Scaling IPsec processing on a virtual machine

1. A method for processing encapsulated encrypted data packets at a virtual network interface card (VNIC) on a host machine, comprising:

receiving at the VNIC an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;

determining a packet type of the encapsulated encrypted data packet based on an IP protocol number included in the first header of the encapsulated encrypted data packet;

in response to the determined packet type indicating the encapsulated encrypted data packet is a type of packet having the SPI value, calculating a hash value based at least in part on the SPI value; and

assigning the encapsulated encrypted data packet to a first VNIC receive side scaling (RSS) queue of a plurality of VNIC RSS queues associated with the VNIC based on the hash value, wherein each of the plurality of VNIC RSS queues is associated with a different virtual CPU configured to process packets in the corresponding VNIC RSS queue, wherein each virtual CPU corresponds to resources of one or more physical CPUs of the host machine.

2. The method of claim 1 , wherein the hash value is further calculated based on the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint.

3. The method of claim 1 , wherein the hash value is further calculated based on a second hash value calculated by a physical network interface card (PNIC) on the host machine for the encapsulated encrypted data packet.

4. The method of claim 1 , wherein the determined packet type is an encapsulating security payload type.

5. The method of claim 1 , further comprising:

receiving at the VNIC a second encapsulated encrypted data packet comprising a third header comprising a second SPI value different than the SPI value and a fourth header comprising the source IP address of the source endpoint and the destination IP address of the destination endpoint; and

calculating a second hash value based at least in part on the second SPI value; and

redirecting the second encapsulated encrypted data packet to the first VNIC RSS queue based on the source IP address of the source endpoint and the destination IP address of the destination endpoint being included in the second encapsulated encrypted data packet.

6. The method of claim 1 , further comprising:

receiving at the VNIC a second encapsulated encrypted data packet comprising a third header comprising a second SPI value different than the SPI value and a fourth header comprising the source IP address of the source endpoint and the destination IP address of the destination endpoint;

calculating a second hash value based at least in part on the second SPI value;

assigning the second encapsulated encrypted data packet to a second VNIC RSS queue of the plurality of VNIC RSS queues based on the second hash value; and

processing the encapsulated encrypted data packet prior to processing the second encapsulated encrypted data packet.

7. A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for processing encapsulated encrypted data packets at a virtual network interface card (VNIC) on a host machine, the method comprising:

receiving at the VNIC an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;

determining a packet type of the encapsulated encrypted data packet based on an IP protocol number included in the first header of the encapsulated encrypted data packet;

in response to the determined packet type indicating the encapsulated encrypted data packet is a type of packet having the SPI value, calculating a hash value based at least in part on the SPI value; and

assigning the encapsulated encrypted data packet to a first VNIC receive side scaling (RSS) queue of a plurality of VNIC RSS queues associated with the VNIC based on the hash value, wherein each of the plurality of VNIC RSS queues is associated with a different virtual CPU configured to process packets in the corresponding VNIC RSS queue, wherein each virtual CPU corresponds to resources of one or more physical CPUs of the host machine.

8. The non-transitory computer readable medium of claim 7 , wherein the hash value is further calculated based on the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint.

9. The non-transitory computer readable medium of claim 7 , wherein the hash value is further calculated based on a second hash value calculated by a physical network interface card (PNIC) on the host machine for the encapsulated encrypted data packet.

10. The non-transitory computer readable medium of claim 7 , wherein the determined packet type is an encapsulating security payload type.

11. The non-transitory computer readable medium of claim 7 , wherein the method further comprises:

receiving at the VNIC a second encapsulated encrypted data packet comprising a third header comprising a second SPI value different than the SPI value and a fourth header comprising the source IP address of the source endpoint and the destination IP address of the destination endpoint; and

calculating a second hash value based at least in part on the second SPI value; and

redirecting the second encapsulated encrypted data packet to the first VNIC RSS queue based on the source IP address of the source endpoint and the destination IP address of the destination endpoint being included in the second encapsulated encrypted data packet.

12. The non-transitory computer readable medium of claim 7 , wherein the method further comprises:

receiving at the VNIC a second encapsulated encrypted data packet comprising a third header comprising a second SPI value different than the SPI value and a fourth header comprising the source IP address of the source endpoint and the destination IP address of the destination endpoint;

calculating a second hash value based at least in part on the second SPI value;

assigning the second encapsulated encrypted data packet to a second VNIC RSS queue of the plurality of VNIC RSS queues based on the second hash value; and

processing the encapsulated encrypted data packet prior to processing the second encapsulated encrypted data packet.

13. A computer system, comprising:

a memory; and

one or more processors coupled to the memory, the one or more processors being configured to:

receive at a virtual network interface card (VNIC) an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;

determine a packet type of the encapsulated encrypted data packet based on an IP protocol number included in the first header of the encapsulated encrypted data packet;

in response to the determined packet type indicating the encapsulated encrypted data packet is a type of packet having the SPI value, calculate a hash value based at least in part on the SPI value; and

assign the encapsulated encrypted data packet to a first VNIC receive side scaling (RSS) queue of a plurality of VNIC RSS queues associated with the VNIC based on the hash value, wherein each of the plurality of VNIC RSS queues is associated with a different virtual CPU configured to process packets in the corresponding VNIC RSS queue.

14. The computer system of claim 13 , wherein the hash value is further calculated based on the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint.

15. The computer system of claim 13 , wherein the hash value is further calculated based on a second hash value calculated by a physical network interface card (PNIC) on the computer system for the encapsulated encrypted data packet.

16. The computer system of claim 13 , wherein the determined packet type is an encapsulating security payload type.

17. The computer system of claim 13 , wherein each virtual CPU corresponds to resources of one or more of the one or more processors.

18. The computer system of claim 13 , wherein the one or more processors are further configured to:

receive at the VNIC a second encapsulated encrypted data packet comprising a third header comprising a second SPI value different than the SPI value and a fourth header comprising the source IP address of the source endpoint and the destination IP address of the destination endpoint;

calculate a second hash value based at least in part on the second SPI value; and

redirect the second encapsulated encrypted data packet to the first VNIC RSS queue based on the source IP address of the source endpoint and the destination IP address of the destination endpoint being included in the second encapsulated encrypted data packet.

19. The computer system of claim 13 , wherein the one or more processors are further configured to:

receive at the VNIC a second encapsulated encrypted data packet comprising a third header comprising a second SPI value different than the SPI value and a fourth header comprising the source IP address of the source endpoint and the destination IP address of the destination endpoint;

calculate a second hash value based at least in part on the second SPI value;

assigning the second encapsulated encrypted data packet to a second VNIC RSS queue of the plurality of VNIC RSS queues based on the second hash value; and

process the encapsulated encrypted data packet prior to processing the second encapsulated encrypted data packet.

20. A method for processing encapsulated encrypted data packets at a physical network interface card (PNIC) on a computing device, comprising:

receiving at the PNIC an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;

determining a packet type of the encapsulated encrypted data packet based on an IP protocol number included in the first header of the encapsulated encrypted data packet;

in response to the determined packet type indicating the encapsulated encrypted data packet is a type of packet having the SPI value, calculating a hash value based at least in part on the SPI value; and

assigning the encapsulated encrypted data packet to a first PNIC receive side scaling (RSS) queue of a plurality of PNIC RSS queues associated with the PNIC based on the hash value, wherein the hash value is further calculated based on the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint.