denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

do not store DH redundant in keymat

Browse Source
This commit is contained in:
Martin Willi
2008-10-29 13:35:06 +00:00
parent 6faa0c3392
commit a64cc8f75f
3 changed files with 30 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/keymat.c
+9 -26
View File
@@ -37,11 +37,6 @@ struct private_keymat_t {
*/ */
bool initiator; bool initiator;
/**
* diffie hellman key exchange
*/
diffie_hellman_t *dh;
/** /**
* inbound signer (verify) * inbound signer (verify)
*/ */
@@ -89,29 +84,20 @@ struct private_keymat_t {
}; };
/** /**
* Implementation of keymat_t.set_dh_group * Implementation of keymat_t.create_dh
*/ */
static bool set_dh_group(private_keymat_t *this, diffie_hellman_group_t group) static diffie_hellman_t* create_dh(private_keymat_t *this,
diffie_hellman_group_t group)
{ {
DESTROY_IF(this->dh); return lib->crypto->create_dh(lib->crypto, group);;
this->dh = lib->crypto->create_dh(lib->crypto, group);
return this->dh != NULL;
}
/**
* Implementation of keymat_t.get_dh
*/
static diffie_hellman_t* get_dh(private_keymat_t *this)
{
return this->dh;
} }
/** /**
* Implementation of keymat_t.derive_keys * Implementation of keymat_t.derive_keys
*/ */
static bool derive_keys(private_keymat_t *this, proposal_t *proposal, static bool derive_keys(private_keymat_t *this, proposal_t *proposal,
chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id, diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r,
private_keymat_t *rekey) ike_sa_id_t *id, private_keymat_t *rekey)
{ {
chunk_t skeyseed, key, secret, full_nonce, fixed_nonce, prf_plus_seed; chunk_t skeyseed, key, secret, full_nonce, fixed_nonce, prf_plus_seed;
chunk_t spi_i, spi_r; chunk_t spi_i, spi_r;
@@ -123,7 +109,7 @@ static bool derive_keys(private_keymat_t *this, proposal_t *proposal,
spi_i = chunk_alloca(sizeof(u_int64_t)); spi_i = chunk_alloca(sizeof(u_int64_t));
spi_r = chunk_alloca(sizeof(u_int64_t)); spi_r = chunk_alloca(sizeof(u_int64_t));
if (!this->dh || this->dh->get_shared_secret(this->dh, &secret) != SUCCESS) if (dh->get_shared_secret(dh, &secret) != SUCCESS)
{ {
return FALSE; return FALSE;
} }
@@ -420,7 +406,6 @@ static chunk_t get_psk_sig(private_keymat_t *this, bool verify,
*/ */
static void destroy(private_keymat_t *this) static void destroy(private_keymat_t *this)
{ {
DESTROY_IF(this->dh);
DESTROY_IF(this->signer_in); DESTROY_IF(this->signer_in);
DESTROY_IF(this->signer_out); DESTROY_IF(this->signer_out);
DESTROY_IF(this->crypter_in); DESTROY_IF(this->crypter_in);
@@ -440,9 +425,8 @@ keymat_t *keymat_create(bool initiator)
{ {
private_keymat_t *this = malloc_thing(private_keymat_t); private_keymat_t *this = malloc_thing(private_keymat_t);
this->public.set_dh_group = (bool(*)(keymat_t*, diffie_hellman_group_t group))set_dh_group; this->public.create_dh = (diffie_hellman_t*(*)(keymat_t*, diffie_hellman_group_t group))create_dh;
this->public.get_dh = (diffie_hellman_t*(*)(keymat_t*))get_dh; this->public.derive_keys = (bool(*)(keymat_t*, proposal_t *proposal, diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id, keymat_t *rekey))derive_keys;
this->public.derive_keys = (bool(*)(keymat_t*, proposal_t *proposal, chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id, keymat_t *rekey))derive_keys;
this->public.get_proposal = (proposal_t*(*)(keymat_t*))get_proposal; this->public.get_proposal = (proposal_t*(*)(keymat_t*))get_proposal;
this->public.get_signer = (signer_t*(*)(keymat_t*, bool in))get_signer; this->public.get_signer = (signer_t*(*)(keymat_t*, bool in))get_signer;
this->public.get_crypter = (crypter_t*(*)(keymat_t*, bool in))get_crypter; this->public.get_crypter = (crypter_t*(*)(keymat_t*, bool in))get_crypter;
@@ -453,7 +437,6 @@ keymat_t *keymat_create(bool initiator)
this->initiator = initiator; this->initiator = initiator;
this->dh = NULL;
this->signer_in = NULL; this->signer_in = NULL;
this->signer_out = NULL; this->signer_out = NULL;
this->crypter_in = NULL; this->crypter_in = NULL;
src/charon/sa/keymat.h
+11 -15
View File
@@ -39,21 +39,16 @@ typedef struct keymat_t keymat_t;
struct keymat_t { struct keymat_t {
/** /**
* Set the diffie hellman group to use. * Create a diffie hellman object for key agreement.
* *
* @param group diffie hellman group to use * The diffie hellman is either for IKE negotiation/rekeying or
* @return TRUE if group supported * CHILD_SA rekeying (using PFS). The resulting DH object must be passed
* to derive_ike_keys or to derive_child_keys and destroyed after use
*
* @param group diffie hellman group
* @return DH object, NULL if group not supported
*/ */
bool (*set_dh_group)(keymat_t *this, diffie_hellman_group_t group); diffie_hellman_t* (*create_dh)(keymat_t *this, diffie_hellman_group_t group);
/**
* Get the diffie hellman key agreement interface.
*
* Call set_dh_group() before acquiring this interface.
*
* @return key agreement interface
*/
diffie_hellman_t* (*get_dh)(keymat_t *this);
/** /**
* Derive keys from the shared secret. * Derive keys from the shared secret.
@@ -65,8 +60,9 @@ struct keymat_t {
* @param rekey keymat of old SA if we are rekeying * @param rekey keymat of old SA if we are rekeying
* @return TRUE on success * @return TRUE on success
*/ */
bool (*derive_keys)(keymat_t *this, proposal_t *proposal, chunk_t nonce_i, bool (*derive_keys)(keymat_t *this, proposal_t *proposal,
chunk_t nonce_r, ike_sa_id_t *id, keymat_t *rekey); diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r,
ike_sa_id_t *id, keymat_t *rekey);
/** /**
* Get a signer to sign/verify IKE messages. * Get a signer to sign/verify IKE messages.
* *
src/charon/sa/tasks/ike_init.c
+11 -12
View File
@@ -197,10 +197,8 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
this->dh_group = ke_payload->get_dh_group_number(ke_payload); this->dh_group = ke_payload->get_dh_group_number(ke_payload);
if (!this->initiator) if (!this->initiator)
{ {
if (this->keymat->set_dh_group(this->keymat, this->dh_group)) this->dh = this->keymat->create_dh(this->keymat,
{ this->dh_group);
this->dh = this->keymat->get_dh(this->keymat);
}
} }
if (this->dh) if (this->dh)
{ {
@@ -254,13 +252,13 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
if (!this->dh) if (!this->dh)
{ {
this->dh_group = this->config->get_dh_group(this->config); this->dh_group = this->config->get_dh_group(this->config);
if (!this->keymat->set_dh_group(this->keymat, this->dh_group)) this->dh = this->keymat->create_dh(this->keymat, this->dh_group);
if (!this->dh)
{ {
DBG1(DBG_IKE, "configured DH group %N not supported", DBG1(DBG_IKE, "configured DH group %N not supported",
diffie_hellman_group_names, this->dh_group); diffie_hellman_group_names, this->dh_group);
return FAILED; return FAILED;
} }
this->dh = this->keymat->get_dh(this->keymat);
} }
/* generate nonce only when we are trying the first time */ /* generate nonce only when we are trying the first time */
@@ -417,8 +415,8 @@ static status_t build_r(private_ike_init_t *this, message_t *message)
id->set_initiator_spi(id, this->proposal->get_spi(this->proposal)); id->set_initiator_spi(id, this->proposal->get_spi(this->proposal));
old_keymat = this->old_sa->get_keymat(this->old_sa); old_keymat = this->old_sa->get_keymat(this->old_sa);
} }
if (!this->keymat->derive_keys(this->keymat, this->proposal, this->other_nonce, if (!this->keymat->derive_keys(this->keymat, this->proposal, this->dh,
this->my_nonce, id, old_keymat)) this->other_nonce, this->my_nonce, id, old_keymat))
{ {
DBG1(DBG_IKE, "key derivation failed"); DBG1(DBG_IKE, "key derivation failed");
message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty); message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
@@ -524,8 +522,8 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
id->set_responder_spi(id, this->proposal->get_spi(this->proposal)); id->set_responder_spi(id, this->proposal->get_spi(this->proposal));
old_keymat = this->old_sa->get_keymat(this->old_sa); old_keymat = this->old_sa->get_keymat(this->old_sa);
} }
if (!this->keymat->derive_keys(this->keymat, this->proposal, this->my_nonce, if (!this->keymat->derive_keys(this->keymat, this->proposal, this->dh,
this->other_nonce, id, old_keymat)) this->my_nonce, this->other_nonce, id, old_keymat))
{ {
DBG1(DBG_IKE, "key derivation failed"); DBG1(DBG_IKE, "key derivation failed");
return FAILED; return FAILED;
@@ -568,8 +566,8 @@ static void migrate(private_ike_init_t *this, ike_sa_t *ike_sa)
this->ike_sa = ike_sa; this->ike_sa = ike_sa;
this->proposal = NULL; this->proposal = NULL;
this->keymat->set_dh_group(this->keymat, this->dh_group); DESTROY_IF(this->dh);
this->dh = this->keymat->get_dh(this->keymat); this->dh = this->keymat->create_dh(this->keymat, this->dh_group);
} }
/** /**
@@ -577,6 +575,7 @@ static void migrate(private_ike_init_t *this, ike_sa_t *ike_sa)
*/ */
static void destroy(private_ike_init_t *this) static void destroy(private_ike_init_t *this)
{ {
DESTROY_IF(this->dh);
DESTROY_IF(this->proposal); DESTROY_IF(this->proposal);
chunk_free(&this->my_nonce); chunk_free(&this->my_nonce);
chunk_free(&this->other_nonce); chunk_free(&this->other_nonce);