Origin: backport, df44e6ae82ffd0f2264972ce14d48a67e008b7d2 From: Bastian Germann Date: Sun, 28 May 2023 21:26:04 +0200 Subject: Replace MD5 with OpenSSL legacy implementation Require OpenSSL for the build so that it can be used always. Drop the internal MD5 implementation and replace every occurence. Keep the HMAC MD5 implementation for now but base it on OpenSSL. Fixes: #513, #712 Signed-off-by: Bastian Germann --- diff --git a/include/Makefile.am b/include/Makefile.am index c942efa9..b525ea78 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -45,7 +45,7 @@ noinst_HEADERS = gai.h exits.h saslincludedir = $(includedir)/sasl -saslinclude_HEADERS = hmac-md5.h md5.h md5global.h sasl.h saslplug.h saslutil.h prop.h +saslinclude_HEADERS = hmac-md5.h md5global.h sasl.h saslplug.h saslutil.h prop.h noinst_PROGRAMS = makemd5 diff --git a/include/hmac-md5.h b/include/hmac-md5.h index babe0031..fb4a740c 100755 --- a/include/hmac-md5.h +++ b/include/hmac-md5.h @@ -4,6 +4,8 @@ #ifndef HMAC_MD5_H #define HMAC_MD5_H 1 +#include + #define HMAC_MD5_SIZE 16 /* intermediate MD5 context */ @@ -45,8 +47,6 @@ void _sasl_hmac_md5_precalc(HMAC_MD5_STATE *hmac, */ void _sasl_hmac_md5_import(HMAC_MD5_CTX *hmac, HMAC_MD5_STATE *state); -#define _sasl_hmac_md5_update(hmac, text, text_len) _sasl_MD5Update(&(hmac)->ictx, (text), (text_len)) - /* finish hmac from intermediate result. Intermediate result is zeroed. */ void _sasl_hmac_md5_final(unsigned char digest[HMAC_MD5_SIZE], diff --git a/include/saslplug.h b/include/saslplug.h index 54d42146..bd5eb983 100755 --- a/include/saslplug.h +++ b/include/saslplug.h @@ -7,9 +7,6 @@ #ifndef MD5GLOBAL_H #include "md5global.h" #endif -#ifndef MD5_H -#include "md5.h" -#endif #ifndef HMAC_MD5_H #include "hmac-md5.h" #endif diff --git a/lib/Makefile.am b/lib/Makefile.am index 929bf25f..8f1cc13a 100644 --- a/lib/Makefile.am +++ b/lib/Makefile.am @@ -82,7 +82,7 @@ libobj_la_LIBADD = $(LTLIBOBJS) libsasl2_la_SOURCES = $(common_sources) $(common_headers) libsasl2_la_LDFLAGS = -version-info $(sasl_version) -no-undefined -libsasl2_la_LIBADD = $(SASL_DL_LIB) $(SASL_STATIC_LIBS) $(LIB_SOCKET) $(LIB_DOOR) $(PLUGIN_COMMON_OBJS) +libsasl2_la_LIBADD = $(SASL_DL_LIB) $(SASL_STATIC_LIBS) $(LIB_SOCKET) $(LIB_DOOR) $(PLUGIN_COMMON_OBJS) -lcrypto if BUILD_LIBOBJ libsasl2_la_LIBADD += libobj.la endif diff --git a/lib/common.c b/lib/common.c index 0425abb1..da1c1287 100644 --- a/lib/common.c +++ b/lib/common.c @@ -2075,9 +2075,9 @@ _sasl_alloc_utils(sasl_conn_t *conn, utils->mutex_unlock = _sasl_mutex_utils.unlock; utils->mutex_free = _sasl_mutex_utils.free; - utils->MD5Init = &_sasl_MD5Init; - utils->MD5Update= &_sasl_MD5Update; - utils->MD5Final = &_sasl_MD5Final; + utils->MD5Init = &MD5_Init; + utils->MD5Update= &MD5_Update; + utils->MD5Final = &MD5_Final; utils->hmac_md5 = &_sasl_hmac_md5; utils->hmac_md5_init = &_sasl_hmac_md5_init; utils->hmac_md5_final = &_sasl_hmac_md5_final; diff --git a/lib/md5.c b/lib/md5.c index fbe7ae89..e327679e 100644 --- a/lib/md5.c +++ b/lib/md5.c @@ -27,292 +27,15 @@ documentation and/or software. #include #include "md5global.h" -#include "md5.h" #include "hmac-md5.h" #ifndef WIN32 # include #endif -/* Constants for MD5Transform routine. -*/ - -#define S11 7 -#define S12 12 -#define S13 17 -#define S14 22 -#define S21 5 -#define S22 9 -#define S23 14 -#define S24 20 -#define S31 4 -#define S32 11 -#define S33 16 -#define S34 23 -#define S41 6 -#define S42 10 -#define S43 15 -#define S44 21 - -static void MD5Transform PROTO_LIST ((UINT4 [4], const unsigned char [64])); -static void Encode PROTO_LIST - ((unsigned char *, UINT4 *, unsigned int)); -static void Decode PROTO_LIST - ((UINT4 *, const unsigned char *, unsigned int)); static void MD5_memcpy PROTO_LIST ((POINTER, POINTER, unsigned int)); static void MD5_memset PROTO_LIST ((POINTER, int, unsigned int)); -static unsigned char PADDING[64] = { - 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 -}; - -/* F, G, H and I are basic MD5 functions. - - */ -#ifdef I -/* This might be defined via NANA */ -#undef I -#endif - -#define F(x, y, z) (((x) & (y)) | ((~x) & (z))) -#define G(x, y, z) (((x) & (z)) | ((y) & (~z))) -#define H(x, y, z) ((x) ^ (y) ^ (z)) -#define I(x, y, z) ((y) ^ ((x) | (~z))) - -/* ROTATE_LEFT rotates x left n bits. - - */ - -#define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32-(n)))) - -/* FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4. -Rotation is separate from addition to prevent recomputation. -*/ - -#define FF(a, b, c, d, x, s, ac) { (a) += F ((b), (c), (d)) + (x) + (UINT4)(ac); (a) = ROTATE_LEFT ((a), (s)); (a) += (b); } -#define GG(a, b, c, d, x, s, ac) { (a) += G ((b), (c), (d)) + (x) + (UINT4)(ac); (a) = ROTATE_LEFT ((a), (s)); (a) += (b); } -#define HH(a, b, c, d, x, s, ac) { (a) += H ((b), (c), (d)) + (x) + (UINT4)(ac); (a) = ROTATE_LEFT ((a), (s)); (a) += (b); } -#define II(a, b, c, d, x, s, ac) { (a) += I ((b), (c), (d)) + (x) + (UINT4)(ac); (a) = ROTATE_LEFT ((a), (s)); (a) += (b); } - -/* MD5 initialization. Begins an MD5 operation, writing a new context. -*/ - -void _sasl_MD5Init (context) -MD5_CTX *context; /* context */ -{ - context->count[0] = context->count[1] = 0; - - /* Load magic initialization constants. */ - context->state[0] = 0x67452301; - context->state[1] = 0xefcdab89; - context->state[2] = 0x98badcfe; - context->state[3] = 0x10325476; -} - -/* MD5 block update operation. Continues an MD5 message-digest - operation, processing another message block, and updating the context. -*/ - -void _sasl_MD5Update (context, input, inputLen) -MD5_CTX *context; /* context */ -const unsigned char *input; /* input block */ -unsigned int inputLen; /* length of input block */ -{ - unsigned int i, index, partLen; - - /* Compute number of bytes mod 64 */ - index = (unsigned int)((context->count[0] >> 3) & 0x3F); - - /* Update number of bits */ - if ((context->count[0] += ((UINT4)inputLen << 3)) - < ((UINT4)inputLen << 3)) - context->count[1]++; - context->count[1] += ((UINT4)inputLen >> 29); - - partLen = 64 - index; - - /* Transform as many times as possible. - -*/ - if (inputLen >= partLen) { - MD5_memcpy - ((POINTER)&context->buffer[index], (POINTER)input, partLen); MD5Transform - (context->state, context->buffer); - - for (i = partLen; i + 63 < inputLen; i += 64) - MD5Transform (context->state, &input[i]); - - index = 0; - } - else - i = 0; - - /* Buffer remaining input */ - MD5_memcpy - ((POINTER)&context->buffer[index], (POINTER)&input[i], - inputLen-i); - -} - -/* MD5 finalization. Ends an MD5 message-digest operation, writing the - the message digest and zeroizing the context. -*/ - -void _sasl_MD5Final (digest, context) -unsigned char digest[16]; /* message digest */ -MD5_CTX *context; /* context */ -{ - unsigned char bits[8]; - unsigned int index, padLen; - - /* Save number of bits */ - Encode (bits, context->count, 8); - - /* Pad out to 56 mod 64. */ - index = (unsigned int)((context->count[0] >> 3) & 0x3f); - padLen = (index < 56) ? (56 - index) : (120 - index); - _sasl_MD5Update (context, PADDING, padLen); - - /* Append length (before padding) */ - _sasl_MD5Update (context, bits, 8); - - /* Store state in digest */ - Encode (digest, context->state, 16); - - /* Zeroize sensitive information. */ - MD5_memset ((POINTER)context, 0, sizeof (*context)); -} - -/* MD5 basic transformation. Transforms state based on block. */ - -static void MD5Transform (state, block) -UINT4 state[4]; -const unsigned char block[64]; -{ - UINT4 a = state[0], b = state[1], c = state[2], d = state[3], x[16]; - - Decode (x, block, 64); - - /* Round 1 */ - FF (a, b, c, d, x[ 0], S11, 0xd76aa478); /* 1 */ - FF (d, a, b, c, x[ 1], S12, 0xe8c7b756); /* 2 */ - FF (c, d, a, b, x[ 2], S13, 0x242070db); /* 3 */ - FF (b, c, d, a, x[ 3], S14, 0xc1bdceee); /* 4 */ - FF (a, b, c, d, x[ 4], S11, 0xf57c0faf); /* 5 */ - FF (d, a, b, c, x[ 5], S12, 0x4787c62a); /* 6 */ - FF (c, d, a, b, x[ 6], S13, 0xa8304613); /* 7 */ - FF (b, c, d, a, x[ 7], S14, 0xfd469501); /* 8 */ - FF (a, b, c, d, x[ 8], S11, 0x698098d8); /* 9 */ - FF (d, a, b, c, x[ 9], S12, 0x8b44f7af); /* 10 */ - FF (c, d, a, b, x[10], S13, 0xffff5bb1); /* 11 */ - FF (b, c, d, a, x[11], S14, 0x895cd7be); /* 12 */ - FF (a, b, c, d, x[12], S11, 0x6b901122); /* 13 */ - FF (d, a, b, c, x[13], S12, 0xfd987193); /* 14 */ - FF (c, d, a, b, x[14], S13, 0xa679438e); /* 15 */ - FF (b, c, d, a, x[15], S14, 0x49b40821); /* 16 */ - - /* Round 2 */ - GG (a, b, c, d, x[ 1], S21, 0xf61e2562); /* 17 */ - GG (d, a, b, c, x[ 6], S22, 0xc040b340); /* 18 */ - GG (c, d, a, b, x[11], S23, 0x265e5a51); /* 19 */ - GG (b, c, d, a, x[ 0], S24, 0xe9b6c7aa); /* 20 */ - GG (a, b, c, d, x[ 5], S21, 0xd62f105d); /* 21 */ - GG (d, a, b, c, x[10], S22, 0x2441453); /* 22 */ - GG (c, d, a, b, x[15], S23, 0xd8a1e681); /* 23 */ - GG (b, c, d, a, x[ 4], S24, 0xe7d3fbc8); /* 24 */ - GG (a, b, c, d, x[ 9], S21, 0x21e1cde6); /* 25 */ - GG (d, a, b, c, x[14], S22, 0xc33707d6); /* 26 */ - GG (c, d, a, b, x[ 3], S23, 0xf4d50d87); /* 27 */ - GG (b, c, d, a, x[ 8], S24, 0x455a14ed); /* 28 */ - GG (a, b, c, d, x[13], S21, 0xa9e3e905); /* 29 */ - GG (d, a, b, c, x[ 2], S22, 0xfcefa3f8); /* 30 */ - GG (c, d, a, b, x[ 7], S23, 0x676f02d9); /* 31 */ - GG (b, c, d, a, x[12], S24, 0x8d2a4c8a); /* 32 */ - - /* Round 3 */ - HH (a, b, c, d, x[ 5], S31, 0xfffa3942); /* 33 */ - HH (d, a, b, c, x[ 8], S32, 0x8771f681); /* 34 */ - HH (c, d, a, b, x[11], S33, 0x6d9d6122); /* 35 */ - HH (b, c, d, a, x[14], S34, 0xfde5380c); /* 36 */ - HH (a, b, c, d, x[ 1], S31, 0xa4beea44); /* 37 */ - HH (d, a, b, c, x[ 4], S32, 0x4bdecfa9); /* 38 */ - HH (c, d, a, b, x[ 7], S33, 0xf6bb4b60); /* 39 */ - HH (b, c, d, a, x[10], S34, 0xbebfbc70); /* 40 */ - HH (a, b, c, d, x[13], S31, 0x289b7ec6); /* 41 */ - HH (d, a, b, c, x[ 0], S32, 0xeaa127fa); /* 42 */ - HH (c, d, a, b, x[ 3], S33, 0xd4ef3085); /* 43 */ - HH (b, c, d, a, x[ 6], S34, 0x4881d05); /* 44 */ - HH (a, b, c, d, x[ 9], S31, 0xd9d4d039); /* 45 */ - HH (d, a, b, c, x[12], S32, 0xe6db99e5); /* 46 */ - HH (c, d, a, b, x[15], S33, 0x1fa27cf8); /* 47 */ - HH (b, c, d, a, x[ 2], S34, 0xc4ac5665); /* 48 */ - - /* Round 4 */ - II (a, b, c, d, x[ 0], S41, 0xf4292244); /* 49 */ - II (d, a, b, c, x[ 7], S42, 0x432aff97); /* 50 */ - II (c, d, a, b, x[14], S43, 0xab9423a7); /* 51 */ - II (b, c, d, a, x[ 5], S44, 0xfc93a039); /* 52 */ - II (a, b, c, d, x[12], S41, 0x655b59c3); /* 53 */ - II (d, a, b, c, x[ 3], S42, 0x8f0ccc92); /* 54 */ - II (c, d, a, b, x[10], S43, 0xffeff47d); /* 55 */ - II (b, c, d, a, x[ 1], S44, 0x85845dd1); /* 56 */ - II (a, b, c, d, x[ 8], S41, 0x6fa87e4f); /* 57 */ - II (d, a, b, c, x[15], S42, 0xfe2ce6e0); /* 58 */ - II (c, d, a, b, x[ 6], S43, 0xa3014314); /* 59 */ - II (b, c, d, a, x[13], S44, 0x4e0811a1); /* 60 */ - II (a, b, c, d, x[ 4], S41, 0xf7537e82); /* 61 */ - II (d, a, b, c, x[11], S42, 0xbd3af235); /* 62 */ - II (c, d, a, b, x[ 2], S43, 0x2ad7d2bb); /* 63 */ - II (b, c, d, a, x[ 9], S44, 0xeb86d391); /* 64 */ - - state[0] += a; - state[1] += b; - state[2] += c; - state[3] += d; - - /* Zeroize sensitive information. - */ - MD5_memset ((POINTER)x, 0, sizeof (x)); -} - -/* Encodes input (UINT4) into output (unsigned char). Assumes len is - a multiple of 4. - - */ - -static void Encode (output, input, len) -unsigned char *output; -UINT4 *input; -unsigned int len; -{ - unsigned int i, j; - - for (i = 0, j = 0; j < len; i++, j += 4) { - output[j] = (unsigned char)(input[i] & 0xff); - output[j+1] = (unsigned char)((input[i] >> 8) & 0xff); - output[j+2] = (unsigned char)((input[i] >> 16) & 0xff); - output[j+3] = (unsigned char)((input[i] >> 24) & 0xff); - } -} - -/* Decodes input (unsigned char) into output (UINT4). Assumes len is - a multiple of 4. - - */ - -static void Decode (output, input, len) -UINT4 *output; -const unsigned char *input; -unsigned int len; -{ - unsigned int i, j; - - for (i = 0, j = 0; j < len; i++, j += 4) - output[i] = ((UINT4)input[j]) | (((UINT4)input[j+1]) << 8) | (((UINT4)input[j+2]) << 16) - | (((UINT4)input[j+3]) << 24); -} - /* Note: Replace "for loop" with standard memcpy if possible. */ @@ -359,9 +82,9 @@ void _sasl_hmac_md5_init(HMAC_MD5_CTX *hmac, MD5_CTX tctx; - _sasl_MD5Init(&tctx); - _sasl_MD5Update(&tctx, key, key_len); - _sasl_MD5Final(tk, &tctx); + MD5_Init(&tctx); + MD5_Update(&tctx, key, key_len); + MD5_Final(tk, &tctx); key = tk; key_len = 16; @@ -390,11 +113,11 @@ void _sasl_hmac_md5_init(HMAC_MD5_CTX *hmac, k_opad[i] ^= 0x5c; } - _sasl_MD5Init(&hmac->ictx); /* init inner context */ - _sasl_MD5Update(&hmac->ictx, k_ipad, 64); /* apply inner pad */ + MD5_Init(&hmac->ictx); /* init inner context */ + MD5_Update(&hmac->ictx, k_ipad, 64); /* apply inner pad */ - _sasl_MD5Init(&hmac->octx); /* init outer context */ - _sasl_MD5Update(&hmac->octx, k_opad, 64); /* apply outer pad */ + MD5_Init(&hmac->octx); /* init outer context */ + MD5_Update(&hmac->octx, k_opad, 64); /* apply outer pad */ /* scrub the pads and key context (if used) */ MD5_memset((POINTER)&k_ipad, 0, sizeof(k_ipad)); @@ -417,13 +140,19 @@ void _sasl_hmac_md5_precalc(HMAC_MD5_STATE *state, int key_len) { HMAC_MD5_CTX hmac; - unsigned lupe; _sasl_hmac_md5_init(&hmac, key, key_len); - for (lupe = 0; lupe < 4; lupe++) { - state->istate[lupe] = htonl(hmac.ictx.state[lupe]); - state->ostate[lupe] = htonl(hmac.octx.state[lupe]); - } + + state->istate[0] = htonl(hmac.ictx.A); + state->istate[1] = htonl(hmac.ictx.B); + state->istate[2] = htonl(hmac.ictx.C); + state->istate[3] = htonl(hmac.ictx.D); + + state->ostate[0] = htonl(hmac.octx.A); + state->ostate[1] = htonl(hmac.octx.B); + state->ostate[2] = htonl(hmac.octx.C); + state->ostate[3] = htonl(hmac.octx.D); + MD5_memset((POINTER)&hmac, 0, sizeof(hmac)); } @@ -431,24 +160,30 @@ void _sasl_hmac_md5_precalc(HMAC_MD5_STATE *state, void _sasl_hmac_md5_import(HMAC_MD5_CTX *hmac, HMAC_MD5_STATE *state) { - unsigned lupe; MD5_memset((POINTER)hmac, 0, sizeof(HMAC_MD5_CTX)); - for (lupe = 0; lupe < 4; lupe++) { - hmac->ictx.state[lupe] = ntohl(state->istate[lupe]); - hmac->octx.state[lupe] = ntohl(state->ostate[lupe]); - } + + hmac->ictx.A = ntohl(state->istate[0]); + hmac->ictx.B = ntohl(state->istate[1]); + hmac->ictx.C = ntohl(state->istate[2]); + hmac->ictx.D = ntohl(state->istate[3]); + + hmac->octx.A = ntohl(state->ostate[0]); + hmac->octx.B = ntohl(state->ostate[1]); + hmac->octx.C = ntohl(state->ostate[2]); + hmac->octx.D = ntohl(state->ostate[3]); + /* Init the counts to account for our having applied * 64 bytes of key; this works out to 0x200 (64 << 3; see * MD5Update above...) */ - hmac->ictx.count[0] = hmac->octx.count[0] = 0x200; + hmac->ictx.Nl = hmac->octx.Nl = 0x200; } void _sasl_hmac_md5_final(unsigned char digest[HMAC_MD5_SIZE], HMAC_MD5_CTX *hmac) { - _sasl_MD5Final(digest, &hmac->ictx); /* Finalize inner md5 */ - _sasl_MD5Update(&hmac->octx, digest, 16); /* Update outer ctx */ - _sasl_MD5Final(digest, &hmac->octx); /* Finalize outer md5 */ + MD5_Final(digest, &hmac->ictx); /* Finalize inner md5 */ + MD5_Update(&hmac->octx, digest, 16); /* Update outer ctx */ + MD5_Final(digest, &hmac->octx); /* Finalize outer md5 */ } @@ -474,9 +209,9 @@ unsigned char *digest; /* caller digest to be filled in */ MD5_CTX tctx; - _sasl_MD5Init(&tctx); - _sasl_MD5Update(&tctx, key, key_len); - _sasl_MD5Final(tk, &tctx); + MD5_Init(&tctx); + MD5_Update(&tctx, key, key_len); + MD5_Final(tk, &tctx); key = tk; key_len = 16; @@ -508,20 +243,20 @@ unsigned char *digest; /* caller digest to be filled in */ * perform inner MD5 */ - _sasl_MD5Init(&context); /* init context for 1st + MD5_Init(&context); /* init context for 1st * pass */ - _sasl_MD5Update(&context, k_ipad, 64); /* start with inner pad */ - _sasl_MD5Update(&context, text, text_len); /* then text of datagram */ - _sasl_MD5Final(digest, &context); /* finish up 1st pass */ + MD5_Update(&context, k_ipad, 64); /* start with inner pad */ + MD5_Update(&context, text, text_len); /* then text of datagram */ + MD5_Final(digest, &context); /* finish up 1st pass */ /* * perform outer MD5 */ - _sasl_MD5Init(&context); /* init context for 2nd + MD5_Init(&context); /* init context for 2nd * pass */ - _sasl_MD5Update(&context, k_opad, 64); /* start with outer pad */ - _sasl_MD5Update(&context, digest, 16); /* then results of 1st + MD5_Update(&context, k_opad, 64); /* start with outer pad */ + MD5_Update(&context, digest, 16); /* then results of 1st * hash */ - _sasl_MD5Final(digest, &context); /* finish up 2nd pass */ + MD5_Final(digest, &context); /* finish up 2nd pass */ }