diff options
| author | Steffan Karger <steffan@karger.me> | 2014-07-29 22:52:24 +0200 |
|---|---|---|
| committer | Gert Doering <gert@greenie.muc.de> | 2015-02-27 17:02:45 +0100 |
| commit | 669f898b8fcaf7a8d43825fa0255c2791cc0ef89 (patch) | |
| tree | f663383f802900284a6455142501eba151f30185 /src | |
| parent | 513eef4884c9be1fd31ba676dfe34d91a4ce6141 (diff) | |
| download | openvpn-669f898b8fcaf7a8d43825fa0255c2791cc0ef89.tar.gz openvpn-669f898b8fcaf7a8d43825fa0255c2791cc0ef89.tar.xz openvpn-669f898b8fcaf7a8d43825fa0255c2791cc0ef89.zip | |
Fix frame size calculation for non-CBC modes.
CBC mode is the only mode that OpenVPN supports that needs padding. So,
only include the worst case padding size in the frame size calculation when
using CBC mode.
While doing so, rewrite crypto_adjust_frame_parameters() to be better
readable, and provide debug output (for high debug levels).
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1406667144-17674-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8952
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Diffstat (limited to 'src')
| -rw-r--r-- | src/openvpn/crypto.c | 26 |
1 files changed, 21 insertions, 5 deletions
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c index 5cf9b9c..c1b9df3 100644 --- a/src/openvpn/crypto.c +++ b/src/openvpn/crypto.c @@ -403,11 +403,27 @@ crypto_adjust_frame_parameters(struct frame *frame, bool packet_id, bool packet_id_long_form) { - frame_add_to_extra_frame (frame, - (packet_id ? packet_id_size (packet_id_long_form) : 0) + - ((cipher_defined && use_iv) ? cipher_kt_iv_size (kt->cipher) : 0) + - (cipher_defined ? cipher_kt_block_size (kt->cipher) : 0) + /* worst case padding expansion */ - kt->hmac_length); + size_t crypto_overhead = 0; + + if (packet_id) + crypto_overhead += packet_id_size (packet_id_long_form); + + if (cipher_defined) + { + if (use_iv) + crypto_overhead += cipher_kt_iv_size (kt->cipher); + + if (cipher_kt_mode_cbc (kt->cipher)) + /* worst case padding expansion */ + crypto_overhead += cipher_kt_block_size (kt->cipher); + } + + crypto_overhead += kt->hmac_length; + + frame_add_to_extra_frame (frame, crypto_overhead); + + msg(D_MTU_DEBUG, "%s: Adjusting frame parameters for crypto by %zu bytes", + __func__, crypto_overhead); } /* |