denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Add hash algorithm used for RSASSA-PSS signature to log message

Browse Source
This commit is contained in:
Tobias Brunner
2017-11-17 09:30:53 +01:00
parent dfd5f090fb
commit 36ae037b81
1 changed files with 41 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
+41 -11
View File
@@ -211,8 +211,7 @@ static status_t sign_signature_auth(private_pubkey_authenticator_t *this,
{ {
enumerator_t *enumerator; enumerator_t *enumerator;
keymat_v2_t *keymat; keymat_v2_t *keymat;
signature_scheme_t scheme = SIGN_UNKNOWN; signature_params_t *params = NULL;
signature_params_t *params;
array_t *schemes; array_t *schemes;
chunk_t octets = chunk_empty; chunk_t octets = chunk_empty;
status_t status = FAILED; status_t status = FAILED;
@@ -234,8 +233,7 @@ static status_t sign_signature_auth(private_pubkey_authenticator_t *this,
enumerator = array_create_enumerator(schemes); enumerator = array_create_enumerator(schemes);
while (enumerator->enumerate(enumerator, &params)) while (enumerator->enumerate(enumerator, &params))
{ {
scheme = params->scheme; if (private->sign(private, params->scheme, params->params, octets,
if (private->sign(private, scheme, params->params, octets,
auth_data) && auth_data) &&
build_signature_auth_data(auth_data, params)) build_signature_auth_data(auth_data, params))
{ {
@@ -245,15 +243,33 @@ static status_t sign_signature_auth(private_pubkey_authenticator_t *this,
else else
{ {
DBG2(DBG_IKE, "unable to create %N signature for %N key", DBG2(DBG_IKE, "unable to create %N signature for %N key",
signature_scheme_names, scheme, key_type_names, signature_scheme_names, params->scheme, key_type_names,
private->get_type(private)); private->get_type(private));
} }
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
} }
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N %s", id, if (params)
signature_scheme_names, scheme, {
status == SUCCESS ? "successful" : "failed"); if (params->scheme == SIGN_RSA_EMSA_PSS)
{
rsa_pss_params_t *pss = params->params;
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N_%N %s", id,
signature_scheme_names, params->scheme,
hash_algorithm_short_names_upper, pss->hash,
status == SUCCESS ? "successful" : "failed");
}
else
{
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N %s", id,
signature_scheme_names, params->scheme,
status == SUCCESS ? "successful" : "failed");
}
}
else
{
DBG1(DBG_IKE, "authentication of '%Y' (myself) failed", id);
}
array_destroy_function(schemes, destroy_scheme, NULL); array_destroy_function(schemes, destroy_scheme, NULL);
chunk_free(&octets); chunk_free(&octets);
return status; return status;
@@ -465,9 +481,23 @@ METHOD(authenticator_t, process, status_t,
if (public->verify(public, params->scheme, params->params, octets, if (public->verify(public, params->scheme, params->params, octets,
auth_data)) auth_data))
{ {
DBG1(DBG_IKE, "authentication of '%Y' with %N successful", id, if (auth_method != AUTH_DS)
auth_method == AUTH_DS ? signature_scheme_names : auth_method_names, {
auth_method == AUTH_DS ? params->scheme : auth_method); DBG1(DBG_IKE, "authentication of '%Y' with %N successful", id,
auth_method_names, auth_method);
}
else if (params->scheme == SIGN_RSA_EMSA_PSS)
{
rsa_pss_params_t *pss = params->params;
DBG1(DBG_IKE, "authentication of '%Y' with %N_%N successful",
id, signature_scheme_names, params->scheme,
hash_algorithm_short_names_upper, pss->hash);
}
else
{
DBG1(DBG_IKE, "authentication of '%Y' with %N successful", id,
signature_scheme_names, params->scheme);
}
status = SUCCESS; status = SUCCESS;
auth->merge(auth, current_auth, FALSE); auth->merge(auth, current_auth, FALSE);
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY); auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);