From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <dev-bounces@dpdk.org>
Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124])
by inbox.dpdk.org (Postfix) with ESMTP id 5741DA00C3;
Fri, 13 May 2022 09:32:55 +0200 (CEST)
Received: from [217.70.189.124] (localhost [127.0.0.1])
by mails.dpdk.org (Postfix) with ESMTP id 592094284E;
Fri, 13 May 2022 09:32:36 +0200 (CEST)
Received: from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com
[67.231.148.174])
by mails.dpdk.org (Postfix) with ESMTP id 81E014284C
for <dev@dpdk.org>; Fri, 13 May 2022 09:32:35 +0200 (CEST)
Received: from pps.filterd (m0045849.ppops.net [127.0.0.1])
by mx0a-0016f401.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 24D6FCAO007609;
Fri, 13 May 2022 00:32:34 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com;
h=from : to : cc :
subject : date : message-id : in-reply-to : references : mime-version :
content-transfer-encoding : content-type; s=pfpt0220;
bh=GlslaEJkJDPdYyTSZFwtd3wAkz8YWE91UJDHyupQXOk=;
b=RNnY1ihPb+hEW/+smBd2Y0Z1xSmqPwVOwvPThXZrU+GFlRcDzWuVlGCblWSZbvVvfBTZ
u8jCTZSrZXD5DJFmNprULRyhKc+Rsb9QOBM8wj29ctGzAnIKYrfYv2byRbb8msGmtyPj
9Pkki9f4racK1DBbi3V+BfvbCR0CTjm46x6JBk+VpYajQRN3iK8z8MlGD3XY4RFyHehe
U1LT80bhBlbJq534hShiccL37dY7fMCmvzaopI3T7WFfWnpahN6pX6C3zmTt3AgmfK4u
1V1NDE4o3s4cSgoeZTn+UuEWI+R9WvtRyAPFu3EMmUkm1sZQm8twHtBbLO35W6pKvAdh 4Q==
Received: from dc5-exch01.marvell.com ([199.233.59.181])
by mx0a-0016f401.pphosted.com (PPS) with ESMTPS id 3g0yqwmyam-1
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT);
Fri, 13 May 2022 00:32:34 -0700
Received: from DC5-EXCH01.marvell.com (10.69.176.38) by DC5-EXCH01.marvell.com
(10.69.176.38) with Microsoft SMTP Server (TLS) id 15.0.1497.2;
Fri, 13 May 2022 00:32:33 -0700
Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH01.marvell.com
(10.69.176.38) with Microsoft SMTP Server id 15.0.1497.2 via Frontend
Transport; Fri, 13 May 2022 00:32:33 -0700
Received: from localhost.localdomain (unknown [10.28.48.55])
by maili.marvell.com (Postfix) with ESMTP id 778223F7052;
Fri, 13 May 2022 00:32:29 -0700 (PDT)
From: Akhil Goyal <gakhil@marvell.com>
To: <dev@dpdk.org>
CC: <thomas@monjalon.net>, <david.marchand@redhat.com>,
<hemant.agrawal@nxp.com>, <anoobj@marvell.com>,
<konstantin.ananyev@intel.com>, <ciara.power@intel.com>,
<ferruh.yigit@intel.com>, <andrew.rybchenko@oktetlabs.ru>,
<ndabilpuram@marvell.com>, <vattunuru@marvell.com>, Akhil Goyal
<gakhil@marvell.com>, Fan Zhang <roy.fan.zhang@intel.com>
Subject: [PATCH v6 6/7] test/security: add ESN and anti-replay cases for inline
Date: Fri, 13 May 2022 13:02:00 +0530
Message-ID: <20220513073201.2320812-7-gakhil@marvell.com>
X-Mailer: git-send-email 2.25.1
In-Reply-To: <20220513073201.2320812-1-gakhil@marvell.com>
References: <20220427151054.2536675-1-gakhil@marvell.com>
<20220513073201.2320812-1-gakhil@marvell.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
X-Proofpoint-ORIG-GUID: FYc1qYbc1FG0z2B_D2cuXJv9pboXG_Sf
X-Proofpoint-GUID: FYc1qYbc1FG0z2B_D2cuXJv9pboXG_Sf
X-Proofpoint-Virus-Version: vendor=baseguard
engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514
definitions=2022-05-13_02,2022-05-12_01,2022-02-23_01
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
<mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
<mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Added cases to test anti replay for inline IPsec processing
with and without extended sequence number support.
Signed-off-by: Akhil Goyal <gakhil@marvell.com>
Acked-by: Fan Zhang <roy.fan.zhang@intel.com>
---
app/test/test_security_inline_proto.c | 311 ++++++++++++++++++++++++++
1 file changed, 311 insertions(+)
diff --git a/app/test/test_security_inline_proto.c b/app/test/test_security_inline_proto.c
index ce68da7605..1c32141cd1 100644
--- a/app/test/test_security_inline_proto.c
+++ b/app/test/test_security_inline_proto.c
@@ -1098,6 +1098,139 @@ test_ipsec_inline_proto_all(const struct ipsec_test_flags *flags)
return TEST_SKIPPED;
}
+static int
+test_ipsec_inline_proto_process_with_esn(struct ipsec_test_data td[],
+ struct ipsec_test_data res_d[],
+ int nb_pkts,
+ bool silent,
+ const struct ipsec_test_flags *flags)
+{
+ struct rte_security_session_conf sess_conf = {0};
+ struct ipsec_test_data *res_d_tmp = NULL;
+ struct rte_crypto_sym_xform cipher = {0};
+ struct rte_crypto_sym_xform auth = {0};
+ struct rte_crypto_sym_xform aead = {0};
+ struct rte_mbuf *rx_pkt = NULL;
+ struct rte_mbuf *tx_pkt = NULL;
+ int nb_rx, nb_sent;
+ struct rte_security_session *ses;
+ struct rte_security_ctx *ctx;
+ uint32_t ol_flags;
+ int i, ret;
+
+ if (td[0].aead) {
+ sess_conf.crypto_xform = &aead;
+ } else {
+ if (td[0].ipsec_xform.direction ==
+ RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
+ sess_conf.crypto_xform = &cipher;
+ sess_conf.crypto_xform->type = RTE_CRYPTO_SYM_XFORM_CIPHER;
+ sess_conf.crypto_xform->next = &auth;
+ sess_conf.crypto_xform->next->type = RTE_CRYPTO_SYM_XFORM_AUTH;
+ } else {
+ sess_conf.crypto_xform = &auth;
+ sess_conf.crypto_xform->type = RTE_CRYPTO_SYM_XFORM_AUTH;
+ sess_conf.crypto_xform->next = &cipher;
+ sess_conf.crypto_xform->next->type = RTE_CRYPTO_SYM_XFORM_CIPHER;
+ }
+ }
+
+ /* Create Inline IPsec session. */
+ ret = create_inline_ipsec_session(&td[0], port_id, &ses, &ctx,
+ &ol_flags, flags, &sess_conf);
+ if (ret)
+ return ret;
+
+ if (td[0].ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
+ ret = create_default_flow(port_id);
+ if (ret)
+ goto out;
+ }
+
+ for (i = 0; i < nb_pkts; i++) {
+ tx_pkt = init_packet(mbufpool, td[i].input_text.data,
+ td[i].input_text.len);
+ if (tx_pkt == NULL) {
+ ret = TEST_FAILED;
+ goto out;
+ }
+
+ if (test_ipsec_pkt_update(rte_pktmbuf_mtod_offset(tx_pkt,
+ uint8_t *, RTE_ETHER_HDR_LEN), flags)) {
+ ret = TEST_FAILED;
+ goto out;
+ }
+
+ if (td[i].ipsec_xform.direction ==
+ RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
+ if (flags->antireplay) {
+ sess_conf.ipsec.esn.value =
+ td[i].ipsec_xform.esn.value;
+ ret = rte_security_session_update(ctx, ses,
+ &sess_conf);
+ if (ret) {
+ printf("Could not update ESN in session\n");
+ rte_pktmbuf_free(tx_pkt);
+ ret = TEST_SKIPPED;
+ goto out;
+ }
+ }
+ if (ol_flags & RTE_SECURITY_TX_OLOAD_NEED_MDATA)
+ rte_security_set_pkt_metadata(ctx, ses,
+ tx_pkt, NULL);
+ tx_pkt->ol_flags |= RTE_MBUF_F_TX_SEC_OFFLOAD;
+ }
+ /* Send packet to ethdev for inline IPsec processing. */
+ nb_sent = rte_eth_tx_burst(port_id, 0, &tx_pkt, 1);
+ if (nb_sent != 1) {
+ printf("\nUnable to TX packets");
+ rte_pktmbuf_free(tx_pkt);
+ ret = TEST_FAILED;
+ goto out;
+ }
+
+ rte_pause();
+
+ /* Receive back packet on loopback interface. */
+ do {
+ rte_delay_ms(1);
+ nb_rx = rte_eth_rx_burst(port_id, 0, &rx_pkt, 1);
+ } while (nb_rx == 0);
+
+ rte_pktmbuf_adj(rx_pkt, RTE_ETHER_HDR_LEN);
+
+ if (res_d != NULL)
+ res_d_tmp = &res_d[i];
+
+ ret = test_ipsec_post_process(rx_pkt, &td[i],
+ res_d_tmp, silent, flags);
+ if (ret != TEST_SUCCESS) {
+ rte_pktmbuf_free(rx_pkt);
+ goto out;
+ }
+
+ ret = test_ipsec_stats_verify(ctx, ses, flags,
+ td->ipsec_xform.direction);
+ if (ret != TEST_SUCCESS) {
+ rte_pktmbuf_free(rx_pkt);
+ goto out;
+ }
+
+ rte_pktmbuf_free(rx_pkt);
+ rx_pkt = NULL;
+ tx_pkt = NULL;
+ }
+
+out:
+ if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
+ destroy_default_flow(port_id);
+
+ /* Destroy session so that other cases can create the session again */
+ rte_security_session_destroy(ctx, ses);
+ ses = NULL;
+
+ return ret;
+}
static int
ut_setup_inline_ipsec(void)
@@ -1709,6 +1842,153 @@ test_ipsec_inline_proto_known_vec_fragmented(const void *test_data)
return test_ipsec_inline_proto_process(&td_outb, NULL, 1, false,
&flags);
}
+
+static int
+test_ipsec_inline_pkt_replay(const void *test_data, const uint64_t esn[],
+ bool replayed_pkt[], uint32_t nb_pkts, bool esn_en,
+ uint64_t winsz)
+{
+ struct ipsec_test_data td_outb[IPSEC_TEST_PACKETS_MAX];
+ struct ipsec_test_data td_inb[IPSEC_TEST_PACKETS_MAX];
+ struct ipsec_test_flags flags;
+ uint32_t i, ret = 0;
+
+ memset(&flags, 0, sizeof(flags));
+ flags.antireplay = true;
+
+ for (i = 0; i < nb_pkts; i++) {
+ memcpy(&td_outb[i], test_data, sizeof(td_outb));
+ td_outb[i].ipsec_xform.options.iv_gen_disable = 1;
+ td_outb[i].ipsec_xform.replay_win_sz = winsz;
+ td_outb[i].ipsec_xform.options.esn = esn_en;
+ }
+
+ for (i = 0; i < nb_pkts; i++)
+ td_outb[i].ipsec_xform.esn.value = esn[i];
+
+ ret = test_ipsec_inline_proto_process_with_esn(td_outb, td_inb,
+ nb_pkts, true, &flags);
+ if (ret != TEST_SUCCESS)
+ return ret;
+
+ test_ipsec_td_update(td_inb, td_outb, nb_pkts, &flags);
+
+ for (i = 0; i < nb_pkts; i++) {
+ td_inb[i].ipsec_xform.options.esn = esn_en;
+ /* Set antireplay flag for packets to be dropped */
+ td_inb[i].ar_packet = replayed_pkt[i];
+ }
+
+ ret = test_ipsec_inline_proto_process_with_esn(td_inb, NULL, nb_pkts,
+ true, &flags);
+
+ return ret;
+}
+
+static int
+test_ipsec_inline_proto_pkt_antireplay(const void *test_data, uint64_t winsz)
+{
+
+ uint32_t nb_pkts = 5;
+ bool replayed_pkt[5];
+ uint64_t esn[5];
+
+ /* 1. Advance the TOP of the window to WS * 2 */
+ esn[0] = winsz * 2;
+ /* 2. Test sequence number within the new window(WS + 1) */
+ esn[1] = winsz + 1;
+ /* 3. Test sequence number less than the window BOTTOM */
+ esn[2] = winsz;
+ /* 4. Test sequence number in the middle of the window */
+ esn[3] = winsz + (winsz / 2);
+ /* 5. Test replay of the packet in the middle of the window */
+ esn[4] = winsz + (winsz / 2);
+
+ replayed_pkt[0] = false;
+ replayed_pkt[1] = false;
+ replayed_pkt[2] = true;
+ replayed_pkt[3] = false;
+ replayed_pkt[4] = true;
+
+ return test_ipsec_inline_pkt_replay(test_data, esn, replayed_pkt,
+ nb_pkts, false, winsz);
+}
+
+static int
+test_ipsec_inline_proto_pkt_antireplay1024(const void *test_data)
+{
+ return test_ipsec_inline_proto_pkt_antireplay(test_data, 1024);
+}
+
+static int
+test_ipsec_inline_proto_pkt_antireplay2048(const void *test_data)
+{
+ return test_ipsec_inline_proto_pkt_antireplay(test_data, 2048);
+}
+
+static int
+test_ipsec_inline_proto_pkt_antireplay4096(const void *test_data)
+{
+ return test_ipsec_inline_proto_pkt_antireplay(test_data, 4096);
+}
+
+static int
+test_ipsec_inline_proto_pkt_esn_antireplay(const void *test_data, uint64_t winsz)
+{
+
+ uint32_t nb_pkts = 7;
+ bool replayed_pkt[7];
+ uint64_t esn[7];
+
+ /* Set the initial sequence number */
+ esn[0] = (uint64_t)(0xFFFFFFFF - winsz);
+ /* 1. Advance the TOP of the window to (1<<32 + WS/2) */
+ esn[1] = (uint64_t)((1ULL << 32) + (winsz / 2));
+ /* 2. Test sequence number within new window (1<<32 + WS/2 + 1) */
+ esn[2] = (uint64_t)((1ULL << 32) - (winsz / 2) + 1);
+ /* 3. Test with sequence number within window (1<<32 - 1) */
+ esn[3] = (uint64_t)((1ULL << 32) - 1);
+ /* 4. Test with sequence number within window (1<<32 - 1) */
+ esn[4] = (uint64_t)(1ULL << 32);
+ /* 5. Test with duplicate sequence number within
+ * new window (1<<32 - 1)
+ */
+ esn[5] = (uint64_t)((1ULL << 32) - 1);
+ /* 6. Test with duplicate sequence number within new window (1<<32) */
+ esn[6] = (uint64_t)(1ULL << 32);
+
+ replayed_pkt[0] = false;
+ replayed_pkt[1] = false;
+ replayed_pkt[2] = false;
+ replayed_pkt[3] = false;
+ replayed_pkt[4] = false;
+ replayed_pkt[5] = true;
+ replayed_pkt[6] = true;
+
+ return test_ipsec_inline_pkt_replay(test_data, esn, replayed_pkt, nb_pkts,
+ true, winsz);
+}
+
+static int
+test_ipsec_inline_proto_pkt_esn_antireplay1024(const void *test_data)
+{
+ return test_ipsec_inline_proto_pkt_esn_antireplay(test_data, 1024);
+}
+
+static int
+test_ipsec_inline_proto_pkt_esn_antireplay2048(const void *test_data)
+{
+ return test_ipsec_inline_proto_pkt_esn_antireplay(test_data, 2048);
+}
+
+static int
+test_ipsec_inline_proto_pkt_esn_antireplay4096(const void *test_data)
+{
+ return test_ipsec_inline_proto_pkt_esn_antireplay(test_data, 4096);
+}
+
+
+
static struct unit_test_suite inline_ipsec_testsuite = {
.suite_name = "Inline IPsec Ethernet Device Unit Test Suite",
.setup = inline_ipsec_testsuite_setup,
@@ -1935,6 +2215,37 @@ static struct unit_test_suite inline_ipsec_testsuite = {
test_ipsec_inline_proto_iv_gen),
+ TEST_CASE_NAMED_WITH_DATA(
+ "Antireplay with window size 1024",
+ ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
+ test_ipsec_inline_proto_pkt_antireplay1024,
+ &pkt_aes_128_gcm),
+ TEST_CASE_NAMED_WITH_DATA(
+ "Antireplay with window size 2048",
+ ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
+ test_ipsec_inline_proto_pkt_antireplay2048,
+ &pkt_aes_128_gcm),
+ TEST_CASE_NAMED_WITH_DATA(
+ "Antireplay with window size 4096",
+ ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
+ test_ipsec_inline_proto_pkt_antireplay4096,
+ &pkt_aes_128_gcm),
+ TEST_CASE_NAMED_WITH_DATA(
+ "ESN and Antireplay with window size 1024",
+ ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
+ test_ipsec_inline_proto_pkt_esn_antireplay1024,
+ &pkt_aes_128_gcm),
+ TEST_CASE_NAMED_WITH_DATA(
+ "ESN and Antireplay with window size 2048",
+ ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
+ test_ipsec_inline_proto_pkt_esn_antireplay2048,
+ &pkt_aes_128_gcm),
+ TEST_CASE_NAMED_WITH_DATA(
+ "ESN and Antireplay with window size 4096",
+ ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
+ test_ipsec_inline_proto_pkt_esn_antireplay4096,
+ &pkt_aes_128_gcm),
+
TEST_CASE_NAMED_WITH_DATA(
"IPv4 Reassembly with 2 fragments",
ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
--
2.25.1