test/crypto: add UDP-encapsulated IPsec cases

Added tests to verify UDP encapsulation with IPsec.
The tests have IPsec packets generated from plain packets
and verifies that UDP header is added. Subsequently, the
packets are decapsulated and then resultant packet is
verified by comparing against original packet.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>
Acked-by: Ciara Power <ciara.power@intel.com>

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 956541ee1c2e17ba1c40b43d317bf2b4fc67e81f..bc2490b6a14fd5451471dfcd71e001b25221702a 100644 (file)
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -8946,6 +8946,9 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
        sec_cap_idx.ipsec.mode = ipsec_xform.mode;
        sec_cap_idx.ipsec.direction = ipsec_xform.direction;
 
+       if (flags->udp_encap)
+               ipsec_xform.options.udp_encap = 1;
+
        sec_cap = rte_security_capability_get(ctx, &sec_cap_idx);
        if (sec_cap == NULL)
                return TEST_SKIPPED;
@@ -9156,6 +9159,18 @@ test_ipsec_proto_err_icv_corrupt(const void *data __rte_unused)
        return test_ipsec_proto_all(&flags);
 }
 
+static int
+test_ipsec_proto_udp_encap(const void *data __rte_unused)
+{
+       struct ipsec_test_flags flags;
+
+       memset(&flags, 0, sizeof(flags));
+
+       flags.udp_encap = true;
+
+       return test_ipsec_proto_all(&flags);
+}
+
 static int
 test_PDCP_PROTO_all(void)
 {
@@ -14072,6 +14087,10 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
                        "IV generation",
                        ut_setup_security, ut_teardown,
                        test_ipsec_proto_iv_gen),
+               TEST_CASE_NAMED_ST(
+                       "UDP encapsulation",
+                       ut_setup_security, ut_teardown,
+                       test_ipsec_proto_udp_encap),
                TEST_CASE_NAMED_ST(
                        "Negative test: ICV corruption",
                        ut_setup_security, ut_teardown,

diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 78c7f3a72b51871e2b4888c2c2fdea04b4b0f385..5b5499615615aa8acb9e2f6c79f4d6cf9a158e7f 100644 (file)
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -7,6 +7,7 @@
 #include <rte_esp.h>
 #include <rte_ip.h>
 #include <rte_security.h>
+#include <rte_udp.h>
 
 #include "test.h"
 #include "test_cryptodev_security_ipsec.h"
@@ -183,6 +184,9 @@ test_ipsec_td_update(struct ipsec_test_data td_inb[],
                        int icv_pos = td_inb[i].input_text.len - 4;
                        td_inb[i].input_text.data[icv_pos] += 1;
                }
+
+               if (flags->udp_encap)
+                       td_inb[i].ipsec_xform.options.udp_encap = 1;
        }
 }
 
@@ -268,6 +272,30 @@ test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td,
            td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
                return TEST_SUCCESS;
 
+       if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS &&
+          flags->udp_encap) {
+               const struct rte_ipv4_hdr *iph4;
+               const struct rte_ipv6_hdr *iph6;
+
+               if (td->ipsec_xform.tunnel.type ==
+                               RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+                       iph4 = (const struct rte_ipv4_hdr *)output_text;
+                       if (iph4->next_proto_id != IPPROTO_UDP) {
+                               printf("UDP header is not found\n");
+                               return TEST_FAILED;
+                       }
+               } else {
+                       iph6 = (const struct rte_ipv6_hdr *)output_text;
+                       if (iph6->proto != IPPROTO_UDP) {
+                               printf("UDP header is not found\n");
+                               return TEST_FAILED;
+                       }
+               }
+
+               len -= sizeof(struct rte_udp_hdr);
+               output_text += sizeof(struct rte_udp_hdr);
+       }
+
        if (len != td->output_text.len) {
                printf("Output length (%d) not matching with expected (%d)\n",
                        len, td->output_text.len);

diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index d2ec63f66aaa195ba2523eb29b97e6a3067eb9e3..e1645f4670ba678ae948be4016f5dc1b0079332c 100644 (file)
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -51,6 +51,7 @@ struct ipsec_test_flags {
        bool display_alg;
        bool icv_corrupt;
        bool iv_gen;
+       bool udp_encap;
 };
 
 struct crypto_param {

diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst
index a0998ff2fb7f46ea56babce992838ac84492c603..a11929c621c9117d122efd2812868620fafcde79 100644 (file)
--- a/doc/guides/rel_notes/release_21_11.rst
+++ b/doc/guides/rel_notes/release_21_11.rst
@@ -101,6 +101,7 @@ New Features
   * Added known vector tests (AES-GCM 128, 192, 256).
   * Added tests to verify error reporting with ICV corruption.
   * Added tests to verify IV generation.
+  * Added tests to verify UDP encapsulation.
 
 
 Removed Items