IPSEC; dpdk backend for tunnel interface encryption

Change-Id: Ide2a9df18db371c8428855d7f12f246006d7c04c
Signed-off-by: Neale Ranns <nranns@cisco.com>

ipsec: drop runts in esp-decrypt

Change-Id: Id7fcaf8590f9f2dcccdebea0ad31c7ecd1cbc8af
Signed-off-by: Damjan Marion <damarion@cisco.com>

crypto: improve key handling

Change-Id: If96f661d507305da4b96cac7b1a8f14ba90676ad
Signed-off-by: Damjan Marion <damarion@cisco.com>

Remove dummy_interface_tx nodes from l2tp l2xcrw and nsh

Change-Id: I51e0d4a9ec62514a85bbe4c5f56a48d60ab6f4e4
Signed-off-by: John Lo <loj@cisco.com>

Add get_endpoint in transport vft

This allows QUIC & TLS specific logic to be implemented, and meaningfull
IP/port to be returned when connection is overridden.

Change-Id: Id79c59fe4d7b16d36f0e96ad3e281c4026b5fe65
Signed-off-by: Aloys Augustin <aloaugus@cisco.com>

ip4_lookup_inline: leverage vlib_get_buffers to improve perf

vlib_get_buffers can save at least 1.2 clocks/pkt for ip4_lookup_inline
on Haswell.

Change-Id: I730fc346cec4d2eb5ca364308e45268bda4d5f89
Signed-off-by: Zhiyong Yang <zhiyong.yang@intel.com>

dpdk: fix interface naming

Change-Id: Ia092a93a7ac0cbf9338f9d4a5db8b94b23549a13
Signed-off-by: Florin Coras <fcoras@cisco.com>

Clean up multi-thread barrier-sync hold-down timer

Main thread: don't bother with the barrier sync hold-down timer if
none of the worker threads are busy.

Worker threads: avoid epoll_pwait (10ms timeout) when the
control-plane has been active in the last half-second.

Change-Id: I82008d09968c65e2a4af0ebb7887389992e60603
Signed-off-by: Dave Barach <dave@barachs.net>

QUIC: Add multi-stream support to internal test apps

Change-Id: Iab07697ef482529e62c11433cffa1f8f894e5bb7
Signed-off-by: Aloys Augustin <aloaugus@cisco.com>
Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>

UDPC: Fix open segfault with multiple workers

Change-Id: Ib4a64f17831e2419f1d6140a6d24649c096bdfa5
Signed-off-by: Aloys Augustin <aloaugus@cisco.com>

dpdk: get a rid of "Invalid port_id=" log message

Change-Id: I65e7188c6893acca67455ff37f2dfbd0bedd5c09
Signed-off-by: Damjan Marion <damarion@cisco.com>

l2: Add support for arp unicast forwarding

Change-Id: I79fc55f36a9b83957f84619bdf8cef08acc8ec24
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>

svm: fifo ooo reads/writes with multiple chunks

Change-Id: If23a04623a7138c9f6c98ee9ecfa587396618a60
Signed-off-by: Florin Coras <fcoras@cisco.com>

svm: move mq test to ut plugin

Change-Id: Ic4e882b784e5773198e55bd97b1bbd3d6dda888a
Signed-off-by: Florin Coras <fcoras@cisco.com>

session: remove unused fifo allo return value

Change-Id: I50a6bcc127e4b44becc4b694bdd3018ac9bfab5c
Signed-off-by: Florin Coras <fcoras@cisco.com>

ethernet_input_inline: leverage vlib_get_buffers

Make full use of well optimized function vlib_get_buffers
for ethernet_input_inline.

Change-Id: Iee7df570b87fa95c0902895686a62386d730f9a1
Signed-off-by: Zhiyong Yang <zhiyong.yang@intel.com>

Rearrange prefetching in ipsec_output_inline

Change-Id: I6151e57643ebed42f51b795980db2c52084295ab
Signed-off-by: Vratko Polak <vrpolak@cisco.com>

svm: move fifo tests to ut plugin

Change-Id: I638facf6e2128334c3d1a5a8494f378505831e1b
Signed-off-by: Florin Coras <fcoras@cisco.com>

NAT: VPP-1531 api cleanup & update

Change-Id: I2492400a67b39a3adbc24ab7cf1ba17a409e95a8
Signed-off-by: Filip Varga <fivarga@cisco.com>

Enable 'test crash' command when running unittest plugin.

Change-Id: Icf0cff122dfbd260a2865b6c83531f4a8c726132
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

API: Python and Unix domain socket improvement

Handle the case where buffer overflows.
Then SOCK_SEQPACKET assumption that multiple API messages
are not returned by recv() is broken. Use SOCK_STREAM for
API exchanges instead.

Add support for running tests over sockets.
make test SOCKET=1

Change-Id: Ibe5fd69b1bf617de4c7ba6cce0a7c2b3f97a2821
Signed-off-by: Ole Troan <ot@cisco.com>

Bump to intel-ipsec-mb version 0.52

Change-Id: Ifeaf93c98e4af92da9409fa5a2114b577e8c0937
Signed-off-by: Damjan Marion <damarion@cisco.com>

Revert "NAT: VPP-1531 api cleanup & update"

This reverts commit bed1421b9f1b3643d93384084972337b596aec73.

/vpp/master3/src/plugins/nat/nat_api.c: In function ‘send_nat_worker_details’:
/vpp/master3/src/vppinfra/clib.h:62:33: error: division ‘sizeof (u8 * {aka unsigned char *}) / sizeof (u8 {aka unsigned char})’ does not compute the number of array elements [-Werror=sizeof-pointer-div]
 #define ARRAY_LEN(x) (sizeof (x)/sizeof (x[0]))
                                 ^
/vpp/master3/src/plugins/nat/nat_api.c:205:43: note: in expansion of macro ‘ARRAY_LEN’
   rmp = vl_msg_api_alloc (sizeof (*rmp) + ARRAY_LEN (w->name) - 1);
                                           ^~~~~~~~~

Change-Id: Ie82672c145fb2f6580827f95e535435307bc7a23
Signed-off-by: Ole Troan <ot@cisco.com>

API sw_interface_dump: Dump all if index is zero

This is a temporary measure, to allow CSIT usage
of VAT command sw_interface_dump without arguments.

Change-Id: Ic40adfcc89d92179e213afc497e4e71bbc0dad83
Signed-off-by: Vratko Polak <vrpolak@cisco.com>

NAT: VPP-1531 api cleanup & update

Change-Id: I519d7efc8ee3c86381d96be2e2a46017cd948895
Signed-off-by: Filip Varga <fivarga@cisco.com>

Fix a ipsec command line typo

Change-Id: Ic75df36e06a77730ff8764f96d3cf53c4e59923b
Signed-off-by: Simon Zhang <yuwei1.zhang@intel.com>

vnet: clean up calc_checksums()

Remove the duplicated code and unnecessary operations.

Change-Id: I78005848d29d3156165627926a79015d590d61a6
Signed-off-by: Zhiyong Yang <zhiyong.yang@intel.com>

dpdk_esp_encrypt: add to prefetch data

The memory areas storing vlib_buffer_t and ip4|6_and_esp_header_t
are not prefetched. The patch help dpdk_esp_encrypt to reduce 18
clocks/pkt from 149 to 131 on Haswell when running IPsec in tunnel
mode.

Change-Id: I4f4e9e2b3982a4b7810cab8ed828a5e4631f8f8c
Signed-off-by: Zhiyong Yang <zhiyong.yang@intel.com>

ipsec4-output: add pkt header and data prefetching

The graph node running IPsec encap in tunnel mode can be saved
from 65.8 to 57.3 clocks/pkt on Haswell platform.
The graph node can be saved 10 clockes/pkt on DVN as well in the
same case.

Change-Id: I4804879c4d489465ee56a8f8317596b7e79b9331
Signed-off-by: Zhiyong Yang <zhiyong.yang@intel.com>

vppinfra: fix one macro issue in clib_cpu_supports_aes()

The macro for x86 platform is wrong, and the patch fixes it.

Change-Id: I4f0ed254b177d6863fbe9113308c6a8b4478e0b2
Signed-off-by: Zhiyong Yang <zhiyong.yang@intel.com>

GRE: set gre_tunnel_type init value to zero in API

Change-Id: I9715b0578852a1ed59d78b7a9e28f32fc763ed3c
Signed-off-by: Alexander Chernavin <achernavin@netgate.com>

vlib epoll: handle file removal on EPOLLIN

Change-Id: I7a3526a8fdf17afb8cc2225bdfbd57f661680992
Signed-off-by: Florin Coras <fcoras@cisco.com>

svm: reorganize fifo march code

- make only the chunk copying (memcpy) code march aware
- cleanup dependencies

Change-Id: I369378264cacfcdaf0823353b957876554eaa17c
Signed-off-by: Florin Coras <fcoras@cisco.com>

rbtree: add successor and predecessor functions

Change-Id: I6934beaf5c08bae2d4f0bd3a6bb811810407c1f9
Signed-off-by: Florin Coras <fcoras@cisco.com>

Doxygen cleanup.

- Add subpages definitions in appropriate
  section (User or Dev docs) for doc files
  (*.rst, *.md) that being listed at the top
  level of the generated doc page.
- Generate and add API list to RELEASE doc.
- Fix list_api_changes script to use HEAD
  as the endtag so it doesn't need to be
  changed every release.

Change-Id: Iace7b6433359c6b96869cb1db01facbbcb0ac1e6
Signed-off-by: Dave Wallace <dwallacelf@gmail.com>
(cherry picked from commit 11ee93f6abfaddf5bbd56cf0858c0c6ea0384b65)

build: fix fedora dependencies

Update various python dependencies package names.

Change-Id: I0f64f988f361adf4705fceaf4f2c147138024b1e
Signed-off-by: Benoît Ganne <bganne@cisco.com>

IPSEC: IPv6 ESP transport mode incorrect packet length and checksum (VPP-1654)

Change-Id: Ia3474e5bfea5764eae9b2987bf78296535df6778
Signed-off-by: Neale Ranns <nranns@cisco.com>

6rd: fix debug cli short-help

Debug cli short help for 6rd tunnel creation was out-of-date.

Change-Id: I06e4d28481470825bf225ba0fd371a3aebd889fa
Signed-off-by: Benoît Ganne <bganne@cisco.com>

svm: move fifo tests to a separate file

Change-Id: Iac9ac9f5a6873aae1882316af4f6c919788a0cef
Signed-off-by: Florin Coras <fcoras@cisco.com>

Remove dummy_interface_tx output node from PPPoE plugin

Avoid creating per PPPoE session interface output/tx nodes
which are not used.

Change-Id: I065aa4f9bda6d2557c630bd45e888c999f2f9130
Signed-off-by: John Lo <loj@cisco.com>

svm: support addition of chunks to fifos

Change-Id: Ia56cad89b85b7a99ab4bfb85318a45a71381fb53
Signed-off-by: Florin Coras <fcoras@cisco.com>

DOCS-ONLY: Fix broken doxygen tag in BVI

Change-Id: Ia42e7c93ebe51a36470f1358827451bcb98da433
Signed-off-by: Dave Wallace <dwallacelf@gmail.com>

IPSEC: ESP IPv6 transport mode payload length incorrect (VPP-1653)

Change-Id: I8977100d7a22b50260858bd1ea9db419b53284ff
Signed-off-by: Neale Ranns <nranns@cisco.com>

FIB: recursion casues path realloc

Change-Id: Ie9c2954eee90ca1a1fc1aa8280f93b2340b544c1
Signed-off-by: Neale Ranns <nranns@cisco.com>

GBP: update cli to reflect API changes

Some GBP debug cli short help and commands were not in sync anymore with
GBP API.

Change-Id: I224bec51fbacd8a3685b70d4e7a52b5803fd3ad4
Signed-off-by: Benoît Ganne <bganne@cisco.com>

vlib epoll: protect against clib file pool expansion

Change-Id: I320e7c2fdacb3056bc448c73fec08d9e2978ee5e
Signed-off-by: Florin Coras <fcoras@cisco.com>

Extras: Fix list_api_changes script for 19.08

Change-Id: I9907a60347933bb2be8c967bf5e0d507b57b982b
Signed-off-by: Dave Wallace <dwallacelf@gmail.com>

Fix memory corruption faulting [VPP-1639]

File pool may be reallocated on epoll events processing.
*f* pointer shows to already freed address and corrupting
memory chunk on clib_file_t property change.

Change-Id: I751bddce27325452862b939c1a3eec2ccd9b71bb
Signed-off-by: Artem Belov <artem.belov@xored.com>

svm: allow indirect fifo data chunks

Fifos can use multiple memory chunks for simple read/write operations.
Adding/removing chunks after assignment not yet supported.

Change-Id: I2aceab6aea78059d74e0d3a9993c40d5196d077b
Signed-off-by: Florin Coras <fcoras@cisco.com>

GRE: API update

Change-Id: I5010cd34123c6498230dedac6ba8dd774a1085f9
Signed-off-by: Neale Ranns <nranns@cisco.com>

tls: allow engines to customize close

Change-Id: I11ac3e4f59206902e5dfc326f815c877c5dd6643
Signed-off-by: Florin Coras <fcoras@cisco.com>

IPSEC: tunnel rekey fix and test (VPP-1652)

Change-Id: I1c2b3e40c689bedcdcea7887792b6b6b6aeb48d5
Signed-off-by: Neale Ranns <nranns@cisco.com>

Use template-specific key compare fn when deleting records

A simple memcmp won't work when comparing pointer-keys, such as those
used by the bihash_vec8_8.h template.

Change-Id: I77e59f3fd7f7740ef42908ace90ed4843e1c9ac7
Signed-off-by: Dave Barach <dave@barachs.net>

session: fix segment manager init condition

Change-Id: I0ef3115bd29a11538090c582a4eacdbb7cd86d7a
Signed-off-by: Florin Coras <fcoras@cisco.com>

Make sw_interface_dump more compatible with 2.2.0

+ As old PAPI clients are likely to put zero as the value
  for sw_if_index, the behavior should not perform
  index filtering at least when name filtering is enabled (valid).
+ interface.api version set to 2.3.0,
  as the new behavior is backward compatible
  (at least for PAPI with name filter enabled),
  but not forward compatible.
+ Minor whitespace cleanup.

Change-Id: I315a0eae4004f9d9b6c5f9ecf0f179e669729118
Signed-off-by: Vratko Polak <vrpolak@cisco.com>

vcl/session: tx notifications for cut-thru sessions

Change-Id: I076c753e419bbb177d2d28609190715e9895b398
Signed-off-by: Florin Coras <fcoras@cisco.com>

api: Add to interface crud - read by sw_if_index.

Change-Id: I02c857da4cf6da5e0e55c1e48b63716af7ade0a9
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

VPP-1649: Coverity warning in http server

Remove duplicate error check

Change-Id: I64463c7f606e198fe8553efea294f0e09bd8dbc3
Signed-off-by: Dave Barach <dave@barachs.net>

Revert "Revert "bond: problem switching from l2 to l3""

This reverts commit 5d0d5494db58422eb528c0f8b39a86ea966505e9.

The csit crash was actually due to the test image missing the patch
https://gerrit.fd.io/r/#/c/17731/

It was a mistake to revert the original patch
https://gerrit.fd.io/r/#/c/15577/

Change-Id: I7fc563981aa13d308d55b25194fee21475ebc57d
Signed-off-by: Steven Luong <sluong@cisco.com>

vppinfra: AVX512 interelaave, insert and permute

Change-Id: I26c704ec27b8f5431faef08156778f53ea454269
Signed-off-by: Damjan Marion <damarion@cisco.com>

tap: clean-up when linux will delete the tap interface

When container is deleted which has tap interface attached,
Linux also delete the tap interface leaving the VPP side of
tap. This patch does a clean up job to remove that VPP side
of tap interface.

To produce the behavior:
In VPP:
  create tap
On linux:
  sudo ip netns add ns1
  sudo ip link set dev tap0 netns ns1
  sudo ip netns del ns1

Change-Id: Iaed1700073a9dc64e626c1d0c449f466c143f3ae
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>

Predicate a packet whether be marked by PKT_RX_FDIR_ID instead of PKT_RX_FDIR

Change-Id: I65b1af5fa0cec4f9789f91f720d1396d06fa0206
Signed-off-by: Simon Zhang <yuwei1.zhang@intel.com>

IPSEC: Pass the algorithm salt (used in GCM) over the API

Change-Id: Ia8cea13f7b937294e6a080a55fb2ceff30063acf
Signed-off-by: Neale Ranns <nranns@cisco.com>

crypto-ipsecmb: enable GCM

Change-Id: I670d7899bcc63a419daf481167dc445a6386cce8
Signed-off-by: Neale Ranns <nranns@cisco.com>

Default nums of RX/TX descriptors changed to 512 for 2M page on DVN

As DVN has fewer DTLB entries supported for 2M page, default numbers of
RX/TX descriptors are changed to 512 if nums of RX/TX descriptors are not
specified by VPP users.

Change-Id: I076493b802b15d12750a5b49d1554da4d19ad460
Signed-off-by: Zhiyong Yang <zhiyong.yang@intel.com>

Duplicate pcap tx trace fix

Change-Id: I0657cb44f58942ef281046dd3841bda669b10589
Signed-off-by: Neale Ranns <nranns@cisco.com>

ADJ: crash in format/show (VPP-1648)

Change-Id: I26279c19b879e59c68fda31426fe42dae62a858d
Signed-off-by: Neale Ranns <nranns@cisco.com>

IPSEC: SA format; don't print keys when there's no algo

Change-Id: I4d1d22cb24564896264e77c1810804ea3f54cb37
Signed-off-by: Neale Ranns <nranns@cisco.com>

vppinfra: more AVX2 and AVX512 inlines

Change-Id: I81bd967a580ae3b476dfd731e9933a9898568a91
Signed-off-by: Damjan Marion <damarion@cisco.com>

dlmalloc: honor 8 byte alignment requests

Change-Id: Ie504603c2e42cae3ad592952b2b166919420e5f7
Signed-off-by: Florin Coras <fcoras@cisco.com>

gbp: Add support for allow sclass/dclass 1

Change-Id: I51f61a399e3eace93011f9431cbd7968e9be627c
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>

Static http server

Good enough to serve the vpp sphinx and doxygen docs. Knows about
html, css, and javascript files.

Change-Id: Ib18c19f07f35f91ba935ea26ed7be406dacf2205
Signed-off-by: Dave Barach <dave@barachs.net>

svm_fifo rework to avoid contention on cursize

Problems Addressed:
- Contention of cursize by producer and consumer.
- Reduce the no of modulo operations.

Changes:
- Synchronization between producer and consumer changed from cursize
  to head and tail indexes
  Implications: reduces the usable size of fifo by 1.
- Using weaker memory ordering C++11 atomics to access head and tail
  based on producer and consumer role.
- Head and tail indexes are unsigned 32 bit integers. Additions and
  subtraction on them are implicit 32 bit Modulo operation.
- Adding weaker memory ordering variants of max_enq, max_deq, is_empty
  and is_full Using them appropriately in all places.

Perfomance improvement (iperf3 via Hoststack):

iperf3 Server: Marvell ThunderX2(AArch64) - iperf3 Client: Skylake(x86)
   ~6%(256 rxd/txd) - ~11%(2048 rxd/txd)

Change-Id: I1d484e000e437430fdd5a819657d1c6b62443018
Signed-off-by: Sirshak Das <sirshak.das@arm.com>
Reviewed-by: Honnappa Nagarahalli <honnappa.nagarahalli@arm.com>

QUIC: Initial multi stream support

To connect a stream, apps should call connect while passing the id of the QUIC
connection in the new transport_opts field in session_endpoint_cfg_t.
Apps are notified of new streams with their accept callback, which is called
each time a peer opens a stream.

Change-Id: I0f82ec344db58008d54641553eddec2973768435
Signed-off-by: Aloys Augustin <aloaugus@cisco.com>

Allow sessions to be allocated in app's RX callbacks

This enables applications to create sessions in their RX callbacks, which can
invalidate the session pointer. This is required for the QUIC protocol
implementation.

Change-Id: I6072c1c368fd9d17a960ec086a788089dd6f54b4
Signed-off-by: Aloys Augustin <aloaugus@cisco.com>

stats: Add name vectors to Python client

Change-Id: Ic62dfa0bf3e082a0b999026830c64a9c543da586
Signed-off-by: Ole Troan <ot@cisco.com>

IPSEC: support GCM in ESP

Change-Id: Id2ddb77b4ec3dd543d6e638bc882923f2bac011d
Signed-off-by: Neale Ranns <nranns@cisco.com>

Add direct packets to specific flow action in dpdk flow

Change-Id: I48cd8052f9509efdf13f64ab279edb66a2d4a0a9
Signed-off-by: Simon Zhang <yuwei1.zhang@intel.com>

VPP-1576: nsim-plugin coverity issues

Change-Id: I832e780b00955e01871874544f3d0afc553b75f7
Signed-off-by: Dave Barach <dave@barachs.net>

vppinfra: add basic rbtree

Algorithm from CLRS, Introduction to Algorithms 3rd Edition, Ch. 13

Change-Id: I5bc2c507593770939cd5584f21dacf36ebd2b4c1
Signed-off-by: Florin Coras <fcoras@cisco.com>

flow: add rte_flow check before creating by rte_flow_validate

Change-Id: Idfcf1644952d647c6e1b61216d9b365d58b77814
Signed-off-by: Simon Zhang <yuwei1.zhang@intel.com>

IPSEC-GRE: return correct API code

Change-Id: I4f72989885ecfc6a0b27553194c6611fd71f7e5b
Signed-off-by: Neale Ranns <nranns@cisco.com>

vpp-1647: fix typo in pcap_trace_command_internal

pcap rx trace on max 100 intfc tap0
then
pcap rx trace status

Displays "local0" instead of "tap0" due to a typo in
pcap_trace_command_internal(...).

Change-Id: Id2de6a24174aac24d9051b7404f01edc806a6573
Signed-off-by: Dave Barach <dave@barachs.net>

API: Handle pthread cond signal case where signal is missed.

Especially on a single core setup the RX thread could signal the main thread
that it was done, before main thread listened to the signal.

Change-Id: Ib70337b21bcf77787ce4ee0aa9cf80c6da2215af
Signed-off-by: Ole Troan <ot@cisco.com>

vppinfra: add SHA-2 family of hash algorithms (including HMAC)

Change-Id: I54d6fb1a2721b548620eb66cea254d0103deca32
Signed-off-by: Damjan Marion <damarion@cisco.com>

tap: fix the crash

Crash will happen when someone will try to setup a tap interface
in host namespace without providing the host side of tap interface
custom name. This patch fixes the problem by using the default name
in this case.

Change-Id: Ic1eaea5abd01bc6c766d0e0fcacae29ab7a7ec45
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>

crypto: fix coverity warnings

Change-Id: Id9dfd912517c44cf812953bd05ac04c9e172a2b7
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>

crypto: openssl - IV len not passed by caller. Callee knows from algo type

Change-Id: Ib80e9bfb19a79e1adc79aef90371a15954daa993
Signed-off-by: Neale Ranns <nranns@cisco.com>

crypto-openssl-gcm: account for failed decrypts

Change-Id: I749c5a9d58128fd6d0fb8284e56b8f89cf91c609
Signed-off-by: Neale Ranns <nranns@cisco.com>

IPSEC: crypto overflow

decrypting too many bytes.

Change-Id: I4663e70271d9734eda7f9a127967b9224c0e5efc
Signed-off-by: Neale Ranns <nranns@cisco.com>

ip4: don't format upper layer if it's a fragment

Parsing ipv4 upper layer is not meaningful
if it's a fragment packet except the first.

Change-Id: I442fb7ec01244fde8c4f7656a8ba633d0aa0f97e
Signed-off-by: Faicker Mo <faicker.mo@ucloud.cn>

crypto: add support for AES-CTR cipher

Change-Id: I7d84bab7768421ed37813702c0413e52167f41ab
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>

vppinfra: AVX-512 transpose (u32x16 and u64x8)

Change-Id: Iefe9d20799a6f5f271aa5b675ea2b19ac3efbe1e
Signed-off-by: Damjan Marion <damarion@cisco.com>

Trivial: Update doxygen comments.

Change-Id: I2f7f3898b913c9b1a37b1c8c84a8df3799c49c5d
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

session: drop lock on segment allocation error

Change-Id: Ib346570daa3e40f4f53100a05e9355ce60d533a4
Signed-off-by: Florin Coras <fcoras@cisco.com>

stats: Off by one error in stats directory vector.

Change-Id: Ic75af8bbd52c8a08e34ff2a847f60be5479b814b
Signed-off-by: Ole Troan <ot@cisco.com>

Adding check to ensure acl_id matches existing acl_id in abf_policy_update

Change-Id: Ia86387ca5a52d6b4b9e5aff0c01c92df13a5dde5
Signed-off-by: Parixit Gokhale <pgokhale@cisco.com>

IPSEC: ESP with ESN tests and fixes

Change-Id: Ie42b26e6d5cdb7b23f370ea2933c65079e8d1089
Signed-off-by: Neale Ranns <nranns@cisco.com>

crypto: add more AES-GCM test cases

Change-Id: Ibb3e2f3ba5f31482fc2f0dce53d68f8476608f4b
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>

IPSEC-MB: Use random & non-repeating IV (VPP-1642)

hard code IV and key lengths based on cipher.
Init IV from random data, use AES instruction to rotate.

Change-Id: I13a6507d12267b823c528660a903787baeba47a0
Signed-off-by: Neale Ranns <nranns@cisco.com>