app/test/test_security_inline_proto.c

   1 /* SPDX-License-Identifier: BSD-3-Clause
   2  * Copyright(C) 2022 Marvell.
   3  */
   4
   5
   6 #include <stdio.h>
   7 #include <inttypes.h>
   8
   9 #include <rte_ethdev.h>
  10 #include <rte_malloc.h>
  11 #include <rte_security.h>
  12
  13 #include "test.h"
  14 #include "test_security_inline_proto_vectors.h"
  15
  16 #ifdef RTE_EXEC_ENV_WINDOWS
  17 static int
  18 test_inline_ipsec(void)
  19 {
  20         printf("Inline ipsec not supported on Windows, skipping test\n");
  21         return TEST_SKIPPED;
  22 }
  23
  24 #else
  25
  26 #define NB_ETHPORTS_USED                1
  27 #define MEMPOOL_CACHE_SIZE              32
  28 #define MAX_PKT_BURST                   32
  29 #define RTE_TEST_RX_DESC_DEFAULT        1024
  30 #define RTE_TEST_TX_DESC_DEFAULT        1024
  31 #define RTE_PORT_ALL            (~(uint16_t)0x0)
  32
  33 #define RX_PTHRESH 8 /**< Default values of RX prefetch threshold reg. */
  34 #define RX_HTHRESH 8 /**< Default values of RX host threshold reg. */
  35 #define RX_WTHRESH 0 /**< Default values of RX write-back threshold reg. */
  36
  37 #define TX_PTHRESH 32 /**< Default values of TX prefetch threshold reg. */
  38 #define TX_HTHRESH 0  /**< Default values of TX host threshold reg. */
  39 #define TX_WTHRESH 0  /**< Default values of TX write-back threshold reg. */
  40
  41 #define MAX_TRAFFIC_BURST               2048
  42 #define NB_MBUF                         10240
  43
  44 extern struct ipsec_test_data pkt_aes_128_gcm;
  45 extern struct ipsec_test_data pkt_aes_192_gcm;
  46 extern struct ipsec_test_data pkt_aes_256_gcm;
  47 extern struct ipsec_test_data pkt_aes_128_gcm_frag;
  48 extern struct ipsec_test_data pkt_aes_128_cbc_null;
  49 extern struct ipsec_test_data pkt_null_aes_xcbc;
  50 extern struct ipsec_test_data pkt_aes_128_cbc_hmac_sha384;
  51 extern struct ipsec_test_data pkt_aes_128_cbc_hmac_sha512;
  52
  53 static struct rte_mempool *mbufpool;
  54 static struct rte_mempool *sess_pool;
  55 static struct rte_mempool *sess_priv_pool;
  56 /* ethernet addresses of ports */
  57 static struct rte_ether_addr ports_eth_addr[RTE_MAX_ETHPORTS];
  58
  59 static struct rte_eth_conf port_conf = {
  60         .rxmode = {
  61                 .mq_mode = RTE_ETH_MQ_RX_NONE,
  62                 .split_hdr_size = 0,
  63                 .offloads = RTE_ETH_RX_OFFLOAD_CHECKSUM |
  64                             RTE_ETH_RX_OFFLOAD_SECURITY,
  65         },
  66         .txmode = {
  67                 .mq_mode = RTE_ETH_MQ_TX_NONE,
  68                 .offloads = RTE_ETH_TX_OFFLOAD_SECURITY |
  69                             RTE_ETH_TX_OFFLOAD_MBUF_FAST_FREE,
  70         },
  71         .lpbk_mode = 1,  /* enable loopback */
  72 };
  73
  74 static struct rte_eth_rxconf rx_conf = {
  75         .rx_thresh = {
  76                 .pthresh = RX_PTHRESH,
  77                 .hthresh = RX_HTHRESH,
  78                 .wthresh = RX_WTHRESH,
  79         },
  80         .rx_free_thresh = 32,
  81 };
  82
  83 static struct rte_eth_txconf tx_conf = {
  84         .tx_thresh = {
  85                 .pthresh = TX_PTHRESH,
  86                 .hthresh = TX_HTHRESH,
  87                 .wthresh = TX_WTHRESH,
  88         },
  89         .tx_free_thresh = 32, /* Use PMD default values */
  90         .tx_rs_thresh = 32, /* Use PMD default values */
  91 };
  92
  93 uint16_t port_id;
  94
  95 static uint64_t link_mbps;
  96
  97 static struct rte_flow *default_flow[RTE_MAX_ETHPORTS];
  98
  99 /* Create Inline IPsec session */
 100 static int
 101 create_inline_ipsec_session(struct ipsec_test_data *sa, uint16_t portid,
 102                 struct rte_security_session **sess, struct rte_security_ctx **ctx,
 103                 uint32_t *ol_flags, const struct ipsec_test_flags *flags,
 104                 struct rte_security_session_conf *sess_conf)
 105 {
 106         uint16_t src_v6[8] = {0x2607, 0xf8b0, 0x400c, 0x0c03, 0x0000, 0x0000,
 107                                 0x0000, 0x001a};
 108         uint16_t dst_v6[8] = {0x2001, 0x0470, 0xe5bf, 0xdead, 0x4957, 0x2174,
 109                                 0xe82c, 0x4887};
 110         uint32_t src_v4 = rte_cpu_to_be_32(RTE_IPV4(192, 168, 1, 2));
 111         uint32_t dst_v4 = rte_cpu_to_be_32(RTE_IPV4(192, 168, 1, 1));
 112         struct rte_security_capability_idx sec_cap_idx;
 113         const struct rte_security_capability *sec_cap;
 114         enum rte_security_ipsec_sa_direction dir;
 115         struct rte_security_ctx *sec_ctx;
 116         uint32_t verify;
 117
 118         sess_conf->action_type = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL;
 119         sess_conf->protocol = RTE_SECURITY_PROTOCOL_IPSEC;
 120         sess_conf->ipsec = sa->ipsec_xform;
 121
 122         dir = sa->ipsec_xform.direction;
 123         verify = flags->tunnel_hdr_verify;
 124
 125         if ((dir == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) && verify) {
 126                 if (verify == RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR)
 127                         src_v4 += 1;
 128                 else if (verify == RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR)
 129                         dst_v4 += 1;
 130         }
 131
 132         if (sa->ipsec_xform.mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
 133                 if (sa->ipsec_xform.tunnel.type ==
 134                                 RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
 135                         memcpy(&sess_conf->ipsec.tunnel.ipv4.src_ip, &src_v4,
 136                                         sizeof(src_v4));
 137                         memcpy(&sess_conf->ipsec.tunnel.ipv4.dst_ip, &dst_v4,
 138                                         sizeof(dst_v4));
 139
 140                         if (flags->df == TEST_IPSEC_SET_DF_0_INNER_1)
 141                                 sess_conf->ipsec.tunnel.ipv4.df = 0;
 142
 143                         if (flags->df == TEST_IPSEC_SET_DF_1_INNER_0)
 144                                 sess_conf->ipsec.tunnel.ipv4.df = 1;
 145
 146                         if (flags->dscp == TEST_IPSEC_SET_DSCP_0_INNER_1)
 147                                 sess_conf->ipsec.tunnel.ipv4.dscp = 0;
 148
 149                         if (flags->dscp == TEST_IPSEC_SET_DSCP_1_INNER_0)
 150                                 sess_conf->ipsec.tunnel.ipv4.dscp =
 151                                                 TEST_IPSEC_DSCP_VAL;
 152                 } else {
 153                         if (flags->dscp == TEST_IPSEC_SET_DSCP_0_INNER_1)
 154                                 sess_conf->ipsec.tunnel.ipv6.dscp = 0;
 155
 156                         if (flags->dscp == TEST_IPSEC_SET_DSCP_1_INNER_0)
 157                                 sess_conf->ipsec.tunnel.ipv6.dscp =
 158                                                 TEST_IPSEC_DSCP_VAL;
 159
 160                         memcpy(&sess_conf->ipsec.tunnel.ipv6.src_addr, &src_v6,
 161                                         sizeof(src_v6));
 162                         memcpy(&sess_conf->ipsec.tunnel.ipv6.dst_addr, &dst_v6,
 163                                         sizeof(dst_v6));
 164                 }
 165         }
 166
 167         /* Save SA as userdata for the security session. When
 168          * the packet is received, this userdata will be
 169          * retrieved using the metadata from the packet.
 170          *
 171          * The PMD is expected to set similar metadata for other
 172          * operations, like rte_eth_event, which are tied to
 173          * security session. In such cases, the userdata could
 174          * be obtained to uniquely identify the security
 175          * parameters denoted.
 176          */
 177
 178         sess_conf->userdata = (void *) sa;
 179
 180         sec_ctx = (struct rte_security_ctx *)rte_eth_dev_get_sec_ctx(portid);
 181         if (sec_ctx == NULL) {
 182                 printf("Ethernet device doesn't support security features.\n");
 183                 return TEST_SKIPPED;
 184         }
 185
 186         sec_cap_idx.action = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL;
 187         sec_cap_idx.protocol = RTE_SECURITY_PROTOCOL_IPSEC;
 188         sec_cap_idx.ipsec.proto = sess_conf->ipsec.proto;
 189         sec_cap_idx.ipsec.mode = sess_conf->ipsec.mode;
 190         sec_cap_idx.ipsec.direction = sess_conf->ipsec.direction;
 191         sec_cap = rte_security_capability_get(sec_ctx, &sec_cap_idx);
 192         if (sec_cap == NULL) {
 193                 printf("No capabilities registered\n");
 194                 return TEST_SKIPPED;
 195         }
 196
 197         if (sa->aead || sa->aes_gmac)
 198                 memcpy(&sess_conf->ipsec.salt, sa->salt.data,
 199                         RTE_MIN(sizeof(sess_conf->ipsec.salt), sa->salt.len));
 200
 201         /* Copy cipher session parameters */
 202         if (sa->aead) {
 203                 rte_memcpy(sess_conf->crypto_xform, &sa->xform.aead,
 204                                 sizeof(struct rte_crypto_sym_xform));
 205                 sess_conf->crypto_xform->aead.key.data = sa->key.data;
 206                 /* Verify crypto capabilities */
 207                 if (test_ipsec_crypto_caps_aead_verify(sec_cap,
 208                                         sess_conf->crypto_xform) != 0) {
 209                         RTE_LOG(INFO, USER1,
 210                                 "Crypto capabilities not supported\n");
 211                         return TEST_SKIPPED;
 212                 }
 213         } else {
 214                 if (dir == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
 215                         rte_memcpy(&sess_conf->crypto_xform->cipher,
 216                                         &sa->xform.chain.cipher.cipher,
 217                                         sizeof(struct rte_crypto_cipher_xform));
 218
 219                         rte_memcpy(&sess_conf->crypto_xform->next->auth,
 220                                         &sa->xform.chain.auth.auth,
 221                                         sizeof(struct rte_crypto_auth_xform));
 222                         sess_conf->crypto_xform->cipher.key.data =
 223                                                         sa->key.data;
 224                         sess_conf->crypto_xform->next->auth.key.data =
 225                                                         sa->auth_key.data;
 226                         /* Verify crypto capabilities */
 227                         if (test_ipsec_crypto_caps_cipher_verify(sec_cap,
 228                                         sess_conf->crypto_xform) != 0) {
 229                                 RTE_LOG(INFO, USER1,
 230                                         "Cipher crypto capabilities not supported\n");
 231                                 return TEST_SKIPPED;
 232                         }
 233
 234                         if (test_ipsec_crypto_caps_auth_verify(sec_cap,
 235                                         sess_conf->crypto_xform->next) != 0) {
 236                                 RTE_LOG(INFO, USER1,
 237                                         "Auth crypto capabilities not supported\n");
 238                                 return TEST_SKIPPED;
 239                         }
 240                 } else {
 241                         rte_memcpy(&sess_conf->crypto_xform->next->cipher,
 242                                         &sa->xform.chain.cipher.cipher,
 243                                         sizeof(struct rte_crypto_cipher_xform));
 244                         rte_memcpy(&sess_conf->crypto_xform->auth,
 245                                         &sa->xform.chain.auth.auth,
 246                                         sizeof(struct rte_crypto_auth_xform));
 247                         sess_conf->crypto_xform->auth.key.data =
 248                                                         sa->auth_key.data;
 249                         sess_conf->crypto_xform->next->cipher.key.data =
 250                                                         sa->key.data;
 251
 252                         /* Verify crypto capabilities */
 253                         if (test_ipsec_crypto_caps_cipher_verify(sec_cap,
 254                                         sess_conf->crypto_xform->next) != 0) {
 255                                 RTE_LOG(INFO, USER1,
 256                                         "Cipher crypto capabilities not supported\n");
 257                                 return TEST_SKIPPED;
 258                         }
 259
 260                         if (test_ipsec_crypto_caps_auth_verify(sec_cap,
 261                                         sess_conf->crypto_xform) != 0) {
 262                                 RTE_LOG(INFO, USER1,
 263                                         "Auth crypto capabilities not supported\n");
 264                                 return TEST_SKIPPED;
 265                         }
 266                 }
 267         }
 268
 269         if (test_ipsec_sec_caps_verify(&sess_conf->ipsec, sec_cap, false) != 0)
 270                 return TEST_SKIPPED;
 271
 272         if ((sa->ipsec_xform.direction ==
 273                         RTE_SECURITY_IPSEC_SA_DIR_EGRESS) &&
 274                         (sa->ipsec_xform.options.iv_gen_disable == 1)) {
 275                 /* Set env variable when IV generation is disabled */
 276                 char arr[128];
 277                 int len = 0, j = 0;
 278                 int iv_len = (sa->aead || sa->aes_gmac) ? 8 : 16;
 279
 280                 for (; j < iv_len; j++)
 281                         len += snprintf(arr+len, sizeof(arr) - len,
 282                                         "0x%x, ", sa->iv.data[j]);
 283                 setenv("ETH_SEC_IV_OVR", arr, 1);
 284         }
 285
 286         *sess = rte_security_session_create(sec_ctx,
 287                                 sess_conf, sess_pool, sess_priv_pool);
 288         if (*sess == NULL) {
 289                 printf("SEC Session init failed.\n");
 290                 return TEST_FAILED;
 291         }
 292
 293         *ol_flags = sec_cap->ol_flags;
 294         *ctx = sec_ctx;
 295
 296         return 0;
 297 }
 298
 299 /* Check the link status of all ports in up to 3s, and print them finally */
 300 static void
 301 check_all_ports_link_status(uint16_t port_num, uint32_t port_mask)
 302 {
 303 #define CHECK_INTERVAL 100 /* 100ms */
 304 #define MAX_CHECK_TIME 30 /* 3s (30 * 100ms) in total */
 305         uint16_t portid;
 306         uint8_t count, all_ports_up, print_flag = 0;
 307         struct rte_eth_link link;
 308         int ret;
 309         char link_status[RTE_ETH_LINK_MAX_STR_LEN];
 310
 311         printf("Checking link statuses...\n");
 312         fflush(stdout);
 313         for (count = 0; count <= MAX_CHECK_TIME; count++) {
 314                 all_ports_up = 1;
 315                 for (portid = 0; portid < port_num; portid++) {
 316                         if ((port_mask & (1 << portid)) == 0)
 317                                 continue;
 318                         memset(&link, 0, sizeof(link));
 319                         ret = rte_eth_link_get_nowait(portid, &link);
 320                         if (ret < 0) {
 321                                 all_ports_up = 0;
 322                                 if (print_flag == 1)
 323                                         printf("Port %u link get failed: %s\n",
 324                                                 portid, rte_strerror(-ret));
 325                                 continue;
 326                         }
 327
 328                         /* print link status if flag set */
 329                         if (print_flag == 1) {
 330                                 if (link.link_status && link_mbps == 0)
 331                                         link_mbps = link.link_speed;
 332
 333                                 rte_eth_link_to_str(link_status,
 334                                         sizeof(link_status), &link);
 335                                 printf("Port %d %s\n", portid, link_status);
 336                                 continue;
 337                         }
 338                         /* clear all_ports_up flag if any link down */
 339                         if (link.link_status == RTE_ETH_LINK_DOWN) {
 340                                 all_ports_up = 0;
 341                                 break;
 342                         }
 343                 }
 344                 /* after finally printing all link status, get out */
 345                 if (print_flag == 1)
 346                         break;
 347
 348                 if (all_ports_up == 0) {
 349                         fflush(stdout);
 350                         rte_delay_ms(CHECK_INTERVAL);
 351                 }
 352
 353                 /* set the print_flag if all ports up or timeout */
 354                 if (all_ports_up == 1 || count == (MAX_CHECK_TIME - 1))
 355                         print_flag = 1;
 356         }
 357 }
 358
 359 static void
 360 print_ethaddr(const char *name, const struct rte_ether_addr *eth_addr)
 361 {
 362         char buf[RTE_ETHER_ADDR_FMT_SIZE];
 363         rte_ether_format_addr(buf, RTE_ETHER_ADDR_FMT_SIZE, eth_addr);
 364         printf("%s%s", name, buf);
 365 }
 366
 367 static void
 368 copy_buf_to_pkt_segs(const uint8_t *buf, unsigned int len,
 369                      struct rte_mbuf *pkt, unsigned int offset)
 370 {
 371         unsigned int copied = 0;
 372         unsigned int copy_len;
 373         struct rte_mbuf *seg;
 374         void *seg_buf;
 375
 376         seg = pkt;
 377         while (offset >= seg->data_len) {
 378                 offset -= seg->data_len;
 379                 seg = seg->next;
 380         }
 381         copy_len = seg->data_len - offset;
 382         seg_buf = rte_pktmbuf_mtod_offset(seg, char *, offset);
 383         while (len > copy_len) {
 384                 rte_memcpy(seg_buf, buf + copied, (size_t) copy_len);
 385                 len -= copy_len;
 386                 copied += copy_len;
 387                 seg = seg->next;
 388                 seg_buf = rte_pktmbuf_mtod(seg, void *);
 389         }
 390         rte_memcpy(seg_buf, buf + copied, (size_t) len);
 391 }
 392
 393 static inline struct rte_mbuf *
 394 init_packet(struct rte_mempool *mp, const uint8_t *data, unsigned int len)
 395 {
 396         struct rte_mbuf *pkt;
 397
 398         pkt = rte_pktmbuf_alloc(mp);
 399         if (pkt == NULL)
 400                 return NULL;
 401         if (((data[0] & 0xF0) >> 4) == IPVERSION) {
 402                 rte_memcpy(rte_pktmbuf_append(pkt, RTE_ETHER_HDR_LEN),
 403                                 &dummy_ipv4_eth_hdr, RTE_ETHER_HDR_LEN);
 404                 pkt->l3_len = sizeof(struct rte_ipv4_hdr);
 405         } else {
 406                 rte_memcpy(rte_pktmbuf_append(pkt, RTE_ETHER_HDR_LEN),
 407                                 &dummy_ipv6_eth_hdr, RTE_ETHER_HDR_LEN);
 408                 pkt->l3_len = sizeof(struct rte_ipv6_hdr);
 409         }
 410         pkt->l2_len = RTE_ETHER_HDR_LEN;
 411
 412         if (pkt->buf_len > (len + RTE_ETHER_HDR_LEN))
 413                 rte_memcpy(rte_pktmbuf_append(pkt, len), data, len);
 414         else
 415                 copy_buf_to_pkt_segs(data, len, pkt, RTE_ETHER_HDR_LEN);
 416         return pkt;
 417 }
 418
 419 static int
 420 init_mempools(unsigned int nb_mbuf)
 421 {
 422         struct rte_security_ctx *sec_ctx;
 423         uint16_t nb_sess = 512;
 424         uint32_t sess_sz;
 425         char s[64];
 426
 427         if (mbufpool == NULL) {
 428                 snprintf(s, sizeof(s), "mbuf_pool");
 429                 mbufpool = rte_pktmbuf_pool_create(s, nb_mbuf,
 430                                 MEMPOOL_CACHE_SIZE, 0,
 431                                 RTE_MBUF_DEFAULT_BUF_SIZE, SOCKET_ID_ANY);
 432                 if (mbufpool == NULL) {
 433                         printf("Cannot init mbuf pool\n");
 434                         return TEST_FAILED;
 435                 }
 436                 printf("Allocated mbuf pool\n");
 437         }
 438
 439         sec_ctx = rte_eth_dev_get_sec_ctx(port_id);
 440         if (sec_ctx == NULL) {
 441                 printf("Device does not support Security ctx\n");
 442                 return TEST_SKIPPED;
 443         }
 444         sess_sz = rte_security_session_get_size(sec_ctx);
 445         if (sess_pool == NULL) {
 446                 snprintf(s, sizeof(s), "sess_pool");
 447                 sess_pool = rte_mempool_create(s, nb_sess, sess_sz,
 448                                 MEMPOOL_CACHE_SIZE, 0,
 449                                 NULL, NULL, NULL, NULL,
 450                                 SOCKET_ID_ANY, 0);
 451                 if (sess_pool == NULL) {
 452                         printf("Cannot init sess pool\n");
 453                         return TEST_FAILED;
 454                 }
 455                 printf("Allocated sess pool\n");
 456         }
 457         if (sess_priv_pool == NULL) {
 458                 snprintf(s, sizeof(s), "sess_priv_pool");
 459                 sess_priv_pool = rte_mempool_create(s, nb_sess, sess_sz,
 460                                 MEMPOOL_CACHE_SIZE, 0,
 461                                 NULL, NULL, NULL, NULL,
 462                                 SOCKET_ID_ANY, 0);
 463                 if (sess_priv_pool == NULL) {
 464                         printf("Cannot init sess_priv pool\n");
 465                         return TEST_FAILED;
 466                 }
 467                 printf("Allocated sess_priv pool\n");
 468         }
 469
 470         return 0;
 471 }
 472
 473 static int
 474 create_default_flow(uint16_t portid)
 475 {
 476         struct rte_flow_action action[2];
 477         struct rte_flow_item pattern[2];
 478         struct rte_flow_attr attr = {0};
 479         struct rte_flow_error err;
 480         struct rte_flow *flow;
 481         int ret;
 482
 483         /* Add the default rte_flow to enable SECURITY for all ESP packets */
 484
 485         pattern[0].type = RTE_FLOW_ITEM_TYPE_ESP;
 486         pattern[0].spec = NULL;
 487         pattern[0].mask = NULL;
 488         pattern[0].last = NULL;
 489         pattern[1].type = RTE_FLOW_ITEM_TYPE_END;
 490
 491         action[0].type = RTE_FLOW_ACTION_TYPE_SECURITY;
 492         action[0].conf = NULL;
 493         action[1].type = RTE_FLOW_ACTION_TYPE_END;
 494         action[1].conf = NULL;
 495
 496         attr.ingress = 1;
 497
 498         ret = rte_flow_validate(portid, &attr, pattern, action, &err);
 499         if (ret) {
 500                 printf("\nValidate flow failed, ret = %d\n", ret);
 501                 return -1;
 502         }
 503         flow = rte_flow_create(portid, &attr, pattern, action, &err);
 504         if (flow == NULL) {
 505                 printf("\nDefault flow rule create failed\n");
 506                 return -1;
 507         }
 508
 509         default_flow[portid] = flow;
 510
 511         return 0;
 512 }
 513
 514 static void
 515 destroy_default_flow(uint16_t portid)
 516 {
 517         struct rte_flow_error err;
 518         int ret;
 519
 520         if (!default_flow[portid])
 521                 return;
 522         ret = rte_flow_destroy(portid, default_flow[portid], &err);
 523         if (ret) {
 524                 printf("\nDefault flow rule destroy failed\n");
 525                 return;
 526         }
 527         default_flow[portid] = NULL;
 528 }
 529
 530 struct rte_mbuf **tx_pkts_burst;
 531 struct rte_mbuf **rx_pkts_burst;
 532
 533 static int
 534 test_ipsec_inline_proto_process(struct ipsec_test_data *td,
 535                 struct ipsec_test_data *res_d,
 536                 int nb_pkts,
 537                 bool silent,
 538                 const struct ipsec_test_flags *flags)
 539 {
 540         struct rte_security_session_conf sess_conf = {0};
 541         struct rte_crypto_sym_xform cipher = {0};
 542         struct rte_crypto_sym_xform auth = {0};
 543         struct rte_crypto_sym_xform aead = {0};
 544         struct rte_security_session *ses;
 545         struct rte_security_ctx *ctx;
 546         int nb_rx = 0, nb_sent;
 547         uint32_t ol_flags;
 548         int i, j = 0, ret;
 549
 550         memset(rx_pkts_burst, 0, sizeof(rx_pkts_burst[0]) * nb_pkts);
 551
 552         if (td->aead) {
 553                 sess_conf.crypto_xform = &aead;
 554         } else {
 555                 if (td->ipsec_xform.direction ==
 556                                 RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
 557                         sess_conf.crypto_xform = &cipher;
 558                         sess_conf.crypto_xform->type = RTE_CRYPTO_SYM_XFORM_CIPHER;
 559                         sess_conf.crypto_xform->next = &auth;
 560                         sess_conf.crypto_xform->next->type = RTE_CRYPTO_SYM_XFORM_AUTH;
 561                 } else {
 562                         sess_conf.crypto_xform = &auth;
 563                         sess_conf.crypto_xform->type = RTE_CRYPTO_SYM_XFORM_AUTH;
 564                         sess_conf.crypto_xform->next = &cipher;
 565                         sess_conf.crypto_xform->next->type = RTE_CRYPTO_SYM_XFORM_CIPHER;
 566                 }
 567         }
 568
 569         /* Create Inline IPsec session. */
 570         ret = create_inline_ipsec_session(td, port_id, &ses, &ctx,
 571                                           &ol_flags, flags, &sess_conf);
 572         if (ret)
 573                 return ret;
 574
 575         if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
 576                 ret = create_default_flow(port_id);
 577                 if (ret)
 578                         goto out;
 579         }
 580         for (i = 0; i < nb_pkts; i++) {
 581                 tx_pkts_burst[i] = init_packet(mbufpool, td->input_text.data,
 582                                                 td->input_text.len);
 583                 if (tx_pkts_burst[i] == NULL) {
 584                         while (i--)
 585                                 rte_pktmbuf_free(tx_pkts_burst[i]);
 586                         ret = TEST_FAILED;
 587                         goto out;
 588                 }
 589
 590                 if (test_ipsec_pkt_update(rte_pktmbuf_mtod_offset(tx_pkts_burst[i],
 591                                         uint8_t *, RTE_ETHER_HDR_LEN), flags)) {
 592                         while (i--)
 593                                 rte_pktmbuf_free(tx_pkts_burst[i]);
 594                         ret = TEST_FAILED;
 595                         goto out;
 596                 }
 597
 598                 if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
 599                         if (ol_flags & RTE_SECURITY_TX_OLOAD_NEED_MDATA)
 600                                 rte_security_set_pkt_metadata(ctx, ses,
 601                                                 tx_pkts_burst[i], NULL);
 602                         tx_pkts_burst[i]->ol_flags |= RTE_MBUF_F_TX_SEC_OFFLOAD;
 603                 }
 604         }
 605         /* Send packet to ethdev for inline IPsec processing. */
 606         nb_sent = rte_eth_tx_burst(port_id, 0, tx_pkts_burst, nb_pkts);
 607         if (nb_sent != nb_pkts) {
 608                 printf("\nUnable to TX %d packets", nb_pkts);
 609                 for ( ; nb_sent < nb_pkts; nb_sent++)
 610                         rte_pktmbuf_free(tx_pkts_burst[nb_sent]);
 611                 ret = TEST_FAILED;
 612                 goto out;
 613         }
 614
 615         rte_pause();
 616
 617         /* Receive back packet on loopback interface. */
 618         do {
 619                 rte_delay_ms(1);
 620                 nb_rx += rte_eth_rx_burst(port_id, 0, &rx_pkts_burst[nb_rx],
 621                                 nb_sent - nb_rx);
 622                 if (nb_rx >= nb_sent)
 623                         break;
 624         } while (j++ < 5 || nb_rx == 0);
 625
 626         if (nb_rx != nb_sent) {
 627                 printf("\nUnable to RX all %d packets", nb_sent);
 628                 while (--nb_rx)
 629                         rte_pktmbuf_free(rx_pkts_burst[nb_rx]);
 630                 ret = TEST_FAILED;
 631                 goto out;
 632         }
 633
 634         for (i = 0; i < nb_rx; i++) {
 635                 rte_pktmbuf_adj(rx_pkts_burst[i], RTE_ETHER_HDR_LEN);
 636
 637                 ret = test_ipsec_post_process(rx_pkts_burst[i], td,
 638                                               res_d, silent, flags);
 639                 if (ret != TEST_SUCCESS) {
 640                         for ( ; i < nb_rx; i++)
 641                                 rte_pktmbuf_free(rx_pkts_burst[i]);
 642                         goto out;
 643                 }
 644
 645                 ret = test_ipsec_stats_verify(ctx, ses, flags,
 646                                         td->ipsec_xform.direction);
 647                 if (ret != TEST_SUCCESS) {
 648                         for ( ; i < nb_rx; i++)
 649                                 rte_pktmbuf_free(rx_pkts_burst[i]);
 650                         goto out;
 651                 }
 652
 653                 rte_pktmbuf_free(rx_pkts_burst[i]);
 654                 rx_pkts_burst[i] = NULL;
 655         }
 656
 657 out:
 658         if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
 659                 destroy_default_flow(port_id);
 660
 661         /* Destroy session so that other cases can create the session again */
 662         rte_security_session_destroy(ctx, ses);
 663         ses = NULL;
 664
 665         return ret;
 666 }
 667
 668 static int
 669 ut_setup_inline_ipsec(void)
 670 {
 671         int ret;
 672
 673         /* Start device */
 674         ret = rte_eth_dev_start(port_id);
 675         if (ret < 0) {
 676                 printf("rte_eth_dev_start: err=%d, port=%d\n",
 677                         ret, port_id);
 678                 return ret;
 679         }
 680         /* always enable promiscuous */
 681         ret = rte_eth_promiscuous_enable(port_id);
 682         if (ret != 0) {
 683                 printf("rte_eth_promiscuous_enable: err=%s, port=%d\n",
 684                         rte_strerror(-ret), port_id);
 685                 return ret;
 686         }
 687
 688         check_all_ports_link_status(1, RTE_PORT_ALL);
 689
 690         return 0;
 691 }
 692
 693 static void
 694 ut_teardown_inline_ipsec(void)
 695 {
 696         uint16_t portid;
 697         int ret;
 698
 699         /* port tear down */
 700         RTE_ETH_FOREACH_DEV(portid) {
 701                 ret = rte_eth_dev_stop(portid);
 702                 if (ret != 0)
 703                         printf("rte_eth_dev_stop: err=%s, port=%u\n",
 704                                rte_strerror(-ret), portid);
 705         }
 706 }
 707
 708 static int
 709 inline_ipsec_testsuite_setup(void)
 710 {
 711         uint16_t nb_rxd;
 712         uint16_t nb_txd;
 713         uint16_t nb_ports;
 714         int ret;
 715         uint16_t nb_rx_queue = 1, nb_tx_queue = 1;
 716
 717         printf("Start inline IPsec test.\n");
 718
 719         nb_ports = rte_eth_dev_count_avail();
 720         if (nb_ports < NB_ETHPORTS_USED) {
 721                 printf("At least %u port(s) used for test\n",
 722                        NB_ETHPORTS_USED);
 723                 return TEST_SKIPPED;
 724         }
 725
 726         ret = init_mempools(NB_MBUF);
 727         if (ret)
 728                 return ret;
 729
 730         if (tx_pkts_burst == NULL) {
 731                 tx_pkts_burst = (struct rte_mbuf **)rte_calloc("tx_buff",
 732                                           MAX_TRAFFIC_BURST,
 733                                           sizeof(void *),
 734                                           RTE_CACHE_LINE_SIZE);
 735                 if (!tx_pkts_burst)
 736                         return TEST_FAILED;
 737
 738                 rx_pkts_burst = (struct rte_mbuf **)rte_calloc("rx_buff",
 739                                           MAX_TRAFFIC_BURST,
 740                                           sizeof(void *),
 741                                           RTE_CACHE_LINE_SIZE);
 742                 if (!rx_pkts_burst)
 743                         return TEST_FAILED;
 744         }
 745
 746         printf("Generate %d packets\n", MAX_TRAFFIC_BURST);
 747
 748         nb_rxd = RTE_TEST_RX_DESC_DEFAULT;
 749         nb_txd = RTE_TEST_TX_DESC_DEFAULT;
 750
 751         /* configuring port 0 for the test is enough */
 752         port_id = 0;
 753         /* port configure */
 754         ret = rte_eth_dev_configure(port_id, nb_rx_queue,
 755                                     nb_tx_queue, &port_conf);
 756         if (ret < 0) {
 757                 printf("Cannot configure device: err=%d, port=%d\n",
 758                          ret, port_id);
 759                 return ret;
 760         }
 761         ret = rte_eth_macaddr_get(port_id, &ports_eth_addr[port_id]);
 762         if (ret < 0) {
 763                 printf("Cannot get mac address: err=%d, port=%d\n",
 764                          ret, port_id);
 765                 return ret;
 766         }
 767         printf("Port %u ", port_id);
 768         print_ethaddr("Address:", &ports_eth_addr[port_id]);
 769         printf("\n");
 770
 771         /* tx queue setup */
 772         ret = rte_eth_tx_queue_setup(port_id, 0, nb_txd,
 773                                      SOCKET_ID_ANY, &tx_conf);
 774         if (ret < 0) {
 775                 printf("rte_eth_tx_queue_setup: err=%d, port=%d\n",
 776                                 ret, port_id);
 777                 return ret;
 778         }
 779         /* rx queue steup */
 780         ret = rte_eth_rx_queue_setup(port_id, 0, nb_rxd, SOCKET_ID_ANY,
 781                                      &rx_conf, mbufpool);
 782         if (ret < 0) {
 783                 printf("rte_eth_rx_queue_setup: err=%d, port=%d\n",
 784                                 ret, port_id);
 785                 return ret;
 786         }
 787         test_ipsec_alg_list_populate();
 788
 789         return 0;
 790 }
 791
 792 static void
 793 inline_ipsec_testsuite_teardown(void)
 794 {
 795         uint16_t portid;
 796         int ret;
 797
 798         /* port tear down */
 799         RTE_ETH_FOREACH_DEV(portid) {
 800                 ret = rte_eth_dev_reset(portid);
 801                 if (ret != 0)
 802                         printf("rte_eth_dev_reset: err=%s, port=%u\n",
 803                                rte_strerror(-ret), port_id);
 804         }
 805 }
 806
 807 static int
 808 test_ipsec_inline_proto_known_vec(const void *test_data)
 809 {
 810         struct ipsec_test_data td_outb;
 811         struct ipsec_test_flags flags;
 812
 813         memset(&flags, 0, sizeof(flags));
 814
 815         memcpy(&td_outb, test_data, sizeof(td_outb));
 816
 817         if (td_outb.aead ||
 818             td_outb.xform.chain.cipher.cipher.algo != RTE_CRYPTO_CIPHER_NULL) {
 819                 /* Disable IV gen to be able to test with known vectors */
 820                 td_outb.ipsec_xform.options.iv_gen_disable = 1;
 821         }
 822
 823         return test_ipsec_inline_proto_process(&td_outb, NULL, 1,
 824                                 false, &flags);
 825 }
 826
 827 static struct unit_test_suite inline_ipsec_testsuite  = {
 828         .suite_name = "Inline IPsec Ethernet Device Unit Test Suite",
 829         .setup = inline_ipsec_testsuite_setup,
 830         .teardown = inline_ipsec_testsuite_teardown,
 831         .unit_test_cases = {
 832                 TEST_CASE_NAMED_WITH_DATA(
 833                         "Outbound known vector (ESP tunnel mode IPv4 AES-GCM 128)",
 834                         ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
 835                         test_ipsec_inline_proto_known_vec, &pkt_aes_128_gcm),
 836                 TEST_CASE_NAMED_WITH_DATA(
 837                         "Outbound known vector (ESP tunnel mode IPv4 AES-GCM 192)",
 838                         ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
 839                         test_ipsec_inline_proto_known_vec, &pkt_aes_192_gcm),
 840                 TEST_CASE_NAMED_WITH_DATA(
 841                         "Outbound known vector (ESP tunnel mode IPv4 AES-GCM 256)",
 842                         ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
 843                         test_ipsec_inline_proto_known_vec, &pkt_aes_256_gcm),
 844                 TEST_CASE_NAMED_WITH_DATA(
 845                         "Outbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA256 [16B ICV])",
 846                         ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
 847                         test_ipsec_inline_proto_known_vec,
 848                         &pkt_aes_128_cbc_hmac_sha256),
 849                 TEST_CASE_NAMED_WITH_DATA(
 850                         "Outbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA384 [24B ICV])",
 851                         ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
 852                         test_ipsec_inline_proto_known_vec,
 853                         &pkt_aes_128_cbc_hmac_sha384),
 854                 TEST_CASE_NAMED_WITH_DATA(
 855                         "Outbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA512 [32B ICV])",
 856                         ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
 857                         test_ipsec_inline_proto_known_vec,
 858                         &pkt_aes_128_cbc_hmac_sha512),
 859                 TEST_CASE_NAMED_WITH_DATA(
 860                         "Outbound known vector (ESP tunnel mode IPv6 AES-GCM 128)",
 861                         ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
 862                         test_ipsec_inline_proto_known_vec, &pkt_aes_256_gcm_v6),
 863                 TEST_CASE_NAMED_WITH_DATA(
 864                         "Outbound known vector (ESP tunnel mode IPv6 AES-CBC 128 HMAC-SHA256 [16B ICV])",
 865                         ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
 866                         test_ipsec_inline_proto_known_vec,
 867                         &pkt_aes_128_cbc_hmac_sha256_v6),
 868                 TEST_CASE_NAMED_WITH_DATA(
 869                         "Outbound known vector (ESP tunnel mode IPv4 NULL AES-XCBC-MAC [12B ICV])",
 870                         ut_setup_inline_ipsec, ut_teardown_inline_ipsec,
 871                         test_ipsec_inline_proto_known_vec,
 872                         &pkt_null_aes_xcbc),
 873
 874                 TEST_CASES_END() /**< NULL terminate unit test array */
 875         },
 876 };
 877
 878
 879 static int
 880 test_inline_ipsec(void)
 881 {
 882         return unit_test_suite_runner(&inline_ipsec_testsuite);
 883 }
 884
 885 #endif /* !RTE_EXEC_ENV_WINDOWS */
 886
 887 REGISTER_TEST_COMMAND(inline_ipsec_autotest, test_inline_ipsec);