Tue Mar 7 20:17:12 2017 UTC ()
Apply patch (requested by mrg in ticket #1380):
Use arc4random when available to produce the auth cookie.
(80f62c54fbd50a3bbdf9c37258525098c9117830 upstream)


(snj)
diff -r1.1.1.5 -r1.1.1.5.40.1 xsrc/xfree/xc/lib/ICE/iceauth.c

cvs diff -r1.1.1.5 -r1.1.1.5.40.1 xsrc/xfree/xc/lib/ICE/Attic/iceauth.c (switch to unified diff)

--- xsrc/xfree/xc/lib/ICE/Attic/iceauth.c 2003/02/28 13:18:45 1.1.1.5
+++ xsrc/xfree/xc/lib/ICE/Attic/iceauth.c 2017/03/07 20:17:12 1.1.1.5.40.1
@@ -1,275 +1,284 @@ @@ -1,275 +1,284 @@
1/* $Xorg: iceauth.c,v 1.4 2001/02/09 02:03:26 xorgcvs Exp $ */ 1/* $Xorg: iceauth.c,v 1.4 2001/02/09 02:03:26 xorgcvs Exp $ */
2/****************************************************************************** 2/******************************************************************************
3 3
4 4
5Copyright 1993, 1998 The Open Group 5Copyright 1993, 1998 The Open Group
6 6
7Permission to use, copy, modify, distribute, and sell this software and its 7Permission to use, copy, modify, distribute, and sell this software and its
8documentation for any purpose is hereby granted without fee, provided that 8documentation for any purpose is hereby granted without fee, provided that
9the above copyright notice appear in all copies and that both that 9the above copyright notice appear in all copies and that both that
10copyright notice and this permission notice appear in supporting 10copyright notice and this permission notice appear in supporting
11documentation. 11documentation.
12 12
13The above copyright notice and this permission notice shall be included in 13The above copyright notice and this permission notice shall be included in
14all copies or substantial portions of the Software. 14all copies or substantial portions of the Software.
15 15
16THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN 19OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
20AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 20AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 21CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
22 22
23Except as contained in this notice, the name of The Open Group shall not be 23Except as contained in this notice, the name of The Open Group shall not be
24used in advertising or otherwise to promote the sale, use or other dealings 24used in advertising or otherwise to promote the sale, use or other dealings
25in this Software without prior written authorization from The Open Group. 25in this Software without prior written authorization from The Open Group.
26 26
27Author: Ralph Mor, X Consortium 27Author: Ralph Mor, X Consortium
28******************************************************************************/ 28******************************************************************************/
29/* $XFree86: xc/lib/ICE/iceauth.c,v 3.6 2002/05/31 18:45:41 dawes Exp $ */ 29/* $XFree86: xc/lib/ICE/iceauth.c,v 3.6 2002/05/31 18:45:41 dawes Exp $ */
30 30
31#include <X11/ICE/ICElib.h> 31#include <X11/ICE/ICElib.h>
32#include "ICElibint.h" 32#include "ICElibint.h"
33#include <X11/ICE/ICEutil.h> 33#include <X11/ICE/ICEutil.h>
34 34
35#include <time.h> 35#include <time.h>
36#define Time_t time_t 36#define Time_t time_t
37 37
38static int binaryEqual (); 38static int binaryEqual ();
39 39
 40#ifdef HAVE_LIBBSD
 41#include <bsd/stdlib.h> /* for arc4random_buf() */
 42#endif
 43
40static int was_called_state; 44static int was_called_state;
41 45
42/* 46/*
43 * MIT-MAGIC-COOKIE-1 is a sample authentication method implemented by 47 * MIT-MAGIC-COOKIE-1 is a sample authentication method implemented by
44 * the SI. It is not part of standard ICElib. 48 * the SI. It is not part of standard ICElib.
45 */ 49 */
46 50
47  51
48char * 52char *
49IceGenerateMagicCookie (len) 53IceGenerateMagicCookie (len)
50 54
51int len; 55int len;
52 56
53{ 57{
54 char *auth; 58 char *auth;
 59#ifndef HAVE_ARC4RANDOM_BUF
55 long ldata[2]; 60 long ldata[2];
56 int seed; 61 int seed;
57 int value; 62 int value;
58 int i; 63 int i;
 64#endif
59  65
60 if ((auth = (char *) malloc (len + 1)) == NULL) 66 if ((auth = (char *) malloc (len + 1)) == NULL)
61 return (NULL); 67 return (NULL);
62 68
 69#ifdef HAVE_ARC4RANDOM_BUF
 70 arc4random_buf(auth, len);
 71#else
63#ifdef ITIMER_REAL 72#ifdef ITIMER_REAL
64 { 73 {
65 struct timeval now; 74 struct timeval now;
66 X_GETTIMEOFDAY (&now); 75 X_GETTIMEOFDAY (&now);
67 ldata[0] = now.tv_sec; 76 ldata[0] = now.tv_sec;
68 ldata[1] = now.tv_usec; 77 ldata[1] = now.tv_usec;
69 } 78 }
70#else 79#else
71 { 80 {
72#ifndef __UNIXOS2__ 81#ifndef __UNIXOS2__
73 long time (); 82 long time ();
74#endif 83#endif
75 ldata[0] = time ((long *) 0); 84 ldata[0] = time ((long *) 0);
76 ldata[1] = getpid (); 85 ldata[1] = getpid ();
77 } 86 }
78#endif 87#endif
79 seed = (ldata[0]) + (ldata[1] << 16); 88 seed = (ldata[0]) + (ldata[1] << 16);
80 srand (seed); 89 srand (seed);
81 for (i = 0; i < len; i++) 90 for (i = 0; i < len; i++)
82 { 91 {
83 value = rand (); 92 value = rand ();
84 auth[i] = value & 0xff; 93 auth[i] = value & 0xff;
85 } 94 }
 95#endif
86 auth[len] = '\0'; 96 auth[len] = '\0';
87 
88 return (auth); 97 return (auth);
89} 98}
90 99
91 100
92  101
93IcePoAuthStatus 102IcePoAuthStatus
94_IcePoMagicCookie1Proc (iceConn, authStatePtr, cleanUp, swap, 103_IcePoMagicCookie1Proc (iceConn, authStatePtr, cleanUp, swap,
95 authDataLen, authData, replyDataLenRet, replyDataRet, errorStringRet) 104 authDataLen, authData, replyDataLenRet, replyDataRet, errorStringRet)
96 105
97IceConn iceConn; 106IceConn iceConn;
98IcePointer *authStatePtr; 107IcePointer *authStatePtr;
99Bool cleanUp; 108Bool cleanUp;
100Bool swap; 109Bool swap;
101int authDataLen; 110int authDataLen;
102IcePointer authData; 111IcePointer authData;
103int *replyDataLenRet; 112int *replyDataLenRet;
104IcePointer *replyDataRet; 113IcePointer *replyDataRet;
105char **errorStringRet; 114char **errorStringRet;
106 115
107{ 116{
108 if (cleanUp) 117 if (cleanUp)
109 { 118 {
110 /* 119 /*
111 * We didn't allocate any state. We're done. 120 * We didn't allocate any state. We're done.
112 */ 121 */
113 122
114 return (IcePoAuthDoneCleanup); 123 return (IcePoAuthDoneCleanup);
115 } 124 }
116 125
117 *errorStringRet = NULL; 126 *errorStringRet = NULL;
118 127
119 if (*authStatePtr == NULL) 128 if (*authStatePtr == NULL)
120 { 129 {
121 /* 130 /*
122 * This is the first time we're being called. Search the 131 * This is the first time we're being called. Search the
123 * authentication data for the first occurence of 132 * authentication data for the first occurence of
124 * MIT-MAGIC-COOKIE-1 that matches iceConn->connection_string. 133 * MIT-MAGIC-COOKIE-1 that matches iceConn->connection_string.
125 */ 134 */
126 135
127 unsigned short length; 136 unsigned short length;
128 char *data; 137 char *data;
129 138
130 _IceGetPoAuthData ("ICE", iceConn->connection_string, 139 _IceGetPoAuthData ("ICE", iceConn->connection_string,
131 "MIT-MAGIC-COOKIE-1", &length, &data); 140 "MIT-MAGIC-COOKIE-1", &length, &data);
132 141
133 if (!data) 142 if (!data)
134 { 143 {
135 char *tempstr = 144 char *tempstr =
136 "Could not find correct MIT-MAGIC-COOKIE-1 authentication"; 145 "Could not find correct MIT-MAGIC-COOKIE-1 authentication";
137 146
138 *errorStringRet = (char *) malloc (strlen (tempstr) + 1); 147 *errorStringRet = (char *) malloc (strlen (tempstr) + 1);
139 if (*errorStringRet) 148 if (*errorStringRet)
140 strcpy (*errorStringRet, tempstr); 149 strcpy (*errorStringRet, tempstr);
141 150
142 return (IcePoAuthFailed); 151 return (IcePoAuthFailed);
143 } 152 }
144 else 153 else
145 { 154 {
146 *authStatePtr = (IcePointer) &was_called_state; 155 *authStatePtr = (IcePointer) &was_called_state;
147 156
148 *replyDataLenRet = length; 157 *replyDataLenRet = length;
149 *replyDataRet = data; 158 *replyDataRet = data;
150 159
151 return (IcePoAuthHaveReply); 160 return (IcePoAuthHaveReply);
152 } 161 }
153 } 162 }
154 else 163 else
155 { 164 {
156 /* 165 /*
157 * We should never get here for MIT-MAGIC-COOKIE-1 since it is 166 * We should never get here for MIT-MAGIC-COOKIE-1 since it is
158 * a single pass authentication method. 167 * a single pass authentication method.
159 */ 168 */
160 169
161 char *tempstr = "MIT-MAGIC-COOKIE-1 authentication internal error"; 170 char *tempstr = "MIT-MAGIC-COOKIE-1 authentication internal error";
162 171
163 *errorStringRet = (char *) malloc (strlen (tempstr) + 1); 172 *errorStringRet = (char *) malloc (strlen (tempstr) + 1);
164 if (*errorStringRet) 173 if (*errorStringRet)
165 strcpy (*errorStringRet, tempstr); 174 strcpy (*errorStringRet, tempstr);
166 175
167 return (IcePoAuthFailed); 176 return (IcePoAuthFailed);
168 } 177 }
169} 178}
170 179
171 180
172 181
173IcePaAuthStatus 182IcePaAuthStatus
174_IcePaMagicCookie1Proc (iceConn, authStatePtr, swap, 183_IcePaMagicCookie1Proc (iceConn, authStatePtr, swap,
175 authDataLen, authData, replyDataLenRet, replyDataRet, errorStringRet) 184 authDataLen, authData, replyDataLenRet, replyDataRet, errorStringRet)
176 185
177IceConn iceConn; 186IceConn iceConn;
178IcePointer *authStatePtr; 187IcePointer *authStatePtr;
179Bool swap; 188Bool swap;
180int authDataLen; 189int authDataLen;
181IcePointer authData; 190IcePointer authData;
182int *replyDataLenRet; 191int *replyDataLenRet;
183IcePointer *replyDataRet; 192IcePointer *replyDataRet;
184char **errorStringRet; 193char **errorStringRet;
185 194
186{ 195{
187 *errorStringRet = NULL; 196 *errorStringRet = NULL;
188 *replyDataLenRet = 0; 197 *replyDataLenRet = 0;
189 *replyDataRet = NULL; 198 *replyDataRet = NULL;
190 199
191 if (*authStatePtr == NULL) 200 if (*authStatePtr == NULL)
192 { 201 {
193 /* 202 /*
194 * This is the first time we're being called. We don't have 203 * This is the first time we're being called. We don't have
195 * any data to pass to the other client. 204 * any data to pass to the other client.
196 */ 205 */
197 206
198 *authStatePtr = (IcePointer) &was_called_state; 207 *authStatePtr = (IcePointer) &was_called_state;
199 208
200 return (IcePaAuthContinue); 209 return (IcePaAuthContinue);
201 } 210 }
202 else 211 else
203 { 212 {
204 /* 213 /*
205 * Search the authentication data for the first occurence of 214 * Search the authentication data for the first occurence of
206 * MIT-MAGIC-COOKIE-1 that matches iceConn->connection_string. 215 * MIT-MAGIC-COOKIE-1 that matches iceConn->connection_string.
207 */ 216 */
208 217
209 unsigned short length; 218 unsigned short length;
210 char *data; 219 char *data;
211 220
212 _IceGetPaAuthData ("ICE", iceConn->connection_string, 221 _IceGetPaAuthData ("ICE", iceConn->connection_string,
213 "MIT-MAGIC-COOKIE-1", &length, &data); 222 "MIT-MAGIC-COOKIE-1", &length, &data);
214 223
215 if (data) 224 if (data)
216 { 225 {
217 IcePaAuthStatus stat; 226 IcePaAuthStatus stat;
218 227
219 if (authDataLen == length && 228 if (authDataLen == length &&
220 binaryEqual ((char *) authData, data, authDataLen)) 229 binaryEqual ((char *) authData, data, authDataLen))
221 { 230 {
222 stat = IcePaAuthAccepted; 231 stat = IcePaAuthAccepted;
223 } 232 }
224 else 233 else
225 { 234 {
226 char *tempstr = "MIT-MAGIC-COOKIE-1 authentication rejected"; 235 char *tempstr = "MIT-MAGIC-COOKIE-1 authentication rejected";
227 236
228 *errorStringRet = (char *) malloc (strlen (tempstr) + 1); 237 *errorStringRet = (char *) malloc (strlen (tempstr) + 1);
229 if (*errorStringRet) 238 if (*errorStringRet)
230 strcpy (*errorStringRet, tempstr); 239 strcpy (*errorStringRet, tempstr);
231 240
232 stat = IcePaAuthRejected; 241 stat = IcePaAuthRejected;
233 } 242 }
234 243
235 free (data); 244 free (data);
236 return (stat); 245 return (stat);
237 } 246 }
238 else 247 else
239 { 248 {
240 /* 249 /*
241 * We should never get here because in the ConnectionReply 250 * We should never get here because in the ConnectionReply
242 * we should have passed all the valid methods. So we should 251 * we should have passed all the valid methods. So we should
243 * always find a valid entry. 252 * always find a valid entry.
244 */ 253 */
245 254
246 char *tempstr = 255 char *tempstr =
247 "MIT-MAGIC-COOKIE-1 authentication internal error"; 256 "MIT-MAGIC-COOKIE-1 authentication internal error";
248 257
249 *errorStringRet = (char *) malloc (strlen (tempstr) + 1); 258 *errorStringRet = (char *) malloc (strlen (tempstr) + 1);
250 if (*errorStringRet) 259 if (*errorStringRet)
251 strcpy (*errorStringRet, tempstr); 260 strcpy (*errorStringRet, tempstr);
252 261
253 return (IcePaAuthFailed); 262 return (IcePaAuthFailed);
254 } 263 }
255 } 264 }
256} 265}
257 266
258 267
259  268
260/* 269/*
261 * local routines 270 * local routines
262 */ 271 */
263 272
264static int 273static int
265binaryEqual (a, b, len) 274binaryEqual (a, b, len)
266 275
267register char *a, *b; 276register char *a, *b;
268register unsigned len; 277register unsigned len;
269 278
270{ 279{
271 while (len--) 280 while (len--)
272 if (*a++ != *b++) 281 if (*a++ != *b++)
273 return 0; 282 return 0;
274 return 1; 283 return 1;
275} 284}