ktls: Centralize the check for CBC ciphers
ClosedPublic
Actions

Authored by jhb on Tue, Jun 30, 8:32 PM.

Details

Reviewers

markj
gallatin

Commits

rG9cee48180d7a: ktls: Centralize the check for CBC ciphers

Summary

Move the check out of ktls_enable_(rx|tx) and into ktls_create_session.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

jhb created this revision.Tue, Jun 30, 8:32 PM

Herald added subscribers: olce, glebius, imp. · View Herald TranscriptTue, Jun 30, 8:32 PM

jhb requested review of this revision.Tue, Jun 30, 8:32 PM

Harbormaster completed remote builds in B74430: Diff 181111.Tue, Jun 30, 8:32 PM

I got the expected failures when toggling this and running kyua ktls_test.

From Claude:

Commit: 50ac71cacbc4 — ktls: Centralize the check for CBC ciphers                                                         
                                                                   
This moves the ktls_cbc_enable guard from ktls_enable_rx() and ktls_enable_tx() into ktls_create_session(), placing it just 
before the CBC cipher's switch on auth_algorithm.                                                                           
 
- The centralization is correct: ktls_create_session() is the natural choke point shared by both paths.                     
- Minor: the error code changes from ENOTSUP to EOPNOTSUPP. On FreeBSD these share the same value (45), so no behavioral
difference, but worth being aware of.                                                                                       
- No other issues.

For the minor point Claude noted, ENOTSUP is an alternate spelling, EOPNOTSUPP is the canonical version for BSD.

markj accepted this revision.Tue, Jun 30, 8:37 PM

This revision is now accepted and ready to land.Tue, Jun 30, 8:37 PM

gallatin accepted this revision.Tue, Jun 30, 10:16 PM

Closed by commit rG9cee48180d7a: ktls: Centralize the check for CBC ciphers (authored by jhb). · Explain WhyWed, Jul 1, 12:55 AM

This revision was automatically updated to reflect the committed changes.

jhb added a commit: rG9cee48180d7a: ktls: Centralize the check for CBC ciphers.