Fix command parser
[samplevnf.git] / VNFs / DPPD-PROX / handle_esp.c
index e27fcd5..ebdd2dc 100644 (file)
 #include <rte_ip.h>
 #include <rte_cryptodev.h>
 #include <rte_cryptodev_pmd.h>
+#include "prox_port_cfg.h"
 
 typedef unsigned int u32;
 typedef unsigned char u8;
-#define NUM_MBUFS                       (8191)
-#define MBUF_CACHE_SIZE                 (250)
 
 #define BYTE_LENGTH(x)                          (x/8)
 #define DIGEST_BYTE_LENGTH_SHA1                 (BYTE_LENGTH(160))
 
-#define CIPHER_KEY_LENGTH_AES_CBC       (32)
+//#define CIPHER_KEY_LENGTH_AES_CBC       (32)
+#define CIPHER_KEY_LENGTH_AES_CBC       (16)//==TEST
 #define CIPHER_IV_LENGTH_AES_CBC        16
 
 static inline void *get_sym_cop(struct rte_crypto_op *cop)
 {
-        return (cop + 1);
+        //return (cop + 1);//makes no sense on dpdk_17.05.2; TODO: doublecheck
+        return cop->sym;
 }
 
 struct task_esp_enc {
@@ -56,6 +57,7 @@ struct task_esp_enc {
         int crypto_dev_id;
         u8 iv[16];
         uint32_t                local_ipv4;
+        struct ether_addr       local_mac;
         uint32_t                remote_ipv4;
         u8 key[16];
         uint32_t  ipaddr;
@@ -70,6 +72,7 @@ struct task_esp_dec {
         int crypto_dev_id;
         u8 iv[16];
         uint32_t                local_ipv4;
+        struct ether_addr       local_mac;
         u8 key[16];
         uint32_t  ipaddr;
         struct rte_cryptodev_sym_session *sess;
@@ -82,8 +85,6 @@ struct crypto_testsuite_params {
         struct rte_mempool *mbuf_ol_pool_enc;
         struct rte_mempool *mbuf_ol_pool_dec;
 
-        uint16_t nb_queue_pairs;
-
         struct rte_cryptodev_config conf;
         struct rte_cryptodev_qp_conf qp_conf;
 };
@@ -95,72 +96,69 @@ static uint8_t hmac_sha1_key[] = {
         0xF8, 0x2A, 0xC7, 0x54, 0xDB, 0x96, 0x18, 0xAA,
         0xC3, 0xA1, 0x53, 0xF6, 0x1F, 0x17, 0x60, 0xBD,
         0xDE, 0xF4, 0xDE, 0xAD };
+
 static uint8_t aes_cbc_key[] = {
         0xE4, 0x23, 0x33, 0x8A, 0x35, 0x64, 0x61, 0xE2,
         0x49, 0x03, 0xDD, 0xC6, 0xB8, 0xCA, 0x55, 0x7A,
         0xE4, 0x23, 0x33, 0x8A, 0x35, 0x64, 0x61, 0xE2,
         0x49, 0x03, 0xDD, 0xC6, 0xB8, 0xCA, 0x55, 0x7A };
 
-static void init_task_esp_enc(struct task_base *tbase, __attribute__((unused)) struct task_args *targ)
+static uint8_t aes_cbc_iv[] = {
+        0xE4, 0x23, 0x33, 0x8A, 0x35, 0x64, 0x61, 0xE2,
+        0x49, 0x03, 0xDD, 0xC6, 0xB8, 0xCA, 0x55, 0x7A };
+
+static void init_task_esp_common(void)
+{
+        static int vdev_initialized = 0;
+        struct crypto_testsuite_params *ts_params = &testsuite_params;
+
+        if (!vdev_initialized) {
+                rte_vdev_init(RTE_STR(CRYPTODEV_NAME_AESNI_MB_PMD), NULL);
+                int nb_devs = rte_cryptodev_count_devtype(RTE_CRYPTODEV_AESNI_MB_PMD);
+                PROX_PANIC(nb_devs < 1, "No crypto devices found?\n");
+                vdev_initialized = 1;
+        }
+        ts_params->conf.nb_queue_pairs = 2;
+        ts_params->conf.socket_id = SOCKET_ID_ANY;
+        ts_params->conf.session_mp.nb_objs = 2048;
+        ts_params->qp_conf.nb_descriptors = 4096;
+
+        /*Now reconfigure queues to size we actually want to use in this testsuite.*/
+        ts_params->qp_conf.nb_descriptors = 128;
+        rte_cryptodev_configure(0, &ts_params->conf);
+               //rte_cryptodev_start(task->crypto_dev_id);
+}
+
+static void init_task_esp_enc(struct task_base *tbase, struct task_args *targ)
 {
         int i, nb_devs, valid_dev_id = 0;
         uint16_t qp_id;
-        struct crypto_testsuite_params *ts_params = &testsuite_params;
         struct rte_cryptodev_info info;
+        struct crypto_testsuite_params *ts_params = &testsuite_params;
 
+        init_task_esp_common();
         tbase->flags |= FLAG_NEVER_FLUSH;
 
         ts_params->mbuf_ol_pool_enc = rte_crypto_op_pool_create("crypto_op_pool_enc",
                         RTE_CRYPTO_OP_TYPE_SYMMETRIC, (2*1024*1024), 128, 0,
                         rte_socket_id());
+        PROX_PANIC(ts_params->mbuf_ol_pool_enc == NULL, "Can't create ENC CRYPTO_OP_POOL\n");
 
         struct task_esp_enc *task = (struct task_esp_enc *)tbase;
-        task->crypto_dev_id = rte_vdev_init(RTE_STR(CRYPTODEV_NAME_AESNI_MB_PMD), NULL);
-        nb_devs = rte_cryptodev_count_devtype(RTE_CRYPTODEV_AESNI_MB_PMD);
-
-        if (nb_devs < 1) {
-                RTE_LOG(ERR, USER1, "No crypto devices found?");
-                exit(-1);
-        }
-
-        /* Search for the first valid */
-        for (i = 0; i < nb_devs; i++) {
-                rte_cryptodev_info_get(i, &info);
-                if (info.dev_type == gbl_cryptodev_preftest_devtype) {
-                        task->crypto_dev_id = i;
-                        valid_dev_id = 1;
-                        break;
-                }
-        }
-
-        if (!valid_dev_id)
-        {
-                RTE_LOG(ERR, USER1, "invalid crypto devices found?");
-                return ;
-        }
+        task->crypto_dev_id = 0;
 
         /*
- *          * Since we can't free and re-allocate queue memory always set the queues
- *                   * on this device up to max size first so enough memory is allocated for
- *                            * any later re-configures needed by other tests */
+         * Since we can't free and re-allocate queue memory always set the queues
+         * on this device up to max size first so enough memory is allocated for
+         * any later re-configures needed by other tests
+         */
 
-        ts_params->conf.nb_queue_pairs = 2;
-        ts_params->conf.socket_id = SOCKET_ID_ANY;
-        ts_params->conf.session_mp.nb_objs = 2048;
-        ts_params->qp_conf.nb_descriptors = 4096;
-
-        /*Now reconfigure queues to size we actually want to use in this testsuite.*/
-        ts_params->qp_conf.nb_descriptors = 128;
-        rte_cryptodev_configure(task->crypto_dev_id, &ts_params->conf);
         rte_cryptodev_queue_pair_setup(task->crypto_dev_id, 0,
                                 &ts_params->qp_conf, rte_cryptodev_socket_id(task->crypto_dev_id));
-        rte_cryptodev_configure(task->crypto_dev_id, &ts_params->conf);
-
-       struct rte_cryptodev *dev;
 
+        struct rte_cryptodev *dev;
         dev = rte_cryptodev_pmd_get_dev(task->crypto_dev_id);
-        if (dev->attached != RTE_CRYPTODEV_ATTACHED)
-                return ;
+        PROX_PANIC(dev->attached != RTE_CRYPTODEV_ATTACHED, "No ENC cryptodev attached\n");
 
         /* Setup Cipher Parameters */
         task->cipher_xform.type = RTE_CRYPTO_SYM_XFORM_CIPHER;
@@ -180,39 +178,48 @@ static void init_task_esp_enc(struct task_base *tbase, __attribute__((unused)) s
         task->auth_xform.auth.key.data = hmac_sha1_key;
         task->auth_xform.auth.digest_length = DIGEST_BYTE_LENGTH_SHA1;
 
-        /* Create Crypto session*/
         task->sess = rte_cryptodev_sym_session_create(task->crypto_dev_id, &task->cipher_xform);
-        if (task->sess == NULL)
-        {
-                printf("not ok\n");
-                return ;
+        PROX_PANIC(task->sess == NULL, "Failed to create ENC session\n");
+
+        //TODO: doublecheck task->ops_burst lifecycle!
+        if (rte_crypto_op_bulk_alloc(ts_params->mbuf_ol_pool_enc,
+                     RTE_CRYPTO_OP_TYPE_SYMMETRIC,
+                     task->ops_burst, MAX_PKT_BURST) != MAX_PKT_BURST) {
+                PROX_PANIC(1, "Failed to allocate ENC crypto operations\n");
         }
+        //to clean up after rte_crypto_op_bulk_alloc:
+        //for (j = 0; j < MAX_PKT_BURST; j++) {
+        //   rte_crypto_op_free(task->ops_burst[j]);
+        //}
 
         // Read config file with SAs
-        task->local_ipv4 = targ->local_ipv4;
-        task->remote_ipv4 = targ->remote_ipv4;
+        task->local_ipv4 = rte_cpu_to_be_32(targ->local_ipv4);
+        task->remote_ipv4 = rte_cpu_to_be_32(targ->remote_ipv4);
+        //memcpy(&task->src_mac, &prox_port_cfg[task->base.tx_params_hw.tx_port_queue->port].eth_addr, sizeof(struct ether_addr));
+        struct prox_port_cfg *port = find_reachable_port(targ);
+        memcpy(&task->local_mac, &port->eth_addr, sizeof(struct ether_addr));
 
         for (i = 0; i < 16; i++) task->key[i] = i+2;
         for (i = 0; i < 16; i++) task->iv[i] = i;
 }
 
-static void init_task_esp_dec(struct task_base *tbase, __attribute__((unused)) struct task_args *targ)
+static void init_task_esp_dec(struct task_base *tbase, struct task_args *targ)
 {
-        int i;
+        int i, nb_devs;
         struct crypto_testsuite_params *ts_params = &testsuite_params;
+        init_task_esp_common();
+
         tbase->flags |= FLAG_NEVER_FLUSH;
         ts_params->mbuf_ol_pool_dec = rte_crypto_op_pool_create("crypto_op_pool_dec",
                         RTE_CRYPTO_OP_TYPE_SYMMETRIC, (2*1024*1024), 128, 0,
                         rte_socket_id());
-        if (ts_params->mbuf_ol_pool_dec == NULL) {
-                RTE_LOG(ERR, USER1, "Can't create CRYPTO_OP_POOL\n");
-                exit(-1);
-        }
+        PROX_PANIC(ts_params->mbuf_ol_pool_dec == NULL, "Can't create DEC CRYPTO_OP_POOL\n");
+
+        struct task_esp_dec *task = (struct task_esp_dec *)tbase;
 
         static struct rte_cryptodev_session *sess_dec = NULL;
         // Read config file with SAs
-        struct task_esp_dec *task = (struct task_esp_dec *)tbase;
-        task->local_ipv4 = targ->local_ipv4;
+        task->local_ipv4 = rte_cpu_to_be_32(targ->local_ipv4);
 
         task->cipher_xform.type = RTE_CRYPTO_SYM_XFORM_CIPHER;
         task->cipher_xform.next = NULL;
@@ -222,7 +229,6 @@ static void init_task_esp_dec(struct task_base *tbase, __attribute__((unused)) s
         task->cipher_xform.cipher.key.length = CIPHER_KEY_LENGTH_AES_CBC;
 
         /* Setup HMAC Parameters */
-        struct rte_crypto_sym_xform auth_xform;
         task->auth_xform.type = RTE_CRYPTO_SYM_XFORM_AUTH;
         task->auth_xform.next = &task->cipher_xform;
         task->auth_xform.auth.op = RTE_CRYPTO_AUTH_OP_VERIFY;
@@ -233,51 +239,35 @@ static void init_task_esp_dec(struct task_base *tbase, __attribute__((unused)) s
 
         rte_cryptodev_queue_pair_setup(task->crypto_dev_id, 1, &ts_params->qp_conf, rte_cryptodev_socket_id(task->crypto_dev_id));
 
-       struct rte_cryptodev *dev;
-
+        struct rte_cryptodev *dev;
         dev = rte_cryptodev_pmd_get_dev(task->crypto_dev_id);
-        if (dev->attached != RTE_CRYPTODEV_ATTACHED)
-                return ;
+        PROX_PANIC(dev->attached != RTE_CRYPTODEV_ATTACHED, "No DEC cryptodev attached\n");
 
         ts_params->qp_conf.nb_descriptors = 128;
 
-        rte_cryptodev_stats_reset(task->crypto_dev_id);
-
         task->sess = rte_cryptodev_sym_session_create(task->crypto_dev_id, &task->auth_xform);
-        if (task->sess == NULL)
-        {
-                printf("not ok dec\n");
-                        return ;
+        PROX_PANIC(task->sess == NULL, "Failed to create DEC session\n");
+
+        if (rte_crypto_op_bulk_alloc(ts_params->mbuf_ol_pool_dec,
+                     RTE_CRYPTO_OP_TYPE_SYMMETRIC,
+                     task->ops_burst, MAX_PKT_BURST) != MAX_PKT_BURST) {
+                PROX_PANIC(1, "Failed to allocate DEC crypto operations\n");
         }
-        rte_cryptodev_stats_reset(task->crypto_dev_id);
-        rte_cryptodev_start(task->crypto_dev_id);
+        //to clean up after rte_crypto_op_bulk_alloc:
+        //for (int j = 0; j < MAX_PKT_BURST; j++) {
+        //    rte_crypto_op_free(task->ops_burst[j]);
+        //}
+
+        struct prox_port_cfg *port = find_reachable_port(targ);
+        memcpy(&task->local_mac, &port->eth_addr, sizeof(struct ether_addr));
 
 // FIXME debug data
         for (i = 0; i < 16; i++) task->key[i] = i+2;
         for (i = 0; i < 16; i++) task->iv[i] = i;
 }
 
-static uint8_t aes_cbc_iv[] = {
-        0xE4, 0x23, 0x33, 0x8A, 0x35, 0x64, 0x61, 0xE2,
-        0x49, 0x03, 0xDD, 0xC6, 0xB8, 0xCA, 0x55, 0x7A };
-
-static int enqueue_crypto_request(struct task_esp_enc *task, struct rte_crypto_op *cop, int dir)
-{
-        if (rte_cryptodev_enqueue_burst(task->crypto_dev_id, dir, &cop, 1) != 1) {
-             //   printf("Error sending packet for encryption");
-                return -1;
-        }
-
-        return 0;
-}
-
-static int debug_counter = 0;
 static inline uint8_t handle_esp_ah_enc(struct task_esp_enc *task, struct rte_mbuf *mbuf, struct rte_crypto_op *cop)
 {
-        struct crypto_testsuite_params *ts_params = &testsuite_params;
-        debug_counter++;
-        int result;
-        u8 dest[8192]; // scratch buf, maximum packet
         u8 *data;
         struct ether_hdr *peth = rte_pktmbuf_mtod(mbuf, struct ether_hdr *);
         struct ipv4_hdr* pip4 = (struct ipv4_hdr *)(peth + 1);
@@ -285,8 +275,8 @@ static inline uint8_t handle_esp_ah_enc(struct task_esp_enc *task, struct rte_mb
         struct rte_crypto_sym_op *sym_cop = get_sym_cop(cop);
 
         if (unlikely((pip4->version_ihl >> 4) != 4)) {
-                plog_info("Received non IPv4 packet at esp tunnel input %i\n", pip4->version_ihl);
-                // Drop packet
+                plog_info("Received non IPv4 packet at esp enc %i\n", pip4->version_ihl);
+                plogdx_info(mbuf, "ENC RX: ");
                 return OUT_DISCARD;
         }
         if (pip4->time_to_live) {
@@ -309,13 +299,11 @@ static inline uint8_t handle_esp_ah_enc(struct task_esp_enc *task, struct rte_mb
         padding = 0;
         if ((encrypt_len & 0xf) != 0)
         {
-        // now add padding
                 padding = 16 - (encrypt_len % 16);
                 encrypt_len += padding;
         }
 
         // Encapsulate, crypt in a separate buffer
-//      memcpy(dest, pip4, encrypt_len);
         const int extra_space = sizeof(struct ipv4_hdr) + 4 + 4 + CIPHER_IV_LENGTH_AES_CBC; // + new IP header, SPI, SN, IV
         struct ether_addr src_mac  = peth->s_addr;
         struct ether_addr dst_mac  = peth->d_addr;
@@ -329,19 +317,28 @@ static inline uint8_t handle_esp_ah_enc(struct task_esp_enc *task, struct rte_mb
         peth = rte_pktmbuf_mtod(mbuf, struct ether_hdr *);
         l1 = rte_pktmbuf_pkt_len(mbuf);
         peth->ether_type = ETYPE_IPv4;
-        ether_addr_copy(&src_mac, &peth->s_addr);
-        ether_addr_copy(&dst_mac, &peth->d_addr);
+#if 0
+        //send it back
+        ether_addr_copy(&dst_mac, &peth->s_addr);
+        ether_addr_copy(&src_mac, &peth->d_addr);
+#else
+        ether_addr_copy(&task->local_mac, &peth->s_addr);
+        ether_addr_copy(&dst_mac, &peth->d_addr);//IS: dstmac should be rewritten by arp
+#endif
 
         pip4 = (struct ipv4_hdr *)(peth + 1);
         pip4->src_addr = task->local_ipv4;
         pip4->dst_addr = task->remote_ipv4;
         pip4->time_to_live = ttl;
-        pip4->next_proto_id = 50; // 50 for ESP, ip in ip next proto trailer
+        pip4->next_proto_id = IPPROTO_ESP; // 50 for ESP, ip in ip next proto trailer
         pip4->version_ihl = version_ihl; // 20 bytes, ipv4
         pip4->total_length = rte_cpu_to_be_16(ipv4_length + sizeof(struct ipv4_hdr) + 4 + 4 + CIPHER_IV_LENGTH_AES_CBC + padding + 1 + 1 + DIGEST_BYTE_LENGTH_SHA1); // iphdr+SPI+SN+IV+payload+padding+padlen+next header + crc + auth
+        pip4->packet_id = 0x0101;
+        pip4->type_of_service = 0;
+        pip4->time_to_live = 64;
         prox_ip_cksum_sw(pip4);
 
-//      find the SA when there will be more than one
+        //find the SA when there will be more than one
         if (task->ipaddr == pip4->src_addr)
         {
         }
@@ -349,15 +346,15 @@ static inline uint8_t handle_esp_ah_enc(struct task_esp_enc *task, struct rte_mb
         *((u32*) data) = 0x2016; // FIXME SPI
         *((u32*) data + 1) = 0x2; // FIXME SN
         u8 *padl = (u8*)data + (8 + encrypt_len - 2 + CIPHER_IV_LENGTH_AES_CBC); // No ESN yet. (-2 means NH is crypted)
-//      padl += CIPHER_IV_LENGTH_AES_CBC;
+        //padl += CIPHER_IV_LENGTH_AES_CBC;
         *padl = padding;
         *(padl + 1) = 4; // ipv4 in 4
 
-//              one key for them all for now
+        //one key for them all for now
         rte_crypto_op_attach_sym_session(cop, task->sess);
 
-        sym_cop->auth.digest.data = data + 8 + CIPHER_IV_LENGTH_AES_CBC + encrypt_len + 2;
-        sym_cop->auth.digest.phys_addr = rte_pktmbuf_mtophys_offset(mbuf, (sizeof (struct ether_hdr) + sizeof(struct ipv4_hdr) + 8 + CIPHER_IV_LENGTH_AES_CBC + encrypt_len + 2));
+        sym_cop->auth.digest.data = data + 8 + CIPHER_IV_LENGTH_AES_CBC + encrypt_len;
+        sym_cop->auth.digest.phys_addr = rte_pktmbuf_mtophys_offset(mbuf, (sizeof (struct ether_hdr) + sizeof(struct ipv4_hdr) + 8 + CIPHER_IV_LENGTH_AES_CBC + encrypt_len));
         sym_cop->auth.digest.length = DIGEST_BYTE_LENGTH_SHA1;
 
         sym_cop->cipher.iv.data = data + 8;
@@ -372,37 +369,34 @@ static inline uint8_t handle_esp_ah_enc(struct task_esp_enc *task, struct rte_mb
         sym_cop->auth.data.offset = sizeof (struct ether_hdr) + sizeof(struct ipv4_hdr);
         sym_cop->auth.data.length = 4 + 4 + CIPHER_IV_LENGTH_AES_CBC + encrypt_len ;// + 4;// FIXME
 
-        /* Process crypto operation */
         sym_cop->m_src = mbuf;
-        return enqueue_crypto_request(task, cop, 0);
+        //cop->type = RTE_CRYPTO_OP_TYPE_SYMMETRIC;
+        //cop->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
+
+        return 0;
 }
 
 static inline uint8_t handle_esp_ah_dec(struct task_esp_dec *task, struct rte_mbuf *mbuf, struct rte_crypto_op *cop)
 {
-        struct crypto_testsuite_params *ts_params = &testsuite_params;
-debug_counter++;
         struct rte_crypto_sym_op *sym_cop = get_sym_cop(cop);
-        int result;
         struct ether_hdr *peth = rte_pktmbuf_mtod(mbuf, struct ether_hdr *);
         struct ipv4_hdr* pip4 = (struct ipv4_hdr *)(peth + 1);
         uint16_t ipv4_length = rte_be_to_cpu_16(pip4->total_length);
-        int l1 = rte_pktmbuf_pkt_len(mbuf);
-        u32 iv_onstack;
         u8 *data = (u8*)(pip4 + 1);
-//              find the SA
-        if (pip4->next_proto_id != 50)
+        //find the SA
+        if (pip4->next_proto_id != IPPROTO_ESP)
         {
-                plog_info("Received non ip in ip tunnel packet esp tunnel output\n");
-                return OUT_DISCARD;//NO_PORT_AVAIL;
+                plog_info("Received non ESP packet on esp dec\n");
+                plogdx_info(mbuf, "DEC RX: ");
+                return OUT_DISCARD;
         }
         if (task->ipaddr == pip4->src_addr)
         {
         }
 
-        /* Create Crypto session*/
         rte_crypto_op_attach_sym_session(cop, task->sess);
 
-        sym_cop->auth.digest.data = (unsigned char *)((unsigned char*)pip4 + ipv4_length - 20);
+        sym_cop->auth.digest.data = (unsigned char *)((unsigned char*)pip4 + ipv4_length - DIGEST_BYTE_LENGTH_SHA1);
         sym_cop->auth.digest.phys_addr = rte_pktmbuf_mtophys_offset(mbuf, sizeof (struct ether_hdr) + sizeof(struct ipv4_hdr) + 4 + 4); // FIXME
         sym_cop->auth.digest.length = DIGEST_BYTE_LENGTH_SHA1;
 
@@ -416,19 +410,38 @@ debug_counter++;
         sym_cop->cipher.data.offset = sizeof (struct ether_hdr) + sizeof(struct ipv4_hdr) + 4 + 4 + CIPHER_IV_LENGTH_AES_CBC;
         sym_cop->cipher.data.length = ipv4_length - sizeof(struct ipv4_hdr) - CIPHER_IV_LENGTH_AES_CBC - 28; // FIXME
 
-        /* Process crypto operation */
         sym_cop->m_src = mbuf;
-        return enqueue_crypto_request((struct task_esp_enc *)task, cop, 1);
+        return 0;
+}
+
+static inline void do_ipv4_swap(struct task_esp_dec *task, struct rte_mbuf *mbuf)
+{
+        struct ether_hdr *peth = rte_pktmbuf_mtod(mbuf, struct ether_hdr *);
+        struct ether_addr src_mac  = peth->s_addr;
+        struct ether_addr dst_mac  = peth->d_addr;
+        uint32_t src_ip, dst_ip;
+
+        struct ipv4_hdr* pip4 = (struct ipv4_hdr *)(peth + 1);
+        src_ip = pip4->src_addr;
+        dst_ip = pip4->dst_addr;
+
+        //peth->s_addr = dst_mac;
+        peth->d_addr = src_mac;//should be replaced by arp
+        //pip4->src_addr = dst_ip;
+        pip4->dst_addr = src_ip;
+        ether_addr_copy(&task->local_mac, &peth->s_addr);
 }
 
-static inline uint8_t handle_esp_ah_dec_finish(struct task_esp_dec *task, struct rte_mbuf *mbuf, struct rte_crypto_op *cop)
+static inline uint8_t handle_esp_ah_dec_finish(struct task_esp_dec *task, struct rte_mbuf *mbuf)
 {
         struct ether_hdr *peth = rte_pktmbuf_mtod(mbuf, struct ether_hdr *);
         rte_memcpy(((u8*)peth) + sizeof (struct ether_hdr), ((u8*)peth) + sizeof (struct ether_hdr) +
                         + sizeof(struct ipv4_hdr) + 4 + 4 + CIPHER_IV_LENGTH_AES_CBC, sizeof(struct ipv4_hdr));// next hdr, padding
         struct ipv4_hdr* pip4 = (struct ipv4_hdr *)(peth + 1);
+
         if (unlikely((pip4->version_ihl >> 4) != 4)) {
-                plog_info("Received non IPv4 packet at esp tunnel input %i\n", pip4->version_ihl);
+                plog_info("non IPv4 packet after esp dec %i\n", pip4->version_ihl);
+                plogdx_info(mbuf, "DEC TX: ");
                 return OUT_DISCARD;
         }
         if (pip4->time_to_live) {
@@ -445,8 +458,12 @@ static inline uint8_t handle_esp_ah_dec_finish(struct task_esp_dec *task, struct
 
         int len = rte_pktmbuf_pkt_len(mbuf);
         rte_pktmbuf_trim(mbuf, len - sizeof (struct ether_hdr) - ipv4_length);
+        prox_ip_cksum_sw(pip4);
         peth = rte_pktmbuf_mtod(mbuf, struct ether_hdr *);
 
+#if 1
+        do_ipv4_swap(task, mbuf);
+#endif
 //              one key for them all for now
 //              set key
 //      struct crypto_aes_ctx ctx;
@@ -460,68 +477,75 @@ static inline uint8_t handle_esp_ah_dec_finish(struct task_esp_dec *task, struct
         return 0;
 }
 
-static void handle_esp_enc_bulk(__attribute__((unused)) struct task_base *tbase, struct rte_mbuf **mbufs, uint16_t n_pkts)
+static int handle_esp_enc_bulk(struct task_base *tbase, struct rte_mbuf **mbufs, uint16_t n_pkts)
 {
         struct task_esp_enc *task = (struct task_esp_enc *)tbase;
         struct crypto_testsuite_params *ts_params = &testsuite_params;
         uint8_t out[MAX_PKT_BURST];
-        uint16_t i = 0, nb_rx = 0, j = 0;
+        uint16_t i = 0, nb_rx = 0, nb_enc=0, j = 0;
 
-        if (rte_crypto_op_bulk_alloc( ts_params->mbuf_ol_pool_enc,
-                     RTE_CRYPTO_OP_TYPE_SYMMETRIC,
-                     task->ops_burst, n_pkts) != n_pkts) {
-                // FXIME AK shit..
-                printf("out of memory\n");
-                return;
+        for (uint16_t j = 0; j < n_pkts; ++j) {
+                out[j] = handle_esp_ah_enc(task, mbufs[j], task->ops_burst[nb_enc]);
+                if (out[j] != OUT_DISCARD)
+                        ++nb_enc;
         }
 
-        for (uint16_t j = 0; j < n_pkts; ++j) {
-                out[j] = handle_esp_ah_enc(task, mbufs[j], task->ops_burst[j]);
+        if (rte_cryptodev_enqueue_burst(task->crypto_dev_id, 0, task->ops_burst, nb_enc) != nb_enc) {
+                plog_info("Error enc enqueue_burst\n");
+                return -1;
         }
-        /* Dequeue packets from Crypto device */
+
+        //do not call rte_cryptodev_dequeue_burst() on already dequeued packets
+        //otherwise handle_completed_jobs() screws up the content of the ops_burst array!
         do {
-            if (out[j] == 0)
-                    nb_rx = rte_cryptodev_dequeue_burst(
+                nb_rx = rte_cryptodev_dequeue_burst(
                                    task->crypto_dev_id, 0,// FIXME AK
-                                   task->ops_burst, n_pkts);
-
-            i += nb_rx;
-        } while (i < n_pkts);
+                                   task->ops_burst+i, nb_enc-i);
+                i += nb_rx;
+        } while (i < nb_enc);
 
-        for (j = 0; j < n_pkts; j++) {
-            rte_crypto_op_free(task->ops_burst[j]);
-        }
-
-        task->base.tx_pkt(&task->base, mbufs, n_pkts, out);
+        return task->base.tx_pkt(&task->base, mbufs, n_pkts, out);
 }
 
-static void handle_esp_dec_bulk(__attribute__((unused)) struct task_base *tbase, struct rte_mbuf **mbufs, uint16_t n_pkts)
+static int handle_esp_dec_bulk(struct task_base *tbase, struct rte_mbuf **mbufs, uint16_t n_pkts)
 {
-        uint8_t out[MAX_PKT_BURST];
         struct task_esp_dec *task = (struct task_esp_dec *)tbase;
         struct crypto_testsuite_params *ts_params = &testsuite_params;
-//__itt_frame_begin_v3(pD, NULL);
-
-        if (rte_crypto_op_bulk_alloc(
-                     ts_params->mbuf_ol_pool_dec,
-                     RTE_CRYPTO_OP_TYPE_SYMMETRIC,
-                     task->ops_burst, n_pkts) !=
-                                  n_pkts) {
+        uint8_t out[MAX_PKT_BURST];
+        uint16_t j, nb_dec=0, nb_rx=0;
 
-                printf("out of memory\n");
-                exit(-1);
+        for (j = 0; j < n_pkts; ++j) {
+                out[j] = handle_esp_ah_dec(task, mbufs[j], task->ops_burst[nb_dec]);
+                if (out[j] != OUT_DISCARD)
+                        ++nb_dec;
         }
-        uint16_t i = 0, nb_rx, j;
-
-        for (uint16_t j = 0; j < n_pkts; ++j) {
 
-                out[j] = handle_esp_ah_dec(task, mbufs[j], task->ops_burst[j]);
+        if (rte_cryptodev_enqueue_burst(task->crypto_dev_id, 1, task->ops_burst, nb_dec) != nb_dec) {
+                plog_info("Error dec enqueue_burst\n");
+                return -1;
         }
-        for (j = 0; j < n_pkts; j++) {
-            rte_crypto_op_free(task->ops_burst[j]);
+
+        j=0;
+        do {
+                nb_rx = rte_cryptodev_dequeue_burst(task->crypto_dev_id, 1,// FIXME AK
+                                   task->ops_burst+j, nb_dec-j);
+                j += nb_rx;
+        } while (j < nb_dec);
+
+        for (j = 0; j < nb_dec; ++j) {
+                if (task->ops_burst[j]->status != RTE_CRYPTO_OP_STATUS_SUCCESS){
+                        plog_info("err: task->ops_burst[%d].status=%d\n", j, task->ops_burst[j]->status);
+                        //!!!TODO!!! find mbuf and discard it!!!
+                        //for now just send it further
+                        //plogdx_info(mbufs[j], "RX: ");
+                }
+                if (task->ops_burst[j]->status == RTE_CRYPTO_OP_STATUS_SUCCESS) {
+                        struct rte_mbuf *mbuf = task->ops_burst[j]->sym->m_src;
+                        handle_esp_ah_dec_finish(task, mbuf);//TODO set out[j] properly
+                }
         }
 
-        task->base.tx_pkt(&task->base, mbufs, n_pkts, out);
+        return task->base.tx_pkt(&task->base, mbufs, n_pkts, out);
 }
 
 struct task_init task_init_esp_enc = {
@@ -529,7 +553,8 @@ struct task_init task_init_esp_enc = {
         .mode_str = "esp_enc",
         .init = init_task_esp_enc,
         .handle = handle_esp_enc_bulk,
-        .size = sizeof(struct task_esp_enc)
+        .size = sizeof(struct task_esp_enc),
+        .mbuf_size = 2048 + sizeof(struct rte_mbuf) + RTE_PKTMBUF_HEADROOM
 };
 
 struct task_init task_init_esp_dec = {
@@ -537,7 +562,8 @@ struct task_init task_init_esp_dec = {
         .mode_str = "esp_dec",
         .init = init_task_esp_dec,
         .handle = handle_esp_dec_bulk,
-        .size = sizeof(struct task_esp_dec)
+        .size = sizeof(struct task_esp_dec),
+        .mbuf_size = 2048 + sizeof(struct rte_mbuf) + RTE_PKTMBUF_HEADROOM
 };
 
 __attribute__((constructor)) static void reg_task_esp_enc(void)