Imported Debian patch 4.7.2-3

daemons/ipa-slapi-plugins/libotp/hotp.c

@@ -43,48 +43,139 @@
  */
 
 #include "hotp.h"
-#include <endian.h>
-#include <string.h>
-#include <syslog.h>
 #include <time.h>
-#include <openssl/hmac.h>
+
+#include <nss.h>
+#include <blapit.h>
+#include <pk11pub.h>
+#include <hasht.h>
+#include <prerror.h>
+#include <prnetdb.h>
+#include <syslog.h>
 
 struct digest_buffer {
-    unsigned char buf[EVP_MAX_MD_SIZE];
+    uint8_t buf[SHA512_LENGTH];
     unsigned int len;
 };
 
 static const struct {
     const char *algo;
-    const char *sn_mech;
+    CK_MECHANISM_TYPE mech;
 } algo2mech[] = {
-    { "sha1",   SN_sha1 },
-    { "sha256", SN_sha256 },
-    { "sha384", SN_sha384 },
-    { "sha512", SN_sha512 },
+    { "sha1",   CKM_SHA_1_HMAC },
+    { "sha256", CKM_SHA256_HMAC },
+    { "sha384", CKM_SHA384_HMAC },
+    { "sha512", CKM_SHA512_HMAC },
     { }
 };
 
-static bool hmac(const struct hotp_token_key *key, const char *sn_mech,
-                 uint64_t counter, struct digest_buffer *out)
+static PK11SymKey *
+import_key(PK11SlotInfo *slot, CK_MECHANISM_TYPE mech, SECItem *key)
 {
-    unsigned char in[sizeof(uint64_t)];
-    const EVP_MD *evp;
-    unsigned char *result;
+    uint8_t ct[(key->len / AES_BLOCK_SIZE + 1) * AES_BLOCK_SIZE];
+    uint8_t iv[AES_BLOCK_SIZE] = {};
+    SECItem ivitem = { .data = iv, .len = sizeof(iv), .type = siBuffer };
+    SECItem ctitem = { .data = ct, .len = sizeof(ct), .type = siBuffer };
+    PK11SymKey *ekey = NULL;
+    PK11SymKey *skey = NULL;
 
-    memcpy(in, &counter, sizeof(uint64_t));
+    /* Try to import the key directly. */
+    skey = PK11_ImportSymKey(slot, mech, PK11_OriginUnwrap,
+                             CKA_SIGN, key, NULL);
+    if (skey)
+        return skey;
 
-    evp = EVP_get_digestbyname(sn_mech);
-    if (evp == NULL) {
-        return false;
+    /* If we get here, we are probably in FIPS mode. Let's encrypt the key so
+     * that we can unseal it instead of loading it directly. */
+
+    /* Generate an ephemeral key. */
+    ekey = PK11_TokenKeyGenWithFlags(slot, CKM_AES_CBC_PAD, NULL,
+                                     AES_128_KEY_LENGTH, NULL,
+                                     CKF_ENCRYPT | CKF_UNWRAP,
+                                     PK11_ATTR_SESSION |
+                                     PK11_ATTR_PRIVATE |
+                                     PK11_ATTR_SENSITIVE, NULL);
+    if (!ekey) {
+        syslog(LOG_ERR, "libotp: in FIPS, PK11_TokenKeyGenWithFlags failed: %d",
+               PR_GetError());
+        goto egress;
     }
 
-    if (!HMAC(evp, (void *)key->bytes, key->len, in, sizeof(in),
-              out->buf, &out->len)) {
-        return false;
+    /* Encrypt the input key. */
+    if (PK11_Encrypt(ekey, CKM_AES_CBC_PAD, &ivitem, ctitem.data, &ctitem.len,
+                     ctitem.len, key->data, key->len) != SECSuccess) {
+        syslog(LOG_ERR, "libotp: in FIPS, PK11_Encrypt failed: %d",
+               PR_GetError());
+        goto egress;
     }
 
-    return true;
+    /* Unwrap the input key. */
+    skey = PK11_UnwrapSymKey(ekey, CKM_AES_CBC_PAD, &ivitem,
+                             &ctitem, mech, CKA_SIGN, key->len);
+    if (!skey) {
+        syslog(LOG_ERR, "libotp: in FIPS, PK11_UnwrapSymKey failed: %d",
+               PR_GetError());
+    }
+
+egress:
+    PK11_FreeSymKey(ekey);
+    return skey;
+}
+
+/*
+ * This code is mostly cargo-cult taken from here:
+ *   http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn5.html
+ *
+ * It should implement HMAC with the given mechanism (SHA: 1, 256, 384, 512).
+ */
+static bool hmac(SECItem *key, CK_MECHANISM_TYPE mech, const SECItem *in,
+                 struct digest_buffer *out)
+{
+    SECItem param = { siBuffer, NULL, 0 };
+    PK11SlotInfo *slot = NULL;
+    PK11SymKey *symkey = NULL;
+    PK11Context *ctx = NULL;
+    bool ret = false;
+    SECStatus s;
+
+    slot = PK11_GetBestSlot(mech, NULL);
+    if (slot == NULL) {
+        slot = PK11_GetInternalKeySlot();
+        if (slot == NULL) {
+            goto done;
+        }
+    }
+
+    symkey = import_key(slot, mech, key);
+    if (symkey == NULL)
+        goto done;
+
+    ctx = PK11_CreateContextBySymKey(mech, CKA_SIGN, symkey, &param);
+    if (ctx == NULL)
+        goto done;
+
+    s = PK11_DigestBegin(ctx);
+    if (s != SECSuccess)
+        goto done;
+
+    s = PK11_DigestOp(ctx, in->data, in->len);
+    if (s != SECSuccess)
+        goto done;
+
+    s = PK11_DigestFinal(ctx, out->buf, &out->len, sizeof(out->buf));
+    if (s != SECSuccess)
+        goto done;
+
+    ret = true;
+
+done:
+    if (ctx != NULL)
+        PK11_DestroyContext(ctx, PR_TRUE);
+    if (symkey != NULL)
+        PK11_FreeSymKey(symkey);
+    if (slot != NULL)
+        PK11_FreeSlot(slot);
+    return ret;
 }
 
 /*
@@ -92,34 +183,32 @@ static bool hmac(const struct hotp_token_key *key, const char *sn_mech,
  */
 bool hotp(const struct hotp_token *token, uint64_t counter, uint32_t *out)
 {
-    const char *mech = SN_sha1;
+    const SECItem cntr = { siBuffer, (uint8_t *) &counter, sizeof(counter) };
+    SECItem keyitm = { siBuffer, token->key.bytes, token->key.len };
+    CK_MECHANISM_TYPE mech = CKM_SHA_1_HMAC;
+    PRUint64 offset, binary, div;
     struct digest_buffer digest;
-    unsigned char counter_buf[sizeof(uint64_t)];
-    const EVP_MD *evp;
     int digits = token->digits;
     int i;
-    uint64_t div, offset, binary;
 
     /* Convert counter to network byte order. */
-    counter = htobe64(counter);
-
-    /* Copy counter to buffer */
-    memcpy(counter_buf, &counter, sizeof(uint64_t));
+    counter = PR_htonll(counter);
 
     /* Find the mech. */
     for (i = 0; algo2mech[i].algo; i++) {
         if (strcasecmp(algo2mech[i].algo, token->algo) == 0) {
-            mech = algo2mech[i].sn_mech;
+            mech = algo2mech[i].mech;
             break;
         }
     }
+
     /* Create the digits divisor. */
     for (div = 1; digits > 0; digits--) {
         div *= 10;
     }
 
     /* Do the digest. */
-    if (!hmac(&(token->key), mech, counter, &digest)) {
+    if (!hmac(&keyitm, mech, &cntr, &digest)) {
         return false;
     }