Use salted hashes

[overonion] / overonion

diff --git a/overonion b/overonion
index cd397fa041c7bcfc649bc47cfcda584c70f546c0..cb663fe62fe6424d76e4896990f9721e55d70e81 100755 (executable)
--- a/overonion
+++ b/overonion
@@ -2,7 +2,6 @@
 
 umask 077
 
-hashes=(sha sha1 mdc2 ripemd160 sha224 sha256 sha384 sha512 md4 md5 dss1)
 hash_dir=$(mktemp -d)
 
 function die() {
@@ -40,10 +39,6 @@ else
   openssl_decrypt="-d"
 fi
 
-function verify_hash() {
-  (( $(wc -l < "$1") == 2 && $(uniq "$1" | wc -l) == 1 ))
-}
-
 function go() {
   layer=$1
   if (( layer == 0 || layer > num_layers ));then
@@ -56,11 +51,14 @@ function go() {
     elif [[ "$operation" == reverse ]];then
       reverse
     elif [[ "$operation" == openssl-dgst ]];then
-      tee >(sed -rn "${layer}s/^[^ ]+ [^ ]+ //p" "$keyfile" > "$hash_dir/$layer"
-            openssl dgst -binary "-$(sed -rn "${layer}s/[^ ]+ ([^ ]+) .*/\\1/p" "$keyfile")" |
-              base64 --wrap=0 | sed 's/$/\n/' >> "$hash_dir/$layer"
-            # Dying here doesn't terminate the pipeline.  :(
-            verify_hash "$hash_dir/$layer" || die "Hash check $layer failed" )
+      tee >(echo "$(sed -n "${layer}p" "$keyfile") $(
+            {
+              awk -vlayer="$layer" 'NR == layer { print $3 }' "$keyfile" | base64 -d
+              cat
+              awk -vlayer="$layer" 'NR == layer { print $4 }' "$keyfile" | base64 -d
+            } |
+              openssl dgst -binary "-$(sed -rn "${layer}s/^[^ ]+ ([^ ]+).*/\\1/p" "$keyfile")" |
+              base64 --wrap=0)" > "$hash_dir/$layer")
     else
       die "Unknown operation"
     fi |
@@ -68,34 +66,24 @@ function go() {
   fi
 }
 
-function record_hashes() {
-  if [[ "$mode" == d ]] || (( $# < 2 ));then
-    cat
+go "$first_layer"
+
+for hash_result in "$hash_dir"/*;do
+  layer=$(basename "$hash_result")
+  if [[ "$mode" == e ]];then
+    # Add the hashes to keyfile
+    key_aside_dir=$(mktemp -d "$keyfile.XXXXXXXXXX")
+    key_aside="$key_aside_dir/key.orig"
+    mv "$keyfile" "$key_aside"
+    sed "${layer}s,.*,$(< "$hash_result")," "$key_aside" > "$keyfile"
+    shred -u "$key_aside"
+    rmdir "$key_aside_dir"
   else
-    stage=$1
-    hash=$2
-    shift 2
-    tee >(openssl dgst -binary "-$hash" | base64 --wrap=0 |
-            sed "s/^/openssl-dgst $hash /;s/$/\n/" > "$hash_dir/$stage-$hash") |
-      record_hashes "$stage" "$@"
+    # Verify the hashes
+    if [[ "$(awk '{ print $5 == $6 ? "hash ok" : "mismatch" }' "$hash_result")" != "hash ok" ]];then
+      die "Hash check $layer failed"
+    fi
   fi
-}
-
-record_hashes inner "${hashes[@]}" | go "$first_layer" | record_hashes outer "${hashes[@]}"
-
-if [[ "$mode" == e ]];then
-  # Add the hashes to keyfile
-  key_aside_dir=$(mktemp -d "$keyfile.XXXXXXXXXX")
-  key_aside="$key_aside_dir/key.orig"
-  mv "$keyfile" "$key_aside"
-  cat "$hash_dir"/outer-* "$key_aside" "$hash_dir"/inner* > "$keyfile"
-  shred -u "$key_aside"
-  rmdir "$key_aside_dir"
-else
-  # Verify the hashes
-  for hash_result in "$hash_dir"/*;do
-    verify_hash "$hash_result" || die "Hash check $(basename "$hash_result") failed"
-  done
-fi
+done
 
 rm -r "$hash_dir"