From d02c6bfcb99a7d5a3595e89a6a05c841767904c1 Mon Sep 17 00:00:00 2001 From: Tejasree Kondoj Date: Mon, 31 Jan 2022 22:13:57 +0530 Subject: [PATCH] test/crypto: add ESN and antireplay cases Added test cases for IPsec ESN and Antireplay. Signed-off-by: Tejasree Kondoj Acked-by: Akhil Goyal --- app/test/test_cryptodev.c | 186 +++++++++++++++++- app/test/test_cryptodev_security_ipsec.c | 23 ++- app/test/test_cryptodev_security_ipsec.h | 6 +- ...st_cryptodev_security_ipsec_test_vectors.h | 1 + 4 files changed, 212 insertions(+), 4 deletions(-) diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c index ca79ff2b29..fc3c09d86f 100644 --- a/app/test/test_cryptodev.c +++ b/app/test/test_cryptodev.c @@ -9301,6 +9301,18 @@ test_ipsec_proto_process(const struct ipsec_test_data td[], return TEST_SKIPPED; for (i = 0; i < nb_td; i++) { + if (flags->antireplay && + (dir == RTE_SECURITY_IPSEC_SA_DIR_EGRESS)) { + sess_conf.ipsec.esn.value = td[i].ipsec_xform.esn.value; + ret = rte_security_session_update(ctx, + ut_params->sec_session, &sess_conf); + if (ret) { + printf("Could not update sequence number in " + "session\n"); + return TEST_SKIPPED; + } + } + /* Setup source mbuf payload */ ut_params->ibuf = rte_pktmbuf_alloc(ts_params->mbuf_pool); memset(rte_pktmbuf_mtod(ut_params->ibuf, uint8_t *), 0, @@ -9353,7 +9365,8 @@ test_ipsec_proto_process(const struct ipsec_test_data td[], /* Process crypto operation */ process_crypto_request(dev_id, ut_params->op); - ret = test_ipsec_status_check(ut_params->op, flags, dir, i + 1); + ret = test_ipsec_status_check(&td[i], ut_params->op, flags, dir, + i + 1); if (ret != TEST_SUCCESS) goto crypto_op_free; @@ -9904,6 +9917,150 @@ test_ipsec_proto_ipv6_set_dscp_1_inner_0(const void *data __rte_unused) return test_ipsec_proto_all(&flags); } +static int +test_ipsec_pkt_replay(const void *test_data, const uint64_t esn[], + bool replayed_pkt[], uint32_t nb_pkts, bool esn_en, + uint64_t winsz) +{ + struct ipsec_test_data td_outb[IPSEC_TEST_PACKETS_MAX]; + struct ipsec_test_data td_inb[IPSEC_TEST_PACKETS_MAX]; + struct ipsec_test_flags flags; + uint32_t i = 0, ret = 0; + + memset(&flags, 0, sizeof(flags)); + flags.antireplay = true; + + for (i = 0; i < nb_pkts; i++) { + memcpy(&td_outb[i], test_data, sizeof(td_outb[i])); + td_outb[i].ipsec_xform.options.iv_gen_disable = 1; + td_outb[i].ipsec_xform.replay_win_sz = winsz; + td_outb[i].ipsec_xform.options.esn = esn_en; + } + + for (i = 0; i < nb_pkts; i++) + td_outb[i].ipsec_xform.esn.value = esn[i]; + + ret = test_ipsec_proto_process(td_outb, td_inb, nb_pkts, true, + &flags); + if (ret != TEST_SUCCESS) + return ret; + + test_ipsec_td_update(td_inb, td_outb, nb_pkts, &flags); + + for (i = 0; i < nb_pkts; i++) { + td_inb[i].ipsec_xform.options.esn = esn_en; + /* Set antireplay flag for packets to be dropped */ + td_inb[i].ar_packet = replayed_pkt[i]; + } + + ret = test_ipsec_proto_process(td_inb, NULL, nb_pkts, true, + &flags); + + return ret; +} + +static int +test_ipsec_proto_pkt_antireplay(const void *test_data, uint64_t winsz) +{ + + uint32_t nb_pkts = 5; + bool replayed_pkt[5]; + uint64_t esn[5]; + + /* 1. Advance the TOP of the window to WS * 2 */ + esn[0] = winsz * 2; + /* 2. Test sequence number within the new window(WS + 1) */ + esn[1] = winsz + 1; + /* 3. Test sequence number less than the window BOTTOM */ + esn[2] = winsz; + /* 4. Test sequence number in the middle of the window */ + esn[3] = winsz + (winsz / 2); + /* 5. Test replay of the packet in the middle of the window */ + esn[4] = winsz + (winsz / 2); + + replayed_pkt[0] = false; + replayed_pkt[1] = false; + replayed_pkt[2] = true; + replayed_pkt[3] = false; + replayed_pkt[4] = true; + + return test_ipsec_pkt_replay(test_data, esn, replayed_pkt, nb_pkts, + false, winsz); +} + +static int +test_ipsec_proto_pkt_antireplay1024(const void *test_data) +{ + return test_ipsec_proto_pkt_antireplay(test_data, 1024); +} + +static int +test_ipsec_proto_pkt_antireplay2048(const void *test_data) +{ + return test_ipsec_proto_pkt_antireplay(test_data, 2048); +} + +static int +test_ipsec_proto_pkt_antireplay4096(const void *test_data) +{ + return test_ipsec_proto_pkt_antireplay(test_data, 4096); +} + +static int +test_ipsec_proto_pkt_esn_antireplay(const void *test_data, uint64_t winsz) +{ + + uint32_t nb_pkts = 7; + bool replayed_pkt[7]; + uint64_t esn[7]; + + /* Set the initial sequence number */ + esn[0] = (uint64_t)(0xFFFFFFFF - winsz); + /* 1. Advance the TOP of the window to (1<<32 + WS/2) */ + esn[1] = (uint64_t)((1ULL << 32) + (winsz / 2)); + /* 2. Test sequence number within new window (1<<32 + WS/2 + 1) */ + esn[2] = (uint64_t)((1ULL << 32) - (winsz / 2) + 1); + /* 3. Test with sequence number within window (1<<32 - 1) */ + esn[3] = (uint64_t)((1ULL << 32) - 1); + /* 4. Test with sequence number within window (1<<32 - 1) */ + esn[4] = (uint64_t)(1ULL << 32); + /* 5. Test with duplicate sequence number within + * new window (1<<32 - 1) + */ + esn[5] = (uint64_t)((1ULL << 32) - 1); + /* 6. Test with duplicate sequence number within new window (1<<32) */ + esn[6] = (uint64_t)(1ULL << 32); + + replayed_pkt[0] = false; + replayed_pkt[1] = false; + replayed_pkt[2] = false; + replayed_pkt[3] = false; + replayed_pkt[4] = false; + replayed_pkt[5] = true; + replayed_pkt[6] = true; + + return test_ipsec_pkt_replay(test_data, esn, replayed_pkt, nb_pkts, + true, winsz); +} + +static int +test_ipsec_proto_pkt_esn_antireplay1024(const void *test_data) +{ + return test_ipsec_proto_pkt_esn_antireplay(test_data, 1024); +} + +static int +test_ipsec_proto_pkt_esn_antireplay2048(const void *test_data) +{ + return test_ipsec_proto_pkt_esn_antireplay(test_data, 2048); +} + +static int +test_ipsec_proto_pkt_esn_antireplay4096(const void *test_data) +{ + return test_ipsec_proto_pkt_esn_antireplay(test_data, 4096); +} + static int test_PDCP_PROTO_all(void) { @@ -14974,6 +15131,33 @@ static struct unit_test_suite ipsec_proto_testsuite = { "Tunnel header IPv6 set DSCP 1 (inner 0)", ut_setup_security, ut_teardown, test_ipsec_proto_ipv6_set_dscp_1_inner_0), + TEST_CASE_NAMED_WITH_DATA( + "Antireplay with window size 1024", + ut_setup_security, ut_teardown, + test_ipsec_proto_pkt_antireplay1024, &pkt_aes_128_gcm), + TEST_CASE_NAMED_WITH_DATA( + "Antireplay with window size 2048", + ut_setup_security, ut_teardown, + test_ipsec_proto_pkt_antireplay2048, &pkt_aes_128_gcm), + TEST_CASE_NAMED_WITH_DATA( + "Antireplay with window size 4096", + ut_setup_security, ut_teardown, + test_ipsec_proto_pkt_antireplay4096, &pkt_aes_128_gcm), + TEST_CASE_NAMED_WITH_DATA( + "ESN and Antireplay with window size 1024", + ut_setup_security, ut_teardown, + test_ipsec_proto_pkt_esn_antireplay1024, + &pkt_aes_128_gcm), + TEST_CASE_NAMED_WITH_DATA( + "ESN and Antireplay with window size 2048", + ut_setup_security, ut_teardown, + test_ipsec_proto_pkt_esn_antireplay2048, + &pkt_aes_128_gcm), + TEST_CASE_NAMED_WITH_DATA( + "ESN and Antireplay with window size 4096", + ut_setup_security, ut_teardown, + test_ipsec_proto_pkt_esn_antireplay4096, + &pkt_aes_128_gcm), TEST_CASES_END() /**< NULL terminate unit test array */ } }; diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c index 970d4d435d..3887b05135 100644 --- a/app/test/test_cryptodev_security_ipsec.c +++ b/app/test/test_cryptodev_security_ipsec.c @@ -178,6 +178,13 @@ test_ipsec_sec_caps_verify(struct rte_security_ipsec_xform *ipsec_xform, return -ENOTSUP; } + if (ipsec_xform->replay_win_sz > sec_cap->ipsec.replay_win_sz_max) { + if (!silent) + RTE_LOG(INFO, USER1, + "Replay window size is not supported\n"); + return -ENOTSUP; + } + return 0; } @@ -656,7 +663,8 @@ test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td, if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS && (flags->icv_corrupt || flags->sa_expiry_pkts_hard || - flags->tunnel_hdr_verify)) + flags->tunnel_hdr_verify || + td->ar_packet)) return TEST_SUCCESS; if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS && @@ -923,13 +931,24 @@ test_ipsec_post_process(struct rte_mbuf *m, const struct ipsec_test_data *td, } int -test_ipsec_status_check(struct rte_crypto_op *op, +test_ipsec_status_check(const struct ipsec_test_data *td, + struct rte_crypto_op *op, const struct ipsec_test_flags *flags, enum rte_security_ipsec_sa_direction dir, int pkt_num) { int ret = TEST_SUCCESS; + if ((dir == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) && + td->ar_packet) { + if (op->status != RTE_CRYPTO_OP_STATUS_ERROR) { + printf("Anti replay test case failed\n"); + return TEST_FAILED; + } else { + return TEST_SUCCESS; + } + } + if (dir == RTE_SECURITY_IPSEC_SA_DIR_INGRESS && flags->sa_expiry_pkts_hard && pkt_num == IPSEC_TEST_PACKETS_MAX) { diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h index c4ecfafca6..a15c1d3015 100644 --- a/app/test/test_cryptodev_security_ipsec.h +++ b/app/test/test_cryptodev_security_ipsec.h @@ -40,6 +40,8 @@ struct ipsec_test_data { struct rte_security_ipsec_xform ipsec_xform; bool aead; + /* Antireplay packet */ + bool ar_packet; union { struct { @@ -82,6 +84,7 @@ struct ipsec_test_flags { bool transport; bool fragment; bool stats_success; + bool antireplay; enum df_flags df; enum dscp_flags dscp; }; @@ -234,7 +237,8 @@ int test_ipsec_post_process(struct rte_mbuf *m, struct ipsec_test_data *res_d, bool silent, const struct ipsec_test_flags *flags); -int test_ipsec_status_check(struct rte_crypto_op *op, +int test_ipsec_status_check(const struct ipsec_test_data *td, + struct rte_crypto_op *op, const struct ipsec_test_flags *flags, enum rte_security_ipsec_sa_direction dir, int pkt_num); diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h index 85cd6c51a8..fe2fd855df 100644 --- a/app/test/test_cryptodev_security_ipsec_test_vectors.h +++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h @@ -102,6 +102,7 @@ struct ipsec_test_data pkt_aes_128_gcm = { .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL, .tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4, .replay_win_sz = 0, + .esn.low = 1, }, .aead = true, -- 2.20.1