When the legacy provider is unavailable, DES ciphers were still reported as supported, causing runtime failures when applications attempted to use them.
Add openssl_pmd_caps_init() to build a filtered capability list at device init, excluding DES-CBC and DES-DOCSISBPI based on legacy provider availability. Add a warning when DES algorithms are unavailable. Signed-off-by: Pratik Senapati <[email protected]> --- drivers/crypto/openssl/openssl_pmd_private.h | 2 ++ drivers/crypto/openssl/rte_openssl_pmd.c | 3 +- drivers/crypto/openssl/rte_openssl_pmd_ops.c | 29 +++++++++++++++++++- 3 files changed, 32 insertions(+), 2 deletions(-) diff --git a/drivers/crypto/openssl/openssl_pmd_private.h b/drivers/crypto/openssl/openssl_pmd_private.h index ab40012d61..71d78459ee 100644 --- a/drivers/crypto/openssl/openssl_pmd_private.h +++ b/drivers/crypto/openssl/openssl_pmd_private.h @@ -21,6 +21,8 @@ /** OPENSSL PMD LOGTYPE DRIVER */ extern int openssl_logtype_driver; +/** Initialize filtered capability list based on legacy provider availability */ +extern void openssl_pmd_caps_init(void); #define RTE_LOGTYPE_OPENSSL_DRIVER openssl_logtype_driver #define OPENSSL_LOG(level, ...) \ RTE_LOG_LINE_PREFIX(level, OPENSSL_DRIVER, "%s() line %u: ", \ diff --git a/drivers/crypto/openssl/rte_openssl_pmd.c b/drivers/crypto/openssl/rte_openssl_pmd.c index 2319c7cfa9..275078050a 100644 --- a/drivers/crypto/openssl/rte_openssl_pmd.c +++ b/drivers/crypto/openssl/rte_openssl_pmd.c @@ -37,7 +37,7 @@ static void ossl_legacy_provider_load(void) /* Load Multiple providers into the default (NULL) library context */ legacy = OSSL_PROVIDER_load(NULL, "legacy"); if (legacy == NULL) { - OPENSSL_LOG(ERR, "Failed to load Legacy provider"); + OPENSSL_LOG(WARNING, "Failed to load Legacy provider"); return; } @@ -3941,6 +3941,7 @@ cryptodev_openssl_create(const char *name, * unless the legacy provider explicitly loaded. e.g. DES */ ossl_legacy_provider_load(); + openssl_pmd_caps_init(); return 0; diff --git a/drivers/crypto/openssl/rte_openssl_pmd_ops.c b/drivers/crypto/openssl/rte_openssl_pmd_ops.c index d927cc5228..3dc1ee11a2 100644 --- a/drivers/crypto/openssl/rte_openssl_pmd_ops.c +++ b/drivers/crypto/openssl/rte_openssl_pmd_ops.c @@ -929,6 +929,7 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = { RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST() }; +static struct rte_cryptodev_capabilities openssl_pmd_caps_active[RTE_DIM(openssl_pmd_capabilities)]; const char *ml_kem_type_names[] = { NULL, "ML-KEM-512", @@ -943,6 +944,29 @@ const char *ml_dsa_type_names[] = { "ML-DSA-87", }; +/** Initialize active capability list, filtering unsupported entries. */ +void +openssl_pmd_caps_init(void) +{ + uint32_t i, j = 0; + + for (i = 0; openssl_pmd_capabilities[i].op != RTE_CRYPTO_OP_TYPE_UNDEFINED; i++) { + const struct rte_cryptodev_capabilities *cap = &openssl_pmd_capabilities[i]; + + if (cap->op == RTE_CRYPTO_OP_TYPE_SYMMETRIC && + cap->sym.xform_type == RTE_CRYPTO_SYM_XFORM_CIPHER && + (cap->sym.cipher.algo == RTE_CRYPTO_CIPHER_DES_CBC || + cap->sym.cipher.algo == RTE_CRYPTO_CIPHER_DES_DOCSISBPI)) { + EVP_CIPHER *des_cbc = EVP_CIPHER_fetch(NULL, "DES-CBC", "provider=legacy"); + if (des_cbc == NULL) + continue; + EVP_CIPHER_free(des_cbc); + } + openssl_pmd_caps_active[j++] = *cap; + } + openssl_pmd_caps_active[j] = openssl_pmd_capabilities[i]; +} + /** Configure device */ static int openssl_pmd_config(__rte_unused struct rte_cryptodev *dev, @@ -1014,7 +1038,10 @@ openssl_pmd_info_get(struct rte_cryptodev *dev, if (dev_info != NULL) { dev_info->driver_id = dev->driver_id; dev_info->feature_flags = dev->feature_flags; - dev_info->capabilities = openssl_pmd_capabilities; + if (openssl_pmd_caps_active[0].op == RTE_CRYPTO_OP_TYPE_UNDEFINED) + dev_info->capabilities = openssl_pmd_capabilities; + else + dev_info->capabilities = openssl_pmd_caps_active; dev_info->max_nb_queue_pairs = internals->max_nb_qpairs; /* No limit of number of sessions */ dev_info->sym.max_nb_sessions = 0; -- 2.43.0
