summaryrefslogtreecommitdiffstats
AgeCommit message (Expand)AuthorFilesLines
2019-08-05quic: fix memset 0 picotls depends onNathan Skrzypczak1-0/+1
2019-08-05vxlan: fix VXLANoIP6 checksum offload setupJohn Lo2-7/+6
2019-08-03ip: fix ip6/udp checksum for pkts using buffer chainingJohn Lo2-4/+15
2019-08-02quic: Improve quic echo connect threadingNathan Skrzypczak4-732/+870
2019-08-02vlib: fix out of memory issueFilip Tehlar1-0/+3
2019-08-02devices: add null check after map_guest_mem callsSteven Luong1-2/+16
2019-08-02vcl: initialize worker thread index and heap map slotFlorin Coras1-0/+3
2019-08-02vppinfra: Expose function setting __os_thread_indexNathan Skrzypczak3-20/+28
2019-08-02tcp: add more connection statsFlorin Coras4-6/+81
2019-08-02ethernet: fix ARP feature arc definitionDave Barach1-2/+9
2019-08-02vmxnet3: don't bypass ethernet_inputSteven Luong2-15/+6
2019-08-02lb: fix usage of lb_main in testFlorin Coras1-2/+18
2019-08-02ipsec: FIx feature orderingNeale Ranns2-4/+2
2019-08-02virtio: add the display information in virtio cliChenmin Sun2-2/+2
2019-08-02quic: fix connection move with multiple workersAloys Augustin1-13/+35
2019-08-01interface: fix pcap tx/rx trace cli handlingJohn Lo4-16/+7
2019-08-01session: session pool migration notificationFlorin Coras6-0/+43
2019-08-01vppinfra: fix spinlock and rwlock testsFlorin Coras3-15/+15
2019-08-01ipsec: Redo the anit-replay check post decryptNeale Ranns3-0/+51
2019-08-01docs: Small fixes and orderingNathan Skrzypczak7-13/+33
2019-08-01vppinfra: refactor clib_rwlock_t to use single condition variablejaszha032-25/+19
2019-08-01vppinfra: remove unused historical codeDave Barach3-375/+0
2019-08-01vppinfra: make first bihash add thread-safeDave Barach2-7/+25
2019-08-01quic: Improve quicly_ctx handling & crypto ctxNathan Skrzypczak2-135/+148
2019-08-01ethernet: Fix node ordering on ARP feautre ARCNeale Ranns1-2/+13
2019-08-01nat: handoff rewrite & fixes for multi-workerFilip Varga2-60/+163
2019-08-01vppinfra: refactor clib_spinlock_t to use compare and swapjaszha032-2/+13
2019-08-01tcp: honor snd_wnd in fast rxtFlorin Coras1-1/+4
2019-08-01qos: Uninitialised variable (coverity)Neale Ranns1-0/+3
2019-08-01vppapigen: revert "implement reversible repr's"Vratko Polak1-34/+15
2019-07-31lb: vip and as dump/detail api'sHongjun Ni9-75/+601
2019-07-31api: add prefix matcher typedefPaul Vinciguerra1-0/+11
2019-07-31nat: elog rewrite for multi-worker supportFilip Varga17-142/+340
2019-07-31gso: fix the test caseMohsin Kazmi1-1/+0
2019-07-31devices interface tests: vhosst GSO supportSteven Luong11-26/+313
2019-07-31qos: Store functionNeale Ranns16-9/+1400
2019-07-31vppapigen: implement reversible repr'sPaul Vinciguerra1-15/+34
2019-07-31build: Append build number for cpack packagesYohanPipereau1-31/+32
2019-07-31pg: clarify the text of error messageAndrew Yourtchenko1-1/+1
2019-07-31vlib: fix format_error_traceDave Barach1-1/+2
2019-07-31vppinfra: added performance test for clib_rwlock_t (test_rwlock.c)jaszha032-0/+265
2019-07-31vppinfra: refactor test_and_set spinlocks to use clib_spinlock_tjaszha0317-105/+83
2019-07-31vppinfra: added lock performance test for clib_spinlock_t (test_spinlock.c)jaszha032-0/+207
2019-07-31vcl: fix epoll chain validationFlorin Coras1-22/+22
2019-07-31api papi: add alias for timestamp(datetime)/timedeltaPaul Vinciguerra5-47/+75
2019-07-31vppapigen: add endian_string for f64Paul Vinciguerra1-0/+1
2019-07-31tests: disable pg capture before enabling itAndrew Yourtchenko4-2/+31
2019-07-31tests: Split IPSec ESP into parameterized tests per engineNeale Ranns2-67/+60
2019-07-31ip: Ensure reassembly runs before IPSec decrypt.Neale Ranns4-5/+84
2019-07-31fib: Add some path-list flags to its keyNeale Ranns2-1/+11
an> cm->mac1, COOKIE_MAC_SIZE); cp->cp_mac1_valid = 1; if (!wg_birthdate_has_expired (cp->cp_birthdate, COOKIE_SECRET_MAX_AGE - COOKIE_SECRET_LATENCY)) cookie_macs_mac2 (cm, buf, len, cp->cp_cookie); else clib_memset (cm->mac2, 0, COOKIE_MAC_SIZE); } enum cookie_mac_state cookie_checker_validate_macs (vlib_main_t *vm, cookie_checker_t *cc, message_macs_t *cm, void *buf, size_t len, bool busy, ip46_address_t *ip, u16 udp_port) { message_macs_t our_cm; uint8_t cookie[COOKIE_COOKIE_SIZE]; len = len - sizeof (message_macs_t); cookie_macs_mac1 (&our_cm, buf, len, cc->cc_mac1_key); /* If mac1 is invalid, we want to drop the packet */ if (clib_memcmp (our_cm.mac1, cm->mac1, COOKIE_MAC_SIZE) != 0) return INVALID_MAC; if (!busy) return VALID_MAC_BUT_NO_COOKIE; cookie_checker_make_cookie (vm, cc, cookie, ip, udp_port); cookie_macs_mac2 (&our_cm, buf, len, cookie); /* If the mac2 is invalid, we want to send a cookie response */ if (clib_memcmp (our_cm.mac2, cm->mac2, COOKIE_MAC_SIZE) != 0) return VALID_MAC_BUT_NO_COOKIE; return VALID_MAC_WITH_COOKIE; } /* Private functions */ static void cookie_precompute_key (uint8_t * key, const uint8_t input[COOKIE_INPUT_SIZE], const char *label) { blake2s_state_t blake; blake2s_init (&blake, COOKIE_KEY_SIZE); blake2s_update (&blake, (const uint8_t *) label, strlen (label)); blake2s_update (&blake, input, COOKIE_INPUT_SIZE); blake2s_final (&blake, key, COOKIE_KEY_SIZE); } static void cookie_macs_mac1 (message_macs_t * cm, const void *buf, size_t len, const uint8_t key[COOKIE_KEY_SIZE]) { blake2s_state_t state; blake2s_init_key (&state, COOKIE_MAC_SIZE, key, COOKIE_KEY_SIZE); blake2s_update (&state, buf, len); blake2s_final (&state, cm->mac1, COOKIE_MAC_SIZE); } static void cookie_macs_mac2 (message_macs_t * cm, const void *buf, size_t len, const uint8_t key[COOKIE_COOKIE_SIZE]) { blake2s_state_t state; blake2s_init_key (&state, COOKIE_MAC_SIZE, key, COOKIE_COOKIE_SIZE); blake2s_update (&state, buf, len); blake2s_update (&state, cm->mac1, COOKIE_MAC_SIZE); blake2s_final (&state, cm->mac2, COOKIE_MAC_SIZE); } static void cookie_checker_make_cookie (vlib_main_t *vm, cookie_checker_t *cc, uint8_t cookie[COOKIE_COOKIE_SIZE], ip46_address_t *ip, u16 udp_port) { blake2s_state_t state; if (wg_birthdate_has_expired (cc->cc_secret_birthdate, COOKIE_SECRET_MAX_AGE)) { cc->cc_secret_birthdate = vlib_time_now (vm); RAND_bytes (cc->cc_secret, COOKIE_SECRET_SIZE); } blake2s_init_key (&state, COOKIE_COOKIE_SIZE, cc->cc_secret, COOKIE_SECRET_SIZE); if (ip46_address_is_ip4 (ip)) { blake2s_update (&state, ip->ip4.as_u8, sizeof (ip4_address_t)); } else { blake2s_update (&state, ip->ip6.as_u8, sizeof (ip6_address_t)); } blake2s_update (&state, (u8 *) & udp_port, sizeof (u16)); blake2s_final (&state, cookie, COOKIE_COOKIE_SIZE); } /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */