diff options
| author |   tedu <tedu@openbsd.org> | 2014-11-16 17:37:42 +0000 |
|---|---|---|
| committer | tedu <tedu@openbsd.org> | 2014-11-16 17:37:42 +0000 |
| commit | 842fba9566e8da3df64e169ae5b9fe620a1ee69e (patch) | |
| tree | d9a522d14524147f3fe549fcd3907e0c60eb0609 | |
| parent | Sort and group includes. (diff) | |
| download | wireguard-openbsd-842fba9566e8da3df64e169ae5b9fe620a1ee69e.tar.xz wireguard-openbsd-842fba9566e8da3df64e169ae5b9fe620a1ee69e.zip | |
convert to use sha512 for pf iss. ok deraadt dlg
| -rw-r--r-- | sys/net/pf.c | 35 |
1 files changed, 19 insertions, 16 deletions
diff --git a/sys/net/pf.c b/sys/net/pf.c index 40d9a8e88e2..5ea4baf9b45 100644 --- a/sys/net/pf.c +++ b/sys/net/pf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pf.c,v 1.892 2014/11/16 11:58:14 dlg Exp $ */ +/* $OpenBSD: pf.c,v 1.893 2014/11/16 17:37:42 tedu Exp $ */ /* * Copyright (c) 2001 Daniel Hartmeier @@ -53,7 +53,7 @@ #include <sys/rwlock.h> #include <sys/syslog.h> -#include <crypto/md5.h> +#include <crypto/sha2.h> #include <net/if.h> #include <net/if_types.h> @@ -105,7 +105,7 @@ struct pf_queuehead *pf_queues_inactive; struct pf_status pf_status; -MD5_CTX pf_tcp_secret_ctx; +SHA2_CTX pf_tcp_secret_ctx; u_char pf_tcp_secret[16]; int pf_tcp_secret_init; int pf_tcp_iss_off; @@ -3031,38 +3031,41 @@ pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr) u_int32_t pf_tcp_iss(struct pf_pdesc *pd) { - MD5_CTX ctx; - u_int32_t digest[4]; + SHA2_CTX ctx; + union { + uint8_t bytes[SHA512_DIGEST_LENGTH]; + uint32_t words[1]; + } digest; if (pf_tcp_secret_init == 0) { arc4random_buf(pf_tcp_secret, sizeof(pf_tcp_secret)); - MD5Init(&pf_tcp_secret_ctx); - MD5Update(&pf_tcp_secret_ctx, pf_tcp_secret, + SHA512Init(&pf_tcp_secret_ctx); + SHA512Update(&pf_tcp_secret_ctx, pf_tcp_secret, sizeof(pf_tcp_secret)); pf_tcp_secret_init = 1; } ctx = pf_tcp_secret_ctx; - MD5Update(&ctx, (char *)&pd->rdomain, sizeof(pd->rdomain)); - MD5Update(&ctx, (char *)&pd->hdr.tcp->th_sport, sizeof(u_short)); - MD5Update(&ctx, (char *)&pd->hdr.tcp->th_dport, sizeof(u_short)); + SHA512Update(&ctx, (char *)&pd->rdomain, sizeof(pd->rdomain)); + SHA512Update(&ctx, (char *)&pd->hdr.tcp->th_sport, sizeof(u_short)); + SHA512Update(&ctx, (char *)&pd->hdr.tcp->th_dport, sizeof(u_short)); switch (pd->af) { #ifdef INET case AF_INET: - MD5Update(&ctx, (char *)&pd->src->v4, sizeof(struct in_addr)); - MD5Update(&ctx, (char *)&pd->dst->v4, sizeof(struct in_addr)); + SHA512Update(&ctx, (char *)&pd->src->v4, sizeof(struct in_addr)); + SHA512Update(&ctx, (char *)&pd->dst->v4, sizeof(struct in_addr)); break; #endif /* INET */ #ifdef INET6 case AF_INET6: - MD5Update(&ctx, (char *)&pd->src->v6, sizeof(struct in6_addr)); - MD5Update(&ctx, (char *)&pd->dst->v6, sizeof(struct in6_addr)); + SHA512Update(&ctx, (char *)&pd->src->v6, sizeof(struct in6_addr)); + SHA512Update(&ctx, (char *)&pd->dst->v6, sizeof(struct in6_addr)); break; #endif /* INET6 */ } - MD5Final((u_char *)digest, &ctx); + SHA512Final(digest.bytes, &ctx); pf_tcp_iss_off += 4096; - return (digest[0] + tcp_iss + pf_tcp_iss_off); + return (digest.words[0] + tcp_iss + pf_tcp_iss_off); } void |