faraphel/chrony
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nts: initialize unused part of server key

Browse source 
Initialize the unused part of shorter server NTS keys (AES-128-GCM-SIV)
loaded from ntsdumpdir to avoid sending uninitialized data in requests
to the NTS-KE helper process.

Do that also for newly generated keys in case the memory will be
allocated dynamically.

Fixes: b1230efac3 ("nts: add support for encrypting cookies with AES-128-GCM-SIV")
This commit is contained in:
Miroslav Lichvar 2023-05-23 15:37:06 +02:00
parent b8b3830dc4
commit 81bf7cdcdc
2 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nts_ke_server.c
View file

@ -512,6 +512,7 @@ generate_key(int index)
assert(0); assert(0);
UTI_GetRandomBytesUrandom(key->key, key_length); UTI_GetRandomBytesUrandom(key->key, key_length);
memset(key->key + key_length, 0, sizeof (key->key) - key_length);
UTI_GetRandomBytes(&key->id, sizeof (key->id)); UTI_GetRandomBytes(&key->id, sizeof (key->id));
/* Encode the index in the lowest bits of the ID */ /* Encode the index in the lowest bits of the ID */
@ -628,6 +629,7 @@ load_keys(void)
key_length <= 0 || key_length <= 0 ||
UTI_HexToBytes(words[1], new_keys[i].key, sizeof (new_keys[i].key)) != key_length) UTI_HexToBytes(words[1], new_keys[i].key, sizeof (new_keys[i].key)) != key_length)
goto error; goto error;
memset(new_keys[i].key + key_length, 0, sizeof (new_keys[i].key) - key_length);
} }
if (i < MAX_SERVER_KEYS) if (i < MAX_SERVER_KEYS)

10
test/unit/nts_ke_server.c
View file

@ -139,7 +139,7 @@ test_unit(void)
NKSN_Instance session; NKSN_Instance session;
NKE_Context context, context2; NKE_Context context, context2;
NKE_Cookie cookie; NKE_Cookie cookie;
int i, valid, l; int i, j, valid, l;
uint32_t sum, sum2; uint32_t sum, sum2;
char conf[][100] = { char conf[][100] = {
@ -200,7 +200,9 @@ test_unit(void)
save_keys(); save_keys();
for (i = 0, sum = 0; i < MAX_SERVER_KEYS; i++) { for (i = 0, sum = 0; i < MAX_SERVER_KEYS; i++) {
sum += server_keys[i].id + server_keys[i].key[0]; sum += server_keys[i].id;
for (j = 0; j < sizeof (server_keys[i].key); j++)
sum += server_keys[i].key[j];
generate_key(i); generate_key(i);
} }
@ -208,7 +210,9 @@ test_unit(void)
TEST_CHECK(unlink("ntskeys") == 0); TEST_CHECK(unlink("ntskeys") == 0);
for (i = 0, sum2 = 0; i < MAX_SERVER_KEYS; i++) { for (i = 0, sum2 = 0; i < MAX_SERVER_KEYS; i++) {
sum2 += server_keys[i].id + server_keys[i].key[0]; sum2 += server_keys[i].id;
for (j = 0; j < sizeof (server_keys[i].key); j++)
sum2 += server_keys[i].key[j];
} }
TEST_CHECK(sum == sum2); TEST_CHECK(sum == sum2);