GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 00:37:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into 'master'

Browse Source 
Fix hmac hash problem for time_t and unit64_t, they may have different size in 32bit/64bit systems

See merge request openconnect/ocserv!156
This commit is contained in:
Nikos Mavrogiannopoulos
2020-04-01 11:31:01 +00:00
parent ced7ba9fd3 899a1323a9
commit 275ab571b3
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/sec-mod-auth.c
View File

@@ -775,6 +775,7 @@ int handle_sec_auth_init(int cfd, sec_mod_st *sec, const SecAuthInitMsg *req, pi
hmac_component_st hmac_components[3];
uint8_t computed_hmac[HMAC_DIGEST_SIZE];
time_t now = time(0);
time_t session_start_time;
if (req->hmac.len != HMAC_DIGEST_SIZE || !req->hmac.data) {
seclog(sec, LOG_AUTH, "hmac is the wrong size");
@@ -782,13 +783,15 @@ int handle_sec_auth_init(int cfd, sec_mod_st *sec, const SecAuthInitMsg *req, pi
}
/* Authenticate the client parameters */
session_start_time = (time_t)req->session_start_time; // avoid time_t size problem
hmac_components[0].data = req->ip;
// req->ip is required and protobuf doesn't permit null for required parameters
hmac_components[0].length = strlen(req->ip);
hmac_components[1].data = req->our_ip;
hmac_components[1].length = req->our_ip ? strlen(req->our_ip) : 0;
hmac_components[2].data = (void*)&req->session_start_time;
hmac_components[2].length = sizeof(req->session_start_time);
hmac_components[2].data = (void*)&session_start_time;
hmac_components[2].length = sizeof(session_start_time);
generate_hmac(sizeof(sec->hmac_key), sec->hmac_key, sizeof(hmac_components) / sizeof(hmac_components[0]), hmac_components, computed_hmac);
@@ -799,7 +802,7 @@ int handle_sec_auth_init(int cfd, sec_mod_st *sec, const SecAuthInitMsg *req, pi
vhost = find_vhost(sec->vconfig, req->vhost);
if ((now - req->session_start_time) > vhost->perm_config.config->auth_timeout) {
if ((now - session_start_time) > vhost->perm_config.config->auth_timeout) {
seclog(sec, LOG_AUTH, "hmac presented by client expired - possible replay");
return -1;
}