Re: [ESP] Only one algorithm is required

[Herbert Xu <herbert@gondor.apana.org.au>]

[-- Attachment #1: Type: text/plain, Size: 660 bytes --]

Hi Dave:

I wrote the wrong subject for the last patch.  It was really
meant for this one :)

Both encryption and authentication are optional for ESP.  However, at
least one of them must be present.  The following patch changes init_state
to match that specification.  It also changes the IPv6 ESP check to allow
zero-length authentication keys as is the case with the IPv4 version.
 
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

[-- Attachment #2: esp-alg-check --]
[-- Type: text/plain, Size: 842 bytes --]

===== net/ipv4/esp4.c 1.55 vs edited =====
--- 1.55/net/ipv4/esp4.c	2004-08-12 19:59:52 +10:00
+++ edited/net/ipv4/esp4.c	2004-08-14 09:33:05 +10:00
@@ -372,8 +372,7 @@
 	if (x->aalg) {
 		if (x->aalg->alg_key_len > 512)
 			goto error;
-	}
-	if (x->ealg == NULL)
+	} else if (x->ealg == NULL)
 		goto error;
 
 	esp = kmalloc(sizeof(*esp), GFP_KERNEL);
===== net/ipv6/esp6.c 1.36 vs edited =====
--- 1.36/net/ipv6/esp6.c	2004-08-12 19:59:52 +10:00
+++ edited/net/ipv6/esp6.c	2004-08-14 09:33:25 +10:00
@@ -302,11 +302,11 @@
 {
 	struct esp_data *esp = NULL;
 
+	/* null auth and encryption can have zero length keys */
 	if (x->aalg) {
-		if (x->aalg->alg_key_len == 0 || x->aalg->alg_key_len > 512)
+		if (x->aalg->alg_key_len > 512)
 			goto error;
-	}
-	if (x->ealg == NULL)
+	} else if (x->ealg == NULL)
 		goto error;
 
 	if (x->encap)