test/crypto: add lookaside IPsec ICV corrupt case

Add negative test to validate IPsec inbound processing failure with ICV
corruption. The tests would first do IPsec encapsulation and corrupt
ICV of the generated IPsec packet. Then the packet is submitted to IPsec
outbound processing for decapsulation. Test case would validate that PMD
returns an error in such cases.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>
Acked-by: Ciara Power <ciara.power@intel.com>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 3eacc6672a023999ae6442df3d2c6f004a4fde14..bfaca1de6225a1185dedf4f4c0d0f8f5fcdbdb6f 100644 (file)
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9129,6 +9129,18 @@ test_ipsec_proto_display_list(const void *data __rte_unused)
        return test_ipsec_proto_all(&flags);
 }
 
+static int
+test_ipsec_proto_err_icv_corrupt(const void *data __rte_unused)
+{
+       struct ipsec_test_flags flags;
+
+       memset(&flags, 0, sizeof(flags));
+
+       flags.icv_corrupt = true;
+
+       return test_ipsec_proto_all(&flags);
+}
+
 static int
 test_PDCP_PROTO_all(void)
 {
@@ -14041,6 +14053,10 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
                        "Combined test alg list",
                        ut_setup_security, ut_teardown,
                        test_ipsec_proto_display_list),
+               TEST_CASE_NAMED_ST(
+                       "Negative test: ICV corruption",
+                       ut_setup_security, ut_teardown,
+                       test_ipsec_proto_err_icv_corrupt),
                TEST_CASES_END() /**< NULL terminate unit test array */
        }
 };

diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index d08e093cb574172df48913fa2789748e3fcbaf9e..aebbe66639dfc5a47f8b6240921638cc3f95e74c 100644 (file)
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -175,9 +175,12 @@ test_ipsec_td_update(struct ipsec_test_data td_inb[],
                memcpy(td_inb[i].output_text.data, td_outb[i].input_text.data,
                       td_outb[i].input_text.len);
                td_inb[i].output_text.len = td_outb->input_text.len;
-       }
 
-       RTE_SET_USED(flags);
+               if (flags->icv_corrupt) {
+                       int icv_pos = td_inb[i].input_text.len - 4;
+                       td_inb[i].input_text.data[icv_pos] += 1;
+               }
+       }
 }
 
 void
@@ -217,6 +220,11 @@ test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td,
        uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *);
        uint32_t skip, len = rte_pktmbuf_pkt_len(m);
 
+       /* For negative tests, no need to do verification */
+       if (flags->icv_corrupt &&
+           td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
+               return TEST_SUCCESS;
+
        if (len != td->output_text.len) {
                printf("Output length (%d) not matching with expected (%d)\n",
                        len, td->output_text.len);
@@ -241,8 +249,6 @@ test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td,
                return TEST_FAILED;
        }
 
-       RTE_SET_USED(flags);
-
        return TEST_SUCCESS;
 }
 
@@ -299,13 +305,17 @@ test_ipsec_status_check(struct rte_crypto_op *op,
 {
        int ret = TEST_SUCCESS;
 
-       if (op->status != RTE_CRYPTO_OP_STATUS_SUCCESS) {
-               printf("Security op processing failed\n");
-               ret = TEST_FAILED;
+       if (dir == RTE_SECURITY_IPSEC_SA_DIR_INGRESS && flags->icv_corrupt) {
+               if (op->status != RTE_CRYPTO_OP_STATUS_ERROR) {
+                       printf("ICV corruption test case failed\n");
+                       ret = TEST_FAILED;
+               }
+       } else {
+               if (op->status != RTE_CRYPTO_OP_STATUS_SUCCESS) {
+                       printf("Security op processing failed\n");
+                       ret = TEST_FAILED;
+               }
        }
 
-       RTE_SET_USED(flags);
-       RTE_SET_USED(dir);
-
        return ret;
 }

diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index cbb3ee48807a7322148925dbe39fba40a9429011..134fc3aa1c141a408e2afc37c93d5e716a3cfff1 100644 (file)
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -49,6 +49,7 @@ struct ipsec_test_data {
 
 struct ipsec_test_flags {
        bool display_alg;
+       bool icv_corrupt;
 };
 
 struct crypto_param {

diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst
index dcfeddb88a7120bfe05075c698428635cc56ac95..22b9865f317774d2c90cfce7c1e1457b2301c3d9 100644 (file)
--- a/doc/guides/rel_notes/release_21_11.rst
+++ b/doc/guides/rel_notes/release_21_11.rst
@@ -99,6 +99,7 @@ New Features
 * **Added lookaside protocol (IPsec) tests in dpdk-test.**
 
   * Added known vector tests (AES-GCM 128, 192, 256).
+  * Added tests to verify error reporting with ICV corruption.
 
 
 Removed Items