Commit 849179ba authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

SSL cleanup: use crypto functions through the sslgen layer 

curl_ntlm_msgs.c would previously use an #ifdef maze and direct
SSL-library calls instead of using the SSL layer we have for this
purpose.
parent 6d1ea388

lib/curl_ntlm_msgs.c

+8 −86
Original line number Diff line number Diff line
@@ -33,56 +33,6 @@ 


#define DEBUG_ME 0



#ifdef USE_SSLEAY



#  ifdef USE_OPENSSL

#    include <openssl/des.h>

#    ifndef OPENSSL_NO_MD4

#      include <openssl/md4.h>

#    endif

#    include <openssl/md5.h>

#    include <openssl/ssl.h>

#    include <openssl/rand.h>

#  else

#    include <des.h>

#    ifndef OPENSSL_NO_MD4

#      include <md4.h>

#    endif

#    include <md5.h>

#    include <ssl.h>

#    include <rand.h>

#  endif

#  include "ssluse.h"



#elif defined(USE_GNUTLS_NETTLE)



#  include <nettle/md5.h>

#  include <gnutls/gnutls.h>

#  include <gnutls/crypto.h>

#  define MD5_DIGEST_LENGTH 16



#elif defined(USE_GNUTLS)



#  include <gcrypt.h>

#  include "gtls.h"

#  define MD5_DIGEST_LENGTH 16

#  define MD4_DIGEST_LENGTH 16



#elif defined(USE_NSS)



#  include <nss.h>

#  include <pk11pub.h>

#  include <hasht.h>

#  include "nssg.h"

#  include "curl_md4.h"

#  define MD5_DIGEST_LENGTH MD5_LENGTH



#elif defined(USE_WINDOWS_SSPI)

#  include "curl_sspi.h"

#else

#  error "Can't compile NTLM support without a crypto library."

#endif



#include "urldata.h"

#include "non-ascii.h"

#include "sendf.h"
@@ -92,6 +42,12 @@ 
#include "curl_multibyte.h"

#include "curl_memory.h"



#if defined(USE_WINDOWS_SSPI)

#  include "curl_sspi.h"

#endif



#include "sslgen.h"



#define BUILDING_CURL_NTLM_MSGS_C

#include "curl_ntlm_msgs.h"
@@ -727,23 +683,7 @@ CURLcode Curl_ntlm_create_type3_message(struct SessionHandle *data, 
    unsigned char entropy[8];



    /* Need to create 8 bytes random data */

#ifdef USE_SSLEAY

    MD5_CTX MD5pw;

    Curl_ossl_seed(data); /* Initiate the seed if not already done */

    RAND_bytes(entropy, 8);

#elif defined(USE_GNUTLS_NETTLE)

    struct md5_ctx MD5pw;

    gnutls_rnd(GNUTLS_RND_RANDOM, entropy, 8);

#elif defined(USE_GNUTLS)

    gcry_md_hd_t MD5pw;

    Curl_gtls_seed(data); /* Initiate the seed if not already done */

    gcry_randomize(entropy, 8, GCRY_STRONG_RANDOM);

#elif defined(USE_NSS)

    PK11Context *MD5pw;

    unsigned int MD5len;

    Curl_nss_seed(data);  /* Initiate the seed if not already done */

    PK11_GenerateRandom(entropy, 8);

#endif

    Curl_ssl_random(data, entropy, sizeof(entropy));



    /* 8 bytes random data as challenge in lmresp */

    memcpy(lmresp, entropy, 8);
@@ -755,25 +695,7 @@ CURLcode Curl_ntlm_create_type3_message(struct SessionHandle *data, 
    memcpy(tmp, &ntlm->nonce[0], 8);

    memcpy(tmp + 8, entropy, 8);



#ifdef USE_SSLEAY

    MD5_Init(&MD5pw);

    MD5_Update(&MD5pw, tmp, 16);

    MD5_Final(md5sum, &MD5pw);

#elif defined(USE_GNUTLS_NETTLE)

    md5_init(&MD5pw);

    md5_update(&MD5pw, 16, tmp);

    md5_digest(&MD5pw, 16, md5sum);

#elif defined(USE_GNUTLS)

    gcry_md_open(&MD5pw, GCRY_MD_MD5, 0);

    gcry_md_write(MD5pw, tmp, MD5_DIGEST_LENGTH);

    memcpy(md5sum, gcry_md_read (MD5pw, 0), MD5_DIGEST_LENGTH);

    gcry_md_close(MD5pw);

#elif defined(USE_NSS)

    MD5pw = PK11_CreateDigestContext(SEC_OID_MD5);

    PK11_DigestOp(MD5pw, tmp, 16);

    PK11_DigestFinal(MD5pw, md5sum, &MD5len, MD5_DIGEST_LENGTH);

    PK11_DestroyContext(MD5pw, PR_TRUE);

#endif

    Curl_ssl_md5sum(tmp, 16, md5sum, MD5_DIGEST_LENGTH);



    /* We shall only use the first 8 bytes of md5sum, but the des

       code in Curl_ntlm_core_lm_resp only encrypt the first 8 bytes */

lib/gtls.c

+32 −0
Original line number Diff line number Diff line
@@ -1060,4 +1060,36 @@ int Curl_gtls_seed(struct SessionHandle *data) 
  return 0;

}



void Curl_gtls_random(struct SessionHandle *data,

                      unsigned char *entropy,

                      size_t length)

{

#if defined(USE_GNUTLS_NETTLE)

  (void)data;

  gnutls_rnd(GNUTLS_RND_RANDOM, entropy, length);

#elif defined(USE_GNUTLS)

  Curl_gtls_seed(data); /* Initiate the seed if not already done */

  gcry_randomize(entropy, length, GCRY_STRONG_RANDOM);

#endif

}



void Curl_gtls_md5sum(unsigned char *tmp, /* input */

                      size_t tmplen,

                      unsigned char *md5sum, /* output */

                      size_t md5len)

{

#if defined(USE_GNUTLS_NETTLE)

  struct md5_ctx MD5pw;

  md5_init(&MD5pw);

  md5_update(&MD5pw, tmplen, tmp);

  md5_digest(&MD5pw, md5len, md5sum);

#elif defined(USE_GNUTLS)

  gcry_md_hd_t MD5pw;

  gcry_md_open(&MD5pw, GCRY_MD_MD5, 0);

  gcry_md_write(MD5pw, tmp, tmplen);

  memcpy(md5sum, gcry_md_read (MD5pw, 0), md5len);

  gcry_md_close(MD5pw);

#endif

}



#endif /* USE_GNUTLS */

lib/gtls.h

+11 −1
Original line number Diff line number Diff line
@@ -7,7 +7,7 @@ 
 *                            | (__| |_| |  _ <| |___

 *                             \___|\___/|_| \_\_____|

 *

 * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.

 * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.

 *

 * This software is licensed as described in the file COPYING, which

 * you should have received as part of this distribution. The terms
@@ -47,6 +47,14 @@ size_t Curl_gtls_version(char *buffer, size_t size); 
int Curl_gtls_shutdown(struct connectdata *conn, int sockindex);

int Curl_gtls_seed(struct SessionHandle *data);



void Curl_gtls_random(struct SessionHandle *data,

                      unsigned char *entropy,

                      size_t length);

void Curl_gtls_md5sum(unsigned char *tmp, /* input */

                      size_t tmplen,

                      unsigned char *md5sum, /* output */

                      size_t md5len);



/* API setup for GnuTLS */

#define curlssl_init Curl_gtls_init

#define curlssl_cleanup Curl_gtls_cleanup
@@ -62,6 +70,8 @@ int Curl_gtls_seed(struct SessionHandle *data); 
#define curlssl_version Curl_gtls_version

#define curlssl_check_cxn(x) (x=x, -1)

#define curlssl_data_pending(x,y) (x=x, y=y, 0)

#define curlssl_random(x,y,z) Curl_gtls_random(x,y,z)

#define curlssl_md5sum(a,b,c,d) Curl_gtls_md5sum(a,b,c,d)



#endif /* USE_GNUTLS */

#endif /* HEADER_CURL_GTLS_H */

lib/nss.c

+20 −0
Original line number Diff line number Diff line
@@ -1533,4 +1533,24 @@ int Curl_nss_seed(struct SessionHandle *data) 
  return 0;

}



void Curl_nss_random(struct SessionHandle *data,

                     unsigned char *entropy,

                     size_t length)

{

  Curl_nss_seed(data);  /* Initiate the seed if not already done */

  PK11_GenerateRandom(entropy, length);

}



void Curl_nss_md5sum(unsigned char *tmp, /* input */

                     size_t tmplen,

                     unsigned char *md5sum, /* output */

                     size_t md5len)

{

  PK11Context *MD5pw = PK11_CreateDigestContext(SEC_OID_MD5);

  unsigned int MD5out;

  PK11_DigestOp(MD5pw, tmp, tmplen);

  PK11_DigestFinal(MD5pw, md5sum, &MD5out, md5len);

  PK11_DestroyContext(MD5pw, PR_TRUE);

}



#endif /* USE_NSS */

lib/nssg.h

+12 −1
Original line number Diff line number Diff line
@@ -7,7 +7,7 @@ 
 *                            | (__| |_| |  _ <| |___

 *                             \___|\___/|_| \_\_____|

 *

 * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.

 * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.

 *

 * This software is licensed as described in the file COPYING, which

 * you should have received as part of this distribution. The terms
@@ -51,6 +51,15 @@ int Curl_nss_seed(struct SessionHandle *data); 
/* initialize NSS library if not already */

CURLcode Curl_nss_force_init(struct SessionHandle *data);



void Curl_nss_random(struct SessionHandle *data,

                     unsigned char *entropy,

                     size_t length);



void Curl_nss_md5sum(unsigned char *tmp, /* input */

                     size_t tmplen,

                     unsigned char *md5sum, /* output */

                     size_t md5len);



/* API setup for NSS */

#define curlssl_init Curl_nss_init

#define curlssl_cleanup Curl_nss_cleanup
@@ -68,6 +77,8 @@ CURLcode Curl_nss_force_init(struct SessionHandle *data); 
#define curlssl_version Curl_nss_version

#define curlssl_check_cxn(x) Curl_nss_check_cxn(x)

#define curlssl_data_pending(x,y) (x=x, y=y, 0)

#define curlssl_random(x,y,z) Curl_nss_random(x,y,z)

#define curlssl_md5sum(a,b,c,d) Curl_nss_md5sum(a,b,c,d)



#endif /* USE_NSS */

#endif /* HEADER_CURL_NSSG_H */