[src/trunk]: src/sys/netipsec Add a comment and a KASSERT. I remember wonderi...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/0e45a372f652
branches:  trunk
changeset: 323092:0e45a372f652
user:      maxv <maxv%NetBSD.org@localhost>
date:      Thu May 31 06:14:18 2018 +0000

description:
Add a comment and a KASSERT. I remember wondering whether this check was a
problem, since ARC4 has a blocksize of one. Normally ARC4 can't be used in
IPsec.

diffstat:

 sys/netipsec/xform_esp.c |  14 +++++++-------
 1 files changed, 7 insertions(+), 7 deletions(-)

diffs (38 lines):

diff -r 1b3b0ff229f9 -r 0e45a372f652 sys/netipsec/xform_esp.c
--- a/sys/netipsec/xform_esp.c  Thu May 31 05:52:09 2018 +0000
+++ b/sys/netipsec/xform_esp.c  Thu May 31 06:14:18 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: xform_esp.c,v 1.95 2018/05/31 05:52:09 maxv Exp $      */
+/*     $NetBSD: xform_esp.c,v 1.96 2018/05/31 06:14:18 maxv Exp $      */
 /*     $FreeBSD: xform_esp.c,v 1.2.2.1 2003/01/24 05:11:36 sam Exp $   */
 /*     $OpenBSD: ip_esp.c,v 1.69 2001/06/26 06:18:59 angelos Exp $ */
 
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.95 2018/05/31 05:52:09 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.96 2018/05/31 06:14:18 maxv Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
@@ -337,14 +337,14 @@
        alen = esph ? esph->authsize : 0;
 
        /*
-        * Verify payload length is multiple of encryption algorithm
-        * block size.
+        * Verify payload length is multiple of encryption algorithm block
+        * size.
         *
-        * NB: This works for the null algorithm because the blocksize
-        *     is 4 and all packets must be 4-byte aligned regardless
-        *     of the algorithm.
+        * The payload must also be 4-byte-aligned. This is implicitly
+        * verified here too, since the blocksize is always 4-byte-aligned.
         */
        plen = m->m_pkthdr.len - (skip + hlen + alen);
+       KASSERT((espx->blocksize & 3) == 0);
        if ((plen & (espx->blocksize - 1)) || (plen <= 0)) {
                char buf[IPSEC_ADDRSTRLEN];
                DPRINTF(("%s: payload of %d octets not a multiple of %d octets,"