testipsec.c

freescale ppc sec2加解密单元驱动

        dyHmacReq.outBytes  = aesecbtest[iTestIndex].hashOutBytes;
        dyHmacReq.keyData   = (unsigned char *)authKey;
        dyHmacReq.inData    = encryptOnlyOutput;
        dyHmacReq.outData   = hmacdigest;

        /* Allocate buffers and copy data */
        if (status = putKmem(fd, authKey, &dyHmacReq.keyData, 16)) return status;
        if (status = putKmem(fd, encryptOnlyOutput, &dyHmacReq.inData, ENC_DATA_LENGTH)) 
            goto free_aesecb_hmac_data_2;        
        if (status = putKmem(fd, NULL, &dyHmacReq.outData, dyHmacReq.outBytes)) 
            goto free_aesecb_hmac_data_2;        
        
        /* Issue IOCTL */
        armCompletion(&dyHmacReq);
        status = ioctl(fd, IOCTL_PROC_REQ, (int)&dyHmacReq);
        
        /* Check for completion error */
        if (status = waitCompletion("testIPSEC: authentication only", status, &dyHmacReq))
            goto free_aesecb_hmac_data_all;
        
        getKmem(fd, hmacdigest, &dyHmacReq.outData, dyHmacReq.outBytes);
        
        /* Free buffers.  Labels are for error-handling only! */
        free_aesecb_hmac_data_all: 
            freeKmem(fd, &dyHmacReq.outData);
        free_aesecb_hmac_data_2: 
            freeKmem(fd, &dyHmacReq.inData);
        free_aesecb_hmac_data_1: 
            freeKmem(fd, &dyHmacReq.keyData);
        
        /* If we encountered an error along the way then return. */
        if (status) return status;
        
        /********************************************************************
         * Second step of test is to perform encryption and HMAC using the  *
         * single IPSEC operation ID.  Compare this to the result obtained  *
         * in the first step.                                               *
         ********************************************************************/
        
        /* Set up IPSec request */
        ipsecReq.opId             = aesecbtest[iTestIndex].ipsecencopId;
        ipsecReq.hashKeyBytes     = 16;
        ipsecReq.cryptKeyBytes    = aesecbtest[iTestIndex].keyBytes;
        ipsecReq.hashInDataBytes  = 8;
        ipsecReq.inDataBytes      = ENC_DATA_LENGTH-8; 
        ipsecReq.hashDataOutBytes = aesecbtest[iTestIndex].hashOutBytes;
        ipsecReq.hashKeyData      = (unsigned char *)authKey;
        ipsecReq.cryptKeyData     = (unsigned char *)EncKey;
        ipsecReq.hashInData       = PlainText; 
        ipsecReq.inData           = &PlainText[8];
        ipsecReq.cryptDataOut     = ipsecoutput;
        ipsecReq.hashDataOut      = ipsecdigest;
        
        /* Allocate buffers and copy data */
        if (status = putKmem(fd, authKey, &ipsecReq.hashKeyData, ipsecReq.hashKeyBytes))
            return status;
        if (status = putKmem(fd, EncKey, &ipsecReq.cryptKeyData, ipsecReq.cryptKeyBytes)) 
            goto free_aesecb_ipsec_data_1;
        if (status = putKmem(fd, PlainText, &ipsecReq.hashInData, ipsecReq.hashInDataBytes)) 
            goto free_aesecb_ipsec_data_2;
        if (status = putKmem(fd, &PlainText[8], &ipsecReq.inData, ipsecReq.inDataBytes)) 
            goto free_aesecb_ipsec_data_3;
        if (status = putKmem(fd, NULL, &ipsecReq.cryptDataOut, ipsecReq.inDataBytes)) 
            goto free_aesecb_ipsec_data_4;
        if (status = putKmem(fd, NULL, &ipsecReq.hashDataOut, ipsecReq.hashDataOutBytes))
            goto free_aesecb_ipsec_data_5;
        
        /* Issue IOCTL */
        armCompletion(&ipsecReq);
        status = ioctl(fd, IOCTL_PROC_REQ, (int)&ipsecReq);
        
        /* Check for completion error */
        if (status = waitCompletion("testIPSEC: combined cipher/authentication", status, &ipsecReq))
            goto free_aesecb_ipsec_data_all;

        /* Get output buffers */
        getKmem(fd, ipsecoutput,   &ipsecReq.cryptDataOut, ipsecReq.inDataBytes);
        getKmem(fd, ipsecdigest, &ipsecReq.hashDataOut,  ipsecReq.hashDataOutBytes);

        /* Free buffers.  Labels are for error-handling only! */
        free_aesecb_ipsec_data_all:
            freeKmem(fd, &ipsecReq.hashDataOut);
        free_aesecb_ipsec_data_5:
            freeKmem(fd, &ipsecReq.cryptDataOut);
        free_aesecb_ipsec_data_4:
            freeKmem(fd, &ipsecReq.inData);
        free_aesecb_ipsec_data_3:
            freeKmem(fd, &ipsecReq.hashInData);
        free_aesecb_ipsec_data_2:
            freeKmem(fd, &ipsecReq.cryptKeyData);
        free_aesecb_ipsec_data_1:
            freeKmem(fd, &ipsecReq.hashKeyData);

        /* If we encountered an error along the way then return. */
        if (status) return status;
       
        /* Verify that separate and combined descriptor operations agree. */
        if ((memcmp(&encryptOnlyOutput[8], ipsecoutput, ENC_DATA_LENGTH-8)) != 0)
        {
            printf ("separate and combined descriptors disagree on cypher\n");
            return SEC2_UNKNOWN_ERROR;
        }
        if ((memcmp(ipsecdigest, hmacdigest, aesecbtest[iTestIndex].hashOutBytes)) !=0)
        {
            printf ("separate and combined descriptors disagree on digests\n");
            return SEC2_UNKNOWN_ERROR;
        }

        printf("Testing decryption\n");
        
        
        /********************************************************************
         * Third step of test is to perform decryption and HMAC.  Compare   * 
         * this to the original plain text and HMAC digest.                 *
         ********************************************************************/
        
        memset(ipsecDecryptOut,0, ENC_DATA_LENGTH);
        memcpy(ipsecDecryptOut, PlainText, 8);       
        memset(&ipsecReq,  0, sizeof(ipsecReq));  
        memset(ipsecdigest,0, 20);
 
        /* Set up IPSec request */
        ipsecReq.opId             = aesecbtest[iTestIndex].ipsecdecopId;
        ipsecReq.hashKeyBytes     = 16;
        ipsecReq.cryptKeyBytes    = aesecbtest[iTestIndex].keyBytes;
        ipsecReq.hashInDataBytes  = 8;
        ipsecReq.inDataBytes      = ENC_DATA_LENGTH-8; 
        ipsecReq.hashDataOutBytes = aesecbtest[iTestIndex].hashOutBytes;
        ipsecReq.hashKeyData      = (unsigned char *)authKey;
        ipsecReq.cryptKeyData     = (unsigned char *)EncKey;
        ipsecReq.hashInData       = ipsecDecryptOut; 
        ipsecReq.inData           = ipsecoutput;
        ipsecReq.cryptDataOut     = &ipsecDecryptOut[8];
        ipsecReq.hashDataOut      = ipsecdigest;
        
        /* Allocate buffers and copy data */
        if (status = putKmem(fd, authKey, &ipsecReq.hashKeyData, ipsecReq.hashKeyBytes))
            return status;
        if (status = putKmem(fd, EncKey, &ipsecReq.cryptKeyData, ipsecReq.cryptKeyBytes)) 
            goto free_aesecb_ipsec_decr_data_1;
        if (status = putKmem(fd, ipsecDecryptOut, &ipsecReq.hashInData, ipsecReq.hashInDataBytes)) 
            goto free_aesecb_ipsec_decr_data_2;
        if (status = putKmem(fd, ipsecoutput, &ipsecReq.inData, ipsecReq.inDataBytes)) 
            goto free_aesecb_ipsec_decr_data_3;
        if (status = putKmem(fd, NULL, &ipsecReq.cryptDataOut, ipsecReq.inDataBytes)) 
            goto free_aesecb_ipsec_decr_data_4;
        if (status = putKmem(fd, NULL, &ipsecReq.hashDataOut, ipsecReq.hashDataOutBytes))
            goto free_aesecb_ipsec_decr_data_5;
        
        /* Issue IOCTL */
        armCompletion(&ipsecReq);
        status = ioctl(fd, IOCTL_PROC_REQ, (int)&ipsecReq);
        
        /* Check for completion error */
        if (status = waitCompletion("testIPSEC: decryption", status, &ipsecReq))
            goto free_aesecb_ipsec_data_all;

        /* Get output buffers */
        getKmem(fd, &ipsecDecryptOut[8],   &ipsecReq.cryptDataOut, ipsecReq.inDataBytes);
        getKmem(fd, ipsecdigest, &ipsecReq.hashDataOut,  ipsecReq.hashDataOutBytes);

        /* Free buffers.  Labels are for error-handling only! */
        free_aesecb_ipsec_decr_data_all:
            freeKmem(fd, &ipsecReq.hashDataOut);
        free_aesecb_ipsec_decr_data_5:
            freeKmem(fd, &ipsecReq.cryptDataOut);
        free_aesecb_ipsec_decr_data_4:
            freeKmem(fd, &ipsecReq.inData);
        free_aesecb_ipsec_decr_data_3:
            freeKmem(fd, &ipsecReq.hashInData);
        free_aesecb_ipsec_decr_data_2:
            freeKmem(fd, &ipsecReq.cryptKeyData);
        free_aesecb_ipsec_decr_data_1:
            freeKmem(fd, &ipsecReq.hashKeyData);

        /* If we encountered an error along the way then return. */
        if (status) return status;
       
        /* Verify that separate and combined descriptor operations agree. */
        if ((memcmp(PlainText, ipsecDecryptOut, ENC_DATA_LENGTH)) != 0)
        {
            printf ("IPSec decryption doesn't match plaintext.\n");
            return SEC2_UNKNOWN_ERROR;
        }
        if ((memcmp(ipsecdigest, hmacdigest, aesecbtest[iTestIndex].hashOutBytes)) !=0)
        {
            printf ("IPSec decryption digest doesn't match HMAC digest\n");
            return SEC2_UNKNOWN_ERROR;
        }

        printf("*** Test %s complete ***\n", aesecbtest[iTestIndex].testDesc);
    }

    return 0;
} /* testIPSECaesecbreq */


/**********************************************************************
 **********************************************************************
 *                  E S P   C B C   T E S T S                         *
 **********************************************************************
 **********************************************************************/

#define NUM_ESP_CBC_TESTS   6

static IPSECTESTTYPE espcbctest[NUM_ESP_CBC_TESTS] = 
{
    /* IPSEC TDES ESP CBC MD5 PAD */
    DPD_TDES_CBC_CTX_ENCRYPT,
    DPD_MD5_LDCTX_HMAC_PAD_ULCTX,
    DPD_IPSEC_ESP_OUT_TDES_CBC_CRPT_MD5_PAD,
    DPD_IPSEC_ESP_IN_TDES_CBC_DCRPT_MD5_PAD,
    24,
    16,
    "IPSEC TDES ESP CBC MD5 PAD",
    
    /* IPSEC TDES ESP SHA-1 PAD */
    DPD_TDES_CBC_CTX_ENCRYPT,
    DPD_SHA_LDCTX_HMAC_PAD_ULCTX,
    DPD_IPSEC_ESP_OUT_TDES_CBC_CRPT_SHA_PAD,
    DPD_IPSEC_ESP_IN_TDES_CBC_DCRPT_SHA_PAD,
    24,
    20,
    "IPSEC TDES ESP CBC SHA-1 PAD",

    /* IPSEC TDES ESP SHA-256 PAD */
    DPD_TDES_CBC_CTX_ENCRYPT,
    DPD_SHA256_LDCTX_HMAC_PAD_ULCTX,
    DPD_IPSEC_ESP_OUT_TDES_CBC_CRPT_SHA256_PAD,
    DPD_IPSEC_ESP_IN_TDES_CBC_DCRPT_SHA256_PAD,
    24,
    32,
    "IPSEC TDES ESP CBC SHA-256 PAD",

    /* IPSEC SDES ESP MD5 PAD */
    DPD_SDES_CBC_CTX_ENCRYPT,
    DPD_MD5_LDCTX_HMAC_PAD_ULCTX,
    DPD_IPSEC_ESP_OUT_SDES_CBC_CRPT_MD5_PAD,
    DPD_IPSEC_ESP_IN_SDES_CBC_DCRPT_MD5_PAD,
    8,
    16,
    "IPSEC SDES ESP CBC MD5 PAD",

    /*  IPSEC SDES ESP SHA-1 PAD */
    DPD_SDES_CBC_CTX_ENCRYPT,
    DPD_SHA_LDCTX_HMAC_PAD_ULCTX,
    DPD_IPSEC_ESP_OUT_SDES_CBC_CRPT_SHA_PAD,
    DPD_IPSEC_ESP_IN_SDES_CBC_DCRPT_SHA_PAD,
    8,
    20,
    "IPSEC SDES ESP CBC SHA-1 PAD",

    /* IPSEC SDES ESP SHA-256 PAD */
    DPD_SDES_CBC_CTX_ENCRYPT,
    DPD_SHA256_LDCTX_HMAC_PAD_ULCTX,
    DPD_IPSEC_ESP_OUT_SDES_CBC_CRPT_SHA256_PAD,
    DPD_IPSEC_ESP_IN_SDES_CBC_DCRPT_SHA256_PAD,
    8,
    32,
    "IPSEC SDES ESP CBC SHA-256 PAD"
};


static int testIPSECespcbcreq
(
    int fd
)
{
    IPSEC_ESP_REQ         ipsecReq;
    DES_LOADCTX_CRYPT_REQ desReq;
    HMAC_PAD_REQ          dyHmacReq;
    int                   i, status, iTestIndex;
    
    for (iTestIndex = 0; iTestIndex < NUM_ESP_CBC_TESTS; iTestIndex++) 
    {
        printf("\n*** Test %s ***\n", espcbctest[iTestIndex].testDesc);
        printf("Testing encryption\n");

        /********************************************************************
         * First step of test is to perform encryption and HMAC separately. *
         * This result will compared with the IPSEC operation result later. *
         ********************************************************************/
        
        /* Clear buffers */
        memset(&ipsecReq,  0, sizeof(ipsecReq));  
        memset(&desReq,   0, sizeof(desReq));  
        memset(&dyHmacReq, 0, sizeof(dyHmacReq));
        memset(ipsecoutput,0, ENC_DATA_LENGTH + 32);
        memset(ipsecDecryptOut,0, ENC_DATA_LENGTH);
        memset(encryptOnlyOutput,  0, ENC_DATA_LENGTH);
        
        /* Copy the first 8 bytes to leave unencrypted because this is the ESP header
           in IPSec which is authenticated but not encrypted. */
        memcpy(encryptOnlyOutput, PlainText, 8);       
        
        /* Set up encryption request */
        desReq.opId       = espcbctest[iTestIndex].encryptopId;
        desReq.inIvBytes  = 8;
        desReq.keyBytes   = espcbctest[iTestIndex].keyBytes;
        desReq.inBytes    = ENC_DATA_LENGTH - 8; 
        desReq.outIvBytes = 8;
        desReq.keyData    = (unsigned char *)EncKey;
        desReq.inData     = &PlainText[8];
        desReq.inIvData   = (unsigned char *)in_iv;
        desReq.outData