examples/ipsec-secgw/sa.c

/* SPDX-License-Identifier: BSD-3-Clause
 * Copyright(c) 2016-2020 Intel Corporation
 */
 
/*
 * Security Associations
 */
#include <stdlib.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
 
#include <rte_memzone.h>
#include <rte_crypto.h>
#include <rte_security.h>
#include <rte_cryptodev.h>
#include <rte_byteorder.h>
#include <rte_errno.h>
#include <rte_ip.h>
#include <rte_udp.h>
#include <rte_random.h>
#include <rte_ethdev.h>
#include <rte_malloc.h>
 
#include "ipsec.h"
#include "esp.h"
#include "parser.h"
#include "sad.h"
 
#define IPDEFTTL 64
 
#define IP4_FULL_MASK (sizeof(((struct ip_addr *)NULL)->ip.ip4) * CHAR_BIT)
 
#define IP6_FULL_MASK (sizeof(((struct ip_addr *)NULL)->ip.ip6.ip6) * CHAR_BIT)
 
#define MBUF_NO_SEC_OFFLOAD(m) ((m->ol_flags & RTE_MBUF_F_RX_SEC_OFFLOAD) == 0)
 
struct supported_cipher_algo {
    const char *keyword;
    enum rte_crypto_cipher_algorithm algo;
    uint16_t iv_len;
    uint16_t block_size;
    uint16_t key_len;
};
 
struct supported_auth_algo {
    const char *keyword;
    enum rte_crypto_auth_algorithm algo;
    uint16_t iv_len;
    uint16_t digest_len;
    uint16_t key_len;
    uint8_t key_not_req;
};
 
struct supported_aead_algo {
    const char *keyword;
    enum rte_crypto_aead_algorithm algo;
    uint16_t iv_len;
    uint16_t block_size;
    uint16_t digest_len;
    uint16_t key_len;
    uint8_t aad_len;
};
 
 
const struct supported_cipher_algo cipher_algos[] = {
    {
        .keyword = "null",
        .algo = RTE_CRYPTO_CIPHER_NULL,
        .iv_len = 0,
        .block_size = 4,
        .key_len = 0
    },
    {
        .keyword = "aes-128-cbc",
        .algo = RTE_CRYPTO_CIPHER_AES_CBC,
        .iv_len = 16,
        .block_size = 16,
        .key_len = 16
    },
    {
        .keyword = "aes-192-cbc",
        .algo = RTE_CRYPTO_CIPHER_AES_CBC,
        .iv_len = 16,
        .block_size = 16,
        .key_len = 24
    },
    {
        .keyword = "aes-256-cbc",
        .algo = RTE_CRYPTO_CIPHER_AES_CBC,
        .iv_len = 16,
        .block_size = 16,
        .key_len = 32
    },
    {
        .keyword = "aes-128-ctr",
        .algo = RTE_CRYPTO_CIPHER_AES_CTR,
        .iv_len = 8,
        .block_size = 4,
        .key_len = 20
    },
    {
        .keyword = "aes-192-ctr",
        .algo = RTE_CRYPTO_CIPHER_AES_CTR,
        .iv_len = 16,
        .block_size = 16,
        .key_len = 28
    },
    {
        .keyword = "aes-256-ctr",
        .algo = RTE_CRYPTO_CIPHER_AES_CTR,
        .iv_len = 16,
        .block_size = 16,
        .key_len = 36
    },
    {
        .keyword = "3des-cbc",
        .algo = RTE_CRYPTO_CIPHER_3DES_CBC,
        .iv_len = 8,
        .block_size = 8,
        .key_len = 24
    },
    {
        .keyword = "des-cbc",
        .algo = RTE_CRYPTO_CIPHER_DES_CBC,
        .iv_len = 8,
        .block_size = 8,
        .key_len = 8
    }
};
 
const struct supported_auth_algo auth_algos[] = {
    {
        .keyword = "null",
        .algo = RTE_CRYPTO_AUTH_NULL,
        .digest_len = 0,
        .key_len = 0,
        .key_not_req = 1
    },
    {
        .keyword = "sha1-hmac",
        .algo = RTE_CRYPTO_AUTH_SHA1_HMAC,
        .digest_len = 12,
        .key_len = 20
    },
    {
        .keyword = "sha256-hmac",
        .algo = RTE_CRYPTO_AUTH_SHA256_HMAC,
        .digest_len = 16,
        .key_len = 32
    },
    {
        .keyword = "sha384-hmac",
        .algo = RTE_CRYPTO_AUTH_SHA384_HMAC,
        .digest_len = 24,
        .key_len = 48
    },
    {
        .keyword = "sha512-hmac",
        .algo = RTE_CRYPTO_AUTH_SHA512_HMAC,
        .digest_len = 32,
        .key_len = 64
    },
    {
        .keyword = "aes-gmac",
        .algo = RTE_CRYPTO_AUTH_AES_GMAC,
        .iv_len = 8,
        .digest_len = 16,
        .key_len = 20
    },
    {
        .keyword = "aes-xcbc-mac-96",
        .algo = RTE_CRYPTO_AUTH_AES_XCBC_MAC,
        .digest_len = 12,
        .key_len = 16
    }
};
 
const struct supported_aead_algo aead_algos[] = {
    {
        .keyword = "aes-128-gcm",
        .algo = RTE_CRYPTO_AEAD_AES_GCM,
        .iv_len = 8,
        .block_size = 4,
        .key_len = 20,
        .digest_len = 16,
        .aad_len = 8,
    },
    {
        .keyword = "aes-192-gcm",
        .algo = RTE_CRYPTO_AEAD_AES_GCM,
        .iv_len = 8,
        .block_size = 4,
        .key_len = 28,
        .digest_len = 16,
        .aad_len = 8,
    },
    {
        .keyword = "aes-256-gcm",
        .algo = RTE_CRYPTO_AEAD_AES_GCM,
        .iv_len = 8,
        .block_size = 4,
        .key_len = 36,
        .digest_len = 16,
        .aad_len = 8,
    },
    {
        .keyword = "aes-128-ccm",
        .algo = RTE_CRYPTO_AEAD_AES_CCM,
        .iv_len = 8,
        .block_size = 4,
        .key_len = 20,
        .digest_len = 16,
        .aad_len = 8,
    },
    {
        .keyword = "aes-192-ccm",
        .algo = RTE_CRYPTO_AEAD_AES_CCM,
        .iv_len = 8,
        .block_size = 4,
        .key_len = 28,
        .digest_len = 16,
        .aad_len = 8,
    },
    {
        .keyword = "aes-256-ccm",
        .algo = RTE_CRYPTO_AEAD_AES_CCM,
        .iv_len = 8,
        .block_size = 4,
        .key_len = 36,
        .digest_len = 16,
        .aad_len = 8,
    },
    {
        .keyword = "chacha20-poly1305",
        .algo = RTE_CRYPTO_AEAD_CHACHA20_POLY1305,
        .iv_len = 12,
        .block_size = 64,
        .key_len = 36,
        .digest_len = 16,
        .aad_len = 8,
    }
};
 
#define SA_INIT_NB  128
 
static uint32_t nb_crypto_sessions;
struct ipsec_sa *sa_out;
uint32_t nb_sa_out;
static uint32_t sa_out_sz;
static struct ipsec_sa_cnt sa_out_cnt;
 
struct ipsec_sa *sa_in;
uint32_t nb_sa_in;
static uint32_t sa_in_sz;
static struct ipsec_sa_cnt sa_in_cnt;
 
static const struct supported_cipher_algo *
find_match_cipher_algo(const char *cipher_keyword)
{
    size_t i;
 
    for (i = 0; i < RTE_DIM(cipher_algos); i++) {
        const struct supported_cipher_algo *algo =
            &cipher_algos[i];
 
        if (strcmp(cipher_keyword, algo->keyword) == 0)
            return algo;
    }
 
    return NULL;
}
 
static const struct supported_auth_algo *
find_match_auth_algo(const char *auth_keyword)
{
    size_t i;
 
    for (i = 0; i < RTE_DIM(auth_algos); i++) {
        const struct supported_auth_algo *algo =
            &auth_algos[i];
 
        if (strcmp(auth_keyword, algo->keyword) == 0)
            return algo;
    }
 
    return NULL;
}
 
static const struct supported_aead_algo *
find_match_aead_algo(const char *aead_keyword)
{
    size_t i;
 
    for (i = 0; i < RTE_DIM(aead_algos); i++) {
        const struct supported_aead_algo *algo =
            &aead_algos[i];
 
        if (strcmp(aead_keyword, algo->keyword) == 0)
            return algo;
    }
 
    return NULL;
}
 
static uint32_t
parse_key_string(const char *key_str, uint8_t *key)
{
    const char *pt_start = key_str, *pt_end = key_str;
    uint32_t nb_bytes = 0;
 
    while (pt_end != NULL) {
        char sub_str[3] = {0};
 
        pt_end = strchr(pt_start, ':');
 
        if (pt_end == NULL) {
            if (strlen(pt_start) > 2)
                return 0;
            strncpy(sub_str, pt_start, 2);
        } else {
            if (pt_end - pt_start > 2)
                return 0;
 
            strncpy(sub_str, pt_start, pt_end - pt_start);
            pt_start = pt_end + 1;
        }
 
        key[nb_bytes++] = strtol(sub_str, NULL, 16);
    }
 
    return nb_bytes;
}
 
static int
extend_sa_arr(struct ipsec_sa **sa_tbl, uint32_t cur_cnt, uint32_t *cur_sz)
{
    if (*sa_tbl == NULL) {
        *sa_tbl = calloc(SA_INIT_NB, sizeof(struct ipsec_sa));
        if (*sa_tbl == NULL)
            return -1;
        *cur_sz = SA_INIT_NB;
        return 0;
    }
 
    if (cur_cnt >= *cur_sz) {
        *sa_tbl = realloc(*sa_tbl,
            *cur_sz * sizeof(struct ipsec_sa) * 2);
        if (*sa_tbl == NULL)
            return -1;
        /* clean reallocated extra space */
        memset(&(*sa_tbl)[*cur_sz], 0,
            *cur_sz * sizeof(struct ipsec_sa));
        *cur_sz *= 2;
    }
 
    return 0;
}
 
void
parse_sa_tokens(char **tokens, uint32_t n_tokens,
    struct parse_status *status)
{
    struct ipsec_sa *rule = NULL;
    struct rte_ipsec_session *ips;
    uint32_t ti; /*token index*/
    uint32_t *ri /*rule index*/;
    struct ipsec_sa_cnt *sa_cnt;
    uint32_t cipher_algo_p = 0;
    uint32_t auth_algo_p = 0;
    uint32_t aead_algo_p = 0;
    uint32_t src_p = 0;
    uint32_t dst_p = 0;
    uint32_t mode_p = 0;
    uint32_t type_p = 0;
    uint32_t portid_p = 0;
    uint32_t fallback_p = 0;
    int16_t status_p = 0;
    uint16_t udp_encap_p = 0;
 
    if (strcmp(tokens[0], "in") == 0) {
        ri = &nb_sa_in;
        sa_cnt = &sa_in_cnt;
        if (extend_sa_arr(&sa_in, nb_sa_in, &sa_in_sz) < 0)
            return;
        rule = &sa_in[*ri];
        rule->direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS;
    } else {
        ri = &nb_sa_out;
        sa_cnt = &sa_out_cnt;
        if (extend_sa_arr(&sa_out, nb_sa_out, &sa_out_sz) < 0)
            return;
        rule = &sa_out[*ri];
        rule->direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS;
    }
 
    /* spi number */
    APP_CHECK_TOKEN_IS_NUM(tokens, 1, status);
    if (status->status < 0)
        return;
    if (atoi(tokens[1]) == INVALID_SPI)
        return;
    rule->flags = 0;
    rule->spi = atoi(tokens[1]);
    rule->portid = UINT16_MAX;
    ips = ipsec_get_primary_session(rule);
 
    for (ti = 2; ti < n_tokens; ti++) {
        if (strcmp(tokens[ti], "mode") == 0) {
            APP_CHECK_PRESENCE(mode_p, tokens[ti], status);
            if (status->status < 0)
                return;
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            if (strcmp(tokens[ti], "ipv4-tunnel") == 0) {
                sa_cnt->nb_v4++;
                rule->flags |= IP4_TUNNEL;
            } else if (strcmp(tokens[ti], "ipv6-tunnel") == 0) {
                sa_cnt->nb_v6++;
                rule->flags |= IP6_TUNNEL;
            } else if (strcmp(tokens[ti], "transport") == 0) {
                sa_cnt->nb_v4++;
                sa_cnt->nb_v6++;
                rule->flags |= TRANSPORT;
            } else {
                APP_CHECK(0, status, "unrecognized "
                    "input \"%s\"", tokens[ti]);
                return;
            }
 
            mode_p = 1;
            continue;
        }
 
        if (strcmp(tokens[ti], "telemetry") == 0) {
            rule->flags |= SA_TELEMETRY_ENABLE;
            continue;
        }
 
        if (strcmp(tokens[ti], "cipher_algo") == 0) {
            const struct supported_cipher_algo *algo;
            uint32_t key_len;
 
            APP_CHECK_PRESENCE(cipher_algo_p, tokens[ti],
                status);
            if (status->status < 0)
                return;
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            algo = find_match_cipher_algo(tokens[ti]);
 
            APP_CHECK(algo != NULL, status, "unrecognized "
                "input \"%s\"", tokens[ti]);
 
            if (status->status < 0)
                return;
 
            rule->cipher_algo = algo->algo;
            rule->block_size = algo->block_size;
            rule->iv_len = algo->iv_len;
            rule->cipher_key_len = algo->key_len;
 
            /* for NULL algorithm, no cipher key required */
            if (rule->cipher_algo == RTE_CRYPTO_CIPHER_NULL) {
                cipher_algo_p = 1;
                continue;
            }
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            APP_CHECK(strcmp(tokens[ti], "cipher_key") == 0,
                status, "unrecognized input \"%s\", "
                "expect \"cipher_key\"", tokens[ti]);
            if (status->status < 0)
                return;
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            key_len = parse_key_string(tokens[ti],
                rule->cipher_key);
            APP_CHECK(key_len == rule->cipher_key_len, status,
                "unrecognized input \"%s\"", tokens[ti]);
            if (status->status < 0)
                return;
 
            if (algo->algo == RTE_CRYPTO_CIPHER_AES_CBC ||
                algo->algo == RTE_CRYPTO_CIPHER_3DES_CBC)
                rule->salt = (uint32_t)rte_rand();
 
            if (algo->algo == RTE_CRYPTO_CIPHER_AES_CTR) {
                key_len -= 4;
                rule->cipher_key_len = key_len;
                memcpy(&rule->salt,
                    &rule->cipher_key[key_len], 4);
            }
 
            cipher_algo_p = 1;
            continue;
        }
 
        if (strcmp(tokens[ti], "auth_algo") == 0) {
            const struct supported_auth_algo *algo;
            uint32_t key_len;
 
            APP_CHECK_PRESENCE(auth_algo_p, tokens[ti],
                status);
            if (status->status < 0)
                return;
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            algo = find_match_auth_algo(tokens[ti]);
            APP_CHECK(algo != NULL, status, "unrecognized "
                "input \"%s\"", tokens[ti]);
 
            if (status->status < 0)
                return;
 
            rule->auth_algo = algo->algo;
            rule->auth_key_len = algo->key_len;
            rule->digest_len = algo->digest_len;
 
            /* NULL algorithm and combined algos do not
             * require auth key
             */
            if (algo->key_not_req) {
                auth_algo_p = 1;
                continue;
            }
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            APP_CHECK(strcmp(tokens[ti], "auth_key") == 0,
                status, "unrecognized input \"%s\", "
                "expect \"auth_key\"", tokens[ti]);
            if (status->status < 0)
                return;
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            key_len = parse_key_string(tokens[ti],
                rule->auth_key);
            APP_CHECK(key_len == rule->auth_key_len, status,
                "unrecognized input \"%s\"", tokens[ti]);
            if (status->status < 0)
                return;
 
            if (algo->algo == RTE_CRYPTO_AUTH_AES_GMAC) {
                key_len -= 4;
                rule->auth_key_len = key_len;
                rule->iv_len = algo->iv_len;
                memcpy(&rule->salt,
                    &rule->auth_key[key_len], 4);
            }
 
            auth_algo_p = 1;
            continue;
        }
 
        if (strcmp(tokens[ti], "aead_algo") == 0) {
            const struct supported_aead_algo *algo;
            uint32_t key_len;
 
            APP_CHECK_PRESENCE(aead_algo_p, tokens[ti],
                status);
            if (status->status < 0)
                return;
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            algo = find_match_aead_algo(tokens[ti]);
 
            APP_CHECK(algo != NULL, status, "unrecognized "
                "input \"%s\"", tokens[ti]);
 
            if (status->status < 0)
                return;
 
            rule->aead_algo = algo->algo;
            rule->cipher_key_len = algo->key_len;
            rule->digest_len = algo->digest_len;
            rule->aad_len = algo->aad_len;
            rule->block_size = algo->block_size;
            rule->iv_len = algo->iv_len;
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            APP_CHECK(strcmp(tokens[ti], "aead_key") == 0,
                status, "unrecognized input \"%s\", "
                "expect \"aead_key\"", tokens[ti]);
            if (status->status < 0)
                return;
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            key_len = parse_key_string(tokens[ti],
                rule->cipher_key);
            APP_CHECK(key_len == rule->cipher_key_len, status,
                "unrecognized input \"%s\"", tokens[ti]);
            if (status->status < 0)
                return;
 
            key_len -= 4;
            rule->cipher_key_len = key_len;
            memcpy(&rule->salt,
                &rule->cipher_key[key_len], 4);
 
            aead_algo_p = 1;
            continue;
        }
 
        if (strcmp(tokens[ti], "src") == 0) {
            APP_CHECK_PRESENCE(src_p, tokens[ti], status);
            if (status->status < 0)
                return;
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            if (IS_IP4_TUNNEL(rule->flags)) {
                struct in_addr ip;
 
                APP_CHECK(parse_ipv4_addr(tokens[ti],
                    &ip, NULL) == 0, status,
                    "unrecognized input \"%s\", "
                    "expect valid ipv4 addr",
                    tokens[ti]);
                if (status->status < 0)
                    return;
                rule->src.ip.ip4 = rte_bswap32(
                    (uint32_t)ip.s_addr);
            } else if (IS_IP6_TUNNEL(rule->flags)) {
                struct in6_addr ip;
 
                APP_CHECK(parse_ipv6_addr(tokens[ti], &ip,
                    NULL) == 0, status,
                    "unrecognized input \"%s\", "
                    "expect valid ipv6 addr",
                    tokens[ti]);
                if (status->status < 0)
                    return;
                memcpy(rule->src.ip.ip6.ip6_b,
                    ip.s6_addr, 16);
            } else if (IS_TRANSPORT(rule->flags)) {
                APP_CHECK(0, status, "unrecognized input "
                    "\"%s\"", tokens[ti]);
                return;
            }
 
            src_p = 1;
            continue;
        }
 
        if (strcmp(tokens[ti], "dst") == 0) {
            APP_CHECK_PRESENCE(dst_p, tokens[ti], status);
            if (status->status < 0)
                return;
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            if (IS_IP4_TUNNEL(rule->flags)) {
                struct in_addr ip;
 
                APP_CHECK(parse_ipv4_addr(tokens[ti],
                    &ip, NULL) == 0, status,
                    "unrecognized input \"%s\", "
                    "expect valid ipv4 addr",
                    tokens[ti]);
                if (status->status < 0)
                    return;
                rule->dst.ip.ip4 = rte_bswap32(
                    (uint32_t)ip.s_addr);
            } else if (IS_IP6_TUNNEL(rule->flags)) {
                struct in6_addr ip;
 
                APP_CHECK(parse_ipv6_addr(tokens[ti], &ip,
                    NULL) == 0, status,
                    "unrecognized input \"%s\", "
                    "expect valid ipv6 addr",
                    tokens[ti]);
                if (status->status < 0)
                    return;
                memcpy(rule->dst.ip.ip6.ip6_b, ip.s6_addr, 16);
            } else if (IS_TRANSPORT(rule->flags)) {
                APP_CHECK(0, status, "unrecognized "
                    "input \"%s\"", tokens[ti]);
                return;
            }
 
            dst_p = 1;
            continue;
        }
 
        if (strcmp(tokens[ti], "type") == 0) {
            APP_CHECK_PRESENCE(type_p, tokens[ti], status);
            if (status->status < 0)
                return;
 
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
 
            if (strcmp(tokens[ti], "inline-crypto-offload") == 0)
                ips->type =
                    RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO;
            else if (strcmp(tokens[ti],
                    "inline-protocol-offload") == 0)
                ips->type =
                RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL;
            else if (strcmp(tokens[ti],
                    "lookaside-protocol-offload") == 0)
                ips->type =
                RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL;
            else if (strcmp(tokens[ti], "no-offload") == 0)
                ips->type = RTE_SECURITY_ACTION_TYPE_NONE;
            else if (strcmp(tokens[ti], "cpu-crypto") == 0)
                ips->type = RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO;
            else {
                APP_CHECK(0, status, "Invalid input \"%s\"",
                        tokens[ti]);
                return;
            }
 
            type_p = 1;
            continue;
        }
 
        if (strcmp(tokens[ti], "port_id") == 0) {
            APP_CHECK_PRESENCE(portid_p, tokens[ti], status);
            if (status->status < 0)
                return;
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
            if (rule->portid == UINT16_MAX)
                rule->portid = atoi(tokens[ti]);
            else if (rule->portid != atoi(tokens[ti])) {
                APP_CHECK(0, status,
                    "portid %s not matching with already assigned portid %u",
                    tokens[ti], rule->portid);
                return;
            }
            portid_p = 1;
            continue;
        }
 
        if (strcmp(tokens[ti], "mss") == 0) {
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
            rule->mss = atoi(tokens[ti]);
            if (status->status < 0)
                return;
            continue;
        }
 
        if (strcmp(tokens[ti], "reassembly_en") == 0) {
            rule->flags |= SA_REASSEMBLY_ENABLE;
            continue;
        }
 
        if (strcmp(tokens[ti], "esn") == 0) {
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
            rule->esn = atoll(tokens[ti]);
            if (status->status < 0)
                return;
            continue;
        }
 
        if (strcmp(tokens[ti], "fallback") == 0) {
            struct rte_ipsec_session *fb;
 
            APP_CHECK(app_sa_prm.enable, status, "Fallback session "
                "not allowed for legacy mode.");
            if (status->status < 0)
                return;
            APP_CHECK(ips->type ==
                RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO, status,
                "Fallback session allowed if primary session "
                "is of type inline-crypto-offload only.");
            if (status->status < 0)
                return;
            APP_CHECK(rule->direction ==
                RTE_SECURITY_IPSEC_SA_DIR_INGRESS, status,
                "Fallback session not allowed for egress "
                "rule");
            if (status->status < 0)
                return;
            APP_CHECK_PRESENCE(fallback_p, tokens[ti], status);
            if (status->status < 0)
                return;
            INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
            if (status->status < 0)
                return;
            fb = ipsec_get_fallback_session(rule);
            if (strcmp(tokens[ti], "lookaside-none") == 0)
                fb->type = RTE_SECURITY_ACTION_TYPE_NONE;
            else if (strcmp(tokens[ti], "cpu-crypto") == 0)
                fb->type = RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO;
            else {
                APP_CHECK(0, status, "unrecognized fallback "
                    "type %s.", tokens[ti]);
                return;
            }
 
            rule->fallback_sessions = 1;
            nb_crypto_sessions++;
            fallback_p = 1;
            continue;
        }
        if (strcmp(tokens[ti], "flow-direction") == 0) {
            switch (ips->type) {
            case RTE_SECURITY_ACTION_TYPE_NONE:
            case RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO:
                rule->fdir_flag = 1;
                INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
                if (status->status < 0)
                    return;
                if (rule->portid == UINT16_MAX)
                    rule->portid = atoi(tokens[ti]);
                else if (rule->portid != atoi(tokens[ti])) {
                    APP_CHECK(0, status,
                        "portid %s not matching with already assigned portid %u",
                        tokens[ti], rule->portid);
                    return;
                }
                INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
                if (status->status < 0)
                    return;
                rule->fdir_qid = atoi(tokens[ti]);
                /* validating portid and queueid */
                status_p = check_flow_params(rule->portid,
                        rule->fdir_qid);
                if (status_p < 0) {
                    printf("port id %u / queue id %u is "
                        "not valid\n", rule->portid,
                         rule->fdir_qid);
                }
                break;
            case RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO:
            case RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL:
            case RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL:
            default:
                APP_CHECK(0, status,
                    "flow director not supported for security session type %d",
                    ips->type);
                return;
            }
            continue;
        }
        if (strcmp(tokens[ti], "udp-encap") == 0) {
            switch (ips->type) {
            case RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL:
            case RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL:
                APP_CHECK_PRESENCE(udp_encap_p, tokens[ti],
                           status);
                if (status->status < 0)
                    return;
 
                rule->udp_encap = 1;
                app_sa_prm.udp_encap = 1;
                udp_encap_p = 1;
                break;
            case RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO:
                rule->udp_encap = 1;
                rule->udp.sport = 0;
                rule->udp.dport = 4500;
                break;
            default:
                APP_CHECK(0, status,
                    "UDP encapsulation not supported for "
                    "security session type %d",
                    ips->type);
                return;
            }
            continue;
        }
 
        /* unrecognizable input */
        APP_CHECK(0, status, "unrecognized input \"%s\"",
            tokens[ti]);
        return;
    }
 
    if (aead_algo_p) {
        APP_CHECK(cipher_algo_p == 0, status,
                "AEAD used, no need for cipher options");
        if (status->status < 0)
            return;
 
        APP_CHECK(auth_algo_p == 0, status,
                "AEAD used, no need for auth options");
        if (status->status < 0)
            return;
    } else {
        APP_CHECK(cipher_algo_p == 1, status, "missing cipher or AEAD options");
        if (status->status < 0)
            return;
 
        APP_CHECK(auth_algo_p == 1, status, "missing auth or AEAD options");
        if (status->status < 0)
            return;
    }
 
    APP_CHECK(mode_p == 1, status, "missing mode option");
    if (status->status < 0)
        return;
 
    if ((ips->type != RTE_SECURITY_ACTION_TYPE_NONE && ips->type !=
            RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) && (portid_p == 0))
        printf("Missing portid option, falling back to non-offload\n");
 
    if (!type_p || (!portid_p && ips->type !=
            RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO)) {
        ips->type = RTE_SECURITY_ACTION_TYPE_NONE;
    }
 
    if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO)
        wrkr_flags |= INL_CR_F;
    else if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL)
        wrkr_flags |= INL_PR_F;
    else if (ips->type == RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL)
        wrkr_flags |= LA_PR_F;
    else
        wrkr_flags |= LA_ANY_F;
 
    nb_crypto_sessions++;
    *ri = *ri + 1;
}
 
static void
print_one_sa_rule(const struct ipsec_sa *sa, int inbound)
{
    uint32_t i;
    uint8_t a, b, c, d;
    const struct rte_ipsec_session *ips;
    const struct rte_ipsec_session *fallback_ips;
 
    printf("\tspi_%s(%3u):", inbound?"in":"out", sa->spi);
 
    for (i = 0; i < RTE_DIM(cipher_algos); i++) {
        if (cipher_algos[i].algo == sa->cipher_algo &&
                cipher_algos[i].key_len == sa->cipher_key_len) {
            printf("%s ", cipher_algos[i].keyword);
            break;
        }
    }
 
    for (i = 0; i < RTE_DIM(auth_algos); i++) {
        if (auth_algos[i].algo == sa->auth_algo) {
            printf("%s ", auth_algos[i].keyword);
            break;
        }
    }
 
    for (i = 0; i < RTE_DIM(aead_algos); i++) {
        if (aead_algos[i].algo == sa->aead_algo &&
                aead_algos[i].key_len-4 == sa->cipher_key_len) {
            printf("%s ", aead_algos[i].keyword);
            break;
        }
    }
 
    printf("mode:");
    if (sa->udp_encap)
        printf("UDP encapsulated ");
 
    switch (WITHOUT_TRANSPORT_VERSION(sa->flags)) {
    case IP4_TUNNEL:
        printf("IP4Tunnel ");
        uint32_t_to_char(sa->src.ip.ip4, &a, &b, &c, &d);
        printf("%hhu.%hhu.%hhu.%hhu ", d, c, b, a);
        uint32_t_to_char(sa->dst.ip.ip4, &a, &b, &c, &d);
        printf("%hhu.%hhu.%hhu.%hhu", d, c, b, a);
        break;
    case IP6_TUNNEL:
        printf("IP6Tunnel ");
        for (i = 0; i < 16; i++) {
            if (i % 2 && i != 15)
                printf("%.2x:", sa->src.ip.ip6.ip6_b[i]);
            else
                printf("%.2x", sa->src.ip.ip6.ip6_b[i]);
        }
        printf(" ");
        for (i = 0; i < 16; i++) {
            if (i % 2 && i != 15)
                printf("%.2x:", sa->dst.ip.ip6.ip6_b[i]);
            else
                printf("%.2x", sa->dst.ip.ip6.ip6_b[i]);
        }
        break;
    case TRANSPORT:
        printf("Transport ");
        break;
    }
 
    ips = &sa->sessions[IPSEC_SESSION_PRIMARY];
    printf(" type:");
    switch (ips->type) {
    case RTE_SECURITY_ACTION_TYPE_NONE:
        printf("no-offload ");
        break;
    case RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO:
        printf("inline-crypto-offload ");
        break;
    case RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL:
        printf("inline-protocol-offload ");
        break;
    case RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL:
        printf("lookaside-protocol-offload ");
        break;
    case RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO:
        printf("cpu-crypto-accelerated ");
        break;
    }
 
    fallback_ips = &sa->sessions[IPSEC_SESSION_FALLBACK];
    if (fallback_ips != NULL && sa->fallback_sessions > 0) {
        printf("inline fallback: ");
        switch (fallback_ips->type) {
        case RTE_SECURITY_ACTION_TYPE_NONE:
            printf("lookaside-none");
            break;
        case RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO:
            printf("cpu-crypto-accelerated");
            break;
        default:
            printf("invalid");
            break;
        }
    }