DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

Test suite: Fixes hmac verification for tests with multiple hmac keys

Browse Source
This commit is contained in:
Jonathan Bennett
2016-05-19 14:04:24 -05:00
parent 2c6396df5c
commit 5b2c29e46c
1 changed files with 38 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/test-fwknop.pl
+38 -7
View File
@@ -2787,6 +2787,7 @@ sub _client_send_spa_packet() {
my $key = '';
my $hmac_key = '';
my $num_hmac_keys = 0;
my $b64_decode_key = 0;
if ($test_hr->{'key_file'}) {
open K, "< $test_hr->{'key_file'}" or die $!;
@@ -2799,8 +2800,10 @@ sub _client_send_spa_packet() {
} elsif (/^HMAC_KEY_BASE64\:?\s+(\S+)/) {
$hmac_key = $1;
$b64_decode_key = 1;
$num_hmac_keys++;
} elsif (/^HMAC_KEY\:?\s+(\S+)/) {
$hmac_key = $1;
$num_hmac_keys++;
}
}
close K;
@@ -2817,10 +2820,36 @@ sub _client_send_spa_packet() {
my $enc_mode = $ENC_RIJNDAEL;
$enc_mode = $ENC_GPG if $test_hr->{'msg'} =~ /gpg/i
or $test_hr->{'msg'} =~ /gnupg/i;
unless (&openssl_hmac_verification($encrypted_msg,
$encoded_msg, '', $hmac_key, $b64_decode_key,
$hmac_digest, $hmac_mode, $enc_mode)) {
$rv = 0;
if ($num_hmac_keys == 1) {
unless (&openssl_hmac_verification($encrypted_msg,
$encoded_msg, '', $hmac_key, $b64_decode_key,
$hmac_digest, $hmac_mode, $enc_mode, 0)) {
$rv = 0;
}
} else { #Try for each of the keys
my $found_success = 0;
open K, "< $test_hr->{'key_file'}" or die $!;
while (<K>) {
if (/^HMAC_KEY_BASE64\:?\s+(\S+)/) {
$hmac_key = $1;
$b64_decode_key = 1;
if (&openssl_hmac_verification($encrypted_msg,
$encoded_msg, '', $hmac_key, $b64_decode_key,
$hmac_digest, $hmac_mode, $enc_mode, 1)) {
$found_success = 1;
}
} elsif (/^HMAC_KEY\:?\s+(\S+)/) {
$hmac_key = $1;
if (&openssl_hmac_verification($encrypted_msg,
$encoded_msg, '', $hmac_key, $b64_decode_key,
$hmac_digest, $hmac_mode, $enc_mode, 1)) {
$found_success = 1;
}
}
}
close K;
if (!$found_success) {
$rv = 0;
}
}
}
@@ -4323,7 +4352,7 @@ sub perl_fko_module_complete_cycle_hmac() {
if ($enable_openssl_compatibility_tests) {
unless (&openssl_hmac_verification($encrypted_msg,
'', $msg, $hmac_key, 0, $hmac_digest,
&hmac_type_to_str($hmac_type), $ENC_RIJNDAEL)) {
&hmac_type_to_str($hmac_type), $ENC_RIJNDAEL, 0)) {
$rv = 0;
}
@@ -6489,7 +6518,7 @@ sub immediate_binding() {
sub openssl_hmac_verification() {
my ($encrypted_msg, $encoded_msg, $access_msg, $tmp_key,
$b64_decode_key, $hmac_digest, $hmac_mode, $enc_mode) = @_;
$b64_decode_key, $hmac_digest, $hmac_mode, $enc_mode, $tolerate_failure) = @_;
my $hmac_key = '';
my $enc_msg_without_hmac = '';
@@ -6597,7 +6626,9 @@ sub openssl_hmac_verification() {
&write_test_file("[-] OpenSSL HMAC mismatch " .
"(openssl): '$openssl_hmac' != (fwknop): '$hmac_digest'\n",
$curr_test_file);
$openssl_hmac_failure_ctr++;
unless ($tolerate_failure){
$openssl_hmac_failure_ctr++;
}
return 0;
}