* [PATCH 2/3] examples/ipsec-secgw: check capabilities before session create
2023-02-16 14:24 [PATCH 1/3] examples/ipsec-secgw: fix auth IV length Akhil Goyal
@ 2023-02-16 14:24 ` Akhil Goyal
2023-02-21 13:13 ` Ji, Kai
2023-02-16 14:24 ` [PATCH 3/3] examples/ipsec-secgw: refactor inline capability check Akhil Goyal
2023-02-21 13:13 ` [PATCH 1/3] examples/ipsec-secgw: fix auth IV length Ji, Kai
2 siblings, 1 reply; 7+ messages in thread
From: Akhil Goyal @ 2023-02-16 14:24 UTC (permalink / raw)
To: dev
Cc: radu.nicolau, anoobj, g.singh, hemant.agrawal, kai.ji,
ruifeng.wang, sunilprakashrao.uttarwar, rnagadheeraj, matan,
Akhil Goyal
Currently, sessions are created without checking the device
capabilities, which may result in failure at a later stage.
Device capabilities are now checked before creating the
security/crypto session.
Signed-off-by: Akhil Goyal <gakhil@marvell.com>
---
examples/ipsec-secgw/ipsec.c | 208 ++++++++++++++++++++++++++++++++++-
1 file changed, 205 insertions(+), 3 deletions(-)
diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c
index 9b52d37b81..c51f1b7eb2 100644
--- a/examples/ipsec-secgw/ipsec.c
+++ b/examples/ipsec-secgw/ipsec.c
@@ -57,6 +57,182 @@ set_ipsec_conf(struct ipsec_sa *sa, struct rte_security_ipsec_xform *ipsec)
ipsec->options.ip_reassembly_en = 1;
}
+static inline int
+verify_crypto_xform(const struct rte_cryptodev_capabilities *capabilities,
+ struct rte_crypto_sym_xform *crypto_xform)
+{
+ const struct rte_cryptodev_capabilities *crypto_cap;
+ int j = 0;
+
+ while ((crypto_cap = &capabilities[j++])->op != RTE_CRYPTO_OP_TYPE_UNDEFINED) {
+ if (crypto_cap->op == RTE_CRYPTO_OP_TYPE_SYMMETRIC &&
+ crypto_cap->sym.xform_type == crypto_xform->type) {
+ if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD &&
+ crypto_cap->sym.aead.algo == crypto_xform->aead.algo) {
+ if (rte_cryptodev_sym_capability_check_aead(&crypto_cap->sym,
+ crypto_xform->aead.key.length,
+ crypto_xform->aead.digest_length,
+ crypto_xform->aead.aad_length,
+ crypto_xform->aead.iv.length) == 0)
+ return 0;
+ }
+ if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_CIPHER &&
+ crypto_cap->sym.cipher.algo == crypto_xform->cipher.algo) {
+ if (rte_cryptodev_sym_capability_check_cipher(&crypto_cap->sym,
+ crypto_xform->cipher.key.length,
+ crypto_xform->cipher.iv.length) == 0)
+ return 0;
+ }
+ if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AUTH &&
+ crypto_cap->sym.auth.algo == crypto_xform->auth.algo) {
+ if (rte_cryptodev_sym_capability_check_auth(&crypto_cap->sym,
+ crypto_xform->auth.key.length,
+ crypto_xform->auth.digest_length,
+ crypto_xform->auth.iv.length) == 0)
+ return 0;
+ }
+ }
+ }
+
+ return -ENOTSUP;
+}
+
+static inline int
+verify_crypto_capabilities(const struct rte_cryptodev_capabilities *capabilities,
+ struct rte_crypto_sym_xform *crypto_xform)
+{
+ if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD)
+ return verify_crypto_xform(capabilities, crypto_xform);
+ else if (crypto_xform->next != NULL)
+ return (verify_crypto_xform(capabilities, crypto_xform) ||
+ verify_crypto_xform(capabilities, crypto_xform->next));
+ else
+ return -ENOTSUP;
+}
+
+static inline int
+verify_ipsec_capabilities(struct rte_security_ipsec_xform *ipsec_xform,
+ const struct rte_security_capability *sec_cap)
+{
+ /* Verify security capabilities */
+
+ if (ipsec_xform->options.esn == 1 && sec_cap->ipsec.options.esn == 0) {
+ RTE_LOG(INFO, USER1, "ESN is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if (ipsec_xform->options.udp_encap == 1 &&
+ sec_cap->ipsec.options.udp_encap == 0) {
+ RTE_LOG(INFO, USER1, "UDP encapsulation is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if (ipsec_xform->options.udp_ports_verify == 1 &&
+ sec_cap->ipsec.options.udp_ports_verify == 0) {
+ RTE_LOG(DEBUG, USER1,
+ "UDP encapsulation ports verification is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if (ipsec_xform->options.copy_dscp == 1 &&
+ sec_cap->ipsec.options.copy_dscp == 0) {
+ RTE_LOG(DEBUG, USER1, "Copy DSCP is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if (ipsec_xform->options.copy_flabel == 1 &&
+ sec_cap->ipsec.options.copy_flabel == 0) {
+ RTE_LOG(DEBUG, USER1, "Copy Flow Label is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if (ipsec_xform->options.copy_df == 1 &&
+ sec_cap->ipsec.options.copy_df == 0) {
+ RTE_LOG(DEBUG, USER1, "Copy DP bit is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if (ipsec_xform->options.dec_ttl == 1 &&
+ sec_cap->ipsec.options.dec_ttl == 0) {
+ RTE_LOG(DEBUG, USER1, "Decrement TTL is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if (ipsec_xform->options.ecn == 1 && sec_cap->ipsec.options.ecn == 0) {
+ RTE_LOG(DEBUG, USER1, "ECN is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if (ipsec_xform->options.stats == 1 &&
+ sec_cap->ipsec.options.stats == 0) {
+ RTE_LOG(DEBUG, USER1, "Stats is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if ((ipsec_xform->direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) &&
+ (ipsec_xform->options.iv_gen_disable == 1) &&
+ (sec_cap->ipsec.options.iv_gen_disable != 1)) {
+ RTE_LOG(DEBUG, USER1, "Application provided IV is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if ((ipsec_xform->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) &&
+ (ipsec_xform->options.tunnel_hdr_verify >
+ sec_cap->ipsec.options.tunnel_hdr_verify)) {
+ RTE_LOG(DEBUG, USER1, "Tunnel header verify is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if (ipsec_xform->options.ip_csum_enable == 1 &&
+ sec_cap->ipsec.options.ip_csum_enable == 0) {
+ RTE_LOG(DEBUG, USER1, "Inner IP checksum is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if (ipsec_xform->options.l4_csum_enable == 1 &&
+ sec_cap->ipsec.options.l4_csum_enable == 0) {
+ RTE_LOG(DEBUG, USER1, "Inner L4 checksum is not supported\n");
+ return -ENOTSUP;
+ }
+
+ if (ipsec_xform->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
+ if (ipsec_xform->replay_win_sz > sec_cap->ipsec.replay_win_sz_max) {
+ RTE_LOG(DEBUG, USER1, "Replay window size is not supported\n");
+ return -ENOTSUP;
+ }
+ }
+
+ return 0;
+}
+
+
+static inline int
+verify_security_capabilities(struct rte_security_ctx *ctx,
+ struct rte_security_session_conf *sess_conf)
+{
+ struct rte_security_capability_idx sec_cap_idx;
+ const struct rte_security_capability *sec_cap;
+
+ sec_cap_idx.action = sess_conf->action_type;
+ sec_cap_idx.protocol = sess_conf->protocol;
+ sec_cap_idx.ipsec.proto = sess_conf->ipsec.proto;
+ sec_cap_idx.ipsec.mode = sess_conf->ipsec.mode;
+ sec_cap_idx.ipsec.direction = sess_conf->ipsec.direction;
+
+ sec_cap = rte_security_capability_get(ctx, &sec_cap_idx);
+ if (sec_cap == NULL)
+ return -ENOTSUP;
+
+ if (verify_crypto_capabilities(sec_cap->crypto_capabilities,
+ sess_conf->crypto_xform))
+ return -ENOTSUP;
+
+ if (verify_ipsec_capabilities(&sess_conf->ipsec, sec_cap))
+ return -ENOTSUP;
+
+ return 0;
+}
+
int
create_lookaside_session(struct ipsec_ctx *ipsec_ctx_lcore[],
struct socket_ctx *skt_ctx, const struct eventmode_conf *em_conf,
@@ -156,6 +332,12 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx_lcore[],
/* Set IPsec parameters in conf */
set_ipsec_conf(sa, &(sess_conf.ipsec));
+ if (verify_security_capabilities(ctx, &sess_conf)) {
+ RTE_LOG(ERR, IPSEC,
+ "Requested security session config not supported\n");
+ return -1;
+ }
+
ips->security.ses = rte_security_session_create(ctx,
&sess_conf, skt_ctx->session_pool);
if (ips->security.ses == NULL) {
@@ -173,15 +355,23 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx_lcore[],
return -1;
}
} else {
+ struct rte_cryptodev_info info;
+
+ rte_cryptodev_info_get(cdev_id, &info);
+
if (ips->type == RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) {
- struct rte_cryptodev_info info;
-
- rte_cryptodev_info_get(cdev_id, &info);
if (!(info.feature_flags &
RTE_CRYPTODEV_FF_SYM_CPU_CRYPTO))
return -ENOTSUP;
}
+
+ if (verify_crypto_capabilities(info.capabilities, sa->xforms)) {
+ RTE_LOG(ERR, IPSEC,
+ "Requested crypto session config not supported\n");
+ return -1;
+ }
+
ips->crypto.dev_id = cdev_id;
ips->crypto.ses = rte_cryptodev_sym_session_create(cdev_id,
sa->xforms, skt_ctx->session_pool);
@@ -308,6 +498,12 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
return -1;
}
+ if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+ RTE_LOG(ERR, IPSEC,
+ "Requested security session config not supported\n");
+ return -1;
+ }
+
ips->security.ses = rte_security_session_create(sec_ctx,
&sess_conf, skt_ctx->session_pool);
if (ips->security.ses == NULL) {
@@ -507,6 +703,12 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
sess_conf.userdata = (void *) sa;
+ if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+ RTE_LOG(ERR, IPSEC,
+ "Requested security session config not supported\n");
+ return -1;
+ }
+
ips->security.ses = rte_security_session_create(sec_ctx,
&sess_conf, skt_ctx->session_pool);
if (ips->security.ses == NULL) {
--
2.25.1
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 3/3] examples/ipsec-secgw: refactor inline capability check
2023-02-16 14:24 [PATCH 1/3] examples/ipsec-secgw: fix auth IV length Akhil Goyal
2023-02-16 14:24 ` [PATCH 2/3] examples/ipsec-secgw: check capabilities before session create Akhil Goyal
@ 2023-02-16 14:24 ` Akhil Goyal
2023-02-21 13:13 ` Ji, Kai
2023-02-21 13:13 ` [PATCH 1/3] examples/ipsec-secgw: fix auth IV length Ji, Kai
2 siblings, 1 reply; 7+ messages in thread
From: Akhil Goyal @ 2023-02-16 14:24 UTC (permalink / raw)
To: dev
Cc: radu.nicolau, anoobj, g.singh, hemant.agrawal, kai.ji,
ruifeng.wang, sunilprakashrao.uttarwar, rnagadheeraj, matan,
Akhil Goyal
In cases of inline IPsec, the supported ol_flags are
retrieved from security capability of device.
Now that capability checks are added before creating the session,
ol_flags can be retrieved from the same function call.
Signed-off-by: Akhil Goyal <gakhil@marvell.com>
---
examples/ipsec-secgw/ipsec.c | 65 ++++++------------------------------
1 file changed, 10 insertions(+), 55 deletions(-)
diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c
index c51f1b7eb2..a5c2b524a7 100644
--- a/examples/ipsec-secgw/ipsec.c
+++ b/examples/ipsec-secgw/ipsec.c
@@ -208,7 +208,8 @@ verify_ipsec_capabilities(struct rte_security_ipsec_xform *ipsec_xform,
static inline int
verify_security_capabilities(struct rte_security_ctx *ctx,
- struct rte_security_session_conf *sess_conf)
+ struct rte_security_session_conf *sess_conf,
+ uint32_t *ol_flags)
{
struct rte_security_capability_idx sec_cap_idx;
const struct rte_security_capability *sec_cap;
@@ -230,6 +231,9 @@ verify_security_capabilities(struct rte_security_ctx *ctx,
if (verify_ipsec_capabilities(&sess_conf->ipsec, sec_cap))
return -ENOTSUP;
+ if (ol_flags != NULL)
+ *ol_flags = sec_cap->ol_flags;
+
return 0;
}
@@ -332,7 +336,7 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx_lcore[],
/* Set IPsec parameters in conf */
set_ipsec_conf(sa, &(sess_conf.ipsec));
- if (verify_security_capabilities(ctx, &sess_conf)) {
+ if (verify_security_capabilities(ctx, &sess_conf, NULL)) {
RTE_LOG(ERR, IPSEC,
"Requested security session config not supported\n");
return -1;
@@ -486,7 +490,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) {
struct rte_flow_error err;
- const struct rte_security_capability *sec_cap;
int ret = 0;
sec_ctx = (struct rte_security_ctx *)
@@ -498,7 +501,8 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
return -1;
}
- if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+ if (verify_security_capabilities(sec_ctx, &sess_conf,
+ &ips->security.ol_flags)) {
RTE_LOG(ERR, IPSEC,
"Requested security session config not supported\n");
return -1;
@@ -512,27 +516,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
return -1;
}
- sec_cap = rte_security_capabilities_get(sec_ctx);
-
- /* iterate until ESP tunnel*/
- while (sec_cap->action != RTE_SECURITY_ACTION_TYPE_NONE) {
- if (sec_cap->action == ips->type &&
- sec_cap->protocol ==
- RTE_SECURITY_PROTOCOL_IPSEC &&
- sec_cap->ipsec.mode ==
- RTE_SECURITY_IPSEC_SA_MODE_TUNNEL &&
- sec_cap->ipsec.direction == sa->direction)
- break;
- sec_cap++;
- }
-
- if (sec_cap->action == RTE_SECURITY_ACTION_TYPE_NONE) {
- RTE_LOG(ERR, IPSEC,
- "No suitable security capability found\n");
- return -1;
- }
-
- ips->security.ol_flags = sec_cap->ol_flags;
ips->security.ctx = sec_ctx;
sa->pattern[0].type = RTE_FLOW_ITEM_TYPE_ETH;
@@ -676,8 +659,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
return -1;
}
} else if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) {
- const struct rte_security_capability *sec_cap;
-
sec_ctx = (struct rte_security_ctx *)
rte_eth_dev_get_sec_ctx(sa->portid);
@@ -703,7 +684,8 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
sess_conf.userdata = (void *) sa;
- if (verify_security_capabilities(sec_ctx, &sess_conf)) {
+ if (verify_security_capabilities(sec_ctx, &sess_conf,
+ &ips->security.ol_flags)) {
RTE_LOG(ERR, IPSEC,
"Requested security session config not supported\n");
return -1;
@@ -717,33 +699,6 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa,
return -1;
}
- sec_cap = rte_security_capabilities_get(sec_ctx);
- if (sec_cap == NULL) {
- RTE_LOG(ERR, IPSEC,
- "No capabilities registered\n");
- return -1;
- }
-
- /* iterate until ESP tunnel*/
- while (sec_cap->action !=
- RTE_SECURITY_ACTION_TYPE_NONE) {
- if (sec_cap->action == ips->type &&
- sec_cap->protocol ==
- RTE_SECURITY_PROTOCOL_IPSEC &&
- sec_cap->ipsec.mode ==
- sess_conf.ipsec.mode &&
- sec_cap->ipsec.direction == sa->direction)
- break;
- sec_cap++;
- }
-
- if (sec_cap->action == RTE_SECURITY_ACTION_TYPE_NONE) {
- RTE_LOG(ERR, IPSEC,
- "No suitable security capability found\n");
- return -1;
- }
-
- ips->security.ol_flags = sec_cap->ol_flags;
ips->security.ctx = sec_ctx;
}
--
2.25.1
^ permalink raw reply [flat|nested] 7+ messages in thread