denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec: Use IV generator to encrypt ESP messages

Browse Source
This commit is contained in:
Tobias Brunner
2013-10-11 15:55:40 +02:00
parent b5010707a0
commit d74c254dfd
2 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libipsec/esp_packet.c
+6 -8
View File
@@ -283,7 +283,7 @@ METHOD(esp_packet_t, encrypt, status_t,
u_int32_t next_seqno; u_int32_t next_seqno;
size_t blocksize, plainlen; size_t blocksize, plainlen;
aead_t *aead; aead_t *aead;
rng_t *rng; iv_gen_t *iv_gen;
this->packet->set_data(this->packet, chunk_empty); this->packet->set_data(this->packet, chunk_empty);
@@ -293,13 +293,13 @@ METHOD(esp_packet_t, encrypt, status_t,
return FAILED; return FAILED;
} }
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK); aead = esp_context->get_aead(esp_context);
if (!rng) iv_gen = aead->get_iv_gen(aead);
if (!iv_gen)
{ {
DBG1(DBG_ESP, "ESP encryption failed: could not find RNG"); DBG1(DBG_ESP, "ESP encryption failed: no IV generator");
return NOT_FOUND; return NOT_FOUND;
} }
aead = esp_context->get_aead(esp_context);
blocksize = aead->get_block_size(aead); blocksize = aead->get_block_size(aead);
iv.len = aead->get_iv_size(aead); iv.len = aead->get_iv_size(aead);
@@ -319,14 +319,12 @@ METHOD(esp_packet_t, encrypt, status_t,
writer->write_uint32(writer, next_seqno); writer->write_uint32(writer, next_seqno);
iv = writer->skip(writer, iv.len); iv = writer->skip(writer, iv.len);
if (!rng->get_bytes(rng, iv.len, iv.ptr)) if (!iv_gen->get_iv(iv_gen, iv.len, iv.ptr))
{ {
DBG1(DBG_ESP, "ESP encryption failed: could not generate IV"); DBG1(DBG_ESP, "ESP encryption failed: could not generate IV");
writer->destroy(writer); writer->destroy(writer);
rng->destroy(rng);
return FAILED; return FAILED;
} }
rng->destroy(rng);
/* plain-/ciphertext will start here */ /* plain-/ciphertext will start here */
ciphertext = writer->get_buf(writer); ciphertext = writer->get_buf(writer);
src/libipsec/esp_packet.h
+1 -1
View File
@@ -91,7 +91,7 @@ struct esp_packet_t {
* @return - SUCCESS if encrypted * @return - SUCCESS if encrypted
* - FAILED if sequence number cycled or any of the * - FAILED if sequence number cycled or any of the
* cryptographic functions failed * cryptographic functions failed
* - NOT_FOUND if no suitable RNG could be found * - NOT_FOUND if no suitable IV generator provided
*/ */
status_t (*encrypt)(esp_packet_t *this, esp_context_t *esp_context, status_t (*encrypt)(esp_packet_t *this, esp_context_t *esp_context,
u_int32_t spi); u_int32_t spi);