fixed 64 bit issue (size_t is 32 bit)
[strongswan.git] / src / libstrongswan / fips / fips.c
1 /**
2 * @file fips.c
3 *
4 * @brief Implementation of the libstrongswan integrity test.
5 *
6 */
7
8 /*
9 * Copyright (C) 2007 Bruno Krieg, Daniel Wydler
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include <stdio.h>
24
25 #include <debug.h>
26 #include <crypto/signers/hmac_signer.h>
27 #include "fips.h"
28
29 extern const u_char FIPS_rodata_start[];
30 extern const u_char FIPS_rodata_end[];
31 extern const void *FIPS_text_start();
32 extern const void *FIPS_text_end();
33
34 /**
35 * Described in header
36 */
37 bool fips_compute_hmac_signature(const char *key, char *signature)
38 {
39 u_char *text_start = (u_char *)FIPS_text_start();
40 u_char *text_end = (u_char *)FIPS_text_end();
41 size_t text_len, rodata_len;
42 signer_t *signer;
43
44 if (text_start > text_end)
45 {
46 DBG1(" TEXT start (%p) > TEXT end (%p",
47 text_start, text_end);
48 return FALSE;
49 }
50 text_len = text_end - text_start;
51 DBG1(" TEXT: %p + %6d = %p",
52 text_start, (int)text_len, text_end);
53
54 if (FIPS_rodata_start > FIPS_rodata_end)
55 {
56 DBG1(" RODATA start (%p) > RODATA end (%p",
57 FIPS_rodata_start, FIPS_rodata_end);
58 return FALSE;
59 }
60 rodata_len = FIPS_rodata_end - FIPS_rodata_start;
61 DBG1(" RODATA: %p + %6d = %p",
62 FIPS_rodata_start, (int)rodata_len, FIPS_rodata_end);
63
64 signer = (signer_t *)hmac_signer_create(HASH_SHA1, HASH_SIZE_SHA1);
65 if (signer == NULL)
66 {
67 DBG1(" SHA-1 HMAC signer could not be created");
68 return FALSE;
69 }
70 else
71 {
72 chunk_t hmac_key = { key, strlen(key) };
73 chunk_t text_chunk = { text_start, text_len };
74 chunk_t rodata_chunk = { (u_char *)FIPS_rodata_start, rodata_len };
75 chunk_t signature_chunk = chunk_empty;
76
77 signer->set_key(signer, hmac_key);
78 signer->allocate_signature(signer, text_chunk, NULL);
79 signer->allocate_signature(signer, rodata_chunk, &signature_chunk);
80 signer->destroy(signer);
81
82 sprintf(signature, "%#B", &signature_chunk);
83 DBG1(" SHA-1 HMAC key: %s", key);
84 DBG1(" SHA-1 HMAC sig: %s", signature);
85 free(signature_chunk.ptr);
86 return TRUE;
87 }
88 }
89
90 /**
91 * Described in header
92 */
93 bool fips_verify_hmac_signature(const char *key,
94 const char *signature)
95 {
96 char current_signature[BUF_LEN];
97
98 if (!fips_compute_hmac_signature(key, current_signature))
99 {
100 return FALSE;
101 }
102 return streq(signature, current_signature);
103 }