From d9b2ac6767f85927a26e2b95bba69c052ac503ac Mon Sep 17 00:00:00 2001
From: Guus Sliepen <guus@tinc-vpn.org>
Date: Thu, 5 Nov 2009 00:01:25 +0100
Subject: [PATCH] Handle truncated message authentication codes with gcrypt.

Commit 4124b9682f8f890acb25d0c92f2583eef670274a did not update the gcrypt
backend.
---
 src/gcrypt/digest.c | 37 +++++++++++++++++++++++++------------
 src/gcrypt/digest.h |  8 ++++----
 2 files changed, 29 insertions(+), 16 deletions(-)

diff --git a/src/gcrypt/digest.c b/src/gcrypt/digest.c
index 4e180589..34f9d280 100644
--- a/src/gcrypt/digest.c
+++ b/src/gcrypt/digest.c
@@ -73,18 +73,25 @@ static bool digesttonid(int algo, int *nid) {
 	return false;
 }
 
-static bool digest_open(digest_t *digest, int algo) {
+static bool digest_open(digest_t *digest, int algo, int maclength) {
 	if(!digesttonid(algo, &digest->nid)) {
 		logger(LOG_DEBUG, "Digest %d has no corresponding nid!", algo);
 		return false;
 	}
 
-	digest->len = gcry_md_get_algo_dlen(algo);
+	unsigned int len = gcry_md_get_algo_dlen(algo);
+
+	if(maclength > len || maclength < 0)
+		digest->maclength = len;
+	else
+		digest->maclength = maclength;
+	
+	digest->algo = algo;
 
 	return true;
 }
 
-bool digest_open_by_name(digest_t *digest, const char *name) {
+bool digest_open_by_name(digest_t *digest, const char *name, int maclength) {
 	int algo;
 
 	if(!nametodigest(name, &algo)) {
@@ -92,10 +99,10 @@ bool digest_open_by_name(digest_t *digest, const char *name) {
 		return false;
 	}
 
-	return digest_open(digest, algo);
+	return digest_open(digest, algo, maclength);
 }
 
-bool digest_open_by_nid(digest_t *digest, int nid) {
+bool digest_open_by_nid(digest_t *digest, int nid, int maclength) {
 	int algo;
 
 	if(!nidtodigest(nid, &algo)) {
@@ -103,26 +110,32 @@ bool digest_open_by_nid(digest_t *digest, int nid) {
 		return false;
 	}
 
-	return digest_open(digest, algo);
+	return digest_open(digest, algo, maclength);
 }
 
-bool digest_open_sha1(digest_t *digest) {
-	return digest_open(digest, GCRY_MD_SHA1);
+bool digest_open_sha1(digest_t *digest, int maclength) {
+	return digest_open(digest, GCRY_MD_SHA1, maclength);
 }
 
 void digest_close(digest_t *digest) {
 }
 
 bool digest_create(digest_t *digest, const void *indata, size_t inlen, void *outdata) {
-	gcry_md_hash_buffer(digest->algo, outdata, indata, inlen);
+	unsigned int len = gcry_md_get_algo_dlen(digest->algo);
+	char tmpdata[len];
+
+	gcry_md_hash_buffer(digest->algo, tmpdata, indata, inlen);
+	memcpy(outdata, tmpdata, digest->maclength);
+
 	return true;
 }
 
 bool digest_verify(digest_t *digest, const void *indata, size_t inlen, const void *cmpdata) {
-	char outdata[digest->len];
+	unsigned int len = gcry_md_get_algo_dlen(digest->algo);
+	char outdata[len];
 
 	gcry_md_hash_buffer(digest->algo, outdata, indata, inlen);
-	return !memcmp(cmpdata, outdata, digest->len);
+	return !memcmp(cmpdata, outdata, digest->maclength);
 }
 
 int digest_get_nid(const digest_t *digest) {
@@ -130,7 +143,7 @@ int digest_get_nid(const digest_t *digest) {
 }
 
 size_t digest_length(const digest_t *digest) {
-	return digest->len;
+	return digest->maclength;
 }
 
 bool digest_active(const digest_t *digest) {
diff --git a/src/gcrypt/digest.h b/src/gcrypt/digest.h
index 6b9b97f7..f70fecce 100644
--- a/src/gcrypt/digest.h
+++ b/src/gcrypt/digest.h
@@ -27,12 +27,12 @@
 typedef struct digest {
 	int algo;
 	int nid;
-	uint16_t len;
+	int maclength;
 } digest_t;
 
-extern bool digest_open_by_name(struct digest *, const char *);
-extern bool digest_open_by_nid(struct digest *, int);
-extern bool digest_open_sha1(struct digest *);
+extern bool digest_open_by_name(struct digest *, const char *name, int maclength);
+extern bool digest_open_by_nid(struct digest *, int nid, int maclength);
+extern bool digest_open_sha1(struct digest *, int maclength);
 extern void digest_close(struct digest *);
 extern bool digest_create(struct digest *, const void *indata, size_t inlen, void *outdata);
 extern bool digest_verify(struct digest *, const void *indata, size_t inlen, const void *digestdata);
-- 
2.39.5