| 54 | } |
| 55 | |
| 56 | static int |
| 57 | pdcp_crypto_xfrm_validate(const struct rte_pdcp_entity_conf *conf, |
| 58 | const struct rte_crypto_sym_xform *c_xfrm, |
| 59 | const struct rte_crypto_sym_xform *a_xfrm, |
| 60 | bool is_auth_then_cipher) |
| 61 | { |
| 62 | uint16_t cipher_iv_len, auth_digest_len, auth_iv_len; |
| 63 | int ret; |
| 64 | |
| 65 | /* |
| 66 | * Uplink means PDCP entity is configured for transmit. Downlink means PDCP entity is |
| 67 | * configured for receive. When integrity protection is enabled, PDCP always performs |
| 68 | * digest-encrypted or auth-gen-encrypt for uplink (and decrypt-auth-verify for downlink). |
| 69 | * So for uplink, crypto chain would be auth-cipher while for downlink it would be |
| 70 | * cipher-auth. |
| 71 | * |
| 72 | * When integrity protection is not required, xform would be cipher only. |
| 73 | */ |
| 74 | |
| 75 | if (c_xfrm == NULL) |
| 76 | return -EINVAL; |
| 77 | |
| 78 | if (conf->pdcp_xfrm.pkt_dir == RTE_SECURITY_PDCP_UPLINK) { |
| 79 | |
| 80 | /* With UPLINK, if auth is enabled, it should be before cipher */ |
| 81 | if (a_xfrm != NULL && !is_auth_then_cipher) |
| 82 | return -EINVAL; |
| 83 | |
| 84 | /* With UPLINK, cipher operation must be encrypt */ |
| 85 | if (c_xfrm->cipher.op != RTE_CRYPTO_CIPHER_OP_ENCRYPT) |
| 86 | return -EINVAL; |
| 87 | |
| 88 | /* With UPLINK, auth operation (if present) must be generate */ |
| 89 | if (a_xfrm != NULL && a_xfrm->auth.op != RTE_CRYPTO_AUTH_OP_GENERATE) |
| 90 | return -EINVAL; |
| 91 | |
| 92 | } else if (conf->pdcp_xfrm.pkt_dir == RTE_SECURITY_PDCP_DOWNLINK) { |
| 93 | |
| 94 | /* With DOWNLINK, if auth is enabled, it should be after cipher */ |
| 95 | if (a_xfrm != NULL && is_auth_then_cipher) |
| 96 | return -EINVAL; |
| 97 | |
| 98 | /* With DOWNLINK, cipher operation must be decrypt */ |
| 99 | if (c_xfrm->cipher.op != RTE_CRYPTO_CIPHER_OP_DECRYPT) |
| 100 | return -EINVAL; |
| 101 | |
| 102 | /* With DOWNLINK, auth operation (if present) must be verify */ |
| 103 | if (a_xfrm != NULL && a_xfrm->auth.op != RTE_CRYPTO_AUTH_OP_VERIFY) |
| 104 | return -EINVAL; |
| 105 | |
| 106 | } else { |
| 107 | return -EINVAL; |
| 108 | } |
| 109 | |
| 110 | if ((c_xfrm->cipher.algo != RTE_CRYPTO_CIPHER_NULL) && |
| 111 | (c_xfrm->cipher.algo != RTE_CRYPTO_CIPHER_AES_CTR) && |
| 112 | (c_xfrm->cipher.algo != RTE_CRYPTO_CIPHER_ZUC_EEA3) && |
| 113 | (c_xfrm->cipher.algo != RTE_CRYPTO_CIPHER_SNOW3G_UEA2)) |
no test coverage detected