diff options
| author |   Chris Luke <chrisy@flirble.org> | 2017-09-07 07:40:13 -0400 |
|---|---|---|
| committer |   Dave Wallace <dwallacelf@gmail.com> | 2017-09-08 02:17:27 +0000 |
| commit | ab7b8d93cf1098970bc17fb4937376bb1ff33a21 (patch) | |
| tree | b1c0c89e34cb87f6cd8c1f783654bf66c7b50ac9 /src/vnet/ipsec/ikev2.c | |
| parent | 8a19f12a0cfe6d611f6e266931af691fb69a74ad (diff) | |
Fixes for issues reported by Coverity (VPP-972)
Change-Id: I25238debb7081b4467aec4620dfdef33fbef3295
Signed-off-by: Chris Luke <chrisy@flirble.org>
Diffstat (limited to 'src/vnet/ipsec/ikev2.c')
| -rw-r--r-- | src/vnet/ipsec/ikev2.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/src/vnet/ipsec/ikev2.c b/src/vnet/ipsec/ikev2.c index 296654ecbac..a3dc7b872c5 100644 --- a/src/vnet/ipsec/ikev2.c +++ b/src/vnet/ipsec/ikev2.c @@ -17,6 +17,7 @@ #include <vnet/vnet.h> #include <vnet/pg/pg.h> #include <vppinfra/error.h> +#include <vppinfra/random.h> #include <vnet/udp/udp.h> #include <vnet/ipsec/ipsec.h> #include <vnet/ipsec/ikev2.h> @@ -1595,8 +1596,16 @@ ikev2_create_tunnel_interface (vnet_main_t * vnm, ikev2_sa_t * sa, + sa->profile->lifetime; if (sa->profile->lifetime_jitter) { + // This is not much better than rand(3), which Coverity warns + // is unsuitable for security applications; random_u32 is + // however fast. If this perturbance to the expiration time + // needs to use a better RNG then we may need to use something + // like /dev/urandom which has significant overhead. + u32 rnd = (u32) (vlib_time_now (vnm->vlib_main) * 1e6); + rnd = random_u32 (&rnd); + child->time_to_expiration += - 1 + (rand () % sa->profile->lifetime_jitter); + 1 + (rnd % sa->profile->lifetime_jitter); } } |