Sign an IPsec (ESP or AH) packet with this algo. :param pkt: a packet that contains a valid encrypted ESP or AH layer :param key: the authentication key, a byte string :param esn_en: extended sequence number enable which allows to use 64
(self, pkt, key, esn_en=False, esn=0)
| 670 | return self.mac(key, self.digestmod(), default_backend()) |
| 671 | |
| 672 | def sign(self, pkt, key, esn_en=False, esn=0): |
| 673 | """ |
| 674 | Sign an IPsec (ESP or AH) packet with this algo. |
| 675 | |
| 676 | :param pkt: a packet that contains a valid encrypted ESP or AH layer |
| 677 | :param key: the authentication key, a byte string |
| 678 | :param esn_en: extended sequence number enable which allows to use |
| 679 | 64-bit sequence number instead of 32-bit |
| 680 | :param esn: extended sequence number (32 MSB) |
| 681 | |
| 682 | :returns: the signed packet |
| 683 | """ |
| 684 | if not self.mac: |
| 685 | return pkt |
| 686 | |
| 687 | mac = self.new_mac(key) |
| 688 | |
| 689 | if pkt.haslayer(ESP): |
| 690 | mac.update(bytes(pkt[ESP])) |
| 691 | if esn_en: |
| 692 | # RFC4303 sect 2.2.1 |
| 693 | mac.update(struct.pack('!L', esn)) |
| 694 | pkt[ESP].data += mac.finalize()[:self.icv_size] |
| 695 | |
| 696 | elif pkt.haslayer(AH): |
| 697 | mac.update(bytes(zero_mutable_fields(pkt.copy(), sending=True))) |
| 698 | if esn_en: |
| 699 | # RFC4302 sect 2.5.1 |
| 700 | mac.update(struct.pack('!L', esn)) |
| 701 | pkt[AH].icv = mac.finalize()[:self.icv_size] |
| 702 | |
| 703 | return pkt |
| 704 | |
| 705 | def verify(self, pkt, key, esn_en=False, esn=0): |
| 706 | """ |
no test coverage detected