From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Sat, 12 May 2001 23:37:30 +0000 (+0000)
Subject: added support for Tom Wu's srp library tpasswd and tpasswd.conf files.
X-Git-Tag: gnutls-0_1_2~12
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1f82dcebc94b53bef986f0f8d67587f7106aa2ff;p=thirdparty%2Fgnutls.git

added support for Tom Wu's srp library tpasswd and tpasswd.conf files.
---

diff --git a/configure.in b/configure.in
index 6ea4a4e0b1..7364e6fcf2 100644
--- a/configure.in
+++ b/configure.in
@@ -109,13 +109,14 @@ if test $ac_cv_prog_gcc != no; then
 
 	if test $opt_profiler_mode = yes; then
 	  CFLAGS="${CFLAGS} -O0 -fprofile-arcs -ftest-coverage -pg"
-	else
-	  CFLAGS="${CFLAGS} -O2 -ffast-math"
 	fi
-		
+
 	if test $opt_maintainer_mode = yes; then
-	  CFLAGS="${CFLAGS} -ggdb3 -Wall -Wpointer-arith"
+	  CFLAGS="${CFLAGS} -O0 -ggdb3 -Wall -Wpointer-arith"
+	else
+	  CFLAGS="${CFLAGS} -O2"
 	fi
+
 	if test $opt_dmalloc_mode = yes; then
 	  AC_CHECK_LIB( dmalloc, main)
 	  AC_DEFINE(USE_DMALLOC)
diff --git a/lib/Makefile.am b/lib/Makefile.am
index 5e6f6ed319..f07f40a1cc 100644
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -15,5 +15,5 @@ libgnutls_la_SOURCES = gnutls.c gnutls_compress.c debug.c gnutls_plaintext.c \
 	gnutls_compress_int.c gnutls_session.c gnutls_db.c cert_b64.c \
 	auth_anon.c auth_dhe_dss.c gnutls_extensions.c ext_srp.c gnutls_auth.c \
 	crypt_bcrypt.c crypt.c gnutls_random.c crypt_srpsha1.c gnutls_srp.c \
-	auth_srp.c auth_srp_passwd.c gnutls_v2_compat.c
+	auth_srp.c auth_srp_passwd.c gnutls_v2_compat.c cert_sb64.c
 libgnutls_la_LDFLAGS = -version-info $(LT_CURRENT):$(LT_REVISION):$(LT_AGE)
diff --git a/lib/auth_srp.c b/lib/auth_srp.c
index ca65f1504c..a150e76cfc 100644
--- a/lib/auth_srp.c
+++ b/lib/auth_srp.c
@@ -331,7 +331,7 @@ int proc_srp_server_kx(GNUTLS_KEY key, opaque * data, int data_size)
 	}
 
 	gnutls_free(hd);
-	
+
 	return 0;
 }
 
diff --git a/lib/auth_srp.h b/lib/auth_srp.h
index 4e6dd7b2de..99f73aff1b 100644
--- a/lib/auth_srp.h
+++ b/lib/auth_srp.h
@@ -8,4 +8,5 @@ typedef struct {
 
 typedef struct {
 	char* password_file;
+	char* password_conf_file;
 } SRP_SERVER_CREDENTIALS;
diff --git a/lib/auth_srp_passwd.c b/lib/auth_srp_passwd.c
index 06573a9b63..119cde8b49 100644
--- a/lib/auth_srp_passwd.c
+++ b/lib/auth_srp_passwd.c
@@ -31,37 +31,37 @@
 #include "gnutls_random.h"
 #include "debug.h"
 
+/* this function parses tpasswd.conf file. Format is:
+ * string(username):base64(v):base64(salt):int(index)
+ */
 static int pwd_put_values( GNUTLS_SRP_PWD_ENTRY *entry, char *str, int str_size) {
 char * p;
 int len;
 opaque *verifier;
 int verifier_size;
-opaque * tmp;
-int tmp_size;
+int index;
 
-	p = rindex( str, '$'); /* we have n */
-	if (p==NULL) return -1;
+	entry->algorithm = SRPSHA1_CRYPT;
+	
+	p = rindex( str, ':'); /* we have index */
+	if (p==NULL) {
+		gnutls_assert();
+		return GNUTLS_E_PARSING_ERROR;
+	}
 	
 	*p='\0';
 	p++;
-	
+
 	len = strlen(p);
-	tmp_size = _gnutls_base64_decode( p, len, &tmp);
-	if (tmp_size < 0) {
-		gnutls_free(tmp);
-		return GNUTLS_E_PARSING_ERROR;
-	}
-	if (gcry_mpi_scan(&entry->n, GCRYMPI_FMT_USG, tmp, &tmp_size)) {
+	index = atoi(p);
+	if (index==0) {
 		gnutls_assert();
-		gnutls_free(tmp);
-		return GNUTLS_E_MPI_SCAN_FAILED;
+		return GNUTLS_E_PARSING_ERROR;
 	}
-	gnutls_free(tmp);
-
-	/* now go for g */
-	p = rindex( str, '$'); /* we have g */
+	
+	/* now go for salt */
+	p = rindex( str, ':'); /* we have salt */
 	if (p==NULL) {
-		mpi_release(entry->n);
 		gnutls_assert();
 		return GNUTLS_E_PARSING_ERROR;
 	}
@@ -70,28 +70,17 @@ int tmp_size;
 	p++;
 	
 	len = strlen(p);
-	tmp_size = _gnutls_base64_decode( p, len, &tmp);
+	entry->salt_size = _gnutls_sbase64_decode( p, len, &entry->salt);
 
-	if (tmp_size < 0) {
+	if (entry->salt_size <= 0) {
 		gnutls_assert();
-		mpi_release(entry->n);
-		gnutls_free(tmp);
 		return GNUTLS_E_PARSING_ERROR;
 	}
-	if (gcry_mpi_scan(&entry->g, GCRYMPI_FMT_USG, tmp, &tmp_size)) {
-		gnutls_assert();
-		gnutls_free(tmp);
-		mpi_release(entry->n);
-		return GNUTLS_E_MPI_SCAN_FAILED;
-	}
-
-	gnutls_free(tmp);
 
 	/* now go for verifier */
-	p = rindex( str, '$'); /* we have verifier */
+	p = rindex( str, ':'); /* we have verifier */
 	if (p==NULL) {
-		mpi_release(entry->n);
-		mpi_release(entry->g);
+		gnutls_free(entry->salt);
 		return GNUTLS_E_PARSING_ERROR;
 	}
 	
@@ -99,80 +88,141 @@ int tmp_size;
 	p++;
 	
 	len = strlen(p);
-	verifier_size = _gnutls_base64_decode( p, len, &verifier);
-	if (verifier_size < 0) {
+	verifier_size = _gnutls_sbase64_decode( p, len, &verifier);
+	if (verifier_size <= 0) {
 		gnutls_assert();
-		mpi_release(entry->n);
-		mpi_release(entry->g);
+		gnutls_free(entry->salt);
 		return GNUTLS_E_PARSING_ERROR;
 	}
 
 	if (gcry_mpi_scan(&entry->v, GCRYMPI_FMT_USG, verifier, &verifier_size)) {
 		gnutls_assert();
-		mpi_release(entry->n);
-		mpi_release(entry->g);
+		gnutls_free(entry->salt);
 		return GNUTLS_E_MPI_SCAN_FAILED;
 	}
 
 
-	/* now go for salt */
-	p = rindex( str, '$'); /* we have salt */
+	/* now go for username */
+	*p='\0';
+
+	entry->username = strdup(str);
+
+	return index;
+}
+
+
+/* this function parses tpasswd.conf file. Format is:
+ * int(index):base64(n):int(g)
+ */
+static int pwd_put_values2( GNUTLS_SRP_PWD_ENTRY *entry, char *str, int str_size) {
+char * p;
+int len;
+opaque * tmp;
+int tmp_size;
+
+	p = rindex( str, ':'); /* we have g */
 	if (p==NULL) {
-		mpi_release(entry->n);
-		mpi_release(entry->g);
-		mpi_release(entry->v);
-		return -1;
+		gnutls_assert();
+		return GNUTLS_E_PARSING_ERROR;
 	}
 	
 	*p='\0';
 	p++;
-
+	
+	/* read the generator */
 	len = strlen(p);
-	entry->salt_size = _gnutls_base64_decode( p, len, &entry->salt);
-	if (entry->salt_size < 0) {
+	tmp_size = _gnutls_sbase64_decode( p, len, &tmp);
+
+	if (tmp_size < 0) {
 		gnutls_assert();
-		mpi_release(entry->n);
-		mpi_release(entry->v);
-		mpi_release(entry->g);
+		gnutls_free(tmp);
+		return GNUTLS_E_PARSING_ERROR;
+	}
+	if (gcry_mpi_scan(&entry->g, GCRYMPI_FMT_USG, tmp, &tmp_size)) {
+		gnutls_assert();
+		gnutls_free(tmp);
+		return GNUTLS_E_MPI_SCAN_FAILED;
 	}
 
-	/* now go for algorithm */
-	p = rindex( str, '$'); /* we have algorithm */
+	gnutls_free(tmp);
+
+
+	/* now go for n - modulo */
+	p = rindex( str, ':'); /* we have n */
 	if (p==NULL) {
-		mpi_release(entry->n);
 		mpi_release(entry->g);
-		mpi_release(entry->v);
-		gnutls_free(entry->salt);
-		return -1;
+		gnutls_assert();
+		return GNUTLS_E_PARSING_ERROR;
 	}
 	
 	*p='\0';
 	p++;
+	
+	len = strlen(p);
+	tmp_size = _gnutls_sbase64_decode( p, len, &tmp);
 
-	entry->algorithm = atoi(p);
-
-	/* now go for username */
-	p = index( str, ':'); /* we have algorithm */
-	if (p==NULL) {
-		mpi_release(entry->n);
+	if (tmp_size < 0) {
+		gnutls_assert();
 		mpi_release(entry->g);
-		mpi_release(entry->v);
-		gnutls_free(entry->salt);
+		gnutls_free(tmp);
 		return GNUTLS_E_PARSING_ERROR;
 	}
-	*p='\0';
+	if (gcry_mpi_scan(&entry->n, GCRYMPI_FMT_USG, tmp, &tmp_size)) {
+		gnutls_assert();
+		gnutls_free(tmp);
+		mpi_release(entry->g);
+		return GNUTLS_E_MPI_SCAN_FAILED;
+	}
 
-	entry->username = strdup(p);
+	gnutls_free(tmp);
 
 	return 0;
 }
 
+
+/* this function opens the tpasswd.conf file
+ */
+static int pwd_read_conf( SRP_SERVER_CREDENTIALS* cred, GNUTLS_SRP_PWD_ENTRY* entry, int index) {
+	FILE * fd;
+	char line[5*1024];
+	int i;
+	char indexstr[10];
+
+	sprintf( indexstr, "%d", index);
+
+	fd = fopen( cred->password_conf_file, "r");
+	if (fd==NULL) {
+		gnutls_assert();
+		gnutls_free(entry);
+		return GNUTLS_E_PWD_ERROR;
+	}
+
+	while( fgets( line, sizeof(line), fd) != NULL) {
+    /* move to first ':' */
+	    i=0;
+	    while( (line[i]!=':') && (line[i]!='\0') && (i < sizeof(line)) ) {
+	            i++;
+	    }
+	    if (strncmp( indexstr, line, i) == 0) {
+			if ((index = pwd_put_values2( entry, line, strlen(line))) >= 0)
+				return 0;
+			else {
+				return GNUTLS_E_PWD_ERROR;
+			}
+	    }
+    }
+    return GNUTLS_E_PWD_ERROR;
+	
+}
+
+
 GNUTLS_SRP_PWD_ENTRY *_gnutls_srp_pwd_read_entry( GNUTLS_KEY key, char* username) {
 	SRP_SERVER_CREDENTIALS* cred;
 	FILE * fd;
 	char line[5*1024];
 	int i;
 	GNUTLS_SRP_PWD_ENTRY * entry = gnutls_malloc(sizeof(GNUTLS_SRP_PWD_ENTRY));
+	int index;
 
 	cred = _gnutls_get_kx_cred( key, GNUTLS_KX_SRP, NULL);
 	if (cred==NULL) {
@@ -195,8 +245,13 @@ GNUTLS_SRP_PWD_ENTRY *_gnutls_srp_pwd_read_entry( GNUTLS_KEY key, char* username
 	            i++;
 	    }
 	    if (strncmp( username, line, i) == 0) {
-			if (pwd_put_values( entry, line, strlen(line))==0)
-				return entry;
+			if ((index = pwd_put_values( entry, line, strlen(line))) >= 0)
+				if (pwd_read_conf( cred, entry, index)==0) {
+					return entry;
+				} else {
+					gnutls_free(entry);
+					return NULL;
+				}
 			else {
 				gnutls_free(entry);
 				return NULL;
diff --git a/lib/cert_b64.c b/lib/cert_b64.c
index d905954a71..f9a80b88fa 100644
--- a/lib/cert_b64.c
+++ b/lib/cert_b64.c
@@ -20,7 +20,6 @@
 
 #include "defines.h"
 #include "gnutls_int.h"
-#define gnutls_free free
 
 const static uint8 b64table[64] =
     "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
diff --git a/lib/cert_b64.h b/lib/cert_b64.h
index 58d4353044..d69b6f273c 100644
--- a/lib/cert_b64.h
+++ b/lib/cert_b64.h
@@ -4,3 +4,5 @@ int _gnutls_fbase64_encode(char *msg, uint8 * data, int data_size,
 int _gnutls_base64_decode(uint8 * data, int data_size, uint8 ** result);
 int _gnutls_fbase64_decode(char *msg, uint8 * data, int data_size,
 			   uint8 ** result);
+int _gnutls_sbase64_encode(uint8 * data, int data_size, uint8 ** result);
+int _gnutls_sbase64_decode(uint8 * data, int data_size, uint8 ** result);
diff --git a/lib/debug.c b/lib/debug.c
index c5b0e1674a..ffc1eb6756 100644
--- a/lib/debug.c
+++ b/lib/debug.c
@@ -30,10 +30,10 @@ void _gnutls_dump_mpi(char* prefix, MPI a)
 {
 	char buf[400];
 	size_t n = sizeof buf;
-
+	
 	if (gcry_mpi_print(GCRYMPI_FMT_HEX, buf, &n, a))
 		strcpy(buf, "[can't print value]");
-	fprintf(stderr, "MPI: %s%s\n", prefix, buf);
+	fprintf(stderr, "MPI: length: %d\n\t%s%s\n", (n-1)/2, prefix, buf);
 }
 
 
diff --git a/lib/gnutls.h b/lib/gnutls.h
index 568fcc59b4..b40301c068 100644
--- a/lib/gnutls.h
+++ b/lib/gnutls.h
@@ -114,6 +114,7 @@ typedef struct {
 
 typedef struct {
 	char* password_file;
+	char* password_conf_file;
 } SRP_SERVER_CREDENTIALS;
 
 
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index 7cd7cd20f2..6320925dab 100644
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -28,8 +28,8 @@
 #define BUFFERS_DEBUG
 #define HANDSHAKE_DEBUG
 #define HARD_DEBUG
-#define DEBUG
 */
+#define DEBUG
 
 #define MAX32 4294967295
 #define MAX24 16777215
diff --git a/lib/gnutls_srp.c b/lib/gnutls_srp.c
index 35fbb0f5f5..c0a87b2aa1 100644
--- a/lib/gnutls_srp.c
+++ b/lib/gnutls_srp.c
@@ -63,13 +63,13 @@ int _gnutls_srp_gx(opaque *text, int textsize, opaque** result, opaque** ret_g,
 	if (gcry_mpi_scan(&prime, GCRYMPI_FMT_USG,
 			  diffie_hellman_group1_prime, &n)) {
 		gnutls_assert();
-		return -1;
+		return GNUTLS_E_MPI_SCAN_FAILED;
 	}
 	if (gcry_mpi_scan(&x, GCRYMPI_FMT_USG,
 			  text, &textsize)) {
 		gnutls_assert();
 		gcry_mpi_release(prime);
-		return -1;
+		return GNUTLS_E_MPI_SCAN_FAILED;
 	}
 
 	g = gcry_mpi_set_ui(NULL, SRP_G);
@@ -80,6 +80,7 @@ int _gnutls_srp_gx(opaque *text, int textsize, opaque** result, opaque** ret_g,
 	gcry_mpi_powm(e, g, x, prime);
 	gcry_mpi_release(x);
 
+	
 	gcry_mpi_print(GCRYMPI_FMT_USG, NULL, &result_size, e);
 	if (result!=NULL) {
 		*result = gnutls_malloc(result_size);
@@ -227,22 +228,20 @@ int bits;
  */
 void* _gnutls_calc_srp_sha( char* username, char* password, opaque* salt, int salt_size) {
 GNUTLS_MAC_HANDLE td;
-opaque* hd;
+opaque* res;
 
 	td = gnutls_hash_init(GNUTLS_MAC_SHA);
 	gnutls_hash(td, username, strlen(username));
 	gnutls_hash(td, ":", 1);
 	gnutls_hash(td, password, strlen(password));
-	hd = gnutls_hash_deinit(td);
+	res = gnutls_hash_deinit(td);
 
 	td = gnutls_hash_init(GNUTLS_MAC_SHA);
 	gnutls_hash(td, salt, salt_size);
-	gnutls_hash(td, hd, 20);
-	gnutls_free(hd);
+	gnutls_hash(td, res, 20); /* 20 bytes is the output of sha1 */
+	gnutls_free(res);
 
-	hd = gnutls_hash_deinit(td);
-
-	return hd;	
+	return gnutls_hash_deinit(td);
 }
 
 void* _gnutls_calc_srp_x( char* username, char* password, opaque* salt, int salt_size, uint8 crypt_algo) {
@@ -269,6 +268,7 @@ MPI S, tmp1, tmp2, tmp4;
 	tmp2 = gcry_mpi_alloc_like(n);
 
 	gcry_mpi_powm(tmp1, g, x, n);
+
 	gcry_mpi_subm(tmp2, B, tmp1, n);
 
 	tmp4 = gcry_mpi_alloc_like(n);
diff --git a/src/port.h b/src/port.h
index 003fa6f42e..696b48cb7d 100644
--- a/src/port.h
+++ b/src/port.h
@@ -1,2 +1,2 @@
-#define PORT 5555
+#define PORT 5556
 #define SERVER "127.0.0.1"
diff --git a/src/serv.c b/src/serv.c
index a025cf1801..0d4bef9285 100644
--- a/src/serv.c
+++ b/src/serv.c
@@ -48,7 +48,8 @@ int main()
     
     /* this is a password file (created with the included crypt utility) 
      */
-    cred.password_file="/tmp/pwd";
+    cred.password_file="/etc/tpasswd";
+    cred.password_conf_file="/etc/tpasswd.conf";
     
     listen_sd = socket(AF_INET, SOCK_STREAM, 0);
     ERR(listen_sd, "socket");