diff options
| -rw-r--r-- | ChangeLog | 8 | ||||
| -rw-r--r-- | deattack.c | 33 | ||||
| -rw-r--r-- | deattack.h | 4 |
3 files changed, 15 insertions, 30 deletions
@@ -56,6 +56,12 @@ - jakob@cvs.openbsd.org 2006/03/22 21:16:24 [ssh.1] simplify SSHFP example; ok jmc@ + - djm@cvs.openbsd.org 2006/03/22 21:27:15 + [deattack.c deattack.h] + remove IV support from the CRC attack detector, OpenSSH has never used + it - it only applied to IDEA-CFB, which we don't support. + prompted by NetBSD Coverity report via elad AT netbsd.org; + feedback markus@ "nuke it" deraadt@ 20060318 - (djm) [auth-pam.c] Fix memleak in error path, from Coverity via @@ -4248,4 +4254,4 @@ - (djm) Trim deprecated options from INSTALL. Mention UsePAM - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu -$Id: ChangeLog,v 1.4240 2006/03/25 13:07:02 djm Exp $ +$Id: ChangeLog,v 1.4241 2006/03/25 13:11:46 djm Exp $ @@ -49,22 +49,17 @@ static void crc_update(u_int32_t *a, u_int32_t b) { b ^= *a; - *a = ssh_crc32((u_char *) &b, sizeof(b)); + *a = ssh_crc32((u_char *)&b, sizeof(b)); } /* detect if a block is used in a particular pattern */ static int -check_crc(u_char *S, u_char *buf, u_int32_t len, - u_char *IV) +check_crc(u_char *S, u_char *buf, u_int32_t len) { u_int32_t crc; u_char *c; crc = 0; - if (IV && !CMP(S, IV)) { - crc_update(&crc, 1); - crc_update(&crc, 0); - } for (c = buf; c < buf + len; c += SSH_BLOCKSIZE) { if (!CMP(S, c)) { crc_update(&crc, 1); @@ -80,7 +75,7 @@ check_crc(u_char *S, u_char *buf, u_int32_t len, /* Detect a crc32 compensation attack on a packet */ int -detect_attack(u_char *buf, u_int32_t len, u_char *IV) +detect_attack(u_char *buf, u_int32_t len) { static u_int16_t *h = (u_int16_t *) NULL; static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE; @@ -109,15 +104,9 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV) if (len <= HASH_MINBLOCKS) { for (c = buf; c < buf + len; c += SSH_BLOCKSIZE) { - if (IV && (!CMP(c, IV))) { - if ((check_crc(c, buf, len, IV))) - return (DEATTACK_DETECTED); - else - break; - } for (d = buf; d < c; d += SSH_BLOCKSIZE) { if (!CMP(c, d)) { - if ((check_crc(c, buf, len, IV))) + if ((check_crc(c, buf, len))) return (DEATTACK_DETECTED); else break; @@ -128,21 +117,11 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV) } memset(h, HASH_UNUSEDCHAR, n * HASH_ENTRYSIZE); - if (IV) - h[HASH(IV) & (n - 1)] = HASH_IV; - for (c = buf, j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) { for (i = HASH(c) & (n - 1); h[i] != HASH_UNUSED; i = (i + 1) & (n - 1)) { - if (h[i] == HASH_IV) { - if (!CMP(c, IV)) { - if (check_crc(c, buf, len, IV)) - return (DEATTACK_DETECTED); - else - break; - } - } else if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) { - if (check_crc(c, buf, len, IV)) + if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) { + if (check_crc(c, buf, len)) return (DEATTACK_DETECTED); else break; @@ -1,4 +1,4 @@ -/* $OpenBSD: deattack.h,v 1.7 2001/06/26 17:27:23 markus Exp $ */ +/* $OpenBSD: deattack.h,v 1.8 2006/03/22 21:27:15 djm Exp $ */ /* * Cryptographic attack detector for ssh - Header file @@ -26,5 +26,5 @@ #define DEATTACK_OK 0 #define DEATTACK_DETECTED 1 -int detect_attack(u_char *, u_int32_t, u_char[8]); +int detect_attack(u_char *, u_int32_t); #endif |