From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by dpdk.org (Postfix) with ESMTP id 6B2972C48 for ; Mon, 21 Nov 2016 07:48:48 +0100 (CET) Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga102.fm.intel.com with ESMTP; 20 Nov 2016 22:48:47 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.31,525,1473145200"; d="scan'208";a="33030331" Received: from yliu-dev.sh.intel.com (HELO yliu-dev) ([10.239.67.162]) by orsmga004.jf.intel.com with ESMTP; 20 Nov 2016 22:48:46 -0800 Date: Mon, 21 Nov 2016 14:49:34 +0800 From: Yuanhan Liu To: Piotr Azarewicz Cc: stable@dpdk.org, michalx.k.jastrzebski@intel.com Message-ID: <20161121064934.GQ5048@yliu-dev.sh.intel.com> References: <1479480924-51387-1-git-send-email-piotrx.t.azarewicz@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1479480924-51387-1-git-send-email-piotrx.t.azarewicz@intel.com> User-Agent: Mutt/1.5.23 (2014-03-12) Subject: Re: [dpdk-stable] [PATCH] examples/l2fwd-crypto: fix verify with decrypt in chain X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Nov 2016 06:48:48 -0000 Applied to dpdk stable branch 16.07 Thanks. --yliu On Fri, Nov 18, 2016 at 03:55:24PM +0100, Piotr Azarewicz wrote: > backported from upstream commit 893fbab03186 ("examples/l2fwd-crypto: > fix verify with decrypt in chain") > > This patch fixes crypto operation data parameters setting > in l2fwd-crypto application, making decryption in chain > with auth verification work. > > How to reproduce the issue: > > 1. Run l2fwd_crypto with command: > -c 0x3 -n 4 --vdev "crypto_aesni_mb" \ > --vdev "crypto_aesni_mb" \ > -- -p 0x3 --chain CIPHER_HASH \ > --cipher_op ENCRYPT --cipher_algo AES_CBC \ > --cipher_key 00:01:02:03:04:05:06:07:08:09:0a:0b:0c:0d:0e:0f \ > --iv 00:01:02:03:04:05:06:07:08:09:0a:0b:0c:0d:0e:ff \ > --auth_op GENERATE --auth_algo SHA1_HMAC \ > --auth_key > 11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11: > 11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11: > 11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11 > > 2. Send packet with payload and capture forwarded packet. > Payload in forwarded packet is encrypted, what is good. > > 3. Run l2fwd_crypto with command: > -c 0x3 -n 4 --vdev "crypto_aesni_mb" \ > --vdev "crypto_aesni_mb" \ > -- -p 0x3 --chain HASH_CIPHER \ > --cipher_op DECRYPT --cipher_algo AES_CBC \ > --cipher_key 00:01:02:03:04:05:06:07:08:09:0a:0b:0c:0d:0e:0f \ > --iv 00:01:02:03:04:05:06:07:08:09:0a:0b:0c:0d:0e:ff \ > --auth_op VERIFY --auth_algo SHA1_HMAC \ > --auth_key > 11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11: > 11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11: > 11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11 > > 4. Send earlier captured packet and capture forwarded packet. > Payload in newly captured packet is not decrypted, what is wrong. > > Fixes: 387259bd6c67 ("examples/l2fwd-crypto: add sample application") > > Signed-off-by: Piotr Azarewicz > Acked-by: Michal Jastrzebski > --- > examples/l2fwd-crypto/main.c | 23 ++++++++--------------- > 1 file changed, 8 insertions(+), 15 deletions(-) > > diff --git a/examples/l2fwd-crypto/main.c b/examples/l2fwd-crypto/main.c > index 66397a0..6cfa916 100644 > --- a/examples/l2fwd-crypto/main.c > +++ b/examples/l2fwd-crypto/main.c > @@ -441,6 +441,10 @@ l2fwd_simple_crypto_enqueue(struct rte_mbuf *m, > > /* Zero pad data to be crypto'd so it is block aligned */ > data_len = rte_pktmbuf_data_len(m) - ipdata_offset; > + > + if (cparams->do_hash && cparams->hash_verify) > + data_len -= cparams->digest_length; > + > pad_len = data_len % cparams->block_size ? cparams->block_size - > (data_len % cparams->block_size) : 0; > > @@ -462,8 +466,8 @@ l2fwd_simple_crypto_enqueue(struct rte_mbuf *m, > op->sym->auth.digest.data = (uint8_t *)rte_pktmbuf_append(m, > cparams->digest_length); > } else { > - op->sym->auth.digest.data = (uint8_t *)rte_pktmbuf_append(m, > - cparams->digest_length); > + op->sym->auth.digest.data = rte_pktmbuf_mtod(m, > + uint8_t *) + ipdata_offset + data_len; > } > > op->sym->auth.digest.phys_addr = rte_pktmbuf_mtophys_offset(m, > @@ -496,21 +500,10 @@ l2fwd_simple_crypto_enqueue(struct rte_mbuf *m, > if (cparams->cipher_algo == RTE_CRYPTO_CIPHER_SNOW3G_UEA2 || > cparams->cipher_algo == RTE_CRYPTO_CIPHER_KASUMI_F8) { > op->sym->cipher.data.offset = ipdata_offset << 3; > - if (cparams->do_hash && cparams->hash_verify) > - /* Do not cipher the hash tag */ > - op->sym->cipher.data.length = (data_len - > - cparams->digest_length) << 3; > - else > - op->sym->cipher.data.length = data_len << 3; > - > + op->sym->cipher.data.length = data_len << 3; > } else { > op->sym->cipher.data.offset = ipdata_offset; > - if (cparams->do_hash && cparams->hash_verify) > - /* Do not cipher the hash tag */ > - op->sym->cipher.data.length = data_len - > - cparams->digest_length; > - else > - op->sym->cipher.data.length = data_len; > + op->sym->cipher.data.length = data_len; > } > } > > -- > 1.7.9.5