nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-01-09 17:38:00 +00:00
Code Issues Projects Releases Wiki Activity

sshhmac: reorganise, and fix crash when used with CBC.

Browse Source 
I'd forgotten that the SSH-2 BPP uses a defensive measure of
generating the MAC for successive prefixes of an incoming packet,
which means that ssh_mac_genresult needs to be nondestructive.

While I'm at it, I've also made all of hmac's hash objects exist all
the time - they're created up front, destroyed unconditionally on
free, and in between, whenever one is destroyed at all it's
immediately recreated. I think this simplifies things in general, and
in particular, creating at least one hash object immediately will come
in useful when I add selector vtables in a few commits' time.
This commit is contained in:
Simon Tatham 2019-01-23 20:12:20 +00:00
parent 8ebdaf0b1d
commit c0de1cbbad
1 changed files with 48 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
sshhmac.c
View File

@ -6,14 +6,16 @@
#include "ssh.h"
struct hmac {
const ssh_hashalg *hashalg;
ssh_hash *h_outer, *h_inner, *h_live;
bool keyed;
uint8_t *digest;
strbuf *text_name;
ssh2_mac mac;
};
struct hmac_extra {
const ssh_hashalg *hashalg;
const ssh_hashalg *hashalg_base;
const char *suffix;
};
@ -22,6 +24,14 @@ static ssh2_mac *hmac_new(const ssh2_macalg *alg, ssh_cipher *cipher)
struct hmac *ctx = snew(struct hmac);
const struct hmac_extra *extra = (const struct hmac_extra *)alg->extra;
ctx->h_outer = ssh_hash_new(extra->hashalg_base);
/* In case that hashalg was a selector vtable, we'll now switch to
* using whatever real one it selected, for all future purposes. */
ctx->hashalg = ssh_hash_alg(ctx->h_outer);
ctx->h_inner = ssh_hash_new(ctx->hashalg);
ctx->h_live = ssh_hash_new(ctx->hashalg);
ctx->keyed = false;
/*
* HMAC is not well defined as a wrapper on an absolutely general
* hash function; it expects that the function it's wrapping will
@ -29,17 +39,16 @@ static ssh2_mac *hmac_new(const ssh2_macalg *alg, ssh_cipher *cipher)
* in terms of that block size. So we insist that the hash we're
* given must have defined a meaningful block size.
*/
assert(extra->hashalg->blocklen);
assert(ctx->hashalg->blocklen);
ctx->h_outer = ctx->h_inner = ctx->h_live = NULL;
ctx->digest = snewn(extra->hashalg->hlen, uint8_t);
ctx->digest = snewn(ctx->hashalg->hlen, uint8_t);
ctx->text_name = strbuf_new();
strbuf_catf(ctx->text_name, "HMAC-%s%s",
extra->hashalg->text_name, extra->suffix);
ctx->hashalg->text_name, extra->suffix);
ctx->mac.vt = alg;
BinarySink_DELEGATE_CLEAR(&ctx->mac);
BinarySink_DELEGATE_INIT(&ctx->mac, ctx->h_live);
return &ctx->mac;
}
@ -49,13 +58,10 @@ static void hmac_free(ssh2_mac *mac)
struct hmac *ctx = container_of(mac, struct hmac, mac);
const struct hmac_extra *extra = (const struct hmac_extra *)mac->vt->extra;
if (ctx->h_outer)
ssh_hash_free(ctx->h_outer);
if (ctx->h_inner)
ssh_hash_free(ctx->h_inner);
if (ctx->h_live)
ssh_hash_free(ctx->h_live);
smemclr(ctx->digest, extra->hashalg->hlen);
ssh_hash_free(ctx->h_outer);
ssh_hash_free(ctx->h_inner);
ssh_hash_free(ctx->h_live);
smemclr(ctx->digest, ctx->hashalg->hlen);
sfree(ctx->digest);
strbuf_free(ctx->text_name);
@ -75,16 +81,28 @@ static void hmac_key(ssh2_mac *mac, ptrlen key)
size_t klen;
strbuf *sb = NULL;
if (key.len > extra->hashalg->blocklen) {
if (ctx->keyed) {
/*
* If we've already been keyed, throw away the existing hash
* objects and make a fresh pair to put the new key in.
*/
ssh_hash_free(ctx->h_outer);
ssh_hash_free(ctx->h_inner);
ctx->h_outer = ssh_hash_new(ctx->hashalg);
ctx->h_inner = ssh_hash_new(ctx->hashalg);
}
ctx->keyed = true;
if (key.len > ctx->hashalg->blocklen) {
/*
* RFC 2104 section 2: if the key exceeds the block length of
* the underlying hash, then we start by hashing the key, and
* use that hash as the 'true' key for the HMAC construction.
*/
sb = strbuf_new();
strbuf_append(sb, extra->hashalg->hlen);
strbuf_append(sb, ctx->hashalg->hlen);
ssh_hash *htmp = ssh_hash_new(extra->hashalg);
ssh_hash *htmp = ssh_hash_new(ctx->hashalg);
put_datapl(htmp, key);
ssh_hash_final(htmp, sb->u);
@ -103,16 +121,16 @@ static void hmac_key(ssh2_mac *mac, ptrlen key)
if (ctx->h_inner)
ssh_hash_free(ctx->h_inner);
ctx->h_outer = ssh_hash_new(extra->hashalg);
ctx->h_outer = ssh_hash_new(ctx->hashalg);
for (size_t i = 0; i < klen; i++)
put_byte(ctx->h_outer, PAD_OUTER ^ kp[i]);
for (size_t i = klen; i < extra->hashalg->blocklen; i++)
for (size_t i = klen; i < ctx->hashalg->blocklen; i++)
put_byte(ctx->h_outer, PAD_OUTER);
ctx->h_inner = ssh_hash_new(extra->hashalg);
ctx->h_inner = ssh_hash_new(ctx->hashalg);
for (size_t i = 0; i < klen; i++)
put_byte(ctx->h_inner, PAD_INNER ^ kp[i]);
for (size_t i = klen; i < extra->hashalg->blocklen; i++)
for (size_t i = klen; i < ctx->hashalg->blocklen; i++)
put_byte(ctx->h_inner, PAD_INNER);
if (sb)
@ -123,10 +141,7 @@ static void hmac_start(ssh2_mac *mac)
{
struct hmac *ctx = container_of(mac, struct hmac, mac);
assert(ctx->h_outer);
if (ctx->h_live)
ssh_hash_free(ctx->h_live);
ssh_hash_free(ctx->h_live);
ctx->h_live = ssh_hash_copy(ctx->h_inner);
BinarySink_DELEGATE_INIT(&ctx->mac, ctx->h_live);
}
@ -135,15 +150,16 @@ static void hmac_genresult(ssh2_mac *mac, unsigned char *output)
{
struct hmac *ctx = container_of(mac, struct hmac, mac);
const struct hmac_extra *extra = (const struct hmac_extra *)mac->vt->extra;
ssh_hash *htmp;
assert(ctx->h_live);
ssh_hash_final(ctx->h_live, ctx->digest);
/* Leave h_live in place, so that the SSH-2 BPP can continue
* regenerating test results from different-length prefixes of the
* packet */
htmp = ssh_hash_copy(ctx->h_live);
ssh_hash_final(htmp, ctx->digest);
ctx->h_live = NULL;
BinarySink_DELEGATE_CLEAR(&ctx->mac);
ssh_hash *htmp = ssh_hash_copy(ctx->h_outer);
put_data(htmp, ctx->digest, extra->hashalg->hlen);
htmp = ssh_hash_copy(ctx->h_outer);
put_data(htmp, ctx->digest, ctx->hashalg->hlen);
ssh_hash_final(htmp, ctx->digest);
/*
@ -152,7 +168,7 @@ static void hmac_genresult(ssh2_mac *mac, unsigned char *output)
* full-length buffer, and now we copy the required amount.
*/
memcpy(output, ctx->digest, mac->vt->len);
smemclr(ctx->digest, extra->hashalg->hlen);
smemclr(ctx->digest, ctx->hashalg->hlen);
}
static const char *hmac_text_name(ssh2_mac *mac)