diff mbox series

[v3,5/6] test/crypto: add packets hard expiry tests

Message ID 1632823662-384-6-git-send-email-anoobj@marvell.com (mailing list archive)
State Superseded, archived
Delegated to: akhil goyal
Headers
Series Add SA lifetime in security |

Checks

Context Check Description
ci/checkpatch success coding style OK

Commit Message

Anoob Joseph Sept. 28, 2021, 10:07 a.m. UTC 
  Add tests to validate packets hard expiry handling.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>

---
 app/test/test_cryptodev.c                | 19 ++++++++++++++++++-
 app/test/test_cryptodev_security_ipsec.c | 22 +++++++++++++++++++---
 app/test/test_cryptodev_security_ipsec.h |  1 +
 3 files changed, 38 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 1befbeb..34b55a9 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9116,7 +9116,8 @@  test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 	int ret;
 
 	if (flags->iv_gen ||
-	    flags->sa_expiry_pkts_soft)
+	    flags->sa_expiry_pkts_soft ||
+	    flags->sa_expiry_pkts_hard)
 		nb_pkts = IPSEC_TEST_PACKETS_MAX;
 
 	for (i = 0; i < RTE_DIM(aead_list); i++) {
@@ -9193,6 +9194,18 @@  test_ipsec_proto_sa_exp_pkts_soft(const void *data __rte_unused)
 }
 
 static int
+test_ipsec_proto_sa_exp_pkts_hard(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.sa_expiry_pkts_hard = true;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
 test_ipsec_proto_err_icv_corrupt(const void *data __rte_unused)
 {
 	struct ipsec_test_flags flags;
@@ -14153,6 +14166,10 @@  static struct unit_test_suite ipsec_proto_testsuite  = {
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_sa_exp_pkts_soft),
 		TEST_CASE_NAMED_ST(
+			"SA expiry packets hard",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_sa_exp_pkts_hard),
+		TEST_CASE_NAMED_ST(
 			"Negative test: ICV corruption",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_err_icv_corrupt),
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 56a44b5..046536c 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -200,6 +200,10 @@  test_ipsec_td_update(struct ipsec_test_data td_inb[],
 			td_inb[i].input_text.data[icv_pos] += 1;
 		}
 
+		if (flags->sa_expiry_pkts_hard)
+			td_inb[i].ipsec_xform.life.packets_hard_limit =
+					IPSEC_TEST_PACKETS_MAX - 1;
+
 		if (flags->udp_encap)
 			td_inb[i].ipsec_xform.options.udp_encap = 1;
 
@@ -285,9 +289,10 @@  test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td,
 	uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *);
 	uint32_t skip, len = rte_pktmbuf_pkt_len(m);
 
-	/* For negative tests, no need to do verification */
-	if (flags->icv_corrupt &&
-	    td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
+	/* For tests with status as error for test success, skip verification */
+	if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS &&
+	    (flags->icv_corrupt ||
+	     flags->sa_expiry_pkts_hard))
 		return TEST_SUCCESS;
 
 	if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS &&
@@ -404,6 +409,17 @@  test_ipsec_status_check(struct rte_crypto_op *op,
 {
 	int ret = TEST_SUCCESS;
 
+	if (dir == RTE_SECURITY_IPSEC_SA_DIR_INGRESS &&
+	    flags->sa_expiry_pkts_hard &&
+	    pkt_num == IPSEC_TEST_PACKETS_MAX) {
+		if (op->status != RTE_CRYPTO_OP_STATUS_ERROR) {
+			printf("SA hard expiry (pkts) test failed\n");
+			return TEST_FAILED;
+		} else {
+			return TEST_SUCCESS;
+		}
+	}
+
 	if (dir == RTE_SECURITY_IPSEC_SA_DIR_INGRESS && flags->icv_corrupt) {
 		if (op->status != RTE_CRYPTO_OP_STATUS_ERROR) {
 			printf("ICV corruption test case failed\n");
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index eed3476..18f3c64 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -50,6 +50,7 @@  struct ipsec_test_data {
 struct ipsec_test_flags {
 	bool display_alg;
 	bool sa_expiry_pkts_soft;
+	bool sa_expiry_pkts_hard;
 	bool icv_corrupt;
 	bool iv_gen;
 	bool udp_encap;