| 48 |
#define DEATTACK_DETECTED 1 |
#define DEATTACK_DETECTED 1 |
| 49 |
|
|
| 50 |
/* |
/* |
| 51 |
* $Id: crypt.c,v 1.16 2007-10-18 03:49:39 maya Exp $ Cryptographic attack |
* $Id: crypt.c,v 1.17 2007-10-18 07:56:33 maya Exp $ Cryptographic attack |
| 52 |
* detector for ssh - source code (C)1998 CORE-SDI, Buenos Aires Argentina |
* detector for ssh - source code (C)1998 CORE-SDI, Buenos Aires Argentina |
| 53 |
* Ariel Futoransky(futo@core-sdi.com) <http://www.core-sdi.com> |
* Ariel Futoransky(futo@core-sdi.com) <http://www.core-sdi.com> |
| 54 |
*/ |
*/ |
| 246 |
goto error; |
goto error; |
| 247 |
|
|
| 248 |
} else { |
} else { |
| 249 |
memcpy(buf, newbuf, bytes); |
//unsigned char key[AES128_KEYLEN], iv[AES128_IVLEN]; |
| 250 |
|
//memcpy(key, pvar->ssh2_keys[MODE_OUT].enc.key, AES128_KEYLEN); |
| 251 |
|
// IVはDES関数内で更新されるため、ローカルにコピーしてから使う。 |
| 252 |
|
//memcpy(iv, pvar->ssh2_keys[MODE_OUT].enc.iv, AES128_IVLEN); |
| 253 |
|
|
| 254 |
|
//debug_print(50, key, 24); |
| 255 |
|
//debug_print(51, iv, 8); |
| 256 |
|
//debug_print(52, buf, bytes); |
| 257 |
|
//debug_print(53, newbuf, bytes); |
| 258 |
|
|
| 259 |
|
memcpy(buf, newbuf, bytes); |
| 260 |
} |
} |
| 261 |
|
|
| 262 |
error: |
error: |
| 292 |
goto error; |
goto error; |
| 293 |
|
|
| 294 |
} else { |
} else { |
| 295 |
memcpy(buf, newbuf, bytes); |
//unsigned char key[AES128_KEYLEN], iv[AES128_IVLEN]; |
| 296 |
|
//memcpy(key, pvar->ssh2_keys[MODE_IN].enc.key, AES128_KEYLEN); |
| 297 |
|
// IVはDES関数内で更新されるため、ローカルにコピーしてから使う。 |
| 298 |
|
//memcpy(iv, pvar->ssh2_keys[MODE_IN].enc.iv, AES128_IVLEN); |
| 299 |
|
|
| 300 |
|
//debug_print(70, key, AES128_KEYLEN); |
| 301 |
|
//debug_print(71, iv, AES128_IVLEN); |
| 302 |
|
//debug_print(72, buf, bytes); |
| 303 |
|
//debug_print(73, newbuf, bytes); |
| 304 |
|
|
| 305 |
|
memcpy(buf, newbuf, bytes); |
| 306 |
} |
} |
| 307 |
|
|
| 308 |
error: |
error: |
| 316 |
int bytes) |
int bytes) |
| 317 |
{ |
{ |
| 318 |
unsigned char *newbuf = malloc(bytes); |
unsigned char *newbuf = malloc(bytes); |
| 319 |
|
int block_size = pvar->ssh2_keys[MODE_OUT].enc.block_size; |
| 320 |
|
|
| 321 |
|
// 事前復号化により、全ペイロードが復号化されている場合は、0バイトになる。(2004.11.7 yutaka) |
| 322 |
|
if (bytes == 0) |
| 323 |
|
return; |
| 324 |
|
|
| 325 |
if (newbuf == NULL) |
if (newbuf == NULL) |
| 326 |
return; |
return; |
| 327 |
|
|
| 328 |
|
if (bytes % block_size) { |
| 329 |
|
char tmp[80]; |
| 330 |
|
UTIL_get_lang_msg("MSG_3DESCBC_ENCRYPT_ERROR1", pvar, |
| 331 |
|
"3DES-CBC encrypt error(1): bytes %d (%d)"); |
| 332 |
|
_snprintf_s(tmp, sizeof(tmp), _TRUNCATE, |
| 333 |
|
pvar->ts->UIMsg, bytes, block_size); |
| 334 |
|
notify_fatal_error(pvar, tmp); |
| 335 |
|
goto error; |
| 336 |
|
} |
| 337 |
|
|
| 338 |
if (EVP_Cipher(&pvar->evpcip[MODE_OUT], newbuf, buf, bytes) == 0) { |
if (EVP_Cipher(&pvar->evpcip[MODE_OUT], newbuf, buf, bytes) == 0) { |
| 339 |
UTIL_get_lang_msg("MSG_3DESCBC_ENCRYPT_ERROR", pvar, |
UTIL_get_lang_msg("MSG_3DESCBC_ENCRYPT_ERROR2", pvar, |
| 340 |
"3DES-CBC encrypt error"); |
"3DES-CBC encrypt error(2)"); |
| 341 |
notify_fatal_error(pvar, pvar->ts->UIMsg); |
notify_fatal_error(pvar, pvar->ts->UIMsg); |
| 342 |
goto error; |
goto error; |
| 343 |
|
|
| 363 |
int bytes) |
int bytes) |
| 364 |
{ |
{ |
| 365 |
unsigned char *newbuf = malloc(bytes); |
unsigned char *newbuf = malloc(bytes); |
| 366 |
|
int block_size = pvar->ssh2_keys[MODE_IN].enc.block_size; |
| 367 |
|
|
| 368 |
|
// 事前復号化により、全ペイロードが復号化されている場合は、0バイトになる。(2004.11.7 yutaka) |
| 369 |
|
if (bytes == 0) |
| 370 |
|
return; |
| 371 |
|
|
| 372 |
if (newbuf == NULL) |
if (newbuf == NULL) |
| 373 |
return; |
return; |
| 374 |
|
|
| 375 |
|
if (bytes % block_size) { |
| 376 |
|
char tmp[80]; |
| 377 |
|
UTIL_get_lang_msg("MSG_3DESCBC_DECRYPT_ERROR1", pvar, |
| 378 |
|
"3DES-CBC decrypt error(1): bytes %d (%d)"); |
| 379 |
|
_snprintf_s(tmp, sizeof(tmp), _TRUNCATE, pvar->ts->UIMsg, bytes, block_size); |
| 380 |
|
notify_fatal_error(pvar, tmp); |
| 381 |
|
goto error; |
| 382 |
|
} |
| 383 |
|
|
| 384 |
if (EVP_Cipher(&pvar->evpcip[MODE_IN], newbuf, buf, bytes) == 0) { |
if (EVP_Cipher(&pvar->evpcip[MODE_IN], newbuf, buf, bytes) == 0) { |
| 385 |
UTIL_get_lang_msg("MSG_3DESCBC_DECRYPT_ERROR", pvar, |
UTIL_get_lang_msg("MSG_3DESCBC_DECRYPT_ERROR2", pvar, |
| 386 |
"3DES-CBC decrypt error"); |
"3DES-CBC decrypt error(2)"); |
| 387 |
notify_fatal_error(pvar, pvar->ts->UIMsg); |
notify_fatal_error(pvar, pvar->ts->UIMsg); |
| 388 |
goto error; |
goto error; |
| 389 |
|
|
| 419 |
if (newbuf == NULL) |
if (newbuf == NULL) |
| 420 |
return; |
return; |
| 421 |
|
|
| 422 |
|
if (bytes % block_size) { |
| 423 |
|
char tmp[80]; |
| 424 |
|
UTIL_get_lang_msg("MSG_BLOWFISH_ENCRYPT_ERROR1", pvar, |
| 425 |
|
"Blowfish encrypt error(1): bytes %d (%d)"); |
| 426 |
|
_snprintf_s(tmp, sizeof(tmp), _TRUNCATE, |
| 427 |
|
pvar->ts->UIMsg, bytes, block_size); |
| 428 |
|
notify_fatal_error(pvar, tmp); |
| 429 |
|
goto error; |
| 430 |
|
} |
| 431 |
|
|
| 432 |
if (EVP_Cipher(&pvar->evpcip[MODE_OUT], newbuf, buf, bytes) == 0) { |
if (EVP_Cipher(&pvar->evpcip[MODE_OUT], newbuf, buf, bytes) == 0) { |
| 433 |
UTIL_get_lang_msg("MSG_BLOWFISH_ENCRYPT_ERROR", pvar, |
UTIL_get_lang_msg("MSG_BLOWFISH_ENCRYPT_ERROR2", pvar, |
| 434 |
"Blowfish encrypt error"); |
"Blowfish encrypt error(2)"); |
| 435 |
notify_fatal_error(pvar, pvar->ts->UIMsg); |
notify_fatal_error(pvar, pvar->ts->UIMsg); |
| 436 |
goto error; |
goto error; |
| 437 |
|
|
| 457 |
if (newbuf == NULL) |
if (newbuf == NULL) |
| 458 |
return; |
return; |
| 459 |
|
|
| 460 |
|
if (bytes % block_size) { |
| 461 |
|
char tmp[80]; |
| 462 |
|
UTIL_get_lang_msg("MSG_BLOWFISH_DECRYPT_ERROR1", pvar, |
| 463 |
|
"Blowfish decrypt error(1): bytes %d (%d)"); |
| 464 |
|
_snprintf_s(tmp, sizeof(tmp), _TRUNCATE, pvar->ts->UIMsg, bytes, block_size); |
| 465 |
|
notify_fatal_error(pvar, tmp); |
| 466 |
|
goto error; |
| 467 |
|
} |
| 468 |
|
|
| 469 |
if (EVP_Cipher(&pvar->evpcip[MODE_IN], newbuf, buf, bytes) == 0) { |
if (EVP_Cipher(&pvar->evpcip[MODE_IN], newbuf, buf, bytes) == 0) { |
| 470 |
UTIL_get_lang_msg("MSG_BLOWFISH_DECRYPT_ERROR", pvar, |
UTIL_get_lang_msg("MSG_BLOWFISH_DECRYPT_ERROR2", pvar, |
| 471 |
"Blowfish decrypt error"); |
"Blowfish decrypt error(2)"); |
| 472 |
notify_fatal_error(pvar, pvar->ts->UIMsg); |
notify_fatal_error(pvar, pvar->ts->UIMsg); |
| 473 |
goto error; |
goto error; |
| 474 |
|
|