From 8a0268f1b3f62292d4124f8d158e0587c4f7c330 Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Fri, 16 Jul 2010 13:57:51 +1000 Subject: - djm@cvs.openbsd.org 2010/07/13 11:52:06 [auth-rsa.c channels.c jpake.c key.c misc.c misc.h monitor.c] [packet.c ssh-rsa.c] implement a timing_safe_cmp() function to compare memory without leaking timing information by short-circuiting like memcmp() and use it for some of the more sensitive comparisons (though nothing high-value was readily attackable anyway); "looks ok" markus@ --- misc.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'misc.h') diff --git a/misc.h b/misc.h index 32073acd4..7a02a03a5 100644 --- a/misc.h +++ b/misc.h @@ -1,4 +1,4 @@ -/* $OpenBSD: misc.h,v 1.41 2010/01/09 23:04:13 dtucker Exp $ */ +/* $OpenBSD: misc.h,v 1.42 2010/07/13 11:52:06 djm Exp $ */ /* * Author: Tatu Ylonen @@ -36,6 +36,7 @@ void sanitise_stdfd(void); void ms_subtract_diff(struct timeval *, int *); void ms_to_timeval(struct timeval *, int); void sock_set_v6only(int); +int timing_safe_cmp(const void *, const void *, size_t); struct passwd *pwcopy(struct passwd *); const char *ssh_gai_strerror(int); -- cgit v1.2.3 From ea1651c98e1814f54c8d4b027b31f7de1c34989c Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Fri, 16 Jul 2010 13:58:37 +1000 Subject: - djm@cvs.openbsd.org 2010/07/13 23:13:16 [auth-rsa.c channels.c jpake.c key.c misc.c misc.h monitor.c packet.c] [ssh-rsa.c] s/timing_safe_cmp/timingsafe_bcmp/g --- ChangeLog | 4 ++++ auth-rsa.c | 4 ++-- channels.c | 4 ++-- jpake.c | 4 ++-- key.c | 4 ++-- misc.c | 4 ++-- misc.h | 4 ++-- monitor.c | 12 ++++++------ packet.c | 4 ++-- ssh-rsa.c | 6 +++--- 10 files changed, 27 insertions(+), 23 deletions(-) (limited to 'misc.h') diff --git a/ChangeLog b/ChangeLog index d650f63f8..1434b3d3c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -29,6 +29,10 @@ timing information by short-circuiting like memcmp() and use it for some of the more sensitive comparisons (though nothing high-value was readily attackable anyway); "looks ok" markus@ + - djm@cvs.openbsd.org 2010/07/13 23:13:16 + [auth-rsa.c channels.c jpake.c key.c misc.c misc.h monitor.c packet.c] + [ssh-rsa.c] + s/timing_safe_cmp/timingsafe_bcmp/g 20100714 - (tim) [contrib/redhat/openssh.spec] Bug 1796: Test for skip_x11_askpass diff --git a/auth-rsa.c b/auth-rsa.c index 71abadf6c..56702d130 100644 --- a/auth-rsa.c +++ b/auth-rsa.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth-rsa.c,v 1.77 2010/07/13 11:52:06 djm Exp $ */ +/* $OpenBSD: auth-rsa.c,v 1.78 2010/07/13 23:13:16 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -116,7 +116,7 @@ auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16]) MD5_Final(mdbuf, &md); /* Verify that the response is the original challenge. */ - if (timing_safe_cmp(response, mdbuf, 16) != 0) { + if (timingsafe_bcmp(response, mdbuf, 16) != 0) { /* Wrong answer. */ return (0); } diff --git a/channels.c b/channels.c index e52946bcd..fd6244d48 100644 --- a/channels.c +++ b/channels.c @@ -1,4 +1,4 @@ -/* $OpenBSD: channels.c,v 1.307 2010/07/13 11:52:06 djm Exp $ */ +/* $OpenBSD: channels.c,v 1.308 2010/07/13 23:13:16 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -917,7 +917,7 @@ x11_open_helper(Buffer *b) } /* Check if authentication data matches our fake data. */ if (data_len != x11_fake_data_len || - timing_safe_cmp(ucp + 12 + ((proto_len + 3) & ~3), + timingsafe_bcmp(ucp + 12 + ((proto_len + 3) & ~3), x11_fake_data, x11_fake_data_len) != 0) { debug2("X11 auth data does not match fake data."); return -1; diff --git a/jpake.c b/jpake.c index 50cf5c82e..cdf65f509 100644 --- a/jpake.c +++ b/jpake.c @@ -1,4 +1,4 @@ -/* $OpenBSD: jpake.c,v 1.3 2010/07/13 11:52:06 djm Exp $ */ +/* $OpenBSD: jpake.c,v 1.4 2010/07/13 23:13:16 djm Exp $ */ /* * Copyright (c) 2008 Damien Miller. All rights reserved. * @@ -434,7 +434,7 @@ jpake_check_confirm(const BIGNUM *k, if (peer_confirm_hash_len != expected_confirm_hash_len) error("%s: confirmation length mismatch (my %u them %u)", __func__, expected_confirm_hash_len, peer_confirm_hash_len); - else if (timing_safe_cmp(peer_confirm_hash, expected_confirm_hash, + else if (timingsafe_bcmp(peer_confirm_hash, expected_confirm_hash, expected_confirm_hash_len) == 0) success = 1; bzero(expected_confirm_hash, expected_confirm_hash_len); diff --git a/key.c b/key.c index 4e31c84e4..e4aa25c03 100644 --- a/key.c +++ b/key.c @@ -1,4 +1,4 @@ -/* $OpenBSD: key.c,v 1.89 2010/07/13 11:52:06 djm Exp $ */ +/* $OpenBSD: key.c,v 1.90 2010/07/13 23:13:16 djm Exp $ */ /* * read_bignum(): * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -228,7 +228,7 @@ cert_compare(struct KeyCert *a, struct KeyCert *b) return 0; if (buffer_len(&a->certblob) != buffer_len(&b->certblob)) return 0; - if (timing_safe_cmp(buffer_ptr(&a->certblob), buffer_ptr(&b->certblob), + if (timingsafe_bcmp(buffer_ptr(&a->certblob), buffer_ptr(&b->certblob), buffer_len(&a->certblob)) != 0) return 0; return 1; diff --git a/misc.c b/misc.c index 3b98e3fc2..52f814fa2 100644 --- a/misc.c +++ b/misc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: misc.c,v 1.78 2010/07/13 11:52:06 djm Exp $ */ +/* $OpenBSD: misc.c,v 1.79 2010/07/13 23:13:16 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2005,2006 Damien Miller. All rights reserved. @@ -851,7 +851,7 @@ ms_to_timeval(struct timeval *tv, int ms) } int -timing_safe_cmp(const void *_s1, const void *_s2, size_t n) +timingsafe_bcmp(const void *_s1, const void *_s2, size_t n) { u_char *s1 = (u_char *)_s1; u_char *s2 = (u_char *)_s2; diff --git a/misc.h b/misc.h index 7a02a03a5..bb799f616 100644 --- a/misc.h +++ b/misc.h @@ -1,4 +1,4 @@ -/* $OpenBSD: misc.h,v 1.42 2010/07/13 11:52:06 djm Exp $ */ +/* $OpenBSD: misc.h,v 1.43 2010/07/13 23:13:16 djm Exp $ */ /* * Author: Tatu Ylonen @@ -36,7 +36,7 @@ void sanitise_stdfd(void); void ms_subtract_diff(struct timeval *, int *); void ms_to_timeval(struct timeval *, int); void sock_set_v6only(int); -int timing_safe_cmp(const void *, const void *, size_t); +int timingsafe_bcmp(const void *, const void *, size_t); struct passwd *pwcopy(struct passwd *); const char *ssh_gai_strerror(int); diff --git a/monitor.c b/monitor.c index 920728398..7acbeaa65 100644 --- a/monitor.c +++ b/monitor.c @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor.c,v 1.107 2010/07/13 11:52:06 djm Exp $ */ +/* $OpenBSD: monitor.c,v 1.108 2010/07/13 23:13:16 djm Exp $ */ /* * Copyright 2002 Niels Provos * Copyright 2002 Markus Friedl @@ -518,7 +518,7 @@ monitor_allowed_key(u_char *blob, u_int bloblen) { /* make sure key is allowed */ if (key_blob == NULL || key_bloblen != bloblen || - timing_safe_cmp(key_blob, blob, key_bloblen)) + timingsafe_bcmp(key_blob, blob, key_bloblen)) return (0); return (1); } @@ -1103,14 +1103,14 @@ monitor_valid_userblob(u_char *data, u_int datalen) len = buffer_len(&b); if ((session_id2 == NULL) || (len < session_id2_len) || - (timing_safe_cmp(p, session_id2, session_id2_len) != 0)) + (timingsafe_bcmp(p, session_id2, session_id2_len) != 0)) fail++; buffer_consume(&b, session_id2_len); } else { p = buffer_get_string(&b, &len); if ((session_id2 == NULL) || (len != session_id2_len) || - (timing_safe_cmp(p, session_id2, session_id2_len) != 0)) + (timingsafe_bcmp(p, session_id2, session_id2_len) != 0)) fail++; xfree(p); } @@ -1158,7 +1158,7 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser, p = buffer_get_string(&b, &len); if ((session_id2 == NULL) || (len != session_id2_len) || - (timing_safe_cmp(p, session_id2, session_id2_len) != 0)) + (timingsafe_bcmp(p, session_id2, session_id2_len) != 0)) fail++; xfree(p); @@ -1684,7 +1684,7 @@ mm_get_kex(Buffer *m) kex->session_id = buffer_get_string(m, &kex->session_id_len); if (session_id2 == NULL || kex->session_id_len != session_id2_len || - timing_safe_cmp(kex->session_id, session_id2, session_id2_len) != 0) + timingsafe_bcmp(kex->session_id, session_id2, session_id2_len) != 0) fatal("mm_get_get: internal error: bad session id"); kex->we_need = buffer_get_int(m); kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; diff --git a/packet.c b/packet.c index 5c7ec2b5f..48f7fe613 100644 --- a/packet.c +++ b/packet.c @@ -1,4 +1,4 @@ -/* $OpenBSD: packet.c,v 1.167 2010/07/13 11:52:06 djm Exp $ */ +/* $OpenBSD: packet.c,v 1.168 2010/07/13 23:13:16 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -1307,7 +1307,7 @@ packet_read_poll2(u_int32_t *seqnr_p) macbuf = mac_compute(mac, active_state->p_read.seqnr, buffer_ptr(&active_state->incoming_packet), buffer_len(&active_state->incoming_packet)); - if (timing_safe_cmp(macbuf, buffer_ptr(&active_state->input), + if (timingsafe_bcmp(macbuf, buffer_ptr(&active_state->input), mac->mac_len) != 0) { logit("Corrupted MAC on input."); if (need > PACKET_MAX_SIZE) diff --git a/ssh-rsa.c b/ssh-rsa.c index 01f27f52c..e3f156156 100644 --- a/ssh-rsa.c +++ b/ssh-rsa.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-rsa.c,v 1.42 2010/07/13 11:52:06 djm Exp $ */ +/* $OpenBSD: ssh-rsa.c,v 1.43 2010/07/13 23:13:16 djm Exp $ */ /* * Copyright (c) 2000, 2003 Markus Friedl * @@ -250,11 +250,11 @@ openssh_RSA_verify(int type, u_char *hash, u_int hashlen, error("bad decrypted len: %d != %d + %d", len, hlen, oidlen); goto done; } - if (timing_safe_cmp(decrypted, oid, oidlen) != 0) { + if (timingsafe_bcmp(decrypted, oid, oidlen) != 0) { error("oid mismatch"); goto done; } - if (timing_safe_cmp(decrypted + oidlen, hash, hlen) != 0) { + if (timingsafe_bcmp(decrypted + oidlen, hash, hlen) != 0) { error("hash mismatch"); goto done; } -- cgit v1.2.3