[PATCH 00/13] Add new cases to lookaside IPsec tests

[PATCH 00/13] Add new cases to lookaside IPsec tests

[Anoob Joseph]

Add new tests to lookaside IPsec tests.

* Support for chained operations.
* AES-CBC 128 NULL auth known vector tests.
* AES-CBC 128 HMAC-SHA256 known vector tests.
* AES-CBC 128 HMAC-SHA384 known vector tests.
* AES-CBC 128 HMAC-SHA512 known vector tests.
* NULL cipher AES-XCBC known vector tests.
* Tunnel mode tests
  * IPv6 in IPv6
  * IPv4 in IPv4
  * IPv4 in IPv6
  * IPv6 in IPv4
* IPv4 transport mode tests.
* Security stats tests.
* AES-CTR tests.
* set/copy DF tests.

Ankur Dwivedi (1):
  test/crypto: add security stats cases

Anoob Joseph (5):
  test/crypto: add IPsec aes-cbc known vectors
  test/crypto: add chained operations in combined cases
  test/crypto: add transport mode cases
  test/crypto: add aes xcbc known vectors
  test/crypto: add copy and set DF cases

Tejasree Kondoj (7):
  test/crypto: add IPsec AES-CBC-HMAC-SHA256 known vectors
  test/crypto: add IPv6 tunnel mode cases
  test/crypto: add IPsec HMAC-SHA384/512 known vectors
  test/crypto: add IPsec fragmented packet known vectors
  test/crypto: add lookaside IPsec AES-CTR known vectors
  test/crypto: add fragmented packet case
  test/crypto: skip null auth in ICV corrupt case

 app/test/test_cryptodev.c                          | 395 +++++++++-
 app/test/test_cryptodev_security_ipsec.c           | 352 ++++++++-
 app/test/test_cryptodev_security_ipsec.h           | 113 +++
 .../test_cryptodev_security_ipsec_test_vectors.h   | 828 +++++++++++++++++++++
 doc/guides/rel_notes/release_22_03.rst             |  18 +
 5 files changed, 1664 insertions(+), 42 deletions(-)

-- 
2.7.4

[PATCH 01/13] test/crypto: add IPsec aes-cbc known vectors

[Anoob Joseph]

Extend the framework to support chained operations and add
AES-CBC 128 known vector tests.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
---
 app/test/test_cryptodev.c                          |  62 ++++++++++--
 app/test/test_cryptodev_security_ipsec.c           |  51 ++++++++++
 app/test/test_cryptodev_security_ipsec.h           |   8 ++
 .../test_cryptodev_security_ipsec_test_vectors.h   | 110 +++++++++++++++++++++
 4 files changed, 222 insertions(+), 9 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 293f59b..1e4b690 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9191,23 +9191,59 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 			return TEST_SKIPPED;
 		}
 	} else {
-		/* Only AEAD supported now */
-		return TEST_SKIPPED;
+		memcpy(&ut_params->cipher_xform, &td[0].xform.chain.cipher,
+		       sizeof(ut_params->cipher_xform));
+		memcpy(&ut_params->auth_xform, &td[0].xform.chain.auth,
+		       sizeof(ut_params->auth_xform));
+		ut_params->cipher_xform.cipher.key.data = td[0].key.data;
+		ut_params->cipher_xform.cipher.iv.offset = IV_OFFSET;
+		ut_params->auth_xform.auth.key.data = td[0].key.data;
+
+		/* Verify crypto capabilities */
+
+		if (test_ipsec_crypto_caps_cipher_verify(
+				sec_cap,
+				&ut_params->cipher_xform) != 0) {
+			if (!silent)
+				RTE_LOG(INFO, USER1,
+					"Cipher crypto capabilities not supported\n");
+			return TEST_SKIPPED;
+		}
+
+		if (test_ipsec_crypto_caps_auth_verify(
+				sec_cap,
+				&ut_params->auth_xform) != 0) {
+			if (!silent)
+				RTE_LOG(INFO, USER1,
+					"Auth crypto capabilities not supported\n");
+			return TEST_SKIPPED;
+		}
 	}
 
 	if (test_ipsec_sec_caps_verify(&ipsec_xform, sec_cap, silent) != 0)
 		return TEST_SKIPPED;
 
-	salt_len = RTE_MIN(sizeof(ipsec_xform.salt), td[0].salt.len);
-	memcpy(&ipsec_xform.salt, td[0].salt.data, salt_len);
-
 	struct rte_security_session_conf sess_conf = {
 		.action_type = ut_params->type,
 		.protocol = RTE_SECURITY_PROTOCOL_IPSEC,
-		.ipsec = ipsec_xform,
-		.crypto_xform = &ut_params->aead_xform,
 	};
 
+	if (td[0].aead) {
+		salt_len = RTE_MIN(sizeof(ipsec_xform.salt), td[0].salt.len);
+		memcpy(&ipsec_xform.salt, td[0].salt.data, salt_len);
+		sess_conf.ipsec = ipsec_xform;
+		sess_conf.crypto_xform = &ut_params->aead_xform;
+	} else {
+		sess_conf.ipsec = ipsec_xform;
+		if (dir == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
+			sess_conf.crypto_xform = &ut_params->cipher_xform;
+			ut_params->cipher_xform.next = &ut_params->auth_xform;
+		} else {
+			sess_conf.crypto_xform = &ut_params->auth_xform;
+			ut_params->auth_xform.next = &ut_params->cipher_xform;
+		}
+	}
+
 	/* Create security session */
 	ut_params->sec_session = rte_security_session_create(ctx, &sess_conf,
 					ts_params->session_mpool,
@@ -9316,14 +9352,18 @@ test_ipsec_proto_known_vec(const void *test_data)
 }
 
 static int
-test_ipsec_proto_known_vec_inb(const void *td_outb)
+test_ipsec_proto_known_vec_inb(const void *test_data)
 {
+	const struct ipsec_test_data *td = test_data;
 	struct ipsec_test_flags flags;
 	struct ipsec_test_data td_inb;
 
 	memset(&flags, 0, sizeof(flags));
 
-	test_ipsec_td_in_from_out(td_outb, &td_inb);
+	if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS)
+		test_ipsec_td_in_from_out(td, &td_inb);
+	else
+		memcpy(&td_inb, td, sizeof(td_inb));
 
 	return test_ipsec_proto_process(&td_inb, NULL, 1, false, &flags);
 }
@@ -14394,6 +14434,10 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Inbound known vector (ESP tunnel mode IPv4 AES-GCM 256)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_256_gcm),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv4 AES-CBC 128)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb, &pkt_aes_128_cbc_null),
 		TEST_CASE_NAMED_ST(
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 4708803..45960bf 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -150,6 +150,57 @@ test_ipsec_crypto_caps_aead_verify(
 	return -ENOTSUP;
 }
 
+int
+test_ipsec_crypto_caps_cipher_verify(
+		const struct rte_security_capability *sec_cap,
+		struct rte_crypto_sym_xform *cipher)
+{
+	const struct rte_cryptodev_symmetric_capability *sym_cap;
+	const struct rte_cryptodev_capabilities *cap;
+	int j = 0;
+
+	while ((cap = &sec_cap->crypto_capabilities[j++])->op !=
+			RTE_CRYPTO_OP_TYPE_UNDEFINED) {
+		if (cap->op == RTE_CRYPTO_OP_TYPE_SYMMETRIC &&
+				cap->sym.xform_type == cipher->type &&
+				cap->sym.cipher.algo == cipher->cipher.algo) {
+			sym_cap = &cap->sym;
+			if (rte_cryptodev_sym_capability_check_cipher(sym_cap,
+					cipher->cipher.key.length,
+					cipher->cipher.iv.length) == 0)
+				return 0;
+		}
+	}
+
+	return -ENOTSUP;
+}
+
+int
+test_ipsec_crypto_caps_auth_verify(
+		const struct rte_security_capability *sec_cap,
+		struct rte_crypto_sym_xform *auth)
+{
+	const struct rte_cryptodev_symmetric_capability *sym_cap;
+	const struct rte_cryptodev_capabilities *cap;
+	int j = 0;
+
+	while ((cap = &sec_cap->crypto_capabilities[j++])->op !=
+			RTE_CRYPTO_OP_TYPE_UNDEFINED) {
+		if (cap->op == RTE_CRYPTO_OP_TYPE_SYMMETRIC &&
+				cap->sym.xform_type == auth->type &&
+				cap->sym.auth.algo == auth->auth.algo) {
+			sym_cap = &cap->sym;
+			if (rte_cryptodev_sym_capability_check_auth(sym_cap,
+					auth->auth.key.length,
+					auth->auth.digest_length,
+					auth->auth.iv.length) == 0)
+				return 0;
+		}
+	}
+
+	return -ENOTSUP;
+}
+
 void
 test_ipsec_td_in_from_out(const struct ipsec_test_data *td_out,
 			  struct ipsec_test_data *td_in)
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 7628d0c..91c6cd4 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -96,6 +96,14 @@ int test_ipsec_crypto_caps_aead_verify(
 		const struct rte_security_capability *sec_cap,
 		struct rte_crypto_sym_xform *aead);
 
+int test_ipsec_crypto_caps_cipher_verify(
+		const struct rte_security_capability *sec_cap,
+		struct rte_crypto_sym_xform *cipher);
+
+int test_ipsec_crypto_caps_auth_verify(
+		const struct rte_security_capability *sec_cap,
+		struct rte_crypto_sym_xform *auth);
+
 void test_ipsec_td_in_from_out(const struct ipsec_test_data *td_out,
 			       struct ipsec_test_data *td_in);
 
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index bb95d00..bf831e9 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -324,4 +324,114 @@ struct ipsec_test_data pkt_aes_256_gcm = {
 	},
 };
 
+/* Known vectors for AES-CBC
+ * https://datatracker.ietf.org/doc/html/rfc3602#section-4
+ */
+
+struct ipsec_test_data pkt_aes_128_cbc_null = {
+	.key = {
+		.data = {
+			0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
+			0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
+		},
+	},
+	.input_text = {
+		.data = {
+			/* IP - outer header */
+			0x45, 0x00, 0x00, 0x8c, 0x00, 0x02, 0x00, 0x00,
+			0x40, 0x32, 0x27, 0xbc, 0x00, 0x01, 0xa8, 0xc0,
+			0x01, 0x01, 0xa8, 0xc0,
+
+			/* ESP */
+			0x00, 0x00, 0x87, 0x65,	0x00, 0x00, 0x00, 0x02,
+
+			/* IV */
+			0xf4, 0xe7, 0x65, 0x24,	0x4f, 0x64, 0x07, 0xad,
+			0xf1, 0x3d, 0xc1, 0x38,	0x0f, 0x67, 0x3f, 0x37,
+
+			/* Data */
+			0x77, 0x3b, 0x52, 0x41,	0xa4, 0xc4, 0x49, 0x22,
+			0x5e, 0x4f, 0x3c, 0xe5, 0xed, 0x61, 0x1b, 0x0c,
+			0x23, 0x7c, 0xa9, 0x6c, 0xf7, 0x4a, 0x93, 0x01,
+			0x3c, 0x1b, 0x0e, 0xa1, 0xa0, 0xcf, 0x70, 0xf8,
+			0xe4, 0xec, 0xae, 0xc7, 0x8a, 0xc5, 0x3a, 0xad,
+			0x7a, 0x0f, 0x02, 0x2b, 0x85, 0x92, 0x43, 0xc6,
+			0x47, 0x75, 0x2e, 0x94, 0xa8, 0x59, 0x35, 0x2b,
+			0x8a, 0x4d, 0x4d, 0x2d, 0xec, 0xd1, 0x36, 0xe5,
+			0xc1, 0x77, 0xf1, 0x32,	0xad, 0x3f, 0xbf, 0xb2,
+			0x20, 0x1a, 0xc9, 0x90,	0x4c, 0x74, 0xee, 0x0a,
+			0x10, 0x9e, 0x0c, 0xa1,	0xe4, 0xdf, 0xe9, 0xd5,
+			0xa1, 0x00, 0xb8, 0x42,	0xf1, 0xc2, 0x2f, 0x0d,
+		},
+		.len = 140,
+	},
+	.output_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x54, 0x09, 0x04, 0x00, 0x00,
+			0x40, 0x01, 0xf9, 0x88, 0xc0, 0xa8, 0x7b, 0x03,
+			0xc0, 0xa8, 0x7b, 0xc8,
+
+			/* ICMP */
+			0x08, 0x00, 0x9f, 0x76,	0xa9, 0x0a, 0x01, 0x00,
+			0xb4, 0x9c, 0x08, 0x3d,	0x02, 0xa2, 0x04, 0x00,
+			0x08, 0x09, 0x0a, 0x0b,	0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23,	0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b,	0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33,	0x34, 0x35, 0x36, 0x37,
+			0x01, 0x02, 0x03, 0x04,	0x05, 0x06, 0x07, 0x08,
+			0x09, 0x0a, 0x0a, 0x04,
+		},
+		.len = 84,
+	},
+	.iv = {
+		.data = {
+			0xf4, 0xe7, 0x65, 0x24, 0x4f, 0x64, 0x07, 0xad,
+			0xf1, 0x3d, 0xc1, 0x38, 0x0f, 0x67, 0x3f, 0x37,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 0x8765,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+
+	.aead = false,
+
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_DECRYPT,
+				.algo = RTE_CRYPTO_CIPHER_AES_CBC,
+				.key.length = 16,
+				.iv.length = 16,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.algo = RTE_CRYPTO_AUTH_NULL,
+			},
+		},
+	},
+};
+
 #endif /* TEST_CRYPTODEV_SECURITY_IPSEC_TEST_VECTORS_H_ */
-- 
2.7.4

[PATCH 02/13] test/crypto: add IPsec AES-CBC-HMAC-SHA256 known vectors

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Adding lookaside IPsec AES-CBC-HMAC-SHA256 test cases.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c                          |  12 ++-
 app/test/test_cryptodev_security_ipsec.h           |   3 +
 .../test_cryptodev_security_ipsec_test_vectors.h   | 109 +++++++++++++++++++++
 3 files changed, 123 insertions(+), 1 deletion(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 1e4b690..3fa618d 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9197,7 +9197,7 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 		       sizeof(ut_params->auth_xform));
 		ut_params->cipher_xform.cipher.key.data = td[0].key.data;
 		ut_params->cipher_xform.cipher.iv.offset = IV_OFFSET;
-		ut_params->auth_xform.auth.key.data = td[0].key.data;
+		ut_params->auth_xform.auth.key.data = td[0].auth_key.data;
 
 		/* Verify crypto capabilities */
 
@@ -14423,6 +14423,11 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec, &pkt_aes_256_gcm),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA256 [16B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec,
+			&pkt_aes_128_cbc_hmac_sha256),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Inbound known vector (ESP tunnel mode IPv4 AES-GCM 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_128_gcm),
@@ -14438,6 +14443,11 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Inbound known vector (ESP tunnel mode IPv4 AES-CBC 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_128_cbc_null),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA256 [16B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb,
+			&pkt_aes_128_cbc_hmac_sha256),
 		TEST_CASE_NAMED_ST(
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 91c6cd4..70a264a 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -14,6 +14,9 @@ struct ipsec_test_data {
 	struct {
 		uint8_t data[32];
 	} key;
+	struct {
+		uint8_t data[32];
+	} auth_key;
 
 	struct {
 		uint8_t data[1024];
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index bf831e9..16c88fe 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -434,4 +434,113 @@ struct ipsec_test_data pkt_aes_128_cbc_null = {
 	},
 };
 
+struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256 = {
+	.key = {
+		.data = {
+			0x00, 0x04, 0x05, 0x01, 0x23, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x0a, 0x0b, 0x0c, 0x0f, 0x00, 0x00,
+		},
+	},
+	.auth_key = {
+		.data = {
+			0xde, 0x34, 0x56, 0x00, 0x00, 0x00, 0x78, 0x00,
+			0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x04,
+			0x0a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+		},
+	},
+	.input_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x32, 0x00, 0x01, 0x00, 0x00,
+			0x1f, 0x11, 0x17, 0x8b, 0xc0, 0xa8, 0x01, 0x6f,
+			0xc0, 0xa8, 0x01, 0x70,
+
+			/* UDP */
+			0x00, 0x09, 0x00, 0x09, 0x00, 0x1e, 0x00, 0x00,
+			0xbe, 0x9b, 0xe9, 0x55, 0x00, 0x00, 0x00, 0x21,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		},
+		.len = 50,
+	},
+	.output_text = {
+		.data = {
+			/* IP - outer header */
+			0x45, 0x00, 0x00, 0x7c, 0x00, 0x01, 0x00, 0x00,
+			0x40, 0x32, 0x52, 0x4d, 0x14, 0x00, 0x00, 0x01,
+			0x14, 0x00, 0x00, 0x02,
+
+			/* ESP */
+			0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x01,
+
+			/* IV */
+			0x34, 0x12, 0x67, 0x45, 0xff, 0xff, 0x00, 0x00,
+			0x20, 0xbf, 0xe8, 0x39, 0x00, 0x00, 0x00, 0x00,
+
+			/* Data */
+			0x67, 0xb5, 0x46, 0x6e, 0x78, 0x17, 0xd3, 0x5a,
+			0xac, 0x62, 0x62, 0x62, 0xb0, 0x57, 0x9b, 0x09,
+			0x19, 0x4f, 0x06, 0x59, 0xc8, 0xb0, 0x30, 0x65,
+			0x1f, 0x45, 0x57, 0x41, 0x72, 0x17, 0x28, 0xe9,
+			0xad, 0x50, 0xbe, 0x44, 0x1d, 0x2d, 0x9a, 0xd0,
+			0x48, 0x75, 0x0d, 0x1c, 0x8d, 0x24, 0xa8, 0x6f,
+			0x6b, 0x24, 0xb6, 0x5d, 0x43, 0x1e, 0x55, 0xf0,
+			0xf7, 0x14, 0x1f, 0xf2, 0x61, 0xd4, 0xe0, 0x30,
+			0x16, 0xbe, 0x1b, 0x5c, 0xcc, 0xb7, 0x66, 0x1c,
+			0x47, 0xad, 0x07, 0x6c, 0xd5, 0xcb, 0xce, 0x6c,
+		},
+		.len = 124,
+	},
+	.iv = {
+		.data = {
+			0x34, 0x12, 0x67, 0x45, 0xff, 0xff, 0x00, 0x00,
+			0x20, 0xbf, 0xe8, 0x39, 0x00, 0x00, 0x00, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+
+	.aead = false,
+
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_CIPHER_AES_CBC,
+				.key.length = 16,
+				.iv.length = 16,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.op = RTE_CRYPTO_AUTH_OP_GENERATE,
+				.algo = RTE_CRYPTO_AUTH_SHA256_HMAC,
+				.key.length = 32,
+				.digest_length = 16,
+			},
+		},
+	},
+};
+
 #endif /* TEST_CRYPTODEV_SECURITY_IPSEC_TEST_VECTORS_H_ */
-- 
2.7.4

[PATCH 03/13] test/crypto: add chained operations in combined cases

[Anoob Joseph]

Extend lookaside IPsec combined mode cases to cover chained operations
also.

Currently covering combinations of,

Ciphers,
1. AES-128-CBC

Auth,
1. NULL
2. SHA2-256 [16B ICV]

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
---
 app/test/test_cryptodev.c                | 11 +++--
 app/test/test_cryptodev_security_ipsec.c | 77 +++++++++++++++++++++++++-------
 app/test/test_cryptodev_security_ipsec.h | 36 +++++++++++++++
 3 files changed, 103 insertions(+), 21 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 3fa618d..2a7ede6 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -835,6 +835,8 @@ ipsec_proto_testsuite_setup(void)
 		ret = TEST_SKIPPED;
 	}
 
+	test_ipsec_alg_list_populate();
+
 	/*
 	 * Stop the device. Device would be started again by individual test
 	 * case setup routine.
@@ -9381,9 +9383,9 @@ test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 	    flags->sa_expiry_pkts_hard)
 		nb_pkts = IPSEC_TEST_PACKETS_MAX;
 
-	for (i = 0; i < RTE_DIM(aead_list); i++) {
-		test_ipsec_td_prepare(&aead_list[i],
-				      NULL,
+	for (i = 0; i < RTE_DIM(alg_list); i++) {
+		test_ipsec_td_prepare(alg_list[i].param1,
+				      alg_list[i].param2,
 				      flags,
 				      td_outb,
 				      nb_pkts);
@@ -9407,7 +9409,8 @@ test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 			return TEST_FAILED;
 
 		if (flags->display_alg)
-			test_ipsec_display_alg(&aead_list[i], NULL);
+			test_ipsec_display_alg(alg_list[i].param1,
+					       alg_list[i].param2);
 
 		pass_cnt++;
 	}
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 45960bf..5f67dc0 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -15,7 +15,29 @@
 
 #define IV_LEN_MAX 16
 
-extern struct ipsec_test_data pkt_aes_256_gcm;
+struct crypto_param_comb alg_list[RTE_DIM(aead_list) +
+				  (RTE_DIM(cipher_list) *
+				   RTE_DIM(auth_list))];
+
+void
+test_ipsec_alg_list_populate(void)
+{
+	unsigned long i, j, index = 0;
+
+	for (i = 0; i < RTE_DIM(aead_list); i++) {
+		alg_list[index].param1 = &aead_list[i];
+		alg_list[index].param2 = NULL;
+		index++;
+	}
+
+	for (i = 0; i < RTE_DIM(cipher_list); i++) {
+		for (j = 0; j < RTE_DIM(auth_list); j++) {
+			alg_list[index].param1 = &cipher_list[i];
+			alg_list[index].param2 = &auth_list[j];
+			index++;
+		}
+	}
+}
 
 int
 test_ipsec_sec_caps_verify(struct rte_security_ipsec_xform *ipsec_xform,
@@ -293,18 +315,31 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 
 	for (i = 0; i < nb_td; i++) {
 		td = &td_array[i];
-		/* Copy template for packet & key fields */
-		memcpy(td, &pkt_aes_256_gcm, sizeof(*td));
 
-		/* Override fields based on param */
+		/* Prepare fields based on param */
+
+		if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
+			/* Copy template for packet & key fields */
+			memcpy(td, &pkt_aes_256_gcm, sizeof(*td));
 
-		if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD)
 			td->aead = true;
-		else
+			td->xform.aead.aead.algo = param1->alg.aead;
+			td->xform.aead.aead.key.length = param1->key_length;
+		} else {
+			/* Copy template for packet & key fields */
+			memcpy(td, &pkt_aes_128_cbc_hmac_sha256, sizeof(*td));
+
 			td->aead = false;
+			td->xform.chain.cipher.cipher.algo = param1->alg.cipher;
+			td->xform.chain.cipher.cipher.key.length =
+					param1->key_length;
+			td->xform.chain.auth.auth.algo = param2->alg.auth;
+			td->xform.chain.auth.auth.key.length =
+					param2->key_length;
+			td->xform.chain.auth.auth.digest_length =
+					param2->digest_length;
 
-		td->xform.aead.aead.algo = param1->alg.aead;
-		td->xform.aead.aead.key.length = param1->key_length;
+		}
 
 		if (flags->iv_gen)
 			td->ipsec_xform.options.iv_gen_disable = 0;
@@ -324,8 +359,6 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 		}
 
 	}
-
-	RTE_SET_USED(param2);
 }
 
 void
@@ -374,12 +407,21 @@ void
 test_ipsec_display_alg(const struct crypto_param *param1,
 		       const struct crypto_param *param2)
 {
-	if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD)
-		printf("\t%s [%d]\n",
+	if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
+		printf("\t%s [%d]",
 		       rte_crypto_aead_algorithm_strings[param1->alg.aead],
-		       param1->key_length);
-
-	RTE_SET_USED(param2);
+		       param1->key_length * 8);
+	} else {
+		printf("\t%s",
+		       rte_crypto_cipher_algorithm_strings[param1->alg.cipher]);
+		if (param1->alg.cipher != RTE_CRYPTO_CIPHER_NULL)
+			printf(" [%d]", param1->key_length * 8);
+		printf(" %s",
+		       rte_crypto_auth_algorithm_strings[param2->alg.auth]);
+		if (param2->alg.auth != RTE_CRYPTO_AUTH_NULL)
+			printf(" [%dB ICV]", param2->digest_length);
+	}
+	printf("\n");
 }
 
 static int
@@ -631,8 +673,9 @@ test_ipsec_res_d_prepare(struct rte_mbuf *m, const struct ipsec_test_data *td,
 	if (res_d->aead) {
 		res_d->xform.aead.aead.op = RTE_CRYPTO_AEAD_OP_DECRYPT;
 	} else {
-		printf("Only AEAD supported\n");
-		return TEST_SKIPPED;
+		res_d->xform.chain.cipher.cipher.op =
+				RTE_CRYPTO_CIPHER_OP_DECRYPT;
+		res_d->xform.chain.auth.auth.op = RTE_CRYPTO_AUTH_OP_VERIFY;
 	}
 
 	return TEST_SUCCESS;
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 70a264a..b1f0ff8 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -71,6 +71,7 @@ struct crypto_param {
 		enum rte_crypto_aead_algorithm aead;
 	} alg;
 	uint16_t key_length;
+	uint16_t digest_length;
 };
 
 static const struct crypto_param aead_list[] = {
@@ -91,6 +92,41 @@ static const struct crypto_param aead_list[] = {
 	},
 };
 
+static const struct crypto_param cipher_list[] = {
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CBC,
+		.key_length = 16,
+	},
+};
+
+static const struct crypto_param auth_list[] = {
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_NULL,
+	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_SHA256_HMAC,
+		.key_length = 32,
+		.digest_length = 16,
+	},
+};
+
+struct crypto_param_comb {
+	const struct crypto_param *param1;
+	const struct crypto_param *param2;
+};
+
+extern struct ipsec_test_data pkt_aes_256_gcm;
+extern struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256;
+
+extern struct crypto_param_comb alg_list[RTE_DIM(aead_list) +
+					 (RTE_DIM(cipher_list) *
+					  RTE_DIM(auth_list))];
+
+void test_ipsec_alg_list_populate(void);
+
 int test_ipsec_sec_caps_verify(struct rte_security_ipsec_xform *ipsec_xform,
 			       const struct rte_security_capability *sec_cap,
 			       bool silent);
-- 
2.7.4

[PATCH 04/13] test/crypto: add IPv6 tunnel mode cases

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Add IPv6 known vector and combined mode tests.

Following modes are added:
Tunnel IPv6 in IPv6
Tunnel IPv4 in IPv4
Tunnel IPv4 in IPv6
Tunnel IPv6 in IPv4

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c                          | 102 ++++++++++-
 app/test/test_cryptodev_security_ipsec.c           |  74 +++++++-
 app/test/test_cryptodev_security_ipsec.h           |   4 +
 .../test_cryptodev_security_ipsec_test_vectors.h   | 202 +++++++++++++++++++++
 4 files changed, 378 insertions(+), 4 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 2a7ede6..f2c677d 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9125,6 +9125,10 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 			 bool silent,
 			 const struct ipsec_test_flags *flags)
 {
+	uint16_t v6_src[8] = {0x2607, 0xf8b0, 0x400c, 0x0c03, 0x0000, 0x0000,
+				0x0000, 0x001a};
+	uint16_t v6_dst[8] = {0x2001, 0x0470, 0xe5bf, 0xdead, 0x4957, 0x2174,
+				0xe82c, 0x4887};
 	struct crypto_testsuite_params *ts_params = &testsuite_params;
 	struct crypto_unittest_params *ut_params = &unittest_params;
 	struct rte_security_capability_idx sec_cap_idx;
@@ -9158,8 +9162,16 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 			dst += 1;
 	}
 
-	memcpy(&ipsec_xform.tunnel.ipv4.src_ip, &src, sizeof(src));
-	memcpy(&ipsec_xform.tunnel.ipv4.dst_ip, &dst, sizeof(dst));
+	if (td->ipsec_xform.tunnel.type ==
+			RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+		memcpy(&ipsec_xform.tunnel.ipv4.src_ip, &src, sizeof(src));
+		memcpy(&ipsec_xform.tunnel.ipv4.dst_ip, &dst, sizeof(dst));
+	} else {
+		memcpy(&ipsec_xform.tunnel.ipv6.src_addr, &v6_src,
+			sizeof(v6_src));
+		memcpy(&ipsec_xform.tunnel.ipv6.dst_addr, &v6_dst,
+			sizeof(v6_dst));
+	}
 
 	ctx = rte_cryptodev_get_sec_ctx(dev_id);
 
@@ -9555,6 +9567,58 @@ test_ipsec_proto_inner_l4_csum(const void *data __rte_unused)
 }
 
 static int
+test_ipsec_proto_tunnel_v4_in_v4(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.ipv6 = false;
+	flags.tunnel_ipv6 = false;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_tunnel_v6_in_v6(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.ipv6 = true;
+	flags.tunnel_ipv6 = true;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_tunnel_v4_in_v6(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.ipv6 = false;
+	flags.tunnel_ipv6 = true;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_tunnel_v6_in_v4(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.ipv6 = true;
+	flags.tunnel_ipv6 = false;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
 test_PDCP_PROTO_all(void)
 {
 	struct crypto_testsuite_params *ts_params = &testsuite_params;
@@ -14431,6 +14495,15 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			test_ipsec_proto_known_vec,
 			&pkt_aes_128_cbc_hmac_sha256),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv6 AES-GCM 128)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec, &pkt_aes_256_gcm_v6),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv6 AES-CBC 128 HMAC-SHA256 [16B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec,
+			&pkt_aes_128_cbc_hmac_sha256_v6),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Inbound known vector (ESP tunnel mode IPv4 AES-GCM 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_128_gcm),
@@ -14451,6 +14524,15 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb,
 			&pkt_aes_128_cbc_hmac_sha256),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv6 AES-GCM 128)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb, &pkt_aes_256_gcm_v6),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv6 AES-CBC 128 HMAC-SHA256 [16B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb,
+			&pkt_aes_128_cbc_hmac_sha256_v6),
 		TEST_CASE_NAMED_ST(
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,
@@ -14495,6 +14577,22 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Inner L4 checksum",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_inner_l4_csum),
+		TEST_CASE_NAMED_ST(
+			"Tunnel IPv4 in IPv4",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_tunnel_v4_in_v4),
+		TEST_CASE_NAMED_ST(
+			"Tunnel IPv6 in IPv6",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_tunnel_v6_in_v6),
+		TEST_CASE_NAMED_ST(
+			"Tunnel IPv4 in IPv6",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_tunnel_v4_in_v6),
+		TEST_CASE_NAMED_ST(
+			"Tunnel IPv6 in IPv4",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_tunnel_v6_in_v4),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 5f67dc0..12031d3 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -19,6 +19,40 @@ struct crypto_param_comb alg_list[RTE_DIM(aead_list) +
 				  (RTE_DIM(cipher_list) *
 				   RTE_DIM(auth_list))];
 
+static bool
+is_valid_ipv4_pkt(const struct rte_ipv4_hdr *pkt)
+{
+	/* The IP version number must be 4 */
+	if (((pkt->version_ihl) >> 4) != 4)
+		return false;
+	/*
+	 * The IP header length field must be large enough to hold the
+	 * minimum length legal IP datagram (20 bytes = 5 words).
+	 */
+	if ((pkt->version_ihl & 0xf) < 5)
+		return false;
+
+	/*
+	 * The IP total length field must be large enough to hold the IP
+	 * datagram header, whose length is specified in the IP header length
+	 * field.
+	 */
+	if (rte_cpu_to_be_16(pkt->total_length) < sizeof(struct rte_ipv4_hdr))
+		return false;
+
+	return true;
+}
+
+static bool
+is_valid_ipv6_pkt(const struct rte_ipv6_hdr *pkt)
+{
+	/* The IP version number must be 6 */
+	if ((rte_be_to_cpu_32((pkt->vtc_flow)) >> 28) != 6)
+		return false;
+
+	return true;
+}
+
 void
 test_ipsec_alg_list_populate(void)
 {
@@ -320,14 +354,22 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 
 		if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 			/* Copy template for packet & key fields */
-			memcpy(td, &pkt_aes_256_gcm, sizeof(*td));
+			if (flags->ipv6)
+				memcpy(td, &pkt_aes_256_gcm_v6, sizeof(*td));
+			else
+				memcpy(td, &pkt_aes_256_gcm, sizeof(*td));
 
 			td->aead = true;
 			td->xform.aead.aead.algo = param1->alg.aead;
 			td->xform.aead.aead.key.length = param1->key_length;
 		} else {
 			/* Copy template for packet & key fields */
-			memcpy(td, &pkt_aes_128_cbc_hmac_sha256, sizeof(*td));
+			if (flags->ipv6)
+				memcpy(td, &pkt_aes_128_cbc_hmac_sha256_v6,
+					sizeof(*td));
+			else
+				memcpy(td, &pkt_aes_128_cbc_hmac_sha256,
+					sizeof(*td));
 
 			td->aead = false;
 			td->xform.chain.cipher.cipher.algo = param1->alg.cipher;
@@ -358,6 +400,13 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 			test_ipsec_csum_init(&td->input_text.data, false, true);
 		}
 
+		if (flags->tunnel_ipv6)
+			td->ipsec_xform.tunnel.type =
+					RTE_SECURITY_IPSEC_TUNNEL_IPV6;
+		else
+			td->ipsec_xform.tunnel.type =
+					RTE_SECURITY_IPSEC_TUNNEL_IPV4;
+
 	}
 }
 
@@ -686,6 +735,7 @@ test_ipsec_post_process(struct rte_mbuf *m, const struct ipsec_test_data *td,
 			struct ipsec_test_data *res_d, bool silent,
 			const struct ipsec_test_flags *flags)
 {
+	uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *);
 	int ret;
 
 	if (flags->iv_gen &&
@@ -695,6 +745,26 @@ test_ipsec_post_process(struct rte_mbuf *m, const struct ipsec_test_data *td,
 			return ret;
 	}
 
+	if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
+		const struct rte_ipv4_hdr *iph4;
+		const struct rte_ipv6_hdr *iph6;
+
+		if (td->ipsec_xform.tunnel.type ==
+				RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+			iph4 = (const struct rte_ipv4_hdr *)output_text;
+			if (is_valid_ipv4_pkt(iph4) == false) {
+				printf("Outer header is not IPv4\n");
+				return TEST_FAILED;
+			}
+		} else {
+			iph6 = (const struct rte_ipv6_hdr *)output_text;
+			if (is_valid_ipv6_pkt(iph6) == false) {
+				printf("Outer header is not IPv6\n");
+				return TEST_FAILED;
+			}
+		}
+	}
+
 	/*
 	 * In case of known vector tests & all inbound tests, res_d provided
 	 * would be NULL and output data need to be validated against expected.
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index b1f0ff8..69e81ae 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -61,6 +61,8 @@ struct ipsec_test_flags {
 	bool udp_ports_verify;
 	bool ip_csum;
 	bool l4_csum;
+	bool ipv6;
+	bool tunnel_ipv6;
 };
 
 struct crypto_param {
@@ -119,7 +121,9 @@ struct crypto_param_comb {
 };
 
 extern struct ipsec_test_data pkt_aes_256_gcm;
+extern struct ipsec_test_data pkt_aes_256_gcm_v6;
 extern struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256;
+extern struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256_v6;
 
 extern struct crypto_param_comb alg_list[RTE_DIM(aead_list) +
 					 (RTE_DIM(cipher_list) *
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index 16c88fe..04ccbf0 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -434,6 +434,103 @@ struct ipsec_test_data pkt_aes_128_cbc_null = {
 	},
 };
 
+struct ipsec_test_data pkt_aes_256_gcm_v6 = {
+	.key = {
+		.data = {
+			0xde, 0x12, 0xbe, 0x56, 0xde, 0xad, 0xbe, 0xef,
+			0xde, 0xad, 0xbe, 0xef, 0xde, 0xad, 0xbe, 0xef,
+			0x12, 0x78, 0xbe, 0x34, 0x01, 0x02, 0x03, 0x07,
+			0xaa, 0xbb, 0xcc, 0xf1, 0x08, 0x07, 0x06, 0x05,
+		},
+	},
+	.input_text = {
+		.data = {
+			0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x38,
+			0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0c, 0x0c, 0x03,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a,
+			0x20, 0x01, 0x04, 0x70, 0xe5, 0xbf, 0xde, 0xad,
+			0x49, 0x57, 0x21, 0x74, 0xe8, 0x2c, 0x48, 0x87,
+			0x00, 0x19, 0xf9, 0xc7, 0x95, 0x63, 0x97, 0x9c,
+			0x03, 0xa0, 0x88, 0x31, 0x80, 0x12, 0xa7, 0xd6,
+			0x25, 0x83, 0x00, 0x00, 0x02, 0x04, 0x05, 0x6a,
+			0x01, 0x01, 0x04, 0x02, 0x01, 0x03, 0x03, 0x07,
+		},
+		.len = 72,
+	},
+	.output_text = {
+		.data = {
+			0x60, 0x00, 0x00, 0x00, 0x00, 0x6c, 0x32, 0x40,
+			0x12, 0x34, 0x12, 0x21, 0x17, 0x45, 0x11, 0x34,
+			0x11, 0xfc, 0x89, 0x71, 0xdf, 0x22, 0x56, 0x78,
+			0x12, 0x34, 0x12, 0x21, 0x17, 0x45, 0x11, 0x34,
+			0x11, 0xfc, 0x89, 0x71, 0xdf, 0x22, 0x34, 0x56,
+			0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x01,
+			0x45, 0xad, 0xfe, 0x23, 0x78, 0x56, 0x12, 0x00,
+			0xe7, 0xdf, 0xc4, 0x7e, 0x21, 0xbd, 0xec, 0x1b,
+			0x74, 0x5a, 0xe4, 0x7e, 0x2e, 0x94, 0x21, 0x0a,
+			0x9b, 0x0e, 0x59, 0xbe, 0x06, 0x2a, 0xda, 0xb8,
+			0x6b, 0x48, 0x7f, 0x0b, 0x88, 0x3a, 0xa9, 0xfd,
+			0x3c, 0xfe, 0x9f, 0xb1, 0x8c, 0x67, 0xd2, 0xf8,
+			0xaf, 0xb5, 0xad, 0x16, 0xdb, 0xff, 0x8d, 0x50,
+			0xd3, 0x48, 0xf5, 0x6c, 0x3c, 0x0c, 0x27, 0x34,
+			0x2b, 0x65, 0xc8, 0xff, 0xeb, 0x5f, 0xb8, 0xff,
+			0x12, 0x00, 0x1c, 0x9f, 0xb7, 0x85, 0xdd, 0x7d,
+			0x40, 0x19, 0xcb, 0x18, 0xeb, 0x15, 0xc4, 0x88,
+			0xe1, 0xc2, 0x91, 0xc7, 0xb1, 0x65, 0xc3, 0x27,
+			0x16, 0x06, 0x8f, 0xf2,
+		},
+		.len = 148,
+	},
+	.salt = {
+		.data = {
+			0x11, 0x22, 0x33, 0x44
+		},
+		.len = 4,
+	},
+
+	.iv = {
+		.data = {
+			0x45, 0xad, 0xfe, 0x23, 0x78, 0x56, 0x12, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV6,
+		.replay_win_sz = 0,
+	},
+
+	.aead = true,
+
+	.xform = {
+		.aead = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AEAD,
+			.aead = {
+				.op = RTE_CRYPTO_AEAD_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_AEAD_AES_GCM,
+				.key.length = 32,
+				.iv.length = 12,
+				.iv.offset = IV_OFFSET,
+				.digest_length = 16,
+				.aad_length = 12,
+			},
+		},
+	},
+};
+
 struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256 = {
 	.key = {
 		.data = {
@@ -543,4 +640,109 @@ struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256 = {
 	},
 };
 
+struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256_v6 = {
+	.key = {
+		.data = {
+			0x00, 0x04, 0x05, 0x01, 0x23, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x0a, 0x0b, 0x0c, 0x0f, 0x00, 0x00,
+		},
+	},
+	.auth_key = {
+		.data = {
+			0xde, 0x34, 0x56, 0x00, 0x00, 0x00, 0x78, 0x00,
+			0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x04,
+			0x0a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+		},
+	},
+	.input_text = {
+		.data = {
+			0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x38,
+			0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0c, 0x0c, 0x03,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a,
+			0x20, 0x01, 0x04, 0x70, 0xe5, 0xbf, 0xde, 0xad,
+			0x49, 0x57, 0x21, 0x74, 0xe8, 0x2c, 0x48, 0x87,
+			0x00, 0x19, 0xf9, 0xc7, 0x95, 0x63, 0x97, 0x9c,
+			0x03, 0xa0, 0x88, 0x31, 0x80, 0x12, 0xa7, 0xd6,
+			0x25, 0x83, 0x00, 0x00, 0x02, 0x04, 0x05, 0x6a,
+			0x01, 0x01, 0x04, 0x02, 0x01, 0x03, 0x03, 0x07,
+		},
+		.len = 72,
+	},
+	.output_text = {
+		.data = {
+			0x60, 0x00, 0x00, 0x00, 0x00, 0x78, 0x32, 0x40,
+			0x12, 0x34, 0x12, 0x21, 0x17, 0x45, 0x11, 0x34,
+			0x11, 0xfc, 0x89, 0x71, 0xdf, 0x22, 0x56, 0x78,
+			0x12, 0x34, 0x12, 0x21, 0x17, 0x45, 0x11, 0x34,
+			0x11, 0xfc, 0x89, 0x71, 0xdf, 0x22, 0x34, 0x56,
+			0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x01,
+			0x45, 0xad, 0xfe, 0x23, 0x78, 0x56, 0x12, 0x00,
+			0xf0, 0xc1, 0x05, 0x3c, 0x00, 0x00, 0x00, 0x00,
+			0x1b, 0x1c, 0x98, 0x6e, 0x2a, 0xce, 0x61, 0xef,
+			0xc1, 0xdd, 0x25, 0x96, 0x5c, 0xb1, 0xb0, 0x15,
+			0x47, 0x25, 0xb7, 0x8b, 0x00, 0xb6, 0xbb, 0xe6,
+			0x2e, 0x29, 0xcb, 0x4a, 0x94, 0x00, 0xf0, 0x73,
+			0xdb, 0x14, 0x32, 0xd9, 0xa2, 0xdf, 0x22, 0x2f,
+			0x52, 0x3e, 0x79, 0x77, 0xf3, 0x17, 0xaa, 0x40,
+			0x1c, 0x57, 0x27, 0x12, 0x82, 0x44, 0x35, 0xb8,
+			0x64, 0xe0, 0xaa, 0x5c, 0x10, 0xc7, 0x97, 0x35,
+			0x9c, 0x6b, 0x1c, 0xf7, 0xe7, 0xbd, 0x83, 0x33,
+			0x77, 0x48, 0x44, 0x7d, 0xa4, 0x13, 0x74, 0x3b,
+			0x6a, 0x91, 0xd0, 0xd8, 0x7d, 0x41, 0x45, 0x23,
+			0x5d, 0xc9, 0x2d, 0x08, 0x7a, 0xd8, 0x25, 0x8e,
+		},
+		.len = 160,
+	},
+	.iv = {
+		.data = {
+			0x45, 0xad, 0xfe, 0x23, 0x78, 0x56, 0x12, 0x00,
+			0xf0, 0xc1, 0x05, 0x3c, 0x00, 0x00, 0x00, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV6,
+		.replay_win_sz = 0,
+	},
+
+	.aead = false,
+
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_CIPHER_AES_CBC,
+				.key.length = 16,
+				.iv.length = 16,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.op = RTE_CRYPTO_AUTH_OP_GENERATE,
+				.algo = RTE_CRYPTO_AUTH_SHA256_HMAC,
+				.key.length = 32,
+				.digest_length = 16,
+			},
+		},
+	},
+};
+
 #endif /* TEST_CRYPTODEV_SECURITY_IPSEC_TEST_VECTORS_H_ */
-- 
2.7.4

[PATCH 05/13] test/crypto: add IPsec HMAC-SHA384/512 known vectors

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Add lookaside IPsec HMAC-SHA384/512 known vectors.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c                          |  20 ++
 app/test/test_cryptodev_security_ipsec.h           |  14 +-
 .../test_cryptodev_security_ipsec_test_vectors.h   | 213 +++++++++++++++++++++
 3 files changed, 246 insertions(+), 1 deletion(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index f2c677d..cb335fc 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -14495,6 +14495,16 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			test_ipsec_proto_known_vec,
 			&pkt_aes_128_cbc_hmac_sha256),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA384 [24B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec,
+			&pkt_aes_128_cbc_hmac_sha384),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA512 [32B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec,
+			&pkt_aes_128_cbc_hmac_sha512),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Outbound known vector (ESP tunnel mode IPv6 AES-GCM 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec, &pkt_aes_256_gcm_v6),
@@ -14525,6 +14535,16 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			test_ipsec_proto_known_vec_inb,
 			&pkt_aes_128_cbc_hmac_sha256),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA384 [24B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb,
+			&pkt_aes_128_cbc_hmac_sha384),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA512 [32B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb,
+			&pkt_aes_128_cbc_hmac_sha512),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Inbound known vector (ESP tunnel mode IPv6 AES-GCM 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_256_gcm_v6),
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 69e81ae..d74eee7 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -15,7 +15,7 @@ struct ipsec_test_data {
 		uint8_t data[32];
 	} key;
 	struct {
-		uint8_t data[32];
+		uint8_t data[64];
 	} auth_key;
 
 	struct {
@@ -113,6 +113,18 @@ static const struct crypto_param auth_list[] = {
 		.key_length = 32,
 		.digest_length = 16,
 	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_SHA384_HMAC,
+		.key_length = 48,
+		.digest_length = 24,
+	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_SHA512_HMAC,
+		.key_length = 64,
+		.digest_length = 32,
+	},
 };
 
 struct crypto_param_comb {
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index 04ccbf0..b8661f7 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -640,6 +640,219 @@ struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256 = {
 	},
 };
 
+struct ipsec_test_data pkt_aes_128_cbc_hmac_sha384 = {
+	.key = {
+		.data = {
+			0x00, 0x04, 0x05, 0x01, 0x23, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x0a, 0x0b, 0x0c, 0x0f, 0x00, 0x00,
+		},
+	},
+	.auth_key = {
+		.data = {
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x04,
+			0x0a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+			0xde, 0x34, 0x56, 0x00, 0x00, 0x00, 0x78, 0x00,
+			0x00, 0x10, 0x00, 0x00, 0x00, 0x10, 0x00, 0x02,
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x34,
+			0x1a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+		},
+	},
+	.input_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x32, 0x00, 0x01, 0x00, 0x00,
+			0x1f, 0x11, 0x17, 0x8b, 0xc0, 0xa8, 0x01, 0x6f,
+			0xc0, 0xa8, 0x01, 0x70,
+
+			/* UDP */
+			0x00, 0x09, 0x00, 0x09, 0x00, 0x1e, 0x00, 0x00,
+			0xbe, 0x9b, 0xe9, 0x55, 0x00, 0x00, 0x00, 0x21,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		},
+		.len = 50,
+	},
+	.output_text = {
+		.data = {
+			0x45, 0x00, 0x00, 0x84, 0x00, 0x01, 0x00, 0x00,
+			0x40, 0x32, 0x52, 0x45, 0x14, 0x00, 0x00, 0x01,
+			0x14, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x34,
+			0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x44, 0x24, 0xb9, 0xd8,
+			0x0f, 0xbe, 0xa3, 0x3f, 0xc9, 0xc0, 0xa2, 0xcb,
+			0xaa, 0xda, 0x3f, 0xc6, 0x0e, 0x88, 0x75, 0x96,
+			0x25, 0x50, 0x07, 0x4d, 0x52, 0xf4, 0x75, 0xec,
+			0xd8, 0xcd, 0xe4, 0xcf, 0x85, 0x9a, 0xbc, 0x9e,
+			0x84, 0x0f, 0xbb, 0x83, 0x72, 0x0c, 0x7f, 0x58,
+			0x02, 0x46, 0xeb, 0x86, 0x6e, 0xd1, 0xcf, 0x05,
+			0x6a, 0xd1, 0xd2, 0xc6, 0xb5, 0x94, 0x09, 0x0a,
+			0x3e, 0xdf, 0x09, 0xfb, 0x0a, 0xb7, 0xb4, 0x97,
+			0x17, 0xf2, 0x20, 0xaf, 0xfa, 0x90, 0x92, 0x4d,
+			0xe4, 0x0e, 0xef, 0x5a, 0xe8, 0x43, 0x46, 0xa8,
+			0x5e, 0x3f, 0x52, 0x46,
+		},
+		.len = 132,
+	},
+	.iv = {
+		.data = {
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+
+	.aead = false,
+
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_CIPHER_AES_CBC,
+				.key.length = 16,
+				.iv.length = 16,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.op = RTE_CRYPTO_AUTH_OP_GENERATE,
+				.algo = RTE_CRYPTO_AUTH_SHA384_HMAC,
+				.key.length = 48,
+				.digest_length = 24,
+			},
+		},
+	},
+};
+
+struct ipsec_test_data pkt_aes_128_cbc_hmac_sha512 = {
+	.key = {
+		.data = {
+			0x00, 0x04, 0x05, 0x01, 0x23, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x0a, 0x0b, 0x0c, 0x0f, 0x00, 0x00,
+		},
+	},
+	.auth_key = {
+		.data = {
+			0xde, 0x34, 0x56, 0x00, 0x00, 0x00, 0x78, 0x00,
+			0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x04,
+			0x0a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+			0xde, 0x34, 0x56, 0x00, 0x00, 0x00, 0x78, 0x00,
+			0x00, 0x10, 0x00, 0x00, 0x00, 0x10, 0x00, 0x02,
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x34,
+			0x1a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+		},
+	},
+	.input_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x32, 0x00, 0x01, 0x00, 0x00,
+			0x1f, 0x11, 0x17, 0x8b, 0xc0, 0xa8, 0x01, 0x6f,
+			0xc0, 0xa8, 0x01, 0x70,
+
+			/* UDP */
+			0x00, 0x09, 0x00, 0x09, 0x00, 0x1e, 0x00, 0x00,
+			0xbe, 0x9b, 0xe9, 0x55, 0x00, 0x00, 0x00, 0x21,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		},
+		.len = 50,
+	},
+	.output_text = {
+		.data = {
+			0x45, 0x00, 0x00, 0x8c, 0x00, 0x01, 0x00, 0x00,
+			0x40, 0x32, 0x52, 0x3d, 0x14, 0x00, 0x00, 0x01,
+			0x14, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x34,
+			0x00, 0x00, 0x00, 0x01, 0x42, 0x32, 0x76, 0x65,
+			0x45, 0x35, 0x24, 0x41, 0xf0, 0xc1, 0xb4, 0x40,
+			0x00, 0x00, 0x00, 0x00, 0xd0, 0x32, 0x23, 0xf7,
+			0xcd, 0x3d, 0xdb, 0xd5, 0x70, 0x19, 0x1b, 0xf5,
+			0x8f, 0xeb, 0x98, 0x3d, 0x41, 0x5c, 0x28, 0xdd,
+			0xfd, 0xcc, 0xdd, 0xa2, 0xeb, 0x43, 0x4c, 0x13,
+			0x2d, 0xa1, 0x98, 0x87, 0x92, 0x3a, 0x1f, 0x67,
+			0x20, 0x8d, 0x9e, 0x8e, 0x51, 0x21, 0x4c, 0xa9,
+			0xff, 0xad, 0xfb, 0x5d, 0x57, 0xa3, 0x16, 0x91,
+			0xaa, 0x75, 0xc7, 0x28, 0x42, 0x4e, 0x8f, 0x8e,
+			0x84, 0x37, 0x94, 0x09, 0x74, 0xfa, 0x70, 0x0d,
+			0xd1, 0x37, 0xe2, 0x7c, 0x54, 0xdd, 0x2e, 0xb4,
+			0xf4, 0x54, 0x4b, 0x12, 0xe0, 0xaf, 0x4a, 0x0a,
+			0x0b, 0x52, 0x57, 0x9d, 0x36, 0xdc, 0xac, 0x02,
+			0xfb, 0x55, 0x34, 0x05,
+		},
+		.len = 140,
+	},
+	.iv = {
+		.data = {
+			0x42, 0x32, 0x76, 0x65, 0x45, 0x35, 0x24, 0x41,
+			0xf0, 0xc1, 0xb4, 0x40, 0x00, 0x00, 0x00, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+
+	.aead = false,
+
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_CIPHER_AES_CBC,
+				.key.length = 16,
+				.iv.length = 16,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.op = RTE_CRYPTO_AUTH_OP_GENERATE,
+				.algo = RTE_CRYPTO_AUTH_SHA512_HMAC,
+				.key.length = 64,
+				.digest_length = 32,
+			},
+		},
+	},
+};
+
 struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256_v6 = {
 	.key = {
 		.data = {
-- 
2.7.4

[PATCH 06/13] test/crypto: add IPsec fragmented packet known vectors

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Add fragmented plain packet known vector test case in
IPsec outbound.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c                          |  22 +++++
 app/test/test_cryptodev_security_ipsec.c           |  10 ++
 app/test/test_cryptodev_security_ipsec.h           |   1 +
 .../test_cryptodev_security_ipsec_test_vectors.h   | 104 +++++++++++++++++++++
 4 files changed, 137 insertions(+)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index cb335fc..1315687 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9383,6 +9383,23 @@ test_ipsec_proto_known_vec_inb(const void *test_data)
 }
 
 static int
+test_ipsec_proto_known_vec_fragmented(const void *test_data)
+{
+	struct ipsec_test_data td_outb;
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+	flags.fragment = true;
+
+	memcpy(&td_outb, test_data, sizeof(td_outb));
+
+	/* Disable IV gen to be able to test with known vectors */
+	td_outb.ipsec_xform.options.iv_gen_disable = 1;
+
+	return test_ipsec_proto_process(&td_outb, NULL, 1, false, &flags);
+}
+
+static int
 test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 {
 	struct ipsec_test_data td_outb[IPSEC_TEST_PACKETS_MAX];
@@ -14514,6 +14531,11 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			test_ipsec_proto_known_vec,
 			&pkt_aes_128_cbc_hmac_sha256_v6),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound fragmented packet",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_fragmented,
+			&pkt_aes_128_gcm_frag),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Inbound known vector (ESP tunnel mode IPv4 AES-GCM 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_128_gcm),
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 12031d3..ccce63f 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -659,6 +659,16 @@ test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td,
 		return TEST_FAILED;
 	}
 
+	if ((td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) &&
+				flags->fragment) {
+		const struct rte_ipv4_hdr *iph4;
+		iph4 = (const struct rte_ipv4_hdr *)output_text;
+		if (iph4->fragment_offset) {
+			printf("Output packet is fragmented");
+			return TEST_FAILED;
+		}
+	}
+
 	skip = test_ipsec_tunnel_hdr_len_get(td);
 
 	len -= skip;
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index d74eee7..884a795 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -63,6 +63,7 @@ struct ipsec_test_flags {
 	bool l4_csum;
 	bool ipv6;
 	bool tunnel_ipv6;
+	bool fragment;
 };
 
 struct crypto_param {
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index b8661f7..b6d48ad 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -958,4 +958,108 @@ struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256_v6 = {
 	},
 };
 
+struct ipsec_test_data pkt_aes_128_gcm_frag = {
+	.key = {
+		.data = {
+			0xde, 0xad, 0xbe, 0xef, 0xde, 0xad, 0xbe, 0xef,
+			0xde, 0xad, 0xbe, 0xef, 0xde, 0xad, 0xbe, 0xef,
+		},
+	},
+	.input_text = {
+		.data = {
+			0x45, 0x00, 0x00, 0x6e, 0x00, 0x01, 0x00, 0x17,
+			0x40, 0x06, 0xed, 0x48, 0xc6, 0x12, 0x00, 0x00,
+			0xc6, 0x12, 0x01, 0x05, 0x00, 0x14, 0x00, 0x50,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x50, 0x00, 0x00, 0x00, 0x55, 0x05, 0x00, 0x00,
+			0x00, 0x01, 0x02, 0x03, 0xf2, 0xf6, 0xe9, 0x21,
+			0xf9, 0xf2, 0xf6, 0xe9, 0x21, 0xf9, 0xf2, 0xf6,
+			0xe9, 0x21, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		},
+		.len = 110,
+	},
+	.output_text = {
+		.data = {
+			0x45, 0x00, 0x00, 0xa4, 0x00, 0x01, 0x00, 0x00,
+			0x40, 0x32, 0xf6, 0x0c, 0xc0, 0xa8, 0x01, 0x70,
+			0xc0, 0xa8, 0x01, 0x5a, 0x00, 0x00, 0x00, 0x34,
+			0x00, 0x00, 0x00, 0x01, 0x45, 0xad, 0xfe, 0x23,
+			0x78, 0x56, 0x12, 0x00, 0x49, 0x26, 0xac, 0x4e,
+			0x8d, 0xf3, 0x74, 0x26, 0x18, 0x3f, 0x65, 0x94,
+			0x73, 0x2e, 0xe4, 0xcf, 0x84, 0x6d, 0x03, 0x8a,
+			0x4c, 0xdd, 0x2d, 0xef, 0xcd, 0x9f, 0x84, 0x76,
+			0x93, 0xe1, 0xee, 0x21, 0x92, 0x8b, 0xf7, 0x7a,
+			0xb1, 0x6a, 0x7f, 0xd6, 0x10, 0x66, 0xdd, 0xa1,
+			0x8b, 0x17, 0x56, 0x99, 0x9a, 0x40, 0xd0, 0x6b,
+			0x2d, 0xe0, 0x55, 0x40, 0x2f, 0xb8, 0x38, 0xe3,
+			0x08, 0x46, 0xe2, 0x69, 0xc9, 0xa1, 0x85, 0x9d,
+			0x7b, 0xec, 0x33, 0x2a, 0x2d, 0x1d, 0x1f, 0x1a,
+			0x9e, 0xf0, 0x1e, 0xc3, 0x33, 0x64, 0x35, 0x82,
+			0xbb, 0xb5, 0x7a, 0x91, 0x2e, 0x8d, 0xd5, 0x5b,
+			0x3a, 0xbe, 0x95, 0x94, 0xba, 0x40, 0x73, 0x4e,
+			0xa4, 0x15, 0xe4, 0x4a, 0xf9, 0x14, 0x2c, 0x4f,
+			0x63, 0x2e, 0x23, 0x6e, 0xeb, 0x06, 0xe7, 0x52,
+			0xe1, 0xc7, 0x91, 0x7f, 0x19, 0xc0, 0x4a, 0xd2,
+			0xd5, 0x3e, 0x84, 0xa8,
+		},
+		.len = 164,
+	},
+	.salt = {
+		.data = {
+			0xde, 0xad, 0xbe, 0xef,
+		},
+		.len = 4,
+	},
+
+	.iv = {
+		.data = {
+			0x45, 0xad, 0xfe, 0x23, 0x78, 0x56, 0x12, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.options.ip_csum_enable = 0,
+		.options.l4_csum_enable = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+
+	.aead = true,
+
+	.xform = {
+		.aead = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AEAD,
+			.aead = {
+				.op = RTE_CRYPTO_AEAD_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_AEAD_AES_GCM,
+				.key.length = 16,
+				.iv.length = 12,
+				.iv.offset = IV_OFFSET,
+				.digest_length = 16,
+				.aad_length = 12,
+			},
+		},
+	},
+};
+
 #endif /* TEST_CRYPTODEV_SECURITY_IPSEC_TEST_VECTORS_H_ */
-- 
2.7.4

[PATCH 07/13] test/crypto: add transport mode cases

[Anoob Joseph]

Add transport mode tests with test cases for IPv4 packets.


Signed-off-by: Anoob Joseph <anoobj@marvell.com>
---
 app/test/test_cryptodev.c                | 39 ++++++++++++++----
 app/test/test_cryptodev_security_ipsec.c | 71 +++++++++++++++++++++-----------
 app/test/test_cryptodev_security_ipsec.h |  1 +
 3 files changed, 79 insertions(+), 32 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 1315687..f8f2660 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9162,15 +9162,19 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 			dst += 1;
 	}
 
-	if (td->ipsec_xform.tunnel.type ==
-			RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
-		memcpy(&ipsec_xform.tunnel.ipv4.src_ip, &src, sizeof(src));
-		memcpy(&ipsec_xform.tunnel.ipv4.dst_ip, &dst, sizeof(dst));
-	} else {
-		memcpy(&ipsec_xform.tunnel.ipv6.src_addr, &v6_src,
-			sizeof(v6_src));
-		memcpy(&ipsec_xform.tunnel.ipv6.dst_addr, &v6_dst,
-			sizeof(v6_dst));
+	if (td->ipsec_xform.mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
+		if (td->ipsec_xform.tunnel.type ==
+				RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+			memcpy(&ipsec_xform.tunnel.ipv4.src_ip, &src,
+			       sizeof(src));
+			memcpy(&ipsec_xform.tunnel.ipv4.dst_ip, &dst,
+			       sizeof(dst));
+		} else {
+			memcpy(&ipsec_xform.tunnel.ipv6.src_addr, &v6_src,
+			       sizeof(v6_src));
+			memcpy(&ipsec_xform.tunnel.ipv6.dst_addr, &v6_dst,
+			       sizeof(v6_dst));
+		}
 	}
 
 	ctx = rte_cryptodev_get_sec_ctx(dev_id);
@@ -9636,6 +9640,19 @@ test_ipsec_proto_tunnel_v6_in_v4(const void *data __rte_unused)
 }
 
 static int
+test_ipsec_proto_transport_v4(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.ipv6 = false;
+	flags.transport = true;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
 test_PDCP_PROTO_all(void)
 {
 	struct crypto_testsuite_params *ts_params = &testsuite_params;
@@ -14635,6 +14652,10 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Tunnel IPv6 in IPv4",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_tunnel_v6_in_v4),
+		TEST_CASE_NAMED_ST(
+			"Transport IPv4",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_transport_v4),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index ccce63f..029fdd3 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -400,12 +400,21 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 			test_ipsec_csum_init(&td->input_text.data, false, true);
 		}
 
-		if (flags->tunnel_ipv6)
-			td->ipsec_xform.tunnel.type =
-					RTE_SECURITY_IPSEC_TUNNEL_IPV6;
-		else
-			td->ipsec_xform.tunnel.type =
-					RTE_SECURITY_IPSEC_TUNNEL_IPV4;
+		if (flags->transport) {
+			td->ipsec_xform.mode =
+					RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT;
+		} else {
+			td->ipsec_xform.mode =
+					RTE_SECURITY_IPSEC_SA_MODE_TUNNEL;
+
+			if (flags->tunnel_ipv6)
+				td->ipsec_xform.tunnel.type =
+						RTE_SECURITY_IPSEC_TUNNEL_IPV6;
+			else
+				td->ipsec_xform.tunnel.type =
+						RTE_SECURITY_IPSEC_TUNNEL_IPV4;
+		}
+
 
 	}
 }
@@ -748,29 +757,45 @@ test_ipsec_post_process(struct rte_mbuf *m, const struct ipsec_test_data *td,
 	uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *);
 	int ret;
 
-	if (flags->iv_gen &&
-	    td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
-		ret = test_ipsec_iv_verify_push(m, td);
-		if (ret != TEST_SUCCESS)
-			return ret;
-	}
-
 	if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
 		const struct rte_ipv4_hdr *iph4;
 		const struct rte_ipv6_hdr *iph6;
 
-		if (td->ipsec_xform.tunnel.type ==
-				RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
-			iph4 = (const struct rte_ipv4_hdr *)output_text;
-			if (is_valid_ipv4_pkt(iph4) == false) {
-				printf("Outer header is not IPv4\n");
-				return TEST_FAILED;
+		if (flags->iv_gen) {
+			ret = test_ipsec_iv_verify_push(m, td);
+			if (ret != TEST_SUCCESS)
+				return ret;
+		}
+
+		iph4 = (const struct rte_ipv4_hdr *)output_text;
+
+		if (td->ipsec_xform.mode ==
+				RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT) {
+			if (flags->ipv6) {
+				iph6 = (const struct rte_ipv6_hdr *)output_text;
+				if (is_valid_ipv6_pkt(iph6) == false) {
+					printf("Transport packet is not IPv6\n");
+					return TEST_FAILED;
+				}
+			} else {
+				if (is_valid_ipv4_pkt(iph4) == false) {
+					printf("Transport packet is not IPv4\n");
+					return TEST_FAILED;
+				}
 			}
 		} else {
-			iph6 = (const struct rte_ipv6_hdr *)output_text;
-			if (is_valid_ipv6_pkt(iph6) == false) {
-				printf("Outer header is not IPv6\n");
-				return TEST_FAILED;
+			if (td->ipsec_xform.tunnel.type ==
+					RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+				if (is_valid_ipv4_pkt(iph4) == false) {
+					printf("Tunnel outer header is not IPv4\n");
+					return TEST_FAILED;
+				}
+			} else {
+				iph6 = (const struct rte_ipv6_hdr *)output_text;
+				if (is_valid_ipv6_pkt(iph6) == false) {
+					printf("Tunnel outer header is not IPv6\n");
+					return TEST_FAILED;
+				}
 			}
 		}
 	}
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 884a795..07d2453 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -63,6 +63,7 @@ struct ipsec_test_flags {
 	bool l4_csum;
 	bool ipv6;
 	bool tunnel_ipv6;
+	bool transport;
 	bool fragment;
 };
 
-- 
2.7.4

[PATCH 08/13] test/crypto: add security stats cases

[Anoob Joseph]

From: Ankur Dwivedi <adwivedi@marvell.com>

Adds security stats test cases in IPSEC protocol testsuite.

Signed-off-by: Ankur Dwivedi <adwivedi@marvell.com>
---
 app/test/test_cryptodev.c                | 21 +++++++++++++++++++++
 app/test/test_cryptodev_security_ipsec.c | 29 +++++++++++++++++++++++++++++
 app/test/test_cryptodev_security_ipsec.h |  6 ++++++
 3 files changed, 56 insertions(+)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index f8f2660..34bc3e0 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9332,6 +9332,11 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 		if (ret != TEST_SUCCESS)
 			goto crypto_op_free;
 
+		ret = test_ipsec_stats_verify(ctx, ut_params->sec_session,
+					      flags, dir);
+		if (ret != TEST_SUCCESS)
+			goto crypto_op_free;
+
 		rte_crypto_op_free(ut_params->op);
 		ut_params->op = NULL;
 
@@ -9653,6 +9658,18 @@ test_ipsec_proto_transport_v4(const void *data __rte_unused)
 }
 
 static int
+test_ipsec_proto_stats(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.stats_success = true;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
 test_PDCP_PROTO_all(void)
 {
 	struct crypto_testsuite_params *ts_params = &testsuite_params;
@@ -14656,6 +14673,10 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Transport IPv4",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_transport_v4),
+		TEST_CASE_NAMED_ST(
+			"Statistics: success",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_stats),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 029fdd3..6fa1d3d 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -415,6 +415,8 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 						RTE_SECURITY_IPSEC_TUNNEL_IPV4;
 		}
 
+		if (flags->stats_success)
+			td->ipsec_xform.options.stats = 1;
 
 	}
 }
@@ -871,3 +873,30 @@ test_ipsec_status_check(struct rte_crypto_op *op,
 
 	return ret;
 }
+
+int
+test_ipsec_stats_verify(struct rte_security_ctx *ctx,
+			struct rte_security_session *sess,
+			const struct ipsec_test_flags *flags,
+			enum rte_security_ipsec_sa_direction dir)
+{
+	struct rte_security_stats stats = {0};
+	int ret = TEST_SUCCESS;
+
+	if (flags->stats_success) {
+		if (rte_security_session_stats_get(ctx, sess, &stats) < 0)
+			return TEST_FAILED;
+
+		if (dir == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
+			if (stats.ipsec.opackets != 1 ||
+			    stats.ipsec.oerrors != 0)
+				ret = TEST_FAILED;
+		} else {
+			if (stats.ipsec.ipackets != 1 ||
+			    stats.ipsec.ierrors != 0)
+				ret = TEST_FAILED;
+		}
+	}
+
+	return ret;
+}
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 07d2453..3565a8c 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -65,6 +65,7 @@ struct ipsec_test_flags {
 	bool tunnel_ipv6;
 	bool transport;
 	bool fragment;
+	bool stats_success;
 };
 
 struct crypto_param {
@@ -188,4 +189,9 @@ int test_ipsec_status_check(struct rte_crypto_op *op,
 			    enum rte_security_ipsec_sa_direction dir,
 			    int pkt_num);
 
+int test_ipsec_stats_verify(struct rte_security_ctx *ctx,
+			    struct rte_security_session *sess,
+			    const struct ipsec_test_flags *flags,
+			    enum rte_security_ipsec_sa_direction dir);
+
 #endif
-- 
2.7.4

[PATCH 09/13] test/crypto: add lookaside IPsec AES-CTR known vectors

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Add known vectors for AES-CTR in lookaside IPsec mode.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev_security_ipsec.h | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 3565a8c..3376d08 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -103,6 +103,21 @@ static const struct crypto_param cipher_list[] = {
 		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CBC,
 		.key_length = 16,
 	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
+		.key_length = 16,
+	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
+		.key_length = 24,
+	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
+		.key_length = 32,
+	},
 };
 
 static const struct crypto_param auth_list[] = {
-- 
2.7.4

[PATCH 10/13] test/crypto: add fragmented packet case

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Add fragmented plain packet test case in combined mode.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c                | 16 ++++++++++++++++
 app/test/test_cryptodev_security_ipsec.c |  7 +++++++
 2 files changed, 23 insertions(+)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 34bc3e0..744eb9f 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9670,6 +9670,18 @@ test_ipsec_proto_stats(const void *data __rte_unused)
 }
 
 static int
+test_ipsec_proto_pkt_fragment(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.fragment = true;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
 test_PDCP_PROTO_all(void)
 {
 	struct crypto_testsuite_params *ts_params = &testsuite_params;
@@ -14677,6 +14689,10 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Statistics: success",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_stats),
+		TEST_CASE_NAMED_ST(
+			"Fragmented packet",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_pkt_fragment),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 6fa1d3d..832f9d8 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -418,6 +418,13 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 		if (flags->stats_success)
 			td->ipsec_xform.options.stats = 1;
 
+		if (flags->fragment) {
+			struct rte_ipv4_hdr *ip;
+			ip = (struct rte_ipv4_hdr *)&td->input_text.data;
+			ip->fragment_offset = 4;
+			ip->hdr_checksum = rte_ipv4_cksum(ip);
+		}
+
 	}
 }
 
-- 
2.7.4

[PATCH 11/13] test/crypto: skip null auth in ICV corrupt case

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Skipping NULL auth in ICV corruption test case.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 744eb9f..0f7885c 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9428,6 +9428,11 @@ test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 				      td_outb,
 				      nb_pkts);
 
+		if (flags->icv_corrupt && (td_outb->aead == false) &&
+		    (td_outb->xform.chain.auth.auth.algo ==
+		     RTE_CRYPTO_AUTH_NULL))
+			continue;
+
 		ret = test_ipsec_proto_process(td_outb, td_inb, nb_pkts, true,
 					       flags);
 		if (ret == TEST_SKIPPED)
-- 
2.7.4

[PATCH 12/13] test/crypto: add aes xcbc known vectors

[Anoob Joseph]

Add known vector test cases for NULL cipher + AES-XCBC. Also add both
algos to the combined mode list of algos.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
---
 app/test/test_cryptodev.c                          | 38 +++++++--
 app/test/test_cryptodev_security_ipsec.c           |  2 +
 app/test/test_cryptodev_security_ipsec.h           | 17 ++++
 .../test_cryptodev_security_ipsec_test_vectors.h   | 90 ++++++++++++++++++++++
 4 files changed, 141 insertions(+), 6 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 0f7885c..aa85a19 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9368,8 +9368,11 @@ test_ipsec_proto_known_vec(const void *test_data)
 
 	memcpy(&td_outb, test_data, sizeof(td_outb));
 
-	/* Disable IV gen to be able to test with known vectors */
-	td_outb.ipsec_xform.options.iv_gen_disable = 1;
+	if (td_outb.aead ||
+	    td_outb.xform.chain.cipher.cipher.algo != RTE_CRYPTO_CIPHER_NULL) {
+		/* Disable IV gen to be able to test with known vectors */
+		td_outb.ipsec_xform.options.iv_gen_disable = 1;
+	}
 
 	return test_ipsec_proto_process(&td_outb, NULL, 1, false, &flags);
 }
@@ -9428,10 +9431,23 @@ test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 				      td_outb,
 				      nb_pkts);
 
-		if (flags->icv_corrupt && (td_outb->aead == false) &&
-		    (td_outb->xform.chain.auth.auth.algo ==
-		     RTE_CRYPTO_AUTH_NULL))
-			continue;
+		if (!td_outb->aead) {
+			enum rte_crypto_cipher_algorithm cipher_alg;
+			enum rte_crypto_auth_algorithm auth_alg;
+
+			cipher_alg = td_outb->xform.chain.cipher.cipher.algo;
+			auth_alg = td_outb->xform.chain.auth.auth.algo;
+
+			/* ICV is not applicable for NULL auth */
+			if (flags->icv_corrupt &&
+			    auth_alg == RTE_CRYPTO_AUTH_NULL)
+				continue;
+
+			/* IV is not applicable for NULL cipher */
+			if (flags->iv_gen &&
+			    cipher_alg == RTE_CRYPTO_CIPHER_NULL)
+				continue;
+		}
 
 		ret = test_ipsec_proto_process(td_outb, td_inb, nb_pkts, true,
 					       flags);
@@ -14582,6 +14598,11 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			test_ipsec_proto_known_vec,
 			&pkt_aes_128_cbc_hmac_sha256_v6),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv4 NULL AES-XCBC-MAC [12B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec,
+			&pkt_null_aes_xcbc),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Outbound fragmented packet",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_fragmented,
@@ -14626,6 +14647,11 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb,
 			&pkt_aes_128_cbc_hmac_sha256_v6),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv4 NULL AES-XCBC-MAC [12B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb,
+			&pkt_null_aes_xcbc),
 		TEST_CASE_NAMED_ST(
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 832f9d8..94e5213 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -375,6 +375,8 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 			td->xform.chain.cipher.cipher.algo = param1->alg.cipher;
 			td->xform.chain.cipher.cipher.key.length =
 					param1->key_length;
+			td->xform.chain.cipher.cipher.iv.length =
+					param1->iv_length;
 			td->xform.chain.auth.auth.algo = param2->alg.auth;
 			td->xform.chain.auth.auth.key.length =
 					param2->key_length;
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 3376d08..6e27eba 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -76,6 +76,7 @@ struct crypto_param {
 		enum rte_crypto_aead_algorithm aead;
 	} alg;
 	uint16_t key_length;
+	uint16_t iv_length;
 	uint16_t digest_length;
 };
 
@@ -100,23 +101,33 @@ static const struct crypto_param aead_list[] = {
 static const struct crypto_param cipher_list[] = {
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+		.alg.cipher =  RTE_CRYPTO_CIPHER_NULL,
+		.key_length = 0,
+		.iv_length = 0,
+	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
 		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CBC,
 		.key_length = 16,
+		.iv_length = 16,
 	},
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
 		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
 		.key_length = 16,
+		.iv_length = 16,
 	},
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
 		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
 		.key_length = 24,
+		.iv_length = 16,
 	},
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
 		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
 		.key_length = 32,
+		.iv_length = 16,
 	},
 };
 
@@ -143,6 +154,12 @@ static const struct crypto_param auth_list[] = {
 		.key_length = 64,
 		.digest_length = 32,
 	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_AES_XCBC_MAC,
+		.key_length = 16,
+		.digest_length = 12,
+	},
 };
 
 struct crypto_param_comb {
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index b6d48ad..85cd6c5 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -1062,4 +1062,94 @@ struct ipsec_test_data pkt_aes_128_gcm_frag = {
 	},
 };
 
+struct ipsec_test_data pkt_null_aes_xcbc = {
+	.auth_key = {
+		.data = {
+			0x61, 0x31, 0x62, 0x32, 0x63, 0x33, 0x64, 0x34,
+			0x65, 0x35, 0x66, 0x36, 0x67, 0x37, 0x68, 0x38,
+		},
+	},
+	.input_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x2f, 0x49, 0x37, 0x00, 0x00,
+			0x40, 0x11, 0x22, 0x84, 0x0d, 0x00, 0x00, 0x02,
+			0x02, 0x00, 0x00, 0x02, 0x08, 0x00, 0x08, 0x00,
+			0x00, 0x1b, 0x6d, 0x99, 0x58, 0x58, 0x58, 0x58,
+			0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+			0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+		},
+		.len = 47,
+	},
+	.output_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x5c, 0x06, 0x00, 0x00, 0x00,
+			0x40, 0x32, 0x13, 0x6c, 0x0a, 0x00, 0x6f, 0x02,
+			0x0a, 0x00, 0xde, 0x02,
+
+			/* ESP */
+			0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01,
+
+			/* IP */
+			0x45, 0x00, 0x00, 0x2f, 0x49, 0x37, 0x00, 0x00,
+			0x40, 0x11, 0x22, 0x84, 0x0d, 0x00, 0x00, 0x02,
+			0x02, 0x00, 0x00, 0x02, 0x08, 0x00, 0x08, 0x00,
+			0x00, 0x1b, 0x6d, 0x99, 0x58, 0x58, 0x58, 0x58,
+			0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+			0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+
+			/* ESP trailer */
+			0x01, 0x02, 0x03, 0x03, 0x04,
+
+			/* ICV */
+			0xf1, 0x52, 0x64, 0xd1, 0x9b, 0x62, 0x24, 0xdd,
+			0xcc, 0x14, 0xf5, 0xc1,
+		},
+		.len = 92,
+	},
+	.ipsec_xform = {
+		.spi = 0x100,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.options.ip_csum_enable = 0,
+		.options.l4_csum_enable = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+	.aead = false,
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_CIPHER_NULL,
+				.key.length = 0,
+				.iv.length = 0,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.op = RTE_CRYPTO_AUTH_OP_GENERATE,
+				.algo = RTE_CRYPTO_AUTH_AES_XCBC_MAC,
+				.key.length = 16,
+				.digest_length = 12,
+			},
+		},
+	},
+};
+
 #endif /* TEST_CRYPTODEV_SECURITY_IPSEC_TEST_VECTORS_H_ */
-- 
2.7.4

[PATCH 13/13] test/crypto: add copy and set DF cases

[Anoob Joseph]

Add test cases to verify copy DF and set DF options with lookaside IPsec
offload.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
---
 app/test/test_cryptodev.c                | 75 ++++++++++++++++++++++++++++++++
 app/test/test_cryptodev_security_ipsec.c | 71 ++++++++++++++++++++++++++++--
 app/test/test_cryptodev_security_ipsec.h | 10 +++++
 doc/guides/rel_notes/release_22_03.rst   | 18 ++++++++
 4 files changed, 171 insertions(+), 3 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index aa85a19..aac17d1 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9169,6 +9169,13 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 			       sizeof(src));
 			memcpy(&ipsec_xform.tunnel.ipv4.dst_ip, &dst,
 			       sizeof(dst));
+
+			if (flags->df == TEST_IPSEC_SET_DF_0_INNER_1)
+				ipsec_xform.tunnel.ipv4.df = 0;
+
+			if (flags->df == TEST_IPSEC_SET_DF_1_INNER_0)
+				ipsec_xform.tunnel.ipv4.df = 1;
+
 		} else {
 			memcpy(&ipsec_xform.tunnel.ipv6.src_addr, &v6_src,
 			       sizeof(v6_src));
@@ -9282,6 +9289,9 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 		memcpy(input_text, td[i].input_text.data,
 		       td[i].input_text.len);
 
+		if (test_ipsec_pkt_update(input_text, flags))
+			return TEST_FAILED;
+
 		/* Generate crypto op data structure */
 		ut_params->op = rte_crypto_op_alloc(ts_params->op_mpool,
 					RTE_CRYPTO_OP_TYPE_SYMMETRIC);
@@ -9700,6 +9710,55 @@ test_ipsec_proto_pkt_fragment(const void *data __rte_unused)
 	flags.fragment = true;
 
 	return test_ipsec_proto_all(&flags);
+
+}
+
+static int
+test_ipsec_proto_copy_df_inner_0(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.df = TEST_IPSEC_COPY_DF_INNER_0;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_copy_df_inner_1(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.df = TEST_IPSEC_COPY_DF_INNER_1;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_set_df_0_inner_1(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.df = TEST_IPSEC_SET_DF_0_INNER_1;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_set_df_1_inner_0(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.df = TEST_IPSEC_SET_DF_1_INNER_0;
+
+	return test_ipsec_proto_all(&flags);
 }
 
 static int
@@ -14724,6 +14783,22 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Fragmented packet",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_pkt_fragment),
+		TEST_CASE_NAMED_ST(
+			"Tunnel header copy DF (inner 0)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_copy_df_inner_0),
+		TEST_CASE_NAMED_ST(
+			"Tunnel header copy DF (inner 1)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_copy_df_inner_1),
+		TEST_CASE_NAMED_ST(
+			"Tunnel header set DF 0 (inner 1)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_set_df_0_inner_1),
+		TEST_CASE_NAMED_ST(
+			"Tunnel header set DF 1 (inner 0)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_set_df_1_inner_0),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 94e5213..4f5f20c 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -427,6 +427,9 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 			ip->hdr_checksum = rte_ipv4_cksum(ip);
 		}
 
+		if (flags->df == TEST_IPSEC_COPY_DF_INNER_0 ||
+		    flags->df == TEST_IPSEC_COPY_DF_INNER_1)
+			td->ipsec_xform.options.copy_df = 1;
 	}
 }
 
@@ -640,6 +643,7 @@ test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td,
 {
 	uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *);
 	uint32_t skip, len = rte_pktmbuf_pkt_len(m);
+	uint8_t td_output_text[4096];
 	int ret;
 
 	/* For tests with status as error for test success, skip verification */
@@ -720,16 +724,21 @@ test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td,
 		return ret;
 	}
 
+	memcpy(td_output_text, td->output_text.data + skip, len);
 
-	if (memcmp(output_text, td->output_text.data + skip, len)) {
+	if (test_ipsec_pkt_update(td_output_text, flags)) {
+		printf("Could not update expected vector");
+		return TEST_FAILED;
+	}
+
+	if (memcmp(output_text, td_output_text, len)) {
 		if (silent)
 			return TEST_FAILED;
 
 		printf("TestCase %s line %d: %s\n", __func__, __LINE__,
 			"output text not as expected\n");
 
-		rte_hexdump(stdout, "expected", td->output_text.data + skip,
-			    len);
+		rte_hexdump(stdout, "expected", td_output_text, len);
 		rte_hexdump(stdout, "actual", output_text, len);
 		return TEST_FAILED;
 	}
@@ -797,10 +806,27 @@ test_ipsec_post_process(struct rte_mbuf *m, const struct ipsec_test_data *td,
 		} else {
 			if (td->ipsec_xform.tunnel.type ==
 					RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+				uint16_t f_off;
+
 				if (is_valid_ipv4_pkt(iph4) == false) {
 					printf("Tunnel outer header is not IPv4\n");
 					return TEST_FAILED;
 				}
+
+				f_off = rte_be_to_cpu_16(iph4->fragment_offset);
+
+				if (flags->df == TEST_IPSEC_COPY_DF_INNER_1 ||
+				    flags->df == TEST_IPSEC_SET_DF_1_INNER_0) {
+					if (!(f_off & RTE_IPV4_HDR_DF_FLAG)) {
+						printf("DF bit is not set\n");
+						return TEST_FAILED;
+					}
+				} else {
+					if ((f_off & RTE_IPV4_HDR_DF_FLAG)) {
+						printf("DF bit is set\n");
+						return TEST_FAILED;
+					}
+				}
 			} else {
 				iph6 = (const struct rte_ipv6_hdr *)output_text;
 				if (is_valid_ipv6_pkt(iph6) == false) {
@@ -909,3 +935,42 @@ test_ipsec_stats_verify(struct rte_security_ctx *ctx,
 
 	return ret;
 }
+
+int
+test_ipsec_pkt_update(uint8_t *pkt, const struct ipsec_test_flags *flags)
+{
+	struct rte_ipv4_hdr *iph4;
+	bool cksum_dirty = false;
+	uint16_t frag_off;
+
+	iph4 = (struct rte_ipv4_hdr *)pkt;
+
+	if (flags->df == TEST_IPSEC_COPY_DF_INNER_1 ||
+	    flags->df == TEST_IPSEC_SET_DF_0_INNER_1 ||
+	    flags->df == TEST_IPSEC_COPY_DF_INNER_0 ||
+	    flags->df == TEST_IPSEC_SET_DF_1_INNER_0) {
+
+		if (!is_ipv4(iph4)) {
+			printf("Invalid packet type");
+			return -1;
+		}
+
+		frag_off = rte_be_to_cpu_16(iph4->fragment_offset);
+
+		if (flags->df == TEST_IPSEC_COPY_DF_INNER_1 ||
+		    flags->df == TEST_IPSEC_SET_DF_0_INNER_1)
+			frag_off |= RTE_IPV4_HDR_DF_FLAG;
+		else
+			frag_off &= !RTE_IPV4_HDR_DF_FLAG;
+
+		iph4->fragment_offset = rte_cpu_to_be_16(frag_off);
+		cksum_dirty = true;
+	}
+
+	if (cksum_dirty && is_ipv4(iph4)) {
+		iph4->hdr_checksum = 0;
+		iph4->hdr_checksum = rte_ipv4_cksum(iph4);
+	}
+
+	return 0;
+}
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 6e27eba..12a9b77 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -50,6 +50,13 @@ struct ipsec_test_data {
 	} xform;
 };
 
+enum df_flags {
+	TEST_IPSEC_COPY_DF_INNER_0 = 1,
+	TEST_IPSEC_COPY_DF_INNER_1,
+	TEST_IPSEC_SET_DF_0_INNER_1,
+	TEST_IPSEC_SET_DF_1_INNER_0,
+};
+
 struct ipsec_test_flags {
 	bool display_alg;
 	bool sa_expiry_pkts_soft;
@@ -66,6 +73,7 @@ struct ipsec_test_flags {
 	bool transport;
 	bool fragment;
 	bool stats_success;
+	enum df_flags df;
 };
 
 struct crypto_param {
@@ -226,4 +234,6 @@ int test_ipsec_stats_verify(struct rte_security_ctx *ctx,
 			    const struct ipsec_test_flags *flags,
 			    enum rte_security_ipsec_sa_direction dir);
 
+int test_ipsec_pkt_update(uint8_t *pkt, const struct ipsec_test_flags *flags);
+
 #endif
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index 6d99d1e..0a29671 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -55,6 +55,24 @@ New Features
      Also, make sure to start the actual text at the margin.
      =======================================================
 
+* **Updated lookaside protocol (IPsec) tests in dpdk-test.**
+
+  * Added support for chained operations.
+  * Added AES-CBC 128 NULL auth known vector tests.
+  * Added AES-CBC 128 HMAC-SHA256 known vector tests.
+  * Added AES-CBC 128 HMAC-SHA384 known vector tests.
+  * Added AES-CBC 128 HMAC-SHA512 known vector tests.
+  * Added NULL cipher AES-XCBC known vector tests.
+  * Added tunnel mode tests
+    * IPv6 in IPv6
+    * IPv4 in IPv4
+    * IPv4 in IPv6
+    * IPv6 in IPv4
+  * Added IPv4 transport mode tests.
+  * Added security stats tests.
+  * Added AES-CTR tests.
+  * Added set/copy DF tests.
+
 
 Removed Items
 -------------
-- 
2.7.4

[PATCH v2 00/13] Add new cases to lookaside IPsec tests

[Anoob Joseph]

Add new tests to lookaside IPsec tests.

* Support for chained operations.
* AES-CBC 128 NULL auth known vector tests.
* AES-CBC 128 HMAC-SHA256 known vector tests.
* AES-CBC 128 HMAC-SHA384 known vector tests.
* AES-CBC 128 HMAC-SHA512 known vector tests.
* NULL cipher AES-XCBC known vector tests.
* Tunnel mode tests
  * IPv6 in IPv6
  * IPv4 in IPv4
  * IPv4 in IPv6
  * IPv6 in IPv4
* IPv4 transport mode tests.
* Tunnel mode fragment packet tests.
* Security stats tests.
* AES-CTR tests.
* set/copy DF tests.

Changes in v2:
- Moved release notes update to originating patch
- Fixed build failure with last patch

Ankur Dwivedi (1):
  test/crypto: add security stats cases

Anoob Joseph (5):
  test/crypto: add IPsec aes-cbc known vectors
  test/crypto: add chained operations in combined cases
  test/crypto: add transport mode cases
  test/crypto: add aes xcbc known vectors
  test/crypto: add copy and set DF cases

Tejasree Kondoj (7):
  test/crypto: add IPsec AES-CBC-HMAC-SHA256 known vectors
  test/crypto: add IPv6 tunnel mode cases
  test/crypto: add IPsec HMAC-SHA384/512 known vectors
  test/crypto: add IPsec fragmented packet known vectors
  test/crypto: add lookaside IPsec AES-CTR known vectors
  test/crypto: add fragmented packet case
  test/crypto: skip null auth in ICV corrupt case

 app/test/test_cryptodev.c                          | 395 +++++++++-
 app/test/test_cryptodev_security_ipsec.c           | 352 ++++++++-
 app/test/test_cryptodev_security_ipsec.h           | 113 +++
 .../test_cryptodev_security_ipsec_test_vectors.h   | 828 +++++++++++++++++++++
 doc/guides/rel_notes/release_22_03.rst             |  19 +
 5 files changed, 1665 insertions(+), 42 deletions(-)

-- 
2.7.4

[PATCH v2 01/13] test/crypto: add IPsec aes-cbc known vectors

[Anoob Joseph]

Extend the framework to support chained operations and add
AES-CBC 128 known vector tests.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
---
 app/test/test_cryptodev.c                          |  62 ++++++++++--
 app/test/test_cryptodev_security_ipsec.c           |  51 ++++++++++
 app/test/test_cryptodev_security_ipsec.h           |   8 ++
 .../test_cryptodev_security_ipsec_test_vectors.h   | 110 +++++++++++++++++++++
 doc/guides/rel_notes/release_22_03.rst             |   4 +
 5 files changed, 226 insertions(+), 9 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 10b48cd..6d94085 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9191,23 +9191,59 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 			return TEST_SKIPPED;
 		}
 	} else {
-		/* Only AEAD supported now */
-		return TEST_SKIPPED;
+		memcpy(&ut_params->cipher_xform, &td[0].xform.chain.cipher,
+		       sizeof(ut_params->cipher_xform));
+		memcpy(&ut_params->auth_xform, &td[0].xform.chain.auth,
+		       sizeof(ut_params->auth_xform));
+		ut_params->cipher_xform.cipher.key.data = td[0].key.data;
+		ut_params->cipher_xform.cipher.iv.offset = IV_OFFSET;
+		ut_params->auth_xform.auth.key.data = td[0].key.data;
+
+		/* Verify crypto capabilities */
+
+		if (test_ipsec_crypto_caps_cipher_verify(
+				sec_cap,
+				&ut_params->cipher_xform) != 0) {
+			if (!silent)
+				RTE_LOG(INFO, USER1,
+					"Cipher crypto capabilities not supported\n");
+			return TEST_SKIPPED;
+		}
+
+		if (test_ipsec_crypto_caps_auth_verify(
+				sec_cap,
+				&ut_params->auth_xform) != 0) {
+			if (!silent)
+				RTE_LOG(INFO, USER1,
+					"Auth crypto capabilities not supported\n");
+			return TEST_SKIPPED;
+		}
 	}
 
 	if (test_ipsec_sec_caps_verify(&ipsec_xform, sec_cap, silent) != 0)
 		return TEST_SKIPPED;
 
-	salt_len = RTE_MIN(sizeof(ipsec_xform.salt), td[0].salt.len);
-	memcpy(&ipsec_xform.salt, td[0].salt.data, salt_len);
-
 	struct rte_security_session_conf sess_conf = {
 		.action_type = ut_params->type,
 		.protocol = RTE_SECURITY_PROTOCOL_IPSEC,
-		.ipsec = ipsec_xform,
-		.crypto_xform = &ut_params->aead_xform,
 	};
 
+	if (td[0].aead) {
+		salt_len = RTE_MIN(sizeof(ipsec_xform.salt), td[0].salt.len);
+		memcpy(&ipsec_xform.salt, td[0].salt.data, salt_len);
+		sess_conf.ipsec = ipsec_xform;
+		sess_conf.crypto_xform = &ut_params->aead_xform;
+	} else {
+		sess_conf.ipsec = ipsec_xform;
+		if (dir == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
+			sess_conf.crypto_xform = &ut_params->cipher_xform;
+			ut_params->cipher_xform.next = &ut_params->auth_xform;
+		} else {
+			sess_conf.crypto_xform = &ut_params->auth_xform;
+			ut_params->auth_xform.next = &ut_params->cipher_xform;
+		}
+	}
+
 	/* Create security session */
 	ut_params->sec_session = rte_security_session_create(ctx, &sess_conf,
 					ts_params->session_mpool,
@@ -9316,14 +9352,18 @@ test_ipsec_proto_known_vec(const void *test_data)
 }
 
 static int
-test_ipsec_proto_known_vec_inb(const void *td_outb)
+test_ipsec_proto_known_vec_inb(const void *test_data)
 {
+	const struct ipsec_test_data *td = test_data;
 	struct ipsec_test_flags flags;
 	struct ipsec_test_data td_inb;
 
 	memset(&flags, 0, sizeof(flags));
 
-	test_ipsec_td_in_from_out(td_outb, &td_inb);
+	if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS)
+		test_ipsec_td_in_from_out(td, &td_inb);
+	else
+		memcpy(&td_inb, td, sizeof(td_inb));
 
 	return test_ipsec_proto_process(&td_inb, NULL, 1, false, &flags);
 }
@@ -14394,6 +14434,10 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Inbound known vector (ESP tunnel mode IPv4 AES-GCM 256)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_256_gcm),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv4 AES-CBC 128)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb, &pkt_aes_128_cbc_null),
 		TEST_CASE_NAMED_ST(
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 4708803..45960bf 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -150,6 +150,57 @@ test_ipsec_crypto_caps_aead_verify(
 	return -ENOTSUP;
 }
 
+int
+test_ipsec_crypto_caps_cipher_verify(
+		const struct rte_security_capability *sec_cap,
+		struct rte_crypto_sym_xform *cipher)
+{
+	const struct rte_cryptodev_symmetric_capability *sym_cap;
+	const struct rte_cryptodev_capabilities *cap;
+	int j = 0;
+
+	while ((cap = &sec_cap->crypto_capabilities[j++])->op !=
+			RTE_CRYPTO_OP_TYPE_UNDEFINED) {
+		if (cap->op == RTE_CRYPTO_OP_TYPE_SYMMETRIC &&
+				cap->sym.xform_type == cipher->type &&
+				cap->sym.cipher.algo == cipher->cipher.algo) {
+			sym_cap = &cap->sym;
+			if (rte_cryptodev_sym_capability_check_cipher(sym_cap,
+					cipher->cipher.key.length,
+					cipher->cipher.iv.length) == 0)
+				return 0;
+		}
+	}
+
+	return -ENOTSUP;
+}
+
+int
+test_ipsec_crypto_caps_auth_verify(
+		const struct rte_security_capability *sec_cap,
+		struct rte_crypto_sym_xform *auth)
+{
+	const struct rte_cryptodev_symmetric_capability *sym_cap;
+	const struct rte_cryptodev_capabilities *cap;
+	int j = 0;
+
+	while ((cap = &sec_cap->crypto_capabilities[j++])->op !=
+			RTE_CRYPTO_OP_TYPE_UNDEFINED) {
+		if (cap->op == RTE_CRYPTO_OP_TYPE_SYMMETRIC &&
+				cap->sym.xform_type == auth->type &&
+				cap->sym.auth.algo == auth->auth.algo) {
+			sym_cap = &cap->sym;
+			if (rte_cryptodev_sym_capability_check_auth(sym_cap,
+					auth->auth.key.length,
+					auth->auth.digest_length,
+					auth->auth.iv.length) == 0)
+				return 0;
+		}
+	}
+
+	return -ENOTSUP;
+}
+
 void
 test_ipsec_td_in_from_out(const struct ipsec_test_data *td_out,
 			  struct ipsec_test_data *td_in)
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 7628d0c..91c6cd4 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -96,6 +96,14 @@ int test_ipsec_crypto_caps_aead_verify(
 		const struct rte_security_capability *sec_cap,
 		struct rte_crypto_sym_xform *aead);
 
+int test_ipsec_crypto_caps_cipher_verify(
+		const struct rte_security_capability *sec_cap,
+		struct rte_crypto_sym_xform *cipher);
+
+int test_ipsec_crypto_caps_auth_verify(
+		const struct rte_security_capability *sec_cap,
+		struct rte_crypto_sym_xform *auth);
+
 void test_ipsec_td_in_from_out(const struct ipsec_test_data *td_out,
 			       struct ipsec_test_data *td_in);
 
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index bb95d00..bf831e9 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -324,4 +324,114 @@ struct ipsec_test_data pkt_aes_256_gcm = {
 	},
 };
 
+/* Known vectors for AES-CBC
+ * https://datatracker.ietf.org/doc/html/rfc3602#section-4
+ */
+
+struct ipsec_test_data pkt_aes_128_cbc_null = {
+	.key = {
+		.data = {
+			0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
+			0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
+		},
+	},
+	.input_text = {
+		.data = {
+			/* IP - outer header */
+			0x45, 0x00, 0x00, 0x8c, 0x00, 0x02, 0x00, 0x00,
+			0x40, 0x32, 0x27, 0xbc, 0x00, 0x01, 0xa8, 0xc0,
+			0x01, 0x01, 0xa8, 0xc0,
+
+			/* ESP */
+			0x00, 0x00, 0x87, 0x65,	0x00, 0x00, 0x00, 0x02,
+
+			/* IV */
+			0xf4, 0xe7, 0x65, 0x24,	0x4f, 0x64, 0x07, 0xad,
+			0xf1, 0x3d, 0xc1, 0x38,	0x0f, 0x67, 0x3f, 0x37,
+
+			/* Data */
+			0x77, 0x3b, 0x52, 0x41,	0xa4, 0xc4, 0x49, 0x22,
+			0x5e, 0x4f, 0x3c, 0xe5, 0xed, 0x61, 0x1b, 0x0c,
+			0x23, 0x7c, 0xa9, 0x6c, 0xf7, 0x4a, 0x93, 0x01,
+			0x3c, 0x1b, 0x0e, 0xa1, 0xa0, 0xcf, 0x70, 0xf8,
+			0xe4, 0xec, 0xae, 0xc7, 0x8a, 0xc5, 0x3a, 0xad,
+			0x7a, 0x0f, 0x02, 0x2b, 0x85, 0x92, 0x43, 0xc6,
+			0x47, 0x75, 0x2e, 0x94, 0xa8, 0x59, 0x35, 0x2b,
+			0x8a, 0x4d, 0x4d, 0x2d, 0xec, 0xd1, 0x36, 0xe5,
+			0xc1, 0x77, 0xf1, 0x32,	0xad, 0x3f, 0xbf, 0xb2,
+			0x20, 0x1a, 0xc9, 0x90,	0x4c, 0x74, 0xee, 0x0a,
+			0x10, 0x9e, 0x0c, 0xa1,	0xe4, 0xdf, 0xe9, 0xd5,
+			0xa1, 0x00, 0xb8, 0x42,	0xf1, 0xc2, 0x2f, 0x0d,
+		},
+		.len = 140,
+	},
+	.output_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x54, 0x09, 0x04, 0x00, 0x00,
+			0x40, 0x01, 0xf9, 0x88, 0xc0, 0xa8, 0x7b, 0x03,
+			0xc0, 0xa8, 0x7b, 0xc8,
+
+			/* ICMP */
+			0x08, 0x00, 0x9f, 0x76,	0xa9, 0x0a, 0x01, 0x00,
+			0xb4, 0x9c, 0x08, 0x3d,	0x02, 0xa2, 0x04, 0x00,
+			0x08, 0x09, 0x0a, 0x0b,	0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23,	0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b,	0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33,	0x34, 0x35, 0x36, 0x37,
+			0x01, 0x02, 0x03, 0x04,	0x05, 0x06, 0x07, 0x08,
+			0x09, 0x0a, 0x0a, 0x04,
+		},
+		.len = 84,
+	},
+	.iv = {
+		.data = {
+			0xf4, 0xe7, 0x65, 0x24, 0x4f, 0x64, 0x07, 0xad,
+			0xf1, 0x3d, 0xc1, 0x38, 0x0f, 0x67, 0x3f, 0x37,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 0x8765,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+
+	.aead = false,
+
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_DECRYPT,
+				.algo = RTE_CRYPTO_CIPHER_AES_CBC,
+				.key.length = 16,
+				.iv.length = 16,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.algo = RTE_CRYPTO_AUTH_NULL,
+			},
+		},
+	},
+};
+
 #endif /* TEST_CRYPTODEV_SECURITY_IPSEC_TEST_VECTORS_H_ */
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index 6d99d1e..9fccddc 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -55,6 +55,10 @@ New Features
      Also, make sure to start the actual text at the margin.
      =======================================================
 
+* **Updated lookaside protocol (IPsec) tests in dpdk-test.**
+
+  * Added AES-CBC 128 NULL auth known vector tests.
+
 
 Removed Items
 -------------
-- 
2.7.4

[PATCH v2 02/13] test/crypto: add IPsec AES-CBC-HMAC-SHA256 known vectors

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Adding lookaside IPsec AES-CBC-HMAC-SHA256 test cases.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c                          |  12 ++-
 app/test/test_cryptodev_security_ipsec.h           |   3 +
 .../test_cryptodev_security_ipsec_test_vectors.h   | 109 +++++++++++++++++++++
 doc/guides/rel_notes/release_22_03.rst             |   1 +
 4 files changed, 124 insertions(+), 1 deletion(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 6d94085..c91b745 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9197,7 +9197,7 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 		       sizeof(ut_params->auth_xform));
 		ut_params->cipher_xform.cipher.key.data = td[0].key.data;
 		ut_params->cipher_xform.cipher.iv.offset = IV_OFFSET;
-		ut_params->auth_xform.auth.key.data = td[0].key.data;
+		ut_params->auth_xform.auth.key.data = td[0].auth_key.data;
 
 		/* Verify crypto capabilities */
 
@@ -14423,6 +14423,11 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec, &pkt_aes_256_gcm),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA256 [16B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec,
+			&pkt_aes_128_cbc_hmac_sha256),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Inbound known vector (ESP tunnel mode IPv4 AES-GCM 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_128_gcm),
@@ -14438,6 +14443,11 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Inbound known vector (ESP tunnel mode IPv4 AES-CBC 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_128_cbc_null),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA256 [16B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb,
+			&pkt_aes_128_cbc_hmac_sha256),
 		TEST_CASE_NAMED_ST(
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 91c6cd4..70a264a 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -14,6 +14,9 @@ struct ipsec_test_data {
 	struct {
 		uint8_t data[32];
 	} key;
+	struct {
+		uint8_t data[32];
+	} auth_key;
 
 	struct {
 		uint8_t data[1024];
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index bf831e9..16c88fe 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -434,4 +434,113 @@ struct ipsec_test_data pkt_aes_128_cbc_null = {
 	},
 };
 
+struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256 = {
+	.key = {
+		.data = {
+			0x00, 0x04, 0x05, 0x01, 0x23, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x0a, 0x0b, 0x0c, 0x0f, 0x00, 0x00,
+		},
+	},
+	.auth_key = {
+		.data = {
+			0xde, 0x34, 0x56, 0x00, 0x00, 0x00, 0x78, 0x00,
+			0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x04,
+			0x0a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+		},
+	},
+	.input_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x32, 0x00, 0x01, 0x00, 0x00,
+			0x1f, 0x11, 0x17, 0x8b, 0xc0, 0xa8, 0x01, 0x6f,
+			0xc0, 0xa8, 0x01, 0x70,
+
+			/* UDP */
+			0x00, 0x09, 0x00, 0x09, 0x00, 0x1e, 0x00, 0x00,
+			0xbe, 0x9b, 0xe9, 0x55, 0x00, 0x00, 0x00, 0x21,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		},
+		.len = 50,
+	},
+	.output_text = {
+		.data = {
+			/* IP - outer header */
+			0x45, 0x00, 0x00, 0x7c, 0x00, 0x01, 0x00, 0x00,
+			0x40, 0x32, 0x52, 0x4d, 0x14, 0x00, 0x00, 0x01,
+			0x14, 0x00, 0x00, 0x02,
+
+			/* ESP */
+			0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x01,
+
+			/* IV */
+			0x34, 0x12, 0x67, 0x45, 0xff, 0xff, 0x00, 0x00,
+			0x20, 0xbf, 0xe8, 0x39, 0x00, 0x00, 0x00, 0x00,
+
+			/* Data */
+			0x67, 0xb5, 0x46, 0x6e, 0x78, 0x17, 0xd3, 0x5a,
+			0xac, 0x62, 0x62, 0x62, 0xb0, 0x57, 0x9b, 0x09,
+			0x19, 0x4f, 0x06, 0x59, 0xc8, 0xb0, 0x30, 0x65,
+			0x1f, 0x45, 0x57, 0x41, 0x72, 0x17, 0x28, 0xe9,
+			0xad, 0x50, 0xbe, 0x44, 0x1d, 0x2d, 0x9a, 0xd0,
+			0x48, 0x75, 0x0d, 0x1c, 0x8d, 0x24, 0xa8, 0x6f,
+			0x6b, 0x24, 0xb6, 0x5d, 0x43, 0x1e, 0x55, 0xf0,
+			0xf7, 0x14, 0x1f, 0xf2, 0x61, 0xd4, 0xe0, 0x30,
+			0x16, 0xbe, 0x1b, 0x5c, 0xcc, 0xb7, 0x66, 0x1c,
+			0x47, 0xad, 0x07, 0x6c, 0xd5, 0xcb, 0xce, 0x6c,
+		},
+		.len = 124,
+	},
+	.iv = {
+		.data = {
+			0x34, 0x12, 0x67, 0x45, 0xff, 0xff, 0x00, 0x00,
+			0x20, 0xbf, 0xe8, 0x39, 0x00, 0x00, 0x00, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+
+	.aead = false,
+
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_CIPHER_AES_CBC,
+				.key.length = 16,
+				.iv.length = 16,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.op = RTE_CRYPTO_AUTH_OP_GENERATE,
+				.algo = RTE_CRYPTO_AUTH_SHA256_HMAC,
+				.key.length = 32,
+				.digest_length = 16,
+			},
+		},
+	},
+};
+
 #endif /* TEST_CRYPTODEV_SECURITY_IPSEC_TEST_VECTORS_H_ */
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index 9fccddc..83536ed 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -58,6 +58,7 @@ New Features
 * **Updated lookaside protocol (IPsec) tests in dpdk-test.**
 
   * Added AES-CBC 128 NULL auth known vector tests.
+  * Added AES-CBC 128 HMAC-SHA256 known vector tests.
 
 
 Removed Items
-- 
2.7.4

[PATCH v2 03/13] test/crypto: add chained operations in combined cases

[Anoob Joseph]

Extend lookaside IPsec combined mode cases to cover chained operations
also.

Currently covering combinations of,

Ciphers,
1. AES-128-CBC

Auth,
1. NULL
2. SHA2-256 [16B ICV]

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
---
 app/test/test_cryptodev.c                | 11 +++--
 app/test/test_cryptodev_security_ipsec.c | 77 +++++++++++++++++++++++++-------
 app/test/test_cryptodev_security_ipsec.h | 36 +++++++++++++++
 doc/guides/rel_notes/release_22_03.rst   |  1 +
 4 files changed, 104 insertions(+), 21 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index c91b745..a307aec 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -835,6 +835,8 @@ ipsec_proto_testsuite_setup(void)
 		ret = TEST_SKIPPED;
 	}
 
+	test_ipsec_alg_list_populate();
+
 	/*
 	 * Stop the device. Device would be started again by individual test
 	 * case setup routine.
@@ -9381,9 +9383,9 @@ test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 	    flags->sa_expiry_pkts_hard)
 		nb_pkts = IPSEC_TEST_PACKETS_MAX;
 
-	for (i = 0; i < RTE_DIM(aead_list); i++) {
-		test_ipsec_td_prepare(&aead_list[i],
-				      NULL,
+	for (i = 0; i < RTE_DIM(alg_list); i++) {
+		test_ipsec_td_prepare(alg_list[i].param1,
+				      alg_list[i].param2,
 				      flags,
 				      td_outb,
 				      nb_pkts);
@@ -9407,7 +9409,8 @@ test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 			return TEST_FAILED;
 
 		if (flags->display_alg)
-			test_ipsec_display_alg(&aead_list[i], NULL);
+			test_ipsec_display_alg(alg_list[i].param1,
+					       alg_list[i].param2);
 
 		pass_cnt++;
 	}
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 45960bf..5f67dc0 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -15,7 +15,29 @@
 
 #define IV_LEN_MAX 16
 
-extern struct ipsec_test_data pkt_aes_256_gcm;
+struct crypto_param_comb alg_list[RTE_DIM(aead_list) +
+				  (RTE_DIM(cipher_list) *
+				   RTE_DIM(auth_list))];
+
+void
+test_ipsec_alg_list_populate(void)
+{
+	unsigned long i, j, index = 0;
+
+	for (i = 0; i < RTE_DIM(aead_list); i++) {
+		alg_list[index].param1 = &aead_list[i];
+		alg_list[index].param2 = NULL;
+		index++;
+	}
+
+	for (i = 0; i < RTE_DIM(cipher_list); i++) {
+		for (j = 0; j < RTE_DIM(auth_list); j++) {
+			alg_list[index].param1 = &cipher_list[i];
+			alg_list[index].param2 = &auth_list[j];
+			index++;
+		}
+	}
+}
 
 int
 test_ipsec_sec_caps_verify(struct rte_security_ipsec_xform *ipsec_xform,
@@ -293,18 +315,31 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 
 	for (i = 0; i < nb_td; i++) {
 		td = &td_array[i];
-		/* Copy template for packet & key fields */
-		memcpy(td, &pkt_aes_256_gcm, sizeof(*td));
 
-		/* Override fields based on param */
+		/* Prepare fields based on param */
+
+		if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
+			/* Copy template for packet & key fields */
+			memcpy(td, &pkt_aes_256_gcm, sizeof(*td));
 
-		if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD)
 			td->aead = true;
-		else
+			td->xform.aead.aead.algo = param1->alg.aead;
+			td->xform.aead.aead.key.length = param1->key_length;
+		} else {
+			/* Copy template for packet & key fields */
+			memcpy(td, &pkt_aes_128_cbc_hmac_sha256, sizeof(*td));
+
 			td->aead = false;
+			td->xform.chain.cipher.cipher.algo = param1->alg.cipher;
+			td->xform.chain.cipher.cipher.key.length =
+					param1->key_length;
+			td->xform.chain.auth.auth.algo = param2->alg.auth;
+			td->xform.chain.auth.auth.key.length =
+					param2->key_length;
+			td->xform.chain.auth.auth.digest_length =
+					param2->digest_length;
 
-		td->xform.aead.aead.algo = param1->alg.aead;
-		td->xform.aead.aead.key.length = param1->key_length;
+		}
 
 		if (flags->iv_gen)
 			td->ipsec_xform.options.iv_gen_disable = 0;
@@ -324,8 +359,6 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 		}
 
 	}
-
-	RTE_SET_USED(param2);
 }
 
 void
@@ -374,12 +407,21 @@ void
 test_ipsec_display_alg(const struct crypto_param *param1,
 		       const struct crypto_param *param2)
 {
-	if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD)
-		printf("\t%s [%d]\n",
+	if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
+		printf("\t%s [%d]",
 		       rte_crypto_aead_algorithm_strings[param1->alg.aead],
-		       param1->key_length);
-
-	RTE_SET_USED(param2);
+		       param1->key_length * 8);
+	} else {
+		printf("\t%s",
+		       rte_crypto_cipher_algorithm_strings[param1->alg.cipher]);
+		if (param1->alg.cipher != RTE_CRYPTO_CIPHER_NULL)
+			printf(" [%d]", param1->key_length * 8);
+		printf(" %s",
+		       rte_crypto_auth_algorithm_strings[param2->alg.auth]);
+		if (param2->alg.auth != RTE_CRYPTO_AUTH_NULL)
+			printf(" [%dB ICV]", param2->digest_length);
+	}
+	printf("\n");
 }
 
 static int
@@ -631,8 +673,9 @@ test_ipsec_res_d_prepare(struct rte_mbuf *m, const struct ipsec_test_data *td,
 	if (res_d->aead) {
 		res_d->xform.aead.aead.op = RTE_CRYPTO_AEAD_OP_DECRYPT;
 	} else {
-		printf("Only AEAD supported\n");
-		return TEST_SKIPPED;
+		res_d->xform.chain.cipher.cipher.op =
+				RTE_CRYPTO_CIPHER_OP_DECRYPT;
+		res_d->xform.chain.auth.auth.op = RTE_CRYPTO_AUTH_OP_VERIFY;
 	}
 
 	return TEST_SUCCESS;
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 70a264a..b1f0ff8 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -71,6 +71,7 @@ struct crypto_param {
 		enum rte_crypto_aead_algorithm aead;
 	} alg;
 	uint16_t key_length;
+	uint16_t digest_length;
 };
 
 static const struct crypto_param aead_list[] = {
@@ -91,6 +92,41 @@ static const struct crypto_param aead_list[] = {
 	},
 };
 
+static const struct crypto_param cipher_list[] = {
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CBC,
+		.key_length = 16,
+	},
+};
+
+static const struct crypto_param auth_list[] = {
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_NULL,
+	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_SHA256_HMAC,
+		.key_length = 32,
+		.digest_length = 16,
+	},
+};
+
+struct crypto_param_comb {
+	const struct crypto_param *param1;
+	const struct crypto_param *param2;
+};
+
+extern struct ipsec_test_data pkt_aes_256_gcm;
+extern struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256;
+
+extern struct crypto_param_comb alg_list[RTE_DIM(aead_list) +
+					 (RTE_DIM(cipher_list) *
+					  RTE_DIM(auth_list))];
+
+void test_ipsec_alg_list_populate(void);
+
 int test_ipsec_sec_caps_verify(struct rte_security_ipsec_xform *ipsec_xform,
 			       const struct rte_security_capability *sec_cap,
 			       bool silent);
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index 83536ed..62682d0 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -57,6 +57,7 @@ New Features
 
 * **Updated lookaside protocol (IPsec) tests in dpdk-test.**
 
+  * Added support for chained operations.
   * Added AES-CBC 128 NULL auth known vector tests.
   * Added AES-CBC 128 HMAC-SHA256 known vector tests.
 
-- 
2.7.4

[PATCH v2 04/13] test/crypto: add IPv6 tunnel mode cases

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Add IPv6 known vector and combined mode tests.

Following modes are added:
Tunnel IPv6 in IPv6
Tunnel IPv4 in IPv4
Tunnel IPv4 in IPv6
Tunnel IPv6 in IPv4

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c                          | 102 ++++++++++-
 app/test/test_cryptodev_security_ipsec.c           |  74 +++++++-
 app/test/test_cryptodev_security_ipsec.h           |   4 +
 .../test_cryptodev_security_ipsec_test_vectors.h   | 202 +++++++++++++++++++++
 doc/guides/rel_notes/release_22_03.rst             |   5 +
 5 files changed, 383 insertions(+), 4 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index a307aec..a64ed60 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9125,6 +9125,10 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 			 bool silent,
 			 const struct ipsec_test_flags *flags)
 {
+	uint16_t v6_src[8] = {0x2607, 0xf8b0, 0x400c, 0x0c03, 0x0000, 0x0000,
+				0x0000, 0x001a};
+	uint16_t v6_dst[8] = {0x2001, 0x0470, 0xe5bf, 0xdead, 0x4957, 0x2174,
+				0xe82c, 0x4887};
 	struct crypto_testsuite_params *ts_params = &testsuite_params;
 	struct crypto_unittest_params *ut_params = &unittest_params;
 	struct rte_security_capability_idx sec_cap_idx;
@@ -9158,8 +9162,16 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 			dst += 1;
 	}
 
-	memcpy(&ipsec_xform.tunnel.ipv4.src_ip, &src, sizeof(src));
-	memcpy(&ipsec_xform.tunnel.ipv4.dst_ip, &dst, sizeof(dst));
+	if (td->ipsec_xform.tunnel.type ==
+			RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+		memcpy(&ipsec_xform.tunnel.ipv4.src_ip, &src, sizeof(src));
+		memcpy(&ipsec_xform.tunnel.ipv4.dst_ip, &dst, sizeof(dst));
+	} else {
+		memcpy(&ipsec_xform.tunnel.ipv6.src_addr, &v6_src,
+			sizeof(v6_src));
+		memcpy(&ipsec_xform.tunnel.ipv6.dst_addr, &v6_dst,
+			sizeof(v6_dst));
+	}
 
 	ctx = rte_cryptodev_get_sec_ctx(dev_id);
 
@@ -9555,6 +9567,58 @@ test_ipsec_proto_inner_l4_csum(const void *data __rte_unused)
 }
 
 static int
+test_ipsec_proto_tunnel_v4_in_v4(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.ipv6 = false;
+	flags.tunnel_ipv6 = false;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_tunnel_v6_in_v6(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.ipv6 = true;
+	flags.tunnel_ipv6 = true;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_tunnel_v4_in_v6(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.ipv6 = false;
+	flags.tunnel_ipv6 = true;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_tunnel_v6_in_v4(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.ipv6 = true;
+	flags.tunnel_ipv6 = false;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
 test_PDCP_PROTO_all(void)
 {
 	struct crypto_testsuite_params *ts_params = &testsuite_params;
@@ -14431,6 +14495,15 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			test_ipsec_proto_known_vec,
 			&pkt_aes_128_cbc_hmac_sha256),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv6 AES-GCM 128)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec, &pkt_aes_256_gcm_v6),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv6 AES-CBC 128 HMAC-SHA256 [16B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec,
+			&pkt_aes_128_cbc_hmac_sha256_v6),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Inbound known vector (ESP tunnel mode IPv4 AES-GCM 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_128_gcm),
@@ -14451,6 +14524,15 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb,
 			&pkt_aes_128_cbc_hmac_sha256),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv6 AES-GCM 128)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb, &pkt_aes_256_gcm_v6),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv6 AES-CBC 128 HMAC-SHA256 [16B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb,
+			&pkt_aes_128_cbc_hmac_sha256_v6),
 		TEST_CASE_NAMED_ST(
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,
@@ -14495,6 +14577,22 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Inner L4 checksum",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_inner_l4_csum),
+		TEST_CASE_NAMED_ST(
+			"Tunnel IPv4 in IPv4",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_tunnel_v4_in_v4),
+		TEST_CASE_NAMED_ST(
+			"Tunnel IPv6 in IPv6",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_tunnel_v6_in_v6),
+		TEST_CASE_NAMED_ST(
+			"Tunnel IPv4 in IPv6",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_tunnel_v4_in_v6),
+		TEST_CASE_NAMED_ST(
+			"Tunnel IPv6 in IPv4",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_tunnel_v6_in_v4),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 5f67dc0..12031d3 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -19,6 +19,40 @@ struct crypto_param_comb alg_list[RTE_DIM(aead_list) +
 				  (RTE_DIM(cipher_list) *
 				   RTE_DIM(auth_list))];
 
+static bool
+is_valid_ipv4_pkt(const struct rte_ipv4_hdr *pkt)
+{
+	/* The IP version number must be 4 */
+	if (((pkt->version_ihl) >> 4) != 4)
+		return false;
+	/*
+	 * The IP header length field must be large enough to hold the
+	 * minimum length legal IP datagram (20 bytes = 5 words).
+	 */
+	if ((pkt->version_ihl & 0xf) < 5)
+		return false;
+
+	/*
+	 * The IP total length field must be large enough to hold the IP
+	 * datagram header, whose length is specified in the IP header length
+	 * field.
+	 */
+	if (rte_cpu_to_be_16(pkt->total_length) < sizeof(struct rte_ipv4_hdr))
+		return false;
+
+	return true;
+}
+
+static bool
+is_valid_ipv6_pkt(const struct rte_ipv6_hdr *pkt)
+{
+	/* The IP version number must be 6 */
+	if ((rte_be_to_cpu_32((pkt->vtc_flow)) >> 28) != 6)
+		return false;
+
+	return true;
+}
+
 void
 test_ipsec_alg_list_populate(void)
 {
@@ -320,14 +354,22 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 
 		if (param1->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 			/* Copy template for packet & key fields */
-			memcpy(td, &pkt_aes_256_gcm, sizeof(*td));
+			if (flags->ipv6)
+				memcpy(td, &pkt_aes_256_gcm_v6, sizeof(*td));
+			else
+				memcpy(td, &pkt_aes_256_gcm, sizeof(*td));
 
 			td->aead = true;
 			td->xform.aead.aead.algo = param1->alg.aead;
 			td->xform.aead.aead.key.length = param1->key_length;
 		} else {
 			/* Copy template for packet & key fields */
-			memcpy(td, &pkt_aes_128_cbc_hmac_sha256, sizeof(*td));
+			if (flags->ipv6)
+				memcpy(td, &pkt_aes_128_cbc_hmac_sha256_v6,
+					sizeof(*td));
+			else
+				memcpy(td, &pkt_aes_128_cbc_hmac_sha256,
+					sizeof(*td));
 
 			td->aead = false;
 			td->xform.chain.cipher.cipher.algo = param1->alg.cipher;
@@ -358,6 +400,13 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 			test_ipsec_csum_init(&td->input_text.data, false, true);
 		}
 
+		if (flags->tunnel_ipv6)
+			td->ipsec_xform.tunnel.type =
+					RTE_SECURITY_IPSEC_TUNNEL_IPV6;
+		else
+			td->ipsec_xform.tunnel.type =
+					RTE_SECURITY_IPSEC_TUNNEL_IPV4;
+
 	}
 }
 
@@ -686,6 +735,7 @@ test_ipsec_post_process(struct rte_mbuf *m, const struct ipsec_test_data *td,
 			struct ipsec_test_data *res_d, bool silent,
 			const struct ipsec_test_flags *flags)
 {
+	uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *);
 	int ret;
 
 	if (flags->iv_gen &&
@@ -695,6 +745,26 @@ test_ipsec_post_process(struct rte_mbuf *m, const struct ipsec_test_data *td,
 			return ret;
 	}
 
+	if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
+		const struct rte_ipv4_hdr *iph4;
+		const struct rte_ipv6_hdr *iph6;
+
+		if (td->ipsec_xform.tunnel.type ==
+				RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+			iph4 = (const struct rte_ipv4_hdr *)output_text;
+			if (is_valid_ipv4_pkt(iph4) == false) {
+				printf("Outer header is not IPv4\n");
+				return TEST_FAILED;
+			}
+		} else {
+			iph6 = (const struct rte_ipv6_hdr *)output_text;
+			if (is_valid_ipv6_pkt(iph6) == false) {
+				printf("Outer header is not IPv6\n");
+				return TEST_FAILED;
+			}
+		}
+	}
+
 	/*
 	 * In case of known vector tests & all inbound tests, res_d provided
 	 * would be NULL and output data need to be validated against expected.
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index b1f0ff8..69e81ae 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -61,6 +61,8 @@ struct ipsec_test_flags {
 	bool udp_ports_verify;
 	bool ip_csum;
 	bool l4_csum;
+	bool ipv6;
+	bool tunnel_ipv6;
 };
 
 struct crypto_param {
@@ -119,7 +121,9 @@ struct crypto_param_comb {
 };
 
 extern struct ipsec_test_data pkt_aes_256_gcm;
+extern struct ipsec_test_data pkt_aes_256_gcm_v6;
 extern struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256;
+extern struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256_v6;
 
 extern struct crypto_param_comb alg_list[RTE_DIM(aead_list) +
 					 (RTE_DIM(cipher_list) *
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index 16c88fe..04ccbf0 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -434,6 +434,103 @@ struct ipsec_test_data pkt_aes_128_cbc_null = {
 	},
 };
 
+struct ipsec_test_data pkt_aes_256_gcm_v6 = {
+	.key = {
+		.data = {
+			0xde, 0x12, 0xbe, 0x56, 0xde, 0xad, 0xbe, 0xef,
+			0xde, 0xad, 0xbe, 0xef, 0xde, 0xad, 0xbe, 0xef,
+			0x12, 0x78, 0xbe, 0x34, 0x01, 0x02, 0x03, 0x07,
+			0xaa, 0xbb, 0xcc, 0xf1, 0x08, 0x07, 0x06, 0x05,
+		},
+	},
+	.input_text = {
+		.data = {
+			0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x38,
+			0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0c, 0x0c, 0x03,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a,
+			0x20, 0x01, 0x04, 0x70, 0xe5, 0xbf, 0xde, 0xad,
+			0x49, 0x57, 0x21, 0x74, 0xe8, 0x2c, 0x48, 0x87,
+			0x00, 0x19, 0xf9, 0xc7, 0x95, 0x63, 0x97, 0x9c,
+			0x03, 0xa0, 0x88, 0x31, 0x80, 0x12, 0xa7, 0xd6,
+			0x25, 0x83, 0x00, 0x00, 0x02, 0x04, 0x05, 0x6a,
+			0x01, 0x01, 0x04, 0x02, 0x01, 0x03, 0x03, 0x07,
+		},
+		.len = 72,
+	},
+	.output_text = {
+		.data = {
+			0x60, 0x00, 0x00, 0x00, 0x00, 0x6c, 0x32, 0x40,
+			0x12, 0x34, 0x12, 0x21, 0x17, 0x45, 0x11, 0x34,
+			0x11, 0xfc, 0x89, 0x71, 0xdf, 0x22, 0x56, 0x78,
+			0x12, 0x34, 0x12, 0x21, 0x17, 0x45, 0x11, 0x34,
+			0x11, 0xfc, 0x89, 0x71, 0xdf, 0x22, 0x34, 0x56,
+			0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x01,
+			0x45, 0xad, 0xfe, 0x23, 0x78, 0x56, 0x12, 0x00,
+			0xe7, 0xdf, 0xc4, 0x7e, 0x21, 0xbd, 0xec, 0x1b,
+			0x74, 0x5a, 0xe4, 0x7e, 0x2e, 0x94, 0x21, 0x0a,
+			0x9b, 0x0e, 0x59, 0xbe, 0x06, 0x2a, 0xda, 0xb8,
+			0x6b, 0x48, 0x7f, 0x0b, 0x88, 0x3a, 0xa9, 0xfd,
+			0x3c, 0xfe, 0x9f, 0xb1, 0x8c, 0x67, 0xd2, 0xf8,
+			0xaf, 0xb5, 0xad, 0x16, 0xdb, 0xff, 0x8d, 0x50,
+			0xd3, 0x48, 0xf5, 0x6c, 0x3c, 0x0c, 0x27, 0x34,
+			0x2b, 0x65, 0xc8, 0xff, 0xeb, 0x5f, 0xb8, 0xff,
+			0x12, 0x00, 0x1c, 0x9f, 0xb7, 0x85, 0xdd, 0x7d,
+			0x40, 0x19, 0xcb, 0x18, 0xeb, 0x15, 0xc4, 0x88,
+			0xe1, 0xc2, 0x91, 0xc7, 0xb1, 0x65, 0xc3, 0x27,
+			0x16, 0x06, 0x8f, 0xf2,
+		},
+		.len = 148,
+	},
+	.salt = {
+		.data = {
+			0x11, 0x22, 0x33, 0x44
+		},
+		.len = 4,
+	},
+
+	.iv = {
+		.data = {
+			0x45, 0xad, 0xfe, 0x23, 0x78, 0x56, 0x12, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV6,
+		.replay_win_sz = 0,
+	},
+
+	.aead = true,
+
+	.xform = {
+		.aead = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AEAD,
+			.aead = {
+				.op = RTE_CRYPTO_AEAD_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_AEAD_AES_GCM,
+				.key.length = 32,
+				.iv.length = 12,
+				.iv.offset = IV_OFFSET,
+				.digest_length = 16,
+				.aad_length = 12,
+			},
+		},
+	},
+};
+
 struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256 = {
 	.key = {
 		.data = {
@@ -543,4 +640,109 @@ struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256 = {
 	},
 };
 
+struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256_v6 = {
+	.key = {
+		.data = {
+			0x00, 0x04, 0x05, 0x01, 0x23, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x0a, 0x0b, 0x0c, 0x0f, 0x00, 0x00,
+		},
+	},
+	.auth_key = {
+		.data = {
+			0xde, 0x34, 0x56, 0x00, 0x00, 0x00, 0x78, 0x00,
+			0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x04,
+			0x0a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+		},
+	},
+	.input_text = {
+		.data = {
+			0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x38,
+			0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0c, 0x0c, 0x03,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a,
+			0x20, 0x01, 0x04, 0x70, 0xe5, 0xbf, 0xde, 0xad,
+			0x49, 0x57, 0x21, 0x74, 0xe8, 0x2c, 0x48, 0x87,
+			0x00, 0x19, 0xf9, 0xc7, 0x95, 0x63, 0x97, 0x9c,
+			0x03, 0xa0, 0x88, 0x31, 0x80, 0x12, 0xa7, 0xd6,
+			0x25, 0x83, 0x00, 0x00, 0x02, 0x04, 0x05, 0x6a,
+			0x01, 0x01, 0x04, 0x02, 0x01, 0x03, 0x03, 0x07,
+		},
+		.len = 72,
+	},
+	.output_text = {
+		.data = {
+			0x60, 0x00, 0x00, 0x00, 0x00, 0x78, 0x32, 0x40,
+			0x12, 0x34, 0x12, 0x21, 0x17, 0x45, 0x11, 0x34,
+			0x11, 0xfc, 0x89, 0x71, 0xdf, 0x22, 0x56, 0x78,
+			0x12, 0x34, 0x12, 0x21, 0x17, 0x45, 0x11, 0x34,
+			0x11, 0xfc, 0x89, 0x71, 0xdf, 0x22, 0x34, 0x56,
+			0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x01,
+			0x45, 0xad, 0xfe, 0x23, 0x78, 0x56, 0x12, 0x00,
+			0xf0, 0xc1, 0x05, 0x3c, 0x00, 0x00, 0x00, 0x00,
+			0x1b, 0x1c, 0x98, 0x6e, 0x2a, 0xce, 0x61, 0xef,
+			0xc1, 0xdd, 0x25, 0x96, 0x5c, 0xb1, 0xb0, 0x15,
+			0x47, 0x25, 0xb7, 0x8b, 0x00, 0xb6, 0xbb, 0xe6,
+			0x2e, 0x29, 0xcb, 0x4a, 0x94, 0x00, 0xf0, 0x73,
+			0xdb, 0x14, 0x32, 0xd9, 0xa2, 0xdf, 0x22, 0x2f,
+			0x52, 0x3e, 0x79, 0x77, 0xf3, 0x17, 0xaa, 0x40,
+			0x1c, 0x57, 0x27, 0x12, 0x82, 0x44, 0x35, 0xb8,
+			0x64, 0xe0, 0xaa, 0x5c, 0x10, 0xc7, 0x97, 0x35,
+			0x9c, 0x6b, 0x1c, 0xf7, 0xe7, 0xbd, 0x83, 0x33,
+			0x77, 0x48, 0x44, 0x7d, 0xa4, 0x13, 0x74, 0x3b,
+			0x6a, 0x91, 0xd0, 0xd8, 0x7d, 0x41, 0x45, 0x23,
+			0x5d, 0xc9, 0x2d, 0x08, 0x7a, 0xd8, 0x25, 0x8e,
+		},
+		.len = 160,
+	},
+	.iv = {
+		.data = {
+			0x45, 0xad, 0xfe, 0x23, 0x78, 0x56, 0x12, 0x00,
+			0xf0, 0xc1, 0x05, 0x3c, 0x00, 0x00, 0x00, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV6,
+		.replay_win_sz = 0,
+	},
+
+	.aead = false,
+
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_CIPHER_AES_CBC,
+				.key.length = 16,
+				.iv.length = 16,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.op = RTE_CRYPTO_AUTH_OP_GENERATE,
+				.algo = RTE_CRYPTO_AUTH_SHA256_HMAC,
+				.key.length = 32,
+				.digest_length = 16,
+			},
+		},
+	},
+};
+
 #endif /* TEST_CRYPTODEV_SECURITY_IPSEC_TEST_VECTORS_H_ */
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index 62682d0..42f3a3c 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -60,6 +60,11 @@ New Features
   * Added support for chained operations.
   * Added AES-CBC 128 NULL auth known vector tests.
   * Added AES-CBC 128 HMAC-SHA256 known vector tests.
+  * Added tunnel mode tests
+    * IPv6 in IPv6
+    * IPv4 in IPv4
+    * IPv4 in IPv6
+    * IPv6 in IPv4
 
 
 Removed Items
-- 
2.7.4

[PATCH v2 05/13] test/crypto: add IPsec HMAC-SHA384/512 known vectors

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Add lookaside IPsec HMAC-SHA384/512 known vectors.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c                          |  20 ++
 app/test/test_cryptodev_security_ipsec.h           |  14 +-
 .../test_cryptodev_security_ipsec_test_vectors.h   | 213 +++++++++++++++++++++
 doc/guides/rel_notes/release_22_03.rst             |   2 +
 4 files changed, 248 insertions(+), 1 deletion(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index a64ed60..0f74984 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -14495,6 +14495,16 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			test_ipsec_proto_known_vec,
 			&pkt_aes_128_cbc_hmac_sha256),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA384 [24B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec,
+			&pkt_aes_128_cbc_hmac_sha384),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA512 [32B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec,
+			&pkt_aes_128_cbc_hmac_sha512),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Outbound known vector (ESP tunnel mode IPv6 AES-GCM 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec, &pkt_aes_256_gcm_v6),
@@ -14525,6 +14535,16 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			test_ipsec_proto_known_vec_inb,
 			&pkt_aes_128_cbc_hmac_sha256),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA384 [24B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb,
+			&pkt_aes_128_cbc_hmac_sha384),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv4 AES-CBC 128 HMAC-SHA512 [32B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb,
+			&pkt_aes_128_cbc_hmac_sha512),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Inbound known vector (ESP tunnel mode IPv6 AES-GCM 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_256_gcm_v6),
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 69e81ae..d74eee7 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -15,7 +15,7 @@ struct ipsec_test_data {
 		uint8_t data[32];
 	} key;
 	struct {
-		uint8_t data[32];
+		uint8_t data[64];
 	} auth_key;
 
 	struct {
@@ -113,6 +113,18 @@ static const struct crypto_param auth_list[] = {
 		.key_length = 32,
 		.digest_length = 16,
 	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_SHA384_HMAC,
+		.key_length = 48,
+		.digest_length = 24,
+	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_SHA512_HMAC,
+		.key_length = 64,
+		.digest_length = 32,
+	},
 };
 
 struct crypto_param_comb {
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index 04ccbf0..b8661f7 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -640,6 +640,219 @@ struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256 = {
 	},
 };
 
+struct ipsec_test_data pkt_aes_128_cbc_hmac_sha384 = {
+	.key = {
+		.data = {
+			0x00, 0x04, 0x05, 0x01, 0x23, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x0a, 0x0b, 0x0c, 0x0f, 0x00, 0x00,
+		},
+	},
+	.auth_key = {
+		.data = {
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x04,
+			0x0a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+			0xde, 0x34, 0x56, 0x00, 0x00, 0x00, 0x78, 0x00,
+			0x00, 0x10, 0x00, 0x00, 0x00, 0x10, 0x00, 0x02,
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x34,
+			0x1a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+		},
+	},
+	.input_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x32, 0x00, 0x01, 0x00, 0x00,
+			0x1f, 0x11, 0x17, 0x8b, 0xc0, 0xa8, 0x01, 0x6f,
+			0xc0, 0xa8, 0x01, 0x70,
+
+			/* UDP */
+			0x00, 0x09, 0x00, 0x09, 0x00, 0x1e, 0x00, 0x00,
+			0xbe, 0x9b, 0xe9, 0x55, 0x00, 0x00, 0x00, 0x21,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		},
+		.len = 50,
+	},
+	.output_text = {
+		.data = {
+			0x45, 0x00, 0x00, 0x84, 0x00, 0x01, 0x00, 0x00,
+			0x40, 0x32, 0x52, 0x45, 0x14, 0x00, 0x00, 0x01,
+			0x14, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x34,
+			0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x44, 0x24, 0xb9, 0xd8,
+			0x0f, 0xbe, 0xa3, 0x3f, 0xc9, 0xc0, 0xa2, 0xcb,
+			0xaa, 0xda, 0x3f, 0xc6, 0x0e, 0x88, 0x75, 0x96,
+			0x25, 0x50, 0x07, 0x4d, 0x52, 0xf4, 0x75, 0xec,
+			0xd8, 0xcd, 0xe4, 0xcf, 0x85, 0x9a, 0xbc, 0x9e,
+			0x84, 0x0f, 0xbb, 0x83, 0x72, 0x0c, 0x7f, 0x58,
+			0x02, 0x46, 0xeb, 0x86, 0x6e, 0xd1, 0xcf, 0x05,
+			0x6a, 0xd1, 0xd2, 0xc6, 0xb5, 0x94, 0x09, 0x0a,
+			0x3e, 0xdf, 0x09, 0xfb, 0x0a, 0xb7, 0xb4, 0x97,
+			0x17, 0xf2, 0x20, 0xaf, 0xfa, 0x90, 0x92, 0x4d,
+			0xe4, 0x0e, 0xef, 0x5a, 0xe8, 0x43, 0x46, 0xa8,
+			0x5e, 0x3f, 0x52, 0x46,
+		},
+		.len = 132,
+	},
+	.iv = {
+		.data = {
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+
+	.aead = false,
+
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_CIPHER_AES_CBC,
+				.key.length = 16,
+				.iv.length = 16,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.op = RTE_CRYPTO_AUTH_OP_GENERATE,
+				.algo = RTE_CRYPTO_AUTH_SHA384_HMAC,
+				.key.length = 48,
+				.digest_length = 24,
+			},
+		},
+	},
+};
+
+struct ipsec_test_data pkt_aes_128_cbc_hmac_sha512 = {
+	.key = {
+		.data = {
+			0x00, 0x04, 0x05, 0x01, 0x23, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x0a, 0x0b, 0x0c, 0x0f, 0x00, 0x00,
+		},
+	},
+	.auth_key = {
+		.data = {
+			0xde, 0x34, 0x56, 0x00, 0x00, 0x00, 0x78, 0x00,
+			0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x04,
+			0x0a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+			0xde, 0x34, 0x56, 0x00, 0x00, 0x00, 0x78, 0x00,
+			0x00, 0x10, 0x00, 0x00, 0x00, 0x10, 0x00, 0x02,
+			0x10, 0x30, 0x40, 0x00, 0x01, 0x02, 0x03, 0x34,
+			0x1a, 0x0b, 0x0c, 0x0d, 0x05, 0x06, 0x07, 0x08,
+		},
+	},
+	.input_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x32, 0x00, 0x01, 0x00, 0x00,
+			0x1f, 0x11, 0x17, 0x8b, 0xc0, 0xa8, 0x01, 0x6f,
+			0xc0, 0xa8, 0x01, 0x70,
+
+			/* UDP */
+			0x00, 0x09, 0x00, 0x09, 0x00, 0x1e, 0x00, 0x00,
+			0xbe, 0x9b, 0xe9, 0x55, 0x00, 0x00, 0x00, 0x21,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		},
+		.len = 50,
+	},
+	.output_text = {
+		.data = {
+			0x45, 0x00, 0x00, 0x8c, 0x00, 0x01, 0x00, 0x00,
+			0x40, 0x32, 0x52, 0x3d, 0x14, 0x00, 0x00, 0x01,
+			0x14, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x34,
+			0x00, 0x00, 0x00, 0x01, 0x42, 0x32, 0x76, 0x65,
+			0x45, 0x35, 0x24, 0x41, 0xf0, 0xc1, 0xb4, 0x40,
+			0x00, 0x00, 0x00, 0x00, 0xd0, 0x32, 0x23, 0xf7,
+			0xcd, 0x3d, 0xdb, 0xd5, 0x70, 0x19, 0x1b, 0xf5,
+			0x8f, 0xeb, 0x98, 0x3d, 0x41, 0x5c, 0x28, 0xdd,
+			0xfd, 0xcc, 0xdd, 0xa2, 0xeb, 0x43, 0x4c, 0x13,
+			0x2d, 0xa1, 0x98, 0x87, 0x92, 0x3a, 0x1f, 0x67,
+			0x20, 0x8d, 0x9e, 0x8e, 0x51, 0x21, 0x4c, 0xa9,
+			0xff, 0xad, 0xfb, 0x5d, 0x57, 0xa3, 0x16, 0x91,
+			0xaa, 0x75, 0xc7, 0x28, 0x42, 0x4e, 0x8f, 0x8e,
+			0x84, 0x37, 0x94, 0x09, 0x74, 0xfa, 0x70, 0x0d,
+			0xd1, 0x37, 0xe2, 0x7c, 0x54, 0xdd, 0x2e, 0xb4,
+			0xf4, 0x54, 0x4b, 0x12, 0xe0, 0xaf, 0x4a, 0x0a,
+			0x0b, 0x52, 0x57, 0x9d, 0x36, 0xdc, 0xac, 0x02,
+			0xfb, 0x55, 0x34, 0x05,
+		},
+		.len = 140,
+	},
+	.iv = {
+		.data = {
+			0x42, 0x32, 0x76, 0x65, 0x45, 0x35, 0x24, 0x41,
+			0xf0, 0xc1, 0xb4, 0x40, 0x00, 0x00, 0x00, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+
+	.aead = false,
+
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_CIPHER_AES_CBC,
+				.key.length = 16,
+				.iv.length = 16,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.op = RTE_CRYPTO_AUTH_OP_GENERATE,
+				.algo = RTE_CRYPTO_AUTH_SHA512_HMAC,
+				.key.length = 64,
+				.digest_length = 32,
+			},
+		},
+	},
+};
+
 struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256_v6 = {
 	.key = {
 		.data = {
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index 42f3a3c..65e348f 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -60,6 +60,8 @@ New Features
   * Added support for chained operations.
   * Added AES-CBC 128 NULL auth known vector tests.
   * Added AES-CBC 128 HMAC-SHA256 known vector tests.
+  * Added AES-CBC 128 HMAC-SHA384 known vector tests.
+  * Added AES-CBC 128 HMAC-SHA512 known vector tests.
   * Added tunnel mode tests
     * IPv6 in IPv6
     * IPv4 in IPv4
-- 
2.7.4

[PATCH v2 06/13] test/crypto: add IPsec fragmented packet known vectors

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Add fragmented plain packet known vector test case in
IPsec outbound.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c                          |  22 +++++
 app/test/test_cryptodev_security_ipsec.c           |  10 ++
 app/test/test_cryptodev_security_ipsec.h           |   1 +
 .../test_cryptodev_security_ipsec_test_vectors.h   | 104 +++++++++++++++++++++
 doc/guides/rel_notes/release_22_03.rst             |   1 +
 5 files changed, 138 insertions(+)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 0f74984..e2bbabf 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9383,6 +9383,23 @@ test_ipsec_proto_known_vec_inb(const void *test_data)
 }
 
 static int
+test_ipsec_proto_known_vec_fragmented(const void *test_data)
+{
+	struct ipsec_test_data td_outb;
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+	flags.fragment = true;
+
+	memcpy(&td_outb, test_data, sizeof(td_outb));
+
+	/* Disable IV gen to be able to test with known vectors */
+	td_outb.ipsec_xform.options.iv_gen_disable = 1;
+
+	return test_ipsec_proto_process(&td_outb, NULL, 1, false, &flags);
+}
+
+static int
 test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 {
 	struct ipsec_test_data td_outb[IPSEC_TEST_PACKETS_MAX];
@@ -14514,6 +14531,11 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			test_ipsec_proto_known_vec,
 			&pkt_aes_128_cbc_hmac_sha256_v6),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound fragmented packet",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_fragmented,
+			&pkt_aes_128_gcm_frag),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Inbound known vector (ESP tunnel mode IPv4 AES-GCM 128)",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb, &pkt_aes_128_gcm),
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 12031d3..ccce63f 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -659,6 +659,16 @@ test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td,
 		return TEST_FAILED;
 	}
 
+	if ((td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) &&
+				flags->fragment) {
+		const struct rte_ipv4_hdr *iph4;
+		iph4 = (const struct rte_ipv4_hdr *)output_text;
+		if (iph4->fragment_offset) {
+			printf("Output packet is fragmented");
+			return TEST_FAILED;
+		}
+	}
+
 	skip = test_ipsec_tunnel_hdr_len_get(td);
 
 	len -= skip;
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index d74eee7..884a795 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -63,6 +63,7 @@ struct ipsec_test_flags {
 	bool l4_csum;
 	bool ipv6;
 	bool tunnel_ipv6;
+	bool fragment;
 };
 
 struct crypto_param {
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index b8661f7..b6d48ad 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -958,4 +958,108 @@ struct ipsec_test_data pkt_aes_128_cbc_hmac_sha256_v6 = {
 	},
 };
 
+struct ipsec_test_data pkt_aes_128_gcm_frag = {
+	.key = {
+		.data = {
+			0xde, 0xad, 0xbe, 0xef, 0xde, 0xad, 0xbe, 0xef,
+			0xde, 0xad, 0xbe, 0xef, 0xde, 0xad, 0xbe, 0xef,
+		},
+	},
+	.input_text = {
+		.data = {
+			0x45, 0x00, 0x00, 0x6e, 0x00, 0x01, 0x00, 0x17,
+			0x40, 0x06, 0xed, 0x48, 0xc6, 0x12, 0x00, 0x00,
+			0xc6, 0x12, 0x01, 0x05, 0x00, 0x14, 0x00, 0x50,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x50, 0x00, 0x00, 0x00, 0x55, 0x05, 0x00, 0x00,
+			0x00, 0x01, 0x02, 0x03, 0xf2, 0xf6, 0xe9, 0x21,
+			0xf9, 0xf2, 0xf6, 0xe9, 0x21, 0xf9, 0xf2, 0xf6,
+			0xe9, 0x21, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		},
+		.len = 110,
+	},
+	.output_text = {
+		.data = {
+			0x45, 0x00, 0x00, 0xa4, 0x00, 0x01, 0x00, 0x00,
+			0x40, 0x32, 0xf6, 0x0c, 0xc0, 0xa8, 0x01, 0x70,
+			0xc0, 0xa8, 0x01, 0x5a, 0x00, 0x00, 0x00, 0x34,
+			0x00, 0x00, 0x00, 0x01, 0x45, 0xad, 0xfe, 0x23,
+			0x78, 0x56, 0x12, 0x00, 0x49, 0x26, 0xac, 0x4e,
+			0x8d, 0xf3, 0x74, 0x26, 0x18, 0x3f, 0x65, 0x94,
+			0x73, 0x2e, 0xe4, 0xcf, 0x84, 0x6d, 0x03, 0x8a,
+			0x4c, 0xdd, 0x2d, 0xef, 0xcd, 0x9f, 0x84, 0x76,
+			0x93, 0xe1, 0xee, 0x21, 0x92, 0x8b, 0xf7, 0x7a,
+			0xb1, 0x6a, 0x7f, 0xd6, 0x10, 0x66, 0xdd, 0xa1,
+			0x8b, 0x17, 0x56, 0x99, 0x9a, 0x40, 0xd0, 0x6b,
+			0x2d, 0xe0, 0x55, 0x40, 0x2f, 0xb8, 0x38, 0xe3,
+			0x08, 0x46, 0xe2, 0x69, 0xc9, 0xa1, 0x85, 0x9d,
+			0x7b, 0xec, 0x33, 0x2a, 0x2d, 0x1d, 0x1f, 0x1a,
+			0x9e, 0xf0, 0x1e, 0xc3, 0x33, 0x64, 0x35, 0x82,
+			0xbb, 0xb5, 0x7a, 0x91, 0x2e, 0x8d, 0xd5, 0x5b,
+			0x3a, 0xbe, 0x95, 0x94, 0xba, 0x40, 0x73, 0x4e,
+			0xa4, 0x15, 0xe4, 0x4a, 0xf9, 0x14, 0x2c, 0x4f,
+			0x63, 0x2e, 0x23, 0x6e, 0xeb, 0x06, 0xe7, 0x52,
+			0xe1, 0xc7, 0x91, 0x7f, 0x19, 0xc0, 0x4a, 0xd2,
+			0xd5, 0x3e, 0x84, 0xa8,
+		},
+		.len = 164,
+	},
+	.salt = {
+		.data = {
+			0xde, 0xad, 0xbe, 0xef,
+		},
+		.len = 4,
+	},
+
+	.iv = {
+		.data = {
+			0x45, 0xad, 0xfe, 0x23, 0x78, 0x56, 0x12, 0x00,
+		},
+	},
+
+	.ipsec_xform = {
+		.spi = 52,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.options.ip_csum_enable = 0,
+		.options.l4_csum_enable = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+
+	.aead = true,
+
+	.xform = {
+		.aead = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AEAD,
+			.aead = {
+				.op = RTE_CRYPTO_AEAD_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_AEAD_AES_GCM,
+				.key.length = 16,
+				.iv.length = 12,
+				.iv.offset = IV_OFFSET,
+				.digest_length = 16,
+				.aad_length = 12,
+			},
+		},
+	},
+};
+
 #endif /* TEST_CRYPTODEV_SECURITY_IPSEC_TEST_VECTORS_H_ */
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index 65e348f..0562547 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -67,6 +67,7 @@ New Features
     * IPv4 in IPv4
     * IPv4 in IPv6
     * IPv6 in IPv4
+  * Added tunnel mode fragment packet tests.
 
 
 Removed Items
-- 
2.7.4

[PATCH v2 07/13] test/crypto: add transport mode cases

[Anoob Joseph]

Add transport mode tests with test cases for IPv4 packets.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
---
 app/test/test_cryptodev.c                | 39 ++++++++++++++----
 app/test/test_cryptodev_security_ipsec.c | 71 +++++++++++++++++++++-----------
 app/test/test_cryptodev_security_ipsec.h |  1 +
 doc/guides/rel_notes/release_22_03.rst   |  1 +
 4 files changed, 80 insertions(+), 32 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index e2bbabf..f470d5c 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9162,15 +9162,19 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 			dst += 1;
 	}
 
-	if (td->ipsec_xform.tunnel.type ==
-			RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
-		memcpy(&ipsec_xform.tunnel.ipv4.src_ip, &src, sizeof(src));
-		memcpy(&ipsec_xform.tunnel.ipv4.dst_ip, &dst, sizeof(dst));
-	} else {
-		memcpy(&ipsec_xform.tunnel.ipv6.src_addr, &v6_src,
-			sizeof(v6_src));
-		memcpy(&ipsec_xform.tunnel.ipv6.dst_addr, &v6_dst,
-			sizeof(v6_dst));
+	if (td->ipsec_xform.mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
+		if (td->ipsec_xform.tunnel.type ==
+				RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+			memcpy(&ipsec_xform.tunnel.ipv4.src_ip, &src,
+			       sizeof(src));
+			memcpy(&ipsec_xform.tunnel.ipv4.dst_ip, &dst,
+			       sizeof(dst));
+		} else {
+			memcpy(&ipsec_xform.tunnel.ipv6.src_addr, &v6_src,
+			       sizeof(v6_src));
+			memcpy(&ipsec_xform.tunnel.ipv6.dst_addr, &v6_dst,
+			       sizeof(v6_dst));
+		}
 	}
 
 	ctx = rte_cryptodev_get_sec_ctx(dev_id);
@@ -9636,6 +9640,19 @@ test_ipsec_proto_tunnel_v6_in_v4(const void *data __rte_unused)
 }
 
 static int
+test_ipsec_proto_transport_v4(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.ipv6 = false;
+	flags.transport = true;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
 test_PDCP_PROTO_all(void)
 {
 	struct crypto_testsuite_params *ts_params = &testsuite_params;
@@ -14635,6 +14652,10 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Tunnel IPv6 in IPv4",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_tunnel_v6_in_v4),
+		TEST_CASE_NAMED_ST(
+			"Transport IPv4",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_transport_v4),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index ccce63f..029fdd3 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -400,12 +400,21 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 			test_ipsec_csum_init(&td->input_text.data, false, true);
 		}
 
-		if (flags->tunnel_ipv6)
-			td->ipsec_xform.tunnel.type =
-					RTE_SECURITY_IPSEC_TUNNEL_IPV6;
-		else
-			td->ipsec_xform.tunnel.type =
-					RTE_SECURITY_IPSEC_TUNNEL_IPV4;
+		if (flags->transport) {
+			td->ipsec_xform.mode =
+					RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT;
+		} else {
+			td->ipsec_xform.mode =
+					RTE_SECURITY_IPSEC_SA_MODE_TUNNEL;
+
+			if (flags->tunnel_ipv6)
+				td->ipsec_xform.tunnel.type =
+						RTE_SECURITY_IPSEC_TUNNEL_IPV6;
+			else
+				td->ipsec_xform.tunnel.type =
+						RTE_SECURITY_IPSEC_TUNNEL_IPV4;
+		}
+
 
 	}
 }
@@ -748,29 +757,45 @@ test_ipsec_post_process(struct rte_mbuf *m, const struct ipsec_test_data *td,
 	uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *);
 	int ret;
 
-	if (flags->iv_gen &&
-	    td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
-		ret = test_ipsec_iv_verify_push(m, td);
-		if (ret != TEST_SUCCESS)
-			return ret;
-	}
-
 	if (td->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
 		const struct rte_ipv4_hdr *iph4;
 		const struct rte_ipv6_hdr *iph6;
 
-		if (td->ipsec_xform.tunnel.type ==
-				RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
-			iph4 = (const struct rte_ipv4_hdr *)output_text;
-			if (is_valid_ipv4_pkt(iph4) == false) {
-				printf("Outer header is not IPv4\n");
-				return TEST_FAILED;
+		if (flags->iv_gen) {
+			ret = test_ipsec_iv_verify_push(m, td);
+			if (ret != TEST_SUCCESS)
+				return ret;
+		}
+
+		iph4 = (const struct rte_ipv4_hdr *)output_text;
+
+		if (td->ipsec_xform.mode ==
+				RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT) {
+			if (flags->ipv6) {
+				iph6 = (const struct rte_ipv6_hdr *)output_text;
+				if (is_valid_ipv6_pkt(iph6) == false) {
+					printf("Transport packet is not IPv6\n");
+					return TEST_FAILED;
+				}
+			} else {
+				if (is_valid_ipv4_pkt(iph4) == false) {
+					printf("Transport packet is not IPv4\n");
+					return TEST_FAILED;
+				}
 			}
 		} else {
-			iph6 = (const struct rte_ipv6_hdr *)output_text;
-			if (is_valid_ipv6_pkt(iph6) == false) {
-				printf("Outer header is not IPv6\n");
-				return TEST_FAILED;
+			if (td->ipsec_xform.tunnel.type ==
+					RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+				if (is_valid_ipv4_pkt(iph4) == false) {
+					printf("Tunnel outer header is not IPv4\n");
+					return TEST_FAILED;
+				}
+			} else {
+				iph6 = (const struct rte_ipv6_hdr *)output_text;
+				if (is_valid_ipv6_pkt(iph6) == false) {
+					printf("Tunnel outer header is not IPv6\n");
+					return TEST_FAILED;
+				}
 			}
 		}
 	}
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 884a795..07d2453 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -63,6 +63,7 @@ struct ipsec_test_flags {
 	bool l4_csum;
 	bool ipv6;
 	bool tunnel_ipv6;
+	bool transport;
 	bool fragment;
 };
 
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index 0562547..58e9690 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -67,6 +67,7 @@ New Features
     * IPv4 in IPv4
     * IPv4 in IPv6
     * IPv6 in IPv4
+  * Added IPv4 transport mode tests.
   * Added tunnel mode fragment packet tests.
 
 
-- 
2.7.4

[PATCH v2 08/13] test/crypto: add security stats cases

[Anoob Joseph]

From: Ankur Dwivedi <adwivedi@marvell.com>

Adds security stats test cases in IPSEC protocol testsuite.

Signed-off-by: Ankur Dwivedi <adwivedi@marvell.com>
---
 app/test/test_cryptodev.c                | 21 +++++++++++++++++++++
 app/test/test_cryptodev_security_ipsec.c | 29 +++++++++++++++++++++++++++++
 app/test/test_cryptodev_security_ipsec.h |  6 ++++++
 doc/guides/rel_notes/release_22_03.rst   |  1 +
 4 files changed, 57 insertions(+)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index f470d5c..d5902dd 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9332,6 +9332,11 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 		if (ret != TEST_SUCCESS)
 			goto crypto_op_free;
 
+		ret = test_ipsec_stats_verify(ctx, ut_params->sec_session,
+					      flags, dir);
+		if (ret != TEST_SUCCESS)
+			goto crypto_op_free;
+
 		rte_crypto_op_free(ut_params->op);
 		ut_params->op = NULL;
 
@@ -9653,6 +9658,18 @@ test_ipsec_proto_transport_v4(const void *data __rte_unused)
 }
 
 static int
+test_ipsec_proto_stats(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.stats_success = true;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
 test_PDCP_PROTO_all(void)
 {
 	struct crypto_testsuite_params *ts_params = &testsuite_params;
@@ -14656,6 +14673,10 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Transport IPv4",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_transport_v4),
+		TEST_CASE_NAMED_ST(
+			"Statistics: success",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_stats),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 029fdd3..6fa1d3d 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -415,6 +415,8 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 						RTE_SECURITY_IPSEC_TUNNEL_IPV4;
 		}
 
+		if (flags->stats_success)
+			td->ipsec_xform.options.stats = 1;
 
 	}
 }
@@ -871,3 +873,30 @@ test_ipsec_status_check(struct rte_crypto_op *op,
 
 	return ret;
 }
+
+int
+test_ipsec_stats_verify(struct rte_security_ctx *ctx,
+			struct rte_security_session *sess,
+			const struct ipsec_test_flags *flags,
+			enum rte_security_ipsec_sa_direction dir)
+{
+	struct rte_security_stats stats = {0};
+	int ret = TEST_SUCCESS;
+
+	if (flags->stats_success) {
+		if (rte_security_session_stats_get(ctx, sess, &stats) < 0)
+			return TEST_FAILED;
+
+		if (dir == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
+			if (stats.ipsec.opackets != 1 ||
+			    stats.ipsec.oerrors != 0)
+				ret = TEST_FAILED;
+		} else {
+			if (stats.ipsec.ipackets != 1 ||
+			    stats.ipsec.ierrors != 0)
+				ret = TEST_FAILED;
+		}
+	}
+
+	return ret;
+}
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 07d2453..3565a8c 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -65,6 +65,7 @@ struct ipsec_test_flags {
 	bool tunnel_ipv6;
 	bool transport;
 	bool fragment;
+	bool stats_success;
 };
 
 struct crypto_param {
@@ -188,4 +189,9 @@ int test_ipsec_status_check(struct rte_crypto_op *op,
 			    enum rte_security_ipsec_sa_direction dir,
 			    int pkt_num);
 
+int test_ipsec_stats_verify(struct rte_security_ctx *ctx,
+			    struct rte_security_session *sess,
+			    const struct ipsec_test_flags *flags,
+			    enum rte_security_ipsec_sa_direction dir);
+
 #endif
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index 58e9690..f15f738 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -69,6 +69,7 @@ New Features
     * IPv6 in IPv4
   * Added IPv4 transport mode tests.
   * Added tunnel mode fragment packet tests.
+  * Added security stats tests.
 
 
 Removed Items
-- 
2.7.4

[PATCH v2 09/13] test/crypto: add lookaside IPsec AES-CTR known vectors

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Add known vectors for AES-CTR in lookaside IPsec mode.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev_security_ipsec.h | 15 +++++++++++++++
 doc/guides/rel_notes/release_22_03.rst   |  1 +
 2 files changed, 16 insertions(+)

diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 3565a8c..3376d08 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -103,6 +103,21 @@ static const struct crypto_param cipher_list[] = {
 		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CBC,
 		.key_length = 16,
 	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
+		.key_length = 16,
+	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
+		.key_length = 24,
+	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
+		.key_length = 32,
+	},
 };
 
 static const struct crypto_param auth_list[] = {
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index f15f738..db5ec20 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -70,6 +70,7 @@ New Features
   * Added IPv4 transport mode tests.
   * Added tunnel mode fragment packet tests.
   * Added security stats tests.
+  * Added AES-CTR tests.
 
 
 Removed Items
-- 
2.7.4

[PATCH v2 10/13] test/crypto: add fragmented packet case

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Add fragmented plain packet test case in combined mode.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c                | 16 ++++++++++++++++
 app/test/test_cryptodev_security_ipsec.c |  7 +++++++
 2 files changed, 23 insertions(+)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index d5902dd..9a8cced 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9670,6 +9670,18 @@ test_ipsec_proto_stats(const void *data __rte_unused)
 }
 
 static int
+test_ipsec_proto_pkt_fragment(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.fragment = true;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
 test_PDCP_PROTO_all(void)
 {
 	struct crypto_testsuite_params *ts_params = &testsuite_params;
@@ -14677,6 +14689,10 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Statistics: success",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_stats),
+		TEST_CASE_NAMED_ST(
+			"Fragmented packet",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_pkt_fragment),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 6fa1d3d..832f9d8 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -418,6 +418,13 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 		if (flags->stats_success)
 			td->ipsec_xform.options.stats = 1;
 
+		if (flags->fragment) {
+			struct rte_ipv4_hdr *ip;
+			ip = (struct rte_ipv4_hdr *)&td->input_text.data;
+			ip->fragment_offset = 4;
+			ip->hdr_checksum = rte_ipv4_cksum(ip);
+		}
+
 	}
 }
 
-- 
2.7.4

[PATCH v2 11/13] test/crypto: skip null auth in ICV corrupt case

[Anoob Joseph]

From: Tejasree Kondoj <ktejasree@marvell.com>

Skipping NULL auth in ICV corruption test case.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 app/test/test_cryptodev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 9a8cced..0ab4ca7 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9428,6 +9428,11 @@ test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 				      td_outb,
 				      nb_pkts);
 
+		if (flags->icv_corrupt && (td_outb->aead == false) &&
+		    (td_outb->xform.chain.auth.auth.algo ==
+		     RTE_CRYPTO_AUTH_NULL))
+			continue;
+
 		ret = test_ipsec_proto_process(td_outb, td_inb, nb_pkts, true,
 					       flags);
 		if (ret == TEST_SKIPPED)
-- 
2.7.4

[PATCH v2 12/13] test/crypto: add aes xcbc known vectors

[Anoob Joseph]

Add known vector test cases for NULL cipher + AES-XCBC. Also add both
algos to the combined mode list of algos.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
---
 app/test/test_cryptodev.c                          | 38 +++++++--
 app/test/test_cryptodev_security_ipsec.c           |  2 +
 app/test/test_cryptodev_security_ipsec.h           | 17 ++++
 .../test_cryptodev_security_ipsec_test_vectors.h   | 90 ++++++++++++++++++++++
 doc/guides/rel_notes/release_22_03.rst             |  1 +
 5 files changed, 142 insertions(+), 6 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 0ab4ca7..203b4a4 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9368,8 +9368,11 @@ test_ipsec_proto_known_vec(const void *test_data)
 
 	memcpy(&td_outb, test_data, sizeof(td_outb));
 
-	/* Disable IV gen to be able to test with known vectors */
-	td_outb.ipsec_xform.options.iv_gen_disable = 1;
+	if (td_outb.aead ||
+	    td_outb.xform.chain.cipher.cipher.algo != RTE_CRYPTO_CIPHER_NULL) {
+		/* Disable IV gen to be able to test with known vectors */
+		td_outb.ipsec_xform.options.iv_gen_disable = 1;
+	}
 
 	return test_ipsec_proto_process(&td_outb, NULL, 1, false, &flags);
 }
@@ -9428,10 +9431,23 @@ test_ipsec_proto_all(const struct ipsec_test_flags *flags)
 				      td_outb,
 				      nb_pkts);
 
-		if (flags->icv_corrupt && (td_outb->aead == false) &&
-		    (td_outb->xform.chain.auth.auth.algo ==
-		     RTE_CRYPTO_AUTH_NULL))
-			continue;
+		if (!td_outb->aead) {
+			enum rte_crypto_cipher_algorithm cipher_alg;
+			enum rte_crypto_auth_algorithm auth_alg;
+
+			cipher_alg = td_outb->xform.chain.cipher.cipher.algo;
+			auth_alg = td_outb->xform.chain.auth.auth.algo;
+
+			/* ICV is not applicable for NULL auth */
+			if (flags->icv_corrupt &&
+			    auth_alg == RTE_CRYPTO_AUTH_NULL)
+				continue;
+
+			/* IV is not applicable for NULL cipher */
+			if (flags->iv_gen &&
+			    cipher_alg == RTE_CRYPTO_CIPHER_NULL)
+				continue;
+		}
 
 		ret = test_ipsec_proto_process(td_outb, td_inb, nb_pkts, true,
 					       flags);
@@ -14582,6 +14598,11 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			test_ipsec_proto_known_vec,
 			&pkt_aes_128_cbc_hmac_sha256_v6),
 		TEST_CASE_NAMED_WITH_DATA(
+			"Outbound known vector (ESP tunnel mode IPv4 NULL AES-XCBC-MAC [12B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec,
+			&pkt_null_aes_xcbc),
+		TEST_CASE_NAMED_WITH_DATA(
 			"Outbound fragmented packet",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_fragmented,
@@ -14626,6 +14647,11 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_known_vec_inb,
 			&pkt_aes_128_cbc_hmac_sha256_v6),
+		TEST_CASE_NAMED_WITH_DATA(
+			"Inbound known vector (ESP tunnel mode IPv4 NULL AES-XCBC-MAC [12B ICV])",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_known_vec_inb,
+			&pkt_null_aes_xcbc),
 		TEST_CASE_NAMED_ST(
 			"Combined test alg list",
 			ut_setup_security, ut_teardown,
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 832f9d8..94e5213 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -375,6 +375,8 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 			td->xform.chain.cipher.cipher.algo = param1->alg.cipher;
 			td->xform.chain.cipher.cipher.key.length =
 					param1->key_length;
+			td->xform.chain.cipher.cipher.iv.length =
+					param1->iv_length;
 			td->xform.chain.auth.auth.algo = param2->alg.auth;
 			td->xform.chain.auth.auth.key.length =
 					param2->key_length;
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 3376d08..6e27eba 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -76,6 +76,7 @@ struct crypto_param {
 		enum rte_crypto_aead_algorithm aead;
 	} alg;
 	uint16_t key_length;
+	uint16_t iv_length;
 	uint16_t digest_length;
 };
 
@@ -100,23 +101,33 @@ static const struct crypto_param aead_list[] = {
 static const struct crypto_param cipher_list[] = {
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+		.alg.cipher =  RTE_CRYPTO_CIPHER_NULL,
+		.key_length = 0,
+		.iv_length = 0,
+	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
 		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CBC,
 		.key_length = 16,
+		.iv_length = 16,
 	},
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
 		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
 		.key_length = 16,
+		.iv_length = 16,
 	},
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
 		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
 		.key_length = 24,
+		.iv_length = 16,
 	},
 	{
 		.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
 		.alg.cipher =  RTE_CRYPTO_CIPHER_AES_CTR,
 		.key_length = 32,
+		.iv_length = 16,
 	},
 };
 
@@ -143,6 +154,12 @@ static const struct crypto_param auth_list[] = {
 		.key_length = 64,
 		.digest_length = 32,
 	},
+	{
+		.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+		.alg.auth =  RTE_CRYPTO_AUTH_AES_XCBC_MAC,
+		.key_length = 16,
+		.digest_length = 12,
+	},
 };
 
 struct crypto_param_comb {
diff --git a/app/test/test_cryptodev_security_ipsec_test_vectors.h b/app/test/test_cryptodev_security_ipsec_test_vectors.h
index b6d48ad..85cd6c5 100644
--- a/app/test/test_cryptodev_security_ipsec_test_vectors.h
+++ b/app/test/test_cryptodev_security_ipsec_test_vectors.h
@@ -1062,4 +1062,94 @@ struct ipsec_test_data pkt_aes_128_gcm_frag = {
 	},
 };
 
+struct ipsec_test_data pkt_null_aes_xcbc = {
+	.auth_key = {
+		.data = {
+			0x61, 0x31, 0x62, 0x32, 0x63, 0x33, 0x64, 0x34,
+			0x65, 0x35, 0x66, 0x36, 0x67, 0x37, 0x68, 0x38,
+		},
+	},
+	.input_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x2f, 0x49, 0x37, 0x00, 0x00,
+			0x40, 0x11, 0x22, 0x84, 0x0d, 0x00, 0x00, 0x02,
+			0x02, 0x00, 0x00, 0x02, 0x08, 0x00, 0x08, 0x00,
+			0x00, 0x1b, 0x6d, 0x99, 0x58, 0x58, 0x58, 0x58,
+			0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+			0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+		},
+		.len = 47,
+	},
+	.output_text = {
+		.data = {
+			/* IP */
+			0x45, 0x00, 0x00, 0x5c, 0x06, 0x00, 0x00, 0x00,
+			0x40, 0x32, 0x13, 0x6c, 0x0a, 0x00, 0x6f, 0x02,
+			0x0a, 0x00, 0xde, 0x02,
+
+			/* ESP */
+			0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01,
+
+			/* IP */
+			0x45, 0x00, 0x00, 0x2f, 0x49, 0x37, 0x00, 0x00,
+			0x40, 0x11, 0x22, 0x84, 0x0d, 0x00, 0x00, 0x02,
+			0x02, 0x00, 0x00, 0x02, 0x08, 0x00, 0x08, 0x00,
+			0x00, 0x1b, 0x6d, 0x99, 0x58, 0x58, 0x58, 0x58,
+			0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+			0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+
+			/* ESP trailer */
+			0x01, 0x02, 0x03, 0x03, 0x04,
+
+			/* ICV */
+			0xf1, 0x52, 0x64, 0xd1, 0x9b, 0x62, 0x24, 0xdd,
+			0xcc, 0x14, 0xf5, 0xc1,
+		},
+		.len = 92,
+	},
+	.ipsec_xform = {
+		.spi = 0x100,
+		.options.esn = 0,
+		.options.udp_encap = 0,
+		.options.copy_dscp = 0,
+		.options.copy_flabel = 0,
+		.options.copy_df = 0,
+		.options.dec_ttl = 0,
+		.options.ecn = 0,
+		.options.stats = 0,
+		.options.tunnel_hdr_verify = 0,
+		.options.ip_csum_enable = 0,
+		.options.l4_csum_enable = 0,
+		.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+		.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+		.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+		.tunnel.type = RTE_SECURITY_IPSEC_TUNNEL_IPV4,
+		.replay_win_sz = 0,
+	},
+	.aead = false,
+	.xform = {
+		.chain.cipher = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+			.cipher = {
+				.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT,
+				.algo = RTE_CRYPTO_CIPHER_NULL,
+				.key.length = 0,
+				.iv.length = 0,
+			},
+		},
+		.chain.auth = {
+			.next = NULL,
+			.type = RTE_CRYPTO_SYM_XFORM_AUTH,
+			.auth = {
+				.op = RTE_CRYPTO_AUTH_OP_GENERATE,
+				.algo = RTE_CRYPTO_AUTH_AES_XCBC_MAC,
+				.key.length = 16,
+				.digest_length = 12,
+			},
+		},
+	},
+};
+
 #endif /* TEST_CRYPTODEV_SECURITY_IPSEC_TEST_VECTORS_H_ */
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index db5ec20..a7d0e53 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -62,6 +62,7 @@ New Features
   * Added AES-CBC 128 HMAC-SHA256 known vector tests.
   * Added AES-CBC 128 HMAC-SHA384 known vector tests.
   * Added AES-CBC 128 HMAC-SHA512 known vector tests.
+  * Added NULL cipher AES-XCBC known vector tests.
   * Added tunnel mode tests
     * IPv6 in IPv6
     * IPv4 in IPv4
-- 
2.7.4

[PATCH v2 13/13] test/crypto: add copy and set DF cases

[Anoob Joseph]

Add test cases to verify copy DF and set DF options with lookaside IPsec
offload.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
---
 app/test/test_cryptodev.c                | 75 ++++++++++++++++++++++++++++++++
 app/test/test_cryptodev_security_ipsec.c | 71 ++++++++++++++++++++++++++++--
 app/test/test_cryptodev_security_ipsec.h | 10 +++++
 doc/guides/rel_notes/release_22_03.rst   |  1 +
 4 files changed, 154 insertions(+), 3 deletions(-)

diff --git a/app/test/test_cryptodev.c b/app/test/test_cryptodev.c
index 203b4a4..f808719 100644
--- a/app/test/test_cryptodev.c
+++ b/app/test/test_cryptodev.c
@@ -9169,6 +9169,13 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 			       sizeof(src));
 			memcpy(&ipsec_xform.tunnel.ipv4.dst_ip, &dst,
 			       sizeof(dst));
+
+			if (flags->df == TEST_IPSEC_SET_DF_0_INNER_1)
+				ipsec_xform.tunnel.ipv4.df = 0;
+
+			if (flags->df == TEST_IPSEC_SET_DF_1_INNER_0)
+				ipsec_xform.tunnel.ipv4.df = 1;
+
 		} else {
 			memcpy(&ipsec_xform.tunnel.ipv6.src_addr, &v6_src,
 			       sizeof(v6_src));
@@ -9282,6 +9289,9 @@ test_ipsec_proto_process(const struct ipsec_test_data td[],
 		memcpy(input_text, td[i].input_text.data,
 		       td[i].input_text.len);
 
+		if (test_ipsec_pkt_update(input_text, flags))
+			return TEST_FAILED;
+
 		/* Generate crypto op data structure */
 		ut_params->op = rte_crypto_op_alloc(ts_params->op_mpool,
 					RTE_CRYPTO_OP_TYPE_SYMMETRIC);
@@ -9700,6 +9710,55 @@ test_ipsec_proto_pkt_fragment(const void *data __rte_unused)
 	flags.fragment = true;
 
 	return test_ipsec_proto_all(&flags);
+
+}
+
+static int
+test_ipsec_proto_copy_df_inner_0(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.df = TEST_IPSEC_COPY_DF_INNER_0;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_copy_df_inner_1(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.df = TEST_IPSEC_COPY_DF_INNER_1;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_set_df_0_inner_1(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.df = TEST_IPSEC_SET_DF_0_INNER_1;
+
+	return test_ipsec_proto_all(&flags);
+}
+
+static int
+test_ipsec_proto_set_df_1_inner_0(const void *data __rte_unused)
+{
+	struct ipsec_test_flags flags;
+
+	memset(&flags, 0, sizeof(flags));
+
+	flags.df = TEST_IPSEC_SET_DF_1_INNER_0;
+
+	return test_ipsec_proto_all(&flags);
 }
 
 static int
@@ -14724,6 +14783,22 @@ static struct unit_test_suite ipsec_proto_testsuite  = {
 			"Fragmented packet",
 			ut_setup_security, ut_teardown,
 			test_ipsec_proto_pkt_fragment),
+		TEST_CASE_NAMED_ST(
+			"Tunnel header copy DF (inner 0)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_copy_df_inner_0),
+		TEST_CASE_NAMED_ST(
+			"Tunnel header copy DF (inner 1)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_copy_df_inner_1),
+		TEST_CASE_NAMED_ST(
+			"Tunnel header set DF 0 (inner 1)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_set_df_0_inner_1),
+		TEST_CASE_NAMED_ST(
+			"Tunnel header set DF 1 (inner 0)",
+			ut_setup_security, ut_teardown,
+			test_ipsec_proto_set_df_1_inner_0),
 		TEST_CASES_END() /**< NULL terminate unit test array */
 	}
 };
diff --git a/app/test/test_cryptodev_security_ipsec.c b/app/test/test_cryptodev_security_ipsec.c
index 94e5213..e662ea2 100644
--- a/app/test/test_cryptodev_security_ipsec.c
+++ b/app/test/test_cryptodev_security_ipsec.c
@@ -427,6 +427,9 @@ test_ipsec_td_prepare(const struct crypto_param *param1,
 			ip->hdr_checksum = rte_ipv4_cksum(ip);
 		}
 
+		if (flags->df == TEST_IPSEC_COPY_DF_INNER_0 ||
+		    flags->df == TEST_IPSEC_COPY_DF_INNER_1)
+			td->ipsec_xform.options.copy_df = 1;
 	}
 }
 
@@ -640,6 +643,7 @@ test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td,
 {
 	uint8_t *output_text = rte_pktmbuf_mtod(m, uint8_t *);
 	uint32_t skip, len = rte_pktmbuf_pkt_len(m);
+	uint8_t td_output_text[4096];
 	int ret;
 
 	/* For tests with status as error for test success, skip verification */
@@ -720,16 +724,21 @@ test_ipsec_td_verify(struct rte_mbuf *m, const struct ipsec_test_data *td,
 		return ret;
 	}
 
+	memcpy(td_output_text, td->output_text.data + skip, len);
 
-	if (memcmp(output_text, td->output_text.data + skip, len)) {
+	if (test_ipsec_pkt_update(td_output_text, flags)) {
+		printf("Could not update expected vector");
+		return TEST_FAILED;
+	}
+
+	if (memcmp(output_text, td_output_text, len)) {
 		if (silent)
 			return TEST_FAILED;
 
 		printf("TestCase %s line %d: %s\n", __func__, __LINE__,
 			"output text not as expected\n");
 
-		rte_hexdump(stdout, "expected", td->output_text.data + skip,
-			    len);
+		rte_hexdump(stdout, "expected", td_output_text, len);
 		rte_hexdump(stdout, "actual", output_text, len);
 		return TEST_FAILED;
 	}
@@ -797,10 +806,27 @@ test_ipsec_post_process(struct rte_mbuf *m, const struct ipsec_test_data *td,
 		} else {
 			if (td->ipsec_xform.tunnel.type ==
 					RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+				uint16_t f_off;
+
 				if (is_valid_ipv4_pkt(iph4) == false) {
 					printf("Tunnel outer header is not IPv4\n");
 					return TEST_FAILED;
 				}
+
+				f_off = rte_be_to_cpu_16(iph4->fragment_offset);
+
+				if (flags->df == TEST_IPSEC_COPY_DF_INNER_1 ||
+				    flags->df == TEST_IPSEC_SET_DF_1_INNER_0) {
+					if (!(f_off & RTE_IPV4_HDR_DF_FLAG)) {
+						printf("DF bit is not set\n");
+						return TEST_FAILED;
+					}
+				} else {
+					if ((f_off & RTE_IPV4_HDR_DF_FLAG)) {
+						printf("DF bit is set\n");
+						return TEST_FAILED;
+					}
+				}
 			} else {
 				iph6 = (const struct rte_ipv6_hdr *)output_text;
 				if (is_valid_ipv6_pkt(iph6) == false) {
@@ -909,3 +935,42 @@ test_ipsec_stats_verify(struct rte_security_ctx *ctx,
 
 	return ret;
 }
+
+int
+test_ipsec_pkt_update(uint8_t *pkt, const struct ipsec_test_flags *flags)
+{
+	struct rte_ipv4_hdr *iph4;
+	bool cksum_dirty = false;
+	uint16_t frag_off;
+
+	iph4 = (struct rte_ipv4_hdr *)pkt;
+
+	if (flags->df == TEST_IPSEC_COPY_DF_INNER_1 ||
+	    flags->df == TEST_IPSEC_SET_DF_0_INNER_1 ||
+	    flags->df == TEST_IPSEC_COPY_DF_INNER_0 ||
+	    flags->df == TEST_IPSEC_SET_DF_1_INNER_0) {
+
+		if (!is_ipv4(iph4)) {
+			printf("Invalid packet type");
+			return -1;
+		}
+
+		frag_off = rte_be_to_cpu_16(iph4->fragment_offset);
+
+		if (flags->df == TEST_IPSEC_COPY_DF_INNER_1 ||
+		    flags->df == TEST_IPSEC_SET_DF_0_INNER_1)
+			frag_off |= RTE_IPV4_HDR_DF_FLAG;
+		else
+			frag_off &= ~RTE_IPV4_HDR_DF_FLAG;
+
+		iph4->fragment_offset = rte_cpu_to_be_16(frag_off);
+		cksum_dirty = true;
+	}
+
+	if (cksum_dirty && is_ipv4(iph4)) {
+		iph4->hdr_checksum = 0;
+		iph4->hdr_checksum = rte_ipv4_cksum(iph4);
+	}
+
+	return 0;
+}
diff --git a/app/test/test_cryptodev_security_ipsec.h b/app/test/test_cryptodev_security_ipsec.h
index 6e27eba..12a9b77 100644
--- a/app/test/test_cryptodev_security_ipsec.h
+++ b/app/test/test_cryptodev_security_ipsec.h
@@ -50,6 +50,13 @@ struct ipsec_test_data {
 	} xform;
 };
 
+enum df_flags {
+	TEST_IPSEC_COPY_DF_INNER_0 = 1,
+	TEST_IPSEC_COPY_DF_INNER_1,
+	TEST_IPSEC_SET_DF_0_INNER_1,
+	TEST_IPSEC_SET_DF_1_INNER_0,
+};
+
 struct ipsec_test_flags {
 	bool display_alg;
 	bool sa_expiry_pkts_soft;
@@ -66,6 +73,7 @@ struct ipsec_test_flags {
 	bool transport;
 	bool fragment;
 	bool stats_success;
+	enum df_flags df;
 };
 
 struct crypto_param {
@@ -226,4 +234,6 @@ int test_ipsec_stats_verify(struct rte_security_ctx *ctx,
 			    const struct ipsec_test_flags *flags,
 			    enum rte_security_ipsec_sa_direction dir);
 
+int test_ipsec_pkt_update(uint8_t *pkt, const struct ipsec_test_flags *flags);
+
 #endif
diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index a7d0e53..1c6b846 100644
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -72,6 +72,7 @@ New Features
   * Added tunnel mode fragment packet tests.
   * Added security stats tests.
   * Added AES-CTR tests.
+  * Added set/copy DF tests.
 
 
 Removed Items
-- 
2.7.4

RE: [PATCH v2 00/13] Add new cases to lookaside IPsec tests

[Akhil Goyal]

> Add new tests to lookaside IPsec tests.
> 
> * Support for chained operations.
> * AES-CBC 128 NULL auth known vector tests.
> * AES-CBC 128 HMAC-SHA256 known vector tests.
> * AES-CBC 128 HMAC-SHA384 known vector tests.
> * AES-CBC 128 HMAC-SHA512 known vector tests.
> * NULL cipher AES-XCBC known vector tests.
> * Tunnel mode tests
>   * IPv6 in IPv6
>   * IPv4 in IPv4
>   * IPv4 in IPv6
>   * IPv6 in IPv4
> * IPv4 transport mode tests.
> * Tunnel mode fragment packet tests.
> * Security stats tests.
> * AES-CTR tests.
> * set/copy DF tests.
> 
> Changes in v2:
> - Moved release notes update to originating patch
> - Fixed build failure with last patch
> 
> Ankur Dwivedi (1):
>   test/crypto: add security stats cases
> 
> Anoob Joseph (5):
>   test/crypto: add IPsec aes-cbc known vectors
>   test/crypto: add chained operations in combined cases
>   test/crypto: add transport mode cases
>   test/crypto: add aes xcbc known vectors
>   test/crypto: add copy and set DF cases
> 
> Tejasree Kondoj (7):
>   test/crypto: add IPsec AES-CBC-HMAC-SHA256 known vectors
>   test/crypto: add IPv6 tunnel mode cases
>   test/crypto: add IPsec HMAC-SHA384/512 known vectors
>   test/crypto: add IPsec fragmented packet known vectors
>   test/crypto: add lookaside IPsec AES-CTR known vectors
>   test/crypto: add fragmented packet case
>   test/crypto: skip null auth in ICV corrupt case
> 
>  app/test/test_cryptodev.c                          | 395 +++++++++-
>  app/test/test_cryptodev_security_ipsec.c           | 352 ++++++++-
>  app/test/test_cryptodev_security_ipsec.h           | 113 +++
>  .../test_cryptodev_security_ipsec_test_vectors.h   | 828
> +++++++++++++++++++++
>  doc/guides/rel_notes/release_22_03.rst             |  19 +
>  5 files changed, 1665 insertions(+), 42 deletions(-)
> 
Series Acked-by: Akhil Goyal <gakhil@marvell.com>

Applied to dpdk-next-crypto