denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use a more complete implementation of a HA specific diffie_hellman_t

Browse Source
This commit is contained in:
Martin Willi
2012-03-20 17:31:37 +01:00
parent 5763367cac
commit 264514826c
1 changed files with 50 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/ha/ha_dispatcher.c
+50 -11
View File
@@ -20,6 +20,7 @@
#include <processing/jobs/callback_job.h>
typedef struct private_ha_dispatcher_t private_ha_dispatcher_t;
typedef struct ha_diffie_hellman_t ha_diffie_hellman_t;
/**
* Private data of an ha_dispatcher_t object.
@@ -63,14 +64,52 @@ struct private_ha_dispatcher_t {
};
/**
* Quick and dirty hack implementation of diffie_hellman_t.get_shared_secret
* DH implementation for HA synced DH values
*/
static status_t get_shared_secret(diffie_hellman_t *this, chunk_t *secret)
struct ha_diffie_hellman_t {
/**
* Implements diffie_hellman_t
*/
diffie_hellman_t dh;
/**
* Shared secret
*/
chunk_t secret;
};
METHOD(diffie_hellman_t, dh_get_shared_secret, status_t,
ha_diffie_hellman_t *this, chunk_t *secret)
{
*secret = chunk_clone((*(chunk_t*)this->destroy));
*secret = chunk_clone(this->secret);
return SUCCESS;
}
METHOD(diffie_hellman_t, dh_destroy, void,
ha_diffie_hellman_t *this)
{
free(this);
}
/**
* Create a HA synced DH implementation
*/
static diffie_hellman_t *ha_diffie_hellman_create(chunk_t secret)
{
ha_diffie_hellman_t *this;
INIT(this,
.dh = {
.get_shared_secret = _dh_get_shared_secret,
.destroy = _dh_destroy,
},
.secret = secret,
);
return &this->dh;
}
/**
* Process messages of type IKE_ADD
*/
@@ -134,9 +173,7 @@ static void process_ike_add(private_ha_dispatcher_t *this, ha_message_t *message
if (ike_sa)
{
proposal_t *proposal;
/* quick and dirty hack of a DH implementation ;-) */
diffie_hellman_t dh = { .get_shared_secret = get_shared_secret,
.destroy = (void*)&secret };
diffie_hellman_t *dh;
proposal = proposal_create(PROTO_IKE, 0);
if (integ)
@@ -152,13 +189,15 @@ static void process_ike_add(private_ha_dispatcher_t *this, ha_message_t *message
proposal->add_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, prf, 0);
}
charon->bus->set_sa(charon->bus, ike_sa);
dh = ha_diffie_hellman_create(secret);
if (ike_sa->get_version(ike_sa) == IKEV2)
{
keymat_v2_t *keymat_v2 = (keymat_v2_t*)ike_sa->get_keymat(ike_sa);
ok = keymat_v2->derive_ike_keys(keymat_v2, proposal, &dh, nonce_i,
ok = keymat_v2->derive_ike_keys(keymat_v2, proposal, dh, nonce_i,
nonce_r, ike_sa->get_id(ike_sa), old_prf, old_skd);
}
dh->destroy(dh);
if (ok)
{
if (old_sa)
@@ -479,9 +518,7 @@ static void process_child_add(private_ha_dispatcher_t *this,
chunk_t nonce_i = chunk_empty, nonce_r = chunk_empty, secret = chunk_empty;
chunk_t encr_i, integ_i, encr_r, integ_r;
linked_list_t *local_ts, *remote_ts;
/* quick and dirty hack of a DH implementation */
diffie_hellman_t dh = { .get_shared_secret = get_shared_secret,
.destroy = (void*)&secret };
diffie_hellman_t *dh;
enumerator = message->create_attribute_enumerator(message);
while (enumerator->enumerate(enumerator, &attribute, &value))
@@ -575,14 +612,16 @@ static void process_child_add(private_ha_dispatcher_t *this,
proposal->add_algorithm(proposal, ENCRYPTION_ALGORITHM, encr, len);
}
proposal->add_algorithm(proposal, EXTENDED_SEQUENCE_NUMBERS, esn, 0);
dh = ha_diffie_hellman_create(secret);
if (ike_sa->get_version(ike_sa) == IKEV2)
{
keymat_v2_t *keymat_v2 = (keymat_v2_t*)ike_sa->get_keymat(ike_sa);
ok = keymat_v2->derive_child_keys(keymat_v2,
proposal, secret.ptr ? &dh : NULL, nonce_i, nonce_r,
proposal, secret.ptr ? dh : NULL, nonce_i, nonce_r,
&encr_i, &integ_i, &encr_r, &integ_r);
}
dh->destroy(dh);
if (!ok)
{
DBG1(DBG_CHD, "HA CHILD_SA key derivation failed");