/*
- silcauth.c
+ silcauth.c
- Author: Pekka Riikonen <priikone@poseidon.pspt.fi>
+ Author: Pekka Riikonen <priikone@silcnet.org>
- Copyright (C) 2001 Pekka Riikonen
+ Copyright (C) 2001 - 2002 Pekka Riikonen
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
+ the Free Software Foundation; version 2 of the License.
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
return NULL;
/* Parse the payload */
- ret = silc_buffer_unformat(&buffer,
+ ret = silc_buffer_unformat(&buffer,
SILC_STR_UI_SHORT(&newp->len),
SILC_STR_UI_SHORT(&newp->auth_method),
SILC_STR_UI16_NSTRING_ALLOC(&newp->random_data,
return NULL;
}
- if (newp->len != buffer.len) {
+ if (newp->len != buffer.len ||
+ newp->random_len + newp->auth_len > buffer.len - 8) {
+ silc_auth_payload_free(newp);
+ return NULL;
+ }
+
+ /* Authentication data must be provided */
+ if (newp->auth_len < 1) {
silc_auth_payload_free(newp);
return NULL;
}
dictates. */
static unsigned char *
-silc_auth_public_key_encode_data(SilcPublicKey public_key,
- const unsigned char *random,
+silc_auth_public_key_encode_data(SilcPublicKey public_key,
+ const unsigned char *randomdata,
SilcUInt32 random_len, const void *id,
SilcIdType type, SilcUInt32 *ret_len)
{
return NULL;
}
silc_buffer_format(buf,
- SILC_STR_UI_XNSTRING(random, random_len),
+ SILC_STR_UI_XNSTRING(randomdata, random_len),
SILC_STR_UI_XNSTRING(id_data, id_len),
SILC_STR_UI_XNSTRING(pk, pk_len),
SILC_STR_END);
-
+
ret = silc_memdup(buf->data, buf->len);
if (!ret)
return NULL;
if (ret_len)
*ret_len = buf->len;
+ silc_buffer_clear(buf);
silc_buffer_free(buf);
silc_free(id_data);
silc_free(pk);
SilcRng rng, SilcHash hash,
const void *id, SilcIdType type)
{
- unsigned char *random;
- unsigned char auth_data[1024];
+ unsigned char *randomdata;
+ unsigned char auth_data[2048 + 1];
SilcUInt32 auth_len;
unsigned char *tmp;
SilcUInt32 tmp_len;
/* Get 256 bytes of random data */
if (rng)
- random = silc_rng_get_rn_data(rng, 256);
+ randomdata = silc_rng_get_rn_data(rng, 256);
else
- random = silc_rng_global_get_rn_data(256);
- if (!random)
+ randomdata = silc_rng_global_get_rn_data(256);
+ if (!randomdata)
return NULL;
-
+
/* Encode the auth data */
- tmp = silc_auth_public_key_encode_data(public_key, random, 256, id, type,
- &tmp_len);
+ tmp = silc_auth_public_key_encode_data(public_key, randomdata, 256, id,
+ type, &tmp_len);
if (!tmp)
return NULL;
/* Allocate PKCS object */
- if (!silc_pkcs_alloc(public_key->name, &pkcs)) {
+ if (!silc_pkcs_alloc(private_key->name, &pkcs)) {
memset(tmp, 0, tmp_len);
silc_free(tmp);
return NULL;
silc_pkcs_private_key_set(pkcs, private_key);
/* Compute the hash and the signature. */
- if (!silc_pkcs_sign_with_hash(pkcs, hash, tmp, tmp_len, auth_data,
+ if (silc_pkcs_get_key_len(pkcs) / 8 > sizeof(auth_data) - 1 ||
+ !silc_pkcs_sign_with_hash(pkcs, hash, tmp, tmp_len, auth_data,
&auth_len)) {
- memset(random, 0, 256);
+ memset(randomdata, 0, 256);
memset(tmp, 0, tmp_len);
silc_free(tmp);
- silc_free(random);
+ silc_free(randomdata);
silc_pkcs_free(pkcs);
return NULL;
}
/* Encode Authentication Payload */
- buf = silc_auth_payload_encode(SILC_AUTH_PUBLIC_KEY, random, 256,
+ buf = silc_auth_payload_encode(SILC_AUTH_PUBLIC_KEY, randomdata, 256,
auth_data, auth_len);
memset(tmp, 0, tmp_len);
memset(auth_data, 0, sizeof(auth_data));
- memset(random, 0, 256);
+ memset(randomdata, 0, 256);
silc_free(tmp);
- silc_free(random);
+ silc_free(randomdata);
silc_pkcs_free(pkcs);
return buf;
SILC_LOG_DEBUG(("Verifying authentication data"));
/* Encode auth data */
- tmp = silc_auth_public_key_encode_data(public_key, payload->random_data,
- payload->random_len,
+ tmp = silc_auth_public_key_encode_data(public_key, payload->random_data,
+ payload->random_len,
id, type, &tmp_len);
if (!tmp) {
SILC_LOG_DEBUG(("Authentication failed"));
bool silc_auth_public_key_auth_verify_data(const unsigned char *payload,
SilcUInt32 payload_len,
- SilcPublicKey public_key,
+ SilcPublicKey public_key,
SilcHash hash,
const void *id, SilcIdType type)
{
return FALSE;
}
- ret = silc_auth_public_key_auth_verify(auth_payload, public_key, hash,
+ ret = silc_auth_public_key_auth_verify(auth_payload, public_key, hash,
id, type);
silc_auth_payload_free(auth_payload);
return ret;
}
-/* Verifies the authentication data directly from the Authentication
+/* Verifies the authentication data directly from the Authentication
Payload. Supports all authentication methods. If the authentication
method is passphrase based then the `auth_data' and `auth_data_len'
are the passphrase and its length. If the method is public key
`auth_data_len' is ignored. */
bool silc_auth_verify(SilcAuthPayload payload, SilcAuthMethod auth_method,
- const void *auth_data, SilcUInt32 auth_data_len,
+ const void *auth_data, SilcUInt32 auth_data_len,
SilcHash hash, const void *id, SilcIdType type)
{
SILC_LOG_DEBUG(("Verifying authentication"));
- if (auth_method != payload->auth_method)
+ if (!payload || auth_method != payload->auth_method)
return FALSE;
switch (payload->auth_method) {
case SILC_AUTH_PASSWORD:
/* Passphrase based authentication. The `pkcs', `hash', `id' and `type'
arguments are not needed. */
+
+ /* Sanity checks */
+ if ((payload->auth_len == 0) || !auth_data ||
+ payload->auth_len != auth_data_len)
+ break;
+
if (!memcmp(payload->auth_data, auth_data, auth_data_len)) {
- SILC_LOG_DEBUG(("Authentication successful"));
+ SILC_LOG_DEBUG(("Passphrase Authentication successful"));
return TRUE;
}
break;
/* Same as above but parses the authentication payload before verify. */
-bool silc_auth_verify_data(const unsigned char *payload,
+bool silc_auth_verify_data(const unsigned char *payload,
SilcUInt32 payload_len,
SilcAuthMethod auth_method, const void *auth_data,
- SilcUInt32 auth_data_len, SilcHash hash,
+ SilcUInt32 auth_data_len, SilcHash hash,
const void *id, SilcIdType type)
{
SilcAuthPayload auth_payload;
- int ret;
+ bool ret;
auth_payload = silc_auth_payload_parse(payload, payload_len);
- if (!auth_payload)
+ if (!auth_payload || (auth_payload->auth_len == 0))
return FALSE;
- ret = silc_auth_verify(auth_payload, auth_method, auth_data, auth_data_len,
+ ret = silc_auth_verify(auth_payload, auth_method, auth_data, auth_data_len,
hash, id, type);
silc_auth_payload_free(auth_payload);
/* Parses and returns an allocated Key Agreement payload. */
-SilcKeyAgreementPayload
+SilcKeyAgreementPayload
silc_key_agreement_payload_parse(const unsigned char *payload,
SilcUInt32 payload_len)
{
return NULL;
/* Parse the payload */
- ret = silc_buffer_unformat(&buffer,
+ ret = silc_buffer_unformat(&buffer,
SILC_STR_UI16_NSTRING_ALLOC(&newp->hostname,
&newp->hostname_len),
SILC_STR_UI_INT(&newp->port),
projects / silc.git / blobdiff