… | |
… | |
58 | }; |
58 | }; |
59 | |
59 | |
60 | crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc) |
60 | crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc) |
61 | { |
61 | { |
62 | EVP_CIPHER_CTX_init (&cctx); |
62 | EVP_CIPHER_CTX_init (&cctx); |
63 | EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc); |
63 | require (EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc)); |
64 | HMAC_CTX_init (&hctx); |
64 | HMAC_CTX_init (&hctx); |
65 | HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0); |
65 | HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0); |
66 | } |
66 | } |
67 | |
67 | |
68 | crypto_ctx::~crypto_ctx () |
68 | crypto_ctx::~crypto_ctx () |
69 | { |
69 | { |
70 | EVP_CIPHER_CTX_cleanup (&cctx); |
70 | require (EVP_CIPHER_CTX_cleanup (&cctx)); |
71 | HMAC_CTX_cleanup (&hctx); |
71 | HMAC_CTX_cleanup (&hctx); |
72 | } |
72 | } |
73 | |
73 | |
74 | static void |
74 | static void |
75 | rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h) |
75 | rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h) |
76 | { |
76 | { |
77 | EVP_MD_CTX ctx; |
77 | EVP_MD_CTX ctx; |
78 | |
78 | |
79 | EVP_MD_CTX_init (&ctx); |
79 | EVP_MD_CTX_init (&ctx); |
80 | EVP_DigestInit (&ctx, RSA_HASH); |
80 | require (EVP_DigestInit (&ctx, RSA_HASH)); |
81 | EVP_DigestUpdate(&ctx, &chg, sizeof chg); |
81 | require (EVP_DigestUpdate(&ctx, &chg, sizeof chg)); |
82 | EVP_DigestUpdate(&ctx, &id, sizeof id); |
82 | require (EVP_DigestUpdate(&ctx, &id, sizeof id)); |
83 | EVP_DigestFinal (&ctx, (unsigned char *)&h, 0); |
83 | require (EVP_DigestFinal (&ctx, (unsigned char *)&h, 0)); |
84 | EVP_MD_CTX_cleanup (&ctx); |
84 | EVP_MD_CTX_cleanup (&ctx); |
85 | } |
85 | } |
86 | |
86 | |
87 | struct rsa_entry { |
87 | struct rsa_entry { |
88 | tstamp expire; |
88 | tstamp expire; |
… | |
… | |
347 | d[0] = cl >> 8; |
347 | d[0] = cl >> 8; |
348 | d[1] = cl; |
348 | d[1] = cl; |
349 | } |
349 | } |
350 | #endif |
350 | #endif |
351 | |
351 | |
352 | EVP_EncryptInit_ex (cctx, 0, 0, 0, 0); |
352 | require (EVP_EncryptInit_ex (cctx, 0, 0, 0, 0)); |
353 | |
353 | |
354 | struct { |
354 | struct { |
355 | #if RAND_SIZE |
355 | #if RAND_SIZE |
356 | u8 rnd[RAND_SIZE]; |
356 | u8 rnd[RAND_SIZE]; |
357 | #endif |
357 | #endif |
… | |
… | |
361 | datahdr.seqno = ntohl (seqno); |
361 | datahdr.seqno = ntohl (seqno); |
362 | #if RAND_SIZE |
362 | #if RAND_SIZE |
363 | RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE); |
363 | RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE); |
364 | #endif |
364 | #endif |
365 | |
365 | |
366 | EVP_EncryptUpdate (cctx, |
366 | require (EVP_EncryptUpdate (cctx, |
367 | (unsigned char *) data + outl, &outl2, |
367 | (unsigned char *) data + outl, &outl2, |
368 | (unsigned char *) &datahdr, DATAHDR); |
368 | (unsigned char *) &datahdr, DATAHDR)); |
369 | outl += outl2; |
369 | outl += outl2; |
370 | |
370 | |
371 | EVP_EncryptUpdate (cctx, |
371 | require (EVP_EncryptUpdate (cctx, |
372 | (unsigned char *) data + outl, &outl2, |
372 | (unsigned char *) data + outl, &outl2, |
373 | (unsigned char *) d, l); |
373 | (unsigned char *) d, l)); |
374 | outl += outl2; |
374 | outl += outl2; |
375 | |
375 | |
376 | EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2); |
376 | require (EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2)); |
377 | outl += outl2; |
377 | outl += outl2; |
378 | |
378 | |
379 | len = outl + data_hdr_size (); |
379 | len = outl + data_hdr_size (); |
380 | |
380 | |
381 | set_hdr (type, dst); |
381 | set_hdr (type, dst); |
… | |
… | |
390 | int outl = 0, outl2; |
390 | int outl = 0, outl2; |
391 | tap_packet *p = new tap_packet; |
391 | tap_packet *p = new tap_packet; |
392 | u8 *d; |
392 | u8 *d; |
393 | u32 l = len - data_hdr_size (); |
393 | u32 l = len - data_hdr_size (); |
394 | |
394 | |
395 | EVP_DecryptInit_ex (cctx, 0, 0, 0, 0); |
395 | require (EVP_DecryptInit_ex (cctx, 0, 0, 0, 0)); |
396 | |
396 | |
397 | #if ENABLE_COMPRESSION |
397 | #if ENABLE_COMPRESSION |
398 | u8 cdata[MAX_MTU]; |
398 | u8 cdata[MAX_MTU]; |
399 | |
399 | |
400 | if (type == PT_DATA_COMPRESSED) |
400 | if (type == PT_DATA_COMPRESSED) |
… | |
… | |
402 | else |
402 | else |
403 | #endif |
403 | #endif |
404 | d = &(*p)[6 + 6 - DATAHDR]; |
404 | d = &(*p)[6 + 6 - DATAHDR]; |
405 | |
405 | |
406 | /* this overwrites part of the src mac, but we fix that later */ |
406 | /* this overwrites part of the src mac, but we fix that later */ |
407 | EVP_DecryptUpdate (cctx, |
407 | require (EVP_DecryptUpdate (cctx, |
408 | d, &outl2, |
408 | d, &outl2, |
409 | (unsigned char *)&data, len - data_hdr_size ()); |
409 | (unsigned char *)&data, len - data_hdr_size ())); |
410 | outl += outl2; |
410 | outl += outl2; |
411 | |
411 | |
412 | EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2); |
412 | require (EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2)); |
413 | outl += outl2; |
413 | outl += outl2; |
414 | |
414 | |
415 | seqno = ntohl (*(u32 *)(d + RAND_SIZE)); |
415 | seqno = ntohl (*(u32 *)(d + RAND_SIZE)); |
416 | |
416 | |
417 | id2mac (dst () ? dst() : THISNODE->id, p->dst); |
417 | id2mac (dst () ? dst() : THISNODE->id, p->dst); |