bugfixes in sbase64 decoding/encoding.

Changes in the included bcrypt algorithm.

7 files changed, 62 insertions, 38 deletions

diff --git a/lib/auth_srp_sb64.c b/lib/auth_srp_sb64.c
index 1a0c118a6f..12e0117e3b 100644
--- a/lib/auth_srp_sb64.c
+++ b/lib/auth_srp_sb64.c
@@ -145,7 +145,7 @@ int _gnutls_sbase64_encode(uint8 * data, int data_size, uint8 ** result)
 
 	ret += (data_size * 4) / 3;
 
-	(*result) = gnutls_malloc(ret + 1);
+	(*result) = gnutls_malloc( ret + 1);
 	if ((*result) == NULL)
 		return -1;
 
@@ -175,7 +175,7 @@ int _gnutls_sbase64_encode(uint8 * data, int data_size, uint8 ** result)
 		(*result)[j+tmp] = 0;
 	}
 
-	return ret;
+	return strlen(*result);
 }
 
 
@@ -200,13 +200,13 @@ inline static int decode(uint8 * result, const uint8 * data)
 	a2 = TOASCII(data[1]);
 	if (a1 != 0xff) result[1] = ((a1 & 0x3c) >> 2);
 	if (a2 != 0xff) result[1] |= ((a2 & 0x0f) << 4);
-	else ret--;
+	else if (a1==0xff || result[1] == 0) ret--;
 	
 	a1 = a2;
 	a2 = TOASCII(data[0]);
 	if (a1 != 0xff) result[0] = (((a1 & 0x30) >> 4) & 0xff);
 	if (a2 != 0xff) result[0] |= ((a2 << 2) & 0xff);
-	else ret--;
+	else if (a1==0xff || result[0] == 0) ret--;
 
 	return ret;
 }
@@ -246,7 +246,8 @@ int _gnutls_sbase64_decode(uint8 * data, int idata_size, uint8 ** result)
 			gnutls_free( (*result));
 			return tmp;
 		}
-		memcpy(&(*result)[0], &tmpres[3-tmp], tmp);
+
+		memcpy( *result, &tmpres[3-tmp], tmp);
 		if (tmp < 3)
 			ret -= (3 - tmp);
 	}
@@ -290,7 +291,7 @@ int main()
 	siz = fread(x, 1, sizeof(x), stdin);
 
 //	siz = _gnutls_sbase64_encode(x, siz, &b64);
-    siz = _gnutls_sbase64_decode(x, siz, &b64);
+	siz = _gnutls_sbase64_decode(x, siz, &b64);
 
 
 	if (siz < 0) {
diff --git a/lib/crypt.c b/lib/crypt.c
index 3fa3153a3d..7d4896f8ba 100644
--- a/lib/crypt.c
+++ b/lib/crypt.c
@@ -29,7 +29,7 @@ char * gnutls_crypt(const char* username, const char *passwd, crypt_algo algo, i
 	switch(algo) {
 	case BLOWFISH_CRYPT: /* bcrypt */
 		/* salt in bcrypt is actually the cost */
-		return crypt_bcrypt_wrapper(passwd, salt, g, n);
+		return crypt_bcrypt_wrapper(username, passwd, salt, g, n);
 	case SRPSHA1_CRYPT: /* bcrypt */
 		/* salt in bcrypt is the salt size */
 		return crypt_srpsha1_wrapper(username, passwd, salt, g, n);
@@ -44,7 +44,7 @@ int gnutls_crypt_vrfy(const char* username, const char *passwd, char* salt, MPI
 	case '$':
 		switch(salt[1]) {
 		case '2':
-			cr = crypt_bcrypt(passwd, salt, g, n);
+			cr = crypt_bcrypt(username, passwd, salt, g, n);
 			if (cr==NULL) return 1;
 			if (strncmp(cr, salt, strlen(cr))==0) return 0;
 			break;
diff --git a/lib/crypt_bcrypt.c b/lib/crypt_bcrypt.c
index 4851d2bd75..029fa8526a 100644
--- a/lib/crypt_bcrypt.c
+++ b/lib/crypt_bcrypt.c
@@ -26,13 +26,22 @@
  * (includes a modified version of b64.c)
  */
 
+/* The differences here from the original openbsd bcrypt algorithm are:
+ * 1. we use a different b64 hash function 
+ * (the one used in SRP password files),
+ * 2. we use all the bytes from the encryption step (openbsd omited one byte),
+ * 3. we use the first 24 bytes of CONCAT(username,NULL,"Orphean...") as the 
+ * encryption string.
+ */
+ 
 #include "defines.h"
 #include "gnutls_int.h"
 #include "crypt_bcrypt.h"
 #include "gnutls_random.h"
 #include "auth_srp_passwd.h"
 #include "gnutls_srp.h"
-#include <gnutls_errors.h>
+#include "gnutls_errors.h"
+#include "debug.h"
 
 #define rotl(x,n)   (((x) << ((uint32)(n))) | ((x) >> (32 - (uint32)(n))))
 #define rotr(x,n)   (((x) >> ((uint32)(n))) | ((x) << (32 - (uint32)(n))))
@@ -588,11 +597,13 @@ static void _blf_deinit(blf_ctx * ctx)
 }
 static const char magic[] = "$2$";
 
-char *crypt_bcrypt(const char *passwd, const char *salt, MPI g, MPI n)
+#define B64TEXT "OrpheanBeholderScryDoubt"
+
+char *crypt_bcrypt(const char* username, const char *passwd, const char *salt, MPI g, MPI n)
 {
 	unsigned char *sp;
 	blf_ctx *ctx;
-	unsigned char text[24] = "OrpheanBeholderScryDoubt";
+	unsigned char text[24];
 	uint8 *csalt;
 	uint8 *rtext;
 	uint8 cost;
@@ -601,6 +612,11 @@ char *crypt_bcrypt(const char *passwd, const char *salt, MPI g, MPI n)
 	int passwd_len, vsize;
 	opaque *tmp;
 
+	/* copy username+null+B64TEXT to text */
+	strncpy( text, username, sizeof(text));
+	if ( ( sizeof(text)-strlen(username) - 1 ) > 0)
+		strncpy( &text[strlen(username)+1], B64TEXT, sizeof(text)-strlen(username)-1);
+		
 	passwd_len = strlen(passwd) + 1;	/* we want the null also */
 	if (passwd_len > 56)
 		passwd_len = 56;
@@ -617,17 +633,16 @@ char *crypt_bcrypt(const char *passwd, const char *salt, MPI g, MPI n)
 
 	len = (int)rindex(sp, ':');
 	if (len==0) { /* no ':' was found */
-		gnutls_assert();
-		return NULL;
-	}
-	len -= (int) sp;
-	
+		len = strlen(sp);
+	} else 
+		len -= (int) sp;
+
 	if (_gnutls_sbase64_decode(sp, len, &csalt) < 0) {
 		gnutls_assert();
 		return NULL;
 	}
 
-	cost = (uint8) csalt[0];
+	cost = (int) csalt[0];
 	ctx = _blf_init(&csalt[1], passwd, passwd_len, cost);
 	gnutls_free(csalt);
 
@@ -664,12 +679,14 @@ char *crypt_bcrypt(const char *passwd, const char *salt, MPI g, MPI n)
 	return tmp;
 }
 
-/* cost is stored as the first byte in salt (thus < 255) which is fine! */
-char *crypt_bcrypt_wrapper(const char *pass_new, int cost, MPI g, MPI n)
+/* cost is stored as the first byte in salt (thus < 255) which is 
+ * just fine! 
+ */
+char *crypt_bcrypt_wrapper(const char* username, const char *pass_new, int cost, MPI g, MPI n)
 {
-	unsigned char *result;
+	opaque *result;
 	char *tcp;
-	unsigned char *rand;
+	uint8 *rand;
 	char *e = NULL;
 	int result_size;
 
@@ -681,9 +698,13 @@ char *crypt_bcrypt_wrapper(const char *pass_new, int cost, MPI g, MPI n)
 		cost = 1;
 
 	rand[0] = (uint8) cost;
-	result_size = _gnutls_sbase64_encode(rand, 17, &result);
+	result_size = _gnutls_sbase64_encode( &rand[0], 17, &result);
+
+	_gnutls_free_rand(rand);
+
+	_gnutls_sbase64_decode( result, strlen(result), &rand);
+
 	if (result_size < 0) {
-		_gnutls_free_rand(rand);
 		gnutls_assert();
 		return NULL;
 	}
@@ -693,21 +714,24 @@ char *crypt_bcrypt_wrapper(const char *pass_new, int cost, MPI g, MPI n)
 
 	gnutls_free(result);
 
-	_gnutls_free_rand(rand);
 
-	e = crypt_bcrypt(pass_new, (const char *) tcp, g, n);
+	e = crypt_bcrypt(username, pass_new, (const char *) tcp, g, n);
 	gnutls_free(tcp);
 
 	return e;
 }
 
-void *_gnutls_calc_srp_bcrypt(char *passwd, opaque * salt, int salt_size, int* size)
+void *_gnutls_calc_srp_bcrypt(const char* username, const char *passwd, opaque * salt, int salt_size, int* size)
 {
 	blf_ctx *ctx;
-	opaque text[24] = "OrpheanBeholderScryDoubt";
+	opaque text[24];
 	int passwd_len, i;
 	opaque *tmp;
 
+	strncpy( text, username, sizeof(text));
+	if ( (sizeof(text)-strlen(username)-1) > 0)
+		strncpy( &text[strlen(username)+1], B64TEXT, sizeof(text)-strlen(username)-1);
+
 	*size = sizeof(text);
 	
 	/* we need 16 + cost */
@@ -717,7 +741,7 @@ void *_gnutls_calc_srp_bcrypt(char *passwd, opaque * salt, int salt_size, int* s
 	if (passwd_len > 56)
 		passwd_len = 56;
 
-	ctx = _blf_init(&salt[1], passwd, passwd_len, (uint32)salt[0]);
+	ctx = _blf_init(&salt[1], passwd, passwd_len, (int)(salt[0]));
 
 	tmp = malloc(sizeof(text));
 	memcpy(tmp, text, sizeof(text));
diff --git a/lib/crypt_bcrypt.h b/lib/crypt_bcrypt.h
index 98f04c575f..0ae362739b 100644
--- a/lib/crypt_bcrypt.h
+++ b/lib/crypt_bcrypt.h
@@ -1,3 +1,3 @@
-char * crypt_bcrypt (const char *passwd, const char *salt, MPI g, MPI n);
-char *crypt_bcrypt_wrapper(const char *pass_new, int cost, MPI g, MPI n);
-void * _gnutls_calc_srp_bcrypt( char *passwd, opaque *salt, int salt_size, int* size);
+char * crypt_bcrypt (const char* username, const char *passwd, const char *salt, MPI g, MPI n);
+char *crypt_bcrypt_wrapper(const char* username, const char *pass_new, int cost, MPI g, MPI n);
+void * _gnutls_calc_srp_bcrypt( const char* username, const char *passwd, opaque *salt, int salt_size, int* size);
diff --git a/lib/crypt_srpsha1.c b/lib/crypt_srpsha1.c
index 9cd057fd35..46cade81ed 100644
--- a/lib/crypt_srpsha1.c
+++ b/lib/crypt_srpsha1.c
@@ -64,10 +64,9 @@ char *crypt_srpsha1(const char *username, const char *passwd,
 	
 	len = (int)rindex(sp, ':');
 	if (len==0) { /* parse error */
-		gnutls_assert();
-		return NULL;
-	}
-	len -= (int)sp;
+		len = strlen(sp);
+	} else
+		len -= (int)sp;
 	
 	rsalt_size = _gnutls_sbase64_decode(sp, len, &csalt);
 	if (rsalt_size < 0) {
diff --git a/lib/gnutls_srp.c b/lib/gnutls_srp.c
index 0cb887e07e..31a269d3d2 100644
--- a/lib/gnutls_srp.c
+++ b/lib/gnutls_srp.c
@@ -23,7 +23,7 @@
 #include <gnutls_errors.h>
 #include <crypt_bcrypt.h>
 #include <gnutls_srp.h>
-#include <cert_b64.h>
+#include <auth_srp_passwd.h>
 #include "debug.h"
 
 /* These should be added in gcrypt.h */
@@ -286,7 +286,7 @@ void *_gnutls_calc_srp_x(char *username, char *password, opaque * salt,
 		return _gnutls_calc_srp_sha(username, password, salt,
 					    salt_size, size);
 	case BLOWFISH_CRYPT:
-		return _gnutls_calc_srp_bcrypt(password, salt, salt_size,
+		return _gnutls_calc_srp_bcrypt(username, password, salt, salt_size,
 					       size);
 	}
 	return NULL;
diff --git a/src/crypt.c b/src/crypt.c
index ac55d36588..086c8f631d 100644
--- a/src/crypt.c
+++ b/src/crypt.c
@@ -26,7 +26,7 @@
 #include "../lib/gnutls_int.h"
 #include "../lib/gnutls_srp.h"
 #include "../lib/crypt.h"
-#include "../lib/cert_b64.h"
+#include "../lib/auth_srp_passwd.h"
 #include "crypt-gaa.h"
 #include <pwd.h>
 #include <sys/types.h>