diff options
| author | itojun <itojun@NetBSD.org> | 2000-08-29 09:08:42 +0000 |
|---|---|---|
| committer | itojun <itojun@NetBSD.org> | 2000-08-29 09:08:42 +0000 |
| commit | bb8d535cc58e4828b4e1943d27466c8a4e34689b (patch) | |
| tree | 87a4daa8861c468f9496f7c8483df1556e1958bc /sys/netinet6/esp_input.c | |
| parent | 25147761ffccb7182b49e0f440ad25cb2e7ed233 (diff) | |
use per-block cipher function + esp_cbc_{de,en}crypt. do not use
cbc-over-mbuf functions in sys/crypto.
the change should make it much easier to switch crypto function to
machine-dependent ones (like assembly code under sys/arch/i386/crypto?).
also it should be much easier to import AES algorithms.
XXX: it looks that past blowfish-cbc code was buggy. i ran some test pattern,
and new blowfish-cbc code looks more correct. there's no interoperability
between the old code (before the commit) and the new code (after the commit).
XXX: need serious interop tests before move it into 1.5 branch
Diffstat (limited to 'sys/netinet6/esp_input.c')
| -rw-r--r-- | sys/netinet6/esp_input.c | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/sys/netinet6/esp_input.c b/sys/netinet6/esp_input.c index 9344d49fef9..55084a1a5e5 100644 --- a/sys/netinet6/esp_input.c +++ b/sys/netinet6/esp_input.c @@ -1,5 +1,5 @@ -/* $NetBSD: esp_input.c,v 1.5 2000/08/16 09:54:39 itojun Exp $ */ -/* $KAME: esp_input.c,v 1.28 2000/07/30 04:28:55 itojun Exp $ */ +/* $NetBSD: esp_input.c,v 1.6 2000/08/29 09:08:43 itojun Exp $ */ +/* $KAME: esp_input.c,v 1.31 2000/08/27 12:11:37 itojun Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -315,8 +315,10 @@ noreplaycheck: if (!algo->decrypt) panic("internal error: no decrypt function"); if ((*algo->decrypt)(m, off, sav, algo, ivlen)) { - ipseclog((LOG_ERR, "decrypt fail in IPv4 ESP input: %s %s\n", - ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav))); + /* m is already freed */ + m = NULL; + ipseclog((LOG_ERR, "decrypt fail in IPv4 ESP input: %s\n", + ipsec_logsastr(sav))); ipsecstat.in_inval++; goto bad; } @@ -678,8 +680,10 @@ noreplaycheck: if (!algo->decrypt) panic("internal error: no decrypt function"); if ((*algo->decrypt)(m, off, sav, algo, ivlen)) { - ipseclog((LOG_ERR, "decrypt fail in IPv6 ESP input: %s %s\n", - ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav))); + /* m is already freed */ + m = NULL; + ipseclog((LOG_ERR, "decrypt fail in IPv6 ESP input: %s\n", + ipsec_logsastr(sav))); ipsec6stat.in_inval++; goto bad; } |
