miniroon

Simplistic macaroon-based authorization for Unix systems
git clone https://ccx.te2000.cz/git/miniroon
Log | Files | Refs

commit acdffb8b87d1775fc79113809135a449d70b8f92
parent 1c05dacc0af8390c80bf9df66b710a612acba155
Author: Jan Pobrislo <ccx@te2000.cz>
Date:   Mon,  7 Oct 2024 21:13:11 +0000

Remove unnecessary pointers

Diffstat:
Msrc/gen-miniroon.py | 11-----------
Msrc/miniroon.c | 125+++++++++++++++++++++++++++++++++++++++++++++++--------------------------------
2 files changed, 75 insertions(+), 61 deletions(-)

diff --git a/src/gen-miniroon.py b/src/gen-miniroon.py @@ -20,17 +20,6 @@ def to_ns(b): return NetString(b'%d:%s,' % (len(b), b)) -def rec_ns(data): - if isinstance(data, NetString): - return data - return NetString.from_any(data) - if isinstance(data, bytes): - return to_ns(data) - if isinstance(data, str): - return to_ns(data.encode('ascii')) - return to_ns(b''.join(rec_ns(i) for i in data)) - - def miniroon_hmac(key, msg): print('miniroon_hmac%r' % ((key, msg),), file=sys.stderr) #return hmac.digest(key, msg, 'blake2s') diff --git a/src/miniroon.c b/src/miniroon.c @@ -2,6 +2,7 @@ #include <assert.h> #include <unistd.h> #include <stdbool.h> +#include <string.h> #include <sys/select.h> #include <skalibs/types.h> @@ -44,26 +45,26 @@ typedef struct miniroon_header_s { } miniroon_header; /* declarations */ -void dbg_print_bb(const bytebuffer *bb); -void dbg_print_bb1(const char *text, const bytebuffer *bb); -void parse_payload(bytebuffer *payload); -void parse_header(miniroon_header *header, bytebuffer *source); -void parse_caveat(bytebuffer *source); // TODO -void read_secret(bytebuffer *secret); // TODO -void hmac_b2s_256(const bytebuffer *key, const bytebuffer *msg, bytebuffer *output); -void hmac_sha2_256(const bytebuffer *key, const bytebuffer *msg, bytebuffer *output); +void dbg_print_bb(const bytebuffer bb); +void dbg_print_bb1(const char *text, const bytebuffer bb); +void parse_payload(const bytebuffer payload); +void parse_header(miniroon_header *header, const bytebuffer source); +void parse_caveat(const bytebuffer source); // TODO +void read_secret(const bytebuffer secret); // TODO +void hmac_b2s_256(const bytebuffer key, const bytebuffer msg, const bytebuffer output); +void hmac_sha2_256(const bytebuffer key, const bytebuffer msg, const bytebuffer output); #define MINIROON_HMAC_SIZE 32 //#define MINIROON_HMAC_FUNC(key, msg, out) hmac_b2s_256(key, msg, out) #define MINIROON_HMAC_FUNC(key, msg, out) hmac_sha2_256(key, msg, out) /* definitions */ -void dbg_print_bb(const bytebuffer *bb) { +void dbg_print_bb(const bytebuffer bb) { static const char digit[] = "0123456789abcdef"; char ascii[16]; char hex[32]; size_t i, j, a_off=0, h_off=0; - for (i = 0; i < bb->len; ++i) { + for (i = 0; i < bb.len; ++i) { if (i % 16 == 0) { if(i) { write(2, "|", 1); @@ -75,7 +76,7 @@ void dbg_print_bb(const bytebuffer *bb) { a_off=0; h_off=0; } - unsigned char c = bb->data[i]; + unsigned char c = bb.data[i]; ascii[a_off++] = (c >= ' ' && c <= '~') ? c : '.'; hex[h_off++] = digit[0xf & (c >> 4)]; hex[h_off++] = digit[0xf & c]; @@ -90,7 +91,7 @@ void dbg_print_bb(const bytebuffer *bb) { write(2, "]\n", 2); } -void dbg_print_bb1(const char *text, const bytebuffer *bb) { +void dbg_print_bb1(const char *text, const bytebuffer bb) { write(2, "\n", 1); write(2, text, strlen(text)); write(2, ":\n", 2); @@ -137,28 +138,52 @@ void fd_block(int fd) { } } -void parse_header(miniroon_header *header, bytebuffer *source) { +int strbbcmp(const bytebuffer bb, const char *s) { + return strncmp(bb.data, s, bb.len); +} + +void set_header_version(miniroon_header *header, const bytebuffer source) { + if(strbbcmp(source, "capv0") == 0) { + header->version = V0; + } else { + strerr_dief1x(111, "Unhandled miniroon version"); + } +} + +void set_header_action(miniroon_header *header, const bytebuffer source) { + if(strbbcmp(source, "revoke") == 0) { + header->action = REVOKE; + } else if(strbbcmp(source, "invoke") == 0) { + header->action = INVOKE; + } else if(strbbcmp(source, "invoke-once") == 0) { + header->action = INVOKE_ONCE; + } else { + strerr_dief1x(111, "Unhandled miniroon action"); + } +} + +void parse_header(miniroon_header *header, const bytebuffer source) { dbg_print_bb1("Got header", source); netstring_chunk c; - netstring_chunk_init(&c, *source); + netstring_chunk_init(&c, source); if(!netstring_chunk_next(&c)) { strerr_dief1x(111, "Mising version in miniroon header"); } - dbg_print_bb1("Header > Version", &c.inner); - // TODO + dbg_print_bb1("Header > Version", c.inner); + set_header_version(header, c.inner); if(!netstring_chunk_next(&c)) { strerr_dief1x(111, "Mising ID in miniroon header"); } - dbg_print_bb1("Header > ID", &c.inner); + dbg_print_bb1("Header > ID", c.inner); header->id = c.inner; if(!netstring_chunk_next(&c)) { strerr_dief1x(111, "Mising action in miniroon header"); } - dbg_print_bb1("Header > Action", &c.inner); - // TODO + dbg_print_bb1("Header > Action", c.inner); + set_header_action(header, c.inner); if(netstring_chunk_next(&c)) { strerr_dief1x(111, "Extraneous data in miniroon header"); @@ -187,36 +212,36 @@ void handle_payload(size_t payload_size) { } bytebuffer payload_bb = {payload, payload_size}; - dbg_print_bb1("Got payload", &payload_bb); - parse_payload(&payload_bb); + dbg_print_bb1("Got payload", payload_bb); + parse_payload(payload_bb); } -void parse_caveat(bytebuffer *source) { +void parse_caveat(const bytebuffer source) { // TODO } -void read_secret(bytebuffer *secret){ - assert(secret->len == MINIROON_HMAC_SIZE); +void read_secret(const bytebuffer secret){ + assert(secret.len == MINIROON_HMAC_SIZE); // TODO - memset(secret->data, 0, secret->len); + memset(secret.data, 0, secret.len); } -void parse_payload(bytebuffer *payload) { +void parse_payload(const bytebuffer payload) { netstring_chunk c; - netstring_chunk_init(&c, *payload); + netstring_chunk_init(&c, payload); if(!netstring_chunk_next(&c)) { strerr_dief1x(111, "Mising miniroon header"); } miniroon_header hdr; - parse_header(&hdr, &c.inner); + parse_header(&hdr, c.inner); // header should be verified by now, we can start hashing uint8_t hmac_data[MINIROON_HMAC_SIZE]; bytebuffer hmac_bb = {hmac_data, MINIROON_HMAC_SIZE}; - read_secret(&hmac_bb); - // dbg_print_bb1("Secret", &hmac_bb); - MINIROON_HMAC_FUNC(&hmac_bb, &c.inner, &hmac_bb); - // dbg_print_bb1("Signature update", &hmac_bb); + read_secret(hmac_bb); + // dbg_print_bb1("Secret", hmac_bb); + MINIROON_HMAC_FUNC(hmac_bb, c.inner, hmac_bb); + // dbg_print_bb1("Signature update", hmac_bb); if(!netstring_chunk_next(&c)) { strerr_dief1x(111, "Mising miniroon body"); @@ -225,16 +250,16 @@ void parse_payload(bytebuffer *payload) { netstring_chunk_init(&body, c.inner); while(netstring_chunk_next(&body)) { - dbg_print_bb1("Got caveat", &body.inner); - parse_caveat(&body.inner); - MINIROON_HMAC_FUNC(&hmac_bb, &body.inner, &hmac_bb); - // dbg_print_bb1("Signature update", &hmac_bb); + dbg_print_bb1("Got caveat", body.inner); + parse_caveat(body.inner); + MINIROON_HMAC_FUNC(hmac_bb, body.inner, hmac_bb); + // dbg_print_bb1("Signature update", hmac_bb); } if(!netstring_chunk_next(&c)) { strerr_dief1x(111, "Mising miniroon signature"); } - dbg_print_bb1("Got signature", &c.inner); + dbg_print_bb1("Got signature", c.inner); if(c.inner.len != MINIROON_HMAC_SIZE) { strerr_dief1x(111, "Invalid miniroon signature length"); } @@ -251,11 +276,11 @@ void parse_payload(bytebuffer *payload) { } } -void hmac_b2s_256(const bytebuffer *key, const bytebuffer *msg, bytebuffer *output) { +void hmac_b2s_256(const bytebuffer key, const bytebuffer msg, const bytebuffer output) { static const size_t block_size = 32; - assert(key->len == block_size); - assert(output->len == block_size); - assert(msg); + assert(key.len == block_size); + assert(output.len == block_size); + //assert(msg); dbg_print_bb1("HMAC key", key); dbg_print_bb1("HMAC message", msg); @@ -265,22 +290,22 @@ void hmac_b2s_256(const bytebuffer *key, const bytebuffer *msg, bytebuffer *outp blake2s_init(&hash_ctx, block_size); // i_key_pad := block_sized_key xor [0x36 blockSize] // Inner padded key for(size_t i=0; i<block_size; i++) { - pad[i] = key->data[i] ^ 0x36; + pad[i] = key.data[i] ^ 0x36; } // ihash = hash(i_key_pad || message) blake2s_update(&hash_ctx, pad, block_size); - blake2s_update(&hash_ctx, msg->data, msg->len); + blake2s_update(&hash_ctx, msg.data, msg.len); blake2s_final(&hash_ctx, ihash); blake2s_init(&hash_ctx, block_size); // o_key_pad := block_sized_key xor [0x5c blockSize] // Outer padded key for(size_t i=0; i<block_size; i++) { - pad[i] = key->data[i] ^ 0x5c; + pad[i] = key.data[i] ^ 0x5c; } // ohash = hash(o_key_pad || ihash) blake2s_update(&hash_ctx, pad, block_size); blake2s_update(&hash_ctx, ihash, block_size); - blake2s_final(&hash_ctx, output->data); + blake2s_final(&hash_ctx, output.data); dbg_print_bb1("HMAC output", output); } @@ -325,15 +350,15 @@ void hmac_sha256(const uint8_t* key, const uint32_t keysize, const uint8_t* msg, sha256_final(&outer, output); } -void hmac_sha2_256(const bytebuffer *key, const bytebuffer *msg, bytebuffer *output) { +void hmac_sha2_256(const bytebuffer key, const bytebuffer msg, bytebuffer output) { static const size_t block_size = 32; - assert(key->len == block_size); - assert(output->len == block_size); - assert(msg); + assert(key.len == block_size); + assert(output.len == block_size); + // assert(msg); dbg_print_bb1("HMAC key", key); dbg_print_bb1("HMAC message", msg); - hmac_sha256(key->data, key->len, msg->data, msg->len, output->data); + hmac_sha256(key.data, key.len, msg.data, msg.len, output.data); /* SHA256Schedule hash_ctx; uint8_t pad[block_size], ihash[block_size];