1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
/**
* @file fips.c
*
* @brief Implementation of the libstrongswan integrity test.
*
*/
/*
* Copyright (C) 2007 Bruno Krieg, Daniel Wydler
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <stdio.h>
#include <debug.h>
#include <crypto/signers/hmac_signer.h>
#include "fips.h"
extern const u_char FIPS_rodata_start[];
extern const u_char FIPS_rodata_end[];
extern const void *FIPS_text_start();
extern const void *FIPS_text_end();
/**
* Described in header
*/
bool fips_compute_hmac_signature(const char *key, char *signature)
{
u_char *text_start = (u_char *)FIPS_text_start();
u_char *text_end = (u_char *)FIPS_text_end();
size_t text_len, rodata_len;
signer_t *signer;
if (text_start > text_end)
{
DBG1(" TEXT start (%p) > TEXT end (%p",
text_start, text_end);
return FALSE;
}
text_len = text_end - text_start;
DBG1(" TEXT: %p + %6d = %p",
text_start, (int)text_len, text_end);
if (FIPS_rodata_start > FIPS_rodata_end)
{
DBG1(" RODATA start (%p) > RODATA end (%p",
FIPS_rodata_start, FIPS_rodata_end);
return FALSE;
}
rodata_len = FIPS_rodata_end - FIPS_rodata_start;
DBG1(" RODATA: %p + %6d = %p",
FIPS_rodata_start, (int)rodata_len, FIPS_rodata_end);
signer = (signer_t *)hmac_signer_create(HASH_SHA1, HASH_SIZE_SHA1);
if (signer == NULL)
{
DBG1(" SHA-1 HMAC signer could not be created");
return FALSE;
}
else
{
chunk_t hmac_key = { key, strlen(key) };
chunk_t text_chunk = { text_start, text_len };
chunk_t rodata_chunk = { (u_char *)FIPS_rodata_start, rodata_len };
chunk_t signature_chunk = chunk_empty;
signer->set_key(signer, hmac_key);
signer->allocate_signature(signer, text_chunk, NULL);
signer->allocate_signature(signer, rodata_chunk, &signature_chunk);
signer->destroy(signer);
sprintf(signature, "%#B", &signature_chunk);
DBG1(" SHA-1 HMAC key: %s", key);
DBG1(" SHA-1 HMAC sig: %s", signature);
free(signature_chunk.ptr);
return TRUE;
}
}
/**
* Described in header
*/
bool fips_verify_hmac_signature(const char *key,
const char *signature)
{
char current_signature[BUF_LEN];
if (!fips_compute_hmac_signature(key, current_signature))
{
return FALSE;
}
return streq(signature, current_signature);
}
|
