/* <2a3cb> ../engine/hashpak.c:1235 */
void HPAK_Validate_f(void)
{
hash_pack_header_t header;
hash_pack_directory_t directory;
hash_pack_entry_t *entry;
char name[MAX_PATH];
char szFileName[MAX_PATH];
char type[32];
FileHandle_t fp;
byte *pData;
int nDataSize;
byte md5[16];
MD5Context_t ctx;
if (cmd_source != src_command)
return;
HPAK_FlushHostQueue();
if (Cmd_Argc() != 2)
{
Con_Printf("Usage: hpkval hpkname\n");
return;
}
Q_snprintf(name, ARRAYSIZE(name), "%s", Cmd_Argv(1));
#ifdef REHLDS_FIXES
name[ARRAYSIZE(name) - 1] = 0;
#endif // REHLDS_FIXES
COM_DefaultExtension(name, HASHPAK_EXTENSION);
Con_Printf("Validating %s.\n", name);
fp = FS_Open(name, "rb");
if (!fp)
{
Con_Printf("ERROR: couldn't open %s.\n", name);
return;
}
FS_Read(&header, sizeof(hash_pack_header_t), 1, fp);
if (Q_strncmp(header.szFileStamp, "HPAK", sizeof(header.szFileStamp)))
{
Con_Printf("%s is not an HPAK file\n", name);
FS_Close(fp);
return;
}
if (header.version != HASHPAK_VERSION)
{
Con_Printf("hpkval: version mismatch\n");
FS_Close(fp);
return;
}
FS_Seek(fp, header.nDirectoryOffset, FILESYSTEM_SEEK_HEAD);
FS_Read(&directory.nEntries, 4, 1, fp);
if (directory.nEntries < 1 || (unsigned int)directory.nEntries > MAX_FILE_ENTRIES)
{
Con_Printf("ERROR: HPAK had bogus # of directory entries: %i\n", directory.nEntries);
FS_Close(fp);
return;
}
Con_Printf("# of Entries: %i\n", directory.nEntries);
Con_Printf("# Type Size FileName : MD5 Hash\n");
directory.p_rgEntries = (hash_pack_entry_t *)Mem_Malloc(sizeof(hash_pack_entry_t) * directory.nEntries);
FS_Read(directory.p_rgEntries, sizeof(hash_pack_entry_t) * directory.nEntries, 1, fp);
for (int nCurrent = 0; nCurrent < directory.nEntries; nCurrent++)
{
entry = &directory.p_rgEntries[nCurrent];
COM_FileBase(entry->resource.szFileName, szFileName);
switch (entry->resource.type)
{
case t_sound:
Q_strcpy(type, "sound");
break;
case t_skin:
Q_strcpy(type, "skin");
break;
case t_model:
Q_strcpy(type, "model");
break;
case t_decal:
Q_strcpy(type, "decal");
break;
case t_generic:
Q_strcpy(type, "generic");
break;
case t_eventscript:
Q_strcpy(type, "event");
break;
default:
Q_strcpy(type, "?");
break;
}
Con_Printf("%i: %10s %.2fK %s: ", nCurrent + 1, type, entry->resource.nDownloadSize / 1024.0f, szFileName);
nDataSize = entry->nFileLength;
if (nDataSize < 1 || (unsigned int)nDataSize >= MAX_FILE_SIZE)
Con_Printf("Unable to MD5 hash data, size invalid: %i\n", nDataSize);
else
{
pData = (byte *)Mem_Malloc(nDataSize + 1);
Q_memset(pData, 0, nDataSize);
FS_Seek(fp, entry->nOffset, FILESYSTEM_SEEK_HEAD);
FS_Read(pData, nDataSize, 1, fp);
Q_memset(&ctx, 0, sizeof(MD5Context_t));
MD5Init(&ctx);
MD5Update(&ctx, pData, nDataSize);
MD5Final(md5, &ctx);
if (Q_memcmp(entry->resource.rgucMD5_hash, md5, sizeof(md5)) == 0)
Con_Printf(" OK\n");
else
{
Con_Printf(" MISMATCHED\n");
Con_Printf("--------------------\n");
Con_Printf(" File : %s\n", MD5_Print(entry->resource.rgucMD5_hash));
Con_Printf(" Actual: %s\n", MD5_Print(md5));
Con_Printf("--------------------\n");
}
if (pData)
Mem_Free(pData);
}
}
FS_Close(fp);
Mem_Free(directory.p_rgEntries);
}
/**
* 先检测黑名单，如果在黑名单内，直接拒，否则放行。
如果不在黑名单，则检查白名单，在白名单内，无操作。
如果不在白名单内，则将文件全路径及hash值传递到上层
* @param filename 文件全路径。
* return 如果文件安全则返回true，否则返回false。
*/
bool CheckIsFileHashSecure(const PUNICODE_STRING filename)
{
/////////////////////////////////////////////比较已经过滤的文件名
if(IsInBlackCache(filename) == true)
return false;
if( MODULE_FILTERED == GetModuleFilter((ULONG)PsGetCurrentProcessId(),filename) )
return true;
///////////////////////////////////////
HANDLE hFile;
OBJECT_ATTRIBUTES oaFile;
InitializeObjectAttributes(&oaFile, filename, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
// 读权限打开文件，如果失败则认为文件不安全，返回false。
IO_STATUS_BLOCK ioStatus;
NTSTATUS status = ZwOpenFile(&hFile, GENERIC_READ, &oaFile, &ioStatus, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT);
if(!NT_SUCCESS(status))
{
KdPrint(("VerifyModule: ZwOpenFile: %ws %08x\n", filename->Buffer, status));
return false;
}
unsigned char* fileBuf = (unsigned char*)ExAllocatePoolWithTag(PagedPool, FILE_BUFFER_SIZE, 'knab');
if(fileBuf == NULL)
{
ZwClose(hFile);
return false;
}
// 获取文件hash。
MD5_CTX md5;
MD5Init(&md5);
ULONG sizeAll=0;
FILE_STANDARD_INFORMATION fsi;
ZwQueryInformationFile(hFile,&ioStatus,&fsi,sizeof(FILE_STANDARD_INFORMATION),FileStandardInformation);
while(1)
{
NTSTATUS status = ZwReadFile(hFile, NULL, NULL, NULL, &ioStatus, fileBuf,
FILE_BUFFER_SIZE, NULL, NULL);
if(!NT_SUCCESS(status))
break;
if(ioStatus.Information == 0)
break;
sizeAll += ioStatus.Information;
MD5Update(&md5, fileBuf, ioStatus.Information);
}
ExFreePoolWithTag(fileBuf, 'knab');
unsigned char final[16];
MD5Final(final, &md5);
ZwClose(hFile);
//黑白名单校验
// bool bOK = IsHashBlack(final);
//
// if( bOK )
// {
// if(!IsInBlackCache(filename))
// {
// WriteSysLog(LOG_TYPE_DEBUG,L" Fileter Module :%s", filename->Buffer);
// AddBlackCache(filename);
// }
// return false;
// }
// else if( !IsHashSecure(final) )//传递到上层
// {
// if( setData(filename->Buffer,filename->Length,final,16) )
// setSigned();
// }
bool bOK = IsHashBlack(final);
bool bReturn = true;
if( bOK )
{
if(!IsInBlackCache(filename))
{
WriteSysLog(LOG_TYPE_INFO,L" Fileter Module :%s", filename->Buffer);
AddBlackCache(filename);
}
bReturn = false;
}
else if( !IsHashSecure(final) )//传递到上层
{
if( !IsInstall() )
{
if( setData(filename->Buffer,filename->Length,final,16) )
setSigned();
LARGE_INTEGER lWaitTimeOuts;
lWaitTimeOuts.QuadPart = -10 * 1000 * 1000;
//DbgPrint("###kernel wait event!");
WriteSysLog(LOG_TYPE_INFO,L" kernel is waitint for event signal!");
if( STATUS_TIMEOUT == KeWaitForSingleObject(g_pEventFilterGo, Executive, KernelMode, FALSE, &lWaitTimeOuts) )
{
IsInstall(true);
if( GetPIDNumber() > 2)
bReturn = false;
else
bReturn = true;
}
else
bReturn = g_bPassFilter;
//DbgPrint("###kernel continue: file path : %ws is %ws \n", filename->Buffer, bReturn? L"pass":L"noPass");
WriteSysLog(LOG_TYPE_INFO,L" kernel continue: file path : %ws is %ws", filename->Buffer, bReturn? L"pass":L"noPass");
if( bReturn )
if( MODULE_FILTERED != GetModuleFilter((ULONG)PsGetCurrentProcessId(),filename) && (GetPIDNumber() > 2) )
SetModuleFilter((ULONG)PsGetCurrentProcessId(), filename, true);
}
}
//
return bReturn;
}
int read_file(char* file_name)
{
puts("--------------------read file");
int i;
int fname_len = 0;
int fdata_len = 0;
int cur_len = 0;
int tmp_len = 0;
char rec_buf[1024] = {0};
char tmp_buf[4096] = {0};
char file_md5[32] = {0};
int send_len = 0;
char send_buf[4096] = {0};
MD5_CTX mdContext;
MD5Init (&mdContext);
FILE *fp = fopen(file_name, "r");
if (fp == NULL)
{
printf("File:\t%s Can Not Open To Write!\n", file_name);
return -1;
}
printf("%s\n", file_name);
while ((tmp_len = fread(rec_buf, sizeof(char), BUFFER_SIZE, fp)) > 0)
{
printf("tmplen:%d\n", tmp_len);
strncpy(tmp_buf+cur_len, rec_buf, tmp_len);
//printf("==================================\n");
//printf("tmpbuf in clrcle is:\n");
//printf("%s\n", tmp_buf);
//printf("==================================\n");
cur_len = cur_len + tmp_len;
//bzero(rec_buf, sizeof(rec_buf));
}
fname_len = strlen(file_name);
fdata_len = strlen(tmp_buf);
printf("fdata_len is:%d\n", fdata_len);
MD5Update (&mdContext, tmp_buf, fdata_len);
MD5Final (&mdContext);
send_len = sizeof(send_len) + sizeof(fname_len) + fname_len + sizeof(fdata_len) + fdata_len + 32;
memcpy(send_buf , &send_len, sizeof(int));
memcpy(send_buf + sizeof(int), &fname_len, sizeof(int));
memcpy(send_buf + 2*sizeof(int), file_name, fname_len);
memcpy(send_buf + 2*sizeof(int) + fname_len, &fdata_len, sizeof(int));
memcpy(send_buf + 3*sizeof(int) + fname_len, tmp_buf, fdata_len);
for(i=0; i<16; i++)
{
sprintf(&file_md5[i*2], "%02x", mdContext.digest[i]);
}
printf("send md5 is:%s\n", file_md5);
memcpy(send_buf + 3*sizeof(int) + fname_len + fdata_len, file_md5, 32);
printf("==================================\n");
printf("disbuf:\n");
t_disbuf(send_buf, send_len + 4);
printf("==================================\n");
if (send_data(send_buf, send_len) < 0)
{
printf("senddata failed\n");
return -1;
}
fclose(fp);
}
static char *
chap_BuildAnswer_old(char *name, char *key, u_char id, char *challenge, u_char type
#ifdef HAVE_DES
, int lanman
#endif
)
{
char *result;
#ifndef __GNU__
char *digest;
#endif /* __GNU__ */
size_t nlen, klen;
nlen = strlen(name);
klen = strlen(key);
#ifdef HAVE_DES
if (type == 0x80) {
char expkey[AUTHLEN << 2];
MD4_CTX MD4context;
int f;
if ((result = malloc(1 + nlen + MS_CHAP_RESPONSE_LEN)) == NULL)
return result;
digest = result; /* the response */
*digest++ = MS_CHAP_RESPONSE_LEN; /* 49 */
memcpy(digest + MS_CHAP_RESPONSE_LEN, name, nlen);
if (lanman) {
memset(digest + 24, '\0', 25);
mschap_LANMan(digest, challenge + 1, key); /* LANMan response */
} else {
memset(digest, '\0', 25);
digest += 24;
for (f = 0; f < klen; f++) {
expkey[2*f] = key[f];
expkey[2*f+1] = '\0';
}
/*
* -----------
* expkey = | k\0e\0y\0 |
* -----------
*/
MD4Init(&MD4context);
MD4Update(&MD4context, expkey, klen << 1);
MD4Final(digest, &MD4context);
/*
* ---- -------- ---------------- ------- ------
* result = | 49 | LANMan | 16 byte digest | 9 * ? | name |
* ---- -------- ---------------- ------- ------
*/
mschap_NT(digest, challenge + 1);
}
/*
* ---- -------- ------------- ----- ------
* | | struct MS_ChapResponse24 | |
* result = | 49 | LANMan | NT digest | 0/1 | name |
* ---- -------- ------------- ----- ------
* where only one of LANMan & NT digest are set.
*/
} else
#endif
if ((result = malloc(nlen + 17)) != NULL) {
/* Normal MD5 stuff */
#ifdef __GNU__
_exit (240); /* Critical */
#else
MD5_CTX MD5context;
digest = result;
*digest++ = 16; /* value size */
MD5Init(&MD5context);
MD5Update(&MD5context, &id, 1);
MD5Update(&MD5context, key, klen);
MD5Update(&MD5context, challenge + 1, *challenge);
MD5Final(digest, &MD5context);
memcpy(digest + 16, name, nlen);
/*
* ---- -------- ------
* result = | 16 | digest | name |
* ---- -------- ------
*/
#endif
}
return result;
}
static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_state *ntlmssp_state,
const DATA_BLOB reply, DATA_BLOB *next_request)
{
uint32 chal_flags, ntlmssp_command, unkn1, unkn2;
DATA_BLOB server_domain_blob;
DATA_BLOB challenge_blob;
DATA_BLOB struct_blob = data_blob_null;
char *server_domain;
const char *chal_parse_string;
const char *auth_gen_string;
DATA_BLOB lm_response = data_blob_null;
DATA_BLOB nt_response = data_blob_null;
DATA_BLOB session_key = data_blob_null;
DATA_BLOB encrypted_session_key = data_blob_null;
NTSTATUS nt_status = NT_STATUS_OK;
if (!msrpc_parse(&reply, "CdBd",
"NTLMSSP",
&ntlmssp_command,
&server_domain_blob,
&chal_flags)) {
DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
dump_data(2, reply.data, reply.length);
return NT_STATUS_INVALID_PARAMETER;
}
data_blob_free(&server_domain_blob);
DEBUG(3, ("Got challenge flags:\n"));
debug_ntlmssp_flags(chal_flags);
ntlmssp_handle_neg_flags(ntlmssp_state, chal_flags, lp_client_lanman_auth());
if (ntlmssp_state->unicode) {
if (chal_flags & NTLMSSP_CHAL_TARGET_INFO) {
chal_parse_string = "CdUdbddB";
} else {
chal_parse_string = "CdUdbdd";
}
auth_gen_string = "CdBBUUUBd";
} else {
if (chal_flags & NTLMSSP_CHAL_TARGET_INFO) {
chal_parse_string = "CdAdbddB";
} else {
chal_parse_string = "CdAdbdd";
}
auth_gen_string = "CdBBAAABd";
}
DEBUG(3, ("NTLMSSP: Set final flags:\n"));
debug_ntlmssp_flags(ntlmssp_state->neg_flags);
if (!msrpc_parse(&reply, chal_parse_string,
"NTLMSSP",
&ntlmssp_command,
&server_domain,
&chal_flags,
&challenge_blob, 8,
&unkn1, &unkn2,
&struct_blob)) {
DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n"));
dump_data(2, reply.data, reply.length);
return NT_STATUS_INVALID_PARAMETER;
}
ntlmssp_state->server_domain = talloc_strdup(ntlmssp_state->mem_ctx,
server_domain);
SAFE_FREE(server_domain);
if (challenge_blob.length != 8) {
data_blob_free(&struct_blob);
return NT_STATUS_INVALID_PARAMETER;
}
if (!ntlmssp_state->nt_hash || !ntlmssp_state->lm_hash) {
uchar zeros[16];
/* do nothing - blobs are zero length */
ZERO_STRUCT(zeros);
/* session key is all zeros */
session_key = data_blob_talloc(ntlmssp_state->mem_ctx, zeros, 16);
/* not doing NLTM2 without a password */
ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
} else if (ntlmssp_state->use_ntlmv2) {
if (!struct_blob.length) {
/* be lazy, match win2k - we can't do NTLMv2 without it */
DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
return NT_STATUS_INVALID_PARAMETER;
}
/* TODO: if the remote server is standalone, then we should replace 'domain'
with the server name as supplied above */
if (!SMBNTLMv2encrypt_hash(ntlmssp_state->user,
ntlmssp_state->domain,
ntlmssp_state->nt_hash, &challenge_blob,
&struct_blob,
&lm_response, &nt_response, &session_key)) {
data_blob_free(&challenge_blob);
data_blob_free(&struct_blob);
return NT_STATUS_NO_MEMORY;
}
} else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
struct MD5Context md5_session_nonce_ctx;
uchar session_nonce[16];
uchar session_nonce_hash[16];
uchar user_session_key[16];
lm_response = data_blob_talloc(ntlmssp_state->mem_ctx, NULL, 24);
generate_random_buffer(lm_response.data, 8);
memset(lm_response.data+8, 0, 16);
memcpy(session_nonce, challenge_blob.data, 8);
memcpy(&session_nonce[8], lm_response.data, 8);
MD5Init(&md5_session_nonce_ctx);
MD5Update(&md5_session_nonce_ctx, challenge_blob.data, 8);
MD5Update(&md5_session_nonce_ctx, lm_response.data, 8);
MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
DEBUG(5, ("challenge is: \n"));
dump_data(5, session_nonce_hash, 8);
nt_response = data_blob_talloc(ntlmssp_state->mem_ctx, NULL, 24);
SMBNTencrypt_hash(ntlmssp_state->nt_hash,
session_nonce_hash,
nt_response.data);
session_key = data_blob_talloc(ntlmssp_state->mem_ctx, NULL, 16);
SMBsesskeygen_ntv1(ntlmssp_state->nt_hash, NULL, user_session_key);
hmac_md5(user_session_key, session_nonce, sizeof(session_nonce), session_key.data);
dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
} else {
/* lanman auth is insecure, it may be disabled */
if (lp_client_lanman_auth()) {
lm_response = data_blob_talloc(ntlmssp_state->mem_ctx, NULL, 24);
SMBencrypt_hash(ntlmssp_state->lm_hash,challenge_blob.data,
lm_response.data);
}
nt_response = data_blob_talloc(ntlmssp_state->mem_ctx, NULL, 24);
SMBNTencrypt_hash(ntlmssp_state->nt_hash,challenge_blob.data,
nt_response.data);
session_key = data_blob_talloc(ntlmssp_state->mem_ctx, NULL, 16);
if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
&& lp_client_lanman_auth()) {
SMBsesskeygen_lm_sess_key(ntlmssp_state->lm_hash, lm_response.data,
session_key.data);
dump_data_pw("LM session key\n", session_key.data, session_key.length);
} else {
SMBsesskeygen_ntv1(ntlmssp_state->nt_hash, NULL, session_key.data);
dump_data_pw("NT session key:\n", session_key.data, session_key.length);
}
}
data_blob_free(&struct_blob);
/* Key exchange encryptes a new client-generated session key with
the password-derived key */
if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
/* Make up a new session key */
uint8 client_session_key[16];
generate_random_buffer(client_session_key, sizeof(client_session_key));
/* Encrypt the new session key with the old one */
encrypted_session_key = data_blob(client_session_key, sizeof(client_session_key));
dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data, encrypted_session_key.length);
SamOEMhash(encrypted_session_key.data, session_key.data, encrypted_session_key.length);
dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length);
/* Mark the new session key as the 'real' session key */
data_blob_free(&session_key);
session_key = data_blob_talloc(ntlmssp_state->mem_ctx, client_session_key, sizeof(client_session_key));
}
/* this generates the actual auth packet */
if (!msrpc_gen(next_request, auth_gen_string,
"NTLMSSP",
NTLMSSP_AUTH,
lm_response.data, lm_response.length,
nt_response.data, nt_response.length,
ntlmssp_state->domain,
ntlmssp_state->user,
ntlmssp_state->get_global_myname(),
encrypted_session_key.data, encrypted_session_key.length,
ntlmssp_state->neg_flags)) {
return NT_STATUS_NO_MEMORY;
}
data_blob_free(&encrypted_session_key);
data_blob_free(&ntlmssp_state->chal);
ntlmssp_state->session_key = session_key;
ntlmssp_state->chal = challenge_blob;
ntlmssp_state->lm_resp = lm_response;
ntlmssp_state->nt_resp = nt_response;
ntlmssp_state->expected_state = NTLMSSP_DONE;
if (!NT_STATUS_IS_OK(nt_status = ntlmssp_sign_init(ntlmssp_state))) {
DEBUG(1, ("Could not setup NTLMSSP signing/sealing system (error was: %s)\n", nt_errstr(nt_status)));
}
return nt_status;
}
/*
* Save an RSA key file. Return nonzero on success.
*/
int saversakey(const Filename *filename, struct RSAKey *key, char *passphrase)
{
unsigned char buf[16384];
unsigned char keybuf[16];
struct MD5Context md5c;
unsigned char *p, *estart;
FILE *fp;
/*
* Write the initial signature.
*/
p = buf;
memcpy(p, rsa_signature, sizeof(rsa_signature));
p += sizeof(rsa_signature);
/*
* One byte giving encryption type, and one reserved (zero)
* uint32.
*/
*p++ = (passphrase ? SSH_CIPHER_3DES : 0);
PUT_32BIT(p, 0);
p += 4;
/*
* An ordinary SSH-1 public key consists of: a uint32
* containing the bit count, then two bignums containing the
* modulus and exponent respectively.
*/
PUT_32BIT(p, bignum_bitcount(key->modulus));
p += 4;
p += ssh1_write_bignum(p, key->modulus);
p += ssh1_write_bignum(p, key->exponent);
/*
* A string containing the comment field.
*/
if (key->comment) {
PUT_32BIT(p, strlen(key->comment));
p += 4;
memcpy(p, key->comment, strlen(key->comment));
p += strlen(key->comment);
} else {
PUT_32BIT(p, 0);
p += 4;
}
/*
* The encrypted portion starts here.
*/
estart = p;
/*
* Two bytes, then the same two bytes repeated.
*/
*p++ = random_byte();
*p++ = random_byte();
p[0] = p[-2];
p[1] = p[-1];
p += 2;
/*
* Four more bignums: the decryption exponent, then iqmp, then
* q, then p.
*/
p += ssh1_write_bignum(p, key->private_exponent);
p += ssh1_write_bignum(p, key->iqmp);
p += ssh1_write_bignum(p, key->q);
p += ssh1_write_bignum(p, key->p);
/*
* Now write zeros until the encrypted portion is a multiple of
* 8 bytes.
*/
while ((p - estart) % 8)
*p++ = '\0';
/*
* Now encrypt the encrypted portion.
*/
if (passphrase) {
MD5Init(&md5c);
MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
MD5Final(keybuf, &md5c);
des3_encrypt_pubkey(keybuf, estart, p - estart);
smemclr(keybuf, sizeof(keybuf)); /* burn the evidence */
}
/*
* Done. Write the result to the file.
*/
fp = f_open(filename, "wb", TRUE);
if (fp) {
int ret = (fwrite(buf, 1, p - buf, fp) == (size_t) (p - buf));
if (fclose(fp))
ret = 0;
return ret;
} else
return 0;
}
/*
* XXX: Add gctl_req arg and give good error msgs.
* XXX: Check that length argument does not bring boot code inside any slice.
*/
static int
g_mbr_modify(struct g_geom *gp, struct g_mbr_softc *ms, u_char *sec0, int len __unused)
{
int i, error;
off_t l[NDOSPART];
struct dos_partition ndp[NDOSPART], *dp;
MD5_CTX md5sum;
g_topology_assert();
if (sec0[0x1fe] != 0x55 && sec0[0x1ff] != 0xaa)
return (EBUSY);
dp = ndp;
for (i = 0; i < NDOSPART; i++) {
dos_partition_dec(
sec0 + DOSPARTOFF + i * sizeof(struct dos_partition),
dp + i);
}
if ((!bcmp(dp, historical_bogus_partition_table,
sizeof historical_bogus_partition_table)) ||
(!bcmp(dp, historical_bogus_partition_table_fixed,
sizeof historical_bogus_partition_table_fixed))) {
/*
* We will not allow people to write these from "the inside",
* Since properly selfdestructing takes too much code. If
* people really want to do this, they cannot have any
* providers of this geom open, and in that case they can just
* as easily overwrite the MBR in the parent device.
*/
return(EBUSY);
}
for (i = 0; i < NDOSPART; i++) {
/*
* A Protective MBR (PMBR) has a single partition of
* type 0xEE spanning the whole disk. Such a MBR
* protects a GPT on the disk from MBR tools that
* don't know anything about GPT. We're interpreting
* it a bit more loosely: any partition of type 0xEE
* is to be skipped as it doesn't contain any data
* that we should care about. We still allow other
* partitions to be present in the MBR. A PMBR will
* be handled correctly anyway.
*/
if (dp[i].dp_typ == DOSPTYP_PMBR)
l[i] = 0;
else if (dp[i].dp_flag != 0 && dp[i].dp_flag != 0x80)
l[i] = 0;
else if (dp[i].dp_typ == 0)
l[i] = 0;
else
l[i] = (off_t)dp[i].dp_size * ms->sectorsize;
error = g_slice_config(gp, i, G_SLICE_CONFIG_CHECK,
(off_t)dp[i].dp_start * ms->sectorsize, l[i],
ms->sectorsize, "%ss%d", gp->name, 1 + i);
if (error)
return (error);
}
for (i = 0; i < NDOSPART; i++) {
ms->type[i] = dp[i].dp_typ;
g_slice_config(gp, i, G_SLICE_CONFIG_SET,
(off_t)dp[i].dp_start * ms->sectorsize, l[i],
ms->sectorsize, "%ss%d", gp->name, 1 + i);
}
bcopy(sec0, ms->sec0, 512);
/*
* Calculate MD5 from the first sector and use it for avoiding
* recursive slices creation.
*/
MD5Init(&md5sum);
MD5Update(&md5sum, ms->sec0, sizeof(ms->sec0));
MD5Final(ms->slicesum, &md5sum);
return (0);
}
int main(int argc, char **argv)
{
JSAMPARRAY buf = malloc(sizeof(JSAMPROW)*BUF_LINES);
jpeg_saved_marker_ptr exif_marker, cmarker;
MD5_CTX *MD5 = malloc(sizeof(MD5_CTX));
volatile int i;
int c,j,lines_read, err_count;
char ch;
char namebuf[1024];
long fs;
char *md5buf,digest[16],digest_text[33];
global_total_errors=0;
if (rcsid); /* to keep compiler from not complaining about rcsid */
cinfo.err = jpeg_std_error(&jerr.pub);
jpeg_create_decompress(&cinfo);
jerr.pub.error_exit=my_error_exit;
jerr.pub.output_message=my_output_message;
if (!buf || !MD5) no_memory();
if (argc<2) {
if (quiet_mode < 2) fprintf(stderr,"jpeginfo: file arguments missing\n"
"Try 'jpeginfo "
"--help"
"' for more information.\n");
exit(1);
}
/* parse command line parameters */
while(1) {
opt_index=0;
if ( (c=getopt_long(argc,argv,"livVdcChqm:f:5",
long_options,&opt_index)) == -1)
break;
switch (c) {
case 'm':
if (!strcasecmp(optarg,"all")) del_mode=0;
else if (!strcasecmp(optarg,"erronly")) del_mode=1;
else if (!quiet_mode)
fprintf(stderr,"Unknown parameter for -m, --mode.\n");
break;
case 'f':
if (!strcmp(optarg,"-")) listfile=stdin;
else if ((listfile=fopen(optarg,"r"))==NULL) {
fprintf(stderr,"Cannot open file '%s'.\n",optarg);
exit(2);
}
input_from_file=1;
break;
case 'v':
verbose_mode=1;
break;
case 'V':
fprintf(stderr,"jpeginfo v" VERSION " " HOST_TYPE
"\nCopyright (c) Timo Kokkonen, 1995-2002.\n");
exit(0);
case 'd':
delete_mode=1;
break;
case 'c':
check_mode=1;
break;
case 'h':
p_usage();
break;
case 'q':
quiet_mode++;
break;
case 'l':
list_mode=1;
break;
case 'i':
longinfo_mode=1;
break;
case '5':
md5_mode=1;
break;
case 'C':
com_mode=1;
break;
case '?':
break;
default:
if (!quiet_mode)
fprintf(stderr,"jpeginfo: error parsing parameters.\n");
}
}
if (delete_mode && verbose_mode && !quiet_mode)
fprintf(stderr,"jpeginfo: delete mode enabled (%s)\n",
!del_mode?"normal":"errors only");
i=1;
do {
if (input_from_file) {
if (!fgetstr(namebuf,sizeof(namebuf),listfile)) break;
current=namebuf;
}
else current=argv[i];
if (current[0]==0) continue;
if (current[0]=='-' && !input_from_file) continue;
if (setjmp(jerr.setjmp_buffer)) {
jpeg_abort_decompress(&cinfo);
fclose(infile);
if (list_mode && quiet_mode < 2) printf(" %s",current);
if (quiet_mode < 2) printf(" [ERROR]\n");
if (delete_mode) delete_file(current,verbose_mode,quiet_mode);
continue;
}
if ((infile=fopen(current,"r"))==NULL) {
if (!quiet_mode) fprintf(stderr, "jpeginfo: can't open '%s'\n", current);
continue;
}
if (is_dir(infile)) {
fclose(infile);
if (verbose_mode) printf("directory: %s skipped\n",current);
continue;
}
fs=filesize(infile);
if (md5_mode) {
md5buf=malloc(fs);
if (!md5buf) no_memory();
fread(md5buf,1,fs,infile);
rewind(infile);
MD5Init(MD5);
MD5Update(MD5,md5buf,fs);
MD5Final(digest,MD5);
md2str(digest,digest_text);
free(md5buf);
}
if (!list_mode && quiet_mode < 2) printf("%s ",current);
global_error_counter=0;
err_count=jerr.pub.num_warnings;
if (com_mode) jpeg_save_markers(&cinfo, JPEG_COM, 0xffff);
jpeg_save_markers(&cinfo, EXIF_JPEG_MARKER, 0xffff);
jpeg_stdio_src(&cinfo, infile);
jpeg_read_header(&cinfo, TRUE);
/* check for Exif marker */
exif_marker=NULL;
cmarker=cinfo.marker_list;
while (cmarker) {
if (cmarker->marker == EXIF_JPEG_MARKER) {
if (!memcmp(cmarker->data,EXIF_IDENT_STRING,6)) exif_marker=cmarker;
}
cmarker=cmarker->next;
}
if (quiet_mode < 2) {
printf("%4d x %-4d %2dbit ",(int)cinfo.image_width,
(int)cinfo.image_height,(int)cinfo.num_components*8);
if (exif_marker) printf("Exif ");
else if (cinfo.saw_JFIF_marker) printf("JFIF ");
else if (cinfo.saw_Adobe_marker) printf("Adobe ");
else printf("n/a ");
if (longinfo_mode) {
printf("%s %s",(cinfo.progressive_mode?"Progressive":"Normal"),
(cinfo.arith_code?"Arithmetic":"Huffman") );
if (cinfo.density_unit==1||cinfo.density_unit==2)
printf(",%ddp%c",MIN(cinfo.X_density,cinfo.Y_density),
(cinfo.density_unit==1?'i':'c') );
if (cinfo.CCIR601_sampling) printf(",CCIR601");
printf(" %7ld ",fs);
} else printf("%c %7ld ",(cinfo.progressive_mode?'P':'N'),fs);
if (md5_mode) printf("%s ",digest_text);
if (list_mode) printf("%s ",current);
if (com_mode) {
cmarker=cinfo.marker_list;
while (cmarker) {
if (cmarker->marker == JPEG_COM) {
printf("\"");
for (j=0;j<cmarker->data_length;j++) {
ch = cmarker->data[j];
if (ch < 32 || iscntrl(ch)) continue;
printf("%c",cmarker->data[j]);
}
printf("\" ");
}
cmarker=cmarker->next;
}
}
}
if (check_mode) {
cinfo.out_color_space=JCS_GRAYSCALE; /* to speed up the process... */
cinfo.scale_denom = 8;
jpeg_start_decompress(&cinfo);
for (j=0;j<BUF_LINES;j++) {
buf[j]=malloc(sizeof(JSAMPLE)*cinfo.output_width*
cinfo.out_color_components);
if (!buf[j]) no_memory();
}
while (cinfo.output_scanline < cinfo.output_height) {
lines_read = jpeg_read_scanlines(&cinfo, buf,BUF_LINES);
}
jpeg_finish_decompress(&cinfo);
for(j=0;j<BUF_LINES;j++) free(buf[j]);
if (!global_error_counter) {
if (quiet_mode < 2) printf(" [OK]\n");
}
else {
if (quiet_mode < 2) printf(" [WARNING]\n");
if (delete_mode && !del_mode)
delete_file(current,verbose_mode,quiet_mode);
}
}
else { /* !check_mode */
if (quiet_mode < 2) printf("\n");
jpeg_abort_decompress(&cinfo);
}
fclose(infile);
} while (++i<argc || input_from_file);
jpeg_destroy_decompress(&cinfo);
free(buf);
free(MD5);
return (global_total_errors>0?1:0); /* return 1 if any errors found file(s)
we checked */
}
int main (int argc, char *argv[])
{
unsigned int i;
unsigned int n = 0;
unsigned int size = 0;
struct MD5Context md5c;
unsigned char digest[16];
uint32_t bit32sum = 0;
uint32_t * pointer_to_buf = (uint32_t *)buf;
if (parse_args (argc, argv))
if (!opt_quiet)
usage();
/* Initialize MD5 module: */
MD5Init(&md5c);
/* Open input and output files: ******************************/
if (opt_stdin)
infile = stdin;
else
infile = fopen (opt_filename, "r");
if (infile == NULL) {
fprintf (stderr, "FATAL: could not open %s\n", opt_filename);
exit(1);
}
if (!opt_quiet) {
fprintf (stderr, "uCimage file: \"%s\"\n",
opt_filename);
}
/* Read various header data: ***************************/
/* Read header and image file to output, compute MD5: ******/
/* read header: */
fread (&header, sizeof(header), 1, infile);
/* Check magic in header */
for (i=0;i<sizeof(header.magic);i++) {
if (header.magic[i] != UCHEADER_MAGIC[i]) {
fprintf (stderr, "Header magic not: \"%s\" instead: \"%s\"\n",
UCHEADER_MAGIC, header.magic);
/* optionally abort? */
break;
}
}
/**** to do: largely respond to header version in the interpretation! ***/
/* read header size */
DBG ("header_size reported as: %10d\n", header.header_size);
/* image size: */
fprintf (stdout, "data_size reported as: %10d\n", header.data_size);
/* image size: */
fprintf (stdout, "partition reported as: %c\n", header.partition);
/* header date code */
fprintf (stdout, "date code reported as: \"%s\"\n", header.datecode);
/* header name */
fprintf (stdout, "name reported as: \"%s\"\n", header.name);
/* MD5: */
fprintf (stdout, "MD5 digest reported as: ");
for (i=0;i<16;i++)
fprintf (stdout, "%02x", header.md5sum[i]);
fprintf (stdout, "\n");
/* 32Bit checksum: */
fprintf (stdout, "32 bit checksum reported as:0x%8x\n", header.bit32sum);
/* read image and do MD5: */
while (!feof(infile)) {
n = fread (buf, 1, BUFFERSIZE, infile);
size += n;
MD5Update (&md5c, buf, n);
/* 32 bit checksum */
pointer_to_buf = (uint32_t *)buf;
while ( (char *)pointer_to_buf - buf < n ) {
bit32sum += htonl(*pointer_to_buf);
pointer_to_buf++;
}
}
/* save MD5: */
MD5Final (digest, &md5c);
if (!opt_stdin)
fclose (infile);
/* Verify: */
for (i=0;i<16;i++) {
if (header.md5sum[i] != digest[i]) {
fprintf (stdout, "ERROR: MD5 digest mismatch\n");
fprintf (stdout, "MD5 digest calculated as: ");
for (i=0;i<16;i++)
fprintf (stdout, "%02x", digest[i]);
fprintf (stdout, "\n");
}
}
/* verify bit32sum */
if (header.bit32sum != bit32sum){
fprintf (stdout, "ERROR: 32 bit checksum mismatch\n");
fprintf (stdout, "This program calculates bit32sum as: 0x%8x\n", bit32sum);
}
/* Also verify that length matches */
if (header.data_size != size) {
fprintf (stdout, "ERROR: image size mismatch\n");
fprintf (stdout, "This program calculates data_size as: %12d\n", size);
}
/* note: rewriting header bits might at some point be desireable */
/* rewind output file to update header: */
/* rewind (outfile); */
/* rewrite header: */
/* fwrite (&header, sizeof(header), 1, outfile); */
/* fclose (outfile); */
return (0);
}
int main_loop(int argc, const char **argv_) {
vpx_codec_ctx_t decoder;
char *fn = NULL;
int i;
uint8_t *buf = NULL;
size_t bytes_in_buffer = 0, buffer_size = 0;
FILE *infile;
int frame_in = 0, frame_out = 0, flipuv = 0, noblit = 0;
int do_md5 = 0, progress = 0;
int stop_after = 0, postproc = 0, summary = 0, quiet = 1;
int arg_skip = 0;
int ec_enabled = 0;
const VpxInterface *interface = NULL;
const VpxInterface *fourcc_interface = NULL;
uint64_t dx_time = 0;
struct arg arg;
char **argv, **argi, **argj;
int single_file;
int use_y4m = 1;
vpx_codec_dec_cfg_t cfg = {0};
#if CONFIG_VP8_DECODER
vp8_postproc_cfg_t vp8_pp_cfg = {0};
int vp8_dbg_color_ref_frame = 0;
int vp8_dbg_color_mb_modes = 0;
int vp8_dbg_color_b_modes = 0;
int vp8_dbg_display_mv = 0;
#endif
int frames_corrupted = 0;
int dec_flags = 0;
int do_scale = 0;
vpx_image_t *scaled_img = NULL;
int frame_avail, got_data;
int num_external_frame_buffers = 0;
struct ExternalFrameBufferList ext_fb_list = {0};
const char *outfile_pattern = NULL;
char outfile_name[PATH_MAX] = {0};
FILE *outfile = NULL;
MD5Context md5_ctx;
unsigned char md5_digest[16];
struct VpxDecInputContext input = {0};
struct VpxInputContext vpx_input_ctx = {0};
struct WebmInputContext webm_ctx = {0};
input.vpx_input_ctx = &vpx_input_ctx;
input.webm_ctx = &webm_ctx;
/* Parse command line */
exec_name = argv_[0];
argv = argv_dup(argc - 1, argv_ + 1);
for (argi = argj = argv; (*argj = *argi); argi += arg.argv_step) {
memset(&arg, 0, sizeof(arg));
arg.argv_step = 1;
if (arg_match(&arg, &codecarg, argi)) {
interface = get_vpx_decoder_by_name(arg.val);
if (!interface)
die("Error: Unrecognized argument (%s) to --codec\n", arg.val);
} else if (arg_match(&arg, &looparg, argi)) {
// no-op
} else if (arg_match(&arg, &outputfile, argi))
outfile_pattern = arg.val;
else if (arg_match(&arg, &use_yv12, argi)) {
use_y4m = 0;
flipuv = 1;
} else if (arg_match(&arg, &use_i420, argi)) {
use_y4m = 0;
flipuv = 0;
} else if (arg_match(&arg, &flipuvarg, argi))
flipuv = 1;
else if (arg_match(&arg, &noblitarg, argi))
noblit = 1;
else if (arg_match(&arg, &progressarg, argi))
progress = 1;
else if (arg_match(&arg, &limitarg, argi))
stop_after = arg_parse_uint(&arg);
else if (arg_match(&arg, &skiparg, argi))
arg_skip = arg_parse_uint(&arg);
else if (arg_match(&arg, &postprocarg, argi))
postproc = 1;
else if (arg_match(&arg, &md5arg, argi))
do_md5 = 1;
else if (arg_match(&arg, &summaryarg, argi))
summary = 1;
else if (arg_match(&arg, &threadsarg, argi))
cfg.threads = arg_parse_uint(&arg);
else if (arg_match(&arg, &verbosearg, argi))
quiet = 0;
else if (arg_match(&arg, &scalearg, argi))
do_scale = 1;
else if (arg_match(&arg, &fb_arg, argi))
num_external_frame_buffers = arg_parse_uint(&arg);
#if CONFIG_VP8_DECODER
else if (arg_match(&arg, &addnoise_level, argi)) {
postproc = 1;
vp8_pp_cfg.post_proc_flag |= VP8_ADDNOISE;
vp8_pp_cfg.noise_level = arg_parse_uint(&arg);
} else if (arg_match(&arg, &demacroblock_level, argi)) {
postproc = 1;
vp8_pp_cfg.post_proc_flag |= VP8_DEMACROBLOCK;
vp8_pp_cfg.deblocking_level = arg_parse_uint(&arg);
} else if (arg_match(&arg, &deblock, argi)) {
postproc = 1;
vp8_pp_cfg.post_proc_flag |= VP8_DEBLOCK;
} else if (arg_match(&arg, &mfqe, argi)) {
postproc = 1;
vp8_pp_cfg.post_proc_flag |= VP8_MFQE;
} else if (arg_match(&arg, &pp_debug_info, argi)) {
unsigned int level = arg_parse_uint(&arg);
postproc = 1;
vp8_pp_cfg.post_proc_flag &= ~0x7;
if (level)
vp8_pp_cfg.post_proc_flag |= level;
} else if (arg_match(&arg, &pp_disp_ref_frame, argi)) {
unsigned int flags = arg_parse_int(&arg);
if (flags) {
postproc = 1;
vp8_dbg_color_ref_frame = flags;
}
} else if (arg_match(&arg, &pp_disp_mb_modes, argi)) {
unsigned int flags = arg_parse_int(&arg);
if (flags) {
postproc = 1;
vp8_dbg_color_mb_modes = flags;
}
} else if (arg_match(&arg, &pp_disp_b_modes, argi)) {
unsigned int flags = arg_parse_int(&arg);
if (flags) {
postproc = 1;
vp8_dbg_color_b_modes = flags;
}
} else if (arg_match(&arg, &pp_disp_mvs, argi)) {
unsigned int flags = arg_parse_int(&arg);
if (flags) {
postproc = 1;
vp8_dbg_display_mv = flags;
}
} else if (arg_match(&arg, &error_concealment, argi)) {
ec_enabled = 1;
}
#endif
else
argj++;
}
/* Check for unrecognized options */
for (argi = argv; *argi; argi++)
if (argi[0][0] == '-' && strlen(argi[0]) > 1)
die("Error: Unrecognized option %s\n", *argi);
/* Handle non-option arguments */
fn = argv[0];
if (!fn)
usage_exit();
/* Open file */
infile = strcmp(fn, "-") ? fopen(fn, "rb") : set_binary_mode(stdin);
if (!infile) {
fprintf(stderr, "Failed to open file '%s'", strcmp(fn, "-") ? fn : "stdin");
return EXIT_FAILURE;
}
#if CONFIG_OS_SUPPORT
/* Make sure we don't dump to the terminal, unless forced to with -o - */
if (!outfile_pattern && isatty(fileno(stdout)) && !do_md5 && !noblit) {
fprintf(stderr,
"Not dumping raw video to your terminal. Use '-o -' to "
"override.\n");
return EXIT_FAILURE;
}
#endif
input.vpx_input_ctx->file = infile;
if (file_is_ivf(input.vpx_input_ctx))
input.vpx_input_ctx->file_type = FILE_TYPE_IVF;
#if CONFIG_WEBM_IO
else if (file_is_webm(input.webm_ctx, input.vpx_input_ctx))
input.vpx_input_ctx->file_type = FILE_TYPE_WEBM;
#endif
else if (file_is_raw(input.vpx_input_ctx))
input.vpx_input_ctx->file_type = FILE_TYPE_RAW;
else {
fprintf(stderr, "Unrecognized input file type.\n");
#if !CONFIG_WEBM_IO
fprintf(stderr, "vpxdec was built without WebM container support.\n");
#endif
return EXIT_FAILURE;
}
outfile_pattern = outfile_pattern ? outfile_pattern : "-";
single_file = is_single_file(outfile_pattern);
if (!noblit && single_file) {
generate_filename(outfile_pattern, outfile_name, PATH_MAX,
vpx_input_ctx.width, vpx_input_ctx.height, 0);
if (do_md5)
MD5Init(&md5_ctx);
else
outfile = open_outfile(outfile_name);
}
if (use_y4m && !noblit) {
if (!single_file) {
fprintf(stderr, "YUV4MPEG2 not supported with output patterns,"
" try --i420 or --yv12.\n");
return EXIT_FAILURE;
}
#if CONFIG_WEBM_IO
if (vpx_input_ctx.file_type == FILE_TYPE_WEBM) {
if (webm_guess_framerate(input.webm_ctx, input.vpx_input_ctx)) {
fprintf(stderr, "Failed to guess framerate -- error parsing "
"webm file?\n");
return EXIT_FAILURE;
}
}
#endif
}
fourcc_interface = get_vpx_decoder_by_fourcc(vpx_input_ctx.fourcc);
if (interface && fourcc_interface && interface != fourcc_interface)
warn("Header indicates codec: %s\n", fourcc_interface->name);
else
interface = fourcc_interface;
if (!interface)
interface = get_vpx_decoder_by_index(0);
dec_flags = (postproc ? VPX_CODEC_USE_POSTPROC : 0) |
(ec_enabled ? VPX_CODEC_USE_ERROR_CONCEALMENT : 0);
if (vpx_codec_dec_init(&decoder, interface->interface(), &cfg, dec_flags)) {
fprintf(stderr, "Failed to initialize decoder: %s\n",
vpx_codec_error(&decoder));
return EXIT_FAILURE;
}
if (!quiet)
fprintf(stderr, "%s\n", decoder.name);
#if CONFIG_VP8_DECODER
if (vp8_pp_cfg.post_proc_flag
&& vpx_codec_control(&decoder, VP8_SET_POSTPROC, &vp8_pp_cfg)) {
fprintf(stderr, "Failed to configure postproc: %s\n", vpx_codec_error(&decoder));
return EXIT_FAILURE;
}
if (vp8_dbg_color_ref_frame
&& vpx_codec_control(&decoder, VP8_SET_DBG_COLOR_REF_FRAME, vp8_dbg_color_ref_frame)) {
fprintf(stderr, "Failed to configure reference block visualizer: %s\n", vpx_codec_error(&decoder));
return EXIT_FAILURE;
}
if (vp8_dbg_color_mb_modes
&& vpx_codec_control(&decoder, VP8_SET_DBG_COLOR_MB_MODES, vp8_dbg_color_mb_modes)) {
fprintf(stderr, "Failed to configure macro block visualizer: %s\n", vpx_codec_error(&decoder));
return EXIT_FAILURE;
}
if (vp8_dbg_color_b_modes
&& vpx_codec_control(&decoder, VP8_SET_DBG_COLOR_B_MODES, vp8_dbg_color_b_modes)) {
fprintf(stderr, "Failed to configure block visualizer: %s\n", vpx_codec_error(&decoder));
return EXIT_FAILURE;
}
if (vp8_dbg_display_mv
&& vpx_codec_control(&decoder, VP8_SET_DBG_DISPLAY_MV, vp8_dbg_display_mv)) {
fprintf(stderr, "Failed to configure motion vector visualizer: %s\n", vpx_codec_error(&decoder));
return EXIT_FAILURE;
}
#endif
if (arg_skip)
fprintf(stderr, "Skipping first %d frames.\n", arg_skip);
while (arg_skip) {
if (read_frame(&input, &buf, &bytes_in_buffer, &buffer_size))
break;
arg_skip--;
}
if (num_external_frame_buffers > 0) {
ext_fb_list.num_external_frame_buffers = num_external_frame_buffers;
ext_fb_list.ext_fb = (struct ExternalFrameBuffer *)calloc(
num_external_frame_buffers, sizeof(*ext_fb_list.ext_fb));
if (vpx_codec_set_frame_buffer_functions(
&decoder, get_vp9_frame_buffer, release_vp9_frame_buffer,
&ext_fb_list)) {
fprintf(stderr, "Failed to configure external frame buffers: %s\n",
vpx_codec_error(&decoder));
return EXIT_FAILURE;
}
}
frame_avail = 1;
got_data = 0;
/* Decode file */
while (frame_avail || got_data) {
vpx_codec_iter_t iter = NULL;
vpx_image_t *img;
struct vpx_usec_timer timer;
int corrupted;
frame_avail = 0;
if (!stop_after || frame_in < stop_after) {
if (!read_frame(&input, &buf, &bytes_in_buffer, &buffer_size)) {
frame_avail = 1;
frame_in++;
vpx_usec_timer_start(&timer);
if (vpx_codec_decode(&decoder, buf, (unsigned int)bytes_in_buffer,
NULL, 0)) {
const char *detail = vpx_codec_error_detail(&decoder);
warn("Failed to decode frame %d: %s",
frame_in, vpx_codec_error(&decoder));
if (detail)
warn("Additional information: %s", detail);
goto fail;
}
vpx_usec_timer_mark(&timer);
dx_time += vpx_usec_timer_elapsed(&timer);
}
}
vpx_usec_timer_start(&timer);
got_data = 0;
if ((img = vpx_codec_get_frame(&decoder, &iter))) {
++frame_out;
got_data = 1;
}
vpx_usec_timer_mark(&timer);
dx_time += (unsigned int)vpx_usec_timer_elapsed(&timer);
if (vpx_codec_control(&decoder, VP8D_GET_FRAME_CORRUPTED, &corrupted)) {
warn("Failed VP8_GET_FRAME_CORRUPTED: %s", vpx_codec_error(&decoder));
goto fail;
}
frames_corrupted += corrupted;
if (progress)
show_progress(frame_in, frame_out, dx_time);
if (!noblit && img) {
const int PLANES_YUV[] = {VPX_PLANE_Y, VPX_PLANE_U, VPX_PLANE_V};
const int PLANES_YVU[] = {VPX_PLANE_Y, VPX_PLANE_V, VPX_PLANE_U};
const int *planes = flipuv ? PLANES_YVU : PLANES_YUV;
if (do_scale) {
if (frame_out == 1) {
// If the output frames are to be scaled to a fixed display size then
// use the width and height specified in the container. If either of
// these is set to 0, use the display size set in the first frame
// header. If that is unavailable, use the raw decoded size of the
// first decoded frame.
int display_width = vpx_input_ctx.width;
int display_height = vpx_input_ctx.height;
if (!display_width || !display_height) {
int display_size[2];
if (vpx_codec_control(&decoder, VP9D_GET_DISPLAY_SIZE,
display_size)) {
// As last resort use size of first frame as display size.
display_width = img->d_w;
display_height = img->d_h;
} else {
display_width = display_size[0];
display_height = display_size[1];
}
}
scaled_img = vpx_img_alloc(NULL, VPX_IMG_FMT_I420, display_width,
display_height, 16);
}
if (img->d_w != scaled_img->d_w || img->d_h != scaled_img->d_h) {
vpx_image_scale(img, scaled_img, kFilterBox);
img = scaled_img;
}
}
if (single_file) {
if (use_y4m) {
char buf[Y4M_BUFFER_SIZE] = {0};
size_t len = 0;
if (frame_out == 1) {
// Y4M file header
len = y4m_write_file_header(buf, sizeof(buf),
vpx_input_ctx.width,
vpx_input_ctx.height,
&vpx_input_ctx.framerate, img->fmt);
if (do_md5) {
MD5Update(&md5_ctx, (md5byte *)buf, (unsigned int)len);
} else {
fputs(buf, outfile);
}
}
// Y4M frame header
len = y4m_write_frame_header(buf, sizeof(buf));
if (do_md5) {
MD5Update(&md5_ctx, (md5byte *)buf, (unsigned int)len);
} else {
fputs(buf, outfile);
}
}
if (do_md5) {
update_image_md5(img, planes, &md5_ctx);
} else {
write_image_file(img, planes, outfile);
}
} else {
generate_filename(outfile_pattern, outfile_name, PATH_MAX,
img->d_w, img->d_h, frame_in);
if (do_md5) {
MD5Init(&md5_ctx);
update_image_md5(img, planes, &md5_ctx);
MD5Final(md5_digest, &md5_ctx);
print_md5(md5_digest, outfile_name);
} else {
outfile = open_outfile(outfile_name);
write_image_file(img, planes, outfile);
fclose(outfile);
}
}
}
if (stop_after && frame_in >= stop_after)
break;
}
if (summary || progress) {
show_progress(frame_in, frame_out, dx_time);
fprintf(stderr, "\n");
}
if (frames_corrupted)
fprintf(stderr, "WARNING: %d frames corrupted.\n", frames_corrupted);
fail:
if (vpx_codec_destroy(&decoder)) {
fprintf(stderr, "Failed to destroy decoder: %s\n",
vpx_codec_error(&decoder));
return EXIT_FAILURE;
}
if (!noblit && single_file) {
if (do_md5) {
MD5Final(md5_digest, &md5_ctx);
print_md5(md5_digest, outfile_name);
} else {
fclose(outfile);
}
}
#if CONFIG_WEBM_IO
if (input.vpx_input_ctx->file_type == FILE_TYPE_WEBM)
webm_free(input.webm_ctx);
#endif
if (input.vpx_input_ctx->file_type != FILE_TYPE_WEBM)
free(buf);
if (scaled_img) vpx_img_free(scaled_img);
for (i = 0; i < ext_fb_list.num_external_frame_buffers; ++i) {
free(ext_fb_list.ext_fb[i].data);
}
free(ext_fb_list.ext_fb);
fclose(infile);
free(argv);
return frames_corrupted ? EXIT_FAILURE : EXIT_SUCCESS;
}
bool cfg_auth_login(struct cfg_state *cmd, char *args)
{
unsigned char secret[20] = "TheTalamasca", c, challenge[16];
unsigned int i,r;
struct MD5Context md5;
int fields = countfields(args);
/* Require a username */
if (fields != 1 ||
!copyfield(args, 1, cmd->user, sizeof(cmd->user)))
{
sock_printf(cmd->sock, "400 The command is: login <username>\n");
return false;
}
/*
* Check that the username is in lower case
* and contains only ascii
*/
for (i=0; i < strlen(cmd->user); i++)
{
if ( cmd->user[i] < 'a' ||
cmd->user[i] > 'z')
{
sock_printf(cmd->sock, "400 Username contains unacceptable characters\n");
return false;
}
}
/* Clear out the secret */
memset(secret, 0, sizeof(secret));
/* Randomize the string */
for (i=0; i < (sizeof(secret)-1); i++)
{
/* Pick random number between 1 and 62 */
r = (random() % 63) + 1;
/* [ 1,10] => [0,9] */
if (r < 11) c = (r+48-1);
/* [11,36] => [A,Z] */
else if (r < 37) c = (r+65-10);
/* [37,62] => [a,z] */
else c = (r+97-36);
/* Randomize */
secret[i] = c;
}
/* Generate a MD5 */
MD5Init(&md5);
MD5Update(&md5, (const unsigned char *)&secret, (unsigned int)strlen((const char *)&secret));
MD5Final(challenge, &md5);
memset(&cmd->challenge, 0, sizeof(cmd->challenge));
/* Generate the Digest */
for (i = 0; i < sizeof(challenge); i++)
{
snprintf(&cmd->challenge[i*2], 3, "%02x", challenge[i]);
}
/* Return the challenge to the client */
sock_printf(cmd->sock, "200 %s\n", cmd->challenge);
/* Upgrade the level */
cmd->level = LEVEL_LOGIN;
return true;
}
static void eap_sm_parseEapReq(struct eap_sm *sm, u8 *req, size_t len)
{
struct eap_hdr *hdr;
size_t plen;
MD5_CTX context;
sm->rxReq = sm->rxSuccess = sm->rxFailure = FALSE;
sm->reqId = 0;
sm->reqMethod = EAP_TYPE_NONE;
if (req == NULL || len < sizeof(*hdr))
return;
hdr = (struct eap_hdr *) req;
plen = be_to_host16(hdr->length);
if (plen > len) {
wpa_printf(MSG_DEBUG, "EAP: Ignored truncated EAP-Packet "
"(len=%lu plen=%lu)",
(unsigned long) len, (unsigned long) plen);
return;
}
sm->reqId = hdr->identifier;
if (sm->workaround) {
MD5Init(&context);
MD5Update(&context, req, len);
MD5Final(sm->req_md5, &context);
}
switch (hdr->code) {
case EAP_CODE_REQUEST:
sm->rxReq = TRUE;
if (plen > sizeof(*hdr))
sm->reqMethod = *((u8 *) (hdr + 1));
wpa_printf(MSG_DEBUG, "EAP: Received EAP-Request method=%d "
"id=%d", sm->reqMethod, sm->reqId);
break;
case EAP_CODE_RESPONSE:
if (sm->selectedMethod == EAP_TYPE_LEAP) {
sm->rxResp = TRUE;
if (plen > sizeof(*hdr))
sm->reqMethod = *((u8 *) (hdr + 1));
wpa_printf(MSG_DEBUG, "EAP: Received EAP-Response for "
"LEAP method=%d id=%d",
sm->reqMethod, sm->reqId);
break;
}
wpa_printf(MSG_DEBUG, "EAP: Ignored EAP-Response");
break;
case EAP_CODE_SUCCESS:
wpa_printf(MSG_DEBUG, "EAP: Received EAP-Success");
sm->rxSuccess = TRUE;
break;
case EAP_CODE_FAILURE:
wpa_printf(MSG_DEBUG, "EAP: Received EAP-Failure");
sm->rxFailure = TRUE;
break;
default:
wpa_printf(MSG_DEBUG, "EAP: Ignored EAP-Packet with unknown "
"code %d", hdr->code);
break;
}
}
/*******************************************************************
open the profiling shared memory area
******************************************************************/
bool profile_setup(struct messaging_context *msg_ctx, bool rdonly)
{
unsigned char tmp[16] = {};
MD5_CTX md5;
char *db_name;
if (smbprofile_state.internal.db != NULL) {
return true;
}
db_name = cache_path("smbprofile.tdb");
if (db_name == NULL) {
return false;
}
smbprofile_state.internal.db = tdb_wrap_open(
NULL, db_name, 0,
rdonly ? 0 : TDB_CLEAR_IF_FIRST|TDB_MUTEX_LOCKING,
O_CREAT | (rdonly ? O_RDONLY : O_RDWR), 0644);
if (smbprofile_state.internal.db == NULL) {
return false;
}
if (msg_ctx != NULL) {
messaging_register(msg_ctx, NULL, MSG_PROFILE,
profile_message);
messaging_register(msg_ctx, NULL, MSG_REQ_PROFILELEVEL,
reqprofile_message);
}
MD5Init(&md5);
MD5Update(&md5,
(const uint8_t *)&smbprofile_state.stats.global,
sizeof(smbprofile_state.stats.global));
#define __UPDATE(str) do { \
MD5Update(&md5, (const uint8_t *)str, strlen(str)); \
} while(0)
#define SMBPROFILE_STATS_START
#define SMBPROFILE_STATS_SECTION_START(name, display) do { \
__UPDATE(#name "+" #display); \
} while(0);
#define SMBPROFILE_STATS_COUNT(name) do { \
__UPDATE(#name "+count"); \
} while(0);
#define SMBPROFILE_STATS_TIME(name) do { \
__UPDATE(#name "+time"); \
} while(0);
#define SMBPROFILE_STATS_BASIC(name) do { \
__UPDATE(#name "+count"); \
__UPDATE(#name "+time"); \
} while(0);
#define SMBPROFILE_STATS_BYTES(name) do { \
__UPDATE(#name "+count"); \
__UPDATE(#name "+time"); \
__UPDATE(#name "+idle"); \
__UPDATE(#name "+bytes"); \
} while(0);
#define SMBPROFILE_STATS_IOBYTES(name) do { \
__UPDATE(#name "+count"); \
__UPDATE(#name "+time"); \
__UPDATE(#name "+idle"); \
__UPDATE(#name "+inbytes"); \
__UPDATE(#name "+outbytes"); \
} while(0);
#define SMBPROFILE_STATS_SECTION_END
#define SMBPROFILE_STATS_END
SMBPROFILE_STATS_ALL_SECTIONS
#undef __UPDATE
#undef SMBPROFILE_STATS_START
#undef SMBPROFILE_STATS_SECTION_START
#undef SMBPROFILE_STATS_COUNT
#undef SMBPROFILE_STATS_TIME
#undef SMBPROFILE_STATS_BASIC
#undef SMBPROFILE_STATS_BYTES
#undef SMBPROFILE_STATS_IOBYTES
#undef SMBPROFILE_STATS_SECTION_END
#undef SMBPROFILE_STATS_END
MD5Final(tmp, &md5);
profile_p = &smbprofile_state.stats.global;
profile_p->magic = BVAL(tmp, 0);
if (profile_p->magic == 0) {
profile_p->magic = BVAL(tmp, 8);
}
return True;
}
/***********************************************************************
update hmac_md5 "inner" buffer
***********************************************************************/
_PUBLIC_ void hmac_md5_update(const uint8_t *text, int text_len, HMACMD5Context *ctx)
{
MD5Update(&ctx->ctx, text, text_len); /* then text of datagram */
}
struct crypto_hash * crypto_hash_init(enum crypto_hash_alg alg, const u8 *key,
size_t key_len)
{
struct crypto_hash *ctx;
u8 k_pad[64];
u8 tk[20];
size_t i;
ctx = os_zalloc(sizeof(*ctx));
if (ctx == NULL)
return NULL;
ctx->alg = alg;
switch (alg) {
case CRYPTO_HASH_ALG_MD5:
MD5Init(&ctx->u.md5);
break;
case CRYPTO_HASH_ALG_SHA1:
SHA1Init(&ctx->u.sha1);
break;
case CRYPTO_HASH_ALG_HMAC_MD5:
if (key_len > sizeof(k_pad)) {
MD5Init(&ctx->u.md5);
MD5Update(&ctx->u.md5, key, key_len);
MD5Final(tk, &ctx->u.md5);
key = tk;
key_len = 16;
}
os_memcpy(ctx->key, key, key_len);
ctx->key_len = key_len;
os_memcpy(k_pad, key, key_len);
os_memset(k_pad + key_len, 0, sizeof(k_pad) - key_len);
for (i = 0; i < sizeof(k_pad); i++)
k_pad[i] ^= 0x36;
MD5Init(&ctx->u.md5);
MD5Update(&ctx->u.md5, k_pad, sizeof(k_pad));
break;
case CRYPTO_HASH_ALG_HMAC_SHA1:
if (key_len > sizeof(k_pad)) {
SHA1Init(&ctx->u.sha1);
SHA1Update(&ctx->u.sha1, key, key_len);
SHA1Final(tk, &ctx->u.sha1);
key = tk;
key_len = 20;
}
os_memcpy(ctx->key, key, key_len);
ctx->key_len = key_len;
os_memcpy(k_pad, key, key_len);
os_memset(k_pad + key_len, 0, sizeof(k_pad) - key_len);
for (i = 0; i < sizeof(k_pad); i++)
k_pad[i] ^= 0x36;
SHA1Init(&ctx->u.sha1);
SHA1Update(&ctx->u.sha1, k_pad, sizeof(k_pad));
break;
default:
os_free(ctx);
return NULL;
}
return ctx;
}
int Radius_msg_verify(struct radius_msg *msg, u8 *secret, size_t secret_len, struct radius_msg *sent_msg)
{
u8 auth[MD5_MAC_LEN], orig[MD5_MAC_LEN];
u8 orig_authenticator[16];
struct radius_attr_hdr *attr = NULL;
int i;
MD5_CTX context;
u8 hash[MD5_MAC_LEN];
if (sent_msg == NULL)
{
DBGPRINT(RT_DEBUG_ERROR,"No matching Access-Request message found\n");
return 1;
}
for (i = 0; i < msg->attr_used; i++)
{
if (msg->attrs[i]->type == RADIUS_ATTR_MESSAGE_AUTHENTICATOR)
{
if (attr != 0)
{
DBGPRINT(RT_DEBUG_ERROR,"Multiple Message-Authenticator attributes in RADIUS message\n");
return 1;
}
attr = msg->attrs[i];
}
}
if (attr == NULL)
{
DBGPRINT(RT_DEBUG_ERROR,"No Message-Authenticator attribute found\n");
return 1;
}
memcpy(orig, attr + 1, MD5_MAC_LEN);
memset(attr + 1, 0, MD5_MAC_LEN);
memcpy(orig_authenticator, msg->hdr->authenticator, sizeof(orig_authenticator));
memcpy(msg->hdr->authenticator, sent_msg->hdr->authenticator, sizeof(msg->hdr->authenticator));
hmac_md5(secret, secret_len, msg->buf, msg->buf_used, auth);
memcpy(attr + 1, orig, MD5_MAC_LEN);
memcpy(msg->hdr->authenticator, orig_authenticator, sizeof(orig_authenticator));
if (memcmp(orig, auth, MD5_MAC_LEN) != 0)
{
DBGPRINT(RT_DEBUG_ERROR,"Invalid Message-Authenticator!\n");
return 1;
}
/* ResponseAuth = MD5(Code+ID+Length+RequestAuth+Attributes+Secret) */
MD5Init(&context);
MD5Update(&context, (u8 *) msg->hdr, 1 + 1 + 2);
MD5Update(&context, sent_msg->hdr->authenticator, MD5_MAC_LEN);
MD5Update(&context, (u8 *) (msg->hdr + 1), msg->buf_used - sizeof(*msg->hdr));
MD5Update(&context, secret, secret_len);
MD5Final(hash, &context);
if (memcmp(hash, msg->hdr->authenticator, MD5_MAC_LEN) != 0)
{
DBGPRINT(RT_DEBUG_ERROR,"Response Authenticator invalid!\n");
return 1;
}
return 0;
}
static void ssh_protocol(unsigned char *in, int inlen, int ispkt) {
int i, j, len;
unsigned char session_id[16];
unsigned char *rsabuf, *keystr1, *keystr2;
unsigned char cookie[8];
struct RSAKey servkey, hostkey;
struct MD5Context md5c;
unsigned long supported_ciphers_mask;
int cipher_type;
extern struct ssh_cipher ssh_3des;
extern struct ssh_cipher ssh_blowfish;
crBegin;
random_init();
while (!ispkt)
crReturnV;
if (pktin.type != 2)
fatalbox("Public key packet not received");
memcpy(cookie, pktin.body, 8);
MD5Init(&md5c);
i = makekey(pktin.body+8, &servkey, &keystr1);
j = makekey(pktin.body+8+i, &hostkey, &keystr2);
supported_ciphers_mask = (pktin.body[12+i+j] << 24) |
(pktin.body[13+i+j] << 16) |
(pktin.body[14+i+j] << 8) |
(pktin.body[15+i+j]);
MD5Update(&md5c, keystr2, hostkey.bytes);
MD5Update(&md5c, keystr1, servkey.bytes);
MD5Update(&md5c, pktin.body, 8);
MD5Final(session_id, &md5c);
for (i=0; i<32; i++)
session_key[i] = random_byte();
len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
rsabuf = malloc(len);
if (!rsabuf)
fatalbox("Out of memory");
verify_ssh_host_key(savedhost, &hostkey);
for (i=0; i<32; i++) {
rsabuf[i] = session_key[i];
if (i < 16)
rsabuf[i] ^= session_id[i];
}
if (hostkey.bytes > servkey.bytes) {
rsaencrypt(rsabuf, 32, &servkey);
rsaencrypt(rsabuf, servkey.bytes, &hostkey);
} else {
rsaencrypt(rsabuf, 32, &hostkey);
rsaencrypt(rsabuf, hostkey.bytes, &servkey);
}
cipher_type = cfg.cipher == CIPHER_BLOWFISH ? SSH_CIPHER_BLOWFISH :
SSH_CIPHER_3DES;
if ((supported_ciphers_mask & (1 << cipher_type)) == 0) {
c_write("Selected cipher not supported, falling back to 3DES\r\n", 53);
cipher_type = SSH_CIPHER_3DES;
}
s_wrpkt_start(3, len+15);
pktout.body[0] = cipher_type;
memcpy(pktout.body+1, cookie, 8);
pktout.body[9] = (len*8) >> 8;
pktout.body[10] = (len*8) & 0xFF;
memcpy(pktout.body+11, rsabuf, len);
pktout.body[len+11] = pktout.body[len+12] = 0; /* protocol flags */
pktout.body[len+13] = pktout.body[len+14] = 0;
s_wrpkt();
free(rsabuf);
cipher = cipher_type == SSH_CIPHER_BLOWFISH ? &ssh_blowfish :
&ssh_3des;
cipher->sesskey(session_key);
do { crReturnV; } while (!ispkt);
if (pktin.type != 14)
fatalbox("Encryption not successfully enabled");
fflush(stdout);
{
static char username[100];
static int pos = 0;
static char c;
if (!*cfg.username) {
c_write("login as: ", 10);
while (pos >= 0) {
do { crReturnV; } while (ispkt);
while (inlen--) switch (c = *in++) {
case 10: case 13:
username[pos] = 0;
pos = -1;
break;
case 8: case 127:
if (pos > 0) {
c_write("\b \b", 3);
pos--;
}
break;
case 21: case 27:
while (pos > 0) {
c_write("\b \b", 3);
pos--;
}
break;
case 3: case 4:
random_save_seed();
exit(0);
break;
default:
if (c >= ' ' && c <= '~' && pos < 40) {
username[pos++] = c;
c_write(&c, 1);
}
break;
}
}
c_write("\r\n", 2);
username[strcspn(username, "\n\r")] = '\0';
} else {
char stuff[200];
strncpy(username, cfg.username, 99);
username[99] = '\0';
sprintf(stuff, "Sent username \"%s\".\r\n", username);
c_write(stuff, strlen(stuff));
}
s_wrpkt_start(4, 4+strlen(username));
pktout.body[0] = pktout.body[1] = pktout.body[2] = 0;
pktout.body[3] = strlen(username);
memcpy(pktout.body+4, username, strlen(username));
s_wrpkt();
}
do { crReturnV; } while (!ispkt);
while (pktin.type == 15) {
static char password[100];
static int pos;
static char c;
c_write("password: "******"\r\n", 2);
s_wrpkt_start(9, 4+strlen(password));
pktout.body[0] = pktout.body[1] = pktout.body[2] = 0;
pktout.body[3] = strlen(password);
memcpy(pktout.body+4, password, strlen(password));
s_wrpkt();
memset(password, 0, strlen(password));
do { crReturnV; } while (!ispkt);
if (pktin.type == 15) {
c_write("Access denied\r\n", 15);
} else if (pktin.type != 14) {
fatalbox("Strange packet received, type %d", pktin.type);
}
}
if (!cfg.nopty) {
i = strlen(cfg.termtype);
s_wrpkt_start(10, i+5*4+1);
pktout.body[0] = (i >> 24) & 0xFF;
pktout.body[1] = (i >> 16) & 0xFF;
pktout.body[2] = (i >> 8) & 0xFF;
pktout.body[3] = i & 0xFF;
memcpy(pktout.body+4, cfg.termtype, i);
i += 4;
pktout.body[i++] = (rows >> 24) & 0xFF;
pktout.body[i++] = (rows >> 16) & 0xFF;
pktout.body[i++] = (rows >> 8) & 0xFF;
pktout.body[i++] = rows & 0xFF;
pktout.body[i++] = (cols >> 24) & 0xFF;
pktout.body[i++] = (cols >> 16) & 0xFF;
pktout.body[i++] = (cols >> 8) & 0xFF;
pktout.body[i++] = cols & 0xFF;
memset(pktout.body+i, 0, 9); /* 0 pixwidth, 0 pixheight, 0.b endofopt */
s_wrpkt();
ssh_state = SSH_STATE_INTERMED;
do { crReturnV; } while (!ispkt);
if (pktin.type != 14 && pktin.type != 15) {
fatalbox("Protocol confusion");
} else if (pktin.type == 15) {
c_write("Server refused to allocate pty\r\n", 32);
}
}
static u8 * decrypt_ms_key(u8 *key, size_t len, struct radius_msg *sent_msg,
u8 *secret, size_t secret_len, size_t *reslen)
{
u8 *pos, *plain, *ppos, *res;
size_t left, plen;
u8 hash[MD5_MAC_LEN];
MD5_CTX context;
int i, first = 1;
/* key: 16-bit salt followed by encrypted key info */
if (len < 2 + 16)
return NULL;
pos = key + 2;
left = len - 2;
if (left % 16)
{
DBGPRINT(RT_DEBUG_ERROR,"Invalid ms key len\n");
return NULL;
}
plen = left;
ppos = plain = malloc(plen);
if (plain == NULL)
return NULL;
while (left > 0)
{
/* b(1) = MD5(Secret + Request-Authenticator + Salt)
* b(i) = MD5(Secret + c(i - 1)) for i > 1 */
MD5Init(&context);
MD5Update(&context, secret, secret_len);
if (first)
{
MD5Update(&context, sent_msg->hdr->authenticator,
MD5_MAC_LEN);
MD5Update(&context, key, 2); /* Salt */
first = 0;
} else
MD5Update(&context, pos - MD5_MAC_LEN, MD5_MAC_LEN);
MD5Final(hash, &context);
for (i = 0; i < MD5_MAC_LEN; i++)
*ppos++ = *pos++ ^ hash[i];
left -= MD5_MAC_LEN;
}
if (plain[0] > plen - 1)
{
DBGPRINT(RT_DEBUG_ERROR,"Failed to decrypt MPPE key\n");
free(plain);
return NULL;
}
res = malloc(plain[0]);
if (res == NULL)
{
free(plain);
return NULL;
}
memcpy(res, plain + 1, plain[0]);
if (reslen)
*reslen = plain[0];
free(plain);
return res;
}
_PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_CTX *mem_ctx,
int *flags,
DATA_BLOB challenge,
const NTTIME *server_timestamp,
DATA_BLOB target_info,
DATA_BLOB *_lm_response, DATA_BLOB *_nt_response,
DATA_BLOB *_lm_session_key, DATA_BLOB *_session_key)
{
const char *user, *domain;
DATA_BLOB lm_response, nt_response;
DATA_BLOB lm_session_key, session_key;
const struct samr_Password *nt_hash;
lm_session_key = data_blob(NULL, 0);
/* We may already have an NTLM response we prepared earlier.
* This is used for NTLM pass-though authentication */
if (cred->nt_response.data || cred->lm_response.data) {
*_nt_response = cred->nt_response;
*_lm_response = cred->lm_response;
if (!cred->lm_response.data) {
*flags = *flags & ~CLI_CRED_LANMAN_AUTH;
}
*_lm_session_key = data_blob(NULL, 0);
*_session_key = data_blob(NULL, 0);
return NT_STATUS_OK;
}
nt_hash = cli_credentials_get_nt_hash(cred, mem_ctx);
cli_credentials_get_ntlm_username_domain(cred, mem_ctx, &user, &domain);
/* If we are sending a username@realm login (see function
* above), then we will not send LM, it will not be
* accepted */
if (cred->principal_obtained > cred->username_obtained) {
*flags = *flags & ~CLI_CRED_LANMAN_AUTH;
}
/* Likewise if we are a machine account (avoid protocol downgrade attacks) */
if (cred->machine_account) {
*flags = *flags & ~CLI_CRED_LANMAN_AUTH;
}
if (cred->use_kerberos == CRED_MUST_USE_KERBEROS) {
return NT_STATUS_ACCESS_DENIED;
}
if (!nt_hash) {
static const uint8_t zeros[16];
/* do nothing - blobs are zero length */
/* session key is all zeros */
session_key = data_blob_talloc(mem_ctx, zeros, 16);
lm_session_key = data_blob_talloc(mem_ctx, zeros, 16);
lm_response = data_blob(NULL, 0);
nt_response = data_blob(NULL, 0);
/* not doing NTLM2 without a password */
*flags &= ~CLI_CRED_NTLM2;
} else if (*flags & CLI_CRED_NTLMv2_AUTH) {
if (!target_info.length) {
/* be lazy, match win2k - we can't do NTLMv2 without it */
DEBUG(1, ("Server did not provide 'target information', required for NTLMv2\n"));
return NT_STATUS_INVALID_PARAMETER;
}
/* TODO: if the remote server is standalone, then we should replace 'domain'
with the server name as supplied above */
if (!SMBNTLMv2encrypt_hash(mem_ctx,
user,
domain,
nt_hash->hash, &challenge,
server_timestamp, &target_info,
&lm_response, &nt_response,
NULL, &session_key)) {
return NT_STATUS_NO_MEMORY;
}
/* LM Key is incompatible... */
*flags &= ~CLI_CRED_LANMAN_AUTH;
if (lm_response.length != 0) {
/*
* We should not expose the lm key.
*/
memset(lm_response.data, 0, lm_response.length);
}
} else if (*flags & CLI_CRED_NTLM2) {
MD5_CTX md5_session_nonce_ctx;
uint8_t session_nonce[16];
uint8_t session_nonce_hash[16];
uint8_t user_session_key[16];
lm_response = data_blob_talloc(mem_ctx, NULL, 24);
generate_random_buffer(lm_response.data, 8);
memset(lm_response.data+8, 0, 16);
memcpy(session_nonce, challenge.data, 8);
memcpy(&session_nonce[8], lm_response.data, 8);
MD5Init(&md5_session_nonce_ctx);
MD5Update(&md5_session_nonce_ctx, challenge.data, 8);
MD5Update(&md5_session_nonce_ctx, lm_response.data, 8);
MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
DEBUG(5, ("NTLMSSP challenge set by NTLM2\n"));
DEBUG(5, ("challenge is: \n"));
dump_data(5, session_nonce_hash, 8);
nt_response = data_blob_talloc(mem_ctx, NULL, 24);
SMBOWFencrypt(nt_hash->hash,
session_nonce_hash,
nt_response.data);
session_key = data_blob_talloc(mem_ctx, NULL, 16);
SMBsesskeygen_ntv1(nt_hash->hash, user_session_key);
hmac_md5(user_session_key, session_nonce, sizeof(session_nonce), session_key.data);
dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
/* LM Key is incompatible... */
*flags &= ~CLI_CRED_LANMAN_AUTH;
} else {
uint8_t lm_hash[16];
nt_response = data_blob_talloc(mem_ctx, NULL, 24);
SMBOWFencrypt(nt_hash->hash, challenge.data,
nt_response.data);
session_key = data_blob_talloc(mem_ctx, NULL, 16);
SMBsesskeygen_ntv1(nt_hash->hash, session_key.data);
dump_data_pw("NT session key:\n", session_key.data, session_key.length);
/* lanman auth is insecure, it may be disabled.
We may also not have a password */
if (*flags & CLI_CRED_LANMAN_AUTH) {
const char *password;
password = cli_credentials_get_password(cred);
if (!password) {
lm_response = nt_response;
} else {
lm_response = data_blob_talloc(mem_ctx, NULL, 24);
if (!SMBencrypt(password,challenge.data,
lm_response.data)) {
/* If the LM password was too long (and therefore the LM hash being
of the first 14 chars only), don't send it.
We don't have any better options but to send the NT response
*/
data_blob_free(&lm_response);
lm_response = nt_response;
/* LM Key is incompatible with 'long' passwords */
*flags &= ~CLI_CRED_LANMAN_AUTH;
} else if (E_deshash(password, lm_hash)) {
lm_session_key = data_blob_talloc(mem_ctx, NULL, 16);
memcpy(lm_session_key.data, lm_hash, 8);
memset(&lm_session_key.data[8], '\0', 8);
if (!(*flags & CLI_CRED_NTLM_AUTH)) {
session_key = lm_session_key;
}
}
}
} else {
const char *password;
/* LM Key is incompatible... */
lm_response = nt_response;
*flags &= ~CLI_CRED_LANMAN_AUTH;
password = cli_credentials_get_password(cred);
if (password && E_deshash(password, lm_hash)) {
lm_session_key = data_blob_talloc(mem_ctx, NULL, 16);
memcpy(lm_session_key.data, lm_hash, 8);
memset(&lm_session_key.data[8], '\0', 8);
}
}
}
if (_lm_response) {
*_lm_response = lm_response;
}
if (_nt_response) {
*_nt_response = nt_response;
}
if (_lm_session_key) {
*_lm_session_key = lm_session_key;
}
if (_session_key) {
*_session_key = session_key;
}
return NT_STATUS_OK;
}
/*
* tcp_time_wait_processing() handles processing of incoming packets when
* the tcp_t is in the TIME_WAIT state.
*
* A TIME_WAIT tcp_t that has an associated open TCP end point (not in
* detached state) is never put on the time wait list.
*/
void
tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp, uint32_t seg_seq,
uint32_t seg_ack, int seg_len, tcpha_t *tcpha, ip_recv_attr_t *ira)
{
int32_t bytes_acked;
int32_t gap;
int32_t rgap;
tcp_opt_t tcpopt;
uint_t flags;
uint32_t new_swnd = 0;
conn_t *nconnp;
conn_t *connp = tcp->tcp_connp;
tcp_stack_t *tcps = tcp->tcp_tcps;
BUMP_LOCAL(tcp->tcp_ibsegs);
DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
flags = (unsigned int)tcpha->tha_flags & 0xFF;
new_swnd = ntohs(tcpha->tha_win) <<
((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);
if (tcp->tcp_snd_ts_ok) {
if (!tcp_paws_check(tcp, tcpha, &tcpopt)) {
tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
tcp->tcp_rnxt, TH_ACK);
goto done;
}
}
gap = seg_seq - tcp->tcp_rnxt;
rgap = tcp->tcp_rwnd - (gap + seg_len);
if (gap < 0) {
TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes,
(seg_len > -gap ? -gap : seg_len));
seg_len += gap;
if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
if (flags & TH_RST) {
goto done;
}
if ((flags & TH_FIN) && seg_len == -1) {
/*
* When TCP receives a duplicate FIN in
* TIME_WAIT state, restart the 2 MSL timer.
* See page 73 in RFC 793. Make sure this TCP
* is already on the TIME_WAIT list. If not,
* just restart the timer.
*/
if (TCP_IS_DETACHED(tcp)) {
if (tcp_time_wait_remove(tcp, NULL) ==
B_TRUE) {
tcp_time_wait_append(tcp);
TCP_DBGSTAT(tcps,
tcp_rput_time_wait);
}
} else {
ASSERT(tcp != NULL);
TCP_TIMER_RESTART(tcp,
tcps->tcps_time_wait_interval);
}
tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
tcp->tcp_rnxt, TH_ACK);
goto done;
}
flags |= TH_ACK_NEEDED;
seg_len = 0;
goto process_ack;
}
/* Fix seg_seq, and chew the gap off the front. */
seg_seq = tcp->tcp_rnxt;
}
if ((flags & TH_SYN) && gap > 0 && rgap < 0) {
/*
* Make sure that when we accept the connection, pick
* an ISS greater than (tcp_snxt + ISS_INCR/2) for the
* old connection.
*
* The next ISS generated is equal to tcp_iss_incr_extra
* + ISS_INCR/2 + other components depending on the
* value of tcp_strong_iss. We pre-calculate the new
* ISS here and compare with tcp_snxt to determine if
* we need to make adjustment to tcp_iss_incr_extra.
*
* The above calculation is ugly and is a
* waste of CPU cycles...
*/
uint32_t new_iss = tcps->tcps_iss_incr_extra;
int32_t adj;
ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
switch (tcps->tcps_strong_iss) {
case 2: {
/* Add time and MD5 components. */
uint32_t answer[4];
struct {
uint32_t ports;
in6_addr_t src;
in6_addr_t dst;
} arg;
MD5_CTX context;
mutex_enter(&tcps->tcps_iss_key_lock);
context = tcps->tcps_iss_key;
mutex_exit(&tcps->tcps_iss_key_lock);
arg.ports = connp->conn_ports;
/* We use MAPPED addresses in tcp_iss_init */
arg.src = connp->conn_laddr_v6;
arg.dst = connp->conn_faddr_v6;
MD5Update(&context, (uchar_t *)&arg,
sizeof (arg));
MD5Final((uchar_t *)answer, &context);
answer[0] ^= answer[1] ^ answer[2] ^ answer[3];
new_iss += (gethrtime() >> ISS_NSEC_SHT) + answer[0];
break;
}
case 1:
/* Add time component and min random (i.e. 1). */
new_iss += (gethrtime() >> ISS_NSEC_SHT) + 1;
break;
default:
/* Add only time component. */
new_iss += (uint32_t)gethrestime_sec() * ISS_INCR;
break;
}
if ((adj = (int32_t)(tcp->tcp_snxt - new_iss)) > 0) {
/*
* New ISS not guaranteed to be ISS_INCR/2
* ahead of the current tcp_snxt, so add the
* difference to tcp_iss_incr_extra.
*/
tcps->tcps_iss_incr_extra += adj;
}
/*
* If tcp_clean_death() can not perform the task now,
* drop the SYN packet and let the other side re-xmit.
* Otherwise pass the SYN packet back in, since the
* old tcp state has been cleaned up or freed.
*/
if (tcp_clean_death(tcp, 0) == -1)
goto done;
nconnp = ipcl_classify(mp, ira, ipst);
if (nconnp != NULL) {
TCP_STAT(tcps, tcp_time_wait_syn_success);
/* Drops ref on nconnp */
tcp_reinput(nconnp, mp, ira, ipst);
return;
}
goto done;
}
static void md_md5_update(struct context *ctx, u_char * s, size_t len)
{
MD5Update(&ctx->checksum.md5context, s, len);
}
static int
pci_vtnet_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
{
MD5_CTX mdctx;
unsigned char digest[16];
char nstr[80];
char tname[MAXCOMLEN + 1];
struct pci_vtnet_softc *sc;
char *devname;
char *vtopts;
int mac_provided;
sc = calloc(1, sizeof(struct pci_vtnet_softc));
pthread_mutex_init(&sc->vsc_mtx, NULL);
vi_softc_linkup(&sc->vsc_vs, &vtnet_vi_consts, sc, pi, sc->vsc_queues);
sc->vsc_vs.vs_mtx = &sc->vsc_mtx;
sc->vsc_queues[VTNET_RXQ].vq_qsize = VTNET_RINGSZ;
sc->vsc_queues[VTNET_RXQ].vq_notify = pci_vtnet_ping_rxq;
sc->vsc_queues[VTNET_TXQ].vq_qsize = VTNET_RINGSZ;
sc->vsc_queues[VTNET_TXQ].vq_notify = pci_vtnet_ping_txq;
#ifdef notyet
sc->vsc_queues[VTNET_CTLQ].vq_qsize = VTNET_RINGSZ;
sc->vsc_queues[VTNET_CTLQ].vq_notify = pci_vtnet_ping_ctlq;
#endif
/*
* Attempt to open the tap device and read the MAC address
* if specified
*/
mac_provided = 0;
sc->vsc_tapfd = -1;
if (opts != NULL) {
char tbuf[80];
int err;
devname = vtopts = strdup(opts);
(void) strsep(&vtopts, ",");
if (vtopts != NULL) {
err = pci_vtnet_parsemac(vtopts, sc->vsc_config.mac);
if (err != 0) {
free(devname);
return (err);
}
mac_provided = 1;
}
strcpy(tbuf, "/dev/");
strlcat(tbuf, devname, sizeof(tbuf));
free(devname);
sc->vsc_tapfd = open(tbuf, O_RDWR);
if (sc->vsc_tapfd == -1) {
WPRINTF(("open of tap device %s failed\n", tbuf));
} else {
/*
* Set non-blocking and register for read
* notifications with the event loop
*/
int opt = 1;
if (ioctl(sc->vsc_tapfd, FIONBIO, &opt) < 0) {
WPRINTF(("tap device O_NONBLOCK failed\n"));
close(sc->vsc_tapfd);
sc->vsc_tapfd = -1;
}
sc->vsc_mevp = mevent_add(sc->vsc_tapfd,
EVF_READ,
pci_vtnet_tap_callback,
sc);
if (sc->vsc_mevp == NULL) {
WPRINTF(("Could not register event\n"));
close(sc->vsc_tapfd);
sc->vsc_tapfd = -1;
}
}
}
/*
* The default MAC address is the standard NetApp OUI of 00-a0-98,
* followed by an MD5 of the PCI slot/func number and dev name
*/
if (!mac_provided) {
snprintf(nstr, sizeof(nstr), "%d-%d-%s", pi->pi_slot,
pi->pi_func, vmname);
MD5Init(&mdctx);
MD5Update(&mdctx, nstr, strlen(nstr));
MD5Final(digest, &mdctx);
sc->vsc_config.mac[0] = 0x00;
sc->vsc_config.mac[1] = 0xa0;
sc->vsc_config.mac[2] = 0x98;
sc->vsc_config.mac[3] = digest[0];
sc->vsc_config.mac[4] = digest[1];
sc->vsc_config.mac[5] = digest[2];
}
/* initialize config space */
pci_set_cfgdata16(pi, PCIR_DEVICE, VIRTIO_DEV_NET);
pci_set_cfgdata16(pi, PCIR_VENDOR, VIRTIO_VENDOR);
pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_NETWORK);
pci_set_cfgdata16(pi, PCIR_SUBDEV_0, VIRTIO_TYPE_NET);
pci_lintr_request(pi);
/* link always up */
sc->vsc_config.status = 1;
/* use BAR 1 to map MSI-X table and PBA, if we're using MSI-X */
if (vi_intr_init(&sc->vsc_vs, 1, fbsdrun_virtio_msix()))
return (1);
/* use BAR 0 to map config regs in IO space */
vi_set_io_bar(&sc->vsc_vs, 0);
sc->resetting = 0;
sc->rx_merge = 1;
sc->rx_vhdrlen = sizeof(struct virtio_net_rxhdr);
sc->rx_in_progress = 0;
pthread_mutex_init(&sc->rx_mtx, NULL);
/*
* Initialize tx semaphore & spawn TX processing thread.
* As of now, only one thread for TX desc processing is
* spawned.
*/
sc->tx_in_progress = 0;
pthread_mutex_init(&sc->tx_mtx, NULL);
pthread_cond_init(&sc->tx_cond, NULL);
pthread_create(&sc->tx_tid, NULL, pci_vtnet_tx_thread, (void *)sc);
snprintf(tname, sizeof(tname), "vtnet-%d:%d tx", pi->pi_slot,
pi->pi_func);
pthread_set_name_np(sc->tx_tid, tname);
return (0);
}
static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state,
const DATA_BLOB request, DATA_BLOB *reply)
{
DATA_BLOB encrypted_session_key = data_blob_null;
DATA_BLOB user_session_key = data_blob_null;
DATA_BLOB lm_session_key = data_blob_null;
DATA_BLOB session_key = data_blob_null;
uint32 ntlmssp_command, auth_flags;
NTSTATUS nt_status = NT_STATUS_OK;
/* used by NTLM2 */
bool doing_ntlm2 = False;
uchar session_nonce[16];
uchar session_nonce_hash[16];
const char *parse_string;
char *domain = NULL;
char *user = NULL;
char *workstation = NULL;
/* parse the NTLMSSP packet */
*reply = data_blob_null;
#if 0
file_save("ntlmssp_auth.dat", request.data, request.length);
#endif
if (ntlmssp_state->unicode) {
parse_string = "CdBBUUUBd";
} else {
parse_string = "CdBBAAABd";
}
data_blob_free(&ntlmssp_state->lm_resp);
data_blob_free(&ntlmssp_state->nt_resp);
ntlmssp_state->user = NULL;
ntlmssp_state->domain = NULL;
ntlmssp_state->workstation = NULL;
/* now the NTLMSSP encoded auth hashes */
if (!msrpc_parse(&request, parse_string,
"NTLMSSP",
&ntlmssp_command,
&ntlmssp_state->lm_resp,
&ntlmssp_state->nt_resp,
&domain,
&user,
&workstation,
&encrypted_session_key,
&auth_flags)) {
SAFE_FREE(domain);
SAFE_FREE(user);
SAFE_FREE(workstation);
data_blob_free(&encrypted_session_key);
auth_flags = 0;
/* Try again with a shorter string (Win9X truncates this packet) */
if (ntlmssp_state->unicode) {
parse_string = "CdBBUUU";
} else {
parse_string = "CdBBAAA";
}
/* now the NTLMSSP encoded auth hashes */
if (!msrpc_parse(&request, parse_string,
"NTLMSSP",
&ntlmssp_command,
&ntlmssp_state->lm_resp,
&ntlmssp_state->nt_resp,
&domain,
&user,
&workstation)) {
DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP (tried both formats):\n"));
dump_data(2, request.data, request.length);
SAFE_FREE(domain);
SAFE_FREE(user);
SAFE_FREE(workstation);
return NT_STATUS_INVALID_PARAMETER;
}
}
if (auth_flags)
ntlmssp_handle_neg_flags(ntlmssp_state, auth_flags, lp_lanman_auth());
if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, domain))) {
SAFE_FREE(domain);
SAFE_FREE(user);
SAFE_FREE(workstation);
data_blob_free(&encrypted_session_key);
return nt_status;
}
if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, user))) {
SAFE_FREE(domain);
SAFE_FREE(user);
SAFE_FREE(workstation);
data_blob_free(&encrypted_session_key);
return nt_status;
}
if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_workstation(ntlmssp_state, workstation))) {
SAFE_FREE(domain);
SAFE_FREE(user);
SAFE_FREE(workstation);
data_blob_free(&encrypted_session_key);
return nt_status;
}
SAFE_FREE(domain);
SAFE_FREE(user);
SAFE_FREE(workstation);
DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n",
ntlmssp_state->user, ntlmssp_state->domain, ntlmssp_state->workstation, (unsigned long)ntlmssp_state->lm_resp.length, (unsigned long)ntlmssp_state->nt_resp.length));
#if 0
file_save("nthash1.dat", &ntlmssp_state->nt_resp.data, &ntlmssp_state->nt_resp.length);
file_save("lmhash1.dat", &ntlmssp_state->lm_resp.data, &ntlmssp_state->lm_resp.length);
#endif
/* NTLM2 uses a 'challenge' that is made of up both the server challenge, and a
client challenge
However, the NTLM2 flag may still be set for the real NTLMv2 logins, be careful.
*/
if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
if (ntlmssp_state->nt_resp.length == 24 && ntlmssp_state->lm_resp.length == 24) {
struct MD5Context md5_session_nonce_ctx;
SMB_ASSERT(ntlmssp_state->internal_chal.data && ntlmssp_state->internal_chal.length == 8);
doing_ntlm2 = True;
memcpy(session_nonce, ntlmssp_state->internal_chal.data, 8);
memcpy(&session_nonce[8], ntlmssp_state->lm_resp.data, 8);
MD5Init(&md5_session_nonce_ctx);
MD5Update(&md5_session_nonce_ctx, session_nonce, 16);
MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
ntlmssp_state->chal = data_blob_talloc(ntlmssp_state->mem_ctx, session_nonce_hash, 8);
/* LM response is no longer useful */
data_blob_free(&ntlmssp_state->lm_resp);
/* We changed the effective challenge - set it */
if (!NT_STATUS_IS_OK(nt_status = ntlmssp_state->set_challenge(ntlmssp_state, &ntlmssp_state->chal))) {
data_blob_free(&encrypted_session_key);
return nt_status;
}
/* LM Key is incompatible. */
ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
}
}
/*
* Note we don't check here for NTLMv2 auth settings. If NTLMv2 auth
* is required (by "ntlm auth = no" and "lm auth = no" being set in the
* smb.conf file) and no NTLMv2 response was sent then the password check
* will fail here. JRA.
*/
/* Finally, actually ask if the password is OK */
if (!NT_STATUS_IS_OK(nt_status = ntlmssp_state->check_password(ntlmssp_state,
&user_session_key, &lm_session_key))) {
data_blob_free(&encrypted_session_key);
return nt_status;
}
dump_data_pw("NT session key:\n", user_session_key.data, user_session_key.length);
dump_data_pw("LM first-8:\n", lm_session_key.data, lm_session_key.length);
/* Handle the different session key derivation for NTLM2 */
if (doing_ntlm2) {
if (user_session_key.data && user_session_key.length == 16) {
session_key = data_blob_talloc(ntlmssp_state->mem_ctx, NULL, 16);
hmac_md5(user_session_key.data, session_nonce,
sizeof(session_nonce), session_key.data);
DEBUG(10,("ntlmssp_server_auth: Created NTLM2 session key.\n"));
dump_data_pw("NTLM2 session key:\n", session_key.data, session_key.length);
} else {
DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM2 session key.\n"));
session_key = data_blob_null;
}
} else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
if (lm_session_key.data && lm_session_key.length >= 8) {
if (ntlmssp_state->lm_resp.data && ntlmssp_state->lm_resp.length == 24) {
session_key = data_blob_talloc(ntlmssp_state->mem_ctx, NULL, 16);
if (session_key.data == NULL) {
return NT_STATUS_NO_MEMORY;
}
SMBsesskeygen_lm_sess_key(lm_session_key.data, ntlmssp_state->lm_resp.data,
session_key.data);
DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
} else {
uint8 zeros[24];
ZERO_STRUCT(zeros);
session_key = data_blob_talloc(
ntlmssp_state->mem_ctx, NULL, 16);
if (session_key.data == NULL) {
return NT_STATUS_NO_MEMORY;
}
SMBsesskeygen_lm_sess_key(
lm_session_key.data, zeros,
session_key.data);
}
dump_data_pw("LM session key:\n", session_key.data,
session_key.length);
} else {
DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM session key.\n"));
session_key = data_blob_null;
}
} else if (user_session_key.data) {
session_key = user_session_key;
DEBUG(10,("ntlmssp_server_auth: Using unmodified nt session key.\n"));
dump_data_pw("unmodified session key:\n", session_key.data, session_key.length);
} else if (lm_session_key.data) {
session_key = lm_session_key;
DEBUG(10,("ntlmssp_server_auth: Using unmodified lm session key.\n"));
dump_data_pw("unmodified session key:\n", session_key.data, session_key.length);
} else {
DEBUG(10,("ntlmssp_server_auth: Failed to create unmodified session key.\n"));
session_key = data_blob_null;
}
/* With KEY_EXCH, the client supplies the proposed session key,
but encrypts it with the long-term key */
if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
if (!encrypted_session_key.data || encrypted_session_key.length != 16) {
data_blob_free(&encrypted_session_key);
DEBUG(1, ("Client-supplied KEY_EXCH session key was of invalid length (%u)!\n",
(unsigned int)encrypted_session_key.length));
return NT_STATUS_INVALID_PARAMETER;
} else if (!session_key.data || session_key.length != 16) {
DEBUG(5, ("server session key is invalid (len == %u), cannot do KEY_EXCH!\n",
(unsigned int)session_key.length));
ntlmssp_state->session_key = session_key;
} else {
dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length);
SamOEMhash(encrypted_session_key.data,
session_key.data,
encrypted_session_key.length);
ntlmssp_state->session_key = data_blob_talloc(ntlmssp_state->mem_ctx,
encrypted_session_key.data,
encrypted_session_key.length);
dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data,
encrypted_session_key.length);
}
} else {
ntlmssp_state->session_key = session_key;
}
if (!NT_STATUS_IS_OK(nt_status)) {
ntlmssp_state->session_key = data_blob_null;
} else if (ntlmssp_state->session_key.length) {
nt_status = ntlmssp_sign_init(ntlmssp_state);
}
data_blob_free(&encrypted_session_key);
/* Only one authentication allowed per server state. */
ntlmssp_state->expected_state = NTLMSSP_DONE;
return nt_status;
}
void
HMAC_MD5_Update(HMAC_MD5_CTX *ctx, const u_int8_t *data, u_int len)
{
MD5Update(&ctx->ctx, data, len);
}
/**
* Calculate keyed-hashing for message authenticaiton using md5.
*
* @param packet pointer to target RADIUS_PACKET.
* @param text_len length of data stream
* @param key pointer to authentication key
* @param key_len length of authentication key
* @param digest caller digest to be filled in
*/
static void
radius_hmac_md5(RADIUS_PACKET *packet, const char * key, int key_len,
caddr_t digest, int check)
{
const RADIUS_ATTRIBUTE* attr;
const RADIUS_ATTRIBUTE* end;
MD5_CTX context;
u_char k_ipad[65]; /* inner padding - key XORd with ipad */
u_char k_opad[65]; /* outer padding - key XORd with opad */
u_char key0[64];
int i;
u_char zero16[16];
/* if key is longer than 64 bytes reset it to key=MD5(key) */
if (key_len > 64)
{
MD5_CTX tctx;
MD5Init(&tctx);
MD5Update(&tctx, (const u_char *)key, key_len);
MD5Final((u_char *)key0, &tctx);
key_len = 16;
} else
memcpy(key0, key, key_len);
key = (const char *)key0;
/*
* the HMAC_MD5 transform looks like:
*
* MD5(K XOR opad, MD5(K XOR ipad, text))
*
* where K is an n byte key
* ipad is the byte 0x36 repeated 64 times
* opad is the byte 0x5c repeated 64 times
* and text is the data being protected
*/
/* start out by storing key in pads */
memset(k_ipad, 0, sizeof k_ipad);
memset(k_opad, 0, sizeof k_opad);
memcpy(k_ipad, key, key_len);
memcpy(k_opad, key, key_len);
/* XOR key with ipad and opad values */
for (i = 0; i < 64; i++)
{
k_ipad[i] ^= 0x36;
k_opad[i] ^= 0x5c;
}
/* perform inner MD5 */
MD5Init(&context); /* init context for 1st pass */
MD5Update(&context, k_ipad, 64); /* start with inner pad */
/*
* Traverse the radius packet.
*/
if (check)
{
MD5Update(&context, (const u_char *)packet->pdata, 4);
MD5Update(&context, (unsigned char*)packet->request->pdata
->authenticator, 16);
}
else
{
MD5Update(&context, (const u_char *)packet->pdata,
sizeof(RADIUS_PACKET_DATA));
}
attr = ATTRS_BEGIN(packet->pdata);
end = ATTRS_END(packet->pdata);
memset(zero16, 0, sizeof(zero16));
for(; attr<end; ADVANCE(attr))
{
if (attr->type == RADIUS_TYPE_MESSAGE_AUTHENTICATOR)
{
MD5Update(&context, (u_char *)attr, 2);
MD5Update(&context, (u_char *)zero16, sizeof(zero16));
} else
MD5Update(&context, (u_char *)attr, (int)attr->length);
}
MD5Final((u_char *)digest, &context); /* finish up 1st pass */
/*
* perform outer MD5
*/
MD5Init(&context); /* init context for 2nd pass */
MD5Update(&context, k_opad, 64); /* start with outer pad */
MD5Update(&context, (u_char *)digest, 16);/* then results of 1st hash */
MD5Final((u_char *)digest, &context); /* finish up 2nd pass */
}
/*
* If filename is NULL, just throw away the result
*/
bool unshield_file_save (Unshield* unshield, int index, const char* filename)/*{{{*/
{
bool success = false;
FILE* output = NULL;
unsigned char* input_buffer = (unsigned char*)malloc(BUFFER_SIZE+1);
unsigned char* output_buffer = (unsigned char*)malloc(BUFFER_SIZE);
int bytes_left;
uLong total_written = 0;
UnshieldReader* reader = NULL;
FileDescriptor* file_descriptor;
MD5_CTX md5;
MD5Init(&md5);
if (!unshield)
goto exit;
if (!(file_descriptor = unshield_get_file_descriptor(unshield, index)))
{
unshield_error("Failed to get file descriptor for file %i", index);
goto exit;
}
if ((file_descriptor->flags & FILE_INVALID) || 0 == file_descriptor->data_offset)
{
/* invalid file */
goto exit;
}
if (file_descriptor->link_flags & LINK_PREV)
{
success = unshield_file_save(unshield, file_descriptor->link_previous, filename);
goto exit;
}
reader = unshield_reader_create(unshield, index, file_descriptor);
if (!reader)
{
unshield_error("Failed to create data reader for file %i", index);
goto exit;
}
if (unshield_fsize(reader->volume_file) == (long)file_descriptor->data_offset)
{
unshield_error("File %i is not inside the cabinet.", index);
goto exit;
}
if (filename)
{
output = fopen(filename, "w");
if (!output)
{
unshield_error("Failed to open output file '%s'", filename);
goto exit;
}
}
if (file_descriptor->flags & FILE_COMPRESSED)
bytes_left = file_descriptor->compressed_size;
else
bytes_left = file_descriptor->expanded_size;
/*unshield_trace("Bytes to read: %i", bytes_left);*/
while (bytes_left > 0)
{
uLong bytes_to_write = BUFFER_SIZE;
int result;
if (file_descriptor->flags & FILE_COMPRESSED)
{
uLong read_bytes;
uint16_t bytes_to_read = 0;
if (!unshield_reader_read(reader, &bytes_to_read, sizeof(bytes_to_read)))
{
#if VERBOSE
unshield_error("Failed to read %i bytes of file %i (%s) from input cabinet file %i",
sizeof(bytes_to_read), index, unshield_file_name(unshield, index), file_descriptor->volume);
#endif
goto exit;
}
bytes_to_read = letoh16(bytes_to_read);
if (!unshield_reader_read(reader, input_buffer, bytes_to_read))
{
#if VERBOSE
unshield_error("Failed to read %i bytes of file %i (%s) from input cabinet file %i",
bytes_to_read, index, unshield_file_name(unshield, index), file_descriptor->volume);
#endif
goto exit;
}
/* add a null byte to make inflate happy */
input_buffer[bytes_to_read] = 0;
read_bytes = bytes_to_read+1;
result = unshield_uncompress(output_buffer, &bytes_to_write, input_buffer, &read_bytes);
if (Z_OK != result)
{
unshield_error("Decompression failed with code %i. bytes_to_read=%i, volume_bytes_left=%i, volume=%i, read_bytes=%i",
result, bytes_to_read, reader->volume_bytes_left, file_descriptor->volume, read_bytes);
goto exit;
}
#if VERBOSE >= 3
unshield_trace("read_bytes = %i",
read_bytes);
#endif
bytes_left -= 2;
bytes_left -= bytes_to_read;
}
else
{
bytes_to_write = MIN(bytes_left, BUFFER_SIZE);
if (!unshield_reader_read(reader, output_buffer, bytes_to_write))
{
#if VERBOSE
unshield_error("Failed to read %i bytes from input cabinet file %i",
bytes_to_write, file_descriptor->volume);
#endif
goto exit;
}
bytes_left -= bytes_to_write;
}
MD5Update(&md5, output_buffer, bytes_to_write);
if (output)
{
if (bytes_to_write != fwrite(output_buffer, 1, bytes_to_write, output))
{
unshield_error("Failed to write %i bytes to file '%s'", bytes_to_write, filename);
goto exit;
}
}
total_written += bytes_to_write;
}
if (file_descriptor->expanded_size != total_written)
{
unshield_error("Expanded size expected to be %i, but was %i",
file_descriptor->expanded_size, total_written);
goto exit;
}
if (unshield->header_list->major_version >= 6)
{
unsigned char md5result[16];
MD5Final(md5result, &md5);
if (0 != memcmp(md5result, file_descriptor->md5, 16))
{
unshield_error("MD5 checksum failure for file %i (%s)",
index, unshield_file_name(unshield, index));
goto exit;
}
}
success = true;
exit:
unshield_reader_destroy(reader);
FCLOSE(output);
FREE(input_buffer);
FREE(output_buffer);
return success;
}/*}}}*/
static char *
chap_BuildAnswer(char *name, char *key, u_char id, char *challenge
#ifndef NODES
, u_char type, char *peerchallenge, char *authresponse,
int lanman
#endif
)
{
char *result, *digest;
size_t nlen, klen;
nlen = strlen(name);
klen = strlen(key);
#ifndef NODES
if (type == 0x80) {
char expkey[AUTHLEN << 2];
MD4_CTX MD4context;
size_t f;
if ((result = malloc(1 + nlen + MS_CHAP_RESPONSE_LEN)) == NULL)
return result;
digest = result; /* the response */
*digest++ = MS_CHAP_RESPONSE_LEN; /* 49 */
memcpy(digest + MS_CHAP_RESPONSE_LEN, name, nlen);
if (lanman) {
memset(digest + 24, '\0', 25);
mschap_LANMan(digest, challenge + 1, key); /* LANMan response */
} else {
memset(digest, '\0', 25);
digest += 24;
for (f = 0; f < klen; f++) {
expkey[2*f] = key[f];
expkey[2*f+1] = '\0';
}
/*
* -----------
* expkey = | k\0e\0y\0 |
* -----------
*/
MD4Init(&MD4context);
MD4Update(&MD4context, expkey, klen << 1);
MD4Final(digest, &MD4context);
/*
* ---- -------- ---------------- ------- ------
* result = | 49 | LANMan | 16 byte digest | 9 * ? | name |
* ---- -------- ---------------- ------- ------
*/
mschap_NT(digest, challenge + 1);
}
/*
* ---- -------- ------------- ----- ------
* | | struct MS_ChapResponse24 | |
* result = | 49 | LANMan | NT digest | 0/1 | name |
* ---- -------- ------------- ----- ------
* where only one of LANMan & NT digest are set.
*/
} else if (type == 0x81) {
char expkey[AUTHLEN << 2];
char pwdhash[CHAP81_HASH_LEN];
char pwdhashhash[CHAP81_HASH_LEN];
char *ntresponse;
size_t f;
if ((result = malloc(1 + nlen + CHAP81_RESPONSE_LEN)) == NULL)
return result;
memset(result, 0, 1 + nlen + CHAP81_RESPONSE_LEN);
digest = result;
*digest++ = CHAP81_RESPONSE_LEN; /* value size */
/* Copy our challenge */
memcpy(digest, peerchallenge + 1, CHAP81_CHALLENGE_LEN);
/* Expand password to Unicode XXX */
for (f = 0; f < klen; f++) {
expkey[2*f] = key[f];
expkey[2*f+1] = '\0';
}
ntresponse = digest + CHAP81_NTRESPONSE_OFF;
/* Get some needed hashes */
NtPasswordHash(expkey, klen * 2, pwdhash);
HashNtPasswordHash(pwdhash, pwdhashhash);
/* Generate NTRESPONSE to respond on challenge call */
GenerateNTResponse(challenge + 1, peerchallenge + 1, name,
expkey, klen * 2, ntresponse);
/* Generate MPPE MASTERKEY */
GetMasterKey(pwdhashhash, ntresponse, MPPE_MasterKey); /* XXX Global ! */
/* Generate AUTHRESPONSE to verify on auth success */
GenerateAuthenticatorResponse(expkey, klen * 2, ntresponse,
peerchallenge + 1, challenge + 1, name,
authresponse);
authresponse[CHAP81_AUTHRESPONSE_LEN] = 0;
memcpy(digest + CHAP81_RESPONSE_LEN, name, nlen);
} else
#endif
if ((result = malloc(nlen + 17)) != NULL) {
/* Normal MD5 stuff */
MD5_CTX MD5context;
digest = result;
*digest++ = 16; /* value size */
MD5Init(&MD5context);
MD5Update(&MD5context, &id, 1);
MD5Update(&MD5context, key, klen);
MD5Update(&MD5context, challenge + 1, *challenge);
MD5Final(digest, &MD5context);
memcpy(digest + 16, name, nlen);
/*
* ---- -------- ------
* result = | 16 | digest | name |
* ---- -------- ------
*/
}
return result;
}
int crypto_hash_finish(struct crypto_hash *ctx, u8 *mac, size_t *len)
{
u8 k_pad[64];
size_t i;
if (ctx == NULL)
return -2;
if (mac == NULL || len == NULL) {
os_free(ctx);
return 0;
}
switch (ctx->alg) {
case CRYPTO_HASH_ALG_MD5:
if (*len < 16) {
*len = 16;
os_free(ctx);
return -1;
}
*len = 16;
MD5Final(mac, &ctx->u.md5);
break;
case CRYPTO_HASH_ALG_SHA1:
if (*len < 20) {
*len = 20;
os_free(ctx);
return -1;
}
*len = 20;
SHA1Final(mac, &ctx->u.sha1);
break;
case CRYPTO_HASH_ALG_HMAC_MD5:
if (*len < 16) {
*len = 16;
os_free(ctx);
return -1;
}
*len = 16;
MD5Final(mac, &ctx->u.md5);
os_memcpy(k_pad, ctx->key, ctx->key_len);
os_memset(k_pad + ctx->key_len, 0,
sizeof(k_pad) - ctx->key_len);
for (i = 0; i < sizeof(k_pad); i++)
k_pad[i] ^= 0x5c;
MD5Init(&ctx->u.md5);
MD5Update(&ctx->u.md5, k_pad, sizeof(k_pad));
MD5Update(&ctx->u.md5, mac, 16);
MD5Final(mac, &ctx->u.md5);
break;
case CRYPTO_HASH_ALG_HMAC_SHA1:
if (*len < 20) {
*len = 20;
os_free(ctx);
return -1;
}
*len = 20;
SHA1Final(mac, &ctx->u.sha1);
os_memcpy(k_pad, ctx->key, ctx->key_len);
os_memset(k_pad + ctx->key_len, 0,
sizeof(k_pad) - ctx->key_len);
for (i = 0; i < sizeof(k_pad); i++)
k_pad[i] ^= 0x5c;
SHA1Init(&ctx->u.sha1);
SHA1Update(&ctx->u.sha1, k_pad, sizeof(k_pad));
SHA1Update(&ctx->u.sha1, mac, 20);
SHA1Final(mac, &ctx->u.sha1);
break;
}
os_free(ctx);
return 0;
}
static int loadrsakey_main(FILE * fp, struct RSAKey *key, int pub_only,
char **commentptr, char *passphrase,
const char **error)
{
unsigned char buf[16384];
unsigned char keybuf[16];
int len;
int i, j, ciphertype;
int ret = 0;
struct MD5Context md5c;
char *comment;
*error = NULL;
/* Slurp the whole file (minus the header) into a buffer. */
len = fread(buf, 1, sizeof(buf), fp);
fclose(fp);
if (len < 0 || len == sizeof(buf)) {
*error = "error reading file";
goto end; /* file too big or not read */
}
i = 0;
*error = "file format error";
/*
* A zero byte. (The signature includes a terminating NUL.)
*/
if (len - i < 1 || buf[i] != 0)
goto end;
i++;
/* One byte giving encryption type, and one reserved uint32. */
if (len - i < 1)
goto end;
ciphertype = buf[i];
if (ciphertype != 0 && ciphertype != SSH_CIPHER_3DES)
goto end;
i++;
if (len - i < 4)
goto end; /* reserved field not present */
if (buf[i] != 0 || buf[i + 1] != 0 || buf[i + 2] != 0
|| buf[i + 3] != 0) goto end; /* reserved field nonzero, panic! */
i += 4;
/* Now the serious stuff. An ordinary SSH-1 public key. */
j = makekey(buf + i, len - i, key, NULL, 1);
if (j < 0)
goto end; /* overran */
i += j;
/* Next, the comment field. */
j = toint(GET_32BIT(buf + i));
i += 4;
if (j < 0 || len - i < j)
goto end;
comment = snewn(j + 1, char);
if (comment) {
memcpy(comment, buf + i, j);
comment[j] = '\0';
}
i += j;
if (commentptr)
*commentptr = dupstr(comment);
if (key)
key->comment = comment;
else
sfree(comment);
if (pub_only) {
ret = 1;
goto end;
}
if (!key) {
ret = ciphertype != 0;
*error = NULL;
goto end;
}
/*
* Decrypt remainder of buffer.
*/
if (ciphertype) {
MD5Init(&md5c);
MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
MD5Final(keybuf, &md5c);
des3_decrypt_pubkey(keybuf, buf + i, (len - i + 7) & ~7);
smemclr(keybuf, sizeof(keybuf)); /* burn the evidence */
}
/*
* We are now in the secret part of the key. The first four
* bytes should be of the form a, b, a, b.
*/
if (len - i < 4)
goto end;
if (buf[i] != buf[i + 2] || buf[i + 1] != buf[i + 3]) {
*error = "wrong passphrase";
ret = -1;
goto end;
}
i += 4;
/*
* After that, we have one further bignum which is our
* decryption exponent, and then the three auxiliary values
* (iqmp, q, p).
*/
j = makeprivate(buf + i, len - i, key);
if (j < 0) goto end;
i += j;
j = ssh1_read_bignum(buf + i, len - i, &key->iqmp);
if (j < 0) goto end;
i += j;
j = ssh1_read_bignum(buf + i, len - i, &key->q);
if (j < 0) goto end;
i += j;
j = ssh1_read_bignum(buf + i, len - i, &key->p);
if (j < 0) goto end;
i += j;
if (!rsa_verify(key)) {
*error = "rsa_verify failed";
freersakey(key);
ret = 0;
} else
ret = 1;
end:
smemclr(buf, sizeof(buf)); /* burn the evidence */
return ret;
}
/* <2a121> ../engine/hashpak.c:1060 */
void HPAK_CreatePak(char *pakname, struct resource_s *pResource, void *pData, FileHandle_t fpSource)
{
char name[MAX_PATH];
int32 curpos;
FileHandle_t fp;
hash_pack_entry_t *pCurrentEntry;
byte md5[16];
MD5Context_t ctx;
byte *pDiskData;
if ((!fpSource && !pData) || (fpSource && pData))
{
Con_Printf("HPAK_CreatePak, must specify one of pData or fpSource\n");
return;
}
Q_snprintf(name, ARRAYSIZE(name), "%s", pakname);
#ifdef REHLDS_FIXES
name[ARRAYSIZE(name) - 1] = 0;
#endif // REHLDS_FIXES
COM_DefaultExtension(name, HASHPAK_EXTENSION);
Con_Printf("Creating HPAK %s.\n", name);
fp = FS_Open(name, "wb");
if (!fp)
{
Con_Printf("ERROR: couldn't open new .hpk, check access rights to %s.\n", name);
return;
}
Q_memset(&ctx, 0, sizeof(MD5Context_t));
MD5Init(&ctx);
if (pData)
MD5Update(&ctx, (byte *)pData, pResource->nDownloadSize);
else
{
curpos = FS_Tell(fpSource);
pDiskData = (byte *)Mem_Malloc(pResource->nDownloadSize + 1);
Q_memset(pDiskData, 0, pResource->nDownloadSize);
FS_Read(pDiskData, pResource->nDownloadSize, 1, fp);
FS_Seek(fpSource, curpos, FILESYSTEM_SEEK_HEAD);
MD5Update(&ctx, pDiskData, pResource->nDownloadSize);
Mem_Free(pDiskData);
}
MD5Final(md5, &ctx);
if (Q_memcmp(pResource->rgucMD5_hash, md5, sizeof(md5)) != 0)
{
Con_Printf("HPAK_CreatePak called with bogus lump, md5 mismatch\n");
Con_Printf("Purported: %s\n", MD5_Print(pResource->rgucMD5_hash));
Con_Printf("Actual : %s\n", MD5_Print(md5));
Con_Printf("Ignoring lump addition\n");
return;
}
Q_memset(&hash_pack_header, 0, sizeof(hash_pack_header_t));
Q_memcpy(hash_pack_header.szFileStamp, "HPAK", sizeof(hash_pack_header.szFileStamp));
hash_pack_header.version = HASHPAK_VERSION;
hash_pack_header.nDirectoryOffset = 0;
FS_Write(&hash_pack_header, sizeof(hash_pack_header_t), 1, fp);
Q_memset(&hash_pack_dir, 0, sizeof(hash_pack_directory_t));
hash_pack_dir.nEntries = 1;
hash_pack_dir.p_rgEntries = (hash_pack_entry_t *)Mem_Malloc(sizeof(hash_pack_entry_t));
Q_memset(hash_pack_dir.p_rgEntries, 0, sizeof(hash_pack_entry_t) * hash_pack_dir.nEntries);
pCurrentEntry = &hash_pack_dir.p_rgEntries[0];
Q_memcpy(&pCurrentEntry->resource, pResource, sizeof(resource_t));
pCurrentEntry->nOffset = FS_Tell(fp);
pCurrentEntry->nFileLength = pResource->nDownloadSize;
if (pData)
FS_Write(pData, pResource->nDownloadSize, 1, fp);
else COM_CopyFileChunk(fp, fpSource, pResource->nDownloadSize);
curpos = FS_Tell(fp);
FS_Write(&hash_pack_dir.nEntries, 4, 1, fp);
FS_Write(hash_pack_dir.p_rgEntries, sizeof(hash_pack_entry_t), 1, fp);
if (hash_pack_dir.p_rgEntries)
{
Mem_Free(hash_pack_dir.p_rgEntries);
hash_pack_dir.p_rgEntries = NULL;
}
hash_pack_dir.nEntries = 0;
hash_pack_header.nDirectoryOffset = curpos;
FS_Seek(fp, 0, FILESYSTEM_SEEK_HEAD);
FS_Write(&hash_pack_header, sizeof(hash_pack_header_t), 1, fp);
FS_Close(fp);
}