sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-16 00:00:37 -04:00
Code Issues Projects Releases Wiki Activity

utils: Use chunk_equals_const() for all cryptographic purposes

Browse Source
This commit is contained in:
Martin Willi 2015-04-11 15:56:42 +02:00
parent 9d6e952201
commit 161a015782
23 changed files with 33 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/libcharon/encoding/message.c
View File

@ -2625,7 +2625,7 @@ METHOD(message_t, parse_body, status_t,
other_hash = hash_payload->get_hash(hash_payload);
DBG3(DBG_ENC, "HASH received %B\nHASH expected %B",
&other_hash, &hash);
if (!chunk_equals(hash, other_hash))
if (!chunk_equals_const(hash, other_hash))
{
DBG1(DBG_ENC, "received HASH payload does not match");
chunk_free(&hash);

2
src/libcharon/network/receiver.c
View File

@ -247,7 +247,7 @@ static bool cookie_verify(private_receiver_t *this, message_t *message,
{
return FALSE;
}
if (chunk_equals(reference, cookie))
if (chunk_equals_const(reference, cookie))
{
chunk_free(&reference);
return TRUE;

5
src/libcharon/plugins/eap_aka/eap_aka_server.c
View File

@ -425,7 +425,7 @@ static status_t process_challenge(private_eap_aka_server_t *this,
enumerator->destroy(enumerator);
/* compare received RES against stored XRES */
if (!chunk_equals(res, this->xres))
if (!chunk_equals_const(res, this->xres))
{
DBG1(DBG_IKE, "received RES does not match XRES");
return FAILED;
@ -486,7 +486,7 @@ static status_t process_reauthentication(private_eap_aka_server_t *this,
this->crypto->clear_keys(this->crypto);
return challenge(this, out);
}
if (!chunk_equals(counter, this->counter))
if (!chunk_equals_const(counter, this->counter))
{
DBG1(DBG_IKE, "received counter does not match");
return FAILED;
@ -730,4 +730,3 @@ eap_aka_server_t *eap_aka_server_create(identification_t *server,
return &this->public;
}

2
src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c
View File

@ -812,7 +812,7 @@ static status_t process_peer_success(private_eap_mschapv2_t *this,
goto error;
}
if (!chunk_equals(this->auth_response, auth_string))
if (!chunk_equals_const(this->auth_response, auth_string))
{
DBG1(DBG_IKE, "EAP-MS-CHAPv2 verification failed");
goto error;

3
src/libcharon/plugins/eap_sim/eap_sim_server.c
View File

@ -262,7 +262,7 @@ static status_t process_reauthentication(private_eap_sim_server_t *this,
this->crypto->clear_keys(this->crypto);
return initiate(this, out);
}
if (!chunk_equals(counter, this->counter))
if (!chunk_equals_const(counter, this->counter))
{
DBG1(DBG_IKE, "received counter does not match");
return FAILED;
@ -644,4 +644,3 @@ eap_sim_server_t *eap_sim_server_create(identification_t *server,
return &this->public;
}

2
src/libcharon/plugins/xauth_generic/xauth_generic.c
View File

@ -180,7 +180,7 @@ METHOD(xauth_method_t, process_server, status_t,
SHARED_EAP, this->server, this->peer);
while (enumerator->enumerate(enumerator, &shared, NULL, NULL))
{
if (chunk_equals(shared->get_key(shared), pass))
if (chunk_equals_const(shared->get_key(shared), pass))
{
status = SUCCESS;
break;

2
src/libcharon/sa/ikev1/authenticators/psk_v1_authenticator.c
View File

@ -124,7 +124,7 @@ METHOD(authenticator_t, process, status_t,
return FAILED;
}
free(dh.ptr);
if (chunk_equals(hash, hash_payload->get_hash(hash_payload)))
if (chunk_equals_const(hash, hash_payload->get_hash(hash_payload)))
{
free(hash.ptr);
if (!this->hybrid)

2
src/libcharon/sa/ikev2/authenticators/eap_authenticator.c
View File

@ -464,7 +464,7 @@ static bool verify_auth(private_eap_authenticator_t *this, message_t *message,
return FALSE;
}
recv_auth_data = auth_payload->get_data(auth_payload);
if (!auth_data.len || !chunk_equals(auth_data, recv_auth_data))
if (!auth_data.len || !chunk_equals_const(auth_data, recv_auth_data))
{
DBG1(DBG_IKE, "verification of AUTH payload with%s EAP MSK failed",
this->msk.ptr ? "" : "out");

2
src/libcharon/sa/ikev2/authenticators/psk_authenticator.c
View File

@ -123,7 +123,7 @@ METHOD(authenticator_t, process, status_t,
{
continue;
}
if (auth_data.len && chunk_equals(auth_data, recv_auth_data))
if (auth_data.len && chunk_equals_const(auth_data, recv_auth_data))
{
DBG1(DBG_IKE, "authentication of '%Y' with %N successful",
other_id, auth_method_names, AUTH_PSK);

2
src/libcharon/sa/ikev2/tasks/ike_mobike.c
View File

@ -537,7 +537,7 @@ METHOD(task_t, process_i, status_t,
cookie2 = this->cookie2;
this->cookie2 = chunk_empty;
process_payloads(this, message);
if (!chunk_equals(cookie2, this->cookie2))
if (!chunk_equals_const(cookie2, this->cookie2))
{
chunk_free(&cookie2);
DBG1(DBG_IKE, "COOKIE2 mismatch, closing IKE_SA");

7
src/libimcv/plugins/imv_attestation/imv_attestation_process.c
View File

@ -181,7 +181,7 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
DBG1(DBG_IMV, "verifying AIK with keyid %#B", &keyid);
keyid_hex = chunk_to_hex(keyid, NULL, FALSE);
if (session->get_device_id(session, &device_id) &&
chunk_equals(keyid_hex, device_id))
chunk_equals_const(keyid_hex, device_id))
{
trusted = session->get_device_trust(session);
}
@ -290,7 +290,7 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
/* check hashes from database against measurements */
e = pts_db->create_file_hash_enumerator(pts_db,
pts->get_platform_id(pts),
pts->get_platform_id(pts),
algo, is_dir, arg_int);
if (!e)
{
@ -446,7 +446,7 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
return FALSE;
}
if (!chunk_equals(pcr_comp, pcr_composite))
if (!chunk_equals_const(pcr_comp, pcr_composite))
{
DBG1(DBG_IMV, "received PCR Composite does not match "
"constructed one");
@ -564,4 +564,3 @@ quote_error:
}
return TRUE;
}

9
src/libimcv/pts/components/ita/ita_comp_ima.c
View File

@ -307,7 +307,7 @@ static bool check_boot_aggregate(pts_pcr_t *pcrs, chunk_t measurement,
}
if (pcr_ok)
{
success = chunk_equals(boot_aggregate, measurement);
success = chunk_equals_const(boot_aggregate, measurement);
DBG1(DBG_PTS, "boot aggregate value is %scorrect",
success ? "":"in");
return success;
@ -693,7 +693,7 @@ METHOD(pts_component_t, verify, status_t,
status = FAILED;
break;
}
if (chunk_equals(measurement, hash))
if (chunk_equals_const(measurement, hash))
{
status = SUCCESS;
break;
@ -748,7 +748,7 @@ METHOD(pts_component_t, verify, status_t,
has_pcr_info = evidence->get_pcr_info(evidence, &pcr_before, &pcr_after);
if (has_pcr_info)
{
if (!chunk_equals(pcr_before, pcrs->get(pcrs, pcr)))
if (!chunk_equals_const(pcr_before, pcrs->get(pcrs, pcr)))
{
DBG1(DBG_PTS, "PCR %2u: pcr_before is not equal to register value",
pcr);
@ -876,7 +876,7 @@ METHOD(pts_component_t, destroy, void,
DESTROY_IF(this->bios_list);
DESTROY_IF(this->ima_list);
this->name->destroy(this->name);
free(this);
}
}
@ -911,4 +911,3 @@ pts_component_t *pts_ita_comp_ima_create(uint32_t depth,
return &this->public;
}

3
src/libimcv/pts/components/ita/ita_comp_tboot.c
View File

@ -249,7 +249,7 @@ METHOD(pts_component_t, verify, status_t,
has_pcr_info = evidence->get_pcr_info(evidence, &pcr_before, &pcr_after);
if (has_pcr_info)
{
if (!chunk_equals(pcr_before, pcrs->get(pcrs, extended_pcr)))
if (!chunk_equals_const(pcr_before, pcrs->get(pcrs, extended_pcr)))
{
DBG1(DBG_PTS, "PCR %2u: pcr_before is not equal to register value",
extended_pcr);
@ -354,4 +354,3 @@ pts_component_t *pts_ita_comp_tboot_create(u_int32_t depth,
return &this->public;
}

2
src/libimcv/pts/components/ita/ita_comp_tgrub.c
View File

@ -141,7 +141,7 @@ METHOD(pts_component_t, verify, status_t,
has_pcr_info = evidence->get_pcr_info(evidence, &pcr_before, &pcr_after);
if (has_pcr_info)
{
if (!chunk_equals(pcr_before, pcrs->get(pcrs, extended_pcr)))
if (!chunk_equals_const(pcr_before, pcrs->get(pcrs, extended_pcr)))
{
DBG1(DBG_PTS, "PCR %2u: pcr_before is not equal to pcr value");
}

4
src/libimcv/pts/pts_database.c
View File

@ -187,7 +187,7 @@ METHOD(pts_database_t, add_file_measurement, status_t,
}
if (e->enumerate(e, &hash_id, &hash_value))
{
if (!chunk_equals(measurement, hash_value))
if (!chunk_equals_const(measurement, hash_value))
{
/* update hash measurement value */
if (this->db->execute(this->db, &hash_id,
@ -289,7 +289,7 @@ METHOD(pts_database_t, check_comp_measurement, status_t,
while (e->enumerate(e, &hash))
{
if (chunk_equals(hash, measurement))
if (chunk_equals_const(hash, measurement))
{
status = SUCCESS;
break;

8
src/libimcv/pts/pts_file_meas.c
View File

@ -133,7 +133,7 @@ METHOD(pts_file_meas_t, check, bool,
{
while (e->enumerate(e, &hash))
{
if (chunk_equals(entry->measurement, hash))
if (chunk_equals_const(entry->measurement, hash))
{
status = SUCCESS;
break;
@ -223,7 +223,7 @@ METHOD(pts_file_meas_t, verify, bool,
}
}
/* no PTS measurement returned for this filename */
/* no PTS measurement returned for this filename */
if (!found)
{
success = FALSE;
@ -234,7 +234,7 @@ METHOD(pts_file_meas_t, verify, bool,
if (found && !match)
{
if (chunk_equals(measurement, entry->measurement))
if (chunk_equals_const(measurement, entry->measurement))
{
match = TRUE;
DBG2(DBG_PTS, " %#B for '%s' is ok",
@ -252,7 +252,7 @@ METHOD(pts_file_meas_t, verify, bool,
&entry->measurement, entry->filename);
enumerator->destroy(enumerator);
}
return success;
}

2
src/libpttls/sasl/sasl_plain/sasl_plain.c
View File

@ -86,7 +86,7 @@ METHOD(sasl_mechanism_t, process_server, status_t,
DBG1(DBG_CFG, "no shared secret found for '%Y'", this->client);
return FAILED;
}
if (!chunk_equals(shared->get_key(shared), password))
if (!chunk_equals_const(shared->get_key(shared), password))
{
DBG1(DBG_CFG, "shared secret for '%Y' does not match", this->client);
shared->destroy(shared);

2
src/libstrongswan/plugins/openssl/openssl_pkcs7.c
View File

@ -305,7 +305,7 @@ static bool verify_digest(CMS_ContentInfo *cms, CMS_SignerInfo *si, int hash_oid
}
hasher->destroy(hasher);
if (!chunk_equals(digest, hash))
if (!chunk_equals_const(digest, hash))
{
free(hash.ptr);
DBG1(DBG_LIB, "invalid messageDigest");

2
src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c
View File

@ -74,7 +74,7 @@ static bool verify_emsa_pkcs1_signature(private_openssl_rsa_public_key_t *this,
RSA_PKCS1_PADDING);
if (len != -1)
{
valid = chunk_equals(data, chunk_create(buf, len));
valid = chunk_equals_const(data, chunk_create(buf, len));
}
free(buf);
}

2
src/libstrongswan/plugins/pkcs12/pkcs12_decode.c
View File

@ -356,7 +356,7 @@ static bool verify_mac(hash_algorithm_t hash, chunk_t salt,
{
break;
}
if (chunk_equals(mac, calculated))
if (chunk_equals_const(mac, calculated))
{
success = TRUE;
break;

2
src/libstrongswan/plugins/pkcs7/pkcs7_signed_data.c
View File

@ -269,7 +269,7 @@ METHOD(enumerator_t, enumerate, bool,
hasher->destroy(hasher);
DBG3(DBG_LIB, "hash: %B", &hash);
valid = chunk_equals(chunk, hash);
valid = chunk_equals_const(chunk, hash);
free(hash.ptr);
if (!valid)
{

2
src/libtls/tls_peer.c
View File

@ -641,7 +641,7 @@ static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
return NEED_MORE;
}
if (!chunk_equals(received, chunk_from_thing(buf)))
if (!chunk_equals_const(received, chunk_from_thing(buf)))
{
DBG1(DBG_TLS, "received server finished invalid");
this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR);

2
src/libtls/tls_server.c
View File

@ -607,7 +607,7 @@ static status_t process_finished(private_tls_server_t *this,
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
return NEED_MORE;
}
if (!chunk_equals(received, chunk_from_thing(buf)))
if (!chunk_equals_const(received, chunk_from_thing(buf)))
{
DBG1(DBG_TLS, "received client finished invalid");
this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR);