Problem statement:
When IPsec traffic is forwarded in the VPP dataplane (bypassing the Linux kernel datapath), the Linux XFRM subsystem does not observe those packets. Consequently, kernel-side per-SA accounting (bytes/packets) does not reflect real traffic volume for SAs that are actively forwarding in VPP.
This can lead to incorrect or delayed behavior for kernel mechanisms that rely on XFRM counters/state, specifically:
- SA lifetime handling when configured with byte-based or packet-based limits (expiry/rekey triggers may not fire as expected).
- Kernel-side visibility/telemetry for IPsec SAs (e.g., ip -s xfrm state shows stale counters).
- Potential inconsistency for replay protection/monitoring when the kernel is not tracking traffic progression for an offloaded SA.
Goal / requirement:
Provide a mechanism that ensures Linux XFRM SA byte/packet counters (and any required related SA state) are kept sufficiently synchronized for SAs whose traffic is forwarded by VPP, so that lifetime/accounting and operational observability remain correct. Additional key criteria: the new mechanism should not impact system or packet processing performance.