summaryrefslogtreecommitdiff
path: root/sys/netinet6/esp_input.c
diff options
context:
space:
mode:
authoritojun <itojun@NetBSD.org>2000-08-29 09:08:42 +0000
committeritojun <itojun@NetBSD.org>2000-08-29 09:08:42 +0000
commitbb8d535cc58e4828b4e1943d27466c8a4e34689b (patch)
tree87a4daa8861c468f9496f7c8483df1556e1958bc /sys/netinet6/esp_input.c
parent25147761ffccb7182b49e0f440ad25cb2e7ed233 (diff)
use per-block cipher function + esp_cbc_{de,en}crypt. do not use
cbc-over-mbuf functions in sys/crypto. the change should make it much easier to switch crypto function to machine-dependent ones (like assembly code under sys/arch/i386/crypto?). also it should be much easier to import AES algorithms. XXX: it looks that past blowfish-cbc code was buggy. i ran some test pattern, and new blowfish-cbc code looks more correct. there's no interoperability between the old code (before the commit) and the new code (after the commit). XXX: need serious interop tests before move it into 1.5 branch
Diffstat (limited to 'sys/netinet6/esp_input.c')
-rw-r--r--sys/netinet6/esp_input.c16
1 files changed, 10 insertions, 6 deletions
diff --git a/sys/netinet6/esp_input.c b/sys/netinet6/esp_input.c
index 9344d49fef9..55084a1a5e5 100644
--- a/sys/netinet6/esp_input.c
+++ b/sys/netinet6/esp_input.c
@@ -1,5 +1,5 @@
-/* $NetBSD: esp_input.c,v 1.5 2000/08/16 09:54:39 itojun Exp $ */
-/* $KAME: esp_input.c,v 1.28 2000/07/30 04:28:55 itojun Exp $ */
+/* $NetBSD: esp_input.c,v 1.6 2000/08/29 09:08:43 itojun Exp $ */
+/* $KAME: esp_input.c,v 1.31 2000/08/27 12:11:37 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -315,8 +315,10 @@ noreplaycheck:
if (!algo->decrypt)
panic("internal error: no decrypt function");
if ((*algo->decrypt)(m, off, sav, algo, ivlen)) {
- ipseclog((LOG_ERR, "decrypt fail in IPv4 ESP input: %s %s\n",
- ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
+ /* m is already freed */
+ m = NULL;
+ ipseclog((LOG_ERR, "decrypt fail in IPv4 ESP input: %s\n",
+ ipsec_logsastr(sav)));
ipsecstat.in_inval++;
goto bad;
}
@@ -678,8 +680,10 @@ noreplaycheck:
if (!algo->decrypt)
panic("internal error: no decrypt function");
if ((*algo->decrypt)(m, off, sav, algo, ivlen)) {
- ipseclog((LOG_ERR, "decrypt fail in IPv6 ESP input: %s %s\n",
- ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
+ /* m is already freed */
+ m = NULL;
+ ipseclog((LOG_ERR, "decrypt fail in IPv6 ESP input: %s\n",
+ ipsec_logsastr(sav)));
ipsec6stat.in_inval++;
goto bad;
}