ipsec: fix AES CBC IV generation (CVE-2022-46397)

For AES-CBC, the IV must be unpredictable (see NIST SP800-38a Appendix
C). Chaining IVs like is done by ipsecmb and native backends for the
VNET_CRYPTO_OP_FLAG_INIT_IV is fully predictable.
Encrypt a counter as part of the message, making the (predictable)
counter-generated IV unpredictable.

Fixes: VPP-2037
Type: fix

Change-Id: If4f192d62bf97dda553e7573331c75efa11822ae
Signed-off-by: Benoît Ganne <bganne@cisco.com>

.gitreview

@@ -2,3 +2,4 @@
 host=gerrit.fd.io
 port=29418
 project=vpp
+defaultbranch=stable/2001

Makefile

@@ -124,6 +124,11 @@ endif
 # +ganglia-devel if building the ganglia plugin
 
 RPM_DEPENDS += chrpath libffi-devel rpm-build
+
+RPM_DEPENDS_DEBUG  = glibc-debuginfo e2fsprogs-debuginfo
+RPM_DEPENDS_DEBUG += krb5-debuginfo openssl-debuginfo
+RPM_DEPENDS_DEBUG += zlib-debuginfo nss-softokn-debuginfo
+RPM_DEPENDS_DEBUG += yum-plugin-auto-update-debug-info
 # lowercase- replace spaces with dashes.
 SUSE_NAME= $(shell grep '^NAME=' /etc/os-release | cut -f2- -d= | sed -e 's/\"//g' | sed -e 's/ /-/' | awk '{print tolower($$0)}')
 SUSE_ID= $(shell grep '^VERSION_ID=' /etc/os-release | cut -f2- -d= | sed -e 's/\"//g' | cut -d' ' -f2)
@@ -308,7 +313,7 @@ else ifeq ($(OS_ID),centos)
 	@sudo -E yum install $(CONFIRM) centos-release-scl-rh epel-release
 	@sudo -E yum groupinstall $(CONFIRM) $(RPM_DEPENDS_GROUPS)
 	@sudo -E yum install $(CONFIRM) $(RPM_DEPENDS)
-	@sudo -E debuginfo-install $(CONFIRM) glibc openssl-libs mbedtls-devel zlib
+	@sudo -E yum install $(CONFIRM) --enablerepo=base-debuginfo $(RPM_DEPENDS_DEBUG)
 else ifeq ($(OS_ID),fedora)
 	@sudo -E dnf groupinstall $(CONFIRM) $(RPM_DEPENDS_GROUPS)
 	@sudo -E dnf install $(CONFIRM) $(RPM_DEPENDS)

build-root/Makefile

@@ -653,12 +653,10 @@ configure_check_timestamp =						\
 # NB: GNU Make 4.2 will let us use '$(file </proc/cpuinfo)' to both test
 # for file presence and content; for now this will have to do.
 ifndef MAKE_PARALLEL_JOBS
-MAKE_PARALLEL_JOBS = -j $(if $(shell [ -f /proc/cpuinfo ] && head /proc/cpuinfo), \
+MAKE_PARALLEL_JOBS = $(if $(shell [ -f /proc/cpuinfo ] && head /proc/cpuinfo), \
 	$(shell grep -c ^processor /proc/cpuinfo), 2)
-else
-MAKE_PARALLEL_JOBS := -j $(MAKE_PARALLEL_JOBS)
 endif
-MAKE_PARALLEL_FLAGS ?= $(if $($(PACKAGE)_make_parallel_fails),,$(MAKE_PARALLEL_JOBS))
+MAKE_PARALLEL_FLAGS ?= $(if $($(PACKAGE)_make_parallel_fails),,-j $(MAKE_PARALLEL_JOBS))
 
 # Make command shorthand for packages & tools.
 PACKAGE_MAKE =					\

doxygen/dev_doc.md

@@ -16,4 +16,7 @@ Programming notes for developers.
 - @subpage stats_doc
 - @subpage if_stats_client_doc
 - @subpage api_lang_doc
-- @subpage handoff_queue_demo_plugin
+- @subpage handoff_queue_demo_plugin
+- @subpage lcov_code_coverage
+- @subpage mdata_doc
+

doxygen/user_doc.md

@@ -16,6 +16,7 @@ Several modules provide operational, dataplane-user focused documentation.
 - @subpage lldp_doc
 - @subpage map_doc
 - @subpage marvel_plugin_doc
+- @subpage srv6_mobile_plugin
 - @subpage mtu_doc
 - @subpage nat64_doc
 - @subpage nat_ha_doc

extras/lcov/README.md

@@ -1,3 +1,5 @@
+# Code coverage analysis with lcov  {#lcov_code_coverage}
+
 ## Prerequisites
 
 The Linux gcov and lcov tools are fussy about gcc / g++ compiler

extras/pcapcli/setup.tracefilter

@@ -17,4 +17,6 @@ packet-generator new {
     }
 }
 
-classify filter trace mask l3 ip4 src match l3 ip4 src 192.168.1.15
+comment { Pick one, uncomment, and "pcap rx ..." or "trace add pg-input ..." }
+comment { classify filter trace mask l3 ip4 src match l3 ip4 src 192.168.1.15 }
+comment { classify filter pcap mask l3 ip4 src match l3 ip4 src 192.168.1.15 }

src/plugins/avf/avf.h

@@ -333,7 +333,8 @@ typedef struct
 } avf_input_trace_t;
 
 #define foreach_avf_tx_func_error	       \
-_(NO_FREE_SLOTS, "no free tx slots")
+  _(SEGMENT_SIZE_EXCEEDED, "segment size exceeded")	\
+  _(NO_FREE_SLOTS, "no free tx slots")
 
 typedef enum
 {

src/plugins/avf/output.c

@@ -31,8 +31,8 @@ avf_tx_desc_get_dtyp (avf_tx_desc_t * d)
 }
 
 static_always_inline u16
-avf_tx_enqueue (vlib_main_t * vm, avf_txq_t * txq, u32 * buffers,
-		u32 n_packets, int use_va_dma)
+avf_tx_enqueue (vlib_main_t * vm, vlib_node_runtime_t * node, avf_txq_t * txq,
+		u32 * buffers, u32 n_packets, int use_va_dma)
 {
   u16 next = txq->next;
   u64 bits = AVF_TXD_CMD_EOP | AVF_TXD_CMD_RSV;
@@ -41,6 +41,8 @@ avf_tx_enqueue (vlib_main_t * vm, avf_txq_t * txq, u32 * buffers,
   u16 mask = txq->size - 1;
   vlib_buffer_t *b[4];
   avf_tx_desc_t *d = txq->descs + next;
+  u16 n_desc_needed;
+  vlib_buffer_t *b0;
 
   /* avoid ring wrap */
   n_desc_left = txq->size - clib_max (txq->next, txq->n_enqueued + 8);
@@ -48,6 +50,7 @@ avf_tx_enqueue (vlib_main_t * vm, avf_txq_t * txq, u32 * buffers,
   if (n_desc_left == 0)
     return 0;
 
+  /* Fast path, no ring wrap */
   while (n_packets_left && n_desc_left)
     {
       u32 or_flags;
@@ -103,6 +106,57 @@ avf_tx_enqueue (vlib_main_t * vm, avf_txq_t * txq, u32 * buffers,
       txq->bufs[next] = buffers[0];
       b[0] = vlib_get_buffer (vm, buffers[0]);
 
+      /* Deal with chain buffer if present */
+      if (b[0]->flags & VLIB_BUFFER_NEXT_PRESENT)
+	{
+	  n_desc_needed = 1;
+	  b0 = b[0];
+
+	  /* Wish there were a buffer count for chain buffer */
+	  while (b0->flags & VLIB_BUFFER_NEXT_PRESENT)
+	    {
+	      b0 = vlib_get_buffer (vm, b0->next_buffer);
+	      n_desc_needed++;
+	    }
+
+	  /* spec says data descriptor is limited to 8 segments */
+	  if (PREDICT_FALSE (n_desc_needed > 8))
+	    {
+	      vlib_buffer_free_one (vm, buffers[0]);
+	      vlib_error_count (vm, node->node_index,
+				AVF_TX_ERROR_SEGMENT_SIZE_EXCEEDED, 1);
+	      n_packets_left -= 1;
+	      buffers += 1;
+	      continue;
+	    }
+
+	  if (PREDICT_FALSE (n_desc_left < n_desc_needed))
+	    /*
+	     * Slow path may be able to to deal with this since it can handle
+	     * ring wrap
+	     */
+	    break;
+
+	  while (b[0]->flags & VLIB_BUFFER_NEXT_PRESENT)
+	    {
+	      if (use_va_dma)
+		d[0].qword[0] = vlib_buffer_get_current_va (b[0]);
+	      else
+		d[0].qword[0] = vlib_buffer_get_current_pa (vm, b[0]);
+
+	      d[0].qword[1] = (((u64) b[0]->current_length) << 34) |
+		AVF_TXD_CMD_RSV;
+
+	      next += 1;
+	      n_desc += 1;
+	      n_desc_left -= 1;
+	      d += 1;
+
+	      txq->bufs[next] = b[0]->next_buffer;
+	      b[0] = vlib_get_buffer (vm, b[0]->next_buffer);
+	    }
+	}
+
       if (use_va_dma)
 	d[0].qword[0] = vlib_buffer_get_current_va (b[0]);
       else
@@ -118,6 +172,84 @@ avf_tx_enqueue (vlib_main_t * vm, avf_txq_t * txq, u32 * buffers,
       d += 1;
     }
 
+  /* Slow path to support ring wrap */
+  if (PREDICT_FALSE (n_packets_left))
+    {
+      txq->n_enqueued += n_desc;
+
+      n_desc = 0;
+      d = txq->descs + (next & mask);
+
+      /* +8 to be consistent with fast path */
+      n_desc_left = txq->size - (txq->n_enqueued + 8);
+
+      while (n_packets_left && n_desc_left)
+	{
+	  txq->bufs[next & mask] = buffers[0];
+	  b[0] = vlib_get_buffer (vm, buffers[0]);
+
+	  /* Deal with chain buffer if present */
+	  if (b[0]->flags & VLIB_BUFFER_NEXT_PRESENT)
+	    {
+	      n_desc_needed = 1;
+	      b0 = b[0];
+
+	      while (b0->flags & VLIB_BUFFER_NEXT_PRESENT)
+		{
+		  b0 = vlib_get_buffer (vm, b0->next_buffer);
+		  n_desc_needed++;
+		}
+
+	      /* Spec says data descriptor is limited to 8 segments */
+	      if (PREDICT_FALSE (n_desc_needed > 8))
+		{
+		  vlib_buffer_free_one (vm, buffers[0]);
+		  vlib_error_count (vm, node->node_index,
+				    AVF_TX_ERROR_SEGMENT_SIZE_EXCEEDED, 1);
+		  n_packets_left -= 1;
+		  buffers += 1;
+		  continue;
+		}
+
+	      if (PREDICT_FALSE (n_desc_left < n_desc_needed))
+		break;
+
+	      while (b[0]->flags & VLIB_BUFFER_NEXT_PRESENT)
+		{
+		  if (use_va_dma)
+		    d[0].qword[0] = vlib_buffer_get_current_va (b[0]);
+		  else
+		    d[0].qword[0] = vlib_buffer_get_current_pa (vm, b[0]);
+
+		  d[0].qword[1] = (((u64) b[0]->current_length) << 34) |
+		    AVF_TXD_CMD_RSV;
+
+		  next += 1;
+		  n_desc += 1;
+		  n_desc_left -= 1;
+		  d = txq->descs + (next & mask);
+
+		  txq->bufs[next & mask] = b[0]->next_buffer;
+		  b[0] = vlib_get_buffer (vm, b[0]->next_buffer);
+		}
+	    }
+
+	  if (use_va_dma)
+	    d[0].qword[0] = vlib_buffer_get_current_va (b[0]);
+	  else
+	    d[0].qword[0] = vlib_buffer_get_current_pa (vm, b[0]);
+
+	  d[0].qword[1] = (((u64) b[0]->current_length) << 34) | bits;
+
+	  next += 1;
+	  n_desc += 1;
+	  buffers += 1;
+	  n_packets_left -= 1;
+	  n_desc_left -= 1;
+	  d = txq->descs + (next & mask);
+	}
+    }
+
   if ((slot = clib_ring_enq (txq->rs_slots)))
     {
       u16 rs_slot = slot[0] = (next - 1) & mask;
@@ -177,15 +309,15 @@ retry:
 	  n_free = (complete_slot + 1 - first) & mask;
 
 	  txq->n_enqueued -= n_free;
-	  vlib_buffer_free_from_ring (vm, txq->bufs, first, txq->size,
-				      n_free);
+	  vlib_buffer_free_from_ring_no_next (vm, txq->bufs, first, txq->size,
+					      n_free);
 	}
     }
 
   if (ad->flags & AVF_DEVICE_F_VA_DMA)
-    n_enq = avf_tx_enqueue (vm, txq, buffers, n_left, 1);
+    n_enq = avf_tx_enqueue (vm, node, txq, buffers, n_left, 1);
   else
-    n_enq = avf_tx_enqueue (vm, txq, buffers, n_left, 0);
+    n_enq = avf_tx_enqueue (vm, node, txq, buffers, n_left, 0);
 
   n_left -= n_enq;
 

src/plugins/crypto_openssl/main.c

@@ -72,7 +72,8 @@ openssl_ops_enc_cbc (vlib_main_t * vm, vnet_crypto_op_t * ops[], u32 n_ops,
       int out_len;
       int iv_len;
 
-      if (op->op == VNET_CRYPTO_OP_3DES_CBC_ENC)
+      if (op->op == VNET_CRYPTO_OP_3DES_CBC_ENC
+	  || op->op == VNET_CRYPTO_OP_DES_CBC_ENC)
 	iv_len = 8;
       else
 	iv_len = 16;

src/plugins/dhcp/client.c

@@ -122,9 +122,7 @@ format_dhcp_client (u8 * s, va_list * va)
       s =
 	format (s, "\n retry-count:%d, next-xmt:%.2f", c->retry_count,
 		c->next_transmit);
-      s =
-	format (s, "\n adjacencies:[unicast:%d broadcast:%d]", c->ai_ucast,
-		c->ai_bcast);
+      s = format (s, "\n broadcast adjacency:%d", c->ai_bcast);
     }
   return s;
 }
@@ -165,15 +163,6 @@ dhcp_client_acquire_address (dhcp_client_main_t * dcm, dhcp_client_t * c)
               FIB_ROUTE_PATH_FLAG_NONE);
           /* *INDENT-ON* */
 	}
-      if (c->learned.dhcp_server.as_u32)
-	{
-	  ip46_address_t dst = {
-	    .ip4 = c->learned.dhcp_server,
-	  };
-	  c->ai_ucast = adj_nbr_add_or_lock (FIB_PROTOCOL_IP4,
-					     VNET_LINK_IP4, &dst,
-					     c->sw_if_index);
-	}
     }
   clib_memcpy (&c->installed, &c->learned, sizeof (c->installed));
   c->addresses_installed = 1;
@@ -210,8 +199,6 @@ dhcp_client_release_address (dhcp_client_main_t * dcm, dhcp_client_t * c)
 				       DPO_PROTO_IP4, &nh, c->sw_if_index, ~0,
 				       1, FIB_ROUTE_PATH_FLAG_NONE);
 	}
-      adj_unlock (c->ai_ucast);
-      c->ai_ucast = ADJ_INDEX_INVALID;
     }
   clib_memset (&c->installed, 0, sizeof (c->installed));
   c->addresses_installed = 0;
@@ -253,7 +240,7 @@ dhcp_client_addr_callback (u32 * cindex)
   if (c->event_callback)
     c->event_callback (c->client_index, c);
 
-  DHCP_INFO ("update: %U", format_dhcp_client, dcm, c);
+  DHCP_INFO ("update: %U", format_dhcp_client, dcm, c, 1 /* verbose */ );
 }
 
 static void
@@ -492,7 +479,7 @@ send_dhcp_pkt (dhcp_client_main_t * dcm, dhcp_client_t * c,
 
   DHCP_INFO ("send: type:%U bcast:%d %U",
 	     format_dhcp_packet_type, type,
-	     is_broadcast, format_dhcp_client, dcm, c);
+	     is_broadcast, format_dhcp_client, dcm, c, 1 /* verbose */ );
 
   /* Interface(s) down? */
   if ((hw->flags & VNET_HW_INTERFACE_FLAG_LINK_UP) == 0)
@@ -518,24 +505,13 @@ send_dhcp_pkt (dhcp_client_main_t * dcm, dhcp_client_t * c,
   vnet_buffer (b)->sw_if_index[VLIB_RX] = c->sw_if_index;
   b->flags |= VNET_BUFFER_F_LOCALLY_ORIGINATED;
 
-  if (ADJ_INDEX_INVALID == c->ai_ucast)
-    is_broadcast = 1;
-
   if (is_broadcast)
     {
       node_index = ip4_rewrite_node.index;
       vnet_buffer (b)->ip.adj_index[VLIB_TX] = c->ai_bcast;
     }
   else
-    {
-      ip_adjacency_t *adj = adj_get (c->ai_ucast);
-
-      if (IP_LOOKUP_NEXT_ARP == adj->lookup_next_index)
-	node_index = ip4_arp_node.index;
-      else
-	node_index = ip4_rewrite_node.index;
-      vnet_buffer (b)->ip.adj_index[VLIB_TX] = c->ai_ucast;
-    }
+    node_index = dcm->ip4_lookup_node_index;
 
   /* Enqueue the packet right now */
   f = vlib_get_frame_to_node (vm, node_index);
@@ -717,8 +693,6 @@ dhcp_discover_state (dhcp_client_main_t * dcm, dhcp_client_t * c, f64 now)
    * State machine "DISCOVER" state. Send a dhcp discover packet,
    * eventually back off the retry rate.
    */
-  DHCP_INFO ("enter discover: %U", format_dhcp_client, dcm, c);
-
   /*
    * In order to accept any OFFER, whether broadcasted or unicasted, we
    * need to configure the dhcp-client-detect feature as an input feature
@@ -753,7 +727,8 @@ dhcp_request_state (dhcp_client_main_t * dcm, dhcp_client_t * c, f64 now)
    * State machine "REQUEST" state. Send a dhcp request packet,
    * eventually drop back to the discover state.
    */
-  DHCP_INFO ("enter request: %U", format_dhcp_client, dcm, c);
+  DHCP_INFO ("enter request: %U", format_dhcp_client, dcm, c,
+	     1 /*verbose */ );
 
   send_dhcp_pkt (dcm, c, DHCP_PACKET_REQUEST, 1 /* is_broadcast */ );
 
@@ -793,7 +768,8 @@ dhcp_bound_state (dhcp_client_main_t * dcm, dhcp_client_t * c, f64 now)
    */
   if (now > c->lease_expires)
     {
-      DHCP_INFO ("lease expired: %U", format_dhcp_client, dcm, c);
+      DHCP_INFO ("lease expired: %U", format_dhcp_client, dcm, c,
+		 1 /*verbose */ );
 
       /* reset all data for the client. do not send any more messages
        * since the objects to do so have been lost */
@@ -801,7 +777,7 @@ dhcp_bound_state (dhcp_client_main_t * dcm, dhcp_client_t * c, f64 now)
       return 1;
     }
 
-  DHCP_INFO ("enter bound: %U", format_dhcp_client, dcm, c);
+  DHCP_INFO ("enter bound: %U", format_dhcp_client, dcm, c, 1 /* verbose */ );
   send_dhcp_pkt (dcm, c, DHCP_PACKET_REQUEST, 0 /* is_broadcast */ );
 
   c->retry_count++;
@@ -827,7 +803,9 @@ dhcp_client_sm (f64 now, f64 timeout, uword pool_index)
 
   /* Time for us to do something with this client? */
   if (now < c->next_transmit)
-    return timeout;
+    return c->next_transmit;
+
+  DHCP_INFO ("sm active session %d", c - dcm->clients);
 
 again:
   switch (c->state)
@@ -853,17 +831,15 @@ again:
       break;
     }
 
-  if (c->next_transmit < now + timeout)
-    return c->next_transmit - now;
-
-  return timeout;
+  return c->next_transmit;
 }
 
 static uword
 dhcp_client_process (vlib_main_t * vm,
 		     vlib_node_runtime_t * rt, vlib_frame_t * f)
 {
-  f64 timeout = 100.0;
+  f64 timeout = 1000.0;
+  f64 next_expire_time, this_next_expire_time;
   f64 now;
   uword event_type;
   uword *event_data = 0;
@@ -883,20 +859,32 @@ dhcp_client_process (vlib_main_t * vm,
 	{
 	case EVENT_DHCP_CLIENT_WAKEUP:
 	  for (i = 0; i < vec_len (event_data); i++)
-	    timeout = dhcp_client_sm (now, timeout, event_data[i]);
-	  break;
+	    (void) dhcp_client_sm (now, timeout, event_data[i]);
+	  /* FALLTHROUGH */
 
 	case ~0:
-          /* *INDENT-OFF* */
-          DHCP_INFO ("timeout");
-	  pool_foreach (c, dcm->clients,
-          ({
-            timeout = dhcp_client_sm (now, timeout,
-                                      (uword) (c - dcm->clients));
-          }));
-          /* *INDENT-ON* */
-	  if (pool_elts (dcm->clients) == 0)
-	    timeout = 100.0;
+	  if (pool_elts (dcm->clients))
+	    {
+              /* *INDENT-OFF* */
+              next_expire_time = 1e70;
+              pool_foreach (c, dcm->clients,
+              ({
+                this_next_expire_time = dhcp_client_sm
+                  (now, timeout, (uword) (c - dcm->clients));
+                next_expire_time = this_next_expire_time < next_expire_time ?
+                  this_next_expire_time : next_expire_time;
+              }));
+              if (next_expire_time > now)
+                timeout = next_expire_time - now;
+              else
+                {
+                  clib_warning ("BUG");
+                  timeout = 1.13;
+                }
+              /* *INDENT-ON* */
+	    }
+	  else
+	    timeout = 1000.0;
 	  break;
 	}
 
@@ -999,7 +987,6 @@ dhcp_client_add_del (dhcp_client_add_del_args_t * a)
       c->client_identifier = a->client_identifier;
       c->set_broadcast_flag = a->set_broadcast_flag;
       c->dscp = a->dscp;
-      c->ai_ucast = ADJ_INDEX_INVALID;
       c->ai_bcast = adj_nbr_add_or_lock (FIB_PROTOCOL_IP4,
 					 VNET_LINK_IP4,
 					 &ADJ_BCAST_ADDR, c->sw_if_index);
@@ -1015,7 +1002,7 @@ dhcp_client_add_del (dhcp_client_add_del_args_t * a)
       vlib_process_signal_event (vm, dhcp_client_process_node.index,
 				 EVENT_DHCP_CLIENT_WAKEUP, c - dcm->clients);
 
-      DHCP_INFO ("create: %U", format_dhcp_client, dcm, c);
+      DHCP_INFO ("create: %U", format_dhcp_client, dcm, c, 1 /* verbose */ );
     }
   else
     {
@@ -1249,7 +1236,15 @@ static clib_error_t *
 dhcp_client_init (vlib_main_t * vm)
 {
   dhcp_client_main_t *dcm = &dhcp_client_main;
+  vlib_node_t *ip4_lookup_node;
 
+  ip4_lookup_node = vlib_get_node_by_name (vm, (u8 *) "ip4-lookup");
+
+  /* Should never happen... */
+  if (ip4_lookup_node == 0)
+    return clib_error_return (0, "ip4-lookup node not found");
+
+  dcm->ip4_lookup_node_index = ip4_lookup_node->index;
   dcm->vlib_main = vm;
   dcm->vnet_main = vnet_get_main ();
   dcm->seed = (u32) clib_cpu_time_now ();

src/plugins/dhcp/client.h

@@ -108,8 +108,6 @@ typedef struct dhcp_client_t_
   u8 client_hardware_address[6];
   u8 client_detect_feature_enabled;
 
-  /* the unicast adjacency for the DHCP server */
-  adj_index_t ai_ucast;
   /* the broadcast adjacency on the link */
   adj_index_t ai_bcast;
   /* IP DSCP to set in sent packets */
@@ -125,6 +123,9 @@ typedef struct
   uword *client_by_sw_if_index;
   u32 seed;
 
+  /* ip4-lookup node index */
+  u32 ip4_lookup_node_index;
+
   /* convenience */
   vlib_main_t *vlib_main;
   vnet_main_t *vnet_main;

src/plugins/dhcp/dhcp4_proxy_error.def

@@ -30,4 +30,4 @@ dhcp_proxy_error (BAD_YIADDR, "DHCP packets with bad your_ip_address fields")
 dhcp_proxy_error (BAD_SVR_FIB_OR_ADDRESS, "DHCP packets not from DHCP server or server FIB.")
 dhcp_proxy_error (PKT_TOO_BIG, "DHCP packets which are too big.")
 dhcp_proxy_error (FOR_US, "DHCP packets for local client.")
-
+dhcp_proxy_error (ALLOC_FAIL, "DHCP buffer allocation failures.")

src/plugins/dhcp/dhcp4_proxy_node.c

@@ -364,6 +364,13 @@ dhcp_proxy_to_server_input (vlib_main_t * vm,
 		  u32 ci0;
 
 		  c0 = vlib_buffer_copy (vm, b0);
+		  if (c0 == NULL)
+		    {
+		      vlib_node_increment_counter
+			(vm, dhcp_proxy_to_server_node.index,
+			 DHCP_PROXY_ERROR_ALLOC_FAIL, 1);
+		      continue;
+		    }
 		  VLIB_BUFFER_TRACE_TRAJECTORY_INIT (c0);
 		  ci0 = vlib_get_buffer_index (vm, c0);
 		  server = &proxy->dhcp_servers[ii];

src/plugins/dhcp/dhcp6_ia_na_client_dp.c

@@ -258,6 +258,9 @@ check_send_client_message (vlib_main_t * vm,
   next_index = ip6_rewrite_mcast_node.index;
 
   c0 = vlib_buffer_copy (vm, p0);
+  if (c0 == NULL)
+    return client_state->keep_sending_client_message;
+
   ci0 = vlib_get_buffer_index (vm, c0);
 
   ip = (ip6_header_t *) vlib_buffer_get_current (c0);

src/plugins/dhcp/dhcp6_pd_client_cp.c

@@ -70,6 +70,8 @@ typedef struct
 {
   prefix_info_t *prefix_pool;
   const u8 **prefix_group_name_by_index;
+  /* vector of active prefix pool indicies, prep-H for pool_foreach(..) */
+  u32 *indices;
 } ip6_prefix_main_t;
 
 static ip6_prefix_main_t ip6_prefix_main;
@@ -277,6 +279,7 @@ dhcp6_pd_reply_event_handler (vl_api_dhcp6_pd_reply_event_t * mp)
   f64 current_time;
   clib_error_t *error = 0;
   u32 i;
+  prefix_info_t *prefix_info;
 
   current_time = vlib_time_now (vm);
 
@@ -363,13 +366,26 @@ dhcp6_pd_reply_event_handler (vl_api_dhcp6_pd_reply_event_t * mp)
   send_client_message_start_stop (sw_if_index, server_index,
 				  mp->msg_type, 0, 0);
 
+  vec_reset_length (pm->indices);
+  /*
+   * We're going to loop through the pool multiple times,
+   * so collect active indices.
+   */
+  /* *INDENT-OFF* */
+  pool_foreach (prefix_info, pm->prefix_pool,
+  ({
+    vec_add1 (pm->indices, prefix_info - pm->prefix_pool);
+  }));
+  /* *INDENT-ON* */
+
   for (i = 0; i < n_prefixes; i++)
     {
-      prefix_info_t *prefix_info = 0;
       u8 prefix_length;
       u32 valid_time;
       u32 preferred_time;
+      int j;
 
+      prefix_info = 0;
       api_prefix = &mp->prefixes[i];
 
       prefix = (ip6_address_t *) api_prefix->prefix.address;
@@ -386,32 +402,40 @@ dhcp6_pd_reply_event_handler (vl_api_dhcp6_pd_reply_event_t * mp)
 	continue;
 
       u8 address_prefix_present = 0;
-      /* *INDENT-OFF* */
-      pool_foreach (prefix_info, pm->prefix_pool,
-      ({
-        if (is_dhcpv6_pd_prefix (prefix_info) &&
-            prefix_info->opaque_data == sw_if_index &&
-            prefix_info->prefix_length == prefix_length &&
-            ip6_prefixes_equal (&prefix_info->prefix, prefix, prefix_length))
-          {
-            address_prefix_present = 1;
-            goto prefix_pool_foreach_out;
-          }
-      }));
-      /* *INDENT-ON* */
-    prefix_pool_foreach_out:
+
+      /* Look for a matching prefix_info */
+      for (j = 0; j < vec_len (pm->indices); j++)
+	{
+	  prefix_info = pool_elt_at_index (pm->prefix_pool, pm->indices[j]);
+
+	  if (is_dhcpv6_pd_prefix (prefix_info) &&
+	      prefix_info->opaque_data == sw_if_index &&
+	      prefix_info->prefix_length == prefix_length &&
+	      ip6_prefixes_equal (&prefix_info->prefix, prefix,
+				  prefix_length))
+	    {
+	      address_prefix_present = 1;
+	      break;
+	    }
+	}
 
       if (address_prefix_present)
 	{
+	  /* Found the (primary) prefix, update prefix timers */
+	  prefix_info->preferred_lt = preferred_time;
+	  prefix_info->valid_lt = valid_time;
+	  prefix_info->due_time = current_time + valid_time;
+	  if (prefix_info->due_time > rm->max_valid_due_time)
+	    rm->max_valid_due_time = prefix_info->due_time;
+
 	  /*
-	   * We found the prefix. Move along.
-	   * Don't touch the prefix timers!
-	   * If we happen to receive a renew reply just before we
-	   * would have sent a solicit to renew the prefix delegation,
-	   * we forget to renew the delegation. Worse luck, we start
-	   * sending router advertisements with a valid time of zero,
-	   * and the wheels fall off...
+	   * Tell the RA code to update any secondary per-interface
+	   * timers that it might be hoarding.
 	   */
+	  ip6_ra_update_secondary_radv_info
+	    (prefix, prefix_length,
+	     prefix_info->opaque_data /* sw_if_index */ ,
+	     valid_time, preferred_time);
 	  continue;
 	}
 
@@ -419,6 +443,7 @@ dhcp6_pd_reply_event_handler (vl_api_dhcp6_pd_reply_event_t * mp)
 	continue;
 
       pool_get (pm->prefix_pool, prefix_info);
+      vec_add1 (pm->indices, prefix_info - pm->prefix_pool);
       prefix_info->prefix_group_index = client_state->prefix_group_index;
       set_is_dhcpv6_pd_prefix (prefix_info, 1);
       prefix_info->opaque_data = sw_if_index;

src/plugins/dhcp/dhcp6_pd_client_dp.c

@@ -264,6 +264,9 @@ check_pd_send_client_message (vlib_main_t * vm,
   next_index = ip6_rewrite_mcast_node.index;
 
   c0 = vlib_buffer_copy (vm, p0);
+  if (c0 == NULL)
+    return client_state->keep_sending_client_message;
+
   ci0 = vlib_get_buffer_index (vm, c0);
 
   ip = (ip6_header_t *) vlib_buffer_get_current (c0);

src/plugins/dhcp/dhcp6_proxy_error.def

@@ -27,3 +27,4 @@ dhcpv6_proxy_error (NO_RELAY_MESSAGE_OPTION, "DHCPv6 reply packets without relay
 dhcpv6_proxy_error (BAD_SVR_FIB_OR_ADDRESS, "DHCPv6 packets not from DHCPv6 server or server FIB.")
 dhcpv6_proxy_error (PKT_TOO_BIG, "DHCPv6 packets which are too big.")
 dhcpv6_proxy_error (WRONG_INTERFACE_ID_OPTION, "DHCPv6 reply to invalid interface.")
+dhcpv6_proxy_error (ALLOC_FAIL, "DHCPv6 buffer allocation failures.")

src/plugins/dhcp/dhcp6_proxy_node.c

@@ -437,6 +437,13 @@ dhcpv6_proxy_to_server_input (vlib_main_t * vm,
 		  u32 ci0;
 
 		  c0 = vlib_buffer_copy (vm, b0);
+		  if (c0 == NULL)
+		    {
+		      vlib_node_increment_counter
+			(vm, dhcpv6_proxy_to_server_node.index,
+			 DHCPV6_PROXY_ERROR_ALLOC_FAIL, 1);
+		      continue;
+		    }
 		  VLIB_BUFFER_TRACE_TRAJECTORY_INIT (c0);
 		  ci0 = vlib_get_buffer_index (vm, c0);
 		  server = &proxy->dhcp_servers[ii];

src/plugins/dpdk/device/init.c

@@ -199,6 +199,15 @@ check_l3cache ()
   return 0;
 }
 
+static void
+dpdk_enable_l4_csum_offload (dpdk_device_t * xd)
+{
+  xd->port_conf.txmode.offloads |= DEV_TX_OFFLOAD_TCP_CKSUM;
+  xd->port_conf.txmode.offloads |= DEV_TX_OFFLOAD_UDP_CKSUM;
+  xd->flags |= DPDK_DEVICE_FLAG_TX_OFFLOAD |
+    DPDK_DEVICE_FLAG_INTEL_PHDR_CKSUM;
+}
+
 static clib_error_t *
 dpdk_lib_init (dpdk_main_t * dm)
 {
@@ -496,6 +505,8 @@ dpdk_lib_init (dpdk_main_t * dm)
 	      /* Cisco VIC */
 	    case VNET_DPDK_PMD_ENIC:
 	      xd->port_type = port_type_from_link_speed (l.link_speed);
+	      if (dm->conf->enable_tcp_udp_checksum)
+		dpdk_enable_l4_csum_offload (xd);
 	      break;
 
 	      /* Intel Red Rock Canyon */

src/plugins/dpdk/ipsec/esp_decrypt.c

@@ -256,7 +256,10 @@ dpdk_esp_decrypt_inline (vlib_main_t * vm,
 	  if (is_ip6)
 	    priv->next = DPDK_CRYPTO_INPUT_NEXT_DECRYPT6_POST;
 	  else
-	    priv->next = DPDK_CRYPTO_INPUT_NEXT_DECRYPT4_POST;
+	    {
+	      priv->next = DPDK_CRYPTO_INPUT_NEXT_DECRYPT4_POST;
+	      b0->flags |= VNET_BUFFER_F_IS_IP4;
+	    }
 
 	  /* FIXME multi-seg */
 	  vlib_increment_combined_counter

src/plugins/dpdk/ipsec/esp_encrypt.c

@@ -66,6 +66,8 @@ static char *esp_encrypt_error_strings[] = {
 
 extern vlib_node_registration_t dpdk_esp4_encrypt_node;
 extern vlib_node_registration_t dpdk_esp6_encrypt_node;
+extern vlib_node_registration_t dpdk_esp4_encrypt_tun_node;
+extern vlib_node_registration_t dpdk_esp6_encrypt_tun_node;
 
 typedef struct
 {
@@ -411,8 +413,16 @@ dpdk_esp_encrypt_inline (vlib_main_t * vm,
 	    }
 	  else			/* transport mode */
 	    {
-	      priv->next = DPDK_CRYPTO_INPUT_NEXT_INTERFACE_OUTPUT;
-	      rewrite_len = vnet_buffer (b0)->ip.save_rewrite_length;
+	      if (is_tun)
+		{
+		  rewrite_len = 0;
+		  priv->next = DPDK_CRYPTO_INPUT_NEXT_MIDCHAIN;
+		}
+	      else
+		{
+		  priv->next = DPDK_CRYPTO_INPUT_NEXT_INTERFACE_OUTPUT;
+		  rewrite_len = vnet_buffer (b0)->ip.save_rewrite_length;
+		}
 	      u16 adv = sizeof (esp_header_t) + iv_size + udp_encap_adv;
 	      vlib_buffer_advance (b0, -adv - rewrite_len);
 	      u8 *src = ((u8 *) ih0) - rewrite_len;
@@ -576,7 +586,10 @@ dpdk_esp_encrypt_inline (vlib_main_t * vm,
     }
   if (is_ip6)
     {
-      vlib_node_increment_counter (vm, dpdk_esp6_encrypt_node.index,
+      vlib_node_increment_counter (vm,
+				   (is_tun ?
+				    dpdk_esp6_encrypt_tun_node.index :
+				    dpdk_esp6_encrypt_node.index),
 				   ESP_ENCRYPT_ERROR_RX_PKTS,
 				   from_frame->n_vectors);
 
@@ -585,7 +598,10 @@ dpdk_esp_encrypt_inline (vlib_main_t * vm,
     }
   else
     {
-      vlib_node_increment_counter (vm, dpdk_esp4_encrypt_node.index,
+      vlib_node_increment_counter (vm,
+				   (is_tun ?
+				    dpdk_esp4_encrypt_tun_node.index :
+				    dpdk_esp4_encrypt_node.index),
 				   ESP_ENCRYPT_ERROR_RX_PKTS,
 				   from_frame->n_vectors);
 

src/plugins/dpdk/ipsec/ipsec.c

@@ -1049,9 +1049,11 @@ dpdk_ipsec_process (vlib_main_t * vm, vlib_node_runtime_t * rt,
 					"dpdk-esp4-encrypt",
 					"dpdk-esp4-encrypt-tun",
 					"dpdk-esp4-decrypt",
+					"dpdk-esp4-decrypt",
 					"dpdk-esp6-encrypt",
 					"dpdk-esp6-encrypt-tun",
 					"dpdk-esp6-decrypt",
+					"dpdk-esp6-decrypt",
 					dpdk_ipsec_check_support,
 					add_del_sa_session);
   int rv = ipsec_select_esp_backend (im, idx);

src/plugins/dpdk/ipsec/ipsec.h

@@ -38,6 +38,7 @@
   _(IP4_LOOKUP, "ip4-lookup")                   \
   _(IP6_LOOKUP, "ip6-lookup")                   \
   _(INTERFACE_OUTPUT, "interface-output")	\
+  _(MIDCHAIN, "adj-midchain-tx")                 \
   _(DECRYPT4_POST, "dpdk-esp4-decrypt-post")     \
   _(DECRYPT6_POST, "dpdk-esp6-decrypt-post")
 

src/plugins/gtpu/test/test_gtpu.py

@@ -187,7 +187,7 @@ class TestGtpu(BridgeDomain, VppTestCase):
         # Pick first received frame and check if it's correctly encapsulated.
         out = self.pg0.get_capture(1)
         pkt = out[0]
-        self.check_encapsulation(pkt, self.single_tunnel_bd)
+        self.check_encapsulation(pkt, self.single_tunnel_vni)
 
         # payload = self.decapsulate(pkt)
         # self.assert_eq_pkts(payload, self.frame_reply)
@@ -343,13 +343,14 @@ class TestGtpu(BridgeDomain, VppTestCase):
             # Create GTPU VTEP on VPP pg0, and put gtpu_tunnel0 and pg1
             #  into BD.
             cls.single_tunnel_bd = 11
+            cls.single_tunnel_vni = 11
             r = cls.vapi.gtpu_add_del_tunnel(
                 is_add=True,
                 mcast_sw_if_index=0xFFFFFFFF,
                 decap_next_index=0xFFFFFFFF,
                 src_address=cls.pg0.local_ip4,
                 dst_address=cls.pg0.remote_ip4,
-                teid=cls.single_tunnel_bd)
+                teid=cls.single_tunnel_vni)
             cls.vapi.sw_interface_set_l2_bridge(rx_sw_if_index=r.sw_if_index,
                                                 bd_id=cls.single_tunnel_bd)
             cls.vapi.sw_interface_set_l2_bridge(

src/plugins/hs_apps/proxy.c

@@ -69,13 +69,12 @@ delete_proxy_session (session_t * s, int is_active_open)
   uword *p;
   u64 handle;
 
+  clib_spinlock_lock_if_init (&pm->sessions_lock);
+
   handle = session_handle (s);
 
-  clib_spinlock_lock_if_init (&pm->sessions_lock);
   if (is_active_open)
     {
-      active_open_session = s;
-
       p = hash_get (pm->proxy_session_by_active_open_handle, handle);
       if (p == 0)
 	{
@@ -85,17 +84,14 @@ delete_proxy_session (session_t * s, int is_active_open)
 	}
       else if (!pool_is_free_index (pm->sessions, p[0]))
 	{
+	  active_open_session = s;
 	  ps = pool_elt_at_index (pm->sessions, p[0]);
 	  if (ps->vpp_server_handle != ~0)
 	    server_session = session_get_from_handle (ps->vpp_server_handle);
-	  else
-	    server_session = 0;
 	}
     }
   else
     {
-      server_session = s;
-
       p = hash_get (pm->proxy_session_by_server_handle, handle);
       if (p == 0)
 	{
@@ -105,12 +101,11 @@ delete_proxy_session (session_t * s, int is_active_open)
 	}
       else if (!pool_is_free_index (pm->sessions, p[0]))
 	{
+	  server_session = s;
 	  ps = pool_elt_at_index (pm->sessions, p[0]);
 	  if (ps->vpp_active_open_handle != ~0)
 	    active_open_session = session_get_from_handle
 	      (ps->vpp_active_open_handle);
-	  else
-	    active_open_session = 0;
 	}
     }
 
@@ -121,8 +116,6 @@ delete_proxy_session (session_t * s, int is_active_open)
       pool_put (pm->sessions, ps);
     }
 
-  clib_spinlock_unlock_if_init (&pm->sessions_lock);
-
   if (active_open_session)
     {
       a->handle = session_handle (active_open_session);
@@ -140,6 +133,8 @@ delete_proxy_session (session_t * s, int is_active_open)
 		  session_handle (server_session));
       vnet_disconnect_session (a);
     }
+
+  clib_spinlock_unlock_if_init (&pm->sessions_lock);
 }
 
 static int
@@ -232,6 +227,7 @@ proxy_rx_callback (session_t * s)
       if (PREDICT_FALSE (max_dequeue == 0))
 	return 0;
 
+      max_dequeue = clib_min (pm->rcv_buffer_size, max_dequeue);
       actual_transfer = svm_fifo_peek (rx_fifo, 0 /* relative_offset */ ,
 				       max_dequeue, pm->rx_buf[thread_index]);
 
@@ -239,7 +235,6 @@ proxy_rx_callback (session_t * s)
 
       clib_memset (a, 0, sizeof (*a));
 
-      clib_spinlock_lock_if_init (&pm->sessions_lock);
       pool_get (pm->sessions, ps);
       clib_memset (ps, 0, sizeof (*ps));
       ps->server_rx_fifo = rx_fifo;
@@ -376,22 +371,6 @@ static session_cb_vft_t active_open_clients = {
 };
 /* *INDENT-ON* */
 
-
-static void
-create_api_loopbacks (vlib_main_t * vm)
-{
-  proxy_main_t *pm = &proxy_main;
-  api_main_t *am = vlibapi_get_main ();
-  vl_shmem_hdr_t *shmem_hdr;
-
-  shmem_hdr = am->shmem_hdr;
-  pm->vl_input_queue = shmem_hdr->vl_input_queue;
-  pm->server_client_index =
-    vl_api_memclnt_create_internal ("proxy_server", pm->vl_input_queue);
-  pm->active_open_client_index =
-    vl_api_memclnt_create_internal ("proxy_active_open", pm->vl_input_queue);
-}
-
 static int
 proxy_server_attach ()
 {
@@ -405,6 +384,7 @@ proxy_server_attach ()
 
   if (pm->private_segment_size)
     segment_size = pm->private_segment_size;
+  a->name = format (0, "proxy-server");
   a->api_client_index = pm->server_client_index;
   a->session_cb_vft = &proxy_session_cb_vft;
   a->options = options;
@@ -424,6 +404,7 @@ proxy_server_attach ()
     }
   pm->server_app_index = a->app_index;
 
+  vec_free (a->name);
   return 0;
 }
 
@@ -439,6 +420,7 @@ active_open_attach (void)
 
   a->api_client_index = pm->active_open_client_index;
   a->session_cb_vft = &active_open_clients;
+  a->name = format (0, "proxy-active-open");
 
   options[APP_OPTIONS_ACCEPT_COOKIE] = 0x12345678;
   options[APP_OPTIONS_SEGMENT_SIZE] = 512 << 20;
@@ -458,6 +440,8 @@ active_open_attach (void)
 
   pm->active_open_app_index = a->app_index;
 
+  vec_free (a->name);
+
   return 0;
 }
 
@@ -480,9 +464,6 @@ proxy_server_create (vlib_main_t * vm)
   u32 num_threads;
   int i;
 
-  if (pm->server_client_index == (u32) ~ 0)
-    create_api_loopbacks (vm);
-
   num_threads = 1 /* main thread */  + vtm->n_threads;
   vec_validate (proxy_main.server_event_queue, num_threads - 1);
   vec_validate (proxy_main.active_open_event_queue, num_threads - 1);
@@ -535,6 +516,7 @@ proxy_server_create_command_fn (vlib_main_t * vm, unformat_input_t * input,
   pm->private_segment_count = 0;
   pm->private_segment_size = 0;
   pm->server_uri = 0;
+  pm->client_uri = 0;
 
   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
     {
@@ -556,9 +538,9 @@ proxy_server_create_command_fn (vlib_main_t * vm, unformat_input_t * input,
 	  pm->private_segment_size = tmp;
 	}
       else if (unformat (input, "server-uri %s", &pm->server_uri))
-	;
+	vec_add1 (pm->server_uri, 0);
       else if (unformat (input, "client-uri %s", &pm->client_uri))
-	pm->client_uri = format (0, "%s%c", pm->client_uri, 0);
+	vec_add1 (pm->client_uri, 0);
       else
 	return clib_error_return (0, "unknown input `%U'",
 				  format_unformat_error, input);

src/plugins/ioam/encap/ip6_ioam_trace.c

@@ -222,14 +222,16 @@ ip6_hbh_ioam_loopback_handler (vlib_buffer_t * b, ip6_header_t * ip,
   ioam_trace_option_t *opt;
   udp_ping_t *udp;
 
+  b0 = vlib_buffer_copy (hm->vlib_main, b);
+  if (b0 == NULL)
+    return;
+
+  buf_index = vlib_get_buffer_index (hm->vlib_main, b0);
   next_node = vlib_get_node_by_name (hm->vlib_main, (u8 *) "ip6-lookup");
   nf = vlib_get_frame_to_node (hm->vlib_main, next_node->index);
   nf->n_vectors = 0;
   to_next = vlib_frame_vector_args (nf);
 
-  b0 = vlib_buffer_copy (hm->vlib_main, b);
-  buf_index = vlib_get_buffer_index (hm->vlib_main, b0);
-
   vnet_buffer (b0)->sw_if_index[VLIB_RX] = 0;
   vnet_buffer (b0)->sw_if_index[VLIB_TX] = ~0;
 

src/plugins/nat/nat.c

@@ -3928,8 +3928,8 @@ snat_config (vlib_main_t * vm, unformat_input_t * input)
 	  sm->worker_in2out_cb = snat_get_worker_in2out_cb;
 	  sm->worker_out2in_cb = snat_get_worker_out2in_cb;
 
-	  sm->handoff_out2in_index = snat_in2out_node.index;
-	  sm->handoff_in2out_index = snat_out2in_node.index;
+	  sm->handoff_out2in_index = snat_out2in_node.index;
+	  sm->handoff_in2out_index = snat_in2out_node.index;
 	  sm->handoff_in2out_output_index = snat_in2out_output_node.index;
 
 	  sm->in2out_node_index = snat_in2out_node.index;