Check that the integrity check value (icv) of a packet is valid. :param pkt: a packet that contains a valid encrypted ESP or AH layer :param key: the authentication key, a byte string :param esn_en: extended sequence number enable which allows to use
(self, pkt, key, esn_en=False, esn=0)
| 703 | return pkt |
| 704 | |
| 705 | def verify(self, pkt, key, esn_en=False, esn=0): |
| 706 | """ |
| 707 | Check that the integrity check value (icv) of a packet is valid. |
| 708 | |
| 709 | :param pkt: a packet that contains a valid encrypted ESP or AH layer |
| 710 | :param key: the authentication key, a byte string |
| 711 | :param esn_en: extended sequence number enable which allows to use |
| 712 | 64-bit sequence number instead of 32-bit |
| 713 | :param esn: extended sequence number (32 MSB) |
| 714 | |
| 715 | :raise scapy.layers.ipsec.IPSecIntegrityError: if the integrity check |
| 716 | fails |
| 717 | """ |
| 718 | if not self.mac or self.icv_size == 0: |
| 719 | return |
| 720 | |
| 721 | mac = self.new_mac(key) |
| 722 | |
| 723 | pkt_icv = 'not found' |
| 724 | |
| 725 | if isinstance(pkt, ESP): |
| 726 | pkt_icv = pkt.data[len(pkt.data) - self.icv_size:] |
| 727 | clone = pkt.copy() |
| 728 | clone.data = clone.data[:len(clone.data) - self.icv_size] |
| 729 | mac.update(bytes(clone)) |
| 730 | if esn_en: |
| 731 | # RFC4303 sect 2.2.1 |
| 732 | mac.update(struct.pack('!L', esn)) |
| 733 | |
| 734 | elif pkt.haslayer(AH): |
| 735 | if len(pkt[AH].icv) != self.icv_size: |
| 736 | # Fill padding since we know the actual icv_size |
| 737 | pkt[AH].padding = pkt[AH].icv[self.icv_size:] |
| 738 | pkt[AH].icv = pkt[AH].icv[:self.icv_size] |
| 739 | pkt_icv = pkt[AH].icv |
| 740 | clone = zero_mutable_fields(pkt.copy(), sending=False) |
| 741 | mac.update(bytes(clone)) |
| 742 | if esn_en: |
| 743 | # RFC4302 sect 2.5.1 |
| 744 | mac.update(struct.pack('!L', esn)) |
| 745 | |
| 746 | computed_icv = mac.finalize()[:self.icv_size] |
| 747 | |
| 748 | # XXX: Cannot use mac.verify because the ICV can be truncated |
| 749 | if pkt_icv != computed_icv: |
| 750 | raise IPSecIntegrityError('pkt_icv=%r, computed_icv=%r' % |
| 751 | (pkt_icv, computed_icv)) |
| 752 | |
| 753 | ############################################################################### |
| 754 | # The names of the integrity algorithms are the same than in scapy.contrib.ikev2 # noqa: E501 |
no test coverage detected