From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by dpdk.org (Postfix) with ESMTP id CA03A4CA6 for ; Fri, 29 Mar 2019 11:28:07 +0100 (CET) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 29 Mar 2019 03:28:07 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.60,284,1549958400"; d="scan'208";a="131234695" Received: from sivswdev08.ir.intel.com ([10.237.217.47]) by orsmga006.jf.intel.com with ESMTP; 29 Mar 2019 03:28:05 -0700 From: Konstantin Ananyev To: dev@dpdk.org Cc: akhil.goyal@nxp.com, olivier.matz@6wind.com, Konstantin Ananyev Date: Fri, 29 Mar 2019 10:27:23 +0000 Message-Id: <20190329102726.27716-7-konstantin.ananyev@intel.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20190329102726.27716-1-konstantin.ananyev@intel.com> References: <20190326154320.29913-1-konstantin.ananyev@intel.com> <20190329102726.27716-1-konstantin.ananyev@intel.com> Subject: [dpdk-dev] [PATCH v4 6/9] ipsec: reorder packet check for esp inbound X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 10:28:08 -0000 Right now check for packet length and padding is done inside cop_prepare(). It makes sense to have all necessary checks in one place at early stage: inside pkt_prepare(). That allows to simplify (and later hopefully) optimize cop_prepare() part. Signed-off-by: Konstantin Ananyev Acked-by: Akhil Goyal --- lib/librte_ipsec/esp_inb.c | 41 +++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 23 deletions(-) diff --git a/lib/librte_ipsec/esp_inb.c b/lib/librte_ipsec/esp_inb.c index a775c7b0b..8d1171556 100644 --- a/lib/librte_ipsec/esp_inb.c +++ b/lib/librte_ipsec/esp_inb.c @@ -18,7 +18,7 @@ /* * setup crypto op and crypto sym op for ESP inbound tunnel packet. */ -static inline int32_t +static inline void inb_cop_prepare(struct rte_crypto_op *cop, const struct rte_ipsec_sa *sa, struct rte_mbuf *mb, const union sym_op_data *icv, uint32_t pofs, uint32_t plen) @@ -27,11 +27,7 @@ inb_cop_prepare(struct rte_crypto_op *cop, struct aead_gcm_iv *gcm; struct aesctr_cnt_blk *ctr; uint64_t *ivc, *ivp; - uint32_t algo, clen; - - clen = plen - sa->ctp.cipher.length; - if ((int32_t)clen < 0 || (clen & (sa->pad_align - 1)) != 0) - return -EINVAL; + uint32_t algo; algo = sa->algo_type; @@ -41,7 +37,7 @@ inb_cop_prepare(struct rte_crypto_op *cop, switch (algo) { case ALGO_TYPE_AES_GCM: sop->aead.data.offset = pofs + sa->ctp.cipher.offset; - sop->aead.data.length = clen; + sop->aead.data.length = plen - sa->ctp.cipher.length; sop->aead.digest.data = icv->va; sop->aead.digest.phys_addr = icv->pa; sop->aead.aad.data = icv->va + sa->icv_len; @@ -57,7 +53,7 @@ inb_cop_prepare(struct rte_crypto_op *cop, case ALGO_TYPE_AES_CBC: case ALGO_TYPE_3DES_CBC: sop->cipher.data.offset = pofs + sa->ctp.cipher.offset; - sop->cipher.data.length = clen; + sop->cipher.data.length = plen - sa->ctp.cipher.length; sop->auth.data.offset = pofs + sa->ctp.auth.offset; sop->auth.data.length = plen - sa->ctp.auth.length; sop->auth.digest.data = icv->va; @@ -71,7 +67,7 @@ inb_cop_prepare(struct rte_crypto_op *cop, break; case ALGO_TYPE_AES_CTR: sop->cipher.data.offset = pofs + sa->ctp.cipher.offset; - sop->cipher.data.length = clen; + sop->cipher.data.length = plen - sa->ctp.cipher.length; sop->auth.data.offset = pofs + sa->ctp.auth.offset; sop->auth.data.length = plen - sa->ctp.auth.length; sop->auth.digest.data = icv->va; @@ -86,17 +82,13 @@ inb_cop_prepare(struct rte_crypto_op *cop, break; case ALGO_TYPE_NULL: sop->cipher.data.offset = pofs + sa->ctp.cipher.offset; - sop->cipher.data.length = clen; + sop->cipher.data.length = plen - sa->ctp.cipher.length; sop->auth.data.offset = pofs + sa->ctp.auth.offset; sop->auth.data.length = plen - sa->ctp.auth.length; sop->auth.digest.data = icv->va; sop->auth.digest.phys_addr = icv->pa; break; - default: - return -EINVAL; } - - return 0; } /* @@ -132,7 +124,7 @@ inb_pkt_prepare(const struct rte_ipsec_sa *sa, const struct replay_sqn *rsn, { int32_t rc; uint64_t sqn; - uint32_t icv_ofs, plen; + uint32_t clen, icv_ofs, plen; struct rte_mbuf *ml; struct esp_hdr *esph; @@ -159,6 +151,11 @@ inb_pkt_prepare(const struct rte_ipsec_sa *sa, const struct replay_sqn *rsn, ml = rte_pktmbuf_lastseg(mb); icv_ofs = ml->data_len - sa->icv_len + sa->sqh_len; + /* check that packet has a valid length */ + clen = plen - sa->ctp.cipher.length; + if ((int32_t)clen < 0 || (clen & (sa->pad_align - 1)) != 0) + return -EBADMSG; + /* we have to allocate space for AAD somewhere, * right now - just use free trailing space at the last segment. * Would probably be more convenient to reserve space for AAD @@ -201,21 +198,19 @@ esp_inb_pkt_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], rc = inb_pkt_prepare(sa, rsn, mb[i], hl, &icv); if (rc >= 0) { lksd_none_cop_prepare(cop[k], cs, mb[i]); - rc = inb_cop_prepare(cop[k], sa, mb[i], &icv, hl, rc); - } - - k += (rc == 0); - if (rc != 0) { + inb_cop_prepare(cop[k], sa, mb[i], &icv, hl, rc); + k++; + } else dr[i - k] = i; - rte_errno = -rc; - } } rsn_release(sa, rsn); /* copy not prepared mbufs beyond good ones */ - if (k != num && k != 0) + if (k != num && k != 0) { move_bad_mbufs(mb, dr, num, num - k); + rte_errno = EBADMSG; + } return k; } -- 2.17.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by dpdk.space (Postfix) with ESMTP id C7ACFA05D3 for ; Fri, 29 Mar 2019 11:28:37 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id C32DF4F98; Fri, 29 Mar 2019 11:28:19 +0100 (CET) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by dpdk.org (Postfix) with ESMTP id CA03A4CA6 for ; Fri, 29 Mar 2019 11:28:07 +0100 (CET) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 29 Mar 2019 03:28:07 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.60,284,1549958400"; d="scan'208";a="131234695" Received: from sivswdev08.ir.intel.com ([10.237.217.47]) by orsmga006.jf.intel.com with ESMTP; 29 Mar 2019 03:28:05 -0700 From: Konstantin Ananyev To: dev@dpdk.org Cc: akhil.goyal@nxp.com, olivier.matz@6wind.com, Konstantin Ananyev Date: Fri, 29 Mar 2019 10:27:23 +0000 Message-Id: <20190329102726.27716-7-konstantin.ananyev@intel.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20190329102726.27716-1-konstantin.ananyev@intel.com> References: <20190326154320.29913-1-konstantin.ananyev@intel.com> <20190329102726.27716-1-konstantin.ananyev@intel.com> Subject: [dpdk-dev] [PATCH v4 6/9] ipsec: reorder packet check for esp inbound X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Content-Type: text/plain; charset="UTF-8" Message-ID: <20190329102723.WJl5tEaFTjsfNsvP8-YPbEAcn3xfMi9TAIyFaRJ-40Q@z> Right now check for packet length and padding is done inside cop_prepare(). It makes sense to have all necessary checks in one place at early stage: inside pkt_prepare(). That allows to simplify (and later hopefully) optimize cop_prepare() part. Signed-off-by: Konstantin Ananyev Acked-by: Akhil Goyal --- lib/librte_ipsec/esp_inb.c | 41 +++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 23 deletions(-) diff --git a/lib/librte_ipsec/esp_inb.c b/lib/librte_ipsec/esp_inb.c index a775c7b0b..8d1171556 100644 --- a/lib/librte_ipsec/esp_inb.c +++ b/lib/librte_ipsec/esp_inb.c @@ -18,7 +18,7 @@ /* * setup crypto op and crypto sym op for ESP inbound tunnel packet. */ -static inline int32_t +static inline void inb_cop_prepare(struct rte_crypto_op *cop, const struct rte_ipsec_sa *sa, struct rte_mbuf *mb, const union sym_op_data *icv, uint32_t pofs, uint32_t plen) @@ -27,11 +27,7 @@ inb_cop_prepare(struct rte_crypto_op *cop, struct aead_gcm_iv *gcm; struct aesctr_cnt_blk *ctr; uint64_t *ivc, *ivp; - uint32_t algo, clen; - - clen = plen - sa->ctp.cipher.length; - if ((int32_t)clen < 0 || (clen & (sa->pad_align - 1)) != 0) - return -EINVAL; + uint32_t algo; algo = sa->algo_type; @@ -41,7 +37,7 @@ inb_cop_prepare(struct rte_crypto_op *cop, switch (algo) { case ALGO_TYPE_AES_GCM: sop->aead.data.offset = pofs + sa->ctp.cipher.offset; - sop->aead.data.length = clen; + sop->aead.data.length = plen - sa->ctp.cipher.length; sop->aead.digest.data = icv->va; sop->aead.digest.phys_addr = icv->pa; sop->aead.aad.data = icv->va + sa->icv_len; @@ -57,7 +53,7 @@ inb_cop_prepare(struct rte_crypto_op *cop, case ALGO_TYPE_AES_CBC: case ALGO_TYPE_3DES_CBC: sop->cipher.data.offset = pofs + sa->ctp.cipher.offset; - sop->cipher.data.length = clen; + sop->cipher.data.length = plen - sa->ctp.cipher.length; sop->auth.data.offset = pofs + sa->ctp.auth.offset; sop->auth.data.length = plen - sa->ctp.auth.length; sop->auth.digest.data = icv->va; @@ -71,7 +67,7 @@ inb_cop_prepare(struct rte_crypto_op *cop, break; case ALGO_TYPE_AES_CTR: sop->cipher.data.offset = pofs + sa->ctp.cipher.offset; - sop->cipher.data.length = clen; + sop->cipher.data.length = plen - sa->ctp.cipher.length; sop->auth.data.offset = pofs + sa->ctp.auth.offset; sop->auth.data.length = plen - sa->ctp.auth.length; sop->auth.digest.data = icv->va; @@ -86,17 +82,13 @@ inb_cop_prepare(struct rte_crypto_op *cop, break; case ALGO_TYPE_NULL: sop->cipher.data.offset = pofs + sa->ctp.cipher.offset; - sop->cipher.data.length = clen; + sop->cipher.data.length = plen - sa->ctp.cipher.length; sop->auth.data.offset = pofs + sa->ctp.auth.offset; sop->auth.data.length = plen - sa->ctp.auth.length; sop->auth.digest.data = icv->va; sop->auth.digest.phys_addr = icv->pa; break; - default: - return -EINVAL; } - - return 0; } /* @@ -132,7 +124,7 @@ inb_pkt_prepare(const struct rte_ipsec_sa *sa, const struct replay_sqn *rsn, { int32_t rc; uint64_t sqn; - uint32_t icv_ofs, plen; + uint32_t clen, icv_ofs, plen; struct rte_mbuf *ml; struct esp_hdr *esph; @@ -159,6 +151,11 @@ inb_pkt_prepare(const struct rte_ipsec_sa *sa, const struct replay_sqn *rsn, ml = rte_pktmbuf_lastseg(mb); icv_ofs = ml->data_len - sa->icv_len + sa->sqh_len; + /* check that packet has a valid length */ + clen = plen - sa->ctp.cipher.length; + if ((int32_t)clen < 0 || (clen & (sa->pad_align - 1)) != 0) + return -EBADMSG; + /* we have to allocate space for AAD somewhere, * right now - just use free trailing space at the last segment. * Would probably be more convenient to reserve space for AAD @@ -201,21 +198,19 @@ esp_inb_pkt_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], rc = inb_pkt_prepare(sa, rsn, mb[i], hl, &icv); if (rc >= 0) { lksd_none_cop_prepare(cop[k], cs, mb[i]); - rc = inb_cop_prepare(cop[k], sa, mb[i], &icv, hl, rc); - } - - k += (rc == 0); - if (rc != 0) { + inb_cop_prepare(cop[k], sa, mb[i], &icv, hl, rc); + k++; + } else dr[i - k] = i; - rte_errno = -rc; - } } rsn_release(sa, rsn); /* copy not prepared mbufs beyond good ones */ - if (k != num && k != 0) + if (k != num && k != 0) { move_bad_mbufs(mb, dr, num, num - k); + rte_errno = EBADMSG; + } return k; } -- 2.17.1