denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Select a signature scheme appropriate for the given key

Browse Source 
By enumerating hashes we'd use SHA-1 by default.  This way stronger
signature schemes are preferred.
This commit is contained in:
Tobias Brunner
2015-03-04 13:54:10 +01:00
parent 1f648d756b
commit 0bdc79b5f9
1 changed files with 13 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
+12 -17
View File
@@ -112,14 +112,11 @@ static signature_scheme_t select_signature_scheme(keymat_v2_t *keymat,
auth_cfg_t *auth, private_key_t *private) auth_cfg_t *auth, private_key_t *private)
{ {
enumerator_t *enumerator; enumerator_t *enumerator;
signature_scheme_t scheme = SIGN_UNKNOWN; signature_scheme_t selected = SIGN_UNKNOWN, scheme;
hash_algorithm_t hash;
char *plugin_name;
uintptr_t config; uintptr_t config;
auth_rule_t rule; auth_rule_t rule;
key_type_t key_type; key_type_t key_type;
bool have_config = FALSE; bool have_config = FALSE;
int oid;
key_type = private->get_type(private); key_type = private->get_type(private);
enumerator = auth->create_enumerator(auth); enumerator = auth->create_enumerator(auth);
@@ -134,32 +131,30 @@ static signature_scheme_t select_signature_scheme(keymat_v2_t *keymat,
keymat->hash_algorithm_supported(keymat, keymat->hash_algorithm_supported(keymat,
hasher_from_signature_scheme(config))) hasher_from_signature_scheme(config)))
{ {
scheme = config; selected = config;
break; break;
} }
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
if (scheme == SIGN_UNKNOWN && !have_config) if (selected == SIGN_UNKNOWN && !have_config)
{ {
/* if no specific configuration, find a scheme supported by us, the /* if no specific configuration, find a scheme appropriate for the key
* other peer and the key */ * and supported by the other peer */
enumerator = lib->crypto->create_hasher_enumerator(lib->crypto); enumerator = signature_schemes_for_key(key_type,
while (enumerator->enumerate(enumerator, &hash, &plugin_name)) private->get_keysize(private));
while (enumerator->enumerate(enumerator, &scheme))
{ {
if (keymat->hash_algorithm_supported(keymat, hash)) if (keymat->hash_algorithm_supported(keymat,
hasher_from_signature_scheme(scheme)))
{ {
oid = hasher_signature_algorithm_to_oid(hash, key_type); selected = scheme;
if (oid != OID_UNKNOWN)
{
scheme = signature_scheme_from_oid(oid);
break; break;
} }
} }
}
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
} }
return scheme; return selected;
} }
METHOD(authenticator_t, build, status_t, METHOD(authenticator_t, build, status_t,