From: Nikos Mavrogiannopoulos Date: Fri, 4 May 2001 21:52:03 +0000 (+0000) Subject: more additions for SRP X-Git-Tag: gnutls-0-1-0-srp~19 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=89af8d0f36cd296d2c6c76bbd797da44b3bf43f5;p=thirdparty%2Fgnutls.git more additions for SRP --- diff --git a/lib/Makefile.am b/lib/Makefile.am index 5051a76e3f..269b3f1d6a 100644 --- a/lib/Makefile.am +++ b/lib/Makefile.am @@ -6,7 +6,7 @@ EXTRA_DIST = debug.h gnutls_compress.h defines.h gnutls_plaintext.h \ gnutls_compress_int.h gnutls_session.h gnutls_priority.h gnutls_auth.h \ auth_anon.h auth_dhe_dss.h gnutls_extensions.h ext_srp.h \ gnutls_auth_int.h crypt_bcrypt.h gnutls_random.h crypt_srpsha1.h \ - cert_b64.h gnutls_srp.h + cert_b64.h gnutls_srp.h auth_srp.h auth_srp_passwd.h lib_LTLIBRARIES = libgnutls.la libgnutls_la_SOURCES = gnutls.c gnutls_compress.c debug.c gnutls_plaintext.c \ gnutls_cipher.c gnutls_buffers.c gnutls_handshake.c gnutls_num.c \ @@ -14,5 +14,6 @@ libgnutls_la_SOURCES = gnutls.c gnutls_compress.c debug.c gnutls_plaintext.c \ gnutls_priority.c gnutls_hash_int.c gnutls_cipher_int.c \ gnutls_compress_int.c gnutls_session.c gnutls_db.c cert_b64.c \ auth_anon.c auth_dhe_dss.c gnutls_extensions.c ext_srp.c gnutls_auth.c \ - crypt_bcrypt.c crypt.c gnutls_random.c crypt_srpsha1.c gnutls_srp.c + crypt_bcrypt.c crypt.c gnutls_random.c crypt_srpsha1.c gnutls_srp.c \ + auth_srp.c auth_srp_passwd.c libgnutls_la_LDFLAGS = -version-info $(LT_CURRENT):$(LT_REVISION):$(LT_AGE) diff --git a/lib/crypt_bcrypt.c b/lib/crypt_bcrypt.c index ff2238b496..cabfb54182 100644 --- a/lib/crypt_bcrypt.c +++ b/lib/crypt_bcrypt.c @@ -604,7 +604,7 @@ char * int i, salt_size = strlen(salt); unsigned char *local_salt, *v; int passwd_len; - char *tmp; + char *tmp, *g, *n; passwd_len = strlen(passwd) + 1; /* we want the null also */ if (passwd_len > 56) @@ -640,7 +640,7 @@ char * } /* v = g^x mod n */ - vsize = _gnutls_srp_gx(text, 8*3, &v); + vsize = _gnutls_srp_gx(text, 8*3, &v, &g, &n); if (vsize==-1 || v==NULL) { gnutls_assert(); return NULL; @@ -649,9 +649,11 @@ char * _gnutls_base64_encode(v, vsize, &rtext); gnutls_free(v); - tmp = gnutls_calloc( 1, strlen(magic)+3+strlen(sp)+1+strlen(rtext)+1); + tmp = gnutls_malloc( strlen(magic)+3+strlen(sp)+1+strlen(rtext)+strlen(g)+2+strlen(n)+1); - sprintf( tmp, "%s%.2u$%s$%s", magic, (unsigned int) cost, sp, rtext); + sprintf( tmp, "%s%.2u$%s$%s$%s$%s", magic, (unsigned int) cost, sp, rtext, g, n); + gnutls_free(g); + gnutls_free(n); gnutls_free(local_salt); gnutls_free(rtext); @@ -679,15 +681,13 @@ char *crypt_bcrypt_wrapper(const char *pass_new, int cost) return NULL; } - /* base64 encoded text is 4/3 times larger than orignal */ tcp = gnutls_calloc( 1, strlen(magic)+ 3 + result_size +1+1); - sprintf(tcp, "%s%.2u$%s$", magic, cost, result); /* magic for the BCRYPT */ + sprintf(tcp, "%s%.2u$%s$", magic, cost, result); gnutls_free(result); _gnutls_free_rand(rand); - /* no longer need cleartext */ e = crypt_bcrypt(pass_new, (const char *) tcp); gnutls_free(tcp); diff --git a/lib/crypt_srpsha1.c b/lib/crypt_srpsha1.c index 86b7f54ff3..6d3ccc8583 100644 --- a/lib/crypt_srpsha1.c +++ b/lib/crypt_srpsha1.c @@ -39,7 +39,7 @@ char * int passwd_len; GNUTLS_MAC_HANDLE h1; int vsize, hash_len = gnutls_hash_get_algo_len(GNUTLS_MAC_SHA); - char *tmp; + char *tmp, *g, *n; uint8 *rtext, * csalt; passwd_len = strlen(passwd); /* we do not want the null */ @@ -74,7 +74,7 @@ char * r1 = gnutls_hash_deinit(h1); /* v = g^x mod n */ - vsize = _gnutls_srp_gx(r1, hash_len, &v); + vsize = _gnutls_srp_gx(r1, hash_len, &v, &g, &n); gnutls_free(r1); if (vsize==-1 || v==NULL) { gnutls_assert(); @@ -84,9 +84,11 @@ char * _gnutls_base64_encode(v, vsize, &rtext); gnutls_free(v); - tmp = gnutls_calloc( 1, strlen(sp)+strlen(rtext)+strlen(magic)+1+1 ); + tmp = gnutls_malloc( strlen(sp)+strlen(rtext)+strlen(magic)+strlen(g)+2+strlen(n)+1+1 ); - sprintf( tmp, "%s%s$%s", magic, sp, rtext); + sprintf( tmp, "%s%s$%s$%s$%s", magic, sp, rtext,g ,n); + gnutls_free(g); + gnutls_free(n); gnutls_free(rtext); gnutls_free(local_salt); @@ -102,7 +104,7 @@ char *crypt_srpsha1_wrapper(const char* username, const char *pass_new, int salt char *e = NULL; int result_size; - if (salt > 50 || salt < 0) return NULL; /* wow that's pretty long salt */ + if (salt > 50 || salt <= 0) return NULL; /* wow that's pretty long salt */ rand = _gnutls_get_random( salt, GNUTLS_WEAK_RANDOM); diff --git a/lib/ext_srp.c b/lib/ext_srp.c index e8708f7867..bd1b7799f4 100644 --- a/lib/ext_srp.c +++ b/lib/ext_srp.c @@ -22,7 +22,11 @@ #include "gnutls_int.h" int _gnutls_srp_recv_params( GNUTLS_STATE state, const opaque* data, int data_size) { - /* actually this reads username from data */ + if (data_size > 0) { + state->gnutls_key->username = gnutls_malloc(data_size+1); + memcpy(state->gnutls_key->username, data, data_size); + state->gnutls_key->username[data_size]=0; /* null terminated */ + } return 0; } @@ -32,5 +36,9 @@ int _gnutls_srp_recv_params( GNUTLS_STATE state, const opaque* data, int data_si int _gnutls_srp_send_params( GNUTLS_STATE state, opaque** data) { /* this functions sends the server extension data */ (*data) = NULL; + if (state->gnutls_key->username!=NULL) { /* send username */ + (*data) = strdup( state->gnutls_key->username); + return strlen(state->gnutls_key->username); + } return 0; } diff --git a/lib/gnutls.c b/lib/gnutls.c index 6f251482f8..2bdbb57dd7 100644 --- a/lib/gnutls.c +++ b/lib/gnutls.c @@ -99,7 +99,8 @@ int gnutls_init(GNUTLS_STATE * state, ConnectionEnd con_end) (*state)->gnutls_internals.buffer_handshake = NULL; (*state)->gnutls_internals.resumable = RESUME_TRUE; - (*state)->gnutls_internals.cred = NULL; /* no credentials by default */ + (*state)->gnutls_key->cred = NULL; /* no credentials by default */ + (*state)->gnutls_key->username = NULL; /* no default username */ gnutls_set_current_version ( (*state), GNUTLS_TLS1); /* default */ @@ -110,7 +111,14 @@ int gnutls_init(GNUTLS_STATE * state, ConnectionEnd con_end) (*state)->gnutls_key->client_p = NULL; (*state)->gnutls_key->client_g = NULL; (*state)->gnutls_key->dh_secret = NULL; - + + (*state)->gnutls_key->A = NULL; + (*state)->gnutls_key->a = NULL; + (*state)->gnutls_key->x = NULL; + (*state)->gnutls_key->u = NULL; + (*state)->gnutls_key->B = NULL; + (*state)->gnutls_key->b = NULL; + (*state)->gnutls_internals.certificate_requested = 0; (*state)->gnutls_internals.certificate_verify_needed = 0; @@ -129,7 +137,7 @@ int gnutls_init(GNUTLS_STATE * state, ConnectionEnd con_end) /* Set default priorities */ gnutls_set_cipher_priority( (*state), 2, GNUTLS_RIJNDAEL, GNUTLS_3DES); gnutls_set_compression_priority( (*state), 1, GNUTLS_NULL_COMPRESSION); - gnutls_set_kx_priority( (*state), 2, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA); + gnutls_set_kx_priority( (*state), 1, GNUTLS_KX_ANON_DH); gnutls_set_mac_priority( (*state), 2, GNUTLS_MAC_SHA, GNUTLS_MAC_MD5); (*state)->security_parameters.session_id_size = 0; @@ -181,9 +189,19 @@ int gnutls_deinit(GNUTLS_STATE * state) mpi_release((*state)->gnutls_key->client_Y); mpi_release((*state)->gnutls_key->client_p); mpi_release((*state)->gnutls_key->client_g); + + mpi_release((*state)->gnutls_key->u); + mpi_release((*state)->gnutls_key->a); + mpi_release((*state)->gnutls_key->x); + mpi_release((*state)->gnutls_key->A); + mpi_release((*state)->gnutls_key->B); + mpi_release((*state)->gnutls_key->b); + mpi_release((*state)->gnutls_key->dh_secret); gnutls_free((*state)->gnutls_key); + gnutls_free((*state)->gnutls_key->username); + /* free priorities */ if ((*state)->gnutls_internals.MACAlgorithmPriority.algorithm_priority!=NULL) gnutls_free((*state)->gnutls_internals.MACAlgorithmPriority.algorithm_priority); diff --git a/lib/gnutls.h b/lib/gnutls.h index ce276c24a4..886e6c92a4 100644 --- a/lib/gnutls.h +++ b/lib/gnutls.h @@ -24,7 +24,7 @@ typedef enum ContentType ContentType; enum BulkCipherAlgorithm { GNUTLS_NULL_CIPHER, GNUTLS_ARCFOUR=1, GNUTLS_3DES = 4, GNUTLS_RIJNDAEL, GNUTLS_TWOFISH, GNUTLS_RIJNDAEL256 }; typedef enum BulkCipherAlgorithm BulkCipherAlgorithm; -enum KXAlgorithm { GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA, GNUTLS_KX_DH_DSS, GNUTLS_KX_DH_RSA, GNUTLS_KX_ANON_DH }; +enum KXAlgorithm { GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA, GNUTLS_KX_DH_DSS, GNUTLS_KX_DH_RSA, GNUTLS_KX_ANON_DH, GNUTLS_KX_SRP }; typedef enum KXAlgorithm KXAlgorithm; enum MACAlgorithm { GNUTLS_NULL_MAC, GNUTLS_MAC_MD5, GNUTLS_MAC_SHA }; typedef enum MACAlgorithm MACAlgorithm; diff --git a/lib/gnutls_algorithms.c b/lib/gnutls_algorithms.c index 6c75ac3971..50dbefd059 100644 --- a/lib/gnutls_algorithms.c +++ b/lib/gnutls_algorithms.c @@ -26,6 +26,7 @@ /* include all the kx handler's definitions */ #include "auth_anon.h" #include "auth_dhe_dss.h" +#include "auth_srp.h" #define MAX_CIPHER 256 #define MAX_MAC 256 @@ -160,7 +161,7 @@ static gnutls_kx_algo_entry kx_algorithms[] = { GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DHE_RSA, 1, 1, 0, 0, NULL), GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DH_DSS, 1, 1, 0, 0, NULL), GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DH_RSA, 1, 1, 0, 0, NULL), -// GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_SRP, 0, 0, 0, 0, &srp_auth_struct), + GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_SRP, 0, 0, 0, 0, &srp_auth_struct), {0} }; diff --git a/lib/gnutls_auth.c b/lib/gnutls_auth.c index 9d99b88fa6..87e178bff0 100644 --- a/lib/gnutls_auth.c +++ b/lib/gnutls_auth.c @@ -32,14 +32,14 @@ int gnutls_clear_creds( GNUTLS_STATE state) { AUTH_CRED * ccred, *ncred; - if (state->gnutls_internals.cred!=NULL) { /* begining of the list */ - ccred = state->gnutls_internals.cred; + if (state->gnutls_key->cred!=NULL) { /* begining of the list */ + ccred = state->gnutls_key->cred; while(ccred!=NULL) { ncred = ccred->next; if (ccred!=NULL) gnutls_free(ccred); ccred = ncred; } - state->gnutls_internals.cred = NULL; + state->gnutls_key->cred = NULL; } return 0; @@ -53,16 +53,16 @@ int gnutls_set_kx_cred( GNUTLS_STATE state, int kx, void* cred) { AUTH_CRED * ccred, *pcred; int exists=0; - if (state->gnutls_internals.cred==NULL) { /* begining of the list */ + if (state->gnutls_key->cred==NULL) { /* begining of the list */ - state->gnutls_internals.cred = gnutls_malloc(sizeof(AUTH_CRED)); - if (state->gnutls_internals.cred == NULL) return GNUTLS_E_MEMORY_ERROR; + state->gnutls_key->cred = gnutls_malloc(sizeof(AUTH_CRED)); + if (state->gnutls_key->cred == NULL) return GNUTLS_E_MEMORY_ERROR; - state->gnutls_internals.cred->credentials = cred; - state->gnutls_internals.cred->next = NULL; - state->gnutls_internals.cred->algorithm = kx; + state->gnutls_key->cred->credentials = cred; + state->gnutls_key->cred->next = NULL; + state->gnutls_key->cred->algorithm = kx; } else { - ccred = state->gnutls_internals.cred; + ccred = state->gnutls_key->cred; while(ccred!=NULL) { if (ccred->algorithm==kx) { exists=1; @@ -89,12 +89,13 @@ int gnutls_set_kx_cred( GNUTLS_STATE state, int kx, void* cred) { } /* - * This returns an item from the linked list + * This returns an pointer to the linked list. Don't + * free that!!! */ -AUTH_CRED *gnutls_get_kx_cred( GNUTLS_STATE state, int kx) { +void *_gnutls_get_kx_cred( GNUTLS_KEY key, int kx) { AUTH_CRED * ccred; - ccred = state->gnutls_internals.cred; + ccred = key->cred; while(ccred!=NULL) { if (ccred->algorithm==kx) { break; diff --git a/lib/gnutls_auth.h b/lib/gnutls_auth.h index cb8d00a90c..b183b7ba49 100644 --- a/lib/gnutls_auth.h +++ b/lib/gnutls_auth.h @@ -17,10 +17,5 @@ typedef struct { int (*gnutls_process_server_cert_vrfy) ( GNUTLS_KEY, opaque*, int); } MOD_AUTH_STRUCT; -typedef struct { - KXAlgorithm algorithm; - void* credentials; - void* next; -} AUTH_CRED; #endif diff --git a/lib/gnutls_auth_int.h b/lib/gnutls_auth_int.h index db30f60caa..1213331596 100644 --- a/lib/gnutls_auth_int.h +++ b/lib/gnutls_auth_int.h @@ -1,4 +1,4 @@ int gnutls_clear_creds( GNUTLS_STATE state); int gnutls_set_kx_cred( GNUTLS_STATE state, int kx, AUTH_CRED* cred); -AUTH_CRED *gnutls_get_kx_cred( GNUTLS_STATE state, int kx); +void *_gnutls_get_kx_cred( GNUTLS_KEY key, int kx); diff --git a/lib/gnutls_dh.c b/lib/gnutls_dh.c index 59a6b76822..1a8570bb34 100644 --- a/lib/gnutls_dh.c +++ b/lib/gnutls_dh.c @@ -60,8 +60,6 @@ static const uint8 diffie_hellman_group1_prime[130] = { 0x04, 0x00, /* #define E_SIZE 1024 */ #define X_SIZE 512 -#define gcry_mpi_alloc_like(x) gcry_mpi_new(gcry_mpi_get_nbits(x)) - /**************** * Choose a random value x and calculate e = g^x mod p. * Return: e and if ret_x is not NULL x. diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c index 598db1f640..6b34a55602 100644 --- a/lib/gnutls_errors.c +++ b/lib/gnutls_errors.c @@ -62,6 +62,8 @@ static gnutls_error_entry error_algorithms[] = { GNUTLS_ERROR_ENTRY( GNUTLS_E_COMPRESSION_FAILED, 1), GNUTLS_ERROR_ENTRY( GNUTLS_E_MEMORY_ERROR, 1), GNUTLS_ERROR_ENTRY( GNUTLS_E_UNIMPLEMENTED_FEATURE, 1), + GNUTLS_ERROR_ENTRY( GNUTLS_E_INSUFICIENT_CRED, 1), + GNUTLS_ERROR_ENTRY( GNUTLS_E_PWD_ERROR, 1), GNUTLS_ERROR_ENTRY( GNUTLS_E_EXPIRED, 1), GNUTLS_ERROR_ENTRY( GNUTLS_E_AGAIN, 0), GNUTLS_ERROR_ENTRY( GNUTLS_E_DB_ERROR, 1), diff --git a/lib/gnutls_errors.h b/lib/gnutls_errors.h index b26cded9db..74c0880611 100644 --- a/lib/gnutls_errors.h +++ b/lib/gnutls_errors.h @@ -50,6 +50,8 @@ #define GNUTLS_E_AGAIN -28 #define GNUTLS_E_EXPIRED -29 #define GNUTLS_E_DB_ERROR -30 +#define GNUTLS_E_PWD_ERROR -31 +#define GNUTLS_E_INSUFICIENT_CRED -32 #define GNUTLS_E_UNIMPLEMENTED_FEATURE -50 diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h index 4cbdb46deb..09dcd3b731 100644 --- a/lib/gnutls_int.h +++ b/lib/gnutls_int.h @@ -108,22 +108,12 @@ typedef struct { AlertDescription description; } Alert; -typedef struct { - /* For DH KX */ - MPI KEY; - MPI client_Y; - MPI client_g; - MPI client_p; - MPI dh_secret; -} GNUTLS_KEY_A; -typedef GNUTLS_KEY_A* GNUTLS_KEY; - /* STATE */ enum ConnectionEnd { GNUTLS_SERVER, GNUTLS_CLIENT }; enum BulkCipherAlgorithm { GNUTLS_NULL_CIPHER, GNUTLS_ARCFOUR=1, GNUTLS_3DES = 4, GNUTLS_RIJNDAEL, GNUTLS_TWOFISH, GNUTLS_RIJNDAEL256 }; enum Extensions { GNUTLS_EXTENSION_SRP=7 }; -enum KXAlgorithm { GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA, GNUTLS_KX_DH_DSS, GNUTLS_KX_DH_RSA, GNUTLS_KX_ANON_DH }; +enum KXAlgorithm { GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA, GNUTLS_KX_DH_DSS, GNUTLS_KX_DH_RSA, GNUTLS_KX_ANON_DH, GNUTLS_KX_SRP }; enum KeyExchangeAlgorithm { GNUTLS_RSA, GNUTLS_DIFFIE_HELLMAN }; enum CipherType { CIPHER_STREAM, CIPHER_BLOCK }; enum MACAlgorithm { GNUTLS_NULL_MAC, GNUTLS_MAC_MD5, GNUTLS_MAC_SHA }; @@ -143,10 +133,42 @@ typedef enum MACAlgorithm MACAlgorithm; typedef enum CompressionMethod CompressionMethod; typedef enum Extensions Extensions; +/* STATE (stop) */ + +typedef struct { + KXAlgorithm algorithm; + void* credentials; + void* next; +} AUTH_CRED; + +typedef struct { + /* For DH KX */ + MPI KEY; + MPI client_Y; + MPI client_g; + MPI client_p; + MPI dh_secret; + /* for SRP */ + MPI A; + MPI B; + MPI u; + MPI b; + MPI a; + MPI x; + + char* username; /* user in srp */ + AUTH_CRED* cred; /* used in srp, etc */ +} GNUTLS_KEY_A; +typedef GNUTLS_KEY_A* GNUTLS_KEY; + + +/* STATE (cont) */ + #include #include #include + typedef struct { ConnectionEnd entity; BulkCipherAlgorithm bulk_cipher_algorithm; @@ -237,7 +259,7 @@ typedef struct { char* db_name; int expire_time; MOD_AUTH_STRUCT* auth_struct; /* used in handshake packets and KX algorithms */ - AUTH_CRED* cred; + } GNUTLS_INTERNALS; typedef struct { @@ -347,4 +369,6 @@ int _gnutls_send_change_cipher_spec(int cd, GNUTLS_STATE state); int _gnutls_version_cmp(GNUTLS_Version ver1, GNUTLS_Version ver2); #define _gnutls_version_ssl3(x) _gnutls_version_cmp(x, GNUTLS_SSL3) +#define gcry_mpi_alloc_like(x) gcry_mpi_new(gcry_mpi_get_nbits(x)) + #endif /* GNUTLS_INT_H */ diff --git a/lib/gnutls_kx.c b/lib/gnutls_kx.c index 33a01c0b23..3ac40f3f3a 100644 --- a/lib/gnutls_kx.c +++ b/lib/gnutls_kx.c @@ -70,7 +70,7 @@ int _gnutls_send_server_kx_message2(int cd, GNUTLS_STATE state) #endif if (_gnutls_kx_server_key_exchange2(algorithm) != 0) { - data_size = state->gnutls_internals.auth_struct->gnutls_generate_server_kx( state->gnutls_key, &data); + data_size = state->gnutls_internals.auth_struct->gnutls_generate_server_kx2( state->gnutls_key, &data); if (data_size<0) { gnutls_assert(); @@ -118,7 +118,7 @@ int _gnutls_send_client_kx_message(int cd, GNUTLS_STATE state) return data_size; } - ret = _gnutls_send_handshake(cd, state, data, data_size, GNUTLS_CLIENT_KEY_EXCHANGE); + ret = _gnutls_send_handshake(cd, state, data, data_size, GNUTLS_CLIENT_KEY_EXCHANGE); gnutls_free(data); gcry_mpi_print(GCRYMPI_FMT_USG, NULL, &premaster_size, state->gnutls_key->KEY); @@ -182,13 +182,13 @@ int _gnutls_send_client_kx_message0(int cd, GNUTLS_STATE state) memmove(random, state->security_parameters.client_random, 32); memmove(&random[32], state->security_parameters.server_random, 32); - data_size = state->gnutls_internals.auth_struct->gnutls_generate_client_kx( state->gnutls_key, &data); + data_size = state->gnutls_internals.auth_struct->gnutls_generate_client_kx0( state->gnutls_key, &data); if (data_size < 0) { gnutls_assert(); return data_size; } - ret = _gnutls_send_handshake(cd, state, data, data_size, GNUTLS_CLIENT_KEY_EXCHANGE); + ret = _gnutls_send_handshake(cd, state, data, data_size, GNUTLS_CLIENT_KEY_EXCHANGE); gnutls_free(data); gcry_mpi_print(GCRYMPI_FMT_USG, NULL, &premaster_size, state->gnutls_key->KEY); @@ -318,7 +318,7 @@ int _gnutls_recv_server_kx_message2(int cd, GNUTLS_STATE state) return ret; - ret = state->gnutls_internals.auth_struct->gnutls_process_server_kx( state->gnutls_key, data, datasize); + ret = state->gnutls_internals.auth_struct->gnutls_process_server_kx2( state->gnutls_key, data, datasize); gnutls_free(data); if (ret < 0) return ret; @@ -437,7 +437,7 @@ int _gnutls_recv_client_kx_message0(int cd, GNUTLS_STATE state) if (ret < 0) return ret; - ret = state->gnutls_internals.auth_struct->gnutls_process_client_kx( state->gnutls_key, data, datasize); + ret = state->gnutls_internals.auth_struct->gnutls_process_client_kx0( state->gnutls_key, data, datasize); gnutls_free(data); if (ret < 0) return ret; diff --git a/lib/gnutls_srp.c b/lib/gnutls_srp.c index c63fe7409c..ca33c58a2b 100644 --- a/lib/gnutls_srp.c +++ b/lib/gnutls_srp.c @@ -21,7 +21,7 @@ #include #include #include -#define gcry_mpi_alloc_like(x) gcry_mpi_new(gcry_mpi_get_nbits(x)) + /* Here functions for SRP (like g^x mod n) are defined */ @@ -45,11 +45,11 @@ static const uint8 diffie_hellman_group1_prime[130] = { 0x04, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF }; -int _gnutls_srp_gx(opaque *text, int textsize, opaque** result) { +int _gnutls_srp_gx(opaque *text, int textsize, opaque** result, char** ret_g, char** ret_n) { MPI g, prime, x, e; size_t n = sizeof diffie_hellman_group1_prime; - int result_size; + int result_size, siz; if (gcry_mpi_scan(&prime, GCRYMPI_FMT_USG, diffie_hellman_group1_prime, &n)) { @@ -65,12 +65,11 @@ int _gnutls_srp_gx(opaque *text, int textsize, opaque** result) { g = mpi_set_ui(NULL, SRP_G); - /* e = g^x mod prime */ e = gcry_mpi_alloc_like(prime); + /* e = g^x mod prime (n) */ mpi_powm(e, g, x, prime); - mpi_release(prime); mpi_release(x); gcry_mpi_print(GCRYMPI_FMT_USG, NULL, &result_size, e); @@ -78,7 +77,27 @@ int _gnutls_srp_gx(opaque *text, int textsize, opaque** result) { *result = gnutls_malloc(result_size); gcry_mpi_print(GCRYMPI_FMT_USG, *result, &result_size, e); } + + siz = 0; + gcry_mpi_print(GCRYMPI_FMT_HEX, NULL, &siz, g); + if (ret_g!=NULL) { + *ret_g = gnutls_malloc(siz+1); + gcry_mpi_print(GCRYMPI_FMT_HEX, *ret_g, &siz, g); + (*ret_g)[siz] = 0; + } + + siz = 0; + gcry_mpi_print(GCRYMPI_FMT_HEX, NULL, &siz, prime); + if (ret_n!=NULL) { + *ret_n = gnutls_malloc(siz+1); + gcry_mpi_print(GCRYMPI_FMT_HEX, *ret_n, &siz, prime); + (*ret_n)[siz] = 0; + } + mpi_release(e); + mpi_release(g); + mpi_release(prime); + return result_size; } diff --git a/lib/gnutls_srp.h b/lib/gnutls_srp.h index b60749144c..c8731130fd 100644 --- a/lib/gnutls_srp.h +++ b/lib/gnutls_srp.h @@ -1 +1 @@ -int _gnutls_srp_gx(opaque *text, int textsize, opaque** result); +int _gnutls_srp_gx(opaque *text, int textsize, opaque** result, char** ret_g, char** ret_n); diff --git a/src/crypt.c b/src/crypt.c index e802f98e9a..7768f5229b 100644 --- a/src/crypt.c +++ b/src/crypt.c @@ -92,12 +92,16 @@ int crypt, salt; if (info.passwd != NULL) { verify_passwd( info.passwd, info.username, passwd); - free(cr); return 0; } cr = gnutls_crypt( info.username, passwd, crypt, salt); + if (cr==NULL) { + fprintf(stderr, "Cannot gnutls_crypt()...\n"); + return -1; + } + printf("%s:%s\n", info.username, cr); free(cr); return 0;