DeforaNetworks/fwknop
DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

[libfko] move is_base64 check to libfko

Browse Source 
This commit replaces the separately implemented client/server
is_base64() check with a single libfko function, and libfko itself now
uses it as well before prepending Rijndael or GnuPG base64 encoded
prefixes.
This commit is contained in:
Michael Rash 2013-11-16 19:20:08 -05:00
parent 173b7518e1
commit 196fef65b6
10 changed files with 133 additions and 136 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
client/utils.c
View File

@ -95,27 +95,6 @@ hex_dump(const unsigned char *data, const int size)
}
}
/* Determine if a buffer contains only characters from the base64
* encoding set
*/
int
is_base64(const unsigned char *buf, const unsigned short int len)
{
unsigned short int i;
int rv = 1;
for(i=0; i<len; i++)
{
if(!(isalnum(buf[i]) || buf[i] == '/' || buf[i] == '+' || buf[i] == '='))
{
rv = 0;
break;
}
}
return rv;
}
int
verify_file_perms_ownership(const char *file)
{

1
client/utils.h
View File

@ -54,7 +54,6 @@
/* Prototypes
*/
void hex_dump(const unsigned char *data, const int size);
int is_base64(const unsigned char *buf, const unsigned short int len);
int set_file_perms(const char *file);
int verify_file_perms_ownership(const char *file);
int resolve_dest_adr(const char *dns_str, struct addrinfo *hints, char *ip_str, size_t ip_bufsize);

14
lib/cipher_funcs.c
View File

@ -331,6 +331,13 @@ add_salted_str(fko_ctx_t ctx)
{
char *tbuf;
/* We only add the base64 encoded salt to data that is already base64
* encoded
*/
if(is_base64((unsigned char *)ctx->encrypted_msg,
ctx->encrypted_msg_len) == 0)
return(FKO_ERROR_INVALID_DATA_ENCODE_NOTBASE64);
if(constant_runtime_cmp(ctx->encrypted_msg,
B64_RIJNDAEL_SALT, B64_RIJNDAEL_SALT_STR_LEN) != 0)
{
@ -367,6 +374,13 @@ add_gpg_prefix(fko_ctx_t ctx)
{
char *tbuf;
/* We only add the base64 encoded salt to data that is already base64
* encoded
*/
if(is_base64((unsigned char *)ctx->encrypted_msg,
ctx->encrypted_msg_len) == 0)
return(FKO_ERROR_INVALID_DATA_ENCODE_NOTBASE64);
if(constant_runtime_cmp(ctx->encrypted_msg,
B64_GPG_PREFIX, B64_GPG_PREFIX_STR_LEN) != 0)
{

1
lib/fko.h
View File

@ -173,6 +173,7 @@ typedef enum {
FKO_ERROR_INVALID_DATA_ENCODE_MSGLEN_VALIDFAIL,
FKO_ERROR_INVALID_DATA_ENCODE_DIGEST_VALIDFAIL,
FKO_ERROR_INVALID_DATA_ENCODE_DIGEST_TOOBIG,
FKO_ERROR_INVALID_DATA_ENCODE_NOTBASE64,
FKO_ERROR_INVALID_DATA_ENCRYPT_MSGLEN_VALIDFAIL,
FKO_ERROR_INVALID_DATA_ENCRYPT_DIGESTLEN_VALIDFAIL,
FKO_ERROR_INVALID_DATA_ENCRYPT_PTLEN_VALIDFAIL,

3
lib/fko_error.c
View File

@ -174,6 +174,9 @@ fko_errstr(const int err_code)
case FKO_ERROR_INVALID_DATA_ENCODE_DIGEST_TOOBIG:
return("Args contain invalid data: FKO_ERROR_INVALID_DATA_ENCODE_DIGEST_TOOBIG");
case FKO_ERROR_INVALID_DATA_ENCODE_NOTBASE64:
return("Args contain invalid data: FKO_ERROR_INVALID_DATA_ENCODE_NOTBASE64");
case FKO_ERROR_INVALID_DATA_ENCRYPT_MSGLEN_VALIDFAIL:
return("Args contain invalid data: FKO_ERROR_INVALID_DATA_ENCRYPT_MSGLEN_VALIDFAIL");

21
lib/fko_util.c
View File

@ -520,6 +520,27 @@ append_msg_to_buf(char *buf, size_t buf_size, const char* msg, ...)
return bytes_written;
}
/* Determine if a buffer contains only characters from the base64
* encoding set
*/
int
is_base64(const unsigned char * const buf, const unsigned short int len)
{
unsigned short int i;
int rv = 1;
for(i=0; i<len; i++)
{
if(!(isalnum(buf[i]) || buf[i] == '/' || buf[i] == '+' || buf[i] == '='))
{
rv = 0;
break;
}
}
return rv;
}
/**
* @brief Dump a FKO context to a buffer
*

1
lib/fko_util.h
View File

@ -38,6 +38,7 @@
int is_valid_encoded_msg_len(const int len);
int is_valid_pt_msg_len(const int len);
int is_valid_digest_len(const int len);
int is_base64(const unsigned char * const buf, const unsigned short int len);
int enc_mode_strtoint(const char *enc_mode_str);
short enc_mode_inttostr(int enc_mode, char* enc_mode_str, size_t enc_mode_size);
int strtol_wrapper(const char * const str, const int min,

185
perl/FKO/lib/FKO_Constants.pl
View File

@ -298,99 +298,100 @@ use constant {
FKO_ERROR_INVALID_DATA_ENCODE_MSGLEN_VALIDFAIL => 42,
FKO_ERROR_INVALID_DATA_ENCODE_DIGEST_VALIDFAIL => 43,
FKO_ERROR_INVALID_DATA_ENCODE_DIGEST_TOOBIG => 44,
FKO_ERROR_INVALID_DATA_ENCRYPT_MSGLEN_VALIDFAIL => 45,
FKO_ERROR_INVALID_DATA_ENCRYPT_DIGESTLEN_VALIDFAIL => 46,
FKO_ERROR_INVALID_DATA_ENCRYPT_PTLEN_VALIDFAIL => 47,
FKO_ERROR_INVALID_DATA_ENCRYPT_RESULT_MSGLEN_VALIDFAIL => 48,
FKO_ERROR_INVALID_DATA_ENCRYPT_CIPHERLEN_DECODEFAIL => 49,
FKO_ERROR_INVALID_DATA_ENCRYPT_CIPHERLEN_VALIDFAIL => 50,
FKO_ERROR_INVALID_DATA_ENCRYPT_DECRYPTED_MESSAGE_MISSING => 51,
FKO_ERROR_INVALID_DATA_ENCRYPT_DECRYPTED_MSGLEN_VALIDFAIL => 52,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_MESSAGE_VALIDFAIL => 53,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_DIGEST_VALIDFAIL => 54,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_MSGLEN_VALIDFAIL => 55,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_RESULT_MSGLEN_VALIDFAIL => 56,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_CIPHER_DECODEFAIL => 57,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_ENCODEDMSG_NULL => 58,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_ENCODEDMSGLEN_VALIDFAIL => 59,
FKO_ERROR_INVALID_DATA_ENCRYPT_TYPE_VALIDFAIL => 60,
FKO_ERROR_INVALID_DATA_ENCRYPT_MODE_VALIDFAIL => 61,
FKO_ERROR_INVALID_DATA_ENCRYPT_TYPE_UNKNOWN => 62,
FKO_ERROR_INVALID_DATA_FUNCS_NEW_ENCMSG_MISSING => 63,
FKO_ERROR_INVALID_DATA_FUNCS_NEW_MSGLEN_VALIDFAIL => 64,
FKO_ERROR_INVALID_DATA_FUNCS_GEN_KEYLEN_VALIDFAIL => 65,
FKO_ERROR_INVALID_DATA_FUNCS_GEN_HMACLEN_VALIDFAIL => 66,
FKO_ERROR_INVALID_DATA_FUNCS_GEN_KEY_ENCODEFAIL => 67,
FKO_ERROR_INVALID_DATA_FUNCS_GEN_HMAC_ENCODEFAIL => 68,
FKO_ERROR_INVALID_DATA_FUNCS_SET_MSGLEN_VALIDFAIL => 69,
FKO_ERROR_INVALID_DATA_HMAC_MSGLEN_VALIDFAIL => 70,
FKO_ERROR_INVALID_DATA_HMAC_ENCMSGLEN_VALIDFAIL => 71,
FKO_ERROR_INVALID_DATA_HMAC_COMPAREFAIL => 72,
FKO_ERROR_INVALID_DATA_HMAC_TYPE_VALIDFAIL => 73,
FKO_ERROR_INVALID_DATA_HMAC_LEN_VALIDFAIL => 74,
FKO_ERROR_INVALID_DATA_MESSAGE_PORT_MISSING => 75,
FKO_ERROR_INVALID_DATA_MESSAGE_TYPE_VALIDFAIL => 76,
FKO_ERROR_INVALID_DATA_MESSAGE_EMPTY => 77,
FKO_ERROR_INVALID_DATA_MESSAGE_CMD_MISSING => 78,
FKO_ERROR_INVALID_DATA_MESSAGE_ACCESS_MISSING => 79,
FKO_ERROR_INVALID_DATA_MESSAGE_NAT_MISSING => 80,
FKO_ERROR_INVALID_DATA_MESSAGE_PORTPROTO_MISSING => 81,
FKO_ERROR_INVALID_DATA_NAT_EMPTY => 82,
FKO_ERROR_INVALID_DATA_RAND_LEN_VALIDFAIL => 83,
FKO_ERROR_INVALID_DATA_SRVAUTH_MISSING => 84,
FKO_ERROR_INVALID_DATA_TIMESTAMP_VALIDFAIL => 85,
FKO_ERROR_INVALID_DATA_USER_MISSING => 86,
FKO_ERROR_INVALID_DATA_USER_FIRSTCHAR_VALIDFAIL => 87,
FKO_ERROR_INVALID_DATA_USER_REMCHAR_VALIDFAIL => 88,
FKO_ERROR_INVALID_DATA_UTIL_STRTOL_LT_MIN => 89,
FKO_ERROR_INVALID_DATA_UTIL_STROL_GT_MAX => 90,
FKO_ERROR_DATA_TOO_LARGE => 91,
FKO_ERROR_INVALID_KEY_LEN => 92,
FKO_ERROR_USERNAME_UNKNOWN => 93,
FKO_ERROR_INCOMPLETE_SPA_DATA => 94,
FKO_ERROR_MISSING_ENCODED_DATA => 95,
FKO_ERROR_INVALID_DIGEST_TYPE => 96,
FKO_ERROR_INVALID_ALLOW_IP => 97,
FKO_ERROR_INVALID_SPA_COMMAND_MSG => 98,
FKO_ERROR_INVALID_SPA_ACCESS_MSG => 99,
FKO_ERROR_INVALID_SPA_NAT_ACCESS_MSG => 100,
FKO_ERROR_INVALID_ENCRYPTION_TYPE => 101,
FKO_ERROR_WRONG_ENCRYPTION_TYPE => 102,
FKO_ERROR_DECRYPTION_SIZE => 103,
FKO_ERROR_DECRYPTION_FAILURE => 104,
FKO_ERROR_DIGEST_VERIFICATION_FAILED => 105,
FKO_ERROR_INVALID_HMAC_KEY_LEN => 106,
FKO_ERROR_UNSUPPORTED_HMAC_MODE => 107,
FKO_ERROR_UNSUPPORTED_FEATURE => 108,
FKO_ERROR_ZERO_OUT_DATA => 109,
FKO_ERROR_UNKNOWN => 110,
FKO_ERROR_INVALID_DATA_ENCODE_NOTBASE64 => 45,
FKO_ERROR_INVALID_DATA_ENCRYPT_MSGLEN_VALIDFAIL => 46,
FKO_ERROR_INVALID_DATA_ENCRYPT_DIGESTLEN_VALIDFAIL => 47,
FKO_ERROR_INVALID_DATA_ENCRYPT_PTLEN_VALIDFAIL => 48,
FKO_ERROR_INVALID_DATA_ENCRYPT_RESULT_MSGLEN_VALIDFAIL => 49,
FKO_ERROR_INVALID_DATA_ENCRYPT_CIPHERLEN_DECODEFAIL => 50,
FKO_ERROR_INVALID_DATA_ENCRYPT_CIPHERLEN_VALIDFAIL => 51,
FKO_ERROR_INVALID_DATA_ENCRYPT_DECRYPTED_MESSAGE_MISSING => 52,
FKO_ERROR_INVALID_DATA_ENCRYPT_DECRYPTED_MSGLEN_VALIDFAIL => 53,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_MESSAGE_VALIDFAIL => 54,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_DIGEST_VALIDFAIL => 55,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_MSGLEN_VALIDFAIL => 56,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_RESULT_MSGLEN_VALIDFAIL => 57,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_CIPHER_DECODEFAIL => 58,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_ENCODEDMSG_NULL => 59,
FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_ENCODEDMSGLEN_VALIDFAIL => 60,
FKO_ERROR_INVALID_DATA_ENCRYPT_TYPE_VALIDFAIL => 61,
FKO_ERROR_INVALID_DATA_ENCRYPT_MODE_VALIDFAIL => 62,
FKO_ERROR_INVALID_DATA_ENCRYPT_TYPE_UNKNOWN => 63,
FKO_ERROR_INVALID_DATA_FUNCS_NEW_ENCMSG_MISSING => 64,
FKO_ERROR_INVALID_DATA_FUNCS_NEW_MSGLEN_VALIDFAIL => 65,
FKO_ERROR_INVALID_DATA_FUNCS_GEN_KEYLEN_VALIDFAIL => 66,
FKO_ERROR_INVALID_DATA_FUNCS_GEN_HMACLEN_VALIDFAIL => 67,
FKO_ERROR_INVALID_DATA_FUNCS_GEN_KEY_ENCODEFAIL => 68,
FKO_ERROR_INVALID_DATA_FUNCS_GEN_HMAC_ENCODEFAIL => 69,
FKO_ERROR_INVALID_DATA_FUNCS_SET_MSGLEN_VALIDFAIL => 70,
FKO_ERROR_INVALID_DATA_HMAC_MSGLEN_VALIDFAIL => 71,
FKO_ERROR_INVALID_DATA_HMAC_ENCMSGLEN_VALIDFAIL => 72,
FKO_ERROR_INVALID_DATA_HMAC_COMPAREFAIL => 73,
FKO_ERROR_INVALID_DATA_HMAC_TYPE_VALIDFAIL => 74,
FKO_ERROR_INVALID_DATA_HMAC_LEN_VALIDFAIL => 75,
FKO_ERROR_INVALID_DATA_MESSAGE_PORT_MISSING => 76,
FKO_ERROR_INVALID_DATA_MESSAGE_TYPE_VALIDFAIL => 77,
FKO_ERROR_INVALID_DATA_MESSAGE_EMPTY => 78,
FKO_ERROR_INVALID_DATA_MESSAGE_CMD_MISSING => 79,
FKO_ERROR_INVALID_DATA_MESSAGE_ACCESS_MISSING => 80,
FKO_ERROR_INVALID_DATA_MESSAGE_NAT_MISSING => 81,
FKO_ERROR_INVALID_DATA_MESSAGE_PORTPROTO_MISSING => 82,
FKO_ERROR_INVALID_DATA_NAT_EMPTY => 83,
FKO_ERROR_INVALID_DATA_RAND_LEN_VALIDFAIL => 84,
FKO_ERROR_INVALID_DATA_SRVAUTH_MISSING => 85,
FKO_ERROR_INVALID_DATA_TIMESTAMP_VALIDFAIL => 86,
FKO_ERROR_INVALID_DATA_USER_MISSING => 87,
FKO_ERROR_INVALID_DATA_USER_FIRSTCHAR_VALIDFAIL => 88,
FKO_ERROR_INVALID_DATA_USER_REMCHAR_VALIDFAIL => 89,
FKO_ERROR_INVALID_DATA_UTIL_STRTOL_LT_MIN => 90,
FKO_ERROR_INVALID_DATA_UTIL_STROL_GT_MAX => 91,
FKO_ERROR_DATA_TOO_LARGE => 92,
FKO_ERROR_INVALID_KEY_LEN => 93,
FKO_ERROR_USERNAME_UNKNOWN => 94,
FKO_ERROR_INCOMPLETE_SPA_DATA => 95,
FKO_ERROR_MISSING_ENCODED_DATA => 96,
FKO_ERROR_INVALID_DIGEST_TYPE => 97,
FKO_ERROR_INVALID_ALLOW_IP => 98,
FKO_ERROR_INVALID_SPA_COMMAND_MSG => 99,
FKO_ERROR_INVALID_SPA_ACCESS_MSG => 100,
FKO_ERROR_INVALID_SPA_NAT_ACCESS_MSG => 101,
FKO_ERROR_INVALID_ENCRYPTION_TYPE => 102,
FKO_ERROR_WRONG_ENCRYPTION_TYPE => 103,
FKO_ERROR_DECRYPTION_SIZE => 104,
FKO_ERROR_DECRYPTION_FAILURE => 105,
FKO_ERROR_DIGEST_VERIFICATION_FAILED => 106,
FKO_ERROR_INVALID_HMAC_KEY_LEN => 107,
FKO_ERROR_UNSUPPORTED_HMAC_MODE => 108,
FKO_ERROR_UNSUPPORTED_FEATURE => 109,
FKO_ERROR_ZERO_OUT_DATA => 110,
FKO_ERROR_UNKNOWN => 111,
# Start GPGME-related errors
GPGME_ERR_START => 111,
FKO_ERROR_MISSING_GPG_KEY_DATA => 112,
FKO_ERROR_GPGME_NO_OPENPGP => 113,
FKO_ERROR_GPGME_CONTEXT => 114,
FKO_ERROR_GPGME_PLAINTEXT_DATA_OBJ => 115,
FKO_ERROR_GPGME_SET_PROTOCOL => 116,
FKO_ERROR_GPGME_CIPHER_DATA_OBJ => 117,
FKO_ERROR_GPGME_BAD_PASSPHRASE => 118,
FKO_ERROR_GPGME_ENCRYPT_SIGN => 119,
FKO_ERROR_GPGME_CONTEXT_SIGNER_KEY => 120,
FKO_ERROR_GPGME_SIGNER_KEYLIST_START => 121,
FKO_ERROR_GPGME_SIGNER_KEY_NOT_FOUND => 122,
FKO_ERROR_GPGME_SIGNER_KEY_AMBIGUOUS => 123,
FKO_ERROR_GPGME_ADD_SIGNER => 124,
FKO_ERROR_GPGME_CONTEXT_RECIPIENT_KEY => 125,
FKO_ERROR_GPGME_RECIPIENT_KEYLIST_START => 126,
FKO_ERROR_GPGME_RECIPIENT_KEY_NOT_FOUND => 127,
FKO_ERROR_GPGME_RECIPIENT_KEY_AMBIGUOUS => 128,
FKO_ERROR_GPGME_DECRYPT_FAILED => 129,
FKO_ERROR_GPGME_DECRYPT_UNSUPPORTED_ALGORITHM => 130,
FKO_ERROR_GPGME_BAD_GPG_EXE => 131,
FKO_ERROR_GPGME_BAD_HOME_DIR => 132,
FKO_ERROR_GPGME_SET_HOME_DIR => 133,
FKO_ERROR_GPGME_NO_SIGNATURE => 134,
FKO_ERROR_GPGME_BAD_SIGNATURE => 135,
FKO_ERROR_GPGME_SIGNATURE_VERIFY_DISABLED => 136,
GPGME_ERR_START => 112,
FKO_ERROR_MISSING_GPG_KEY_DATA => 113,
FKO_ERROR_GPGME_NO_OPENPGP => 114,
FKO_ERROR_GPGME_CONTEXT => 115,
FKO_ERROR_GPGME_PLAINTEXT_DATA_OBJ => 116,
FKO_ERROR_GPGME_SET_PROTOCOL => 117,
FKO_ERROR_GPGME_CIPHER_DATA_OBJ => 118,
FKO_ERROR_GPGME_BAD_PASSPHRASE => 119,
FKO_ERROR_GPGME_ENCRYPT_SIGN => 120,
FKO_ERROR_GPGME_CONTEXT_SIGNER_KEY => 121,
FKO_ERROR_GPGME_SIGNER_KEYLIST_START => 122,
FKO_ERROR_GPGME_SIGNER_KEY_NOT_FOUND => 123,
FKO_ERROR_GPGME_SIGNER_KEY_AMBIGUOUS => 124,
FKO_ERROR_GPGME_ADD_SIGNER => 125,
FKO_ERROR_GPGME_CONTEXT_RECIPIENT_KEY => 126,
FKO_ERROR_GPGME_RECIPIENT_KEYLIST_START => 127,
FKO_ERROR_GPGME_RECIPIENT_KEY_NOT_FOUND => 128,
FKO_ERROR_GPGME_RECIPIENT_KEY_AMBIGUOUS => 129,
FKO_ERROR_GPGME_DECRYPT_FAILED => 130,
FKO_ERROR_GPGME_DECRYPT_UNSUPPORTED_ALGORITHM => 131,
FKO_ERROR_GPGME_BAD_GPG_EXE => 132,
FKO_ERROR_GPGME_BAD_HOME_DIR => 133,
FKO_ERROR_GPGME_SET_HOME_DIR => 134,
FKO_ERROR_GPGME_NO_SIGNATURE => 135,
FKO_ERROR_GPGME_BAD_SIGNATURE => 136,
FKO_ERROR_GPGME_SIGNATURE_VERIFY_DISABLED => 137,
};
1;

21
server/utils.c
View File

@ -161,25 +161,4 @@ verify_file_perms_ownership(const char *file)
return res;
}
/* Determine if a buffer contains only characters from the base64
* encoding set
*/
int
is_base64(const unsigned char *buf, const unsigned short int len)
{
unsigned short int i;
int rv = 1;
for(i=0; i<len; i++)
{
if(!(isalnum(buf[i]) || buf[i] == '/' || buf[i] == '+' || buf[i] == '='))
{
rv = 0;
break;
}
}
return rv;
}
/***EOF***/

1
server/utils.h
View File

@ -58,7 +58,6 @@
*/
void hex_dump(const unsigned char *data, const int size);
char* dump_ctx(fko_ctx_t ctx);
int is_base64(const unsigned char *buf, const unsigned short int len);
int is_valid_dir(const char *path);
int verify_file_perms_ownership(const char *file);