From 6ecf81b16e601b92f67487cee2ef4c303f733b2e Mon Sep 17 00:00:00 2001 From: Damien Stuart Date: Sat, 2 Mar 2013 17:03:20 -0500 Subject: [PATCH] First round if refactoring to clean up header dependencies. --- client/fwknop.c | 28 +++++++++++++++++++++++----- client/fwknop_common.h | 1 + client/utils.h | 3 --- common/common.h | 1 + configure.ac | 2 +- lib/base64.c | 1 + lib/base64.h | 2 -- lib/cipher_funcs.c | 1 + lib/cipher_funcs.h | 2 +- lib/digest.c | 2 ++ lib/digest.h | 10 ---------- lib/fko.h | 15 ++++++--------- lib/fko_common.h | 6 ------ lib/fko_context.h | 4 ++++ lib/fko_encryption.c | 35 +++++++++++++++++++++++++++++++---- lib/fko_hmac.c | 17 +++++++++++++++-- lib/fko_util.c | 25 +------------------------ lib/fko_util.h | 2 -- lib/gpgme_funcs.h | 5 ++++- lib/md5.h | 3 ++- lib/rijndael.c | 1 + lib/rijndael.h | 3 +-- lib/sha1.h | 3 ++- lib/sha2.h | 5 ++++- server/access.c | 1 + server/incoming_spa.c | 1 + server/utils.h | 3 --- 27 files changed, 104 insertions(+), 78 deletions(-) diff --git a/client/fwknop.c b/client/fwknop.c index e77c76d2..861a76af 100644 --- a/client/fwknop.c +++ b/client/fwknop.c @@ -28,14 +28,20 @@ * ***************************************************************************** */ +#include "fko.h" #include "fwknop.h" #include "config_init.h" #include "spa_comm.h" #include "utils.h" #include "getpasswd.h" + +#include "digest.h" +#include "rijndael.h" + #include #include + /* prototypes */ static void get_keys(fko_ctx_t ctx, fko_cli_options_t *options, @@ -61,13 +67,14 @@ static void clean_exit(fko_ctx_t ctx, fko_cli_options_t *opts, int main(int argc, char **argv) { - fko_ctx_t ctx = NULL, ctx2 = NULL; + fko_ctx_t ctx = NULL; + fko_ctx_t ctx2 = NULL; int res; char *spa_data, *version; char access_buf[MAX_LINE_LEN] = {0}; char key[MAX_KEY_LEN+1] = {0}; char hmac_key[MAX_KEY_LEN+1] = {0}; - int key_len = 0, hmac_key_len = 0; + int key_len = 0, hmac_key_len = 0, enc_mode; FILE *key_gen_file_ptr = NULL; fko_cli_options_t options; @@ -402,6 +409,17 @@ main(int argc, char **argv) return(EXIT_FAILURE); } + /* Pull the encryption mode. + */ + res = fko_get_spa_encryption_mode(ctx, &enc_mode); + if(res != FKO_SUCCESS) + { + errmsg("fko_get_spa_encryption_mode", res); + fko_destroy(ctx); + fko_destroy(ctx2); + return(EXIT_FAILURE); + } + /* If gpg-home-dir is specified, we have to defer decrypting if we * use the fko_new_with_data() function because we need to set the * gpg home dir after the context is created, but before we attempt @@ -411,7 +429,7 @@ main(int argc, char **argv) * options, then decode it. */ res = fko_new_with_data(&ctx2, spa_data, NULL, - 0, ctx->encryption_mode, hmac_key, hmac_key_len); + 0, enc_mode, hmac_key, hmac_key_len); if(res != FKO_SUCCESS) { errmsg("fko_new_with_data", res); @@ -420,7 +438,7 @@ main(int argc, char **argv) return(EXIT_FAILURE); } - res = fko_set_spa_encryption_mode(ctx2, ctx->encryption_mode); + res = fko_set_spa_encryption_mode(ctx2, enc_mode); if(res != FKO_SUCCESS) { errmsg("fko_set_spa_encryption_mode", res); @@ -919,7 +937,7 @@ get_keys(fko_ctx_t ctx, fko_cli_options_t *options, { *hmac_key_len = fko_base64_decode(options->hmac_key_base64, (unsigned char *) options->hmac_key); - memcpy(hmac_key, options->hmac_key, SHA256_BLOCK_LEN); + memcpy(hmac_key, options->hmac_key, *hmac_key_len); use_hmac = 1; } else if (options->use_hmac) diff --git a/client/fwknop_common.h b/client/fwknop_common.h index 01915f1b..4367ae87 100644 --- a/client/fwknop_common.h +++ b/client/fwknop_common.h @@ -32,6 +32,7 @@ #define FWKNOP_COMMON_H #include "common.h" +#include "fko_limits.h" /* My Name and Version */ diff --git a/client/utils.h b/client/utils.h index 20a7512f..b3156fe4 100644 --- a/client/utils.h +++ b/client/utils.h @@ -42,7 +42,4 @@ int is_base64(const unsigned char *buf, const unsigned short int len); int set_file_perms(const char *file); int verify_file_perms_ownership(const char *file); -size_t strlcat(char *dst, const char *src, size_t siz); -size_t strlcpy(char *dst, const char *src, size_t siz); - #endif /* UTILS_H */ diff --git a/common/common.h b/common/common.h index 96ad4c41..f1205db2 100644 --- a/common/common.h +++ b/common/common.h @@ -100,6 +100,7 @@ #include "fko.h" #include "fko_limits.h" +#include "fko_util.h" /* Get our program version from VERSION (defined in config.h). */ diff --git a/configure.ac b/configure.ac index 79d352a8..a45a031e 100644 --- a/configure.ac +++ b/configure.ac @@ -11,7 +11,7 @@ AC_PREREQ(2.62) dnl Define our name, version and email. m4_define(my_package, [fwknop]) -m4_define(my_version, [2.0.4]) +m4_define(my_version, [2.5.0b]) m4_define(my_bug_email, [dstuart@dstuart.org]) AC_INIT(my_package, my_version, my_bug_email) diff --git a/lib/base64.c b/lib/base64.c index 9ae8fb8a..4dc50e79 100644 --- a/lib/base64.c +++ b/lib/base64.c @@ -31,6 +31,7 @@ ***************************************************************************** */ #include "base64.h" +#include "fko_common.h" static unsigned char map2[] = { diff --git a/lib/base64.h b/lib/base64.h index 85ab1f6d..5c449f77 100644 --- a/lib/base64.h +++ b/lib/base64.h @@ -31,8 +31,6 @@ #ifndef BASE64_H #define BASE64_H 1 -#include "fko_common.h" - /* Prototypes */ int b64_encode(unsigned char *in, char *out, int in_len); diff --git a/lib/cipher_funcs.c b/lib/cipher_funcs.c index 09fad5b5..2ea3aa14 100644 --- a/lib/cipher_funcs.c +++ b/lib/cipher_funcs.c @@ -39,6 +39,7 @@ #include #endif +#include "fko_common.h" #include "cipher_funcs.h" #include "digest.h" diff --git a/lib/cipher_funcs.h b/lib/cipher_funcs.h index 06d18359..151d4406 100644 --- a/lib/cipher_funcs.h +++ b/lib/cipher_funcs.h @@ -31,7 +31,7 @@ #ifndef CIPHER_FUNCS_H #define CIPHER_FUNCS_H 1 -#include "fko_common.h" +#include "fko.h" #include "rijndael.h" #include "gpgme_funcs.h" diff --git a/lib/digest.c b/lib/digest.c index 5eaaf851..4987d8ca 100644 --- a/lib/digest.c +++ b/lib/digest.c @@ -28,9 +28,11 @@ * ***************************************************************************** */ +#include "fko_common.h" #include "digest.h" #include "base64.h" + /* Convert a raw digest into its hex string representation. */ static void diff --git a/lib/digest.h b/lib/digest.h index 47162094..b948ac2d 100644 --- a/lib/digest.h +++ b/lib/digest.h @@ -31,8 +31,6 @@ #ifndef DIGEST_H #define DIGEST_H 1 -#include "fko_common.h" - #include "md5.h" #include "sha1.h" #include "sha2.h" @@ -41,14 +39,6 @@ */ #define MD_HEX_SIZE(x) x * 2 -/* Predefined base64 encoded digest sizes. -*/ -#define MD5_B64_LEN 22 -#define SHA1_B64_LEN 27 -#define SHA256_B64_LEN 43 -#define SHA384_B64_LEN 64 -#define SHA512_B64_LEN 86 - void md5(unsigned char* out, unsigned char* in, size_t size); void md5_hex(char* out, unsigned char* in, size_t size); void md5_base64(char* out, unsigned char* in, size_t size); diff --git a/lib/fko.h b/lib/fko.h index b3efe88c..4ef7eb31 100644 --- a/lib/fko.h +++ b/lib/fko.h @@ -33,9 +33,6 @@ #include -#include "rijndael.h" /* For encryption modes */ -#include "digest.h" - #ifdef __cplusplus extern "C" { #endif @@ -111,12 +108,12 @@ typedef enum { */ typedef enum { FKO_ENC_MODE_UNKNOWN = 0, - FKO_ENC_MODE_ECB = MODE_ECB, - FKO_ENC_MODE_CBC = MODE_CBC, - FKO_ENC_MODE_CFB = MODE_CFB, - FKO_ENC_MODE_PCBC = MODE_PCBC, - FKO_ENC_MODE_OFB = MODE_OFB, - FKO_ENC_MODE_CTR = MODE_CTR, + FKO_ENC_MODE_ECB, // = MODE_ECB, + FKO_ENC_MODE_CBC, // = MODE_CBC, + FKO_ENC_MODE_CFB, // = MODE_CFB, + FKO_ENC_MODE_PCBC, // = MODE_PCBC, + FKO_ENC_MODE_OFB, // = MODE_OFB, + FKO_ENC_MODE_CTR, // = MODE_CTR, FKO_ENC_MODE_ASYMMETRIC, /* placeholder when GPG is used */ FKO_ENC_MODE_CBC_LEGACY_IV, /* for the old zero-padding strategy */ FKO_LAST_ENC_MODE /* Always leave this as the last one */ diff --git a/lib/fko_common.h b/lib/fko_common.h index fdf3bb92..000cbfeb 100644 --- a/lib/fko_common.h +++ b/lib/fko_common.h @@ -126,12 +126,6 @@ #define END_C_DECLS #endif /* __cplusplus */ -/* Pull in gpgme.h if we have it. -*/ -#if HAVE_LIBGPGME - #include -#endif - #include "fko_util.h" #include "fko_limits.h" #include "fko_state.h" diff --git a/lib/fko_context.h b/lib/fko_context.h index e1401dec..fe248bd2 100644 --- a/lib/fko_context.h +++ b/lib/fko_context.h @@ -33,6 +33,10 @@ #include "fko_common.h" +#if HAVE_LIBGPGME + #include +#endif + #if HAVE_LIBGPGME /* Stucture to hold a list of the gpg signature information * we are interested in. diff --git a/lib/fko_encryption.c b/lib/fko_encryption.c index 0a7d1e6b..3d2db7e2 100644 --- a/lib/fko_encryption.c +++ b/lib/fko_encryption.c @@ -32,6 +32,7 @@ #include "fko.h" #include "cipher_funcs.h" #include "base64.h" +#include "digest.h" #if HAVE_LIBGPGME #include "gpgme_funcs.h" @@ -54,8 +55,21 @@ _rijndael_encrypt(fko_ctx_t ctx, const char *enc_key, const int enc_key_len) if (! is_valid_encoded_msg_len(ctx->encoded_msg_len)) return(FKO_ERROR_INVALID_DATA); - if (! is_valid_digest_len(ctx->digest_len)) - return(FKO_ERROR_INVALID_DATA); + switch(ctx->digest_len) + { + case MD5_B64_LEN: + break; + case SHA1_B64_LEN: + break; + case SHA256_B64_LEN: + break; + case SHA384_B64_LEN: + break; + case SHA512_B64_LEN: + break; + default: + return(FKO_ERROR_INVALID_DATA); + } pt_len = ctx->encoded_msg_len + ctx->digest_len + RIJNDAEL_BLOCKSIZE + 2; @@ -217,8 +231,21 @@ gpg_encrypt(fko_ctx_t ctx, const char *enc_key) if (! is_valid_encoded_msg_len(ctx->encoded_msg_len)) return(FKO_ERROR_INVALID_DATA); - if (! is_valid_digest_len(ctx->digest_len)) - return(FKO_ERROR_INVALID_DATA); + switch(ctx->digest_len) + { + case MD5_B64_LEN: + break; + case SHA1_B64_LEN: + break; + case SHA256_B64_LEN: + break; + case SHA384_B64_LEN: + break; + case SHA512_B64_LEN: + break; + default: + return(FKO_ERROR_INVALID_DATA); + } /* First make sure we have a recipient key set. */ diff --git a/lib/fko_hmac.c b/lib/fko_hmac.c index 32809385..ec90d44f 100644 --- a/lib/fko_hmac.c +++ b/lib/fko_hmac.c @@ -174,8 +174,21 @@ int fko_calculate_hmac(fko_ctx_t ctx, free(hmac_base64); - if(! is_valid_digest_len(ctx->msg_hmac_len)) - return(FKO_ERROR_INVALID_DATA); + switch(ctx->msg_hmac_len) + { + case MD5_B64_LEN: + break; + case SHA1_B64_LEN: + break; + case SHA256_B64_LEN: + break; + case SHA384_B64_LEN: + break; + case SHA512_B64_LEN: + break; + default: + return(FKO_ERROR_INVALID_DATA); + } return FKO_SUCCESS; } diff --git a/lib/fko_util.c b/lib/fko_util.c index e1ad9890..712feee5 100644 --- a/lib/fko_util.c +++ b/lib/fko_util.c @@ -30,6 +30,7 @@ */ #include "fko_common.h" #include "fko.h" +#include "fko_util.h" #include /* Validate encoded message length @@ -54,30 +55,6 @@ is_valid_pt_msg_len(const int len) return(1); } -/* Validate digest length -*/ -int -is_valid_digest_len(const int len) -{ - switch(len) - { - case MD5_B64_LEN: - break; - case SHA1_B64_LEN: - break; - case SHA256_B64_LEN: - break; - case SHA384_B64_LEN: - break; - case SHA512_B64_LEN: - break; - default: - return(0); - } - - return(1); -} - int strtol_wrapper(const char * const str, const int min, const int max, const int exit_upon_err, int *err) diff --git a/lib/fko_util.h b/lib/fko_util.h index e0017b2d..50721813 100644 --- a/lib/fko_util.h +++ b/lib/fko_util.h @@ -31,8 +31,6 @@ #ifndef FKO_UTIL_H #define FKO_UTIL_H 1 -#include "fko_common.h" - /* Function prototypes */ int is_valid_encoded_msg_len(const int len); diff --git a/lib/gpgme_funcs.h b/lib/gpgme_funcs.h index 557a968b..c8e30718 100644 --- a/lib/gpgme_funcs.h +++ b/lib/gpgme_funcs.h @@ -31,7 +31,10 @@ #ifndef GPGME_FUNCS_H #define GPGME_FUNCS_H 1 -#include "fko_common.h" +#if HAVE_LIBGPGME + #include +#endif + #include "fko.h" int gpgme_encrypt(fko_ctx_t ctx, unsigned char *in, size_t len, const char *pw, unsigned char **out, size_t *out_len); diff --git a/lib/md5.h b/lib/md5.h index e9113e85..b6acb99c 100644 --- a/lib/md5.h +++ b/lib/md5.h @@ -35,9 +35,10 @@ #ifndef MD5_H #define MD5_H 1 -#include "fko_common.h" +#include "common.h" #define MD5_DIGEST_LEN 16 +#define MD5_B64_LEN 22 typedef struct _MD5Context { uint32_t buf[4]; diff --git a/lib/rijndael.c b/lib/rijndael.c index 2d6e450b..9fb4954e 100644 --- a/lib/rijndael.c +++ b/lib/rijndael.c @@ -28,6 +28,7 @@ * ***************************************************************************** */ +#include "fko_common.h" #include "rijndael.h" #include #include diff --git a/lib/rijndael.h b/lib/rijndael.h index 691ce820..3837de80 100644 --- a/lib/rijndael.h +++ b/lib/rijndael.h @@ -33,11 +33,10 @@ * 128, 192, or 256 bits, designed by Joan Daemen and Vincent Rijmen. See * http://www.esat.kuleuven.ac.be/~rijmen/rijndael/ for details. */ - #ifndef RIJNDAEL_H #define RIJNDAEL_H 1 -#include "fko_common.h" +#include "common.h" /* Other block sizes and key lengths are possible, but in the context of * the ssh protocols, 256 bits is the default. diff --git a/lib/sha1.h b/lib/sha1.h index 85e5bbc0..dfa1e887 100644 --- a/lib/sha1.h +++ b/lib/sha1.h @@ -32,7 +32,7 @@ #ifndef SHA1_H #define SHA1_H 1 -#include "fko_common.h" +#include "common.h" #ifdef WIN32 #define BYTEORDER 1234 @@ -46,6 +46,7 @@ #define SHA1_BLOCKSIZE 64 #define SHA1_DIGEST_LEN 20 +#define SHA1_B64_LEN 27 typedef struct { uint32_t digest[8]; diff --git a/lib/sha2.h b/lib/sha2.h index ee4a2863..17801bab 100644 --- a/lib/sha2.h +++ b/lib/sha2.h @@ -43,7 +43,7 @@ extern "C" { #endif -#include "fko_common.h" +#include "common.h" /* * Import u_intXX_t size_t type definitions from system headers. You @@ -70,12 +70,15 @@ extern "C" { #define SHA256_BLOCK_LEN 64 #define SHA256_DIGEST_LEN 32 #define SHA256_DIGEST_STR_LEN (SHA256_DIGEST_LEN * 2 + 1) +#define SHA256_B64_LEN 43 #define SHA384_BLOCK_LEN 128 #define SHA384_DIGEST_LEN 48 #define SHA384_DIGEST_STR_LEN (SHA384_DIGEST_LEN * 2 + 1) +#define SHA384_B64_LEN 64 #define SHA512_BLOCK_LEN 128 #define SHA512_DIGEST_LEN 64 #define SHA512_DIGEST_STR_LEN (SHA512_DIGEST_LEN * 2 + 1) +#define SHA512_B64_LEN 86 /*** SHA-256/384/512 Context Structures *******************************/ diff --git a/server/access.c b/server/access.c index bf2726fe..d2d95e58 100644 --- a/server/access.c +++ b/server/access.c @@ -40,6 +40,7 @@ #include "access.h" #include "utils.h" #include "log_msg.h" +#include "rijndael.h" /* Add an access string entry */ diff --git a/server/incoming_spa.c b/server/incoming_spa.c index fa8b3041..bec59163 100644 --- a/server/incoming_spa.c +++ b/server/incoming_spa.c @@ -43,6 +43,7 @@ #include "fw_util.h" #include "fwknopd_errors.h" #include "replay_cache.h" +#include "rijndael.h" /* Validate and in some cases preprocess/reformat the SPA data. Return an * error code value if there is any indication the data is not valid spa data. diff --git a/server/utils.h b/server/utils.h index 1d4942ed..5ab8c6b1 100644 --- a/server/utils.h +++ b/server/utils.h @@ -64,7 +64,4 @@ int is_base64(const unsigned char *buf, const unsigned short int len); int is_valid_dir(const char *path); int verify_file_perms_ownership(const char *file); -size_t strlcat(char *dst, const char *src, size_t siz); -size_t strlcpy(char *dst, const char *src, size_t siz); - #endif /* UTILS_H */