Skip to content

Commit ce1d134

Browse files
arif-pragmasysarif-pragmasys
committed
cng digest code changes to replace openssl digest
1 parent 89452c8 commit ce1d134

File tree

3 files changed

+229
-4
lines changed

3 files changed

+229
-4
lines changed

‎Makefile.in

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
8787
msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
8888
ssh-pkcs11.o smult_curve25519_ref.o \
8989
poly1305.o chacha.o cipher-chachapoly.o \
90-
ssh-ed25519.o digest-openssl.o digest-libc.o hmac.o \
90+
ssh-ed25519.o digest-libc.o hmac.o \
9191
sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o blocks.o \
9292
kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
9393
kexdhc.o kexgexc.o kexecdhc.o kexc25519c.o \

‎contrib/win32/win32compat/Makefile.in

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ WIN32COMPATFILES = daemon.o gettimeofday.o homedirhelp.o pwd.o sfds.o \
2323

2424
WIN32COMPATLIB=@LIBWIN32COMPAT@
2525

26-
CNGFILES=cng_cipher.o
26+
CNGFILES=cng_cipher.o cng_digest.o
2727

2828

2929
.c.o:
@@ -44,6 +44,6 @@ distclean: clean
4444

4545
$(WIN32COMPATFILES): ../../../config.h
4646

47-
$(WIN32COMPATLIB): $(WIN32COMPATFILES)
48-
$(AR) rv $@ $(WIN32COMPATFILES)
47+
$(WIN32COMPATLIB): $(WIN32COMPATFILES) $(CNGFILES)
48+
$(AR) rv $@ $(WIN32COMPATFILES) $(CNGFILES)
4949
$(RANLIB) $@

‎contrib/win32/win32compat/cng_digest.c

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
/* digest_cng.c
2+
* Author: Pragma Systems, Inc. <www.pragmasys.com>
3+
* Contribution by Pragma Systems, Inc. for Microsoft openssh win32 port
4+
* Copyright (c) 2011, 2015 Pragma Systems, Inc.
5+
* All rights reserved
6+
*
7+
* Common library for Windows Console Screen IO.
8+
* Contains Windows console related definition so that emulation code can draw
9+
* on Windows console screen surface.
10+
*
11+
* Redistribution and use in source and binary forms, with or without
12+
* modification, are permitted provided that the following conditions are met:
13+
*
14+
* 1. Redistributions of source code must retain the above copyright notice.
15+
* 2. Binaries produced provide no direct or implied warranties or any
16+
* guarantee of performance or suitability.
17+
*/
18+
19+
typedef unsigned int u_int;
20+
typedef unsigned char u_char;
21+
22+
23+
#include <limits.h>
24+
#include <string.h>
25+
26+
#include <digest.h>
27+
#include <ssherr.h>
28+
29+
#include <Windows.h>
30+
#include <bcrypt.h>
31+
32+
33+
const u_char *sshbuf_ptr(const struct sshbuf *buf);
34+
size_t sshbuf_len(const struct sshbuf *buf);
35+
36+
37+
38+
struct ssh_digest_ctx {
39+
int alg;
40+
BCRYPT_ALG_HANDLE cng_alg_handle;
41+
BCRYPT_HASH_HANDLE hash_handle;
42+
};
43+
44+
struct ssh_digest {
45+
int id;
46+
const char *name;
47+
size_t digest_len;
48+
const wchar_t * cng_alg_name;
49+
};
50+
51+
/* NB. Indexed directly by algorithm number */
52+
const struct ssh_digest digests[] = {
53+
{ SSH_DIGEST_MD5, "MD5", 16, BCRYPT_MD5_ALGORITHM },
54+
{ SSH_DIGEST_RIPEMD160, "RIPEMD160", 20, NULL }, /* not supported */
55+
{ SSH_DIGEST_SHA1, "SHA1", 20, BCRYPT_SHA1_ALGORITHM },
56+
{ SSH_DIGEST_SHA256, "SHA256", 32, BCRYPT_SHA256_ALGORITHM },
57+
{ SSH_DIGEST_SHA384, "SHA384", 48, BCRYPT_SHA384_ALGORITHM },
58+
{ SSH_DIGEST_SHA512, "SHA512", 64, BCRYPT_SHA512_ALGORITHM },
59+
{ -1, NULL, 0, NULL },
60+
};
61+
62+
static const struct ssh_digest *
63+
ssh_digest_by_alg(int alg)
64+
{
65+
if (alg < 0 || alg >= SSH_DIGEST_MAX)
66+
return NULL;
67+
if (digests[alg].id != alg) /* sanity */
68+
return NULL;
69+
if (digests[alg].cng_alg_name == NULL)
70+
return NULL;
71+
return &(digests[alg]);
72+
}
73+
74+
int
75+
ssh_digest_alg_by_name(const char *name)
76+
{
77+
int alg;
78+
79+
for (alg = 0; digests[alg].id != -1; alg++) {
80+
if (_stricmp(name, digests[alg].name) == 0)
81+
return digests[alg].id;
82+
}
83+
return -1;
84+
}
85+
86+
const char *
87+
ssh_digest_alg_name(int alg)
88+
{
89+
const struct ssh_digest *digest = ssh_digest_by_alg(alg);
90+
91+
return digest == NULL ? NULL : digest->name;
92+
}
93+
94+
size_t
95+
ssh_digest_bytes(int alg)
96+
{
97+
const struct ssh_digest *digest = ssh_digest_by_alg(alg);
98+
99+
return digest == NULL ? 0 : digest->digest_len;
100+
}
101+
102+
size_t
103+
ssh_digest_blocksize(struct ssh_digest_ctx *ctx)
104+
{
105+
HRESULT hr = S_OK;
106+
DWORD blocksize = 0;
107+
DWORD count;
108+
109+
hr = BCryptGetProperty(ctx->cng_alg_handle, BCRYPT_HASH_BLOCK_LENGTH, (PUCHAR)&blocksize, sizeof(DWORD), &count, 0);
110+
111+
return (size_t)blocksize;
112+
}
113+
114+
struct ssh_digest_ctx *
115+
ssh_digest_start(int alg)
116+
{
117+
const struct ssh_digest *digest = ssh_digest_by_alg(alg);
118+
struct ssh_digest_ctx *ret;
119+
HRESULT hr = S_OK;
120+
121+
if (digest == NULL || ((ret = (struct ssh_digest_ctx *)malloc(sizeof(*ret))) == NULL))
122+
return NULL;
123+
ret->alg = alg;
124+
125+
if ((hr = BCryptOpenAlgorithmProvider(&(ret->cng_alg_handle), digest->cng_alg_name, NULL, 0)) != S_OK){
126+
free(ret);
127+
return NULL;
128+
}
129+
130+
if ((hr = BCryptCreateHash(ret->cng_alg_handle, &(ret->hash_handle), NULL, 0, NULL, 0, BCRYPT_HASH_REUSABLE_FLAG)) != S_OK)
131+
{
132+
BCryptCloseAlgorithmProvider(ret->cng_alg_handle, 0);
133+
free(ret);
134+
return NULL;
135+
136+
}
137+
138+
return ret;
139+
}
140+
141+
int
142+
ssh_digest_copy_state(struct ssh_digest_ctx *from, struct ssh_digest_ctx *to)
143+
{
144+
HRESULT hr = S_OK;
145+
146+
if (from->alg != to->alg)
147+
return SSH_ERR_INVALID_ARGUMENT;
148+
if ((hr = BCryptDuplicateHash(from->hash_handle, &(to->hash_handle),NULL,0,0)) != S_OK)
149+
return SSH_ERR_LIBCRYPTO_ERROR;
150+
return 0;
151+
}
152+
153+
int
154+
ssh_digest_update(struct ssh_digest_ctx *ctx, const void *m, size_t mlen)
155+
{
156+
HRESULT hr = S_OK;
157+
if ((hr = BCryptHashData(ctx->hash_handle, (PUCHAR)m, mlen, 0)) != S_OK)
158+
return SSH_ERR_LIBCRYPTO_ERROR;
159+
return 0;
160+
}
161+
162+
int
163+
ssh_digest_update_buffer(struct ssh_digest_ctx *ctx, const struct sshbuf *b)
164+
{
165+
return ssh_digest_update(ctx, sshbuf_ptr(b), sshbuf_len(b));
166+
}
167+
168+
int
169+
ssh_digest_final(struct ssh_digest_ctx *ctx, u_char *d, size_t dlen)
170+
{
171+
const struct ssh_digest *digest = ssh_digest_by_alg(ctx->alg);
172+
u_int l = dlen;
173+
HRESULT hr = S_OK;
174+
175+
if (dlen > UINT_MAX)
176+
return SSH_ERR_INVALID_ARGUMENT;
177+
if (dlen < digest->digest_len) /* No truncation allowed */
178+
return SSH_ERR_INVALID_ARGUMENT;
179+
if ((hr = BCryptFinishHash(ctx->hash_handle, d, digest->digest_len, 0)) != S_OK)
180+
return SSH_ERR_LIBCRYPTO_ERROR;
181+
return 0;
182+
}
183+
184+
void
185+
ssh_digest_free(struct ssh_digest_ctx *ctx)
186+
{
187+
if (ctx != NULL) {
188+
BCryptCloseAlgorithmProvider(ctx->cng_alg_handle, 0);
189+
BCryptDestroyHash(ctx->hash_handle);
190+
explicit_bzero(ctx, sizeof(*ctx));
191+
free(ctx);
192+
}
193+
}
194+
195+
int
196+
ssh_digest_memory(int alg, const void *m, size_t mlen, u_char *d, size_t dlen)
197+
{
198+
const struct ssh_digest *digest = ssh_digest_by_alg(alg);
199+
struct ssh_digest_ctx *ctx = ssh_digest_start(alg);
200+
u_int mdlen;
201+
202+
if (digest == NULL)
203+
return SSH_ERR_INVALID_ARGUMENT;
204+
if (dlen > UINT_MAX)
205+
return SSH_ERR_INVALID_ARGUMENT;
206+
if (dlen < digest->digest_len)
207+
return SSH_ERR_INVALID_ARGUMENT;
208+
mdlen = dlen;
209+
if (ssh_digest_update(ctx, m, mlen) != 0 ||
210+
ssh_digest_final(ctx, d, dlen) != 0)
211+
return -1;
212+
ssh_digest_free(ctx);
213+
return 0;
214+
}
215+
216+
const u_char *sshbuf_ptr(const struct sshbuf *buf);
217+
size_t sshbuf_len(const struct sshbuf *buf);
218+
219+
220+
int
221+
ssh_digest_buffer(int alg, const struct sshbuf *b, u_char *d, size_t dlen)
222+
{
223+
return ssh_digest_memory(alg, sshbuf_ptr(b), sshbuf_len(b), d, dlen);
224+
return 0;
225+
}

0 commit comments

Comments
 (0)