Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

support signing of server DH public parameters #869

Merged
merged 1 commit into from Dec 7, 2018
Merged

support signing of server DH public parameters #869

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
70 changes: 50 additions & 20 deletions src/XrdSecgsi/XrdSecProtocolgsi.cc
View file
Open in desktop
Expand Up @@ -1690,8 +1690,9 @@ int XrdSecProtocolgsi::Authenticate(XrdSecCredentials *cred,
String RndmTag;
String ClntMsg(256);
// Buffer related
XrdSutBuffer *bpar = 0; // Global buffer
XrdSutBuffer *bmai = 0; // Main buffer
XrdSutBuffer *bpar = 0; // Global buffer
XrdSutBuffer *bmai = 0; // Main buffer
XrdSutBucket *bck = 0; // Generic bucket
// Proxy export related
XrdOucString spxy;
XrdSutBucket *bpxy = 0;
Expand Down Expand Up @@ -1749,17 +1750,34 @@ int XrdSecProtocolgsi::Authenticate(XrdSecCredentials *cred,

case kXGC_certreq:
//
// Client required us to send our certificate and cipher public part:
// Client required us to send our certificate and cipher DH public parameters:
// add first this last one.
// Extract buffer with public info for the cipher agreement
if (!(bpub = hs->Rcip->Public(lpub)))
return ErrS(hs->ID,ei,bpar,bmai,0, kGSErrNoPublic,
"session",stepstr);
bck = new XrdSutBucket(bpub,lpub,kXRS_puk);

// If client supports decoding of signed DH, do sign them
if (hs->RemVers >= XrdSecgsiVersDHsigned) {
if (sessionKsig) {
//
// Encrypt server DH public parameters with server key
if (sessionKsig->EncryptPrivate(*bck) <= 0)
return ErrS(hs->ID,ei,bpar,bmai,0, kGSErrExportPuK,
"encrypting server DH public parameters",stepstr);
} else {
return ErrS(hs->ID,ei,bpar,bmai,0, kGSErrExportPuK,
"server signing key undefined!",stepstr);
}
}

//
// Add it to the global list
if (bpar->AddBucket(bpub,lpub,kXRS_puk) != 0)
if (bpar->AddBucket(bck) != 0)
return ErrS(hs->ID,ei,bpar,bmai,0, kGSErrAddBucket,
"main",stepstr);

//
// Add bucket with list of supported ciphers
if (bpar->AddBucket(DefCipher,kXRS_cipher_alg) != 0)
Expand Down Expand Up @@ -3069,22 +3087,6 @@ int XrdSecProtocolgsi::ClientDoCert(XrdSutBuffer *br, XrdSutBuffer **bm,
" - using default");
}

//
// Extract server public part for session cipher
if (!(bck = br->GetBucket(kXRS_puk))) {
emsg = "server public part for session cipher missing";
hs->Chain = 0;
return -1;
}
//
// Initialize session cipher
SafeDelete(sessionKey);
if (!(sessionKey =
sessionCF->Cipher(0,bck->buffer,bck->size,cip.c_str()))) {
PRINT("could not instantiate session cipher "
"using cipher public info from server");
emsg = "could not instantiate session cipher ";
}
//
// Extract server certificate
if (!(bck = br->GetBucket(kXRS_x509))) {
Expand Down Expand Up @@ -3202,6 +3204,34 @@ int XrdSecProtocolgsi::ClientDoCert(XrdSutBuffer *br, XrdSutBuffer **bm,
return -1;
}

// move this part to here, after sessionKver set, in order to verify the signature of DH parameters
// Extract server public part for session cipher
if (!(bck = br->GetBucket(kXRS_puk))) {
emsg = "server public part for session cipher missing";
hs->Chain = 0;
return -1;
}

// If client supports decoding of signed DH, do sign them
if (hs->RemVers >= XrdSecgsiVersDHsigned) {
//
// Encrypt server DH public parameters with server key
if (sessionKver->DecryptPublic(*bck) <= 0) {
emsg = "decrypting server DH public parameters";
return -1;
}
}

//
// Initialize session cipher
SafeDelete(sessionKey);
if (!(sessionKey =
sessionCF->Cipher(0,bck->buffer,bck->size,cip.c_str()))) {
PRINT("could not instantiate session cipher "
"using cipher public info from server");
emsg = "could not instantiate session cipher ";
}

// Deactivate what not needed any longer
br->Deactivate(kXRS_puk);
br->Deactivate(kXRS_x509);
Expand Down
6 changes: 5 additions & 1 deletion src/XrdSecgsi/XrdSecProtocolgsi.hh
View file
Open in desktop
Expand Up @@ -63,13 +63,17 @@ typedef XrdCryptogsiX509Chain X509Chain;

#define XrdSecPROTOIDENT "gsi"
#define XrdSecPROTOIDLEN sizeof(XrdSecPROTOIDENT)
#define XrdSecgsiVERSION 10300
#define XrdSecgsiVERSION 10400
#define XrdSecNOIPCHK 0x0001
#define XrdSecDEBUG 0x1000
#define XrdCryptoMax 10

#define kMAXBUFLEN 1024


#define XrdSecgsiVersDHsigned 10400 // Version at which started signing
// of server DH parameters

//
// Message codes either returned by server or included in buffers
enum kgsiStatus {
Expand Down