/* Portions of this file are subject to the following copyright(s).  See

 * the Net-SNMP's COPYING file for more details and other copyrights

 * that may apply:

 */

/*

 * Portions of this file are copyrighted by:

 * Copyright © 2003 Sun Microsystems, Inc. All rights reserved.

 * Use is subject to license terms specified in the COPYING file

 * distributed with the Net-SNMP package.

 *

 * Portions of this file are copyrighted by:

 * Copyright (c) 2016 VMware, Inc. All rights reserved.

 * Use is subject to license terms specified in the COPYING file

 * distributed with the Net-SNMP package.

 */

/*

 * scapi.c

 *

 */

#include <net-snmp/net-snmp-config.h>

#include <net-snmp/net-snmp-features.h>

#include <sys/types.h>

#ifdef HAVE_STDLIB_H

#include <stdlib.h>

#endif

#if HAVE_STRING_H

#include <string.h>

#else

#include <strings.h>

#endif

#if TIME_WITH_SYS_TIME

# include <sys/time.h>

# include <time.h>

#else

# if HAVE_SYS_TIME_H

#  include <sys/time.h>

# else

#  include <time.h>

# endif

#endif

#ifdef HAVE_NETINET_IN_H

#include <netinet/in.h>

#endif

#if HAVE_UNISTD_H

#include <unistd.h>

#endif

#if HAVE_DMALLOC_H

#include <dmalloc.h>

#endif

#include <net-snmp/types.h>

#include <net-snmp/output_api.h>

#include <net-snmp/utilities.h>

netsnmp_feature_child_of(usm_support, libnetsnmp)

netsnmp_feature_child_of(usm_scapi, usm_support)

#ifndef NETSNMP_FEATURE_REMOVE_USM_SCAPI

#ifdef NETSNMP_USE_INTERNAL_MD5

#include <net-snmp/library/md5.h>

#endif

#include <net-snmp/library/snmp_api.h>

#include <net-snmp/library/callback.h>

#include <net-snmp/library/snmp_secmod.h>

#include <net-snmp/library/snmpusm.h>

#include <net-snmp/library/keytools.h>

#include <net-snmp/library/scapi.h>

#include <net-snmp/library/mib.h>

#include <net-snmp/library/transform_oids.h>

#ifdef NETSNMP_USE_INTERNAL_CRYPTO

#include <net-snmp/library/openssl_md5.h>

#include <net-snmp/library/openssl_sha.h>

#include <net-snmp/library/openssl_des.h>

#include <net-snmp/library/openssl_aes.h>

#endif

#ifdef NETSNMP_USE_OPENSSL

#include <openssl/hmac.h>

#include <openssl/evp.h>

#include <openssl/rand.h>

#include <openssl/des.h>

#ifdef HAVE_AES

#include <openssl/aes.h>

#endif

#ifndef NETSNMP_DISABLE_DES

#ifdef HAVE_STRUCT_DES_KS_STRUCT_WEAK_KEY

/* these are older names for newer structures that exist in openssl .9.7 */

#define DES_key_schedule    des_key_schedule 

#define DES_cblock          des_cblock 

#define DES_key_sched       des_key_sched 

#define DES_ncbc_encrypt    des_ncbc_encrypt

#define DES_cbc_encrypt    des_cbc_encrypt

#define OLD_DES

#endif

#endif

#endif /* HAVE_OPENSSL */

#ifdef NETSNMP_USE_INTERNAL_CRYPTO

#endif

#ifdef NETSNMP_USE_PKCS11

#include <security/cryptoki.h>

#endif

#ifdef QUITFUN

#undef QUITFUN

#define QUITFUN(e, l)					\

	if (e != SNMPERR_SUCCESS) {			\

		rval = SNMPERR_SC_GENERAL_FAILURE;	\

		goto l ;				\

	}

#endif

#ifdef NETSNMP_USE_INTERNAL_CRYPTO

static

int SHA1_hmac(const u_char * data, size_t len, u_char * mac, size_t maclen,

              const u_char * secret, size_t secretlen);

static

int MD5_hmac(const u_char * data, size_t len, u_char * mac, size_t maclen,

             const u_char * secret, size_t secretlen);

#endif

static netsnmp_auth_alg_info _auth_alg_info[] = {

    { NETSNMP_USMAUTH_NOAUTH, "usmNoAuthProtocol", usmNoAuthProtocol,

      OID_LENGTH(usmNoAuthProtocol), 0, 0 },

    { NETSNMP_USMAUTH_HMACSHA1, "usmHMACSHA1AuthProtocol",

      usmHMACSHA1AuthProtocol, OID_LENGTH(usmHMACSHA1AuthProtocol),

      BYTESIZE(SNMP_TRANS_AUTHLEN_HMACSHA1), USM_MD5_AND_SHA_AUTH_LEN },

#ifndef NETSNMP_DISABLE_MD5

    { NETSNMP_USMAUTH_HMACMD5, "usmHMACMD5AuthProtocol",

      usmHMACMD5AuthProtocol, OID_LENGTH(usmHMACMD5AuthProtocol),

      BYTESIZE(SNMP_TRANS_AUTHLEN_HMACMD5), USM_MD5_AND_SHA_AUTH_LEN },

#endif

#ifdef HAVE_EVP_SHA224

    { NETSNMP_USMAUTH_HMAC128SHA224, "usmHMAC128SHA224AuthProtocol",

      usmHMAC128SHA224AuthProtocol, OID_LENGTH(usmHMAC128SHA224AuthProtocol),

      BYTESIZE(SNMP_TRANS_AUTHLEN_HMAC128SHA224), USM_HMAC128SHA224_AUTH_LEN },

    { NETSNMP_USMAUTH_HMAC192SHA256, "usmHMAC192SHA256AuthProtocol",

      usmHMAC192SHA256AuthProtocol, OID_LENGTH(usmHMAC192SHA256AuthProtocol),

      BYTESIZE(SNMP_TRANS_AUTHLEN_HMAC192SHA256), USM_HMAC192SHA256_AUTH_LEN },

#endif

#ifdef HAVE_EVP_SHA384

    { NETSNMP_USMAUTH_HMAC256SHA384, "usmHMAC256SHA384AuthProtocol",

      usmHMAC256SHA384AuthProtocol, OID_LENGTH(usmHMAC256SHA384AuthProtocol),

      BYTESIZE(SNMP_TRANS_AUTHLEN_HMAC256SHA384), USM_HMAC256SHA384_AUTH_LEN },

    { NETSNMP_USMAUTH_HMAC384SHA512, "usmHMAC384SHA512AuthProtocol",

      usmHMAC384SHA512AuthProtocol, OID_LENGTH(usmHMAC384SHA512AuthProtocol),

      BYTESIZE(SNMP_TRANS_AUTHLEN_HMAC384SHA512), USM_HMAC384SHA512_AUTH_LEN },

#endif

    { -1, "unknown", NULL, 0, 0, 0 }

};

static netsnmp_priv_alg_info _priv_alg_info[] = {

    { USM_CREATE_USER_PRIV_NONE, "usmNoPrivProtocol",

      usmNoPrivProtocol, OID_LENGTH(usmNoPrivProtocol), 0, 0, 0 },

#ifndef NETSNMP_DISABLE_DES

    { USM_CREATE_USER_PRIV_DES, "usmDESPrivProtocol",

      usmDESPrivProtocol, OID_LENGTH(usmDESPrivProtocol),

      BYTESIZE(SNMP_TRANS_PRIVLEN_1DES),

      BYTESIZE(SNMP_TRANS_PRIVLEN_1DES_IV),

      BYTESIZE(SNMP_TRANS_PRIVLEN_1DES) },

#endif

#ifdef HAVE_AES

    { USM_CREATE_USER_PRIV_AES, "usmAESPrivProtocol",

      usmAESPrivProtocol, OID_LENGTH(usmAESPrivProtocol),

      BYTESIZE(SNMP_TRANS_PRIVLEN_AES),

      BYTESIZE(SNMP_TRANS_PRIVLEN_AES_IV),

      0 },

#ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04

    { USM_CREATE_USER_PRIV_AES192, "usmAES192PrivProtocol",

      usmAES192PrivProtocol, OID_LENGTH(usmAES192PrivProtocol),

      BYTESIZE(SNMP_TRANS_PRIVLEN_AES192),

      BYTESIZE(SNMP_TRANS_PRIVLEN_AES192_IV),

      0 },

    { USM_CREATE_USER_PRIV_AES192_CISCO, "usmAES192CiscoPrivProtocol",

      usmAES192CiscoPrivProtocol, OID_LENGTH(usmAES192CiscoPrivProtocol),

      BYTESIZE(SNMP_TRANS_PRIVLEN_AES192),

      BYTESIZE(SNMP_TRANS_PRIVLEN_AES192_IV),

      0 },

    { USM_CREATE_USER_PRIV_AES256, "usmAES256PrivProtocol",

      usmAES256PrivProtocol, OID_LENGTH(usmAES256PrivProtocol),

      BYTESIZE(SNMP_TRANS_PRIVLEN_AES256),

      BYTESIZE(SNMP_TRANS_PRIVLEN_AES256_IV),

      0 },

    { USM_CREATE_USER_PRIV_AES256_CISCO, "usmAES256CiscoPrivProtocol",

      usmAES256CiscoPrivProtocol, OID_LENGTH(usmAES256CiscoPrivProtocol),

      BYTESIZE(SNMP_TRANS_PRIVLEN_AES256),

      BYTESIZE(SNMP_TRANS_PRIVLEN_AES256_IV),

      0 },

#endif

#endif

    { -1, NULL, NULL, 0 , 0, 0, 0 },

};

/*

 * sc_get_priv_alg(oid *privoid, u_int len)

 *

 * returns a pointer to a netsnmp_priv_alg_info struct

 */

netsnmp_priv_alg_info *

sc_get_priv_alg_byoid(const oid *privoid, u_int len)

{

    int i = 0;

    DEBUGTRACE;

    if ((NULL == privoid) || (0 == len))

        return NULL;

    for( ; _priv_alg_info[i].type != -1; ++i) {

        if (len != _priv_alg_info[i].oid_len)

            continue;

        if (snmp_oid_compare(_priv_alg_info[i].alg_oid,

                             _priv_alg_info[i].oid_len,

                             privoid, len) == 0 )

            return(&_priv_alg_info[i]);

    }

    DEBUGMSGTL(("scapi", "no match for OID "));

    DEBUGMSGOID(("scapi", privoid, len));

    DEBUGMSG(("scapi", "\n"));

    return NULL;

}

/*

 * sc_get_priv_alg_bytype(u_int type)

 *

 * returns a pointer to a netsnmp_priv_alg_info struct

 */

netsnmp_priv_alg_info *

sc_get_priv_alg_bytype(u_int type)

{

    int i = 0;

    DEBUGTRACE;

    for( ; _priv_alg_info[i].type != -1; ++i) {

        if (type != _priv_alg_info[i].type)

            continue;

        return(&_priv_alg_info[i]);

    }

    return NULL;

}

/*

 * sc_find_auth_alg(oid *authoid, u_int len)

 *

 * returns a pointer to a netsnmp_auth_alg_info struct

 */

netsnmp_auth_alg_info *

sc_find_auth_alg_byoid(const oid *authoid, u_int len)

{

    int i = 0;

    DEBUGTRACE;

    if ((NULL == authoid) || (0 == len))

        return NULL;

    for( ; _auth_alg_info[i].type != -1; ++i) {

        if (len != _auth_alg_info[i].oid_len)

            continue;

        if (snmp_oid_compare(_auth_alg_info[i].alg_oid,

                             _auth_alg_info[i].oid_len,

                             authoid, len) == 0 )

            return(&_auth_alg_info[i]);

    }

/*    DEBUGMSGTL(("scapi", "No auth alg found for"));

      DEBUGMSGOID(("scapi", authoid, len ));*/

    return NULL;

}

/*

 * sc_get_auth_alg_byindex(u_int index)

 *

 * returns a pointer to a netsnmp_auth_alg_info struct

 */

netsnmp_auth_alg_info *

sc_get_auth_alg_byindex(u_int index)

{

    DEBUGTRACE;

    if (index >= (sizeof(_auth_alg_info)) / (sizeof(_auth_alg_info[0])) ||

        -1 == _auth_alg_info[index].type)

        return NULL;

    return(&_auth_alg_info[index]);

}

/*

 * sc_find_auth_alg_bytype(u_int type)

 *

 * returns a pointer to a netsnmp_auth_alg_info struct

 */

netsnmp_auth_alg_info *

sc_find_auth_alg_bytype(u_int type)

{

    int i = 0;

    DEBUGTRACE;

    for( ; _auth_alg_info[i].type != -1; ++i) {

        if (type != _auth_alg_info[i].type)

            continue;

        return(&_auth_alg_info[i]);

    }

    return NULL;

}

/*

 * sc_get_authtype(oid *hashtype, u_int hashtype_len):

 * 

 * Given a hashing type ("hashtype" and its length hashtype_len), return

 * its type (the last suboid). NETSNMP_USMAUTH_* constants are defined in

 * transform_oids.h.

 * 

 * Returns SNMPERR_GENERR for an unknown hashing type.

 */

int

sc_get_authtype(const oid * hashtype, u_int hashtype_len)

{

    netsnmp_auth_alg_info *aai;

    DEBUGTRACE;

    aai = sc_find_auth_alg_byoid(hashtype, hashtype_len);

    if (NULL == aai)

        return SNMPERR_GENERR;

    return aai->type;

}

int

sc_get_privtype(const oid * privtype, u_int privtype_len)

{

    netsnmp_priv_alg_info *pai;

    DEBUGTRACE;

    pai = sc_get_priv_alg_byoid(privtype, privtype_len);

    if (NULL == pai)

        return SNMPERR_GENERR;

    return pai->type;

}

/*

 * sc_get_auth_maclen(int hashtype):

 *

 * Given a hash type, return its MAC length, which may be shorter than

 * the full hash length.

 *

 * Returns 0 for an unknown hash type.

 */

int

sc_get_auth_maclen(int hashtype)

{

    netsnmp_auth_alg_info *aai;

    DEBUGTRACE;

    aai = sc_find_auth_alg_bytype(hashtype);

    if (NULL == aai)

        return 0;

    return aai->mac_length;

}

/*

 * sc_get_proper_auth_length_bytype(int hashtype):

 * 

 * Given a hashing type, return the length of the hash result.

 * 

 * Returns either the length or SNMPERR_GENERR for an unknown hashing type.

 */

int

sc_get_proper_auth_length_bytype(int hashtype)

{

    netsnmp_auth_alg_info *aai;

    DEBUGTRACE;

    aai = sc_find_auth_alg_bytype(hashtype);

    if (NULL == aai)

        return SNMPERR_GENERR;

    return aai->proper_length;

}

/*

 * sc_get_auth_oid(int hashtype, int *oid_len):

 * 

 * Given a type, return the OID and optionally set OID length.

 */

oid *

sc_get_auth_oid(int type, size_t *oid_len)

{

    netsnmp_auth_alg_info *ai;

    DEBUGTRACE;

    ai = sc_find_auth_alg_bytype(type);

    if (NULL == ai)

        return NULL;

    if (NULL != oid_len)

        *oid_len = ai->oid_len;

    return ai->alg_oid;

}

/*

 * sc_get_auth_name(int hashtype):

 * 

 * Given a type, return the name string

 */

const char*

sc_get_auth_name(int type)

{

    netsnmp_auth_alg_info *ai;

    DEBUGTRACE;

    ai = sc_find_auth_alg_bytype(type);

    if (NULL == ai)

        return NULL;

    return ai->name;

}

/*

 * sc_get_priv_oid(int type, int *oid_len):

 * 

 * Given a type, return the OID and optionally set OID length.

 */

oid *

sc_get_priv_oid(int type, size_t *oid_len)

{

    netsnmp_priv_alg_info *ai;

    DEBUGTRACE;

    ai = sc_get_priv_alg_bytype(type);

    if (NULL == ai)

        return NULL;

    if (NULL != oid_len)

        *oid_len = ai->oid_len;

    return ai->alg_oid;

}

/*

 * sc_get_properlength(oid *hashtype, u_int hashtype_len):

 * 

 * Given a hashing type ("hashtype" and its length hashtype_len), return

 * the length of the hash result.

 * 

 * Returns either the length or SNMPERR_GENERR for an unknown hashing type.

 */

int

sc_get_properlength(const oid * hashtype, u_int hashtype_len)

{

    DEBUGTRACE;

    /*

     * Determine transform type hash length.

     */

    return sc_get_proper_auth_length_bytype(

        sc_get_authtype(hashtype, hashtype_len));

}

netsnmp_feature_child_of(scapi_get_proper_priv_length, netsnmp_unused)

#ifndef NETSNMP_FEATURE_REMOVE_SCAPI_GET_PROPER_PRIV_LENGTH

int

sc_get_proper_priv_length(const oid * privtype, u_int privtype_len)

{

    netsnmp_priv_alg_info *pai;

    DEBUGTRACE;

    pai = sc_get_priv_alg_byoid(privtype, privtype_len);

    if (NULL == pai)

        return 0;

    return pai->proper_length;

}

#endif /* NETSNMP_FEATURE_REMOVE_SCAPI_GET_PROPER_PRIV_LENGTH */

/*

 * sc_get_priv_alg_byindex(u_int index)

 *

 * returns a pointer to a netsnmp_priv_alg_info struct

 */

netsnmp_priv_alg_info *

sc_get_priv_alg_byindex(u_int index)

{

    DEBUGTRACE;

    if (index >= (sizeof(_priv_alg_info)) / (sizeof(_priv_alg_info[0])) ||

        -1 == _priv_alg_info[index].type)

        return NULL;

    return(&_priv_alg_info[index]);

}

int

sc_get_proper_priv_length_bytype(int privtype)

{

    netsnmp_priv_alg_info *pai;

    DEBUGTRACE;

    pai = sc_get_priv_alg_bytype(privtype);

    if (NULL == pai)

        return 0;

    return pai->proper_length;

}

/*******************************************************************-o-******

 * sc_init

 *

 * Returns:

 *	SNMPERR_SUCCESS			Success.

 */

int

sc_init(void)

{

    int             rval = SNMPERR_SUCCESS;

#if !defined(NETSNMP_USE_OPENSSL)

#if defined(NETSNMP_USE_INTERNAL_MD5) || defined(NETSNMP_USE_INTERNAL_CRYPTO)

    struct timeval  tv;

    DEBUGTRACE;

    gettimeofday(&tv, (struct timezone *) 0);

    netsnmp_srandom((unsigned)(tv.tv_sec ^ tv.tv_usec));

#elif NETSNMP_USE_PKCS11

    DEBUGTRACE;

    rval = pkcs_init();

#else

    rval = SNMPERR_SC_NOT_CONFIGURED;

#endif                           /* NETSNMP_USE_INTERNAL_MD5 */

    /*

     * XXX ogud: The only reason to do anything here with openssl is to 

     * * XXX ogud: seed random number generator 

     */

#endif                          /* ifndef NETSNMP_USE_OPENSSL */

    return rval;

}                               /* end sc_init() */

/*******************************************************************-o-******

 * sc_random

 *

 * Parameters:

 *	*buf		Pre-allocated buffer.

 *	*buflen 	Size of buffer.

 *      

 * Returns:

 *	SNMPERR_SUCCESS			Success.

 */

int

sc_random(u_char * buf, size_t * buflen)

#if defined(NETSNMP_USE_INTERNAL_MD5) || defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_PKCS11) || defined(NETSNMP_USE_INTERNAL_CRYPTO)

{

    int             rval = SNMPERR_SUCCESS;

#if !defined(NETSNMP_USE_OPENSSL) && !defined(NETSNMP_USE_PKCS11)

    int             i;

    int             rndval;

    u_char         *ucp = buf;

#endif

    DEBUGTRACE;

#ifdef NETSNMP_USE_OPENSSL

    RAND_bytes(buf, *buflen);   /* will never fail */

#elif NETSNMP_USE_PKCS11			/* NETSNMP_USE_PKCS11 */

    pkcs_random(buf, *buflen);

#else                           /* NETSNMP_USE_INTERNAL_MD5 */

    /*

     * fill the buffer with random integers.  Note that random()

     * is defined in config.h and may not be truly the random()

     * system call if something better existed 

     */

    rval = *buflen - *buflen % sizeof(rndval);

    for (i = 0; i < rval; i += sizeof(rndval)) {

        rndval = netsnmp_random();

        memcpy(ucp, &rndval, sizeof(rndval));

        ucp += sizeof(rndval);

    }

    rndval = netsnmp_random();

    memcpy(ucp, &rndval, *buflen % sizeof(rndval));

    rval = SNMPERR_SUCCESS;

#endif                          /* NETSNMP_USE_OPENSSL */

    return rval;

}                               /* end sc_random() */

#else

_SCAPI_NOT_CONFIGURED

#endif                          /*  */

#ifdef NETSNMP_USE_OPENSSL

const EVP_MD   *

sc_get_openssl_hashfn(int auth_type)

{

    const EVP_MD   *hashfn = NULL;

    DEBUGTRACE;

    switch (auth_type) {

#ifndef NETSNMP_DISABLE_MD5

        case NETSNMP_USMAUTH_HMACMD5:

            hashfn = (const EVP_MD *) EVP_md5();

            break;

#endif

        case NETSNMP_USMAUTH_HMACSHA1:

            hashfn = (const EVP_MD *) EVP_sha1();

            break;

#ifdef HAVE_EVP_SHA224

        case NETSNMP_USMAUTH_HMAC128SHA224:

            hashfn = (const EVP_MD *) EVP_sha224();

            break;

        case NETSNMP_USMAUTH_HMAC192SHA256:

            hashfn = (const EVP_MD *) EVP_sha256();

            break;

#endif /* HAVE_EVP_SHA224 */

#ifdef HAVE_EVP_SHA384

        case NETSNMP_USMAUTH_HMAC256SHA384:

            hashfn = (const EVP_MD *) EVP_sha384();

            break;

        case NETSNMP_USMAUTH_HMAC384SHA512:

            hashfn = (const EVP_MD *) EVP_sha512();

            break;

#endif /* HAVE_EVP_SHA384 */

    }

    return hashfn;

}

const EVP_CIPHER *

sc_get_openssl_privfn(int priv_type)

{

    const EVP_CIPHER *fn = NULL;

    DEBUGTRACE;

    switch(priv_type & (USM_PRIV_MASK_ALG | USM_PRIV_MASK_VARIANT)) {

#ifdef HAVE_AES

        case USM_CREATE_USER_PRIV_AES:

            fn = (const EVP_CIPHER *)EVP_aes_128_cfb();

            break;

#ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04

        case USM_CREATE_USER_PRIV_AES192:

            fn = (const void*)EVP_aes_192_cfb();

            break;

        case USM_CREATE_USER_PRIV_AES256:

            fn = (const void*)EVP_aes_256_cfb();

            break;

#endif

#endif /* HAVE_AES */

    }

    return fn;

}

#endif /* openssl */

/*******************************************************************-o-******

 * sc_generate_keyed_hash

 *

 * Parameters:

 *	 authtype	Type of authentication transform.

 *	 authtypelen

 *	*key		Pointer to key (Kul) to use in keyed hash.

 *	 keylen		Length of key in bytes.

 *	*message	Pointer to the message to hash.

 *	 msglen		Length of the message.

 *	*MAC		Will be returned with allocated bytes containg hash.

 *	*maclen		Length of the hash buffer in bytes; also indicates

 *				whether the MAC should be truncated.

 *      

 * Returns:

 *	SNMPERR_SUCCESS			Success.

 *	SNMPERR_GENERR			All errs

 *

 *

 * A hash of the first msglen bytes of message using a keyed hash defined

 * by authtype is created and stored in MAC.  MAC is ASSUMED to be a buffer

 * of at least maclen bytes.  If the length of the hash is greater than

 * maclen, it is truncated to fit the buffer.  If the length of the hash is

 * less than maclen, maclen set to the number of hash bytes generated.

 *

 * ASSUMED that the number of hash bits is a multiple of 8.

 */

int

sc_generate_keyed_hash(const oid * authtypeOID, size_t authtypeOIDlen,

                       const u_char * key, u_int keylen,

                       const u_char * message, u_int msglen,

                       u_char * MAC, size_t * maclen)

#if  defined(NETSNMP_USE_INTERNAL_MD5) || defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_PKCS11) || defined(NETSNMP_USE_INTERNAL_CRYPTO)

{

    int             rval = SNMPERR_SUCCESS, auth_type;

    int             iproperlength;

    size_t          properlength;

    u_char          buf[SNMP_MAXBUF_SMALL];

#if  defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_PKCS11)

    unsigned int    buf_len = sizeof(buf);

#endif

#ifdef NETSNMP_USE_OPENSSL

    const EVP_MD   *hashfn;

#elif defined(NETSNMP_USE_PKCS11)

    u_long          ck_type;

#endif

    DEBUGTRACE;

#ifdef NETSNMP_ENABLE_TESTING_CODE

    {

        int             i;

        DEBUGMSG(("sc_generate_keyed_hash",

                  "sc_generate_keyed_hash(): key=0x"));

        for (i = 0; i < keylen; i++)

            DEBUGMSG(("sc_generate_keyed_hash", "%02x", key[i] & 0xff));

        DEBUGMSG(("sc_generate_keyed_hash", " (%d)\n", keylen));

    }

#endif                          /* NETSNMP_ENABLE_TESTING_CODE */

    /*

     * Sanity check.

     */

    if (!authtypeOID || !key || !message || !MAC || !maclen

        || (keylen <= 0) || (msglen <= 0) || (*maclen <= 0)) {

        QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);

    }

    auth_type = sc_get_authtype(authtypeOID, authtypeOIDlen);

    iproperlength = sc_get_auth_maclen(auth_type);

    if (iproperlength == SNMPERR_GENERR)

        return SNMPERR_GENERR;

    properlength = (size_t)iproperlength;

    if (keylen < properlength) {

        QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);

    }

#ifdef NETSNMP_ENABLE_TESTING_CODE

    DEBUGMSGTL(("scapi", "iproperlength: %d, maclen:%" NETSNMP_PRIz "d\n", iproperlength,

                *maclen));

#endif

#ifdef NETSNMP_USE_OPENSSL

    /** get hash function */

    hashfn = sc_get_openssl_hashfn(auth_type);

    if (NULL == hashfn) {

        QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);

    }

    HMAC(hashfn, key, keylen, message, msglen, buf, &buf_len);

    if (buf_len != properlength) {

        QUITFUN(rval, sc_generate_keyed_hash_quit);

    }

    if (*maclen > buf_len)

        *maclen = buf_len;

    memcpy(MAC, buf, *maclen);

#elif NETSNMP_USE_PKCS11                    /* NETSNMP_USE_PKCS11 */

#ifndef NETSNMP_DISABLE_MD5

    if (NETSNMP_USMAUTH_HMACMD5 == auth_type) {

	if (pkcs_sign(CKM_MD5_HMAC,key, keylen, message,

			msglen, buf, &buf_len) != SNMPERR_SUCCESS) {

            QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);

        }

    } else

#endif

        if (NETSNMP_USMAUTH_HMACSHA1 == auth_type) {

	if (pkcs_sign(CKM_SHA_1_HMAC,key, keylen, message,

			msglen, buf, &buf_len) != SNMPERR_SUCCESS) {

            QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);

        }

    } else {

        QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);

    }

    if (buf_len != properlength) {

        QUITFUN(rval, sc_generate_keyed_hash_quit);

    }

    if (*maclen > buf_len)

        *maclen = buf_len;

    memcpy(MAC, buf, *maclen);

#elif NETSNMP_USE_INTERNAL_CRYPTO

    if (*maclen > properlength)

        *maclen = properlength;

#ifndef NETSNMP_DISABLE_MD5

    if (NETSNMP_USMAUTH_HMACMD5 == auth_type)

        rval = MD5_hmac(message, msglen, MAC, *maclen, key, keylen);

    else

#endif

         if (NETSNMP_USMAUTH_HMACSHA1 == auth_type)

        rval = SHA1_hmac(message, msglen, MAC, *maclen, key, keylen);

    else {

        QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);

    }

    if (rval != 0) {

        rval = SNMPERR_GENERR;

        goto sc_generate_keyed_hash_quit;

    }    

#else                            /* NETSNMP_USE_INTERNAL_MD5 */

    if (*maclen > properlength)

        *maclen = properlength;

    if (MDsign(message, msglen, MAC, *maclen, key, keylen)) {

        rval = SNMPERR_GENERR;

        goto sc_generate_keyed_hash_quit;

    }

#endif                          /* NETSNMP_USE_OPENSSL */

#ifdef NETSNMP_ENABLE_TESTING_CODE

    {

        char           *s;

        int             len = binary_to_hex(MAC, *maclen, &s);

        DEBUGMSGTL(("scapi", "Full v3 message hash: %s\n", s));

        SNMP_ZERO(s, len);

        SNMP_FREE(s);

    }

#endif                          /* NETSNMP_ENABLE_TESTING_CODE */

  sc_generate_keyed_hash_quit:

    memset(buf, 0, SNMP_MAXBUF_SMALL);

    return rval;

}                               /* end sc_generate_keyed_hash() */

#else

                _SCAPI_NOT_CONFIGURED

#endif                          /* */

/*******************************************************************-o-******

 * sc_hash(): a generic wrapper around whatever hashing package we are using.

 * 

 * IN:

 * hashtype    - oid pointer to a hash type

 * hashtypelen - length of oid pointer

 * buf         - u_char buffer to be hashed

 * buf_len     - integer length of buf data

 * MAC_len     - length of the passed MAC buffer size.

 * 

 * OUT:    

 * MAC         - pre-malloced space to store hash output.

 * MAC_len     - length of MAC output to the MAC buffer.

 * 

 * Returns:

 * SNMPERR_SUCCESS              Success.

 * SNMP_SC_GENERAL_FAILURE      Any error.

 * SNMPERR_SC_NOT_CONFIGURED    Hash type not supported.

 */

int

sc_hash(const oid * hashtype, size_t hashtypelen, const u_char * buf,