA_INIT
requests with the same SPI set in the IKE header sometimes and hence generate 2
IPsec SAs with the same SPI. As a result of which, the IKE stack at Responder
end denies to configure the second <span style="mso-spacerun: yes;"> </span>IPsec
SA. For a given destination address/protocol combination, unique SPI values
must be used. </font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><font face="Calibri"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;">But with</span><span style="line-height: 115%; font-size: 12pt;"> reduced setup rate <span style="mso-spacerun: yes;"> </span>i.e.. 200+,<span style="mso-spacerun: yes;"> </span>all these (250k) tunnels are getting up
always. I think, the we need to use the gcc atomic built-in function __sync_fetch_and_add()
in get_spi() function (defined in src/libcharon/plugins/load_tester/load_tester_ipsec.c)
for atomic incrementation. <span style="mso-spacerun: yes;"> </span><span style="mso-spacerun: yes;"> </span></span></font></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">METHOD(kernel_ipsec_t, get_spi, status_t,</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri"><span style="mso-spacerun: yes;">
</span>private_load_tester_ipsec_t *this, host_t *src, host_t *dst,</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri"><span style="mso-spacerun: yes;"> </span>u_int8_t
protocol, u_int32_t reqid, u_int32_t *spi)</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">{</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">//*spi = ++this->spi;</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">*spi=(uint32_t)__sync_fetch_and_add(&this->spi,
1);<span style="mso-spacerun: yes;"> </span></font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">return SUCCESS;</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">}</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri"> </font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">Can anyone please validate and confirm whether my understanding
is correct or not? Thanks in advance for your support.</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">Note that, we are using two Multi-Core MIPS64 Processors with
16 cnMIPS64 v2 cores (one acts as an IKE initiator and another as an IKE
responder). We are running strongswan in both systems. Both the systems have
1Gbps Ethernet cards, which are connected to 1 Gbps L2 switch. The Wind River
Linux runs on all the 16 cores. </font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">Regards,</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt; mso-bidi-font-size: 11.0pt;"><font face="Calibri">Chinmaya</font></span></div><div><font face="Times New Roman">
</font><br></div></div></body></html>