[PATCH v2] common/cpt: use timing-safe digest comparison

compl_auth_verify() compared the generated and received MAC with
memcmp(), which returns early on the first differing byte and leaks
the number of matching leading bytes through timing.

Use rte_memeq_timingsafe() for the verify comparison.

Bugzilla ID: 1773

Signed-off-by: Rupesh Chiluka <[email protected]>
---
v2:
  - dropped salt and MAC address patches (comparisons operate on
    non-secret data; timing-safe compare unnecessary)

 drivers/common/cpt/cpt_ucode.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/common/cpt/cpt_ucode.h b/drivers/common/cpt/cpt_ucode.h
index 636f93604e..a6ecbaf429 100644
--- a/drivers/common/cpt/cpt_ucode.h
+++ b/drivers/common/cpt/cpt_ucode.h
@@ -3354,10 +3354,10 @@ compl_auth_verify(struct rte_crypto_op *op,
 		return;
 	}
 
-	if (memcmp(mac, gen_mac, mac_len))
-		op->status = RTE_CRYPTO_OP_STATUS_AUTH_FAILED;
-	else
+	if (rte_memeq_timingsafe(mac, gen_mac, mac_len))
 		op->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
+	else
+		op->status = RTE_CRYPTO_OP_STATUS_AUTH_FAILED;
 }
 
 static __rte_always_inline void
-- 
2.48.1