Skip to content

Conversation

@sever-sever
Copy link
Member

Change Summary

VPP was incorrectly identifying AES-GCM-256 IPsec SAs as AES-GCM-128,
causing a cryptographic key material mismatch with peer implementations
like StrongSwan. This resulted in encryption/decryption failures and
non-functional IPsec tunnels.

Root cause: The libnl xfrmnl_sa_get_aead_params() function reports only
the cipher key length (e.g., 128 bits for what should be AES-GCM-256)
in the aead_key_len parameter, while extracting the full key material
including padding into the key buffer (46 bytes instead of the expected 36).

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes)
  • Other (please describe):

Related Task(s)

Related PR(s)

Proposed changes

How to test

Checklist:

  • I have read the CONTRIBUTING document
  • I have linked this PR to one or more Phabricator Task(s)
  • My commit headlines contain a valid Task id
  • My change requires a change to the documentation
  • I have updated the documentation accordingly

@sever-sever sever-sever merged commit dd1fca3 into current Oct 27, 2025
1 check passed
@vyosbot vyosbot added mirror-initiated This PR initiated for mirror sync workflow mirror-completed This PR has been mirrored successfully and removed mirror-initiated This PR initiated for mirror sync workflow labels Oct 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

mirror-completed This PR has been mirrored successfully

Development

Successfully merging this pull request may close these issues.

3 participants