Home | History | Annotate | Download | only in common
      1 /*
      2  * Copyright 2003 Sun Microsystems, Inc.  All rights reserved.
      3  * Use is subject to license terms.
      4  */
      5 /*
      6  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
      7  *
      8  * Redistribution and use in source and binary forms, with or without
      9  * modification, are permitted provided that the following conditions
     10  * are met:
     11  * 1. Redistributions of source code must retain the above copyright
     12  *    notice, this list of conditions and the following disclaimer.
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in the
     15  *    documentation and/or other materials provided with the distribution.
     16  *
     17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     27  */
     28 
     29 #include "includes.h"
     30 RCSID("$OpenBSD: mac.c,v 1.5 2002/05/16 22:02:50 markus Exp $");
     31 
     32 #pragma ident	"%Z%%M%	%I%	%E% SMI"
     33 
     34 #include <openssl/hmac.h>
     35 
     36 #include "xmalloc.h"
     37 #include "getput.h"
     38 #include "log.h"
     39 #include "cipher.h"
     40 #include "kex.h"
     41 #include "mac.h"
     42 
     43 struct {
     44 	char		*name;
     45 	const EVP_MD *	(*mdfunc)(void);
     46 	int		truncatebits;	/* truncate digest if != 0 */
     47 } macs[] = {
     48 	{ "hmac-sha1",			EVP_sha1, 0 },
     49 	{ "hmac-sha1-96",		EVP_sha1, 96 },
     50 	{ "hmac-md5",			EVP_md5, 0 },
     51 	{ "hmac-md5-96",		EVP_md5, 96 },
     52 #ifdef SOLARIS_SSH_ENABLE_RIPEMD160
     53 	{ "hmac-ripemd160",		EVP_ripemd160, 0 },
     54 	{ "hmac-ripemd160 (at) openssh.com",	EVP_ripemd160, 0 },
     55 #endif /* SOLARIS_SSH_ENABLE_RIPEMD160 */
     56 	{ NULL,				NULL, 0 }
     57 };
     58 
     59 int
     60 mac_init(Mac *mac, char *name)
     61 {
     62 	int i;
     63 	for (i = 0; macs[i].name; i++) {
     64 		if (strcmp(name, macs[i].name) == 0) {
     65 			if (mac != NULL) {
     66 				mac->md = (*macs[i].mdfunc)();
     67 				mac->key_len = mac->mac_len = EVP_MD_size(mac->md);
     68 				if (macs[i].truncatebits != 0)
     69 					mac->mac_len = macs[i].truncatebits/8;
     70 			}
     71 			debug2("mac_init: found %s", name);
     72 			return (0);
     73 		}
     74 	}
     75 	debug2("mac_init: unknown %s", name);
     76 	return (-1);
     77 }
     78 
     79 u_char *
     80 mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
     81 {
     82 	HMAC_CTX c;
     83 	static u_char m[EVP_MAX_MD_SIZE];
     84 	u_char b[4];
     85 
     86 	if (mac->key == NULL)
     87 		fatal("mac_compute: no key");
     88 	if (mac->mac_len > sizeof(m))
     89 		fatal("mac_compute: mac too long");
     90 	HMAC_Init(&c, mac->key, mac->key_len, mac->md);
     91 	PUT_32BIT(b, seqno);
     92 	HMAC_Update(&c, b, sizeof(b));
     93 	HMAC_Update(&c, data, datalen);
     94 	HMAC_Final(&c, m, NULL);
     95 	HMAC_cleanup(&c);
     96 	return (m);
     97 }
     98 
     99 /* XXX copied from ciphers_valid */
    100 #define	MAC_SEP	","
    101 int
    102 mac_valid(const char *names)
    103 {
    104 	char *maclist, *cp, *p;
    105 
    106 	if (names == NULL || strcmp(names, "") == 0)
    107 		return (0);
    108 	maclist = cp = xstrdup(names);
    109 	for ((p = strsep(&cp, MAC_SEP)); p && *p != '\0';
    110 	    (p = strsep(&cp, MAC_SEP))) {
    111 		if (mac_init(NULL, p) < 0) {
    112 			debug("bad mac %s [%s]", p, names);
    113 			xfree(maclist);
    114 			return (0);
    115 		} else {
    116 			debug3("mac ok: %s [%s]", p, names);
    117 		}
    118 	}
    119 	debug3("macs ok: [%s]", names);
    120 	xfree(maclist);
    121 	return (1);
    122 }
    123