mirror of
https://git.tartarus.org/simon/putty.git
synced 2025-01-09 17:38:00 +00:00
25b034ee39
The old 'Bignum' data type is gone completely, and so is sshbn.c. In its place is a new thing called 'mp_int', handled by an entirely new library module mpint.c, with API differences both large and small. The main aim of this change is that the new library should be free of timing- and cache-related side channels. I've written the code so that it _should_ - assuming I haven't made any mistakes - do all of its work without either control flow or memory addressing depending on the data words of the input numbers. (Though, being an _arbitrary_ precision library, it does have to at least depend on the sizes of the numbers - but there's a 'formal' size that can vary separately from the actual magnitude of the represented integer, so if you want to keep it secret that your number is actually small, it should work fine to have a very long mp_int and just happen to store 23 in it.) So I've done all my conditionalisation by means of computing both answers and doing bit-masking to swap the right one into place, and all loops over the words of an mp_int go up to the formal size rather than the actual size. I haven't actually tested the constant-time property in any rigorous way yet (I'm still considering the best way to do it). But this code is surely at the very least a big improvement on the old version, even if I later find a few more things to fix. I've also completely rewritten the low-level elliptic curve arithmetic from sshecc.c; the new ecc.c is closer to being an adjunct of mpint.c than it is to the SSH end of the code. The new elliptic curve code keeps all coordinates in Montgomery-multiplication transformed form to speed up all the multiplications mod the same prime, and only converts them back when you ask for the affine coordinates. Also, I adopted extended coordinates for the Edwards curve implementation. sshecc.c has also had a near-total rewrite in the course of switching it over to the new system. While I was there, I've separated ECDSA and EdDSA more completely - they now have separate vtables, instead of a single vtable in which nearly every function had a big if statement in it - and also made the externally exposed types for an ECDSA key and an ECDH context different. A minor new feature: since the new arithmetic code includes a modular square root function, we can now support the compressed point representation for the NIST curves. We seem to have been getting along fine without that so far, but it seemed a shame not to put it in, since it was suddenly easy. In sshrsa.c, one major change is that I've removed the RSA blinding step in rsa_privkey_op, in which we randomise the ciphertext before doing the decryption. The purpose of that was to avoid timing leaks giving away the plaintext - but the new arithmetic code should take that in its stride in the course of also being careful enough to avoid leaking the _private key_, which RSA blinding had no way to do anything about in any case. Apart from those specific points, most of the rest of the changes are more or less mechanical, just changing type names and translating code into the new API.
104 lines
4.3 KiB
C
104 lines
4.3 KiB
C
typedef struct AuthPolicy AuthPolicy;
|
|
|
|
Plug *ssh_server_plug(
|
|
Conf *conf, ssh_key *const *hostkeys, int nhostkeys,
|
|
struct RSAKey *hostkey1, AuthPolicy *authpolicy, LogPolicy *logpolicy,
|
|
const SftpServerVtable *sftpserver_vt);
|
|
void ssh_server_start(Plug *plug, Socket *socket);
|
|
|
|
void server_instance_terminated(void);
|
|
void platform_logevent(const char *msg);
|
|
|
|
#define AUTHMETHODS(X) \
|
|
X(NONE) \
|
|
X(PASSWORD) \
|
|
X(PUBLICKEY) \
|
|
X(KBDINT) \
|
|
X(TIS) \
|
|
X(CRYPTOCARD) \
|
|
/* end of list */
|
|
|
|
#define AUTHMETHOD_BIT_INDEX(name) AUTHMETHOD_BIT_INDEX_##name,
|
|
enum { AUTHMETHODS(AUTHMETHOD_BIT_INDEX) AUTHMETHOD_BIT_INDEX_dummy };
|
|
#define AUTHMETHOD_BIT_VALUE(name) \
|
|
AUTHMETHOD_##name = 1 << AUTHMETHOD_BIT_INDEX_##name,
|
|
enum { AUTHMETHODS(AUTHMETHOD_BIT_VALUE) AUTHMETHOD_BIT_VALUE_dummy };
|
|
|
|
typedef struct AuthKbdInt AuthKbdInt;
|
|
typedef struct AuthKbdIntPrompt AuthKbdIntPrompt;
|
|
struct AuthKbdInt {
|
|
char *title, *instruction; /* both need freeing */
|
|
int nprompts;
|
|
AuthKbdIntPrompt *prompts; /* the array itself needs freeing */
|
|
};
|
|
struct AuthKbdIntPrompt {
|
|
char *prompt; /* needs freeing */
|
|
bool echo;
|
|
};
|
|
|
|
unsigned auth_methods(AuthPolicy *);
|
|
bool auth_none(AuthPolicy *, ptrlen username);
|
|
|
|
int auth_password(AuthPolicy *, ptrlen username, ptrlen password,
|
|
ptrlen *opt_new_password);
|
|
/* auth_password returns 1 for 'accepted', 0 for 'rejected', and 2 for
|
|
* 'ok but now you need to change your password' */
|
|
|
|
bool auth_publickey(AuthPolicy *, ptrlen username, ptrlen public_blob);
|
|
/* auth_publickey_ssh1 must return the whole public key given the modulus,
|
|
* because the SSH-1 client never transmits the exponent over the wire.
|
|
* The key remains owned by the AuthPolicy. */
|
|
|
|
AuthKbdInt *auth_kbdint_prompts(AuthPolicy *, ptrlen username);
|
|
/* auth_kbdint_prompts returns NULL to trigger auth failure */
|
|
int auth_kbdint_responses(AuthPolicy *, const ptrlen *responses);
|
|
/* auth_kbdint_responses returns >0 for success, <0 for failure, and 0
|
|
* to indicate that we haven't decided yet and further prompts are
|
|
* coming */
|
|
|
|
/* The very similar SSH-1 TIS and CryptoCard methods are combined into
|
|
* a single API for AuthPolicy, which takes a method argument */
|
|
char *auth_ssh1int_challenge(AuthPolicy *, unsigned method, ptrlen username);
|
|
bool auth_ssh1int_response(AuthPolicy *, ptrlen response);
|
|
|
|
struct RSAKey *auth_publickey_ssh1(
|
|
AuthPolicy *ap, ptrlen username, mp_int *rsa_modulus);
|
|
/* auth_successful returns false if further authentication is needed */
|
|
bool auth_successful(AuthPolicy *, ptrlen username, unsigned method);
|
|
|
|
PacketProtocolLayer *ssh2_userauth_server_new(
|
|
PacketProtocolLayer *successor_layer, AuthPolicy *authpolicy);
|
|
void ssh2_userauth_server_set_transport_layer(
|
|
PacketProtocolLayer *userauth, PacketProtocolLayer *transport);
|
|
|
|
void ssh2connection_server_configure(
|
|
PacketProtocolLayer *ppl, const SftpServerVtable *sftpserver_vt);
|
|
|
|
PacketProtocolLayer *ssh1_login_server_new(
|
|
PacketProtocolLayer *successor_layer, struct RSAKey *hostkey,
|
|
AuthPolicy *authpolicy);
|
|
|
|
Channel *sesschan_new(SshChannel *c, LogContext *logctx,
|
|
const SftpServerVtable *sftpserver_vt);
|
|
|
|
Backend *pty_backend_create(
|
|
Seat *seat, LogContext *logctx, Conf *conf, char **argv, const char *cmd,
|
|
struct ssh_ttymodes ttymodes, bool pipes_instead_of_pty);
|
|
ptrlen pty_backend_exit_signame(Backend *be, char **aux_msg);
|
|
|
|
/*
|
|
* Establish a listening X server. Return value is the _number_ of
|
|
* Sockets that it established pointing at the given Plug. (0
|
|
* indicates complete failure.) The socket pointers themselves are
|
|
* written into sockets[], up to a possible total of MAX_X11_SOCKETS.
|
|
*
|
|
* The supplied Conf has necessary environment variables written into
|
|
* it. (And is also used to open the port listeners, though that
|
|
* shouldn't affect anything.)
|
|
*/
|
|
#define MAX_X11_SOCKETS 2
|
|
int platform_make_x11_server(Plug *plug, const char *progname, int mindisp,
|
|
const char *screen_number_suffix,
|
|
ptrlen authproto, ptrlen authdata,
|
|
Socket **sockets, Conf *conf);
|