Store NM between encrypt/decrypt.

diff --git a/src/libcryptobox/cryptobox.c b/src/libcryptobox/cryptobox.c
index 5e344d46c91ee9a651444a8ca7f8af6a0c6cc04b..3169c01a04e796a9064cbd2200d9901fcf4e06c3 100644 (file)
--- a/src/libcryptobox/cryptobox.c
+++ b/src/libcryptobox/cryptobox.c
@@ -392,7 +392,7 @@ rspamd_cryptobox_siphash (unsigned char *out, const unsigned char *in,
  * Code based on IEEE Std 802.11-2007, Annex H.4.2.
  */
 gboolean
-rspamd_cryptobox_pbkdf(const char *pass, gsize pass_len,
+rspamd_cryptobox_pbkdf (const char *pass, gsize pass_len,
                const guint8 *salt, gsize salt_len, guint8 *key, gsize key_len,
                unsigned int rounds)
 {

diff --git a/src/libutil/http.c b/src/libutil/http.c
index 612e898bb2189d29d0e97f46728233585a20b2eb..2f618164a33e4ed90ebe03a9a7bccf1c2e0535ee 100644 (file)
--- a/src/libutil/http.c
+++ b/src/libutil/http.c
@@ -441,7 +441,7 @@ rspamd_http_parse_key (rspamd_ftok_t *data, struct rspamd_http_connection *conn,
                                                key_len >= sizeof (kp->pk)) {
                                        if (memcmp (priv->local_key->id, decoded_id,
                                                        RSPAMD_HTTP_KEY_ID_LEN) == 0) {
-                                               kp = g_slice_alloc (sizeof (*kp));
+                                               kp = g_slice_alloc0 (sizeof (*kp));
                                                REF_INIT_RETAIN (kp, rspamd_http_keypair_dtor);
                                                memcpy (kp->pk, decoded_key, sizeof (kp->pk));
                                                priv->msg->peer_key = kp;
@@ -688,20 +688,16 @@ rspamd_http_decrypt_message (struct rspamd_http_connection *conn,
        dec_len = msg->body->len - rspamd_cryptobox_NONCEBYTES -
                        rspamd_cryptobox_MACBYTES;
 
-       if (conn->cache) {
-               if (!rspamd_cryptobox_decrypt_nm_inplace (m, dec_len, nonce,
-                               peer_key->nm, m - rspamd_cryptobox_MACBYTES)) {
-                       msg_err ("cannot verify encrypted message");
-                       return -1;
-               }
+       if (!peer_key->has_nm) {
+               /* We still save NM for the following encryption */
+               rspamd_cryptobox_nm (peer_key->nm, peer_key->pk, priv->local_key->sk);
+               peer_key->has_nm = TRUE;
        }
-       else {
-               if (!rspamd_cryptobox_decrypt_inplace (m, dec_len, nonce,
-                               peer_key->pk, priv->local_key->sk,
-                               m - rspamd_cryptobox_MACBYTES)) {
-                       msg_err ("cannot verify encrypted message");
-                       return -1;
-               }
+
+       if (!rspamd_cryptobox_decrypt_nm_inplace (m, dec_len, nonce,
+                       peer_key->nm, m - rspamd_cryptobox_MACBYTES)) {
+               msg_err ("cannot verify encrypted message");
+               return -1;
        }
 
        /* Cleanup message */
@@ -1229,17 +1225,15 @@ rspamd_http_connection_encrypt_message (
 
        cnt = i;
 
-       if (conn->cache) {
-               rspamd_cryptobox_encryptv_nm_inplace (segments,
+       if (!peer_key->has_nm) {
+               rspamd_cryptobox_nm (peer_key->nm, peer_key->pk, priv->local_key->sk);
+               peer_key->has_nm = TRUE;
+       }
+
+       rspamd_cryptobox_encryptv_nm_inplace (segments,
                        cnt,
                        np,
                        peer_key->nm, mp);
-       }
-       else {
-               rspamd_cryptobox_encryptv_inplace (segments,
-                               cnt, np,
-                               peer_key->pk, priv->local_key->sk, mp);
-       }
 
        /*
         * iov[0] = base HTTP request
@@ -2384,7 +2378,7 @@ rspamd_http_connection_make_peer_key (const gchar *key)
        pk_decoded = rspamd_decode_base32 (key, strlen (key), &dec_len);
 
        if (pk_decoded != NULL && dec_len == rspamd_cryptobox_PKBYTES) {
-               kp = g_slice_alloc (sizeof (*kp));
+               kp = g_slice_alloc0 (sizeof (*kp));
                REF_INIT_RETAIN (kp, rspamd_http_keypair_dtor);
                memcpy (kp->pk, pk_decoded, sizeof (kp->pk));
                blake2b (kp->id, kp->pk, NULL, sizeof (kp->id), sizeof (kp->pk), 0);

diff --git a/src/libutil/keypair_private.h b/src/libutil/keypair_private.h
index 70f9bad59498918a7ff68d0e8cad58021fcab562..ac70f25e65481499d7ae263a63807bb569f6bf0f 100644 (file)
--- a/src/libutil/keypair_private.h
+++ b/src/libutil/keypair_private.h
@@ -35,6 +35,7 @@ struct rspamd_http_keypair {
        guchar sk[rspamd_cryptobox_SKBYTES];
        guchar id[BLAKE2B_OUTBYTES];
        guchar nm[rspamd_cryptobox_NMBYTES];
+       gboolean has_nm;
        ref_entry_t ref;
 };
 

diff --git a/src/libutil/keypairs_cache.c b/src/libutil/keypairs_cache.c
index c10c6959d8e9cbfabb7fa8d0f7b5f1f4e7bde56f..eb9b5215c26c2bb016a42e5b73b25c50481b32fb 100644 (file)
--- a/src/libutil/keypairs_cache.c
+++ b/src/libutil/keypairs_cache.c
@@ -107,6 +107,7 @@ rspamd_keypair_cache_process (struct rspamd_keypair_cache *c,
        g_assert (new != NULL);
 
        memcpy (kp_remote->nm, new->nm, rspamd_cryptobox_NMBYTES);
+       kp_remote->has_nm = TRUE;
 #if 0
        memcpy (kp_local->nm, new->nm, rspamd_cryptobox_NMBYTES);
 #endif