From patchwork Wed Sep 29 09:08:09 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Archana Muniganti X-Patchwork-Id: 99979 X-Patchwork-Delegate: gakhil@marvell.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 7DEBFA0547; Wed, 29 Sep 2021 11:08:33 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 323E2410ED; Wed, 29 Sep 2021 11:08:31 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by mails.dpdk.org (Postfix) with ESMTP id 0A91E410ED for ; Wed, 29 Sep 2021 11:08:29 +0200 (CEST) Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18T8e2p8005169; Wed, 29 Sep 2021 02:08:29 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=pfpt0220; bh=eNnu20Rs/i3tK8U1fLNPYSL5X73bBCwZy5v37jri4Ms=; b=QFbqcUC8vbs8K0z+j7ug4/JNI0lLQbur8BnJwS/JqrjuDqdW22i0Ugsp9GWKThvcik14 b17a4RlEBMGSjVdWxvt2ivaI4CsPJzak/KJeJiLxiMACEBDImur9HFt1RE+1184vLxHe wUyD7QYxs4f/OtRsIdjVpV8Lis5q+2oRqCcGyenVRa7qU4u+0lVPSlC5P0lW3GTgCRCZ 0yHO4NGEsPWwRkuOoSpPsjVjVZhjOchffTrVgMrIlqoPo0oUy/ODJEDQTHkgnUfBaFFT ngb6aN1pGL8m5zw2VT3mhoohiwkcpXE46dDC+4Z4w/kfmzuaPqts9dyVaVcBzNlNZE41 uQ== Received: from dc5-exch02.marvell.com ([199.233.59.182]) by mx0a-0016f401.pphosted.com with ESMTP id 3bcknk8cv3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 29 Sep 2021 02:08:29 -0700 Received: from DC5-EXCH02.marvell.com (10.69.176.39) by DC5-EXCH02.marvell.com (10.69.176.39) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Wed, 29 Sep 2021 02:08:27 -0700 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH02.marvell.com (10.69.176.39) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Wed, 29 Sep 2021 02:08:27 -0700 Received: from hyd1409.caveonetworks.com.com (unknown [10.29.45.15]) by maili.marvell.com (Postfix) with ESMTP id AF20A3F707D; Wed, 29 Sep 2021 02:08:24 -0700 (PDT) From: Archana Muniganti To: , , , , CC: Archana Muniganti , , , , , Date: Wed, 29 Sep 2021 14:38:09 +0530 Message-ID: <20210929090811.21030-2-marchana@marvell.com> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20210929090811.21030-1-marchana@marvell.com> References: <20210929090811.21030-1-marchana@marvell.com> MIME-Version: 1.0 X-Proofpoint-GUID: CPWqQLiyroFXxw-p4PjXh4UczoZnowX4 X-Proofpoint-ORIG-GUID: CPWqQLiyroFXxw-p4PjXh4UczoZnowX4 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.790,Hydra:6.0.391,FMLib:17.0.607.475 definitions=2021-09-29_02,2021-09-28_01,2020-04-07_01 Subject: [dpdk-dev] [PATCH v2 1/3] security: add SA config option for inner pkt csum X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Add inner packet IPv4 hdr and L4 checksum enable options in conf. These will be used in case of protocol offload. Per SA, application could specify whether the checksum(compute/verify) can be offloaded to security device. Signed-off-by: Archana Muniganti --- doc/guides/cryptodevs/features/default.ini | 1 + doc/guides/rel_notes/deprecation.rst | 4 ++-- doc/guides/rel_notes/release_21_11.rst | 4 ++++ lib/cryptodev/rte_cryptodev.h | 2 ++ lib/security/rte_security.h | 18 ++++++++++++++++++ 5 files changed, 27 insertions(+), 2 deletions(-) diff --git a/doc/guides/cryptodevs/features/default.ini b/doc/guides/cryptodevs/features/default.ini index c24814de98..96d95ddc81 100644 --- a/doc/guides/cryptodevs/features/default.ini +++ b/doc/guides/cryptodevs/features/default.ini @@ -33,6 +33,7 @@ Non-Byte aligned data = Sym raw data path API = Cipher multiple data units = Cipher wrapped key = +Inner checksum = ; ; Supported crypto algorithms of a default crypto driver. diff --git a/doc/guides/rel_notes/deprecation.rst b/doc/guides/rel_notes/deprecation.rst index 05fc2fdee7..8308e00ed4 100644 --- a/doc/guides/rel_notes/deprecation.rst +++ b/doc/guides/rel_notes/deprecation.rst @@ -232,8 +232,8 @@ Deprecation Notices IPsec payload MSS (Maximum Segment Size), and ESN (Extended Sequence Number). * security: The IPsec SA config options ``struct rte_security_ipsec_sa_options`` - will be updated with new fields to support new features like IPsec inner - checksum, TSO in case of protocol offload. + will be updated with new fields to support new features like TSO in case of + protocol offload. * ipsec: The structure ``rte_ipsec_sa_prm`` will be extended with a new field ``hdr_l3_len`` to configure tunnel L3 header length. diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst index 8da851cccc..93d1b36889 100644 --- a/doc/guides/rel_notes/release_21_11.rst +++ b/doc/guides/rel_notes/release_21_11.rst @@ -194,6 +194,10 @@ ABI Changes ``rte_security_ipsec_xform`` to allow applications to configure SA soft and hard expiry limits. Limits can be either in number of packets or bytes. +* security: The new options ``ip_csum_enable`` and ``l4_csum_enable`` were added + in structure ``rte_security_ipsec_sa_options`` to indicate whether inner + packet IPv4 header checksum and L4 checksum need to be offloaded to + security device. Known Issues ------------ diff --git a/lib/cryptodev/rte_cryptodev.h b/lib/cryptodev/rte_cryptodev.h index bb01f0f195..d9271a6c45 100644 --- a/lib/cryptodev/rte_cryptodev.h +++ b/lib/cryptodev/rte_cryptodev.h @@ -479,6 +479,8 @@ rte_cryptodev_asym_get_xform_enum(enum rte_crypto_asym_xform_type *xform_enum, /**< Support operations on multiple data-units message */ #define RTE_CRYPTODEV_FF_CIPHER_WRAPPED_KEY (1ULL << 26) /**< Support wrapped key in cipher xform */ +#define RTE_CRYPTODEV_FF_SECURITY_INNER_CSUM (1ULL << 27) +/**< Support inner checksum computation/verification */ /** * Get the name of a crypto device feature flag diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h index ab1a6e1f65..945f45ad76 100644 --- a/lib/security/rte_security.h +++ b/lib/security/rte_security.h @@ -230,6 +230,24 @@ struct rte_security_ipsec_sa_options { * * 0: Do not match UDP ports */ uint32_t udp_ports_verify : 1; + + /** Compute/verify inner packet IPv4 header checksum in tunnel mode + * + * * 1: For outbound, compute inner packet IPv4 header checksum + * before tunnel encapsulation and for inbound, verify after + * tunnel decapsulation. + * * 0: Inner packet IP header checksum is not computed/verified. + */ + uint32_t ip_csum_enable : 1; + + /** Compute/verify inner packet L4 checksum in tunnel mode + * + * * 1: For outbound, compute inner packet L4 checksum before + * tunnel encapsulation and for inbound, verify after + * tunnel decapsulation. + * * 0: Inner packet L4 checksum is not computed/verified. + */ + uint32_t l4_csum_enable : 1; }; /** IPSec security association direction */ From patchwork Wed Sep 29 09:08:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Archana Muniganti X-Patchwork-Id: 99980 X-Patchwork-Delegate: gakhil@marvell.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 62497A0547; Wed, 29 Sep 2021 11:08:39 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 3E3C8410F2; Wed, 29 Sep 2021 11:08:35 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by mails.dpdk.org (Postfix) with ESMTP id BFF0940E3C for ; Wed, 29 Sep 2021 11:08:33 +0200 (CEST) Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18T8daQf004913; Wed, 29 Sep 2021 02:08:32 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=pfpt0220; bh=+dc7wvIg6qBHwZFt53Znvpzvk/UiUpGmbq8a92t8ntM=; b=K0suQtLNKVYZ3ybC/GOsFvG9FSQ6vgD2da/i+yCUtH1tn8HFdwmYCoeP2QYMSdxVRNSF +yZpOqv+MzYlZuKoJmuJfckMsymBOLur9v0Wyn3VP61Fy3/waSUtkZPwqyM4IkmIz27q Yty6oYUbkThXmBt84ZRLy0koSMdRgwg4Jm/G/PzdqKjEgHntx6nQc2ah4O5pLHjlmxCy m+BhVLZx//JsEdnQM2KXW2wz0X/wvZ3ALL9NEL+C+j9s8W2/I3ixk1aDD9KYvuCSpfT+ Zx0DTVXzNdX21P8VoBcEh7CoLgHY5TjrKulBSkN41rPMDNwoj7Qoqjkdt/65tigtrda4 1w== Received: from dc5-exch02.marvell.com ([199.233.59.182]) by mx0a-0016f401.pphosted.com with ESMTP id 3bcknk8cw0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 29 Sep 2021 02:08:32 -0700 Received: from DC5-EXCH01.marvell.com (10.69.176.38) by DC5-EXCH02.marvell.com (10.69.176.39) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Wed, 29 Sep 2021 02:08:31 -0700 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Wed, 29 Sep 2021 02:08:31 -0700 Received: from hyd1409.caveonetworks.com.com (unknown [10.29.45.15]) by maili.marvell.com (Postfix) with ESMTP id 618463F707E; Wed, 29 Sep 2021 02:08:28 -0700 (PDT) From: Archana Muniganti To: , , , , CC: Archana Muniganti , , , , , Date: Wed, 29 Sep 2021 14:38:10 +0530 Message-ID: <20210929090811.21030-3-marchana@marvell.com> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20210929090811.21030-1-marchana@marvell.com> References: <20210929090811.21030-1-marchana@marvell.com> MIME-Version: 1.0 X-Proofpoint-GUID: VaAf7AhoukICqVvJIUC8v14T1orLND_A X-Proofpoint-ORIG-GUID: VaAf7AhoukICqVvJIUC8v14T1orLND_A X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.790,Hydra:6.0.391,FMLib:17.0.607.475 definitions=2021-09-29_02,2021-09-28_01,2020-04-07_01 Subject: [dpdk-dev] [PATCH v2 2/3] crypto/cnxk: add inner checksum X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Add inner checksum support for cn10k. Signed-off-by: Archana Muniganti --- doc/guides/cryptodevs/features/cn10k.ini | 1 + doc/guides/rel_notes/release_21_11.rst | 1 + drivers/crypto/cnxk/cn10k_cryptodev_ops.c | 65 +++++++++++++++---- drivers/crypto/cnxk/cn10k_ipsec.c | 49 +++++++++++++- drivers/crypto/cnxk/cn10k_ipsec.h | 1 + drivers/crypto/cnxk/cn10k_ipsec_la_ops.h | 9 ++- drivers/crypto/cnxk/cnxk_cryptodev.c | 3 + .../crypto/cnxk/cnxk_cryptodev_capabilities.c | 2 + 8 files changed, 113 insertions(+), 18 deletions(-) diff --git a/doc/guides/cryptodevs/features/cn10k.ini b/doc/guides/cryptodevs/features/cn10k.ini index f5552feca3..9d08bd5c04 100644 --- a/doc/guides/cryptodevs/features/cn10k.ini +++ b/doc/guides/cryptodevs/features/cn10k.ini @@ -15,6 +15,7 @@ OOP SGL In SGL Out = Y OOP LB In LB Out = Y Symmetric sessionless = Y Digest encrypted = Y +Inner checksum = Y ; ; Supported crypto algorithms of 'cn10k' crypto driver. diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst index 93d1b36889..163cdaa800 100644 --- a/doc/guides/rel_notes/release_21_11.rst +++ b/doc/guides/rel_notes/release_21_11.rst @@ -72,6 +72,7 @@ New Features * Added Transport mode support in lookaside protocol (IPsec) for CN10K. * Added UDP encapsulation support in lookaside protocol (IPsec) for CN10K. * Added support for lookaside protocol (IPsec) offload for CN9K. + * Added inner checksum support in lookaside protocol (IPsec) for CN10K. * **Added support for event crypto adapter on Marvell CN10K and CN9K.** diff --git a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c index 3caf05aab9..c25c8e67b2 100644 --- a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c +++ b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c @@ -50,7 +50,7 @@ cn10k_cpt_sym_temp_sess_create(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op) static __rte_always_inline int __rte_hot cpt_sec_inst_fill(struct rte_crypto_op *op, struct cn10k_sec_session *sess, - struct cpt_inst_s *inst) + struct cpt_inflight_req *infl_req, struct cpt_inst_s *inst) { struct rte_crypto_sym_op *sym_op = op->sym; union roc_ot_ipsec_sa_word2 *w2; @@ -72,8 +72,10 @@ cpt_sec_inst_fill(struct rte_crypto_op *op, struct cn10k_sec_session *sess, if (w2->s.dir == ROC_IE_SA_DIR_OUTBOUND) ret = process_outb_sa(op, sa, inst); - else + else { + infl_req->op_flags |= CPT_OP_FLAGS_IPSEC_DIR_INBOUND; ret = process_inb_sa(op, sa, inst); + } return ret; } @@ -122,7 +124,8 @@ cn10k_cpt_fill_inst(struct cnxk_cpt_qp *qp, struct rte_crypto_op *ops[], if (op->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION) { sec_sess = get_sec_session_private_data( sym_op->sec_session); - ret = cpt_sec_inst_fill(op, sec_sess, &inst[0]); + ret = cpt_sec_inst_fill(op, sec_sess, infl_req, + &inst[0]); if (unlikely(ret)) return 0; w7 = sec_sess->sa.inst.w7; @@ -342,6 +345,49 @@ cn10k_cpt_sec_post_process(struct rte_crypto_op *cop, m->pkt_len = m_len; } +static inline void +cn10k_cpt_sec_ucc_process(struct rte_crypto_op *cop, + struct cpt_inflight_req *infl_req, + const uint8_t uc_compcode) +{ + struct cn10k_sec_session *sess; + struct cn10k_ipsec_sa *sa; + struct rte_mbuf *mbuf; + + if (uc_compcode == ROC_IE_OT_UCC_SUCCESS_SA_SOFTEXP_FIRST) + cop->aux_flags = RTE_CRYPTO_OP_AUX_FLAGS_IPSEC_SOFT_EXPIRY; + + if (!(infl_req->op_flags & CPT_OP_FLAGS_IPSEC_DIR_INBOUND)) + return; + + sess = get_sec_session_private_data(cop->sym->sec_session); + sa = &sess->sa; + + mbuf = cop->sym->m_src; + + switch (uc_compcode) { + case ROC_IE_OT_UCC_SUCCESS: + if (sa->ip_csum_enable) + mbuf->ol_flags |= PKT_RX_IP_CKSUM_GOOD; + break; + case ROC_IE_OT_UCC_SUCCESS_PKT_IP_BADCSUM: + mbuf->ol_flags |= PKT_RX_IP_CKSUM_BAD; + break; + case ROC_IE_OT_UCC_SUCCESS_PKT_L4_GOODCSUM: + mbuf->ol_flags |= PKT_RX_L4_CKSUM_GOOD; + if (sa->ip_csum_enable) + mbuf->ol_flags |= PKT_RX_IP_CKSUM_GOOD; + break; + case ROC_IE_OT_UCC_SUCCESS_PKT_L4_BADCSUM: + mbuf->ol_flags |= PKT_RX_L4_CKSUM_BAD; + if (sa->ip_csum_enable) + mbuf->ol_flags |= PKT_RX_IP_CKSUM_GOOD; + break; + default: + break; + } +} + static inline void cn10k_cpt_dequeue_post_process(struct cnxk_cpt_qp *qp, struct rte_crypto_op *cop, @@ -357,17 +403,8 @@ cn10k_cpt_dequeue_post_process(struct cnxk_cpt_qp *qp, if (cop->type == RTE_CRYPTO_OP_TYPE_SYMMETRIC && cop->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION) { if (likely(compcode == CPT_COMP_WARN)) { - if (unlikely(uc_compcode != ROC_IE_OT_UCC_SUCCESS)) { - /* Success with additional info */ - switch (uc_compcode) { - case ROC_IE_OT_UCC_SUCCESS_SA_SOFTEXP_FIRST: - cop->aux_flags = - RTE_CRYPTO_OP_AUX_FLAGS_IPSEC_SOFT_EXPIRY; - break; - default: - break; - } - } + /* Success with additional info */ + cn10k_cpt_sec_ucc_process(cop, infl_req, uc_compcode); cn10k_cpt_sec_post_process(cop, res); } else { cop->status = RTE_CRYPTO_OP_STATUS_ERROR; diff --git a/drivers/crypto/cnxk/cn10k_ipsec.c b/drivers/crypto/cnxk/cn10k_ipsec.c index ebb2a7ec48..defc792aa8 100644 --- a/drivers/crypto/cnxk/cn10k_ipsec.c +++ b/drivers/crypto/cnxk/cn10k_ipsec.c @@ -37,6 +37,7 @@ cn10k_ipsec_outb_sa_create(struct roc_cpt *roc_cpt, struct rte_crypto_sym_xform *crypto_xfrm, struct rte_security_session *sec_sess) { + union roc_ot_ipsec_outb_param1 param1; struct roc_ot_ipsec_outb_sa *out_sa; struct cnxk_ipsec_outb_rlens rlens; struct cn10k_sec_session *sess; @@ -83,7 +84,27 @@ cn10k_ipsec_outb_sa_create(struct roc_cpt *roc_cpt, /* pre-populate CPT INST word 4 */ inst_w4.u64 = 0; inst_w4.s.opcode_major = ROC_IE_OT_MAJOR_OP_PROCESS_OUTBOUND_IPSEC; - inst_w4.s.param1 = 0; + + param1.u16 = 0; + + /* Disable IP checksum computation by default */ + param1.s.ip_csum_disable = ROC_IE_OT_SA_INNER_PKT_IP_CSUM_DISABLE; + + if (ipsec_xfrm->options.ip_csum_enable) { + param1.s.ip_csum_disable = + ROC_IE_OT_SA_INNER_PKT_IP_CSUM_ENABLE; + } + + /* Disable L4 checksum computation by default */ + param1.s.l4_csum_disable = ROC_IE_OT_SA_INNER_PKT_L4_CSUM_DISABLE; + + if (ipsec_xfrm->options.l4_csum_enable) { + param1.s.l4_csum_disable = + ROC_IE_OT_SA_INNER_PKT_L4_CSUM_ENABLE; + } + + inst_w4.s.param1 = param1.u16; + sa->inst.w4 = inst_w4.u64; return 0; @@ -95,6 +116,7 @@ cn10k_ipsec_inb_sa_create(struct roc_cpt *roc_cpt, struct rte_crypto_sym_xform *crypto_xfrm, struct rte_security_session *sec_sess) { + union roc_ot_ipsec_inb_param1 param1; struct roc_ot_ipsec_inb_sa *in_sa; struct cn10k_sec_session *sess; struct cn10k_ipsec_sa *sa; @@ -121,8 +143,29 @@ cn10k_ipsec_inb_sa_create(struct roc_cpt *roc_cpt, inst_w4.u64 = 0; inst_w4.s.opcode_major = ROC_IE_OT_MAJOR_OP_PROCESS_INBOUND_IPSEC; - /* Disable checksum verification for now */ - inst_w4.s.param1 = 7; + param1.u16 = 0; + + /* Disable IP checksum verification by default */ + param1.s.ip_csum_disable = ROC_IE_OT_SA_INNER_PKT_IP_CSUM_DISABLE; + + if (ipsec_xfrm->options.ip_csum_enable) { + param1.s.ip_csum_disable = + ROC_IE_OT_SA_INNER_PKT_IP_CSUM_ENABLE; + sa->ip_csum_enable = true; + } + + /* Disable L4 checksum verification by default */ + param1.s.l4_csum_disable = ROC_IE_OT_SA_INNER_PKT_L4_CSUM_DISABLE; + + if (ipsec_xfrm->options.l4_csum_enable) { + param1.s.l4_csum_disable = + ROC_IE_OT_SA_INNER_PKT_L4_CSUM_ENABLE; + } + + param1.s.esp_trailer_disable = 1; + + inst_w4.s.param1 = param1.u16; + sa->inst.w4 = inst_w4.u64; return 0; diff --git a/drivers/crypto/cnxk/cn10k_ipsec.h b/drivers/crypto/cnxk/cn10k_ipsec.h index 6f974b716d..86cd2483f5 100644 --- a/drivers/crypto/cnxk/cn10k_ipsec.h +++ b/drivers/crypto/cnxk/cn10k_ipsec.h @@ -23,6 +23,7 @@ struct cn10k_ipsec_sa { uint16_t max_extended_len; uint16_t iv_offset; uint8_t iv_length; + bool ip_csum_enable; }; struct cn10k_sec_session { diff --git a/drivers/crypto/cnxk/cn10k_ipsec_la_ops.h b/drivers/crypto/cnxk/cn10k_ipsec_la_ops.h index 862476a72e..df1b0a3678 100644 --- a/drivers/crypto/cnxk/cn10k_ipsec_la_ops.h +++ b/drivers/crypto/cnxk/cn10k_ipsec_la_ops.h @@ -53,6 +53,7 @@ process_outb_sa(struct rte_crypto_op *cop, struct cn10k_ipsec_sa *sess, { struct rte_crypto_sym_op *sym_op = cop->sym; struct rte_mbuf *m_src = sym_op->m_src; + uint64_t inst_w4_u64 = sess->inst.w4; if (unlikely(rte_pktmbuf_tailroom(m_src) < sess->max_extended_len)) { plt_dp_err("Not enough tail room"); @@ -68,8 +69,14 @@ process_outb_sa(struct rte_crypto_op *cop, struct cn10k_ipsec_sa *sess, } #endif + if (m_src->ol_flags & PKT_TX_IP_CKSUM) + inst_w4_u64 &= ~BIT_ULL(33); + + if (m_src->ol_flags & PKT_TX_L4_MASK) + inst_w4_u64 &= ~BIT_ULL(32); + /* Prepare CPT instruction */ - inst->w4.u64 = sess->inst.w4; + inst->w4.u64 = inst_w4_u64; inst->w4.s.dlen = rte_pktmbuf_pkt_len(m_src); inst->dptr = rte_pktmbuf_iova(m_src); inst->rptr = inst->dptr; diff --git a/drivers/crypto/cnxk/cnxk_cryptodev.c b/drivers/crypto/cnxk/cnxk_cryptodev.c index 5c7801ec48..d67de54a7b 100644 --- a/drivers/crypto/cnxk/cnxk_cryptodev.c +++ b/drivers/crypto/cnxk/cnxk_cryptodev.c @@ -24,6 +24,9 @@ cnxk_cpt_default_ff_get(void) RTE_CRYPTODEV_FF_DIGEST_ENCRYPTED | RTE_CRYPTODEV_FF_SECURITY; + if (roc_model_is_cn10k()) + ff |= RTE_CRYPTODEV_FF_SECURITY_INNER_CSUM; + return ff; } diff --git a/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c b/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c index ba4166c56d..20df37709a 100644 --- a/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c +++ b/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c @@ -926,6 +926,8 @@ cn10k_sec_caps_update(struct rte_security_capability *sec_cap) sec_cap->ipsec.options.tunnel_hdr_verify = RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR; } + sec_cap->ipsec.options.ip_csum_enable = 1; + sec_cap->ipsec.options.l4_csum_enable = 1; } static void From patchwork Wed Sep 29 09:08:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Archana Muniganti X-Patchwork-Id: 99981 X-Patchwork-Delegate: gakhil@marvell.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 165B3A0547; Wed, 29 Sep 2021 11:08:47 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id B28EB410EE; Wed, 29 Sep 2021 11:08:39 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by mails.dpdk.org (Postfix) with ESMTP id 8161140E3C for ; Wed, 29 Sep 2021 11:08:37 +0200 (CEST) Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18T8daJQ004906; Wed, 29 Sep 2021 02:08:36 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=pfpt0220; bh=BnUvVQSw3mAVRa6uhQg+VdgQk8exFUpSHmRtSAupY90=; b=P+kVx1y8lk4bEmA48Ca6rpkuePENX3gTn1m+4oOKfiqwlEg6Mhx7hczf4uBpb1CHWzSC 6zGqLh76Tpi15n1711zYp7RixhOeesBTMdCIQdTkluN2QEA6A2GmdtwjyJwpSvpHOgI5 4LYgtCNpdWM3CW4JpQAEg0PGetW5XaWsnekN3331yca+k/9hRfGlg4fi6E2S+BhE8C77 RdimxcNvEoGXQMVeJyUW8Eqsg/wsQG/CKHkhZxiRxAqWcO/6n70RSlkjlYrTTjiwmGUd IjvoJ4p34XF13RTo27uwIsKEn1lv3bLBUye4WuttJ1+e6hFK6HiNJDQ5l6LlgsnjUSsN kA== Received: from dc5-exch01.marvell.com ([199.233.59.181]) by mx0a-0016f401.pphosted.com with ESMTP id 3bcknk8cwb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 29 Sep 2021 02:08:36 -0700 Received: from DC5-EXCH01.marvell.com (10.69.176.38) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Wed, 29 Sep 2021 02:08:34 -0700 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Wed, 29 Sep 2021 02:08:34 -0700 Received: from hyd1409.caveonetworks.com.com (unknown [10.29.45.15]) by maili.marvell.com (Postfix) with ESMTP id EB8723F707C; Wed, 29 Sep 2021 02:08:31 -0700 (PDT) From: Archana Muniganti To: , , , , CC: Archana Muniganti , , , , , Date: Wed, 29 Sep 2021 14:38:11 +0530 Message-ID: <20210929090811.21030-4-marchana@marvell.com> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20210929090811.21030-1-marchana@marvell.com> References: <20210929090811.21030-1-marchana@marvell.com> MIME-Version: 1.0 X-Proofpoint-GUID: qOOrMOb-irNgoJ1oO1ePunlxrejjNuHJ X-Proofpoint-ORIG-GUID: qOOrMOb-irNgoJ1oO1ePunlxrejjNuHJ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.790,Hydra:6.0.391,FMLib:17.0.607.475 definitions=2021-09-29_02,2021-09-28_01,2020-04-07_01 Subject: [dpdk-dev] [PATCH v2 3/3] test/crypto: add inner checksum cases X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" This patch adds tests for inner IP and inner L4 checksum in IPsec mode. Signed-off-by: Archana Muniganti --- app/test/test_cryptodev.c | 34 +++ app/test/test_cryptodev_security_ipsec.c | 195 ++++++++++++++++++ app/test/test_cryptodev_security_ipsec.h | 2 + ...st_cryptodev_security_ipsec_test_vectors.h | 118 +++++++++++ doc/guides/rel_notes/release_21_11.rst | 1 + 5 files changed, 350 insertions(+) diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c index 5f0d023451..c127e6bc04 100644 --- a/app/test/test_cryptodev.c +++ b/app/test/test_cryptodev.c @@ -18,6 +18,8 @@ #include #include #include +#include +#include #ifdef RTE_CRYPTO_SCHEDULER #include @@ -9275,6 +9277,30 @@ test_ipsec_proto_udp_ports_verify(const void *data __rte_unused) return test_ipsec_proto_all(&flags); } +static int +test_ipsec_proto_inner_ip_csum(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.ip_csum = true; + + return test_ipsec_proto_all(&flags); +} + +static int +test_ipsec_proto_inner_l4_csum(const void *data __rte_unused) +{ + struct ipsec_test_flags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.l4_csum = true; + + return test_ipsec_proto_all(&flags); +} + static int test_PDCP_PROTO_all(void) { @@ -14231,6 +14257,14 @@ static struct unit_test_suite ipsec_proto_testsuite = { "Tunnel src and dst addr verification", ut_setup_security, ut_teardown, test_ipsec_proto_tunnel_src_dst_addr_verify), + TEST_CASE_NAMED_ST( + "Inner IP checksum", + ut_setup_security, ut_teardown, + test_ipsec_proto_inner_ip_csum), + TEST_CASE_NAMED_ST( + "Inner L4 checksum", + ut_setup_security, ut_teardown, + test_ipsec_proto_inner_l4_csum), TEST_CASES_END() /**< NULL terminate unit test array */ } }; diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c index 764e77bbff..bcd9746c98 100644 --- a/app/test/test_cryptodev_security_ipsec.c +++ b/app/test/test_cryptodev_security_ipsec.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include "test.h" @@ -103,6 +104,22 @@ test_ipsec_sec_caps_verify(struct rte_security_ipsec_xform *ipsec_xform, return -ENOTSUP; } + if (ipsec_xform->options.ip_csum_enable == 1 && + sec_cap->ipsec.options.ip_csum_enable == 0) { + if (!silent) + RTE_LOG(INFO, USER1, + "Inner IP checksum is not supported\n"); + return -ENOTSUP; + } + + if (ipsec_xform->options.l4_csum_enable == 1 && + sec_cap->ipsec.options.l4_csum_enable == 0) { + if (!silent) + RTE_LOG(INFO, USER1, + "Inner L4 checksum is not supported\n"); + return -ENOTSUP; + } + return 0; } @@ -160,6 +177,56 @@ test_ipsec_td_in_from_out(const struct ipsec_test_data *td_out, } } +static bool +is_ipv4(void *ip) +{ + struct rte_ipv4_hdr *ipv4 = ip; + uint8_t ip_ver; + + ip_ver = (ipv4->version_ihl & 0xf0) >> RTE_IPV4_IHL_MULTIPLIER; + if (ip_ver == IPVERSION) + return true; + else + return false; +} + +static void +test_ipsec_csum_init(void *ip, bool l3, bool l4) +{ + struct rte_ipv4_hdr *ipv4; + struct rte_tcp_hdr *tcp; + struct rte_udp_hdr *udp; + uint8_t next_proto; + uint8_t size; + + if (is_ipv4(ip)) { + ipv4 = ip; + size = sizeof(struct rte_ipv4_hdr); + next_proto = ipv4->next_proto_id; + + if (l3) + ipv4->hdr_checksum = 0; + } else { + size = sizeof(struct rte_ipv6_hdr); + next_proto = ((struct rte_ipv6_hdr *)ip)->proto; + } + + if (l4) { + switch (next_proto) { + case IPPROTO_TCP: + tcp = (struct rte_tcp_hdr *)RTE_PTR_ADD(ip, size); + tcp->cksum = 0; + break; + case IPPROTO_UDP: + udp = (struct rte_udp_hdr *)RTE_PTR_ADD(ip, size); + udp->dgram_cksum = 0; + break; + default: + return; + } + } +} + void test_ipsec_td_prepare(const struct crypto_param *param1, const struct crypto_param *param2, @@ -194,6 +261,17 @@ test_ipsec_td_prepare(const struct crypto_param *param1, if (flags->sa_expiry_pkts_soft) td->ipsec_xform.life.packets_soft_limit = IPSEC_TEST_PACKETS_MAX - 1; + + if (flags->ip_csum) { + td->ipsec_xform.options.ip_csum_enable = 1; + test_ipsec_csum_init(&td->input_text.data, true, false); + } + + if (flags->l4_csum) { + td->ipsec_xform.options.l4_csum_enable = 1; + test_ipsec_csum_init(&td->input_text.data, false, true); + } + } RTE_SET_USED(param2); @@ -230,6 +308,12 @@ test_ipsec_td_update(struct ipsec_test_data td_inb[], td_inb[i].ipsec_xform.options.tunnel_hdr_verify = flags->tunnel_hdr_verify; + if (flags->ip_csum) + td_inb[i].ipsec_xform.options.ip_csum_enable = 1; + + if (flags->l4_csum) + td_inb[i].ipsec_xform.options.l4_csum_enable = 1; + /* Clear outbound specific flags */ td_inb[i].ipsec_xform.options.iv_gen_disable = 0; } @@ -305,12 +389,96 @@ test_ipsec_iv_verify_push(struct rte_mbuf *m, const struct ipsec_test_data *td) return TEST_SUCCESS; } +static int +test_ipsec_l3_csum_verify(struct rte_mbuf *m) +{ + uint16_t actual_cksum, expected_cksum; + struct rte_ipv4_hdr *ip; + + ip = rte_pktmbuf_mtod(m, struct rte_ipv4_hdr *); + + if (!is_ipv4((void *)ip)) + return TEST_SKIPPED; + + actual_cksum = ip->hdr_checksum; + + ip->hdr_checksum = 0; + + expected_cksum = rte_ipv4_cksum(ip); + + if (actual_cksum != expected_cksum) + return TEST_FAILED; + + return TEST_SUCCESS; +} + +static int +test_ipsec_l4_csum_verify(struct rte_mbuf *m) +{ + uint16_t actual_cksum = 0, expected_cksum = 0; + struct rte_ipv4_hdr *ipv4; + struct rte_ipv6_hdr *ipv6; + struct rte_tcp_hdr *tcp; + struct rte_udp_hdr *udp; + void *ip, *l4; + + ip = rte_pktmbuf_mtod(m, void *); + + if (is_ipv4(ip)) { + ipv4 = ip; + l4 = RTE_PTR_ADD(ipv4, sizeof(struct rte_ipv4_hdr)); + + switch (ipv4->next_proto_id) { + case IPPROTO_TCP: + tcp = (struct rte_tcp_hdr *)l4; + actual_cksum = tcp->cksum; + tcp->cksum = 0; + expected_cksum = rte_ipv4_udptcp_cksum(ipv4, l4); + break; + case IPPROTO_UDP: + udp = (struct rte_udp_hdr *)l4; + actual_cksum = udp->dgram_cksum; + udp->dgram_cksum = 0; + expected_cksum = rte_ipv4_udptcp_cksum(ipv4, l4); + break; + default: + break; + } + } else { + ipv6 = ip; + l4 = RTE_PTR_ADD(ipv6, sizeof(struct rte_ipv6_hdr)); + + switch (ipv6->proto) { + case IPPROTO_TCP: + tcp = (struct rte_tcp_hdr *)l4; + actual_cksum = tcp->cksum; + tcp->cksum = 0; + expected_cksum = rte_ipv6_udptcp_cksum(ipv6, l4); + break; + case IPPROTO_UDP: + udp = (struct rte_udp_hdr *)l4; + actual_cksum = udp->dgram_cksum; + udp->dgram_cksum = 0; + expected_cksum = rte_ipv6_udptcp_cksum(ipv6, l4); + break; + default: + break; + } + } + + if (actual_cksum != expected_cksum) + return TEST_FAILED; + + return TEST_SUCCESS; +} + static int test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td, bool silent, const struct ipsec_test_flags *flags) { uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *); uint32_t skip, len = rte_pktmbuf_pkt_len(m); + int ret; /* For tests with status as error for test success, skip verification */ if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS && @@ -354,6 +522,33 @@ test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td, len -= skip; output_text += skip; + if ((td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) && + flags->ip_csum) { + if (m->ol_flags & PKT_RX_IP_CKSUM_GOOD) + ret = test_ipsec_l3_csum_verify(m); + else + ret = TEST_FAILED; + + if (ret == TEST_FAILED) + printf("Inner IP checksum test failed\n"); + + return ret; + } + + if ((td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) && + flags->l4_csum) { + if (m->ol_flags & PKT_RX_L4_CKSUM_GOOD) + ret = test_ipsec_l4_csum_verify(m); + else + ret = TEST_FAILED; + + if (ret == TEST_FAILED) + printf("Inner L4 checksum test failed\n"); + + return ret; + } + + if (memcmp(output_text, td->output_text.data + skip, len)) { if (silent) return TEST_FAILED; diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h index 0416005520..7628d0c42a 100644 --- a/app/test/test_cryptodev_security_ipsec.h +++ b/app/test/test_cryptodev_security_ipsec.h @@ -56,6 +56,8 @@ struct ipsec_test_flags { uint32_t tunnel_hdr_verify; bool udp_encap; bool udp_ports_verify; + bool ip_csum; + bool l4_csum; }; struct crypto_param { diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h index 4e147ec19c..5d4518c39c 100644 --- a/app/test/test_cryptodev_security_ipsec_test_vectors.h +++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h @@ -95,6 +95,8 @@ struct ipsec_test_data pkt_aes_128_gcm = { .options.ecn = 0, .options.stats = 0, .options.tunnel_hdr_verify = 0, + .options.ip_csum_enable = 0, + .options.l4_csum_enable = 0, .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS, .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL, @@ -192,6 +194,8 @@ struct ipsec_test_data pkt_aes_192_gcm = { .options.ecn = 0, .options.stats = 0, .options.tunnel_hdr_verify = 0, + .options.ip_csum_enable = 0, + .options.l4_csum_enable = 0, .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS, .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL, @@ -292,6 +296,8 @@ struct ipsec_test_data pkt_aes_256_gcm = { .options.ecn = 0, .options.stats = 0, .options.tunnel_hdr_verify = 0, + .options.ip_csum_enable = 0, + .options.l4_csum_enable = 0, .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS, .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL, @@ -318,4 +324,116 @@ struct ipsec_test_data pkt_aes_256_gcm = { }, }; +/* Known vectors for AES-CBC + * https://datatracker.ietf.org/doc/html/rfc3602#section-4 + */ + +struct ipsec_test_data pkt_aes_128_cbc_null = { + .key = { + .data = { + 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, + 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, + }, + }, + .input_text = { + .data = { + /* IP - outer header */ + 0x45, 0x00, 0x00, 0x8c, 0x00, 0x02, 0x00, 0x00, + 0x40, 0x32, 0x27, 0xbc, 0x00, 0x01, 0xa8, 0xc0, + 0x01, 0x01, 0xa8, 0xc0, + + /* ESP */ + 0x00, 0x00, 0x87, 0x65, 0x00, 0x00, 0x00, 0x02, + + /* IV */ + 0xf4, 0xe7, 0x65, 0x24, 0x4f, 0x64, 0x07, 0xad, + 0xf1, 0x3d, 0xc1, 0x38, 0x0f, 0x67, 0x3f, 0x37, + + /* Data */ + 0x77, 0x3b, 0x52, 0x41, 0xa4, 0xc4, 0x49, 0x22, + 0x5e, 0x4f, 0x3c, 0xe5, 0xed, 0x61, 0x1b, 0x0c, + 0x23, 0x7c, 0xa9, 0x6c, 0xf7, 0x4a, 0x93, 0x01, + 0x3c, 0x1b, 0x0e, 0xa1, 0xa0, 0xcf, 0x70, 0xf8, + 0xe4, 0xec, 0xae, 0xc7, 0x8a, 0xc5, 0x3a, 0xad, + 0x7a, 0x0f, 0x02, 0x2b, 0x85, 0x92, 0x43, 0xc6, + 0x47, 0x75, 0x2e, 0x94, 0xa8, 0x59, 0x35, 0x2b, + 0x8a, 0x4d, 0x4d, 0x2d, 0xec, 0xd1, 0x36, 0xe5, + 0xc1, 0x77, 0xf1, 0x32, 0xad, 0x3f, 0xbf, 0xb2, + 0x20, 0x1a, 0xc9, 0x90, 0x4c, 0x74, 0xee, 0x0a, + 0x10, 0x9e, 0x0c, 0xa1, 0xe4, 0xdf, 0xe9, 0xd5, + 0xa1, 0x00, 0xb8, 0x42, 0xf1, 0xc2, 0x2f, 0x0d, + }, + .len = 140, + }, + .output_text = { + .data = { + /* IP */ + 0x45, 0x00, 0x00, 0x54, 0x09, 0x04, 0x00, 0x00, + 0x40, 0x01, 0xf9, 0x88, 0xc0, 0xa8, 0x7b, 0x03, + 0xc0, 0xa8, 0x7b, 0xc8, + + /* ICMP */ + 0x08, 0x00, 0x9f, 0x76, 0xa9, 0x0a, 0x01, 0x00, + 0xb4, 0x9c, 0x08, 0x3d, 0x02, 0xa2, 0x04, 0x00, + 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, + 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, + 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, + 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, + 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, + 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, + 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, + 0x09, 0x0a, 0x0a, 0x04, + }, + .len = 84, + }, + .iv = { + .data = { + 0xf4, 0xe7, 0x65, 0x24, 0x4f, 0x64, 0x07, 0xad, + 0xf1, 0x3d, 0xc1, 0x38, 0x0f, 0x67, 0x3f, 0x37, + }, + }, + + .ipsec_xform = { + .spi = 0x8765, + .options.esn = 0, + .options.udp_encap = 0, + .options.copy_dscp = 0, + .options.copy_flabel = 0, + .options.copy_df = 0, + .options.dec_ttl = 0, + .options.ecn = 0, + .options.stats = 0, + .options.tunnel_hdr_verify = 0, + .options.ip_csum_enable = 0, + .options.l4_csum_enable = 0, + .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS, + .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, + .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL, + .tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4, + .replay_win_sz = 0, + }, + + .aead = false, + + .xform = { + .chain.cipher = { + .next = NULL, + .type = RTE_CRYPTO_SYM_XFORM_CIPHER, + .cipher = { + .op = RTE_CRYPTO_CIPHER_OP_DECRYPT, + .algo = RTE_CRYPTO_CIPHER_AES_CBC, + .key.length = 16, + .iv.length = 16, + }, + }, + .chain.auth = { + .next = NULL, + .type = RTE_CRYPTO_SYM_XFORM_AUTH, + .auth = { + .algo = RTE_CRYPTO_AUTH_NULL, + }, + }, + }, +}; + #endif /* TEST_CRYPTODEV_SECURITY_IPSEC_TEST_VECTORS_H_ */ diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst index 163cdaa800..e2e1e1547f 100644 --- a/doc/guides/rel_notes/release_21_11.rst +++ b/doc/guides/rel_notes/release_21_11.rst @@ -106,6 +106,7 @@ New Features * Added tests to validate packets soft expiry. * Added tests to validate packets hard expiry. * Added tests to verify tunnel header verification in IPsec inbound. + * Added tests to verify inner checksum. Removed Items