Benoît Ganne 474f0ba2ab ipsec: fix AES CBC IV generation (CVE-2022-46397) ...

For AES-CBC, the IV must be unpredictable (see NIST SP800-38a Appendix
C). Chaining IVs like is done by ipsecmb and native backends for the
VNET_CRYPTO_OP_FLAG_INIT_IV is fully predictable.
Encrypt a counter as part of the message, making the (predictable)
counter-generated IV unpredictable.

Fixes: VPP-2037
Type: fix

Change-Id: If4f192d62bf97dda553e7573331c75efa11822ae
Signed-off-by: Benoît Ganne <bganne@cisco.com>

2023-02-03 21:04:11 -05:00

..

cmake

build: set OS_ID_LIKE only if unset

2022-09-01 12:53:15 +00:00

examples

vppinfra: make _vec_len() read-only

2022-04-04 23:17:13 +00:00

pkg

tls: remove pkg dependencies on mbedtls

2022-03-11 19:04:46 +00:00

plugins

dpdk: link DPDK with MLX4/MLX5 libraries again

2022-12-21 19:55:00 +00:00

scripts

vlib: exec cli line-by-line processing and script updates

2022-05-16 01:31:54 +00:00

svm

vcl: add hugepage for vcl configure and svm

2022-09-15 23:15:26 +00:00

tools

vppapigen: make json in parallel

2022-08-05 08:33:10 +00:00

vat

ip: unformat_ip_address should no modify its argument on failure

2022-06-01 08:15:07 +00:00

vat2

vat2: fix argument parsing

2022-05-05 05:34:19 +00:00

vcl

vcl: repatch "align the RST behaviour with kernel"

2022-09-27 06:09:28 +00:00

vlib

vlib: Counter free needs to NULL the allocated counter vector

2022-10-17 05:44:34 +00:00

vlibapi

vlib: fix coverity 274744

2022-08-17 15:35:17 +00:00

vlibmemory

vlib: fix coverity 274750, part 2

2022-08-30 14:11:30 +00:00

vnet

ipsec: fix AES CBC IV generation (CVE-2022-46397)

2023-02-03 21:04:11 -05:00

vpp

vlib: introduce DMA infrastructure

2022-08-25 19:05:40 +00:00

vpp-api

vapi: use the correct my_context_id when disconnecting API clients

2022-12-20 12:09:26 +00:00

vppinfra

vppinfra: fix incorrect sizeof() argument due to typo

2022-10-24 13:21:54 +00:00

CMakeLists.txt

build: disable gcc warning stringop-overflow for gcc-10 or greater

2022-08-25 17:47:35 -04:00