diff options
author | Luiz Otavio O Souza <luiz@netgate.com> | 2016-05-11 12:51:39 -0500 |
---|---|---|
committer | Luiz Otavio O Souza <luiz@netgate.com> | 2016-05-11 17:02:14 -0500 |
commit | c23a05e2de0834d542caafe185dcb440b47051a5 (patch) | |
tree | fa605b5c497769f2108dc69e590f13b7aa2b175d | |
parent | 3e1742ed6cd844d82787f2fa5cd57652805c6b34 (diff) | |
download | FreeBSD-src-c23a05e2de0834d542caafe185dcb440b47051a5.zip FreeBSD-src-c23a05e2de0834d542caafe185dcb440b47051a5.tar.gz |
MFC r290924:
Use explicitly specified ivsize instead of blocksize when we mean IV size.
Set zero ivsize for enc_xform_null and remove special handling from
xform_esp.c.
Reviewed by: gnn
Differential Revision: https://reviews.freebsd.org/D1503
TAG: IPSEC-HEAD
-rw-r--r-- | sys/netipsec/key.c | 2 | ||||
-rw-r--r-- | sys/netipsec/xform_esp.c | 8 | ||||
-rw-r--r-- | sys/opencrypto/xform.c | 2 |
3 files changed, 3 insertions, 9 deletions
diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c index 2920fbb..3f7ea10 100644 --- a/sys/netipsec/key.c +++ b/sys/netipsec/key.c @@ -6705,7 +6705,7 @@ key_register(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) continue; alg = (struct sadb_alg *)(mtod(n, caddr_t) + off); alg->sadb_alg_id = i; - alg->sadb_alg_ivlen = ealgo->blocksize; + alg->sadb_alg_ivlen = ealgo->ivsize; alg->sadb_alg_minbits = _BITS(ealgo->minkey); alg->sadb_alg_maxbits = _BITS(ealgo->maxkey); off += PFKEY_ALIGN8(sizeof(struct sadb_alg)); diff --git a/sys/netipsec/xform_esp.c b/sys/netipsec/xform_esp.c index 694545d..982a7a3 100644 --- a/sys/netipsec/xform_esp.c +++ b/sys/netipsec/xform_esp.c @@ -199,16 +199,10 @@ esp_init(struct secasvar *sav, struct xformsw *xsp) return EINVAL; } - /* - * NB: The null xform needs a non-zero blocksize to keep the - * crypto code happy but if we use it to set ivlen then - * the ESP header will be processed incorrectly. The - * compromise is to force it to zero here. - */ if (SAV_ISCTRORGCM(sav)) sav->ivlen = 8; /* RFC4106 3.1 and RFC3686 3.1 */ else - sav->ivlen = (txform == &enc_xform_null ? 0 : txform->ivsize); + sav->ivlen = txform->ivsize; /* * Setup AH-related state. diff --git a/sys/opencrypto/xform.c b/sys/opencrypto/xform.c index cb44bfa..3dee366 100644 --- a/sys/opencrypto/xform.c +++ b/sys/opencrypto/xform.c @@ -154,7 +154,7 @@ MALLOC_DEFINE(M_XDATA, "xform", "xform data buffers"); struct enc_xform enc_xform_null = { CRYPTO_NULL_CBC, "NULL", /* NB: blocksize of 4 is to generate a properly aligned ESP header */ - NULL_BLOCK_LEN, NULL_BLOCK_LEN, NULL_MIN_KEY, NULL_MAX_KEY, + NULL_BLOCK_LEN, 0, NULL_MIN_KEY, NULL_MAX_KEY, null_encrypt, null_decrypt, null_setkey, |