denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented IKEv1 signature verification in openssl_rsa_public_key.c

Browse Source
This commit is contained in:
Andreas Steffen
2009-06-10 13:43:51 +02:00
parent c04bf43363
commit 29bbfc11ee
1 changed files with 54 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c
+54 -36
View File
@@ -60,49 +60,65 @@ static bool verify_emsa_pkcs1_signature(private_openssl_rsa_public_key_t *this,
int type, chunk_t data, chunk_t signature) int type, chunk_t data, chunk_t signature)
{ {
bool valid = FALSE; bool valid = FALSE;
const EVP_MD *hasher = EVP_get_digestbynid(type); int rsa_size = RSA_size(this->rsa);
if (!hasher)
/* OpenSSL expects a signature of exactly RSA size (no leading 0x00) */
if (signature.len > rsa_size)
{ {
return FALSE; signature = chunk_skip(signature, signature.len - rsa_size);
} }
EVP_MD_CTX *ctx = EVP_MD_CTX_create(); if (type == NID_undef)
EVP_PKEY *key = EVP_PKEY_new();
if (!ctx || !key)
{ {
goto error; chunk_t hash = chunk_alloc(rsa_size);
hash.len = RSA_public_decrypt(signature.len, signature.ptr, hash.ptr,
this->rsa, RSA_PKCS1_PADDING);
valid = chunk_equals(data, hash);
free(hash.ptr);
} }
else
if (!EVP_PKEY_set1_RSA(key, this->rsa))
{ {
goto error; EVP_MD_CTX *ctx;
} EVP_PKEY *key;
const EVP_MD *hasher;
if (!EVP_VerifyInit_ex(ctx, hasher, NULL))
{ hasher = EVP_get_digestbynid(type);
goto error; if (!hasher)
} {
return FALSE;
if (!EVP_VerifyUpdate(ctx, data.ptr, data.len)) }
{
goto error; ctx = EVP_MD_CTX_create();
} key = EVP_PKEY_new();
/* VerifyFinal expects a signature of exactly RSA size (no leading 0x00) */ if (!ctx || !key)
if (signature.len > RSA_size(this->rsa)) {
{ goto error;
signature = chunk_skip(signature, signature.len - RSA_size(this->rsa)); }
} if (!EVP_PKEY_set1_RSA(key, this->rsa))
valid = (EVP_VerifyFinal(ctx, signature.ptr, signature.len, key) == 1); {
goto error;
}
if (!EVP_VerifyInit_ex(ctx, hasher, NULL))
{
goto error;
}
if (!EVP_VerifyUpdate(ctx, data.ptr, data.len))
{
goto error;
}
valid = (EVP_VerifyFinal(ctx, signature.ptr, signature.len, key) == 1);
error: error:
if (key) if (key)
{ {
EVP_PKEY_free(key); EVP_PKEY_free(key);
} }
if (ctx) if (ctx)
{ {
EVP_MD_CTX_destroy(ctx); EVP_MD_CTX_destroy(ctx);
}
} }
return valid; return valid;
} }
@@ -124,6 +140,8 @@ static bool verify(private_openssl_rsa_public_key_t *this, signature_scheme_t sc
switch (scheme) switch (scheme)
{ {
case SIGN_DEFAULT: case SIGN_DEFAULT:
case SIGN_RSA_EMSA_PKCS1_NULL:
return verify_emsa_pkcs1_signature(this, NID_undef, data, signature);
case SIGN_RSA_EMSA_PKCS1_SHA1: case SIGN_RSA_EMSA_PKCS1_SHA1:
return verify_emsa_pkcs1_signature(this, NID_sha1, data, signature); return verify_emsa_pkcs1_signature(this, NID_sha1, data, signature);
case SIGN_RSA_EMSA_PKCS1_SHA256: case SIGN_RSA_EMSA_PKCS1_SHA256: