denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't allocate extra memory to MAC the TLS header

Browse Source
This commit is contained in:
Martin Willi
2011-09-28 17:32:23 +02:00
parent b79bb79a66
commit 5976e149eb
1 changed files with 22 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_protection.c
+22 -21
View File
@@ -91,21 +91,26 @@ struct private_tls_protection_t {
}; };
/** /**
* Create the header to append to the record data to create the MAC * Create the header and feed it into a signer for MAC verification
*/ */
static chunk_t sigheader(u_int32_t seq, u_int8_t type, static void sigheader(signer_t *signer, u_int32_t seq, u_int8_t type,
u_int16_t version, u_int16_t length) u_int16_t version, u_int16_t length)
{ {
/* we only support 32 bit sequence numbers, but TLS uses 64 bit */ /* we only support 32 bit sequence numbers, but TLS uses 64 bit */
u_int32_t seq_high = 0; struct __attribute__((__packed__)) {
u_int32_t seq_high;
u_int32_t seq_low;
u_int8_t type;
u_int16_t version;
u_int16_t length;
} header = {
.type = type,
};
htoun32(&header.seq_low, seq);
htoun16(&header.version, version);
htoun16(&header.length, length);
seq = htonl(seq); signer->get_signature(signer, chunk_from_thing(header), NULL);
version = htons(version);
length = htons(length);
return chunk_cat("ccccc", chunk_from_thing(seq_high),
chunk_from_thing(seq), chunk_from_thing(type),
chunk_from_thing(version), chunk_from_thing(length));
} }
METHOD(tls_protection_t, process, status_t, METHOD(tls_protection_t, process, status_t,
@@ -162,7 +167,7 @@ METHOD(tls_protection_t, process, status_t,
} }
if (this->signer_in) if (this->signer_in)
{ {
chunk_t mac, macdata, header; chunk_t mac;
u_int8_t bs; u_int8_t bs;
bs = this->signer_in->get_block_size(this->signer_in); bs = this->signer_in->get_block_size(this->signer_in);
@@ -175,16 +180,13 @@ METHOD(tls_protection_t, process, status_t,
mac = chunk_skip(data, data.len - bs); mac = chunk_skip(data, data.len - bs);
data.len -= bs; data.len -= bs;
header = sigheader(this->seq_in, type, this->version, data.len); sigheader(this->signer_in, this->seq_in, type, this->version, data.len);
macdata = chunk_cat("mc", header, data); if (!this->signer_in->verify_signature(this->signer_in, data, mac))
if (!this->signer_in->verify_signature(this->signer_in, macdata, mac))
{ {
DBG1(DBG_TLS, "TLS record MAC verification failed"); DBG1(DBG_TLS, "TLS record MAC verification failed");
free(macdata.ptr);
this->alert->add(this->alert, TLS_FATAL, TLS_BAD_RECORD_MAC); this->alert->add(this->alert, TLS_FATAL, TLS_BAD_RECORD_MAC);
return NEED_MORE; return NEED_MORE;
} }
free(macdata.ptr);
} }
if (type == TLS_CHANGE_CIPHER_SPEC) if (type == TLS_CHANGE_CIPHER_SPEC)
@@ -214,11 +216,10 @@ METHOD(tls_protection_t, build, status_t,
{ {
if (this->signer_out) if (this->signer_out)
{ {
chunk_t mac, header; chunk_t mac;
header = sigheader(this->seq_out, *type, this->version, data->len); sigheader(this->signer_out, this->seq_out, *type,
this->signer_out->get_signature(this->signer_out, header, NULL); this->version, data->len);
free(header.ptr);
this->signer_out->allocate_signature(this->signer_out, *data, &mac); this->signer_out->allocate_signature(this->signer_out, *data, &mac);
if (this->crypter_out) if (this->crypter_out)
{ {