commit 21ada3bd7e9bc5cca7c2c8399adcbaa044bf8103
author Neale Ranns <nranns@cisco.com> Thu Apr 11 08:18:34 2019 +0000
committer Damjan Marion <dmarion@me.com> Thu Apr 11 15:12:58 2019 +0000
tree 845b74dfee811bfe27f3feef6a608d349e99436d
parent 5e282e93ad9f961d332cac9a033be33542979848

IPSEC-MB: Use random & non-repeating IV (VPP-1642)

hard code IV and key lengths based on cipher.
Init IV from random data, use AES instruction to rotate.

Change-Id: I13a6507d12267b823c528660a903787baeba47a0
Signed-off-by: Neale Ranns <nranns@cisco.com>

src/vnet/crypto/crypto.c

diff --git a/src/vnet/crypto/crypto.c b/src/vnet/crypto/crypto.c
index 58b1363..dbdb58b 100644
--- a/src/vnet/crypto/crypto.c
+++ b/src/vnet/crypto/crypto.c
@@ -119,8 +119,11 @@
       if (id == 0)
 	continue;
       od = vec_elt_at_index (cm->opt_data, id);
-      od->active_engine_index = p[0];
-      cm->ops_handlers[id] = ce->ops_handlers[id];
+      if (ce->ops_handlers[id])
+	{
+	  od->active_engine_index = p[0];
+	  cm->ops_handlers[id] = ce->ops_handlers[id];
+	}
     }
 
   return 0;

src/vnet/ipsec/esp_decrypt.c

diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index de951d1..fc4a99a 100644
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -232,9 +232,7 @@
 	  vec_add2_aligned (ptd->crypto_ops, op, 1, CLIB_CACHE_LINE_BYTES);
 	  vnet_crypto_op_init (op, sa0->crypto_dec_op_id);
 	  op->key = sa0->crypto_key.data;
-	  op->key_len = sa0->crypto_key.len;
 	  op->iv = payload;
-	  op->iv_len = cpd.iv_sz;
 	  op->src = op->dst = payload += cpd.iv_sz;
 	  op->len = len;
 	  op->user_data = b - bufs;
@@ -287,7 +285,7 @@
 	      bi = op->user_data;
 
 	      if (op->status == VNET_CRYPTO_OP_STATUS_FAIL_BAD_HMAC)
-		err = ESP_DECRYPT_ERROR_INTEG_ERROR;
+		err = ESP_DECRYPT_ERROR_DECRYPTION_FAILED;
 	      else
 		err = ESP_DECRYPT_ERROR_CRYPTO_ENGINE_ERROR;
 

src/vnet/ipsec/esp_encrypt.c

diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index c801859..bb1effd 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -431,10 +431,8 @@
 	  vec_add2_aligned (ptd->crypto_ops, op, 1, CLIB_CACHE_LINE_BYTES);
 	  vnet_crypto_op_init (op, sa0->crypto_enc_op_id);
 	  op->iv = payload - iv_sz;
-	  op->iv_len = iv_sz;
 	  op->src = op->dst = payload;
 	  op->key = sa0->crypto_key.data;
-	  op->key_len = sa0->crypto_key.len;
 	  op->len = payload_len - icv_sz;
 	  op->flags = VNET_CRYPTO_OP_FLAG_INIT_IV;
 	  op->user_data = b - bufs;