static gpointer run_client_thread (gpointer data) { gint *socket = data; GkdSshAgentCall call; EggBuffer req; EggBuffer resp; guchar op; g_assert (GP11_IS_MODULE (pkcs11_module)); memset (&call, 0, sizeof (call)); call.sock = g_atomic_int_get (socket); g_assert (call.sock != -1); egg_buffer_init_full (&req, 128, egg_secure_realloc); egg_buffer_init_full (&resp, 128, (EggBufferAllocator)g_realloc); call.req = &req; call.resp = &resp; call.module = g_object_ref (pkcs11_module); for (;;) { egg_buffer_reset (call.req); /* 1. Read in the request */ if (!read_packet_with_size (&call)) break; /* 2. Now decode the operation */ if (!egg_buffer_get_byte (call.req, 4, NULL, &op)) break; if (op >= GKD_SSH_OP_MAX) break; g_assert (gkd_ssh_agent_operations[op]); /* 3. Execute the right operation */ egg_buffer_reset (call.resp); egg_buffer_add_uint32 (call.resp, 0); if (!(gkd_ssh_agent_operations[op]) (&call)) break; if (!egg_buffer_set_uint32 (call.resp, 0, call.resp->len - 4)) break; /* 4. Write the reply back out */ if (!write_all (call.sock, call.resp->buf, call.resp->len)) break; } egg_buffer_uninit (&req); egg_buffer_uninit (&resp); g_object_unref (call.module); close (call.sock); g_atomic_int_set (socket, -1); return NULL; }
void gkm_rpc_message_free (GkmRpcMessage *msg) { EggBufferAllocator allocator; if (msg) { assert (msg->buffer.allocator); allocator = msg->buffer.allocator; egg_buffer_uninit (&msg->buffer); /* frees data buffer */ (allocator) (msg, 0); } }
GkmDataResult gkm_secret_binary_read (GkmSecretCollection *collection, GkmSecretData *sdata, gconstpointer data, gsize n_data) { gsize offset; guchar major, minor, crypto, hash; guint32 flags; guint32 lock_timeout; time_t mtime, ctime; char *display_name; guint32 tmp; guint32 num_items; guint32 crypto_size; guint32 hash_iterations; guchar salt[8]; ItemInfo *items; GkmSecret* master; GkmSecretObject *obj; EggBuffer to_decrypt = EGG_BUFFER_EMPTY; GkmDataResult res = GKM_DATA_FAILURE; GHashTable *checks = NULL; GkmSecretItem *item; EggBuffer buffer; GList *l, *iteml; int i; display_name = NULL; items = 0; obj = GKM_SECRET_OBJECT (collection); /* The buffer we read from */ egg_buffer_init_static (&buffer, data, n_data); if (buffer.len < KEYRING_FILE_HEADER_LEN || memcmp (buffer.buf, KEYRING_FILE_HEADER, KEYRING_FILE_HEADER_LEN) != 0) { egg_buffer_uninit (&buffer); return GKM_DATA_UNRECOGNIZED; } offset = KEYRING_FILE_HEADER_LEN; major = buffer.buf[offset++]; minor = buffer.buf[offset++]; crypto = buffer.buf[offset++]; hash = buffer.buf[offset++]; if (major != 0 || minor != 0 || crypto != 0 || hash != 0) { egg_buffer_uninit (&buffer); return GKM_DATA_UNRECOGNIZED; } if (!buffer_get_utf8_string (&buffer, offset, &offset, &display_name) || !buffer_get_time (&buffer, offset, &offset, &ctime) || !buffer_get_time (&buffer, offset, &offset, &mtime) || !egg_buffer_get_uint32 (&buffer, offset, &offset, &flags) || !egg_buffer_get_uint32 (&buffer, offset, &offset, &lock_timeout) || !egg_buffer_get_uint32 (&buffer, offset, &offset, &hash_iterations) || !buffer_get_bytes (&buffer, offset, &offset, salt, 8)) goto bail; for (i = 0; i < 4; i++) { if (!egg_buffer_get_uint32 (&buffer, offset, &offset, &tmp)) goto bail; } if (!egg_buffer_get_uint32 (&buffer, offset, &offset, &num_items)) goto bail; items = g_new0 (ItemInfo, num_items + 1); /* Hashed data, without secrets */ if (!read_hashed_item_info (&buffer, &offset, items, num_items)) goto bail; if (!egg_buffer_get_uint32 (&buffer, offset, &offset, &crypto_size)) goto bail; /* Make the crypted part is the right size */ if (crypto_size % 16 != 0) goto bail; /* Ensure the file is large enough to hold all the data (in case it got truncated) */ if (buffer.len < offset + crypto_size) goto bail; /* Copy the data into to_decrypt into non-pageable memory */ egg_buffer_set_allocator (&to_decrypt, egg_secure_realloc); egg_buffer_reserve (&to_decrypt, crypto_size); memcpy (to_decrypt.buf, buffer.buf + offset, crypto_size); to_decrypt.len = crypto_size; if (sdata != NULL) { master = gkm_secret_data_get_master (sdata); if (!decrypt_buffer (&to_decrypt, master, salt, hash_iterations)) goto bail; if (!verify_decrypted_buffer (&to_decrypt)) { res = GKM_DATA_LOCKED; goto bail; } else { offset = 16; /* Skip hash */ if (!read_full_item_info (&to_decrypt, &offset, items, num_items)) goto bail; } } /* Correctly read all data, possibly including the decrypted data. * Now update the keyring and items: */ gkm_secret_object_set_label (obj, display_name); gkm_secret_object_set_modified (obj, mtime); gkm_secret_object_set_created (obj, ctime); if (flags & LOCK_ON_IDLE_FLAG) gkm_secret_collection_set_lock_idle (collection, lock_timeout); else if (flags & LOCK_AFTER_FLAG) gkm_secret_collection_set_lock_after (collection, lock_timeout); /* Build a Hash table where we can track ids we haven't yet seen */ checks = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, NULL); iteml = gkm_secret_collection_get_items (collection); for (l = iteml; l; l = g_list_next (l)) g_hash_table_insert (checks, g_strdup (gkm_secret_object_get_identifier (l->data)), "unused"); g_list_free (iteml); for (i = 0; i < num_items; i++) { /* We've seen this id */ g_hash_table_remove (checks, items[i].identifier); item = gkm_secret_collection_get_item (collection, items[i].identifier); if (item == NULL) item = gkm_secret_collection_new_item (collection, items[i].identifier); setup_item_from_info (item, sdata, &items[i]); } g_hash_table_foreach (checks, remove_unavailable_item, collection); res = GKM_DATA_SUCCESS; bail: egg_buffer_uninit (&to_decrypt); if (checks) g_hash_table_destroy (checks); g_free (display_name); for (i = 0; items && i < num_items; i++) free_item_info (&items[i]); g_free (items); return res; }
GkmDataResult gkm_secret_binary_write (GkmSecretCollection *collection, GkmSecretData *sdata, gpointer *data, gsize *n_data) { GkmSecretObject *obj; EggBuffer to_encrypt; GkmSecret *master; guchar digest[16]; EggBuffer buffer; gint hash_iterations; gint lock_timeout; guchar salt[8]; guint flags = 0; int i; g_return_val_if_fail (GKM_IS_SECRET_COLLECTION (collection), GKM_DATA_FAILURE); g_return_val_if_fail (GKM_IS_SECRET_DATA (sdata), GKM_DATA_LOCKED); g_return_val_if_fail (data && n_data, GKM_DATA_FAILURE); g_return_val_if_fail (gcry_md_get_algo_dlen (GCRY_MD_MD5) == sizeof (digest), GKM_DATA_FAILURE); obj = GKM_SECRET_OBJECT (collection); egg_buffer_init_full (&buffer, 256, g_realloc); /* Prepare the keyring for encryption */ hash_iterations = g_random_int_range (1000, 4096); gcry_create_nonce (salt, sizeof (salt)); egg_buffer_append (&buffer, (guchar*)KEYRING_FILE_HEADER, KEYRING_FILE_HEADER_LEN); egg_buffer_add_byte (&buffer, 0); /* Major version */ egg_buffer_add_byte (&buffer, 0); /* Minor version */ egg_buffer_add_byte (&buffer, 0); /* crypto (0 == AES) */ egg_buffer_add_byte (&buffer, 0); /* hash (0 == MD5) */ buffer_add_utf8_string (&buffer, gkm_secret_object_get_label (obj)); buffer_add_time (&buffer, gkm_secret_object_get_modified (obj)); buffer_add_time (&buffer, gkm_secret_object_get_created (obj)); lock_timeout = gkm_secret_collection_get_lock_idle (collection); if (lock_timeout) { flags |= LOCK_ON_IDLE_FLAG; } else { lock_timeout = gkm_secret_collection_get_lock_after (collection); if (lock_timeout) flags |= LOCK_AFTER_FLAG; } egg_buffer_add_uint32 (&buffer, flags); egg_buffer_add_uint32 (&buffer, lock_timeout); egg_buffer_add_uint32 (&buffer, hash_iterations); egg_buffer_append (&buffer, salt, 8); /* Reserved: */ for (i = 0; i < 4; i++) egg_buffer_add_uint32 (&buffer, 0); /* Hashed items: */ generate_hashed_items (collection, &buffer); /* Encrypted data. Use non-pageable memory */ egg_buffer_init_full (&to_encrypt, 4096, egg_secure_realloc); egg_buffer_append (&to_encrypt, (guchar*)digest, 16); /* Space for hash */ if (!generate_encrypted_data (&to_encrypt, collection, sdata)) { egg_buffer_uninit (&to_encrypt); egg_buffer_uninit (&buffer); return GKM_DATA_FAILURE; } /* Pad with zeros to multiple of 16 bytes */ while (to_encrypt.len % 16 != 0) egg_buffer_add_byte (&to_encrypt, 0); gcry_md_hash_buffer (GCRY_MD_MD5, (void*)digest, (guchar*)to_encrypt.buf + 16, to_encrypt.len - 16); memcpy (to_encrypt.buf, digest, 16); /* If no master password is set, we shouldn't be writing binary... */ master = gkm_secret_data_get_master (sdata); g_return_val_if_fail (master, GKM_DATA_FAILURE); if (!encrypt_buffer (&to_encrypt, master, salt, hash_iterations)) { egg_buffer_uninit (&buffer); egg_buffer_uninit (&to_encrypt); return GKM_DATA_FAILURE; } if (egg_buffer_has_error (&to_encrypt) || egg_buffer_has_error (&buffer)) { egg_buffer_uninit (&buffer); egg_buffer_uninit (&to_encrypt); return GKM_DATA_FAILURE; } egg_buffer_add_uint32 (&buffer, to_encrypt.len); egg_buffer_append (&buffer, to_encrypt.buf, to_encrypt.len); egg_buffer_uninit (&to_encrypt); *data = egg_buffer_uninit_steal (&buffer, n_data); return GKM_DATA_SUCCESS; }