utils: Use chunk_equals_const() for all cryptographic purposes

src/libcharon/encoding/message.c

@@ -2625,7 +2625,7 @@ METHOD(message_t, parse_body, status_t,
 			other_hash = hash_payload->get_hash(hash_payload);
 			DBG3(DBG_ENC, "HASH received %B\nHASH expected %B",
 				 &other_hash, &hash);
-			if (!chunk_equals(hash, other_hash))
+			if (!chunk_equals_const(hash, other_hash))
 			{
 				DBG1(DBG_ENC, "received HASH payload does not match");
 				chunk_free(&hash);

src/libcharon/network/receiver.c

@@ -247,7 +247,7 @@ static bool cookie_verify(private_receiver_t *this, message_t *message,
 	{
 		return FALSE;
 	}
-	if (chunk_equals(reference, cookie))
+	if (chunk_equals_const(reference, cookie))
 	{
 		chunk_free(&reference);
 		return TRUE;

src/libcharon/plugins/eap_aka/eap_aka_server.c

@@ -425,7 +425,7 @@ static status_t process_challenge(private_eap_aka_server_t *this,
 	enumerator->destroy(enumerator);
 
 	/* compare received RES against stored XRES */
-	if (!chunk_equals(res, this->xres))
+	if (!chunk_equals_const(res, this->xres))
 	{
 		DBG1(DBG_IKE, "received RES does not match XRES");
 		return FAILED;
@@ -486,7 +486,7 @@ static status_t process_reauthentication(private_eap_aka_server_t *this,
 		this->crypto->clear_keys(this->crypto);
 		return challenge(this, out);
 	}
-	if (!chunk_equals(counter, this->counter))
+	if (!chunk_equals_const(counter, this->counter))
 	{
 		DBG1(DBG_IKE, "received counter does not match");
 		return FAILED;
@@ -730,4 +730,3 @@ eap_aka_server_t *eap_aka_server_create(identification_t *server,
 
 	return &this->public;
 }
-

src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c

@@ -812,7 +812,7 @@ static status_t process_peer_success(private_eap_mschapv2_t *this,
 		goto error;
 	}
 
-	if (!chunk_equals(this->auth_response, auth_string))
+	if (!chunk_equals_const(this->auth_response, auth_string))
 	{
 		DBG1(DBG_IKE, "EAP-MS-CHAPv2 verification failed");
 		goto error;

src/libcharon/plugins/eap_sim/eap_sim_server.c

@@ -262,7 +262,7 @@ static status_t process_reauthentication(private_eap_sim_server_t *this,
 		this->crypto->clear_keys(this->crypto);
 		return initiate(this, out);
 	}
-	if (!chunk_equals(counter, this->counter))
+	if (!chunk_equals_const(counter, this->counter))
 	{
 		DBG1(DBG_IKE, "received counter does not match");
 		return FAILED;
@@ -644,4 +644,3 @@ eap_sim_server_t *eap_sim_server_create(identification_t *server,
 
 	return &this->public;
 }
-

src/libcharon/plugins/xauth_generic/xauth_generic.c

@@ -180,7 +180,7 @@ METHOD(xauth_method_t, process_server, status_t,
 										SHARED_EAP, this->server, this->peer);
 	while (enumerator->enumerate(enumerator, &shared, NULL, NULL))
 	{
-		if (chunk_equals(shared->get_key(shared), pass))
+		if (chunk_equals_const(shared->get_key(shared), pass))
 		{
 			status = SUCCESS;
 			break;

src/libcharon/sa/ikev1/authenticators/psk_v1_authenticator.c

@@ -124,7 +124,7 @@ METHOD(authenticator_t, process, status_t,
 		return FAILED;
 	}
 	free(dh.ptr);
-	if (chunk_equals(hash, hash_payload->get_hash(hash_payload)))
+	if (chunk_equals_const(hash, hash_payload->get_hash(hash_payload)))
 	{
 		free(hash.ptr);
 		if (!this->hybrid)

src/libcharon/sa/ikev2/authenticators/eap_authenticator.c

@@ -464,7 +464,7 @@ static bool verify_auth(private_eap_authenticator_t *this, message_t *message,
 		return FALSE;
 	}
 	recv_auth_data = auth_payload->get_data(auth_payload);
-	if (!auth_data.len || !chunk_equals(auth_data, recv_auth_data))
+	if (!auth_data.len || !chunk_equals_const(auth_data, recv_auth_data))
 	{
 		DBG1(DBG_IKE, "verification of AUTH payload with%s EAP MSK failed",
 			 this->msk.ptr ? "" : "out");

src/libcharon/sa/ikev2/authenticators/psk_authenticator.c

@@ -123,7 +123,7 @@ METHOD(authenticator_t, process, status_t,
 		{
 			continue;
 		}
-		if (auth_data.len && chunk_equals(auth_data, recv_auth_data))
+		if (auth_data.len && chunk_equals_const(auth_data, recv_auth_data))
 		{
 			DBG1(DBG_IKE, "authentication of '%Y' with %N successful",
 				 other_id, auth_method_names, AUTH_PSK);

src/libcharon/sa/ikev2/tasks/ike_mobike.c

@@ -537,7 +537,7 @@ METHOD(task_t, process_i, status_t,
 			cookie2 = this->cookie2;
 			this->cookie2 = chunk_empty;
 			process_payloads(this, message);
-			if (!chunk_equals(cookie2, this->cookie2))
+			if (!chunk_equals_const(cookie2, this->cookie2))
 			{
 				chunk_free(&cookie2);
 				DBG1(DBG_IKE, "COOKIE2 mismatch, closing IKE_SA");