transmission/libtransmission/crypto.c

/*
 * This file Copyright (C) Mnemosyne LLC
 *
 * This file is licensed by the GPL version 2. Works owned by the
 * Transmission project are granted a special exemption to clause 2 (b)
 * so that the bulk of its code can remain under the MIT license.
 * This exemption does not extend to derived works not owned by
 * the Transmission project.
 *
 * $Id$
 */

#include <assert.h>
#include <inttypes.h> /* uint8_t */
#include <limits.h> /* INT_MAX */
#include <stdarg.h>
#include <stdlib.h> /* abs () */
#include <string.h> /* memcpy (), memset (), strcmp () */

#include <openssl/bn.h>
#include <openssl/dh.h>
#include <openssl/err.h>
#include <openssl/rc4.h>
#include <openssl/sha.h>
#include <openssl/rand.h>

#include "transmission.h"
#include "crypto.h"
#include "utils.h"

#define MY_NAME "tr_crypto"

/**
***
**/

void
tr_sha1 (uint8_t * setme, const void * content1, int content1_len, ...)
{
    va_list vl;
    SHA_CTX sha;
    const void * content;

    SHA1_Init (&sha);
    SHA1_Update (&sha, content1, content1_len);

    va_start (vl, content1_len);
    while ((content = va_arg (vl, const void*)))
        SHA1_Update (&sha, content, va_arg (vl, int));
    va_end (vl);

    SHA1_Final (setme, &sha);
}

/**
***
**/

#define KEY_LEN 96

#define PRIME_LEN 96

#define DH_PRIVKEY_LEN_MIN 16
#define DH_PRIVKEY_LEN 20

static const uint8_t dh_P[PRIME_LEN] =
{
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2,
    0x21, 0x68, 0xC2, 0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 0x02, 0x0B, 0xBE, 0xA6,
    0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D,
    0xF2, 0x5F, 0x14, 0x37, 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, 0xF4, 0x4C, 0x42, 0xE9,
    0xA6, 0x3A, 0x36, 0x21, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x05, 0x63,
};

static const uint8_t dh_G[] = { 2 };

/**
***
**/

#define logErrorFromSSL(...) \
    do { \
        if (tr_msgLoggingIsActive (TR_MSG_ERR)) { \
            char buf[512]; \
            ERR_error_string_n (ERR_get_error (), buf, sizeof (buf)); \
            tr_msg (__FILE__, __LINE__, TR_MSG_ERR, MY_NAME, "%s", buf); \
        } \
    } while (0)

static void
ensureKeyExists (tr_crypto * crypto)
{
    if (crypto->dh == NULL)
    {
        int len, offset;
        DH * dh = DH_new ();

        dh->p = BN_bin2bn (dh_P, sizeof (dh_P), NULL);
        if (dh->p == NULL)
            logErrorFromSSL ();

        dh->g = BN_bin2bn (dh_G, sizeof (dh_G), NULL);
        if (dh->g == NULL)
            logErrorFromSSL ();

        /* private DH value: strong random BN of DH_PRIVKEY_LEN*8 bits */
        dh->priv_key = BN_new ();
        do {
            if (BN_rand (dh->priv_key, DH_PRIVKEY_LEN * 8, -1, 0) != 1)
                logErrorFromSSL ();
        } while (BN_num_bits (dh->priv_key) < DH_PRIVKEY_LEN_MIN * 8);

        if (!DH_generate_key (dh))
            logErrorFromSSL ();

        /* DH can generate key sizes that are smaller than the size of
           P with exponentially decreasing probability, in which case
           the msb's of myPublicKey need to be zeroed appropriately. */
        len = BN_num_bytes (dh->pub_key);
        offset = KEY_LEN - len;
        assert (len <= KEY_LEN);
        memset (crypto->myPublicKey, 0, offset);
        BN_bn2bin (dh->pub_key, crypto->myPublicKey + offset);

        crypto->dh = dh;
    }
}

void
tr_cryptoConstruct (tr_crypto * crypto, const uint8_t * torrentHash, bool isIncoming)
{
    memset (crypto, 0, sizeof (tr_crypto));

    crypto->dh = NULL;
    crypto->isIncoming = isIncoming;
    tr_cryptoSetTorrentHash (crypto, torrentHash);
}

void
tr_cryptoDestruct (tr_crypto * crypto)
{
    if (crypto->dh != NULL)
        DH_free (crypto->dh);
}

/**
***
**/

const uint8_t*
tr_cryptoComputeSecret (tr_crypto *     crypto,
                        const uint8_t * peerPublicKey)
{
    int      len;
    uint8_t  secret[KEY_LEN];
    BIGNUM * bn = BN_bin2bn (peerPublicKey, KEY_LEN, NULL);
    DH *     dh;

    ensureKeyExists (crypto);
    dh = crypto->dh;

    assert (DH_size (dh) == KEY_LEN);

    len = DH_compute_key (secret, bn, dh);
    if (len == -1)
        logErrorFromSSL ();
    else {
        int offset;
        assert (len <= KEY_LEN);
        offset = KEY_LEN - len;
        memset (crypto->mySecret, 0, offset);
        memcpy (crypto->mySecret + offset, secret, len);
        crypto->mySecretIsSet = 1;
    }

    BN_free (bn);
    return crypto->mySecret;
}

const uint8_t*
tr_cryptoGetMyPublicKey (const tr_crypto * crypto,
                         int *             setme_len)
{
    ensureKeyExists ((tr_crypto *) crypto);
    *setme_len = KEY_LEN;
    return crypto->myPublicKey;
}

/**
***
**/

static void
initRC4 (tr_crypto *  crypto,
         RC4_KEY *    setme,
         const char * key)
{
    SHA_CTX sha;
    uint8_t buf[SHA_DIGEST_LENGTH];

    assert (crypto->torrentHashIsSet);
    assert (crypto->mySecretIsSet);

    if (SHA1_Init (&sha)
        && SHA1_Update (&sha, key, 4)
        && SHA1_Update (&sha, crypto->mySecret, KEY_LEN)
        && SHA1_Update (&sha, crypto->torrentHash, SHA_DIGEST_LENGTH)
        && SHA1_Final (buf, &sha))
    {
        RC4_set_key (setme, SHA_DIGEST_LENGTH, buf);
    }
    else
    {
        logErrorFromSSL ();
    }
}

void
tr_cryptoDecryptInit (tr_crypto * crypto)
{
    unsigned char discard[1024];
    const char *  txt = crypto->isIncoming ? "keyA" : "keyB";

    initRC4 (crypto, &crypto->dec_key, txt);
    RC4 (&crypto->dec_key, sizeof (discard), discard, discard);
}

void
tr_cryptoDecrypt (tr_crypto *  crypto,
                  size_t       buf_len,
                  const void * buf_in,
                  void *       buf_out)
{
    RC4 (&crypto->dec_key, buf_len,
       (const unsigned char*)buf_in,
       (unsigned char*)buf_out);
}

void
tr_cryptoEncryptInit (tr_crypto * crypto)
{
    unsigned char discard[1024];
    const char *  txt = crypto->isIncoming ? "keyB" : "keyA";

    initRC4 (crypto, &crypto->enc_key, txt);
    RC4 (&crypto->enc_key, sizeof (discard), discard, discard);
}

void
tr_cryptoEncrypt (tr_crypto *  crypto,
                  size_t       buf_len,
                  const void * buf_in,
                  void *       buf_out)
{
    RC4 (&crypto->enc_key, buf_len,
       (const unsigned char*)buf_in,
       (unsigned char*)buf_out);
}

/**
***
**/

void
tr_cryptoSetTorrentHash (tr_crypto *     crypto,
                         const uint8_t * hash)
{
    crypto->torrentHashIsSet = hash ? 1 : 0;

    if (hash)
        memcpy (crypto->torrentHash, hash, SHA_DIGEST_LENGTH);
    else
        memset (crypto->torrentHash, 0, SHA_DIGEST_LENGTH);
}

const uint8_t*
tr_cryptoGetTorrentHash (const tr_crypto * crypto)
{
    assert (crypto);
    assert (crypto->torrentHashIsSet);

    return crypto->torrentHash;
}

int
tr_cryptoHasTorrentHash (const tr_crypto * crypto)
{
    assert (crypto);

    return crypto->torrentHashIsSet ? 1 : 0;
}

int
tr_cryptoRandInt (int upperBound)
{
    int noise;
    int val;

    assert (upperBound > 0);

    if (RAND_pseudo_bytes ((unsigned char *) &noise, sizeof noise) >= 0)
    {
        val = abs (noise) % upperBound;
    }
    else /* fall back to a weaker implementation... */
    {
        val = tr_cryptoWeakRandInt (upperBound);
    }

    return val;
}

int
tr_cryptoWeakRandInt (int upperBound)
{
    static bool init = false;

    assert (upperBound > 0);

    if (!init)
    {
        srand (tr_time_msec ());
        init = true;
    }

    return rand () % upperBound;
}

void
tr_cryptoRandBuf (void * buf, size_t len)
{
    if (RAND_pseudo_bytes ((unsigned char*)buf, len) != 1)
        logErrorFromSSL ();
}

/***
****
***/

char*
tr_ssha1 (const void * plaintext)
{
    enum { saltval_len = 8,
           salter_len  = 64 };
    static const char * salter = "0123456789"
                                 "abcdefghijklmnopqrstuvwxyz"
                                 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
                                 "./";

    size_t i;
    unsigned char salt[saltval_len];
    uint8_t sha[SHA_DIGEST_LENGTH];
    char buf[2*SHA_DIGEST_LENGTH + saltval_len + 2];

    tr_cryptoRandBuf (salt, saltval_len);
    for (i=0; i<saltval_len; ++i)
        salt[i] = salter[ salt[i] % salter_len ];

    tr_sha1 (sha, plaintext, strlen (plaintext), salt, saltval_len, NULL);
    tr_sha1_to_hex (&buf[1], sha);
    memcpy (&buf[1+2*SHA_DIGEST_LENGTH], &salt, saltval_len);
    buf[1+2*SHA_DIGEST_LENGTH + saltval_len] = '\0';
    buf[0] = '{'; /* signal that this is a hash. this makes saving/restoring
                     easier */

    return tr_strdup (&buf);
}

bool
tr_ssha1_matches (const char * source, const char * pass)
{
    char * salt;
    size_t saltlen;
    char * hashed;
    uint8_t buf[SHA_DIGEST_LENGTH];
    bool result;
    const size_t sourcelen = strlen (source);

    /* extract the salt */
    if (sourcelen < 2*SHA_DIGEST_LENGTH-1)
        return false;
    saltlen = sourcelen - 2*SHA_DIGEST_LENGTH-1;
    salt = tr_malloc (saltlen);
    memcpy (salt, source + 2*SHA_DIGEST_LENGTH+1, saltlen);

    /* hash pass + salt */
    hashed = tr_malloc (2*SHA_DIGEST_LENGTH + saltlen + 2);
    tr_sha1 (buf, pass, strlen (pass), salt, saltlen, NULL);
    tr_sha1_to_hex (&hashed[1], buf);
    memcpy (hashed + 1+2*SHA_DIGEST_LENGTH, salt, saltlen);
    hashed[1+2*SHA_DIGEST_LENGTH + saltlen] = '\0';
    hashed[0] = '{';

    result = strcmp (source, hashed) == 0 ? true : false;

    tr_free (hashed);
    tr_free (salt);

    return result;
}