xfrm: Installing NULL encryption IPSec SAs fails

Installing NULL encryption IPSec SAs works using the .compat name "cipher_null", but fails with the .name "ecp(cipher_null)" due the missing check in key length verification.


@@ -57,6 +57,7 @@
 
        case XFRMA_ALG_CRYPT:
                if (!algp->alg_key_len &&
+                   strcmp(algp->alg_name, "ecb(cipher_null)") != 0 &&
                    strcmp(algp->alg_name, "cipher_null") != 0)
                        return -EINVAL;
                break;

From: Martin Willi <[email protected]>
Date: Wed, 21 May 2008 11:55:06 -0500

Herbert does this look Ok to you?

Thanks. ���{.n�+�������+%�����ݶ��w��{.n�+����{��G�����{ay�ʇڙ�,j��f���h��������z_�(�階�ݢj"���m������G������?����&���~��iO��z��v�^�m����������?�I�

I think we should get rid of the zero check altogether as a zero-length key will fail on setkey of a real algorithm anyway because of the min_keysize/max_keysize checks in the crypto API.

Cheers,

Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

From: Herbert Xu <[email protected]>
Date: Thu, 22 May 2008 07:59:22 +0800

Ok, how does this look?

xfrm_user: Remove zero length key checks.

The crypto layer will determine whether that is valid or not.

Suggested by Herbert Xu, based upon a report and patch by Martin Willi.

index a1b0fbe..b976d9e 100644
@@ -50,19 +50,8 @@ static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
 
 	switch (type) {
 	case XFRMA_ALG_AUTH:
-		if (!algp->alg_key_len &&
-		    strcmp(algp->alg_name, "digest_null") != 0)
-			return -EINVAL;
-		break;
-
 	case XFRMA_ALG_CRYPT:
-		if (!algp->alg_key_len &&
-		    strcmp(algp->alg_name, "cipher_null") != 0)
-			return -EINVAL;
-		break;
-
 	case XFRMA_ALG_COMP:
-		/* Zero length keys are legal.  */
 		break;
 
 	default:

Looks good to me!

Thanks,

Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

From: Herbert Xu <[email protected]>
Date: Thu, 22 May 2008 08:30:31 +0800

Thanks for reviewing.