From owner-svn-src-head@freebsd.org Mon Nov 16 07:10:44 2015 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 60FE5A30BEF; Mon, 16 Nov 2015 07:10:44 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 0FC9B15B5; Mon, 16 Nov 2015 07:10:43 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id tAG7Ahvm082298; Mon, 16 Nov 2015 07:10:43 GMT (envelope-from ae@FreeBSD.org) Received: (from ae@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id tAG7AgJO082295; Mon, 16 Nov 2015 07:10:42 GMT (envelope-from ae@FreeBSD.org) Message-Id: <201511160710.tAG7AgJO082295@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: ae set sender to ae@FreeBSD.org using -f From: "Andrey V. Elsukov" Date: Mon, 16 Nov 2015 07:10:42 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r290924 - in head/sys: netipsec opencrypto X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Nov 2015 07:10:44 -0000 Author: ae Date: Mon Nov 16 07:10:42 2015 New Revision: 290924 URL: https://svnweb.freebsd.org/changeset/base/290924 Log: Use explicitly specified ivsize instead of blocksize when we mean IV size. Set zero ivsize for enc_xform_null and remove special handling from xform_esp.c. Reviewed by: gnn Differential Revision: https://reviews.freebsd.org/D1503 Modified: head/sys/netipsec/key.c head/sys/netipsec/xform_esp.c head/sys/opencrypto/xform.c Modified: head/sys/netipsec/key.c ============================================================================== --- head/sys/netipsec/key.c Mon Nov 16 07:03:00 2015 (r290923) +++ head/sys/netipsec/key.c Mon Nov 16 07:10:42 2015 (r290924) @@ -6706,7 +6706,7 @@ key_register(struct socket *so, struct m continue; alg = (struct sadb_alg *)(mtod(n, caddr_t) + off); alg->sadb_alg_id = i; - alg->sadb_alg_ivlen = ealgo->blocksize; + alg->sadb_alg_ivlen = ealgo->ivsize; alg->sadb_alg_minbits = _BITS(ealgo->minkey); alg->sadb_alg_maxbits = _BITS(ealgo->maxkey); off += PFKEY_ALIGN8(sizeof(struct sadb_alg)); Modified: head/sys/netipsec/xform_esp.c ============================================================================== --- head/sys/netipsec/xform_esp.c Mon Nov 16 07:03:00 2015 (r290923) +++ head/sys/netipsec/xform_esp.c Mon Nov 16 07:10:42 2015 (r290924) @@ -200,16 +200,10 @@ esp_init(struct secasvar *sav, struct xf return EINVAL; } - /* - * NB: The null xform needs a non-zero blocksize to keep the - * crypto code happy but if we use it to set ivlen then - * the ESP header will be processed incorrectly. The - * compromise is to force it to zero here. - */ if (SAV_ISCTRORGCM(sav)) sav->ivlen = 8; /* RFC4106 3.1 and RFC3686 3.1 */ else - sav->ivlen = (txform == &enc_xform_null ? 0 : txform->ivsize); + sav->ivlen = txform->ivsize; /* * Setup AH-related state. Modified: head/sys/opencrypto/xform.c ============================================================================== --- head/sys/opencrypto/xform.c Mon Nov 16 07:03:00 2015 (r290923) +++ head/sys/opencrypto/xform.c Mon Nov 16 07:10:42 2015 (r290924) @@ -154,7 +154,7 @@ MALLOC_DEFINE(M_XDATA, "xform", "xform d struct enc_xform enc_xform_null = { CRYPTO_NULL_CBC, "NULL", /* NB: blocksize of 4 is to generate a properly aligned ESP header */ - NULL_BLOCK_LEN, NULL_BLOCK_LEN, NULL_MIN_KEY, NULL_MAX_KEY, + NULL_BLOCK_LEN, 0, NULL_MIN_KEY, NULL_MAX_KEY, null_encrypt, null_decrypt, null_setkey,