removed trailing spaces ([[:space:]]+$)
This commit is contained in:
@@ -75,7 +75,7 @@ authenticator_t *authenticator_create_verifier(
|
||||
chunk_t received_init, chunk_t sent_init)
|
||||
{
|
||||
auth_payload_t *auth_payload;
|
||||
|
||||
|
||||
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
|
||||
if (auth_payload == NULL)
|
||||
{
|
||||
|
||||
@@ -36,34 +36,34 @@ typedef struct authenticator_t authenticator_t;
|
||||
*/
|
||||
enum auth_method_t {
|
||||
/**
|
||||
* Computed as specified in section 2.15 of RFC using
|
||||
* Computed as specified in section 2.15 of RFC using
|
||||
* an RSA private key over a PKCS#1 padded hash.
|
||||
*/
|
||||
AUTH_RSA = 1,
|
||||
|
||||
|
||||
/**
|
||||
* Computed as specified in section 2.15 of RFC using the
|
||||
* shared key associated with the identity in the ID payload
|
||||
* Computed as specified in section 2.15 of RFC using the
|
||||
* shared key associated with the identity in the ID payload
|
||||
* and the negotiated prf function
|
||||
*/
|
||||
AUTH_PSK = 2,
|
||||
|
||||
|
||||
/**
|
||||
* Computed as specified in section 2.15 of RFC using a
|
||||
* Computed as specified in section 2.15 of RFC using a
|
||||
* DSS private key over a SHA-1 hash.
|
||||
*/
|
||||
AUTH_DSS = 3,
|
||||
|
||||
|
||||
/**
|
||||
* ECDSA with SHA-256 on the P-256 curve as specified in RFC 4754
|
||||
*/
|
||||
AUTH_ECDSA_256 = 9,
|
||||
|
||||
|
||||
/**
|
||||
* ECDSA with SHA-384 on the P-384 curve as specified in RFC 4754
|
||||
*/
|
||||
AUTH_ECDSA_384 = 10,
|
||||
|
||||
|
||||
/**
|
||||
* ECDSA with SHA-512 on the P-521 curve as specified in RFC 4754
|
||||
*/
|
||||
@@ -115,7 +115,7 @@ struct authenticator_t {
|
||||
* - NEED_MORE if another exchange required
|
||||
*/
|
||||
status_t (*process)(authenticator_t *this, message_t *message);
|
||||
|
||||
|
||||
/**
|
||||
* Attach authentication data to an outgoing message.
|
||||
*
|
||||
@@ -126,7 +126,7 @@ struct authenticator_t {
|
||||
* - NEED_MORE if another exchange required
|
||||
*/
|
||||
status_t (*build)(authenticator_t *this, message_t *message);
|
||||
|
||||
|
||||
/**
|
||||
* Destroy authenticator instance.
|
||||
*/
|
||||
@@ -151,7 +151,7 @@ authenticator_t *authenticator_create_builder(
|
||||
|
||||
/**
|
||||
* Create an authenticator to verify signatures.
|
||||
*
|
||||
*
|
||||
* @param ike_sa associated ike_sa
|
||||
* @param message message containing authentication data
|
||||
* @param received_nonce nonce received in IKE_SA_INIT
|
||||
|
||||
@@ -25,22 +25,22 @@ typedef struct eap_entry_t eap_entry_t;
|
||||
* EAP constructor entry
|
||||
*/
|
||||
struct eap_entry_t {
|
||||
|
||||
|
||||
/**
|
||||
* EAP method type, vendor specific if vendor is set
|
||||
*/
|
||||
eap_type_t type;
|
||||
|
||||
|
||||
/**
|
||||
* vendor ID, 0 for default EAP methods
|
||||
*/
|
||||
u_int32_t vendor;
|
||||
|
||||
|
||||
/**
|
||||
* Role of the method returned by the constructor, EAP_SERVER or EAP_PEER
|
||||
*/
|
||||
eap_role_t role;
|
||||
|
||||
|
||||
/**
|
||||
* constructor function to create instance
|
||||
*/
|
||||
@@ -56,12 +56,12 @@ struct private_eap_manager_t {
|
||||
* public functions
|
||||
*/
|
||||
eap_manager_t public;
|
||||
|
||||
|
||||
/**
|
||||
* list of eap_entry_t's
|
||||
*/
|
||||
linked_list_t *methods;
|
||||
|
||||
|
||||
/**
|
||||
* rwlock to lock methods
|
||||
*/
|
||||
@@ -76,7 +76,7 @@ static void add_method(private_eap_manager_t *this, eap_type_t type,
|
||||
eap_constructor_t constructor)
|
||||
{
|
||||
eap_entry_t *entry = malloc_thing(eap_entry_t);
|
||||
|
||||
|
||||
entry->type = type;
|
||||
entry->vendor = vendor;
|
||||
entry->role = role;
|
||||
@@ -94,7 +94,7 @@ static void remove_method(private_eap_manager_t *this, eap_constructor_t constru
|
||||
{
|
||||
enumerator_t *enumerator;
|
||||
eap_entry_t *entry;
|
||||
|
||||
|
||||
this->lock->write_lock(this->lock);
|
||||
enumerator = this->methods->create_enumerator(this->methods);
|
||||
while (enumerator->enumerate(enumerator, &entry))
|
||||
@@ -120,7 +120,7 @@ static eap_method_t* create_instance(private_eap_manager_t *this,
|
||||
enumerator_t *enumerator;
|
||||
eap_entry_t *entry;
|
||||
eap_method_t *method = NULL;
|
||||
|
||||
|
||||
this->lock->read_lock(this->lock);
|
||||
enumerator = this->methods->create_enumerator(this->methods);
|
||||
while (enumerator->enumerate(enumerator, &entry))
|
||||
@@ -156,15 +156,15 @@ static void destroy(private_eap_manager_t *this)
|
||||
eap_manager_t *eap_manager_create()
|
||||
{
|
||||
private_eap_manager_t *this = malloc_thing(private_eap_manager_t);
|
||||
|
||||
|
||||
this->public.add_method = (void(*)(eap_manager_t*, eap_type_t type, u_int32_t vendor, eap_role_t role, eap_constructor_t constructor))add_method;
|
||||
this->public.remove_method = (void(*)(eap_manager_t*, eap_constructor_t constructor))remove_method;
|
||||
this->public.create_instance = (eap_method_t*(*)(eap_manager_t*, eap_type_t type, u_int32_t vendor, eap_role_t role, identification_t*,identification_t*))create_instance;
|
||||
this->public.destroy = (void(*)(eap_manager_t*))destroy;
|
||||
|
||||
|
||||
this->methods = linked_list_create();
|
||||
this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
|
||||
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
|
||||
@@ -45,14 +45,14 @@ struct eap_manager_t {
|
||||
*/
|
||||
void (*add_method)(eap_manager_t *this, eap_type_t type, u_int32_t vendor,
|
||||
eap_role_t role, eap_constructor_t constructor);
|
||||
|
||||
|
||||
/**
|
||||
* Unregister a EAP method implementation using it's constructor.
|
||||
*
|
||||
* @param constructor constructor function to remove, as added in add_method
|
||||
*/
|
||||
void (*remove_method)(eap_manager_t *this, eap_constructor_t constructor);
|
||||
|
||||
|
||||
/**
|
||||
* Create a new EAP method instance.
|
||||
*
|
||||
@@ -67,7 +67,7 @@ struct eap_manager_t {
|
||||
u_int32_t vendor, eap_role_t role,
|
||||
identification_t *server,
|
||||
identification_t *peer);
|
||||
|
||||
|
||||
/**
|
||||
* Destroy a eap_manager instance.
|
||||
*/
|
||||
|
||||
@@ -53,7 +53,7 @@ eap_type_t eap_type_from_string(char *name)
|
||||
{"mschapv2", EAP_MSCHAPV2},
|
||||
{"radius", EAP_RADIUS},
|
||||
};
|
||||
|
||||
|
||||
for (i = 0; i < countof(types); i++)
|
||||
{
|
||||
if (strcaseeq(name, types[i].name))
|
||||
|
||||
@@ -107,7 +107,7 @@ extern enum_name_t *eap_code_names;
|
||||
* EAP-Identity exchange always uses identifier 0.
|
||||
*/
|
||||
struct eap_method_t {
|
||||
|
||||
|
||||
/**
|
||||
* Initiate the EAP exchange.
|
||||
*
|
||||
@@ -121,7 +121,7 @@ struct eap_method_t {
|
||||
* - FAILED, if unable to create eap request payload
|
||||
*/
|
||||
status_t (*initiate) (eap_method_t *this, eap_payload_t **out);
|
||||
|
||||
|
||||
/**
|
||||
* Process a received EAP message.
|
||||
*
|
||||
@@ -136,7 +136,7 @@ struct eap_method_t {
|
||||
*/
|
||||
status_t (*process) (eap_method_t *this, eap_payload_t *in,
|
||||
eap_payload_t **out);
|
||||
|
||||
|
||||
/**
|
||||
* Get the EAP type implemented in this method.
|
||||
*
|
||||
@@ -144,17 +144,17 @@ struct eap_method_t {
|
||||
* @return type of the EAP method
|
||||
*/
|
||||
eap_type_t (*get_type) (eap_method_t *this, u_int32_t *vendor);
|
||||
|
||||
|
||||
/**
|
||||
* Check if this EAP method authenticates the server.
|
||||
*
|
||||
* Some EAP methods provide mutual authentication and
|
||||
* Some EAP methods provide mutual authentication and
|
||||
* allow authentication using only EAP, if the peer supports it.
|
||||
*
|
||||
* @return TRUE if methods provides mutual authentication
|
||||
*/
|
||||
bool (*is_mutual) (eap_method_t *this);
|
||||
|
||||
|
||||
/**
|
||||
* Get the MSK established by this EAP method.
|
||||
*
|
||||
@@ -167,7 +167,7 @@ struct eap_method_t {
|
||||
* - FAILED, if MSK not established (yet)
|
||||
*/
|
||||
status_t (*get_msk) (eap_method_t *this, chunk_t *msk);
|
||||
|
||||
|
||||
/**
|
||||
* Destroys a eap_method_t object.
|
||||
*/
|
||||
|
||||
@@ -23,17 +23,17 @@ typedef struct private_sim_manager_t private_sim_manager_t;
|
||||
* Private data of an sim_manager_t object.
|
||||
*/
|
||||
struct private_sim_manager_t {
|
||||
|
||||
|
||||
/**
|
||||
* Public sim_manager_t interface.
|
||||
*/
|
||||
sim_manager_t public;
|
||||
|
||||
|
||||
/**
|
||||
* list of added cards
|
||||
*/
|
||||
linked_list_t *cards;
|
||||
|
||||
|
||||
/**
|
||||
* list of added provider
|
||||
*/
|
||||
@@ -106,7 +106,7 @@ static void destroy(private_sim_manager_t *this)
|
||||
sim_manager_t *sim_manager_create()
|
||||
{
|
||||
private_sim_manager_t *this = malloc_thing(private_sim_manager_t);
|
||||
|
||||
|
||||
this->public.add_card = (void(*)(sim_manager_t*, sim_card_t *card))add_card;
|
||||
this->public.remove_card = (void(*)(sim_manager_t*, sim_card_t *card))remove_card;
|
||||
this->public.create_card_enumerator = (enumerator_t*(*)(sim_manager_t*))create_card_enumerator;
|
||||
@@ -114,10 +114,10 @@ sim_manager_t *sim_manager_create()
|
||||
this->public.remove_provider = (void(*)(sim_manager_t*, sim_provider_t *provider))remove_provider;
|
||||
this->public.create_provider_enumerator = (enumerator_t*(*)(sim_manager_t*))create_provider_enumerator;
|
||||
this->public.destroy = (void(*)(sim_manager_t*))destroy;
|
||||
|
||||
|
||||
this->cards = linked_list_create();
|
||||
this->provider = linked_list_create();
|
||||
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
|
||||
@@ -42,7 +42,7 @@ struct sim_card_t {
|
||||
* @return identity
|
||||
*/
|
||||
identification_t* (*get_imsi)(sim_card_t *this);
|
||||
|
||||
|
||||
/**
|
||||
* Calculate SRES/KC from a RAND.
|
||||
*
|
||||
@@ -59,7 +59,7 @@ struct sim_card_t {
|
||||
* Interface for a triplet provider (used as EAP server).
|
||||
*/
|
||||
struct sim_provider_t {
|
||||
|
||||
|
||||
/**
|
||||
* Get a single triplet to authenticate a EAP client.
|
||||
*
|
||||
@@ -77,49 +77,49 @@ struct sim_provider_t {
|
||||
* The EAP-SIM manager handles multiple SIM cards and providers.
|
||||
*/
|
||||
struct sim_manager_t {
|
||||
|
||||
|
||||
/**
|
||||
* Register a SIM card (client) at the manager.
|
||||
*
|
||||
* @param card sim card to register
|
||||
*/
|
||||
void (*add_card)(sim_manager_t *this, sim_card_t *card);
|
||||
|
||||
|
||||
/**
|
||||
* Unregister a previously registered card from the manager.
|
||||
*
|
||||
* @param card sim card to unregister
|
||||
*/
|
||||
void (*remove_card)(sim_manager_t *this, sim_card_t *card);
|
||||
|
||||
|
||||
/**
|
||||
* Create an enumerator over all registered cards.
|
||||
*
|
||||
* @return enumerator over sim_card_t's
|
||||
*/
|
||||
enumerator_t* (*create_card_enumerator)(sim_manager_t *this);
|
||||
|
||||
|
||||
/**
|
||||
* Register a triplet provider (server) at the manager.
|
||||
*
|
||||
* @param card sim card to register
|
||||
*/
|
||||
void (*add_provider)(sim_manager_t *this, sim_provider_t *provider);
|
||||
|
||||
|
||||
/**
|
||||
* Unregister a previously registered provider from the manager.
|
||||
*
|
||||
* @param card sim card to unregister
|
||||
*/
|
||||
void (*remove_provider)(sim_manager_t *this, sim_provider_t *provider);
|
||||
|
||||
|
||||
/**
|
||||
* Create an enumerator over all registered provider.
|
||||
*
|
||||
* @return enumerator over sim_provider_t's
|
||||
*/
|
||||
enumerator_t* (*create_provider_enumerator)(sim_manager_t *this);
|
||||
|
||||
|
||||
/**
|
||||
* Destroy a manager instance.
|
||||
*/
|
||||
|
||||
@@ -26,62 +26,62 @@ typedef struct private_eap_authenticator_t private_eap_authenticator_t;
|
||||
* Private data of an eap_authenticator_t object.
|
||||
*/
|
||||
struct private_eap_authenticator_t {
|
||||
|
||||
|
||||
/**
|
||||
* Public authenticator_t interface.
|
||||
*/
|
||||
eap_authenticator_t public;
|
||||
|
||||
|
||||
/**
|
||||
* Assigned IKE_SA
|
||||
*/
|
||||
ike_sa_t *ike_sa;
|
||||
|
||||
|
||||
/**
|
||||
* others nonce to include in AUTH calculation
|
||||
*/
|
||||
chunk_t received_nonce;
|
||||
|
||||
|
||||
/**
|
||||
* our nonce to include in AUTH calculation
|
||||
*/
|
||||
chunk_t sent_nonce;
|
||||
|
||||
|
||||
/**
|
||||
* others IKE_SA_INIT message data to include in AUTH calculation
|
||||
*/
|
||||
chunk_t received_init;
|
||||
|
||||
|
||||
/**
|
||||
* our IKE_SA_INIT message data to include in AUTH calculation
|
||||
*/
|
||||
chunk_t sent_init;
|
||||
|
||||
|
||||
/**
|
||||
* Current EAP method processing
|
||||
*/
|
||||
eap_method_t *method;
|
||||
|
||||
|
||||
/**
|
||||
* MSK used to build and verify auth payload
|
||||
*/
|
||||
chunk_t msk;
|
||||
|
||||
|
||||
/**
|
||||
* EAP authentication method completed successfully
|
||||
*/
|
||||
bool eap_complete;
|
||||
|
||||
|
||||
/**
|
||||
* authentication payload verified successfully
|
||||
*/
|
||||
bool auth_complete;
|
||||
|
||||
|
||||
/**
|
||||
* generated EAP payload
|
||||
*/
|
||||
eap_payload_t *eap_payload;
|
||||
|
||||
|
||||
/**
|
||||
* EAP identity of peer
|
||||
*/
|
||||
@@ -95,7 +95,7 @@ static eap_method_t *load_method(private_eap_authenticator_t *this,
|
||||
eap_type_t type, u_int32_t vendor, eap_role_t role)
|
||||
{
|
||||
identification_t *server, *peer;
|
||||
|
||||
|
||||
if (role == EAP_SERVER)
|
||||
{
|
||||
server = this->ike_sa->get_my_id(this->ike_sa);
|
||||
@@ -125,9 +125,9 @@ static eap_payload_t* server_initiate_eap(private_eap_authenticator_t *this,
|
||||
identification_t *id;
|
||||
u_int32_t vendor;
|
||||
eap_payload_t *out;
|
||||
|
||||
|
||||
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
|
||||
|
||||
|
||||
/* initiate EAP-Identity exchange if required */
|
||||
if (!this->eap_identity && do_identity)
|
||||
{
|
||||
@@ -157,7 +157,7 @@ static eap_payload_t* server_initiate_eap(private_eap_authenticator_t *this,
|
||||
if (vendor)
|
||||
{
|
||||
DBG1(DBG_IKE, "initiating EAP vendor type %d-%d", type, vendor);
|
||||
|
||||
|
||||
}
|
||||
else
|
||||
{
|
||||
@@ -186,14 +186,14 @@ static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
|
||||
u_int32_t vendor, received_vendor;
|
||||
eap_payload_t *out;
|
||||
auth_cfg_t *cfg;
|
||||
|
||||
|
||||
if (in->get_code(in) != EAP_RESPONSE)
|
||||
{
|
||||
DBG1(DBG_IKE, "received %N, sending %N",
|
||||
eap_code_names, in->get_code(in), eap_code_names, EAP_FAILURE);
|
||||
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
|
||||
}
|
||||
|
||||
|
||||
type = this->method->get_type(this->method, &vendor);
|
||||
received_type = in->get_type(in, &received_vendor);
|
||||
if (type != received_type || vendor != received_vendor)
|
||||
@@ -210,7 +210,7 @@ static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
|
||||
}
|
||||
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
|
||||
}
|
||||
|
||||
|
||||
switch (this->method->process(this->method, in, &out))
|
||||
{
|
||||
case NEED_MORE:
|
||||
@@ -220,7 +220,7 @@ static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
|
||||
{
|
||||
chunk_t data;
|
||||
char buf[256];
|
||||
|
||||
|
||||
if (this->method->get_msk(this->method, &data) == SUCCESS)
|
||||
{
|
||||
snprintf(buf, sizeof(buf), "%.*s", data.len, data.ptr);
|
||||
@@ -262,7 +262,7 @@ static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
|
||||
if (vendor)
|
||||
{
|
||||
DBG1(DBG_IKE, "EAP vendor specific method %d-%d failed for "
|
||||
"peer %Y", type, vendor,
|
||||
"peer %Y", type, vendor,
|
||||
this->ike_sa->get_other_id(this->ike_sa));
|
||||
}
|
||||
else
|
||||
@@ -286,9 +286,9 @@ static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
|
||||
auth_cfg_t *auth;
|
||||
eap_payload_t *out;
|
||||
identification_t *id;
|
||||
|
||||
|
||||
type = in->get_type(in, &vendor);
|
||||
|
||||
|
||||
if (!vendor && type == EAP_IDENTITY)
|
||||
{
|
||||
DESTROY_IF(this->eap_identity);
|
||||
@@ -301,7 +301,7 @@ static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
|
||||
DBG1(DBG_IKE, "server requested %N, sending '%Y'",
|
||||
eap_type_names, type, id);
|
||||
this->eap_identity = id->clone(id);
|
||||
|
||||
|
||||
this->method = load_method(this, type, vendor, EAP_PEER);
|
||||
if (this->method)
|
||||
{
|
||||
@@ -337,14 +337,14 @@ static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
|
||||
return eap_payload_create_nak(in->get_identifier(in));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
type = this->method->get_type(this->method, &vendor);
|
||||
|
||||
|
||||
if (this->method->process(this->method, in, &out) == NEED_MORE)
|
||||
{ /* client methods should never return SUCCESS */
|
||||
return out;
|
||||
}
|
||||
|
||||
|
||||
if (vendor)
|
||||
{
|
||||
DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed", type, vendor);
|
||||
@@ -367,7 +367,7 @@ static bool verify_auth(private_eap_authenticator_t *this, message_t *message,
|
||||
identification_t *other_id;
|
||||
auth_cfg_t *auth;
|
||||
keymat_t *keymat;
|
||||
|
||||
|
||||
auth_payload = (auth_payload_t*)message->get_payload(message,
|
||||
AUTHENTICATION);
|
||||
if (!auth_payload)
|
||||
@@ -388,7 +388,7 @@ static bool verify_auth(private_eap_authenticator_t *this, message_t *message,
|
||||
return FALSE;
|
||||
}
|
||||
chunk_free(&auth_data);
|
||||
|
||||
|
||||
DBG1(DBG_IKE, "authentication of '%Y' with %N successful",
|
||||
other_id, auth_class_names, AUTH_CLASS_EAP);
|
||||
this->auth_complete = TRUE;
|
||||
@@ -407,13 +407,13 @@ static void build_auth(private_eap_authenticator_t *this, message_t *message,
|
||||
identification_t *my_id;
|
||||
chunk_t auth_data;
|
||||
keymat_t *keymat;
|
||||
|
||||
|
||||
my_id = this->ike_sa->get_my_id(this->ike_sa);
|
||||
keymat = this->ike_sa->get_keymat(this->ike_sa);
|
||||
|
||||
|
||||
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N",
|
||||
my_id, auth_class_names, AUTH_CLASS_EAP);
|
||||
|
||||
|
||||
auth_data = keymat->get_psk_sig(keymat, FALSE, init, nonce, this->msk, my_id);
|
||||
auth_payload = auth_payload_create();
|
||||
auth_payload->set_auth_method(auth_payload, AUTH_PSK);
|
||||
@@ -429,7 +429,7 @@ static status_t process_server(private_eap_authenticator_t *this,
|
||||
message_t *message)
|
||||
{
|
||||
eap_payload_t *eap_payload;
|
||||
|
||||
|
||||
if (this->eap_complete)
|
||||
{
|
||||
if (!verify_auth(this, message, this->sent_nonce, this->received_init))
|
||||
@@ -438,7 +438,7 @@ static status_t process_server(private_eap_authenticator_t *this,
|
||||
}
|
||||
return NEED_MORE;
|
||||
}
|
||||
|
||||
|
||||
if (!this->method)
|
||||
{
|
||||
this->eap_payload = server_initiate_eap(this, TRUE);
|
||||
@@ -465,7 +465,7 @@ static status_t build_server(private_eap_authenticator_t *this,
|
||||
if (this->eap_payload)
|
||||
{
|
||||
eap_code_t code;
|
||||
|
||||
|
||||
code = this->eap_payload->get_code(this->eap_payload);
|
||||
message->add_payload(message, (payload_t*)this->eap_payload);
|
||||
this->eap_payload = NULL;
|
||||
@@ -490,7 +490,7 @@ static status_t process_client(private_eap_authenticator_t *this,
|
||||
message_t *message)
|
||||
{
|
||||
eap_payload_t *eap_payload;
|
||||
|
||||
|
||||
if (this->eap_complete)
|
||||
{
|
||||
if (!verify_auth(this, message, this->sent_nonce, this->received_init))
|
||||
@@ -499,7 +499,7 @@ static status_t process_client(private_eap_authenticator_t *this,
|
||||
}
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
eap_payload = (eap_payload_t*)message->get_payload(message,
|
||||
EXTENSIBLE_AUTHENTICATION);
|
||||
if (eap_payload)
|
||||
@@ -520,7 +520,7 @@ static status_t process_client(private_eap_authenticator_t *this,
|
||||
eap_type_t type;
|
||||
u_int32_t vendor;
|
||||
auth_cfg_t *cfg;
|
||||
|
||||
|
||||
if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
|
||||
{
|
||||
this->msk = chunk_clone(this->msk);
|
||||
@@ -561,7 +561,7 @@ static status_t process_client(private_eap_authenticator_t *this,
|
||||
/**
|
||||
* Implementation of authenticator_t.build for a client
|
||||
*/
|
||||
static status_t build_client(private_eap_authenticator_t *this,
|
||||
static status_t build_client(private_eap_authenticator_t *this,
|
||||
message_t *message)
|
||||
{
|
||||
if (this->eap_payload)
|
||||
@@ -598,11 +598,11 @@ eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
chunk_t received_init, chunk_t sent_init)
|
||||
{
|
||||
private_eap_authenticator_t *this = malloc_thing(private_eap_authenticator_t);
|
||||
|
||||
|
||||
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build_client;
|
||||
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process_client;
|
||||
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
|
||||
|
||||
|
||||
this->ike_sa = ike_sa;
|
||||
this->received_init = received_init;
|
||||
this->received_nonce = received_nonce;
|
||||
@@ -614,7 +614,7 @@ eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
this->eap_complete = FALSE;
|
||||
this->auth_complete = FALSE;
|
||||
this->eap_identity = NULL;
|
||||
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
@@ -626,11 +626,11 @@ eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
|
||||
chunk_t received_init, chunk_t sent_init)
|
||||
{
|
||||
private_eap_authenticator_t *this = malloc_thing(private_eap_authenticator_t);
|
||||
|
||||
|
||||
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *messageh))build_server;
|
||||
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process_server;
|
||||
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
|
||||
|
||||
|
||||
this->ike_sa = ike_sa;
|
||||
this->received_init = received_init;
|
||||
this->received_nonce = received_nonce;
|
||||
@@ -642,7 +642,7 @@ eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
|
||||
this->eap_complete = FALSE;
|
||||
this->auth_complete = FALSE;
|
||||
this->eap_identity = NULL;
|
||||
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
|
||||
@@ -83,7 +83,7 @@ eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
|
||||
/**
|
||||
* Create an authenticator to authenticate EAP clients.
|
||||
*
|
||||
*
|
||||
* @param ike_sa associated ike_sa
|
||||
* @param received_nonce nonce received in IKE_SA_INIT
|
||||
* @param sent_nonce nonce sent in IKE_SA_INIT
|
||||
|
||||
@@ -35,12 +35,12 @@ struct private_psk_authenticator_t {
|
||||
* Assigned IKE_SA
|
||||
*/
|
||||
ike_sa_t *ike_sa;
|
||||
|
||||
|
||||
/**
|
||||
* nonce to include in AUTH calculation
|
||||
*/
|
||||
chunk_t nonce;
|
||||
|
||||
|
||||
/**
|
||||
* IKE_SA_INIT message data to include in AUTH calculation
|
||||
*/
|
||||
@@ -57,7 +57,7 @@ static status_t build(private_psk_authenticator_t *this, message_t *message)
|
||||
shared_key_t *key;
|
||||
chunk_t auth_data;
|
||||
keymat_t *keymat;
|
||||
|
||||
|
||||
keymat = this->ike_sa->get_keymat(this->ike_sa);
|
||||
my_id = this->ike_sa->get_my_id(this->ike_sa);
|
||||
other_id = this->ike_sa->get_other_id(this->ike_sa);
|
||||
@@ -79,7 +79,7 @@ static status_t build(private_psk_authenticator_t *this, message_t *message)
|
||||
auth_payload->set_data(auth_payload, auth_data);
|
||||
chunk_free(&auth_data);
|
||||
message->add_payload(message, (payload_t*)auth_payload);
|
||||
|
||||
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
@@ -97,7 +97,7 @@ static status_t process(private_psk_authenticator_t *this, message_t *message)
|
||||
bool authenticated = FALSE;
|
||||
int keys_found = 0;
|
||||
keymat_t *keymat;
|
||||
|
||||
|
||||
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
|
||||
if (!auth_payload)
|
||||
{
|
||||
@@ -112,7 +112,7 @@ static status_t process(private_psk_authenticator_t *this, message_t *message)
|
||||
while (!authenticated && enumerator->enumerate(enumerator, &key, NULL, NULL))
|
||||
{
|
||||
keys_found++;
|
||||
|
||||
|
||||
auth_data = keymat->get_psk_sig(keymat, TRUE, this->ike_sa_init,
|
||||
this->nonce, key->get_key(key), other_id);
|
||||
if (auth_data.len && chunk_equals(auth_data, recv_auth_data))
|
||||
@@ -124,7 +124,7 @@ static status_t process(private_psk_authenticator_t *this, message_t *message)
|
||||
chunk_free(&auth_data);
|
||||
}
|
||||
enumerator->destroy(enumerator);
|
||||
|
||||
|
||||
if (!authenticated)
|
||||
{
|
||||
if (keys_found == 0)
|
||||
@@ -136,7 +136,7 @@ static status_t process(private_psk_authenticator_t *this, message_t *message)
|
||||
keys_found, keys_found == 1 ? "" : "s", my_id, other_id);
|
||||
return FAILED;
|
||||
}
|
||||
|
||||
|
||||
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
|
||||
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
|
||||
return SUCCESS;
|
||||
@@ -166,15 +166,15 @@ psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
chunk_t received_nonce, chunk_t sent_init)
|
||||
{
|
||||
private_psk_authenticator_t *this = malloc_thing(private_psk_authenticator_t);
|
||||
|
||||
|
||||
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build;
|
||||
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))return_failed;
|
||||
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
|
||||
|
||||
|
||||
this->ike_sa = ike_sa;
|
||||
this->ike_sa_init = sent_init;
|
||||
this->nonce = received_nonce;
|
||||
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
@@ -185,15 +185,15 @@ psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
|
||||
chunk_t sent_nonce, chunk_t received_init)
|
||||
{
|
||||
private_psk_authenticator_t *this = malloc_thing(private_psk_authenticator_t);
|
||||
|
||||
|
||||
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *messageh))return_failed;
|
||||
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process;
|
||||
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
|
||||
|
||||
|
||||
this->ike_sa = ike_sa;
|
||||
this->ike_sa_init = received_init;
|
||||
this->nonce = sent_nonce;
|
||||
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
|
||||
@@ -49,7 +49,7 @@ psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
|
||||
/**
|
||||
* Create an authenticator to verify PSK signatures.
|
||||
*
|
||||
*
|
||||
* @param ike_sa associated ike_sa
|
||||
* @param sent_nonce nonce sent in IKE_SA_INIT
|
||||
* @param received_init received IKE_SA_INIT message data
|
||||
|
||||
@@ -26,22 +26,22 @@ typedef struct private_pubkey_authenticator_t private_pubkey_authenticator_t;
|
||||
* Private data of an pubkey_authenticator_t object.
|
||||
*/
|
||||
struct private_pubkey_authenticator_t {
|
||||
|
||||
|
||||
/**
|
||||
* Public authenticator_t interface.
|
||||
*/
|
||||
pubkey_authenticator_t public;
|
||||
|
||||
|
||||
/**
|
||||
* Assigned IKE_SA
|
||||
*/
|
||||
ike_sa_t *ike_sa;
|
||||
|
||||
|
||||
/**
|
||||
* nonce to include in AUTH calculation
|
||||
*/
|
||||
chunk_t nonce;
|
||||
|
||||
|
||||
/**
|
||||
* IKE_SA_INIT message data to include in AUTH calculation
|
||||
*/
|
||||
@@ -72,11 +72,11 @@ static status_t build(private_pubkey_authenticator_t *this, message_t *message)
|
||||
DBG1(DBG_IKE, "no private key found for '%Y'", id);
|
||||
return NOT_FOUND;
|
||||
}
|
||||
|
||||
|
||||
switch (private->get_type(private))
|
||||
{
|
||||
case KEY_RSA:
|
||||
/* we currently use always SHA1 for signatures,
|
||||
/* we currently use always SHA1 for signatures,
|
||||
* TODO: support other hashes depending on configuration/auth */
|
||||
scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
|
||||
auth_method = AUTH_RSA;
|
||||
@@ -86,7 +86,7 @@ static status_t build(private_pubkey_authenticator_t *this, message_t *message)
|
||||
switch (private->get_keysize(private))
|
||||
{
|
||||
case 32:
|
||||
scheme = SIGN_ECDSA_256;
|
||||
scheme = SIGN_ECDSA_256;
|
||||
auth_method = AUTH_ECDSA_256;
|
||||
break;
|
||||
case 48:
|
||||
@@ -121,11 +121,11 @@ static status_t build(private_pubkey_authenticator_t *this, message_t *message)
|
||||
status = SUCCESS;
|
||||
}
|
||||
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N %s", id,
|
||||
auth_method_names, auth_method,
|
||||
auth_method_names, auth_method,
|
||||
(status == SUCCESS)? "successful":"failed");
|
||||
chunk_free(&octets);
|
||||
private->destroy(private);
|
||||
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
@@ -145,7 +145,7 @@ static status_t process(private_pubkey_authenticator_t *this, message_t *message
|
||||
signature_scheme_t scheme;
|
||||
status_t status = NOT_FOUND;
|
||||
keymat_t *keymat;
|
||||
|
||||
|
||||
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
|
||||
if (!auth_payload)
|
||||
{
|
||||
@@ -231,15 +231,15 @@ pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
chunk_t received_nonce, chunk_t sent_init)
|
||||
{
|
||||
private_pubkey_authenticator_t *this = malloc_thing(private_pubkey_authenticator_t);
|
||||
|
||||
|
||||
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build;
|
||||
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))return_failed;
|
||||
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
|
||||
|
||||
|
||||
this->ike_sa = ike_sa;
|
||||
this->ike_sa_init = sent_init;
|
||||
this->nonce = received_nonce;
|
||||
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
@@ -250,14 +250,14 @@ pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
|
||||
chunk_t sent_nonce, chunk_t received_init)
|
||||
{
|
||||
private_pubkey_authenticator_t *this = malloc_thing(private_pubkey_authenticator_t);
|
||||
|
||||
|
||||
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))return_failed;
|
||||
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process;
|
||||
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
|
||||
|
||||
|
||||
this->ike_sa = ike_sa;
|
||||
this->ike_sa_init = received_init;
|
||||
this->nonce = sent_nonce;
|
||||
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
@@ -50,7 +50,7 @@ pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
|
||||
/**
|
||||
* Create an authenticator to verify public key signatures.
|
||||
*
|
||||
*
|
||||
* @param ike_sa associated ike_sa
|
||||
* @param sent_nonce nonce sent in IKE_SA_INIT
|
||||
* @param received_init received IKE_SA_INIT message data
|
||||
|
||||
Reference in New Issue
Block a user