denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Include the used reserved bytes from ID payloads in AUTH calculation

Browse Source
This commit is contained in:
Martin Willi
2011-01-05 16:45:53 +01:00
parent 502edf425f
commit 5f15faebc8
12 changed files with 132 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/keymat.c
+4 -4
View File
@@ -540,7 +540,7 @@ METHOD(keymat_t, get_aead, aead_t*,
METHOD(keymat_t, get_auth_octets, chunk_t,
private_keymat_t *this, bool verify, chunk_t ike_sa_init,
chunk_t nonce, identification_t *id)
chunk_t nonce, identification_t *id, char reserved[3])
{
chunk_t chunk, idx, octets;
chunk_t skp;
@@ -548,8 +548,8 @@ METHOD(keymat_t, get_auth_octets, chunk_t,
skp = verify ? this->skp_verify : this->skp_build;
chunk = chunk_alloca(4);
memset(chunk.ptr, 0, chunk.len);
chunk.ptr[0] = id->get_type(id);
memcpy(chunk.ptr + 1, reserved, 3);
idx = chunk_cata("cc", chunk, id->get_encoding(id));
DBG3(DBG_IKE, "IDx' %B", &idx);
@@ -570,7 +570,7 @@ METHOD(keymat_t, get_auth_octets, chunk_t,
METHOD(keymat_t, get_psk_sig, chunk_t,
private_keymat_t *this, bool verify, chunk_t ike_sa_init,
chunk_t nonce, chunk_t secret, identification_t *id)
chunk_t nonce, chunk_t secret, identification_t *id, char reserved[3])
{
chunk_t key_pad, key, sig, octets;
@@ -578,7 +578,7 @@ METHOD(keymat_t, get_psk_sig, chunk_t,
{ /* EAP uses SK_p if no MSK has been established */
secret = verify ? this->skp_verify : this->skp_build;
}
octets = get_auth_octets(this, verify, ike_sa_init, nonce, id);
octets = get_auth_octets(this, verify, ike_sa_init, nonce, id, reserved);
/* AUTH = prf(prf(Shared Secret,"Key Pad for IKEv2"), <msg octets>) */
key_pad = chunk_create(IKEV2_KEY_PAD, IKEV2_KEY_PAD_LENGTH);
this->prf->set_key(this->prf, secret);