- Just use sw->octx != NULL to handle the HMAC case when finalizing the MAC.
- Explicitly zero the on-stack auth context.
Details
Details
- cryptocheck -d soft -all -z
- also tested with some KTLS changes which used HMAC with AES-CBC
Diff Detail
Diff Detail
- Lint
No Lint Coverage - Unit
No Test Coverage - Build Status
Buildable 34006 Build 31195: arc lint + arc unit
Event Timeline
| sys/opencrypto/cryptosoft.c | ||
|---|---|---|
| 361 | We are now doing some extra work for CRYPTO_NULL_HMAC, but I doubt it matters in any meaningful way. | |
| sys/opencrypto/cryptosoft.c | ||
|---|---|---|
| 361 | Ah, the correct fix for that would be to not allocate a sw_octx for NULL_HMAC then. However, it's probably not worth fixing. I do think the real solution for NULL_CBC and NULL_HMAC is that IPsec should handle NULL ciphers explicitly and not (ab)use OCF. That would avoid the need for having to deal with the context switches, etc. | |