free hmac_signature string after use
[strongswan.git] / src / libstrongswan / fips / fips.c
1 /**
2 * @file fips.c
3 *
4 * @brief Implementation of the libstrongswan integrity test.
5 *
6 */
7
8 /*
9 * Copyright (C) 2007 Bruno Krieg, Daniel Wydler
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "fips.h"
24 #include <debug.h>
25 #include <crypto/signers/hmac_signer.h>
26
27 extern const unsigned char FIPS_rodata_start[];
28 extern const unsigned char FIPS_rodata_end[];
29 extern const void *FIPS_text_start();
30 extern const void *FIPS_text_end();
31
32 /**
33 * Described in header
34 */
35 char* fips_compute_hmac_signature(const char *key)
36 {
37 chunk_t hmac_key = { key, strlen(key) };
38
39 hmac_signer_t *signer = hmac_signer_create(HASH_SHA1, HASH_SIZE_SHA1);
40
41 DBG1(" TEXT: %p + %6d = %p",
42 FIPS_text_start(),
43 (int)( (size_t)FIPS_text_end() - (size_t)FIPS_text_start() ),
44 FIPS_text_end());
45 DBG1(" RODATA: %p + %6d = %p",
46 FIPS_rodata_start,
47 (int)( (size_t)FIPS_rodata_end - (size_t)FIPS_rodata_start ),
48 FIPS_rodata_end);
49
50 if (signer == NULL)
51 {
52 DBG1(" fips hmac signer could not be created");
53 return NULL;
54 }
55 signer->signer_interface.set_key((signer_t *)signer, hmac_key);
56 signer->signer_interface.destroy((signer_t *)signer);
57 return strdup("01020304050607080901011121314151617181920");
58 }
59
60 /**
61 * Described in header
62 */
63 status_t fips_verify_hmac_signature(const char *signature,
64 const char *key)
65 {
66 status_t status;
67 char *current_signature = fips_compute_hmac_signature(key);
68
69 if (current_signature == NULL)
70 {
71 status = FAILED;
72 }
73 else
74 {
75 status = streq(signature, current_signature)? SUCCESS:VERIFY_ERROR;
76 free(current_signature);
77 }
78 return status;
79 }