Deleted Added
sdiff udiff text old ( 286101 ) new ( 286292 )
full compact
xform_esp.c (286101) xform_esp.c (286292)
1/* $FreeBSD: head/sys/netipsec/xform_esp.c 286101 2015-07-31 00:31:52Z jmg $ */
1/* $FreeBSD: head/sys/netipsec/xform_esp.c 286292 2015-08-04 17:47:11Z jmg $ */
2/* $OpenBSD: ip_esp.c,v 1.69 2001/06/26 06:18:59 angelos Exp $ */
3/*-
4 * The authors of this code are John Ioannidis (ji@tla.org),
5 * Angelos D. Keromytis (kermit@csd.uch.gr) and
6 * Niels Provos (provos@physnet.uni-hamburg.de).
7 *
8 * The original version of this code was written by John Ioannidis
9 * for BSD/OS in Athens, Greece, in November 1995.

--- 33 unchanged lines hidden (view full) ---

43#include <sys/mbuf.h>
44#include <sys/socket.h>
45#include <sys/syslog.h>
46#include <sys/kernel.h>
47#include <sys/lock.h>
48#include <sys/random.h>
49#include <sys/rwlock.h>
50#include <sys/sysctl.h>
2/* $OpenBSD: ip_esp.c,v 1.69 2001/06/26 06:18:59 angelos Exp $ */
3/*-
4 * The authors of this code are John Ioannidis (ji@tla.org),
5 * Angelos D. Keromytis (kermit@csd.uch.gr) and
6 * Niels Provos (provos@physnet.uni-hamburg.de).
7 *
8 * The original version of this code was written by John Ioannidis
9 * for BSD/OS in Athens, Greece, in November 1995.

--- 33 unchanged lines hidden (view full) ---

43#include <sys/mbuf.h>
44#include <sys/socket.h>
45#include <sys/syslog.h>
46#include <sys/kernel.h>
47#include <sys/lock.h>
48#include <sys/random.h>
49#include <sys/rwlock.h>
50#include <sys/sysctl.h>
51#include <sys/mutex.h>
52#include <machine/atomic.h>
51
52#include <net/if.h>
53#include <net/vnet.h>
54
55#include <netinet/in.h>
56#include <netinet/in_systm.h>
57#include <netinet/ip.h>
58#include <netinet/ip_ecn.h>

--- 118 unchanged lines hidden (view full) ---

177 __func__, sav->alg_enc));
178 return EINVAL;
179 }
180 if (sav->key_enc == NULL) {
181 DPRINTF(("%s: no encoding key for %s algorithm\n",
182 __func__, txform->name));
183 return EINVAL;
184 }
53
54#include <net/if.h>
55#include <net/vnet.h>
56
57#include <netinet/in.h>
58#include <netinet/in_systm.h>
59#include <netinet/ip.h>
60#include <netinet/ip_ecn.h>

--- 118 unchanged lines hidden (view full) ---

179 __func__, sav->alg_enc));
180 return EINVAL;
181 }
182 if (sav->key_enc == NULL) {
183 DPRINTF(("%s: no encoding key for %s algorithm\n",
184 __func__, txform->name));
185 return EINVAL;
186 }
185 if ((sav->flags&(SADB_X_EXT_OLD|SADB_X_EXT_IV4B)) == SADB_X_EXT_IV4B) {
187 if ((sav->flags & (SADB_X_EXT_OLD | SADB_X_EXT_IV4B)) ==
188 SADB_X_EXT_IV4B) {
186 DPRINTF(("%s: 4-byte IV not supported with protocol\n",
187 __func__));
188 return EINVAL;
189 }
189 DPRINTF(("%s: 4-byte IV not supported with protocol\n",
190 __func__));
191 return EINVAL;
192 }
190 keylen = _KEYLEN(sav->key_enc);
193 /* subtract off the salt, RFC4106, 8.1 and RFC3686, 5.1 */
194 keylen = _KEYLEN(sav->key_enc) - SAV_ISCTRORGCM(sav) * 4;
191 if (txform->minkey > keylen || keylen > txform->maxkey) {
192 DPRINTF(("%s: invalid key length %u, must be in the range "
193 "[%u..%u] for algorithm %s\n", __func__,
194 keylen, txform->minkey, txform->maxkey,
195 txform->name));
196 return EINVAL;
197 }
198
199 /*
200 * NB: The null xform needs a non-zero blocksize to keep the
201 * crypto code happy but if we use it to set ivlen then
202 * the ESP header will be processed incorrectly. The
203 * compromise is to force it to zero here.
204 */
195 if (txform->minkey > keylen || keylen > txform->maxkey) {
196 DPRINTF(("%s: invalid key length %u, must be in the range "
197 "[%u..%u] for algorithm %s\n", __func__,
198 keylen, txform->minkey, txform->maxkey,
199 txform->name));
200 return EINVAL;
201 }
202
203 /*
204 * NB: The null xform needs a non-zero blocksize to keep the
205 * crypto code happy but if we use it to set ivlen then
206 * the ESP header will be processed incorrectly. The
207 * compromise is to force it to zero here.
208 */
205 sav->ivlen = (txform == &enc_xform_null ? 0 : txform->ivsize);
206 sav->iv = (caddr_t) malloc(sav->ivlen, M_XDATA, M_WAITOK);
207 key_randomfill(sav->iv, sav->ivlen); /*XXX*/
209 if (SAV_ISCTRORGCM(sav))
210 sav->ivlen = 8; /* RFC4106 3.1 and RFC3686 3.1 */
211 else
212 sav->ivlen = (txform == &enc_xform_null ? 0 : txform->ivsize);
208
209 /*
210 * Setup AH-related state.
211 */
212 if (sav->alg_auth != 0) {
213 error = ah_init0(sav, xsp, &cria);
214 if (error)
215 return error;

--- 5 unchanged lines hidden (view full) ---

221
222 /*
223 * Whenever AES-GCM is used for encryption, one
224 * of the AES authentication algorithms is chosen
225 * as well, based on the key size.
226 */
227 if (sav->alg_enc == SADB_X_EALG_AESGCM16) {
228 switch (keylen) {
213
214 /*
215 * Setup AH-related state.
216 */
217 if (sav->alg_auth != 0) {
218 error = ah_init0(sav, xsp, &cria);
219 if (error)
220 return error;

--- 5 unchanged lines hidden (view full) ---

226
227 /*
228 * Whenever AES-GCM is used for encryption, one
229 * of the AES authentication algorithms is chosen
230 * as well, based on the key size.
231 */
232 if (sav->alg_enc == SADB_X_EALG_AESGCM16) {
233 switch (keylen) {
229 case AES_128_HMAC_KEY_LEN:
234 case AES_128_GMAC_KEY_LEN:
230 sav->alg_auth = SADB_X_AALG_AES128GMAC;
231 sav->tdb_authalgxform = &auth_hash_nist_gmac_aes_128;
232 break;
235 sav->alg_auth = SADB_X_AALG_AES128GMAC;
236 sav->tdb_authalgxform = &auth_hash_nist_gmac_aes_128;
237 break;
233 case AES_192_HMAC_KEY_LEN:
238 case AES_192_GMAC_KEY_LEN:
234 sav->alg_auth = SADB_X_AALG_AES192GMAC;
235 sav->tdb_authalgxform = &auth_hash_nist_gmac_aes_192;
236 break;
239 sav->alg_auth = SADB_X_AALG_AES192GMAC;
240 sav->tdb_authalgxform = &auth_hash_nist_gmac_aes_192;
241 break;
237 case AES_256_HMAC_KEY_LEN:
242 case AES_256_GMAC_KEY_LEN:
238 sav->alg_auth = SADB_X_AALG_AES256GMAC;
239 sav->tdb_authalgxform = &auth_hash_nist_gmac_aes_256;
240 break;
241 default:
242 DPRINTF(("%s: invalid key length %u"
243 "for algorithm %s\n", __func__,
244 keylen, txform->name));
245 return EINVAL;
246 }
247 bzero(&cria, sizeof(cria));
248 cria.cri_alg = sav->tdb_authalgxform->type;
243 sav->alg_auth = SADB_X_AALG_AES256GMAC;
244 sav->tdb_authalgxform = &auth_hash_nist_gmac_aes_256;
245 break;
246 default:
247 DPRINTF(("%s: invalid key length %u"
248 "for algorithm %s\n", __func__,
249 keylen, txform->name));
250 return EINVAL;
251 }
252 bzero(&cria, sizeof(cria));
253 cria.cri_alg = sav->tdb_authalgxform->type;
249 cria.cri_klen = _KEYBITS(sav->key_enc) + 4;
250 cria.cri_key = sav->key_enc->key_data;
254 cria.cri_key = sav->key_enc->key_data;
255 cria.cri_klen = _KEYBITS(sav->key_enc) - SAV_ISGCM(sav) * 32;
251 }
252
253 /* Initialize crypto session. */
256 }
257
258 /* Initialize crypto session. */
254 bzero(&crie, sizeof (crie));
259 bzero(&crie, sizeof(crie));
255 crie.cri_alg = sav->tdb_encalgxform->type;
260 crie.cri_alg = sav->tdb_encalgxform->type;
256 crie.cri_klen = _KEYBITS(sav->key_enc);
257 crie.cri_key = sav->key_enc->key_data;
261 crie.cri_key = sav->key_enc->key_data;
258 if (sav->alg_enc == SADB_X_EALG_AESGCM16)
259 arc4rand(crie.cri_iv, sav->ivlen, 0);
262 crie.cri_klen = _KEYBITS(sav->key_enc) - SAV_ISCTRORGCM(sav) * 32;
260
263
261 /* XXX Rounds ? */
262
263 if (sav->tdb_authalgxform && sav->tdb_encalgxform) {
264 /* init both auth & enc */
265 crie.cri_next = &cria;
266 error = crypto_newsession(&sav->tdb_cryptoid,
267 &crie, V_crypto_support);
268 } else if (sav->tdb_encalgxform) {
269 error = crypto_newsession(&sav->tdb_cryptoid,
270 &crie, V_crypto_support);

--- 15 unchanged lines hidden (view full) ---

286static int
287esp_zeroize(struct secasvar *sav)
288{
289 /* NB: ah_zerorize free's the crypto session state */
290 int error = ah_zeroize(sav);
291
292 if (sav->key_enc)
293 bzero(sav->key_enc->key_data, _KEYLEN(sav->key_enc));
264 if (sav->tdb_authalgxform && sav->tdb_encalgxform) {
265 /* init both auth & enc */
266 crie.cri_next = &cria;
267 error = crypto_newsession(&sav->tdb_cryptoid,
268 &crie, V_crypto_support);
269 } else if (sav->tdb_encalgxform) {
270 error = crypto_newsession(&sav->tdb_cryptoid,
271 &crie, V_crypto_support);

--- 15 unchanged lines hidden (view full) ---

287static int
288esp_zeroize(struct secasvar *sav)
289{
290 /* NB: ah_zerorize free's the crypto session state */
291 int error = ah_zeroize(sav);
292
293 if (sav->key_enc)
294 bzero(sav->key_enc->key_data, _KEYLEN(sav->key_enc));
294 if (sav->iv) {
295 free(sav->iv, M_XDATA);
296 sav->iv = NULL;
297 }
298 sav->tdb_encalgxform = NULL;
299 sav->tdb_xform = NULL;
300 return error;
301}
302
303/*
304 * ESP input processing, called (eventually) through the protocol switch.
305 */
306static int
307esp_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
308{
309 char buf[128];
310 struct auth_hash *esph;
311 struct enc_xform *espx;
312 struct tdb_crypto *tc;
295 sav->tdb_encalgxform = NULL;
296 sav->tdb_xform = NULL;
297 return error;
298}
299
300/*
301 * ESP input processing, called (eventually) through the protocol switch.
302 */
303static int
304esp_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
305{
306 char buf[128];
307 struct auth_hash *esph;
308 struct enc_xform *espx;
309 struct tdb_crypto *tc;
310 uint8_t *ivp;
313 int plen, alen, hlen;
314 struct newesp *esp;
315 struct cryptodesc *crde;
316 struct cryptop *crp;
317
318 IPSEC_ASSERT(sav != NULL, ("null SA"));
319 IPSEC_ASSERT(sav->tdb_encalgxform != NULL, ("null encoding xform"));
320

--- 24 unchanged lines hidden (view full) ---

345 * block size.
346 *
347 * NB: This works for the null algorithm because the blocksize
348 * is 4 and all packets must be 4-byte aligned regardless
349 * of the algorithm.
350 */
351 plen = m->m_pkthdr.len - (skip + hlen + alen);
352 if ((plen & (espx->blocksize - 1)) || (plen <= 0)) {
311 int plen, alen, hlen;
312 struct newesp *esp;
313 struct cryptodesc *crde;
314 struct cryptop *crp;
315
316 IPSEC_ASSERT(sav != NULL, ("null SA"));
317 IPSEC_ASSERT(sav->tdb_encalgxform != NULL, ("null encoding xform"));
318

--- 24 unchanged lines hidden (view full) ---

343 * block size.
344 *
345 * NB: This works for the null algorithm because the blocksize
346 * is 4 and all packets must be 4-byte aligned regardless
347 * of the algorithm.
348 */
349 plen = m->m_pkthdr.len - (skip + hlen + alen);
350 if ((plen & (espx->blocksize - 1)) || (plen <= 0)) {
353 if (!espx || sav->alg_enc != SADB_X_EALG_AESGCM16) {
354 DPRINTF(("%s: payload of %d octets not a multiple of %d octets,"
355 " SA %s/%08lx\n", __func__,
356 plen, espx->blocksize, ipsec_address(&sav->sah->saidx.dst,
357 buf, sizeof(buf)), (u_long) ntohl(sav->spi)));
358 ESPSTAT_INC(esps_badilen);
359 m_freem(m);
360 return EINVAL;
361 }
351 DPRINTF(("%s: payload of %d octets not a multiple of %d octets,"
352 " SA %s/%08lx\n", __func__, plen, espx->blocksize,
353 ipsec_address(&sav->sah->saidx.dst, buf, sizeof(buf)),
354 (u_long)ntohl(sav->spi)));
355 ESPSTAT_INC(esps_badilen);
356 m_freem(m);
357 return EINVAL;
362 }
363
364 /*
365 * Check sequence number.
366 */
367 if (esph != NULL && sav->replay != NULL &&
368 !ipsec_chkreplay(ntohl(esp->esp_seq), sav)) {
369 DPRINTF(("%s: packet replay check for %s\n", __func__,

--- 29 unchanged lines hidden (view full) ---

399
400 if (esph != NULL) {
401 struct cryptodesc *crda = crp->crp_desc;
402
403 IPSEC_ASSERT(crda != NULL, ("null ah crypto descriptor"));
404
405 /* Authentication descriptor */
406 crda->crd_skip = skip;
358 }
359
360 /*
361 * Check sequence number.
362 */
363 if (esph != NULL && sav->replay != NULL &&
364 !ipsec_chkreplay(ntohl(esp->esp_seq), sav)) {
365 DPRINTF(("%s: packet replay check for %s\n", __func__,

--- 29 unchanged lines hidden (view full) ---

395
396 if (esph != NULL) {
397 struct cryptodesc *crda = crp->crp_desc;
398
399 IPSEC_ASSERT(crda != NULL, ("null ah crypto descriptor"));
400
401 /* Authentication descriptor */
402 crda->crd_skip = skip;
407 if (espx && espx->type == CRYPTO_AES_NIST_GCM_16)
408 crda->crd_len = hlen - sav->ivlen;
403 if (SAV_ISGCM(sav))
404 crda->crd_len = 8; /* RFC4106 5, SPI + SN */
409 else
410 crda->crd_len = m->m_pkthdr.len - (skip + alen);
411 crda->crd_inject = m->m_pkthdr.len - alen;
412
413 crda->crd_alg = esph->type;
405 else
406 crda->crd_len = m->m_pkthdr.len - (skip + alen);
407 crda->crd_inject = m->m_pkthdr.len - alen;
408
409 crda->crd_alg = esph->type;
414 if (espx && (espx->type == CRYPTO_AES_NIST_GCM_16)) {
415 crda->crd_key = sav->key_enc->key_data;
416 crda->crd_klen = _KEYBITS(sav->key_enc);
417 } else {
418 crda->crd_key = sav->key_auth->key_data;
419 crda->crd_klen = _KEYBITS(sav->key_auth);
420 }
421
422 /* Copy the authenticator */
423 m_copydata(m, m->m_pkthdr.len - alen, alen,
424 (caddr_t) (tc + 1));
425
426 /* Chain authentication request */
427 crde = crda->crd_next;
428 } else {

--- 18 unchanged lines hidden (view full) ---

447 tc->tc_sav = sav;
448
449 /* Decryption descriptor */
450 IPSEC_ASSERT(crde != NULL, ("null esp crypto descriptor"));
451 crde->crd_skip = skip + hlen;
452 crde->crd_len = m->m_pkthdr.len - (skip + hlen + alen);
453 crde->crd_inject = skip + hlen - sav->ivlen;
454
410
411 /* Copy the authenticator */
412 m_copydata(m, m->m_pkthdr.len - alen, alen,
413 (caddr_t) (tc + 1));
414
415 /* Chain authentication request */
416 crde = crda->crd_next;
417 } else {

--- 18 unchanged lines hidden (view full) ---

436 tc->tc_sav = sav;
437
438 /* Decryption descriptor */
439 IPSEC_ASSERT(crde != NULL, ("null esp crypto descriptor"));
440 crde->crd_skip = skip + hlen;
441 crde->crd_len = m->m_pkthdr.len - (skip + hlen + alen);
442 crde->crd_inject = skip + hlen - sav->ivlen;
443
455 crde->crd_alg = espx->type;
456 crde->crd_key = sav->key_enc->key_data;
457 crde->crd_klen = _KEYBITS(sav->key_enc);
458 if (espx && (espx->type == CRYPTO_AES_NIST_GCM_16))
444 if (SAV_ISCTRORGCM(sav)) {
445 ivp = &crde->crd_iv[0];
446
447 /* GCM IV Format: RFC4106 4 */
448 /* CTR IV Format: RFC3686 4 */
449 /* Salt is last four bytes of key, RFC4106 8.1 */
450 /* Nonce is last four bytes of key, RFC3686 5.1 */
451 memcpy(ivp, sav->key_enc->key_data +
452 _KEYLEN(sav->key_enc) - 4, 4);
453
454 if (SAV_ISCTR(sav)) {
455 /* Initial block counter is 1, RFC3686 4 */
456 be32enc(&ivp[sav->ivlen + 4], 1);
457 }
458
459 m_copydata(m, skip + hlen - sav->ivlen, sav->ivlen, &ivp[4]);
459 crde->crd_flags |= CRD_F_IV_EXPLICIT;
460 crde->crd_flags |= CRD_F_IV_EXPLICIT;
461 }
460
462
461 /* XXX Rounds ? */
463 crde->crd_alg = espx->type;
462
463 return (crypto_dispatch(crp));
464}
465
466/*
467 * ESP input callback from the crypto driver.
468 */
469static int

--- 189 unchanged lines hidden (view full) ---

659 */
660static int
661esp_output(struct mbuf *m, struct ipsecrequest *isr, struct mbuf **mp,
662 int skip, int protoff)
663{
664 char buf[INET6_ADDRSTRLEN];
665 struct enc_xform *espx;
666 struct auth_hash *esph;
464
465 return (crypto_dispatch(crp));
466}
467
468/*
469 * ESP input callback from the crypto driver.
470 */
471static int

--- 189 unchanged lines hidden (view full) ---

661 */
662static int
663esp_output(struct mbuf *m, struct ipsecrequest *isr, struct mbuf **mp,
664 int skip, int protoff)
665{
666 char buf[INET6_ADDRSTRLEN];
667 struct enc_xform *espx;
668 struct auth_hash *esph;
669 uint8_t *ivp;
670 uint64_t cntr;
667 int hlen, rlen, padding, blks, alen, i, roff;
668 struct mbuf *mo = (struct mbuf *) NULL;
669 struct tdb_crypto *tc;
670 struct secasvar *sav;
671 struct secasindex *saidx;
672 unsigned char *pad;
673 u_int8_t prot;
674 int error, maxpacketsize;

--- 9 unchanged lines hidden (view full) ---

684
685 if (sav->flags & SADB_X_EXT_OLD)
686 hlen = sizeof (struct esp) + sav->ivlen;
687 else
688 hlen = sizeof (struct newesp) + sav->ivlen;
689
690 rlen = m->m_pkthdr.len - skip; /* Raw payload length. */
691 /*
671 int hlen, rlen, padding, blks, alen, i, roff;
672 struct mbuf *mo = (struct mbuf *) NULL;
673 struct tdb_crypto *tc;
674 struct secasvar *sav;
675 struct secasindex *saidx;
676 unsigned char *pad;
677 u_int8_t prot;
678 int error, maxpacketsize;

--- 9 unchanged lines hidden (view full) ---

688
689 if (sav->flags & SADB_X_EXT_OLD)
690 hlen = sizeof (struct esp) + sav->ivlen;
691 else
692 hlen = sizeof (struct newesp) + sav->ivlen;
693
694 rlen = m->m_pkthdr.len - skip; /* Raw payload length. */
695 /*
692 * NB: The null encoding transform has a blocksize of 4
693 * so that headers are properly aligned.
696 * RFC4303 2.4 Requires 4 byte alignment.
694 */
697 */
695 blks = espx->ivsize; /* IV blocksize */
698 blks = MAX(4, espx->blocksize); /* Cipher blocksize */
696
697 /* XXX clamp padding length a la KAME??? */
698 padding = ((blks - ((rlen + 2) % blks)) % blks) + 2;
699
700 alen = xform_ah_authsize(esph);
701
702 ESPSTAT_INC(esps_output);
703

--- 107 unchanged lines hidden (view full) ---

811 pad[padding - 2] = padding - 2;
812 m_copydata(m, protoff, sizeof(u_int8_t), pad + padding - 1);
813
814 /* Fix Next Protocol in IPv4/IPv6 header. */
815 prot = IPPROTO_ESP;
816 m_copyback(m, protoff, sizeof(u_int8_t), (u_char *) &prot);
817
818 /* Get crypto descriptors. */
699
700 /* XXX clamp padding length a la KAME??? */
701 padding = ((blks - ((rlen + 2) % blks)) % blks) + 2;
702
703 alen = xform_ah_authsize(esph);
704
705 ESPSTAT_INC(esps_output);
706

--- 107 unchanged lines hidden (view full) ---

814 pad[padding - 2] = padding - 2;
815 m_copydata(m, protoff, sizeof(u_int8_t), pad + padding - 1);
816
817 /* Fix Next Protocol in IPv4/IPv6 header. */
818 prot = IPPROTO_ESP;
819 m_copyback(m, protoff, sizeof(u_int8_t), (u_char *) &prot);
820
821 /* Get crypto descriptors. */
819 crp = crypto_getreq(esph && espx ? 2 : 1);
822 crp = crypto_getreq(esph != NULL ? 2 : 1);
820 if (crp == NULL) {
821 DPRINTF(("%s: failed to acquire crypto descriptors\n",
822 __func__));
823 ESPSTAT_INC(esps_crypto);
824 error = ENOBUFS;
825 goto bad;
826 }
827
823 if (crp == NULL) {
824 DPRINTF(("%s: failed to acquire crypto descriptors\n",
825 __func__));
826 ESPSTAT_INC(esps_crypto);
827 error = ENOBUFS;
828 goto bad;
829 }
830
828 if (espx) {
829 crde = crp->crp_desc;
830 crda = crde->crd_next;
831
832 /* Encryption descriptor. */
833 crde->crd_skip = skip + hlen;
834 crde->crd_len = m->m_pkthdr.len - (skip + hlen + alen);
835 crde->crd_flags = CRD_F_ENCRYPT;
836 crde->crd_inject = skip + hlen - sav->ivlen;
837
838 /* Encryption operation. */
839 crde->crd_alg = espx->type;
840 crde->crd_key = sav->key_enc->key_data;
841 crde->crd_klen = _KEYBITS(sav->key_enc);
842 if (espx->type == CRYPTO_AES_NIST_GCM_16)
843 crde->crd_flags |= CRD_F_IV_EXPLICIT;
844 /* XXX Rounds ? */
845 } else
846 crda = crp->crp_desc;
847
848 /* IPsec-specific opaque crypto info. */
849 tc = (struct tdb_crypto *) malloc(sizeof(struct tdb_crypto),
831 /* IPsec-specific opaque crypto info. */
832 tc = (struct tdb_crypto *) malloc(sizeof(struct tdb_crypto),
850 M_XDATA, M_NOWAIT|M_ZERO);
833 M_XDATA, M_NOWAIT|M_ZERO);
851 if (tc == NULL) {
852 crypto_freereq(crp);
853 DPRINTF(("%s: failed to allocate tdb_crypto\n", __func__));
854 ESPSTAT_INC(esps_crypto);
855 error = ENOBUFS;
856 goto bad;
857 }
858
834 if (tc == NULL) {
835 crypto_freereq(crp);
836 DPRINTF(("%s: failed to allocate tdb_crypto\n", __func__));
837 ESPSTAT_INC(esps_crypto);
838 error = ENOBUFS;
839 goto bad;
840 }
841
842 crde = crp->crp_desc;
843 crda = crde->crd_next;
844
845 /* Encryption descriptor. */
846 crde->crd_skip = skip + hlen;
847 crde->crd_len = m->m_pkthdr.len - (skip + hlen + alen);
848 crde->crd_flags = CRD_F_ENCRYPT;
849 crde->crd_inject = skip + hlen - sav->ivlen;
850
851 /* Encryption operation. */
852 crde->crd_alg = espx->type;
853 if (SAV_ISCTRORGCM(sav)) {
854 ivp = &crde->crd_iv[0];
855
856 /* GCM IV Format: RFC4106 4 */
857 /* CTR IV Format: RFC3686 4 */
858 /* Salt is last four bytes of key, RFC4106 8.1 */
859 /* Nonce is last four bytes of key, RFC3686 5.1 */
860 memcpy(ivp, sav->key_enc->key_data +
861 _KEYLEN(sav->key_enc) - 4, 4);
862 SECASVAR_LOCK(sav);
863 cntr = sav->cntr++;
864 SECASVAR_UNLOCK(sav);
865 be64enc(&ivp[4], cntr);
866
867 if (SAV_ISCTR(sav)) {
868 /* Initial block counter is 1, RFC3686 4 */
869 be32enc(&ivp[sav->ivlen + 4], 1);
870 }
871
872 m_copyback(m, skip + hlen - sav->ivlen, sav->ivlen, &ivp[4]);
873 crde->crd_flags |= CRD_F_IV_EXPLICIT|CRD_F_IV_PRESENT;
874 }
875
859 /* Callback parameters */
860 tc->tc_isr = isr;
861 KEY_ADDREFSA(sav);
862 tc->tc_sav = sav;
863 tc->tc_spi = sav->spi;
864 tc->tc_dst = saidx->dst;
865 tc->tc_proto = saidx->proto;
866
867 /* Crypto operation descriptor. */
868 crp->crp_ilen = m->m_pkthdr.len; /* Total input length. */
869 crp->crp_flags = CRYPTO_F_IMBUF | CRYPTO_F_CBIFSYNC;
870 crp->crp_buf = (caddr_t) m;
871 crp->crp_callback = esp_output_cb;
872 crp->crp_opaque = (caddr_t) tc;
873 crp->crp_sid = sav->tdb_cryptoid;
874
875 if (esph) {
876 /* Authentication descriptor. */
876 /* Callback parameters */
877 tc->tc_isr = isr;
878 KEY_ADDREFSA(sav);
879 tc->tc_sav = sav;
880 tc->tc_spi = sav->spi;
881 tc->tc_dst = saidx->dst;
882 tc->tc_proto = saidx->proto;
883
884 /* Crypto operation descriptor. */
885 crp->crp_ilen = m->m_pkthdr.len; /* Total input length. */
886 crp->crp_flags = CRYPTO_F_IMBUF | CRYPTO_F_CBIFSYNC;
887 crp->crp_buf = (caddr_t) m;
888 crp->crp_callback = esp_output_cb;
889 crp->crp_opaque = (caddr_t) tc;
890 crp->crp_sid = sav->tdb_cryptoid;
891
892 if (esph) {
893 /* Authentication descriptor. */
894 crda->crd_alg = esph->type;
877 crda->crd_skip = skip;
895 crda->crd_skip = skip;
878 if (espx && espx->type == CRYPTO_AES_NIST_GCM_16)
879 crda->crd_len = hlen - sav->ivlen;
896 if (SAV_ISGCM(sav))
897 crda->crd_len = 8; /* RFC4106 5, SPI + SN */
880 else
881 crda->crd_len = m->m_pkthdr.len - (skip + alen);
882 crda->crd_inject = m->m_pkthdr.len - alen;
898 else
899 crda->crd_len = m->m_pkthdr.len - (skip + alen);
900 crda->crd_inject = m->m_pkthdr.len - alen;
883
884 /* Authentication operation. */
885 crda->crd_alg = esph->type;
886 if (espx && espx->type == CRYPTO_AES_NIST_GCM_16) {
887 crda->crd_key = sav->key_enc->key_data;
888 crda->crd_klen = _KEYBITS(sav->key_enc);
889 } else {
890 crda->crd_key = sav->key_auth->key_data;
891 crda->crd_klen = _KEYBITS(sav->key_auth);
892 }
893
894 }
895
896 return crypto_dispatch(crp);
897bad:
898 if (m)
899 m_freem(m);
900 return (error);
901}

--- 14 unchanged lines hidden (view full) ---

916 tc = (struct tdb_crypto *) crp->crp_opaque;
917 IPSEC_ASSERT(tc != NULL, ("null opaque data area!"));
918 m = (struct mbuf *) crp->crp_buf;
919
920 isr = tc->tc_isr;
921 IPSEC_ASSERT(isr->sp != NULL, ("NULL isr->sp"));
922 IPSECREQUEST_LOCK(isr);
923 sav = tc->tc_sav;
901 }
902
903 return crypto_dispatch(crp);
904bad:
905 if (m)
906 m_freem(m);
907 return (error);
908}

--- 14 unchanged lines hidden (view full) ---

923 tc = (struct tdb_crypto *) crp->crp_opaque;
924 IPSEC_ASSERT(tc != NULL, ("null opaque data area!"));
925 m = (struct mbuf *) crp->crp_buf;
926
927 isr = tc->tc_isr;
928 IPSEC_ASSERT(isr->sp != NULL, ("NULL isr->sp"));
929 IPSECREQUEST_LOCK(isr);
930 sav = tc->tc_sav;
924 /* With the isr lock released SA pointer can be updated. */
931
932 /* With the isr lock released, SA pointer may have changed. */
925 if (sav != isr->sav) {
926 ESPSTAT_INC(esps_notdb);
927 DPRINTF(("%s: SA gone during crypto (SA %s/%08lx proto %u)\n",
928 __func__, ipsec_address(&tc->tc_dst, buf, sizeof(buf)),
929 (u_long) ntohl(tc->tc_spi), tc->tc_proto));
930 error = ENOBUFS; /*XXX*/
931 goto bad;
932 }

--- 85 unchanged lines hidden --- 		933 if (sav != isr->sav) {
934 ESPSTAT_INC(esps_notdb);
935 DPRINTF(("%s: SA gone during crypto (SA %s/%08lx proto %u)\n",
936 __func__, ipsec_address(&tc->tc_dst, buf, sizeof(buf)),
937 (u_long) ntohl(tc->tc_spi), tc->tc_proto));
938 error = ENOBUFS; /*XXX*/
939 goto bad;
940 }

--- 85 unchanged lines hidden ---