denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Reset HMAC key if chunk_empty is passed

Browse Source 
If no valid key is configured (e.g. because it's inadvertently uninitialized),
we should not just reuse the previous key.

The `key_set` flag is not necessary anymore because a non-NULL key is set
during initialization since 6b347d5232 ("openssl: Ensure underlying hash
algorithm is available during HMAC init").
This commit is contained in:
Tobias Brunner
2021-02-11 16:40:58 +01:00
parent cd10ae2ff0
commit 6a440f83ab
1 changed files with 16 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_hmac.c
+16 -14
View File
@@ -76,37 +76,39 @@ struct private_mac_t {
*/
HMAC_CTX hmac_ctx;
#endif
/**
* Key set on HMAC_CTX?
*/
bool key_set;
};
METHOD(mac_t, set_key, bool,
private_mac_t *this, chunk_t key)
/**
* Resets the state with the given key, or only resets the internal state
* if key is chunk_empty.
*/
static bool reset(private_mac_t *this, chunk_t key)
{
#if OPENSSL_VERSION_NUMBER >= 0x10000000L
if (HMAC_Init_ex(this->hmac, key.ptr, key.len, this->hasher, NULL))
{
this->key_set = TRUE;
return TRUE;
}
return FALSE;
#else /* OPENSSL_VERSION_NUMBER < 1.0 */
HMAC_Init_ex(this->hmac, key.ptr, key.len, this->hasher, NULL);
this->key_set = TRUE;
return TRUE;
#endif
}
METHOD(mac_t, set_key, bool,
private_mac_t *this, chunk_t key)
{
if (!key.ptr)
{ /* HMAC_Init_ex() won't reset the key if a NULL pointer is passed */
key = chunk_from_str("");
}
return reset(this, key);
}
METHOD(mac_t, get_mac, bool,
private_mac_t *this, chunk_t data, uint8_t *out)
{
if (!this->key_set)
{
return FALSE;
}
#if OPENSSL_VERSION_NUMBER >= 0x10000000L
if (!HMAC_Update(this->hmac, data.ptr, data.len))
{
@@ -128,7 +130,7 @@ METHOD(mac_t, get_mac, bool,
}
HMAC_Final(this->hmac, out, NULL);
#endif
return set_key(this, chunk_empty);
return reset(this, chunk_empty);
}
METHOD(mac_t, get_mac_size, size_t,