diff -Naur libreswan-3.29-orig/include/impair.h libreswan-3.29/include/impair.h
--- libreswan-3.29-orig/include/impair.h 2019-06-10 10:22:04.000000000 -0400
+++ libreswan-3.29/include/impair.h 2019-06-11 19:22:39.786283961 -0400
@@ -1,6 +1,6 @@
-/* impair operation
+/* impair operation, for libreswan
*
- * Copyright (C) 2019 Andrew Cagney <cagney@gnu.org>
+ * Copyright (C) 2018-2019 Andrew Cagney
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
@@ -22,9 +22,7 @@
#include "lswcdefs.h"
/*
- * How to impair something. This is just the start ...
- *
- * Extra enums go here.
+ * Meddle with the contents of a payload.
*/
enum send_impairment {
@@ -35,6 +33,21 @@
SEND_ROOF, /* >= ROOF -> <number> */
};
+/*
+ * Meddle with a specific exchange.
+ */
+
+enum exchange_impairment {
+ NO_EXCHANGE = 0,
+ NOTIFICATION_EXCHANGE,
+ QUICK_EXCHANGE,
+ XAUTH_EXCHANGE,
+ DELETE_EXCHANGE,
+};
+
+/*
+ * add more here
+ */
#if 0
enum xxx_impair ...;
#endif
@@ -53,6 +66,10 @@
extern enum send_impairment impair_ike_key_length_attribute;
extern enum send_impairment impair_child_key_length_attribute;
+extern enum send_impairment impair_v1_hash_payload;
+extern enum exchange_impairment impair_v1_hash_exchange;
+extern bool impair_v1_hash_check;
+
/*
* What whack sends across the wire for a impair.
*/
diff -Naur libreswan-3.29-orig/lib/libswan/impair.c libreswan-3.29/lib/libswan/impair.c
--- libreswan-3.29-orig/lib/libswan/impair.c 2019-06-10 10:22:04.000000000 -0400
+++ libreswan-3.29/lib/libswan/impair.c 2019-06-11 19:22:54.290445191 -0400
@@ -1,5 +1,4 @@
-/*
- * impair constants, for libreswan
+/* impair constants, for libreswan
*
* Copyright (C) 2017-2019 Andrew Cagney <cagney@gnu.org>
* Copyright (C) 2019-2019 Paul Wouters <pwouters@redhat.com>
@@ -125,6 +124,19 @@
static const struct keywords send_impairment_keywords =
DIRECT_KEYWORDS("send impaired content", send_impairment_value);
+static const struct keyword exchange_impairment_value[] = {
+#define S(E, H) [E##_EXCHANGE] = { .name = "SEND_" #E, .sname = #E, .value = E##_EXCHANGE, .details = H, }
+ S(NO, "do not modify exchanges"),
+ S(QUICK, "modify IKEv1 QUICK exchanges"),
+ S(XAUTH, "modify IKEv1 XAUTH exchanges"),
+ S(NOTIFICATION, "modify notification (informational) exchanges"),
+ S(DELETE, "modify delete exchanges"),
+#undef S
+};
+
+static const struct keywords exchange_impairment_keywords =
+ DIRECT_KEYWORDS("impaire exchange content", exchange_impairment_value);
+
struct impairment {
const char *what;
const char *help;
@@ -182,6 +194,27 @@
.how_keynum = &send_impairment_keywords,
V(impair_child_key_length_attribute),
},
+
+ /*
+ * IKEv1: hash payloads
+ */
+ {
+ .what = "v1-hash-check",
+ .help = "disable check of incoming IKEv1 hash payload",
+ V(impair_emitting),
+ },
+ {
+ .what = "v1-hash-payload",
+ .help = "corrupt the outgoing HASH payload",
+ .how_keynum = &send_impairment_keywords,
+ V(impair_v1_hash_payload),
+ },
+ {
+ .what = "v1-hash-exchange",
+ .help = "the outgoing exchange that should contain the corrupted HASH payload",
+ .how_keynum = &exchange_impairment_keywords,
+ V(impair_v1_hash_exchange),
+ },
};
static void help(const char *prefix, const struct impairment *cr)
@@ -522,8 +555,9 @@
}
/*
- * declare these last so that all references are forced to use the
- * declaration in the header.
+ * XXX: define these at the end of the file so that all references are
+ * forced to use the declaration in the header (help stop code
+ * refering to the wrong variable?).
*/
bool impair_revival;
@@ -531,3 +565,6 @@
enum send_impairment impair_ke_payload;
enum send_impairment impair_ike_key_length_attribute;
enum send_impairment impair_child_key_length_attribute;
+bool impair_v1_hash_check;
+enum send_impairment impair_v1_hash_payload;
+enum exchange_impairment impair_v1_hash_exchange;
diff -Naur libreswan-3.29-orig/programs/pluto/ikev1.c libreswan-3.29/programs/pluto/ikev1.c
--- libreswan-3.29-orig/programs/pluto/ikev1.c 2019-06-10 10:22:04.000000000 -0400
+++ libreswan-3.29/programs/pluto/ikev1.c 2019-06-11 19:27:44.516665524 -0400
@@ -157,6 +157,7 @@
#include "ikev1_dpd.h"
#include "hostpair.h"
#include "ip_address.h"
+#include "ikev1_hash.h"
#ifdef HAVE_NM
#include "kernel.h"
@@ -181,6 +182,8 @@
lset_t opt_payloads; /* optional payloads (any mumber) */
enum event_type timeout_event;
ikev1_state_transition_fn *processor;
+ const char *message;
+ enum v1_hash_type hash_type;
};
/* State Microcode Flags, in several groups */
@@ -255,6 +258,7 @@
static const struct state_v1_microcode v1_state_microcode_table[] = {
#define P(n) LELEM(ISAKMP_NEXT_ ##n)
+#define FM(F) .processor = F, .message = #F
/***** Phase 1 Main Mode *****/
@@ -266,7 +270,9 @@
{ STATE_MAIN_R0, STATE_MAIN_R1,
SMF_ALL_AUTH | SMF_REPLY,
P(SA), P(VID) | P(CR),
- EVENT_SO_DISCARD, main_inI1_outR1 },
+ EVENT_SO_DISCARD,
+ FM(main_inI1_outR1),
+ .hash_type = V1_HASH_NONE, },
/* STATE_MAIN_I1: R1 --> I2
* HDR, SA --> auth dependent
@@ -281,7 +287,9 @@
{ STATE_MAIN_I1, STATE_MAIN_I2,
SMF_ALL_AUTH | SMF_INITIATOR | SMF_REPLY,
P(SA), P(VID) | P(CR),
- EVENT_RETRANSMIT, main_inR1_outI2 },
+ EVENT_RETRANSMIT,
+ FM(main_inR1_outI2),
+ .hash_type = V1_HASH_NONE, },
/* STATE_MAIN_R1: I2 --> R2
* SMF_PSK_AUTH, SMF_DS_AUTH: HDR, KE, Ni --> HDR, KE, Nr
@@ -294,17 +302,23 @@
{ STATE_MAIN_R1, STATE_MAIN_R2,
SMF_PSK_AUTH | SMF_DS_AUTH | SMF_REPLY | SMF_RETRANSMIT_ON_DUPLICATE,
P(KE) | P(NONCE), P(VID) | P(CR) | P(NATD_RFC),
- EVENT_RETRANSMIT, main_inI2_outR2 },
+ EVENT_RETRANSMIT,
+ FM(main_inI2_outR2),
+ .hash_type = V1_HASH_NONE, },
{ STATE_MAIN_R1, STATE_UNDEFINED,
SMF_PKE_AUTH | SMF_REPLY | SMF_RETRANSMIT_ON_DUPLICATE,
P(KE) | P(ID) | P(NONCE), P(VID) | P(CR) | P(HASH),
- EVENT_RETRANSMIT, unexpected /* ??? not yet implemented */ },
+ EVENT_RETRANSMIT,
+ FM(unexpected) /* ??? not yet implemented */,
+ .hash_type = V1_HASH_NONE, },
{ STATE_MAIN_R1, STATE_UNDEFINED,
SMF_RPKE_AUTH | SMF_REPLY | SMF_RETRANSMIT_ON_DUPLICATE,
P(NONCE) | P(KE) | P(ID), P(VID) | P(CR) | P(HASH) | P(CERT),
- EVENT_RETRANSMIT, unexpected /* ??? not yet implemented */ },
+ EVENT_RETRANSMIT,
+ FM(unexpected) /* ??? not yet implemented */,
+ .hash_type = V1_HASH_NONE, },
/* for states from here on, output message must be encrypted */
@@ -319,17 +333,24 @@
{ STATE_MAIN_I2, STATE_MAIN_I3,
SMF_PSK_AUTH | SMF_DS_AUTH | SMF_INITIATOR | SMF_OUTPUT_ENCRYPTED | SMF_REPLY,
P(KE) | P(NONCE), P(VID) | P(CR) | P(NATD_RFC),
- EVENT_RETRANSMIT, main_inR2_outI3 },
+ EVENT_RETRANSMIT,
+ FM(main_inR2_outI3),
+ /* calls main_mode_hash() after DH */
+ .hash_type = V1_HASH_NONE, },
{ STATE_MAIN_I2, STATE_UNDEFINED,
SMF_PKE_AUTH | SMF_INITIATOR | SMF_OUTPUT_ENCRYPTED | SMF_REPLY,
P(KE) | P(ID) | P(NONCE), P(VID) | P(CR),
- EVENT_RETRANSMIT, unexpected /* ??? not yet implemented */ },
+ EVENT_RETRANSMIT,
+ FM(unexpected) /* ??? not yet implemented */,
+ .hash_type = V1_HASH_NONE, },
{ STATE_MAIN_I2, STATE_UNDEFINED,
SMF_ALL_AUTH | SMF_INITIATOR | SMF_OUTPUT_ENCRYPTED | SMF_REPLY,
P(NONCE) | P(KE) | P(ID), P(VID) | P(CR),
- EVENT_RETRANSMIT, unexpected /* ??? not yet implemented */ },
+ EVENT_RETRANSMIT,
+ FM(unexpected) /* ??? not yet implemented */,
+ .hash_type = V1_HASH_NONE, },
/* for states from here on, input message must be encrypted */
@@ -342,20 +363,34 @@
SMF_PSK_AUTH | SMF_FIRST_ENCRYPTED_INPUT | SMF_ENCRYPTED |
SMF_REPLY | SMF_RELEASE_PENDING_P2,
P(ID) | P(HASH), P(VID) | P(CR),
- EVENT_SA_REPLACE, main_inI3_outR3 },
+ EVENT_SA_REPLACE,
+ FM(main_inI3_outR3),
+ /* calls oakley_id_and_auth() which calls main_mode_hash() */
+ /* RFC 2409: 5. Exchanges & 5.2 Phase 1 Authenticated With Public Key Encryption
+ HASH_I = prf(SKEYID, g^xi | g^xr | CKY-I | CKY-R | SAi_b | IDii_b ) */
+ .hash_type = V1_HASH_NONE, },
{ STATE_MAIN_R2, STATE_MAIN_R3,
SMF_DS_AUTH | SMF_FIRST_ENCRYPTED_INPUT | SMF_ENCRYPTED |
SMF_REPLY | SMF_RELEASE_PENDING_P2,
P(ID) | P(SIG), P(VID) | P(CR) | P(CERT),
- EVENT_SA_REPLACE, main_inI3_outR3 },
+ EVENT_SA_REPLACE,
+ FM(main_inI3_outR3),
+ /* calls oakley_id_and_auth() which calls main_mode_hash() */
+ /* RFC 2409: 5. Exchanges & 5.1 IKE Phase 1 Authenticated With Signatures
+ HASH_I = prf(SKEYID, g^xi | g^xr | CKY-I | CKY-R | SAi_b | IDii_b )
+ SIG_I = SIGN(HASH_I) *",
+ SIG_I = SIGN(HASH_I) */
+ .hash_type = V1_HASH_NONE, },
{ STATE_MAIN_R2, STATE_UNDEFINED,
SMF_PKE_AUTH | SMF_RPKE_AUTH | SMF_FIRST_ENCRYPTED_INPUT |
SMF_ENCRYPTED |
SMF_REPLY | SMF_RELEASE_PENDING_P2,
P(HASH), P(VID) | P(CR),
- EVENT_SA_REPLACE, unexpected /* ??? not yet implemented */ },
+ EVENT_SA_REPLACE,
+ FM(unexpected) /* ??? not yet implemented */,
+ .hash_type = V1_HASH_NONE, },
/* STATE_MAIN_I3: R3 --> done
* SMF_PSK_AUTH: HDR*, IDr1, HASH_R --> done
@@ -367,31 +402,48 @@
SMF_PSK_AUTH | SMF_INITIATOR |
SMF_FIRST_ENCRYPTED_INPUT | SMF_ENCRYPTED | SMF_RELEASE_PENDING_P2,
P(ID) | P(HASH), P(VID) | P(CR),
- EVENT_SA_REPLACE, main_inR3 },
+ EVENT_SA_REPLACE,
+ FM(main_inR3),
+ /* calls oakley_id_and_auth() which calls main_mode_hash() */
+ /* RFC 2409: 5. Exchanges & 5.2 Phase 1 Authenticated With Public Key Encryption
+ HASH_R = prf(SKEYID, g^xr | g^xi | CKY-R | CKY-I | SAi_b | IDir_b ) */
+ .hash_type = V1_HASH_NONE, },
{ STATE_MAIN_I3, STATE_MAIN_I4,
SMF_DS_AUTH | SMF_INITIATOR |
SMF_FIRST_ENCRYPTED_INPUT | SMF_ENCRYPTED | SMF_RELEASE_PENDING_P2,
P(ID) | P(SIG), P(VID) | P(CR) | P(CERT),
- EVENT_SA_REPLACE, main_inR3 },
+ EVENT_SA_REPLACE,
+ FM(main_inR3),
+ /* calls oakley_id_and_auth() which calls main_mode_hash() */
+ /* RFC 2409: 5. Exchanges & 5.1 IKE Phase 1 Authenticated With Signatures
+ HASH_R = prf(SKEYID, g^xr | g^xi | CKY-R | CKY-I | SAi_b | IDir_b )
+ SIG_R = SIGN(HASH_R) */
+ .hash_type = V1_HASH_NONE, },
{ STATE_MAIN_I3, STATE_UNDEFINED,
SMF_PKE_AUTH | SMF_RPKE_AUTH | SMF_INITIATOR |
SMF_FIRST_ENCRYPTED_INPUT | SMF_ENCRYPTED | SMF_RELEASE_PENDING_P2,
P(HASH), P(VID) | P(CR),
- EVENT_SA_REPLACE, unexpected /* ??? not yet implemented */ },
+ EVENT_SA_REPLACE,
+ FM(unexpected) /* ??? not yet implemented */,
+ .hash_type = V1_HASH_NONE, },
/* STATE_MAIN_R3: can only get here due to packet loss */
{ STATE_MAIN_R3, STATE_UNDEFINED,
SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_RETRANSMIT_ON_DUPLICATE,
LEMPTY, LEMPTY,
- EVENT_NULL, unexpected },
+ EVENT_NULL,
+ FM(unexpected),
+ .hash_type = V1_HASH_NONE, },
/* STATE_MAIN_I4: can only get here due to packet loss */
{ STATE_MAIN_I4, STATE_UNDEFINED,
SMF_ALL_AUTH | SMF_INITIATOR | SMF_ENCRYPTED,
LEMPTY, LEMPTY,
- EVENT_NULL, unexpected },
+ EVENT_NULL,
+ FM(unexpected),
+ .hash_type = V1_HASH_NONE, },
/***** Phase 1 Aggressive Mode *****/
@@ -413,7 +465,10 @@
{ STATE_AGGR_R0, STATE_AGGR_R1,
SMF_PSK_AUTH | SMF_DS_AUTH | SMF_REPLY,
P(SA) | P(KE) | P(NONCE) | P(ID), P(VID) | P(NATD_RFC),
- EVENT_SO_DISCARD, aggr_inI1_outR1 },
+ EVENT_SO_DISCARD,
+ FM(aggr_inI1_outR1),
+ /* N/A */
+ .hash_type = V1_HASH_NONE, },
/* STATE_AGGR_I1:
* SMF_PSK_AUTH: HDR, SA, KE, Nr, IDir, HASH_R
@@ -425,13 +480,24 @@
SMF_PSK_AUTH | SMF_INITIATOR | SMF_OUTPUT_ENCRYPTED | SMF_REPLY |
SMF_RELEASE_PENDING_P2,
P(SA) | P(KE) | P(NONCE) | P(ID) | P(HASH), P(VID) | P(NATD_RFC),
- EVENT_SA_REPLACE, aggr_inR1_outI2 },
+ EVENT_SA_REPLACE,
+ FM(aggr_inR1_outI2),
+ /* after DH calls oakley_id_and_auth() which calls main_mode_hash() */
+ /* RFC 2409: 5. Exchanges & 5.2 Phase 1 Authenticated With Public Key Encryption
+ HASH_R = prf(SKEYID, g^xr | g^xi | CKY-R | CKY-I | SAi_b | IDir_b ) */
+ .hash_type = V1_HASH_NONE, },
{ STATE_AGGR_I1, STATE_AGGR_I2,
SMF_DS_AUTH | SMF_INITIATOR | SMF_OUTPUT_ENCRYPTED | SMF_REPLY |
SMF_RELEASE_PENDING_P2,
P(SA) | P(KE) | P(NONCE) | P(ID) | P(SIG), P(VID) | P(NATD_RFC),
- EVENT_SA_REPLACE, aggr_inR1_outI2 },
+ EVENT_SA_REPLACE,
+ FM(aggr_inR1_outI2),
+ /* after DH calls oakley_id_and_auth() which calls main_mode_hash() */
+ /* RFC 2409: 5. Exchanges & 5.1 IKE Phase 1 Authenticated With Signatures
+ HASH_R = prf(SKEYID, g^xr | g^xi | CKY-R | CKY-I | SAi_b | IDir_b )
+ SIG_R = SIGN(HASH_R) */
+ .hash_type = V1_HASH_NONE, },
/* STATE_AGGR_R1:
* SMF_PSK_AUTH: HDR*, HASH_I --> done
@@ -442,24 +508,39 @@
SMF_OUTPUT_ENCRYPTED | SMF_RELEASE_PENDING_P2 |
SMF_RETRANSMIT_ON_DUPLICATE,
P(HASH), P(VID) | P(NATD_RFC),
- EVENT_SA_REPLACE, aggr_inI2 },
+ EVENT_SA_REPLACE,
+ FM(aggr_inI2),
+ /* calls oakley_id_and_auth() which calls main_mode_hash() */
+ /* RFC 2409: 5. Exchanges & 5.2 Phase 1 Authenticated With Public Key Encryption
+ HASH_I = prf(SKEYID, g^xi | g^xr | CKY-I | CKY-R | SAi_b | IDii_b ) */
+ .hash_type = V1_HASH_NONE, },
{ STATE_AGGR_R1, STATE_AGGR_R2,
SMF_DS_AUTH | SMF_FIRST_ENCRYPTED_INPUT |
SMF_OUTPUT_ENCRYPTED | SMF_RELEASE_PENDING_P2 |
SMF_RETRANSMIT_ON_DUPLICATE,
P(SIG), P(VID) | P(NATD_RFC),
- EVENT_SA_REPLACE, aggr_inI2 },
+ EVENT_SA_REPLACE,
+ FM(aggr_inI2),
+ /* calls oakley_id_and_auth() which calls main_mode_hash() */
+ /* RFC 2409: 5. Exchanges & 5.1 IKE Phase 1 Authenticated With Signatures
+ HASH_I = prf(SKEYID, g^xi | g^xr | CKY-I | CKY-R | SAi_b | IDii_b )
+ SIG_I = SIGN(HASH_I) */
+ .hash_type = V1_HASH_NONE, },
/* STATE_AGGR_I2: can only get here due to packet loss */
{ STATE_AGGR_I2, STATE_UNDEFINED,
SMF_ALL_AUTH | SMF_INITIATOR | SMF_RETRANSMIT_ON_DUPLICATE,
- LEMPTY, LEMPTY, EVENT_NULL, unexpected },
+ LEMPTY, LEMPTY, EVENT_NULL,
+ FM(unexpected),
+ .hash_type = V1_HASH_NONE, },
/* STATE_AGGR_R2: can only get here due to packet loss */
{ STATE_AGGR_R2, STATE_UNDEFINED,
SMF_ALL_AUTH,
- LEMPTY, LEMPTY, EVENT_NULL, unexpected },
+ LEMPTY, LEMPTY, EVENT_NULL,
+ FM(unexpected),
+ .hash_type = V1_HASH_NONE, },
/***** Phase 2 Quick Mode *****/
@@ -478,7 +559,11 @@
{ STATE_QUICK_R0, STATE_QUICK_R1,
SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY,
P(HASH) | P(SA) | P(NONCE), /* P(SA) | */ P(KE) | P(ID) | P(NATOA_RFC),
- EVENT_RETRANSMIT, quick_inI1_outR1 },
+ EVENT_RETRANSMIT,
+ FM(quick_inI1_outR1),
+ /* RFC 2409: 5.5 Phase 2 - Quick Mode:
+ HASH(1) = prf(SKEYID_a, M-ID | <rest>) */
+ .hash_type = V1_HASH_1, },
/* STATE_QUICK_I1:
* HDR*, HASH(2), SA, Nr [, KE ] [, IDci, IDcr ] -->
@@ -489,7 +574,11 @@
{ STATE_QUICK_I1, STATE_QUICK_I2,
SMF_ALL_AUTH | SMF_INITIATOR | SMF_ENCRYPTED | SMF_REPLY,
P(HASH) | P(SA) | P(NONCE), /* P(SA) | */ P(KE) | P(ID) | P(NATOA_RFC),
- EVENT_SA_REPLACE, quick_inR1_outI2 },
+ EVENT_SA_REPLACE,
+ FM(quick_inR1_outI2),
+ /* RFC 2409: 5.5 Phase 2 - Quick Mode:
+ HASH(2) = prf(SKEYID_a, M-ID | Ni_b | <rest>) */
+ .hash_type = V1_HASH_2, },
/* STATE_QUICK_R1: HDR*, HASH(3) --> done
* Installs outbound IPsec SAs, routing, etc.
@@ -497,20 +586,28 @@
{ STATE_QUICK_R1, STATE_QUICK_R2,
SMF_ALL_AUTH | SMF_ENCRYPTED,
P(HASH), LEMPTY,
- EVENT_SA_REPLACE, quick_inI2 },
+ EVENT_SA_REPLACE,
+ FM(quick_inI2),
+ /* RFC 2409: 5.5 Phase 2 - Quick Mode:
+ HASH(3) = prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b) */
+ .hash_type = V1_HASH_3, },
/* STATE_QUICK_I2: can only happen due to lost packet */
{ STATE_QUICK_I2, STATE_UNDEFINED,
SMF_ALL_AUTH | SMF_INITIATOR | SMF_ENCRYPTED |
SMF_RETRANSMIT_ON_DUPLICATE,
LEMPTY, LEMPTY,
- EVENT_NULL, unexpected },
+ EVENT_NULL,
+ FM(unexpected),
+ .hash_type = V1_HASH_NONE, },
/* STATE_QUICK_R2: can only happen due to lost packet */
{ STATE_QUICK_R2, STATE_UNDEFINED,
SMF_ALL_AUTH | SMF_ENCRYPTED,
LEMPTY, LEMPTY,
- EVENT_NULL, unexpected },
+ EVENT_NULL,
+ FM(unexpected),
+ .hash_type = V1_HASH_NONE, },
/***** informational messages *****/
@@ -522,7 +619,9 @@
{ STATE_INFO, STATE_UNDEFINED,
SMF_ALL_AUTH,
LEMPTY, LEMPTY,
- EVENT_NULL, informational },
+ EVENT_NULL,
+ FM(informational),
+ .hash_type = V1_HASH_NONE, },
/* Informational Exchange (RFC 2408 4.8):
* HDR* N/D
@@ -531,29 +630,41 @@
{ STATE_INFO_PROTECTED, STATE_UNDEFINED,
SMF_ALL_AUTH | SMF_ENCRYPTED,
P(HASH), LEMPTY,
- EVENT_NULL, informational },
+ EVENT_NULL,
+ FM(informational),
+ /* RFC 2409: 5.7 ISAKMP Informational Exchanges:
+ HASH(1) = prf(SKEYID_a, M-ID | N/D) */
+ .hash_type = V1_HASH_1, },
{ STATE_XAUTH_R0, STATE_XAUTH_R1,
SMF_ALL_AUTH | SMF_ENCRYPTED,
P(MCFG_ATTR) | P(HASH), P(VID),
- EVENT_NULL, xauth_inR0 }, /* Re-transmit may be done by previous state */
+ EVENT_NULL,
+ FM(xauth_inR0),
+ /* RFC ????: */
+ .hash_type = V1_HASH_1, }, /* Re-transmit may be done by previous state */
{ STATE_XAUTH_R1, STATE_MAIN_R3,
SMF_ALL_AUTH | SMF_ENCRYPTED,
P(MCFG_ATTR) | P(HASH), P(VID),
- EVENT_SA_REPLACE, xauth_inR1 },
+ EVENT_SA_REPLACE,
+ FM(xauth_inR1),
+ /* RFC ????: */
+ .hash_type = V1_HASH_1, },
#if 0
/* for situation where there is XAUTH + ModeCFG */
{ STATE_XAUTH_R2, STATE_XAUTH_R3,
SMF_ALL_AUTH | SMF_ENCRYPTED,
P(MCFG_ATTR) | P(HASH), P(VID),
- EVENT_SA_REPLACE, xauth_inR2 },
+ EVENT_SA_REPLACE,
+ FM(xauth_inR2), },
{ STATE_XAUTH_R3, STATE_MAIN_R3,
SMF_ALL_AUTH | SMF_ENCRYPTED,
P(MCFG_ATTR) | P(HASH), P(VID),
- EVENT_SA_REPLACE, xauth_inR3 },
+ EVENT_SA_REPLACE,
+ FM(xauth_inR3), },
#endif
/* MODE_CFG_x:
@@ -568,37 +679,57 @@
{ STATE_MODE_CFG_R0, STATE_MODE_CFG_R1,
SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY,
P(MCFG_ATTR) | P(HASH), P(VID),
- EVENT_SA_REPLACE, modecfg_inR0 },
+ EVENT_SA_REPLACE,
+ FM(modecfg_inR0),
+ /* RFC ????: */
+ .hash_type = V1_HASH_1, },
{ STATE_MODE_CFG_R1, STATE_MODE_CFG_R2,
SMF_ALL_AUTH | SMF_ENCRYPTED,
P(MCFG_ATTR) | P(HASH), P(VID),
- EVENT_SA_REPLACE, modecfg_inR1 },
+ EVENT_SA_REPLACE,
+ FM(modecfg_inR1),
+ /* RFC ????: */
+ .hash_type = V1_HASH_1, },
{ STATE_MODE_CFG_R2, STATE_UNDEFINED,
SMF_ALL_AUTH | SMF_ENCRYPTED,
LEMPTY, LEMPTY,
- EVENT_NULL, unexpected },
+ EVENT_NULL,
+ FM(unexpected),
+ .hash_type = V1_HASH_NONE, },
{ STATE_MODE_CFG_I1, STATE_MAIN_I4,
SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_RELEASE_PENDING_P2,
P(MCFG_ATTR) | P(HASH), P(VID),
- EVENT_SA_REPLACE, modecfg_inR1 },
+ EVENT_SA_REPLACE,
+ FM(modecfg_inR1),
+ /* RFC ????: */
+ .hash_type = V1_HASH_1, },
{ STATE_XAUTH_I0, STATE_XAUTH_I1,
SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY | SMF_RELEASE_PENDING_P2,
P(MCFG_ATTR) | P(HASH), P(VID),
- EVENT_RETRANSMIT, xauth_inI0 },
+ EVENT_RETRANSMIT,
+ FM(xauth_inI0),
+ /* RFC ????: */
+ .hash_type = V1_HASH_1, },
{ STATE_XAUTH_I1, STATE_MAIN_I4,
SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY | SMF_RELEASE_PENDING_P2,
P(MCFG_ATTR) | P(HASH), P(VID),
- EVENT_RETRANSMIT, xauth_inI1 },
+ EVENT_RETRANSMIT,
+ FM(xauth_inI1),
+ /* RFC ????: */
+ .hash_type = V1_HASH_1, },
{ STATE_IKEv1_ROOF, STATE_IKEv1_ROOF,
LEMPTY,
LEMPTY, LEMPTY,
- EVENT_NULL, NULL },
+ EVENT_NULL, NULL,
+ .hash_type = V1_HASH_NONE, },
+
+#undef FM
#undef P
};
@@ -748,6 +879,11 @@
DBGF(DBG_TMI, "processing IKEv1 state transition %s -> %s",
from->fs_short_name, to->fs_short_name);
+ if (t->message == NULL) {
+ PEXPECT_LOG("transition %s -> %s missing .message",
+ from->fs_short_name, to->fs_short_name);
+ }
+
/*
* Point .fs_v1_transitions at to the first entry in
* v1_state_microcode_table for that state. All other
@@ -786,10 +922,32 @@
* always true of a state?
*/
if ((t->flags & from->fs_flags) != from->fs_flags) {
- DBGF(DBG_BASE, "transition %s -> %s missing flags 0x%"PRIxLSET,
- from->fs_short_name, to->fs_short_name, from->fs_flags);
+ DBGF(DBG_BASE, "transition %s -> %s (%s) missing flags 0x%"PRIxLSET,
+ from->fs_short_name, to->fs_short_name,
+ t->message, from->fs_flags);
}
from->fs_flags |= t->flags & SMF_RETRANSMIT_ON_DUPLICATE;
+
+ if (!(t->flags & SMF_FIRST_ENCRYPTED_INPUT) &&
+ (t->flags & SMF_INPUT_ENCRYPTED) &&
+ t->processor != unexpected) {
+ /*
+ * The first encrypted message carries
+ * authentication information so isn't
+ * applicable. Other encrypted messages
+ * require integrity via the HASH payload.
+ */
+ if (!(t->req_payloads & LELEM(ISAKMP_NEXT_HASH))) {
+ PEXPECT_LOG("transition %s -> %s (%s) missing HASH payload",
+ from->fs_short_name, to->fs_short_name,
+ t->message);
+ }
+ if (t->hash_type == V1_HASH_NONE) {
+ PEXPECT_LOG("transition %s -> %s (%s) missing HASH protection",
+ from->fs_short_name, to->fs_short_name,
+ t->message);
+ }
+ }
}
/*
@@ -2252,30 +2410,9 @@
}
}
- if (md->hdr.isa_xchg == ISAKMP_XCHG_INFO &&
- md->hdr.isa_np == ISAKMP_NEXT_HASH) {
- pb_stream *const hash_pbs = &(md)->chain[ISAKMP_NEXT_HASH]->pbs;
- u_char hash_val[MAX_DIGEST_LEN];
- size_t hash_len = quick_mode_hash12(hash_val, hash_pbs->roof,
- md->message_pbs.roof,
- st, &md->hdr.isa_msgid, FALSE);
- if (pbs_left(hash_pbs) != hash_len) {
- loglog(RC_LOG_SERIOUS,
- "received 'informational' message HASH(1) data is the wrong length (received %zu bytes but expected %zu)",
- pbs_left(hash_pbs), hash_len);
- return;
- }
- if (!memeq(hash_pbs->cur, hash_val, hash_len)) {
- if (DBGP(DBG_CRYPT)) {
- DBG_dump("received 'informational':",
- hash_pbs->cur, pbs_left(hash_pbs));
- }
- loglog(RC_LOG_SERIOUS,
- "received 'informational' message HASH(1) data does not match computed value");
- return;
- } else {
- dbg("received 'informational' message HASH(1) data ok");
- }
+ if (!check_v1_HASH(smc->hash_type, smc->message, st, md)) {
+ /*SEND_NOTIFICATION(INVALID_HASH_INFORMATION);*/
+ return;
}
/* more sanity checking: enforce most ordering constraints */
diff -Naur libreswan-3.29-orig/programs/pluto/ikev1_hash.c libreswan-3.29/programs/pluto/ikev1_hash.c
--- libreswan-3.29-orig/programs/pluto/ikev1_hash.c 1969-12-31 19:00:00.000000000 -0500
+++ libreswan-3.29/programs/pluto/ikev1_hash.c 2019-06-11 19:24:00.543181473 -0400
@@ -0,0 +1,158 @@
+/* IKEv1 HASH payload wierdness, for Libreswan
+ *
+ * Copyright (C) 2019 Andrew Cagney
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <https://www.gnu.org/licenses/gpl2.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ *
+ */
+
+#include "ikev1_hash.h"
+
+#include "state.h"
+#include "crypt_prf.h"
+#include "ike_alg.h"
+#include "lswlog.h"
+#include "demux.h"
+#include "impair.h"
+
+bool emit_v1_HASH(enum v1_hash_type hash_type, const char *what,
+ enum exchange_impairment exchange,
+ struct state *st, struct v1_hash_fixup *fixup,
+ pb_stream *rbody)
+{
+ zero(fixup);
+ fixup->what = what;
+ fixup->hash_type = hash_type;
+ fixup->impair = (impair_v1_hash_exchange == exchange
+ ? impair_v1_hash_payload : SEND_NORMAL);
+ if (fixup->impair == SEND_OMIT) {
+ libreswan_log("IMPAIR: omitting HASH payload for %s", what);
+ return true;
+ }
+ pb_stream hash_pbs;
+ if (!ikev1_out_generic(0, &isakmp_hash_desc, rbody, &hash_pbs)) {
+ return false;
+ }
+ if (fixup->impair == SEND_EMPTY) {
+ libreswan_log("IMPAIR: sending HASH payload with no data for %s", what);
+ } else {
+ /* reserve space for HASH data */
+ fixup->hash_data = chunk(hash_pbs.cur, st->st_oakley.ta_prf->prf_output_size);
+ if (!out_zero(fixup->hash_data.len, &hash_pbs, "HASH DATA"))
+ return false;
+ }
+ close_output_pbs(&hash_pbs);
+ /* save start of rest of message for later */
+ fixup->body = rbody->cur;
+ return true;
+}
+
+void fixup_v1_HASH(struct state *st, const struct v1_hash_fixup *fixup,
+ msgid_t msgid, const uint8_t *roof)
+{
+ if (fixup->impair >= SEND_ROOF) {
+ libreswan_log("IMPAIR: setting HASH payload bytes to %02x",
+ fixup->impair - SEND_ROOF);
+ /* chunk_fill()? */
+ memset(fixup->hash_data.ptr, fixup->impair - SEND_ROOF,
+ fixup->hash_data.len);
+ return;
+ } else if (fixup->impair != SEND_NORMAL) {
+ /* already logged above? */
+ return;
+ }
+ struct crypt_prf *hash =
+ crypt_prf_init_symkey("HASH(1)", st->st_oakley.ta_prf,
+ "SKEYID_a", st->st_skeyid_a_nss);
+ /* msgid */
+ passert(sizeof(msgid_t) == sizeof(uint32_t));
+ msgid_t raw_msgid = htonl(msgid);
+ switch (fixup->hash_type) {
+ case V1_HASH_1:
+ /* HASH(1) = prf(SKEYID_a, M-ID | payload ) */
+ crypt_prf_update_bytes(hash, "M-ID", &raw_msgid, sizeof(raw_msgid));
+ crypt_prf_update_bytes(hash, "payload",
+ fixup->body, roof - fixup->body);
+ break;
+ case V1_HASH_2:
+ /* HASH(2) = prf(SKEYID_a, M-ID | Ni_b | payload ) */
+ crypt_prf_update_bytes(hash, "M-ID", &raw_msgid, sizeof(raw_msgid));
+ crypt_prf_update_chunk(hash, "Ni_b", st->st_ni);
+ crypt_prf_update_bytes(hash, "payload",
+ fixup->body, roof - fixup->body);
+ break;
+ case V1_HASH_3:
+ /* HASH(3) = prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b) */
+ crypt_prf_update_byte(hash, "0", 0);
+ crypt_prf_update_bytes(hash, "M-ID", &raw_msgid, sizeof(raw_msgid));
+ crypt_prf_update_chunk(hash, "Ni_b", st->st_ni);
+ crypt_prf_update_chunk(hash, "Nr_b", st->st_nr);
+ break;
+ default:
+ bad_case(fixup->hash_type);
+ }
+ /* stuff result into hash_data */
+ passert(fixup->hash_data.len == st->st_oakley.ta_prf->prf_output_size);
+ crypt_prf_final_bytes(&hash, fixup->hash_data.ptr, fixup->hash_data.len);
+ if (DBGP(DBG_BASE)) {
+ DBG_log("%s HASH(%u):", fixup->what, fixup->hash_type);
+ DBG_dump_chunk(NULL, fixup->hash_data);
+ }
+}
+
+bool check_v1_HASH(enum v1_hash_type type, const char *what,
+ struct state *st, struct msg_digest *md)
+{
+ if (type == V1_HASH_NONE) {
+ dbg("message '%s' HASH payload not checked early", what);
+ return true;
+ }
+ if (impair_v1_hash_check) {
+ libreswan_log("IMPAIR: skipping check of '%s' HASH payload", what);
+ return true;
+ }
+ if (md->hdr.isa_np != ISAKMP_NEXT_HASH) {
+ loglog(RC_LOG_SERIOUS, "received '%s' message is missing a HASH(%u) payload",
+ what, type);
+ return false;
+ }
+ pb_stream *hash_pbs = &md->chain[ISAKMP_NEXT_HASH]->pbs;
+ chunk_t received_hash = same_in_pbs_left_as_chunk(hash_pbs);
+ if (received_hash.len != st->st_oakley.ta_prf->prf_output_size) {
+ loglog(RC_LOG_SERIOUS,
+ "received '%s' message HASH(%u) data is the wrong length (received %zd bytes but expected %zd)",
+ what, type, received_hash.len, st->st_oakley.ta_prf->prf_output_size);
+ return false;
+ }
+ /* compute the expected hash */
+ uint8_t hash_val[MAX_DIGEST_LEN];
+ passert(sizeof(hash_val) >= st->st_oakley.ta_prf->prf_output_size);
+ struct v1_hash_fixup expected = {
+ .hash_data = chunk(hash_val, st->st_oakley.ta_prf->prf_output_size),
+ .body = received_hash.ptr + received_hash.len,
+ .what = what,
+ .hash_type = type,
+ };
+ fixup_v1_HASH(st, &expected, md->hdr.isa_msgid, md->message_pbs.roof);
+ /* does it match? */
+ if (!chunk_eq(received_hash, expected.hash_data)) {
+ if (DBGP(DBG_BASE)) {
+ DBG_log("received %s HASH_DATA:", what);
+ DBG_dump_chunk(NULL, received_hash);
+ }
+ loglog(RC_LOG_SERIOUS,
+ "received '%s' message HASH(%u) data does not match computed value",
+ what, type);
+ return false;
+ }
+ dbg("received '%s' message HASH(%u) data ok", what, type);
+ return true;
+}
diff -Naur libreswan-3.29-orig/programs/pluto/ikev1_hash.h libreswan-3.29/programs/pluto/ikev1_hash.h
--- libreswan-3.29-orig/programs/pluto/ikev1_hash.h 1969-12-31 19:00:00.000000000 -0500
+++ libreswan-3.29/programs/pluto/ikev1_hash.h 2019-06-11 19:24:00.543181473 -0400
@@ -0,0 +1,77 @@
+/* IKEv1 HASH payload wierdness, for Libreswan
+ *
+ * Copyright (C) 2019 Andrew Cagney
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <https://www.gnu.org/licenses/gpl2.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ *
+ */
+
+#ifndef IKEV1_HASH_H
+#define IKEV1_HASH_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#include "chunk.h"
+#include "defs.h" /* for msgid_t */
+#include "packet.h" /* for pb_stream */
+#include "impair.h"
+
+struct state;
+struct msg_digest;
+
+/*
+ * RFC 2409: 5.5 Phase 2 - Quick Mode
+ *
+ * HASH(1) = prf(SKEYID_a, M-ID | SA | Ni [ | KE ] [ | IDci | IDcr )
+ * aka HASH(1) = prf(SKEYID_a, M-ID | payload )
+ *
+ * HASH(2) = prf(SKEYID_a, M-ID | Ni_b | SA | Nr [ | KE ] [ | IDci | IDcr )
+ * aka HASH(2) = prf(SKEYID_a, M-ID | Ni_b | payload )
+ *
+ * HASH(3) = prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b)
+ */
+
+enum v1_hash_type {
+ V1_HASH_NONE,
+ V1_HASH_1 = 1,
+ V1_HASH_2 = 2,
+ V1_HASH_3 = 3,
+};
+
+/*
+ * Emit (saving where it is) and fixup (a previously saved) v1 HASH
+ * payload.
+ */
+
+struct v1_hash_fixup {
+ chunk_t hash_data;
+ const uint8_t *body;
+ msgid_t msgid;
+ const char *what;
+ enum send_impairment impair;
+ enum v1_hash_type hash_type;
+};
+
+bool emit_v1_HASH(enum v1_hash_type type, const char *what,
+ enum exchange_impairment exchange, struct state *st,
+ struct v1_hash_fixup *hash_fixup, pb_stream *out_pbs);
+
+void fixup_v1_HASH(struct state *st, const struct v1_hash_fixup *data,
+ msgid_t msgid, const uint8_t *roof);
+
+/*
+ * Check the IKEv1 HASH payload.
+ */
+bool check_v1_HASH(enum v1_hash_type type, const char *what,
+ struct state *st, struct msg_digest *md);
+
+#endif
diff -Naur libreswan-3.29-orig/programs/pluto/ikev1_main.c libreswan-3.29/programs/pluto/ikev1_main.c
--- libreswan-3.29-orig/programs/pluto/ikev1_main.c 2019-06-10 10:22:04.000000000 -0400
+++ libreswan-3.29/programs/pluto/ikev1_main.c 2019-06-11 19:23:55.362124010 -0400
@@ -65,6 +65,7 @@
#include "fetch.h"
#include "asn1.h"
#include "pending.h"
+#include "ikev1_hash.h"
#include "crypto.h"
#include "secrets.h"
@@ -1547,6 +1548,10 @@
"received Hash Payload does not match computed value");
/* XXX Could send notification back */
r = STF_FAIL + INVALID_HASH_INFORMATION;
+ } else {
+ dbg("received '%s' message HASH_%s data ok",
+ aggrmode ? "Aggr" : "Main",
+ initiator ? "R" : "I" /*reverse*/);
}
break;
}
@@ -1555,6 +1560,11 @@
{
r = RSA_check_signature(st, hash_val, hash_len,
&md->chain[ISAKMP_NEXT_SIG]->pbs, 0 /* for ikev2 only*/);
+ if (r != STF_OK) {
+ dbg("received '%s' message SIG_%s data did not match computed value",
+ aggrmode ? "Aggr" : "Main",
+ initiator ? "R" : "I" /*reverse*/);
+ }
break;
}
/* These are the only IKEv1 AUTH methods we support */
@@ -1862,14 +1872,11 @@
}
stf_status send_isakmp_notification(struct state *st,
- uint16_t type, const void *data,
- size_t len)
+ uint16_t type, const void *data,
+ size_t len)
{
msgid_t msgid;
pb_stream rbody;
- u_char
- *r_hashval, /* where in reply to jam hash value */
- *r_hash_start; /* start of what is to be hashed */
msgid = generate_msgid(st);
@@ -1879,7 +1886,6 @@
/* HDR* */
{
struct isakmp_hdr hdr = {
- .isa_np = ISAKMP_NEXT_HASH,
.isa_version = ISAKMP_MAJOR_VERSION << ISA_MAJ_SHIFT |
ISAKMP_MINOR_VERSION,
.isa_xchg = ISAKMP_XCHG_INFO,
@@ -1891,8 +1897,13 @@
if (!out_struct(&hdr, &isakmp_hdr_desc, &reply_stream, &rbody))
return STF_INTERNAL_ERROR;
}
- /* HASH -- create and note space to be filled later */
- START_HASH_PAYLOAD(rbody, ISAKMP_NEXT_N);
+
+ struct v1_hash_fixup hash_fixup;
+ if (!emit_v1_HASH(V1_HASH_1, "notification",
+ NOTIFICATION_EXCHANGE,
+ st, &hash_fixup, &rbody)) {
+ return STF_INTERNAL_ERROR;
+ }
/* NOTIFY */
{
@@ -1919,23 +1930,8 @@
close_output_pbs(¬ify_pbs);
}
+ fixup_v1_HASH(st, &hash_fixup, msgid, rbody.cur);
- {
- /* finish computing HASH */
- struct hmac_ctx ctx;
-
- hmac_init(&ctx, st->st_oakley.ta_prf, st->st_skeyid_a_nss);
- passert(sizeof(msgid_t) == sizeof(uint32_t));
- msgid_t raw_msgid = htonl(msgid);
- hmac_update(&ctx, (const void *)&raw_msgid, sizeof(raw_msgid));
- hmac_update(&ctx, r_hash_start, rbody.cur - r_hash_start);
- hmac_final(r_hashval, &ctx);
-
- DBG(DBG_CRYPT, {
- DBG_log("HASH computed:");
- DBG_dump("", r_hashval, ctx.hmac_digest_len);
- });
- }
/*
* save old IV (this prevents from copying a whole new state object
* for NOTIFICATION / DELETE messages we don't need to maintain a state
@@ -1984,13 +1980,9 @@
pb_stream pbs;
pb_stream r_hdr_pbs;
- u_char *r_hashval, *r_hash_start;
static monotime_t last_malformed = MONOTIME_EPOCH;
monotime_t n = mononow();
- r_hashval = NULL;
- r_hash_start = NULL;
-
switch (type) {
case PAYLOAD_MALFORMED:
/* only send one per second. */
@@ -2065,7 +2057,6 @@
struct isakmp_hdr hdr = {
.isa_version = ISAKMP_MAJOR_VERSION << ISA_MAJ_SHIFT |
ISAKMP_MINOR_VERSION,
- .isa_np = encst ? ISAKMP_NEXT_HASH : ISAKMP_NEXT_N,
.isa_xchg = ISAKMP_XCHG_INFO,
.isa_msgid = msgid,
.isa_flags = encst ? ISAKMP_FLAGS_v1_ENCRYPTION : 0,
@@ -2078,15 +2069,14 @@
}
/* HASH -- value to be filled later */
- if (encst) {
- pb_stream hash_pbs;
- passert(ikev1_out_generic(ISAKMP_NEXT_N, &isakmp_hash_desc, &r_hdr_pbs,
- &hash_pbs));
- r_hashval = hash_pbs.cur; /* remember where to plant value */
- passert(out_zero(encst->st_oakley.ta_prf->prf_output_size,
- &hash_pbs, "HASH(1)"));
- close_output_pbs(&hash_pbs);
- r_hash_start = r_hdr_pbs.cur; /* hash from after HASH(1) */
+ struct v1_hash_fixup hash_fixup;
+ if (encst != NULL) {
+ if (!emit_v1_HASH(V1_HASH_1, "send notification",
+ NOTIFICATION_EXCHANGE,
+ encst, &hash_fixup, &r_hdr_pbs)) {
+ /* return STF_INTERNAL_ERROR; */
+ return;
+ }
}
/* Notification Payload */
@@ -2111,21 +2101,8 @@
}
/* calculate hash value and patch into Hash Payload */
- if (encst) {
- struct hmac_ctx ctx;
-
- hmac_init(&ctx, encst->st_oakley.ta_prf,
- encst->st_skeyid_a_nss);
- passert(sizeof(msgid_t) == sizeof(uint32_t));
- msgid_t raw_msgid = htonl(msgid);
- hmac_update(&ctx, (const void *)&raw_msgid, sizeof(raw_msgid));
- hmac_update(&ctx, r_hash_start, r_hdr_pbs.cur - r_hash_start);
- hmac_final(r_hashval, &ctx);
-
- DBG(DBG_CRYPT, {
- DBG_log("HASH(1) computed:");
- DBG_dump("", r_hashval, ctx.hmac_digest_len);
- });
+ if (encst != NULL) {
+ fixup_v1_HASH(encst, &hash_fixup, msgid, r_hdr_pbs.cur);
}
if (encst != NULL) {
@@ -2242,9 +2219,6 @@
struct state *p1st;
ip_said said[EM_MAXRELSPIS];
ip_said *ns = said;
- u_char
- *r_hashval, /* where in reply to jam hash value */
- *r_hash_start; /* start of what is to be hashed */
bool isakmp_sa = FALSE;
/* If there are IPsec SA's related to this state struct... */
@@ -2288,7 +2262,6 @@
struct isakmp_hdr hdr = {
.isa_version = ISAKMP_MAJOR_VERSION << ISA_MAJ_SHIFT |
ISAKMP_MINOR_VERSION,
- .isa_np = ISAKMP_NEXT_HASH,
.isa_xchg = ISAKMP_XCHG_INFO,
.isa_msgid = msgid,
.isa_flags = ISAKMP_FLAGS_v1_ENCRYPTION,
@@ -2300,16 +2273,10 @@
}
/* HASH -- value to be filled later */
- {
- pb_stream hash_pbs;
-
- passert(ikev1_out_generic(ISAKMP_NEXT_D, &isakmp_hash_desc, &r_hdr_pbs,
- &hash_pbs));
- r_hashval = hash_pbs.cur; /* remember where to plant value */
- passert(out_zero(p1st->st_oakley.ta_prf->prf_output_size,
- &hash_pbs, "HASH(1)"));
- close_output_pbs(&hash_pbs);
- r_hash_start = r_hdr_pbs.cur; /* hash from after HASH(1) */
+ struct v1_hash_fixup hash_fixup;
+ if (!emit_v1_HASH(V1_HASH_1, "send delete", DELETE_EXCHANGE,
+ p1st, &hash_fixup, &r_hdr_pbs)) {
+ return /* STF_INTERNAL_ERROR */;
}
/* Delete Payloads */
@@ -2375,22 +2342,7 @@
}
/* calculate hash value and patch into Hash Payload */
- {
- struct hmac_ctx ctx;
-
- hmac_init(&ctx, p1st->st_oakley.ta_prf,
- p1st->st_skeyid_a_nss);
- passert(sizeof(msgid_t) == sizeof(uint32_t));
- msgid_t raw_msgid = htonl(msgid);
- hmac_update(&ctx, (const void *)&raw_msgid, sizeof(raw_msgid));
- hmac_update(&ctx, r_hash_start, r_hdr_pbs.cur - r_hash_start);
- hmac_final(r_hashval, &ctx);
-
- DBG(DBG_CRYPT, {
- DBG_log("HASH(1) computed:");
- DBG_dump("", r_hashval, ctx.hmac_digest_len);
- });
- }
+ fixup_v1_HASH(p1st, &hash_fixup, msgid, r_hdr_pbs.cur);
/*
* Do a dance to avoid needing a new state object.
diff -Naur libreswan-3.29-orig/programs/pluto/ikev1_quick.c libreswan-3.29/programs/pluto/ikev1_quick.c
--- libreswan-3.29-orig/programs/pluto/ikev1_quick.c 2019-06-10 10:22:04.000000000 -0400
+++ libreswan-3.29/programs/pluto/ikev1_quick.c 2019-06-11 19:28:00.687844878 -0400
@@ -81,6 +81,7 @@
#include "pluto_x509.h"
#include "ip_address.h"
#include "af_info.h"
+#include "ikev1_hash.h"
#include <blapit.h>
@@ -660,69 +661,6 @@
return !bad_proposal;
}
-/* Compute HASH(1), HASH(2) of Quick Mode.
- * HASH(1) is part of Quick I1 message.
- * HASH(2) is part of Quick R1 message.
- * Used by: quick_outI1, quick_inI1_outR1 (twice), quick_inR1_outI2
- * (see RFC 2409 "IKE" 5.5, pg. 18 or draft-ietf-ipsec-ike-01.txt 6.2 pg 25)
- */
-size_t quick_mode_hash12(u_char *dest, const u_char *start,
- const u_char *roof,
- const struct state *st, const msgid_t *msgid,
- bool hash2)
-{
- struct hmac_ctx ctx;
-
-#if 0 /* if desperate to debug hashing */
-# define hmac_update(ctx, ptr, len) { \
- DBG_dump("hash input", (ptr), (len)); \
- (hmac_update)((ctx), (ptr), (len)); \
-}
- DBG_dump("hash key", st->st_skeyid_a.ptr, st->st_skeyid_a.len);
-#endif
- hmac_init(&ctx, st->st_oakley.ta_prf, st->st_skeyid_a_nss);
- passert(sizeof(msgid_t) == sizeof(uint32_t));
- msgid_t raw_msgid = htonl(*msgid);
- hmac_update(&ctx, (const void *)&raw_msgid, sizeof(raw_msgid));
- if (hash2)
- hmac_update_chunk(&ctx, st->st_ni); /* include Ni_b in the hash */
- hmac_update(&ctx, start, roof - start);
- hmac_final(dest, &ctx);
-
- DBG(DBG_CRYPT, {
- DBG_log("HASH(%d) computed:", hash2 + 1);
- DBG_dump("", dest, ctx.hmac_digest_len);
- });
- return ctx.hmac_digest_len;
-
-# undef hmac_update
-}
-
-/* Compute HASH(3) in Quick Mode (part of Quick I2 message).
- * Used by: quick_inR1_outI2, quick_inI2
- * See RFC2409 "The Internet Key Exchange (IKE)" 5.5.
- * NOTE: this hash (unlike HASH(1) and HASH(2)) ONLY covers the
- * Message ID and Nonces. This is a mistake.
- */
-static size_t quick_mode_hash3(u_char *dest, struct state *st)
-{
- struct hmac_ctx ctx;
-
- hmac_init(&ctx, st->st_oakley.ta_prf, st->st_skeyid_a_nss);
- hmac_update(&ctx, (const u_char *)"\0", 1);
- passert(sizeof(msgid_t) == sizeof(uint32_t));
- msgid_t raw_msgid = htonl(st->st_msgid);
- hmac_update(&ctx, (const void*)&raw_msgid, sizeof(raw_msgid));
- hmac_update_chunk(&ctx, st->st_ni);
- hmac_update_chunk(&ctx, st->st_nr);
- hmac_final(dest, &ctx);
- if (DBGP(DBG_CRYPT)) {
- DBG_dump("HASH(3) computed:", dest,
- ctx.hmac_digest_len);
- }
- return ctx.hmac_digest_len;
-}
-
/* Compute Phase 2 IV.
* Uses Phase 1 IV from st_iv; puts result in st_new_iv.
*/
@@ -879,9 +817,6 @@
struct state *isakmp_sa = state_with_serialno(st->st_clonedfrom);
struct connection *c = st->st_connection;
pb_stream rbody;
- u_char /* set by START_HASH_PAYLOAD: */
- *r_hashval, /* where in reply to jam hash value */
- *r_hash_start; /* start of what is to be hashed */
bool has_client = c->spd.this.has_client || c->spd.that.has_client ||
c->spd.this.protocol != 0 || c->spd.that.protocol != 0 ||
c->spd.this.port != 0 || c->spd.that.port != 0;
@@ -915,7 +850,6 @@
struct isakmp_hdr hdr = {
.isa_version = ISAKMP_MAJOR_VERSION << ISA_MAJ_SHIFT |
ISAKMP_MINOR_VERSION,
- .isa_np = ISAKMP_NEXT_HASH,
.isa_xchg = ISAKMP_XCHG_QUICK,
.isa_msgid = st->st_msgid,
.isa_flags = ISAKMP_FLAGS_v1_ENCRYPTION,
@@ -930,7 +864,11 @@
}
/* HASH(1) -- create and note space to be filled later */
- START_HASH_PAYLOAD(rbody, ISAKMP_NEXT_SA);
+ struct v1_hash_fixup hash_fixup;
+ if (!emit_v1_HASH(V1_HASH_1, "outI1", QUICK_EXCHANGE,
+ st, &hash_fixup, &rbody)) {
+ return STF_INTERNAL_ERROR;
+ }
/* SA out */
@@ -1010,8 +948,7 @@
}
/* finish computing HASH(1), inserting it in output */
- (void) quick_mode_hash12(r_hashval, r_hash_start, rbody.cur,
- st, &st->st_msgid, FALSE);
+ fixup_v1_HASH(st, &hash_fixup, st->st_msgid, rbody.cur);
/* encrypt message, except for fixed part of header */
@@ -1098,13 +1035,6 @@
struct payload_digest *const id_pd = md->chain[ISAKMP_NEXT_ID];
struct verify_oppo_bundle b;
- /* HASH(1) in */
- CHECK_QUICK_HASH(md,
- quick_mode_hash12(hash_val, hash_pbs->roof,
- md->message_pbs.roof,
- p1st, &md->hdr.isa_msgid, FALSE),
- "HASH(1)", "Quick I1");
-
/* [ IDci, IDcr ] in
* We do this now (probably out of physical order) because
* we wish to select the correct connection before we consult
@@ -1577,9 +1507,6 @@
struct state *st = md->st;
struct payload_digest *const id_pd = md->chain[ISAKMP_NEXT_ID];
struct payload_digest *const sapd = md->chain[ISAKMP_NEXT_SA];
- u_char /* set by START_HASH_PAYLOAD: */
- *r_hashval, /* where in reply to jam hash value */
- *r_hash_start; /* from where to start hashing */
/* Start the output packet.
*
@@ -1594,12 +1521,15 @@
/* HDR* out */
pb_stream rbody;
- ikev1_init_out_pbs_echo_hdr(md, TRUE, ISAKMP_NEXT_HASH,
+ ikev1_init_out_pbs_echo_hdr(md, TRUE, 0,
&reply_stream, reply_buffer, sizeof(reply_buffer),
&rbody);
- /* HASH(2) out -- first pass */
- START_HASH_PAYLOAD(rbody, ISAKMP_NEXT_SA);
+ struct v1_hash_fixup hash_fixup;
+ if (!emit_v1_HASH(V1_HASH_2, "quick inR1 outI2",
+ QUICK_EXCHANGE, st, &hash_fixup, &rbody)) {
+ return STF_INTERNAL_ERROR;
+ }
passert(st->st_connection != NULL);
@@ -1720,8 +1650,7 @@
}
/* Compute reply HASH(2) and insert in output */
- (void)quick_mode_hash12(r_hashval, r_hash_start, rbody.cur,
- st, &st->st_msgid, TRUE);
+ fixup_v1_HASH(st, &hash_fixup, st->st_msgid, rbody.cur);
/* Derive new keying material */
compute_keymats(st);
@@ -1758,13 +1687,6 @@
stf_status quick_inR1_outI2(struct state *st, struct msg_digest *md)
{
- /* HASH(2) in */
- CHECK_QUICK_HASH(md,
- quick_mode_hash12(hash_val, hash_pbs->roof,
- md->message_pbs.roof,
- st, &st->st_msgid, TRUE),
- "HASH(2)", "Quick R1");
-
/* SA in */
{
struct payload_digest *const sa_pd = md->chain[ISAKMP_NEXT_SA];
@@ -1812,7 +1734,7 @@
struct connection *c = st->st_connection;
pb_stream rbody;
- ikev1_init_out_pbs_echo_hdr(md, TRUE, ISAKMP_NEXT_HASH,
+ ikev1_init_out_pbs_echo_hdr(md, TRUE, 0,
&reply_stream, reply_buffer, sizeof(reply_buffer),
&rbody);
@@ -1907,7 +1829,7 @@
/* HASH(3) out -- sometimes, we add more content */
{
- u_char *r_hashval; /* set by START_HASH_PAYLOAD */
+ struct v1_hash_fixup hash_fixup;
#ifdef IMPAIR_UNALIGNED_I2_MSG
{
@@ -1945,12 +1867,13 @@
}
}
#else
- START_HASH_PAYLOAD_NO_R_HASH_START(rbody,
- ISAKMP_NEXT_NONE);
+ if (!emit_v1_HASH(V1_HASH_3, "quick_inR1_outI2",
+ QUICK_EXCHANGE, st, &hash_fixup, &rbody)) {
+ return STF_INTERNAL_ERROR;
+ }
#endif
-
- (void)quick_mode_hash3(r_hashval, st);
+ fixup_v1_HASH(st, &hash_fixup, st->st_msgid, NULL);
}
/* Derive new keying material */
@@ -1986,12 +1909,8 @@
* (see RFC 2409 "IKE" 5.5)
* Installs outbound IPsec SAs, routing, etc.
*/
-stf_status quick_inI2(struct state *st, struct msg_digest *md)
+stf_status quick_inI2(struct state *st, struct msg_digest *md UNUSED)
{
- /* HASH(3) in */
- CHECK_QUICK_HASH(md, quick_mode_hash3(hash_val, st),
- "HASH(3)", "Quick I2");
-
/* Tell the kernel to establish the outbound and routing part of the new SA
* (the previous state established inbound)
* (unless the commit bit is set -- which we don't support).
diff -Naur libreswan-3.29-orig/programs/pluto/ikev1_xauth.c libreswan-3.29/programs/pluto/ikev1_xauth.c
--- libreswan-3.29-orig/programs/pluto/ikev1_xauth.c 2019-06-10 10:22:04.000000000 -0400
+++ libreswan-3.29/programs/pluto/ikev1_xauth.c 2019-06-11 19:28:00.688844889 -0400
@@ -78,6 +78,8 @@
#include "send.h" /* for send without recording */
#include "ikev1_send.h"
#include "af_info.h"
+#include "ikev1_hash.h"
+#include "impair.h"
/* forward declarations */
static stf_status xauth_client_ackstatus(struct state *st,
@@ -198,25 +200,19 @@
* @param st State structure
* @return size_t Length of the HASH
*/
-static size_t xauth_mode_cfg_hash(u_char *dest,
- const u_char *start,
- const u_char *roof,
- const struct state *st)
-{
- struct hmac_ctx ctx;
-
- hmac_init(&ctx, st->st_oakley.ta_prf, st->st_skeyid_a_nss);
- passert(sizeof(msgid_t) == sizeof(uint32_t));
- msgid_t raw_msgid = htonl(st->st_msgid_phase15);
- hmac_update(&ctx, (const void *)&raw_msgid, sizeof(raw_msgid));
- hmac_update(&ctx, start, roof - start);
- hmac_final(dest, &ctx);
-
- DBG(DBG_CRYPT|DBG_XAUTH, {
- DBG_log("XAUTH: HASH computed:");
- DBG_dump("", dest, ctx.hmac_digest_len);
- });
- return ctx.hmac_digest_len;
+
+static bool emit_xauth_hash(const char *what, struct state *st,
+ struct v1_hash_fixup *hash_fixup, pb_stream *out)
+{
+ return emit_v1_HASH(V1_HASH_1, what, XAUTH_EXCHANGE,
+ st, hash_fixup, out);
+}
+
+static void fixup_xauth_hash(struct state *st,
+ struct v1_hash_fixup *hash_fixup,
+ const uint8_t *roof)
+{
+ fixup_v1_HASH(st, hash_fixup, st->st_msgid_phase15, roof);
}
/**
@@ -383,23 +379,10 @@
bool use_modecfg_addr_as_client_addr,
uint16_t ap_id)
{
- unsigned char *r_hash_start, *r_hashval;
-
- /* START_HASH_PAYLOAD(rbody, ISAKMP_NEXT_MCFG_ATTR); */
-
- {
- pb_stream hash_pbs;
-
- if (!ikev1_out_generic(ISAKMP_NEXT_MCFG_ATTR, &isakmp_hash_desc, rbody, &hash_pbs))
- return STF_INTERNAL_ERROR;
-
- r_hashval = hash_pbs.cur; /* remember where to plant value */
- if (!out_zero(st->st_oakley.ta_prf->prf_output_size,
- &hash_pbs, "HASH"))
- return STF_INTERNAL_ERROR;
-
- close_output_pbs(&hash_pbs);
- r_hash_start = rbody->cur; /* hash from after HASH payload */
+ struct v1_hash_fixup hash_fixup;
+ if (!emit_xauth_hash("XAUTH: mode config response",
+ st, &hash_fixup, rbody)) {
+ return STF_INTERNAL_ERROR;
}
/* ATTR out */
@@ -497,7 +480,7 @@
return STF_INTERNAL_ERROR;
}
- xauth_mode_cfg_hash(r_hashval, r_hash_start, rbody->cur, st);
+ fixup_xauth_hash(st, &hash_fixup, rbody->cur);
if (!ikev1_close_message(rbody, st) ||
!ikev1_encrypt_message(rbody, st))
@@ -523,7 +506,6 @@
/* HDR out */
{
struct isakmp_hdr hdr = {
- .isa_np = ISAKMP_NEXT_HASH,
.isa_version = ISAKMP_MAJOR_VERSION << ISA_MAJ_SHIFT |
ISAKMP_MINOR_VERSION,
.isa_xchg = ISAKMP_XCHG_MODE_CFG,
@@ -604,7 +586,6 @@
pb_stream reply;
pb_stream rbody;
unsigned char buf[256];
- u_char *r_hash_start, *r_hashval;
const enum state_kind p_state = st->st_state;
/* set up reply */
@@ -620,7 +601,6 @@
/* HDR out */
{
struct isakmp_hdr hdr = {
- .isa_np = ISAKMP_NEXT_HASH,
.isa_version = ISAKMP_MAJOR_VERSION << ISA_MAJ_SHIFT |
ISAKMP_MINOR_VERSION,
.isa_xchg = ISAKMP_XCHG_MODE_CFG,
@@ -638,7 +618,11 @@
return STF_INTERNAL_ERROR;
}
- START_HASH_PAYLOAD(rbody, ISAKMP_NEXT_MCFG_ATTR);
+ struct v1_hash_fixup hash_fixup;
+ if (!emit_xauth_hash("XAUTH: send request",
+ st, &hash_fixup, &rbody)) {
+ return STF_INTERNAL_ERROR;
+ }
/* ATTR out */
{
@@ -668,7 +652,7 @@
return STF_INTERNAL_ERROR;
}
- xauth_mode_cfg_hash(r_hashval, r_hash_start, rbody.cur, st);
+ fixup_xauth_hash(st, &hash_fixup, rbody.cur);
if (!ikev1_close_message(&rbody, st))
return STF_INTERNAL_ERROR;
@@ -719,7 +703,6 @@
pb_stream reply;
pb_stream rbody;
unsigned char buf[256];
- u_char *r_hash_start, *r_hashval;
/* set up reply */
init_out_pbs(&reply, buf, sizeof(buf), "xauth_buf");
@@ -733,7 +716,6 @@
/* HDR out */
{
struct isakmp_hdr hdr = {
- .isa_np = ISAKMP_NEXT_HASH,
.isa_version = ISAKMP_MAJOR_VERSION << ISA_MAJ_SHIFT |
ISAKMP_MINOR_VERSION,
.isa_xchg = ISAKMP_XCHG_MODE_CFG,
@@ -752,7 +734,11 @@
return STF_INTERNAL_ERROR;
}
- START_HASH_PAYLOAD(rbody, ISAKMP_NEXT_MCFG_ATTR);
+ struct v1_hash_fixup hash_fixup;
+ if (!emit_xauth_hash("XAUTH: mode config request",
+ st, &hash_fixup, &rbody)) {
+ return STF_INTERNAL_ERROR;
+ }
/* ATTR out */
{
@@ -785,7 +771,7 @@
return STF_INTERNAL_ERROR;
}
- xauth_mode_cfg_hash(r_hashval, r_hash_start, rbody.cur, st);
+ fixup_xauth_hash(st, &hash_fixup, rbody.cur);
if (!ikev1_close_message(&rbody, st))
return STF_INTERNAL_ERROR;
@@ -821,7 +807,6 @@
pb_stream reply;
pb_stream rbody;
unsigned char buf[256];
- u_char *r_hash_start, *r_hashval;
/* set up reply */
init_out_pbs(&reply, buf, sizeof(buf), "xauth_buf");
@@ -832,7 +817,6 @@
/* HDR out */
{
struct isakmp_hdr hdr = {
- .isa_np = ISAKMP_NEXT_HASH,
.isa_version = ISAKMP_MAJOR_VERSION << ISA_MAJ_SHIFT |
ISAKMP_MINOR_VERSION,
.isa_xchg = ISAKMP_XCHG_MODE_CFG,
@@ -850,7 +834,10 @@
return STF_INTERNAL_ERROR;
}
- START_HASH_PAYLOAD(rbody, ISAKMP_NEXT_MCFG_ATTR);
+ struct v1_hash_fixup hash_fixup;
+ if (!emit_xauth_hash("XAUTH: status", st, &hash_fixup, &rbody)) {
+ return STF_INTERNAL_ERROR;
+ }
/* ATTR out */
{
@@ -873,7 +860,7 @@
return STF_INTERNAL_ERROR;
}
- xauth_mode_cfg_hash(r_hashval, r_hash_start, rbody.cur, st);
+ fixup_xauth_hash(st, &hash_fixup, rbody.cur);
if (!ikev1_close_message(&rbody, st))
return STF_INTERNAL_ERROR;
@@ -1280,12 +1267,6 @@
bool gotname = FALSE,
gotpassword = FALSE;
- CHECK_QUICK_HASH(md,
- xauth_mode_cfg_hash(hash_val, hash_pbs->roof,
- md->message_pbs.roof,
- st),
- "XAUTH-HASH", "XAUTH R0");
-
setchunk(name, unknown, sizeof(unknown) - 1); /* to make diagnostics easier */
/* XXX This needs checking with the proper RFC's - ISAKMP_CFG_ACK got added for Cisco interop */
@@ -1469,11 +1450,6 @@
DBG(DBG_CONTROLMORE, DBG_log("arrived in modecfg_inR0"));
st->st_msgid_phase15 = md->hdr.isa_msgid;
- CHECK_QUICK_HASH(md,
- xauth_mode_cfg_hash(hash_val,
- hash_pbs->roof,
- md->message_pbs.roof, st),
- "MODECFG-HASH", "MODE R0");
switch (ma->isama_type) {
default:
@@ -1559,12 +1535,6 @@
DBG(DBG_CONTROL, DBG_log("modecfg_inI2"));
st->st_msgid_phase15 = md->hdr.isa_msgid;
- CHECK_QUICK_HASH(md,
- xauth_mode_cfg_hash(hash_val,
- hash_pbs->roof,
- md->message_pbs.roof,
- st),
- "MODECFG-HASH", "MODE R1");
/* CHECK that SET has been received. */
@@ -1690,11 +1660,6 @@
DBG(DBG_CONTROL, DBG_log("modecfg_inR1: received mode cfg reply"));
st->st_msgid_phase15 = md->hdr.isa_msgid;
- CHECK_QUICK_HASH(md,
- xauth_mode_cfg_hash(hash_val, hash_pbs->roof,
- md->message_pbs.roof,
- st),
- "MODECFG-HASH", "MODE R1");
switch (ma->isama_type) {
default:
@@ -1978,26 +1943,12 @@
pb_stream *rbody,
uint16_t ap_id)
{
- unsigned char *r_hash_start, *r_hashval;
char xauth_username[MAX_XAUTH_USERNAME_LEN];
struct connection *c = st->st_connection;
- /* START_HASH_PAYLOAD(rbody, ISAKMP_NEXT_MCFG_ATTR); */
-
- {
- pb_stream hash_pbs;
- int np = ISAKMP_NEXT_MCFG_ATTR;
-
- if (!ikev1_out_generic(np, &isakmp_hash_desc, rbody, &hash_pbs))
- return STF_INTERNAL_ERROR;
-
- r_hashval = hash_pbs.cur; /* remember where to plant value */
- if (!out_zero(st->st_oakley.ta_prf->prf_output_size,
- &hash_pbs, "HASH"))
- return STF_INTERNAL_ERROR;
-
- close_output_pbs(&hash_pbs);
- r_hash_start = (rbody)->cur; /* hash from after HASH payload */
+ struct v1_hash_fixup hash_fixup;
+ if (!emit_xauth_hash("XAUTH: client response", st, &hash_fixup, rbody)) {
+ return STF_INTERNAL_ERROR;
}
/* MCFG_ATTR out */
@@ -2201,7 +2152,7 @@
libreswan_log("XAUTH: Answering XAUTH challenge with user='%s'",
st->st_xauth_username);
- xauth_mode_cfg_hash(r_hashval, r_hash_start, rbody->cur, st);
+ fixup_xauth_hash(st, &hash_fixup, rbody->cur);
if (!ikev1_close_message(rbody, st) ||
!ikev1_encrypt_message(rbody, st))
@@ -2252,10 +2203,6 @@
}
st->st_msgid_phase15 = md->hdr.isa_msgid;
- CHECK_QUICK_HASH(md, xauth_mode_cfg_hash(hash_val,
- hash_pbs->roof,
- md->message_pbs.roof, st),
- "MODECFG-HASH", "XAUTH I0");
switch (ma->isama_type) {
default:
@@ -2446,24 +2393,9 @@
pb_stream *rbody,
uint16_t ap_id)
{
- unsigned char *r_hash_start, *r_hashval;
-
- /* START_HASH_PAYLOAD(rbody, ISAKMP_NEXT_MCFG_ATTR); */
-
- {
- pb_stream hash_pbs;
- int np = ISAKMP_NEXT_MCFG_ATTR;
-
- if (!ikev1_out_generic(np, &isakmp_hash_desc, rbody, &hash_pbs))
- return STF_INTERNAL_ERROR;
-
- r_hashval = hash_pbs.cur; /* remember where to plant value */
- if (!out_zero(st->st_oakley.ta_prf->prf_output_size,
- &hash_pbs, "HASH"))
- return STF_INTERNAL_ERROR;
-
- close_output_pbs(&hash_pbs);
- r_hash_start = (rbody)->cur; /* hash from after HASH payload */
+ struct v1_hash_fixup hash_fixup;
+ if (!emit_xauth_hash("XAUTH: ack status", st, &hash_fixup, rbody)) {
+ return STF_INTERNAL_ERROR;
}
/* ATTR out */
@@ -2486,7 +2418,7 @@
return STF_INTERNAL_ERROR;
}
- xauth_mode_cfg_hash(r_hashval, r_hash_start, rbody->cur, st);
+ fixup_xauth_hash(st, &hash_fixup, rbody->cur);
if (!ikev1_close_message(rbody, st) ||
!ikev1_encrypt_message(rbody, st))
@@ -2525,11 +2457,6 @@
DBG(DBG_CONTROLMORE, DBG_log("Continuing with xauth_inI1"));
st->st_msgid_phase15 = md->hdr.isa_msgid;
- CHECK_QUICK_HASH(md,
- xauth_mode_cfg_hash(hash_val,
- hash_pbs->roof,
- md->message_pbs.roof, st),
- "MODECFG-HASH", "XAUTH I1");
switch (ma->isama_type) {
default:
diff -Naur libreswan-3.29-orig/programs/pluto/ipsec_doi.h libreswan-3.29/programs/pluto/ipsec_doi.h
--- libreswan-3.29-orig/programs/pluto/ipsec_doi.h 2019-06-10 10:22:04.000000000 -0400
+++ libreswan-3.29/programs/pluto/ipsec_doi.h 2019-06-11 19:28:00.688844889 -0400
@@ -65,67 +65,6 @@
const struct oakley_group_desc *gr,
struct payload_digest *ke_pd);
-/* START_HASH_PAYLOAD_NO_HASH_START
- *
- * Emit a to-be-filled-in hash payload, noting the field start (r_hashval)
- * and the start of the part of the message to be hashed (r_hash_start).
- * This macro is magic.
- * - it can cause the caller to return
- * - it references variables local to the caller (r_hashval, st)
- */
-#define START_HASH_PAYLOAD_NO_R_HASH_START(rbody, np) { \
- pb_stream hash_pbs; \
- if (!ikev1_out_generic(np, &isakmp_hash_desc, &(rbody), &hash_pbs)) \
- return STF_INTERNAL_ERROR; \
- r_hashval = hash_pbs.cur; /* remember where to plant value */ \
- if (!out_zero(st->st_oakley.ta_prf->prf_output_size, \
- &hash_pbs, "HASH")) \
- return STF_INTERNAL_ERROR; \
- close_output_pbs(&hash_pbs); \
-}
-
-/* START_HASH_PAYLOAD
- *
- * Emit a to-be-filled-in hash payload, noting the field start (r_hashval)
- * and the start of the part of the message to be hashed (r_hash_start).
- * This macro is magic.
- * - it can cause the caller to return
- * - it references variables local to the caller (r_hashval, r_hash_start, st)
- */
-#define START_HASH_PAYLOAD(rbody, np) { \
- START_HASH_PAYLOAD_NO_R_HASH_START(rbody, np); \
- r_hash_start = (rbody).cur; /* hash from after HASH payload */ \
-}
-
-/* CHECK_QUICK_HASH
- *
- * This macro is magic -- it cannot be expressed as a function.
- * - it causes the caller to return!
- * - it declares local variables and expects the "do_hash" argument
- * expression to reference them (hash_val, hash_pbs)
- */
-#define CHECK_QUICK_HASH(md, do_hash, hash_name, msg_name) { \
- pb_stream *const hash_pbs = &(md)->chain[ISAKMP_NEXT_HASH]->pbs; \
- u_char hash_val[MAX_DIGEST_LEN]; \
- size_t hash_len = (do_hash); \
- if (pbs_left(hash_pbs) != hash_len || \
- !memeq(hash_pbs->cur, hash_val, hash_len)) { \
- if (DBGP(DBG_CRYPT)) { \
- DBG_dump("received " hash_name ":", \
- hash_pbs->cur, pbs_left(hash_pbs)); \
- } \
- loglog(RC_LOG_SERIOUS, \
- "received " hash_name " does not match computed value in " msg_name); \
- /* XXX Could send notification back */ \
- return STF_FAIL + INVALID_HASH_INFORMATION; \
- } \
- }
-
-size_t quick_mode_hash12(u_char *dest, const u_char *start,
- const u_char *roof,
- const struct state *st, const msgid_t *msgid,
- bool hash2);
-
extern stf_status send_isakmp_notification(struct state *st,
uint16_t type, const void *data,
size_t len);
diff -Naur libreswan-3.29-orig/programs/pluto/Makefile libreswan-3.29/programs/pluto/Makefile
--- libreswan-3.29-orig/programs/pluto/Makefile 2019-06-10 10:22:04.000000000 -0400
+++ libreswan-3.29/programs/pluto/Makefile 2019-06-11 19:23:19.841729230 -0400
@@ -215,6 +215,7 @@
OBJS += ikev2_ipseckey.o
endif
OBJS += ikev1.o ikev1_main.o ikev1_quick.o ikev1_dpd.o ikev1_spdb_struct.o ikev1_msgid.o
+OBJS += ikev1_hash.o
OBJS += ikev2.o ikev2_parent.o ikev2_child.o ikev2_spdb_struct.o
OBJS += ikev2_ecdsa.o ikev2_rsa.o ikev2_psk.o ikev2_ppk.o ikev2_crypto.o
OBJS += ikev2_redirect.o