denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed some memleaks in mschapv2 plugin

Browse Source
This commit is contained in:
Tobias Brunner
2009-02-19 14:32:13 +00:00
parent 7b76702587
commit 3078b18778
1 changed files with 25 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/plugins/eap_mschapv2/eap_mschapv2.c
+25 -16
View File
@@ -318,7 +318,7 @@ static status_t ChallengeResponse(chunk_t challenge_hash, chunk_t password_hash,
int i; int i;
crypter_t *crypter; crypter_t *crypter;
chunk_t keys[3], z_password_hash; chunk_t keys[3], z_password_hash;
crypter = lib->crypto->create_crypter(lib->crypto, ENCR_DES_ECB, 64); crypter = lib->crypto->create_crypter(lib->crypto, ENCR_DES_ECB, 8);
if (crypter == NULL) if (crypter == NULL)
{ {
DBG1(DBG_IKE, "EAP-MS-CHAPv2 failed, DES-ECB not supported"); DBG1(DBG_IKE, "EAP-MS-CHAPv2 failed, DES-ECB not supported");
@@ -339,6 +339,7 @@ static status_t ChallengeResponse(chunk_t challenge_hash, chunk_t password_hash,
crypter->set_key(crypter, expanded); crypter->set_key(crypter, expanded);
crypter->encrypt(crypter, challenge_hash, chunk_empty, &encrypted); crypter->encrypt(crypter, challenge_hash, chunk_empty, &encrypted);
memcpy(&response->ptr[i * 8], encrypted.ptr, encrypted.len); memcpy(&response->ptr[i * 8], encrypted.ptr, encrypted.len);
chunk_clear(&encrypted);
chunk_clear(&expanded); chunk_clear(&expanded);
} }
crypter->destroy(crypter); crypter->destroy(crypter);
@@ -709,9 +710,9 @@ static status_t process_peer_success(private_eap_mschapv2_t *this,
return FAILED; return FAILED;
} }
message_len = data.len - HEADER_LEN + 1; /* + null byte */ message_len = data.len - HEADER_LEN;
message = malloc(message_len); message = malloc(message_len + 1);
memcpy(message, eap->data, message_len - 1); memcpy(message, eap->data, message_len);
message[message_len] = '\0'; message[message_len] = '\0';
/* S=<auth_string> M=<msg> */ /* S=<auth_string> M=<msg> */
@@ -838,18 +839,19 @@ static status_t process_peer_failure(private_eap_mschapv2_t *this,
DBG1(DBG_IKE, "EAP-MS-CHAPv2 failed with error %N: '%s'", mschapv2_error_names, error, msg); DBG1(DBG_IKE, "EAP-MS-CHAPv2 failed with error %N: '%s'", mschapv2_error_names, error, msg);
/** /**
* at this point, if the error is retryable, we MAY retry the * at this point, if the error is retryable, we MAY retry the authentication
* authentication or MAY send a Change Password packet. * or MAY send a Change Password packet.
* *
* if the error is not retryable (or if we do neither of the * if the error is not retryable (or if we do neither of the above), we
* above), we SHOULD send a Failure Response packet. * SHOULD send a Failure Response packet.
* windows clients don't do that, and since windows server 2008 r2 * windows clients don't do that, and since windows server 2008 r2 behaves
* behaves pretty odd if we do send a Failure Response, we just * pretty odd if we do send a Failure Response, we just don't send one
* don't send one either. * either. windows 7 actually sends a delete notify (which, according to the
* logs, results in an error on windows server 2008 r2).
* *
* btw, windows server 2008 r2 does not send non-retryable errors * btw, windows server 2008 r2 does not send non-retryable errors for e.g.
* for e.g. a disabled account but returns the windows error code in * a disabled account but returns the windows error code in a notify payload
* a notify payload of type 12345. * of type 12345.
*/ */
status = FAILED; status = FAILED;
@@ -914,7 +916,7 @@ static status_t process_server_retry(private_eap_mschapv2_t *this,
rng_t *rng; rng_t *rng;
chunk_t hex; chunk_t hex;
char msg[FAILURE_MESSAGE_LEN]; char msg[FAILURE_MESSAGE_LEN];
u_int16_t len = HEADER_LEN + FAILURE_MESSAGE_LEN - 1; u_int16_t len = HEADER_LEN + FAILURE_MESSAGE_LEN - 1; /* no null byte */
if (++this->retries > MAX_RETRIES) if (++this->retries > MAX_RETRIES)
{ {
@@ -938,6 +940,10 @@ static status_t process_server_retry(private_eap_mschapv2_t *this,
rng->get_bytes(rng, CHALLENGE_LEN, this->challenge.ptr); rng->get_bytes(rng, CHALLENGE_LEN, this->challenge.ptr);
rng->destroy(rng); rng->destroy(rng);
chunk_free(&this->nt_response);
chunk_free(&this->auth_response);
chunk_free(&this->msk);
eap = alloca(len); eap = alloca(len);
eap->code = EAP_REQUEST; eap->code = EAP_REQUEST;
eap->identifier = ++this->identifier; eap->identifier = ++this->identifier;
@@ -950,7 +956,7 @@ static status_t process_server_retry(private_eap_mschapv2_t *this,
hex = chunk_to_hex(this->challenge, NULL, TRUE); hex = chunk_to_hex(this->challenge, NULL, TRUE);
snprintf(msg, FAILURE_MESSAGE_LEN, "%s%s", FAILURE_MESSAGE, hex.ptr); snprintf(msg, FAILURE_MESSAGE_LEN, "%s%s", FAILURE_MESSAGE, hex.ptr);
chunk_free(&hex); chunk_free(&hex);
memcpy(eap->data, msg, FAILURE_MESSAGE_LEN - 1); memcpy(eap->data, msg, FAILURE_MESSAGE_LEN - 1); /* no null byte */
*out = eap_payload_create_data(chunk_create((void*) eap, len)); *out = eap_payload_create_data(chunk_create((void*) eap, len));
/* delay the response for some time to make brute-force attacks harder */ /* delay the response for some time to make brute-force attacks harder */
@@ -1002,6 +1008,7 @@ static status_t process_server_response(private_eap_mschapv2_t *this,
* thus, we could actually fail here, because retries do not make much * thus, we could actually fail here, because retries do not make much
* sense. on the other hand, an attacker could guess usernames, if the * sense. on the other hand, an attacker could guess usernames, if the
* error messages were different. */ * error messages were different. */
userid->destroy(userid);
return process_server_retry(this, out); return process_server_retry(this, out);
} }
@@ -1011,9 +1018,11 @@ static status_t process_server_response(private_eap_mschapv2_t *this,
if (GenerateStuff(this, this->challenge, peer_challenge, username, password) != SUCCESS) if (GenerateStuff(this, this->challenge, peer_challenge, username, password) != SUCCESS)
{ {
DBG1(DBG_IKE, "EAP-MS-CHAPv2 verification failed"); DBG1(DBG_IKE, "EAP-MS-CHAPv2 verification failed");
userid->destroy(userid);
chunk_clear(&password); chunk_clear(&password);
return FAILED; return FAILED;
} }
userid->destroy(userid);
chunk_clear(&password); chunk_clear(&password);
if (memeq(res->response.nt_response, this->nt_response.ptr, this->nt_response.len)) if (memeq(res->response.nt_response, this->nt_response.ptr, this->nt_response.len))