MCPcopy Create free account
hub / github.com/secdev/scapy / verify

Method verify

scapy/layers/ipsec.py:705–751  ·  view source on GitHub ↗

Check that the integrity check value (icv) of a packet is valid. :param pkt: a packet that contains a valid encrypted ESP or AH layer :param key: the authentication key, a byte string :param esn_en: extended sequence number enable which allows to use

(self, pkt, key, esn_en=False, esn=0)

Source from the content-addressed store, hash-verified

703 return pkt
704
705 def verify(self, pkt, key, esn_en=False, esn=0):
706 """
707 Check that the integrity check value (icv) of a packet is valid.
708
709 :param pkt: a packet that contains a valid encrypted ESP or AH layer
710 :param key: the authentication key, a byte string
711 :param esn_en: extended sequence number enable which allows to use
712 64-bit sequence number instead of 32-bit
713 :param esn: extended sequence number (32 MSB)
714
715 :raise scapy.layers.ipsec.IPSecIntegrityError: if the integrity check
716 fails
717 """
718 if not self.mac or self.icv_size == 0:
719 return
720
721 mac = self.new_mac(key)
722
723 pkt_icv = 'not found'
724
725 if isinstance(pkt, ESP):
726 pkt_icv = pkt.data[len(pkt.data) - self.icv_size:]
727 clone = pkt.copy()
728 clone.data = clone.data[:len(clone.data) - self.icv_size]
729 mac.update(bytes(clone))
730 if esn_en:
731 # RFC4303 sect 2.2.1
732 mac.update(struct.pack('!L', esn))
733
734 elif pkt.haslayer(AH):
735 if len(pkt[AH].icv) != self.icv_size:
736 # Fill padding since we know the actual icv_size
737 pkt[AH].padding = pkt[AH].icv[self.icv_size:]
738 pkt[AH].icv = pkt[AH].icv[:self.icv_size]
739 pkt_icv = pkt[AH].icv
740 clone = zero_mutable_fields(pkt.copy(), sending=False)
741 mac.update(bytes(clone))
742 if esn_en:
743 # RFC4302 sect 2.5.1
744 mac.update(struct.pack('!L', esn))
745
746 computed_icv = mac.finalize()[:self.icv_size]
747
748 # XXX: Cannot use mac.verify because the ICV can be truncated
749 if pkt_icv != computed_icv:
750 raise IPSecIntegrityError('pkt_icv=%r, computed_icv=%r' %
751 (pkt_icv, computed_icv))
752
753###############################################################################
754# The names of the integrity algorithms are the same than in scapy.contrib.ikev2 # noqa: E501

Callers 2

_decrypt_espMethod · 0.45
_decrypt_ahMethod · 0.45

Calls 6

new_macMethod · 0.95
zero_mutable_fieldsFunction · 0.85
IPSecIntegrityErrorClass · 0.85
copyMethod · 0.45
updateMethod · 0.45
haslayerMethod · 0.45

Tested by

no test coverage detected