summaryrefslogtreecommitdiff
path: root/libs/libssh2/src/mac.c
diff options
context:
space:
mode:
Diffstat (limited to 'libs/libssh2/src/mac.c')
-rw-r--r--libs/libssh2/src/mac.c159
1 files changed, 122 insertions, 37 deletions
diff --git a/libs/libssh2/src/mac.c b/libs/libssh2/src/mac.c
index 5ac71df4ce..db6f57a44e 100644
--- a/libs/libssh2/src/mac.c
+++ b/libs/libssh2/src/mac.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2004-2007, Sara Golemon <sarag@libssh2.org>
+/* Copyright (C) Sara Golemon <sarag@libssh2.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms,
@@ -33,20 +33,33 @@
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
* USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
* OF SUCH DAMAGE.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
*/
#include "libssh2_priv.h"
#include "mac.h"
-#ifdef LIBSSH2_MAC_NONE
+#if defined(LIBSSH2DEBUG) && defined(LIBSSH2_MAC_NONE_INSECURE)
/* mac_none_MAC
- * Minimalist MAC: No MAC
+ *
+ * Minimalist MAC: No MAC. DO NOT USE.
+ *
+ * The SSH2 Transport allows implementations to forego a message
+ * authentication code. While this is less of a security risk than using
+ * a "none" cipher, it is still not recommended as disabling MAC hashes
+ * removes a layer of security.
+ *
+ * Enabling this option will allow for "none" as a negotiable method,
+ * however it still requires that the method be advertised by the remote
+ * end and that no more-preferable methods are available.
+ *
*/
static int
mac_none_MAC(LIBSSH2_SESSION * session, unsigned char *buf,
uint32_t seqno, const unsigned char *packet,
- uint32_t packet_len, const unsigned char *addtl,
- uint32_t addtl_len, void **abstract)
+ size_t packet_len, const unsigned char *addtl,
+ size_t addtl_len, void **abstract)
{
return 0;
}
@@ -60,9 +73,10 @@ static LIBSSH2_MAC_METHOD mac_method_none = {
0,
NULL,
mac_none_MAC,
- NULL
+ NULL,
+ 0
};
-#endif /* LIBSSH2_MAC_NONE */
+#endif /* defined(LIBSSH2DEBUG) && defined(LIBSSH2_MAC_NONE_INSECURE) */
/* mac_method_common_init
* Initialize simple mac methods
@@ -73,7 +87,7 @@ mac_method_common_init(LIBSSH2_SESSION * session, unsigned char *key,
{
*abstract = key;
*free_key = 0;
- (void) session;
+ (void)session;
return 0;
}
@@ -102,15 +116,15 @@ mac_method_common_dtor(LIBSSH2_SESSION * session, void **abstract)
*/
static int
mac_method_hmac_sha2_512_hash(LIBSSH2_SESSION * session,
- unsigned char *buf, uint32_t seqno,
- const unsigned char *packet,
- uint32_t packet_len,
- const unsigned char *addtl,
- uint32_t addtl_len, void **abstract)
+ unsigned char *buf, uint32_t seqno,
+ const unsigned char *packet,
+ size_t packet_len,
+ const unsigned char *addtl,
+ size_t addtl_len, void **abstract)
{
libssh2_hmac_ctx ctx;
unsigned char seqno_buf[4];
- (void) session;
+ (void)session;
_libssh2_htonu32(seqno_buf, seqno);
@@ -127,8 +141,6 @@ mac_method_hmac_sha2_512_hash(LIBSSH2_SESSION * session,
return 0;
}
-
-
static const LIBSSH2_MAC_METHOD mac_method_hmac_sha2_512 = {
"hmac-sha2-512",
64,
@@ -136,7 +148,19 @@ static const LIBSSH2_MAC_METHOD mac_method_hmac_sha2_512 = {
mac_method_common_init,
mac_method_hmac_sha2_512_hash,
mac_method_common_dtor,
+ 0
};
+
+static const LIBSSH2_MAC_METHOD mac_method_hmac_sha2_512_etm = {
+ "hmac-sha2-512-etm@openssh.com",
+ 64,
+ 64,
+ mac_method_common_init,
+ mac_method_hmac_sha2_512_hash,
+ mac_method_common_dtor,
+ 1
+};
+
#endif
@@ -147,15 +171,15 @@ static const LIBSSH2_MAC_METHOD mac_method_hmac_sha2_512 = {
*/
static int
mac_method_hmac_sha2_256_hash(LIBSSH2_SESSION * session,
- unsigned char *buf, uint32_t seqno,
- const unsigned char *packet,
- uint32_t packet_len,
- const unsigned char *addtl,
- uint32_t addtl_len, void **abstract)
+ unsigned char *buf, uint32_t seqno,
+ const unsigned char *packet,
+ size_t packet_len,
+ const unsigned char *addtl,
+ size_t addtl_len, void **abstract)
{
libssh2_hmac_ctx ctx;
unsigned char seqno_buf[4];
- (void) session;
+ (void)session;
_libssh2_htonu32(seqno_buf, seqno);
@@ -181,7 +205,19 @@ static const LIBSSH2_MAC_METHOD mac_method_hmac_sha2_256 = {
mac_method_common_init,
mac_method_hmac_sha2_256_hash,
mac_method_common_dtor,
+ 0
};
+
+static const LIBSSH2_MAC_METHOD mac_method_hmac_sha2_256_etm = {
+ "hmac-sha2-256-etm@openssh.com",
+ 32,
+ 32,
+ mac_method_common_init,
+ mac_method_hmac_sha2_256_hash,
+ mac_method_common_dtor,
+ 1
+};
+
#endif
@@ -194,13 +230,13 @@ static int
mac_method_hmac_sha1_hash(LIBSSH2_SESSION * session,
unsigned char *buf, uint32_t seqno,
const unsigned char *packet,
- uint32_t packet_len,
+ size_t packet_len,
const unsigned char *addtl,
- uint32_t addtl_len, void **abstract)
+ size_t addtl_len, void **abstract)
{
libssh2_hmac_ctx ctx;
unsigned char seqno_buf[4];
- (void) session;
+ (void)session;
_libssh2_htonu32(seqno_buf, seqno);
@@ -226,6 +262,17 @@ static const LIBSSH2_MAC_METHOD mac_method_hmac_sha1 = {
mac_method_common_init,
mac_method_hmac_sha1_hash,
mac_method_common_dtor,
+ 0
+};
+
+static const LIBSSH2_MAC_METHOD mac_method_hmac_sha1_etm = {
+ "hmac-sha1-etm@openssh.com",
+ 20,
+ 20,
+ mac_method_common_init,
+ mac_method_hmac_sha1_hash,
+ mac_method_common_dtor,
+ 1
};
/* mac_method_hmac_sha1_96_hash
@@ -235,9 +282,9 @@ static int
mac_method_hmac_sha1_96_hash(LIBSSH2_SESSION * session,
unsigned char *buf, uint32_t seqno,
const unsigned char *packet,
- uint32_t packet_len,
+ size_t packet_len,
const unsigned char *addtl,
- uint32_t addtl_len, void **abstract)
+ size_t addtl_len, void **abstract)
{
unsigned char temp[SHA_DIGEST_LENGTH];
@@ -257,6 +304,7 @@ static const LIBSSH2_MAC_METHOD mac_method_hmac_sha1_96 = {
mac_method_common_init,
mac_method_hmac_sha1_96_hash,
mac_method_common_dtor,
+ 0
};
#if LIBSSH2_MD5
@@ -267,13 +315,13 @@ static int
mac_method_hmac_md5_hash(LIBSSH2_SESSION * session, unsigned char *buf,
uint32_t seqno,
const unsigned char *packet,
- uint32_t packet_len,
+ size_t packet_len,
const unsigned char *addtl,
- uint32_t addtl_len, void **abstract)
+ size_t addtl_len, void **abstract)
{
libssh2_hmac_ctx ctx;
unsigned char seqno_buf[4];
- (void) session;
+ (void)session;
_libssh2_htonu32(seqno_buf, seqno);
@@ -299,6 +347,7 @@ static const LIBSSH2_MAC_METHOD mac_method_hmac_md5 = {
mac_method_common_init,
mac_method_hmac_md5_hash,
mac_method_common_dtor,
+ 0
};
/* mac_method_hmac_md5_96_hash
@@ -308,9 +357,9 @@ static int
mac_method_hmac_md5_96_hash(LIBSSH2_SESSION * session,
unsigned char *buf, uint32_t seqno,
const unsigned char *packet,
- uint32_t packet_len,
+ size_t packet_len,
const unsigned char *addtl,
- uint32_t addtl_len, void **abstract)
+ size_t addtl_len, void **abstract)
{
unsigned char temp[MD5_DIGEST_LENGTH];
mac_method_hmac_md5_hash(session, temp, seqno, packet, packet_len,
@@ -328,6 +377,7 @@ static const LIBSSH2_MAC_METHOD mac_method_hmac_md5_96 = {
mac_method_common_init,
mac_method_hmac_md5_96_hash,
mac_method_common_dtor,
+ 0
};
#endif /* LIBSSH2_MD5 */
@@ -339,14 +389,14 @@ static int
mac_method_hmac_ripemd160_hash(LIBSSH2_SESSION * session,
unsigned char *buf, uint32_t seqno,
const unsigned char *packet,
- uint32_t packet_len,
+ size_t packet_len,
const unsigned char *addtl,
- uint32_t addtl_len,
+ size_t addtl_len,
void **abstract)
{
libssh2_hmac_ctx ctx;
unsigned char seqno_buf[4];
- (void) session;
+ (void)session;
_libssh2_htonu32(seqno_buf, seqno);
@@ -372,6 +422,7 @@ static const LIBSSH2_MAC_METHOD mac_method_hmac_ripemd160 = {
mac_method_common_init,
mac_method_hmac_ripemd160_hash,
mac_method_common_dtor,
+ 0
};
static const LIBSSH2_MAC_METHOD mac_method_hmac_ripemd160_openssh_com = {
@@ -381,17 +432,21 @@ static const LIBSSH2_MAC_METHOD mac_method_hmac_ripemd160_openssh_com = {
mac_method_common_init,
mac_method_hmac_ripemd160_hash,
mac_method_common_dtor,
+ 0
};
#endif /* LIBSSH2_HMAC_RIPEMD */
static const LIBSSH2_MAC_METHOD *mac_methods[] = {
#if LIBSSH2_HMAC_SHA256
&mac_method_hmac_sha2_256,
+ &mac_method_hmac_sha2_256_etm,
#endif
#if LIBSSH2_HMAC_SHA512
&mac_method_hmac_sha2_512,
+ &mac_method_hmac_sha2_512_etm,
#endif
&mac_method_hmac_sha1,
+ &mac_method_hmac_sha1_etm,
&mac_method_hmac_sha1_96,
#if LIBSSH2_MD5
&mac_method_hmac_md5,
@@ -401,9 +456,9 @@ static const LIBSSH2_MAC_METHOD *mac_methods[] = {
&mac_method_hmac_ripemd160,
&mac_method_hmac_ripemd160_openssh_com,
#endif /* LIBSSH2_HMAC_RIPEMD */
-#ifdef LIBSSH2_MAC_NONE
+#if defined(LIBSSH2DEBUG) && defined(LIBSSH2_MAC_NONE_INSECURE)
&mac_method_none,
-#endif /* LIBSSH2_MAC_NONE */
+#endif
NULL
};
@@ -412,3 +467,33 @@ _libssh2_mac_methods(void)
{
return mac_methods;
}
+
+#if LIBSSH2_AES_GCM
+/* Stub for aes256-gcm@openssh.com crypto type, which has an integrated
+ HMAC method. This must not be added to mac_methods[] since it cannot be
+ negotiated separately. */
+static const LIBSSH2_MAC_METHOD mac_method_hmac_aesgcm = {
+ "INTEGRATED-AES-GCM", /* made up name for display only */
+ 16,
+ 16,
+ NULL,
+ NULL,
+ NULL,
+ 0
+};
+#endif /* LIBSSH2_AES_GCM */
+
+/* See if the negotiated crypto method has its own authentication scheme that
+ * obviates the need for a separate negotiated hmac method */
+const LIBSSH2_MAC_METHOD *
+_libssh2_mac_override(const LIBSSH2_CRYPT_METHOD *crypt)
+{
+#if LIBSSH2_AES_GCM
+ if(!strcmp(crypt->name, "aes256-gcm@openssh.com") ||
+ !strcmp(crypt->name, "aes128-gcm@openssh.com"))
+ return &mac_method_hmac_aesgcm;
+#else
+ (void) crypt;
+#endif /* LIBSSH2_AES_GCM */
+ return NULL;
+}
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-05 08:08:52 +0000