From ddf4fcee5812e453f784e7b453f52d242baf060c Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sat, 23 Nov 2024 10:18:03 +0900 Subject: [PATCH 1/2] secrets: allocate secret_pubkey_stuff separately from heap Signed-off-by: Daiki Ueno --- include/secrets.h | 2 +- lib/libswan/pubkey_ecdsa.c | 10 +++--- lib/libswan/pubkey_rsa.c | 18 +++++------ .../secret_pubkey_stuff_to_pubkey_der.c | 2 +- lib/libswan/secrets.c | 32 ++++++++++--------- programs/pluto/ikev2_eap.c | 2 +- programs/pluto/keys.c | 6 ++-- programs/showhostkey/showhostkey.c | 31 ++++++++++-------- 8 files changed, 54 insertions(+), 49 deletions(-) diff --git a/include/secrets.h b/include/secrets.h index 8f9f990c10..c9272d71e0 100644 --- a/include/secrets.h +++ b/include/secrets.h @@ -88,7 +88,7 @@ struct secret_stuff { int line; union { chunk_t preshared_secret; - struct secret_pubkey_stuff pubkey; + struct secret_pubkey_stuff *pubkey; } u; chunk_t ppk; diff --git a/lib/libswan/pubkey_ecdsa.c b/lib/libswan/pubkey_ecdsa.c index f8d0fe5dae..a4250d9356 100644 --- a/lib/libswan/pubkey_ecdsa.c +++ b/lib/libswan/pubkey_ecdsa.c @@ -288,7 +288,7 @@ static struct hash_signature ECDSA_raw_sign_hash(const struct secret_stuff *pks, { ldbgf(DBG_CRYPT, logger, "%s: started using NSS", __func__); - if (!pexpect(pks->u.pubkey.private_key != NULL)) { + if (!pexpect(pks->u.pubkey->private_key != NULL)) { dbg("no private key!"); return (struct hash_signature) { .len = 0, }; } @@ -304,7 +304,7 @@ static struct hash_signature ECDSA_raw_sign_hash(const struct secret_stuff *pks, /* point signature at the SIG_VAL buffer */ struct hash_signature signature = {0}; SECItem raw_signature; - SECStatus s = SGN_Digest(pks->u.pubkey.private_key, + SECStatus s = SGN_Digest(pks->u.pubkey->private_key, hash_alg->nss.oid_tag, &raw_signature, &hash_to_sign); if (s != SECSuccess) { @@ -411,7 +411,7 @@ static struct hash_signature ECDSA_digsig_sign_hash(const struct secret_stuff *p struct logger *logger) { - if (!pexpect(pks->u.pubkey.private_key != NULL)) { + if (!pexpect(pks->u.pubkey->private_key != NULL)) { dbg("no private key!"); return (struct hash_signature) { .len = 0, }; } @@ -429,14 +429,14 @@ static struct hash_signature ECDSA_digsig_sign_hash(const struct secret_stuff *p uint8_t raw_signature_data[sizeof(struct hash_signature)]; SECItem raw_signature = { .type = siBuffer, - .len = PK11_SignatureLen(pks->u.pubkey.private_key), + .len = PK11_SignatureLen(pks->u.pubkey->private_key), .data = raw_signature_data, }; passert(raw_signature.len <= sizeof(raw_signature_data)); dbg("ECDSA signature.len %d", raw_signature.len); /* create the raw signature */ - SECStatus s = PK11_Sign(pks->u.pubkey.private_key, &raw_signature, &hash_to_sign); + SECStatus s = PK11_Sign(pks->u.pubkey->private_key, &raw_signature, &hash_to_sign); if (DBGP(DBG_CRYPT)) { DBG_dump("sig_from_nss", raw_signature.data, raw_signature.len); } diff --git a/lib/libswan/pubkey_rsa.c b/lib/libswan/pubkey_rsa.c index 78620620d6..796748bdaa 100644 --- a/lib/libswan/pubkey_rsa.c +++ b/lib/libswan/pubkey_rsa.c @@ -350,7 +350,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk return (struct hash_signature) { .len = 0, }; } - if (!pexpect(pks->u.pubkey.private_key != NULL)) { + if (!pexpect(pks->u.pubkey->private_key != NULL)) { dbg("no private key!"); return (struct hash_signature) { .len = 0, }; } @@ -361,7 +361,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk .data = DISCARD_CONST(uint8_t *, hash_val), }; - struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey.private_key), }; + struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey->private_key), }; passert(sig.len <= sizeof(sig.ptr/*array*/)); SECItem signature = { .type = siBuffer, @@ -369,7 +369,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk .data = sig.ptr, }; - SECStatus s = PK11_Sign(pks->u.pubkey.private_key, &signature, &data); + SECStatus s = PK11_Sign(pks->u.pubkey->private_key, &signature, &data); if (s != SECSuccess) { /* PR_GetError() returns the thread-local error */ llog_nss_error(RC_LOG, logger, @@ -485,7 +485,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu { dbg("%s: started using NSS", __func__); - if (!pexpect(pks->u.pubkey.private_key != NULL)) { + if (!pexpect(pks->u.pubkey->private_key != NULL)) { dbg("no private key!"); return (struct hash_signature) { .len = 0, }; } @@ -501,7 +501,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu * used to generate the signature. */ SECItem signature_result = {0}; - SECStatus s = SGN_Digest(pks->u.pubkey.private_key, + SECStatus s = SGN_Digest(pks->u.pubkey->private_key, hash_algo->nss.oid_tag, &signature_result, &digest); if (s != SECSuccess) { @@ -516,7 +516,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu /* save the signature, free the returned pointer */ struct hash_signature signature = { - .len = PK11_SignatureLen(pks->u.pubkey.private_key), + .len = PK11_SignatureLen(pks->u.pubkey->private_key), }; passert(signature.len <= sizeof(signature.ptr/*array*/)); memcpy(signature.ptr, signature_result.data, signature.len); @@ -629,7 +629,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff { dbg("%s: started using NSS", __func__); - if (!pexpect(pks->u.pubkey.private_key != NULL)) { + if (!pexpect(pks->u.pubkey->private_key != NULL)) { dbg("no private key!"); return (struct hash_signature) { .len = 0, }; } @@ -640,7 +640,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff .data = DISCARD_CONST(uint8_t *, hash_val), }; - struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey.private_key), }; + struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey->private_key), }; passert(sig.len <= sizeof(sig.ptr/*array*/)); SECItem signature = { .type = siBuffer, @@ -661,7 +661,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff .data = (void*)mech, /* strip const */ .len = sizeof(*mech), }; - SECStatus s = PK11_SignWithMechanism(pks->u.pubkey.private_key, CKM_RSA_PKCS_PSS, + SECStatus s = PK11_SignWithMechanism(pks->u.pubkey->private_key, CKM_RSA_PKCS_PSS, &mech_item, &signature, &data); if (s != SECSuccess) { /* PR_GetError() returns the thread-local error */ diff --git a/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c b/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c index 1b5de6917e..3f28cbd765 100644 --- a/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c +++ b/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c @@ -32,7 +32,7 @@ static diag_t seckey_pubkey_to_der(SECKEYPublicKey *seckey_pubkey, chunk_t *der) diag_t secret_pubkey_stuff_to_pubkey_der(struct secret_stuff *pks, chunk_t *der) { - SECKEYPublicKey *seckey_pubkey = SECKEY_ConvertToPublicKey(pks->u.pubkey.private_key); + SECKEYPublicKey *seckey_pubkey = SECKEY_ConvertToPublicKey(pks->u.pubkey->private_key); if (seckey_pubkey == NULL) { return diag_nss_error("extracting Public Key from Private Key"); } diff --git a/lib/libswan/secrets.c b/lib/libswan/secrets.c index 01cf90e4f3..1088f914af 100644 --- a/lib/libswan/secrets.c +++ b/lib/libswan/secrets.c @@ -186,7 +186,7 @@ const ckaid_t *secret_ckaid(const struct secret *secret) case SECRET_RSA: case SECRET_ECDSA: /* some sort of PKI */ - return &secret->stuff.u.pubkey.content.ckaid; + return &secret->stuff.u.pubkey->content.ckaid; default: return NULL; } @@ -198,7 +198,7 @@ const keyid_t *secret_keyid(const struct secret *secret) case SECRET_RSA: case SECRET_ECDSA: /* some sort of PKI */ - return &secret->stuff.u.pubkey.content.keyid; + return &secret->stuff.u.pubkey->content.keyid; default: return NULL; } @@ -241,12 +241,12 @@ static struct secret *find_secret_by_pubkey_ckaid_1(struct secret *secrets, dbg(" not PKI"); continue; } - if (type != NULL && pks->u.pubkey.content.type != type) { + if (type != NULL && pks->u.pubkey->content.type != type) { /* need exact or wildcard */ dbg(" not %s", type->name); continue; } - if (!ckaid_eq_nss(&pks->u.pubkey.content.ckaid, pubkey_ckaid)) { + if (!ckaid_eq_nss(&pks->u.pubkey->content.ckaid, pubkey_ckaid)) { dbg(" wrong ckaid"); continue; } @@ -276,12 +276,12 @@ bool secret_pubkey_same(struct secret *lhs, struct secret *rhs) return false; } - if (lhs->stuff.u.pubkey.content.type != rhs->stuff.u.pubkey.content.type) { + if (lhs->stuff.u.pubkey->content.type != rhs->stuff.u.pubkey->content.type) { return false; } - return lhs->stuff.u.pubkey.content.type->pubkey_same(&lhs->stuff.u.pubkey.content, - &rhs->stuff.u.pubkey.content); + return lhs->stuff.u.pubkey->content.type->pubkey_same(&lhs->stuff.u.pubkey->content, + &rhs->stuff.u.pubkey->content); } struct secret *lsw_find_secret_by_id(struct secret *secrets, @@ -954,8 +954,9 @@ void lsw_free_preshared_secrets(struct secret **psecrets, struct logger *logger) case SECRET_RSA: case SECRET_ECDSA: /* Note: pub is all there is */ - SECKEY_DestroyPrivateKey(s->stuff.u.pubkey.private_key); - s->stuff.u.pubkey.content.type->free_pubkey_content(&s->stuff.u.pubkey.content); + SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key); + s->stuff.u.pubkey->content.type->free_pubkey_content(&s->stuff.u.pubkey->content); + pfree(s->stuff.u.pubkey); break; default: bad_case(s->stuff.kind); @@ -1180,19 +1181,20 @@ static err_t add_private_key(struct secret **secrets, const struct secret_stuff s->stuff.kind = type->private_key_kind; s->stuff.line = 0; /* make an unpacked copy of the private key */ - s->stuff.u.pubkey.private_key = copy_private_key(private_key); - err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey.content, + s->stuff.u.pubkey = alloc_thing(struct secret_pubkey_stuff, "secret_pubkey_stuff"); + s->stuff.u.pubkey->private_key = copy_private_key(private_key); + err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey->content, pubk, ckaid_nss); if (err != NULL) { /* extract should leave pubkey_content clean */ - SECKEY_DestroyPrivateKey(s->stuff.u.pubkey.private_key); /* allocated above */ + SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key); /* allocated above */ pfree(s); return err; } - passert(s->stuff.u.pubkey.content.type == type); - pexpect(s->stuff.u.pubkey.content.ckaid.len > 0); - pexpect(s->stuff.u.pubkey.content.keyid.keyid[0] != '\0'); + passert(s->stuff.u.pubkey->content.type == type); + pexpect(s->stuff.u.pubkey->content.ckaid.len > 0); + pexpect(s->stuff.u.pubkey->content.keyid.keyid[0] != '\0'); add_secret(secrets, s, "lsw_add_rsa_secret"); *pks = &s->stuff; diff --git a/programs/pluto/ikev2_eap.c b/programs/pluto/ikev2_eap.c index c43bd59b6d..118c4c484e 100644 --- a/programs/pluto/ikev2_eap.c +++ b/programs/pluto/ikev2_eap.c @@ -282,7 +282,7 @@ static bool start_eap(struct ike_sa *ike, struct pbs_out *pbs) SSL_OptionSet(pr, SSL_ENABLE_SSL3, PR_FALSE) != SECSuccess || SSL_BadCertHook(pr, eaptls_bad_cert_cb, eap) != SECSuccess || SSL_HandshakeCallback(pr, eaptls_handshake_cb, eap) != SECSuccess || - SSL_ConfigServerCert(pr, mycert->nss_cert, pks->u.pubkey.private_key, 0, 0) != SECSuccess) { + SSL_ConfigServerCert(pr, mycert->nss_cert, pks->u.pubkey->private_key, 0, 0) != SECSuccess) { llog_nss_error(RC_LOG, logger, "Failed to start configure TLS options"); return false; } diff --git a/programs/pluto/keys.c b/programs/pluto/keys.c index 359ed87f75..e71fccb825 100644 --- a/programs/pluto/keys.c +++ b/programs/pluto/keys.c @@ -697,7 +697,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c, * etc) then best will end up as NULL */ pexpect(pks->kind == type->private_key_kind); - pexpect(pks->u.pubkey.content.type == type); + pexpect(pks->u.pubkey->content.type == type); dbg("connection %s's %s private key found in NSS DB using cert", c->name, type->name); return pks; @@ -745,7 +745,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c, * etc) then best will end up as NULL */ pexpect(pks->kind == type->private_key_kind); - pexpect(pks->u.pubkey.content.type == type); + pexpect(pks->u.pubkey->content.type == type); dbg("connection %s's %s private key found in NSS DB using CKAID", c->name, type->name); return pks; @@ -764,7 +764,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c, passert(pks != NULL); pexpect(pks->kind == type->private_key_kind); - pexpect(pks->u.pubkey.content.type == type); + pexpect(pks->u.pubkey->content.type == type); dbg("connection %s's %s private key found", c->name, type->name); return pks; diff --git a/programs/showhostkey/showhostkey.c b/programs/showhostkey/showhostkey.c index aaef793914..65b95ba596 100644 --- a/programs/showhostkey/showhostkey.c +++ b/programs/showhostkey/showhostkey.c @@ -172,14 +172,14 @@ static void print(struct secret_stuff *pks, case SECRET_RSA: case SECRET_ECDSA: { - printf("%s", pks->u.pubkey.content.type->name); - keyid_t keyid = pks->u.pubkey.content.keyid; + printf("%s", pks->u.pubkey->content.type->name); + keyid_t keyid = pks->u.pubkey->content.keyid; printf(" keyid: %s", str_keyid(keyid)[0] ? str_keyid(keyid) : ""); if (id) { printf(" id: %s", idb); } ckaid_buf cb; - const ckaid_t *ckaid = &pks->u.pubkey.content.ckaid; + const ckaid_t *ckaid = &pks->u.pubkey->content.ckaid; printf(" ckaid: %s\n", str_ckaid(ckaid, &cb)); break; } @@ -237,7 +237,7 @@ static int pick_by_rsaid(struct secret *secret UNUSED, { char *rsaid = (char *)uservoid; - if (pks->kind == SECRET_RSA && streq(pks->u.pubkey.content.keyid.keyid, rsaid)) { + if (pks->kind == SECRET_RSA && streq(pks->u.pubkey->content.keyid.keyid, rsaid)) { /* stop */ return 0; } else { @@ -254,7 +254,7 @@ static int pick_by_ckaid(struct secret *secret UNUSED, switch (pks->kind) { case SECRET_RSA: case SECRET_ECDSA: - if (ckaid_starts_with(&pks->u.pubkey.content.ckaid, start)) { + if (ckaid_starts_with(&pks->u.pubkey->content.ckaid, start)) { /* stop */ return 0; } @@ -283,7 +283,7 @@ static char *base64_ipseckey_rdata_from_pubkey_secret(struct secret_stuff *pks, enum ipseckey_algorithm_type *ipseckey_algorithm) { chunk_t ipseckey_pubkey = empty_chunk; /* must free */ - err_t e = pks->u.pubkey.content.type->pubkey_content_to_ipseckey_rdata(&pks->u.pubkey.content, + err_t e = pks->u.pubkey->content.type->pubkey_content_to_ipseckey_rdata(&pks->u.pubkey->content, &ipseckey_pubkey, ipseckey_algorithm); if (e != NULL) { @@ -390,7 +390,7 @@ static int show_leftright(struct secret_stuff *pks, } } - passert(pks->u.pubkey.content.type != NULL); + passert(pks->u.pubkey->content.type != NULL); char *base64 = NULL; if (pubkey_flg) { @@ -408,11 +408,11 @@ static int show_leftright(struct secret_stuff *pks, } else { switch (pks->kind) { case SECRET_RSA: - printf("\t# rsakey %s\n", pks->u.pubkey.content.keyid.keyid); + printf("\t# rsakey %s\n", pks->u.pubkey->content.keyid.keyid); printf("\t%srsasigkey=0s", side); break; case SECRET_ECDSA: - printf("\t# ecdsakey %s\n", pks->u.pubkey.content.keyid.keyid); + printf("\t# ecdsakey %s\n", pks->u.pubkey->content.keyid.keyid); printf("\t%secdsakey=0s", side); break; default: @@ -481,14 +481,17 @@ static struct secret_stuff *foreach_nss_private_key(secret_eval func, continue; } + struct secret_pubkey_stuff pubkey = { + .private_key = SECKEY_CopyPrivateKey(private_key), /* add reference */ + }; + type->extract_pubkey_content(&pubkey.content, pubk, ckaid_nss); + struct secret_stuff pks = { .kind = type->private_key_kind, .line = 0, - .u.pubkey.private_key = SECKEY_CopyPrivateKey(private_key), /* add reference */ + .u.pubkey = &pubkey, }; - type->extract_pubkey_content(&pks.u.pubkey.content, pubk, ckaid_nss); - /* * Only count private keys that get processed. */ @@ -513,8 +516,8 @@ static struct secret_stuff *foreach_nss_private_key(secret_eval func, break; } - SECKEY_DestroyPrivateKey(pks.u.pubkey.private_key); /* destroy reference */ - type->free_pubkey_content(&pks.u.pubkey.content); + SECKEY_DestroyPrivateKey(pks.u.pubkey->private_key); /* destroy reference */ + type->free_pubkey_content(&pks.u.pubkey->content); if (ret < 0) { break; -- 2.47.0 From 9e9bdbc27aedb035e769660b65a92e173ee9a5f9 Mon Sep 17 00:00:00 2001 From: Andrew Cagney Date: Fri, 8 Nov 2024 17:45:53 -0500 Subject: [PATCH 2/2] crypto: refcnt struct secret_pubkey_stuff when passing to helper thread fix problem where a thread was trying to use a key when which was being deleted by reloadsecrets. close #1894 Segmentation fault in PK11_SignatureLen (key=0xa5a5a5a5a5a5a5a5) Modified-by: Daiki Ueno --- include/secrets.h | 4 ++++ lib/libswan/secrets.c | 23 ++++++++++++++++++----- programs/pluto/ikev2_auth_helper.c | 27 ++++++++++++++++++--------- 3 files changed, 40 insertions(+), 14 deletions(-) diff --git a/include/secrets.h b/include/secrets.h index c9272d71e0..488d12e8c5 100644 --- a/include/secrets.h +++ b/include/secrets.h @@ -74,10 +74,14 @@ enum secret_kind { }; struct secret_pubkey_stuff { + struct refcnt refcnt; SECKEYPrivateKey *private_key; struct pubkey_content content; }; +struct secret_pubkey_stuff *secret_pubkey_stuff_addref(struct secret_pubkey_stuff *, where_t where); +void secret_pubkey_stuff_delref(struct secret_pubkey_stuff **, where_t where); + struct secret_stuff { enum secret_kind kind; /* diff --git a/lib/libswan/secrets.c b/lib/libswan/secrets.c index 1088f914af..3fed6a55da 100644 --- a/lib/libswan/secrets.c +++ b/lib/libswan/secrets.c @@ -953,10 +953,7 @@ void lsw_free_preshared_secrets(struct secret **psecrets, struct logger *logger) break; case SECRET_RSA: case SECRET_ECDSA: - /* Note: pub is all there is */ - SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key); - s->stuff.u.pubkey->content.type->free_pubkey_content(&s->stuff.u.pubkey->content); - pfree(s->stuff.u.pubkey); + secret_pubkey_stuff_delref(&s->stuff.u.pubkey, HERE); break; default: bad_case(s->stuff.kind); @@ -1173,6 +1170,22 @@ static const struct pubkey_type *private_key_type_nss(SECKEYPrivateKey *private_ } } +struct secret_pubkey_stuff *secret_pubkey_stuff_addref(struct secret_pubkey_stuff *pks, + where_t where) +{ + return addref_where(pks, where); +} + +void secret_pubkey_stuff_delref(struct secret_pubkey_stuff **pks, where_t where) +{ + struct secret_pubkey_stuff *last = delref_where(pks, &global_logger, where); + if (last != NULL) { + SECKEY_DestroyPrivateKey(last->private_key); + last->content.type->free_pubkey_content(&last->content); + pfree(last); + } +} + static err_t add_private_key(struct secret **secrets, const struct secret_stuff **pks, SECKEYPublicKey *pubk, SECItem *ckaid_nss, const struct pubkey_type *type, SECKEYPrivateKey *private_key) @@ -1181,7 +1194,7 @@ static err_t add_private_key(struct secret **secrets, const struct secret_stuff s->stuff.kind = type->private_key_kind; s->stuff.line = 0; /* make an unpacked copy of the private key */ - s->stuff.u.pubkey = alloc_thing(struct secret_pubkey_stuff, "secret_pubkey_stuff"); + s->stuff.u.pubkey = refcnt_alloc(struct secret_pubkey_stuff, HERE); s->stuff.u.pubkey->private_key = copy_private_key(private_key); err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey->content, pubk, ckaid_nss); diff --git a/programs/pluto/ikev2_auth_helper.c b/programs/pluto/ikev2_auth_helper.c index 4fe661b559..2973569a90 100644 --- a/programs/pluto/ikev2_auth_helper.c +++ b/programs/pluto/ikev2_auth_helper.c @@ -38,7 +38,7 @@ struct task { const struct crypt_mac hash_to_sign; const struct hash_desc *hash_algo; v2_auth_signature_cb *cb; - const struct secret_stuff *pks; + struct secret_pubkey_stuff *pks; const struct pubkey_signer *signer; /* out */ struct hash_signature signature; @@ -63,19 +63,21 @@ bool submit_v2_auth_signature(struct ike_sa *ike, struct msg_digest *md, where_t where) { const struct connection *c = ike->sa.st_connection; + const struct secret_stuff *s = get_local_private_key(c, signer->type, + ike->sa.logger); + if (s == NULL) { + /* failure: no key to use */ + return false; + } + struct task task = { .cb = cb, .hash_algo = hash_algo, .hash_to_sign = *hash_to_sign, .signer = signer, - .pks = get_local_private_key(c, signer->type, - ike->sa.logger), + .pks = secret_pubkey_stuff_addref(s->u.pubkey, HERE), }; - if (task.pks == NULL) - /* failure: no key to use */ - return false; - submit_task(/*callback*/&ike->sa, /*task*/&ike->sa, md, /*detach_whack*/false, clone_thing(task, "signature task"), @@ -86,7 +88,7 @@ bool submit_v2_auth_signature(struct ike_sa *ike, struct msg_digest *md, static struct hash_signature v2_auth_signature(struct logger *logger, const struct crypt_mac *hash_to_sign, const struct hash_desc *hash_algo, - const struct secret_stuff *pks, + const struct secret_pubkey_stuff *pks, const struct pubkey_signer *signer) { passert(hash_to_sign->len <= sizeof(hash_to_sign->ptr/*array*/)); /*hint to coverity*/ @@ -96,8 +98,14 @@ static struct hash_signature v2_auth_signature(struct logger *logger, DBG_dump_hunk("hash to sign", *hash_to_sign); } + struct secret_stuff s = { + .kind = pks->content.type->private_key_kind, + .line = 0, + .u.pubkey = (struct secret_pubkey_stuff *)pks, + }; + logtime_t sign_time = logtime_start(logger); - struct hash_signature sig = signer->sign_hash(pks, + struct hash_signature sig = signer->sign_hash(&s, hash_to_sign->ptr, hash_to_sign->len, hash_algo, @@ -125,5 +133,6 @@ static stf_status v2_auth_signature_completed(struct state *st, static void v2_auth_signature_cleanup(struct task **task) { + secret_pubkey_stuff_delref(&(*task)->pks, HERE); pfreeany(*task); } -- 2.47.0