X-Git-Url: http://www.average.org/gitweb/?p=pam_pcsc_cr.git;a=blobdiff_plain;f=authobj.c;h=b4a1f2be26e1f3e3a284a128a5a6ba49c2aac954;hp=f8d577d8d66eb43efbcf89409c620791ceca0ca9;hb=HEAD;hpb=dc8959a3cb5615448ea9307a3277e608ffd8a6dd diff --git a/authobj.c b/authobj.c index f8d577d..7e3c2ed 100644 --- a/authobj.c +++ b/authobj.c @@ -1,13 +1,36 @@ +/* +Copyright (c) 2013 Eugene Crosser + +This software is provided 'as-is', without any express or implied +warranty. In no event will the authors be held liable for any damages +arising from the use of this software. + +Permission is granted to anyone to use this software for any purpose, +including commercial applications, and to alter it and redistribute it +freely, subject to the following restrictions: + + 1. The origin of this software must not be misrepresented; you must + not claim that you wrote the original software. If you use this + software in a product, an acknowledgment in the product documentation + would be appreciated but is not required. + + 2. Altered source versions must be plainly marked as such, and must + not be misrepresented as being the original software. + + 3. This notice may not be removed or altered from any source + distribution. +*/ + #ifdef HAVE_CONFIG_H # include "config.h" #endif #include #include +#include #include #include "serial.h" #include "crypto.h" #include "authobj.h" -#include "pcsc_cr.h" static struct _auth_chunk make_challenge(const char *uid, const char *pass, const char *nonce) @@ -15,10 +38,10 @@ make_challenge(const char *uid, const char *pass, const char *nonce) struct _auth_chunk ho = {0}; unsigned long rc; serializer_t srl; - int datasize = strlen(uid) + strlen(pass) + strlen(nonce) + + size_t datasize = strlen(uid) + strlen(pass) + strlen(nonce) + 4 * sizeof(short); unsigned char *data = alloca(datasize); - int hashsize = sizeof(ho.data); + size_t hashsize = sizeof(ho.data); serial_init(&srl, data, datasize); if (serial_put(&srl, uid, strlen(uid)) != strlen(uid)) { @@ -42,12 +65,12 @@ make_challenge(const char *uid, const char *pass, const char *nonce) } static struct _auth_chunk -new_key(const unsigned char *challenge, const int challengesize, - const unsigned char *secret, const int secsize) +new_key(const unsigned char *challenge, const size_t challengesize, + const unsigned char *secret, const size_t secsize) { struct _auth_chunk ho = {0}; unsigned long rc; - int keysize = sizeof(ho.data); + size_t keysize = sizeof(ho.data); if ((rc = hmac(secret, secsize, challenge, challengesize, &ho.data, &keysize))) { @@ -62,7 +85,7 @@ static struct _auth_chunk make_key(const char *userid, const char *password, const char *nonce, const unsigned char *secret, const int secsize, struct _auth_chunk (*fetch_key)(const unsigned char *chal, - const int csize)) + const size_t csize)) { struct _auth_chunk ho_chal, ho_key = {0}; @@ -88,21 +111,30 @@ make_key(const char *userid, const char *password, const char *nonce, } static struct _auth_obj -make_authobj(char *userid, char *password, char *nonce, - const unsigned char *secret, const int secsize, - const unsigned char *payload, const int paylsize) +make_authobj(const char *userid, const char *password, const char *nonce, + const unsigned char *secret, const size_t secsize, + const unsigned char *payload, const size_t paylsize) { struct _auth_obj ao = {0}; unsigned long rc; unsigned char *data; - int datasize; + size_t datasize; unsigned char datahash[HASHSIZE]; - int datahashsize = HASHSIZE; + size_t datahashsize = HASHSIZE; serializer_t srl; datasize = ((secsize + paylsize + HASHSIZE + 4 * sizeof(short) - 1) / CBLKSIZE + 1) * CBLKSIZE; data = alloca(datasize); + /* + We allocate memory rounded up to CBLKSIZE on the stack, but do not + use the last bytes. Stack protectors, if enabled, fill this memory + with `canary` value. Later, when encryption function is called, + stack protector detects that it tries to access "uninitialized + memory". Which, while technically true, is not an error. Still, + let us make stack protector happy by initializing the whole area: + */ + memset(data, 0, datasize); serial_init(&srl, data, datasize); if (serial_put(&srl, secret, secsize) != secsize) { ao.err = "authobj: serialization of secret failed"; @@ -146,11 +178,11 @@ make_authobj(char *userid, char *password, char *nonce, } static struct _auth_obj -parse_authobj(char *userid, char *password, char *nonce, +parse_authobj(const char *userid, const char *password, const char *nonce, const unsigned char *secret, const int secsize, const unsigned char *ablob, const int blobsize, struct _auth_chunk (*fetch_key)(const unsigned char *chal, - const int csize)) + const size_t csize)) { unsigned long rc; struct _auth_obj ao = {0}; @@ -167,9 +199,9 @@ parse_authobj(char *userid, char *password, char *nonce, } else { serializer_t srl; unsigned char myhash[HASHSIZE]; - int myhsize = HASHSIZE; + size_t myhsize = HASHSIZE; unsigned char *theirhash; - int theirhsize; + size_t theirhsize; unsigned long rc; serial_init(&srl, ao.buffer, blobsize); @@ -195,20 +227,24 @@ parse_authobj(char *userid, char *password, char *nonce, struct _auth_obj authobj(const char *userid, const char *password, const char *oldnonce, const char *newnonce, - const unsigned char *secret, const int secsize, - const unsigned char *payload, const int paylsize, - const unsigned char *ablob, const int blobsize, + const unsigned char *secret, const size_t secsize, + const unsigned char *payload, const size_t paylsize, + const unsigned char *ablob, const size_t blobsize, struct _auth_chunk (*fetch_key)(const unsigned char *chal, - const int csize)) + const size_t csize)) { - unsigned char *wsecret; + const unsigned char *wsecret; int wsecsize; - unsigned char *wpayload; + const unsigned char *wpayload; int wpaylsize; - struct _auth_obj old_ao; + struct _auth_obj old_ao = {0}; struct _auth_obj new_ao = {0}; if (!secret || !secsize || !payload) { + if (!ablob || !blobsize) { + new_ao.err = "authobj: previous data not supplied"; + return new_ao; + } old_ao = parse_authobj(userid, password, oldnonce, secret, secsize, ablob, blobsize, fetch_key);