summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLuiz Otavio O Souza <luiz@netgate.com>2016-05-11 12:51:39 -0500
committerLuiz Otavio O Souza <luiz@netgate.com>2016-05-12 10:59:59 -0500
commiteaaca999d480adab78b944fb5b4822c14ab4778f (patch)
treedc479c0ed2f7c85d0b542384bf0a354ce4d85134
parentb2fbeb687ab88416fde1db788240cd4694bf340b (diff)
downloadFreeBSD-src-eaaca999d480adab78b944fb5b4822c14ab4778f.zip
FreeBSD-src-eaaca999d480adab78b944fb5b4822c14ab4778f.tar.gz
MFC r290924:
Use explicitly specified ivsize instead of blocksize when we mean IV size. Set zero ivsize for enc_xform_null and remove special handling from xform_esp.c. Reviewed by: gnn Differential Revision: https://reviews.freebsd.org/D1503 TAG: IPSEC-HEAD (cherry picked from commit c23a05e2de0834d542caafe185dcb440b47051a5)
-rw-r--r--sys/netipsec/key.c2
-rw-r--r--sys/netipsec/xform_esp.c8
-rw-r--r--sys/opencrypto/xform.c2
3 files changed, 3 insertions, 9 deletions
diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c
index 7705a63..e648a9f 100644
--- a/sys/netipsec/key.c
+++ b/sys/netipsec/key.c
@@ -6705,7 +6705,7 @@ key_register(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
continue;
alg = (struct sadb_alg *)(mtod(n, caddr_t) + off);
alg->sadb_alg_id = i;
- alg->sadb_alg_ivlen = ealgo->blocksize;
+ alg->sadb_alg_ivlen = ealgo->ivsize;
alg->sadb_alg_minbits = _BITS(ealgo->minkey);
alg->sadb_alg_maxbits = _BITS(ealgo->maxkey);
off += PFKEY_ALIGN8(sizeof(struct sadb_alg));
diff --git a/sys/netipsec/xform_esp.c b/sys/netipsec/xform_esp.c
index 694545d..982a7a3 100644
--- a/sys/netipsec/xform_esp.c
+++ b/sys/netipsec/xform_esp.c
@@ -199,16 +199,10 @@ esp_init(struct secasvar *sav, struct xformsw *xsp)
return EINVAL;
}
- /*
- * NB: The null xform needs a non-zero blocksize to keep the
- * crypto code happy but if we use it to set ivlen then
- * the ESP header will be processed incorrectly. The
- * compromise is to force it to zero here.
- */
if (SAV_ISCTRORGCM(sav))
sav->ivlen = 8; /* RFC4106 3.1 and RFC3686 3.1 */
else
- sav->ivlen = (txform == &enc_xform_null ? 0 : txform->ivsize);
+ sav->ivlen = txform->ivsize;
/*
* Setup AH-related state.
diff --git a/sys/opencrypto/xform.c b/sys/opencrypto/xform.c
index cb44bfa..3dee366 100644
--- a/sys/opencrypto/xform.c
+++ b/sys/opencrypto/xform.c
@@ -154,7 +154,7 @@ MALLOC_DEFINE(M_XDATA, "xform", "xform data buffers");
struct enc_xform enc_xform_null = {
CRYPTO_NULL_CBC, "NULL",
/* NB: blocksize of 4 is to generate a properly aligned ESP header */
- NULL_BLOCK_LEN, NULL_BLOCK_LEN, NULL_MIN_KEY, NULL_MAX_KEY,
+ NULL_BLOCK_LEN, 0, NULL_MIN_KEY, NULL_MAX_KEY,
null_encrypt,
null_decrypt,
null_setkey,
OpenPOWER on IntegriCloud