Gitiles
Code Review Sign In
gerrit.nordix.org / fdio / vpp / refs/heads/stable/2001
commit752f6fe1b06e96f2c28bf846aadc79d8cdb0bdb1[log] [tgz]
authorBenoît Ganne <bganne@cisco.com>Tue Jan 18 15:56:41 2022 +0100
committerBenoît Ganne <bganne@cisco.com>Mon Feb 06 17:03:39 2023 +0100
tree6cbfd63112e6e002ddd884cc4cf53a6a546cb1e0
parent3e0dafb74636671624a4168ea55c189c9e37929c [diff]
ipsec: fix AES CBC IV generation (CVE-2022-46397)

For AES-CBC, the IV must be unpredictable (see NIST SP800-38a Appendix
C). Chaining IVs like is done by ipsecmb and native backends for the
VNET_CRYPTO_OP_FLAG_INIT_IV is fully predictable.
Encrypt a counter as part of the message, making the (predictable)
counter-generated IV unpredictable.

Fixes: VPP-2037
Type: fix

Change-Id: If4f192d62bf97dda553e7573331c75efa11822ae
Signed-off-by: Benoît Ganne <bganne@cisco.com>
2 files changed
tree: 6cbfd63112e6e002ddd884cc4cf53a6a546cb1e0
  1. build/
  2. build-data/
  3. build-root/
  4. docs/
  5. doxygen/
  6. extras/
  7. gmod/
  8. src/
  9. test/
  10. .clang-format
  11. .git_commit_template.txt
  12. .gitignore
  13. .gitreview
  14. INFO.yaml
  15. LICENSE
  16. MAINTAINERS
  17. Makefile
  18. README.md
  19. RELEASE.md
README.md

Vector Packet Processing

Introduction

The VPP platform is an extensible framework that provides out-of-the-box production quality switch/router functionality. It is the open source version of Cisco's Vector Packet Processing (VPP) technology: a high performance, packet-processing stack that can run on commodity CPUs.

The benefits of this implementation of VPP are its high performance, proven technology, its modularity and flexibility, and rich feature set.

For more information on VPP and its features please visit the FD.io website and What is VPP? pages.

Changes

Details of the changes leading up to this version of VPP can be found under @ref release_notes.

Directory layout

Directory nameDescription
build-dataBuild metadata
build-rootBuild output directory
doxygenDocumentation generator configuration
dpdkDPDK patches and build infrastructure
@ref extras/libmemifClient library for memif
@ref src/examplesVPP example code
@ref src/pluginsVPP bundled plugins directory
@ref src/svmShared virtual memory allocation library
src/testsStandalone tests (not part of test harness)
src/vatVPP API test program
@ref src/vlibVPP application library
@ref src/vlibapiVPP API library
@ref src/vlibmemoryVPP Memory management
@ref src/vnetVPP networking
@ref src/vppVPP application
@ref src/vpp-apiVPP application API bindings
@ref src/vppinfraVPP core library
@ref src/vpp/apiNot-yet-relocated API bindings
testUnit tests and Python test harness

Getting started

In general anyone interested in building, developing or running VPP should consult the VPP wiki for more complete documentation.

In particular, readers are recommended to take a look at [Pulling, Building, Running, Hacking, Pushing](https://wiki.fd.io/view/VPP/Pulling,_Building,_Run ning,_Hacking_and_Pushing_VPP_Code) which provides extensive step-by-step coverage of the topic.

For the impatient, some salient information is distilled below.

Quick-start: On an existing Linux host

To install system dependencies, build VPP and then install it, simply run the build script. This should be performed a non-privileged user with sudo access from the project base directory:

./extras/vagrant/build.sh

If you want a more fine-grained approach because you intend to do some development work, the Makefile in the root directory of the source tree provides several convenience shortcuts as make targets that may be of interest. To see the available targets run:

make

Quick-start: Vagrant

The directory extras/vagrant contains a VagrantFile and supporting scripts to bootstrap a working VPP inside a Vagrant-managed Virtual Machine. This VM can then be used to test concepts with VPP or as a development platform to extend VPP. Some obvious caveats apply when using a VM for VPP since its performance will never match that of bare metal; if your work is timing or performance sensitive, consider using bare metal in addition or instead of the VM.

For this to work you will need a working installation of Vagrant. Instructions for this can be found [on the Setting up Vagrant wiki page] (https://wiki.fd.io/view/DEV/Setting_Up_Vagrant).

More information

Several modules provide documentation, see @subpage user_doc for more end-user-oriented information. Also see @subpage dev_doc for developer notes.

Visit the VPP wiki for details on more advanced building strategies and other development notes.

Test Framework

There is PyDoc generated documentation available for the VPP test framework. See @ref test_framework_doc for details.