examples/fips_validation: support AES parsing
[dpdk.git] / examples / fips_validation / main.c
1 /* SPDX-License-Identifier: BSD-3-Clause
2  * Copyright(c) 2018 Intel Corporation
3  */
4
5 #include <sys/stat.h>
6 #include <getopt.h>
7 #include <dirent.h>
8
9 #include <rte_cryptodev.h>
10 #include <rte_cryptodev_pmd.h>
11 #include <rte_mempool.h>
12 #include <rte_mbuf.h>
13 #include <rte_string_fns.h>
14
15 #include "fips_validation.h"
16
17 #define REQ_FILE_PATH_KEYWORD   "req-file"
18 #define RSP_FILE_PATH_KEYWORD   "rsp-file"
19 #define FOLDER_KEYWORD          "path-is-folder"
20 #define CRYPTODEV_KEYWORD       "cryptodev"
21 #define CRYPTODEV_ID_KEYWORD    "cryptodev-id"
22
23 struct fips_test_vector vec;
24 struct fips_test_interim_info info;
25
26 struct cryptodev_fips_validate_env {
27         const char *req_path;
28         const char *rsp_path;
29         uint32_t is_path_folder;
30         uint32_t dev_id;
31         struct rte_mempool *mpool;
32         struct rte_mempool *op_pool;
33         struct rte_mbuf *mbuf;
34         struct rte_crypto_op *op;
35         struct rte_cryptodev_sym_session *sess;
36 } env;
37
38 static int
39 cryptodev_fips_validate_app_int(void)
40 {
41         struct rte_cryptodev_config conf = {rte_socket_id(), 1};
42         struct rte_cryptodev_qp_conf qp_conf = {128};
43         int ret;
44
45         ret = rte_cryptodev_configure(env.dev_id, &conf);
46         if (ret < 0)
47                 return ret;
48
49         env.mpool = rte_pktmbuf_pool_create("FIPS_MEMPOOL", 128, 0, 0,
50                         UINT16_MAX, rte_socket_id());
51         if (!env.mpool)
52                 return ret;
53
54         ret = rte_cryptodev_queue_pair_setup(env.dev_id, 0, &qp_conf,
55                         rte_socket_id(), env.mpool);
56         if (ret < 0)
57                 return ret;
58
59         ret = -ENOMEM;
60
61         env.op_pool = rte_crypto_op_pool_create(
62                         "FIPS_OP_POOL",
63                         RTE_CRYPTO_OP_TYPE_SYMMETRIC,
64                         1, 0,
65                         16,
66                         rte_socket_id());
67         if (!env.op_pool)
68                 goto error_exit;
69
70         env.mbuf = rte_pktmbuf_alloc(env.mpool);
71         if (!env.mbuf)
72                 goto error_exit;
73
74         env.op = rte_crypto_op_alloc(env.op_pool, RTE_CRYPTO_OP_TYPE_SYMMETRIC);
75         if (!env.op)
76                 goto error_exit;
77
78         return 0;
79
80 error_exit:
81         rte_mempool_free(env.mpool);
82         if (env.op_pool)
83                 rte_mempool_free(env.op_pool);
84
85         return ret;
86 }
87
88 static void
89 cryptodev_fips_validate_app_uninit(void)
90 {
91         rte_pktmbuf_free(env.mbuf);
92         rte_crypto_op_free(env.op);
93         rte_cryptodev_sym_session_clear(env.dev_id, env.sess);
94         rte_cryptodev_sym_session_free(env.sess);
95         rte_mempool_free(env.mpool);
96         rte_mempool_free(env.op_pool);
97 }
98
99 static int
100 fips_test_one_file(void);
101
102 static int
103 parse_cryptodev_arg(char *arg)
104 {
105         int id = rte_cryptodev_get_dev_id(arg);
106
107         if (id < 0) {
108                 RTE_LOG(ERR, USER1, "Error %i: invalid cryptodev name %s\n",
109                                 id, arg);
110                 return id;
111         }
112
113         env.dev_id = (uint32_t)id;
114
115         return 0;
116 }
117
118 static int
119 parse_cryptodev_id_arg(char *arg)
120 {
121         uint32_t cryptodev_id;
122
123         if (parser_read_uint32(&cryptodev_id, arg) < 0) {
124                 RTE_LOG(ERR, USER1, "Error %i: invalid cryptodev id %s\n",
125                                 -EINVAL, arg);
126                 return -1;
127         }
128
129
130         if (!rte_cryptodev_pmd_is_valid_dev(cryptodev_id)) {
131                 RTE_LOG(ERR, USER1, "Error %i: invalid cryptodev id %s\n",
132                                 cryptodev_id, arg);
133                 return -1;
134         }
135
136         env.dev_id = (uint32_t)cryptodev_id;
137
138         return 0;
139 }
140
141 static void
142 cryptodev_fips_validate_usage(const char *prgname)
143 {
144         printf("%s [EAL options] --\n"
145                 "  --%s: REQUEST-FILE-PATH\n"
146                 "  --%s: RESPONSE-FILE-PATH\n"
147                 "  --%s: indicating both paths are folders\n"
148                 "  --%s: CRYPTODEV-NAME\n"
149                 "  --%s: CRYPTODEV-ID-NAME\n",
150                 prgname, REQ_FILE_PATH_KEYWORD, RSP_FILE_PATH_KEYWORD,
151                 FOLDER_KEYWORD, CRYPTODEV_KEYWORD, CRYPTODEV_ID_KEYWORD);
152 }
153
154 static int
155 cryptodev_fips_validate_parse_args(int argc, char **argv)
156 {
157         int opt, ret;
158         char *prgname = argv[0];
159         char **argvopt;
160         int option_index;
161         struct option lgopts[] = {
162                         {REQ_FILE_PATH_KEYWORD, required_argument, 0, 0},
163                         {RSP_FILE_PATH_KEYWORD, required_argument, 0, 0},
164                         {FOLDER_KEYWORD, no_argument, 0, 0},
165                         {CRYPTODEV_KEYWORD, required_argument, 0, 0},
166                         {CRYPTODEV_ID_KEYWORD, required_argument, 0, 0},
167                         {NULL, 0, 0, 0}
168         };
169
170         argvopt = argv;
171
172         while ((opt = getopt_long(argc, argvopt, "s:",
173                                   lgopts, &option_index)) != EOF) {
174
175                 switch (opt) {
176                 case 0:
177                         if (strcmp(lgopts[option_index].name,
178                                         REQ_FILE_PATH_KEYWORD) == 0)
179                                 env.req_path = optarg;
180                         else if (strcmp(lgopts[option_index].name,
181                                         RSP_FILE_PATH_KEYWORD) == 0)
182                                 env.rsp_path = optarg;
183                         else if (strcmp(lgopts[option_index].name,
184                                         FOLDER_KEYWORD) == 0)
185                                 env.is_path_folder = 1;
186                         else if (strcmp(lgopts[option_index].name,
187                                         CRYPTODEV_KEYWORD) == 0) {
188                                 ret = parse_cryptodev_arg(optarg);
189                                 if (ret < 0) {
190                                         cryptodev_fips_validate_usage(prgname);
191                                         return -EINVAL;
192                                 }
193                         } else if (strcmp(lgopts[option_index].name,
194                                         CRYPTODEV_ID_KEYWORD) == 0) {
195                                 ret = parse_cryptodev_id_arg(optarg);
196                                 if (ret < 0) {
197                                         cryptodev_fips_validate_usage(prgname);
198                                         return -EINVAL;
199                                 }
200                         } else {
201                                 cryptodev_fips_validate_usage(prgname);
202                                 return -EINVAL;
203                         }
204                         break;
205                 default:
206                         return -1;
207                 }
208         }
209
210         if (env.req_path == NULL || env.rsp_path == NULL ||
211                         env.dev_id == UINT32_MAX) {
212                 cryptodev_fips_validate_usage(prgname);
213                 return -EINVAL;
214         }
215
216         return 0;
217 }
218
219 int
220 main(int argc, char *argv[])
221 {
222         int ret;
223
224         ret = rte_eal_init(argc, argv);
225         if (ret < 0) {
226                 RTE_LOG(ERR, USER1, "Error %i: Failed init\n", ret);
227                 return -1;
228         }
229
230         argc -= ret;
231         argv += ret;
232
233         ret = cryptodev_fips_validate_parse_args(argc, argv);
234         if (ret < 0)
235                 rte_exit(EXIT_FAILURE, "Failed to parse arguments!\n");
236
237         ret = cryptodev_fips_validate_app_int();
238         if (ret < 0) {
239                 RTE_LOG(ERR, USER1, "Error %i: Failed init\n", ret);
240                 return -1;
241         }
242
243         if (!env.is_path_folder) {
244                 printf("Processing file %s... ", env.req_path);
245
246                 ret = fips_test_init(env.req_path, env.rsp_path,
247                         rte_cryptodev_name_get(env.dev_id));
248                 if (ret < 0) {
249                         RTE_LOG(ERR, USER1, "Error %i: Failed test %s\n",
250                                         ret, env.req_path);
251                         goto exit;
252                 }
253
254
255                 ret = fips_test_one_file();
256                 if (ret < 0) {
257                         RTE_LOG(ERR, USER1, "Error %i: Failed test %s\n",
258                                         ret, env.req_path);
259                         goto exit;
260                 }
261
262                 printf("Done\n");
263
264         } else {
265                 struct dirent *dir;
266                 DIR *d_req, *d_rsp;
267                 char req_path[1024];
268                 char rsp_path[1024];
269
270                 d_req = opendir(env.req_path);
271                 if (!d_req) {
272                         RTE_LOG(ERR, USER1, "Error %i: Path %s not exist\n",
273                                         -EINVAL, env.req_path);
274                         goto exit;
275                 }
276
277                 d_rsp = opendir(env.rsp_path);
278                 if (!d_rsp) {
279                         ret = mkdir(env.rsp_path, 0700);
280                         if (ret == 0)
281                                 d_rsp = opendir(env.rsp_path);
282                         else {
283                                 RTE_LOG(ERR, USER1, "Error %i: Invalid %s\n",
284                                                 -EINVAL, env.rsp_path);
285                                 goto exit;
286                         }
287                 }
288                 closedir(d_rsp);
289
290                 while ((dir = readdir(d_req)) != NULL) {
291                         if (strstr(dir->d_name, "req") == NULL)
292                                 continue;
293
294                         snprintf(req_path, 1023, "%s/%s", env.req_path,
295                                         dir->d_name);
296                         snprintf(rsp_path, 1023, "%s/%s", env.rsp_path,
297                                         dir->d_name);
298                         strlcpy(strstr(rsp_path, "req"), "rsp", 4);
299
300                         printf("Processing file %s... ", req_path);
301
302                         ret = fips_test_init(req_path, rsp_path,
303                         rte_cryptodev_name_get(env.dev_id));
304                         if (ret < 0) {
305                                 RTE_LOG(ERR, USER1, "Error %i: Failed test %s\n",
306                                                 ret, req_path);
307                                 break;
308                         }
309
310                         ret = fips_test_one_file();
311                         if (ret < 0) {
312                                 RTE_LOG(ERR, USER1, "Error %i: Failed test %s\n",
313                                                 ret, req_path);
314                                 break;
315                         }
316
317                         printf("Done\n");
318                 }
319
320                 closedir(d_req);
321         }
322
323
324 exit:
325         fips_test_clear();
326         cryptodev_fips_validate_app_uninit();
327
328         return ret;
329
330 }
331
332 #define IV_OFF (sizeof(struct rte_crypto_op) + sizeof(struct rte_crypto_sym_op))
333 #define CRYPTODEV_FIPS_MAX_RETRIES      16
334
335 typedef int (*fips_test_one_case_t)(void);
336 typedef int (*fips_prepare_op_t)(void);
337 typedef int (*fips_prepare_xform_t)(struct rte_crypto_sym_xform *);
338
339 struct fips_test_ops {
340         fips_prepare_xform_t prepare_xform;
341         fips_prepare_op_t prepare_op;
342         fips_test_one_case_t test;
343 } test_ops;
344
345 static int
346 prepare_cipher_op(void)
347 {
348         struct rte_crypto_sym_op *sym = env.op->sym;
349         uint8_t *iv = rte_crypto_op_ctod_offset(env.op, uint8_t *, IV_OFF);
350
351         __rte_crypto_op_reset(env.op, RTE_CRYPTO_OP_TYPE_SYMMETRIC);
352         rte_pktmbuf_reset(env.mbuf);
353
354         sym->m_src = env.mbuf;
355         sym->cipher.data.offset = 0;
356
357         memcpy(iv, vec.iv.val, vec.iv.len);
358
359         if (info.op == FIPS_TEST_ENC_AUTH_GEN) {
360                 uint8_t *pt;
361
362                 if (vec.pt.len > RTE_MBUF_MAX_NB_SEGS) {
363                         RTE_LOG(ERR, USER1, "PT len %u\n", vec.pt.len);
364                         return -EPERM;
365                 }
366
367                 pt = (uint8_t *)rte_pktmbuf_append(env.mbuf, vec.pt.len);
368
369                 if (!pt) {
370                         RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n",
371                                         -ENOMEM);
372                         return -ENOMEM;
373                 }
374
375                 memcpy(pt, vec.pt.val, vec.pt.len);
376                 sym->cipher.data.length = vec.pt.len;
377
378         } else {
379                 uint8_t *ct;
380
381                 if (vec.ct.len > RTE_MBUF_MAX_NB_SEGS) {
382                         RTE_LOG(ERR, USER1, "CT len %u\n", vec.ct.len);
383                         return -EPERM;
384                 }
385
386                 ct = (uint8_t *)rte_pktmbuf_append(env.mbuf, vec.ct.len);
387
388                 if (!ct) {
389                         RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n",
390                                         -ENOMEM);
391                         return -ENOMEM;
392                 }
393
394                 memcpy(ct, vec.ct.val, vec.ct.len);
395                 sym->cipher.data.length = vec.ct.len;
396         }
397
398         rte_crypto_op_attach_sym_session(env.op, env.sess);
399
400         return 0;
401 }
402
403 static int
404 prepare_aes_xform(struct rte_crypto_sym_xform *xform)
405 {
406         const struct rte_cryptodev_symmetric_capability *cap;
407         struct rte_cryptodev_sym_capability_idx cap_idx;
408         struct rte_crypto_cipher_xform *cipher_xform = &xform->cipher;
409
410         xform->type = RTE_CRYPTO_SYM_XFORM_CIPHER;
411
412         cipher_xform->algo = RTE_CRYPTO_CIPHER_AES_CBC;
413         cipher_xform->op = (info.op == FIPS_TEST_ENC_AUTH_GEN) ?
414                         RTE_CRYPTO_CIPHER_OP_ENCRYPT :
415                         RTE_CRYPTO_CIPHER_OP_DECRYPT;
416         cipher_xform->key.data = vec.cipher_auth.key.val;
417         cipher_xform->key.length = vec.cipher_auth.key.len;
418         cipher_xform->iv.length = vec.iv.len;
419         cipher_xform->iv.offset = IV_OFF;
420
421         cap_idx.algo.cipher = RTE_CRYPTO_CIPHER_AES_CBC;
422         cap_idx.type = RTE_CRYPTO_SYM_XFORM_CIPHER;
423
424         cap = rte_cryptodev_sym_capability_get(env.dev_id, &cap_idx);
425         if (!cap) {
426                 RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n",
427                                 env.dev_id);
428                 return -EINVAL;
429         }
430
431         if (rte_cryptodev_sym_capability_check_cipher(cap,
432                         cipher_xform->key.length,
433                         cipher_xform->iv.length) != 0) {
434                 RTE_LOG(ERR, USER1, "PMD %s key length %u IV length %u\n",
435                                 info.device_name, cipher_xform->key.length,
436                                 cipher_xform->iv.length);
437                 return -EPERM;
438         }
439
440         return 0;
441 }
442
443 static void
444 get_writeback_data(struct fips_val *val)
445 {
446         val->val = rte_pktmbuf_mtod(env.mbuf, uint8_t *);
447         val->len = rte_pktmbuf_pkt_len(env.mbuf);
448 }
449
450 static int
451 fips_run_test(void)
452 {
453         struct rte_crypto_sym_xform xform = {0};
454         uint16_t n_deqd;
455         int ret;
456
457         ret = test_ops.prepare_xform(&xform);
458         if (ret < 0)
459                 return ret;
460
461         env.sess = rte_cryptodev_sym_session_create(env.mpool);
462         if (!env.sess)
463                 return -ENOMEM;
464
465         ret = rte_cryptodev_sym_session_init(env.dev_id,
466                         env.sess, &xform, env.mpool);
467         if (ret < 0) {
468                 RTE_LOG(ERR, USER1, "Error %i: Init session\n",
469                                 ret);
470                 return ret;
471         }
472
473         ret = test_ops.prepare_op();
474         if (ret < 0) {
475                 RTE_LOG(ERR, USER1, "Error %i: Prepare op\n",
476                                 ret);
477                 return ret;
478         }
479
480         if (rte_cryptodev_enqueue_burst(env.dev_id, 0, &env.op, 1) < 1) {
481                 RTE_LOG(ERR, USER1, "Error: Failed enqueue\n");
482                 return ret;
483         }
484
485         do {
486                 struct rte_crypto_op *deqd_op;
487
488                 n_deqd = rte_cryptodev_dequeue_burst(env.dev_id, 0, &deqd_op,
489                                 1);
490         } while (n_deqd == 0);
491
492         vec.status = env.op->status;
493
494         rte_cryptodev_sym_session_clear(env.dev_id, env.sess);
495         rte_cryptodev_sym_session_free(env.sess);
496         env.sess = NULL;
497
498         return ret;
499 }
500
501 static int
502 fips_generic_test(void)
503 {
504         struct fips_val val;
505         int ret;
506
507         fips_test_write_one_case();
508
509         ret = fips_run_test();
510         if (ret < 0) {
511                 if (ret == -EPERM) {
512                         fprintf(info.fp_wr, "Bypass\n\n");
513                         return 0;
514                 }
515
516                 return ret;
517         }
518
519         get_writeback_data(&val);
520
521         switch (info.file_type) {
522         case FIPS_TYPE_REQ:
523         case FIPS_TYPE_RSP:
524                 if (info.parse_writeback == NULL)
525                         return -EPERM;
526                 ret = info.parse_writeback(&val);
527                 if (ret < 0)
528                         return ret;
529                 break;
530         case FIPS_TYPE_FAX:
531                 if (info.kat_check == NULL)
532                         return -EPERM;
533                 ret = info.kat_check(&val);
534                 if (ret < 0)
535                         return ret;
536                 break;
537         }
538
539         fprintf(info.fp_wr, "\n");
540
541         return 0;
542 }
543
544 static int
545 fips_mct_aes_test(void)
546 {
547 #define AES_BLOCK_SIZE  16
548 #define AES_EXTERN_ITER 100
549 #define AES_INTERN_ITER 1000
550         struct fips_val val, val_key;
551         uint8_t prev_out[AES_BLOCK_SIZE] = {0};
552         uint8_t prev_in[AES_BLOCK_SIZE] = {0};
553         uint32_t i, j, k;
554         int ret;
555
556         for (i = 0; i < AES_EXTERN_ITER; i++) {
557                 if (i != 0)
558                         update_info_vec(i);
559
560                 fips_test_write_one_case();
561
562                 for (j = 0; j < AES_INTERN_ITER; j++) {
563                         ret = fips_run_test();
564                         if (ret < 0) {
565                                 if (ret == -EPERM) {
566                                         fprintf(info.fp_wr, "Bypass\n");
567                                         return 0;
568                                 }
569
570                                 return ret;
571                         }
572
573                         get_writeback_data(&val);
574
575                         if (info.op == FIPS_TEST_DEC_AUTH_VERIF)
576                                 memcpy(prev_in, vec.ct.val, AES_BLOCK_SIZE);
577
578                         if (j == 0) {
579                                 memcpy(prev_out, val.val, AES_BLOCK_SIZE);
580
581                                 if (info.op == FIPS_TEST_ENC_AUTH_GEN) {
582                                         memcpy(vec.pt.val, vec.iv.val,
583                                                         AES_BLOCK_SIZE);
584                                         memcpy(vec.iv.val, val.val,
585                                                         AES_BLOCK_SIZE);
586                                 } else {
587                                         memcpy(vec.ct.val, vec.iv.val,
588                                                         AES_BLOCK_SIZE);
589                                         memcpy(vec.iv.val, prev_in,
590                                                         AES_BLOCK_SIZE);
591                                 }
592                                 continue;
593                         }
594
595                         if (info.op == FIPS_TEST_ENC_AUTH_GEN) {
596                                 memcpy(vec.iv.val, val.val, AES_BLOCK_SIZE);
597                                 memcpy(vec.pt.val, prev_out, AES_BLOCK_SIZE);
598                         } else {
599                                 memcpy(vec.iv.val, prev_in, AES_BLOCK_SIZE);
600                                 memcpy(vec.ct.val, prev_out, AES_BLOCK_SIZE);
601                         }
602
603                         if (j == AES_INTERN_ITER - 1)
604                                 continue;
605
606                         memcpy(prev_out, val.val, AES_BLOCK_SIZE);
607                 }
608
609                 info.parse_writeback(&val);
610                 fprintf(info.fp_wr, "\n");
611
612                 if (i == AES_EXTERN_ITER - 1)
613                         continue;
614
615                 /** update key */
616                 memcpy(&val_key, &vec.cipher_auth.key, sizeof(val_key));
617                 for (k = 0; k < vec.cipher_auth.key.len; k++) {
618                         switch (vec.cipher_auth.key.len) {
619                         case 16:
620                                 val_key.val[k] ^= val.val[k];
621                                 break;
622                         case 24:
623                                 if (k < 8)
624                                         val_key.val[k] ^= prev_out[k + 8];
625                                 else
626                                         val_key.val[k] ^= val.val[k - 8];
627                                 break;
628                         case 32:
629                                 if (k < 16)
630                                         val_key.val[k] ^= prev_out[k];
631                                 else
632                                         val_key.val[k] ^= val.val[k - 16];
633                                 break;
634                         default:
635                                 return -1;
636                         }
637                 }
638
639                 if (info.op == FIPS_TEST_DEC_AUTH_VERIF)
640                         memcpy(vec.iv.val, val.val, AES_BLOCK_SIZE);
641         }
642
643         return 0;
644 }
645
646 static int
647 init_test_ops(void)
648 {
649         switch (info.algo) {
650         case FIPS_TEST_ALGO_AES:
651                 test_ops.prepare_op = prepare_cipher_op;
652                 test_ops.prepare_xform  = prepare_aes_xform;
653                 if (info.interim_info.aes_data.test_type == AESAVS_TYPE_MCT)
654                         test_ops.test = fips_mct_aes_test;
655                 else
656                         test_ops.test = fips_generic_test;
657                 break;
658
659         default:
660                 return -1;
661         }
662
663         return 0;
664 }
665
666 static void
667 print_test_block(void)
668 {
669         uint32_t i;
670
671         for (i = 0; i < info.nb_vec_lines; i++)
672                 printf("%s\n", info.vec[i]);
673
674         printf("\n");
675 }
676
677 static int
678 fips_test_one_file(void)
679 {
680         int fetch_ret = 0, ret;
681
682
683         ret = init_test_ops();
684         if (ret < 0) {
685                 RTE_LOG(ERR, USER1, "Error %i: Init test op\n", ret);
686                 return ret;
687         }
688
689         while (ret >= 0 && fetch_ret == 0) {
690                 fetch_ret = fips_test_fetch_one_block();
691                 if (fetch_ret < 0) {
692                         RTE_LOG(ERR, USER1, "Error %i: Fetch block\n",
693                                         fetch_ret);
694                         ret = fetch_ret;
695                         goto error_one_case;
696                 }
697
698                 if (info.nb_vec_lines == 0) {
699                         if (fetch_ret == -EOF)
700                                 break;
701
702                         fprintf(info.fp_wr, "\n");
703                         continue;
704                 }
705
706                 ret = fips_test_parse_one_case();
707                 switch (ret) {
708                 case 0:
709                         ret = test_ops.test();
710                         if (ret == 0)
711                                 break;
712                         RTE_LOG(ERR, USER1, "Error %i: test block\n",
713                                         ret);
714                         goto error_one_case;
715                 case 1:
716                         break;
717                 default:
718                         RTE_LOG(ERR, USER1, "Error %i: Parse block\n",
719                                         ret);
720                         goto error_one_case;
721                 }
722
723                 continue;
724 error_one_case:
725                 print_test_block();
726         }
727
728         fips_test_clear();
729
730         return ret;
731
732 }