[gssapi-openssh.git] / openssh / deattack.c

/*
 * Cryptographic attack detector for ssh - source code
 *
 * Copyright (c) 1998 CORE SDI S.A., Buenos Aires, Argentina.
 *
 * All rights reserved. Redistribution and use in source and binary
 * forms, with or without modification, are permitted provided that
 * this copyright notice is retained.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
 * WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI S.A. BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
 * CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF THIS
 * SOFTWARE.
 *
 * Ariel Futoransky <futo@core-sdi.com>
 * <http://www.core-sdi.com>
 */

#include "includes.h"
RCSID("$OpenBSD: deattack.c,v 1.19 2003/09/18 08:49:45 markus Exp $");

#include "deattack.h"
#include "log.h"
#include "crc32.h"
#include "getput.h"
#include "xmalloc.h"
#include "deattack.h"

/* SSH Constants */
#define SSH_MAXBLOCKS	(32 * 1024)
#define SSH_BLOCKSIZE	(8)

/* Hashing constants */
#define HASH_MINSIZE	(8 * 1024)
#define HASH_ENTRYSIZE	(2)
#define HASH_FACTOR(x)	((x)*3/2)
#define HASH_UNUSEDCHAR	(0xff)
#define HASH_UNUSED	(0xffff)
#define HASH_IV		(0xfffe)

#define HASH_MINBLOCKS	(7*SSH_BLOCKSIZE)


/* Hash function (Input keys are cipher results) */
#define HASH(x)		GET_32BIT(x)

#define CMP(a, b)	(memcmp(a, b, SSH_BLOCKSIZE))

static void
crc_update(u_int32_t *a, u_int32_t b)
{
	b ^= *a;
	*a = ssh_crc32((u_char *) &b, sizeof(b));
}

/* detect if a block is used in a particular pattern */
static int
check_crc(u_char *S, u_char *buf, u_int32_t len,
	  u_char *IV)
{
	u_int32_t crc;
	u_char *c;

	crc = 0;
	if (IV && !CMP(S, IV)) {
		crc_update(&crc, 1);
		crc_update(&crc, 0);
	}
	for (c = buf; c < buf + len; c += SSH_BLOCKSIZE) {
		if (!CMP(S, c)) {
			crc_update(&crc, 1);
			crc_update(&crc, 0);
		} else {
			crc_update(&crc, 0);
			crc_update(&crc, 0);
		}
	}
	return (crc == 0);
}


/* Detect a crc32 compensation attack on a packet */
int
detect_attack(u_char *buf, u_int32_t len, u_char *IV)
{
	static u_int16_t *h = (u_int16_t *) NULL;
	static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE;
	u_int32_t i, j;
	u_int32_t l;
	u_char *c;
	u_char *d;

	if (len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) ||
	    len % SSH_BLOCKSIZE != 0) {
		fatal("detect_attack: bad length %d", len);
	}
	for (l = n; l < HASH_FACTOR(len / SSH_BLOCKSIZE); l = l << 2)
		;

	if (h == NULL) {
		debug("Installing crc compensation attack detector.");
		h = (u_int16_t *) xmalloc(l * HASH_ENTRYSIZE);
		n = l;
	} else {
		if (l > n) {
			h = (u_int16_t *) xrealloc(h, l * HASH_ENTRYSIZE);
			n = l;
		}
	}

	if (len <= HASH_MINBLOCKS) {
		for (c = buf; c < buf + len; c += SSH_BLOCKSIZE) {
			if (IV && (!CMP(c, IV))) {
				if ((check_crc(c, buf, len, IV)))
					return (DEATTACK_DETECTED);
				else
					break;
			}
			for (d = buf; d < c; d += SSH_BLOCKSIZE) {
				if (!CMP(c, d)) {
					if ((check_crc(c, buf, len, IV)))
						return (DEATTACK_DETECTED);
					else
						break;
				}
			}
		}
		return (DEATTACK_OK);
	}
	memset(h, HASH_UNUSEDCHAR, n * HASH_ENTRYSIZE);

	if (IV)
		h[HASH(IV) & (n - 1)] = HASH_IV;

	for (c = buf, j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) {
		for (i = HASH(c) & (n - 1); h[i] != HASH_UNUSED;
		    i = (i + 1) & (n - 1)) {
			if (h[i] == HASH_IV) {
				if (!CMP(c, IV)) {
					if (check_crc(c, buf, len, IV))
						return (DEATTACK_DETECTED);
					else
						break;
				}
			} else if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) {
				if (check_crc(c, buf, len, IV))
					return (DEATTACK_DETECTED);
				else
					break;
			}
		}
		h[i] = j;
	}
	return (DEATTACK_OK);
}
Commit	Line	Data
3c0ef626	1	/*
	2	* Cryptographic attack detector for ssh - source code
	3	*
	4	* Copyright (c) 1998 CORE SDI S.A., Buenos Aires, Argentina.
	5	*
	6	* All rights reserved. Redistribution and use in source and binary
	7	* forms, with or without modification, are permitted provided that
	8	* this copyright notice is retained.
	9	*
	10	* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
	11	* WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI S.A. BE
	12	* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
	13	* CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF THIS
	14	* SOFTWARE.
	15	*
	16	* Ariel Futoransky <futo@core-sdi.com>
	17	* <http://www.core-sdi.com>
	18	*/
	19
	20	#include "includes.h"
acc3d05e	21	RCSID("$OpenBSD: deattack.c,v 1.19 2003/09/18 08:49:45 markus Exp $");
e9a17296	22
3c0ef626	23	#include "deattack.h"
	24	#include "log.h"
	25	#include "crc32.h"
	26	#include "getput.h"
	27	#include "xmalloc.h"
e9a17296	28	#include "deattack.h"
3c0ef626	29
	30	/* SSH Constants */
	31	#define SSH_MAXBLOCKS (32 * 1024)
	32	#define SSH_BLOCKSIZE (8)
	33
	34	/* Hashing constants */
	35	#define HASH_MINSIZE (8 * 1024)
	36	#define HASH_ENTRYSIZE (2)
	37	#define HASH_FACTOR(x) ((x)*3/2)
	38	#define HASH_UNUSEDCHAR (0xff)
	39	#define HASH_UNUSED (0xffff)
e9a17296	40	#define HASH_IV (0xfffe)
3c0ef626	41
	42	#define HASH_MINBLOCKS (7*SSH_BLOCKSIZE)
	43
	44
	45	/* Hash function (Input keys are cipher results) */
	46	#define HASH(x) GET_32BIT(x)
	47
	48	#define CMP(a, b) (memcmp(a, b, SSH_BLOCKSIZE))
	49
	50	static void
	51	crc_update(u_int32_t *a, u_int32_t b)
	52	{
	53	b ^= *a;
	54	a = ssh_crc32((u_char ) &b, sizeof(b));
	55	}
	56
	57	/* detect if a block is used in a particular pattern */
	58	static int
	59	check_crc(u_char S, u_char buf, u_int32_t len,
	60	u_char *IV)
	61	{
	62	u_int32_t crc;
	63	u_char *c;
	64
	65	crc = 0;
	66	if (IV && !CMP(S, IV)) {
	67	crc_update(&crc, 1);
	68	crc_update(&crc, 0);
	69	}
	70	for (c = buf; c < buf + len; c += SSH_BLOCKSIZE) {
	71	if (!CMP(S, c)) {
	72	crc_update(&crc, 1);
	73	crc_update(&crc, 0);
	74	} else {
	75	crc_update(&crc, 0);
	76	crc_update(&crc, 0);
	77	}
	78	}
	79	return (crc == 0);
	80	}
	81
	82
	83	/* Detect a crc32 compensation attack on a packet */
	84	int
	85	detect_attack(u_char buf, u_int32_t len, u_char IV)
	86	{
	87	static u_int16_t h = (u_int16_t ) NULL;
	88	static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE;
e9a17296	89	u_int32_t i, j;
3c0ef626	90	u_int32_t l;
e9a17296	91	u_char *c;
3c0ef626	92	u_char *d;
	93
	94	if (len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) \|\|
	95	len % SSH_BLOCKSIZE != 0) {
	96	fatal("detect_attack: bad length %d", len);
	97	}
	98	for (l = n; l < HASH_FACTOR(len / SSH_BLOCKSIZE); l = l << 2)
	99	;
	100
	101	if (h == NULL) {
	102	debug("Installing crc compensation attack detector.");
acc3d05e	103	h = (u_int16_t ) xmalloc(l HASH_ENTRYSIZE);
3c0ef626	104	n = l;
3c0ef626	105	} else {
3c0ef626	106	if (l > n) {
acc3d05e	107	h = (u_int16_t ) xrealloc(h, l HASH_ENTRYSIZE);
3c0ef626	108	n = l;
3c0ef626	109	}
	110	}
	111
	112	if (len <= HASH_MINBLOCKS) {
	113	for (c = buf; c < buf + len; c += SSH_BLOCKSIZE) {
	114	if (IV && (!CMP(c, IV))) {
	115	if ((check_crc(c, buf, len, IV)))
	116	return (DEATTACK_DETECTED);
	117	else
	118	break;
	119	}
	120	for (d = buf; d < c; d += SSH_BLOCKSIZE) {
	121	if (!CMP(c, d)) {
	122	if ((check_crc(c, buf, len, IV)))
	123	return (DEATTACK_DETECTED);
	124	else
	125	break;
	126	}
	127	}
	128	}
	129	return (DEATTACK_OK);
	130	}
	131	memset(h, HASH_UNUSEDCHAR, n * HASH_ENTRYSIZE);
	132
	133	if (IV)
	134	h[HASH(IV) & (n - 1)] = HASH_IV;
	135
	136	for (c = buf, j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) {
	137	for (i = HASH(c) & (n - 1); h[i] != HASH_UNUSED;
e9a17296	138	i = (i + 1) & (n - 1)) {
3c0ef626	139	if (h[i] == HASH_IV) {
	140	if (!CMP(c, IV)) {
	141	if (check_crc(c, buf, len, IV))
	142	return (DEATTACK_DETECTED);
	143	else
	144	break;
	145	}
	146	} else if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) {
	147	if (check_crc(c, buf, len, IV))
	148	return (DEATTACK_DETECTED);
	149	else
	150	break;
	151	}
	152	}
	153	h[i] = j;
	154	}
	155	return (DEATTACK_OK);
	156	}