d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't pass bogus keys down for NULL algorithms.

Browse Source 
The changes in r359374 added various sanity checks in sessions and
requests created by crypto consumers in part to permit backend drivers
to make assumptions instead of duplicating checks for various edge
cases.  One of the new checks was to reject sessions which provide a
pointer to a key while claiming the key is zero bits long.

IPsec ESP tripped over this as it passes along whatever key is
provided for NULL, including a pointer to a zero-length key when an
empty string ("") is used with setkey(8).  One option would be to
teach the IPsec key layer to not allocate keys of zero length, but I
went with a simpler fix of just not passing any keys down and always
using a key length of zero for NULL algorithms.

PR:		245832
Reported by:	CI
This commit is contained in:
John Baldwin 2020-05-02 01:00:29 +00:00
parent a9d9cfff01
commit 897e43124e
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/netipsec/xform_ah.c
View File

@ -215,8 +215,10 @@ ah_init0(struct secasvar *sav, struct xformsw *xsp,
/* Initialize crypto session. */
csp->csp_auth_alg = sav->tdb_authalgxform->type;
csp->csp_auth_klen = _KEYBITS(sav->key_auth) / 8;
csp->csp_auth_key = sav->key_auth->key_data;
if (csp->csp_auth_alg != CRYPTO_NULL_HMAC) {
csp->csp_auth_klen = _KEYBITS(sav->key_auth) / 8;
csp->csp_auth_key = sav->key_auth->key_data;
};
csp->csp_auth_mlen = AUTHSIZE(sav);
return 0;

8
sys/netipsec/xform_esp.c
View File

@ -220,9 +220,11 @@ esp_init(struct secasvar *sav, struct xformsw *xsp)
/* Initialize crypto session. */
csp.csp_cipher_alg = sav->tdb_encalgxform->type;
csp.csp_cipher_key = sav->key_enc->key_data;
csp.csp_cipher_klen = _KEYBITS(sav->key_enc) / 8 -
SAV_ISCTRORGCM(sav) * 4;
if (csp.csp_cipher_alg != CRYPTO_NULL_CBC) {
csp.csp_cipher_key = sav->key_enc->key_data;
csp.csp_cipher_klen = _KEYBITS(sav->key_enc) / 8 -
SAV_ISCTRORGCM(sav) * 4;
};
csp.csp_ivlen = txform->ivsize;
error = crypto_newsession(&sav->tdb_cryptoid, &csp, V_crypto_support);