From patchwork Fri May 13 07:32:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Akhil Goyal X-Patchwork-Id: 111111 X-Patchwork-Delegate: gakhil@marvell.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 5741DA00C3; Fri, 13 May 2022 09:32:55 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 592094284E; Fri, 13 May 2022 09:32:36 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by mails.dpdk.org (Postfix) with ESMTP id 81E014284C for ; Fri, 13 May 2022 09:32:35 +0200 (CEST) Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 24D6FCAO007609; Fri, 13 May 2022 00:32:34 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=pfpt0220; bh=GlslaEJkJDPdYyTSZFwtd3wAkz8YWE91UJDHyupQXOk=; b=RNnY1ihPb+hEW/+smBd2Y0Z1xSmqPwVOwvPThXZrU+GFlRcDzWuVlGCblWSZbvVvfBTZ u8jCTZSrZXD5DJFmNprULRyhKc+Rsb9QOBM8wj29ctGzAnIKYrfYv2byRbb8msGmtyPj 9Pkki9f4racK1DBbi3V+BfvbCR0CTjm46x6JBk+VpYajQRN3iK8z8MlGD3XY4RFyHehe U1LT80bhBlbJq534hShiccL37dY7fMCmvzaopI3T7WFfWnpahN6pX6C3zmTt3AgmfK4u 1V1NDE4o3s4cSgoeZTn+UuEWI+R9WvtRyAPFu3EMmUkm1sZQm8twHtBbLO35W6pKvAdh 4Q== Received: from dc5-exch01.marvell.com ([199.233.59.181]) by mx0a-0016f401.pphosted.com (PPS) with ESMTPS id 3g0yqwmyam-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 13 May 2022 00:32:34 -0700 Received: from DC5-EXCH01.marvell.com (10.69.176.38) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 13 May 2022 00:32:33 -0700 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Fri, 13 May 2022 00:32:33 -0700 Received: from localhost.localdomain (unknown [10.28.48.55]) by maili.marvell.com (Postfix) with ESMTP id 778223F7052; Fri, 13 May 2022 00:32:29 -0700 (PDT) From: Akhil Goyal To: CC: , , , , , , , , , , Akhil Goyal , Fan Zhang Subject: [PATCH v6 6/7] test/security: add ESN and anti-replay cases for inline Date: Fri, 13 May 2022 13:02:00 +0530 Message-ID: <20220513073201.2320812-7-gakhil@marvell.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220513073201.2320812-1-gakhil@marvell.com> References: <20220427151054.2536675-1-gakhil@marvell.com> <20220513073201.2320812-1-gakhil@marvell.com> MIME-Version: 1.0 X-Proofpoint-ORIG-GUID: FYc1qYbc1FG0z2B_D2cuXJv9pboXG_Sf X-Proofpoint-GUID: FYc1qYbc1FG0z2B_D2cuXJv9pboXG_Sf X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514 definitions=2022-05-13_02,2022-05-12_01,2022-02-23_01 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Added cases to test anti replay for inline IPsec processing with and without extended sequence number support. Signed-off-by: Akhil Goyal Acked-by: Fan Zhang --- app/test/test_security_inline_proto.c | 311 ++++++++++++++++++++++++++ 1 file changed, 311 insertions(+) diff --git a/app/test/test_security_inline_proto.c b/app/test/test_security_inline_proto.c index ce68da7605..1c32141cd1 100644 --- a/app/test/test_security_inline_proto.c +++ b/app/test/test_security_inline_proto.c @@ -1098,6 +1098,139 @@ test_ipsec_inline_proto_all(const struct ipsec_test_flags *flags) return TEST_SKIPPED; } +static int +test_ipsec_inline_proto_process_with_esn(struct ipsec_test_data td[], + struct ipsec_test_data res_d[], + int nb_pkts, + bool silent, + const struct ipsec_test_flags *flags) +{ + struct rte_security_session_conf sess_conf = {0}; + struct ipsec_test_data *res_d_tmp = NULL; + struct rte_crypto_sym_xform cipher = {0}; + struct rte_crypto_sym_xform auth = {0}; + struct rte_crypto_sym_xform aead = {0}; + struct rte_mbuf *rx_pkt = NULL; + struct rte_mbuf *tx_pkt = NULL; + int nb_rx, nb_sent; + struct rte_security_session *ses; + struct rte_security_ctx *ctx; + uint32_t ol_flags; + int i, ret; + + if (td[0].aead) { + sess_conf.crypto_xform = &aead; + } else { + if (td[0].ipsec_xform.direction == + RTE_SECURITY_IPSEC_SA_DIR_EGRESS) { + sess_conf.crypto_xform = &cipher; + sess_conf.crypto_xform->type = RTE_CRYPTO_SYM_XFORM_CIPHER; + sess_conf.crypto_xform->next = &auth; + sess_conf.crypto_xform->next->type = RTE_CRYPTO_SYM_XFORM_AUTH; + } else { + sess_conf.crypto_xform = &auth; + sess_conf.crypto_xform->type = RTE_CRYPTO_SYM_XFORM_AUTH; + sess_conf.crypto_xform->next = &cipher; + sess_conf.crypto_xform->next->type = RTE_CRYPTO_SYM_XFORM_CIPHER; + } + } + + /* Create Inline IPsec session. */ + ret = create_inline_ipsec_session(&td[0], port_id, &ses, &ctx, + &ol_flags, flags, &sess_conf); + if (ret) + return ret; + + if (td[0].ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) { + ret = create_default_flow(port_id); + if (ret) + goto out; + } + + for (i = 0; i < nb_pkts; i++) { + tx_pkt = init_packet(mbufpool, td[i].input_text.data, + td[i].input_text.len); + if (tx_pkt == NULL) { + ret = TEST_FAILED; + goto out; + } + + if (test_ipsec_pkt_update(rte_pktmbuf_mtod_offset(tx_pkt, + uint8_t *, RTE_ETHER_HDR_LEN), flags)) { + ret = TEST_FAILED; + goto out; + } + + if (td[i].ipsec_xform.direction == + RTE_SECURITY_IPSEC_SA_DIR_EGRESS) { + if (flags->antireplay) { + sess_conf.ipsec.esn.value = + td[i].ipsec_xform.esn.value; + ret = rte_security_session_update(ctx, ses, + &sess_conf); + if (ret) { + printf("Could not update ESN in session\n"); + rte_pktmbuf_free(tx_pkt); + ret = TEST_SKIPPED; + goto out; + } + } + if (ol_flags & RTE_SECURITY_TX_OLOAD_NEED_MDATA) + rte_security_set_pkt_metadata(ctx, ses, + tx_pkt, NULL); + tx_pkt->ol_flags |= RTE_MBUF_F_TX_SEC_OFFLOAD; + } + /* Send packet to ethdev for inline IPsec processing. */ + nb_sent = rte_eth_tx_burst(port_id, 0, &tx_pkt, 1); + if (nb_sent != 1) { + printf("\nUnable to TX packets"); + rte_pktmbuf_free(tx_pkt); + ret = TEST_FAILED; + goto out; + } + + rte_pause(); + + /* Receive back packet on loopback interface. */ + do { + rte_delay_ms(1); + nb_rx = rte_eth_rx_burst(port_id, 0, &rx_pkt, 1); + } while (nb_rx == 0); + + rte_pktmbuf_adj(rx_pkt, RTE_ETHER_HDR_LEN); + + if (res_d != NULL) + res_d_tmp = &res_d[i]; + + ret = test_ipsec_post_process(rx_pkt, &td[i], + res_d_tmp, silent, flags); + if (ret != TEST_SUCCESS) { + rte_pktmbuf_free(rx_pkt); + goto out; + } + + ret = test_ipsec_stats_verify(ctx, ses, flags, + td->ipsec_xform.direction); + if (ret != TEST_SUCCESS) { + rte_pktmbuf_free(rx_pkt); + goto out; + } + + rte_pktmbuf_free(rx_pkt); + rx_pkt = NULL; + tx_pkt = NULL; + } + +out: + if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) + destroy_default_flow(port_id); + + /* Destroy session so that other cases can create the session again */ + rte_security_session_destroy(ctx, ses); + ses = NULL; + + return ret; +} static int ut_setup_inline_ipsec(void) @@ -1709,6 +1842,153 @@ test_ipsec_inline_proto_known_vec_fragmented(const void *test_data) return test_ipsec_inline_proto_process(&td_outb, NULL, 1, false, &flags); } + +static int +test_ipsec_inline_pkt_replay(const void *test_data, const uint64_t esn[], + bool replayed_pkt[], uint32_t nb_pkts, bool esn_en, + uint64_t winsz) +{ + struct ipsec_test_data td_outb[IPSEC_TEST_PACKETS_MAX]; + struct ipsec_test_data td_inb[IPSEC_TEST_PACKETS_MAX]; + struct ipsec_test_flags flags; + uint32_t i, ret = 0; + + memset(&flags, 0, sizeof(flags)); + flags.antireplay = true; + + for (i = 0; i < nb_pkts; i++) { + memcpy(&td_outb[i], test_data, sizeof(td_outb)); + td_outb[i].ipsec_xform.options.iv_gen_disable = 1; + td_outb[i].ipsec_xform.replay_win_sz = winsz; + td_outb[i].ipsec_xform.options.esn = esn_en; + } + + for (i = 0; i < nb_pkts; i++) + td_outb[i].ipsec_xform.esn.value = esn[i]; + + ret = test_ipsec_inline_proto_process_with_esn(td_outb, td_inb, + nb_pkts, true, &flags); + if (ret != TEST_SUCCESS) + return ret; + + test_ipsec_td_update(td_inb, td_outb, nb_pkts, &flags); + + for (i = 0; i < nb_pkts; i++) { + td_inb[i].ipsec_xform.options.esn = esn_en; + /* Set antireplay flag for packets to be dropped */ + td_inb[i].ar_packet = replayed_pkt[i]; + } + + ret = test_ipsec_inline_proto_process_with_esn(td_inb, NULL, nb_pkts, + true, &flags); + + return ret; +} + +static int +test_ipsec_inline_proto_pkt_antireplay(const void *test_data, uint64_t winsz) +{ + + uint32_t nb_pkts = 5; + bool replayed_pkt[5]; + uint64_t esn[5]; + + /* 1. Advance the TOP of the window to WS * 2 */ + esn[0] = winsz * 2; + /* 2. Test sequence number within the new window(WS + 1) */ + esn[1] = winsz + 1; + /* 3. Test sequence number less than the window BOTTOM */ + esn[2] = winsz; + /* 4. Test sequence number in the middle of the window */ + esn[3] = winsz + (winsz / 2); + /* 5. Test replay of the packet in the middle of the window */ + esn[4] = winsz + (winsz / 2); + + replayed_pkt[0] = false; + replayed_pkt[1] = false; + replayed_pkt[2] = true; + replayed_pkt[3] = false; + replayed_pkt[4] = true; + + return test_ipsec_inline_pkt_replay(test_data, esn, replayed_pkt, + nb_pkts, false, winsz); +} + +static int +test_ipsec_inline_proto_pkt_antireplay1024(const void *test_data) +{ + return test_ipsec_inline_proto_pkt_antireplay(test_data, 1024); +} + +static int +test_ipsec_inline_proto_pkt_antireplay2048(const void *test_data) +{ + return test_ipsec_inline_proto_pkt_antireplay(test_data, 2048); +} + +static int +test_ipsec_inline_proto_pkt_antireplay4096(const void *test_data) +{ + return test_ipsec_inline_proto_pkt_antireplay(test_data, 4096); +} + +static int +test_ipsec_inline_proto_pkt_esn_antireplay(const void *test_data, uint64_t winsz) +{ + + uint32_t nb_pkts = 7; + bool replayed_pkt[7]; + uint64_t esn[7]; + + /* Set the initial sequence number */ + esn[0] = (uint64_t)(0xFFFFFFFF - winsz); + /* 1. Advance the TOP of the window to (1<<32 + WS/2) */ + esn[1] = (uint64_t)((1ULL << 32) + (winsz / 2)); + /* 2. Test sequence number within new window (1<<32 + WS/2 + 1) */ + esn[2] = (uint64_t)((1ULL << 32) - (winsz / 2) + 1); + /* 3. Test with sequence number within window (1<<32 - 1) */ + esn[3] = (uint64_t)((1ULL << 32) - 1); + /* 4. Test with sequence number within window (1<<32 - 1) */ + esn[4] = (uint64_t)(1ULL << 32); + /* 5. Test with duplicate sequence number within + * new window (1<<32 - 1) + */ + esn[5] = (uint64_t)((1ULL << 32) - 1); + /* 6. Test with duplicate sequence number within new window (1<<32) */ + esn[6] = (uint64_t)(1ULL << 32); + + replayed_pkt[0] = false; + replayed_pkt[1] = false; + replayed_pkt[2] = false; + replayed_pkt[3] = false; + replayed_pkt[4] = false; + replayed_pkt[5] = true; + replayed_pkt[6] = true; + + return test_ipsec_inline_pkt_replay(test_data, esn, replayed_pkt, nb_pkts, + true, winsz); +} + +static int +test_ipsec_inline_proto_pkt_esn_antireplay1024(const void *test_data) +{ + return test_ipsec_inline_proto_pkt_esn_antireplay(test_data, 1024); +} + +static int +test_ipsec_inline_proto_pkt_esn_antireplay2048(const void *test_data) +{ + return test_ipsec_inline_proto_pkt_esn_antireplay(test_data, 2048); +} + +static int +test_ipsec_inline_proto_pkt_esn_antireplay4096(const void *test_data) +{ + return test_ipsec_inline_proto_pkt_esn_antireplay(test_data, 4096); +} + + + static struct unit_test_suite inline_ipsec_testsuite = { .suite_name = "Inline IPsec Ethernet Device Unit Test Suite", .setup = inline_ipsec_testsuite_setup, @@ -1935,6 +2215,37 @@ static struct unit_test_suite inline_ipsec_testsuite = { test_ipsec_inline_proto_iv_gen), + TEST_CASE_NAMED_WITH_DATA( + "Antireplay with window size 1024", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_pkt_antireplay1024, + &pkt_aes_128_gcm), + TEST_CASE_NAMED_WITH_DATA( + "Antireplay with window size 2048", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_pkt_antireplay2048, + &pkt_aes_128_gcm), + TEST_CASE_NAMED_WITH_DATA( + "Antireplay with window size 4096", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_pkt_antireplay4096, + &pkt_aes_128_gcm), + TEST_CASE_NAMED_WITH_DATA( + "ESN and Antireplay with window size 1024", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_pkt_esn_antireplay1024, + &pkt_aes_128_gcm), + TEST_CASE_NAMED_WITH_DATA( + "ESN and Antireplay with window size 2048", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_pkt_esn_antireplay2048, + &pkt_aes_128_gcm), + TEST_CASE_NAMED_WITH_DATA( + "ESN and Antireplay with window size 4096", + ut_setup_inline_ipsec, ut_teardown_inline_ipsec, + test_ipsec_inline_proto_pkt_esn_antireplay4096, + &pkt_aes_128_gcm), + TEST_CASE_NAMED_WITH_DATA( "IPv4 Reassembly with 2 fragments", ut_setup_inline_ipsec, ut_teardown_inline_ipsec,