Add TLS record test suite

PATCH Applied Anoob Joseph 2 participants 17 messages Dec 7, 2023 – Jan 19, 2024 Arm/Amlogic Meson SoC support

Share & tools

Anoob Joseph

author

2023-12-07 13:02 UTC #0 lore raw

cover Add TLS record test suite

Add TLS record test suite in cryptodev autotest framework. The test suite would run based on capabilities exposed by the cryptodev.

The test suite framework is similar to the framework used in case of IPsec tests. To avoid duplication of code, protocol independent code is moved to common files and the functions are renamed accordingly.

TLS record test suite has known vector tests as well as combined mode tests. Known vector tests leverages vectors generated with kTLS and gnuTLS utilities. The test suite supports testing both operations (read or decrypt, write or encrypt) with a single vector. Write or encrypt test would get skipped if cryptodev doesn't support disabling of IV generation. Combined mode tests are targetted at testing protocol features with all combinations of cipher-authentication algorithms.

Combined mode performs record write operation first and feeds that back to record read operation. Individual test cases may update the input to record write operation based on the test case and the test framework validates the output obtained (not complete text, but protocol specific fields such as TLS header). Once it is validated, the output will be submitted for record read operation which would give back the original data. Currently this framework supports testing of multi-segmented mbuf as input with TLS record. The same would be enhanced to support more cases such as ICV corruption, incorrect padding etc.

Enhancements planned for future,
- Add TLS 1.3 suite
- Add negative tests such as ICV corruption and incorrect padding
- Add session expiry tests
- Add anti-replay tests with DTLS

Sample output with crypto_cn10k:

+ ------------------------------------------------------- + [67/18944]
+ ------------------------------------------------------- +
+ Test Suite : TLS 1.2 Record Protocol Unit Test Suite
+ ------------------------------------------------------- +
+ TestCase [ 0] : Write record known vector AES-GCM-128 (vector 1) succeeded
+ TestCase [ 1] : Write record known vector AES-GCM-128 (vector 2) succeeded
+ TestCase [ 2] : Write record known vector AES-GCM-256 succeeded
+ TestCase [ 3] : Write record known vector AES-CBC-128-SHA1 succeeded
+ TestCase [ 4] : Write record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [ 5] : Write record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [ 6] : Write record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [ 7] : Write record known vector 3DES-CBC-SHA1-HMAC succeeded
USER1: Cipher crypto capabilities not supported
+ TestCase [ 8] : Write record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [ 9] : Write record known vector CHACHA20-POLY1305 skipped
+ TestCase [10] : Read record known vector AES-GCM-128 (vector 1) succeeded
+ TestCase [11] : Read record known vector AES-GCM-128 (vector 2) succeeded
+ TestCase [12] : Read record known vector AES-GCM-256 succeeded
+ TestCase [13] : Read record known vector AES-128-CBC-SHA1 succeeded
+ TestCase [14] : Read record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [15] : Read record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [16] : Read record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [17] : Read record known vector 3DES-CBC-SHA1-HMAC succeeded
USER1: Cipher crypto capabilities not supported
+ TestCase [18] : Read record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [19] : Read record known vector CHACHA20-POLY1305 skipped

        3des-cbc [192] sha1-hmac [20B ICV]
        aes-cbc [128] sha1-hmac [20B ICV]
        aes-cbc [128] sha2-256-hmac [32B ICV]
        aes-cbc [256] sha1-hmac [20B ICV]
        aes-cbc [256] sha2-256-hmac [32B ICV]

+ TestCase [20] : Combined test alg list succeeded
+ TestCase [21] : Multi-segmented mode succeeded
+ ------------------------------------------------------- +
+ Test Suite Summary : TLS 1.2 Record Protocol Unit Test Suite
+ ------------------------------------------------------- +
+ Tests Total : 22
+ Tests Skipped : 4
+ Tests Executed : 22
+ Tests Unsupported: 0
+ Tests Passed : 18
+ Tests Failed : 0
+ ------------------------------------------------------- +
+ ------------------------------------------------------- +
+ Test Suite : DTLS 1.2 Record Protocol Unit Test Suite
+ ------------------------------------------------------- +
+ TestCase [ 0] : Write record known vector AES-GCM-128 succeeded
+ TestCase [ 1] : Write record known vector AES-GCM-256 succeeded
+ TestCase [ 2] : Write record known vector AES-128-CBC-SHA1 succeeded
+ TestCase [ 3] : Write record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [ 4] : Write record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [ 5] : Write record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [ 6] : Write record known vector 3DES-CBC-SHA1-HMAC succeeded
USER1: Cipher crypto capabilities not supported
+ TestCase [ 7] : Write record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [ 8] : Write record known vector CHACHA20-POLY1305 skipped
+ TestCase [ 9] : Read record known vector AES-GCM-128 succeeded
+ TestCase [10] : Read record known vector AES-GCM-256 succeeded
+ TestCase [11] : Read record known vector AES-128-CBC-SHA1 succeeded
+ TestCase [12] : Read record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [13] : Read record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [14] : Read record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [15] : Read record known vector 3DES-CBC-SHA1-HMAC succeeded
USER1: Cipher crypto capabilities not supported
+ TestCase [16] : Read record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [17] : Read record known vector CHACHA20-POLY1305 skipped

        3des-cbc [192] sha1-hmac [20B ICV]
        aes-cbc [128] sha1-hmac [20B ICV]
        aes-cbc [128] sha2-256-hmac [32B ICV]
        aes-cbc [256] sha1-hmac [20B ICV]
        aes-cbc [256] sha2-256-hmac [32B ICV]

+ TestCase [18] : Combined test alg list succeeded
+ TestCase [19] : Multi-segmented mode succeeded
+ ------------------------------------------------------- +
+ Test Suite Summary : DTLS 1.2 Record Protocol Unit Test Suite
+ ------------------------------------------------------- +
+ Tests Total : 20
+ Tests Skipped : 4
+ Tests Executed : 20
+ Tests Unsupported: 0
+ Tests Passed : 16
+ Tests Failed : 0
+ ------------------------------------------------------- +

Akhil Goyal (3):
test/crypto: add TLS1.2 vectors
test/crypto: add TLS1.2/DTLS1.2 AES-128/256-GCM vectors test/security: add TLS 1.2 and DTLS 1.2 vectors

Anoob Joseph (5):
test/crypto: move security caps checks to separate file test/crypto: move algorithm display routines to common test/security: add sha1-hmac to auth list test/crypto: add TLS record tests
test/crypto: add verification of TLS headers

Tejasree Kondoj (2):
test/crypto: add AES-GCM 128 TLS 1.2 vector
test/crypto: add multi segmented cases

Vidya Sagar Velumuri (4):
test/crypto: move algorithm list to common
test/crypto: move algorithm framework to common
test/crypto: add combined mode cases
test/security: add more algos to combined tests

 app/test-security-perf/meson.build            |    1 +
 app/test-security-perf/test_security_perf.c   |   35 +-
 app/test/meson.build                          |    2 +
 app/test/test_cryptodev.c                     |  596 ++++++-
 app/test/test_cryptodev.h                     |    2 +
 app/test/test_cryptodev_security_ipsec.c      |  164 +-
 app/test/test_cryptodev_security_ipsec.h      |  157 +-
 app/test/test_cryptodev_security_tls_record.c |  327 ++++
 app/test/test_cryptodev_security_tls_record.h |  101 ++
 ...yptodev_security_tls_record_test_vectors.h | 1584 +++++++++++++++++
 app/test/test_security_inline_proto.c         |   42 +-
 app/test/test_security_proto.c                |  154 ++
 app/test/test_security_proto.h                |  186 ++
 doc/guides/rel_notes/release_24_03.rst        |    4 +
 14 files changed, 2960 insertions(+), 395 deletions(-)
 create mode 100644 app/test/test_cryptodev_security_tls_record.c
 create mode 100644 app/test/test_cryptodev_security_tls_record.h
 create mode 100644 app/test/test_cryptodev_security_tls_record_test_vectors.h
 create mode 100644 app/test/test_security_proto.c
 create mode 100644 app/test/test_security_proto.h

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:02 UTC #1 lore raw

PATCH 1/14 test/crypto: move security caps checks to separate file

Move routines performing security caps verifications to a separate file to allow the usage of same for other protocol tests such as TLS record.

Signed-off-by Anoob Joseph <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test-security-perf/meson.build          |  1 +
 app/test-security-perf/test_security_perf.c | 17 ++---
 app/test/meson.build                        |  1 +
 app/test/test_cryptodev.c                   | 17 ++---
 app/test/test_cryptodev_security_ipsec.c    | 78 -------------------
 app/test/test_cryptodev_security_ipsec.h    | 12 ---
 app/test/test_security_inline_proto.c       | 12 +--
 app/test/test_security_proto.c              | 83 +++++++++++++++++++++
 app/test/test_security_proto.h              | 20 +++++
 9 files changed, 121 insertions(+), 120 deletions(-)
 create mode 100644 app/test/test_security_proto.c
 create mode 100644 app/test/test_security_proto.h

app/test-security-perf/meson.build +1 -0

index 076999022e..547de9c908 100644
@@ -10,5 +10,6 @@ endif
 sources = files(
         'test_security_perf.c',
         '../test/test_cryptodev_security_ipsec.c',
+        '../test/test_security_proto.c',
 )
 deps += ['security', 'cmdline']

app/test-security-perf/test_security_perf.c +5 ~~-12~~

index 4dfaca4800..c64f20e76c 100644
@@ -16,6 +16,7 @@
 #include <app/test/test_cryptodev.h>
 #include <app/test/test_cryptodev_security_ipsec.h>
 #include <app/test/test_cryptodev_security_ipsec_test_vectors.h>
+#include <app/test/test_security_proto.h>
 
 #define NB_DESC 4096
 #define DEF_NB_SESSIONS (16 * 10 * 1024) /* 16 * 10K tunnels */

@@ -258,9 +259,7 @@ sec_conf_init(struct lcore_conf *conf,
 		conf->aead_xform.aead.iv.offset = IV_OFFSET;
 
 		/* Verify crypto capabilities */
-		if (test_ipsec_crypto_caps_aead_verify(
-				sec_cap,
-				&conf->aead_xform) != 0) {
+		if (test_sec_crypto_caps_aead_verify(sec_cap, &conf->aead_xform) != 0) {
 			RTE_LOG(ERR, USER1,
 				"Crypto capabilities not supported\n");
 			return -1;

@@ -270,9 +269,7 @@ sec_conf_init(struct lcore_conf *conf,
 		       sizeof(conf->auth_xform));
 		conf->auth_xform.auth.key.data = td[0].auth_key.data;
 
-		if (test_ipsec_crypto_caps_auth_verify(
-				sec_cap,
-				&conf->auth_xform) != 0) {
+		if (test_sec_crypto_caps_auth_verify(sec_cap, &conf->auth_xform) != 0) {
 			RTE_LOG(INFO, USER1,
 				"Auth crypto capabilities not supported\n");
 			return -1;

@@ -288,17 +285,13 @@ sec_conf_init(struct lcore_conf *conf,
 
 		/* Verify crypto capabilities */
 
-		if (test_ipsec_crypto_caps_cipher_verify(
-				sec_cap,
-				&conf->cipher_xform) != 0) {
+		if (test_sec_crypto_caps_cipher_verify(sec_cap, &conf->cipher_xform) != 0) {
 			RTE_LOG(ERR, USER1,
 				"Cipher crypto capabilities not supported\n");
 			return -1;
 		}
 
-		if (test_ipsec_crypto_caps_auth_verify(
-				sec_cap,
-				&conf->auth_xform) != 0) {
+		if (test_sec_crypto_caps_auth_verify(sec_cap, &conf->auth_xform) != 0) {
 			RTE_LOG(ERR, USER1,
 				"Auth crypto capabilities not supported\n");
 			return -1;

app/test/meson.build +1 -0

index dcc93f4a43..58e120a6ab 100644
@@ -169,6 +169,7 @@ source_file_deps = {
     'test_security.c': ['net', 'security'],
     'test_security_inline_macsec.c': ['ethdev', 'security'],
     'test_security_inline_proto.c': ['ethdev', 'security', 'eventdev'] + test_cryptodev_deps,
+    'test_security_proto.c' : ['cryptodev', 'security'],
     'test_seqlock.c': [],
     'test_service_cores.c': [],
     'test_spinlock.c': [],

app/test/test_cryptodev.c +5 ~~-12~~

index 58561ededf..9644566acc 100644
@@ -53,6 +53,7 @@
 #include "test_cryptodev_security_pdcp_sdap_test_vectors.h"
 #include "test_cryptodev_security_pdcp_test_func.h"
 #include "test_cryptodev_security_docsis_test_vectors.h"
+#include "test_security_proto.h"
 
 #define SDAP_DISABLED	0
 #define SDAP_ENABLED	1

@@ -10229,9 +10230,7 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 		ut_params->aead_xform.aead.iv.offset = IV_OFFSET;
 
 		/* Verify crypto capabilities */
-		if (test_ipsec_crypto_caps_aead_verify(
-				sec_cap,
-				&ut_params->aead_xform) != 0) {
+		if (test_sec_crypto_caps_aead_verify(sec_cap, &ut_params->aead_xform) != 0) {
 			if (!silent)
 				RTE_LOG(INFO, USER1,
 					"Crypto capabilities not supported\n");

@@ -10242,9 +10241,7 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 		       sizeof(ut_params->auth_xform));
 		ut_params->auth_xform.auth.key.data = td[0].auth_key.data;
 
-		if (test_ipsec_crypto_caps_auth_verify(
-				sec_cap,
-				&ut_params->auth_xform) != 0) {
+		if (test_sec_crypto_caps_auth_verify(sec_cap, &ut_params->auth_xform) != 0) {
 			if (!silent)
 				RTE_LOG(INFO, USER1,
 					"Auth crypto capabilities not supported\n");

@@ -10261,18 +10258,14 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 
 		/* Verify crypto capabilities */
 
-		if (test_ipsec_crypto_caps_cipher_verify(
-				sec_cap,
-				&ut_params->cipher_xform) != 0) {
+		if (test_sec_crypto_caps_cipher_verify(sec_cap, &ut_params->cipher_xform) != 0) {
 			if (!silent)
 				RTE_LOG(INFO, USER1,
 					"Cipher crypto capabilities not supported\n");
 			return TEST_SKIPPED;
 		}
 
-		if (test_ipsec_crypto_caps_auth_verify(
-				sec_cap,
-				&ut_params->auth_xform) != 0) {
+		if (test_sec_crypto_caps_auth_verify(sec_cap, &ut_params->auth_xform) != 0) {
 			if (!silent)
 				RTE_LOG(INFO, USER1,
 					"Auth crypto capabilities not supported\n");

app/test/test_cryptodev_security_ipsec.c +0 ~~-78~~

84 lines not on this page · raw message

app/test/test_cryptodev_security_ipsec.h +0 ~~-12~~

index d7fc562751..dc1b4c4a80 100644
@@ -263,18 +263,6 @@ int test_ipsec_sec_caps_verify(struct rte_security_ipsec_xform *ipsec_xform,
 			       const struct rte_security_capability *sec_cap,
 			       bool silent);
 
-int test_ipsec_crypto_caps_aead_verify(
-		const struct rte_security_capability *sec_cap,
-		struct rte_crypto_sym_xform *aead);
-
-int test_ipsec_crypto_caps_cipher_verify(
-		const struct rte_security_capability *sec_cap,
-		struct rte_crypto_sym_xform *cipher);
-
-int test_ipsec_crypto_caps_auth_verify(
-		const struct rte_security_capability *sec_cap,
-		struct rte_crypto_sym_xform *auth);
-
 void test_ipsec_td_in_from_out(const struct ipsec_test_data *td_out,
 			       struct ipsec_test_data *td_in);

app/test/test_security_inline_proto.c +6 -6

index 78a2064b65..9644a3c39c 100644
@@ -12,6 +12,7 @@
 
 #include "test.h"
 #include "test_security_inline_proto_vectors.h"
+#include "test_security_proto.h"
 
 #ifdef RTE_EXEC_ENV_WINDOWS
 static int

@@ -248,8 +249,7 @@ create_inline_ipsec_session(struct ipsec_test_data *sa, uint16_t portid,
 				sizeof(struct rte_crypto_sym_xform));
 		sess_conf->crypto_xform->aead.key.data = sa->key.data;
 		/* Verify crypto capabilities */
-		if (test_ipsec_crypto_caps_aead_verify(sec_cap,
-					sess_conf->crypto_xform) != 0) {
+		if (test_sec_crypto_caps_aead_verify(sec_cap, sess_conf->crypto_xform) != 0) {
 			RTE_LOG(INFO, USER1,
 				"Crypto capabilities not supported\n");
 			return TEST_SKIPPED;

@@ -268,14 +268,14 @@ create_inline_ipsec_session(struct ipsec_test_data *sa, uint16_t portid,
 			sess_conf->crypto_xform->next->auth.key.data =
 							sa->auth_key.data;
 			/* Verify crypto capabilities */
-			if (test_ipsec_crypto_caps_cipher_verify(sec_cap,
+			if (test_sec_crypto_caps_cipher_verify(sec_cap,
 					sess_conf->crypto_xform) != 0) {
 				RTE_LOG(INFO, USER1,
 					"Cipher crypto capabilities not supported\n");
 				return TEST_SKIPPED;
 			}
 
-			if (test_ipsec_crypto_caps_auth_verify(sec_cap,
+			if (test_sec_crypto_caps_auth_verify(sec_cap,
 					sess_conf->crypto_xform->next) != 0) {
 				RTE_LOG(INFO, USER1,
 					"Auth crypto capabilities not supported\n");

@@ -294,14 +294,14 @@ create_inline_ipsec_session(struct ipsec_test_data *sa, uint16_t portid,
 							sa->key.data;
 
 			/* Verify crypto capabilities */
-			if (test_ipsec_crypto_caps_cipher_verify(sec_cap,
+			if (test_sec_crypto_caps_cipher_verify(sec_cap,
 					sess_conf->crypto_xform->next) != 0) {
 				RTE_LOG(INFO, USER1,
 					"Cipher crypto capabilities not supported\n");
 				return TEST_SKIPPED;
 			}
 
-			if (test_ipsec_crypto_caps_auth_verify(sec_cap,
+			if (test_sec_crypto_caps_auth_verify(sec_cap,
 					sess_conf->crypto_xform) != 0) {
 				RTE_LOG(INFO, USER1,
 					"Auth crypto capabilities not supported\n");

app/test/test_security_proto.c new file +83 -0

83 lines not on this page · raw message

app/test/test_security_proto.h new file +20 -0

new file mode 100644
index 0000000000..b91181384b
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ * Copyright(C) 2023 Marvell.
+ */
+
+#ifndef _TEST_SECURITY_PROTO_H_
+#define _TEST_SECURITY_PROTO_H_
+
+#include <rte_cryptodev.h>
+#include <rte_security.h>
+
+int test_sec_crypto_caps_aead_verify(const struct rte_security_capability *sec_cap,
+		struct rte_crypto_sym_xform *aead);
+
+int test_sec_crypto_caps_cipher_verify(const struct rte_security_capability *sec_cap,
+		struct rte_crypto_sym_xform *cipher);
+
+int test_sec_crypto_caps_auth_verify(const struct rte_security_capability *sec_cap,
+		struct rte_crypto_sym_xform *auth);
+
+#endif

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:02 UTC #2 lore raw

PATCH 2/14 test/crypto: move algorithm list to common

In reply to Anoob Joseph

From: Vidya Sagar Velumuri <[email protected]>

The algorithm list and associated structs are used for IPsec combined mode tests. The same list can be employed for other security protocol testing as well. Move the same to test_security_proto.h for the same.

Signed-off-by Anoob Joseph <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test/test_cryptodev_security_ipsec.h | 126 +----------------------
 app/test/test_security_proto.h           | 124 ++++++++++++++++++++++
 2 files changed, 126 insertions(+), 124 deletions(-)

app/test/test_cryptodev_security_ipsec.h +2 ~~-124~~

index dc1b4c4a80..77cb5fa7f9 100644
@@ -8,6 +8,8 @@
 #include <rte_cryptodev.h>
 #include <rte_security.h>
 
+#include "test_security_proto.h"
+
 #define IPSEC_TEST_PACKETS_MAX 32
 #define IPSEC_TEXT_MAX_LEN 16384u

@@ -115,130 +117,6 @@ struct ipsec_test_flags {
 	bool rx_inject;
 };
 
-struct crypto_param {
-	enum rte_crypto_sym_xform_type type;
-	union {
-		enum rte_crypto_cipher_algorithm cipher;
-		enum rte_crypto_auth_algorithm auth;
-		enum rte_crypto_aead_algorithm aead;
-	} alg;
-	uint16_t key_length;
-	uint16_t iv_length;
-	uint16_t digest_length;
-};
-
-static const struct crypto_param aead_list[] = {
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_AEAD,
-		.alg.aead =  RTE_CRYPTO_AEAD_AES_GCM,
-		.key_length = 16,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_AEAD,
-		.alg.aead = RTE_CRYPTO_AEAD_AES_GCM,
-		.key_length = 24,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_AEAD,
-		.alg.aead = RTE_CRYPTO_AEAD_AES_GCM,
-		.key_length = 32,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_AEAD,
-		.alg.aead = RTE_CRYPTO_AEAD_AES_CCM,
-		.key_length = 32
-	},
-};
-
-static const struct crypto_param cipher_list[] = {
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
-		.alg.cipher =  RTE_CRYPTO_CIPHER_NULL,
-		.key_length = 0,
-		.iv_length = 0,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
-		.alg.cipher =  RTE_CRYPTO_CIPHER_DES_CBC,
-		.key_length = 8,
-		.iv_length = 8,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
-		.alg.cipher =  RTE_CRYPTO_CIPHER_3DES_CBC,
-		.key_length = 24,
-		.iv_length = 8,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
-		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CBC,
-		.key_length = 16,
-		.iv_length = 16,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
-		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
-		.key_length = 16,
-		.iv_length = 16,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
-		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
-		.key_length = 24,
-		.iv_length = 16,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
-		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
-		.key_length = 32,
-		.iv_length = 16,
-	},
-};
-
-static const struct crypto_param auth_list[] = {
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
-		.alg.auth =  RTE_CRYPTO_AUTH_NULL,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
-		.alg.auth =  RTE_CRYPTO_AUTH_MD5_HMAC,
-		.key_length = 16,
-		.digest_length = 12,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
-		.alg.auth =  RTE_CRYPTO_AUTH_SHA256_HMAC,
-		.key_length = 32,
-		.digest_length = 16,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
-		.alg.auth =  RTE_CRYPTO_AUTH_SHA384_HMAC,
-		.key_length = 48,
-		.digest_length = 24,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
-		.alg.auth =  RTE_CRYPTO_AUTH_SHA512_HMAC,
-		.key_length = 64,
-		.digest_length = 32,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
-		.alg.auth =  RTE_CRYPTO_AUTH_AES_XCBC_MAC,
-		.key_length = 16,
-		.digest_length = 12,
-	},
-	{
-		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
-		.alg.auth =  RTE_CRYPTO_AUTH_AES_GMAC,
-		.key_length = 16,
-		.digest_length = 16,
-		.iv_length = 12,
-	},
-};
-
 struct crypto_param_comb {
 	const struct crypto_param *param1;
 	const struct crypto_param *param2;

app/test/test_security_proto.h +124 -0

130 lines not on this page · raw message

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:02 UTC #3 lore raw

PATCH 3/14 test/crypto: move algorithm display routines to common

In reply to Anoob Joseph

The functions that are used for printing algorithms in case of IPsec can be moved to the common header, test_security_proto.h. The same could be used for other security protocol testing.

Signed-off-by Anoob Joseph <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test-security-perf/test_security_perf.c |  3 +--
 app/test/test_cryptodev.c                   |  6 ++---
 app/test/test_cryptodev_security_ipsec.c    | 26 ---------------------
 app/test/test_cryptodev_security_ipsec.h    |  3 ---
 app/test/test_security_inline_proto.c       |  9 +++----
 app/test/test_security_proto.c              | 25 ++++++++++++++++++++
 app/test/test_security_proto.h              |  2 ++
 7 files changed, 33 insertions(+), 41 deletions(-)

app/test-security-perf/test_security_perf.c +1 -2

index c64f20e76c..84726de7b0 100644
@@ -532,8 +532,7 @@ main(int argc, char **argv)
 	for (ctx.td_idx = 0; ctx.td_idx < RTE_DIM(alg_list); ctx.td_idx++) {
 
 		printf("\n\n    Algorithm combination:");
-		test_ipsec_display_alg(alg_list[ctx.td_idx].param1,
-				       alg_list[ctx.td_idx].param2);
+		test_sec_alg_display(alg_list[ctx.td_idx].param1, alg_list[ctx.td_idx].param2);
 		printf("    ----------------------");
 
 		printf("\n%20s%20s%20s%20s%20s%20s\n\n",

app/test/test_cryptodev.c +2 -4

index 9644566acc..218761f0a9 100644
@@ -10540,8 +10540,7 @@ test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 			return TEST_FAILED;
 
 		if (flags->display_alg)
-			test_ipsec_display_alg(alg_list[i].param1,
-					       alg_list[i].param2);
+			test_sec_alg_display(alg_list[i].param1, alg_list[i].param2);
 
 		pass_cnt++;
 	}

@@ -10586,8 +10585,7 @@ test_ipsec_ah_proto_all(const struct ipsec_test_flags *flags)
 			return TEST_FAILED;
 
 		if (flags->display_alg)
-			test_ipsec_display_alg(ah_alg_list[i].param1,
-					       ah_alg_list[i].param2);
+			test_sec_alg_display(ah_alg_list[i].param1, ah_alg_list[i].param2);
 
 		pass_cnt++;
 	}

app/test/test_cryptodev_security_ipsec.c +0 ~~-26~~

index 01e0a45ffd..dafe3244e8 100644
@@ -549,32 +549,6 @@ test_ipsec_td_update(struct ipsec_test_data td_inb[],
 	}
 }
 
-void
-test_ipsec_display_alg(const struct crypto_param *param1,
-		       const struct crypto_param *param2)
-{
-	if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
-		printf("\t%s [%d]",
-		       rte_cryptodev_get_aead_algo_string(param1->alg.aead),
-		       param1->key_length * 8);
-	} else if (param1->type == RTE_CRYPTO_SYM_XFORM_AUTH) {
-		printf("\t%s",
-		       rte_cryptodev_get_auth_algo_string(param1->alg.auth));
-		if (param1->alg.auth != RTE_CRYPTO_AUTH_NULL)
-			printf(" [%dB ICV]", param1->digest_length);
-	} else {
-		printf("\t%s",
-		       rte_cryptodev_get_cipher_algo_string(param1->alg.cipher));
-		if (param1->alg.cipher != RTE_CRYPTO_CIPHER_NULL)
-			printf(" [%d]", param1->key_length * 8);
-		printf(" %s",
-		       rte_cryptodev_get_auth_algo_string(param2->alg.auth));
-		if (param2->alg.auth != RTE_CRYPTO_AUTH_NULL)
-			printf(" [%dB ICV]", param2->digest_length);
-	}
-	printf("\n");
-}
-
 static int
 test_ipsec_tunnel_hdr_len_get(const struct ipsec_test_data *td)
 {

app/test/test_cryptodev_security_ipsec.h +0 -3

index 77cb5fa7f9..41aa865a0f 100644
@@ -155,9 +155,6 @@ void test_ipsec_td_update(struct ipsec_test_data td_inb[],
 			  int nb_td,
 			  const struct ipsec_test_flags *flags);
 
-void test_ipsec_display_alg(const struct crypto_param *param1,
-			    const struct crypto_param *param2);
-
 int test_ipsec_post_process(const struct rte_mbuf *m,
 			    const struct ipsec_test_data *td,
 			    struct ipsec_test_data *res_d, bool silent,

app/test/test_security_inline_proto.c +3 -6

index 9644a3c39c..6cda9fe7aa 100644
@@ -1345,8 +1345,7 @@ test_ipsec_inline_proto_all(const struct ipsec_test_flags *flags)
 
 		if (ret == TEST_FAILED) {
 			printf("\n TEST FAILED");
-			test_ipsec_display_alg(alg_list[i].param1,
-					       alg_list[i].param2);
+			test_sec_alg_display(alg_list[i].param1, alg_list[i].param2);
 			fail_cnt++;
 			continue;
 		}

@@ -1360,15 +1359,13 @@ test_ipsec_inline_proto_all(const struct ipsec_test_flags *flags)
 
 		if (ret == TEST_FAILED) {
 			printf("\n TEST FAILED");
-			test_ipsec_display_alg(alg_list[i].param1,
-					       alg_list[i].param2);
+			test_sec_alg_display(alg_list[i].param1, alg_list[i].param2);
 			fail_cnt++;
 			continue;
 		}
 
 		if (flags->display_alg)
-			test_ipsec_display_alg(alg_list[i].param1,
-					       alg_list[i].param2);
+			test_sec_alg_display(alg_list[i].param1, alg_list[i].param2);
 
 		pass_cnt++;
 	}

app/test/test_security_proto.c +25 -0

index bc4c5e11d2..d62302a8dd 100644
@@ -81,3 +81,28 @@ test_sec_crypto_caps_auth_verify(const struct rte_security_capability *sec_cap,
 
 	return -ENOTSUP;
 }
+
+void
+test_sec_alg_display(const struct crypto_param *param1, const struct crypto_param *param2)
+{
+	if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
+		printf("\t%s [%d]",
+		       rte_cryptodev_get_aead_algo_string(param1->alg.aead),
+		       param1->key_length * 8);
+	} else if (param1->type == RTE_CRYPTO_SYM_XFORM_AUTH) {
+		printf("\t%s",
+		       rte_cryptodev_get_auth_algo_string(param1->alg.auth));
+		if (param1->alg.auth != RTE_CRYPTO_AUTH_NULL)
+			printf(" [%dB ICV]", param1->digest_length);
+	} else {
+		printf("\t%s",
+		       rte_cryptodev_get_cipher_algo_string(param1->alg.cipher));
+		if (param1->alg.cipher != RTE_CRYPTO_CIPHER_NULL)
+			printf(" [%d]", param1->key_length * 8);
+		printf(" %s",
+		       rte_cryptodev_get_auth_algo_string(param2->alg.auth));
+		if (param2->alg.auth != RTE_CRYPTO_AUTH_NULL)
+			printf(" [%dB ICV]", param2->digest_length);
+	}
+	printf("\n");
+}

app/test/test_security_proto.h +2 -0

index e8d6193530..596402fff9 100644
@@ -141,4 +141,6 @@ int test_sec_crypto_caps_cipher_verify(const struct rte_security_capability *sec
 int test_sec_crypto_caps_auth_verify(const struct rte_security_capability *sec_cap,
 		struct rte_crypto_sym_xform *auth);
 
+void test_sec_alg_display(const struct crypto_param *param1, const struct crypto_param *param2);
+
 #endif

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:03 UTC #4 lore raw

PATCH 4/14 test/security: add sha1-hmac to auth list

In reply to Anoob Joseph

Add SHA1-HMAC with 12B digest to the auth list. This algorithm would be used in IPsec tests and combined tests would run on devices that support the capabilities.

Signed-off-by Anoob Joseph <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test/test_security_proto.h | 6 ++++++
 1 file changed, 6 insertions(+)

app/test/test_security_proto.h +6 -0

index 596402fff9..d6a00018e3 100644
@@ -99,6 +99,12 @@ static const struct crypto_param auth_list[] = {
 		.key_length = 16,
 		.digest_length = 12,
 	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_SHA1_HMAC,
+		.key_length = 20,
+		.digest_length = 12,
+	},
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
 		.alg.auth =  RTE_CRYPTO_AUTH_SHA256_HMAC,

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:03 UTC #5 lore raw

PATCH 5/14 test/crypto: move algorithm framework to common

In reply to Anoob Joseph

From: Vidya Sagar Velumuri <[email protected]>

Move algorithm list and the associated framework to common files (test_security_proto.c & .h) to be able to use same framework for other security offload tests such as TLS record.

Signed-off-by Anoob Joseph <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test-security-perf/test_security_perf.c | 17 +++---
 app/test/test_cryptodev.c                   | 35 ++++++------
 app/test/test_cryptodev_security_ipsec.c    | 60 +++------------------
 app/test/test_cryptodev_security_ipsec.h    | 16 ------
 app/test/test_security_inline_proto.c       | 27 +++++-----
 app/test/test_security_proto.c              | 46 ++++++++++++++++
 app/test/test_security_proto.h              | 16 ++++++
 7 files changed, 109 insertions(+), 108 deletions(-)

app/test-security-perf/test_security_perf.c +9 -8

index 84726de7b0..b0d55cbab0 100644
@@ -474,8 +474,8 @@ args_parse(int argc, char **argv)
 int
 main(int argc, char **argv)
 {
-	struct ipsec_test_data td_outb[RTE_DIM(alg_list)];
-	struct ipsec_test_data td_inb[RTE_DIM(alg_list)];
+	struct ipsec_test_data td_outb[RTE_DIM(sec_alg_list)];
+	struct ipsec_test_data td_inb[RTE_DIM(sec_alg_list)];
 	struct ipsec_test_flags flags;
 	uint32_t lcore_id;
 	uint8_t nb_lcores;

@@ -513,11 +513,11 @@ main(int argc, char **argv)
 	if (ret)
 		goto cryptodev_fini;
 
-	test_ipsec_alg_list_populate();
+	test_sec_alg_list_populate();
 
-	for (i = 0; i < RTE_DIM(alg_list); i++) {
-		test_ipsec_td_prepare(alg_list[i].param1,
-				      alg_list[i].param2,
+	for (i = 0; i < RTE_DIM(sec_alg_list); i++) {
+		test_ipsec_td_prepare(sec_alg_list[i].param1,
+				      sec_alg_list[i].param2,
 				      &flags,
 				      &td_outb[i],
 				      1);

@@ -529,10 +529,11 @@ main(int argc, char **argv)
 	if (ctx.is_inbound)
 		ctx.td = td_inb;
 
-	for (ctx.td_idx = 0; ctx.td_idx < RTE_DIM(alg_list); ctx.td_idx++) {
+	for (ctx.td_idx = 0; ctx.td_idx < RTE_DIM(sec_alg_list); ctx.td_idx++) {
 
 		printf("\n\n    Algorithm combination:");
-		test_sec_alg_display(alg_list[ctx.td_idx].param1, alg_list[ctx.td_idx].param2);
+		test_sec_alg_display(sec_alg_list[ctx.td_idx].param1,
+				     sec_alg_list[ctx.td_idx].param2);
 		printf("    ----------------------");
 
 		printf("\n%20s%20s%20s%20s%20s%20s\n\n",

app/test/test_cryptodev.c +18 ~~-17~~

index 218761f0a9..fbb97d5456 100644
@@ -838,8 +838,8 @@ ipsec_proto_testsuite_setup(void)
 		ret = TEST_SKIPPED;
 	}
 
-	test_ipsec_alg_list_populate();
-	test_ipsec_ah_alg_list_populate();
+	test_sec_alg_list_populate();
+	test_sec_auth_only_alg_list_populate();
 
 	/*
 	 * Stop the device. Device would be started again by individual test

@@ -10483,19 +10483,19 @@ test_ipsec_proto_known_vec_inb_rx_inject(const void *test_data)
 static int
 test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 {
-	struct ipsec_test_data td_outb[IPSEC_TEST_PACKETS_MAX];
-	struct ipsec_test_data td_inb[IPSEC_TEST_PACKETS_MAX];
+	struct ipsec_test_data td_outb[TEST_SEC_PKTS_MAX];
+	struct ipsec_test_data td_inb[TEST_SEC_PKTS_MAX];
 	unsigned int i, nb_pkts = 1, pass_cnt = 0;
 	int ret;
 
 	if (flags->iv_gen ||
 	    flags->sa_expiry_pkts_soft ||
 	    flags->sa_expiry_pkts_hard)
-		nb_pkts = IPSEC_TEST_PACKETS_MAX;
+		nb_pkts = TEST_SEC_PKTS_MAX;
 
-	for (i = 0; i < RTE_DIM(alg_list); i++) {
-		test_ipsec_td_prepare(alg_list[i].param1,
-				      alg_list[i].param2,
+	for (i = 0; i < RTE_DIM(sec_alg_list); i++) {
+		test_ipsec_td_prepare(sec_alg_list[i].param1,
+				      sec_alg_list[i].param2,
 				      flags,
 				      td_outb,
 				      nb_pkts);

@@ -10540,7 +10540,7 @@ test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 			return TEST_FAILED;
 
 		if (flags->display_alg)
-			test_sec_alg_display(alg_list[i].param1, alg_list[i].param2);
+			test_sec_alg_display(sec_alg_list[i].param1, sec_alg_list[i].param2);
 
 		pass_cnt++;
 	}

@@ -10554,14 +10554,14 @@ test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 static int
 test_ipsec_ah_proto_all(const struct ipsec_test_flags *flags)
 {
-	struct ipsec_test_data td_outb[IPSEC_TEST_PACKETS_MAX];
-	struct ipsec_test_data td_inb[IPSEC_TEST_PACKETS_MAX];
+	struct ipsec_test_data td_outb[TEST_SEC_PKTS_MAX];
+	struct ipsec_test_data td_inb[TEST_SEC_PKTS_MAX];
 	unsigned int i, nb_pkts = 1, pass_cnt = 0;
 	int ret;
 
-	for (i = 0; i < RTE_DIM(ah_alg_list); i++) {
-		test_ipsec_td_prepare(ah_alg_list[i].param1,
-				      ah_alg_list[i].param2,
+	for (i = 0; i < RTE_DIM(sec_auth_only_alg_list); i++) {
+		test_ipsec_td_prepare(sec_auth_only_alg_list[i].param1,
+				      sec_auth_only_alg_list[i].param2,
 				      flags,
 				      td_outb,
 				      nb_pkts);

@@ -10585,7 +10585,8 @@ test_ipsec_ah_proto_all(const struct ipsec_test_flags *flags)
 			return TEST_FAILED;
 
 		if (flags->display_alg)
-			test_sec_alg_display(ah_alg_list[i].param1, ah_alg_list[i].param2);
+			test_sec_alg_display(sec_auth_only_alg_list[i].param1,
+					     sec_auth_only_alg_list[i].param2);
 
 		pass_cnt++;
 	}

@@ -11087,8 +11088,8 @@ test_ipsec_pkt_replay(const void *test_data, const uint64_t esn[],
 		      bool replayed_pkt[], uint32_t nb_pkts, bool esn_en,
 		      uint64_t winsz)
 {
-	struct ipsec_test_data td_outb[IPSEC_TEST_PACKETS_MAX];
-	struct ipsec_test_data td_inb[IPSEC_TEST_PACKETS_MAX];
+	struct ipsec_test_data td_outb[TEST_SEC_PKTS_MAX];
+	struct ipsec_test_data td_inb[TEST_SEC_PKTS_MAX];
 	struct ipsec_test_flags flags;
 	uint32_t i = 0, ret = 0;

app/test/test_cryptodev_security_ipsec.c +6 ~~-54~~

108 lines not on this page · raw message

app/test/test_cryptodev_security_ipsec.h +0 ~~-16~~

index 41aa865a0f..3c69471099 100644
@@ -10,7 +10,6 @@
 
 #include "test_security_proto.h"
 
-#define IPSEC_TEST_PACKETS_MAX 32
 #define IPSEC_TEXT_MAX_LEN 16384u
 
 struct ipsec_test_data {

@@ -117,26 +116,11 @@ struct ipsec_test_flags {
 	bool rx_inject;
 };
 
-struct crypto_param_comb {
-	const struct crypto_param *param1;
-	const struct crypto_param *param2;
-};
-
 extern struct ipsec_test_data pkt_aes_256_gcm;
 extern struct ipsec_test_data pkt_aes_256_gcm_v6;
 extern struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256;
 extern struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256_v6;
 
-extern struct crypto_param_comb alg_list[RTE_DIM(aead_list) +
-					 (RTE_DIM(cipher_list) *
-					  RTE_DIM(auth_list))];
-
-extern struct crypto_param_comb ah_alg_list[2 * (RTE_DIM(auth_list) - 1)];
-
-void test_ipsec_alg_list_populate(void);
-
-void test_ipsec_ah_alg_list_populate(void);
-
 int test_ipsec_sec_caps_verify(struct rte_security_ipsec_xform *ipsec_xform,
 			       const struct rte_security_capability *sec_cap,
 			       bool silent);

app/test/test_security_inline_proto.c +14 ~~-13~~

index 6cda9fe7aa..481382b64e 100644
@@ -1295,11 +1295,11 @@ test_ipsec_inline_proto_all(const struct ipsec_test_flags *flags)
 			flags->sa_expiry_bytes_soft ||
 			flags->sa_expiry_bytes_hard ||
 			flags->sa_expiry_pkts_hard)
-		nb_pkts = IPSEC_TEST_PACKETS_MAX;
+		nb_pkts = TEST_SEC_PKTS_MAX;
 
-	for (i = 0; i < RTE_DIM(alg_list); i++) {
-		test_ipsec_td_prepare(alg_list[i].param1,
-				      alg_list[i].param2,
+	for (i = 0; i < RTE_DIM(sec_alg_list); i++) {
+		test_ipsec_td_prepare(sec_alg_list[i].param1,
+				      sec_alg_list[i].param2,
 				      flags, &td_outb, 1);
 
 		if (!td_outb.aead) {

@@ -1331,8 +1331,7 @@ test_ipsec_inline_proto_all(const struct ipsec_test_flags *flags)
 				(((td_outb.output_text.len + RTE_ETHER_HDR_LEN)
 				  * nb_pkts) >> 3) - 1;
 		if (flags->sa_expiry_pkts_hard)
-			td_outb.ipsec_xform.life.packets_hard_limit =
-					IPSEC_TEST_PACKETS_MAX - 1;
+			td_outb.ipsec_xform.life.packets_hard_limit = TEST_SEC_PKTS_MAX - 1;
 		if (flags->sa_expiry_bytes_hard)
 			td_outb.ipsec_xform.life.bytes_hard_limit =
 				(((td_outb.output_text.len + RTE_ETHER_HDR_LEN)

@@ -1345,7 +1344,7 @@ test_ipsec_inline_proto_all(const struct ipsec_test_flags *flags)
 
 		if (ret == TEST_FAILED) {
 			printf("\n TEST FAILED");
-			test_sec_alg_display(alg_list[i].param1, alg_list[i].param2);
+			test_sec_alg_display(sec_alg_list[i].param1, sec_alg_list[i].param2);
 			fail_cnt++;
 			continue;
 		}

@@ -1359,13 +1358,13 @@ test_ipsec_inline_proto_all(const struct ipsec_test_flags *flags)
 
 		if (ret == TEST_FAILED) {
 			printf("\n TEST FAILED");
-			test_sec_alg_display(alg_list[i].param1, alg_list[i].param2);
+			test_sec_alg_display(sec_alg_list[i].param1, sec_alg_list[i].param2);
 			fail_cnt++;
 			continue;
 		}
 
 		if (flags->display_alg)
-			test_sec_alg_display(alg_list[i].param1, alg_list[i].param2);
+			test_sec_alg_display(sec_alg_list[i].param1, sec_alg_list[i].param2);
 
 		pass_cnt++;
 	}

@@ -1742,7 +1741,8 @@ inline_ipsec_testsuite_setup(void)
 				ret, port_id);
 		return ret;
 	}
-	test_ipsec_alg_list_populate();
+
+	test_sec_alg_list_populate();
 
 	/* Change the plaintext size for tests without Known vectors */
 	if (sg_mode) {

@@ -2003,7 +2003,8 @@ event_inline_ipsec_testsuite_setup(void)
 	}
 
 	event_mode_enabled = true;
-	test_ipsec_alg_list_populate();
+
+	test_sec_alg_list_populate();
 
 	return 0;
 }

@@ -2685,8 +2686,8 @@ test_ipsec_inline_pkt_replay(const void *test_data, const uint64_t esn[],
 		      bool replayed_pkt[], uint32_t nb_pkts, bool esn_en,
 		      uint64_t winsz)
 {
-	struct ipsec_test_data td_outb[IPSEC_TEST_PACKETS_MAX];
-	struct ipsec_test_data td_inb[IPSEC_TEST_PACKETS_MAX];
+	struct ipsec_test_data td_outb[TEST_SEC_PKTS_MAX];
+	struct ipsec_test_data td_inb[TEST_SEC_PKTS_MAX];
 	struct ipsec_test_flags flags;
 	uint32_t i, ret = 0;

app/test/test_security_proto.c +46 -0

52 lines not on this page · raw message

app/test/test_security_proto.h +16 -0

index d6a00018e3..6797e8b8c2 100644
@@ -8,6 +8,8 @@
 #include <rte_cryptodev.h>
 #include <rte_security.h>
 
+#define TEST_SEC_PKTS_MAX 32
+
 struct crypto_param {
 	enum rte_crypto_sym_xform_type type;
 	union {

@@ -138,6 +140,20 @@ static const struct crypto_param auth_list[] = {
 	},
 };
 
+struct crypto_param_comb {
+	const struct crypto_param *param1;
+	const struct crypto_param *param2;
+};
+
+extern struct crypto_param_comb sec_alg_list[RTE_DIM(aead_list) +
+					     (RTE_DIM(cipher_list) * RTE_DIM(auth_list))];
+
+extern struct crypto_param_comb sec_auth_only_alg_list[2 * (RTE_DIM(auth_list) - 1)];
+
+void test_sec_alg_list_populate(void);
+
+void test_sec_auth_only_alg_list_populate(void);
+
 int test_sec_crypto_caps_aead_verify(const struct rte_security_capability *sec_cap,
 		struct rte_crypto_sym_xform *aead);

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:03 UTC #6 lore raw

PATCH 6/14 test/crypto: add TLS record tests

In reply to Anoob Joseph

Add framework for testing TLS record cases. The framework supports testing with known vector tests in both session types (read & write).

Signed-off-by Anoob Joseph <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test/meson.build                          |   1 +
 app/test/test_cryptodev.c                     | 282 +++++++++++++++++-
 app/test/test_cryptodev.h                     |   2 +
 app/test/test_cryptodev_security_tls_record.c | 151 ++++++++++
 app/test/test_cryptodev_security_tls_record.h |  71 +++++
 ...yptodev_security_tls_record_test_vectors.h |  16 +
 6 files changed, 515 insertions(+), 8 deletions(-)
 create mode 100644 app/test/test_cryptodev_security_tls_record.c
 create mode 100644 app/test/test_cryptodev_security_tls_record.h
 create mode 100644 app/test/test_cryptodev_security_tls_record_test_vectors.h

app/test/meson.build +1 -0

index 58e120a6ab..f9e81eda2e 100644
@@ -56,6 +56,7 @@ source_file_deps = {
     'test_cryptodev_crosscheck.c': test_cryptodev_deps,
     'test_cryptodev_security_ipsec.c': test_cryptodev_deps,
     'test_cryptodev_security_pdcp.c': test_cryptodev_deps,
+    'test_cryptodev_security_tls_record.c': ['cryptodev', 'security'],
     'test_cycles.c': [],
     'test_debug.c': [],
     'test_devargs.c': ['kvargs'],

app/test/test_cryptodev.c +274 -8

330 lines not on this page · raw message

app/test/test_cryptodev.h +2 -0

index f2c417a267..f27d9697fd 100644
@@ -4,6 +4,8 @@
 #ifndef TEST_CRYPTODEV_H_
 #define TEST_CRYPTODEV_H_
 
+#include <rte_cryptodev.h>
+
 #define HEX_DUMP 0
 
 #define FALSE                           0

app/test/test_cryptodev_security_tls_record.c new file +151 -0

151 lines not on this page · raw message

app/test/test_cryptodev_security_tls_record.h new file +71 -0

71 lines not on this page · raw message

app/test/test_cryptodev_security_tls_record_test_vectors.h new file +16 -0

new file mode 100644
index 0000000000..5aa0d27fda
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ * Copyright(c) 2023 Marvell
+ */
+
+#ifndef _TEST_CRYPTODEV_SECURITY_TLS_RECORD_TEST_VECTORS_H_
+#define _TEST_CRYPTODEV_SECURITY_TLS_RECORD_TEST_VECTORS_H_
+
+#include <rte_crypto.h>
+#include <rte_security.h>
+
+#include "test_cryptodev.h"
+#include "test_cryptodev_security_tls_record.h"
+
+struct tls_record_test_data tls_test_data1;
+
+#endif

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:03 UTC #7 lore raw

PATCH 7/14 test/crypto: add AES-GCM 128 TLS 1.2 vector

In reply to Anoob Joseph

From: Tejasree Kondoj <[email protected]>

Add AES-GCM-128 test vector generated with kTLS.

Signed-off-by Tejasree Kondoj <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test/test_cryptodev.c                     |  8 +--
 app/test/test_cryptodev_security_tls_record.h |  2 +-
 ...yptodev_security_tls_record_test_vectors.h | 67 ++++++++++++++++++-
 3 files changed, 71 insertions(+), 6 deletions(-)

app/test/test_cryptodev.c +4 -4

index cd83370790..e7e4b93c20 100644
@@ -16814,13 +16814,13 @@ static struct unit_test_suite tls12_record_proto_testsuite  = {
 	.setup = tls_record_proto_testsuite_setup,
 	.unit_test_cases = {
 		TEST_CASE_NAMED_WITH_DATA(
-			"Known vector TBD",
+			"Write record known vector AES-GCM-128 (vector 1)",
 			ut_setup_security, ut_teardown,
-			test_tls_record_proto_known_vec, &tls_test_data1),
+			test_tls_record_proto_known_vec, &tls_test_data_aes_128_gcm_v1),
 		TEST_CASE_NAMED_WITH_DATA(
-			"Known vector TBD",
+			"Read record known vector AES-GCM-128 (vector 1)",
 			ut_setup_security, ut_teardown,
-			test_tls_record_proto_known_vec_read, &tls_test_data1),
+			test_tls_record_proto_known_vec_read, &tls_test_data_aes_128_gcm_v1),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };

app/test/test_cryptodev_security_tls_record.h +1 -1

index 9a0cf70218..b9cadd5cd4 100644
@@ -55,7 +55,7 @@ struct tls_record_test_flags {
 	bool display_alg;
 };
 
-extern struct tls_record_test_data tls_test_data1;
+extern struct tls_record_test_data tls_test_data_aes_128_gcm_v1;
 
 int test_tls_record_status_check(struct rte_crypto_op *op);

app/test/test_cryptodev_security_tls_record_test_vectors.h +66 -1

72 lines not on this page · raw message

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:03 UTC #8 lore raw

PATCH 8/14 test/crypto: add TLS1.2 vectors

In reply to Anoob Joseph

From: Akhil Goyal <[email protected]>

Added TLS 1.2 test vectors for AES-128-CBC-SHA1

Signed-off-by Akhil Goyal <[email protected]>

---
 app/test/test_cryptodev.c                     |  8 ++
 app/test/test_cryptodev_security_tls_record.h |  1 +
 ...yptodev_security_tls_record_test_vectors.h | 91 +++++++++++++++++++
 3 files changed, 100 insertions(+)

app/test/test_cryptodev.c +8 -0

index e7e4b93c20..a82f971135 100644
@@ -16817,10 +16817,18 @@ static struct unit_test_suite tls12_record_proto_testsuite  = {
 			"Write record known vector AES-GCM-128 (vector 1)",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_known_vec, &tls_test_data_aes_128_gcm_v1),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-128-CBC-SHA1",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &tls_test_data_aes_128_cbc_sha1_hmac),
 		TEST_CASE_NAMED_WITH_DATA(
 			"Read record known vector AES-GCM-128 (vector 1)",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_known_vec_read, &tls_test_data_aes_128_gcm_v1),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-128-CBC-SHA1",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read, &tls_test_data_aes_128_cbc_sha1_hmac),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };

app/test/test_cryptodev_security_tls_record.h +1 -0

index b9cadd5cd4..3e42db2c03 100644
@@ -56,6 +56,7 @@ struct tls_record_test_flags {
 };
 
 extern struct tls_record_test_data tls_test_data_aes_128_gcm_v1;
+extern struct tls_record_test_data tls_test_data_aes_128_cbc_sha1_hmac;
 
 int test_tls_record_status_check(struct rte_crypto_op *op);

app/test/test_cryptodev_security_tls_record_test_vectors.h +91 -0

95 lines not on this page · raw message

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:03 UTC #9 lore raw

PATCH 9/14 test/crypto: add TLS1.2/DTLS1.2 AES-128/256-GCM vectors

In reply to Anoob Joseph

From: Akhil Goyal <[email protected]>

Added test vectors for TLS1.2 and DTLS 1.2 for AES-128-GCM and AES-256-GCM.

These vectors are generated using GnuTLS server and client applications.

Signed-off-by Akhil Goyal <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test/test_cryptodev.c                     |  43 ++-
 app/test/test_cryptodev_security_tls_record.h |   4 +
 ...yptodev_security_tls_record_test_vectors.h | 286 ++++++++++++++++++
 3 files changed, 332 insertions(+), 1 deletion(-)

app/test/test_cryptodev.c +42 -1

index a82f971135..0360f30bd1 100644
@@ -16818,13 +16818,29 @@ static struct unit_test_suite tls12_record_proto_testsuite  = {
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_known_vec, &tls_test_data_aes_128_gcm_v1),
 		TEST_CASE_NAMED_WITH_DATA(
-			"Write record known vector AES-128-CBC-SHA1",
+			"Write record known vector AES-GCM-128 (vector 2)",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &tls_test_data_aes_128_gcm_v2),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-GCM-256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &tls_test_data_aes_256_gcm),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-CBC-128-SHA1",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_known_vec, &tls_test_data_aes_128_cbc_sha1_hmac),
 		TEST_CASE_NAMED_WITH_DATA(
 			"Read record known vector AES-GCM-128 (vector 1)",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_known_vec_read, &tls_test_data_aes_128_gcm_v1),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-GCM-128 (vector 2)",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read, &tls_test_data_aes_128_gcm_v2),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-GCM-256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read, &tls_test_data_aes_256_gcm),
 		TEST_CASE_NAMED_WITH_DATA(
 			"Read record known vector AES-128-CBC-SHA1",
 			ut_setup_security, ut_teardown,

@@ -16833,6 +16849,30 @@ static struct unit_test_suite tls12_record_proto_testsuite  = {
 	}
 };
 
+static struct unit_test_suite dtls12_record_proto_testsuite  = {
+	.suite_name = "DTLS 1.2 Record Protocol Unit Test Suite",
+	.setup = tls_record_proto_testsuite_setup,
+	.unit_test_cases = {
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-GCM-128",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &dtls_test_data_aes_128_gcm),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-GCM-256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &dtls_test_data_aes_256_gcm),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-GCM-128",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read, &dtls_test_data_aes_128_gcm),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-GCM-256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read, &dtls_test_data_aes_256_gcm),
+		TEST_CASES_END() /**< NULL terminate unit test array */
+	}
+};
+
 #define ADD_UPLINK_TESTCASE(data)						\
 	TEST_CASE_NAMED_WITH_DATA(data.test_descr_uplink, ut_setup_security,	\
 	ut_teardown, test_docsis_proto_uplink, (const void *) &data),		\

@@ -17841,6 +17881,7 @@ run_cryptodev_testsuite(const char *pmd_name)
 		&pdcp_proto_testsuite,
 		&docsis_proto_testsuite,
 		&tls12_record_proto_testsuite,
+		&dtls12_record_proto_testsuite,
 #endif
 		&end_testsuite
 	};

app/test/test_cryptodev_security_tls_record.h +4 -0

index 3e42db2c03..18d689253b 100644
@@ -56,6 +56,10 @@ struct tls_record_test_flags {
 };
 
 extern struct tls_record_test_data tls_test_data_aes_128_gcm_v1;
+extern struct tls_record_test_data tls_test_data_aes_128_gcm_v2;
+extern struct tls_record_test_data tls_test_data_aes_256_gcm;
+extern struct tls_record_test_data dtls_test_data_aes_128_gcm;
+extern struct tls_record_test_data dtls_test_data_aes_256_gcm;
 extern struct tls_record_test_data tls_test_data_aes_128_cbc_sha1_hmac;
 
 int test_tls_record_status_check(struct rte_crypto_op *op);

app/test/test_cryptodev_security_tls_record_test_vectors.h +286 -0

296 lines not on this page · raw message

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:04 UTC #10 lore raw

PATCH 10/14 test/crypto: add combined mode cases

In reply to Anoob Joseph

From: Vidya Sagar Velumuri <[email protected]>

Add cases to try TLS record write(encrypt) + read(decrypt) operations. This is used for testing TLS record features with all algorithms supported by the security device.

Signed-off-by Anoob Joseph <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test/test_cryptodev.c                     | 67 ++++++++++++++++++-
 app/test/test_cryptodev_security_tls_record.c | 60 +++++++++++++++++
 app/test/test_cryptodev_security_tls_record.h | 11 +++
 3 files changed, 136 insertions(+), 2 deletions(-)

app/test/test_cryptodev.c +65 -2

index 0360f30bd1..6070e7f336 100644
@@ -11704,6 +11704,7 @@ test_tls_record_proto_process(const struct tls_record_test_data td[],
 	struct rte_security_tls_record_xform tls_record_xform;
 	struct rte_security_capability_idx sec_cap_idx;
 	const struct rte_security_capability *sec_cap;
+	struct tls_record_test_data *res_d_tmp = NULL;
 	enum rte_security_tls_sess_type sess_type;
 	uint8_t dev_id = ts_params->valid_devs[0];
 	struct rte_security_ctx *ctx;

@@ -11841,7 +11842,10 @@ test_tls_record_proto_process(const struct tls_record_test_data td[],
 		if (ret != TEST_SUCCESS)
 			goto crypto_op_free;
 
-		ret = test_tls_record_post_process(ut_params->ibuf, &td[i], NULL, silent);
+		if (res_d != NULL)
+			res_d_tmp = &res_d[i];
+
+		ret = test_tls_record_post_process(ut_params->ibuf, &td[i], res_d_tmp, silent);
 		if (ret != TEST_SUCCESS)
 			goto crypto_op_free;

@@ -11864,7 +11868,6 @@ test_tls_record_proto_process(const struct tls_record_test_data td[],
 		rte_security_session_destroy(ctx, ut_params->sec_session);
 	ut_params->sec_session = NULL;
 
-	RTE_SET_USED(res_d);
 	RTE_SET_USED(flags);
 
 	return ret;

@@ -11903,6 +11906,58 @@ test_tls_record_proto_known_vec_read(const void *test_data)
 	return test_tls_record_proto_process(&td_inb, NULL, 1, false, &flags);
 }
 
+static int
+test_tls_record_proto_all(const struct tls_record_test_flags *flags)
+{
+	struct tls_record_test_data td_outb[TEST_SEC_PKTS_MAX];
+	struct tls_record_test_data td_inb[TEST_SEC_PKTS_MAX];
+	unsigned int i, nb_pkts = 1, pass_cnt = 0;
+	int ret;
+
+	for (i = 0; i < RTE_DIM(sec_alg_list); i++) {
+		test_tls_record_td_prepare(sec_alg_list[i].param1, sec_alg_list[i].param2, flags,
+					   td_outb, nb_pkts);
+
+		ret = test_tls_record_proto_process(td_outb, td_inb, nb_pkts, true, flags);
+		if (ret == TEST_SKIPPED)
+			continue;
+
+		if (ret == TEST_FAILED)
+			return TEST_FAILED;
+
+		test_tls_record_td_update(td_inb, td_outb, nb_pkts, flags);
+
+		ret = test_tls_record_proto_process(td_inb, NULL, nb_pkts, true, flags);
+		if (ret == TEST_SKIPPED)
+			continue;
+
+		if (ret == TEST_FAILED)
+			return TEST_FAILED;
+
+		if (flags->display_alg)
+			test_sec_alg_display(sec_alg_list[i].param1, sec_alg_list[i].param2);
+
+		pass_cnt++;
+	}
+
+	if (pass_cnt > 0)
+		return TEST_SUCCESS;
+	else
+		return TEST_SKIPPED;
+}
+
+static int
+test_tls_record_proto_display_list(void)
+{
+	struct tls_record_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.display_alg = true;
+
+	return test_tls_record_proto_all(&flags);
+}
+
 #endif
 
 static int

@@ -16845,6 +16900,10 @@ static struct unit_test_suite tls12_record_proto_testsuite  = {
 			"Read record known vector AES-128-CBC-SHA1",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_known_vec_read, &tls_test_data_aes_128_cbc_sha1_hmac),
+		TEST_CASE_NAMED_ST(
+			"Combined test alg list",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_display_list),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };

@@ -16869,6 +16928,10 @@ static struct unit_test_suite dtls12_record_proto_testsuite  = {
 			"Read record known vector AES-GCM-256",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_known_vec_read, &dtls_test_data_aes_256_gcm),
+		TEST_CASE_NAMED_ST(
+			"Combined test alg list",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_display_list),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };

app/test/test_cryptodev_security_tls_record.c +60 -0

72 lines not on this page · raw message

app/test/test_cryptodev_security_tls_record.h +11 -0

index 18d689253b..68dd55fef2 100644
@@ -8,6 +8,8 @@
 #include <rte_cryptodev.h>
 #include <rte_security.h>
 
+#include "test_security_proto.h"
+
 #define TLS_RECORD_MAX_LEN 16384u
 
 struct tls_record_test_data {

@@ -70,6 +72,15 @@ int test_tls_record_sec_caps_verify(struct rte_security_tls_record_xform *tls_re
 void test_tls_record_td_read_from_write(const struct tls_record_test_data *td_out,
 					struct tls_record_test_data *td_in);
 
+void test_tls_record_td_prepare(const struct crypto_param *param1,
+				const struct crypto_param *param2,
+				const struct tls_record_test_flags *flags,
+				struct tls_record_test_data *td_array, int nb_td);
+
+void test_tls_record_td_update(struct tls_record_test_data td_inb[],
+			       const struct tls_record_test_data td_outb[], int nb_td,
+			       const struct tls_record_test_flags *flags);
+
 int test_tls_record_post_process(const struct rte_mbuf *m, const struct tls_record_test_data *td,
 				 struct tls_record_test_data *res_d, bool silent);

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:04 UTC #11 lore raw

PATCH 11/14 test/crypto: add verification of TLS headers

In reply to Anoob Joseph

Add verification of TLS headers in protocol offload tests.

Signed-off-by Anoob Joseph <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test/test_cryptodev_security_tls_record.c | 118 +++++++++++++++++-
 1 file changed, 117 insertions(+), 1 deletion(-)

app/test/test_cryptodev_security_tls_record.c +117 -1

index 6f106050c2..bcb2eba4ff 100644
@@ -3,6 +3,8 @@
  */
 
 #include <rte_crypto.h>
+#include <rte_dtls.h>
+#include <rte_tls.h>
 
 #include "test.h"
 #include "test_cryptodev_security_tls_record.h"

@@ -62,8 +64,8 @@ test_tls_record_td_prepare(const struct crypto_param *param1, const struct crypt
 			   const struct tls_record_test_flags *flags,
 			   struct tls_record_test_data *td_array, int nb_td)
 {
+	int i, min_padding, hdr_len, tls_pkt_size, mac_len = 0, exp_nonce_len = 0, roundup_len = 0;
 	struct tls_record_test_data *td = NULL;
-	int i;
 
 	memset(td_array, 0, nb_td * sizeof(*td));

@@ -94,6 +96,59 @@ test_tls_record_td_prepare(const struct crypto_param *param1, const struct crypt
 		}
 	}
 
+	tls_pkt_size = td->input_text.len;
+
+	if (!td->aead) {
+		mac_len = td->xform.chain.auth.auth.digest_length;
+		switch (td->xform.chain.cipher.cipher.algo) {
+		case RTE_CRYPTO_CIPHER_3DES_CBC:
+			roundup_len = 8;
+			exp_nonce_len = 8;
+			break;
+		case RTE_CRYPTO_CIPHER_AES_CBC:
+			roundup_len = 16;
+			exp_nonce_len = 16;
+			break;
+		default:
+			roundup_len = 0;
+			exp_nonce_len = 0;
+			break;
+		}
+	} else {
+		mac_len = td->xform.aead.aead.digest_length;
+		exp_nonce_len = 8;
+	}
+
+	switch (td->tls_record_xform.ver) {
+	case RTE_SECURITY_VERSION_TLS_1_2:
+	case RTE_SECURITY_VERSION_TLS_1_3:
+		hdr_len = sizeof(struct rte_tls_hdr);
+		min_padding = 1;
+		break;
+	case RTE_SECURITY_VERSION_DTLS_1_2:
+		hdr_len = sizeof(struct rte_dtls_hdr);
+		min_padding = 0;
+		break;
+	default:
+		hdr_len = 0;
+		min_padding = 0;
+		break;
+	}
+
+	tls_pkt_size += mac_len;
+
+	/* Padding */
+	tls_pkt_size += min_padding;
+	tls_pkt_size = RTE_ALIGN_MUL_CEIL(tls_pkt_size, roundup_len);
+
+	/* Explicit nonce */
+	tls_pkt_size += exp_nonce_len;
+
+	/* Add TLS header */
+	tls_pkt_size += hdr_len;
+
+	td->output_text.len = tls_pkt_size;
+
 	RTE_SET_USED(flags);
 }

@@ -160,6 +215,60 @@ test_tls_record_res_d_prepare(const uint8_t *output_text, uint32_t len,
 
 	return TEST_SUCCESS;
 }
+static int
+tls_record_hdr_verify(const struct tls_record_test_data *td, const uint8_t *output_text)
+{
+	uint16_t length, hdr_len;
+	uint8_t content_type;
+
+	if (td->tls_record_xform.ver == RTE_SECURITY_VERSION_TLS_1_2) {
+		const struct rte_tls_hdr *hdr = (const struct rte_tls_hdr *)output_text;
+		if (rte_be_to_cpu_16(hdr->version) != RTE_TLS_VERSION_1_2) {
+			printf("Incorrect header version [expected - %4x, received - %4x]\n",
+			       RTE_TLS_VERSION_1_2, rte_be_to_cpu_16(hdr->version));
+			return TEST_FAILED;
+		}
+		content_type = hdr->type;
+		length = rte_be_to_cpu_16(hdr->length);
+		hdr_len = sizeof(struct rte_tls_hdr);
+	} else if (td->tls_record_xform.ver == RTE_SECURITY_VERSION_TLS_1_3) {
+		const struct rte_tls_hdr *hdr = (const struct rte_tls_hdr *)output_text;
+		if (rte_be_to_cpu_16(hdr->version) != RTE_TLS_VERSION_1_3) {
+			printf("Incorrect header version [expected - %4x, received - %4x]\n",
+			       RTE_TLS_VERSION_1_3, rte_be_to_cpu_16(hdr->version));
+			return TEST_FAILED;
+		}
+		content_type = hdr->type;
+		length = rte_be_to_cpu_16(hdr->length);
+		hdr_len = sizeof(struct rte_tls_hdr);
+	} else if (td->tls_record_xform.ver == RTE_SECURITY_VERSION_DTLS_1_2) {
+		const struct rte_dtls_hdr *hdr = (const struct rte_dtls_hdr *)output_text;
+		if (rte_be_to_cpu_16(hdr->version) != RTE_DTLS_VERSION_1_2) {
+			printf("Incorrect header version [expected - %4x, received - %4x]\n",
+			       RTE_DTLS_VERSION_1_2, rte_be_to_cpu_16(hdr->version));
+			return TEST_FAILED;
+		}
+		content_type = hdr->type;
+		length = rte_be_to_cpu_16(hdr->length);
+		hdr_len = sizeof(struct rte_dtls_hdr);
+	} else {
+		return TEST_FAILED;
+	}
+
+	if (content_type != td->app_type) {
+		printf("Incorrect content type in packet [expected - %d, received - %d]\n",
+		       td->app_type, content_type);
+		return TEST_FAILED;
+	}
+
+	if (length != td->output_text.len - hdr_len) {
+		printf("Incorrect packet length [expected - %d, received - %d]\n",
+		       td->output_text.len - hdr_len, length);
+		return TEST_FAILED;
+	}
+
+	return TEST_SUCCESS;
+}
 
 int
 test_tls_record_post_process(const struct rte_mbuf *m, const struct tls_record_test_data *td,

@@ -169,6 +278,7 @@ test_tls_record_post_process(const struct rte_mbuf *m, const struct tls_record_t
 	uint8_t output_text[TLS_RECORD_MAX_LEN];
 	const struct rte_mbuf *seg;
 	const uint8_t *output;
+	int ret;
 
 	memset(output_text, 0, TLS_RECORD_MAX_LEN);

@@ -193,6 +303,12 @@ test_tls_record_post_process(const struct rte_mbuf *m, const struct tls_record_t
 		memcpy(output_text, output, len);
 	}
 
+	if (td->tls_record_xform.type == RTE_SECURITY_TLS_SESS_TYPE_WRITE) {
+		ret = tls_record_hdr_verify(td, output_text);
+		if (ret != TEST_SUCCESS)
+			return ret;
+	}
+
 	/*
 	 * In case of known vector tests & all record read (decrypt) tests, res_d provided would be
 	 * NULL and output data need to be validated against expected. For record read (decrypt),

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:04 UTC #12 lore raw

PATCH 12/14 test/security: add more algos to combined tests

In reply to Anoob Joseph

From: Vidya Sagar Velumuri <[email protected]>

Add following algos to combined mode cases. These are intended primarily for TLS record combined mode tests.

- AES256-CBC
- SHA256-HMAC
- SHA1-HMAC [20B]

Signed-off-by Anoob Joseph <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test/test_security_proto.h | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

app/test/test_security_proto.h +18 -0

index 6797e8b8c2..efa023b99d 100644
@@ -70,6 +70,12 @@ static const struct crypto_param cipher_list[] = {
 		.key_length = 16,
 		.iv_length = 16,
 	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CBC,
+		.key_length = 32,
+		.iv_length = 16,
+	},
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
 		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,

@@ -107,12 +113,24 @@ static const struct crypto_param auth_list[] = {
 		.key_length = 20,
 		.digest_length = 12,
 	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_SHA1_HMAC,
+		.key_length = 20,
+		.digest_length = 20,
+	},
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
 		.alg.auth =  RTE_CRYPTO_AUTH_SHA256_HMAC,
 		.key_length = 32,
 		.digest_length = 16,
 	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_SHA256_HMAC,
+		.key_length = 32,
+		.digest_length = 32,
+	},
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
 		.alg.auth =  RTE_CRYPTO_AUTH_SHA384_HMAC,

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:04 UTC #13 lore raw

PATCH 13/14 test/security: add TLS 1.2 and DTLS 1.2 vectors

In reply to Anoob Joseph

From: Akhil Goyal <[email protected]>

Add TLS v1.2 vectors generated using gnuTLS for AES-256, SHA256, 3DES, CHACHA-POLY

Add DTLS v1.2 test vectors generated using gnuTLS for AES-128-CBC, AES-256-CBC, SHA1, SHA256, 3DES-CBC, CHACHA20-POLY1305 and NULL cipher

Signed-off-by Akhil Goyal <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test/test_cryptodev.c                     |  121 ++
 app/test/test_cryptodev_security_tls_record.h |   13 +
 ...yptodev_security_tls_record_test_vectors.h | 1126 +++++++++++++++++
 3 files changed, 1260 insertions(+)

app/test/test_cryptodev.c +121 -0

index 6070e7f336..86e2ccd483 100644
@@ -16884,6 +16884,31 @@ static struct unit_test_suite tls12_record_proto_testsuite  = {
 			"Write record known vector AES-CBC-128-SHA1",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_known_vec, &tls_test_data_aes_128_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-128-CBC-SHA256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &tls_test_data_aes_128_cbc_sha256_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-256-CBC-SHA1",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &tls_test_data_aes_256_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-256-CBC-SHA256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &tls_test_data_aes_256_cbc_sha256_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector 3DES-CBC-SHA1-HMAC",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &tls_test_data_3des_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector NULL-SHA1-HMAC",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &tls_test_data_null_cipher_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector CHACHA20-POLY1305",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &tls_test_data_chacha20_poly1305),
+
 		TEST_CASE_NAMED_WITH_DATA(
 			"Read record known vector AES-GCM-128 (vector 1)",
 			ut_setup_security, ut_teardown,

@@ -16900,6 +16925,33 @@ static struct unit_test_suite tls12_record_proto_testsuite  = {
 			"Read record known vector AES-128-CBC-SHA1",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_known_vec_read, &tls_test_data_aes_128_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-128-CBC-SHA256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read,
+			&tls_test_data_aes_128_cbc_sha256_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-256-CBC-SHA1",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read, &tls_test_data_aes_256_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-256-CBC-SHA256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read,
+			&tls_test_data_aes_256_cbc_sha256_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector 3DES-CBC-SHA1-HMAC",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read, &tls_test_data_3des_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector NULL-SHA1-HMAC",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read, &tls_test_data_null_cipher_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector CHACHA20-POLY1305",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read, &tls_test_data_chacha20_poly1305),
+
 		TEST_CASE_NAMED_ST(
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,

@@ -16920,6 +16972,40 @@ static struct unit_test_suite dtls12_record_proto_testsuite  = {
 			"Write record known vector AES-GCM-256",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_known_vec, &dtls_test_data_aes_256_gcm),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-128-CBC-SHA1",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec,
+			&dtls_test_data_aes_128_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-128-CBC-SHA256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec,
+			&dtls_test_data_aes_128_cbc_sha256_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-256-CBC-SHA1",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec,
+			&dtls_test_data_aes_256_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector AES-256-CBC-SHA256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec,
+			&dtls_test_data_aes_256_cbc_sha256_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector 3DES-CBC-SHA1-HMAC",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec,
+			&dtls_test_data_3des_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector NULL-SHA1-HMAC",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec,
+			&dtls_test_data_null_cipher_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Write record known vector CHACHA20-POLY1305",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec, &dtls_test_data_chacha20_poly1305),
 		TEST_CASE_NAMED_WITH_DATA(
 			"Read record known vector AES-GCM-128",
 			ut_setup_security, ut_teardown,

@@ -16928,6 +17014,41 @@ static struct unit_test_suite dtls12_record_proto_testsuite  = {
 			"Read record known vector AES-GCM-256",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_known_vec_read, &dtls_test_data_aes_256_gcm),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-128-CBC-SHA1",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read,
+			&dtls_test_data_aes_128_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-128-CBC-SHA256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read,
+			&dtls_test_data_aes_128_cbc_sha256_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-256-CBC-SHA1",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read,
+			&dtls_test_data_aes_256_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector AES-256-CBC-SHA256",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read,
+			&dtls_test_data_aes_256_cbc_sha256_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector 3DES-CBC-SHA1-HMAC",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read,
+			&dtls_test_data_3des_cbc_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector NULL-SHA1-HMAC",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read,
+			&dtls_test_data_null_cipher_sha1_hmac),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Read record known vector CHACHA20-POLY1305",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_known_vec_read, &dtls_test_data_chacha20_poly1305),
+
 		TEST_CASE_NAMED_ST(
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,

app/test/test_cryptodev_security_tls_record.h +13 -0

index 68dd55fef2..82a1776265 100644
@@ -63,6 +63,19 @@ extern struct tls_record_test_data tls_test_data_aes_256_gcm;
 extern struct tls_record_test_data dtls_test_data_aes_128_gcm;
 extern struct tls_record_test_data dtls_test_data_aes_256_gcm;
 extern struct tls_record_test_data tls_test_data_aes_128_cbc_sha1_hmac;
+extern struct tls_record_test_data tls_test_data_aes_128_cbc_sha256_hmac;
+extern struct tls_record_test_data tls_test_data_aes_256_cbc_sha1_hmac;
+extern struct tls_record_test_data tls_test_data_aes_256_cbc_sha256_hmac;
+extern struct tls_record_test_data tls_test_data_3des_cbc_sha1_hmac;
+extern struct tls_record_test_data tls_test_data_null_cipher_sha1_hmac;
+extern struct tls_record_test_data tls_test_data_chacha20_poly1305;
+extern struct tls_record_test_data dtls_test_data_chacha20_poly1305;
+extern struct tls_record_test_data dtls_test_data_aes_128_cbc_sha1_hmac;
+extern struct tls_record_test_data dtls_test_data_aes_128_cbc_sha256_hmac;
+extern struct tls_record_test_data dtls_test_data_aes_256_cbc_sha1_hmac;
+extern struct tls_record_test_data dtls_test_data_aes_256_cbc_sha256_hmac;
+extern struct tls_record_test_data dtls_test_data_3des_cbc_sha1_hmac;
+extern struct tls_record_test_data dtls_test_data_null_cipher_sha1_hmac;
 
 int test_tls_record_status_check(struct rte_crypto_op *op);

app/test/test_cryptodev_security_tls_record_test_vectors.h +1126 -0

1,130 lines not on this page · raw message

Signature · 1 line

2.25.1

Anoob Joseph

author

2023-12-07 13:04 UTC #14 lore raw

PATCH 14/14 test/crypto: add multi segmented cases

In reply to Anoob Joseph

From: Tejasree Kondoj <[email protected]>

Add multi segmented buffer test cases in TLS suites.

Signed-off-by Tejasree Kondoj <[email protected]>

Signed-off-by Vidya Sagar Velumuri <[email protected]>

---
 app/test/test_cryptodev.c                     | 29 ++++++++++++++++++-
 app/test/test_cryptodev_security_tls_record.h |  1 +
 doc/guides/rel_notes/release_24_03.rst        |  4 +++
 3 files changed, 33 insertions(+), 1 deletion(-)

app/test/test_cryptodev.c +28 -1

index 86e2ccd483..b208cca4e2 100644
@@ -11699,6 +11699,7 @@ test_tls_record_proto_process(const struct tls_record_test_data td[],
 			      struct tls_record_test_data res_d[], int nb_td, bool silent,
 			      const struct tls_record_test_flags *flags)
 {
+	int nb_segs = flags->nb_segs_in_mbuf ? flags->nb_segs_in_mbuf : 1;
 	struct crypto_testsuite_params *ts_params = &testsuite_params;
 	struct crypto_unittest_params *ut_params = &unittest_params;
 	struct rte_security_tls_record_xform tls_record_xform;

@@ -11801,7 +11802,7 @@ test_tls_record_proto_process(const struct tls_record_test_data td[],
 	for (i = 0; i < nb_td; i++) {
 		/* Setup source mbuf payload */
 		ut_params->ibuf = create_segmented_mbuf(ts_params->mbuf_pool, td[i].input_text.len,
-				1, 0);
+				nb_segs, 0);
 		pktmbuf_write(ut_params->ibuf, 0, td[i].input_text.len, td[i].input_text.data);
 
 		/* Generate crypto op data structure */

@@ -11958,6 +11959,24 @@ test_tls_record_proto_display_list(void)
 	return test_tls_record_proto_all(&flags);
 }
 
+static int
+test_tls_record_proto_sgl(void)
+{
+	struct tls_record_test_flags flags = {
+		.nb_segs_in_mbuf = 5
+	};
+	struct crypto_testsuite_params *ts_params = &testsuite_params;
+	struct rte_cryptodev_info dev_info;
+
+	rte_cryptodev_info_get(ts_params->valid_devs[0], &dev_info);
+	if (!(dev_info.feature_flags & RTE_CRYPTODEV_FF_IN_PLACE_SGL)) {
+		printf("Device doesn't support in-place scatter-gather. Test Skipped.\n");
+		return TEST_SKIPPED;
+	}
+
+	return test_tls_record_proto_all(&flags);
+}
+
 #endif
 
 static int

@@ -16956,6 +16975,10 @@ static struct unit_test_suite tls12_record_proto_testsuite  = {
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_display_list),
+		TEST_CASE_NAMED_ST(
+			"Multi-segmented mode",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_sgl),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };

@@ -17053,6 +17076,10 @@ static struct unit_test_suite dtls12_record_proto_testsuite  = {
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,
 			test_tls_record_proto_display_list),
+		TEST_CASE_NAMED_ST(
+			"Multi-segmented mode",
+			ut_setup_security, ut_teardown,
+			test_tls_record_proto_sgl),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };

app/test/test_cryptodev_security_tls_record.h +1 -0

index 82a1776265..0bd83f88f0 100644
@@ -55,6 +55,7 @@ struct tls_record_test_data {
 
 struct tls_record_test_flags {
 	bool display_alg;
+	int nb_segs_in_mbuf;
 };
 
 extern struct tls_record_test_data tls_test_data_aes_128_gcm_v1;

doc/guides/rel_notes/release_24_03.rst +4 -0

index e9c9717706..0d226e9644 100644
@@ -55,6 +55,10 @@ New Features
      Also, make sure to start the actual text at the margin.
      =======================================================
 
+* **Added TLS record test suite.**
+
+  Added a new test suite in cryptodev autotest framework to test TLS record
+  security offload by supported cryptodevs.
 
 Removed Items
 -------------

Signature · 1 line

2.25.1

Akhil Goyal

2024-01-16 09:02 UTC #15 lore raw

In reply to Anoob Joseph

Quoted 159 lines

Subject: [PATCH 00/14] Add TLS record test suite
Add TLS record test suite in cryptodev autotest framework. The test suite would run based on capabilities exposed by the cryptodev.
The test suite framework is similar to the framework used in case of IPsec tests. To avoid duplication of code, protocol independent code is moved to common files and the functions are renamed accordingly.
TLS record test suite has known vector tests as well as combined mode tests. Known vector tests leverages vectors generated with kTLS and gnuTLS utilities. The test suite supports testing both operations (read or decrypt, write or encrypt) with a single vector. Write or encrypt test would get skipped if cryptodev doesn't support disabling of IV generation. Combined mode tests are targetted at testing protocol features with all combinations of cipher-authentication algorithms.
Combined mode performs record write operation first and feeds that back to record read operation. Individual test cases may update the input to record write operation based on the test case and the test framework validates the output obtained (not complete text, but protocol specific fields such as TLS header). Once it is validated, the output will be submitted for record read operation which would give back the original data. Currently this framework supports testing of multi-segmented mbuf as input with TLS record. The same would be enhanced to support more cases such as ICV corruption, incorrect padding etc.
Enhancements planned for future,
- Add TLS 1.3 suite
- Add negative tests such as ICV corruption and incorrect padding
- Add session expiry tests
- Add anti-replay tests with DTLS
Sample output with crypto_cn10k:
+ ------------------------------------------------------- +
[67/18944]
+ ------------------------------------------------------- +
+ Test Suite : TLS 1.2 Record Protocol Unit Test Suite
+ ------------------------------------------------------- +
+ TestCase [ 0] : Write record known vector AES-GCM-128 (vector 1) succeeded
+ TestCase [ 1] : Write record known vector AES-GCM-128 (vector 2) succeeded
+ TestCase [ 2] : Write record known vector AES-GCM-256 succeeded
+ TestCase [ 3] : Write record known vector AES-CBC-128-SHA1 succeeded
+ TestCase [ 4] : Write record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [ 5] : Write record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [ 6] : Write record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [ 7] : Write record known vector 3DES-CBC-SHA1-HMAC succeeded
USER1: Cipher crypto capabilities not supported
+ TestCase [ 8] : Write record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [ 9] : Write record known vector CHACHA20-POLY1305 skipped
+ TestCase [10] : Read record known vector AES-GCM-128 (vector 1) succeeded
+ TestCase [11] : Read record known vector AES-GCM-128 (vector 2) succeeded
+ TestCase [12] : Read record known vector AES-GCM-256 succeeded
+ TestCase [13] : Read record known vector AES-128-CBC-SHA1 succeeded
+ TestCase [14] : Read record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [15] : Read record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [16] : Read record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [17] : Read record known vector 3DES-CBC-SHA1-HMAC succeeded
USER1: Cipher crypto capabilities not supported
+ TestCase [18] : Read record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [19] : Read record known vector CHACHA20-POLY1305 skipped
        3des-cbc [192] sha1-hmac [20B ICV]
        aes-cbc [128] sha1-hmac [20B ICV]
        aes-cbc [128] sha2-256-hmac [32B ICV]
        aes-cbc [256] sha1-hmac [20B ICV]
        aes-cbc [256] sha2-256-hmac [32B ICV]
+ TestCase [20] : Combined test alg list succeeded
+ TestCase [21] : Multi-segmented mode succeeded
+ ------------------------------------------------------- +
+ Test Suite Summary : TLS 1.2 Record Protocol Unit Test Suite
+ ------------------------------------------------------- +
+ Tests Total : 22
+ Tests Skipped : 4
+ Tests Executed : 22
+ Tests Unsupported: 0
+ Tests Passed : 18
+ Tests Failed : 0
+ ------------------------------------------------------- +
+ ------------------------------------------------------- +
+ Test Suite : DTLS 1.2 Record Protocol Unit Test Suite
+ ------------------------------------------------------- +
+ TestCase [ 0] : Write record known vector AES-GCM-128 succeeded
+ TestCase [ 1] : Write record known vector AES-GCM-256 succeeded
+ TestCase [ 2] : Write record known vector AES-128-CBC-SHA1 succeeded
+ TestCase [ 3] : Write record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [ 4] : Write record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [ 5] : Write record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [ 6] : Write record known vector 3DES-CBC-SHA1-HMAC succeeded
USER1: Cipher crypto capabilities not supported
+ TestCase [ 7] : Write record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [ 8] : Write record known vector CHACHA20-POLY1305 skipped
+ TestCase [ 9] : Read record known vector AES-GCM-128 succeeded
+ TestCase [10] : Read record known vector AES-GCM-256 succeeded
+ TestCase [11] : Read record known vector AES-128-CBC-SHA1 succeeded
+ TestCase [12] : Read record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [13] : Read record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [14] : Read record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [15] : Read record known vector 3DES-CBC-SHA1-HMAC succeeded
USER1: Cipher crypto capabilities not supported
+ TestCase [16] : Read record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [17] : Read record known vector CHACHA20-POLY1305 skipped
        3des-cbc [192] sha1-hmac [20B ICV]
        aes-cbc [128] sha1-hmac [20B ICV]
        aes-cbc [128] sha2-256-hmac [32B ICV]
        aes-cbc [256] sha1-hmac [20B ICV]
        aes-cbc [256] sha2-256-hmac [32B ICV]
+ TestCase [18] : Combined test alg list succeeded
+ TestCase [19] : Multi-segmented mode succeeded
+ ------------------------------------------------------- +
+ Test Suite Summary : DTLS 1.2 Record Protocol Unit Test Suite
+ ------------------------------------------------------- +
+ Tests Total : 20
+ Tests Skipped : 4
+ Tests Executed : 20
+ Tests Unsupported: 0
+ Tests Passed : 16
+ Tests Failed : 0
+ ------------------------------------------------------- +
Akhil Goyal (3):
test/crypto: add TLS1.2 vectors
test/crypto: add TLS1.2/DTLS1.2 AES-128/256-GCM vectors test/security: add TLS 1.2 and DTLS 1.2 vectors
Anoob Joseph (5):
test/crypto: move security caps checks to separate file test/crypto: move algorithm display routines to common test/security: add sha1-hmac to auth list test/crypto: add TLS record tests
test/crypto: add verification of TLS headers
Tejasree Kondoj (2):
test/crypto: add AES-GCM 128 TLS 1.2 vector
test/crypto: add multi segmented cases
Vidya Sagar Velumuri (4):
test/crypto: move algorithm list to common
test/crypto: move algorithm framework to common
test/crypto: add combined mode cases
test/security: add more algos to combined tests
 app/test-security-perf/meson.build            |    1 +
 app/test-security-perf/test_security_perf.c   |   35 +-
 app/test/meson.build                          |    2 +
 app/test/test_cryptodev.c                     |  596 ++++++-
 app/test/test_cryptodev.h                     |    2 +
 app/test/test_cryptodev_security_ipsec.c      |  164 +-
 app/test/test_cryptodev_security_ipsec.h      |  157 +-
 app/test/test_cryptodev_security_tls_record.c |  327 ++++
 app/test/test_cryptodev_security_tls_record.h |  101 ++
 ...yptodev_security_tls_record_test_vectors.h | 1584 +++++++++++++++++
 app/test/test_security_inline_proto.c         |   42 +-
 app/test/test_security_proto.c                |  154 ++
 app/test/test_security_proto.h                |  186 ++

Quoted 9 lines

 doc/guides/rel_notes/release_24_03.rst        |    4 +
 14 files changed, 2960 insertions(+), 395 deletions(-)
 create mode 100644 app/test/test_cryptodev_security_tls_record.c
 create mode 100644 app/test/test_cryptodev_security_tls_record.h
 create mode 100644
app/test/test_cryptodev_security_tls_record_test_vectors.h
 create mode 100644 app/test/test_security_proto.c
 create mode 100644 app/test/test_security_proto.h

Series Acked-by: Akhil Goyal <[email protected]>

Akhil Goyal

Applied

2024-01-19 08:55 UTC #16 lore raw

Quoted 178 lines

Subject: RE: [PATCH 00/14] Add TLS record test suite
Quoted 33 lines
Subject: [PATCH 00/14] Add TLS record test suite
Add TLS record test suite in cryptodev autotest framework. The test suite would run based on capabilities exposed by the cryptodev.
The test suite framework is similar to the framework used in case of IPsec tests. To avoid duplication of code, protocol independent code is moved to common files and the functions are renamed accordingly.
TLS record test suite has known vector tests as well as combined mode tests. Known vector tests leverages vectors generated with kTLS and gnuTLS utilities. The test suite supports testing both operations (read or decrypt, write or encrypt) with a single vector. Write or encrypt test would get skipped if cryptodev doesn't support disabling of IV generation. Combined mode tests are targetted at testing protocol features with all combinations of cipher-authentication algorithms.
Combined mode performs record write operation first and feeds that back to record read operation. Individual test cases may update the input to record write operation based on the test case and the test framework validates the output obtained (not complete text, but protocol specific fields such as TLS header). Once it is validated, the output will be submitted for record read operation which would give back the original data. Currently this framework supports testing of multi-segmented mbuf as input with TLS record. The same would be enhanced to support more cases such as ICV corruption, incorrect padding etc.
Enhancements planned for future,
- Add TLS 1.3 suite
- Add negative tests such as ICV corruption and incorrect padding
- Add session expiry tests
- Add anti-replay tests with DTLS
Quoted 8 lines
Sample output with crypto_cn10k:
+ ------------------------------------------------------- +
[67/18944]
+ ------------------------------------------------------- +
+ Test Suite : TLS 1.2 Record Protocol Unit Test Suite
+ ------------------------------------------------------- +
+ TestCase [ 0] : Write record known vector AES-GCM-128 (vector 1)
succeeded
Quoted 1 line
+ TestCase [ 1] : Write record known vector AES-GCM-128 (vector 2)
succeeded
Quoted 6 lines
+ TestCase [ 2] : Write record known vector AES-GCM-256 succeeded
+ TestCase [ 3] : Write record known vector AES-CBC-128-SHA1 succeeded
+ TestCase [ 4] : Write record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [ 5] : Write record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [ 6] : Write record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [ 7] : Write record known vector 3DES-CBC-SHA1-HMAC
succeeded
Quoted 5 lines
USER1: Cipher crypto capabilities not supported
+ TestCase [ 8] : Write record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [ 9] : Write record known vector CHACHA20-POLY1305 skipped
+ TestCase [10] : Read record known vector AES-GCM-128 (vector 1)
succeeded
Quoted 1 line
+ TestCase [11] : Read record known vector AES-GCM-128 (vector 2)
succeeded
Quoted 6 lines
+ TestCase [12] : Read record known vector AES-GCM-256 succeeded
+ TestCase [13] : Read record known vector AES-128-CBC-SHA1 succeeded
+ TestCase [14] : Read record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [15] : Read record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [16] : Read record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [17] : Read record known vector 3DES-CBC-SHA1-HMAC
succeeded
Quoted 23 lines
USER1: Cipher crypto capabilities not supported
+ TestCase [18] : Read record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [19] : Read record known vector CHACHA20-POLY1305 skipped
        3des-cbc [192] sha1-hmac [20B ICV]
        aes-cbc [128] sha1-hmac [20B ICV]
        aes-cbc [128] sha2-256-hmac [32B ICV]
        aes-cbc [256] sha1-hmac [20B ICV]
        aes-cbc [256] sha2-256-hmac [32B ICV]
+ TestCase [20] : Combined test alg list succeeded
+ TestCase [21] : Multi-segmented mode succeeded
+ ------------------------------------------------------- +
+ Test Suite Summary : TLS 1.2 Record Protocol Unit Test Suite
+ ------------------------------------------------------- +
+ Tests Total : 22
+ Tests Skipped : 4
+ Tests Executed : 22
+ Tests Unsupported: 0
+ Tests Passed : 18
+ Tests Failed : 0
+ ------------------------------------------------------- +
+ ------------------------------------------------------- +
+ Test Suite : DTLS 1.2 Record Protocol Unit Test Suite
Quoted 8 lines
+ ------------------------------------------------------- +
+ TestCase [ 0] : Write record known vector AES-GCM-128 succeeded
+ TestCase [ 1] : Write record known vector AES-GCM-256 succeeded
+ TestCase [ 2] : Write record known vector AES-128-CBC-SHA1 succeeded
+ TestCase [ 3] : Write record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [ 4] : Write record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [ 5] : Write record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [ 6] : Write record known vector 3DES-CBC-SHA1-HMAC
succeeded
Quoted 11 lines
USER1: Cipher crypto capabilities not supported
+ TestCase [ 7] : Write record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [ 8] : Write record known vector CHACHA20-POLY1305 skipped
+ TestCase [ 9] : Read record known vector AES-GCM-128 succeeded
+ TestCase [10] : Read record known vector AES-GCM-256 succeeded
+ TestCase [11] : Read record known vector AES-128-CBC-SHA1 succeeded
+ TestCase [12] : Read record known vector AES-128-CBC-SHA256 succeeded
+ TestCase [13] : Read record known vector AES-256-CBC-SHA1 succeeded
+ TestCase [14] : Read record known vector AES-256-CBC-SHA256 succeeded
+ TestCase [15] : Read record known vector 3DES-CBC-SHA1-HMAC
succeeded
Quoted 57 lines
USER1: Cipher crypto capabilities not supported
+ TestCase [16] : Read record known vector NULL-SHA1-HMAC skipped
USER1: Crypto capabilities not supported
+ TestCase [17] : Read record known vector CHACHA20-POLY1305 skipped
        3des-cbc [192] sha1-hmac [20B ICV]
        aes-cbc [128] sha1-hmac [20B ICV]
        aes-cbc [128] sha2-256-hmac [32B ICV]
        aes-cbc [256] sha1-hmac [20B ICV]
        aes-cbc [256] sha2-256-hmac [32B ICV]
+ TestCase [18] : Combined test alg list succeeded
+ TestCase [19] : Multi-segmented mode succeeded
+ ------------------------------------------------------- +
+ Test Suite Summary : DTLS 1.2 Record Protocol Unit Test Suite
+ ------------------------------------------------------- +
+ Tests Total : 20
+ Tests Skipped : 4
+ Tests Executed : 20
+ Tests Unsupported: 0
+ Tests Passed : 16
+ Tests Failed : 0
+ ------------------------------------------------------- +
Akhil Goyal (3):
test/crypto: add TLS1.2 vectors
test/crypto: add TLS1.2/DTLS1.2 AES-128/256-GCM vectors test/security: add TLS 1.2 and DTLS 1.2 vectors
Anoob Joseph (5):
test/crypto: move security caps checks to separate file test/crypto: move algorithm display routines to common test/security: add sha1-hmac to auth list test/crypto: add TLS record tests
test/crypto: add verification of TLS headers
Tejasree Kondoj (2):
test/crypto: add AES-GCM 128 TLS 1.2 vector
test/crypto: add multi segmented cases
Vidya Sagar Velumuri (4):
test/crypto: move algorithm list to common
test/crypto: move algorithm framework to common
test/crypto: add combined mode cases
test/security: add more algos to combined tests
 app/test-security-perf/meson.build            |    1 +
 app/test-security-perf/test_security_perf.c   |   35 +-
 app/test/meson.build                          |    2 +
 app/test/test_cryptodev.c                     |  596 ++++++-
 app/test/test_cryptodev.h                     |    2 +
 app/test/test_cryptodev_security_ipsec.c      |  164 +-
 app/test/test_cryptodev_security_ipsec.h      |  157 +-
 app/test/test_cryptodev_security_tls_record.c |  327 ++++
 app/test/test_cryptodev_security_tls_record.h |  101 ++
 ...yptodev_security_tls_record_test_vectors.h | 1584 +++++++++++++++++
 app/test/test_security_inline_proto.c         |   42 +-
 app/test/test_security_proto.c                |  154 ++
 app/test/test_security_proto.h                |  186 ++
Quoted 9 lines
 doc/guides/rel_notes/release_24_03.rst        |    4 +
 14 files changed, 2960 insertions(+), 395 deletions(-)
 create mode 100644 app/test/test_cryptodev_security_tls_record.c
 create mode 100644 app/test/test_cryptodev_security_tls_record.h
 create mode 100644
app/test/test_cryptodev_security_tls_record_test_vectors.h
 create mode 100644 app/test/test_security_proto.c
 create mode 100644 app/test/test_security_proto.h

Quoted 1 line

Series Acked-by: Akhil Goyal <[email protected]>

Applied to dpdk-next-crypto
Thanks.