[PATCH 1/3] examples/ipsec-secgw: fix auth IV length

[PATCH 1/3] examples/ipsec-secgw: fix auth IV length

[Akhil Goyal]

Currently, cipher IV length is getting used to set auth
xform IV length. Auth IV is needed for AES-GMAC case,
and in all other cases, auth IV should be 0.
Used a separate auth IV length to separate out cipher and auth cases.

Fixes: 9413c3901f31 ("examples/ipsec-secgw: support additional algorithms")
Cc: stable@dpdk.org

Signed-off-by: Akhil Goyal <gakhil@marvell.com>
---
 examples/ipsec-secgw/sa.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c
index 7da9444a7b..001762bea9 100644
--- a/examples/ipsec-secgw/sa.c
+++ b/examples/ipsec-secgw/sa.c
@@ -1247,6 +1247,7 @@ sa_add_rules(struct sa_ctx *sa_ctx, const struct ipsec_sa entries[],
 	struct ipsec_sa *sa;
 	uint32_t i, idx;
 	uint16_t iv_length, aad_length;
+	uint16_t auth_iv_length = 0;
 	int inline_status;
 	int32_t rc;
 	struct rte_ipsec_session *ips;
@@ -1340,7 +1341,7 @@ sa_add_rules(struct sa_ctx *sa_ctx, const struct ipsec_sa entries[],
 
 			/* AES_GMAC uses salt like AEAD algorithms */
 			if (sa->auth_algo == RTE_CRYPTO_AUTH_AES_GMAC)
-				iv_length = 12;
+				auth_iv_length = 12;
 
 			if (inbound) {
 				sa_ctx->xf[idx].b.type = RTE_CRYPTO_SYM_XFORM_CIPHER;
@@ -1364,7 +1365,7 @@ sa_add_rules(struct sa_ctx *sa_ctx, const struct ipsec_sa entries[],
 				sa_ctx->xf[idx].a.auth.op =
 					RTE_CRYPTO_AUTH_OP_VERIFY;
 				sa_ctx->xf[idx].a.auth.iv.offset = IV_OFFSET;
-				sa_ctx->xf[idx].a.auth.iv.length = iv_length;
+				sa_ctx->xf[idx].a.auth.iv.length = auth_iv_length;
 
 			} else { /* outbound */
 				sa_ctx->xf[idx].a.type = RTE_CRYPTO_SYM_XFORM_CIPHER;
@@ -1388,7 +1389,7 @@ sa_add_rules(struct sa_ctx *sa_ctx, const struct ipsec_sa entries[],
 				sa_ctx->xf[idx].b.auth.op =
 					RTE_CRYPTO_AUTH_OP_GENERATE;
 				sa_ctx->xf[idx].b.auth.iv.offset = IV_OFFSET;
-				sa_ctx->xf[idx].b.auth.iv.length = iv_length;
+				sa_ctx->xf[idx].b.auth.iv.length = auth_iv_length;
 
 			}
 
-- 
2.25.1

[PATCH 2/3] examples/ipsec-secgw: check capabilities before session create

[Akhil Goyal]

Currently, sessions are created without checking the device
capabilities, which may result in failure at a later stage.

Device capabilities are now checked before creating the
security/crypto session.

Signed-off-by: Akhil Goyal <gakhil@marvell.com>
---
 examples/ipsec-secgw/ipsec.c | 208 ++++++++++++++++++++++++++++++++++-
 1 file changed, 205 insertions(+), 3 deletions(-)

diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c
index 9b52d37b81..c51f1b7eb2 100644
--- a/examples/ipsec-secgw/ipsec.c
+++ b/examples/ipsec-secgw/ipsec.c
@@ -57,6 +57,182 @@ set_ipsec_conf(struct ipsec_sa *sa, struct rte_security_ipsec_xform *ipsec)
 		ipsec->options.ip_reassembly_en = 1;
 }
 
+static inline int
+verify_crypto_xform(const struct rte_cryptodev_capabilities *capabilities,
+		struct rte_crypto_sym_xform *crypto_xform)
+{
+	const struct rte_cryptodev_capabilities *crypto_cap;
+	int j = 0;
+
+	while ((crypto_cap = &capabilities[j++])->op != RTE_CRYPTO_OP_TYPE_UNDEFINED) {
+		if (crypto_cap->op == RTE_CRYPTO_OP_TYPE_SYMMETRIC &&
+				crypto_cap->sym.xform_type == crypto_xform->type) {
+			if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD &&
+					crypto_cap->sym.aead.algo == crypto_xform->aead.algo) {
+				if (rte_cryptodev_sym_capability_check_aead(&crypto_cap->sym,
+						crypto_xform->aead.key.length,
+						crypto_xform->aead.digest_length,
+						crypto_xform->aead.aad_length,
+						crypto_xform->aead.iv.length) == 0)
+					return 0;
+			}
+			if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_CIPHER &&
+					crypto_cap->sym.cipher.algo == crypto_xform->cipher.algo) {
+				if (rte_cryptodev_sym_capability_check_cipher(&crypto_cap->sym,
+						crypto_xform->cipher.key.length,
+						crypto_xform->cipher.iv.length) == 0)
+					return 0;
+			}
+			if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AUTH &&
+					crypto_cap->sym.auth.algo == crypto_xform->auth.algo) {
+				if (rte_cryptodev_sym_capability_check_auth(&crypto_cap->sym,
+						crypto_xform->auth.key.length,
+						crypto_xform->auth.digest_length,
+						crypto_xform->auth.iv.length) == 0)
+					return 0;
+			}
+		}
+	}
+
+	return -ENOTSUP;
+}
+
+static inline int
+verify_crypto_capabilities(const struct rte_cryptodev_capabilities *capabilities,
+		struct rte_crypto_sym_xform *crypto_xform)
+{
+	if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD)
+		return verify_crypto_xform(capabilities, crypto_xform);
+	else if (crypto_xform->next != NULL)
+		return (verify_crypto_xform(capabilities, crypto_xform) ||
+		    verify_crypto_xform(capabilities, crypto_xform->next));
+	else
+		return -ENOTSUP;
+}
+
+static inline int
+verify_ipsec_capabilities(struct rte_security_ipsec_xform *ipsec_xform,
+		const struct rte_security_capability *sec_cap)
+{
+	/* Verify security capabilities */
+
+	if (ipsec_xform->options.esn == 1 && sec_cap->ipsec.options.esn == 0) {
+		RTE_LOG(INFO, USER1, "ESN is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if (ipsec_xform->options.udp_encap == 1 &&
+	    sec_cap->ipsec.options.udp_encap == 0) {
+		RTE_LOG(INFO, USER1, "UDP encapsulation is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if (ipsec_xform->options.udp_ports_verify == 1 &&
+	    sec_cap->ipsec.options.udp_ports_verify == 0) {
+		RTE_LOG(DEBUG, USER1,
+			"UDP encapsulation ports verification is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if (ipsec_xform->options.copy_dscp == 1 &&
+	    sec_cap->ipsec.options.copy_dscp == 0) {
+		RTE_LOG(DEBUG, USER1, "Copy DSCP is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if (ipsec_xform->options.copy_flabel == 1 &&
+	    sec_cap->ipsec.options.copy_flabel == 0) {
+		RTE_LOG(DEBUG, USER1, "Copy Flow Label is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if (ipsec_xform->options.copy_df == 1 &&
+	    sec_cap->ipsec.options.copy_df == 0) {
+		RTE_LOG(DEBUG, USER1, "Copy DP bit is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if (ipsec_xform->options.dec_ttl == 1 &&
+	    sec_cap->ipsec.options.dec_ttl == 0) {
+		RTE_LOG(DEBUG, USER1, "Decrement TTL is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if (ipsec_xform->options.ecn == 1 && sec_cap->ipsec.options.ecn == 0) {
+		RTE_LOG(DEBUG, USER1, "ECN is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if (ipsec_xform->options.stats == 1 &&
+	    sec_cap->ipsec.options.stats == 0) {
+		RTE_LOG(DEBUG, USER1, "Stats is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if ((ipsec_xform->direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) &&
+	    (ipsec_xform->options.iv_gen_disable == 1) &&
+	    (sec_cap->ipsec.options.iv_gen_disable != 1)) {
+		RTE_LOG(DEBUG, USER1, "Application provided IV is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if ((ipsec_xform->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) &&
+	    (ipsec_xform->options.tunnel_hdr_verify >
+	    sec_cap->ipsec.options.tunnel_hdr_verify)) {
+		RTE_LOG(DEBUG, USER1, "Tunnel header verify is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if (ipsec_xform->options.ip_csum_enable == 1 &&
+	    sec_cap->ipsec.options.ip_csum_enable == 0) {
+		RTE_LOG(DEBUG, USER1, "Inner IP checksum is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if (ipsec_xform->options.l4_csum_enable == 1 &&
+	    sec_cap->ipsec.options.l4_csum_enable == 0) {
+		RTE_LOG(DEBUG, USER1, "Inner L4 checksum is not supported\n");
+		return -ENOTSUP;
+	}
+
+	if (ipsec_xform->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
+		if (ipsec_xform->replay_win_sz > sec_cap->ipsec.replay_win_sz_max) {
+			RTE_LOG(DEBUG, USER1, "Replay window size is not supported\n");
+			return -ENOTSUP;
+		}
+	}
+
+	return 0;
+}
+
+
+static inline int
+verify_security_capabilities(struct rte_security_ctx *ctx,
+		struct rte_security_session_conf *sess_conf)
+{
+	struct rte_security_capability_idx sec_cap_idx;
+	const struct rte_security_capability *sec_cap;
+
+	sec_cap_idx.action = sess_conf->action_type;
+	sec_cap_idx.protocol = sess_conf->protocol;
+	sec_cap_idx.ipsec.proto = sess_conf->ipsec.proto;
+	sec_cap_idx.ipsec.mode = sess_conf->ipsec.mode;
+	sec_cap_idx.ipsec.direction = sess_conf->ipsec.direction;
+
+	sec_cap = rte_security_capability_get(ctx, &sec_cap_idx);
+	if (sec_cap == NULL)
+		return -ENOTSUP;
+
+	if (verify_crypto_capabilities(sec_cap->crypto_capabilities,
+				sess_conf->crypto_xform))
+		return -ENOTSUP;
+
+	if (verify_ipsec_capabilities(&sess_conf->ipsec, sec_cap))
+		return -ENOTSUP;
+
+	return 0;
+}
+
 int
 create_lookaside_session(struct ipsec_ctx *ipsec_ctx_lcore[],
 	struct socket_ctx *skt_ctx, const struct eventmode_conf *em_conf,
@@ -156,6 +332,12 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx_lcore[],
 			/* Set IPsec parameters in conf */
 			set_ipsec_conf(sa, &(sess_conf.ipsec));
 
+			if (verify_security_capabilities(ctx, &sess_conf)) {
+				RTE_LOG(ERR, IPSEC,
+					"Requested security session config not supported\n");
+				return -1;
+			}
+
 			ips->security.ses = rte_security_session_create(ctx,
 					&sess_conf, skt_ctx->session_pool);
 			if (ips->security.ses == NULL) {
@@ -173,15 +355,23 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx_lcore[],
 			return -1;
 		}
 	} else {
+		struct rte_cryptodev_info info;
+
+		rte_cryptodev_info_get(cdev_id, &info);
+
 		if (ips->type == RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) {
-			struct rte_cryptodev_info info;
-
-			rte_cryptodev_info_get(cdev_id, &info);
 			if (!(info.feature_flags &
 				RTE_CRYPTODEV_FF_SYM_CPU_CRYPTO))
 				return -ENOTSUP;
 
 		}
+
+		if (verify_crypto_capabilities(info.capabilities, sa->xforms)) {
+			RTE_LOG(ERR, IPSEC,
+				"Requested crypto session config not supported\n");
+			return -1;
+		}
+
 		ips->crypto.dev_id = cdev_id;
 		ips->crypto.ses = rte_cryptodev_sym_session_create(cdev_id,
 				sa->xforms, skt_ctx->session_pool);
@@ -308,6 +498,12 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 			return -1;
 		}
 
+		if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+			RTE_LOG(ERR, IPSEC,
+				"Requested security session config not supported\n");
+			return -1;
+		}
+
 		ips->security.ses = rte_security_session_create(sec_ctx,
 				&sess_conf, skt_ctx->session_pool);
 		if (ips->security.ses == NULL) {
@@ -507,6 +703,12 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 
 		sess_conf.userdata = (void *) sa;
 
+		if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+			RTE_LOG(ERR, IPSEC,
+				"Requested security session config not supported\n");
+			return -1;
+		}
+
 		ips->security.ses = rte_security_session_create(sec_ctx,
 					&sess_conf, skt_ctx->session_pool);
 		if (ips->security.ses == NULL) {
-- 
2.25.1

[PATCH 3/3] examples/ipsec-secgw: refactor inline capability check

[Akhil Goyal]

In cases of inline IPsec, the supported ol_flags are
retrieved from security capability of device.
Now that capability checks are added before creating the session,
ol_flags can be retrieved from the same function call.

Signed-off-by: Akhil Goyal <gakhil@marvell.com>
---
 examples/ipsec-secgw/ipsec.c | 65 ++++++------------------------------
 1 file changed, 10 insertions(+), 55 deletions(-)

diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c
index c51f1b7eb2..a5c2b524a7 100644
--- a/examples/ipsec-secgw/ipsec.c
+++ b/examples/ipsec-secgw/ipsec.c
@@ -208,7 +208,8 @@ verify_ipsec_capabilities(struct rte_security_ipsec_xform *ipsec_xform,
 
 static inline int
 verify_security_capabilities(struct rte_security_ctx *ctx,
-		struct rte_security_session_conf *sess_conf)
+		struct rte_security_session_conf *sess_conf,
+		uint32_t *ol_flags)
 {
 	struct rte_security_capability_idx sec_cap_idx;
 	const struct rte_security_capability *sec_cap;
@@ -230,6 +231,9 @@ verify_security_capabilities(struct rte_security_ctx *ctx,
 	if (verify_ipsec_capabilities(&sess_conf->ipsec, sec_cap))
 		return -ENOTSUP;
 
+	if (ol_flags != NULL)
+		*ol_flags = sec_cap->ol_flags;
+
 	return 0;
 }
 
@@ -332,7 +336,7 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx_lcore[],
 			/* Set IPsec parameters in conf */
 			set_ipsec_conf(sa, &(sess_conf.ipsec));
 
-			if (verify_security_capabilities(ctx, &sess_conf)) {
+			if (verify_security_capabilities(ctx, &sess_conf, NULL)) {
 				RTE_LOG(ERR, IPSEC,
 					"Requested security session config not supported\n");
 				return -1;
@@ -486,7 +490,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 
 	if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) {
 		struct rte_flow_error err;
-		const struct rte_security_capability *sec_cap;
 		int ret = 0;
 
 		sec_ctx = (struct rte_security_ctx *)
@@ -498,7 +501,8 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 			return -1;
 		}
 
-		if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+		if (verify_security_capabilities(sec_ctx, &sess_conf,
+					&ips->security.ol_flags)) {
 			RTE_LOG(ERR, IPSEC,
 				"Requested security session config not supported\n");
 			return -1;
@@ -512,27 +516,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 			return -1;
 		}
 
-		sec_cap = rte_security_capabilities_get(sec_ctx);
-
-		/* iterate until ESP tunnel*/
-		while (sec_cap->action != RTE_SECURITY_ACTION_TYPE_NONE) {
-			if (sec_cap->action == ips->type &&
-			    sec_cap->protocol ==
-				RTE_SECURITY_PROTOCOL_IPSEC &&
-			    sec_cap->ipsec.mode ==
-				RTE_SECURITY_IPSEC_SA_MODE_TUNNEL &&
-			    sec_cap->ipsec.direction == sa->direction)
-				break;
-			sec_cap++;
-		}
-
-		if (sec_cap->action == RTE_SECURITY_ACTION_TYPE_NONE) {
-			RTE_LOG(ERR, IPSEC,
-				"No suitable security capability found\n");
-			return -1;
-		}
-
-		ips->security.ol_flags = sec_cap->ol_flags;
 		ips->security.ctx = sec_ctx;
 		sa->pattern[0].type = RTE_FLOW_ITEM_TYPE_ETH;
 
@@ -676,8 +659,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 			return -1;
 		}
 	} else if (ips->type ==	RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) {
-		const struct rte_security_capability *sec_cap;
-
 		sec_ctx = (struct rte_security_ctx *)
 				rte_eth_dev_get_sec_ctx(sa->portid);
 
@@ -703,7 +684,8 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 
 		sess_conf.userdata = (void *) sa;
 
-		if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+		if (verify_security_capabilities(sec_ctx, &sess_conf,
+					&ips->security.ol_flags)) {
 			RTE_LOG(ERR, IPSEC,
 				"Requested security session config not supported\n");
 			return -1;
@@ -717,33 +699,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
 			return -1;
 		}
 
-		sec_cap = rte_security_capabilities_get(sec_ctx);
-		if (sec_cap == NULL) {
-			RTE_LOG(ERR, IPSEC,
-				"No capabilities registered\n");
-			return -1;
-		}
-
-		/* iterate until ESP tunnel*/
-		while (sec_cap->action !=
-				RTE_SECURITY_ACTION_TYPE_NONE) {
-			if (sec_cap->action == ips->type &&
-			    sec_cap->protocol ==
-				RTE_SECURITY_PROTOCOL_IPSEC &&
-			    sec_cap->ipsec.mode ==
-				sess_conf.ipsec.mode &&
-			    sec_cap->ipsec.direction == sa->direction)
-				break;
-			sec_cap++;
-		}
-
-		if (sec_cap->action == RTE_SECURITY_ACTION_TYPE_NONE) {
-			RTE_LOG(ERR, IPSEC,
-				"No suitable security capability found\n");
-			return -1;
-		}
-
-		ips->security.ol_flags = sec_cap->ol_flags;
 		ips->security.ctx = sec_ctx;
 	}
 
-- 
2.25.1

RE: [PATCH 1/3] examples/ipsec-secgw: fix auth IV length

[Ji, Kai]

Acked-by: Kai Ji <kai.ji@intel.com>

> -----Original Message-----
> From: Akhil Goyal <gakhil@marvell.com>
> Sent: Thursday, February 16, 2023 2:25 PM
> To: dev@dpdk.org
> Cc: Nicolau, Radu <radu.nicolau@intel.com>; anoobj@marvell.com;
> g.singh@nxp.com; hemant.agrawal@nxp.com; Ji, Kai <kai.ji@intel.com>;
> ruifeng.wang@arm.com; sunilprakashrao.uttarwar@amd.com;
> rnagadheeraj@marvell.com; matan@nvidia.com; Akhil Goyal
> <gakhil@marvell.com>; stable@dpdk.org
> Subject: [PATCH 1/3] examples/ipsec-secgw: fix auth IV length
> 
> Currently, cipher IV length is getting used to set auth xform IV length.
> Auth IV is needed for AES-GMAC case, and in all other cases, auth IV
> should be 0.
> Used a separate auth IV length to separate out cipher and auth cases.
> 
> Fixes: 9413c3901f31 ("examples/ipsec-secgw: support additional
> algorithms")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Akhil Goyal <gakhil@marvell.com>
> ---

RE: [PATCH 2/3] examples/ipsec-secgw: check capabilities before session create

[Ji, Kai]

Acked-by: Kai Ji <kai.ji@intel.com>

> -----Original Message-----
> From: Akhil Goyal <gakhil@marvell.com>
> Sent: Thursday, February 16, 2023 2:25 PM
> To: dev@dpdk.org
> Cc: Nicolau, Radu <radu.nicolau@intel.com>; anoobj@marvell.com;
> g.singh@nxp.com; hemant.agrawal@nxp.com; Ji, Kai <kai.ji@intel.com>;
> ruifeng.wang@arm.com; sunilprakashrao.uttarwar@amd.com;
> rnagadheeraj@marvell.com; matan@nvidia.com; Akhil Goyal
> <gakhil@marvell.com>
> Subject: [PATCH 2/3] examples/ipsec-secgw: check capabilities before
> session create
> 
> Currently, sessions are created without checking the device
> capabilities, which may result in failure at a later stage.
> 
> Device capabilities are now checked before creating the security/crypto
> session.
> 
> Signed-off-by: Akhil Goyal <gakhil@marvell.com>
> ---

RE: [PATCH 3/3] examples/ipsec-secgw: refactor inline capability check

[Ji, Kai]

Acked-by: Kai Ji <kai.ji@intel.com>

> -----Original Message-----
> From: Akhil Goyal <gakhil@marvell.com>
> Sent: Thursday, February 16, 2023 2:25 PM
> To: dev@dpdk.org
> Cc: Nicolau, Radu <radu.nicolau@intel.com>; anoobj@marvell.com;
> g.singh@nxp.com; hemant.agrawal@nxp.com; Ji, Kai <kai.ji@intel.com>;
> ruifeng.wang@arm.com; sunilprakashrao.uttarwar@amd.com;
> rnagadheeraj@marvell.com; matan@nvidia.com; Akhil Goyal
> <gakhil@marvell.com>
> Subject: [PATCH 3/3] examples/ipsec-secgw: refactor inline capability
> check
> 
> In cases of inline IPsec, the supported ol_flags are retrieved from
> security capability of device.
> Now that capability checks are added before creating the session,
> ol_flags can be retrieved from the same function call.
> 
> Signed-off-by: Akhil Goyal <gakhil@marvell.com>
> ---

RE: [PATCH 1/3] examples/ipsec-secgw: fix auth IV length

[Akhil Goyal]

> Acked-by: Kai Ji <kai.ji@intel.com>

Please do bottom post in future.

Series Applied to dpdk-next-crypto