denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add a return value to simaka_crypto_t.derive_keys_*()

Browse Source
This commit is contained in:
Martin Willi
2012-07-16 14:53:33 +02:00
parent 2e96de60a8
commit 86d2cdc1ed
6 changed files with 84 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/eap_aka/eap_aka_peer.c
+19 -9
View File
@@ -290,10 +290,13 @@ static status_t process_challenge(private_eap_aka_peer_t *this,
}
data = chunk_cata("cc", chunk_create(ik, AKA_IK_LEN),
chunk_create(ck, AKA_CK_LEN));
free(this->msk.ptr);
this->msk = this->crypto->derive_keys_full(this->crypto, id, data, &mk);
chunk_clear(&this->msk);
if (!this->crypto->derive_keys_full(this->crypto, id, data, &mk, &this->msk))
{
return FAILED;
}
memcpy(this->mk, mk.ptr, mk.len);
free(mk.ptr);
chunk_clear(&mk);
/* Verify AT_MAC attribute and parse() again after key derivation,
* reading encrypted attributes */
@@ -373,8 +376,11 @@ static status_t process_reauthentication(private_eap_aka_peer_t *this,
return NEED_MORE;
}
this->crypto->derive_keys_reauth(this->crypto,
chunk_create(this->mk, HASH_SIZE_SHA1));
if (!this->crypto->derive_keys_reauth(this->crypto,
chunk_create(this->mk, HASH_SIZE_SHA1)))
{
return FAILED;
}
/* verify MAC and parse again with decryption key */
if (!in->verify(in, chunk_empty) || !in->parse(in))
@@ -434,10 +440,14 @@ static status_t process_reauthentication(private_eap_aka_peer_t *this,
}
else
{
free(this->msk.ptr);
this->msk = this->crypto->derive_keys_reauth_msk(this->crypto,
this->reauth, counter, nonce,
chunk_create(this->mk, HASH_SIZE_SHA1));
chunk_clear(&this->msk);
if (!this->crypto->derive_keys_reauth_msk(this->crypto,
this->reauth, counter, nonce,
chunk_create(this->mk, HASH_SIZE_SHA1), &this->msk))
{
message->destroy(message);
return FAILED;
}
if (id.len)
{
identification_t *reauth;
src/libcharon/plugins/eap_aka/eap_aka_server.c
+11 -5
View File
@@ -199,8 +199,11 @@ static status_t challenge(private_eap_aka_server_t *this, eap_payload_t **out)
}
data = chunk_cata("cc", chunk_create(ik, AKA_IK_LEN),
chunk_create(ck, AKA_CK_LEN));
free(this->msk.ptr);
this->msk = this->crypto->derive_keys_full(this->crypto, id, data, &mk);
chunk_clear(&this->msk);
if (!this->crypto->derive_keys_full(this->crypto, id, data, &mk, &this->msk))
{
return FAILED;
}
this->rand = chunk_clone(chunk_create(rand, AKA_RAND_LEN));
this->xres = chunk_clone(chunk_create(xres, xres_len));
@@ -252,9 +255,12 @@ static status_t reauthenticate(private_eap_aka_server_t *this,
counter = htons(counter);
this->counter = chunk_clone(chunk_create((char*)&counter, sizeof(counter)));
this->crypto->derive_keys_reauth(this->crypto, mkc);
this->msk = this->crypto->derive_keys_reauth_msk(this->crypto,
this->reauth, this->counter, this->nonce, mkc);
if (!this->crypto->derive_keys_reauth(this->crypto, mkc) ||
!this->crypto->derive_keys_reauth_msk(this->crypto,
this->reauth, this->counter, this->nonce, mkc, &this->msk))
{
return FAILED;
}
message = simaka_message_create(TRUE, this->identifier++, EAP_AKA,
AKA_REAUTHENTICATION, this->crypto);
src/libcharon/plugins/eap_sim/eap_sim_peer.c
+19 -9
View File
@@ -344,10 +344,13 @@ static status_t process_challenge(private_eap_sim_peer_t *this,
id = this->pseudonym;
}
data = chunk_cata("cccc", kcs, this->nonce, this->version_list, version);
free(this->msk.ptr);
this->msk = this->crypto->derive_keys_full(this->crypto, id, data, &mk);
chunk_clear(&this->msk);
if (!this->crypto->derive_keys_full(this->crypto, id, data, &mk, &this->msk))
{
return FAILED;
}
memcpy(this->mk, mk.ptr, mk.len);
free(mk.ptr);
chunk_clear(&mk);
/* Verify AT_MAC attribute, signature is over "EAP packet | NONCE_MT", and
* parse() again after key derivation, reading encrypted attributes */
@@ -427,8 +430,11 @@ static status_t process_reauthentication(private_eap_sim_peer_t *this,
return NEED_MORE;
}
this->crypto->derive_keys_reauth(this->crypto,
chunk_create(this->mk, HASH_SIZE_SHA1));
if (!this->crypto->derive_keys_reauth(this->crypto,
chunk_create(this->mk, HASH_SIZE_SHA1)))
{
return FAILED;
}
/* verify MAC and parse again with decryption key */
if (!in->verify(in, chunk_empty) || !in->parse(in))
@@ -488,10 +494,14 @@ static status_t process_reauthentication(private_eap_sim_peer_t *this,
}
else
{
free(this->msk.ptr);
this->msk = this->crypto->derive_keys_reauth_msk(this->crypto,
this->reauth, counter, nonce,
chunk_create(this->mk, HASH_SIZE_SHA1));
chunk_clear(&this->msk);
if (!this->crypto->derive_keys_reauth_msk(this->crypto,
this->reauth, counter, nonce,
chunk_create(this->mk, HASH_SIZE_SHA1), &this->msk))
{
message->destroy(message);
return FAILED;
}
if (id.len)
{
identification_t *reauth;
src/libcharon/plugins/eap_sim/eap_sim_server.c
+10 -4
View File
@@ -180,9 +180,12 @@ static status_t reauthenticate(private_eap_sim_server_t *this,
counter = htons(counter);
this->counter = chunk_clone(chunk_create((char*)&counter, sizeof(counter)));
this->crypto->derive_keys_reauth(this->crypto, mkc);
this->msk = this->crypto->derive_keys_reauth_msk(this->crypto,
this->reauth, this->counter, this->nonce, mkc);
if (!this->crypto->derive_keys_reauth(this->crypto, mkc) ||
!this->crypto->derive_keys_reauth_msk(this->crypto,
this->reauth, this->counter, this->nonce, mkc, &this->msk))
{
return FAILED;
}
message = simaka_message_create(TRUE, this->identifier++, EAP_SIM,
SIM_REAUTHENTICATION, this->crypto);
@@ -406,7 +409,10 @@ static status_t process_start(private_eap_sim_server_t *this,
{
id = this->pseudonym;
}
this->msk = this->crypto->derive_keys_full(this->crypto, id, data, &mk);
if (!this->crypto->derive_keys_full(this->crypto, id, data, &mk, &this->msk))
{
return FAILED;
}
/* build response with AT_MAC, built over "EAP packet | NONCE_MT" */
message = simaka_message_create(TRUE, this->identifier++, EAP_SIM,