| 48 |
#define DEATTACK_DETECTED 1 |
#define DEATTACK_DETECTED 1 |
| 49 |
|
|
| 50 |
/* |
/* |
| 51 |
* $Id: crypt.c,v 1.25 2008-11-21 18:54:22 doda Exp $ Cryptographic attack |
* $Id: crypt.c,v 1.26 2008-11-22 06:46:43 doda Exp $ Cryptographic attack |
| 52 |
* detector for ssh - source code (C)1998 CORE-SDI, Buenos Aires Argentina |
* detector for ssh - source code (C)1998 CORE-SDI, Buenos Aires Argentina |
| 53 |
* Ariel Futoransky(futo@core-sdi.com) <http://www.core-sdi.com> |
* Ariel Futoransky(futo@core-sdi.com) <http://www.core-sdi.com> |
| 54 |
*/ |
*/ |
| 786 |
| (1 << SSH2_CIPHER_AES128_CTR) |
| (1 << SSH2_CIPHER_AES128_CTR) |
| 787 |
| (1 << SSH2_CIPHER_AES192_CTR) |
| (1 << SSH2_CIPHER_AES192_CTR) |
| 788 |
| (1 << SSH2_CIPHER_AES256_CTR) |
| (1 << SSH2_CIPHER_AES256_CTR) |
| 789 |
| (1 << SSH2_CIPHER_ARCFOUR); |
| (1 << SSH2_CIPHER_ARCFOUR) |
| 790 |
|
| (1 << SSH2_CIPHER_ARCFOUR128) |
| 791 |
|
| (1 << SSH2_CIPHER_ARCFOUR256); |
| 792 |
} |
} |
| 793 |
|
|
| 794 |
sender_ciphers &= cipher_mask; |
sender_ciphers &= cipher_mask; |
| 1189 |
const u_char *iv, u_int ivlen, |
const u_char *iv, u_int ivlen, |
| 1190 |
int encrypt, |
int encrypt, |
| 1191 |
const EVP_CIPHER *type, |
const EVP_CIPHER *type, |
| 1192 |
|
int discard_len, |
| 1193 |
PTInstVar pvar) |
PTInstVar pvar) |
| 1194 |
{ |
{ |
| 1195 |
int klen; |
int klen; |
| 1196 |
char tmp[80]; |
char tmp[80]; |
| 1197 |
|
unsigned char *junk = NULL, *discard = NULL; |
| 1198 |
|
|
| 1199 |
EVP_CIPHER_CTX_init(evp); |
EVP_CIPHER_CTX_init(evp); |
| 1200 |
if (EVP_CipherInit(evp, type, NULL, (u_char *)iv, (encrypt == CIPHER_ENCRYPT)) == 0) { |
if (EVP_CipherInit(evp, type, NULL, (u_char *)iv, (encrypt == CIPHER_ENCRYPT)) == 0) { |
| 1222 |
notify_fatal_error(pvar, tmp); |
notify_fatal_error(pvar, tmp); |
| 1223 |
return; |
return; |
| 1224 |
} |
} |
| 1225 |
|
|
| 1226 |
|
if (discard_len > 0) { |
| 1227 |
|
junk = malloc(discard_len); |
| 1228 |
|
discard = malloc(discard_len); |
| 1229 |
|
if (junk == NULL || discard == NULL || |
| 1230 |
|
EVP_Cipher(evp, discard, junk, discard_len) == 0) { |
| 1231 |
|
UTIL_get_lang_msg("MSG_CIPHER_INIT_ERROR", pvar, |
| 1232 |
|
"Cipher initialize error(%d)"); |
| 1233 |
|
_snprintf_s(tmp, sizeof(tmp), _TRUNCATE, |
| 1234 |
|
pvar->ts->UIMsg, 3); |
| 1235 |
|
notify_fatal_error(pvar, tmp); |
| 1236 |
|
} |
| 1237 |
|
else { |
| 1238 |
|
memset(discard, 0, discard_len); |
| 1239 |
|
} |
| 1240 |
|
free(junk); |
| 1241 |
|
free(discard); |
| 1242 |
|
} |
| 1243 |
} |
} |
| 1244 |
|
|
| 1245 |
|
|
| 1262 |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
| 1263 |
CIPHER_ENCRYPT, |
CIPHER_ENCRYPT, |
| 1264 |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
| 1265 |
|
get_cipher_discard_len(pvar->crypt_state.sender_cipher), |
| 1266 |
pvar); |
pvar); |
| 1267 |
|
|
| 1268 |
//debug_print(10, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
//debug_print(10, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
| 1288 |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
| 1289 |
CIPHER_ENCRYPT, |
CIPHER_ENCRYPT, |
| 1290 |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
| 1291 |
|
get_cipher_discard_len(pvar->crypt_state.sender_cipher), |
| 1292 |
pvar); |
pvar); |
| 1293 |
|
|
| 1294 |
//debug_print(10, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
//debug_print(10, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
| 1308 |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
| 1309 |
CIPHER_ENCRYPT, |
CIPHER_ENCRYPT, |
| 1310 |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
| 1311 |
|
get_cipher_discard_len(pvar->crypt_state.sender_cipher), |
| 1312 |
pvar); |
pvar); |
| 1313 |
|
|
| 1314 |
//debug_print(10, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
//debug_print(10, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
| 1319 |
} |
} |
| 1320 |
|
|
| 1321 |
case SSH2_CIPHER_ARCFOUR: |
case SSH2_CIPHER_ARCFOUR: |
| 1322 |
|
case SSH2_CIPHER_ARCFOUR128: |
| 1323 |
|
case SSH2_CIPHER_ARCFOUR256: |
| 1324 |
{ |
{ |
| 1325 |
struct Enc *enc; |
struct Enc *enc; |
| 1326 |
|
|
| 1330 |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
| 1331 |
CIPHER_ENCRYPT, |
CIPHER_ENCRYPT, |
| 1332 |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
| 1333 |
|
get_cipher_discard_len(pvar->crypt_state.sender_cipher), |
| 1334 |
pvar); |
pvar); |
| 1335 |
//debug_print(10, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
//debug_print(10, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
| 1336 |
//debug_print(11, enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher)); |
//debug_print(11, enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher)); |
| 1385 |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
| 1386 |
CIPHER_DECRYPT, |
CIPHER_DECRYPT, |
| 1387 |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
| 1388 |
|
get_cipher_discard_len(pvar->crypt_state.sender_cipher), |
| 1389 |
pvar); |
pvar); |
| 1390 |
|
|
| 1391 |
//debug_print(12, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
//debug_print(12, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
| 1411 |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
| 1412 |
CIPHER_DECRYPT, |
CIPHER_DECRYPT, |
| 1413 |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
| 1414 |
|
get_cipher_discard_len(pvar->crypt_state.sender_cipher), |
| 1415 |
pvar); |
pvar); |
| 1416 |
|
|
| 1417 |
//debug_print(12, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
//debug_print(12, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
| 1431 |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
| 1432 |
CIPHER_DECRYPT, |
CIPHER_DECRYPT, |
| 1433 |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
| 1434 |
|
get_cipher_discard_len(pvar->crypt_state.sender_cipher), |
| 1435 |
pvar); |
pvar); |
| 1436 |
|
|
| 1437 |
//debug_print(12, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
//debug_print(12, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
| 1442 |
} |
} |
| 1443 |
|
|
| 1444 |
case SSH2_CIPHER_ARCFOUR: |
case SSH2_CIPHER_ARCFOUR: |
| 1445 |
|
case SSH2_CIPHER_ARCFOUR128: |
| 1446 |
|
case SSH2_CIPHER_ARCFOUR256: |
| 1447 |
{ |
{ |
| 1448 |
struct Enc *enc; |
struct Enc *enc; |
| 1449 |
|
|
| 1453 |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
enc->iv, get_cipher_block_size(pvar->crypt_state.sender_cipher), |
| 1454 |
CIPHER_DECRYPT, |
CIPHER_DECRYPT, |
| 1455 |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
get_cipher_EVP_CIPHER(pvar->crypt_state.sender_cipher), |
| 1456 |
|
get_cipher_discard_len(pvar->crypt_state.sender_cipher), |
| 1457 |
pvar); |
pvar); |
| 1458 |
|
|
| 1459 |
//debug_print(12, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
//debug_print(12, enc->key, get_cipher_key_len(pvar->crypt_state.sender_cipher)); |
| 1555 |
case SSH2_CIPHER_AES256_CTR: |
case SSH2_CIPHER_AES256_CTR: |
| 1556 |
return "AES256-CTR"; |
return "AES256-CTR"; |
| 1557 |
case SSH2_CIPHER_ARCFOUR: |
case SSH2_CIPHER_ARCFOUR: |
| 1558 |
return "ARCFOUR"; |
return "Arcfour"; |
| 1559 |
|
case SSH2_CIPHER_ARCFOUR128: |
| 1560 |
|
return "Arcfour128"; |
| 1561 |
|
case SSH2_CIPHER_ARCFOUR256: |
| 1562 |
|
return "Arcfour256"; |
| 1563 |
|
|
| 1564 |
default: |
default: |
| 1565 |
return "Unknown"; |
return "Unknown"; |