diff --git a/Makefile b/Makefile index d6bd2c82..560f5a7c 100644 --- a/Makefile +++ b/Makefile @@ -31,7 +31,7 @@ AR = ar # "-DDEBUG to the BASE_CFLAGS arg. This should not be used on a # production build. # -BASE_CFLAGS = -Wall -fno-strict-aliasing +BASE_CFLAGS = -Wall #-fno-strict-aliasing # Uncomment one of these CFLAGS based on your needs # @@ -113,7 +113,7 @@ realclean: clean # Generate the dependencies for the sources in this current directory # while ignoring warnings. Note: If you don't have makedepend in your PATH, -# you will simple get a warning and noting will happen. +# you will simple get a warning and nothing will happen. # depend: @`which makedepend 2>/dev/null` -Y -- $(CFLAGS) -- $(ALLSRCS) 2> /dev/null \ diff --git a/base64.c b/base64.c index ba8c1eb3..4d2cff18 100644 --- a/base64.c +++ b/base64.c @@ -100,4 +100,15 @@ int b64_encode(uchar *in, char *out, int in_len) return(dst - out); } +/* Strip trailing equals ("=") charcters from a base64-encode + * message digest. +*/ +void strip_b64_eq(char *data) +{ + char *ndx; + + if((ndx = strchr(data, '=')) != NULL) + *ndx = '\0'; +} + /***EOF***/ diff --git a/base64.h b/base64.h index b32d56ff..feae929e 100644 --- a/base64.h +++ b/base64.h @@ -32,6 +32,7 @@ */ int b64_encode(uchar *in, char *out, int in_len); int b64_decode(char *in, uchar *out, int out_len); +void strip_b64_eq(char *data); #endif /* _BASE64_H_ */ diff --git a/cipher_funcs.c b/cipher_funcs.c index eef42ef7..066b03ac 100644 --- a/cipher_funcs.c +++ b/cipher_funcs.c @@ -69,13 +69,26 @@ void get_random_data(uint8 *data, int len) */ void salt_and_iv(RIJNDAEL_context *ctx, char *pass, uint8 *data) { - uint8 tmp_buf[64]; //--DSS do we limit pw size (pwlen + 8(salt))? + char pw_buf[16]; + uint8 tmp_buf[64]; /* How big does this need to be? */ uint8 kiv_buf[48]; /* Key and IV buffer */ uint8 md5_buf[16]; /* Buffer for computed md5 hash */ int kiv_len = 0; int plen = strlen(pass); + /* First make pw 16 bytes (pad with "0" (ascii 0x30)) or truncate. + * Note: pw_buf was initialized with '0' chars (again, not the value + * 0, but the digit '0' character). + */ + if(plen < 16) + { + memcpy(pw_buf, pass, plen); + memset(pw_buf+plen, '0', 16 - plen); + } + else + strncpy(pw_buf, pass, 16); + /* If we are decrypting, data will contain the salt. Otherwise, * for encryption, we generate a random salt. */ @@ -93,17 +106,18 @@ void salt_and_iv(RIJNDAEL_context *ctx, char *pass, uint8 *data) } /* Now generate the key and initialization vector. - * (again it is the perl Crypt::CBC way) + * (again it is the perl Crypt::CBC way, with a touch of + * fwknop). */ - memcpy(tmp_buf+16, pass, plen); - memcpy(tmp_buf+16+plen, ctx->salt, 8); + memcpy(tmp_buf+16, pw_buf, 16); + memcpy(tmp_buf+32, ctx->salt, 8); while(kiv_len < sizeof(kiv_buf)) { if(kiv_len == 0) - md5(md5_buf, tmp_buf+16, plen+8); + md5(md5_buf, tmp_buf+16, 24); else - md5(md5_buf, tmp_buf, 16+plen+8); + md5(md5_buf, tmp_buf, 40); memcpy(tmp_buf, md5_buf, 16); diff --git a/digest.c b/digest.c index 2c65db83..b7f12703 100644 --- a/digest.c +++ b/digest.c @@ -65,6 +65,8 @@ void md5_base64(char *out, uchar *in, int size) md5(md, in, size); b64_encode(md, out, MD5_DIGESTSIZE); + + strip_b64_eq(out); } /* Compute SHA1 hash on in and store result in out. @@ -96,6 +98,8 @@ void sha1_base64(char *out, uchar *in, int size) sha1(md, in, size); b64_encode(md, out, SHA1_DIGESTSIZE); + + strip_b64_eq(out); } /* Compute SHA256 hash on in and store the hex string result in out. @@ -128,6 +132,8 @@ void sha256_base64(char *out, uchar *in, int size) sha256(md, in, size); b64_encode(md, out, SHA256_DIGESTSIZE); + + strip_b64_eq(out); } diff --git a/fko_test.c b/fko_test.c index f2350eec..a887794f 100644 --- a/fko_test.c +++ b/fko_test.c @@ -33,7 +33,7 @@ int main(int argc, char **argv) /* Zero our SPA message struct. */ memset(&sm, 0x0, sizeof(spa_message_t)); - +#if 0 /********************************************************************* * Get a random 16-byte string of hex values. */ @@ -187,15 +187,17 @@ int main(int argc, char **argv) tst_string, tst_sha256_digest, sha256_digest ); - +#endif /********************************************************************* * Rijndael test. */ - char *pass = "bubba"; + char *pass = "BubbaWasHere"; char b64buf[1024] = {0}; uchar encbuf[1024] = {0}; uchar decbuf[1024] = {0}; + char tst_string[] = "This is a test."; + int len = strlen(tst_string); int enc_len, dec_len; @@ -217,6 +219,15 @@ int main(int argc, char **argv) ); + //char tst_dec[] = "U2FsdGVkX19GsvEbSbjzMs6uKLFBN8YsHiyqGn2hu26o7kDyT+74fq/rqd+c5SLZGEgZ3OrFX5ogEof2UOt3HcZG7IAO7YBLHDwfTb069O9rsN8uLYa/ABdDsRDd6X5Z1dwIlOBhqrpEQDHvThWWlqgXUOsg10zxXf0miy/4HmEDWJCEszq4WrZ2Jx2ymNCf"; + char tst_dec[] = "U2FsdGVkX188TWDKS1fJShJQF6ZzQJlUjbi5Byv45JVyjklRltN3DhRODCwc5/iY/lIFExA30Zwv0dkA4WG685X7UavFmf7grEoaeyZJhVyz1ycSp3IBCsL1h2QU7pocCIMHppuwkXnqpfqBNkCFiB26yq4xscxgFwGm8GQXAgvuYxepWPK67FWsyxdTW1OT"; + + int blen = b64_decode(tst_dec, encbuf, strlen(tst_dec)); +printf("BLEN: %i\n", blen); +hex_dump(encbuf, blen); + fko_decrypt(encbuf, blen, "BubbaWasHere", (uchar*)b64buf); + +printf("DSS TEST:\n%s\n", b64buf); return(0); } diff --git a/fwknop.c b/fwknop.c index f2823cd9..80e10c70 100644 --- a/fwknop.c +++ b/fwknop.c @@ -38,6 +38,8 @@ int main(int argc, char **argv) uchar spa_pkt_enc[1500] = {0}; // -DSS what is max size? char spa_pkt_b64[1500] = {0}; // -DSS what is max size? + char *spb64_p = spa_pkt_b64; + char *test_pw = "BubbaWasHere"; /* Initialize - this sets random, user, and other defaults. @@ -65,13 +67,25 @@ int main(int argc, char **argv) * I do not think we will do it this way in the end. :) */ sprintf(spa_pkt_raw, "%s:%s", sm.message, sm.digest); + + /* Encrypt it + */ enc_size = fko_encrypt((uchar*)spa_pkt_raw, strlen(spa_pkt_raw), test_pw, spa_pkt_enc); - b64_encode(spa_pkt_enc, spa_pkt_b64, enc_size); + + /* Base64 encode it and strip off trailing '='s + */ + b64_encode(spa_pkt_enc, spb64_p, enc_size); + strip_b64_eq(spb64_p); + + /* Remove the preceeding encoded "Salted__" string (if it is there). + */ + if(strncmp(spb64_p, "U2FsdGVkX1", 10) == 0) + spb64_p += 10; printf("Hexdump of encrypted data: (%i bytes)\n", enc_size); hex_dump(spa_pkt_enc, enc_size); - printf("Base64 version:\n\n%s\n\n", spa_pkt_b64); + printf("Base64 version:\n\n%s\n\n", spb64_p); return(0); } diff --git a/spa_message.c b/spa_message.c index 88269536..00df5f64 100644 --- a/spa_message.c +++ b/spa_message.c @@ -27,18 +27,18 @@ char* spa_message(spa_message_t *sm) { - char user_b64[1024] = {0}; - char msg_text[1024] = {0}; + char user_b64[64] = {0}; + char msg_text[128] = {0}; + char msg_b64[256] = {0}; b64_encode((uchar*)sm->user, user_b64, strlen(sm->user)); switch(sm->message_type) { case SPA_ACCESS_MSG: - sprintf(msg_text, "%s,%s,%u", + sprintf(msg_text, "%s,%s", sm->allow_ip, - sm->access_str, - sm->enc_pcap_port + sm->access_str ); break; @@ -53,13 +53,15 @@ char* spa_message(spa_message_t *sm) } + b64_encode((uchar*)msg_text, msg_b64, strlen(msg_text)); + sprintf(sm->message, "%s:%s:%u:%s:%u:%s", sm->rand_val, user_b64, sm->timestamp, sm->version, sm->message_type, - msg_text + msg_b64 ); // NOT DONE YET diff --git a/spa_random_number.c b/spa_random_number.c index 5ec29f43..f0168bff 100644 --- a/spa_random_number.c +++ b/spa_random_number.c @@ -30,6 +30,8 @@ char* spa_random_number(spa_message_t *sm) FILE *rfd; struct timeval tv; unsigned int seed; + unsigned long rnd; + char tmp_buf[RAND_VAL_SIZE+1] = {0}; /* Attempt to read seed data from /dev/urandom. If that does not * work, then fall back to a time-based method (less secure, but @@ -59,12 +61,13 @@ char* spa_random_number(spa_message_t *sm) srand(seed); - sprintf(sm->rand_val, "%04x%04x%04x%04x", - rand() % RAND_MASK, - rand() % RAND_MASK, - rand() % RAND_MASK, - rand() % RAND_MASK - ); + sprintf(sm->rand_val, "%u", rand()); + + while(strlen(sm->rand_val) < RAND_VAL_SIZE) + { + sprintf(tmp_buf, "%u", rand()); + strlcat(sm->rand_val, tmp_buf, RAND_VAL_SIZE+1); + } return(sm->rand_val); }