1 /* SPDX-License-Identifier: BSD-3-Clause
2 * Copyright(C) 2021 Marvell.
5 #ifndef RTE_EXEC_ENV_WINDOWS
7 #include <rte_common.h>
8 #include <rte_cryptodev.h>
11 #include <rte_security.h>
16 #include "test_cryptodev_security_ipsec.h"
20 struct crypto_param_comb alg_list[RTE_DIM(aead_list) +
21 (RTE_DIM(cipher_list) *
25 is_valid_ipv4_pkt(const struct rte_ipv4_hdr *pkt)
27 /* The IP version number must be 4 */
28 if (((pkt->version_ihl) >> 4) != 4)
31 * The IP header length field must be large enough to hold the
32 * minimum length legal IP datagram (20 bytes = 5 words).
34 if ((pkt->version_ihl & 0xf) < 5)
38 * The IP total length field must be large enough to hold the IP
39 * datagram header, whose length is specified in the IP header length
42 if (rte_cpu_to_be_16(pkt->total_length) < sizeof(struct rte_ipv4_hdr))
49 is_valid_ipv6_pkt(const struct rte_ipv6_hdr *pkt)
51 /* The IP version number must be 6 */
52 if ((rte_be_to_cpu_32((pkt->vtc_flow)) >> 28) != 6)
59 test_ipsec_alg_list_populate(void)
61 unsigned long i, j, index = 0;
63 for (i = 0; i < RTE_DIM(aead_list); i++) {
64 alg_list[index].param1 = &aead_list[i];
65 alg_list[index].param2 = NULL;
69 for (i = 0; i < RTE_DIM(cipher_list); i++) {
70 for (j = 0; j < RTE_DIM(auth_list); j++) {
71 alg_list[index].param1 = &cipher_list[i];
72 alg_list[index].param2 = &auth_list[j];
79 test_ipsec_sec_caps_verify(struct rte_security_ipsec_xform *ipsec_xform,
80 const struct rte_security_capability *sec_cap,
83 /* Verify security capabilities */
85 if (ipsec_xform->options.esn == 1 && sec_cap->ipsec.options.esn == 0) {
87 RTE_LOG(INFO, USER1, "ESN is not supported\n");
91 if (ipsec_xform->options.udp_encap == 1 &&
92 sec_cap->ipsec.options.udp_encap == 0) {
94 RTE_LOG(INFO, USER1, "UDP encapsulation is not supported\n");
98 if (ipsec_xform->options.udp_ports_verify == 1 &&
99 sec_cap->ipsec.options.udp_ports_verify == 0) {
101 RTE_LOG(INFO, USER1, "UDP encapsulation ports "
102 "verification is not supported\n");
106 if (ipsec_xform->options.copy_dscp == 1 &&
107 sec_cap->ipsec.options.copy_dscp == 0) {
109 RTE_LOG(INFO, USER1, "Copy DSCP is not supported\n");
113 if (ipsec_xform->options.copy_flabel == 1 &&
114 sec_cap->ipsec.options.copy_flabel == 0) {
116 RTE_LOG(INFO, USER1, "Copy Flow Label is not supported\n");
120 if (ipsec_xform->options.copy_df == 1 &&
121 sec_cap->ipsec.options.copy_df == 0) {
123 RTE_LOG(INFO, USER1, "Copy DP bit is not supported\n");
127 if (ipsec_xform->options.dec_ttl == 1 &&
128 sec_cap->ipsec.options.dec_ttl == 0) {
130 RTE_LOG(INFO, USER1, "Decrement TTL is not supported\n");
134 if (ipsec_xform->options.ecn == 1 && sec_cap->ipsec.options.ecn == 0) {
136 RTE_LOG(INFO, USER1, "ECN is not supported\n");
140 if (ipsec_xform->options.stats == 1 &&
141 sec_cap->ipsec.options.stats == 0) {
143 RTE_LOG(INFO, USER1, "Stats is not supported\n");
147 if ((ipsec_xform->direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) &&
148 (ipsec_xform->options.iv_gen_disable == 1) &&
149 (sec_cap->ipsec.options.iv_gen_disable != 1)) {
152 "Application provided IV is not supported\n");
156 if ((ipsec_xform->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) &&
157 (ipsec_xform->options.tunnel_hdr_verify >
158 sec_cap->ipsec.options.tunnel_hdr_verify)) {
161 "Tunnel header verify is not supported\n");
165 if (ipsec_xform->options.ip_csum_enable == 1 &&
166 sec_cap->ipsec.options.ip_csum_enable == 0) {
169 "Inner IP checksum is not supported\n");
173 if (ipsec_xform->options.l4_csum_enable == 1 &&
174 sec_cap->ipsec.options.l4_csum_enable == 0) {
177 "Inner L4 checksum is not supported\n");
181 if (ipsec_xform->replay_win_sz > sec_cap->ipsec.replay_win_sz_max) {
184 "Replay window size is not supported\n");
192 test_ipsec_crypto_caps_aead_verify(
193 const struct rte_security_capability *sec_cap,
194 struct rte_crypto_sym_xform *aead)
196 const struct rte_cryptodev_symmetric_capability *sym_cap;
197 const struct rte_cryptodev_capabilities *crypto_cap;
200 while ((crypto_cap = &sec_cap->crypto_capabilities[j++])->op !=
201 RTE_CRYPTO_OP_TYPE_UNDEFINED) {
202 if (crypto_cap->op == RTE_CRYPTO_OP_TYPE_SYMMETRIC &&
203 crypto_cap->sym.xform_type == aead->type &&
204 crypto_cap->sym.aead.algo == aead->aead.algo) {
205 sym_cap = &crypto_cap->sym;
206 if (rte_cryptodev_sym_capability_check_aead(sym_cap,
207 aead->aead.key.length,
208 aead->aead.digest_length,
209 aead->aead.aad_length,
210 aead->aead.iv.length) == 0)
219 test_ipsec_crypto_caps_cipher_verify(
220 const struct rte_security_capability *sec_cap,
221 struct rte_crypto_sym_xform *cipher)
223 const struct rte_cryptodev_symmetric_capability *sym_cap;
224 const struct rte_cryptodev_capabilities *cap;
227 while ((cap = &sec_cap->crypto_capabilities[j++])->op !=
228 RTE_CRYPTO_OP_TYPE_UNDEFINED) {
229 if (cap->op == RTE_CRYPTO_OP_TYPE_SYMMETRIC &&
230 cap->sym.xform_type == cipher->type &&
231 cap->sym.cipher.algo == cipher->cipher.algo) {
233 if (rte_cryptodev_sym_capability_check_cipher(sym_cap,
234 cipher->cipher.key.length,
235 cipher->cipher.iv.length) == 0)
244 test_ipsec_crypto_caps_auth_verify(
245 const struct rte_security_capability *sec_cap,
246 struct rte_crypto_sym_xform *auth)
248 const struct rte_cryptodev_symmetric_capability *sym_cap;
249 const struct rte_cryptodev_capabilities *cap;
252 while ((cap = &sec_cap->crypto_capabilities[j++])->op !=
253 RTE_CRYPTO_OP_TYPE_UNDEFINED) {
254 if (cap->op == RTE_CRYPTO_OP_TYPE_SYMMETRIC &&
255 cap->sym.xform_type == auth->type &&
256 cap->sym.auth.algo == auth->auth.algo) {
258 if (rte_cryptodev_sym_capability_check_auth(sym_cap,
259 auth->auth.key.length,
260 auth->auth.digest_length,
261 auth->auth.iv.length) == 0)
270 test_ipsec_td_in_from_out(const struct ipsec_test_data *td_out,
271 struct ipsec_test_data *td_in)
273 memcpy(td_in, td_out, sizeof(*td_in));
275 /* Populate output text of td_in with input text of td_out */
276 memcpy(td_in->output_text.data, td_out->input_text.data,
277 td_out->input_text.len);
278 td_in->output_text.len = td_out->input_text.len;
280 /* Populate input text of td_in with output text of td_out */
281 memcpy(td_in->input_text.data, td_out->output_text.data,
282 td_out->output_text.len);
283 td_in->input_text.len = td_out->output_text.len;
285 td_in->ipsec_xform.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS;
288 td_in->xform.aead.aead.op = RTE_CRYPTO_AEAD_OP_DECRYPT;
290 td_in->xform.chain.auth.auth.op = RTE_CRYPTO_AUTH_OP_VERIFY;
291 td_in->xform.chain.cipher.cipher.op =
292 RTE_CRYPTO_CIPHER_OP_DECRYPT;
299 struct rte_ipv4_hdr *ipv4 = ip;
302 ip_ver = (ipv4->version_ihl & 0xf0) >> RTE_IPV4_IHL_MULTIPLIER;
303 if (ip_ver == IPVERSION)
310 test_ipsec_csum_init(void *ip, bool l3, bool l4)
312 struct rte_ipv4_hdr *ipv4;
313 struct rte_tcp_hdr *tcp;
314 struct rte_udp_hdr *udp;
320 size = sizeof(struct rte_ipv4_hdr);
321 next_proto = ipv4->next_proto_id;
324 ipv4->hdr_checksum = 0;
326 size = sizeof(struct rte_ipv6_hdr);
327 next_proto = ((struct rte_ipv6_hdr *)ip)->proto;
331 switch (next_proto) {
333 tcp = (struct rte_tcp_hdr *)RTE_PTR_ADD(ip, size);
337 udp = (struct rte_udp_hdr *)RTE_PTR_ADD(ip, size);
338 udp->dgram_cksum = 0;
347 test_ipsec_td_prepare(const struct crypto_param *param1,
348 const struct crypto_param *param2,
349 const struct ipsec_test_flags *flags,
350 struct ipsec_test_data *td_array,
354 struct ipsec_test_data *td;
357 memset(td_array, 0, nb_td * sizeof(*td));
359 for (i = 0; i < nb_td; i++) {
362 /* Prepare fields based on param */
364 if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
365 /* Copy template for packet & key fields */
367 memcpy(td, &pkt_aes_256_gcm_v6, sizeof(*td));
369 memcpy(td, &pkt_aes_256_gcm, sizeof(*td));
372 td->xform.aead.aead.algo = param1->alg.aead;
373 td->xform.aead.aead.key.length = param1->key_length;
375 /* Copy template for packet & key fields */
377 memcpy(td, &pkt_aes_128_cbc_hmac_sha256_v6,
380 memcpy(td, &pkt_aes_128_cbc_hmac_sha256,
384 td->xform.chain.cipher.cipher.algo = param1->alg.cipher;
385 td->xform.chain.cipher.cipher.key.length =
387 td->xform.chain.cipher.cipher.iv.length =
389 td->xform.chain.auth.auth.algo = param2->alg.auth;
390 td->xform.chain.auth.auth.key.length =
392 td->xform.chain.auth.auth.digest_length =
393 param2->digest_length;
398 td->ipsec_xform.options.iv_gen_disable = 0;
400 if (flags->sa_expiry_pkts_soft)
401 td->ipsec_xform.life.packets_soft_limit =
402 IPSEC_TEST_PACKETS_MAX - 1;
404 if (flags->ip_csum) {
405 td->ipsec_xform.options.ip_csum_enable = 1;
406 test_ipsec_csum_init(&td->input_text.data, true, false);
409 if (flags->l4_csum) {
410 td->ipsec_xform.options.l4_csum_enable = 1;
411 test_ipsec_csum_init(&td->input_text.data, false, true);
414 if (flags->transport) {
415 td->ipsec_xform.mode =
416 RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT;
418 td->ipsec_xform.mode =
419 RTE_SECURITY_IPSEC_SA_MODE_TUNNEL;
421 if (flags->tunnel_ipv6)
422 td->ipsec_xform.tunnel.type =
423 RTE_SECURITY_IPSEC_TUNNEL_IPV6;
425 td->ipsec_xform.tunnel.type =
426 RTE_SECURITY_IPSEC_TUNNEL_IPV4;
429 if (flags->stats_success)
430 td->ipsec_xform.options.stats = 1;
432 if (flags->fragment) {
433 struct rte_ipv4_hdr *ip;
434 ip = (struct rte_ipv4_hdr *)&td->input_text.data;
435 ip->fragment_offset = 4;
436 ip->hdr_checksum = rte_ipv4_cksum(ip);
439 if (flags->df == TEST_IPSEC_COPY_DF_INNER_0 ||
440 flags->df == TEST_IPSEC_COPY_DF_INNER_1)
441 td->ipsec_xform.options.copy_df = 1;
443 if (flags->dscp == TEST_IPSEC_COPY_DSCP_INNER_0 ||
444 flags->dscp == TEST_IPSEC_COPY_DSCP_INNER_1)
445 td->ipsec_xform.options.copy_dscp = 1;
447 if (flags->dec_ttl_or_hop_limit)
448 td->ipsec_xform.options.dec_ttl = 1;
453 test_ipsec_td_update(struct ipsec_test_data td_inb[],
454 const struct ipsec_test_data td_outb[],
456 const struct ipsec_test_flags *flags)
460 for (i = 0; i < nb_td; i++) {
461 memcpy(td_inb[i].output_text.data, td_outb[i].input_text.data,
462 td_outb[i].input_text.len);
463 td_inb[i].output_text.len = td_outb->input_text.len;
465 if (flags->icv_corrupt) {
466 int icv_pos = td_inb[i].input_text.len - 4;
467 td_inb[i].input_text.data[icv_pos] += 1;
470 if (flags->sa_expiry_pkts_hard)
471 td_inb[i].ipsec_xform.life.packets_hard_limit =
472 IPSEC_TEST_PACKETS_MAX - 1;
474 if (flags->udp_encap)
475 td_inb[i].ipsec_xform.options.udp_encap = 1;
477 if (flags->udp_ports_verify)
478 td_inb[i].ipsec_xform.options.udp_ports_verify = 1;
480 td_inb[i].ipsec_xform.options.tunnel_hdr_verify =
481 flags->tunnel_hdr_verify;
484 td_inb[i].ipsec_xform.options.ip_csum_enable = 1;
487 td_inb[i].ipsec_xform.options.l4_csum_enable = 1;
489 /* Clear outbound specific flags */
490 td_inb[i].ipsec_xform.options.iv_gen_disable = 0;
495 test_ipsec_display_alg(const struct crypto_param *param1,
496 const struct crypto_param *param2)
498 if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
500 rte_crypto_aead_algorithm_strings[param1->alg.aead],
501 param1->key_length * 8);
504 rte_crypto_cipher_algorithm_strings[param1->alg.cipher]);
505 if (param1->alg.cipher != RTE_CRYPTO_CIPHER_NULL)
506 printf(" [%d]", param1->key_length * 8);
508 rte_crypto_auth_algorithm_strings[param2->alg.auth]);
509 if (param2->alg.auth != RTE_CRYPTO_AUTH_NULL)
510 printf(" [%dB ICV]", param2->digest_length);
516 test_ipsec_tunnel_hdr_len_get(const struct ipsec_test_data *td)
520 if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
521 if (td->ipsec_xform.mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
522 if (td->ipsec_xform.tunnel.type ==
523 RTE_SECURITY_IPSEC_TUNNEL_IPV4)
524 len += sizeof(struct rte_ipv4_hdr);
526 len += sizeof(struct rte_ipv6_hdr);
534 test_ipsec_iv_verify_push(struct rte_mbuf *m, const struct ipsec_test_data *td)
536 static uint8_t iv_queue[IV_LEN_MAX * IPSEC_TEST_PACKETS_MAX];
537 uint8_t *iv_tmp, *output_text = rte_pktmbuf_mtod(m, uint8_t *);
538 int i, iv_pos, iv_len;
542 iv_len = td->xform.aead.aead.iv.length - td->salt.len;
544 iv_len = td->xform.chain.cipher.cipher.iv.length;
546 iv_pos = test_ipsec_tunnel_hdr_len_get(td) + sizeof(struct rte_esp_hdr);
547 output_text += iv_pos;
549 TEST_ASSERT(iv_len <= IV_LEN_MAX, "IV length greater than supported");
551 /* Compare against previous values */
552 for (i = 0; i < index; i++) {
553 iv_tmp = &iv_queue[i * IV_LEN_MAX];
555 if (memcmp(output_text, iv_tmp, iv_len) == 0) {
556 printf("IV repeated");
561 /* Save IV for future comparisons */
563 iv_tmp = &iv_queue[index * IV_LEN_MAX];
564 memcpy(iv_tmp, output_text, iv_len);
567 if (index == IPSEC_TEST_PACKETS_MAX)
574 test_ipsec_l3_csum_verify(struct rte_mbuf *m)
576 uint16_t actual_cksum, expected_cksum;
577 struct rte_ipv4_hdr *ip;
579 ip = rte_pktmbuf_mtod(m, struct rte_ipv4_hdr *);
581 if (!is_ipv4((void *)ip))
584 actual_cksum = ip->hdr_checksum;
586 ip->hdr_checksum = 0;
588 expected_cksum = rte_ipv4_cksum(ip);
590 if (actual_cksum != expected_cksum)
597 test_ipsec_l4_csum_verify(struct rte_mbuf *m)
599 uint16_t actual_cksum = 0, expected_cksum = 0;
600 struct rte_ipv4_hdr *ipv4;
601 struct rte_ipv6_hdr *ipv6;
602 struct rte_tcp_hdr *tcp;
603 struct rte_udp_hdr *udp;
606 ip = rte_pktmbuf_mtod(m, void *);
610 l4 = RTE_PTR_ADD(ipv4, sizeof(struct rte_ipv4_hdr));
612 switch (ipv4->next_proto_id) {
614 tcp = (struct rte_tcp_hdr *)l4;
615 actual_cksum = tcp->cksum;
617 expected_cksum = rte_ipv4_udptcp_cksum(ipv4, l4);
620 udp = (struct rte_udp_hdr *)l4;
621 actual_cksum = udp->dgram_cksum;
622 udp->dgram_cksum = 0;
623 expected_cksum = rte_ipv4_udptcp_cksum(ipv4, l4);
630 l4 = RTE_PTR_ADD(ipv6, sizeof(struct rte_ipv6_hdr));
632 switch (ipv6->proto) {
634 tcp = (struct rte_tcp_hdr *)l4;
635 actual_cksum = tcp->cksum;
637 expected_cksum = rte_ipv6_udptcp_cksum(ipv6, l4);
640 udp = (struct rte_udp_hdr *)l4;
641 actual_cksum = udp->dgram_cksum;
642 udp->dgram_cksum = 0;
643 expected_cksum = rte_ipv6_udptcp_cksum(ipv6, l4);
650 if (actual_cksum != expected_cksum)
657 test_ipsec_ttl_or_hop_decrement_verify(void *received, void *expected)
659 struct rte_ipv4_hdr *iph4_ex, *iph4_re;
660 struct rte_ipv6_hdr *iph6_ex, *iph6_re;
662 if (is_ipv4(received) && is_ipv4(expected)) {
665 iph4_ex->time_to_live -= 1;
666 if (iph4_re->time_to_live != iph4_ex->time_to_live)
668 } else if (!is_ipv4(received) && !is_ipv4(expected)) {
671 iph6_ex->hop_limits -= 1;
672 if (iph6_re->hop_limits != iph6_ex->hop_limits)
675 printf("IP header version miss match\n");
683 test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td,
684 bool silent, const struct ipsec_test_flags *flags)
686 uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *);
687 uint32_t skip, len = rte_pktmbuf_pkt_len(m);
688 uint8_t td_output_text[4096];
691 /* For tests with status as error for test success, skip verification */
692 if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS &&
693 (flags->icv_corrupt ||
694 flags->sa_expiry_pkts_hard ||
695 flags->tunnel_hdr_verify ||
699 if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS &&
701 const struct rte_ipv4_hdr *iph4;
702 const struct rte_ipv6_hdr *iph6;
704 if (td->ipsec_xform.tunnel.type ==
705 RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
706 iph4 = (const struct rte_ipv4_hdr *)output_text;
707 if (iph4->next_proto_id != IPPROTO_UDP) {
708 printf("UDP header is not found\n");
712 iph6 = (const struct rte_ipv6_hdr *)output_text;
713 if (iph6->proto != IPPROTO_UDP) {
714 printf("UDP header is not found\n");
719 len -= sizeof(struct rte_udp_hdr);
720 output_text += sizeof(struct rte_udp_hdr);
723 if (len != td->output_text.len) {
724 printf("Output length (%d) not matching with expected (%d)\n",
725 len, td->output_text.len);
729 if ((td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) &&
731 const struct rte_ipv4_hdr *iph4;
732 iph4 = (const struct rte_ipv4_hdr *)output_text;
733 if (iph4->fragment_offset) {
734 printf("Output packet is fragmented");
739 skip = test_ipsec_tunnel_hdr_len_get(td);
744 if ((td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) &&
746 if (m->ol_flags & RTE_MBUF_F_RX_IP_CKSUM_GOOD)
747 ret = test_ipsec_l3_csum_verify(m);
751 if (ret == TEST_FAILED)
752 printf("Inner IP checksum test failed\n");
757 if ((td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) &&
759 if (m->ol_flags & RTE_MBUF_F_RX_L4_CKSUM_GOOD)
760 ret = test_ipsec_l4_csum_verify(m);
764 if (ret == TEST_FAILED)
765 printf("Inner L4 checksum test failed\n");
770 memcpy(td_output_text, td->output_text.data + skip, len);
772 if ((td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) &&
773 flags->dec_ttl_or_hop_limit) {
774 if (test_ipsec_ttl_or_hop_decrement_verify(output_text, td_output_text)) {
775 printf("Inner TTL/hop limit decrement test failed\n");
780 if (test_ipsec_pkt_update(td_output_text, flags)) {
781 printf("Could not update expected vector");
785 if (memcmp(output_text, td_output_text, len)) {
789 printf("TestCase %s line %d: %s\n", __func__, __LINE__,
790 "output text not as expected\n");
792 rte_hexdump(stdout, "expected", td_output_text, len);
793 rte_hexdump(stdout, "actual", output_text, len);
801 test_ipsec_res_d_prepare(struct rte_mbuf *m, const struct ipsec_test_data *td,
802 struct ipsec_test_data *res_d)
804 uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *);
805 uint32_t len = rte_pktmbuf_pkt_len(m);
807 memcpy(res_d, td, sizeof(*res_d));
808 memcpy(res_d->input_text.data, output_text, len);
809 res_d->input_text.len = len;
811 res_d->ipsec_xform.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS;
813 res_d->xform.aead.aead.op = RTE_CRYPTO_AEAD_OP_DECRYPT;
815 res_d->xform.chain.cipher.cipher.op =
816 RTE_CRYPTO_CIPHER_OP_DECRYPT;
817 res_d->xform.chain.auth.auth.op = RTE_CRYPTO_AUTH_OP_VERIFY;
824 test_ipsec_iph4_hdr_validate(const struct rte_ipv4_hdr *iph4,
825 const struct ipsec_test_flags *flags)
830 if (!is_valid_ipv4_pkt(iph4)) {
831 printf("Tunnel outer header is not IPv4\n");
835 f_off = rte_be_to_cpu_16(iph4->fragment_offset);
836 if (flags->df == TEST_IPSEC_COPY_DF_INNER_1 ||
837 flags->df == TEST_IPSEC_SET_DF_1_INNER_0) {
838 if (!(f_off & RTE_IPV4_HDR_DF_FLAG)) {
839 printf("DF bit is not set\n");
843 if (f_off & RTE_IPV4_HDR_DF_FLAG) {
844 printf("DF bit is set\n");
849 tos = iph4->type_of_service;
850 dscp = (tos & RTE_IPV4_HDR_DSCP_MASK) >> 2;
852 if (flags->dscp == TEST_IPSEC_COPY_DSCP_INNER_1 ||
853 flags->dscp == TEST_IPSEC_SET_DSCP_1_INNER_0) {
854 if (dscp != TEST_IPSEC_DSCP_VAL) {
855 printf("DSCP value is not matching [exp: %x, actual: %x]\n",
856 TEST_IPSEC_DSCP_VAL, dscp);
861 printf("DSCP value is set [exp: 0, actual: %x]\n",
871 test_ipsec_iph6_hdr_validate(const struct rte_ipv6_hdr *iph6,
872 const struct ipsec_test_flags *flags)
877 if (!is_valid_ipv6_pkt(iph6)) {
878 printf("Tunnel outer header is not IPv6\n");
882 vtc_flow = rte_be_to_cpu_32(iph6->vtc_flow);
883 dscp = (vtc_flow & RTE_IPV6_HDR_DSCP_MASK) >>
884 (RTE_IPV6_HDR_TC_SHIFT + 2);
886 if (flags->dscp == TEST_IPSEC_COPY_DSCP_INNER_1 ||
887 flags->dscp == TEST_IPSEC_SET_DSCP_1_INNER_0) {
888 if (dscp != TEST_IPSEC_DSCP_VAL) {
889 printf("DSCP value is not matching [exp: %x, actual: %x]\n",
890 TEST_IPSEC_DSCP_VAL, dscp);
895 printf("DSCP value is set [exp: 0, actual: %x]\n",
905 test_ipsec_post_process(struct rte_mbuf *m, const struct ipsec_test_data *td,
906 struct ipsec_test_data *res_d, bool silent,
907 const struct ipsec_test_flags *flags)
909 uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *);
912 if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
913 const struct rte_ipv4_hdr *iph4;
914 const struct rte_ipv6_hdr *iph6;
917 ret = test_ipsec_iv_verify_push(m, td);
918 if (ret != TEST_SUCCESS)
922 iph4 = (const struct rte_ipv4_hdr *)output_text;
924 if (td->ipsec_xform.mode ==
925 RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT) {
927 iph6 = (const struct rte_ipv6_hdr *)output_text;
928 if (is_valid_ipv6_pkt(iph6) == false) {
929 printf("Transport packet is not IPv6\n");
933 if (is_valid_ipv4_pkt(iph4) == false) {
934 printf("Transport packet is not IPv4\n");
939 if (td->ipsec_xform.tunnel.type ==
940 RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
941 if (test_ipsec_iph4_hdr_validate(iph4, flags))
944 iph6 = (const struct rte_ipv6_hdr *)output_text;
945 if (test_ipsec_iph6_hdr_validate(iph6, flags))
952 * In case of known vector tests & all inbound tests, res_d provided
953 * would be NULL and output data need to be validated against expected.
954 * For inbound, output_text would be plain packet and for outbound
955 * output_text would IPsec packet. Validate by comparing against
958 * In case of combined mode tests, the output_text from outbound
959 * operation (ie, IPsec packet) would need to be inbound processed to
960 * obtain the plain text. Copy output_text to result data, 'res_d', so
961 * that inbound processing can be done.
965 return test_ipsec_td_verify(m, td, silent, flags);
967 return test_ipsec_res_d_prepare(m, td, res_d);
971 test_ipsec_status_check(const struct ipsec_test_data *td,
972 struct rte_crypto_op *op,
973 const struct ipsec_test_flags *flags,
974 enum rte_security_ipsec_sa_direction dir,
977 int ret = TEST_SUCCESS;
979 if ((dir == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) &&
981 if (op->status != RTE_CRYPTO_OP_STATUS_ERROR) {
982 printf("Anti replay test case failed\n");
989 if (dir == RTE_SECURITY_IPSEC_SA_DIR_INGRESS &&
990 flags->sa_expiry_pkts_hard &&
991 pkt_num == IPSEC_TEST_PACKETS_MAX) {
992 if (op->status != RTE_CRYPTO_OP_STATUS_ERROR) {
993 printf("SA hard expiry (pkts) test failed\n");
1000 if ((dir == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) &&
1001 flags->tunnel_hdr_verify) {
1002 if (op->status != RTE_CRYPTO_OP_STATUS_ERROR) {
1003 printf("Tunnel header verify test case failed\n");
1006 return TEST_SUCCESS;
1010 if (dir == RTE_SECURITY_IPSEC_SA_DIR_INGRESS && flags->icv_corrupt) {
1011 if (op->status != RTE_CRYPTO_OP_STATUS_ERROR) {
1012 printf("ICV corruption test case failed\n");
1016 if (op->status != RTE_CRYPTO_OP_STATUS_SUCCESS) {
1017 printf("Security op processing failed [pkt_num: %d]\n",
1023 if (flags->sa_expiry_pkts_soft && pkt_num == IPSEC_TEST_PACKETS_MAX) {
1024 if (!(op->aux_flags &
1025 RTE_CRYPTO_OP_AUX_FLAGS_IPSEC_SOFT_EXPIRY)) {
1026 printf("SA soft expiry (pkts) test failed\n");
1035 test_ipsec_stats_verify(struct rte_security_ctx *ctx,
1036 struct rte_security_session *sess,
1037 const struct ipsec_test_flags *flags,
1038 enum rte_security_ipsec_sa_direction dir)
1040 struct rte_security_stats stats = {0};
1041 int ret = TEST_SUCCESS;
1043 if (flags->stats_success) {
1044 if (rte_security_session_stats_get(ctx, sess, &stats) < 0)
1047 if (dir == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
1048 if (stats.ipsec.opackets != 1 ||
1049 stats.ipsec.oerrors != 0)
1052 if (stats.ipsec.ipackets != 1 ||
1053 stats.ipsec.ierrors != 0)
1062 test_ipsec_pkt_update(uint8_t *pkt, const struct ipsec_test_flags *flags)
1064 struct rte_ipv4_hdr *iph4;
1065 struct rte_ipv6_hdr *iph6;
1066 bool cksum_dirty = false;
1068 iph4 = (struct rte_ipv4_hdr *)pkt;
1070 if (flags->df == TEST_IPSEC_COPY_DF_INNER_1 ||
1071 flags->df == TEST_IPSEC_SET_DF_0_INNER_1 ||
1072 flags->df == TEST_IPSEC_COPY_DF_INNER_0 ||
1073 flags->df == TEST_IPSEC_SET_DF_1_INNER_0) {
1076 if (!is_ipv4(iph4)) {
1077 printf("Invalid packet type\n");
1081 frag_off = rte_be_to_cpu_16(iph4->fragment_offset);
1083 if (flags->df == TEST_IPSEC_COPY_DF_INNER_1 ||
1084 flags->df == TEST_IPSEC_SET_DF_0_INNER_1)
1085 frag_off |= RTE_IPV4_HDR_DF_FLAG;
1087 frag_off &= ~RTE_IPV4_HDR_DF_FLAG;
1089 iph4->fragment_offset = rte_cpu_to_be_16(frag_off);
1093 if (flags->dscp == TEST_IPSEC_COPY_DSCP_INNER_1 ||
1094 flags->dscp == TEST_IPSEC_SET_DSCP_0_INNER_1 ||
1095 flags->dscp == TEST_IPSEC_COPY_DSCP_INNER_0 ||
1096 flags->dscp == TEST_IPSEC_SET_DSCP_1_INNER_0) {
1098 if (is_ipv4(iph4)) {
1101 tos = iph4->type_of_service;
1102 if (flags->dscp == TEST_IPSEC_COPY_DSCP_INNER_1 ||
1103 flags->dscp == TEST_IPSEC_SET_DSCP_0_INNER_1)
1104 tos |= (RTE_IPV4_HDR_DSCP_MASK &
1105 (TEST_IPSEC_DSCP_VAL << 2));
1107 tos &= ~RTE_IPV4_HDR_DSCP_MASK;
1109 iph4->type_of_service = tos;
1114 iph6 = (struct rte_ipv6_hdr *)pkt;
1116 vtc_flow = rte_be_to_cpu_32(iph6->vtc_flow);
1117 if (flags->dscp == TEST_IPSEC_COPY_DSCP_INNER_1 ||
1118 flags->dscp == TEST_IPSEC_SET_DSCP_0_INNER_1)
1119 vtc_flow |= (RTE_IPV6_HDR_DSCP_MASK &
1120 (TEST_IPSEC_DSCP_VAL << (RTE_IPV6_HDR_TC_SHIFT + 2)));
1122 vtc_flow &= ~RTE_IPV6_HDR_DSCP_MASK;
1124 iph6->vtc_flow = rte_cpu_to_be_32(vtc_flow);
1128 if (cksum_dirty && is_ipv4(iph4)) {
1129 iph4->hdr_checksum = 0;
1130 iph4->hdr_checksum = rte_ipv4_cksum(iph4);
1136 #endif /* !RTE_EXEC_ENV_WINDOWS */