X-Git-Url: http://git.tuebingen.mpg.de/?p=paraslash.git;a=blobdiff_plain;f=crypt.c;h=8116fb6eeacdbeaa0f1f22d14cfcc3726ee3bbbf;hp=69e4a3140a1599f971dbd641dd99e3461af40ff1;hb=9165680a9639a8412adef13b96e466efdbb9d806;hpb=9de1287d67c9562e9140c6dc7deb0c01c4e10cc0 diff --git a/crypt.c b/crypt.c index 69e4a314..8116fb6e 100644 --- a/crypt.c +++ b/crypt.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2005-2012 Andre Noll + * Copyright (C) 2005 Andre Noll * * Licensed under the GPL v2. For licencing details see COPYING. */ @@ -15,6 +15,7 @@ #include #include #include +#include #include "para.h" #include "error.h" @@ -22,6 +23,7 @@ #include "crypt.h" #include "fd.h" #include "crypt_backend.h" +#include "base64.h" struct asymmetric_key { RSA *rsa; @@ -132,23 +134,29 @@ static int read_rsa_bignums(const unsigned char *blob, int blen, RSA **result) { int ret; RSA *rsa; + BIGNUM *n, *e; const unsigned char *p = blob, *end = blob + blen; rsa = RSA_new(); if (!rsa) return -E_BIGNUM; - ret = read_bignum(p, end - p, &rsa->e); + ret = read_bignum(p, end - p, &e); if (ret < 0) goto fail; p += ret; - ret = read_bignum(p, end - p, &rsa->n); + ret = read_bignum(p, end - p, &n); if (ret < 0) goto fail; +#ifdef HAVE_RSA_SET0_KEY + RSA_set0_key(rsa, n, e, NULL); +#else + rsa->n = n; + rsa->e = e; +#endif *result = rsa; return 1; fail: - if (rsa) - RSA_free(rsa); + RSA_free(rsa); return ret; } @@ -158,7 +166,7 @@ int get_asymmetric_key(const char *key_file, int private, struct asymmetric_key *key = NULL; void *map = NULL; unsigned char *blob = NULL; - size_t map_size, blob_size, decoded_size; + size_t map_size, encoded_size, decoded_size; int ret, ret2; char *cp; @@ -180,16 +188,11 @@ int get_asymmetric_key(const char *key_file, int private, goto out; } cp = map + ret; + encoded_size = map_size - ret; PARA_INFO_LOG("decoding public rsa-ssh key %s\n", key_file); - ret = -ERRNO_TO_PARA_ERROR(EOVERFLOW); - if (map_size > INT_MAX / 4) - goto out_unmap; - blob_size = 2 * map_size; - blob = para_malloc(blob_size); - ret = uudecode(cp, blob, blob_size); + ret = uudecode(cp, encoded_size, (char **)&blob, &decoded_size); if (ret < 0) goto out_unmap; - decoded_size = ret; ret = check_ssh_key_header(blob, decoded_size); if (ret < 0) goto out_unmap; @@ -261,18 +264,35 @@ int pub_encrypt(struct asymmetric_key *pub, unsigned char *inbuf, } struct stream_cipher { - RC4_KEY key; + bool use_aes; + union { + RC4_KEY rc4_key; + EVP_CIPHER_CTX *aes; + } context; }; -struct stream_cipher *sc_new(const unsigned char *data, int len) +struct stream_cipher *sc_new(const unsigned char *data, int len, + bool use_aes) { struct stream_cipher *sc = para_malloc(sizeof(*sc)); - RC4_set_key(&sc->key, len, data); + + sc->use_aes = use_aes; + if (!use_aes) { + RC4_set_key(&sc->context.rc4_key, len, data); + return sc; + } + assert(len >= 2 * AES_CRT128_BLOCK_SIZE); + sc->context.aes = EVP_CIPHER_CTX_new(); + EVP_EncryptInit_ex(sc->context.aes, EVP_aes_128_ctr(), NULL, data, + data + AES_CRT128_BLOCK_SIZE); return sc; } void sc_free(struct stream_cipher *sc) { + if (!sc) + return; + EVP_CIPHER_CTX_free(sc->context.aes); free(sc); } @@ -283,38 +303,53 @@ void sc_free(struct stream_cipher *sc) */ #define RC4_ALIGN 8 -int sc_send_bin_buffer(struct stream_cipher_context *scc, char *buf, - size_t len) +static void rc4_crypt(RC4_KEY *key, struct iovec *src, struct iovec *dst) { - int ret; - unsigned char *tmp; - static unsigned char remainder[RC4_ALIGN]; - size_t l1 = ROUND_DOWN(len, RC4_ALIGN), l2 = ROUND_UP(len, RC4_ALIGN); - - assert(len); - tmp = para_malloc(l2); - RC4(&scc->send->key, l1, (const unsigned char *)buf, tmp); + size_t len = src->iov_len, l1, l2; + + assert(len > 0); + assert(len < ((typeof(src->iov_len))-1) / 2); + l1 = ROUND_DOWN(len, RC4_ALIGN); + l2 = ROUND_UP(len, RC4_ALIGN); + + *dst = (typeof(*dst)) { + /* Add one for the terminating zero byte. */ + .iov_base = para_malloc(l2 + 1), + .iov_len = len + }; + RC4(key, l1, src->iov_base, dst->iov_base); if (len > l1) { - memcpy(remainder, buf + l1, len - l1); - RC4(&scc->send->key, len - l1, remainder, tmp + l1); + unsigned char remainder[RC4_ALIGN] = ""; + memcpy(remainder, src->iov_base + l1, len - l1); + RC4(key, len - l1, remainder, dst->iov_base + l1); } - ret = write_all(scc->fd, (char *)tmp, &len); - free(tmp); - return ret; + ((char *)dst->iov_base)[len] = '\0'; } -int sc_recv_bin_buffer(struct stream_cipher_context *scc, char *buf, - size_t size) +static void aes_ctr128_crypt(EVP_CIPHER_CTX *ctx, struct iovec *src, + struct iovec *dst) { - unsigned char *tmp = para_malloc(ROUND_UP(size, RC4_ALIGN)); - ssize_t ret = recv(scc->fd, tmp, size, 0); - - if (ret > 0) - RC4(&scc->recv->key, ret, tmp, (unsigned char *)buf); - else if (ret < 0) - ret = -ERRNO_TO_PARA_ERROR(errno); - free(tmp); - return ret; + int ret, inlen = src->iov_len, outlen, tmplen; + + *dst = (typeof(*dst)) { + /* Add one for the terminating zero byte. */ + .iov_base = para_malloc(inlen + 1), + .iov_len = inlen + }; + ret = EVP_EncryptUpdate(ctx, dst->iov_base, &outlen, src->iov_base, inlen); + assert(ret != 0); + ret = EVP_EncryptFinal_ex(ctx, dst->iov_base + outlen, &tmplen); + assert(ret != 0); + outlen += tmplen; + ((char *)dst->iov_base)[outlen] = '\0'; + dst->iov_len = outlen; +} + +void sc_crypt(struct stream_cipher *sc, struct iovec *src, struct iovec *dst) +{ + if (sc->use_aes) + return aes_ctr128_crypt(sc->context.aes, src, dst); + return rc4_crypt(&sc->context.rc4_key, src, dst); } void hash_function(const char *data, unsigned long len, unsigned char *hash)