[PATCH v1 1/1] crypto/openssl: filter legacy ciphers from capability list

[Pratik Senapati]

> /** Configure device */
>static int
> openssl_pmd_config(__rte_unused struct rte_cryptodev *dev,
>@@ -1014,7 +1038,10 @@ openssl_pmd_info_get(struct rte_cryptodev *dev,
>         if (dev_info != NULL) {
>                 dev_info->driver_id = dev->driver_id;
>                 dev_info->feature_flags = dev->feature_flags;
>-               dev_info->capabilities = openssl_pmd_capabilities;
>+               if (openssl_pmd_caps_active[0].op == RTE_CRYPTO_OP_TYPE_UNDEFINED)
>+                       dev_info->capabilities = openssl_pmd_capabilities;
>
>It seems  fallback also advertises DES even when DES is unavailable, which defeats the filtering during that >window. Would it be better fix to initialize the filtered list before the device can be queried; then this fallback >should not be needed.
>
>+               else
>+                       dev_info->capabilities = openssl_pmd_caps_active;
>                 dev_info->max_nb_queue_pairs = internals->max_nb_qpairs;
>                 /* No limit of number of sessions */
>                 dev_info->sym.max_nb_sessions = 0;
>--
>2.43.0

Hi Kai,

You're right, there's an issue where 3-DES is advertised and it causes a session-failure. This is due to the fact that 3-DES (sessionless) in the 8-Byte key mode routes via DES, unlike the 16/24 byte key-mode. 

When the legacy provider is missing, 3-DES is still marked as available and when a session is attempted a failure occurs. 

I will be sending a v2 that fixes this by making a change in the sessionless path. 

Also, after testing, I noticed that based on the logic implemented, only the active list is used, and hence I will be altering the logic to only use the active list, removing the need to check whether we need to use the regular or filtered list; this change will be included in the v2 patch-series.

Thanks,

Pratik Senapati