Module Name: src
Committed By: maxv
Date: Thu May 31 06:14:18 UTC 2018
Modified Files:
src/sys/netipsec: xform_esp.c
Log Message:
Add a comment and a KASSERT. I remember wondering whether this check was a
problem, since ARC4 has a blocksize of one. Normally ARC4 can't be used in
IPsec.
To generate a diff of this commit:
cvs rdiff -u -r1.95 -r1.96 src/sys/netipsec/xform_esp.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/netipsec/xform_esp.c
diff -u src/sys/netipsec/xform_esp.c:1.95 src/sys/netipsec/xform_esp.c:1.96
--- src/sys/netipsec/xform_esp.c:1.95 Thu May 31 05:52:09 2018
+++ src/sys/netipsec/xform_esp.c Thu May 31 06:14:18 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: xform_esp.c,v 1.95 2018/05/31 05:52:09 maxv Exp $ */
+/* $NetBSD: xform_esp.c,v 1.96 2018/05/31 06:14:18 maxv Exp $ */
/* $FreeBSD: xform_esp.c,v 1.2.2.1 2003/01/24 05:11:36 sam Exp $ */
/* $OpenBSD: ip_esp.c,v 1.69 2001/06/26 06:18:59 angelos Exp $ */
@@ -39,7 +39,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.95 2018/05/31 05:52:09 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.96 2018/05/31 06:14:18 maxv Exp $");
#if defined(_KERNEL_OPT)
#include "opt_inet.h"
@@ -337,14 +337,14 @@ esp_input(struct mbuf *m, struct secasva
alen = esph ? esph->authsize : 0;
/*
- * Verify payload length is multiple of encryption algorithm
- * block size.
+ * Verify payload length is multiple of encryption algorithm block
+ * size.
*
- * NB: This works for the null algorithm because the blocksize
- * is 4 and all packets must be 4-byte aligned regardless
- * of the algorithm.
+ * The payload must also be 4-byte-aligned. This is implicitly
+ * verified here too, since the blocksize is always 4-byte-aligned.
*/
plen = m->m_pkthdr.len - (skip + hlen + alen);
+ KASSERT((espx->blocksize & 3) == 0);
if ((plen & (espx->blocksize - 1)) || (plen <= 0)) {
char buf[IPSEC_ADDRSTRLEN];
DPRINTF(("%s: payload of %d octets not a multiple of %d octets,"
