nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-01-09 17:38:00 +00:00
Code Issues Projects Releases Wiki Activity

Implement anti-replay protection for XDM-AUTHORIZATION-1, as required by

Browse Source 
the specification.  We keep a cache of tickets we've seen recently and 
reject duplicates.  Once a ticket in our cache is old enough that we
wouldn't accept a duplicate anyway, we expire it.

[originally from svn r5236]
This commit is contained in:
Ben Harris 2005-02-02 23:51:58 +00:00
parent 76231a5c98
commit b69e9d0781
1 changed files with 45 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
x11fwd.c
View File

@ -9,6 +9,7 @@
#include "putty.h"
#include "ssh.h"
#include "tree234.h"
#define GET_32BIT_LSB_FIRST(cp) \
(((unsigned long)(unsigned char)(cp)[0]) | \
@ -60,10 +61,16 @@ const char *const x11_authnames[] = {
"", "MIT-MAGIC-COOKIE-1", "XDM-AUTHORIZATION-1"
};
struct XDMSeen {
unsigned int time;
unsigned char clientid[6];
};
struct X11Auth {
unsigned char fakedata[64], realdata[64];
int fakeproto, realproto;
int fakelen, reallen;
tree234 *xdmseen;
};
struct X11Private {
@ -82,6 +89,14 @@ struct X11Private {
Socket s;
};
static int xdmseen_cmp(void *a, void *b)
{
struct XDMSeen *sa = a, *sb = b;
return sa->time > sb->time ? 1 :
sa->time < sb->time ? -1 :
memcmp(sa->clientid, sb->clientid, sizeof(sa->clientid));
}
void *x11_invent_auth(char *proto, int protomaxlen,
char *data, int datamaxlen, int proto_id)
{
@ -104,6 +119,7 @@ void *x11_invent_auth(char *proto, int protomaxlen,
auth->fakelen = 16;
for (i = 0; i < 16; i++)
auth->fakedata[i] = (i == 8 ? 0 : random_byte());
auth->xdmseen = newtree234(xdmseen_cmp);
}
/* Now format for the recipient. */
@ -116,9 +132,16 @@ void *x11_invent_auth(char *proto, int protomaxlen,
return auth;
}
void x11_free_auth(void *auth)
void x11_free_auth(void *authv)
{
struct X11Auth *auth = (struct X11Auth *)authv;
struct XDMSeen *seen;
if (auth->xdmseen != NULL) {
while ((seen = delpos234(auth->xdmseen, 0)) != NULL)
sfree(seen);
freetree234(auth->xdmseen);
}
sfree(auth);
}
@ -138,6 +161,8 @@ void x11_get_real_auth(void *authv, char *display)
auth->realdata, &auth->reallen);
}
#define XDM_MAXSKEW 20*60 /* 20 minute clock skew should be OK */
static char *x11_verify(unsigned long peer_ip, int peer_port,
struct X11Auth *auth, char *proto,
unsigned char *data, int dlen)
@ -154,6 +179,7 @@ static char *x11_verify(unsigned long peer_ip, int peer_port,
unsigned long t;
time_t tim;
int i;
struct XDMSeen *seen, *ret;
if (dlen != 24)
return "XDM-AUTHORIZATION-1 data was wrong length";
@ -171,8 +197,25 @@ static char *x11_verify(unsigned long peer_ip, int peer_port,
if (data[i] != 0) /* zero padding wrong */
return "XDM-AUTHORIZATION-1 data failed check";
tim = time(NULL);
if (abs(t - tim) > 20*60) /* 20 minute clock skew should be OK */
if (abs(t - tim) > XDM_MAXSKEW)
return "XDM-AUTHORIZATION-1 time stamp was too far out";
seen = snew(struct XDMSeen);
seen->time = t;
memcpy(seen->clientid, data+8, 6);
assert(auth->xdmseen != NULL);
ret = add234(auth->xdmseen, seen);
if (ret != seen) {
sfree(seen);
return "XDM-AUTHORIZATION-1 data replayed";
}
/* While we're here, purge entries too old to be replayed. */
for (;;) {
seen = index234(auth->xdmseen, 0);
assert(seen != NULL);
if (t - seen->time <= XDM_MAXSKEW)
break;
sfree(delpos234(auth->xdmseen, 0));
}
}
/* implement other protocols here if ever required */
return NULL;