Page MenuHomeFreeBSD

Fix AES-CTR compatibility issue in ipsec
ClosedPublic

Authored by kd on May 25 2020, 11:00 AM.
Tags
None
Referenced Files
Unknown Object (File)
Feb 11 2024, 7:08 PM
Unknown Object (File)
Dec 22 2023, 11:58 PM
Unknown Object (File)
Dec 20 2023, 9:39 PM
Unknown Object (File)
Dec 18 2023, 11:46 AM
Unknown Object (File)
Nov 29 2023, 5:22 AM
Unknown Object (File)
Nov 24 2023, 12:58 AM
Unknown Object (File)
Nov 23 2023, 2:35 PM
Unknown Object (File)
Nov 6 2023, 12:27 PM
Subscribers

Details

Summary

r361390 decreased blocksize of AES-CTR from 16 to 1. Because of that ESP payload is no longer aligned to 16 bytes before being encrypted and sent.
This is a good change since RFC3686 specifies that the last block doesn't need to be aligned.
Because FreeBSD before r361390 couldn't decrypt partial blocks encrypted with AES-CTR we need to enforce 16 byte alignment in order to preserve compatibility.
Add a sysctl(on by default) to control it.

Test Plan

Create ipsec tunnel with FreeBSD host without r361390 and use AES-CTR encryption.
Ping it, turn the sysctl off, try to ping it again and verify that connectivity was lost.
Do a similar test connecting to a Linux host and FreeBSD with this patch applied.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable