From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 63130A00C3; Fri, 13 May 2022 09:32:48 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 66E10427F1; Fri, 13 May 2022 09:32:33 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0b-0016f401.pphosted.com [67.231.156.173]) by mails.dpdk.org (Postfix) with ESMTP id E004B4284B for ; Fri, 13 May 2022 09:32:31 +0200 (CEST) Received: from pps.filterd (m0045851.ppops.net [127.0.0.1]) by mx0b-0016f401.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 24CNcfET010448; Fri, 13 May 2022 00:32:31 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=pfpt0220; bh=Z8k7voGVcPpMFLvCW2hGWaI9MN5OZdHxpFnWJLLnSlU=; b=OCbHr3IPLreZQ3hQhizrJrR4WF7WxC1L4bHgCZx1yoozCZZU7z8WHiWRJqwWeVvJqPOe s2AMbPZrOf8N+pdXbntbko37D+6Wefvom15ULmH+L6SF7ngg/sqzYzuD+fMdrwXcDNl7 CJXH80kE/hojwqUjyiObAIXe3oF9dhXpRWhsflrm4nrDcyWOmwAihsUysRgL2WtZREIu bMJWyQYlmR0PyXk3Necl29hUftvyV5yyJ7sDAiJ1GjK2fqbthJPGkeM3cHHsNLuPtJp/ +duZAflEsd5zfLWxwCPqyO2nMmVpc1AMrxGCl5RHvti79hbGJLEQiCbUPt/gjW/drn5i Wg== Received: from dc5-exch01.marvell.com ([199.233.59.181]) by mx0b-0016f401.pphosted.com (PPS) with ESMTPS id 3g1c379fmu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 13 May 2022 00:32:31 -0700 Received: from DC5-EXCH01.marvell.com (10.69.176.38) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 13 May 2022 00:32:29 -0700 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Fri, 13 May 2022 00:32:29 -0700 Received: from localhost.localdomain (unknown [10.28.48.55]) by maili.marvell.com (Postfix) with ESMTP id 6A9683F7063; Fri, 13 May 2022 00:32:25 -0700 (PDT) From: Akhil Goyal To: CC: , , , , , , , , , , Akhil Goyal , Fan Zhang Subject: [PATCH v6 5/7] test/security: add more inline IPsec functional cases Date: Fri, 13 May 2022 13:01:59 +0530 Message-ID: <20220513073201.2320812-6-gakhil@marvell.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220513073201.2320812-1-gakhil@marvell.com> References: <20220427151054.2536675-1-gakhil@marvell.com> <20220513073201.2320812-1-gakhil@marvell.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Proofpoint-GUID: d41T31a3mA_0WmCdMP909x6J1kin23LC X-Proofpoint-ORIG-GUID: d41T31a3mA_0WmCdMP909x6J1kin23LC X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514 definitions=2022-05-13_02,2022-05-12_01,2022-02-23_01 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Added more inline IPsec functional verification cases. These cases do not have known vectors but are verified using encap + decap test for all the algo combinations. Signed-off-by: Akhil Goyal Acked-by: Fan Zhang --- app/test/test_security_inline_proto.c | 517 ++++++++++++++++++++++++++ 1 file changed, 517 insertions(+) diff --git a/app/test/test_security_inline_proto.c b/app/test/test_security_inline_proto.c index 2aa7072512..ce68da7605 100644 --- a/app/test/test_security_inline_proto.c +++ b/app/test/test_security_inline_proto.c @@ -1321,6 +1321,394 @@ test_ipsec_inline_proto_display_list(const void *data __rte_unused) return test_ipsec_inline_proto_all(&flags); } +static int +test_ipsec_inline_proto_udp_encap(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.udp_encap = true; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_udp_ports_verify(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.udp_encap = true; + flags.udp_ports_verify = true; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_err_icv_corrupt(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.icv_corrupt = true; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_tunnel_dst_addr_verify(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.tunnel_hdr_verify = RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_tunnel_src_dst_addr_verify(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.tunnel_hdr_verify = RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_inner_ip_csum(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.ip_csum = true; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_inner_l4_csum(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.l4_csum = true; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_tunnel_v4_in_v4(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.ipv6 = false; + flags.tunnel_ipv6 = false; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_tunnel_v6_in_v6(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.ipv6 = true; + flags.tunnel_ipv6 = true; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_tunnel_v4_in_v6(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.ipv6 = false; + flags.tunnel_ipv6 = true; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_tunnel_v6_in_v4(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.ipv6 = true; + flags.tunnel_ipv6 = false; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_transport_v4(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.ipv6 = false; + flags.transport = true; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_transport_l4_csum(const void *data __rte_unused) +{ + struct ipsec_test_flags flags = { + .l4_csum = true, + .transport = true, + }; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_stats(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.stats_success = true; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_pkt_fragment(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.fragment = true; + + return test_ipsec_inline_proto_all(&flags); + +} + +static int +test_ipsec_inline_proto_copy_df_inner_0(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.df = TEST_IPSEC_COPY_DF_INNER_0; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_copy_df_inner_1(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.df = TEST_IPSEC_COPY_DF_INNER_1; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_set_df_0_inner_1(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.df = TEST_IPSEC_SET_DF_0_INNER_1; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_set_df_1_inner_0(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.df = TEST_IPSEC_SET_DF_1_INNER_0; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_ipv4_copy_dscp_inner_0(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.dscp = TEST_IPSEC_COPY_DSCP_INNER_0; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_ipv4_copy_dscp_inner_1(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.dscp = TEST_IPSEC_COPY_DSCP_INNER_1; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_ipv4_set_dscp_0_inner_1(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.dscp = TEST_IPSEC_SET_DSCP_0_INNER_1; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_ipv4_set_dscp_1_inner_0(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.dscp = TEST_IPSEC_SET_DSCP_1_INNER_0; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_ipv6_copy_dscp_inner_0(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.ipv6 = true; + flags.tunnel_ipv6 = true; + flags.dscp = TEST_IPSEC_COPY_DSCP_INNER_0; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_ipv6_copy_dscp_inner_1(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.ipv6 = true; + flags.tunnel_ipv6 = true; + flags.dscp = TEST_IPSEC_COPY_DSCP_INNER_1; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_ipv6_set_dscp_0_inner_1(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.ipv6 = true; + flags.tunnel_ipv6 = true; + flags.dscp = TEST_IPSEC_SET_DSCP_0_INNER_1; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_ipv6_set_dscp_1_inner_0(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.ipv6 = true; + flags.tunnel_ipv6 = true; + flags.dscp = TEST_IPSEC_SET_DSCP_1_INNER_0; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_ipv4_ttl_decrement(const void *data __rte_unused) +{ + struct ipsec_test_flags flags = { + .dec_ttl_or_hop_limit = true + }; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_ipv6_hop_limit_decrement(const void *data __rte_unused) +{ + struct ipsec_test_flags flags = { + .ipv6 = true, + .dec_ttl_or_hop_limit = true + }; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_iv_gen(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.iv_gen = true; + + return test_ipsec_inline_proto_all(&flags); +} + +static int +test_ipsec_inline_proto_known_vec_fragmented(const void *test_data) +{ + struct ipsec_test_data td_outb; + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + flags.fragment = true; + + memcpy(&td_outb, test_data, sizeof(td_outb)); + + /* Disable IV gen to be able to test with known vectors */ + td_outb.ipsec_xform.options.iv_gen_disable = 1; + + return test_ipsec_inline_proto_process(&td_outb, NULL, 1, false, + &flags); +} static struct unit_test_suite inline_ipsec_testsuite = { .suite_name = "Inline IPsec Ethernet Device Unit Test Suite", .setup = inline_ipsec_testsuite_setup, @@ -1367,6 +1755,13 @@ static struct unit_test_suite inline_ipsec_testsuite = { ut_setup_inline_ipsec, ut_teardown_inline_ipsec, test_ipsec_inline_proto_known_vec, &pkt_null_aes_xcbc), + + TEST_CASE_NAMED_WITH_DATA( + "Outbound fragmented packet", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_known_vec_fragmented, + &pkt_aes_128_gcm_frag), + TEST_CASE_NAMED_WITH_DATA( "Inbound known vector (ESP tunnel mode IPv4 AES-GCM 128)", ut_setup_inline_ipsec, ut_teardown_inline_ipsec, @@ -1418,6 +1813,128 @@ static struct unit_test_suite inline_ipsec_testsuite = { ut_setup_inline_ipsec, ut_teardown_inline_ipsec, test_ipsec_inline_proto_display_list), + TEST_CASE_NAMED_ST( + "UDP encapsulation", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_udp_encap), + TEST_CASE_NAMED_ST( + "UDP encapsulation ports verification test", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_udp_ports_verify), + TEST_CASE_NAMED_ST( + "Negative test: ICV corruption", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_err_icv_corrupt), + TEST_CASE_NAMED_ST( + "Tunnel dst addr verification", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_tunnel_dst_addr_verify), + TEST_CASE_NAMED_ST( + "Tunnel src and dst addr verification", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_tunnel_src_dst_addr_verify), + TEST_CASE_NAMED_ST( + "Inner IP checksum", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_inner_ip_csum), + TEST_CASE_NAMED_ST( + "Inner L4 checksum", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_inner_l4_csum), + TEST_CASE_NAMED_ST( + "Tunnel IPv4 in IPv4", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_tunnel_v4_in_v4), + TEST_CASE_NAMED_ST( + "Tunnel IPv6 in IPv6", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_tunnel_v6_in_v6), + TEST_CASE_NAMED_ST( + "Tunnel IPv4 in IPv6", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_tunnel_v4_in_v6), + TEST_CASE_NAMED_ST( + "Tunnel IPv6 in IPv4", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_tunnel_v6_in_v4), + TEST_CASE_NAMED_ST( + "Transport IPv4", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_transport_v4), + TEST_CASE_NAMED_ST( + "Transport l4 checksum", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_transport_l4_csum), + TEST_CASE_NAMED_ST( + "Statistics: success", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_stats), + TEST_CASE_NAMED_ST( + "Fragmented packet", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_pkt_fragment), + TEST_CASE_NAMED_ST( + "Tunnel header copy DF (inner 0)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_copy_df_inner_0), + TEST_CASE_NAMED_ST( + "Tunnel header copy DF (inner 1)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_copy_df_inner_1), + TEST_CASE_NAMED_ST( + "Tunnel header set DF 0 (inner 1)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_set_df_0_inner_1), + TEST_CASE_NAMED_ST( + "Tunnel header set DF 1 (inner 0)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_set_df_1_inner_0), + TEST_CASE_NAMED_ST( + "Tunnel header IPv4 copy DSCP (inner 0)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_ipv4_copy_dscp_inner_0), + TEST_CASE_NAMED_ST( + "Tunnel header IPv4 copy DSCP (inner 1)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_ipv4_copy_dscp_inner_1), + TEST_CASE_NAMED_ST( + "Tunnel header IPv4 set DSCP 0 (inner 1)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_ipv4_set_dscp_0_inner_1), + TEST_CASE_NAMED_ST( + "Tunnel header IPv4 set DSCP 1 (inner 0)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_ipv4_set_dscp_1_inner_0), + TEST_CASE_NAMED_ST( + "Tunnel header IPv6 copy DSCP (inner 0)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_ipv6_copy_dscp_inner_0), + TEST_CASE_NAMED_ST( + "Tunnel header IPv6 copy DSCP (inner 1)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_ipv6_copy_dscp_inner_1), + TEST_CASE_NAMED_ST( + "Tunnel header IPv6 set DSCP 0 (inner 1)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_ipv6_set_dscp_0_inner_1), + TEST_CASE_NAMED_ST( + "Tunnel header IPv6 set DSCP 1 (inner 0)", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_ipv6_set_dscp_1_inner_0), + TEST_CASE_NAMED_ST( + "Tunnel header IPv4 decrement inner TTL", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_ipv4_ttl_decrement), + TEST_CASE_NAMED_ST( + "Tunnel header IPv6 decrement inner hop limit", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_ipv6_hop_limit_decrement), + TEST_CASE_NAMED_ST( + "IV generation", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_iv_gen), + + TEST_CASE_NAMED_WITH_DATA( "IPv4 Reassembly with 2 fragments", ut_setup_inline_ipsec, ut_teardown_inline_ipsec, -- 2.25.1