ipv4+ipv6: Make INET*_ESP select CRYPTO_ECHAINIV
Subsystems (2)
PATCH 1/1 ipv4+ipv6: Make INET*_ESP select CRYPTO_ECHAINIV
The ESP algorithms using CBC mode require echainiv. Hence INET*_ESP have to select CRYPTO_ECHAINIV in order to work properly. This solves the issues caused by a misconfiguration as described in [1].
The original approach, patching crypto/Kconfig was turned down by Herbert Xu [2].
[1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html
[2] http://marc.info/?l=linux-crypto-vger&m=145224655809562&w=2
--- net/ipv4/Kconfig | 1 + net/ipv6/Kconfig | 1 + 2 files changed, 2 insertions(+)
net/ipv4/Kconfig +1 -0
@@ -353,6 +353,7 @@ config INET_ESP select CRYPTO_CBC select CRYPTO_SHA1 select CRYPTO_DES + select CRYPTO_ECHAINIV ---help--- Support for IPsec ESP.
net/ipv6/Kconfig +0 -0
@@ -69,6 +69,7 @@ config INET6_ESP select CRYPTO_CBC select CRYPTO_SHA1 select CRYPTO_DES
Quoted 32 lines · Thomas Egerer
The ESP algorithms using CBC mode require echainiv. Hence INET*_ESP have to select
CRYPTO_ECHAINIVin order to work properly. This solves the issues caused by a misconfiguration as described in [1].
The original approach, patchingcrypto/Kconfigwas turned down by Herbert Xu [2].[1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html
[2] http://marc.info/?l=linux-crypto-vger&m=145224655809562&w=2Signed-off-by Thomas Egerer <[email protected]>---
net/ipv4/Kconfig| 1 +net/ipv6/Kconfig| 1 +2 files changed, 2 insertions(+)net/ipv4/Kconfig +1
-0@@ -353,6 +353,7 @@ config INET_ESP select CRYPTO_CBC select CRYPTO_SHA1 select CRYPTO_DES + select CRYPTO_ECHAINIV ---help--- Support for IPsec ESP.net/ipv6/Kconfig +0
-0
net/ipv6/Kconfig config INET6_ESP · line 71
Quoted 3 lines
net/ipv6/Kconfig +0
-0@@ -69,6 +69,7 @@ config INET6_ESP select CRYPTO_CBC select CRYPTO_SHA1 select CRYPTO_DES
Your patch seems to be missing a few lines at the end.
Otherwise it looks good to me.
Cheers,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Quoted 28 lines · Herbert Xu
Quoted 27 lines · Thomas Egerer
The ESP algorithms using CBC mode require echainiv. Hence INET*_ESP have to select
CRYPTO_ECHAINIVin order to work properly. This solves the issues caused by a misconfiguration as described in [1].
The original approach, patchingcrypto/Kconfigwas turned down by Herbert Xu [2].[1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html
[2] http://marc.info/?l=linux-crypto-vger&m=145224655809562&w=2Signed-off-by Thomas Egerer <[email protected]>---
net/ipv4/Kconfig| 1 +net/ipv6/Kconfig| 1 +2 files changed, 2 insertions(+)net/ipv4/Kconfig +1
-0@@ -353,6 +353,7 @@ config INET_ESP select CRYPTO_CBC select CRYPTO_SHA1 select CRYPTO_DES + select CRYPTO_ECHAINIV ---help--- Support for IPsec ESP.
Quoted 10 lines
net/ipv6/Kconfig config INET6_ESP · line 71
Quoted 8 lines
net/ipv6/Kconfig +0
-0@@ -69,6 +69,7 @@ config INET6_ESP select CRYPTO_CBC select CRYPTO_SHA1 select CRYPTO_DESYour patch seems to be missing a few lines at the end.
That's odd, yet the my outbox contains a truncated mail, too. Sorry, will resend the patch in a jiff.
Thomas
Quoted 4 lines
Otherwise it looks good to me.
Cheers,
PATCH 1/1 ipv4+ipv6: Make INET*_ESP select CRYPTO_ECHAINIV
In reply to Herbert XuThe ESP algorithms using CBC mode require echainiv. Hence INET*_ESP have to select CRYPTO_ECHAINIV in order to work properly. This solves the issues caused by a misconfiguration as described in [1].
The original approach, patching crypto/Kconfig was turned down by Herbert Xu [2].
[1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html
[2] http://marc.info/?l=linux-crypto-vger&m=145224655809562&w=2
--- net/ipv4/Kconfig | 1 + net/ipv6/Kconfig | 1 + 2 files changed, 2 insertions(+)
net/ipv4/Kconfig +1 -0
@@ -353,6 +353,7 @@ config INET_ESP select CRYPTO_CBC select CRYPTO_SHA1 select CRYPTO_DES + select CRYPTO_ECHAINIV ---help--- Support for IPsec ESP.
net/ipv6/Kconfig +1 -0
@@ -69,6 +69,7 @@ config INET6_ESP select CRYPTO_CBC select CRYPTO_SHA1 select CRYPTO_DES + select CRYPTO_ECHAINIV ---help--- Support for IPsec ESP.
Signature · 1 line
2.6.4
Quoted 10 lines · Thomas Egerer
The ESP algorithms using CBC mode require echainiv. Hence INET*_ESP have to select
CRYPTO_ECHAINIVin order to work properly. This solves the issues caused by a misconfiguration as described in [1].
The original approach, patchingcrypto/Kconfigwas turned down by Herbert Xu [2].[1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html
[2] http://marc.info/?l=linux-crypto-vger&m=145224655809562&w=2Signed-off-by Thomas Egerer <[email protected]>
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
From: Herbert Xu <[email protected]>
Date: Mon, 25 Jan 2016 21:56:28 +0800
Quoted 7 lines · Thomas Egerer
Quoted 6 lines
The ESP algorithms using CBC mode require echainiv. Hence INET*_ESP have to select
CRYPTO_ECHAINIVin order to work properly. This solves the issues caused by a misconfiguration as described in [1].
The original approach, patchingcrypto/Kconfigwas turned down by Herbert Xu [2].
Quoted 6 lines
Quoted 4 lines
[1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html
[2] http://marc.info/?l=linux-crypto-vger&m=145224655809562&w=2Signed-off-by Thomas Egerer <[email protected]>Acked-by Herbert Xu <[email protected]>
Applied, thanks.