From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by dpdk.space (Postfix) with ESMTP id B1299A0679 for ; Tue, 30 Apr 2019 16:56:08 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 4329158FE; Tue, 30 Apr 2019 16:56:07 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0b-0016f401.pphosted.com [67.231.156.173]) by dpdk.org (Postfix) with ESMTP id AF9EA56A3 for ; Tue, 30 Apr 2019 16:56:05 +0200 (CEST) Received: from pps.filterd (m0045851.ppops.net [127.0.0.1]) by mx0b-0016f401.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x3UEe7FQ027935; Tue, 30 Apr 2019 07:56:04 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : mime-version : content-type; s=pfpt0818; bh=7fxLoGZntJNrHh+GiHVpd5H6c+qFFI8gXjg1mTIXafM=; b=aYarp0vniS+nVw0WC1VGoLHpqOWPHjCMt48U1MdsAuTbMfCf4FhXfkKxZQfPt1Fg3AWR 8BmpH72nCZy9LQtwNW32p/t5a81m+ZNbI/jPZPVBBsj6CYVda+2t7RI5ncPHskXRI5Wm BZrUeBlZ/uCZviM5kIajFtPOFUljwDNeN419kcblLK9gYbeVf4685ouw7GKvhRT+nG2i zzYdISwtMxcDDGp6sGP8cvHmp5XEwURX2fWHGim3lTSEQt1vxq+3TxmZdIyMS1JcFej7 iaHQmYFfBDAWC3RkPqWB/SXzQLrKIYGIz9ObeoF9N9/CLJRnsD+BmI4HqPg4/w6FRjYc dQ== Received: from sc-exch03.marvell.com ([199.233.58.183]) by mx0b-0016f401.pphosted.com with ESMTP id 2s68rt39rw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 30 Apr 2019 07:56:03 -0700 Received: from SC-EXCH01.marvell.com (10.93.176.81) by SC-EXCH03.marvell.com (10.93.176.83) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 30 Apr 2019 07:55:59 -0700 Received: from maili.marvell.com (10.93.176.43) by SC-EXCH01.marvell.com (10.93.176.81) with Microsoft SMTP Server id 15.0.1367.3 via Frontend Transport; Tue, 30 Apr 2019 07:55:59 -0700 Received: from luke.marvell.com (unknown [10.95.130.15]) by maili.marvell.com (Postfix) with ESMTP id 4D6713F703F; Tue, 30 Apr 2019 07:55:58 -0700 (PDT) From: Lukasz Bartosik To: CC: , , Lukasz Bartosik Date: Tue, 30 Apr 2019 16:55:55 +0200 Message-ID: <1556636155-26299-1-git-send-email-lbartosik@marvell.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-04-30_07:, , signatures=0 Subject: [dpdk-dev] [PATCH] ipsec: include high order bytes of esn in pkt len X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Message-ID: <20190430145555.8jQq0vH_r368NdJqUDQRDcEy48qks2GDbLrFHsTtghE@z> When esn is used then high-order 32 bits are included in ICV calculation however are not transmitted. Update packet length to be consistent with auth data offset and length before crypto operation. High-order 32 bits of esn will be removed from packet length in crypto post processing. Change-Id: I5ba50e341059a8d6a5e4ce7c626dfe7b9173740b Signed-off-by: Lukasz Bartosik --- lib/librte_ipsec/esp_inb.c | 56 +++++++++++++++++++++++++++++++++++++-------- lib/librte_ipsec/esp_outb.c | 31 +++++++++++++++++++++++++ lib/librte_ipsec/sa.c | 4 ++-- lib/librte_ipsec/sa.h | 8 +++++++ 4 files changed, 87 insertions(+), 12 deletions(-) diff --git a/lib/librte_ipsec/esp_inb.c b/lib/librte_ipsec/esp_inb.c index 4e0e12a..eb899e3 100644 --- a/lib/librte_ipsec/esp_inb.c +++ b/lib/librte_ipsec/esp_inb.c @@ -16,7 +16,8 @@ #include "pad.h" typedef uint16_t (*esp_inb_process_t)(const struct rte_ipsec_sa *sa, - struct rte_mbuf *mb[], uint32_t sqn[], uint32_t dr[], uint16_t num); + struct rte_mbuf *mb[], uint32_t sqn[], uint32_t dr[], uint16_t num, + uint8_t is_inline); /* * helper function to fill crypto_sym op for cipher+auth algorithms. @@ -181,6 +182,15 @@ inb_pkt_prepare(const struct rte_ipsec_sa *sa, const struct replay_sqn *rsn, icv->va = rte_pktmbuf_mtod_offset(ml, void *, icv_ofs); icv->pa = rte_pktmbuf_iova_offset(ml, icv_ofs); + /* + * if esn is used then high-order 32 bits are also used in ICV + * calculation but are not transmitted, update packet length + * to be consistent with auth data length and offset, this will + * be subtracted from packet length in post crypto processing + */ + mb->pkt_len += sa->sqh_len; + ml->data_len += sa->sqh_len; + inb_pkt_xprepare(sa, sqn, icv); return plen; } @@ -373,14 +383,20 @@ tun_process_step3(struct rte_mbuf *mb, uint64_t txof_msk, uint64_t txof_val) */ static inline uint16_t tun_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[], - uint32_t sqn[], uint32_t dr[], uint16_t num) + uint32_t sqn[], uint32_t dr[], uint16_t num, uint8_t is_inline) { uint32_t adj, i, k, tl; uint32_t hl[num]; struct esp_tail espt[num]; struct rte_mbuf *ml[num]; - const uint32_t tlen = sa->icv_len + sizeof(espt[0]); + /* + * remove high-order 32 bits of esn from packet length + * which was added before crypto processing, this doesn't + * apply to inline case + */ + const uint32_t tlen = sa->icv_len + sizeof(espt[0]) + + (is_inline ? 0 : sa->sqh_len); const uint32_t cofs = sa->ctp.cipher.offset; /* @@ -420,7 +436,7 @@ tun_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[], */ static inline uint16_t trs_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[], - uint32_t sqn[], uint32_t dr[], uint16_t num) + uint32_t sqn[], uint32_t dr[], uint16_t num, uint8_t is_inline) { char *np; uint32_t i, k, l2, tl; @@ -428,7 +444,13 @@ trs_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[], struct esp_tail espt[num]; struct rte_mbuf *ml[num]; - const uint32_t tlen = sa->icv_len + sizeof(espt[0]); + /* + * remove high-order 32 bits of esn from packet length + * which was added before crypto processing, this doesn't + * apply to inline case + */ + const uint32_t tlen = sa->icv_len + sizeof(espt[0]) + + (is_inline ? 0 : sa->sqh_len); const uint32_t cofs = sa->ctp.cipher.offset; /* @@ -496,8 +518,8 @@ esp_inb_rsn_update(struct rte_ipsec_sa *sa, const uint32_t sqn[], * process group of ESP inbound packets. */ static inline uint16_t -esp_inb_pkt_process(const struct rte_ipsec_session *ss, - struct rte_mbuf *mb[], uint16_t num, esp_inb_process_t process) +esp_inb_pkt_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], + uint16_t num, uint8_t is_inline, esp_inb_process_t process) { uint32_t k, n; struct rte_ipsec_sa *sa; @@ -507,7 +529,7 @@ esp_inb_pkt_process(const struct rte_ipsec_session *ss, sa = ss->sa; /* process packets, extract seq numbers */ - k = process(sa, mb, sqn, dr, num); + k = process(sa, mb, sqn, dr, num, is_inline); /* handle unprocessed mbufs */ if (k != num && k != 0) @@ -533,7 +555,14 @@ uint16_t esp_inb_tun_pkt_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint16_t num) { - return esp_inb_pkt_process(ss, mb, num, tun_process); + return esp_inb_pkt_process(ss, mb, num, 0, tun_process); +} + +uint16_t +inline_inb_tun_pkt_process(const struct rte_ipsec_session *ss, + struct rte_mbuf *mb[], uint16_t num) +{ + return esp_inb_pkt_process(ss, mb, num, 1, tun_process); } /* @@ -543,5 +572,12 @@ uint16_t esp_inb_trs_pkt_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint16_t num) { - return esp_inb_pkt_process(ss, mb, num, trs_process); + return esp_inb_pkt_process(ss, mb, num, 0, trs_process); +} + +uint16_t +inline_inb_trs_pkt_process(const struct rte_ipsec_session *ss, + struct rte_mbuf *mb[], uint16_t num) +{ + return esp_inb_pkt_process(ss, mb, num, 1, trs_process); } diff --git a/lib/librte_ipsec/esp_outb.c b/lib/librte_ipsec/esp_outb.c index c798bc4..71a595e 100644 --- a/lib/librte_ipsec/esp_outb.c +++ b/lib/librte_ipsec/esp_outb.c @@ -221,6 +221,7 @@ esp_outb_tun_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint32_t i, k, n; uint64_t sqn; rte_be64_t sqc; + struct rte_mbuf *ml; struct rte_ipsec_sa *sa; struct rte_cryptodev_sym_session *cs; union sym_op_data icv; @@ -246,6 +247,19 @@ esp_outb_tun_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], /* success, setup crypto op */ if (rc >= 0) { + /* + * if esn is used then high-order 32 bits are also + * used in ICV calculation but are not transmitted, + * update packet length to be consistent with auth + * data length and offset, this will be subtracted + * from packet length in post crypto processing + */ + if (sa->sqh_len) { + mb[i]->pkt_len += sa->sqh_len; + ml = rte_pktmbuf_lastseg(mb[i]); + ml->data_len += sa->sqh_len; + } + outb_pkt_xprepare(sa, sqc, &icv); lksd_none_cop_prepare(cop[k], cs, mb[i]); outb_cop_prepare(cop[k], sa, iv, &icv, 0, rc); @@ -356,6 +370,7 @@ esp_outb_trs_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint32_t i, k, n, l2, l3; uint64_t sqn; rte_be64_t sqc; + struct rte_mbuf *ml; struct rte_ipsec_sa *sa; struct rte_cryptodev_sym_session *cs; union sym_op_data icv; @@ -384,6 +399,19 @@ esp_outb_trs_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], /* success, setup crypto op */ if (rc >= 0) { + /* + * if esn is used then high-order 32 bits are also + * used in ICV calculation but are not transmitted, + * update packet length to be consistent with auth + * data length and offset, this will be subtracted + * from packet length in post crypto processing + */ + if (sa->sqh_len) { + mb[i]->pkt_len += sa->sqh_len; + ml = rte_pktmbuf_lastseg(mb[i]); + ml->data_len += sa->sqh_len; + } + outb_pkt_xprepare(sa, sqc, &icv); lksd_none_cop_prepare(cop[k], cs, mb[i]); outb_cop_prepare(cop[k], sa, iv, &icv, l2 + l3, rc); @@ -425,6 +453,9 @@ esp_outb_sqh_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], for (i = 0; i != num; i++) { if ((mb[i]->ol_flags & PKT_RX_SEC_OFFLOAD_FAILED) == 0) { ml = rte_pktmbuf_lastseg(mb[i]); + /* remove high-order 32 bits of esn from packet len */ + mb[i]->pkt_len -= sa->sqh_len; + ml->data_len -= sa->sqh_len; icv = rte_pktmbuf_mtod_offset(ml, void *, ml->data_len - icv_len); remove_sqh(icv, icv_len); diff --git a/lib/librte_ipsec/sa.c b/lib/librte_ipsec/sa.c index 846e317..ff01358 100644 --- a/lib/librte_ipsec/sa.c +++ b/lib/librte_ipsec/sa.c @@ -610,10 +610,10 @@ inline_crypto_pkt_func_select(const struct rte_ipsec_sa *sa, switch (sa->type & msk) { case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4): case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6): - pf->process = esp_inb_tun_pkt_process; + pf->process = inline_inb_tun_pkt_process; break; case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS): - pf->process = esp_inb_trs_pkt_process; + pf->process = inline_inb_trs_pkt_process; break; case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4): case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6): diff --git a/lib/librte_ipsec/sa.h b/lib/librte_ipsec/sa.h index ffb5fb4..20c0a65 100644 --- a/lib/librte_ipsec/sa.h +++ b/lib/librte_ipsec/sa.h @@ -143,9 +143,17 @@ esp_inb_tun_pkt_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint16_t num); uint16_t +inline_inb_tun_pkt_process(const struct rte_ipsec_session *ss, + struct rte_mbuf *mb[], uint16_t num); + +uint16_t esp_inb_trs_pkt_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint16_t num); +uint16_t +inline_inb_trs_pkt_process(const struct rte_ipsec_session *ss, + struct rte_mbuf *mb[], uint16_t num); + /* outbound processing */ uint16_t -- 2.7.4