denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Include the used reserved bytes from ID payloads in AUTH calculation

Browse Source
This commit is contained in:
Martin Willi
2011-01-05 16:45:53 +01:00
parent 502edf425f
commit 5f15faebc8
12 changed files with 132 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/authenticators/authenticator.c
+12 -8
View File
@@ -39,7 +39,8 @@ ENUM_END(auth_method_names, AUTH_ECDSA_521);
*/
authenticator_t *authenticator_create_builder(ike_sa_t *ike_sa, auth_cfg_t *cfg,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init)
chunk_t received_init, chunk_t sent_init,
char reserved[3])
{
switch ((uintptr_t)cfg->get(cfg, AUTH_RULE_AUTH_CLASS))
{
@@ -47,13 +48,14 @@ authenticator_t *authenticator_create_builder(ike_sa_t *ike_sa, auth_cfg_t *cfg,
/* defaults to PUBKEY */
case AUTH_CLASS_PUBKEY:
return (authenticator_t*)pubkey_authenticator_create_builder(ike_sa,
received_nonce, sent_init);
received_nonce, sent_init, reserved);
case AUTH_CLASS_PSK:
return (authenticator_t*)psk_authenticator_create_builder(ike_sa,
received_nonce, sent_init);
received_nonce, sent_init, reserved);
case AUTH_CLASS_EAP:
return (authenticator_t*)eap_authenticator_create_builder(ike_sa,
received_nonce, sent_nonce, received_init, sent_init);
received_nonce, sent_nonce,
received_init, sent_init, reserved);
default:
return NULL;
}
@@ -65,7 +67,8 @@ authenticator_t *authenticator_create_builder(ike_sa_t *ike_sa, auth_cfg_t *cfg,
authenticator_t *authenticator_create_verifier(
ike_sa_t *ike_sa, message_t *message,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init)
chunk_t received_init, chunk_t sent_init,
char reserved[3])
{
auth_payload_t *auth_payload;
@@ -73,7 +76,8 @@ authenticator_t *authenticator_create_verifier(
if (auth_payload == NULL)
{
return (authenticator_t*)eap_authenticator_create_verifier(ike_sa,
received_nonce, sent_nonce, received_init, sent_init);
received_nonce, sent_nonce,
received_init, sent_init, reserved);
}
switch (auth_payload->get_auth_method(auth_payload))
{
@@ -82,10 +86,10 @@ authenticator_t *authenticator_create_verifier(
case AUTH_ECDSA_384:
case AUTH_ECDSA_521:
return (authenticator_t*)pubkey_authenticator_create_verifier(ike_sa,
sent_nonce, received_init);
sent_nonce, received_init, reserved);
case AUTH_PSK:
return (authenticator_t*)psk_authenticator_create_verifier(ike_sa,
sent_nonce, received_init);
sent_nonce, received_init, reserved);
default:
return NULL;
}
src/libcharon/sa/authenticators/authenticator.h
+6 -2
View File
@@ -130,12 +130,14 @@ struct authenticator_t {
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @param sent_init sent IKE_SA_INIT message data
* @param reserved reserved bytes of the ID payload
* @return authenticator, NULL if not supported
*/
authenticator_t *authenticator_create_builder(
ike_sa_t *ike_sa, auth_cfg_t *cfg,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init);
chunk_t received_init, chunk_t sent_init,
char reserved[3]);
/**
* Create an authenticator to verify signatures.
@@ -146,11 +148,13 @@ authenticator_t *authenticator_create_builder(
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @param sent_init sent IKE_SA_INIT message data
* @param reserved reserved bytes of the ID payload
* @return authenticator, NULL if not supported
*/
authenticator_t *authenticator_create_verifier(
ike_sa_t *ike_sa, message_t *message,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init);
chunk_t received_init, chunk_t sent_init,
char reserved[3]);
#endif /** AUTHENTICATOR_H_ @}*/
src/libcharon/sa/authenticators/eap_authenticator.c
+14 -4
View File
@@ -57,6 +57,11 @@ struct private_eap_authenticator_t {
*/
chunk_t sent_init;
/**
* Reserved bytes of ID payload
*/
char reserved[3];
/**
* Current EAP method processing
*/
@@ -422,7 +427,7 @@ static bool verify_auth(private_eap_authenticator_t *this, message_t *message,
other_id = this->ike_sa->get_other_id(this->ike_sa);
keymat = this->ike_sa->get_keymat(this->ike_sa);
auth_data = keymat->get_psk_sig(keymat, TRUE, init, nonce,
this->msk, other_id);
this->msk, other_id, this->reserved);
recv_auth_data = auth_payload->get_data(auth_payload);
if (!auth_data.len || !chunk_equals(auth_data, recv_auth_data))
{
@@ -458,7 +463,8 @@ static void build_auth(private_eap_authenticator_t *this, message_t *message,
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N",
my_id, auth_class_names, AUTH_CLASS_EAP);
auth_data = keymat->get_psk_sig(keymat, FALSE, init, nonce, this->msk, my_id);
auth_data = keymat->get_psk_sig(keymat, FALSE, init, nonce,
this->msk, my_id, this->reserved);
auth_payload = auth_payload_create();
auth_payload->set_auth_method(auth_payload, AUTH_PSK);
auth_payload->set_data(auth_payload, auth_data);
@@ -642,7 +648,8 @@ METHOD(authenticator_t, destroy, void,
*/
eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init)
chunk_t received_init, chunk_t sent_init,
char reserved[3])
{
private_eap_authenticator_t *this;
@@ -661,6 +668,7 @@ eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
.sent_init = sent_init,
.sent_nonce = sent_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
@@ -670,7 +678,8 @@ eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
*/
eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init)
chunk_t received_init, chunk_t sent_init,
char reserved[3])
{
private_eap_authenticator_t *this;
@@ -689,6 +698,7 @@ eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
.sent_init = sent_init,
.sent_nonce = sent_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
src/libcharon/sa/authenticators/eap_authenticator.h
+6 -2
View File
@@ -75,11 +75,13 @@ struct eap_authenticator_t {
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @param sent_init sent IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return EAP authenticator
*/
eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init);
chunk_t received_init, chunk_t sent_init,
char reserved[3]);
/**
* Create an authenticator to authenticate EAP clients.
@@ -89,10 +91,12 @@ eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @param sent_init sent IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return EAP authenticator
*/
eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init);
chunk_t received_init, chunk_t sent_init,
char reserved[3]);
#endif /** EAP_AUTHENTICATOR_H_ @}*/
src/libcharon/sa/authenticators/psk_authenticator.c
+16 -5
View File
@@ -45,6 +45,11 @@ struct private_psk_authenticator_t {
* IKE_SA_INIT message data to include in AUTH calculation
*/
chunk_t ike_sa_init;
/**
* Reserved bytes of ID payload
*/
char reserved[3];
};
METHOD(authenticator_t, build, status_t,
@@ -68,7 +73,7 @@ METHOD(authenticator_t, build, status_t,
return NOT_FOUND;
}
auth_data = keymat->get_psk_sig(keymat, FALSE, this->ike_sa_init,
this->nonce, key->get_key(key), my_id);
this->nonce, key->get_key(key), my_id, this->reserved);
key->destroy(key);
DBG2(DBG_IKE, "successfully created shared key MAC");
auth_payload = auth_payload_create();
@@ -109,7 +114,7 @@ METHOD(authenticator_t, process, status_t,
keys_found++;
auth_data = keymat->get_psk_sig(keymat, TRUE, this->ike_sa_init,
this->nonce, key->get_key(key), other_id);
this->nonce, key->get_key(key), other_id, this->reserved);
if (auth_data.len && chunk_equals(auth_data, recv_auth_data))
{
DBG1(DBG_IKE, "authentication of '%Y' with %N successful",
@@ -147,7 +152,8 @@ METHOD(authenticator_t, destroy, void,
* Described in header.
*/
psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init)
chunk_t received_nonce, chunk_t sent_init,
char reserved[3])
{
private_psk_authenticator_t *this;
@@ -159,11 +165,13 @@ psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
.is_mutual = (void*)return_false,
.destroy = _destroy,
},
}.
},
.ike_sa = ike_sa,
.ike_sa_init = sent_init,
.nonce = received_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
@@ -171,7 +179,8 @@ psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
* Described in header.
*/
psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init)
chunk_t sent_nonce, chunk_t received_init,
char reserved[3])
{
private_psk_authenticator_t *this;
@@ -188,6 +197,8 @@ psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
.ike_sa_init = received_init,
.nonce = sent_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
src/libcharon/sa/authenticators/psk_authenticator.h
+6 -2
View File
@@ -42,10 +42,12 @@ struct psk_authenticator_t {
* @param ike_sa associated ike_sa
* @param received_nonce nonce received in IKE_SA_INIT
* @param sent_init sent IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return PSK authenticator
*/
psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init);
chunk_t received_nonce, chunk_t sent_init,
char reserved[3]);
/**
* Create an authenticator to verify PSK signatures.
@@ -53,9 +55,11 @@ psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
* @param ike_sa associated ike_sa
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return PSK authenticator
*/
psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init);
chunk_t sent_nonce, chunk_t received_init,
char reserved[3]);
#endif /** PSK_AUTHENTICATOR_H_ @}*/
src/libcharon/sa/authenticators/pubkey_authenticator.c
+15 -4
View File
@@ -46,6 +46,11 @@ struct private_pubkey_authenticator_t {
* IKE_SA_INIT message data to include in AUTH calculation
*/
chunk_t ike_sa_init;
/**
* Reserved bytes of ID payload
*/
char reserved[3];
};
METHOD(authenticator_t, build, status_t,
@@ -107,7 +112,7 @@ METHOD(authenticator_t, build, status_t,
}
keymat = this->ike_sa->get_keymat(this->ike_sa);
octets = keymat->get_auth_octets(keymat, FALSE, this->ike_sa_init,
this->nonce, id);
this->nonce, id, this->reserved);
if (private->sign(private, scheme, octets, &auth_data))
{
auth_payload = auth_payload_create();
@@ -171,7 +176,7 @@ METHOD(authenticator_t, process, status_t,
id = this->ike_sa->get_other_id(this->ike_sa);
keymat = this->ike_sa->get_keymat(this->ike_sa);
octets = keymat->get_auth_octets(keymat, TRUE, this->ike_sa_init,
this->nonce, id);
this->nonce, id, this->reserved);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
key_type, id, auth);
@@ -212,7 +217,8 @@ METHOD(authenticator_t, destroy, void,
* Described in header.
*/
pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init)
chunk_t received_nonce, chunk_t sent_init,
char reserved[3])
{
private_pubkey_authenticator_t *this;
@@ -229,6 +235,8 @@ pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
.ike_sa_init = sent_init,
.nonce = received_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
@@ -236,7 +244,8 @@ pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
* Described in header.
*/
pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init)
chunk_t sent_nonce, chunk_t received_init,
char reserved[3])
{
private_pubkey_authenticator_t *this;
@@ -253,5 +262,7 @@ pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
.ike_sa_init = received_init,
.nonce = sent_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
src/libcharon/sa/authenticators/pubkey_authenticator.h
+6 -2
View File
@@ -43,10 +43,12 @@ struct pubkey_authenticator_t {
* @param ike_sa associated ike_sa
* @param received_nonce nonce received in IKE_SA_INIT
* @param sent_init sent IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return public key authenticator
*/
pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init);
chunk_t received_nonce, chunk_t sent_init,
char reserved[3]);
/**
* Create an authenticator to verify public key signatures.
@@ -54,9 +56,11 @@ pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
* @param ike_sa associated ike_sa
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return public key authenticator
*/
pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init);
chunk_t sent_nonce, chunk_t received_init,
char reserved[3]);
#endif /** PUBKEY_AUTHENTICATOR_H_ @}*/