Page MenuHomeFreeBSD
Files F177478839

D61395.1794524007.diff
No OneTemporary
Actions

Authored By
Unknown
Size
5 KB
Referenced Files
None
Subscribers
None

D61395.1794524007.diff
View Options

diff --git a/sys/netipsec/xform_esp.c b/sys/netipsec/xform_esp.c
--- a/sys/netipsec/xform_esp.c
+++ b/sys/netipsec/xform_esp.c
@@ -103,6 +103,39 @@
static MALLOC_DEFINE(M_ESP, "esp", "IPsec ESP");
+/*
+ * The crypto request and the state its callback needs, allocated together
+ * once per packet. aad holds the separate AAD that ESN needs: the ESP
+ * header, the IV and the high-order half of the sequence number.
+ */
+#define ESP_AAD_MAXLEN (sizeof(struct newesp) + EALG_MAX_BLOCK_LEN)
+struct esp_req {
+ struct cryptop crp;
+ struct xform_data xd;
+ uint8_t aad[ESP_AAD_MAXLEN];
+};
+
+static struct esp_req *
+esp_getreq(crypto_session_t cryptoid)
+{
+ struct esp_req *req;
+
+ req = malloc(sizeof(*req), M_ESP, M_NOWAIT);
+ if (req == NULL)
+ return (NULL);
+ crypto_initreq(&req->crp, cryptoid);
+ memset(&req->xd, 0, sizeof(req->xd));
+ return (req);
+}
+
+static void
+esp_freereq(struct cryptop *crp)
+{
+
+ crypto_destroyreq(crp);
+ free(__containerof(crp, struct esp_req, crp), M_ESP);
+}
+
static int esp_input_cb(struct cryptop *op);
static int esp_output_cb(struct cryptop *crp);
@@ -270,6 +303,7 @@
IPSEC_DEBUG_DECLARE(char buf[128]);
const struct auth_hash *esph;
const struct enc_xform *espx;
+ struct esp_req *req;
struct xform_data *xd;
struct cryptop *crp;
struct newesp *esp;
@@ -352,21 +386,16 @@
ESPSTAT_ADD(esps_ibytes, m->m_pkthdr.len - (skip + hlen + alen));
/* Get crypto descriptors */
- crp = crypto_getreq(cryptoid, M_NOWAIT);
- if (crp == NULL) {
+ req = esp_getreq(cryptoid);
+ if (req == NULL) {
DPRINTF(("%s: failed to acquire crypto descriptors\n",
__func__));
ESPSTAT_INC(esps_crypto);
error = ENOBUFS;
goto bad;
}
-
- /* Get IPsec-specific opaque pointer */
- xd = malloc(sizeof(*xd), M_ESP, M_NOWAIT | M_ZERO);
- if (xd == NULL) {
- DPRINTF(("%s: failed to allocate xform_data\n", __func__));
- goto xd_fail;
- }
+ crp = &req->crp;
+ xd = &req->xd;
if (esph != NULL) {
crp->crp_op = CRYPTO_OP_VERIFY_DIGEST;
@@ -381,12 +410,10 @@
int aad_skip;
crp->crp_aad_length += sizeof(seqh);
- crp->crp_aad = malloc(crp->crp_aad_length, M_ESP, M_NOWAIT);
- if (crp->crp_aad == NULL) {
- DPRINTF(("%s: failed to allocate xform_data\n",
- __func__));
- goto crp_aad_fail;
- }
+ KASSERT(crp->crp_aad_length <= sizeof(req->aad),
+ ("%s: AAD of %d bytes", __func__,
+ crp->crp_aad_length));
+ crp->crp_aad = req->aad;
/* SPI */
m_copydata(m, skip, SPI_SIZE, crp->crp_aad);
@@ -470,12 +497,6 @@
else
return (crypto_dispatch(crp));
-crp_aad_fail:
- free(xd, M_ESP);
-xd_fail:
- crypto_freereq(crp);
- ESPSTAT_INC(esps_crypto);
- error = ENOBUFS;
bad:
m_freem(m);
key_freesav(&sav);
@@ -569,9 +590,7 @@
}
/* Release the crypto descriptors */
- free(xd, M_ESP), xd = NULL;
- free(crp->crp_aad, M_ESP), crp->crp_aad = NULL;
- crypto_freereq(crp), crp = NULL;
+ esp_freereq(crp), crp = NULL;
/*
* Packet is now decrypted.
@@ -680,12 +699,8 @@
key_freesav(&sav);
if (m != NULL)
m_freem(m);
- if (xd != NULL)
- free(xd, M_ESP);
- if (crp != NULL) {
- free(crp->crp_aad, M_ESP);
- crypto_freereq(crp);
- }
+ if (crp != NULL)
+ esp_freereq(crp);
CURVNET_RESTORE();
return error;
}
@@ -697,6 +712,7 @@
u_int idx, int skip, int protoff)
{
IPSEC_DEBUG_DECLARE(char buf[IPSEC_ADDRSTRLEN]);
+ struct esp_req *req;
struct cryptop *crp;
const struct auth_hash *esph;
const struct enc_xform *espx;
@@ -870,21 +886,16 @@
m_copyback(m, protoff, sizeof(u_int8_t), (u_char *) &prot);
/* Get crypto descriptor. */
- crp = crypto_getreq(cryptoid, M_NOWAIT);
- if (crp == NULL) {
+ req = esp_getreq(cryptoid);
+ if (req == NULL) {
DPRINTF(("%s: failed to acquire crypto descriptor\n",
__func__));
ESPSTAT_INC(esps_crypto);
error = ENOBUFS;
goto bad;
}
-
- /* IPsec-specific opaque crypto info. */
- xd = malloc(sizeof(struct xform_data), M_ESP, M_NOWAIT | M_ZERO);
- if (xd == NULL) {
- DPRINTF(("%s: failed to allocate xform_data\n", __func__));
- goto xd_fail;
- }
+ crp = &req->crp;
+ xd = &req->xd;
/* Encryption descriptor. */
crp->crp_payload_start = skip + hlen;
@@ -940,12 +951,10 @@
int aad_skip;
crp->crp_aad_length += sizeof(seqh);
- crp->crp_aad = malloc(crp->crp_aad_length, M_ESP, M_NOWAIT);
- if (crp->crp_aad == NULL) {
- DPRINTF(("%s: failed to allocate xform_data\n",
- __func__));
- goto crp_aad_fail;
- }
+ KASSERT(crp->crp_aad_length <= sizeof(req->aad),
+ ("%s: AAD of %d bytes", __func__,
+ crp->crp_aad_length));
+ crp->crp_aad = req->aad;
/* SPI */
m_copydata(m, skip, SPI_SIZE, crp->crp_aad);
@@ -974,12 +983,6 @@
else
return (crypto_dispatch(crp));
-crp_aad_fail:
- free(xd, M_ESP);
-xd_fail:
- crypto_freereq(crp);
- ESPSTAT_INC(esps_crypto);
- error = ENOBUFS;
bad:
if (m)
m_freem(m);
@@ -1033,9 +1036,7 @@
error = EINVAL;
goto bad;
}
- free(xd, M_ESP);
- free(crp->crp_aad, M_ESP);
- crypto_freereq(crp);
+ esp_freereq(crp);
ESPSTAT_INC2(esps_hist, sav->alg_enc);
if (sav->tdb_authalgxform != NULL)
AHSTAT_INC2(ahs_hist, sav->alg_auth);
@@ -1066,9 +1067,7 @@
CURVNET_RESTORE();
return (error);
bad:
- free(xd, M_ESP);
- free(crp->crp_aad, M_ESP);
- crypto_freereq(crp);
+ esp_freereq(crp);
key_freesav(&sav);
key_freesp(&sp);
CURVNET_RESTORE();

File Metadata

Mime Type
text/plain
Expires
Thu, Nov 12, 10:53 PM (7 h, 4 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41661691
Default Alt Text
D61395.1794524007.diff (5 KB)

Event Timeline