[PATCH 08/18] pipeline: use secure random for IPsec salt

[Stephen Hemminger]

The salt for AES-CBC and 3DES-CBC was generated with rte_rand().
Unlike the other cipher cases, where the salt comes from the key
material supplied by the application, this value is generated
internally and ends up in the IPsec transform.

rte_rand() is a fast pseudo-random generator whose state can be
recovered from a few outputs, so use rte_random_bytes() instead.

Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
---
 lib/pipeline/rte_swx_ipsec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/pipeline/rte_swx_ipsec.c b/lib/pipeline/rte_swx_ipsec.c
index 553056fad2..9959009aab 100644
--- a/lib/pipeline/rte_swx_ipsec.c
+++ b/lib/pipeline/rte_swx_ipsec.c
@@ -1460,7 +1460,8 @@ crypto_xform_get(struct rte_swx_ipsec_sa_params *p,
 		switch (p->crypto.cipher_auth.cipher.alg) {
 		case RTE_CRYPTO_CIPHER_AES_CBC:
 		case RTE_CRYPTO_CIPHER_3DES_CBC:
-			salt = rte_rand();
+			if (rte_random_bytes(&salt, sizeof(salt)) != 0)
+				return NULL;
 			break;
 
 		case RTE_CRYPTO_CIPHER_AES_CTR:
-- 
2.53.0