From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Wed, 2 Dec 2009 19:51:40 +0000 (+0200)
Subject: Added plain MD5 hash check and corrected gnutls_hash_fast() usage in openssl.c
X-Git-Tag: gnutls_2_9_10~191
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=54486afbfcf3398846d5c20d3094bdb7d0a43ff2;p=thirdparty%2Fgnutls.git

Added plain MD5 hash check and corrected gnutls_hash_fast() usage in openssl.c
Corrected new hash API bug that prevented usage of plain hash functions.
---

diff --git a/lib/gnutls_hash_int.c b/lib/gnutls_hash_int.c
index c70fa8f81b..682cb2347c 100644
--- a/lib/gnutls_hash_int.c
+++ b/lib/gnutls_hash_int.c
@@ -110,40 +110,25 @@ _gnutls_hash_init (hash_hd_st * dig, gnutls_digest_algorithm_t algorithm,
       dig->registered = 1;
 
       dig->hd.rh.cc = cc;
-      if (cc->init (algorithm, &dig->hd.rh.ctx) < 0)
+      if (cc->init (algorithm, &dig->hd.rh.ctx, key, keylen) < 0)
 	{
 	  gnutls_assert ();
 	  return GNUTLS_E_HASH_FAILED;
 	}
 
-      if (key)
-	{
-	  if (cc->setkey == NULL || cc->setkey (dig->hd.rh.ctx, key, keylen) < 0)
-	    {
-	      gnutls_assert ();
-  	      cc->deinit (dig->hd.rh.ctx);
-	      return GNUTLS_E_HASH_FAILED;
-            }
-	}
-
       dig->active = 1;
       return 0;
     }
 
   dig->registered = 0;
 
-  result = _gnutls_mac_ops.init (algorithm, &dig->hd.gc);
+  result = _gnutls_mac_ops.init (algorithm, &dig->hd.gc, key, keylen);
   if (result < 0)
     {
       gnutls_assert ();
       return result;
     }
 
-  if (key) 
-    {
-      _gnutls_mac_ops.setkey (dig->hd.gc, key, keylen);
-    }
-
   dig->active = 1;
   return 0;
 }
diff --git a/lib/includes/gnutls/crypto.h b/lib/includes/gnutls/crypto.h
index d348864519..ac67386fdf 100644
--- a/lib/includes/gnutls/crypto.h
+++ b/lib/includes/gnutls/crypto.h
@@ -70,8 +70,7 @@ typedef struct
 
 typedef struct
 {
-  int (*init) (gnutls_mac_algorithm_t, void **ctx);
-  int (*setkey) (void *ctx, const void *key, size_t keysize);
+  int (*init) (gnutls_mac_algorithm_t, void **ctx, const void* key, size_t keysize);
   int (*hash) (void *ctx, const void *text, size_t textsize);
   int (*copy) (void **dst_ctx, void *src_ctx);
   int (*output) (void *src_ctx, void *digest, size_t digestsize);
diff --git a/lib/mac-libgcrypt.c b/lib/mac-libgcrypt.c
index acb9deba1d..75f5fccd16 100644
--- a/lib/mac-libgcrypt.c
+++ b/lib/mac-libgcrypt.c
@@ -31,10 +31,12 @@
 #include <gcrypt.h>
 
 static int
-wrap_gcry_mac_init (gnutls_digest_algorithm_t algo, void **ctx)
+wrap_gcry_mac_init (gnutls_digest_algorithm_t algo, void **ctx, const void* key, size_t keylen)
 {
   int err;
-  unsigned int flags = GCRY_MD_FLAG_HMAC;
+  unsigned int flags = 0;
+  
+  if (key) flags = GCRY_MD_FLAG_HMAC;
 
   switch (algo)
     {
@@ -64,6 +66,9 @@ wrap_gcry_mac_init (gnutls_digest_algorithm_t algo, void **ctx)
       return GNUTLS_E_INVALID_REQUEST;
     }
 
+  if (key)
+    gcry_md_setkey ((gcry_md_hd_t) *ctx, key, keylen);
+
   if (err == 0)
     return 0;
 
@@ -71,12 +76,6 @@ wrap_gcry_mac_init (gnutls_digest_algorithm_t algo, void **ctx)
   return GNUTLS_E_ENCRYPTION_FAILED;
 }
 
-static int
-wrap_gcry_md_setkey (void *ctx, const void *key, size_t keylen)
-{
-  return gcry_md_setkey ((gcry_md_hd_t) ctx, key, keylen);
-}
-
 static int
 wrap_gcry_md_write (void *ctx, const void *text, size_t textsize)
 {
@@ -119,7 +118,6 @@ int crypto_mac_prio = INT_MAX;
 
 gnutls_crypto_digest_st _gnutls_mac_ops = {
   .init = wrap_gcry_mac_init,
-  .setkey = wrap_gcry_md_setkey,
   .hash = wrap_gcry_md_write,
   .copy = wrap_gcry_md_copy,
   .output = wrap_gcry_mac_output,
diff --git a/libextra/gnutls_openssl.c b/libextra/gnutls_openssl.c
index 56aa0dbee7..edec49528f 100644
--- a/libextra/gnutls_openssl.c
+++ b/libextra/gnutls_openssl.c
@@ -1034,7 +1034,7 @@ MD5 (const unsigned char *buf, unsigned long len, unsigned char *md)
   if (!md)
     return NULL;
 
-  _gnutls_hash_fast (GNUTLS_DIG_MD5, buf, len, NULL, 0, md);
+  _gnutls_hash_fast (GNUTLS_DIG_MD5, NULL, 0, buf, len, md);
 
   return md;
 }
@@ -1067,7 +1067,7 @@ RIPEMD160 (const unsigned char *buf, unsigned long len, unsigned char *md)
   if (!md)
     return NULL;
 
-  _gnutls_hash_fast (GNUTLS_DIG_RMD160, buf, len, NULL, 0, md);
+  _gnutls_hash_fast (GNUTLS_DIG_RMD160, NULL, 0, buf, len, md);
 
   return md;
 }
diff --git a/tests/gc.c b/tests/gc.c
index 86614ac6a1..9330ac2fc3 100644
--- a/tests/gc.c
+++ b/tests/gc.c
@@ -41,6 +41,22 @@ doit (void)
   /* XXX: We need this to fix secure memory. */
   gnutls_global_init ();
 
+  err =
+    _gnutls_hash_fast (GNUTLS_MAC_MD5, NULL, 0, "testtest", 8, digest);
+  if (err < 0)
+    fail ("_gnutls_hash_fast(MD5) failed: %d\n", err);
+  else
+    {
+      if (memcmp (digest, "\x05\xa6\x71\xc6\x6a\xef\xea\x12\x4c\xc0\x8b\x76\xea\x6d\x30\xbb", 16) == 0)
+	success ("HASH: _gnutls_hash_fast(MD5) OK\n");
+      else
+	{
+	  hexprint (digest, 16);
+	  fail ("HASH: _gnutls_hash_fast(MD5) failure\n");
+	}
+    }
+
+
   err =
     _gnutls_hash_fast (GNUTLS_MAC_MD5, "keykeykey", 9, "abcdefgh", 8, digest);
   if (err < 0)