From owner-svn-src-all@freebsd.org Wed Jul 29 17:23:21 2015 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 880B19AE472; Wed, 29 Jul 2015 17:23:21 +0000 (UTC) (envelope-from ermal.luci@gmail.com) Received: from mail-yk0-x22f.google.com (mail-yk0-x22f.google.com [IPv6:2607:f8b0:4002:c07::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 3F6D0FA4; Wed, 29 Jul 2015 17:23:21 +0000 (UTC) (envelope-from ermal.luci@gmail.com) Received: by ykba194 with SMTP id a194so13665301ykb.0; Wed, 29 Jul 2015 10:23:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=o3rfOeQCBgK8YhQbKC/HqowXlO5swI9eXVndo6IoWT8=; b=LDAOl69ecm0GWocyo9K5hvQVY1kPImNI/JeknDTpjg6x1lLMbrD/DPXak+y49bYcyE 6LDicvCXQnnJVHZJ0N6pmj5tpQFaxK+tnfFqNzLMdSegH4wgr9D9UkmY4NOsBDXFbPw8 VOYt3C3wRb65ekBy5SopyYJmuDT124Z+f+/czv/RDfoIdEi83gozJ7B3L3W6JyXG8aOz q8QpBrzzKRGvM1TCGC10Ra+oEn8tjsgwtiTzwuoyAP8L5CsXxjXpCW37BdhXuaOi6URG xZbgMDjxAn/twJ2ySiUQL55wpeKauWq0GptPUGNI0j5ibvkyxzGlJIC8zIfYYG/4TIB1 aP+A== MIME-Version: 1.0 X-Received: by 10.170.150.7 with SMTP id r7mr45845759ykc.48.1438190600227; Wed, 29 Jul 2015 10:23:20 -0700 (PDT) Sender: ermal.luci@gmail.com Received: by 10.129.83.139 with HTTP; Wed, 29 Jul 2015 10:23:20 -0700 (PDT) In-Reply-To: <20150729154036.GG78154@funkthat.com> References: <201507290715.t6T7FHGb094456@repo.freebsd.org> <20150729154036.GG78154@funkthat.com> Date: Wed, 29 Jul 2015 19:23:20 +0200 X-Google-Sender-Auth: LgyKWPwELnSzmEQYN-398X_PHbI Message-ID: Subject: Re: svn commit: r286000 - head/sys/netipsec From: =?UTF-8?Q?Ermal_Lu=C3=A7i?= To: John-Mark Gurney Cc: George Neville-Neil , src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2015 17:23:21 -0000 On Wed, Jul 29, 2015 at 5:40 PM, John-Mark Gurney wrote: > Ermal Lui wrote this message on Wed, Jul 29, 2015 at 14:53 +0200: > > this was forgotten part on my patches merge from gnn@. > > Can it be fixed by correcting the patches rather than re-introducing > this? > > > > Most probably the constant definition is wrong on the transforms and also > > some part of code removal was missed. > > No, it cannot be fixed by changing opencrypto/xform.c to truncate the > hash size... The reason it cannot be is that OCF is not an IPsec only > framework... > > Geli also uses the HMAC constructions, and I have not confirmed if they > use the full hash size or not... I would be open to adding a field to > the crypto descriptor that limited how much of the hash is copied out... > > It would have been helpful to comment more of these changes... If you > make a change for a reason (RFC, etc), then throw that in the comments, > which allows someone following to understand why and prevent their > removal... At least if they were commented as to why they changed, we > would have known to rework the change... > > Yes you are right but according to me this is standard practice being done allover SSL/IPSec.... I am not sure which standard GELI follows to comment on that! Also then it would be better to review the declarations on the transform since they are apparently not generic, no? > > On Wed, Jul 29, 2015 at 9:15 AM, John-Mark Gurney > wrote: > > > > > Author: jmg > > > Date: Wed Jul 29 07:15:16 2015 > > > New Revision: 286000 > > > URL: https://svnweb.freebsd.org/changeset/base/286000 > > > > > > Log: > > > RFC4868 section 2.3 requires that the output be half... This fixes > > > problems that was introduced in r285336... I have verified that > > > HMAC-SHA2-256 both ah only and w/ AES-CBC interoperate w/ a NetBSD > > > 6.1.5 vm... > > > > > > Reviewed by: gnn > > -- > John-Mark Gurney Voice: +1 415 225 5579 > > "All that I will do, has been done, All that I have, has not." > -- Ermal