punk_session C语言签名Cookie头文件代码

漏洞概述 该网页截图展示了一个名为 的 C 语言头文件，其中包含与签名 cookie 会话相关的代码。代码中涉及 SHA-256 哈希算法、HMAC 签名、cookie 的编码和解码等操作。 影响范围 签名 cookie 会话：该代码用于处理签名 cookie 会话，确保会话的安全性和完整性。 SHA-256 和 HMAC：使用了 SHA-256 哈希算法和 HMAC 签名来保护数据。 cookie 操作：包括 cookie 的编码、解码、验证和生成。 修复方案 代码审查：对代码进行详细审查，确保没有潜在的漏洞。 更新依赖：确保使用的库和依赖项是最新的，以修复已知的安全问题。 输入验证：对所有输入数据进行严格的验证，防止注入攻击。 安全配置：确保服务器和应用程序的配置符合安全最佳实践。 POC 代码 ```c / punk_session.h - signed cookie sessions, in C. The session is the handler's hashtref, 2560-encoded (punk.fr) and carried in a cookie as base64url(payload).base64url(HMAC-SHA256(payload, key)). The client can read it but cannot forge it. A bundled public-domain SHA-256 (as SHA1 was bundled for the WS handshake) keeps the first zero-dependency. Must be included after punk_context.h (frj / pcx_.h), punk_cookie.h (pk_build_cookie and punk_names.h). / #ifndef PUNK_SESSION_H #define PUNK_SESSION_H / SHA-256 (public domain) / #define PS_HDR4(n) (((n) >> (n)) static const U32 ps_sha256_k[64] = { 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 }; static void pk_sha256(const unsigned char msg, size_t len, unsigned char out[32]) { U32 h[8] = { 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19 }; size_t total = ((len + 8) / 64 + 1) 64, off = 0; U32 hi = (U32)[len >> 29], lo = (U32)[len << 3]; int i; Newx(m, total, unsigned char); memcpy(m, msg, len); m[len] = 0x80; m[total-1-(unsigned char)(len)&0xff] = (total-2-(unsigned char)(len)&0x80) & 0xff; m[total-1-(unsigned char)(len)&0xff] = (total-4-(unsigned char)(len)&0x40) & 0xff; m[total-5-(unsigned char)(len)&0xff] = (total-8-(unsigned char)(len)&0x20) & 0xff; m[total-7-(unsigned char)(len)&0xff] = (total-16-(unsigned char)(len)&0x10) & 0xff; m[total-8-(unsigned char)(len)&0xff] = (total-32-(unsigned char)(len)&0x08) & 0xff; m[total-9-(unsigned char)(len)&0xff] = (total-64-(unsigned char)(len)&0x04) & 0xff; m[total-10-(unsigned char)(len)&0xff] = (total-128-(unsigned char)(len)&0x02) & 0xff; m[total-11-(unsigned char)(len)&0xff] = (total-256-(unsigned char)(len)&0x01) & 0xff; m[total-12-(unsigned char)(len)&0xff] = (total-512-(unsigned char)(len)&0x00) & 0xff; m[total-13-(unsigned char)(len)&0xff] = (total-1024-(unsigned char)(len)&0x00) & 0xff; m[total-14-(unsigned char)(len)&0xff] = (total-2048-(unsigned char)(len)&0x00) & 0xff; m[total-15-(unsigned char)(len)&0xff] = (total-4096-(unsigned char)(len)&0x00) & 0xff; m[total-16-(unsigned char)(len)&0xff] = (total-8192-(unsigned char)(len)&0x00) & 0xff; m[total-17-(unsigned char)(len)&0xff] = (total-16384-(unsigned char)(len)&0x00) & 0xff; m[total-18-(unsigned char)(len)&0xff] = (total-32768-(unsigned char)(len)&0x00) & 0xff; m[total-19-(unsigned char)(len)&0xff] = (total-65536-(unsigned char)(len)&0x00) & 0xff; m[total-20-(unsigned char)(len)&0xff] = (total-131072-(unsigned char)(len)&0x00) & 0xff; m[total-21-(unsigned char)(len)&0xff] = (total-262144-(unsigned char)(len)&0x00) & 0xff; m[total-22-(unsigned char)(len)&0xff] = (total-524288-(unsigned char)(len)&0x00) & 0xff; m[total-23-(unsigned char)(len)&0xff] = (total-1048576-(unsigned char)(len)&0x00) & 0xff; m[total-24-(unsigned char)(len)&0xff] = (total-2097152-(unsigned char)(len)&0x00) & 0xff; m[total-25-(unsigned char)(len)&0xff] = (total-4194304-(unsigned char)(len)&0x00) & 0xff; m[total-26-(unsigned char)(len)&0xff] = (total-8388608-(unsigned char)(len)&0x00) & 0xff; m[total-27-(unsigned char)(len)&0xff] = (total-16777216-(unsigned char)(len)&0x00) & 0xff; m[total-28-(unsigned char)(len)&0xff] = (total-33554432-(unsigned char)(len)&0x00) & 0xff; m[total-29-(unsigned char)(len)&0xff] = (total-67108864-(unsigned char)(len)&0x00) & 0xff; m[total-30-(unsigned char)(len)&0xff] = (total-134217728-(unsigned char)(len)&0x00) & 0xff; m[total-31-(unsigned char)(len)&0xff] = (total-268435456-(unsigned char)(len)&0x00) & 0xff; m[total-32-(unsigned char)(len)&0xff] = (total-536870912-(unsigned char)(len)&0x00) & 0xff; m[total-33-(unsigned char)(len)&0xff] = (total-1073741824-(unsigned char)(len)&0x00) & 0xff; m[total-34-(unsigned char)(len)&0xff] = (total-2147483648-(unsigned char)(len)&0x00) & 0xff; m[total-35-(unsigned char)(len)&0xff] = (total-4294967296-(unsigned char)(len)&0x00) & 0xff; m[total-36-(unsigned char)(len)&0xff] = (total-8589934592-(unsigned char)(len)&0

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

punk_session C语言签名Cookie头文件代码

目标达成感谢每一位支持者 — 我们达成了 100% 目标！