mirror of
https://github.com/profanity-im/profanity.git
synced 2024-06-23 21:45:30 +00:00
eaf76555bd
So that off_t is defined in all files (so far http_upload.c and http_download.c too) the same way. Fix https://github.com/profanity-im/profanity/issues/1512 Thanks @pasis for finding the solution!
487 lines
13 KiB
C
487 lines
13 KiB
C
/*
|
|
* crypto.c
|
|
* vim: expandtab:ts=4:sts=4:sw=4
|
|
*
|
|
* Copyright (C) 2019 Paul Fariello <paul@fariello.eu>
|
|
*
|
|
* This file is part of Profanity.
|
|
*
|
|
* Profanity is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* Profanity is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with Profanity. If not, see <https://www.gnu.org/licenses/>.
|
|
*
|
|
* In addition, as a special exception, the copyright holders give permission to
|
|
* link the code of portions of this program with the OpenSSL library under
|
|
* certain conditions as described in each individual source file, and
|
|
* distribute linked combinations including the two.
|
|
*
|
|
* You must obey the GNU General Public License in all respects for all of the
|
|
* code used other than OpenSSL. If you modify file(s) with this exception, you
|
|
* may extend this exception to your version of the file(s), but you are not
|
|
* obligated to do so. If you do not wish to do so, delete this exception
|
|
* statement from your version. If you delete this exception statement from all
|
|
* source files in the program, then also delete it here.
|
|
*
|
|
*/
|
|
#include "config.h"
|
|
|
|
#include <assert.h>
|
|
#include <signal/signal_protocol.h>
|
|
#include <signal/signal_protocol_types.h>
|
|
|
|
#include "log.h"
|
|
#include "omemo/omemo.h"
|
|
#include "omemo/crypto.h"
|
|
|
|
#define AES256_GCM_TAG_LENGTH 16
|
|
#define AES256_GCM_BUFFER_SIZE 1024
|
|
|
|
int
|
|
omemo_crypto_init(void)
|
|
{
|
|
if (!gcry_check_version(GCRYPT_VERSION)) {
|
|
return -1;
|
|
}
|
|
|
|
gcry_control(GCRYCTL_SUSPEND_SECMEM_WARN);
|
|
|
|
gcry_control(GCRYCTL_INIT_SECMEM, 16384, 0);
|
|
|
|
gcry_control(GCRYCTL_RESUME_SECMEM_WARN);
|
|
|
|
gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
|
|
|
|
/* Ask for a first random buffer to ensure CSPRNG is initialized.
|
|
* Thus we control the memleak produced by gcrypt initialization and we can
|
|
* suppress it without having false negatives */
|
|
gcry_free(gcry_random_bytes_secure(1, GCRY_VERY_STRONG_RANDOM));
|
|
|
|
return 0;
|
|
}
|
|
|
|
int
|
|
omemo_random_func(uint8_t* data, size_t len, void* user_data)
|
|
{
|
|
gcry_randomize(data, len, GCRY_VERY_STRONG_RANDOM);
|
|
return 0;
|
|
}
|
|
|
|
int
|
|
omemo_hmac_sha256_init_func(void** hmac_context, const uint8_t* key, size_t key_len, void* user_data)
|
|
{
|
|
gcry_error_t res;
|
|
gcry_mac_hd_t hd;
|
|
|
|
res = gcry_mac_open(&hd, GCRY_MAC_HMAC_SHA256, 0, NULL);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
log_error("OMEMO: %s", gcry_strerror(res));
|
|
return OMEMO_ERR_GCRYPT;
|
|
}
|
|
|
|
*hmac_context = hd;
|
|
res = gcry_mac_setkey(hd, key, key_len);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
log_error("OMEMO: %s", gcry_strerror(res));
|
|
return OMEMO_ERR_GCRYPT;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
int
|
|
omemo_hmac_sha256_update_func(void* hmac_context, const uint8_t* data, size_t data_len, void* user_data)
|
|
{
|
|
gcry_error_t res;
|
|
|
|
res = gcry_mac_write(hmac_context, data, data_len);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
log_error("OMEMO: %s", gcry_strerror(res));
|
|
return OMEMO_ERR_GCRYPT;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
int
|
|
omemo_hmac_sha256_final_func(void* hmac_context, signal_buffer** output, void* user_data)
|
|
{
|
|
gcry_error_t res;
|
|
size_t mac_len = 32;
|
|
unsigned char out[mac_len];
|
|
|
|
res = gcry_mac_read(hmac_context, out, &mac_len);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
log_error("OMEMO: %s", gcry_strerror(res));
|
|
return OMEMO_ERR_GCRYPT;
|
|
}
|
|
|
|
*output = signal_buffer_create(out, mac_len);
|
|
return 0;
|
|
}
|
|
|
|
void
|
|
omemo_hmac_sha256_cleanup_func(void* hmac_context, void* user_data)
|
|
{
|
|
gcry_mac_close(hmac_context);
|
|
}
|
|
|
|
int
|
|
omemo_sha512_digest_init_func(void** digest_context, void* user_data)
|
|
{
|
|
gcry_error_t res;
|
|
gcry_md_hd_t hd;
|
|
|
|
res = gcry_md_open(&hd, GCRY_MD_SHA512, 0);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
log_error("OMEMO: %s", gcry_strerror(res));
|
|
return OMEMO_ERR_GCRYPT;
|
|
}
|
|
|
|
*digest_context = hd;
|
|
|
|
return 0;
|
|
}
|
|
|
|
int
|
|
omemo_sha512_digest_update_func(void* digest_context, const uint8_t* data, size_t data_len, void* user_data)
|
|
{
|
|
gcry_md_write(digest_context, data, data_len);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int
|
|
omemo_sha512_digest_final_func(void* digest_context, signal_buffer** output, void* user_data)
|
|
{
|
|
gcry_error_t res;
|
|
unsigned char out[64];
|
|
|
|
res = gcry_md_extract(digest_context, GCRY_MD_SHA512, out, 64);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
log_error("OMEMO: %s", gcry_strerror(res));
|
|
return OMEMO_ERR_GCRYPT;
|
|
}
|
|
|
|
*output = signal_buffer_create(out, 64);
|
|
return 0;
|
|
}
|
|
|
|
void
|
|
omemo_sha512_digest_cleanup_func(void* digest_context, void* user_data)
|
|
{
|
|
gcry_md_close(digest_context);
|
|
}
|
|
|
|
int
|
|
omemo_encrypt_func(signal_buffer** output, int cipher, const uint8_t* key, size_t key_len, const uint8_t* iv, size_t iv_len,
|
|
const uint8_t* plaintext, size_t plaintext_len, void* user_data)
|
|
{
|
|
gcry_cipher_hd_t hd;
|
|
unsigned char* padded_plaintext;
|
|
unsigned char* ciphertext;
|
|
size_t ciphertext_len;
|
|
int mode;
|
|
int algo;
|
|
uint8_t padding = 0;
|
|
|
|
switch (key_len) {
|
|
case 32:
|
|
algo = GCRY_CIPHER_AES256;
|
|
break;
|
|
default:
|
|
return OMEMO_ERR_UNSUPPORTED_CRYPTO;
|
|
}
|
|
|
|
switch (cipher) {
|
|
case SG_CIPHER_AES_CBC_PKCS5:
|
|
mode = GCRY_CIPHER_MODE_CBC;
|
|
break;
|
|
default:
|
|
return OMEMO_ERR_UNSUPPORTED_CRYPTO;
|
|
}
|
|
|
|
gcry_cipher_open(&hd, algo, mode, GCRY_CIPHER_SECURE);
|
|
|
|
gcry_cipher_setkey(hd, key, key_len);
|
|
|
|
switch (cipher) {
|
|
case SG_CIPHER_AES_CBC_PKCS5:
|
|
gcry_cipher_setiv(hd, iv, iv_len);
|
|
padding = 16 - (plaintext_len % 16);
|
|
break;
|
|
default:
|
|
assert(FALSE);
|
|
}
|
|
|
|
padded_plaintext = malloc(plaintext_len + padding);
|
|
memcpy(padded_plaintext, plaintext, plaintext_len);
|
|
memset(padded_plaintext + plaintext_len, padding, padding);
|
|
|
|
ciphertext_len = plaintext_len + padding;
|
|
ciphertext = malloc(ciphertext_len);
|
|
gcry_cipher_encrypt(hd, ciphertext, ciphertext_len, padded_plaintext, plaintext_len + padding);
|
|
|
|
*output = signal_buffer_create(ciphertext, ciphertext_len);
|
|
free(padded_plaintext);
|
|
free(ciphertext);
|
|
|
|
gcry_cipher_close(hd);
|
|
|
|
return SG_SUCCESS;
|
|
}
|
|
|
|
int
|
|
omemo_decrypt_func(signal_buffer** output, int cipher, const uint8_t* key, size_t key_len, const uint8_t* iv, size_t iv_len,
|
|
const uint8_t* ciphertext, size_t ciphertext_len, void* user_data)
|
|
{
|
|
int ret = SG_SUCCESS;
|
|
gcry_cipher_hd_t hd;
|
|
unsigned char* plaintext;
|
|
size_t plaintext_len;
|
|
int mode;
|
|
int algo;
|
|
uint8_t padding = 0;
|
|
|
|
switch (key_len) {
|
|
case 32:
|
|
algo = GCRY_CIPHER_AES256;
|
|
break;
|
|
default:
|
|
return OMEMO_ERR_UNSUPPORTED_CRYPTO;
|
|
}
|
|
|
|
switch (cipher) {
|
|
case SG_CIPHER_AES_CBC_PKCS5:
|
|
mode = GCRY_CIPHER_MODE_CBC;
|
|
break;
|
|
default:
|
|
return OMEMO_ERR_UNSUPPORTED_CRYPTO;
|
|
}
|
|
|
|
gcry_cipher_open(&hd, algo, mode, GCRY_CIPHER_SECURE);
|
|
|
|
gcry_cipher_setkey(hd, key, key_len);
|
|
|
|
switch (cipher) {
|
|
case SG_CIPHER_AES_CBC_PKCS5:
|
|
gcry_cipher_setiv(hd, iv, iv_len);
|
|
break;
|
|
default:
|
|
assert(FALSE);
|
|
}
|
|
|
|
plaintext_len = ciphertext_len;
|
|
plaintext = malloc(plaintext_len);
|
|
gcry_cipher_decrypt(hd, plaintext, plaintext_len, ciphertext, ciphertext_len);
|
|
|
|
switch (cipher) {
|
|
case SG_CIPHER_AES_CBC_PKCS5:
|
|
padding = plaintext[plaintext_len - 1];
|
|
break;
|
|
default:
|
|
assert(FALSE);
|
|
}
|
|
|
|
for (int i = 0; i < padding; i++) {
|
|
if (plaintext[plaintext_len - 1 - i] != padding) {
|
|
ret = SG_ERR_UNKNOWN;
|
|
goto out;
|
|
}
|
|
}
|
|
|
|
*output = signal_buffer_create(plaintext, plaintext_len - padding);
|
|
|
|
out:
|
|
free(plaintext);
|
|
|
|
gcry_cipher_close(hd);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int
|
|
aes128gcm_encrypt(unsigned char* ciphertext, size_t* ciphertext_len, unsigned char* tag, size_t* tag_len, const unsigned char* const plaintext, size_t plaintext_len, const unsigned char* const iv, const unsigned char* const key)
|
|
{
|
|
gcry_error_t res;
|
|
gcry_cipher_hd_t hd;
|
|
|
|
res = gcry_cipher_open(&hd, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_GCM, GCRY_CIPHER_SECURE);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
res = gcry_cipher_setkey(hd, key, AES128_GCM_KEY_LENGTH);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
res = gcry_cipher_setiv(hd, iv, AES128_GCM_IV_LENGTH);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
res = gcry_cipher_encrypt(hd, ciphertext, *ciphertext_len, plaintext, plaintext_len);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
res = gcry_cipher_gettag(hd, tag, *tag_len);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
out:
|
|
gcry_cipher_close(hd);
|
|
return res;
|
|
}
|
|
|
|
int
|
|
aes128gcm_decrypt(unsigned char* plaintext, size_t* plaintext_len, const unsigned char* const ciphertext, size_t ciphertext_len, const unsigned char* const iv, size_t iv_len, const unsigned char* const key, const unsigned char* const tag)
|
|
{
|
|
gcry_error_t res;
|
|
gcry_cipher_hd_t hd;
|
|
|
|
res = gcry_cipher_open(&hd, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_GCM, GCRY_CIPHER_SECURE);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
res = gcry_cipher_setkey(hd, key, AES128_GCM_KEY_LENGTH);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
res = gcry_cipher_setiv(hd, iv, iv_len);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
res = gcry_cipher_decrypt(hd, plaintext, *plaintext_len, ciphertext, ciphertext_len);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
res = gcry_cipher_checktag(hd, tag, AES128_GCM_TAG_LENGTH);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
out:
|
|
gcry_cipher_close(hd);
|
|
return res;
|
|
}
|
|
|
|
gcry_error_t
|
|
aes256gcm_crypt_file(FILE* in, FILE* out, off_t file_size,
|
|
unsigned char key[], unsigned char nonce[], bool encrypt)
|
|
{
|
|
|
|
if (!gcry_control(GCRYCTL_INITIALIZATION_FINISHED_P)) {
|
|
fputs("libgcrypt has not been initialized\n", stderr);
|
|
abort();
|
|
}
|
|
|
|
if (!encrypt) {
|
|
file_size -= AES256_GCM_TAG_LENGTH;
|
|
}
|
|
|
|
gcry_error_t res;
|
|
gcry_cipher_hd_t hd;
|
|
|
|
res = gcry_cipher_open(&hd, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_GCM,
|
|
GCRY_CIPHER_SECURE);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
res = gcry_cipher_setkey(hd, key, OMEMO_AESGCM_KEY_LENGTH);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
res = gcry_cipher_setiv(hd, nonce, OMEMO_AESGCM_NONCE_LENGTH);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
unsigned char buffer[AES256_GCM_BUFFER_SIZE];
|
|
|
|
int bytes = 0;
|
|
off_t bytes_read = 0, bytes_available = 0, read_size = 0;
|
|
while (bytes_read < file_size) {
|
|
bytes_available = file_size - bytes_read;
|
|
if (!bytes_available || ferror(in) != 0) {
|
|
break;
|
|
}
|
|
|
|
if (bytes_available < AES256_GCM_BUFFER_SIZE) {
|
|
read_size = bytes_available;
|
|
gcry_cipher_final(hd); // Signal last round of bytes.
|
|
} else {
|
|
read_size = AES256_GCM_BUFFER_SIZE;
|
|
}
|
|
|
|
bytes = fread(buffer, 1, read_size, in);
|
|
bytes_read += bytes;
|
|
|
|
if (encrypt) {
|
|
res = gcry_cipher_encrypt(hd, buffer, bytes, NULL, 0);
|
|
} else {
|
|
res = gcry_cipher_decrypt(hd, buffer, bytes, NULL, 0);
|
|
}
|
|
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
fwrite(buffer, 1, bytes, out);
|
|
}
|
|
|
|
unsigned char tag[AES256_GCM_TAG_LENGTH];
|
|
|
|
if (encrypt) {
|
|
// Append authentication tag at the end of the file.
|
|
res = gcry_cipher_gettag(hd, tag, AES256_GCM_TAG_LENGTH);
|
|
if (res != GPG_ERR_NO_ERROR) {
|
|
goto out;
|
|
}
|
|
|
|
fwrite(tag, 1, AES256_GCM_TAG_LENGTH, out);
|
|
|
|
} else {
|
|
// Read and verify authentication tag stored at the end of the file.
|
|
bytes = fread(tag, 1, AES256_GCM_TAG_LENGTH, in);
|
|
res = gcry_cipher_checktag(hd, tag, bytes);
|
|
}
|
|
|
|
out:
|
|
gcry_cipher_close(hd);
|
|
return res;
|
|
}
|
|
|
|
char*
|
|
aes256gcm_create_secure_fragment(unsigned char* key, unsigned char* nonce)
|
|
{
|
|
int key_size = OMEMO_AESGCM_KEY_LENGTH;
|
|
int nonce_size = OMEMO_AESGCM_NONCE_LENGTH;
|
|
|
|
char* fragment = gcry_malloc_secure((nonce_size + key_size) * 2 + 1);
|
|
|
|
for (int i = 0; i < nonce_size; i++) {
|
|
sprintf(&(fragment[i * 2]), "%02x", nonce[i]);
|
|
}
|
|
|
|
for (int i = 0; i < key_size; i++) {
|
|
sprintf(&(fragment[(i + nonce_size) * 2]), "%02x", key[i]);
|
|
}
|
|
|
|
return fragment;
|
|
}
|