From: Nikos Mavrogiannopoulos Date: Fri, 19 Nov 2010 15:21:22 +0000 (+0100) Subject: Deprecate the netconf password and use a key only. X-Git-Tag: gnutls_2_11_5~43 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7754f268ec72cf07ae546201a738c20d74ee9947;p=thirdparty%2Fgnutls.git Deprecate the netconf password and use a key only. --- diff --git a/src/cli.c b/src/cli.c index 580fe1f0b5..bd1d71299d 100644 --- a/src/cli.c +++ b/src/cli.c @@ -1138,8 +1138,11 @@ static int psk_callback (gnutls_session_t session, char **username, gnutls_datum_t * key) { const char *hint = gnutls_psk_client_get_hint (session); + unsigned char* rawkey; char *passwd; int ret; + size_t res_size; + gnutls_datum_t tmp; printf ("- PSK client callback. "); if (hint) @@ -1176,15 +1179,22 @@ psk_callback (gnutls_session_t session, char **username, gnutls_datum_t * key) if (!*username) return GNUTLS_E_MEMORY_ERROR; - passwd = getpass ("Enter password: "); + passwd = getpass ("Enter key: "); if (passwd == NULL) { - fprintf (stderr, "No password given, aborting...\n"); + fprintf (stderr, "No key given, aborting...\n"); return GNUTLS_E_INSUFFICIENT_CREDENTIALS; } - ret = gnutls_psk_netconf_derive_key (passwd, - *username, hint ? hint : "", key); + tmp.data = passwd; + tmp.size = strlen(passwd); + + res_size = tmp.size/2+1; + rawkey = gnutls_malloc(res_size); + if (rawkey == NULL) + return GNUTLS_E_MEMORY_ERROR; + + ret = gnutls_hex_decode(&tmp, rawkey, &res_size); if (ret < 0) { fprintf (stderr, "Error deriving password: %s\n", @@ -1192,11 +1202,14 @@ psk_callback (gnutls_session_t session, char **username, gnutls_datum_t * key) gnutls_free (*username); return ret; } + + key->data = rawkey; + key->size = res_size; if (info.debug) { char hexkey[41]; - size_t res_size = sizeof (hexkey); + res_size = sizeof (hexkey); gnutls_hex_encode (key, hexkey, &res_size); fprintf (stderr, "PSK username: %s\n", *username); fprintf (stderr, "PSK hint: %s\n", hint); diff --git a/src/psk-gaa.c b/src/psk-gaa.c index 82d8383e5b..fda757fe80 100644 --- a/src/psk-gaa.c +++ b/src/psk-gaa.c @@ -131,7 +131,6 @@ void gaa_help(void) printf("PSKtool help\nUsage : psktool [options]\n"); __gaa_helpsingle('u', "username", "username ", "specify username."); __gaa_helpsingle('p', "passwd", "FILE ", "specify a password file."); - __gaa_helpsingle('n', "netconf-hint", "HINT ", "derive key from Netconf password, using HINT as the psk_identity_hint."); __gaa_helpsingle('s', "keysize", "SIZE ", "specify the key size in bytes."); __gaa_helpsingle('v', "version", "", "prints the program's version number"); __gaa_helpsingle('h', "help", "", "shows this help text"); @@ -149,10 +148,8 @@ typedef struct _gaainfo gaainfo; struct _gaainfo { -#line 25 "psk.gaa" - int key_size; #line 22 "psk.gaa" - char *netconf_hint; + int key_size; #line 19 "psk.gaa" char *passwd; #line 16 "psk.gaa" @@ -211,13 +208,12 @@ static int gaa_error = 0; #define GAA_MULTIPLE_OPTION 3 #define GAA_REST 0 -#define GAA_NB_OPTION 6 +#define GAA_NB_OPTION 5 #define GAAOPTID_help 1 #define GAAOPTID_version 2 #define GAAOPTID_keysize 3 -#define GAAOPTID_netconf_hint 4 -#define GAAOPTID_passwd 5 -#define GAAOPTID_username 6 +#define GAAOPTID_passwd 4 +#define GAAOPTID_username 5 #line 168 "gaa.skel" @@ -377,12 +373,31 @@ static int gaa_getint(char *arg) return tmp; } +static char gaa_getchar(char *arg) +{ + if(strlen(arg) != 1) + { + printf("Option %s: '%s' isn't an character\n", gaa_current_option, arg); + GAAERROR(-1); + } + return arg[0]; +} static char* gaa_getstr(char *arg) { return arg; } - +static float gaa_getfloat(char *arg) +{ + float tmp; + char a; + if(sscanf(arg, "%f%c", &tmp, &a) < 1) + { + printf("Option %s: '%s' isn't a float number\n", gaa_current_option, arg); + GAAERROR(-1); + } + return tmp; +} /* option structures */ struct GAAOPTION_keysize @@ -391,12 +406,6 @@ struct GAAOPTION_keysize int size1; }; -struct GAAOPTION_netconf_hint -{ - char* arg1; - int size1; -}; - struct GAAOPTION_passwd { char* arg1; @@ -439,7 +448,6 @@ static int gaa_get_option_num(char *str, int status) { case GAA_LETTER_OPTION: GAA_CHECK1STR("s", GAAOPTID_keysize); - GAA_CHECK1STR("n", GAAOPTID_netconf_hint); GAA_CHECK1STR("p", GAAOPTID_passwd); GAA_CHECK1STR("u", GAAOPTID_username); case GAA_MULTIPLE_OPTION: @@ -453,7 +461,6 @@ static int gaa_get_option_num(char *str, int status) GAA_CHECKSTR("help", GAAOPTID_help); GAA_CHECKSTR("version", GAAOPTID_version); GAA_CHECKSTR("keysize", GAAOPTID_keysize); - GAA_CHECKSTR("netconf-hint", GAAOPTID_netconf_hint); GAA_CHECKSTR("passwd", GAAOPTID_passwd); GAA_CHECKSTR("username", GAAOPTID_username); @@ -469,7 +476,6 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list) int OK = 0; int gaa_last_non_option; struct GAAOPTION_keysize GAATMP_keysize; - struct GAAOPTION_netconf_hint GAATMP_netconf_hint; struct GAAOPTION_passwd GAATMP_passwd; struct GAAOPTION_username GAATMP_username; @@ -494,14 +500,14 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list) { case GAAOPTID_help: OK = 0; -#line 29 "psk.gaa" +#line 26 "psk.gaa" { gaa_help(); exit(0); ;}; return GAA_OK; break; case GAAOPTID_version: OK = 0; -#line 28 "psk.gaa" +#line 25 "psk.gaa" { psktool_version(); exit(0); ;}; return GAA_OK; @@ -511,18 +517,8 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list) GAA_TESTMOREARGS; GAA_FILL(GAATMP_keysize.arg1, gaa_getint, GAATMP_keysize.size1); gaa_index++; -#line 26 "psk.gaa" -{ gaaval->key_size = GAATMP_keysize.arg1 ;}; - - return GAA_OK; - break; - case GAAOPTID_netconf_hint: - OK = 0; - GAA_TESTMOREARGS; - GAA_FILL(GAATMP_netconf_hint.arg1, gaa_getstr, GAATMP_netconf_hint.size1); - gaa_index++; #line 23 "psk.gaa" -{ gaaval->netconf_hint = GAATMP_netconf_hint.arg1 ;}; +{ gaaval->key_size = GAATMP_keysize.arg1 ;}; return GAA_OK; break; @@ -556,25 +552,22 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list) int gaa(int argc, char **argv, gaainfo *gaaval) { int tmp1, tmp2; - int l; - size_t i, j; + int i, j; char *opt_list; - i = 0; - GAAargv = argv; GAAargc = argc; opt_list = (char*) gaa_malloc(GAA_NB_OPTION + 1); - for(l = 0; l < GAA_NB_OPTION + 1; l++) - opt_list[l] = 0; + for(i = 0; i < GAA_NB_OPTION + 1; i++) + opt_list[i] = 0; /* initialization */ if(inited == 0) { -#line 31 "psk.gaa" -{ gaaval->username=NULL; gaaval->passwd=NULL; gaaval->key_size = 0; gaaval->netconf_hint = NULL; ;}; +#line 28 "psk.gaa" +{ gaaval->username=NULL; gaaval->passwd=NULL; gaaval->key_size = 0; ;}; } inited = 1; @@ -585,27 +578,27 @@ int gaa(int argc, char **argv, gaainfo *gaaval) gaa_arg_used = gaa_malloc(argc * sizeof(char)); } - for(l = 1; l < argc; l++) - gaa_arg_used[l] = 0; - for(l = 1; l < argc; l++) + for(i = 1; i < argc; i++) + gaa_arg_used[i] = 0; + for(i = 1; i < argc; i++) { - if(gaa_arg_used[l] == 0) + if(gaa_arg_used[i] == 0) { j = 0; - tmp1 = gaa_is_an_argument(GAAargv[l]); + tmp1 = gaa_is_an_argument(GAAargv[i]); switch(tmp1) { case GAA_WORD_OPTION: j++; case GAA_LETTER_OPTION: j++; - tmp2 = gaa_get_option_num(argv[l]+j, tmp1); + tmp2 = gaa_get_option_num(argv[i]+j, tmp1); if(tmp2 == GAA_ERROR_NOMATCH) { - printf("Invalid option '%s'\n", argv[l]+j); + printf("Invalid option '%s'\n", argv[i]+j); return 0; } - switch(gaa_try(tmp2, l+1, gaaval, opt_list)) + switch(gaa_try(tmp2, i+1, gaaval, opt_list)) { case GAA_ERROR_NOTENOUGH_ARGS: printf("'%s': not enough arguments\n",gaa_current_option); @@ -618,18 +611,18 @@ int gaa(int argc, char **argv, gaainfo *gaaval) default: printf("Unknown error\n"); } - gaa_arg_used[l] = 1; + gaa_arg_used[i] = 1; break; case GAA_MULTIPLE_OPTION: - for(j = 1; j < strlen(argv[l]); j++) + for(j = 1; j < strlen(argv[i]); j++) { - tmp2 = gaa_get_option_num(argv[l]+j, tmp1); + tmp2 = gaa_get_option_num(argv[i]+j, tmp1); if(tmp2 == GAA_ERROR_NOMATCH) { - printf("Invalid option '%c'\n", *(argv[l]+j)); + printf("Invalid option '%c'\n", *(argv[i]+j)); return 0; } - switch(gaa_try(tmp2, l+1, gaaval, opt_list)) + switch(gaa_try(tmp2, i+1, gaaval, opt_list)) { case GAA_ERROR_NOTENOUGH_ARGS: printf("'%s': not enough arguments\n",gaa_current_option); @@ -643,7 +636,7 @@ int gaa(int argc, char **argv, gaainfo *gaaval) printf("Unknown error\n"); } } - gaa_arg_used[l] = 1; + gaa_arg_used[i] = 1; break; default: break; } @@ -669,9 +662,9 @@ if(gaa_processing_file == 0) } #endif } - for(l = 1; l < argc; l++) + for(i = 1; i < argc; i++) { - if(gaa_arg_used[l] == 0) + if(gaa_arg_used[i] == 0) { printf("Too many arguments\n"); return 0; @@ -722,7 +715,7 @@ static int gaa_internal_get_next_str(FILE *file, gaa_str_node *tmp_str, int argc len++; a = fgetc( file); - if(a==EOF) return 0; /* a = ' '; */ + if(a==EOF) return 0; //a = ' '; } len += 1; diff --git a/src/psk-gaa.h b/src/psk-gaa.h index 57b36a6edc..88c5de5aed 100644 --- a/src/psk-gaa.h +++ b/src/psk-gaa.h @@ -8,10 +8,8 @@ typedef struct _gaainfo gaainfo; struct _gaainfo { -#line 25 "psk.gaa" - int key_size; #line 22 "psk.gaa" - char *netconf_hint; + int key_size; #line 19 "psk.gaa" char *passwd; #line 16 "psk.gaa" diff --git a/src/psk.c b/src/psk.c index 20911598dc..e733ffc6a5 100644 --- a/src/psk.c +++ b/src/psk.c @@ -119,53 +119,22 @@ main (int argc, char **argv) exit (1); } - if (info.netconf_hint) - { - char *passwd; + if (info.key_size < 1) + info.key_size = 16; - if (info.key_size != 0 && info.key_size != 20) - { - fprintf (stderr, "For netconf, key size must always be 20.\n"); - exit (1); - } + printf ("Generating a random key for user '%s'\n", info.username); - passwd = getpass ("Enter password: "); - if (passwd == NULL) - { - fprintf (stderr, "Please specify a password\n"); - exit (1); - } - - ret = gnutls_psk_netconf_derive_key (passwd, - info.username, - info.netconf_hint, &dkey); - if (ret < 0) - { - fprintf (stderr, "Deriving the key failed\n"); - exit (1); - } - } - else + ret = gnutls_rnd (GNUTLS_RND_RANDOM, (char *) key, info.key_size); + if (ret < 0) { - if (info.key_size < 1) - info.key_size = 16; - - printf ("Generating a random key for user '%s'\n", info.username); - - ret = gnutls_rnd (GNUTLS_RND_RANDOM, (char *) key, info.key_size); - if (ret < 0) - { - fprintf (stderr, "Not enough randomness\n"); - exit (1); - } - - dkey.data = key; - dkey.size = info.key_size; + fprintf (stderr, "Not enough randomness\n"); + exit (1); } + dkey.data = key; + dkey.size = info.key_size; + ret = gnutls_hex_encode (&dkey, hex_key, &hex_key_size); - if (info.netconf_hint) - gnutls_free (dkey.data); if (ret < 0) { fprintf (stderr, "HEX encoding error\n"); diff --git a/src/psk.gaa b/src/psk.gaa index 9b4cc31f5a..f8eb6b5b45 100644 --- a/src/psk.gaa +++ b/src/psk.gaa @@ -19,13 +19,10 @@ option (u,username) STR "username" { $username = $1 } "specify username." #char *passwd; option (p, passwd) STR "FILE" { $passwd = $1 } "specify a password file." -#char *netconf_hint; -option (n, netconf-hint) STR "HINT" { $netconf_hint = $1 } "derive key from Netconf password, using HINT as the psk_identity_hint." - #int key_size; option (s, keysize) INT "SIZE" { $key_size = $1 } "specify the key size in bytes." option (v, version) { psktool_version(); exit(0); } "prints the program's version number" option (h, help) { gaa_help(); exit(0); } "shows this help text" -init { $username=NULL; $passwd=NULL; $key_size = 0; $netconf_hint = NULL; } +init { $username=NULL; $passwd=NULL; $key_size = 0; } diff --git a/tests/Makefile.am b/tests/Makefile.am index bc099e46cd..57a1981489 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -74,7 +74,7 @@ endif if HAVE_FORK ctests += x509self x509dn anonself pskself dhepskself \ - tlsia resume netconf-psk setcredcrash + tlsia resume setcredcrash if ENABLE_OPENPGP ctests += openpgpself diff --git a/tests/netconf-psk.c b/tests/netconf-psk.c deleted file mode 100644 index 2d606d4bf5..0000000000 --- a/tests/netconf-psk.c +++ /dev/null @@ -1,80 +0,0 @@ -/* - * Copyright (C) 2008, 2010 Free Software Foundation, Inc. - * - * Author: Simon Josefsson - * - * This file is part of GnuTLS. - * - * GnuTLS is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * GnuTLS is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with GnuTLS; if not, write to the Free Software Foundation, - * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA - */ - -#ifdef HAVE_CONFIG_H -#include -#endif - -#include -#include -#include -#include -#include - -#include - -#include "utils.h" - -static void -tls_log_func (int level, const char *str) -{ - fprintf (stderr, "<%d>| %s", level, str); -} - -void -doit (void) -{ - const char *known = - "\x88\xf3\x82\x4b\x3e\x56\x59\xf5\x2d\x00" - "\xe9\x59\xba\xca\xb9\x54\xb6\x54\x03\x44"; - gnutls_datum_t key = { NULL, 0 }; - - gnutls_global_init (); - - gnutls_global_set_log_function (tls_log_func); - if (debug) - gnutls_global_set_log_level (2); - - if (gnutls_psk_netconf_derive_key ("password", "psk_identity", - "psk_identity_hint", &key) == 0) - { - if (debug) - success ("success: gnutls_psk_netconf_derive_key\n"); - } - else - fail ("gnutls_psk_netconf_derive_key failure\n"); - - if (debug) - hexprint (key.data, key.size); - - if (key.size == 20 && memcmp (key.data, known, 20) == 0) - { - if (debug) - success ("success: match.\n"); - } - else - fail ("FAIL: key differ.\n"); - - gnutls_free (key.data); - - gnutls_global_deinit (); -}