denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libipsec: Fix crypter lookup for AES-CTR

Browse Source 
Due to the nonce, the ESP key material is four bytes longer than needed for
the actual AES key.  The crypto plugins, however, register their AES-CTR
implementations with the AES key length, so the lookup here failed.

For IKEv2 the key material is allocated after creating a crypter instance
with the negotiated AES key size.  The length of the actual key material is
retrieved via get_key_size(), which adds the four bytes to the AES key length.

Fixes #1124.
This commit is contained in:
Tobias Brunner
2015-10-30 10:54:45 +01:00
parent 72cc029e24
commit 0e80127691
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libipsec/esp_context.c
+12 -1
View File
@@ -247,7 +247,18 @@ static bool create_traditional(private_esp_context_t *this, int enc_alg,
signer_t *signer = NULL; signer_t *signer = NULL;
iv_gen_t *ivg; iv_gen_t *ivg;
crypter = lib->crypto->create_crypter(lib->crypto, enc_alg, enc_key.len); switch (enc_alg)
{
case ENCR_AES_CTR:
/* the key includes a 4 byte salt */
crypter = lib->crypto->create_crypter(lib->crypto, enc_alg,
enc_key.len - 4);
break;
default:
crypter = lib->crypto->create_crypter(lib->crypto, enc_alg,
enc_key.len);
break;
}
if (!crypter) if (!crypter)
{ {
DBG1(DBG_ESP, "failed to create ESP context: unsupported encryption " DBG1(DBG_ESP, "failed to create ESP context: unsupported encryption "