ipsec: fix AES CBC IV generation (CVE-2022-46397)

For AES-CBC, the IV must be unpredictable (see NIST SP800-38a Appendix
C). Chaining IVs like is done by ipsecmb and native backends for the
VNET_CRYPTO_OP_FLAG_INIT_IV is fully predictable.
Encrypt a counter as part of the message, making the (predictable)
counter-generated IV unpredictable.

Fixes: VPP-2037
Type: fix

Change-Id: If4f192d62bf97dda553e7573331c75efa11822ae
Signed-off-by: Benoît Ganne <bganne@cisco.com>

build: touch files when extracting rpm tarballs

Type: fix

- Long story short, intermittently centos jobs have been
  failing with clock skew issues. When someone commits a
  patch on a machine with the date ahead of UTC, then clock
  skew will be encountered when extracting the RPM source
  tarball. See [0] and [1] for details.

- Replace 'make bootstrap' with 'make install-dep' in
  RPM package build specfile.

[0] https://unix.stackexchange.com/questions/164807/does-git-archive-use-the-wrong-file-timestamp
[1] https://git.fd.io/vpp/tree/Makefile#n380

Change-Id: Iebfb9eb2e26c1f2e4488e871da86d0c60b9f4048
Signed-off-by: Dave Wallace <dwallacelf@gmail.com>
(cherry picked from commit 27b50fea143f2d45613ef982870cd2052e21fb0f)

misc: 19.08.3 Release Notes

Also remove the duplicate 17.07.1 section

Change-Id: I809f417fabea96df506886ae6576b6e8c1b72caf
Type: docs
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

ipsec: fix esp padding

Type: fix
Signed-off-by: Milan Lenco <milan.lenco@pantheon.tech>
Change-Id: Ic8db52b41d7e5af3425099f008984e50afb3da74

vcl: fix epoll timeout

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I917158a62e5881b97917c3339527d3c34c37565a
(cherry picked from commit 0edfb1a06ed093c5ed82be34b42b8cacc3ac0ff8)

build: Fix 'make install-deps' errors on aarch64 CentOS 7

On CentOS-7 aarch64, command of 'debuginfo-install -y glibc openssl-libs mbedtls-devel zlib' in 'make install-deps' fails because it tries to install the corresponding *debuginfo* packages from some inaccessible/unmaintained repos on aarch64, e.g., centos-sclo-rh-debuginfo. The error message shows as below.

Using 'debuginfo-install --enablerepo=xxx' also fails because it will still enable all the repos including the broken repos on aarch64. Using 'debuginfo-install --disablerepo=xxx' (xxx is the broken repo) works fine but we are not centain about that if VPP user will install additional broken repos on aarch64 or not. So to fix this error, we install all the *debuginfo* packages for 'glibc openssl-libs mbedtls-devel zlib' packages using 'yum install' instead.

[root@ ~]# debuginfo-install -y glibc openssl-libs mbedtls-devel zlib
Loaded plugins: auto-update-debuginfo, fastestmirror, ovl
enabling epel-debuginfo
enabling base-debuginfo
enabling centos-sclo-rh-debuginfo
Loading mirror speeds from cached hostfile
epel/aarch64/metalink                                                                                                                                                                       | 8.2 kB  00:00:00
epel-debuginfo/aarch64/metalink                                                                                                                                                             | 8.5 kB  00:00:00
 * base: mirror.aktkn.sg
 * centos-sclo-rh: mirror.aktkn.sg
 * epel: mirrors.yun-idc.com
 * epel-debuginfo: mirrors.yun-idc.com
 * extras: mirror.aktkn.sg
 * updates: mirror.xtom.com.hk
http://debuginfo.centos.org/centos/7/sclo/aarch64/repodata/repomd.xml: [Errno 14] HTTP Error 404 - Not Found
Trying other mirror.
To address this issue please refer to the below wiki article

https://wiki.centos.org/yum-errors

If above article doesn't help to resolve this issue please use https://bugs.centos.org/.

failure: repodata/repomd.xml from centos-sclo-rh-debuginfo: [Errno 256] No more mirrors to try.
http://debuginfo.centos.org/centos/7/sclo/aarch64/repodata/repomd.xml: [Errno 14] HTTP Error 404 - Not Found

Type: fix

Change-Id: I017c3b20a167d8035c3ae617b9ad5ae479e52f57
Signed-off-by: Jieqiang Wang <jieqiang.wang@arm.com>
(cherry picked from commit 81b95c1fe2ece45ee2a5d895631b608733384182)

stats: memory leak in stat_validate_counter_vector

Free the existing vectors prior to losing them.

Type: fix
Ticket: VPPSUPP-94

Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: Ic15f1fbc7a0c6c348065fc9759ee5d5c43013b91
Signed-off-by: Ole Troan <ot@cisco.com>
(cherry picked from commit e29fb5bf1b9ab87f4213d990377ea2604990135b)

misc: 20.05.1 Release Notes

Change-Id: Ib77b5928ba0db64ffe747f3b9a9f1248cc239b2a
Type: docs
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

virtio: fix the msix for multiqueue

Type: fix

Change-Id: Ie0cff37b474f8d85a3ae376e0f547a347fb1ad8a
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
(cherry picked from commit 8046fdc10b14fd161ee81d0a25cfa79793ef698b)

misc: ipfix-export unformat u16 collector_port fix

Use %U and unformat_udp_port instead of %u for unformat() call for
u16 collector_port number in set_ipfix_exporter_command_fn() to
avoid corruption of other variables which can happen if unformat()
with %u is used with a 16-bit variable. This avoids crash due to
corrupted fib_index value.

Type: fix

Signed-off-by: Elias Rudberg <elias.rudberg@bahnhof.net>
Change-Id: Id54273fcc458a7f9c5aa4025aa91711f160c1c1a
(cherry picked from commit 2dca180db989ea7afacdf4e70cc85e4408557382)

nat: fix regarding vm arg for vlib_time_now call

Change in snat_ipfix_header_create() to use thread-specific
vlib_main_t *vm pointer to avoid problems with different threads
accessing the same vlib_main_t data structure. This avoids
assertion failure when vlib_time_now() is called with a vm
corresponding to a different thread.

Type: fix

Signed-off-by: Elias Rudberg <elias.rudberg@bahnhof.net>
Change-Id: I2096c1debb5688d3b97e5ed9a0ea78d94053d8b7
(cherry picked from commit 5556813fb63d28240a17ccf18f947e60c4cbb263)

sr: fix for SID index across segment lists within a sr policy

Type: fix
Signed-off-by: Chinmaya Agarwal <chinmaya.agarwal@hsc.com>
Change-Id: I9aa5456bf94356e8702fbfd39b14db4c2e74d3e6
(cherry picked from commit edc2ea435b5c407a78f4fcb42d750338d6cdd6d5)

tap: fix dump for TUN interfaces

Type: fix

Change-Id: I3bcc8ff1cf0a828ce3ba112694d38e3287d38d8d
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
(cherry picked from commit 86f281a841b5ec67c6a440dfc691e4c42b883df9)

tap: fix the tun sndbuf value for kernel 4.20 and later

Type: fix

From kernel 4.20, xdp support has been added in tun_sendmsg.
If sndbuf == INT_MAX, kernel executes xdp data path
for tun driver which assumes packets are ethernet frames.
This patch is avoiding the xdp data path in kernel by setting
the sendbuf value < INT_MAX.

Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
Change-Id: Ia4aa54b177b96d56a2d513d18d26ca01d5b88929
(cherry picked from commit 4834a66b7b3ef73e486c40ea9d8e36cc2e09c473)

tap: remove the bridge configurations for TUN interface

Type: fix

Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
Change-Id: Ifeae641ec0aa7de74e33e582234505bf6e28ca87
(cherry picked from commit add4a412d1f5271be21f99fe15a93cb73c38b833)

gso: fix the l2 path

Type: fix

Change-Id: I4f91175444dec9800d651aa5a5e0472359de63d1
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
(cherry picked from commit ec1d61efe6d01a1a687f39e57a601ac693833b07)

tests: fix deps pinning / patching

This ensures we don't recompute the requirements-{2,3}.txt on each make
test run, and skips patching scapy if it is already patched instead of
failing.

Change-Id: I3da57182ae49f3dd04db139d96734a5d145fedff
Type: fix
Signed-off-by: Aloys Augustin <aloaugus@cisco.com>
(cherry picked from commit 8eca60df745b7656b96db16e75b0deda66bfc515)

l2: L2/L3 mode swicth cleanup and l2-patch fix

Cleanup L2/L3 mode switch to not redirect to/from ethernet-input node
as it is no longer necessary.
L2 patch should use sw_if_index for device feature enable/disable.

Type: fix

Signed-off-by: John Lo <loj@cisco.com>
Change-Id: I0f24161d027b07c188fd1e05276146f94c075710
(cherry picked from commit f415a3b53a51b261d08cc3312c25f250d6bc1bd6)

vppinfra: refactor mpcap.h

vppinfra source files MUST NOT #include <vlib/vlib.h>, <vnet/vnet.h>
or similar. Move mpcap_add_packet(...), mpcap_add_buffer(...) to a new
file: src/vnet/mpcap.h.

Type: refactor
Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: Id517aef6fe49b618f853ce32940b91ba45a1e60d
(cherry picked from commit 2a41919e39d4672f76a654f30be9c2093cef4fad)

nat: update ip4-udp src port for checksum == 0 pkts

Otherwise, the out2in path will discard return-path traffic with
probability 1.0.

Type: fix
Fixes: gerrit 23963 / f126e746fc01c75bc99329d10ce9127b26b23814

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: I621ed99329c04ef358035747dde599c0016b58f5
(cherry picked from commit 63c672c440d92cc570c587254afb4167617ec0b7)

vcl: support connected udp listens

Request connected udp listener behavior by setting
VPPCOM_ATTR_SET_CONNECTED attribute with vppcom_session_attr

Type: feature

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Iba95155c0f41cea8c6e1a4263946270d49c213ac
(cherry picked from commit 1e96617d952e2d5d8cc367a226702f8f825ed039)

lisp: fix api_format reference

Type: fix
Ticket: VPP-1885

Change-Id: I474fffd4d36f439a19d475a8cb20171ca88274ec
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>
(cherry picked from commit 353535bb4856d8ee6d818a3c75b8b576b9967ee4)

gso: fix flag for inner header

Type: fix

Change-Id: Ic3fc488521636f7f7c9402a20db45fdb599adaae
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
(cherry picked from commit be03b5c15598131355da91967d05321c15fa1f24)

lisp: fix api_format

Type: fix
Ticket: VPP-1885
Fixes: 58db6e1

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I6431e49b315e09490fed8fd70ac53872836c6a09
(cherry picked from commit f3c1e4b61269cd93302073a631a2549f1aeb24d9)

vcl: fix udp connected check

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I83dafe10cdc78fbb9a751f32155cd84d281b12d9
(cherry picked from commit a4dac8af0eb4271db0c528a00beca58f41b51c95)

lisp: fix custom dump

Type: fix
Ticket: VPP-1886
Fixes: 58db6e1

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Ic40018a756e57bfec05ffbc5e30d18f4feb315db
(cherry picked from commit 9b72b153d85d0e3e0ca218bcf1564805424b64b9)

fib: Safe adj walk

Type: fix

the hash walk does not give the same guarantees as the bihash so
walk in a safe manner.

Change-Id: Idfe48c3a84ab3a341d887f7d196bc81ba34ae8b0
Signed-off-by: Neale Ranns <nranns@cisco.com>
(cherry picked from commit 22391fa92b95ee0376eb372450d6315523c8a9ae)

ethernet: fix DMAC check and skip unnecessary ones (VPP-1868)

Fix and optimize DMAC check in ethernet-input node to utilize NIC or
driver which support L3 DMAC-filtering mode so that DMAC check can be
bypassed safely for interfaces/sub-interfaces in L3 mode.
Checking of interface in L3-DMAC-filtering state to avoid DMAC check
require the following:
a) Fix interface driver init sequence for devices which supports L3
   DMAC-filtering to indicate its capability and initialize interface
   to L3 DMAC-filtering state.
b) Fix ethernet_set_flags() function and its associated callback
   flags_change() functions registered by various drivers in interface
   infra to provide proper L3 DMAC filtering status.
Maintain interface/sub-interface L3 config count so DMAC checks can be
bypassed if L3 forwarding is not setup on any main/sub-interfaces.

Type: fix
Ticket: VPP-1868

Signed-off-by: John Lo <loj@cisco.com>
Change-Id: I204d90459c13e9e486cfcba4e64e3d479bc9f2ae
(cherry picked from commit 4a302ee7c75f3d4fd1a73a9d1f6c34b3bde8d620)

misc: 20.05 Release Notes

Change-Id: If68e419b00f8961c814727713f989fd0d72f6f1b
Type: docs
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

vppinfra: fix SIGBUS in bihash init when running unpriviledged, take two

Looks like MAP_LOCK is not enough, so call mlock(...) instead....

Type: fix
Change-Id: I1bc668a2bf3c861ca1c2d376c0fb6bfea87d4f48
Signed-off-by: Damjan Marion <damarion@cisco.com>

fib: IPv6 lookup data structure MP safe when prefixes change (VPP-1881)

Type: fix

adding routes should be MP safe. When new prefixes with differrent
prefix lengths are added, adjust the sorted list in an MP safe way.

Change-Id: Ib73a3c84d01eb86d17f8e79ea2bd2505dd9afb3d
Signed-off-by: Neale Ranns <nranns@cisco.com>

ipsec: Add/Del IPSec SA is not MP safe

Type: fix

we can probably do better, but for now this is needed

Signed-off-by: Neale Ranns <nranns@cisco.com>
Change-Id: I07161f5ac07a70a0e6db6608ba31659d9bc2c9ed

vcl: fix ldp fcntl64

Type: fix
Ticket: VPP-1882

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I342d8f928fcc7de74f9bd288c1a5d63ea1f90020
(cherry picked from commit 0ab36f55753d3d1417c41f8a3aec5e79a882555c)

misc: Avoid sample.md from in the VPP docs, clean up the extraneous copy

I had cleaned up the sample.md previously for 20.01, but when later
that was merged to master, the file was renamed. So, fix this issue.

Change-Id: I6347685af216901fbfdd445606735b9bf79f8fe5
Type: docs
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

fib: Fix interpose source reactivate

Type: fix

when the interpose is on an adj-fib and the cover is removed the adj
source will not install. this lead to no path list being found for the
interpose source and a crash. pick a drop path list in this case.

Signed-off-by: Neale Ranns <nranns@cisco.com>
Change-Id: Ied217da043926c913657080f5ffb151201225d23

fib: Use basic hash for adjacency neighbour table (VPP-1877)

Type: improvement

a bihash per-interface used too much memory.

Change-Id: I447bb66c0907e1632fa5d886a3600e518663c39e
Signed-off-by: Neale Ranns <nranns@cisco.com>
(cherry picked from commit 20aec3db441074ee5a861a40d6e02fad2f3dcb37)

ipsec: DES/3DES fixing the iv_len for openssl crypto

Type: fix

Signed-off-by: Rajesh Goel <rajegoel@cisco.com>
Change-Id: I8d128598b4c872f19b64c779c19b5908ba2f2c08
(cherry picked from commit d1d90f5951df93625594f1904cddd95880838ff0)

vcl: do not propagate epoll events if session closed

Type: fix
Ticket: VPP-1880

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I1e9652b476bbc07852b4e701a948c36a0d8c67fa

tcp: fix sack block validation on wrap

Type: fix
Fixes: 487507f
Ticket: VPP-1879

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Ia9813ae09d14111dc8edac0fa6ab082e13ab6e2e
(cherry picked from commit 3b9540966f877ae67d374cab334c31bd6e3f8c8b)

vppinfra: fix SIGBUS in bihash init when running unpriviledged

Obserbed when VPP is running in k8s container

Type: fix
Change-Id: Ibbff9c3921bd7f4f97d47cb6f10eed8ed5efe269
Signed-off-by: Damjan Marion <damarion@cisco.com>

ipsec: fixed chaining ops after add footer and icv

In case there is no free space in first buffer for ICV and footer,
additional buffer will be added, but esp_encrypt will stay in single
buffer mode.
The issue happens for the following payload sizes:
 - TCP packets with payload 1992
 - ICMP packets with payload 2004

This fix moves the single/chained buffer ops selection to after
esp_add_footer_and_icv call.

Type: fix

Signed-off-by: Fan Zhang <roy.fan.zhang@intel.com>
Signed-off-by: PiotrX Kleski <piotrx.kleski@intel.com>
Change-Id: Ic5ceba418f738933f96edb3e489ca2d149033b79
(cherry picked from commit fdca4dd1a1a817e65bf44e435261d893fc0c51d6)

srv6-mobile: Update the doc of 20.05 for gtp4.dt and gtp6.dt funcitons.

Document update to reflect merged SRv6 functions into 20.05 of lookup and forwarding for inner IP packet encapsulated with outer IP and GTP-U headers.

Type: docs

Signed-off-by: Satoru Matsushima <satoru.matsushima@gmail.com>
Change-Id: I85c9ddf6bf9fa63f2b8b6e03eff3ecec1e7615ab

ip: Dual loop error in midchain chksum

Type: fix

Change-Id: Idf7c80b7d81f796bd0512bca4276bcfcf2af241a
Signed-off-by: Neale Ranns <nranns@cisco.com>
(cherry picked from commit fc74697ed3b45499027b272332af786e8e7917bb)

nat: fix segv if out of ports in ed mode

Type: fix
Ticket: VPP-1870
Change-Id: Ife726d2f6baaa3516c209011183f39670cf6a55d
Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
(cherry picked from commit 88120824acc299a0aec17ce4c208dbc8be394779)

ip: fix interface ip address del sw_if_index check

Type: fix

Signed-off-by: Ye donggang <yedg@wangsu.com>
Change-Id: Ia9f72ff2be455ecd4ff3d16e884c5a50f9df69fe
(cherry picked from commit dbd366b239c0506b0d9984e7481967e038f10a23)

docs: asan: update doc to match current status

Type: docs

Change-Id: I45265876c9c778f6b91d39f30eb6035f14d166ec
Signed-off-by: Benoît Ganne <bganne@cisco.com>
(cherry picked from commit ca86c95a3413214110a03b001d45d018385b92dc)

dpdk: fix pktmbuf pool private data init

Type: fix

Change-Id: I7349840af48eec209532dab43a8ad0bd68993268
Signed-off-by: Benoît Ganne <bganne@cisco.com>
(cherry picked from commit c32a84c70efb45081568fc8aa5fa1884d74865fe)

lisp: API doc/comments cleanup

Removing the comments around eid_type which seem to have been overlooked
by the original patch https://gerrit.fd.io/r/c/vpp/+/24663.

NOTE: This patch is a doc-only change. It does two things:
    1. Remove comments around obsolete eid_type type
    2. Update the comments to reflect the new vl_api_eid_t type

This is to ensure correct documentation is displayed to user/reader of
VPP docs in 20.05.

Type: fix

Signed-off-by: Onong Tayeng <otayeng@cisco.com>
Change-Id: I48e1993cf8869cb32e159d1956f3ec1e5943e33f
(cherry picked from commit 4ab5190eb4167ac4c06cd649ec8a860784ab1d41)

interface: fix interface rx mode config API

Swap byte order for fields of type vl_api_rx_mode_t.

Ticket: VPP-1871
Type: fix

Signed-off-by: Jakub Grajciar <jgrajcia@cisco.com>
Change-Id: Ia1745257b57209d41661d38067e0dd7618f9a9b9
Signed-off-by: Jakub Grajciar <jgrajcia@cisco.com>
(cherry picked from commit aefcd1a3579ec2c93f606b151d563d87ea211387)

vcl: remove udpc transport

Type: refactor
Ticket: VPP-1875

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I145ff3301f168973c4f7f32c337bbcac47900705
(cherry picked from commit 3ca663e743dda703e76d8493a0c5cf13d7004c63)

tcp: fix bogus time update due to missing cast

Type: fix
Ticket: VPP-1874

Seems clang needs explicit casting to u64 of u64 and f64 multiplication
before truncating to u32

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Ib0d7a33d4c5e68577e401e854fc3e55e0723da93
(cherry picked from commit 17b5c3d6ab83a597e7c79613041f2fd7470825bd)

vcl svm: fix rx event loss

When vcl_epoll_wait_handle_mq handles rx events exceeding maxevents, VPP will not signal because cursize > 0, and the remaining rx events cannot be triggered because the eventfd event has been read. Therefore, we should dequeue all events until cursize = 0. And then handle msg up to maxevents with vcl_epoll_wait_handle_mq_event and those beyond with vcl_handle_mq_event.

Type: fix
Ticket: VPP-1873
Signed-off-by: hanlin <hanlin_wang@163.com>
Change-Id: I8a0c87cb41c837deb8284b40f668cc3c7d9d6e56
Signed-off-by: hanlin <hanlin_wang@163.com>
(cherry picked from commit d0e646f6892e9c85278c9538760a8940c86dcdbb)

docs: Add link to 20.05 test framework docs

Change-Id: I429a29a5cb1f311bec4361c758b14b51b0afc8aa
Type: docs
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

docs: Initial changes for stable/2005 branch

This patch adds an entry for the defaultbranch
    in .gitreview

Type: docs
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Change-Id: I6f78398d6c7779b52d64ad65285c0194f0849996

sr: fix srv6/srv6-ad/srv6-as promisc mode switch

Calling ethernet_set_flags() to switch interface to/from promiscuous
mode must use use hw_if_index instead of sw_if_index.

Type: fix

Signed-off-by: John Lo <loj@cisco.com>
Change-Id: I72da286b913893227e32193ee11fbbc56e04804d

gso: remove ordering dependency on esp-encrypt-tun

Type: fix

... it's not a feature anymore

Signed-off-by: Neale Ranns <nranns@cisco.com>
Change-Id: Ifbcaf7d832aa76336feb0556d0dc7d2002f19c35

nat: fix broken build

Type: fix
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Change-Id: I2a70db3a25450e014adaed84989f4da9bb77b14d

nat: fix LRU blocked by inactive session

This fixes a situation where long-lived inactive session blocks LRU
list. Solution is to have multiple LRU lists based on session type.
This helps because session timeout is same for all sessions of same
type.

Type: fix

Signed-off-by: Klement Sekera <ksekera@cisco.com>
Change-Id: I5e54b2aab73b23911d6518d42e8c3f166c69a38c

nat: perf improvement - replace branchy code

Use a lookup table instead.

Type: improvement
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Change-Id: Ia8461099828bb8824bf016201f135e6b69c444d1

dpdk: DPDK 20.05 iavf fdir bug-fix patch cherry pick

After VF reset, FDIR rule still takes effect. To solve the issue,
this patch adds to flush all flows before flow uninit. VIRTCHNL
sends message to PF by Admin Queue, so flow flush should be implemented
before Admin Queue shut down.

Type: fix

Signed-off-by: Chenmin Sun <chenmin.sun@intel.com>
Change-Id: I8ba0db7cd7646eaabd5745f74952016b0b968bbb

interface: fix the checksum offload in quad loop

Type: fix

In quad loop, checksum will be calculated for all four packets,
if one packet needs checksum computation, without respecting their
respective flags. This patch fixes it.

Change-Id: I479b420ba0dcbd178ea4180bf05a0e55a6b13843
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>

feature: Config end nodes are user specific

Type: fix

it is possible for a user to change the end node of a feature arc, but
this change should only apply to that 'instnace' of the arc, not all
arcs. for example, if a tunnel has its ipx-output end node changed to
adj-midchain-tx, this shouldn't affect all ipx-output arcs. obviously...

Signed-off-by: Neale Ranns <nranns@cisco.com>
Change-Id: I41daea7ba6907963e42140307d065c8bcfdcb585

bonding: fix the GSO flags

Type: fix

Only add GSO and Checksum offload flags when gso is
enabled.

Change-Id: I58945a4ffbb9a0e6a8640fc01424c63feef16306
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>

ipsec: Support 4o6 and 6o4 for SPD tunnel mode SAs

Type: feature

the es4-encrypt and esp6-encrypt nodes need to be siblings so they both have the same edges for the DPO on which the tunnel mode SA stacks.

Signed-off-by: Neale Ranns <nranns@cisco.com>
Change-Id: I2126589135a1df6c95ee14503dfde9ff406df60a

nat: handoff next node feature fix

Type: fix

Change-Id: I14e323e7bb1db7a3d40668212535c07504374e59
Signed-off-by: Filip Varga <fivarga@cisco.com>

ikev2: fix removing of expired SAs

Type: fix

Change-Id: Idf9b0ffb4e3a0113bece80d1195192bdf46feb89
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>

misc: remove useless assignment

Type: fix

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: I7708587804bc979fa9c46fb11f96d264821e2357

api: use malloc for rx thread arg instead of heap

Type: fix

Avoids issues if thread with non-zero __os_thread_index attaches to
binary api.

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Ib981f12c867fdee7590391ec43128145bb1abce6

vcl: de-init vcl on destroy

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: If3372e3edd403240c2c9da746246170549a3e644

tcp: avoid rcv wnd less than mss

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I84ec1c91a3a7b2195aad58923fa6f17f551444cb

lacp: missing endian conversions for trace packet format

Fix a couple endian conversions for displaying Marker Protocol packet
in the trace

Type: fix

Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: I746a67fb6143b5ad52bc4af9604ff8760dbdec9b

crypto-native: properly deal with broken or outdated toolchains

Avoids crash due to missing symbol, when build system detects toolchain
which is not able to produce binaries for all targets we need....

Type: fix

Change-Id: I77ee63cb8dca3c9e4e83a6235c60f1439a472444
Signed-off-by: Damjan Marion <damarion@cisco.com>

vlib: fix u64 error counter cli printing

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Ie35dc623394cfb6c358740361fd85aa0924ab187

ip-neighbor: fix show ip neighbor issue

Fix the issue that vppctl show ip4{6} neighbor [interface] command can't
show entries correctly, example: both ip4 and ip6 entries can be shown
with command:
vppctl show ip4 neighbor.

Type: fix

Signed-off-by: Michael Yu <michael.a.yu@nokia-sbell.com>
Change-Id: I229368b71cd285adce994c8290cc9d7e4c4f5aa6
Signed-off-by: Michael Yu <michael.a.yu@nokia-sbell.com>

ethernet: fix dmac stride error

Type: fix

Signed-off-by: Zhiyong Yang <zhiyong.yang@intel.com>
Change-Id: I617fb365def22a28d48f75013dea38f8e1703a44

vppapigen: api crc checker

crcchecker is a tool for enforcement of the binary API.

1. Production APIs should never change.
2. An API can be deprecated across three release cycles.
   Release 1: API is marked as deprecated.
   option deprecated="vyy.mm";
   option replaced_by="new_api_2";
   Release 2: both old and new APIs are supported
   Release 3: the deprecated API is deleted.
3. APIs that are experimental / not released are not checked.
   An API message can be individually marked as in progress, by:
   option status="in_progress";
   In the API definition.

The definition of a "production API" is if the major version in the API file is > 0.

extras/scripts/crcchecker.py --check-patchset # returns -1 if backwards incompatible
extras/scripts/crcchecker.py --dump-manifest
extras/scripts/crcchecker.py --git-revision v20.01 <files>
extras/scripts/crcchecker.py -- diff <oldfile> <newfile>

This patch integrates the tool in "make checkstyle-api".
A future patch is required to integrate the tool in the verify job.
I.e. this patch does not enable enforcement through Jenkins.

Change-Id: I5f13c0976d8a12a58131b3e270f2dc9c00dc7d8c
Type: feature
Signed-off-by: Ole Troan <ot@cisco.com>

gtpu: fix coverity issue

Fix coverity issue #210194 in gtpu-decap

Type: fix

Signed-off-by: Chenmin Sun <chenmin.sun@intel.com>
Change-Id: I5b172c8494527e7117c4e7e7083a8473165aa40f

build: reject merge conflict checkin attempts

Although attempts to build code containing merge conflict markers
USUALLY results in compile errors, this patch adds an explicit check
for the conflict end marker.

If for some unknown reason it's necessary to check in the text
'>>>>>>>', construct it by concatenation: ">>>"">>>>"
or '>>>' + '>>>>' depending on the language involved.

Type: improvement

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: Iaad2aa8b87a71137a3bb9a09f7f4159909bf79ab

docs: fix merge damage in nat.h

Type: fix
Fixes: b5a575b09

Signed-off-by: Dave Wallace <dwallacelf@gmail.com>
Change-Id: I22d35159a923075243df9760f1a74e2ca74e30e1

vppinfra: set explicit found in search_free_list loop

While https://gerrit.fd.io/r/c/vpp/+/26948 fixed avoid using -1 to
index into h->free_lists[b][l] by changing the loop counter, the
check for the value of the loop counter (l < 0) cannot be trusted
to decide whether we've found a large enough object within the bin
or not. When the loop is terminated, the value of the variable l
could be ambiguous if it equals to 0 and it is never less than 0,
ie, when we bail out of the loop, we don't know if it was due to the
breaking out of the condition in
  if ((s = f_size - size) >= 0)
     break;
or
  while (l > 0);

The fix is to explicitly set a variable when we have found a large enough
object inside the loop to be used to test whether the loop was prematurely
terminated (found == 1) or the loop just ran exhausted (found == 0)

Type: fix

Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: I0161813fbd44dcba8982a767eac2e0930e9d77e3

misc: add knob to generate compile_commands.json

Used for lanuguage servers like clangd and ccls

Type: improvement
Change-Id: I68d534dfa7b8ba3459fbd919d5ffccaa1fa1171e
Signed-off-by: Damjan Marion <damarion@cisco.com>

build: various improvements

- add option to install only host tools
- add option to specify lib and runtime dir

Type: improvement

Change-Id: I6356b52df459120fc9b0127948bae7679fb10e52
Signed-off-by: Damjan Marion <damarion@cisco.com>

ethernet: fix coverity warning

Type: fix
Ticket: VPP-1837

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: I20daa023eed50f8b42e8dc2d17e47a54aa16ae31

papi: use python3 for papi install

Breaks on Ubuntu 20.04 otherwise.

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I407215a03948d6e49152ee97099539bb625c12ef

nat: fix per thread data vlib_main_t usage take 2

The original fix access vlib_main before these was initialized.
Removed cached vlib_mains structure.

Type: fix
Fixes: 9bb09afb56b1aa787ca574cc732085272059fd5f
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I686bab9220e27891f66bf60489c1602855786aa8
Signed-off-by: Ole Troan <ot@cisco.com>

dpdk: fix compiling issue with clang

When building vpp image with below command, clang reports warnings/errors
on the unused option '-L', as it's not linking stage, and does not require
linking libraries.

In dpdk.mk, the linking library path should be attached to
DPDK_EXTRA_LDFLAGS, instead of DPDK_EXTRA_CFLAGS

$ make build-release CC=clang V=1

clang -Wp,-MD,./.ark_ddm.o.d.tmp  -fPIE -fPIC -pthread -I/root/origin/build-root/build-vpp-native/external/dpdk-20.02/lib/librte_eal/linux/eal/include  -march=armv8-a+crc -DRTE_MACHINE_CPUFLAG_NEON -DRTE_MACHINE_CPUFLAG_CRC32  -I/root/origin/build-root/build-vpp-native/external/dpdk-20.02/arm64-armv8a-linuxapp-clang/include -DRTE_USE_FUNCTION_VERSIONING -include /root/origin/build-root/build-vpp-native/external/dpdk-20.02/arm64-armv8a-linuxapp-clang/include/rte_config.h
-D_GNU_SOURCE -O3 -I./ -W -Wall -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wold-style-definition -Wpointer-arith -Wnested-externs -Wcast-qual -Wformat-nonliteral -Wformat-security -Wundef -Wwrite-strings -Wdeprecated -Wno-missing-field-initializers -Wno-address-of-packed-member -Werror   -g -mtune=generic -L/root/origin/build-root/install-vpp-native/external/lib -I/root/origin/build-root/install-vpp-native/external/include -o ark_ddm.o -c
/root/origin/build-root/build-vpp-native/external/dpdk-20.02/drivers/net/ark/ark_ddm.c
== Build drivers/vdpa/ifc
clang: warning: argument unused during compilation: '-L/root/origin/build-root/install-vpp-native/external/lib' [-Wunused-command-line-argument]
clang: error: argument unused during compilation: '-L/root/origin/build-root/install-vpp-native/external/lib' [-Werror,-Wunused-command-line-argument]

Type: fix

Change-Id: If8fd9b19d0aff9d3c27d77e78cd3064bb1ad6565
Signed-off-by: Lijian Zhang <Lijian.Zhang@arm.com>
Reviewed-by: Jieqiang Wang <Jieqiang.Wang@arm.com>
Reviewed-by: Govindarajan Mohandoss <Govindarajan.Mohandoss@arm.com>

vppinfra: fix u32x4_byte_swap on Arm

Fix the endianness conversion function u32x4_byte_swap() on Arm. Here's
an example of using this function with and without the fix.

This issue is seen using Mellanox NIC RDMA driver on Arm servers.
The packet length cannot be parsed correctly.

Testing code:
u32x4 s = {0x12345678, 0x23456789, 0x3456789a, 0x456789ab};
u32x4 ss = u32x4_byte_swap (s);

Without the code change:
(gdb) p /x s
$1 = {0x12345678, 0x23456789, 0x3456789a, 0x456789ab}
(gdb) p /x ss
$2 = {0x23456789, 0x12345678, 0x456789ab, 0x3456789a}

With the code change:
(gdb) p /x s
$3 = {0x12345678, 0x23456789, 0x3456789a, 0x456789ab}
(gdb) p /x ss
$4 = {0x78563412, 0x89674523, 0x9a785634, 0xab896745}

Type: fix

Change-Id: Ie5f263e94331783940e7c00397092a64e4fc4279
Signed-off-by: Lijian Zhang <Lijian.Zhang@arm.com>
Reviewed-by: Jieqiang Wang <Jieqiang.Wang@arm.com>
Reviewed-by: Govindarajan Mohandoss <Govindarajan.Mohandoss@arm.com>

vppinfra: loop counter off by 1 in search_free_list()

In search_free_list(), we have this do while loop.
do
  {
    l--;
    f_index = h->free_lists[b][l];
    f = elt_at (h, f_index);
    f_size = heap_elt_size (v, f);
    if ((s = f_size - size) >= 0)
      break;
  }
while (l >= 0);

When (l == 0), we still go back up to execute l--. Then l become -1. The
next statement is we index h->free_lists[b][-1]. After that, elt_at() would
probably cause a crash in the ASSERT.

Type: fix
Ticket: VPPSUPP-63

Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: I617d122aa221cfdfe38f8be50f4e0f0e76e11bb5

nat: remove duplicate line of code

Type: fix

Signed-off-by: Klement Sekera <ksekera@cisco.com>
Change-Id: I3c914d5c457df40205280ac589a2d353261343d5

nat: fix per thread data vlib_main_t usage

Type: fix

Change-Id: If6784c9eb278f525e05304d10fd1a00641faaaf0
Signed-off-by: Filip Varga <fivarga@cisco.com>

misc: deprecate elftool

Type: make

Change-Id: I34fec1c40ef660177c266517eaf41d60827609f4
Signed-off-by: Damjan Marion <damarion@cisco.com>

session: catch segment manager alloc failure

Type: improvement

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I4ac923fda84feee8d2ad76d0c3e3a252f53008ed

lacp: fix regarding vm arg for vlib_time_now calls

Use thread-specific vlib_main_t *vm pointers to avoid problems with
different threads accessing the same vlib_main_t data structure.
This avoids assertion failure when vlib_time_now() is called with a vm
corresponding to a different thread.

Type: fix

Signed-off-by: Elias Rudberg <elias.rudberg@bahnhof.net>
Change-Id: I359596ecff86e03d57aa8d2330f77bf9a913485f

rdma: fix alignment issue

Type: fix

Change-Id: I0ff7a6f3354066c2252c1ebd0d43ac59db278bf0
Signed-off-by: Damjan Marion <damarion@cisco.com>
Signed-off-by: Elias Rudberg <elias.rudberg@bahnhof.net>

docs: clean up make docs job

Type: docs

Change-Id: I9b5e5137eb4c1e89f6e8d7a278cd11a0fd496471
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

vppinfra: add timer wheel section to Sphinx docs

Type: docs

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: Id0576d98b8e78cf4cd00161968d3eb6dbd58055a

crypto: fix coverity issues

Fix coverity issues in crypto framework and cryptodev
engine.

Type: fix

Signed-off-by: Fan Zhang <roy.fan.zhang@intel.com>
Change-Id: Ib261da0163c8182c803600db22c5a6dad5a19999

misc: fix coverity warnings

Type: fix
Ticket: VPP-1837

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: I51660e4b02f449bd2db12a8cfd395c6c343d2dee

rdma: fix clang build

Type: fix

Change-Id: I9b613f0af484f601dd20a851e2f59ee5e06b5c37
Signed-off-by: Benoît Ganne <bganne@cisco.com>

misc: fts add support for non-ascii author names in yaml

Type: fix

Change-Id: I3f034ca86412b58d3e41a627bd8902157683435a
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>